{
  "markdown": "# Pramagent\n\n[![PyPI version](https://img.shields.io/pypi/v/pramagent.svg)](https://pypi.org/project/pramagent/)\n[![PyPI Downloads](https://static.pepy.tech/personalized-badge/pramagent?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=GREEN&left_text=downloads)](https://pepy.tech/projects/pramagent)\n[![Python versions](https://img.shields.io/pypi/pyversions/pramagent.svg)](https://pypi.org/project/pramagent/)\n[![License](https://img.shields.io/pypi/l/pramagent.svg)](https://github.com/sriram7737/pramagent/blob/main/LICENSE)\n[![CI](https://github.com/sriram7737/pramagent/actions/workflows/tests.yml/badge.svg)](https://github.com/sriram7737/pramagent/actions/workflows/tests.yml)\n[![Google Gemini Cookbook](https://img.shields.io/badge/Google%20Gemini%20Cookbook-merged-4285F4)](https://github.com/google-gemini/cookbook/blob/main/examples/Pramagent_trust_layer_for_gemini.ipynb)\n[![LangChain Docs](https://img.shields.io/badge/LangChain%20Docs-merged-1C3C3C)](https://github.com/langchain-ai/docs/pull/4806)\n\nTrust middleware for LLM agents: deterministic tool policy, HITL approvals,\nand tamper-evident audit traces. **Alpha** - read the\n[implementation status](https://github.com/sriram7737/pramagent/blob/main/docs/IMPLEMENTATION_STATUS.md)\nbefore customer-facing pilots.\n\nPramagent is listed in the\n[Google Gemini Cookbook examples index](https://github.com/google-gemini/cookbook/blob/main/examples/README.md)\nand included as the\n[Pramagent trust layer for Gemini agents notebook](https://github.com/google-gemini/cookbook/blob/main/examples/Pramagent_trust_layer_for_gemini.ipynb).\nThe contribution was merged in\n[google-gemini/cookbook#1269](https://github.com/google-gemini/cookbook/pull/1269)\non July 29, 2026.\n\nPramagent is also listed in the\n[LangChain docs integrations index](https://github.com/langchain-ai/docs/blob/main/src/oss/python/integrations/providers/all_providers.mdx)\nas an external `ToolGuardLayer` integration for LangGraph tool calls. The\ncontribution was merged in\n[langchain-ai/docs#4806](https://github.com/langchain-ai/docs/pull/4806)\non August 11, 2026.\n\nThe wedge is narrow by design: Pramagent does not prevent your model from being\nwrong; it prevents your model from doing damage when it is wrong.\n\n![Pramagent trust stack](https://raw.githubusercontent.com/sriram7737/pramagent/main/docs/stack.png)\n\nPramagent wraps OpenAI, Anthropic, Gemini, Ollama, local, and\nOpenAI-compatible providers with guardrails that run outside the model. The\nmost differentiated layer is ToolGuard: deterministic tool validation with JSON\nSchema, tenant/action allow-lists, side-effect taxonomy, dangerous-chain\ndetection, output scanning, and HITL escalation. The current package also\nships curated safety rule corpora, persistent HITL queues, thin adapters for\npopular agent frameworks, compliance evidence generation, and trace-local\nself-assessed control indicators mapped to DeepMind/AWS-style vocabulary. It also includes an\noptional agent-memory integrity contract, structured decision-rationale schema,\nand a human-labeled overreach corpus for measuring valid-goal overreach.\n\n## What it's ready for (and what it isn't)\n\nPramagent is an honest alpha. The core trust pipeline is real and tested; the\ngaps are around it. Use this to decide whether it fits your use case.\n\n**Ready for today:**\n\n- Developer evaluation and integration against the SDK and FastAPI sidecar\n- Single-tenant or trusted-network pilots **with a persistent store configured**\n  (`PRAMAGENT_POSTGRES_DSN` or `PRAMAGENT_DB`) — the API refuses to boot on\n  volatile memory unless you explicitly opt in\n- Design-partner deployments where you control the network boundary\n- Generating compliance *evidence* (control mappings, not certifications)\n\n**Not ready for yet — do not claim:**\n\n- Production banking / healthcare or other regulated environments\n- Multi-tenant SaaS at scale (no published HA/soak evidence, no backup/DR runbook,\n  no SLA)\n- Prompt-injection *immunity*, *certified* GDPR/SOC 2/HIPAA compliance, or\n  third-party-validated safety — none of these have been externally assessed\n\n**What backs this:** 720 passing integration-first tests across Python\n3.10–3.13, CI security scanning (Bandit, Semgrep, authenticated OWASP ZAP), and\nthree prior engineering audits whose release-blocking findings are remediated\nand verified in the current source. Those audit reports are kept in the repo\n**with remediation banners** so you can read both the original findings and\ntheir fixes — see\n[Full audit](https://github.com/sriram7737/pramagent/blob/main/docs/audits/pramagent_full_audit.md)\nand [Enterprise review](https://github.com/sriram7737/pramagent/blob/main/docs/audits/pramagent_enterprise_audit.md).\n\n## Alpha Maturity Notice\n\nPramagent is published as **Alpha software**. It has live smoke-test evidence\nfor Sepolia anchoring, S3 cold archive, local load testing, real OpenAI/Ollama\nprovider calls, and bundled red-team runs, but it has **not** passed an\nexternal penetration test, SOC 2 audit, HIPAA assessment, or\nregulated-production certification.\n\nDo not treat Pramagent as bank-grade or healthcare-grade security\ninfrastructure. Do not claim prompt-injection immunity, production compliance,\nor third-party-validated safety from the bundled benchmarks alone. Read\n[Implementation status](https://github.com/sriram7737/pramagent/blob/main/docs/IMPLEMENTATION_STATUS.md),\n[Live test results](https://github.com/sriram7737/pramagent/blob/main/docs/LIVE_TEST_RESULTS.md), and\n[Hardening guide](https://github.com/sriram7737/pramagent/blob/main/docs/HARDENING_GUIDE.md)\nbefore using it in a customer-facing pilot.\nThe June 11 active security prompt results are tracked in\n[Security test results](https://github.com/sriram7737/pramagent/blob/main/docs/audits/pramagent_security_test_results.md).\nThe self-assessed DeepMind/AWS agent-security mapping is tracked in\n[Conformance map](https://github.com/sriram7737/pramagent/blob/main/docs/CONFORMANCE.md).\nDeferred controls and the reasoning behind them are tracked in\n[Design decisions](https://github.com/sriram7737/pramagent/blob/main/docs/DESIGN_DECISIONS.md).\nThe YC/product-readiness gap list and commercial hardening roadmap are tracked\nin [Enterprise readiness roadmap](https://github.com/sriram7737/pramagent/blob/main/docs/ENTERPRISE_READINESS_ROADMAP.md).\n\n**Start here:** [Getting Started With Pramagent](https://github.com/sriram7737/pramagent/blob/main/docs/GETTING_STARTED.md)\nwalks from install to provider setup, agent wrapping, ToolGuard, HITL, trace\nstorage, dashboard/API, and real workflow demos.\n\n**Try the public demo:** run the API and open `/demo`. The front-door scenario\nis financial tool-calling safety: a payment-like action is held for HITL before\nany provider call and sealed into a verifiable trace. No provider key is needed\nfor that zero-config path. Visitors can optionally enter an NVIDIA NIM\n`nvapi-*` key, OpenAI `sk-*` key, or Gemini API Studio key for live model\nanswers; keys are used for that request only and never persisted.\n\nOne-command local demo:\n\n```bash\npip install \"pramagent[api]\"\npramagent demo\n# open http://127.0.0.1:8080/demo\n```\n\n## Bare Install Quickstart\n\nThis works with the base package only. No Docker, API server, or provider key is\nrequired.\n\n```bash\npip install pramagent\n```\n\n### Google Gemini Cookbook Recipe\n\nThe merged recipe appears in the\n[Google Gemini Cookbook examples index](https://github.com/google-gemini/cookbook/blob/main/examples/README.md)\nas \"Pramagent trust layer for Gemini agents\" and links to the direct\n[notebook in `examples/`](https://github.com/google-gemini/cookbook/blob/main/examples/Pramagent_trust_layer_for_gemini.ipynb).\nIt is pinned to `pramagent==0.8.5` for reproducibility. That notebook should\nkeep using the stable `0.8.5` baseline even as newer Pramagent releases ship\nadditional hardening and coding-agent hook support. For the latest package in\nnew projects, install or upgrade normally:\n\n```bash\npip install -U pramagent\n```\n\nOnly update the Cookbook pin for a security fix, a breakage fix, or a\nsubstantial recipe revision.\n\n### LangChain Docs Integration\n\nThe merged LangChain docs entry appears in the\n[LangChain integrations index](https://github.com/langchain-ai/docs/blob/main/src/oss/python/integrations/providers/all_providers.mdx)\nas \"Pramagent\" and in the generated tools/downloads table as\n[`ToolGuardLayer`](https://github.com/sriram7737/pramagent). The contribution\nwas merged in\n[langchain-ai/docs#4806](https://github.com/langchain-ai/docs/pull/4806)\non August 11, 2026.\n\nFor LangGraph users, start with the repo-hosted\n[Pramagent with LangGraph guide](https://github.com/sriram7737/pramagent/blob/main/docs/integrations/langgraph.md),\nwhich shows deterministic `ToolGuardLayer` checks before LangGraph tool\nexecution.\n\n```python\nimport asyncio\nfrom pramagent import Pramagent\n\nasync def main():\n    resp = await Pramagent().run(\"Summarize this request\", tenant_id=\"demo\", session_id=\"s1\")\n    print(resp.output)\nprint(resp.trace.this_hash)\nprint(resp.trace.detection_tier, resp.trace.response_tier)  # trace-local indicators\n\nasyncio.run(main())\n```\n\n![Pramagent bare-install terminal quickstart](https://raw.githubusercontent.com/sriram7737/pramagent/main/docs/quickstart-terminal.png)\n\nThat creates a tamper-evident trace using the deterministic mock provider.\n\nSwap to a real OpenAI model by setting `OPENAI_API_KEY`:\n\n```python\nfrom pramagent import Pramagent\nfrom pramagent.providers import OpenAIProvider\n\narmor = Pramagent(provider=OpenAIProvider(model=\"gpt-4o-mini\"))\n```\n\nRun against NVIDIA NIM with an `nvapi-*` key:\n\n```python\nfrom pramagent import Pramagent\nfrom pramagent.providers import NvidiaProvider\n\narmor = Pramagent(provider=NvidiaProvider(model=\"meta/llama-3.3-70b-instruct\"))\n```\n\n## Frequently Asked Questions\n\n**How do I add safety guardrails to an LLM agent?**  \nInstall Pramagent and wrap your agent call with the trust stack. Pramagent\nenforces deterministic policy outside the model, so the LLM cannot override the\ntool policy, HITL gate, or audit chain by changing its own text output.\n\n**How do I audit AI agent decisions in production?**  \nEvery Pramagent call produces a hash-chained `TraceEvent` with layer decisions,\nverdicts, provider metadata, PII redactions, HITL status, and `this_hash` /\n`prev_hash`. New traces also include `aws_scope`, `detection_tier`,\n`response_tier`, `attack_techniques`, and `conformance_metrics` so the same\nevidence can be read through DeepMind/AWS-style agent-security vocabulary. These\nfields are trace-local self-assessment metadata, not system-level conformance\nor certification claims. The local chain can be verified and optionally anchored\nexternally.\n\n**How do I declare AWS agent autonomy scope?**\nPass `agent_scope=\"scope_1\"`, `\"scope_2\"`, or `\"scope_3\"` to `Pramagent`, or\nset `PRAMAGENT_AGENT_SCOPE` for the API sidecar. Scope 1 blocks non-read side\neffects. Scope 2 requires human approval for non-read tools even if a policy\nwas accidentally configured as `ALLOW`. Scope 3 records bounded-autonomy intent\nand relies on your configured ToolGuard/HITL/rate-limit policies.\n\n**How do I prevent prompt injection in a Python LLM agent?**  \n`IsolationLayer` is a content-boundary layer: it scans inputs before the model\nsees them, enforces size caps, and scopes optional memory by tenant/session. It\ndoes not sandbox processes, networks, credentials, tools, or files. It covers known\ninstruction overrides, chat-template wrapper attacks, authority framing,\nbase64/hex/unicode-escape encoded payloads, and targeted multilingual override\nphrases. v0.8.0 adds structured classifier verdicts, held-out PINT/TensorTrust\nstyle fixtures, provenance-aware stricter scanning for tool output and\nretrieved content, and optional `pramagent[ml]` embedding/DeBERTa layers. This\nis defense-in-depth, not proof of prompt-injection immunity.\n\n**How do I stop unsafe model output from reaching users?**  \n`OutputJudgeLayer` runs an LLM-as-judge on every output before it returns — the\n\"is the OUTPUT safe?\" check that regex cannot give. It catches semantic failures\ndeterministic rules miss (working malware, bypass walkthroughs, confirmed\ndestructive actions, leaked internals). On by default in the public demo, opt-in\nfor `/v1/run` (`PRAMAGENT_OUTPUT_JUDGE=1`). It is fail-closed, but it is itself a\nmodel — strong defense-in-depth, not a guarantee.\n\n**How do I stop unsafe tool calls from an AI agent?**  \nUse `ToolGuardLayer` with `ToolPolicy`. Pramagent validates JSON Schema,\ntenant/action allow-lists, side-effect class, call frequency, argument\ninjection, and dangerous chains before any side effect can execute.\n\n**Can I trial policies without breaking production workflows?**\nYes. Construct `Pramagent(enforcement_mode=\"observe\")` or set\n`PRAMAGENT_ENFORCEMENT_MODE=observe` for the API sidecar. Observe mode records\n`trace.would_block=True`, `trace.would_block_reason`, and a `*.observe`\nLayerEvent, but lets Safety/ToolGuard/Scope policy decisions continue so teams\ncan tune policies. Consent, size caps, and injection isolation still fail\nclosed.\n\n**Can security teams review policies without editing Python?**\nYes. `pramagent.policies.load_tool_guard(\"policies.json\")` loads ToolPolicy\ndefinitions from JSON, and YAML is supported with `pip install pyyaml` or\n`pramagent[policy]`. `pramagent backtest policies.json --cases cases.jsonl`\nruns proposed policy changes against explicit tool-call cases and exits\nnonzero on expected-verdict mismatches.\n\n**How do I add human approval to AI agent actions?**  \nUse `HITLLayer` or a ToolGuard policy with `Verdict.ESCALATE`. Silence is never\nconsent: if approval does not arrive, the action remains unexecuted.\n\n**Does Pramagent work with OpenAI, Anthropic, Gemini, Ollama, and local models?**  \nYes. Pramagent ships provider adapters for OpenAI, Anthropic, Gemini, Ollama,\nNVIDIA NIM, and OpenAI-compatible local endpoints, plus a deterministic mock\nprovider for tests.\n\n**Is Pramagent compliant with SOC 2, HIPAA, or the EU AI Act?**  \nNo. Pramagent includes compliance evidence mapping and tamper-evident logging\nfeatures that can support an assessment, but it has not passed SOC 2, HIPAA, EU\nAI Act conformity assessment, or an external penetration test.\n\n## API And Dashboard Install\n\n```bash\npip install \"pramagent[api,dashboard,redis,postgres]\"\n```\n\nFrom source:\n\n```bash\ngit clone git@github.com:sriram7737/pramagent.git\ncd Pramagent\npip install -e \".[dev,api,redis,postgres,dashboard]\"\n```\n\n## CLI And Docker Quickstart\n\n```bash\npramagent init\npramagent validate\n```\n\nRun the local stack:\n\n```bash\ncp .env.example .env\ndocker compose up -d\n```\n\nOpen:\n\n- API docs: `http://localhost:8080/docs`\n- Dashboard: `http://localhost:8501`\n\n## Public Live Demo\n\nThe API serves a single-page product demo at `/demo`. It is enabled by default\nso a new evaluator reaches the trust-stack proof immediately; set\n`PRAMAGENT_DEMO_ENABLED=false` for API-only deployments.\n\n```bash\npip install \"pramagent[api]\"\npramagent demo\n```\n\n`pramagent demo` sets demo-safe local defaults in that process:\n`PRAMAGENT_DEMO_ENABLED=true`, `PRAMAGENT_ALLOW_MEMORY_STORE=1`, and\n`PRAMAGENT_PROVIDER=mock`.\n\nThe first scenario needs no provider key: it routes a financial transfer\nrequest through deterministic policy, pauses it at HITL, and returns the trace\nplus `this_hash` / `prev_hash`. This is the five-minute wedge: financial\nside-effect safety before the model is trusted.\n\nThe same page includes a read-only quantum evidence band backed by completed\nphysical IBM Quantum job `dajho5hhvn6c73cueht0`. It shows the backend, physical\nlayout, observed shots and counts, correlation, QPU usage, layout-policy proxy,\nand execution-evidence hash. The public endpoint never receives IBM\ncredentials or submits paid hardware work. The displayed run is real hardware\nevidence, while its original local audit capture is explicitly labeled as an\nunkeyed test chain; new local runs use a separate versioned quantum signing\nring.\n\nVisitors can optionally bring a provider key on each run: `nvapi-*` for NVIDIA\nNIM models, `sk-*` / `sk-proj-*` for OpenAI `gpt-4o-mini`, or an AI Studio\nGemini key for `gemini-2.5-flash`. Pramagent uses that key only for the current\nprovider call; it is not written to traces, logs, stores, usage records, or the\nhash-chain payload. Each demo run uses an isolated in-memory trace store and\nreturns the output, trust-layer events, redactions, HITL state, latency,\nself-assessed trace-control fields, `this_hash`, `prev_hash`, and local chain\nverification.\n\nThe demo also includes optional product signals. If a visitor checks the\nanonymous usage box, Pramagent records only a process-salted hashed visitor ID,\nprovider kind, verdict, HITL state, and trace-control indicators. It never records\nprompts, outputs, provider keys, IP addresses, or plaintext email. The\nmanaged-pilot form stores salted contact hashes plus a short use-case label\nwith obvious email/phone values redacted, so demand can show up as data without\nturning the demo into a tracking surface.\n\nSet `PRAMAGENT_DEMO_ADMIN_KEY` to enable the protected operator view at\n`/demo/admin/signals`. The browser page asks for that key and then calls\n`/demo/admin/signals.json` with an `Authorization: Bearer ...` header; the key\nis never placed in a URL. By default these signals are process-local memory.\nSet `PRAMAGENT_DEMO_SIGNALS_POSTGRES_DSN` to persist them to Postgres, and set\n`PRAMAGENT_DEMO_SIGNAL_SALT` when you want hashed visitor/contact identifiers\nto remain stable across restarts. The persisted schema still stores only\nhashed/scrubbed fields, not prompts, outputs, provider keys, IPs, or plaintext\ncontacts.\n\nThe public throttle is keyed by client IP plus a short in-memory SHA-256 hash\nof the visitor's provider key. The no-key deterministic path is throttled by\nIP. If a visitor switches to a different key, they get a fresh demo bucket\nwithout Pramagent storing the plaintext key.\nA `DEGRADED` demo result means the upstream model call failed and Pramagent\nreturned its safe default with a trace. NVIDIA HTTP 403 usually means the\nNVIDIA organization lacks hosted Public API Endpoints access; changing models\nusually will not fix that entitlement issue.\n\nDashboard evidence from the authenticated June 21 smoke run is captured in\n[Demo evidence](https://github.com/sriram7737/pramagent/blob/main/docs/DEMO_EVIDENCE_2026-06-21.md).\nIt includes screenshots for safe output, PII scrubbing, prompt-injection\nblocking, destructive database-operation blocking, HITL-held financial action,\ntrace hashes, and the dashboard metric fix that reports engine latency\nseparately from human approval wait time. The evidence set also includes the\ncurrent console redesign preview: single-brand navigation, dense trace detail\nwith raw/scrubbed payloads, terminal `EXPIRED` approval states, and a\nfavicon-size proof for the Pramagent mark. The packaged dashboard serves the\nnew Pramagent SVG mark from `/static` across authenticated and pre-auth key\nflows.\n\nRun the release sanity checks:\n\n```bash\npython -m pytest -q --tb=no\npython -m pramagent.cli redteam --json --attacks 100\npython -m pramagent.cli redteam --json --dynamic --attacks 200 --seed 999\n```\n\nCurrent local result: `684 passed, 2 skipped`. The latest targeted prompt\nsuite also passed with `0` failures across emergency override, output override,\nmargin/liquidation, IBAN/SWIFT, ambiguous escalation, PHI, false-positive,\nbase64, hex, unicode-escape, multilingual override-token, and\nchat-template-wrapper cases.\n\n## ToolGuard Example\n\n```python\nimport asyncio\n\nfrom pramagent import Pramagent, Verdict\nfrom pramagent.layers import ToolGuardLayer, ToolPolicy\nfrom pramagent.layers.tool_guard import SideEffect\n\nguard = ToolGuardLayer(policies=[\n    ToolPolicy(\n        name=\"send_payment\",\n        side_effect=SideEffect.PAYMENT,\n        action=Verdict.ESCALATE,\n        allowed_tenants={\"finance_team\"},\n        schema={\n            \"type\": \"object\",\n            \"required\": [\"amount_usd\", \"destination\"],\n            \"properties\": {\n                \"amount_usd\": {\"type\": \"number\", \"minimum\": 0.01, \"maximum\": 5000},\n                \"destination\": {\"type\": \"string\", \"pattern\": r\"acct-\\d{6,}\"},\n            },\n            \"additionalProperties\": False,\n        },\n    )\n])\n\narmor = Pramagent(tool_guard=guard)\n\nasync def main():\n    decision = armor.validate_tool(\n        \"send_payment\",\n        {\"amount_usd\": 250.00, \"destination\": \"acct-123456\"},\n        tenant_id=\"finance_team\",\n        session_id=\"demo\",\n    )\n    print(decision.verdict)  # ESCALATE\n\n    too_large = armor.validate_tool(\n        \"send_payment\",\n        {\"amount_usd\": 9000.00, \"destination\": \"acct-123456\"},\n        tenant_id=\"finance_team\",\n        session_id=\"demo\",\n    )\n    print(too_large.verdict, too_large.reason)  # BLOCK: schema violation\n\n    wrong_tenant = armor.validate_tool(\n        \"send_payment\",\n        {\"amount_usd\": 250.00, \"destination\": \"acct-123456\"},\n        tenant_id=\"marketing_team\",\n        session_id=\"demo\",\n    )\n    print(wrong_tenant.verdict, wrong_tenant.reason)  # BLOCK: tenant mismatch\n\n    response = await armor.run(\n        \"Summarize this payment request\",\n        tenant_id=\"finance_team\",\n        session_id=\"demo\",\n        action=\"send_payment\",\n    )\n    print(response.hitl)\n    print(response.trace.this_hash)\n\nasyncio.run(main())\n```\n\n## Policy-As-Code And Backtesting\n\nSecurity teams can review ToolGuard definitions as JSON/YAML files instead of\nhardcoding them in application code.\n\n`policies.json`:\n\n```json\n{\n  \"policies\": [\n    {\n      \"name\": \"send_payment\",\n      \"side_effect\": \"payment\",\n      \"action\": \"escalate\",\n      \"allowed_tenants\": [\"finance_team\"],\n      \"schema\": {\n        \"type\": \"object\",\n        \"required\": [\"amount_usd\", \"destination\"],\n        \"properties\": {\n          \"amount_usd\": {\"type\": \"number\", \"minimum\": 0.01, \"maximum\": 5000},\n          \"destination\": {\"type\": \"string\", \"pattern\": \"acct-\\\\d{6,}\"}\n        },\n        \"additionalProperties\": false\n      }\n    }\n  ]\n}\n```\n\n```python\nfrom pramagent import Pramagent\nfrom pramagent.policies import load_tool_guard\n\narmor = Pramagent(tool_guard=load_tool_guard(\"policies.json\"))\n```\n\nBacktest before merging a policy PR:\n\n```bash\npramagent backtest policies.json --cases cases.jsonl\n```\n\n`cases.jsonl` uses one JSON object per historical/proposed tool call:\n\n```json\n{\"case_id\":\"pay-001\",\"tool_name\":\"send_payment\",\"arguments\":{\"amount_usd\":250,\"destination\":\"acct-123456\"},\"tenant_id\":\"finance_team\",\"expected\":\"escalate\"}\n```\n\nThis v0 backtest contract is explicit case replay. Stored-trace replay over the\nlast 30 days is on the roadmap once deployments have a stable tool-call export\nshape.\n\n## Drop-In Tool Decorator\n\nFor custom Python agents, wrap existing tools without rewriting the execution\nloop:\n\n```python\nfrom pramagent.adapters import guarded_tool\n\n@guarded_tool(armor, policy=\"send_payment\")\ndef send_payment(amount_usd: float, destination: str):\n    ...\n```\n\n`BLOCK` and `ESCALATE` both stop the function before the side effect runs.\nUse the persistent HITL queue/dashboard path to approve and then re-run the\nside effect intentionally; the decorator never treats escalation as consent.\n\n## Built-In Rule Corpora\n\nPramagent now includes deterministic, importable rule bundles. They are plain\nPython `Rule` objects, so a reviewer can inspect exactly what is enforced.\n\n```python\nfrom pramagent import Pramagent\nfrom pramagent.layers import SafetyLayer\nfrom pramagent.rules import ALL_RULES, JAILBREAK_PATTERNS, OWASP_LLM_TOP10\n\narmor = Pramagent(\n    safety=SafetyLayer(rules=[*JAILBREAK_PATTERNS, *OWASP_LLM_TOP10])\n)\n\nstrict_armor = Pramagent(safety=SafetyLayer(rules=ALL_RULES))\n```\n\nIncluded corpora:\n\n- `JAILBREAK_PATTERNS`\n- `OWASP_LLM_TOP10`\n- `INJECTION_CORPUS`\n- `FICTIONAL_WRAPPER`\n- `PHI_PATTERNS`\n- `FINANCIAL_PII`\n\n## Escalation Policy\n\n`Verdict.ESCALATE` means \"suspicious, but not certain enough to block.\" What\nthe pipeline does with it is configurable per stage — `pre` (the input pass,\nbefore the model runs) and `post` (the output pass, after) — with one of\n`\"log\"` (record and continue), `\"hitl\"` (route to the human-in-the-loop gate,\nidle-on-silence), or `\"block\"` (hard stop). The default is `\"log\"` so adding an\nESCALATE rule never silently starts gating traffic; the ESCALATE verdict is\nalways recorded in the trace either way.\n\n```python\n# Healthcare / finance — maximum caution\nPramagent(safety=SafetyLayer(rules=[...]),\n          escalate_policy={\"pre\": \"hitl\", \"post\": \"block\"})\n\n# Developer tool — minimal interruption (default)\nPramagent(safety=SafetyLayer(rules=[...]),\n          escalate_policy=\"log\")\n\n# Internal enterprise — gate suspicious input, log suspicious output\nPramagent(safety=SafetyLayer(rules=[...]),\n          escalate_policy={\"pre\": \"hitl\", \"post\": \"log\"})\n```\n\nA string applies to both stages; a dict sets them independently. Invalid values\nraise at construction, not at request time.\n\n## Persistent HITL Queue\n\nFor approval flows that must survive process restarts, use the persistent\nqueue backends:\n\n```python\nfrom pramagent.layers import HITLLayer\nfrom pramagent.queue import SQLiteHITLQueue\n\nhitl = HITLLayer(\n    require_approval_for=[\"send_email\", \"wire_transfer\"],\n    store=SQLiteHITLQueue(\"hitl.db\"),\n    timeout_s=None,  # wait until another process approves or denies\n)\n```\n\n`InMemoryHITLQueue`, `SQLiteHITLQueue`, and `PostgresHITLQueue` are available\nunder `pramagent.queue`.\n\nPersistent requests carry an expiry and a SHA-256 binding over the tenant,\naction, and canonical context. Queue backends enforce expiry at decision time,\naccept only the first decision, and reject duplicate request IDs, so a stale or\nreplayed approval cannot authorize a different action.\n\n## Framework Adapters\n\nPramagent is meant to sit under existing agent frameworks, not replace them.\n\n```python\nfrom pramagent.adapters import PramagentNode, PramagentHook, PramagentGuard\n\n# LangGraph\nguard_node = PramagentNode(armor=armor)\n\n# AutoGen\nPramagentHook(armor=armor).attach(agent)\n\n# CrewAI\nsafe_tool = PramagentGuard(armor=armor).wrap_tool(send_email)\n```\n\nGeneric helpers are also available:\n\n```python\nfrom pramagent.adapters import protect, protect_tool\n```\n\n## Integration Listings\n\nPramagent is listed in external ecosystem docs as a trust layer for agent tool\ncalls:\n\n- [Google Gemini Cookbook recipe](https://github.com/google-gemini/cookbook/blob/main/examples/Pramagent_trust_layer_for_gemini.ipynb) - Gemini agent trust-layer notebook merged in `google-gemini/cookbook#1269`.\n- [LangChain/LangGraph integration guide](https://github.com/sriram7737/pramagent/blob/main/docs/integrations/langgraph.md) - deterministic `ToolGuardLayer` checks before LangGraph tool execution.\n- [LangChain docs integration listing](https://github.com/langchain-ai/docs/pull/4806) - merged external listing for `ToolGuardLayer` and `pramagent`.\n\n## Coding-Agent Hooks\n\nFor deployments where the agent must not be able to rewrite its own hook,\ninstall the runtime and host configuration under an OS-owned permission\nboundary. The Windows and Linux installers, threat boundary, and verification\nsteps are documented in\n[Hook Deployment Boundary](docs/HOOK_DEPLOYMENT_BOUNDARY.md). In-process path\nchecks alone do not protect files writable by the same OS identity.\n\nPramagent also ships a publishable hook plugin for coding agents:\n\n- Claude Code `PreToolUse`\n- Codex plugin hooks\n- Grok Build / xAI plugin hooks\n- any host that can emit Claude-style pre-tool-call JSON on stdin\n\nThe plugin lives in `plugins/pramagent-guard/`, with publishing notes in\n[`docs/AGENT_HOOK_PUBLISHING.md`](docs/AGENT_HOOK_PUBLISHING.md). It is not an\nMCP server/client/proxy; it is a host-agent lifecycle hook that evaluates\nproposed tool calls before execution.\n\nHook registrations use a broad matcher and deny unregistered tools. The shared\ncontrol-plane check runs before policy toggles and protects host settings, hook\nlaunchers, plugin policy files, the guard package, and audit stores from\ntool-mediated edits. A bootstrap wrapper converts import, syntax, timeout, and\ninvalid-output failures into explicit denials. These checks protect the agent\ntool path; production deployments still need OS permissions or a separate\nservice account so the guarded process cannot rewrite its own installation.\n\nFrom the source checkout that provides the hook/plugin files, run\n`pramagent hooks-doctor --repo-root .` to verify host wiring, approved runtime\nhashes, and control-plane integrity. The PyPI wheel provides the shared policy\nengine and doctor command; host hook bundles are installed from this repository\nor its plugin marketplace. `--strict` also fails when hook files remain writable\nby the current OS account. The admin console records field-level changes and can\nrestore an audited snapshot by appending a rollback event; history is never\nrewritten.\n\n## Compliance Evidence\n\n`ComplianceReporter.generate()` can produce point-in-time evidence packages\nfrom Pramagent traces and mappings:\n\n```python\nfrom pramagent.compliance import ComplianceReporter\n\nComplianceReporter(store=store, audit=audit).generate(\n    framework=\"SOC2\",\n    period_start=\"2026-01-01\",\n    period_end=\"2026-06-30\",\n    tenant_id=\"demo\",\n    output=\"evidence.json\",\n)\n```\n\nSupported mapping targets include SOC2, HIPAA, GDPR, NIST AI RMF, EU AI Act,\nand PCI DSS. This is engineering evidence, not a certification.\n\n## When To Use Pramagent\n\n- You are wrapping LLM calls or agent workflows and need audit trails, policy\n  checks, HITL approvals, PII scrubbing, and provider fallback in one place.\n- You want deterministic tool policy outside the model, especially for actions\n  like payments, data export, account changes, or admin operations.\n- You are building an internal tool or pilot where honest safety evidence\n  matters more than marketing claims.\n- You need tamper-evident traces with optional Sepolia anchoring and encrypted\n  S3 cold archive support.\n- You already use LangGraph, AutoGen, CrewAI, or a custom loop and want a thin\n  trust layer around prompts, tool calls, and approvals.\n\n## When Not To Use Pramagent Yet\n\n- You need certified bank-grade, healthcare-grade, or SOC2-audited production\n  infrastructure today.\n- You need proven jailbreak resistance against a serious red team; the bundled\n  benchmark is only a deterministic smoke test, not third-party assurance.\n- You need mature enterprise dashboard auth such as SSO/OIDC/RBAC. Optional\n  generated dashboard keys and SQL users exist, but this is not an enterprise\n  IAM plane yet.\n- You need production-grade scale evidence, chaos engineering, or SLA-backed\n  capacity numbers beyond the published local Docker Compose load run.\n- You need billing-grade Stripe/Chargebee metering rather than the local usage\n  ledger and event hooks.\n\n## What Works Today\n\n| Capability | Status | Notes |\n|---|---|---|\n| Provider adapters | Implemented | Mock, OpenAI, Anthropic, Gemini, Ollama, OpenAI-compatible/local |\n| Rule corpora | MVP | 129 deterministic rules across jailbreaks, OWASP LLM risks, injection, fictional-wrapper bypasses, PHI, and financial PII |\n| ToolGuard | Strong MVP | Draft 2020-12 JSON Schema, allow-lists, side-effect taxonomy, output scanning, Redis-backed chain state |\n| HITL | Beta | Slack callbacks, persistent SQLite/Postgres queues, quorum/escalation primitives, ServiceNow/PagerDuty/email/webhook notifiers |\n| Audit trail | Strong MVP | SHA-256 hash chain; optional real Sepolia anchoring |\n| PII redaction | Strong MVP | Context-aware patterns for common regulated data; bounded email scrubbing avoids long-input regex DoS |\n| Auth/rate limits/quotas | Beta | JWT/API keys, token buckets, per-tenant quotas |\n| Framework adapters | MVP | LangGraph node, AutoGen hook, CrewAI guard, generic protect/protect_tool helpers |\n| Dashboard | Prototype | Shared-key fallback, optional SQL users with generated keys, tenant scoping, traces, approvals, metrics, usage page, CSRF |\n| Redis/Postgres backends | Beta | Wired and tested locally; needs scale/load testing |\n| OpenTelemetry | Partial | Per-layer spans exist; dashboards and alerting need hardening |\n| Red-team benchmark | MVP | Static and dynamic mutation modes; includes base64, translation-wrapper, and authority-framing regressions |\n| Billing hooks | MVP | In-memory hash-chain usage ledger plus fail-open webhook; no Stripe/Chargebee provider yet |\n| S3 cold archive | MVP | Gzip + encrypted trace archive wrapper; metadata sink hook |\n| Compliance evidence | MVP | `ComplianceReporter.generate()` for JSON/text/PDF-style evidence packages |\n\n## Integration Safety Contract\n\nPramagent should not replace human workflows that already work. Treat it as a\npolicy and evidence layer around risky agent actions, not as a mandate to put AI\ninto every decision path.\n\nBefore integrating a new feature or agent workflow, require three gates:\n\n1. **Isolation contract:** declare which trust layers the feature touches. HITL\n   features need a negative test proving the action cannot proceed without an\n   authenticated approval. Isolation features need tenant/session boundary tests.\n2. **Regression baseline:** run the full suite plus the new feature tests. Zero\n   regressions are allowed for previously passing safety, trace, auth, and store\n   behavior.\n3. **Consequence traceability:** every approved or triggered action must leave a\n   trace that explains why it was allowed, who/what approved it, what policy\n   applied, and which downstream side effect was attempted.\n\nThe reusable reviewer prompt for this is in\n[Security audit prompt](https://github.com/sriram7737/pramagent/blob/main/docs/SECURITY_AUDIT_PROMPT.md).\n\n## Honest Limits\n\n- Prompt-injection defense is not complete. The bundled static corpus and\n  seeded dynamic mutation smoke tests now include base64, translation-wrapper,\n  and authority-framing regressions. v0.8.0 adds structured verdicts,\n  provenance-aware stricter scanning, held-out PINT/TensorTrust-style fixtures,\n  and optional `pramagent[ml]` embedding/DeBERTa layers, but the project still\n  needs larger third-party red-team sets and external assessment.\n- ToolGuard is a hard policy gate outside the model, but it is not a sandbox.\n- ToolGuard chain detection and per-session call limits are per-process unless\n  a shared Redis backend is configured (`PRAMAGENT_TOOL_GUARD_REDIS_URL` or\n  `PRAMAGENT_REDIS_URL`). When running multiple uvicorn workers, a dangerous\n  tool chain whose steps land on different workers is only detected with a\n  shared Redis backend; the Redis path uses an atomic Lua append so concurrent\n  same-session calls never lose history.\n- Slack is the main decision-collecting HITL adapter today. ServiceNow,\n  PagerDuty, email, and generic webhooks are useful notification/escalation\n  adapters. Persistent SQLite/Postgres approval queues exist, but broader\n  enterprise approval workflows are still in development.\n- Dashboard auth has tenant-scoped shared-key fallback plus optional SQL-backed\n  users with generated dashboard keys and key regeneration. It is still not\n  SSO/OIDC/RBAC-grade.\n- Ethereum anchoring is Sepolia/testnet-oriented; no mainnet runbook, verifier\n  contract, HSM/KMS key-management story, or enterprise anchoring operating\n  model is included yet.\n- The usage ledger is local audit evidence for pilots, not an invoice-grade\n  billing system.\n- Redis/Postgres support exists, but the stack has not been chaos-tested or\n  load-tested for high-stakes deployments.\n- No external penetration test or formal compliance certification has been run.\n- Portable Evidence Envelope V2 now includes integer-only RFC 8785\n  canonicalization, Merkle proofs, and strict hybrid Ed25519 plus ML-DSA-65\n  checkpoint signatures. Its optional Sigstore adapter obtains live RFC 3161\n  timestamps and Rekor inclusion receipts using TUF-authenticated trust\n  material, with a durable local retry outbox. Managed signing keys, archive\n  timestamp renewal, QRNG mixing, and a complete QuantumLayer remain roadmap\n  work. The IBM Runtime path submits a guarded\n  Bell-pair hardware attestation with explicit consent, bounded shots, provider\n  job evidence, and hash-chained audit records. It is not a quantum-advantage\n  claim or a production VLM by itself.\n\n## Optional Anchoring And Archive\n\n```bash\npip install \"pramagent[ethereum,s3]\"\n```\n\nEthereum/Sepolia anchoring submits the audit head as transaction calldata and\nstores the tx hash plus block number on the trace when configured. S3 cold\narchive wraps a primary store and archives pruned/erased traces as encrypted\ngzip JSON while keeping metadata available for compliance reporting.\n\n## Demo Flow\n\n```bash\npramagent init\ndocker compose up -d\npython -m pytest -q --tb=no\npython -m pramagent.cli redteam --json --dynamic --attacks 200 --seed 999\n```\n\nThen use the dashboard to inspect traces, pending HITL approvals, audit status,\nmetrics, and per-tenant usage.\n\n## Current Integration Notes\n\nThe merged Gemini Cookbook notebook remains pinned for reproducibility, and the\nLangChain docs listing points back to this repository. Newer integration work\nshould stay additive here: keep the public `Pramagent`, `ToolGuardLayer`,\n`ToolPolicy`, `SideEffect`, `Verdict`, and `validate_tool()` surface stable,\nthen document newer controls in this repo.\n\nRecent additions include the local hook control plane, per-tenant hook\npermissions, HMAC-chained hook-admin audit records, and installable guarded\nPennyLane QNode and hybrid-router APIs under `pramagent.quantum`. Existing hook-control files created\nbefore state binding must be reviewed and bound once from the admin console;\nuntil then, hook enforcement stays on. Users coming from the cookbook or\nLangChain listing can upgrade Pramagent from PyPI and follow the docs in this\nrepository without changing either upstream link.\n\nThe optional IBM hardware path is installed with\n`pip install \"pramagent[quantum-ibm]\"`. Run `pramagent quantum-status` before\nusing `pramagent quantum-run`; real submissions require explicit hardware and\nunpriced-QPU-time acknowledgements. See the quantum guide for the exact trust\nboundary and current limitations.\n\nQuantum budgets can use an opt-in SQLite ledger on one host or a PostgreSQL\nledger across workers and hosts. Both atomically reserve shots and estimated\ncost before execution and reconcile measured use afterward. IBM attestations\nalso emit a sealed, time-bounded calibration canary. Applications can require a\nfresh canary for the same provider and backend, then bind it to the completed\nworkload evidence in the audit chain. IBM and PennyLane paths emit the same\nsealed `QuantumExecutionEvidence` shape. Unknown IBM QPU-time cost remains\n`None`, not `$0`.\n\nPortable evidence signing is installed separately with\n`pip install \"pramagent[evidence-v2]\"`. It writes additive V2 envelopes while\nleaving issued V1 hashes unchanged, requires both Ed25519 and ML-DSA-65 under a\nversioned policy, and reports `record_assurance`, `checkpoint_assurance`, and\nthe effective `assurance_level` on every verification. See the\n[Evidence Envelope V2 specification](docs/EVIDENCE_ENVELOPE_V2.md); the\n`evidence-v2-verify` CLI accepts trusted public keys from a separate registry.\n\nInstall `pramagent[evidence-anchors]` to timestamp a signed checkpoint with the\nSigstore production RFC 3161 service and publish its digest to Rekor. Anchoring\nruns after checkpoint creation. SQLite is the local default; multi-worker\ndeployments use the PostgreSQL outbox with transactional `SKIP LOCKED` claims\nand lease fencing:\n\n```bash\npramagent evidence-v2-anchor \\\n  --envelope evidence.json \\\n  --output evidence.anchored.json \\\n  --outbox .pramagent/evidence_anchor_outbox.sqlite3\n\n# Multi-worker deployment; the DSN may instead come from\n# PRAMAGENT_ANCHOR_POSTGRES_DSN.\npramagent evidence-v2-anchor \\\n  --envelope evidence.json \\\n  --output evidence.anchored.json \\\n  --outbox-postgres-dsn \"$PRAMAGENT_ANCHOR_POSTGRES_DSN\"\n\npramagent evidence-v2-verify \\\n  --envelope evidence.anchored.json \\\n  --keys verification-keys.json \\\n  --anchor-trust sigstore-production \\\n  --require-assurance tsa_anchored\n```\n\nThe verifier checks the RFC 3161 message imprint, nonce, TSA chain, Rekor\nartifact signature, Merkle inclusion proof, and signed log checkpoint. The\nproduction and cache-only trust modes obtain roots from Sigstore's TUF trust\nconfiguration. This establishes externally witnessed time and publication; it\ndoes not make the underlying event truthful or turn two services in the same\noperator ecosystem into two independent organizations. The anchor captures\nand verifies OCSP/CRL responses when the TSA certificate advertises them; a\nsigned certificate without either endpoint receives an explicit\n`no_endpoint_advertised` record. Pramagent also supports the RFC 4998\nsingle-object/SHA-256 timestamp-renewal profile:\n\n```bash\npramagent evidence-archive-create \\\n  --envelope evidence.anchored.json \\\n  --output evidence.archive.json\n\npramagent evidence-archive-renew \\\n  --bundle evidence.archive.json \\\n  --output evidence.archive.renewed.json\n\npramagent evidence-archive-verify \\\n  --bundle evidence.archive.renewed.json\n```\n\nThe archive bundle retains each TSA response, certificate chain, and available\nrevocation artifact. Hash-tree renewal, immutable archive storage, automated\nrenewal scheduling, and a seven-year operational validation drill remain\nrelease requirements; timestamp-renewal support alone is not a seven-year\nguarantee. The\nPostgreSQL outbox provides at-least-once delivery: a crash after a witness\naccepts a request can repeat that external request, while lease fencing keeps\nstale workers from overwriting the authoritative stored receipt.\n\n## Verified IBM Hardware Results\n\nOn September 13, 2026, the updated Pramagent CLI submitted two guarded\nBell-pair attestations to the physical IBM Quantum backend `ibm_fez`. Both used\natomic shot reservation, explicit hardware consent, sealed execution evidence,\nand the persistent HMAC audit chain. IBM Runtime and the local audit database\nwere independently read again after each completion.\n\n| Field | Optimization 1 | Optimization 3 |\n| --- | --- | --- |\n| IBM Runtime job | `dajg0i1hvn6c73cuckbg` | `dajg4l1hvn6c73cucon0` |\n| Physical qubits | `[0, 1]` | `[146, 147]` |\n| Requested / observed shots | `128 / 128` | `128 / 128` |\n| Counts (`00`, `01`, `10`, `11`) | `68, 2, 3, 55` | `74, 1, 1, 52` |\n| Same-bit correlation | `0.9609375` | `0.984375` |\n| Wilson 95% interval | `[0.9118, 0.9832]` | `[0.9448, 0.9957]` |\n| Two-sided Fisher exact comparison | reference | `p = 0.4466`; not significant at `0.05` |\n| Logical / ISA depth | `3 / 8` | `3 / 7` |\n| ISA operations | `12` | `11` |\n| SWAP operations | `0` | `0` |\n| IBM QPU charge time | `2 s` (billing granularity, not a differentiator) | `2 s` |\n| Audit chain | valid | valid |\n\nThe PostgreSQL budget and calibration-binding path was subsequently validated\nwith another physical `ibm_fez` job, `dajgtnphvn6c73cudlf0`: 128/128 observed\nshots, counts `00=48, 01=8, 10=4, 11=68`, same-bit correlation `0.90625`, and\n2 seconds of provider-reported QPU usage. The budget reservation reconciled\nfrom 128 estimated to 128 actual shots. Its sealed canary was bound to the\nearlier same-backend hardware job `dajgs2b9k43c73ah7730` at an age of\n183.639432 seconds, and the destination audit chain remained valid. The clean\nvalidation database used an unkeyed SHA-256 test chain because no audit signing\nkey was visible to that process; deployments should configure the versioned\nsigning-key ring. See the\n[control-plane validation record](docs/quantum-results/ibm_fez_dajgtnphvn6c73cudlf0.json).\n\nThe calibration-aware layout guard was then enabled and validated on physical\nhardware. Job `dajho5hhvn6c73cueht0` used level 3, automatically selected\n`[147,146]`, and passed a complete layout error proxy of `0.011177` against the\n`0.05` ceiling before submission. It observed 249 same-bit outcomes in 256\nshots, for correlation `0.972656` and Wilson 95% interval\n`[0.9446, 0.9867]`. This was higher than the degraded `[0,1]` run at the raw\nshot-count level (two-sided Fisher exact `p=0.0102`) and statistically\nindistinguishable from the earlier `0.984375` optimized result (`p=0.7236`).\nThe runs differ in calibration time and shot count, so this validates the\nselection and enforcement workflow rather than isolating a causal fidelity\neffect. Record: [calibration-aware hardware validation](docs/quantum-results/ibm_fez_dajho5hhvn6c73cueht0.json).\n\nThis verifies a one-layer ISA reduction from optimization level 3, not the\nsuggested SWAP-removal explanation. Physical qubits `[0, 1]` were already\ndirectly connected and the first ISA circuit contained no SWAP. For the current\nQiskit Runtime API, layout belongs on `generate_preset_pass_manager`; `SamplerV2`\ndoes not expose `options.transpilation.initial_layout`. Calibration-aware auto\nlayout selected `[146, 147]` for the optimized run.\n\nBecause the two hardware runs changed optimization level and qubit pair\ntogether, the depth attribution was re-tested offline over the full grid -\noptimization level `1` and `3` crossed with layouts `[0, 1]`, `[146, 147]`, and\nauto, across 10 transpiler seeds each. Transpilation consumes no QPU time.\n\n| Optimization level | Layout `[0, 1]` | Layout `[146, 147]` | Auto layout |\n| --- | --- | --- | --- |\n| `1` | depth `8`, size `12` | depth `8`, size `12` | depth `8`, size `12` |\n| `3` | depth `7`, size `11` | depth `7`, size `11` | depth `7`, size `11` |\n\nDepth and size were identical across all 10 seeds in every cell. For this Bell\ncircuit, backend snapshot, and tested layouts, ISA depth and size varied only\nwith optimization level. This settles the observed depth attribution only. The\nhardware correlation comparison remains confounded by layout and is not\nstatistically significant (two-sided Fisher exact `p = 0.4466`). Record:\n[transpiler depth attribution](docs/quantum-results/transpiler_depth_attribution.json).\n\nMachine-readable records are available for the\n[optimization-1 run](docs/quantum-results/ibm_fez_dajg0i1hvn6c73cuckbg.json),\n[optimization-3 run](docs/quantum-results/ibm_fez_dajg4l1hvn6c73cucon0.json),\nand [earlier provider-only run](docs/quantum-results/ibm_fez_daj5doomhr3c73e8i5a0.json).\nThey contain no API key or instance CRN. The three records are not\nschema-identical and should not be parsed interchangeably: the provider-only run\npredates the guarded path and carries no `audit`, `pramagent_execution`, or\n`same_bit_correlation_wilson_95` fields, and only the optimization-3 record\ncarries `isa_circuit` in place of `circuit`. The optimized sample had higher\nobserved correlation, but the confidence intervals overlap and the runs used\ndifferent calibrated qubit pairs. The result does not establish a causal\nfidelity improvement, a complete entanglement witness, quantum advantage, or\nhybrid-VLM improvement.\n\n## Docs\n\n- [Getting started](https://github.com/sriram7737/pramagent/blob/main/docs/GETTING_STARTED.md)\n- [LangGraph integration](https://github.com/sriram7737/pramagent/blob/main/docs/integrations/langgraph.md)\n- [Implementation status](https://github.com/sriram7737/pramagent/blob/main/docs/IMPLEMENTATION_STATUS.md)\n- [Quantum integration](https://github.com/sriram7737/pramagent/blob/main/docs/QUANTUM.md)\n- [Conformance map](https://github.com/sriram7737/pramagent/blob/main/docs/CONFORMANCE.md)\n- [Design decisions](https://github.com/sriram7737/pramagent/blob/main/docs/DESIGN_DECISIONS.md)\n- [Overreach corpus](https://github.com/sriram7737/pramagent/tree/main/corpus/overreach)\n- [Live test results](https://github.com/sriram7737/pramagent/blob/main/docs/LIVE_TEST_RESULTS.md)\n- [Hardening guide](https://github.com/sriram7737/pramagent/blob/main/docs/HARDENING_GUIDE.md)\n- [Incident-response runbook](https://github.com/sriram7737/pramagent/blob/main/docs/INCIDENT_RESPONSE_RUNBOOK.md) - key/credential compromise, audit-chain tamper response, and the security CLI: `pramagent auth-revoke` (revoke a leaked API key), `pramagent audit-verify-watch` (automated tamper detection), `pramagent audit-export` (export a tenant's trace rows)\n- [Google Dev Library submission draft](https://github.com/sriram7737/pramagent/blob/main/docs/GOOGLE_DEV_LIBRARY_SUBMISSION.md)\n- [Cookbook submission plan](https://github.com/sriram7737/pramagent/blob/main/docs/COOKBOOK_SUBMISSIONS.md)\n- [Security test results](https://github.com/sriram7737/pramagent/blob/main/docs/audits/pramagent_security_test_results.md)\n- [More documentation](https://github.com/sriram7737/pramagent/tree/main/docs)\n\n## Author\n\n- [Sriram Rampelli](https://sriram7737.github.io)\n\n## License\n\nApache-2.0.\n",
  "bytes": 48729,
  "sha": "5a3f2aa208428090b93c0f8bb0b22459605834a35c0b87d99980f13cf3aab91a",
  "repo_slug": "sriram7737/pramagent",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_sriram7737_pramagent_b93a6d4e/readme"
}