visiq — VisIQ agent-governance harness for Python

Action governance, retrieval governance, and audit-trail reporting, from one Governor wrapper. Decisions are made in-process by the compiled VisIQ core that every VisIQ SDK shares — the same engine behind @visiq/harness — exposed through an ergonomic Python API. The engine ships as compiled machine code.

import visiq
d = visiq.gate_action(bundle, tool_name="wire_transfer", args={"amount": 999}, agent_id="a")
if not d["allowed"]:
    ...  # block — the tool never runs

Why it's real (not a prototype)

• Installable: maturin builds an abi3 wheel (pip install visiq) — ONE binary for py3.9+; the engine is compiled machine code, no source in the artifact (closed / hard-to-RE, better than npm minification).
• Correct: it reuses the proven rego engine (../rseval/engine, 1316/1316 vs L0) + the unified-runtime layer matched to the real TS UnifiedRuntime.

Structure

• src/lib.rs — the Path-B core + PyO3 _core.evaluate(event_json, bundle_json).
• python/visiq/__init__.py — the ergonomic API (decide / gate_action / gate_retrieval).
• conformance.py — GATE 1: the installable SDK reproduces the event-corpus stamps (== shipped TS SDK decisions) across the full 118-vector corpus.
• interception_smoke.py — GATE 2: a REAL LlamaIndex FunctionAgent's tool dispatch is governed by the REAL compiled core (denied tool never executes; committed negative control).

Publishing (CTO-gated)

.github/workflows/pypi-publish.yml — workflow_dispatch-only; builds closed abi3 wheels for every platform, runs both gates (required), then publishes via PyPI OIDC Trusted Publishing behind the production environment (CTO approval). No SDK is claimed "supported" on the integrations page until it is genuinely installable AND passes both gates.

Build + verify

./run.sh

Prereq: Rust toolchain + python3 -m venv .venv && .venv/bin/pip install maturin llama-index-core.

Scope + next

Covers every event→input dimension + verb + the no-coverage posture (action: verb→read/write/delete/admin→approve/deny/ask, a faithful port of the TS resolveNoCoverage; retrieval: always fail-closed). Next: grow the event corpus toward full L0 breadth; then the Ruby/Go/Java/Node bindings over the SAME core, each gated by this same corpus.