semantic-kernel-mycelium-ref-verify

Semantic Kernel plugin for action_ref and decision_binding_ref — the content-addressed identifiers from the argentum-core spec family. action_ref identifies an agent action instance; decision_binding_ref binds it to the authorization decision that permitted it. Both are SHA-256(JCS(preimage)) — deterministic, independently recomputable by any third party, no trust in the emitting system required.

Same underlying logic as mycelium-ref-verify (Agent Skill) and crewai-decision-binding-ref (CrewAI Tool) — action_ref.py and decision_binding_ref.py here are the same stdlib-only modules, wrapped as @kernel_function-decorated methods instead of a BaseTool.

Specs: action-ref.md · decision-binding-ref-v1.0.md

Install

pip install semantic-kernel-mycelium-ref-verify

Usage

from semantic_kernel import Kernel
from semantic_kernel_mycelium_ref_verify import MyceliumRefPlugin

kernel = Kernel()
kernel.add_plugin(MyceliumRefPlugin(), plugin_name="mycelium_ref")

fn = kernel.get_function("mycelium_ref", "compute_decision_binding_ref")
result = await kernel.invoke(
    fn,
    action_ref="sha256:...",
    decision_id="approval:...",
    decision_at_ms=1748736000000,
)

Four kernel functions are exposed:

The four verify states

Both verify_* functions report one of four states, deliberately kept separate from the trail_status ladder (COMMITTED/PENDING/FAILED) used elsewhere in Mycelium for execution-outcome tracking. That ladder answers a temporal question — did the post-execution receipt arrive? This plugin answers a cryptographic one — does this hash match? verify_* never returns FAILED.

Tests

Conformance tests reuse the byte-verified fixtures already published in argentum-core, no new vectors invented:

• Fixtures A–D from decision-binding-ref-v1.0.md
• Vectors cd-001..cd-004 from examples/conformance/decision-binding-context-digest-v1/

pip install -e .
pytest

License

Apache-2.0