icebox-gov 0.1.0

Runtime governance for autonomous offensive security — the single seam every human operator, REST client, and LLM agent must pass through before anything touches a target.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

# Quickstart

ICEBOX is **local-first and account-free**. You accept a charter, declare a
scope, then run governed modules through the seam.

## 1. Start the CLI + REST API

```sh
icebox            # interactive REPL on :8443 REST API
icebox --api     # REST API only
```

## 2. Accept a charter and add a scope

```text
icebox> charter accept "authorization test"
icebox> scope add 10.0.0.0/24
```

## 3. List and run a module

```text
icebox> list
icebox> use tcp_port_scanner
icebox> set host 10.0.0.5
icebox> run
```

High-risk modules are blocked unless you explicitly opt in:

```text
icebox> run --approve 10.0.0.5
```

## 4. Govern an agent programmatically (Python)

```python
from icebox import Governance

gov = Governance({
    "charter": "authorized engagement",
    "scope": ["10.0.0.0/24"],
    "max_risk": "high",
})
outcome = gov.run({
    "module": "tcp_port_scanner",
    "target": "10.0.0.5",
    "options": {"host": "10.0.0.5", "ports": "1-1024"},
})
print(outcome)            # decision, audit trail, evidence
print(gov.audit_json())   # full audit log
```

## 5. Continuous validation

```text
icebox> validate run --targets 10.0.0.5 --model llama3.2
icebox> validate diff before.json after.json
```

The REST API is served at `http://127.0.0.1:8443/api/v1` for
non-interactive integrations.