visiq 0.2.0

VisIQ agent-governance SDK — local, in-process policy decisions from ONE compiled core (Path B).

visiq — VisIQ agent-governance Python SDK (Path B)

The first REAL, installable, CLOSED multi-language SDK. ONE compiled Rust core (the Path-B engine) makes the SAME governance decisions as the shipped TypeScript SDK (@visiq/harness), exposed through an ergonomic Python API.

import visiq
d = visiq.gate_action(bundle, tool_name="wire_transfer", args={"amount": 999}, agent_id="a")
if not d["allowed"]:
    ...  # block — the tool never runs

Why it's real (not a prototype)

• Installable: maturin builds an abi3 wheel (pip install visiq) — ONE binary for py3.9+; the engine is compiled machine code, no source in the artifact (closed / hard-to-RE, better than npm minification).
• Correct: it reuses the proven rego engine (../rseval/engine, 1316/1316 vs L0) + the unified-runtime layer matched to the real TS UnifiedRuntime.

Structure

• src/lib.rs — the Path-B core + PyO3 _core.evaluate(event_json, bundle_json).
• python/visiq/__init__.py — the ergonomic API (decide / gate_action / gate_retrieval).
• conformance.py — GATE 1: the installable SDK reproduces the event-corpus stamps (== shipped TS SDK decisions) across the full 93-vector corpus.
• interception_smoke.py — GATE 2: a REAL LlamaIndex FunctionAgent's tool dispatch is governed by the REAL compiled core (denied tool never executes; committed negative control).

Publishing (CTO-gated)

.github/workflows/pypi-publish.yml — workflow_dispatch-only; builds closed abi3 wheels for every platform, runs both gates (required), then publishes via PyPI OIDC Trusted Publishing behind the production environment (CTO approval). No SDK is claimed "supported" on the integrations page until it is genuinely installable AND passes both gates.

Build + verify

./run.sh

Prereq: Rust toolchain + python3 -m venv .venv && .venv/bin/pip install maturin llama-index-core.

Scope + next

Covers every event→input dimension + verb + the no-coverage posture (action: verb→read/write/delete/admin→approve/deny/ask, a faithful port of the TS resolveNoCoverage; retrieval: always fail-closed). Next: grow the event corpus toward full L0 breadth; then the Ruby/Go/Java/Node bindings over the SAME core, each gated by this same corpus.