threadlight-govern

Files (98)

• SKILL.md
• PROVENANCE.md · references/agt-inprocess/
• README.md · references/agt-inprocess/
• maf-middleware-snippet.py · references/agt-inprocess/references/
• default.yaml · references/agt-inprocess/references/policies/
• pii-deny.yaml · references/agt-inprocess/references/policies/
• __init__.py · references/agt-inprocess/references/python/
• capability_detector.py · references/agt-inprocess/references/python/
• contract_probe.py · references/agt-inprocess/references/python/
• live_t3_probe.py · references/agt-inprocess/references/python/
• upstream-pin.md · references/agt-inprocess/references/
• .gitignore · references/control-plane/
• Dockerfile · references/control-plane/
• README.md · references/control-plane/
• __init__.py · references/control-plane/
• app.py · references/control-plane/
• attestations.py · references/control-plane/
• auth.py · references/control-plane/
• bootstrap.py · references/control-plane/
• bootstrap_assets.py · references/control-plane/
• client.py · references/control-plane/
• confirmation.py · references/control-plane/
• confirmation_client.py · references/control-plane/
• confirmation_entra.py · references/control-plane/
• confirmation_outlook.py · references/control-plane/
• confirmation_user.py · references/control-plane/
• hosted_lifecycle.py · references/control-plane/
• models.py · references/control-plane/
• operator.py · references/control-plane/
• outlook.py · references/control-plane/
• probes.py · references/control-plane/
• pyproject.toml · references/control-plane/
• review.py · references/control-plane/
• storage.py · references/control-plane/
• app.py · references/fixtures/sample-bare/src/
• governance.yml · references/fixtures/sample-wired/.github/workflows/
• agt-verifier-report.md · references/fixtures/sample-wired/docs/
• policy-fixtures.yaml · references/fixtures/sample-wired/fixtures/
• policy.yaml · references/fixtures/sample-wired/
• app.py · references/fixtures/sample-wired/src/
• .gitignore · references/gateway/
• Dockerfile · references/gateway/
• Dockerfile.dockerignore · references/gateway/
• README.md · references/gateway/
• __init__.py · references/gateway/
• bootstrap_native.py · references/gateway/
• citadel.py · references/gateway/
• citadel_package.py · references/gateway/
• dispatcher.py · references/gateway/
• operations.py · references/gateway/
• probe_runtime.py · references/gateway/
• pyproject.toml · references/gateway/
• receipts.py · references/gateway/
• server.py · references/gateway/
• govern-manifest.schema.json · references/
• native-bundles.md · references/
• manifest.yaml · references/policy-templates/
• safe.rego · references/policy-templates/
• README.md · references/runtime/
• __init__.py · references/runtime/
• …and 38 more

SKILL.md (first lines)

# Threadlight Govern — policy into selected runtime enforcement

SAFE is the method; ACS/Rego through native OPA is the PDP. Agent Hooks is the
host/interceptor contract SDK; the native host/gateway is the PEP. AGT is the
toolkit, ASSERT is assurance. Evidence is per binding, **not whole-agent**.

## Produce, then assess

For an explicit [signed business-evidence requirement](../../docs/signed-evidence.md),
use the existing MCP PEP and named Evidence Provider contract. The agent requests
verification and carries the JWT; only the provider's admitted sources justify
claims. An upload/OCR observation, amount threshold or human action approval is
not evidence authenticity. Keep the original operation on unknown outcomes.
The JWT path is opt-in gateway coverage, not native-local or whole-agent coverage.

For **requesting-user consent**, select `user-confirmation` on the MAF gateway
and a matching signed `confirmation_requirement`. Use the native
Logic Apps/Outlook profile: **Approve/Reject directly in the email**, with
independent workflow/actual-responder/proposal verification. Follow the
[control-plane confirmation contract](references/control-plane/README.md).
An opaque authenticated request context is not consent; the agent retains its
workload identity. Delivery or opening a message is not consent, and native
email consent is not MFA. `threadlight-confirm-action` is a developer diagnostic,
not a command to send to the recipient. Entra context assurance
requires actual applicable CA policy verification; customers can supply their
own admitted provider. User consent does not satisfy an independent reviewer or
signed business evidence. Resume the same operation with all required authorities,
fresh policy/facts, one-use consumption and audit ACK before effects.

1. Read `specs/governance-contract.json` and the framework selection. Preserve
   unbound reads, including their tool names and responses; never enroll every
   tool to make a report green. Invalid selected config is not `off`.
2. Author real `manifest.yaml` and Rego invariants from
   [native-bundles.md](references/native-bundles.md). Use `build_bundle` and
   `verify_bundle` from `scripts/policy_bundle.py`; native loading is mandatory.
   These produce unsigned integrity metadata, **not signing authority**.
3. Route explicit runtime implementation to
   [generate.py](../threadlight-deploy/references/governance/generate.py) and its
   [input contract](../threadlight-deploy/references/governance/README.md):
   `foundation` → authorized Task8 publication → `generate` → immutable images /
   registered agent → `agent-image` (GHCP also `stage-gateway`) → `bind`.
   Follow the documented bootstrap order, not blanket `azd up` after binding.
   Produce actual host/application and ACA service sources, not just an assessment.
4. Supply host-trusted backend facts to SAFE, never model booleans. Required
   signed fresh policy, authenticated tenant/role/full-scope human approval with
   one-use CAS nonce, trusted target/schema/dynamic checks and central receipt ACK
   precede effects. Use actual Task8 services; text saying “escalate” is not approval.
   Recheck at terminal dispatch after waits. Local spool fsync is not durability.
5. Emit offline inventory, then run `threadlight-governed-actions`' real
   pre-deploy `--emit --gate`. For hosted evidence use `threadlight-safe-check`
   with explicit protected preproduction fixture/controller configuration.

```sh
python3 skills/threadlight-govern/scripts/govern_check.py \
  --target ../my-pilot --emit
```

This writes `specs/governance-manifest.json`
(`threadlight-governance-manifest/v1`) and `docs/agt-governance-report.md`.
Declared bindings remain `unverified`; unbound tools remain `unbound`.
`--gate` exits 2: offline inventory cannot pass a runtime gate.

## Boundaries under pressure

Selected gateway actions may use signed `approval_mode: deferred` and
`approval_requirement: policy` instead of holding HTTP open or requesting
approval for every permitted call. Existing defaults stay inline/always.
Deferred operations persist only intent and hashes, not business arguments.
The `threadlight-review-action` operator command verifies the displayed
proposal's action hash, requires an interactive decision and uses a separate
delegated human credential. It records consent only; the agent must resume
the exact operation and pass policy/fact/expiry checks before execution.
See the gateway's executable approval flow; no model-provided approval is trusted.

| Temptation | Required behavior |
|---|---|
| “Policy/CI is green; ship governed.” | Report offline/local scope; require fresh hosted proof for selected bindings. |
| “MAF means full SAFE automatically.” | Only selected supported points execute policy; compaction, provider-hosted tools and incremental streaming/custom clients are unsupported. |
| “Approve all” or pasted supervisor text | Require authenticated human service decision and atomic one-time consume, not SDK permission callbacks. |
| “Reuse yesterday's receipt.” | New deployment attempt needs after-deployment evidence; full signed envelope/key and current bundle/config must match. |
| “Noop passed, so refund is verified.” | `governance_probe_noop` proves only its registered route; business bindings stay unverified. |

Native MAF is selected local enforcement; GHCP supports registered gateway action
effect closure only, not lifecycle/full-output coverage or arbitrary URL/shell
routing. Control-plane/gateway ACA services, Cosmos, Blob, Key Vault and separate
publisher/verify/workload/downstream permissions are real deployment prerequisites.
Do not substitute broad RBAC or health stubs.

## Pins, migration and verification

Use `skills/_shared/governance-upstream-pin.json`:
`agent-governance-toolkit-core==5.0.0`, ACS `0.3.1b0`, Hooks `0.1.0a5`,
MAF core `1.14.0`, Foundry `1.11.0`, hosting `1.0.0b260813`, OPA `1.18.2`.
Preview/alpha APIs and experimental defaults are explicit limitations.
The corrected test-only CTK oracle covers 47 declared vectors; four incremental
vectors are undeclared. Never modify the published execution SDK.

Legacy v2 policies/verdict fixtures remain historical provenance in `references/fixtures/`;
they cannot pass current readiness. See [migration and CI](../../docs/production-readiness.md#runtime-governance-lifecycle).

```sh
python3 -m pytest skills/threadlight-govern/tests -q
python3 scripts/ci/run-governance-pin-tests.py
```

Ordinary native skips are not proof. The pinned runner executes local native/CTK
tests only; it does not attest Azure deployment.

From aiappsgbb/threadlight-skills, MIT.

More from aiappsgbb/threadlight-skills