Validate a credit card number using the Luhn algorithm. Args: card_number: String of digits (spaces/dashes already removed) Ret

Adapt an AGT :class:`ApprovalCallback` to the ACS approval resolver shape. Returns ``None`` when ``callback`` is ``None`` so the underlying A

Return the ``after_llm_call`` governance function. Returns ------- callable A function that scans LLM output for

Return the ``after_tool_call`` governance function. Returns ------- callable A function that checks tool output f

Return the ``before_llm_call`` governance function. Returns ------- callable A function that scans LLM input mess

Create a function that raises SecurityError when called.

Generate a stable dedup key for PagerDuty.

Build a Gemini-shaped response containing a single function call.

Create a unique key from labels

Return a governed wrapper preserving sync/async semantics.

Create an in-memory LoggerProvider for testing.

Create a registry pre-populated with identities.

Map an OpenAI tool name to an ActionType. This uses both the provided mapping and pattern matching to handle various

Mask sensitive data for logging.

Check if a config subscribes to the given event type.

Check if a proposed action matches the condition filters.

Check if metadata matches filters

Write a generated Rego file to disk and return the bundle path. The generated rule package is ``agt.legacy`` and exposes a single ``verdict``

Send alert if status changed meaningfully.

Flush if batch size reached or interval exceeded.

Resolve a v4 governance chain rooted at *chain_root* into v5. On --write the function: - calls :func:`resolve_manifest` to produce a flat AC

Materialise a v5 manifest for a single GovernancePolicy() call.

Minimal YAML parser for SLO template format. Handles: top-level keys, nested dicts, list-of-dicts, multiline strings.

Create directory and all parent directories (like mkdir -p).

Check if a tool call requires human approval.

Check if a tool call requires human approval.

Map the upstream ``RunResult`` (or anything duck-compatible) into our :class:`SandboxResult`. Handles missing/None attributes gracefu

Normalize supported JSON types for deterministic canonical encoding. This example intentionally limits values to JCS-friendly primitives: dic

Return *text* normalised so common Unicode obfuscation doesn't bypass the regex patterns. The patterns in this module are ASCII-shaped, but t

Normalize CRLF to LF for consistent matching.

Map a PolicyDecision to a canonical verdict string. Fixtures can use "allow", "deny", "audit", or "block" as the expected_verdict. The evalua

Fire-and-forget webhook notification.

Calculate numerical drift by extracting and comparing numbers. Pure function - no side effects.

OpenAI / Azure OpenAI chat completion call.

OpenAI / Azure OpenAI chat completion call.

OpenAPI v3 schema for AgentRollout CRD.

Main Agent OS overview dashboard.

Parse bandit JSON output and create findings.

Extract Action::"X" identifiers from a permit/forbid head, or None for catch-all.

Parse command string to device state.

Parse, validate, and return CORS origins. Rejects ``*`` when credentials are enabled, and validates that each origin has a scheme and a non-e

Parse, validate, and return CORS origins. Rejects ``*`` when credentials are enabled, and validates that each origin has a scheme and a non-e

Parse, validate, and return CORS origins. Rejects ``*`` when credentials are enabled, and validates that each origin has a scheme and a non-e

Parse a dependency specifier like ``plugin-name>=1.0.0``. Returns: Tuple of (name, version_or_none).

Parse npm audit JSON output and create findings.

Parse pip-audit JSON output and create findings.

Parse execution result from container logs. Args: logs: Container logs output. Returns:

Parse security.md (Agent OS extension).

Parse a CRD spec dict into a RolloutSpec.

Parse JSON result from subprocess stdout.

Parse dbt timestamps with or without trailing Z / fractional seconds.

Parse a window string like '30d', '1h', '7d' into seconds.

Parse YAML content. Uses PyYAML if available, otherwise basic parser.

Normalise a v4 ``blocked_patterns`` entry to a Go RE2 regex string. v4 entries are either a bare string (substring match) or a ``(pattern, Pa

Check if peer has a required capability (supports wildcards).