rootzerovault

Constitutional AI Governance SDK for Python — connects your AI agents and tools to the Root Zero Vault constitutional gateway.

Install

pip install rootzerovault

Quick start (live gateway)

from rootzerovault import RzvClient

rzv = RzvClient(gateway="http://localhost:8443")
result = rzv.validate(specimen)
print(result.outcome)  # 'ACCEPT' | 'REJECT'

Quick start (offline / demo mode)

For tests, demos, or offline development without a gateway, use demo_mode=True:

from rootzerovault import RzvClient

rzv = RzvClient(demo_mode=True)
# Governance calls return simulated outcomes instead of raising RzvNotConfiguredError.
# All adapters propagate this through their internal GovernanceClient.

Important: demo_mode is for tests and demos only — never use in production. Without gateway and without demo_mode=True, calls that need governance fail closed with RzvNotConfiguredError.

R&D sandbox vaults

RootZero017008_RAndDIDs of the constitution: "Anyone may create R&D IDs — free, deedless vaults that mimic Root Zero. They serve as sandboxes for education, AI training, and experimentation." The guarantee: "No R&D ID is authentic until converted into a Deeded Vault."

The SDK models this as two distinct, non-interchangeable types — RDVault (a deedless sandbox) and Deed (an authentic, Floor-bearing Deed). mypy rejects passing one where the other is expected, so a sandbox vault can never be silently treated as authentic. convert_to_deed() is the only declared bridge between them.

from rootzerovault import RzvClient

rzv = RzvClient(gateway="http://localhost:8443")

# Create a free, deedless R&D sandbox vault — no authorization required.
vault = rzv.create_sandbox_vault(requested_suffix="myproject")
assert vault.is_authentic is False          # constitutionally pinned
print(vault.ancestry_path)                  # ['(R&D)', '(R&D)myproject']
print(vault.constitutional_quote_blake3)    # pin this to detect deed drift

# Convert it into an authentic Deed when ready to commit. Per
# RootZero017005_CustodianAuthority + RootZero017009_MigrationAndUpgrades,
# conversion requires a Master-Custodian scoped-token credential.
deed = rzv.convert_to_deed(
    vault,
    target_namespace="myprojectcorp",
    master_custodian_auth="rzv-tok-v1:<token_id>:<sig>",
)
assert deed.is_authentic is True
print(deed.converted_from_vault)            # lineage link back to the vault

The conversion path is R&D → Standard → Premium → Trunk (RootZero017008_RAndDIDs). async variants — create_sandbox_vault_async() and convert_to_deed_async() — are also available.

Framework adapters

Out-of-the-box wrappers for common AI/agent frameworks. Each adapter constructs a GovernanceClient that propagates the demo_mode flag from the RzvClient you pass in.

• LangChain — from rootzerovault.adapters import governed_langchain_tool, GovernedTool
• CrewAI — from rootzerovault.adapters import governed_crewai_tool, GovernedCrew
• OpenAI Agents — from rootzerovault.adapters import governed_openai_tool
• Anthropic — from rootzerovault.adapters import GovernedAnthropic
• AWS Bedrock — from rootzerovault.adapters import GovernedBedrockClient
• Google Vertex / Gemini — from rootzerovault.adapters import governed_vertex_tool
• Azure OpenAI — from rootzerovault.adapters import GovernedAzureOpenAI
• Cohere — from rootzerovault.adapters import GovernedCohereClient
• MCP (Model Context Protocol) — from rootzerovault.adapters import GovernedMCPServer, governed_tool
• A2A (Agent-to-Agent) — from rootzerovault.adapters import GovernedA2AAgent
• ANP (Agent Network Protocol) — from rootzerovault.adapters import GovernedANPAgent
• ACP — from rootzerovault.adapters import governed_acp_agent
• Agno — from rootzerovault.adapters import GovernedAgnoAgent
• Semantic Kernel — from rootzerovault.adapters import governed_kernel_function
• Smolagents — from rootzerovault.adapters import GovernedSmolTool
• PydanticAI — from rootzerovault.adapters import governed_pydantic_tool
• HTTP — from rootzerovault.adapters import HttpAdapter
• Database / SQL — from rootzerovault.adapters import GovernedSQLAlchemy
• gRPC — from rootzerovault.adapters import GovernedGrpcChannel

Optional dependencies are listed under pyproject.toml [project.optional-dependencies]. Install with the framework you need:

pip install rootzerovault[langchain]
pip install rootzerovault[crewai]
pip install rootzerovault[mcp]
# or all at once:
pip install rootzerovault[all]

Genesis

Constitutional anchor — frozen since March 14, 2026. Backdating is detectable by any independent verifier recomputing the hash chain; because the CVID is the deed's own BLAKE3 hash, any alteration yields a different CVID and is immediately detectable.

cvid:blake3:1544ff7dd978d911083bd60a7a4e6ba9647996bfdefb62aa8a045ccb63158867

Testing

pip install -e ".[dev]"
python -m pytest tests/

Tests fall into three implicit categories: unit tests (no optional deps required), adapter tests (each requires its framework's optional dep installed; skipped otherwise), and live-gateway tests (require a running gateway at http://localhost:8443).

License

Dual MIT OR Apache-2.0.

Links

• Source: https://github.com/deensaleh/rsbis-sdk
• Issues: https://github.com/deensaleh/rsbis-sdk/issues
• Project: https://rootzerovault.com