agentcontract-rs

Rust implementation of the AgentContract specification.

Install

# Cargo.toml
[dependencies]
agentcontract = "0.1"

Quickstart

1. Write a contract:

# my-agent.contract.yaml
agent: my-agent
spec-version: "0.1.0"
version: "1.0.0"

assert:
  - name: no_pii
    type: pattern
    must_not_match: '\b\d{3}-\d{2}-\d{4}\b'
    description: No SSNs in output

limits:
  max_latency_ms: 10000
  max_cost_usd: 0.10

on_violation:
  default: block

2. Enforce it in your agent:

use agentcontract::{load_contract, ContractRunner, RunContext};

fn main() {
    let contract = load_contract("my-agent.contract.yaml").unwrap();
    let runner = ContractRunner::new(contract);

    let output = run_my_agent("What are the GxP requirements?");

    let ctx = RunContext {
        input: "What are the GxP requirements?".into(),
        output,
        duration_ms: 1200.0,
        ..Default::default()
    };

    let result = runner.run(&ctx);

    if !result.passed {
        for v in result.blocking_violations() {
            eprintln!("[{}] {}: {}", v.action_taken, v.clause_name, v.details);
        }
        std::process::exit(1);
    }

    println!("✓ Contract passed ({} assertions checked)", result.violations.len());
}

3. When a violation occurs:

[block] no_pii: Forbidden pattern found at position 42: '123-45-6789'

CLI

# Check a contract file is valid
agentcontract check my-agent.contract.yaml

# Show contract metadata and assertions
agentcontract info my-agent.contract.yaml

# Validate a JSONL file of run contexts against a contract
agentcontract validate my-agent.contract.yaml runs.jsonl

runs.jsonl format (one JSON object per line):

{"input": "question", "output": "answer", "duration_ms": 1200, "cost_usd": 0.002}
{"input": "question2", "output": "SSN 123-45-6789", "duration_ms": 800, "cost_usd": 0.001}

Validator Types

Limits (max_latency_ms, max_cost_usd, max_tokens) are checked automatically from the limits: block.

Audit Trail

Every run can be written to a tamper-evident JSONL file with a SHA-256 content hash:

use agentcontract::AuditWriter;

let writer = AuditWriter::new("audit.jsonl");
writer.write(&result, "my-agent.contract.yaml").unwrap();

Each entry:

{
  "run_id": "uuid",
  "timestamp": "2026-03-22T10:00:00Z",
  "agent": "my-agent",
  "outcome": "violation",
  "passed": false,
  "violations": [...],
  "entry_sha256": "abc123..."
}

Architecture

agentcontract-rs/src/
├── lib.rs          # Public API and re-exports
├── main.rs         # CLI (check / info / validate)
├── models.rs       # Contract, Assertion, Limits, OnViolation (serde)
├── loader.rs       # load_contract() — YAML or JSON
├── runner.rs       # ContractRunner, RunResult, ViolationRecord
├── audit.rs        # AuditWriter — JSONL + SHA-256
└── validators/
    ├── mod.rs      # RunContext, ValidationResult
    ├── pattern.rs  # Regex must_not_match / must_match
    ├── latency.rs  # duration_ms check
    └── cost.rs     # cost_usd check

Evaluation order follows spec §6.1: limits → assert → must → must_not → ensures

Full Documentation

See the AgentContract specification.

Python implementation: pip install agentcontract → agentcontract-py

TypeScript implementation: npm install @agentcontract/core → agentcontract-ts

Roadmap

• LLM judge validator (optional anthropic feature flag)
• rollback violation action (snapshot/restore hook)
• requires and invariant clause evaluation
• HMAC-signed audit trail (mirrors Python implementation)
• PyO3 bindings — expose Rust validator core to Python for performance

License

Apache 2.0 — Part of the AgentContract open standard.