Return a stable SHA-256 digest for JSON-like values.

Return the handle name bound to `actionClass`, or undefined.

Return the handle name bound to ``action_class``, or None.

Check if an owned capability matches a required capability. Supports: - Exact match: "workflow:execute" matches "workflow:execute" -

Score breakdown by category.

cedarDecisionFromCLIOutput inspects `cedar authorize` stdout and returns (allowed, true) when the first non-empty line is an unambiguous "ALLOW" or "D

Return current rate-limit status without consuming a token.

Return True if request is allowed.

Check content against policies.

Check if user has access to resource. Returns: (allowed, reason)

Check all active agents and rotate expiring credentials. Returns list of rotation results: [{"agent_id": "...", "action": "rotated|ex

Scan tool arguments for blocked content patterns.

Perform the health check asynchronously. Default implementation runs sync check in executor. Override for true async checks.

Check an action for compliance violations. Evaluates the action against all mapped controls for the given action type and records any

Check if an agent's code has changed

Return True if the file has the correct license header.

Check if matter has conflict with existing matters.

Check a single package for known vulnerabilities via OSV.dev. Args: name: Package name (e.g., "@modelcontextprotocol/sdk").

Public Preview: only ALL_MUST_SUCCEED is enforced.

Readiness probe — same as full health check.

Detect regex patterns susceptible to catastrophic backtracking.

Check if version is present in a file

Clamp a zoom level to the allowed range.

Classify a PolicyDecision into allow / escalate / deny.

Classify a PolicyDecision into allow / escalate / deny.

Remove expired entries. Returns count of removed entries.

Clear all agents from inventory.

Clear all entries.

Remove all registered adapters (useful for testing).

* Clear all logs

Delete measurements. If *name* is None, clear everything.

Delete measurements (thread-safe). Pass *name* to delete one SLI only.

Clear the verification cache. Subsequent calls to :meth:`is_verified` will re-verify signatures from scratch.

Remove items labelled *hot*.

Release HTTP client resources.

Output Prometheus metrics for Agent OS.

Generate an Ed25519 signing keypair.

Return synthetic evidence with a deterministic ADR 0010 binding.

Collect current values for all SLIs of an agent.

Fraction of measurements at or below the target (lower is better).

Fraction of recorded aggregate deltas at or below *target_delta*. A measurement is *good* when the running calibration gap (the recorded

Convenience function to compose tools. Example: >>> pipeline = compose(parse, process, format, name="my_pipeline") >>> result = p

computeRiskScore calculates a 0-100 risk score from threat severity.

Compute SHA-256 entry hash chained to *previous_hash*.

Return the source line of a key inside a condition. *branch* is either ``"condition"`` or ``"conditions"``. *cond_idx* is the positio

Get the cache configuration.

Configure a TracerProvider that prints spans to stdout. Intended for local development and debugging. Args: service_name: Service na

Establish connection (no-op for memory).

Check if the given datetime falls within this blackout window.

Return whether a string contains any PII/CRI pattern. Args: value: String content to inspect. Returns: ``Tru

Simulate a sudden cost spike on a tool or provider.

Count entries matching a severity level.

* Create annotations from analysis result