visiq — VisIQ agent-governance harness for Python

Action governance, retrieval governance, and audit-trail reporting, from one Governor wrapper. Decisions are made in-process by the compiled VisIQ core that every VisIQ SDK shares — the same engine behind @visiq/harness — exposed through an ergonomic Python API. The engine ships as compiled machine code.

import visiq
d = visiq.gate_action(bundle, tool_name="wire_transfer", args={"amount": 999}, agent_id="a")
if not d["allowed"]:
    ...  # block — the tool never runs

One call for Pydantic AI and Semantic Kernel

from visiq import govern

govern(agent, agent_id="support-bot")    # a pydantic_ai.Agent (pydantic-ai >= 1.107)
govern(kernel, agent_id="support-bot")   # a Microsoft semantic_kernel.Kernel

Every tool on the agent or kernel is governed with no per-tool wiring: a deny means the tool never runs and the model reads why, a mask hands the tool only the redacted arguments, and retrieval_tools= (Pydantic AI) / retrieval_functions= (Semantic Kernel) governs a RAG tool's result before the model sees it. For other frameworks, route each tool through Governor.gate_tool.

Why it's real (not a prototype)

• Installable: maturin builds an abi3 wheel (pip install visiq) — ONE binary for py3.9+; the engine is compiled machine code, no source in the artifact (closed / hard-to-RE, better than npm minification).
• Correct: it reuses the proven rego engine (../rseval/engine, 1316/1316 vs L0) + the unified-runtime layer matched to the real TS UnifiedRuntime.

Structure

• src/lib.rs — the Path-B core + PyO3 _core.evaluate(event_json, bundle_json).
• python/visiq/__init__.py — the ergonomic API (decide / gate_action / gate_retrieval).
• conformance.py — GATE 1: the installable SDK reproduces the event-corpus stamps (== shipped TS SDK decisions) across the full 118-vector corpus.
• interception_smoke.py — GATE 2: a REAL LlamaIndex FunctionAgent's tool dispatch is governed by the REAL compiled core (denied tool never executes; committed negative control).

Publishing (CTO-gated)

.github/workflows/pypi-publish.yml — workflow_dispatch-only; builds closed abi3 wheels for every platform, runs both gates (required), then publishes via PyPI OIDC Trusted Publishing behind the production environment (CTO approval). No SDK is claimed "supported" on the integrations page until it is genuinely installable AND passes both gates.

Build + verify

./run.sh

Prereq: Rust toolchain + python3 -m venv .venv && .venv/bin/pip install maturin llama-index-core.

Scope + next

Covers every event→input dimension + verb + the no-coverage posture (action: verb→read/write/delete/admin→approve/deny/ask, a faithful port of the TS resolveNoCoverage; retrieval: always fail-closed). Next: grow the event corpus toward full L0 breadth; then the Ruby/Go/Java/Node bindings over the SAME core, each gated by this same corpus.