klieo-ops 3.3.0

Operational layer above klieo-core: supervisor, governor, gates, escalation, worklog, handoff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

# klieo-ops

Operations layer above `klieo-core`: run supervision, policy gates, escalation chains, durable worklog, agent handoff, and PII redaction.

Every primitive emits structured events into the existing Merkle-chained `EpisodicMemory`, so compliance evidence is a byproduct of normal operation rather than a separate instrumentation concern.

Part of the [klieo](https://crates.io/crates/klieo) Rust agent framework.

## Features

| Feature | What it enables |
|---|---|
| `supervisor` | Kill-switch, budget enforcement, run lifecycle management |
| `governor` | Concurrency limits and rate controls at the pre-effect boundary |
| `gates` | Cedar policy-as-code approval gates |
| `escalation` | Four-eyes review and escalation chains |
| `worklog` | Durable operation audit log |
| `handoff` | Structured agent handoff protocol |
| `crypter` | AES-GCM envelope encryption for worklog entries |
| `hot-reload` | Live policy reload without process restart |
| `full` | All of the above |

All features in `default` except `hot-reload` (opt-in) and `test-utils` (dev-only).

## Quickstart — single-tenant deployment

```toml
[dependencies]
klieo-ops = { version = "3", features = ["full"] }
```

```rust
use klieo_ops::OpsRuntime;

# async fn run<A: klieo_core::Agent>(agent: A) -> Result<(), klieo_ops::error::BuildError> {
let supervised = OpsRuntime::single_tenant("acme")
    .spawn(agent)?;
# let _ = supervised; Ok(()) }
```

`OpsRuntime::single_tenant(id)` pre-wires a `SingleTenant` resolver —
no per-step tenant resolution needed. Power users serving multiple
tenants reach for `OpsRuntime::builder().tenant_resolver(...)` and
plug a custom `TenantResolver` that reads from a request-scoped
task-local or JWT claim.

## Advanced wiring — multi-tenant

```rust
use std::sync::Arc;
use klieo_ops::{OpsRuntime, tenant::TenantResolver};

# fn run(my_resolver: Arc<dyn TenantResolver>, agent: impl klieo_core::Agent) -> Result<(), klieo_ops::error::BuildError> {
let supervised = OpsRuntime::builder()
    .tenant_resolver(my_resolver)
    .spawn(agent)?;
# let _ = supervised; Ok(()) }
```

### Key public exports

- `OpsRuntime` — main entry point; wires all enabled primitives together
- `RunContext`, `scope_run_context`, `spawn_with_run_context`, `current_run_context` — async context propagation
- `OpsEvent`, `emit_ops_event` — structured event emission into `EpisodicMemory`
- `TenantId`, `AgentId`, `AgentMeta`, `ProviderId`, `RuntimeState` — domain ID newtypes and state types
- `TenantResolver`, `spawn_with_context` — multi-tenant context routing
- `BuildError`, `OpsError` — typed errors

### What is out of scope

This crate does not assess agent decision quality, bias, or accuracy. Those are user-owned concerns (EU AI Act Art 10, Art 15).

## Status

`3.x` — stable.
See [`docs/SEMVER.md`](https://github.com/mohrimic/klieo/blob/main/docs/SEMVER.md).

## License

MIT — see [`LICENSE`](https://github.com/mohrimic/klieo/blob/main/LICENSE).