klieo-ops

Operations layer above klieo-core: run supervision, policy gates, escalation chains, durable worklog, agent handoff, and PII redaction.

Every primitive emits structured events into the existing Merkle-chained EpisodicMemory, so compliance evidence is a byproduct of normal operation rather than a separate instrumentation concern.

Part of the klieo Rust agent framework.

Features

Feature	What it enables
`supervisor`	Kill-switch, budget enforcement, run lifecycle management
`governor`	Concurrency limits and rate controls at the pre-effect boundary
`gates`	Cedar policy-as-code approval gates
`escalation`	Four-eyes review and escalation chains
`worklog`	Durable operation audit log
`handoff`	Structured agent handoff protocol
`crypter`	AES-GCM envelope encryption for worklog entries
`hot-reload`	Live policy reload without process restart
`full`	All of the above

All features in default except hot-reload (opt-in) and test-utils (dev-only).

Quickstart — single-tenant deployment

[dependencies]
klieo-ops = { version = "3", features = ["full"] }

use klieo_ops::OpsRuntime;

# async fn run<A: klieo_core::Agent>(agent: A) -> Result<(), klieo_ops::error::BuildError> {
let supervised = OpsRuntime::single_tenant("acme")
    .spawn(agent)?;
# let _ = supervised; Ok(()) }

OpsRuntime::single_tenant(id) pre-wires a SingleTenant resolver — no per-step tenant resolution needed. Power users serving multiple tenants reach for OpsRuntime::builder().tenant_resolver(...) and plug a custom TenantResolver that reads from a request-scoped task-local or JWT claim.

Advanced wiring — multi-tenant

use std::sync::Arc;
use klieo_ops::{OpsRuntime, tenant::TenantResolver};

# fn run(my_resolver: Arc<dyn TenantResolver>, agent: impl klieo_core::Agent) -> Result<(), klieo_ops::error::BuildError> {
let supervised = OpsRuntime::builder()
    .tenant_resolver(my_resolver)
    .spawn(agent)?;
# let _ = supervised; Ok(()) }

Key public exports

OpsRuntime — main entry point; wires all enabled primitives together
RunContext, scope_run_context, spawn_with_run_context, current_run_context — async context propagation
OpsEvent, emit_ops_event — structured event emission into EpisodicMemory
TenantId, AgentId, AgentMeta, ProviderId, RuntimeState — domain ID newtypes and state types
TenantResolver, spawn_with_context — multi-tenant context routing
BuildError, OpsError — typed errors

What is out of scope

This crate does not assess agent decision quality, bias, or accuracy. Those are user-owned concerns (EU AI Act Art 10, Art 15).

Status

3.x — stable. See docs/SEMVER.md.

License

MIT — see LICENSE.

klieo-ops 3.3.0