Write YAML to ``path`` atomically via tempfile + ``os.replace``. A torn write or crash leaves either the previous file intact or no file, nev

Log tool call to audit trail.

Log PHI access to audit chain.

Attempt to reconnect with exponential back-off.

Decode base64url string without padding per RFC 7515.

Encode bytes as base64url without padding per RFC 7515.

Stable identifier for a finding used by the baseline file. Format: ``<relative-source-path>\t<target>``. Line numbers are intentionally exclu

Build request headers with trust metadata.

Build the evaluation prompt.

Build a Cedar authorization request from the AGT context dict. Converts AGT's ``tool_name`` (snake_case) → Cedar ``action`` (PascalCa

Calculate aggregated compliance statistics.

Calculate initial trust score for a new agent. New agents start with a score of 500/1000 with balanced dimensions.

Calculate score trend.

Serialize JSON deterministically for signing and verification.

Stable hash of the card's signable content + signature. Used as a cache key suffix so any mutation of the signed fields or the signat

Split history into successful (positive delta) and failed (negative delta) task lists.

Return the ATR category for a single rule dict.

Simulate Cedar's `default deny; forbid overrides permit` semantics against the specific shape compile.py emits. Supports: * permit / fo

Check if a Cedar statement's resource constraint matches.

Approved change request must exist.

Host-side fallback content scan (kept for callers that still invoke this method directly). The primary content gate runs through the A

Check nesting depth recursively.

Block on pattern matches and PII in input.

Check JavaScript code block for dangerous patterns.

Check collection against allow/deny lists.

Caller must hold ``self._lock``. Pure check; no mutation.

Check if the agent has permission for an action.

Verify the call is allowed by trust policy.

Check if syscall is allowed by policy. Returns: Tuple of (allowed, error_message). If allowed is True, error_mes

Check shell code block for dangerous patterns.

Check input size.

Check whether the kernel has exceeded its configured timeout. Returns: Tuple of (within_limit: bool, reason: str).

Check whether a tool is permitted by the active ADK policy. Args: tool_name: Name of the ADK tool to check. Returns:

Check whether a tool is permitted by the active policy. Args: tool_name: Name of the tool to check. Returns:

Close a server instance and run cleanup callback.

Pre-compile regex and glob patterns for performance.

Pre-compile regex and glob patterns for performance.

Complete an in-flight step span.

Compute checksum for audit entry integrity.

Return the sleep duration before the next retry attempt. Without jitter, returns the classic exponential ``backoff_base * 2^(n-1)``. With ji

Compute a SHA-256 content hash of a callable's source code. Returns an empty string if source is unavailable (e.g. built-in or C-exte

Compute SHA-256 hash for an entry.

Compute SHA-256 hash for a chain entry.

HMAC-SHA256 hex digest of ``content_hash`` using *secret_key*.

Atomically reserve one call slot from the agent's rate-limit budget. Returns False if the bucket is at or above ``max_tool_calls`` — callers

Recursively detect any approval-flag key in ``value``.

Tools declare a content_hash; the policy denies the call when the runtime-supplied hash differs from the manifest catalog entry. This defends

Convert a Flight Recorder entry to a Lightning span.

Decode the payload section of a JWT without signature verification.

Decrypt with ChaCha20-Poly1305.

Build a non-persisted default record for an unknown DID.

Actually deliver a signal to its handler.

Convert a ``DetectionResult`` dataclass to a Pydantic response.

Discover server DID from /.well-known/agent.json

Tools tagged with security_labels are treated as the allowlist; a host that knows nothing about a destination URL denies it.

Emit telemetry event to the stream.

Ensure a directory exists in the file system.

Create a session if one doesn't exist.

Remaining error budget above threshold.

Production-targeted deploys escalate to human approval per D5; the engine returns escalate and the host's approval resolver handles it from th

Evaluate a single Rego condition line.