Main resolution loop.

* Internal: resolve a credential value and emit an audit event. * Returns `[value, event]`; on deny `value` is null. * * Callers must ensure

Find the first matching rule (highest priority) and return its action.

Recursively resolve and install plugin dependencies. Args: manifest: The manifest whose dependencies should be resolved.

Recursively resolve and install plugin dependencies. Args: manifest: The manifest whose dependencies should be resolved.

Mark escrow as disputed - to be resolved by Arbiter.

Resolve a dispute.

Resolve a dot-notated field path against a context dict.

Resolve a credential value and emit an audit event. Returns ``(value_or_None, audit_event)``. On deny, the value is None. Callers mus

Resolve agent_id to a sanitized AVP agent name. Output is URL-encoded to prevent path injection when interpolated into API URLs.

Resolve escrow as success.

Resolve escrow as success - credits to provider.

Find the upstream URL for a given request path.

Resolve the view function for the current request, if possible.

Calculate drift between two responses. For numeric responses: normalized absolute difference For string responses: L

Restore ``sys.modules`` entries replaced by :meth:`_shadow_sys_modules`. Only the outermost paired call across the whole process actually

Review a single file.

Return revocation URL, preferring a verified claim override. Override is taken only from the already-signature-verified payload. Even

Run rollback actions in reverse order for completed steps.

Run all 9 governance scenarios.

Run the optional advisory check (defense-in-depth).

Run a single scenario.

Run all validators against a value.

Run ``command`` in a thread with a timeout. On timeout, attempt to kill only the offending exec process by looking up its PID via the

Fallback path when the low-level API isn't available. Mirrors the prior watchdog behaviour: run ``container.exec_run`` in a thread, `

Recursively evaluate an AST node using only safe operations. No eval()/compile() — walks the AST tree and computes results us

Detailed safety metrics dashboard.

Return a copy of *code* with dangerous lines commented out.

Classify an error into a safe, fixed message. Never expose URLs or headers.

Map an A2A DID to a string that satisfies the v4 :class:`ExecutionContext.agent_id` regex (``^[a-zA-Z0-9_-]+$``). DIDs use colons (e.g. ``did

Replace ${{ ... }} GitHub Actions expressions with shellcheck-safe placeholders.

Sanitize output to remove sensitive data.

Sanitize response to fix policy violations.

Return a minimal process environment for launched MCP servers. MCP configs may come from repositories or pull requests. The scanner must laun

Save design proposals to file.

Save behavior patterns to storage.

Save the model upgrade log to disk. Persists the current upgrade history and model information.

Scan chunks and return (clean_docs, num_blocked).

Scan a single repository for agent indicators. Uses the Git Tree API to fetch the full file tree in a single request, then checks loc

Return scanner-visible text from schema descriptions and property names.

Generate deterministic digest for replay-window tracking.

Return hex color on red-yellow-green gradient for 0-1000.

Populate the store with sample agents for standalone use.

Send message via protocol handler.

Send a single event to a single webhook endpoint with retries.

Send initial data snapshot to a newly connected client.

Send event to Datadog API via urllib.

Send feedback to LangSmith API via urllib.

Send heartbeats to followers

Send metric to Datadog API via urllib.

Send run creation to LangSmith API via urllib.

Send run update to LangSmith API via urllib.

Send events to Application Insights as custom events.

Send events to Azure Event Hub. Returns: Tuple of (success_count, failed_events).

Serve health check.

Serve Prometheus metrics.

Serve readiness check.

Apply security headers to all HTTP responses.

Write the wrapped callable back into the graph's node registry. For LangGraph 1.x ``StateNodeSpec``, mutate ``node_spec.runnable.func``

Navigate storage to set value at path.