evgraph-rules

The built-in rule pack for Evgraph.

What is it

evgraph-rules is the reference implementation of Evgraph's rule-pack mechanism, and the set of governance checks that ship out of the box. Rules are deliberately shipped as their own package, separate from evgraph-core: policy — what counts as good evidence — should be free to evolve, gain new checks, or be replaced by an organization's own rule pack, without ever touching the stable graph and evidence-level vocabulary that evgraph-core defines. A rule pack participates in Evgraph purely by being pip install-ed; evgraph.discover_rules() finds every rule registered under the evgraph.rules entry-point group at runtime; evgraph-rules is simply the first (and currently only first-party) example of that mechanism, not a privileged one.

Each rule here is a small, pure function over an EvidenceGraph: it takes a graph, cites the specific nodes and edges its conclusion rests on, and returns Findings whose certainty (EvidenceLevel) is never higher than the evidence it cites — enforced by evgraph_core.compute_finding_level(), not by convention.

Main features

• approval-precedes-deployment — checks that a deployment's REQUIRES_APPROVAL edge points to a HumanApproval whose approved_at precedes the deployment's deployed_at. Reasoning class CONSISTENCY: it cross-references two structural timestamps rather than reading either in isolation. A missing approved_at stays inconclusive. The rule does not invent the timestamp.
• dataset-manifest-complete — checks that every Dataset node in the graph declares a non-empty license attribute. Reasoning class STRUCTURAL: a direct presence check on a single node, with no cross-referencing between nodes.
• model-version-has-training-provenance — checks that every node whose type ends in ModelVersion has a TRAINED_BY edge to the run that produced it. Deliberately written against the graph shape (…ModelVersion node, TRAINED_BY edge) rather than against MLflow by name, entirely independent of any one adapter's implementation — so it applies unmodified to any future adapter (a different model registry, for example) that produces the same shape.
• Entry-point registration — all three rules register under evgraph.rules in this package's pyproject.toml. Installing a third-party rule pack the same way makes scan() pick it up automatically; no changes to evgraph-core or evgraph are required.

Where to get it

The source is hosted on GitHub at: https://github.com/SVamseekar/evgraph

Binary installers for the latest released version are available at the Python Package Index (PyPI):

pip install evgraph-rules

From source, for contributing:

git clone https://github.com/SVamseekar/evgraph.git
cd evgraph
pip install -e reference/python/evgraph-core
pip install -e reference/python/evgraph-rules

Dependencies

• evgraph-core — installed automatically as a dependency.

pytest>=7 is required for the test suite (pip install "evgraph-rules[test]").

Documentation

Getting help

Ask questions and report bugs via GitHub Issues on the main repository.

Contributing

All contributions, bug reports, and feature requests are welcome on the main repository. See CONTRIBUTING.md and the Code of Conduct. Security reports: SECURITY.md.

License

BSD 3-Clause.