Cybernetic Agent Governance Engine (CAGE)

AI governance for regulated financial services — built-in, not bolted on.

Universal (all regions):

Jurisdictional Extensions:

What's New in v2.1.1

Release date: 2026-07-30 — Patch release: jurisdiction-aware compliance fixes (FINDING-05/07/08/09), two production HITL bug fixes surfaced by new FTRA test coverage, and a documentation completeness audit. No new features. See CHANGELOG.md for full details.

What's New in v2.1.0

Release date: 2026-07-27

New Capabilities

Capability	Location	Description
FTRA Commencement Reachability Gate	`src/gateway/governance/ftra/`	Forward-Looking Trajectory Reachability Analyzer (Tier 0.5) — builds a NetworkX directed graph from `ExecutionPlan.steps`, classifies terminal steps via `IrreversibilityClassifier`, and issues `CLEAR` / `HITL_REQUIRED` / `BLOCKED` before any tool call executes. Implemented by `create_ftra_node()`, `PlanGraphAnalyzer`, `IrreversibilityClassifier`. Two production defects fixed in v2.1.1 (POAM-2026-033): `DeferQueue` instantiation and `NodeInterrupt` re-raise
Phase A Ingress Adapters	`src/gateway/governance/ingress/`	AAIF, ACS, OSCAL, Lula, and AGP policy-uploader adapters; policy translation layer
Phase B AGW Absorption	`src/gateway/governance/ingress/agw_adapter.py` + `src/gateway/server/agent_gateway_adapter.py`	Agent Gateway Protocol bridge with OPA policy enforcement
CAGE-003 Agent Registry Integration	`src/gateway/governance/ingress/agent_registry_adapter.py`	SPIFFE trust-domain agent catalog integration
CBF External Reconciliation Worker	`src/compliance_bridge/reconciliation_worker.py`	Implements POAM-023; external CBF state reconciliation (closes POAM-023)
NIST AI 600-1 Compliance Gates (phases 0–3)	`compliance/lula/lula-validation-ai600-*.yaml`	CBRN, confabulation, data privacy, and prompt injection Lula validation manifests
Three-Region Compliance Matrix	`compliance/lula/`, `compliance/oscal/`	Separate Lula manifests, pytest matrix, and region-aware K8s templates for EU_ECB, APAC_MAS, US_FED
AgentSight UI	`src/agentsight-ui/`	React/TypeScript real-time governance dashboard with `KernelDashboard`
Governed Financial Advisor	`src/governed_financial_advisor/`	Full multi-agent reference implementation with LangGraph, NeMo Guardrails, OPA policy enforcement
NeMo Guardrails Integration	`src/gateway/governance/nemo/`	Actions, manager, server, vLLM client; CBRN rails (`config/rails/cbrn_rails.co`)
LangGraph Harness	`src/gateway/governance/langgraph_harness/`	Composable `NemoNodeFactory` and `OpaNodeFactory` governance nodes for LangGraph pipelines
AARM Profile Mapper	`src/compliance_bridge/aarm_mapper.py` + `aarm_report_generator.py`	11-vector threat ledger mapping with live conformance report endpoint
Evidence Chain Metadata Binding	`src/compliance_bridge/evidence_stream.py`	Binds metadata to evidence chain entries
Region-Aware K8s Templates	`deployment/k8s/*.yaml.tpl`	`CAGE_DEPLOYMENT_REGION` guards in all Kubernetes deployment templates
Langfuse Native OTLP	`src/gateway/tracing_setup.py`	Replaced standalone OTel Collector with Langfuse native OTLP integration

Test Status

Suite	Result	Date
Unit (`pytest tests/`)	✅ 1,509 passed / 0 failed / 161 skipped	2026-07-30
Integration (`pytest tests/ --run-integration`)	✅ 1,622 passed / 0 failed / 48 skipped	2026-07-30
Total	✅ 1,670 collected, 0 failed	2026-07-30

Tests run against a live GKE cluster (governance-cluster-2, project laah-cybernetics). See infra/DEPLOYMENT_GUIDE.md for cluster setup instructions. Skipped tests: the 48 integration skips are region-specific tests (eu_ecb, apac_mas) that require CAGE_DEPLOYMENT_REGION set to a non-US_FED value — expected behaviour for a US_FED cluster posture.

Platform Compatibility

CAGE is a Kubernetes-native, cloud-agnostic AI governance engine. The core governance kernel — OPA policy enforcement, NeMo Guardrails, SymbolicGovernor, Control Barrier Functions, and the LangGraph audit harness — runs on any conformant Kubernetes 1.24+ cluster without modification.

Deployment Target	Kubernetes	Cloud Provider	Status
GKE (Google Kubernetes Engine)	✅ Any GKE channel	GCP (optional integrations)	Production-ready
EKS (Amazon Elastic Kubernetes Service)	✅ Any EKS version	AWS (optional integrations)	Supported
AKS (Azure Kubernetes Service)	✅ Any AKS version	Azure (optional integrations)	Supported
OpenShift	✅ 4.12+	On-prem / any cloud	Supported
Vanilla Kubernetes	✅ 1.24+	On-prem / any cloud	Supported

Optional GCP Integrations

The following GCP services are optional drivers — the system functions fully without them using the listed alternatives:

GCP Service	Purpose	Alternative
Cloud KMS	Audit log signing	AWS KMS, Azure Key Vault, HashiCorp Vault
Cloud Storage (GCS)	OSCAL evidence storage	AWS S3, MinIO, local filesystem
GKE Workload Identity	Pod-level IAM	AWS IRSA, Azure Workload Identity, static credentials
Cloud Build	CI/CD	GitHub Actions, GitLab CI, any OCI-compatible CI

The CAGE Product Offering

CAGE v2.1.0 provides a multi-jurisdiction, dual-layer governance architecture for enterprise AI with evidentiary independence — the system cannot manufacture the conditions necessary to satisfy its own governance checks:

The Governance Gateway: A high-performance inference proxy and MCP tool server that enforces an 8-tier symbolic governance model — a pre-execution Forward-Looking Trajectory Reachability Analysis (FTRA, Tier 0.5) plus seven in-pipeline tiers: STPA/UCA validation, agentic confidence check, Control Barrier Function concurrent with OPA Rego, Fiscal Limit Pre-Reservation, multi-agent consensus, causal gatekeeper, and adaptive FRIA gate — combined with network and runtime hardening (Linkerd mTLS, Cilium L7, eBPF telemetry). The legacy SLM sidecar has been fully deprecated and replaced by a permanent slm_available=false sentinel to optimize latency. It acts as the "Controller" in our Controller-Plant architecture, intercepting all agent-to-tool and agent-to-LLM communications.
The FTRA Reachability Gate: A pre-execution Forward-Looking Trajectory Reachability Analyzer (src/gateway/governance/ftra/) that builds a NetworkX directed graph from the agent's ExecutionPlan, classifies each step with IrreversibilityClassifier against the compiled terminal registry, and issues a CLEAR / HITL_REQUIRED / BLOCKED verdict before any tool call is made. This is Tier 0.5 — it fires at the LangGraph graph level before the SymbolicGovernor's _run_checks() pipeline begins.
The Reusable Agent Harness: A set of deterministic LangGraph factories (OpaNodeConfig/NemoNodeConfig) that allow developers to wrap any agentic workflow in mandatory, non-bypassable governance guardrails.
The STPA-to-Policy Compiler: A CLI tool that ingests a declarative YAML control structure (config/stpa_control_structure.yaml) and auto-generates OPA Rego policies, NeMo Colang rails, Python validator classes, and LangGraph Saga compensating sub-graphs — eliminating the Natural Language Tax between design-time hazard analysis and runtime enforcement.
The DoWhy Causal Gatekeeper: An optional, refutation-based causal inference safety lock (src/gateway/governance/causal_gatekeeper.py) that validates world-model integrity via DoWhy placebo refutation before allowing high-stakes trade actions. Integrated as Tier 6 in the SymbolicGovernor pipeline.
The LangGraph Saga Engine: A Write-Ahead Log + LIFO rollback + idempotent compensating node pattern that provides atomic transaction guarantees for execute_trade actions, with ghost-state recovery and ISO 42001 telemetry on every rollback.
The FiscalLimitGuard: A Redis-backed atomic pre-reservation guard that prevents multi-agent "race to the rail" collisions when multiple agents simultaneously evaluate OPA fiscal limits.
The Cryptographic Hash-Chained Context Accumulator (AARM-V1): SHA-256 hash-chained, append-only log of every OscalFinding. Each node's record_hash is SHA-256(prev_hash || content_json), sealing an unalterable chain-of-custody that detects any Memory Poisoning attempt at the mutated node. Satisfies ISO 42001 Annex A.5.3 and neutralizes AARM-V1.
The DEFER State Machine Primitive (AARM-V7): Extends the OPA tri-state (ALLOW | DENY | MANUAL_REVIEW) to four states. When confidence_score < 0.70 (Confidence-Starvation Boundary), execution is parked in a Redis-backed DeferQueue (db=1, noeviction) pending automated data injection — preventing the agent from proceeding on fundamentally incomplete context. Satisfies ISO 42001 Annex A.8.4 and neutralizes AARM-V7.
Native AARM Threat Vector Mapping (11-Vector Ledger): Machine-readable proof that specific CAGE control points neutralize all 11 CSA AARM threat vectors. GET /v1/aarm/conformance-report returns a live NEUTRALIZED | PARTIAL | EXPOSED verdict per vector, auto-serialized to GCS/S3 on every Lula audit run.
Cloud KMS HSM-Backed Governance Signing (v2.0.0): Asymmetric signing via Google Cloud KMS Hardware Security Module (src/gateway/governance/kms_signer.py). The private key never leaves the HSM; verification uses a locally-embedded public key PEM for sub-millisecond latency. Cloud Audit Logs provide external, immutable attestation of every signing operation. Replaces the prior HMAC-SHA256 self-signing pattern that was vulnerable to container-breakout key extraction.
Human-Gated NeMo Refinement (v2.0.0): The autonomous Langfuse → KFP → NeMo hot-reload loop is severed. All config refinements are staged via POST /v1/nemo/propose-refinement and require explicit human approval with reviewer identity and rationale before applying — eliminating the recursive self-authentication path where a model could engineer its own privilege escalation.
Heterogeneous Multi-Model Consensus (v2.0.0): ConsensusModelRegistry routes each critic persona to a distinct vLLM inference backend (DeepSeek-R1 for Risk Manager, Llama 3.1 for Compliance Officer). No single model can "consent" to its own output — system invariants are no longer vulnerable to a shared semantic blind spot.
Externally Reconciled CBF Ground Truth (v2.1.0 — POAM-023 Closed): The Control Barrier Function's cash_balance input is sourced from an independently reconciled external custody ledger via src/compliance_bridge/reconciliation_worker.py. The reconciliation worker implements POAM-023 and performs external CBF state reconciliation; reconciled balances are KMS-signed before Redis write and the CBF fails closed on TTL expiry.
External Normative Provider with Adaptive Gating (v2.0.0): src/gateway/governance/normative_provider.py implements the 3-endpoint external normative provider integration (§2.5 Extensibility Architecture) with an Adaptive Gating Primitive (enforce_fria_boundary()) that maps the blocking semantic to CAGE's confidence boundary: Score ≥0.95 → async attestation (0ms); [0.70, 0.95) → synchronous blocking gate via DEFER queue; <0.70 → local hard deny (no external call). Supports pluggable providers (StubNormativeProvider for dev/CI, TrustLayersProvider for production). Background daemon for boot-time baseline fetch + 6-hour polling refresh.

Compliance is not documented after the fact; it is enforced at the point of inference, producing both governed outputs and a cryptographically hash-chained, tamper-evident audit evidence trail in real time.

Architecture Overview

CAGE is composed of six runtime subsystems:

Subsystem	Root Path	Role
Gateway / Governance Harness	`src/gateway/governance/`	Reusable `langgraph_harness` factories, OPA symbolic governor, NeMo manager
Governed Financial Advisor	`src/governed_financial_advisor/`	LangGraph multi-agent pipeline; FastAPI server; all agents, pipelines, demo
Hybrid Inference Gateway	`src/gateway/`	MCP tool server + inference proxy + 8-tier SymbolicGovernor (FTRA + 7 in-pipeline tiers) + KMS signer + ConsensusModelRegistry
Compliance Bridge	`src/compliance_bridge/`	OSCAL audit ingest; SSE event bus; Langfuse integration; AARM Conformance Engine; DEFER Queue API
AgentSight UI	`src/agentsight-ui/`	React/TypeScript operator dashboard; real-time governance and remediation events
AgentSight eBPF DaemonSet	`deployment/agentsight/`	Kernel-level process telemetry via BPF uprobes
Vendor Integrations	`src/integrations/`	Isolated third-party adapters: `trustlayers/` (normative provider), `nexart/` (CER attestation)

User ──POST /agent/query──► FastAPI Agent Server (:8000)
                                      │
                         [nemo_guardrail] (mandatory input rail - Node 1)
                                      │
                         LangGraph StateGraph (10 Nodes)
                         thinker_node (DeepSeek-R1) → doer_node (Llama 3.1)
                            ├─► data_analyst → [nemo_output_rail_da] ──► (short-circuit path)
                            └─► execution_analyst → evaluator 
                                      │ (APPROVED + sig)
                                 safety_check ──(BLOCKED/ESCALATED)──┐
                                      │ (APPROVED/SKIPPED)           │
                         [governed_trader] (HITL Interrupt Gate)      │
                                      │                              ▼
                                  explainer ◄────────────────────────┘
                                      │
                         [nemo_output_rail] (mandatory output rail)
                                      │
                              ◄── governed response ──

For full architectural detail, see docs/GATEWAY_ARCHITECTURE.md, the Technical Report Series, and the Extensibility Architecture (domain-agnostic kernel design and multi-domain roadmap).

Key Features

Multi-Jurisdiction Compliance Profiles — Dynamic loading of regional control profiles (config/compliance/) and thresholds (config/thresholds/) via CAGE_DEPLOYMENT_REGION. Supports US_FED, EU_ECB (EU AI Act, GDPR Art. 22, DORA, with Step 7 Fundamental Rights Impact Assessment attestation and SR 26-2 telemetry suppression), and APAC_MAS (MAS FEAT Principles) baselines.
Reusable LangGraph Governance Harness — OpaNodeConfig and NemoNodeConfig factories allow any agent to inherit enterprise governance (tracing, metrics, fail-closed mechanisms) with pluggable domain-state extractors.
DoWhy Causal Gatekeeper — Microsoft DoWhy causal inference validates world-model integrity via placebo refutation before allowing high-stakes actions; fail-safe on error (blocks when causal assumptions cannot be verified). The Causal Gatekeeper's Redis fallback is now fail-closed: connection errors raise RuntimeError rather than returning a zero sentinel; absent keys return None (first-boot safe).
LangGraph Saga Pattern — STPA compiler now generates WAL forward nodes, idempotent compensating nodes, and a centralized saga_router_node from UCA definitions in YAML. UCA-4 (atomic debit/credit failure) is fully enforced. Ghost-state recovery (OOM crash between PENDING and COMPLETED) escalates to human_review. Rollback evidence emitted as OTel spans via SagaCallbackHandler (ISO 42001 A.8.4). A rollback_state() Saga compensation stub has been added to FiscalLimitGuard to reverse Redis debits when a downstream tier fails after Tier 3a commitment (saga-atomicity gap, not a concurrency race).
FiscalLimitGuard — Redis WATCH/MULTI/EXEC optimistic-lock pre-reservation guard prevents multi-agent "race to the rail" where concurrent threads all read the same OPA limit and all pass. Fail-closed on Redis failure. Integrates with Saga rollback via release(token).
Token Quota Proxy (CTRL_TQP_007) — src/gateway/governance/token_quota_proxy.py enforces hard per-session step-count (≤12) and token (≤100,000) quotas via Redis atomic Lua counters. Fail-CLOSED: Redis unavailability blocks the request (HTTP 429). Two-phase commit: check_and_increment() reserves quota before the vLLM call; reconcile_actual_tokens() corrects over-allocation after the response. rollback_step() atomically decrements counters on downstream failure. Implements ISO 42001 Annex A.4 (Resource Management). Governance control: CTRL_TQP_007.
PII Sanitizer — src/gateway/governance/pii_sanitizer.py applies five compiled regex patterns (SSN, credit card, email, phone, API key/Bearer token) sequentially to every UCA compliance record before WORM persistence. Implements ISO 42001 Annex A.6 (Data Lineage and PII Leak Mitigation). Thread-safe; no per-call state.
UCA Logger — src/gateway/governance/uca_logger.py builds, cryptographically signs (Cloud KMS in production; HMAC-SHA256 stub when CAGE_ENV=test), and persists 16-field ISO 42001 Clause 6.1 Unsafe Control Action records to a region-gated WORM bucket (CAGE_DEPLOYMENT_REGION → OSCAL_S3_BUCKET_{REGION}). Three UCA types: quota_exceeded, prompt_injection, pii_sanitization.
Mandatory NeMo input + output guardrails — non-bypassable LangGraph nodes generated by the harness; fail-closed on any exception; Presidio PII scan on every request and response.
OPA policy evaluation via direct REST API — circuit breaker defaults to DENY on failure; generated by the harness router.
STPA-to-Policy Compiler — CLI tool (src/gateway/governance/stpa_compiler.py) ingests config/stpa_control_structure.yaml and generates OPA Rego, NeMo Colang rails, a Python GeneratedSTPAValidator, and LangGraph Saga nodes — eliminating manual policy transcription errors.
Zero-Trust Network (Z3N) hardening — Linkerd mTLS Server/AuthorizationPolicy/MeshTLSAuthentication for cryptographic SPIFFE/SVID identity verification; Cilium L7 FQDN egress lockdown for sovereign agent pods. Closes POAM-007 (IA-3); POAM-011 (SC-8) remains Open.
Automated OSCAL SSP exporter — oscal_ssp_exporter.py surgically patches the 1,151-line system-security-plan.yaml in-place with implementation evidence for every governance control, on every CI run.
HITL Mandatory Rationale — High-risk actions trigger LangGraph interrupts. Resuming the graph requires a mandatory justification that is cryptographically hashed into the evidence chain BEFORE the thread resumes.
Cryptographic Hash-Chained Context Accumulator (AARM-V1) — src/compliance_bridge/context_accumulator.py promotes the SHA-256 chain-of-custody pattern to the core compliance pipeline. Each OscalFinding is hash-linked to the preceding node. A CHAIN_SEALED sentinel terminates every run. chain_root, chain_length, and chain_integrity_valid are returned in all audit API responses. Neutralizes AARM-V1 Memory Poisoning; satisfies ISO 42001 A.5.3.
DEFER State Machine Primitive (AARM-V7) — src/gateway/governance/defer_queue.py parks execution context in Redis db=1 (noeviction) when confidence_score < 0.70. The GET /v1/defer/pending, POST /v1/defer/{id}/inject, and POST /v1/defer/{id}/escalate endpoints manage the queue lifecycle. Neutralizes AARM-V7 Context Window Overflow; satisfies ISO 42001 A.8.4 (UCA-7).
Native AARM 11-Vector Threat Ledger — src/compliance_bridge/aarm_mapper.py provides a static, version-pinned ledger mapping all 11 CSA AARM vectors to specific CAGE control points. GET /v1/aarm/conformance-report returns per-vector NEUTRALIZED | PARTIAL | EXPOSED verdicts with optional vLLM narrative enrichment. Report auto-serialized to GCS/S3 on every Lula audit run.
Governance-as-Code Demo — examples/governance_demo.py is a 3-act CLI walkthrough of v1.0.0 features (Concurrency Race, HITL Rationale, and Hash-Chain Verification).
Multi-Jurisdiction Compliance Engine (v2.0.0) — CAGE_DEPLOYMENT_REGION env var activates one of three regional compliance postures (US_FED, EU_ECB, APAC_MAS) at boot, loading the correct JSON control profile, numeric thresholds, and OSCAL framework routing table with zero code changes.
Chaos Agent Playground — examples/chaos_agent_playground.py provides a zero-infrastructure local demo intercepting five adversarial scenarios (A–E: governance tiers; D: Saga LIFO rollback; E: ghost-state OOM crash recovery) across the full governance stack.
OSCAL-compliant compliance bridge — SSE event bus with 7-year audit retention; ISO 42001, FedRAMP HIGH, and EU AI Act evidence artifacts via Langfuse dual-project setup.
Langfuse observability — LLM chain-of-thought, tool use, governance verdicts, and compliance scores captured without blocking inference.
Kubernetes-native secret management — all secrets injected as environment variables via K8s Secret objects; no Google Secret Manager.
Cloud KMS HSM governance signatures (v2.0.0) — Asymmetric signing via Google Cloud KMS HSM; private key never leaves hardware. HMAC-SHA256 fallback for dev/CI. Required before any trade execution. KMS-signed payloads now embed a signed_at timestamp; the verifier rejects payloads older than 300 seconds, closing a replay-attack vector.
Human-gated NeMo refinement (v2.0.0) — All config changes staged as proposals requiring explicit human approval with reviewer identity and rationale. Severs the autonomous hot-reload loop.
Heterogeneous multi-model consensus (v2.0.0) — ConsensusModelRegistry routes each critic persona to a distinct vLLM backend, preventing single-model semantic blind spots. The degraded-quorum case (ERROR + APPROVE) is now explicitly routed to HITL escalation.
Externally reconciled CBF (v2.1.0 — POAM-023 Closed) — src/compliance_bridge/reconciliation_worker.py implements external CBF state reconciliation. Reconciled balances are KMS-signed before Redis write; the CBF fails closed on TTL expiry. The CBF module tracks intra-window debits locally (_local_debits) to prevent double-spend within the KMS snapshot refresh window (60 s fetch / 300 s TTL).
Human-in-the-loop approval gate — LangGraph interrupt_before=["governed_trader"]; resume via POST /v1/approvals/{thread_id}/resume.
W3C traceparent propagation — full OTel trace waterfall across LangGraph → Gateway → vLLM; 100% sampling for governance decision spans.

Mathematical Foundations & Formal Safety Guarantees

CAGE's runtime safety properties are grounded in formal mathematical constructs implemented directly in source code. The following summarises the key formalisms; full derivations are in docs/technical-report/10-FORMAL-VERIFICATION.md and docs/governance/CAUSAL_AND_CBF_GOVERNANCE.md.

Control Barrier Function (CBF)

Source: src/gateway/governance/cbf.py

The safe set is defined as S = {x ∈ ℝⁿ : h(x) ≥ 0} where the barrier function is:

h(x) = cash_balance − min_cash_balance

The discrete-time CBF condition enforced at every governance tick is:

h(S(t+1)) ≥ (1−γ) · h(S(t)),   γ ∈ (0,1)

This guarantees that the cash balance never drops below the minimum threshold in a single step — the decay factor γ bounds the maximum permissible drawdown per evaluation cycle. External reconciliation is implemented via src/compliance_bridge/reconciliation_worker.py (POAM-023 closed 2026-07-27).

8-Tier Symbolic Governor Pipeline

Sources: src/gateway/governance/symbolic_governor.py, src/gateway/governance/ftra/

Every execute_trade action passes through the following sequential tiers before a routing seal is issued. Tier 0.5 (FTRA) executes at the LangGraph graph level before the first node fires; Tiers 0–6b run inside SymbolicGovernor._run_checks():

Tier	Name	Mechanism
0.5	FTRA — Forward-Looking Trajectory Reachability Analyzer	`create_ftra_node()` builds a NetworkX directed graph from the `ExecutionPlan`, classifies terminal steps with `IrreversibilityClassifier`, and issues `CLEAR` / `HITL_REQUIRED` / `BLOCKED` before any tool call executes
0	STPA/STAMP UCA validation	`GeneratedSTPAValidator.validate()` checks Unsafe Control Actions defined in the STPA ontology
1	Agent confidence pre-check	Fast-fail local check against `AGENT_CONFIDENCE_THRESHOLD` (default 0.95) before any network I/O
2 / 4	CBF + OPA concurrent	`asyncio.gather` runs the Control Barrier Function (Tier 2) and OPA Rego evaluation (Tier 4) in parallel
3	Fiscal Limit Pre-Reservation	`FiscalLimitGuard.reserve()` atomically pre-reserves the daily fiscal cap in Redis before the consensus gate
5	Consensus gate	Heterogeneous multi-model consensus required for trades ≥ $10k; 30 s timeout
6	Causal gatekeeper	SCM + `PlaceboTreatmentRefuter` (50 sims, p < 0.05, \|eff\| > 0.2) validates world-model integrity
6b	Adaptive FRIA enforcement	`FRIA_ZONE_ALLOW = 0.95`, `FRIA_ZONE_DEFER = 0.70`; scores below 0.70 hard-deny locally

The routing seal is issued only after all tiers pass. PII sanitization (pii_sanitizer.py) and confabulation scoring (confabulation_scorer.py) are separate, standalone components — PII sanitization runs on audit records immediately before WORM persistence (inside uca_logger.py), and confabulation scoring is a Langfuse observability metric — neither is a sequential tier of _run_checks().

Confabulation Risk Formula

Source: src/gateway/governance/confabulation_scorer.py

risk_score = 1.0 − confidence

Scores ≥ 0.95 pass immediately (async attestation, 0 ms overhead). Scores in [0.70, 0.95) enter the DEFER queue for synchronous blocking review. Scores < 0.70 are hard-denied without an external call.

Causal Marginal Risk Boundary

Source: src/gateway/governance/causal_gatekeeper.py

A trade action is blocked when the marginal risk expression exceeds the safety boundary:

(0.5 + estimate.value × amount) > 0.95

The PlaceboTreatmentRefuter runs 50 simulations; the causal effect is considered spurious (and the action blocked) when p ≥ 0.05 or |effect| ≤ 0.2.

Routing Seal Integrity

Source: src/gateway/governance/routing_seal.py

Every governance decision is sealed with an HMAC-SHA256 token in the format:

<expire_ts_hex>.<action_slug>.<hmac_hex>

Tokens carry a 30-second TTL. Unsigned or expired requests return HTTP 403.

Provenance Hash Chain

Source: src/gateway/governance/provenance_chain.py

SHA-256 hash chain with O(n) construction. Each node's record_hash is SHA-256(prev_hash ‖ content_json), producing a tamper-evident chain-of-custody that detects any mutation at the altered node.

Fiscal Limit Guard

Source: src/gateway/governance/fiscal_limit_guard.py

Daily cap: $500,000 over an 86,400 s rolling window
Redis WATCH/MULTI/EXEC optimistic-lock pre-reservation prevents multi-agent "race to the rail"
Exponential backoff on contention; fail-closed on Redis unavailability

STPA Unsafe Control Actions (UCAs)

Source: src/gateway/governance/ontology.py

UCA ID	Condition	Enforcement
FIN-1	`trade_value > position_limit`	OPA Rego + GeneratedSTPAValidator
FIN-2	`portfolio_concentration > 0.25`	OPA Rego + GeneratedSTPAValidator
UCA-5	`order_size > 0.1 × daily_volume`	Saga compensating node + HITL escalation
UCA-6	`order_size > fraction × daily_vol`	Saga compensating node + HITL escalation

Full STPA hazard analysis: docs/security/STPA_ANALYSIS.md

Deployment Policy

CAGE enforces strict deployment rules to ensure compliance and consistency:

🚨 Critical Rule: When deploying to Google Kubernetes Engine (GKE), ALWAYS use Cloud Build, never local Docker builds.

Why:

Platform consistency (avoids ARM64 vs AMD64 issues)
Integrated security scanning
Full audit trail for compliance
Reproducible builds

Quick Reference:

Target	Build Method	Command
GKE Production	☁️ Cloud Build	`./deploy_all.sh --target gcp-gke --env prod`
GKE Development	☁️ Cloud Build	`./deploy_all.sh --target gcp-gke --env dev --auto-approve`
Local k3d/kind	🐳 Local Docker	`./deploy_all.sh --target agnostic --env dev`
Docker Compose	🐳 Local Docker	`docker compose up`

Documentation:

Deployment Rules — Complete deployment policy
Agent Ops Architecture — Defense-in-depth governance pattern
Deployment Guide — Step-by-step procedures

Security & Compliance Status

Important

CAGE v2.1.0 has not received a NIST Authorization to Operate (ATO). The AI governance enforcement controls (NeMo Guardrails, OPA, Cloud KMS signing, HITL, STPA, heterogeneous consensus, human-gated refinement, externally reconciled CBF) are fully implemented and tested. The full NIST RMF authorization process — Security Assessment, System Security Plan, ATO letter — has not been completed. Regulated-environment deployers must conduct their own risk assessment before production use.

Compliance Framework Scope

Architecture Note: ISO 42001 is the universal baseline active in all three deployment regions. NIST SP 800-53, EU AI Act/GDPR/DORA, and MAS FEAT are jurisdictional extensions active only when CAGE_DEPLOYMENT_REGION is set to the corresponding value. See docs/JURISDICTIONAL_SEPARATION_ANALYSIS.md for the full architectural rationale.

Compliance Framework	Scope	`CAGE_DEPLOYMENT_REGION`	Status
ISO/IEC 42001:2023	Universal — all regions	All values	✅ Active
CSA AARM v1.0	Universal — all regions	All values	✅ Active
NIST SP 800-53 Rev 5	US_FED only	`US_FED`	🟡 Partial (ATO pending)
NIST AI 600-1	US_FED only	`US_FED`	✅ Implemented (phases 0–3)
FedRAMP HIGH	US_FED only	`US_FED`	🟡 Partial (ATO pending)
SR 26-2 (Federal Reserve)	US_FED only	`US_FED`	✅ Implemented
EU AI Act	EU_ECB only	`EU_ECB`	✅ Implemented
GDPR Art. 22	EU_ECB only	`EU_ECB`	✅ Implemented
DORA Art. 10/12	EU_ECB only	`EU_ECB`	✅ Implemented
MAS FEAT Principles	APAC_MAS only	`APAC_MAS`	✅ Implemented
MAS Notice 655	APAC_MAS only	`APAC_MAS`	✅ Implemented
MAS TRM §4.2/§6.3	APAC_MAS only	`APAC_MAS`	✅ Implemented

Footnote: SR 26-2 has no legal force outside the US Federal Reserve system. The EU_ECB_BASELINE.json and APAC_MAS_BASELINE.json profiles encode a "no legal force" sentinel that suppresses SR 26-2 telemetry in non-US deployments (see EU_ECB_BASELINE.json).

Operational Security Status

Domain	Status	Detail
AI governance enforcement	✅ Implemented & tested	NeMo rails, OPA circuit breaker, Cloud KMS HSM seal (production seal enforcement active — unsigned requests return 403), HITL, CBF (externally reconciled), heterogeneous consensus, PII, STPA — all fail-closed
Evidentiary independence (v2.0.0)	✅ Implemented & tested	KMS asymmetric signing, human-gated refinement, multi-model consensus — recursive self-authentication eliminated. External CBF reconciliation implemented via `reconciliation_worker.py` (POAM-023 closed 2026-07-27).
Multi-Framework automated compliance	🟡 Partial	29 Lula validation manifests across ISO 42001, NIST SP 800-53, NIST AI 600-1 (phases 0–3), EU AI Act/GDPR/DORA, MAS FEAT/Notice 655/TRM, and CSA AARM — see `compliance/lula/README.md`
NIST RMF Steps 1–4 (Prepare → Implement)	🟡 Partial (US_FED only)	SC-8 elevated to implemented; SC-7 reinforced; FIPS 199 unsigned; ATO not yet issued
NIST RMF Step 5 (Assess)	❌ Not started (US_FED only)	No Security Assessment Report; no independent assessor
NIST RMF Step 6 (Authorize)	❌ Not started (US_FED only)	No ATO letter issued
Infrastructure security	🟡 Partial	12 of 23 SP 800-53 POA&M open (8 Closed: POAM-003 AU-12, POAM-007 IA-3, POAM-010 RA-5, POAM-012 SC-12, POAM-016 SI-2, POAM-020 CM-3, POAM-021 SI-4, POAM-023 CBF reconciliation worker) — see `docs/SECURITY_STATUS.md`
PodSecurity (restricted)	✅ Implemented	`securityContext` (`runAsNonRoot`, `runAsUser: 65534`, `seccompProfile`, `allowPrivilegeEscalation: false`, `capabilities.drop: ALL`) applied to all 6 app deployment manifests (rc.3)
Intra-cluster mTLS	✅ Implemented	Linkerd mTLS: SPIFFE/SVID identity for Gateway→OPA, Gateway→NeMo (POAM-007 closed)
L7 egress boundary	✅ Implemented	Cilium CiliumNetworkPolicy: FQDN allowlist for gateway, internal-only lockdown for agent pods
CI vulnerability scanning	✅ Implemented	pip-audit, Trivy, Grype, CycloneDX SBOM in `.github/workflows/security-scan.yml` (POAM-010 closed)

See docs/SECURITY_STATUS.md for the complete posture breakdown, all open POA&M items, and pre-deployment guidance for regulated environments.

Quick Start

Prerequisites

Python ≥ 3.10, < 3.13
Docker & Docker Compose
uv (recommended) or pip; build system requires uv_build>=0.8.14

Environment Variables

Copy .env.example to .env and configure at minimum:

Variable	Description
`CAGE_DEPLOYMENT_REGION`	Deployment region baseline (`US_FED`, `EU_ECB`, `APAC_MAS`; default is `US_FED`)
`KMS_GOVERNANCE_KEY`	Cloud KMS key resource name for HSM-backed governance signing (v2.0.0)
`KMS_GOVERNANCE_PUBLIC_PEM`	Path to public key PEM for local signature verification (v2.0.0)
`GOVERNANCE_SALT`	(Legacy) HMAC salt — used as fallback when KMS is not configured
`NEMO_AUTO_APPLY_ENABLED`	Set `true` to bypass human-gated refinement (dev/CI only; default `false`)
`RECONCILIATION_PROVIDER`	Custody provider (`stub`, `gcs`, `s3` / `object-store`, `plaid`, or `anchorage`; default `stub`)
`LANGFUSE_COMPLIANCE_PUBLIC_KEY` / `_SECRET_KEY`	Keys for ISO 42001 audit Langfuse project
`REDIS_URL`	Redis connection URL (e.g. `redis://localhost:6379`)
`OPA_URL`	OPA policy engine URL (e.g. `http://localhost:8181`)
`VLLM_REASONING_API_BASE`	vLLM reasoning endpoint (also default for Risk Manager consensus persona)
`VLLM_FAST_API_BASE`	vLLM fast-path endpoint (also default for Compliance Officer consensus persona)
`CONSENSUS_RISK_MANAGER_URL`	Override vLLM endpoint for Risk Manager critic persona
`CONSENSUS_COMPLIANCE_OFFICER_URL`	Override vLLM endpoint for Compliance Officer critic persona
`CAGE_NORMATIVE_PROVIDER`	External normative provider (`static` or `trustlayers`; default `static`)
`STEP_QUOTA_MAX`	Hard step-count limit per agent session for Token Quota Proxy (default: `12`)
`TOKEN_QUOTA_MAX`	Hard token limit per agent session for Token Quota Proxy (default: `100000`)
`SESSION_TTL_SECONDS`	Redis key TTL for Token Quota Proxy session counters in seconds (default: `3600`)
`OSCAL_S3_BUCKET_US_FED`	WORM bucket for UCA records in US_FED region (used by UCA Logger)
`OSCAL_S3_BUCKET_EU_ECB`	WORM bucket for UCA records in EU_ECB region (europe-west1; used by UCA Logger)
`OSCAL_S3_BUCKET_APAC_MAS`	WORM bucket for UCA records in APAC_MAS region (asia-southeast1; used by UCA Logger)
`CAGE_ENV`	Set to `test` to enable HMAC-SHA256 stub signing in UCA Logger (suppresses KMS requirement)

Local Development

# Clone
git clone https://github.com/google/cybernetic-agent-governance-engine.git
cd cybernetic-agent-governance-engine

# Install dependencies
uv sync --group dev

# Configure environment
cp .env.example .env

# Start infrastructure (deploys to an existing local k3s/kind cluster)
./deploy_all.sh --target agnostic --env dev

# Or start services locally with Docker Compose
docker compose up

# Verify gateway health
curl http://localhost:8080/health

Local Development Overlay

For local development with hot-reload and relaxed resource limits, use the dev overlay:

docker compose -f docker-compose.yml -f docker-compose.dev.yml up

⚠️ Do not use docker-compose.dev.yml in staging or production. It disables production-grade resource constraints and is intended for local development only.

Run Tests

bash setup_test_env.sh && python -m pytest tests/   # 1,509 unit tests passing, 0 failed (161 skipped); 1,622 integration passing, 0 failed (48 skipped — v2.1.1 2026-07-30)

Project Structure

cybernetic-agent-governance-engine/
├── src/
│   ├── gateway/
│   │   ├── governance/               # SymbolicGovernor, STPAValidator, NeMo manager
│   │   │   ├── kms_signer.py         # v2.0.0: Cloud KMS HSM-backed governance signer
│   │   │   ├── consensus.py          # v2.0.0: ConsensusModelRegistry + heterogeneous consensus
│   │   │   ├── normative_provider.py  # v2.0.0: External Normative Provider + Adaptive Gating Primitive
│   │   │   ├── stpa_compiler.py      # STPA-to-Policy compiler CLI (OPA/NeMo/Python/LangGraph)
│   │   │   ├── oscal_ssp_exporter.py # Automated OSCAL SSP patcher
│   │   │   ├── generated_stpa_validator.py  # Auto-generated from YAML
│   │   │   ├── generated_saga_nodes.py      # Auto-generated LangGraph Saga nodes
│   │   │   ├── fiscal_limit_guard.py        # Redis pre-reservation guard
│   │   │   ├── token_quota_proxy.py  # CTRL_TQP_007: per-session step/token quota circuit breaker (ISO 42001 A.4)
│   │   │   ├── pii_sanitizer.py      # Pre-ledger PII sanitization pipeline (ISO 42001 A.6)
│   │   │   └── uca_logger.py         # ISO 42001 Clause 6.1 UCA record builder, KMS signer, WORM persister
│   │   └── server/                   # MCP tool server + inference proxy
│   ├── governed_financial_advisor/
│   │   ├── graph/
│   │   │   └── state.py              # AgentState + LedgerEntry WAL schema
│   │   └── utils/
│   │       └── langfuse_utils.py     # SagaCallbackHandler OTel interceptor
│   ├── compliance_bridge/            # OSCAL audit ingest + SSE event bus
│   │   ├── context_accumulator.py    # AARM-V1: SHA-256 hash-chained Context Accumulator
│   │   ├── aarm_mapper.py            # AARM 11-vector static threat ledger
│   │   ├── aarm_report_generator.py  # vLLM narrative enrichment (Semaphore(3))
│   │   └── audit_workflow.py         # 6-step compliance pipeline (upgraded from 5-step)
│   ├── gateway/
│   │   └── governance/
│   │       ├── defer_queue.py        # AARM-V7: Redis DEFER state machine (db=1, noeviction)
│   │       └── ...                   # SymbolicGovernor, STPAValidator, NeMo manager
│   ├── integrations/                 # v2.0.0: Vendor-isolated third-party adapters
│   │   ├── nexart/                   # NexArt SDK attestation adapter + provider
│   │   └── trustlayers/              # TrustLayers normative provider adapter
│   └── agentsight-ui/                # React/TypeScript operator dashboard
├── config/
│   ├── stpa_control_structure.yaml   # Single source of truth for all STPA UCAs
│   ├── governance_thresholds.json    # All numeric thresholds (THRESHOLDS singleton)
│   ├── compliance/                   # v2.0.0: Regional control-mapping JSON profiles
│   │   ├── US_FED_BASELINE.json      #   SR 26-2 / NIST AI RMF / ISO 42001
│   │   ├── EU_ECB_BASELINE.json      #   EU AI Act / DORA / GDPR / EBA
│   │   ├── APAC_MAS_BASELINE.json    #   MAS FEAT / MAS TRM / ISO 42001
│   │   └── reconciliation_worker.py  # External ledger reconciliation daemon: Stub/GCS/S3(ObjectStore)/Plaid/Anchorage providers
│   ├── thresholds/                   # v2.0.0: Regionalized numeric threshold profiles
│   │   ├── US_FED_BASELINE.json
│   │   ├── EU_ECB_BASELINE.json
│   │   └── APAC_MAS_BASELINE.json
│   ├── oscal/framework_mappings/     # v2.0.0: OSCAL exporter UCA routing tables (FrameworkRouter)
│   │   ├── NIST_SP800_53.json
│   │   ├── ISO_42001.json
│   │   ├── EU_AI_ACT.json
│   │   └── MAS_FEAT.json
│   ├── opa/                          # Generated OPA Rego policies
│   └── rails/                        # NeMo Guardrails Colang 2.x definitions
├── deployment/k8s/
│   ├── linkerd-mtls-policy.yaml      # Z3N: Linkerd Server/AuthorizationPolicy/MeshTLSAuthentication
│   └── cilium-egress-lockdown.yaml   # Z3N: Cilium L7 FQDN egress lockdown
├── examples/
│   ├── chaos_agent_playground.py     # Scenarios A–E: adversarial governance + Saga chaos tests
│   ├── governance_demo.py            # 3-act Governance-as-Code walkthrough
│   ├── telemetry.py                  # SHA-256 evidence chain + view-access audit log
│   └── evidence/                     # Generated NDJSON evidence chain (gitignored)
├── compliance/oscal/
│   ├── system-security-plan.yaml     # 1,151-line hand-authored OSCAL SSP (patched by exporter)
│   └── component-definition.yaml    # OSCAL component registry
├── tests/
│   ├── test_context_accumulator.py   # 15 tests: chain integrity, tamper detection
│   ├── test_defer_queue.py           # hermetic fakeredis DeferQueue tests
│   ├── test_aarm_mapper.py           # 11-vector ledger, NEUTRALIZED/PARTIAL/EXPOSED scoring
│   ├── test_compliance_bridge_integration.py  # 104 live GKE integration tests (Groups 1–17)
│   ├── test_stpa_compiler.py         # 33 compiler tests
│   ├── test_fiscal_limit_guard.py    # 16 multi-agent collision tests
│   └── ...                           # Full test suite
├── docs/                             # Architecture, compliance, and operational docs
└── pyproject.toml                    # Project metadata and dependencies

Documentation

Document	Description
`COMPLIANCE.md`	Core Compliance Posture & Framework Mapping (SR 26-2, ISO 42001, DORA)
`docs/governance/GOVERNANCE_OVERVIEW.md`	Detailed 7-Tier Symbolic Governor & Decoupled Architecture Spec
`docs/AUDIT_LOG_SCHEMA.md`	`cage-intent/1.0` & `cage-view-access/1.0` schema reference — hash-chain mechanics, all fields, regulatory mapping (MiFID II Art. 25 / GDPR Art. 30 / ISO 42001 A.8.4)
`docs/SECURITY_STATUS.md`	Security posture, NIST RMF status, open POA&M items
`docs/POAM_INDEX.md`	POA&M Master Index — cross-region traceability matrix (38 items)
`docs/POAM_ISO42001.md`	POA&M — ISO 42001 universal AIMS weaknesses (all regions, 6 items)
`docs/POAM_US_FED.md`	POA&M — US_FED NIST SP 800-53 / ATO track (23 items; 6 closed)
`docs/POAM_EU_ECB.md`	POA&M — EU_ECB EU AI Act / DORA / GDPR (5 items)
`docs/POAM_APAC_MAS.md`	POA&M — APAC_MAS MAS FEAT / Notice 655 / TRM (4 items)
`docs/GATEWAY_ARCHITECTURE.md`	Gateway subsystem detail
`docs/NEURO_SYMBOLIC_GOVERNANCE.md`	Neuro-symbolic governance design
`docs/STPA_ANALYSIS.md`	STPA hazard assessment — UCAs 1–9, Saga pattern, FiscalLimitGuard
`tests/`	Automated unit, integration, and red-team test suites
`examples/README.md`	Chaos Agent Playground & Governance 3-Act Demo
`deployment/k8s/K8S_SECURITY_HARDENING.md`	Pod Security Standards, network policy topology, Z3N verification
`docs/technical-report/`	10-document technical report series
`infra/DEPLOYMENT_GUIDE.md`	Step-by-step infrastructure deployment guide

Dependencies

All third-party dependencies are accessed via standard package management. Key libraries:

Library	License	Purpose
NVIDIA NeMo Guardrails	Apache 2.0	Runtime LLM rail enforcement
LangGraph	MIT	Stateful agentic workflow orchestration
Open Policy Agent	Apache 2.0	Policy-as-code governance evaluation
Presidio	MIT	PII detection and anonymization
LangChain	MIT	LLM integration and tool orchestration
DoWhy	MIT	Causal inference for world-model validation
redis-py	MIT	Redis client for FiscalLimitGuard + CBF state
fakeredis	BSD-3	In-memory Redis emulator for unit tests
google-adk	Apache 2.0	Google Agent Development Kit (advisor extras, ≥1.28.1)

Removed packages: outlines was removed in v2.0.0 due to CVE-2025-69872 (critical severity). Structured-output generation previously provided by outlines is now handled via vLLM's native JSON-mode API.

Full license inventory: THIRD_PARTY_NOTICES.md

What's New in v2.0.0

Release date: 2026-06-08 — Stable release: Token Quota Proxy, PII Sanitizer, UCA Logger, gateway CVE remediation, seal enforcement verification, all universal Lula assertions PASS

See What's New in v2.1.1 above for the latest additions.

Bug Fixes

fix(governance): GeneratedSTPAValidator.validate() missing method — Call-sites that invoke .validate() directly on GeneratedSTPAValidator (e.g. opa_node_factory safety check) raised AttributeError because only validate_generated() existed. Added validate() as a public entry-point that delegates to validate_generated(), making GeneratedSTPAValidator a drop-in replacement for the deprecated STPAValidator shim. Verified: test_senior_trade_below_500k_approved_by_opa PASSED on live GKE cluster under EU_ECB posture (Cloud Build sha256:1849f966).
fix(gateway): Production seal enforcement activated (D-04) — GOVERNANCE_SALT is now sourced from advisor-secrets K8s Secret rather than an env override. Unsigned requests now return HTTP 403. Added trivy-egress-policy.yaml for security scanner egress. Fixed sbom-cronjob.yaml secretRef → secretKeyRef. Fixed test_kms_signer_security.py to remove stale legacy_salt param (HMAC fallback removed in D-01 remediation; tests now assert RuntimeError). Fixed test_langfuse_smoke.py to skip on ReadTimeout when port-forward is absent.
fix(infra): P0 blocker remediation (D-01, D-02, D-04, D-06, D-07) — PodSecurity restricted-compliant securityContext applied to all 6 app deployment manifests (runAsNonRoot, runAsUser: 65534, seccompProfile: RuntimeDefault, allowPrivilegeEscalation: false, capabilities.drop: ALL). Security-scan CronJob deployed (closes D-06 / POAM-010 RA-5 dependency). PSA labels applied via Terraform (enable_pod_security_standards=true). GOVERNANCE_SALT moved to secretKeyRef in live_deployment.yaml.
fix: CI failures resolved — STPA freshness check now passes after re-running the STPA compiler. License headers added to src/integrations/nexart/tests/__init__.py, src/gateway/protos/nemo_pb2.py, and src/gateway/protos/nemo_pb2_grpc.py. CI workflow branch triggers corrected (main → rc-v2.0.0).
fix(infra): Lula-audit CronJob self-perpetuating failure resolved — Stale Job deletion logic corrected; lula-sc4-watch patched to lula:0.9.5 (resolves ImagePullBackOff). Dockerfile.lula rewritten as multi-stage go-build from source (v0.9.5). scripts/build_images.sh fixed: SHORT_SHA substitution added for vllm-streamer build.
Six runtime fixes applied: getpwuid env vars, quantization flags, GCSFuse annotation, nginx emptyDir, LANGFUSE_BASIC_AUTH_HEADER header propagation.

CI & Developer Experience

Git workflow standards — Added docs/GIT_WORKFLOW_STANDARDS.md, .github/pull_request_template.md, and scripts/setup_git_hooks.sh. Commit message convention enforced via .gitmessage template and pre-commit hook.
.gitignore hardening — terraform.auto.tfvars, temp_test/, test result artifacts (test_results_*.txt, junit*.xml, coverage.xml, .coverage, htmlcov/) excluded.
Stale temp_test/ directory removed — Byte-for-byte duplicates of canonical proto files at src/gateway/protos/ removed from index and disk.

Test Results (v2.0.0 stable — 2026-06-08, cluster: )

Suite	Passed	Failed	Notes
Full suite (`uv run pytest tests/ --run-integration`)	796	0	148 skipped — 0 regressions (Track D 2026-06-08, cluster: )

Note: An earlier rc.2 run recorded 844 passes against a stable port-forward session. The v2.0.0 stable count of 796 reflects the rc.3 run against a freshly restarted cluster; the 25 Langfuse port-forward timeout failures from that session were resolved before the stable tag was applied (2026-06-08). No governance logic regressions.

POAM Status (v2.0.0)

Metric	Count	Notes
Total Items (all files)	47	23 SP 800-53 + 7 AI 600-1 + 8 ISO 42001 + 3 EU_ECB + 3 APAC_MAS + 3 other
Closed (SP 800-53)	7	POAM-003 AU-12, POAM-007 IA-3, POAM-010 RA-5, POAM-012 SC-12, POAM-016 SI-2, POAM-020 CM-3, POAM-021 SI-4
Open (SP 800-53)	12	Includes POAM-023 SI-2 CVE-2025-13462 (opened 2026-06-08)
In Progress (SP 800-53)	4
AI 600-1 Items	7	All Open — see `docs/POAM_US_FED.md` §NIST AI 600-1
ISO 42001 Universal	8	All Open — see `docs/POAM_ISO42001.md`
EU_ECB / APAC_MAS	6	All Open — see `docs/POAM_EU_ECB.md`, `docs/POAM_APAC_MAS.md`

See docs/POAM_INDEX.md for the full cross-region traceability matrix.

Contributing

We welcome contributions! Please read CONTRIBUTING.md for:

Dev environment setup (Python, uv, Docker Compose)
Branch naming and commit message conventions
Pull request process and review requirements
Code style (ruff, mypy, ESLint)
Contributor License Agreement (CLA) requirements

To report a security vulnerability, see SECURITY.md.

To report a bug or request a feature, use GitHub Issues.

License

Apache 2.0 — see LICENSE

This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program.

By participating in this project, you agree to abide by the CODE_OF_CONDUCT.md.

CAGE v2.0.0 — 2026-06-08 — Stable Release: Token Quota Proxy, PII Sanitizer, UCA Logger, CTRL_TQP_007, gateway CVE remediation, seal enforcement verification

Name		Name	Last commit message	Last commit date
Latest commit History 289 Commits
.agents		.agents
.github		.github
.roo		.roo
assets		assets
compliance		compliance
config		config
deployment		deployment
docs		docs
examples		examples
infra		infra
mcp-servers/infrastructure		mcp-servers/infrastructure
proof		proof
scripts		scripts
src		src
tests		tests
third_party/no-direct-bind		third_party/no-direct-bind
.coveragerc		.coveragerc
.dockerignore		.dockerignore
.env.example		.env.example
.gitignore		.gitignore
.gitmessage		.gitmessage
.trivyignore		.trivyignore
AGENTS.md		AGENTS.md
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
COMPLIANCE.md		COMPLIANCE.md
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile		Dockerfile
LICENSE		LICENSE
Makefile		Makefile
NOTICE		NOTICE
README.md		README.md
SECURITY.md		SECURITY.md
SUPPORT.md		SUPPORT.md
THIRD_PARTY_NOTICES.md		THIRD_PARTY_NOTICES.md
coverage.json		coverage.json
deploy_all.sh		deploy_all.sh
docker-compose.dev.yml		docker-compose.dev.yml
docker-compose.yml		docker-compose.yml
pyproject.toml		pyproject.toml
pytest.ini		pytest.ini
uv.lock		uv.lock

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

Cybernetic Agent Governance Engine (CAGE)

What's New in v2.1.1

What's New in v2.1.0

New Capabilities

Test Status

Platform Compatibility

Optional GCP Integrations

The CAGE Product Offering

Architecture Overview

Key Features

Mathematical Foundations & Formal Safety Guarantees

Control Barrier Function (CBF)

8-Tier Symbolic Governor Pipeline

Confabulation Risk Formula

Causal Marginal Risk Boundary

Routing Seal Integrity

Provenance Hash Chain

Fiscal Limit Guard

STPA Unsafe Control Actions (UCAs)

Deployment Policy

Security & Compliance Status

Compliance Framework Scope

Operational Security Status

Quick Start

Prerequisites

Environment Variables

Local Development

Local Development Overlay

Run Tests

Project Structure

Documentation

Dependencies

What's New in v2.0.0

Bug Fixes

CI & Developer Experience

Test Results (v2.0.0 stable — 2026-06-08, cluster: )

POAM Status (v2.0.0)

Contributing

License

About

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages