Acquire a lock (Public Preview: always succeeds).

Attempt to acquire a rate limit slot. Args: blocking: If True, wait until a slot is available. timeout: Maximum time

Mark escrow as active (task in progress).

ADK after_tool_callback — called after each tool execution. Inspects tool output for blocked patterns and routes through the

Clear entries from the DLQ. Args: topic: Optional topic filter (clears all if None) Returns

Create an escrow for a task. Args: provider_did: DID of the agent providing the service task_hash: S

Map an anomaly score to a severity level.

Evaluate all trust rules against the context. Rules across all loaded policies are sorted by priority (lower number = higher priority

Run a function with import hooks and (optionally) sys.modules shadowing. Args: func: The function to execute. *args:

Execute a task by selecting and running the best agent. Args: task: Description of the task task_met

Run *action* through the full governance pipeline. Steps: 1. Evaluate loaded policies. 2. Log the event to the audit

Return all PII/CRI-like matches found in a string. Unlike :meth:`find_matches`, these patterns detect personally identifiable informa

Derive ring level from effective reputation score.

* Map a verdict to a host gate outcome. Returns `undefined` to allow (also * for `warn`, which is non-blocking). Effects are applied separately by

Generate a fresh Fernet encryption key (URL-safe base64, 32 bytes). Falls back to :func:`os.urandom` if ``cryptography`` is unavailable

Get value by key.

Get the agent's audit log. Returns: List of audit entries as dictionaries

Get the numeric trust score (0-1000) for an agent.

Return the tier name for a given trust score. Args: score: Integer trust score in the range 0-1000. Returns: Tier name (e.g.

Initiate a secure data transfer through DMZ. Args: sender_did: DID of sending agent receiver_did: DI

Check whether a previously verified peer meets the trust threshold.

Return True if this policy is more restrictive than other. Stricter means: lower limits, higher thresholds, more blocked patterns, fe

Check if a tool is allowed by policy. Supports wildcard patterns.

Load a dataset from a JSON file.

Create a flight recorder log with valid hash.

Promote a successful trace to a golden reference. Args: trace: The captured Trace to use as golden reference. name: H

Process a message and optionally produce output.

Record a policy check result. Args: adapter: Adapter name (e.g. ``"langchain"``). latency_ms: Time taken for the chec

Register an AI Card in the catalog. Args: card: The AI Card to register. verify: Whether to verify the card signature

Generate a tracing report with all protocol spans and timeline.

Run the CLI with the given arguments and return the exit code.

Run MCPSecurityScanner over already-known tool definitions.

Score a Langfuse trace with SLO health data. Creates multiple scores per SLO: - `slo.<name>.status`: Overall status (0=healthy, 1=war

Slash an agent's reputation for misbehavior. When triggered, broadcasts to the network so all agents immediately blo

Frame data events into an SSE byte stream the way a proxy emits them.

Start a new span, automatically parented to the current span.

Start a new trace for an agent action. Creates a pending audit log entry and links it into the Merkle hash chain for tamper detection

Store or update a trust score for an agent. Args: agent_did: DID of the agent. score: Trust score data (arbitrary dic

Transition to a new state, enforcing valid transitions.

Walk every assessment and verify hash linkage. Returns ``(True, None)`` when the chain is intact, or ``(False, description)`` on the

Activate is a convenience method to move to the active state.

AddEvidence appends evidence and updates the aggregate confidence and timestamps. Confidence is combined using a noisy-OR formula: combined = 1 - (

LoadFromYAML replaces the engine's rule set with the rules from a YAML file. Existing rules are discarded on success; on parse or I/O error the previo

NewLifecycleManager creates a manager starting in the provisioning state.

Return an approval_resolver that always approves and records the IP.

Check whether *path* is a system directory that must not be mounted.

Create a mock LLMCallHookContext.

Simulate on_chain_start → on_chain_end (or on_chain_error).

Activate a provisioned agent and issue initial credentials.

Add an entry and update the Merkle tree incrementally.

Add an alerting rule. Args: name: Rule name condition: Function that evaluates alert condition

* Analyze a set of policies for surface parity gaps.

Create a governance filter for Semantic Kernel's native filter system. Returns a ``GovernanceFunctionFilter`` that can be registered with::

Pre-run hook: scan prompt for governance violations. Routes the prompt through the AGT 5.0 ACS engine at the ``input`` intervention p

Calculate delay before the given attempt. Args: attempt: The attempt number (1-indexed). Returns: Delay in s

RFC 8785 JCS canonical JSON; signature fields excluded (they cover this payload).

Return ``True`` if the agent is within its limit, ``False`` if exceeded. Records the current call timestamp regardless of the outcome so that

Check for behavioral drift. Returns a pass-through result when no verifier is configured.

Run health check if configured. Returns: HealthCheckResult or None if no health check configured.

Classify the semantic intent of a tool call using keyword matching.

Clear all offline storage.

Compute per-tool fingerprints over descriptions and input schemas.

Minimal mock Memento for workspace state.

Providers that return fixed data.

Helper: Create a text signal from a string.

Create a (NexusClient, private_key_bytes) pair with a real Ed25519 keypair.

Extract sandbox-relevant fields from a policy into a config. Reads well-known policy attributes when present and merges them into *base*. Un

Emit a centralized skill-aware governance audit payload. Emission happens in governance middleware/hooks (outside skill loading or ex

Evaluate content scores against configured rules.

Extract context from a document with structure-aware boosting and time-based decay. Now with Context scoring support: