29-pact — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 29-pact (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick reference for PACT organizational governance patterns.
Use PACT when asking about governance, D/T/R, operating envelope, knowledge clearance, verification gradient, GovernanceEngine, PactGovernedAgent, access enforcement, organizational governance, PACT, governed agent, clearance, bridges, KSP, monotonic tightening, MCP governance, McpGovernanceEnforcer, McpGovernanceMiddleware, McpAuditTrail, McpToolPolicy, MCP tool policy, default-deny MCP, or governed MCP tools.
pip install kailash-pact # Governance framework
pip install kailash>=2.0.0 # Core SDK with trust subsystem
pip install kailash-kaizen>=2.0.0 # For governed Kaizen agents| Skill | Use When |
|---|---|
| pact-quickstart | Getting started, first GovernanceEngine |
| pact-governance-engine | Engine API, verify_action, compute_envelope |
| pact-dtr-addressing | D/T/R grammar, Address parsing |
| pact-envelopes | Three-layer model, monotonic tightening |
| pact-access-enforcement | 5-step algorithm, clearance, bridges, KSPs |
| pact-governed-agents | PactGovernedAgent, @governed_tool |
| pact-kaizen-integration | Wrapping Kaizen agents with governance |
| pact-mcp-governance | MCP tool governance: enforce, audit, middleware |
| pact-enforcement-modes | ENFORCE/SHADOW/DISABLED modes, HELD verdict handling, envelope adapter |
| pact-conformance-features | N1-N6: KnowledgeFilter, EnvelopeCache, PlanSuspension, AuditTiers, ObservationSink, cross-SDK vectors |
from pact.governance import GovernanceEngine, GovernanceVerdict
from kailash.trust.pact.config import (
ConstraintEnvelopeConfig, OrgDefinition,
TrustPostureLevel, VerificationLevel,
ConfidentialityLevel,
)
from kailash.trust.pact.agent import PactGovernedAgent
from kailash.trust.pact.audit import AuditChain
# MCP governance
from pact.mcp import (
McpGovernanceEnforcer, McpGovernanceMiddleware, McpAuditTrail,
McpToolPolicy, McpGovernanceConfig, McpActionContext,
)Five canonical posture levels with autonomy gradient:
| Canonical | Autonomy | Ceiling | Old Name (alias) |
|---|---|---|---|
| PSEUDO | 1 | PUBLIC | PSEUDO_AGENT |
| TOOL | 2 | RESTRICTED | _(new, no old)_ |
| SUPERVISED | 3 | CONFIDENTIAL | SHARED_PLANNING |
| DELEGATING | 4 | SECRET | CONTINUOUS_INSIGHT |
| AUTONOMOUS | 5 | TOP_SECRET | DELEGATED |
Old names work as enum aliases (TrustPostureLevel.PSEUDO_AGENT resolves to PSEUDO). String deserialization of old values is handled by _missing_().
See .claude/rules/pact-governance.md for security invariants.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.