RFC 8785-style canonical JSON (signature excluded).

Deterministic JSON payload used for hashing. Excludes ``content_hash`` and ``signature`` so they can be recomputed during verificatio

Read execution-environment variables once and return an immutable snapshot. Resolution rules: * ``sandbox_id``: prefers ``OPENSHELL_SANDBOX_I

Convert chart to searchable text.

Raise a helpful error when the ``google-adk`` package is missing.

Check if alerts should be triggered.

Check for medication-allergy interactions.

Check if a cost is anomalous using Z-score. Caller must hold ``self._lock``.

Raise a helpful error when the ``anthropic`` package is missing.

Built-in check stub for the audit backend.

Check if backpressure should be applied for a topic. Args: topic: The topic to check Return

Detect templated repo creation: many repos with same suffix in a short window.

Check whether a tool call would exceed the configured cost budget. Args: cost: Cost units to add for this call (default 1.0).

Check whether a tool call would exceed the configured cost budget. Args: cost: Cost units to add for this call (default 1.0).

Flag calls to dangerous builtins / functions.

Check if context has required capabilities.

Check collection access using Cedar policy engine. Uses CedarBackend from agent-os for policy evaluation. When neither cedarpy nor Ce

Detect circular dependencies via DFS.

Check if a draft claim conflicts with a lab report

Check transaction history for inconsistencies.

Check if an action violates a specific control.

Check if a single control's component is importable.

Verify consistency across delegation boundaries. For each delegation link, checks that the delegator's delegation span output is cons

Detect prompt injection patterns in tool descriptions.

Check if any agent needs escalation to human

EU AI Act checks: transparency, risk classification, human oversight.

Return True if the agent is triggering escalations too rapidly. When fatigue detection is enabled, auto-DENY prevents an agent from o

Detect credibility-farming fork bursts (e.g., forking awesome lists). Forks that have at least one outgoing PR to their parent repo are exclu

Raise a helpful error when the ``google-generativeai`` package is missing.

Detect hidden instructions in tool descriptions.

HIPAA checks: PHI protection, access logging, minimum necessary.

Flag imports from the dangerous-imports set.

Raise a helpful error when the ``mistralai`` package is missing.

Check if agent has permission for the requested action

Check if action is allowed under policies. Args: action: The action being attempted (e.g., "database_query", "file_write")

Built-in check that validates the policy engine can create a policy.

Detect privilege escalation and code-execution wording in descriptions.

Prevent rapid command spam.

Enforce ring-level resource constraints and inject ring context. Returns a denial PolicyDecision when the agent's ring forbids the re

Check tool input schemas for suspicious patterns.

Detect issues that promote the author's own repos across other orgs.

Detect ``subprocess`` calls with ``shell=True``.

Raise a helpful error when the ``smolagents`` package is missing.

SOC2 checks: access control, audit logging, change management.

Check whether the kernel has exceeded its configured timeout. Returns: Tuple of (within_limit: bool, reason: str).

Enforce tool allow/block-list and call-count limit.

Check a single tool call against the control plane. Args: tool_call: Dictionary with 'name', 'args', and optiona

Check if trust level is sufficient.

Return (rule, message) when ``version`` is non-pinned, else None. Distinguishes three failure modes so operators can triage: * ``non-semver

Classify prompt into action type and parameters

Classify AI risk level per EU AI Act.

Map composite score and action to severity level.

Remove hibernated agent and delete its state file

Remove data older than retention period.

Release bonds, purge VFS data, and archive session.

Clear all events. **Test-only — do not call in production.** The event bus is wired into the hypervisor as a long-lived, process-sing

Clear instance-level fallback state. ``step()`` no longer uses the instance lists; this exists for callers that drive ``_handle_viola

Compare two policy files structurally.

Run test scenarios against a policy.

Validate a policy file against the PolicyDocument Pydantic schema.

CMVK (Verification Kernel) dashboard for ML Ops.

Pull bridge-relevant fields out of the literal-decoded kwargs. Anything we cannot literal-decode is silently treated as the field's default;

Read audit entries from JSONL log file.

Load compliance reports from JSON files.

Last-writer-wins union of intervention_points across documents. AGT-RESOLUTION does not introduce custom merge logic for intervention point b

Walk a nested structure and return the set of placeholder names found.

Scan policies directory for YAML policy files.

Load SLO/SLI metrics from JSON file.