Execute an HTTP request with trust headers.

Create a tracer with SimpleSpanProcessor so spans are exported immediately. Because ``trace.set_tracer_provider`` only works on the first call,

Create an Agent-Mesh TrustPolicy with N rules.

Create a minimal ComplianceViolation for testing.

Check whether a single PolicyCondition matches the context.

Rotate the file if it exceeds *max_file_size*.

Build an unsigned demo JWT carrying a ``role`` capability claim.

Dispatch a message to all subscribers for the given topic. Args: topic: Message topic. payload: Message data.

Parse agents.md file.

Parse a limit string like '100/hour'.

Parse LLM response into structured result.

Parse HH:MM string to a time object.

At least N peer reviews completed.

Return the *pct*-th percentile from a pre-sorted list.

A permissive policy that allows everything (for negative testing).

Write current state to the storage file (if configured).

Write current state to the storage file (if configured).

Evaluate a complete stream response before disclosure.

Build a host-friendly :class:`PolicyViolationError` for an SK surface. Surfaces the v4-style ``"<prefix>: <detail>"`` message that hosts match

Prepare kwargs for function call.

Print agent inventory as a rich table.

Print verification summary for a loaded manifest.

Generate a random election timeout

Record the evaluation as an audit event if a policy engine is set.

Caller must hold ``self._lock``. Recording + alerts only.

Record a compliance event.

Record evaluation metrics.

Policy: at the output intervention point, redact SSN-looking strings in response content via a transform verdict.

Recursively redact patterns in dictionary.

Refill tokens based on elapsed time.

Register a fresh agent and issue a challenge. Returns ``(private_key, public_key_b64, agent_did, challenge_id, nonce)`` ready for sig

Simulate the emitted Rego allow rule against a request. The emitted Rego is a fixed shape: allow { input.principal_role == "<role

Internal remove without lock.

Raise a clear ImportError when langgraph is not installed.

Return the dotted name of a call, e.g. ``os.system``.

Resolve agent_id to a validated AVP DID string.

Resolve escrow as failure.

Resolve escrow as failure - credits returned to requester.

Resolve 'ClassName.method' or 'function_name' from a module.

Resolve a simple ``$snap.x.y[0]`` path against the snapshot. Supports `$snap` / `$` roots and `.name` / `[n]` segments. Matches what the engi

Resolve a tool name to its ID, or return ID if already an ID

Full-jitter exponential backoff: random in [0, base * 2**attempt).

Full-jitter exponential backoff: random in [0, base * 2**attempt).

Rewrite a fail-closed AGT runtime-error deny into an ``allow``. Used to bridge v4 default-permit semantics that the AGT manifest brid

Convert risk to numeric level for comparison.

Best-effort recursive delete used by the dry-run path.

Round durations while preserving tiny positive measurements.

Run an async coroutine from sync context.

Run an awaitable to completion from a sync context. Timed calls use daemon worker threads capped by ``_TIMED_RUN_SYNC_MAX_WORKERS``. CPython

Best-effort sandbox teardown with ordered fallback. Tries ``close()``, ``shutdown()``, and ``__exit__()`` in order, stopping at the f

Extract a normalized hostname from a URL or bare host string. Uses urlparse's `.hostname` property so userinfo (`user@host`) and port

Serialize data to JSON string, truncating if too large.