Crate klieo_ops 

klieo-ops

Operational layer above klieo_core. Ships supervisor, governor, gates, escalation, worklog, and handoff primitives. Compliance evidence is a byproduct: every primitive emits structured events into the existing Merkle-chained klieo_core::EpisodicMemory.

Out of scope

See README.md for the load-bearing out-of-scope list. Critically, the framework does not assess agent decision quality, bias, or accuracy — those are user-owned (EU AI Act Art 10, Art 15).

Re-exports

pub use approver_registry::ApproverId;

pub use approver_registry::ApproverRegistry;

pub use approver_registry::StaticApproverRegistry;

pub use audit::OpsAuditSink;

pub use key_registry::HotReloadableEd25519Registry;

pub use key_registry::load_ed25519_yaml;

pub use key_registry::Ed25519KeyRegistry;

pub use key_registry::KeyRegistryError;

pub use key_registry::StaticEd25519KeyRegistry;

pub use signer::SignedPayload;

pub use signer::SignerError;

pub use signer::SignerProvider;

pub use signer::SoftwareSigner;

pub use source_identity_registry::SourceIdentityRegistry;

pub use source_identity_registry::SourceIdentityRegistryError;

pub use source_identity_registry::StaticSourceIdentityRegistry;

pub use crypter::Crypter;

pub use crypter::CrypterError;

pub use crypter::KeyProvider;

pub use crypter::StaticKeyProvider;

pub use crypter::TenantKeyedCrypter;

pub use emit::emit_ops_event;

pub use error::BuildError;

pub use error::OpsError;

pub use ops_event::OpsEvent;

pub use run_context::current_run_context;

pub use run_context::scope_run_context;

pub use run_context::spawn_with_run_context;

pub use run_context::RunContext;

pub use runtime::OpsRuntime;

pub use tenant::spawn_with_context;

pub use tenant::TenantResolver;

pub use types::AgentId;

pub use types::AgentMeta;

pub use types::BudgetScope;

pub use types::KillReason;

pub use types::KillTrigger;

pub use types::ProviderId;

pub use types::RuntimeState;

pub use types::TenantId;

Modules

approver_registry

Approver identity → Ed25519 pubkey registry for FourEyesGate.

audit

Shared audit sink: emit OpsEvent into klieo_core::EpisodicMemory with tracing::warn on failure. Used by primitive impls (JobQueueEscalation, KvWorkLog, KvHandoff) and the SupervisedAgent runtime wrappers (GovernedLlmClient, GatedToolInvoker).

clock

Clock trait + system-time default impl.

crypter

Pluggable at-rest encryption for klieo-ops adapters that want to crypto-shred per-tenant data (GDPR Art 17 erasure).

emit

Helper for emitting OpsEvent values into a klieo-core EpisodicMemory.

error

Shared error enums for the ops layer.

escalation

Escalation primitive: severity-routed ticket raise + resolve.

gates

Gates primitive: policy-as-code at the pre-effect boundary.

governor

Governor primitive: capacity + rate limiting.

handoff

Handoff primitive: signed state-transfer envelopes between agent runs.

key_registry

Shared Ed25519 key-lookup registry generic over the ID type.

ops_event

Typed shape of the body carried inside klieo_core::Episode::Ops.

redactor

Redaction trait + default impl.

run_context

Task-local run context bound by SupervisedAgent::run.

runtime

OpsRuntime builder + supervised-agent wrapper.

signer

Pluggable signing for handoff envelopes.

source_identity_registry

Source-agent identity → Ed25519 verifying-key registry for Handoff envelope verification.

supervisor

Supervisor primitive: agent lifecycle, heartbeat, kill-switch.

tenant

Per-step tenant resolution via tokio task-local.

test_fixtures

Public conformance fixtures consumed by third-party impl crates as dev-dependencies. Each run_<primitive>_conformance asserts the documented contract end-to-end.

types

Shared types used across klieo-ops primitives.

worklog

Worklog primitive: durable DAG of agent work items.