Create a span context manager. Usage: with tracer.span("operation", {"key": "value"}): do_work()

Handle a system call from user space. All agent actions MUST go through this interface. The kernel enforces policy, logs the attempt

Convert episode to dictionary format.

Transition the saga to a new state.

Verify an envelope's signature and replay metadata. Args: envelope: Signed message envelope to validate. Returns:

Build a duck-typed policy object matching what the provider reads.

Create a registry pre-populated with the given identities.

Create a mock tool.

Create a mock LangChain ToolCallRequest.

Create a mock GitHub user dict.

Check if file should be scanned based on exclusion patterns.

Resolve and validate *raw* database path. Accepts only: - the special literal ``:memory:`` - ``file://`` URIs whose path resolves inside

Track *nonce* until *expires_at*.

Evaluate whether an agent may perform an action. Checks are applied in order: blocked list, agent status, trust threshold, then capab

Compute drift between *output_data* and the baseline stored in *ctx*. On the first call the output is recorded as the baseline and ``None``

Compute hash of this link.

Create an enhanced agent control plane. This is the recommended way to create a control plane instance. Args: health_ch

Create a new saga for a session.

* Construct a leaf detail item.

Generate a polymorphic response from agent output. Args: data: The response data from the agent inpu

Return the current session lifecycle state.

Get tier from score.

Handle an MCP tool call.

Ingest a metric data point and check for anomalies. Returns an ``AnomalyAlert`` if an anomaly is detected, ``None`` otherwise.

Load persisted records from disk. Idempotent.

Append an entry to the audit chain.

Create a narrower scope for sub-delegation. If trust_ceiling is provided in overrides, it is clamped to not exceed the parent's ceili

Called before a tool is invoked. Governance actions performed: 1. **Tool allow/block** — checks the tool name against ``_

Mock business logic — no LLM, deterministic canned responses.

Process an Agent Mesh event and return a Signal if relevant.

Record a causal episode. Inserts the episode row and any causal edges (caused_by → this, this → each effect). Returns the e

Feed an observed action into all analyzers.

Declare the set of tools an agent is expected to use.

Register a named health check function (thread-safe).

Render a polymorphic response as a UI component. Args: response: The polymorphic response from the agent

Render all metrics in Prometheus text exposition format.

Resolve effective authority for an agent action. Args: request: Complete context including delegation chain, trus

Respond to a trust handshake challenge with an Ed25519 signature. The response payload is signed with the agent's Ed25519 private key.

Scan tool output and return a structured safety result. Args: response_content: Raw tool output to inspect. tool_name

Search for similar vectors. Override with actual vector search implementation.

Execute one step in the environment. Args: action: Agent's action Returns: Tuple of (next_state, re

Verify a cross-org token. Returns ExternalIdentity on success.

Wrap an OpenAI Agent with a governance proxy. .. deprecated:: Use :meth:`as_hooks` instead. The ``wrap()`` approach creates

Serialise *entry* to JSONL and write it to the output stream. The output stream is flushed immediately after the write so that contai

Activate marks the given scope blocked and records the event in registry history.

NewClient creates a fully initialised AgentMeshClient.

Build a valid (signed) ``connect`` frame for *label*.

Parse a Kubernetes API request into policy-evaluable fields. Reads k8s_ctx["method"] and k8s_ctx["path"] and returns verb, resource, namespac

Handle a policy violation from the kernel. When an active ``step()`` has bound its per-rollout violation list to the current asyncio

Create an agent identity with a unique name.

Create a GovernedRollout for testing.

Print with optional rich styling; falls back to plain print.

Create, record, and surface a PolicyViolationError. Appends the error to the violations list and calls on_violation. Args:

Return sanitized error for callers and log detailed reason.

Register a sink. Returns self for chaining.

Create a ``GovernanceCapability`` for PydanticAI's native hook system. Returns a capability that can be passed to the ``Agent`` constructor's

Tool-level governance gate. Raises: PolicyViolationError: If the tool call is blocked by policy.

Create a new task request.

Snapshot current state. This is **not** a ``copy.deepcopy`` — it's a one-level copy that relies on the value types being either immut

Remove the episode with the given ID.

Evaluate all multi-agent policies for a proposed action. This is the main entry point, called before an action is executed to check w

Evaluate an agent against a certification tier. Args: tier: The certification tier to evaluate against. evidence: Dic

Return a colorized error string with an optional suggestion and docs link.

Load a policy from a YAML string. Validates the ``apiVersion`` field against supported versions and emits deprecation warnings for ol