This matrix classifies the current govengine.__all__ top-level export surface for the alpha governed-runtime kernel.
Classification meanings:
- v1-candidate: real deterministic kernel symbol exported by
govengine.v1; still alpha until the API freeze. - adapter: compatibility or host/SCLite boundary retained for migration, but not part of the v1 kernel facade.
- experimental: runtime-shaped or broad alpha surface that must not enter the stable facade without a new ownership review.
- fixture: development, demo, or profile fixture; never production authority.
- remove: symbol selected for removal after consumer migration. The current inventory has no immediate removals.
- internal-exposed: compatibility callable visible at package root outside
__all__; migrate its consumers before removal or reclassification.
GovEngine is still alpha. This matrix is not a production readiness claim, and it does not grant live execution, PKI/KMS, credential, raw evidence storage, scheduler, carrier, Ravenclaw, OpenClaw, MCP, or A2A ownership.
The v1 candidate subset is a compatibility target inside the alpha surface,
not a stable API declaration yet. It contains only the deterministic API
error/result envelope, PolicyEngine compilation/evaluation/enforcement
contracts, the digest-bound GovernanceRequest/ApprovalAttestation inputs,
the canonical GovernanceDecision evaluator, and the current governance trace
projection. Legacy runtime
admission, SCLite bridges, receipt helpers, typed-execution projections and
profile bindings remain adapters until the canonical G2/G3 contracts exist.
The facade must not introduce a second runtime admission record, live executor, scheduler, planner, PKI/KMS/key manager, replay database, raw evidence store, or host-specific Ravenclaw/Tecrax runtime behavior.
| Classification | Owner/source | Exports | Migration/boundary note |
|---|---|---|---|
| adapter | govengine.admission | AuditLedgerAppendResult, AuditLedgerEntry, AuditLedgerPort, AuditLedgerVerificationResult, GovAdmissionDecision, GovApprovalRequest, GovAuditRecord, GovPolicyDecision, RuntimeAdmissionResult, admission_decision_from_host_gate, audit_ledger_entry_digest, audit_ledger_verification_public_summary, audit_record_public_summary, compose_runtime_admission_result, normalize_admission_artifact_refs, policy_verdict_to_gov_policy_decision, runtime_admission_public_summary, validate_admission_decision, validate_approval_request, validate_audit_record, validate_audit_ledger_append_result, validate_audit_ledger_entry, validate_audit_ledger_verification_result, validate_policy_decision, validate_runtime_admission_result, validate_runtime_admission_proof_inputs |
Neutral admission/policy/runtime-admission records, PolicyEngine verdict projection, bounded audit-ledger port contracts, bounded reference normalization, public-safe projection helpers, proof-input completeness checks, and gate-summary composition only; host owns policy meaning, approval workflow, live backend behavior, production audit persistence/concurrency, raw evidence storage, SCLite canonicalization, and production trust/key boundaries. |
| v1-candidate | govengine.api | GovApiError, GovApiResult |
Lightweight result/error helpers. |
| v1-candidate | govengine.approvals | ApprovalAttestation, ApprovalRevocationPort, ApprovalTrustPolicy, validate_approval_attestation |
Digest-bound approval for one operation/step/attempt/spec/scope/policy/side-effect subject, with explicit issuer trust, validity and host-provided revocation checks. It is neither admission nor runtime authority; signature references are required by policy but cryptographic verification remains a separate host trust boundary. The low-level digest helper stays module-scoped. |
| experimental | govengine.boundary | BoundaryReport, DomainProfileConformance, DomainProfileContract, KernelBoundary, boundary_surface_index, domain_profile_conformance, kernel_boundary_contract, kernel_boundary_report, validate_domain_profile_contract, validate_domain_profile_conformance |
Kernel/profile/runtime/SCLite ownership registry remains experimental; profile fixtures are classified separately. |
| adapter | govengine.context | GovEngineContext, GovEnginePaths, host_compat_context |
Host path/context adapter records; the legacy Ravenclaw fixture is classified separately. |
| experimental | govengine.control | ControlDecision, apply_control_decision, validate_control_decision |
Between-step control decisions without scheduler/storage/live-execution ownership. |
| fixture | govengine.contract_proofs | GovernanceVocabularyEntry, RuntimeContractProof, governance_contract_vocabulary, ravenclaw_contract_proof, tecrax_contract_proof, validate_governance_contract_vocabulary, validate_runtime_contract_proof |
Public-safe proof fixtures and neutral vocabulary; no domain runtime ownership. |
| adapter | govengine.core | ArtifactDescriptor, ArtifactEnvelope, ArtifactState, ExecutionPrerequisites, GovernanceContext, ReasonCode, TransitionDecision |
Portable artifact and governance primitives. |
| adapter | govengine.deconfliction | ArtifactChangeOrder, ArtifactConflict, ConflictDetector |
Digest/state conflict helpers only. |
| experimental | govengine.events | EventEnvelope, GovEvent, validate_event_envelope, validate_gov_event |
Transport-neutral event metadata; no carrier payload authority. |
| experimental | govengine.execution.gate | DryRunRunner, ExecutionGate, ExecutionGateInput, RunnerProfile |
Dry-run/default-deny execution gate helpers; no live backend ownership. |
| adapter | govengine.execution.runner_protocol | runner_receipt_public_summary |
Public-safe runner receipt summary over bounded binding refs and digest counts only; no raw stdout/stderr publication and no execution authority. |
| adapter | govengine.execution.supervision | GovRunnerLease, GovSupervisionDecision, GovSupervisionPlan, LocalSubprocessRunnerReadiness, evaluate_local_subprocess_runner_readiness, runner_lease_from_request, supervision_plan_from_runner_request, validate_runner_lease, validate_runner_receipt_binding, validate_runner_receipt_for_request, validate_supervised_runner_request, validate_supervision_decision, validate_supervision_plan |
Runner request, lease, supervision, readiness, and receipt boundary helpers; live subprocess execution remains not applicable until the missing host-owned safety prerequisites are closed. |
| experimental | govengine.execution_backend | CommandResult, GovExecutionBackend |
Host-neutral backend protocol/result helpers. |
| adapter | govengine.lifecycle | ArtifactLifecycleController, TransitionGate, TransitionPolicy, canonical_lifecycle_state |
Lightweight lifecycle gate/controller helpers; verified_chain and verified_lifecycle are canonical while legacy aliases are migration shims; SCLite remains lifecycle authority. |
| experimental | govengine.ooda | GovObservation, GovOodaController, GovOodaDecision, GovOrientation |
Neutral OODA records/controller; no scheduler or agent framework ownership. |
| experimental | govengine.orchestration | OrchestrationStep, OrchestratorBoundary, orchestrator_boundary_contract, validate_orchestration_step |
Deterministic orchestration handoff records only. |
| experimental | govengine.planning | GovPlanIntentContract, GovTaskContract, PlannerPort, task_contract_from_host_task, validate_plan_intent_contract, validate_planner_port, validate_task_contract |
Planner-to-runtime contract shapes; no planner implementation ownership. |
| v1-candidate | govengine.policy | CompiledPolicyPack, CompileResult, PolicyCompiler, PolicyConstraint, PolicyEngine, PolicyEnforcementPlan, PolicyEvaluationExplanation, PolicyObligation, PolicyRequest, PolicyRule, PolicyVerdict, RuntimeControlProjection, admit_policy_execution, compile_policy_pack, evaluate_policy, explain_policy_evaluation, policy_enforcement_admission, policy_enforcement_admission_digest, policy_enforcement_plan_digest, policy_pack_digest, policy_verdict_digest, project_runtime_controls, validate_policy_enforcement_admission, validate_policy_enforcement_plan, validate_policy_request, validate_policy_verdict |
Deterministic policy request/verdict contracts, legacy v0.1 equality-map compatibility, typed v1 condition AST with a closed operator set and namespace/type validation, v1 issuer/epoch/validity declarations, fail-closed evaluation, redacted policy explanation, GovEngine-owned enforcement plan, existing GovAdmissionDecision binding, canonical digests for GovEngine records, and domain-neutral runtime-control projection. PolicyCondition and host-owned PolicyActivationBinding remain module-scoped during facade reduction; hosts still own policy repository/activation storage, IO/enforcement, and SCLite retains truth/canonicalization authority. |
| adapter | govengine.profiles | CapabilityDeclaration, DomainProfile, EvidenceRuleDeclaration, PlanningStageRegistry, PolicyHookDeclaration, ProfileConformanceReport, ResourceTypeRegistry, RunnerProfileDeclaration, TaskFamilyRegistry, profile_conformance_report, validate_domain_profile, validate_profile_conformance |
Contract-only domain profile SDK; domain fixtures are classified separately and hosts own domain semantics. |
| adapter | govengine.replay | GuardedBundleRuntimeDecision, GuardReplayDecision, GuardReplayRecord, ReplayClaimStore, evaluate_guard_replay, guard_replay_record_from_guard, record_guard_replay, verify_guard_and_record_replay |
Guarded SCLite root replay freshness over host-supplied store plus a claim-once port; no HMAC/key ownership, database ownership, or production concurrency guarantee. |
| adapter | govengine.review | GovEvidenceClaim, GovEvidenceQualification, GovEvidenceRequirement, GovReviewResult, evidence_claim_public_summary, qualify_evidence_claim, review_result_public_summary, validate_evidence_claim, validate_evidence_qualification, validate_evidence_requirement, validate_evidence_review_chain, validate_review_result |
Receipt-bounded evidence review records and public-safe summaries; SCLite review bundle authority is not duplicated and raw evidence stays host-owned. |
| adapter | govengine.roles | GovRoleAdapters |
Adapter binding record; no Ravenclaw/OpenClaw dependency. |
| experimental | govengine.runtime_shell | GovControlAction, GovQueueLane, GovQueueSnapshot, GovRuntimeSnapshot, GovSchedulerTick, control_action_from_host_action, queue_snapshot_from_lanes, validate_control_action, validate_queue_snapshot, validate_runtime_snapshot, validate_scheduler_tick |
Host-provided runtime shell projection; no scheduler/storage/live-execution authority. |
| adapter | govengine.sclite_contracts lazy exports | GovSCLiteLifecycleVerifier, review_bundle_state, review_bundle_transition_decision, review_sclite_bundle, verify_lifecycle_manifest |
Lazy SCLite bridge exports; SCLite owns lifecycle and review verification. |
| adapter | govengine.scope_ports | FunctionalScopePort, GovScopePort |
Host-neutral scope port protocols/helpers. |
| adapter | govengine.signing | KeyResolutionRequest, KeyResolutionResult, KeyResolverPort, SignatureEnvelope, SignedArtifact, SigningPolicy, TrustPolicy, TrustStoreDecision, TrustStorePort, VerificationResult, canonical_govengine_record, govengine_record_digest, signed_artifact_from_record, signature_transition_decision, verify_signed_govengine_record |
Host-provided signer/verifier/key-resolver/trust-store decision records plus deterministic serialization/digest, signed-envelope helpers, and signature transition decisioning for GovEngine-owned records only; no SCLite canonicalization, PKI/KMS, or key-store ownership. |
| fixture | govengine.signing demo helpers | DemoDigestSigner, DemoDigestVerifier, demo_sign_and_verify, demo_sign_govengine_record |
Deterministic demo-only signer/verifier helpers; not cryptographic identity proof. |
| experimental | govengine.state_index | ArtifactStateIndex |
Lightweight artifact state summary helper. |
| experimental | govengine.state_machine | GovRunState, StateTransition, apply_state_transition, validate_run_state, validate_state_transition |
Neutral run-state transitions; no persistence/scheduler/live-execution authority. |
| experimental | govengine.state_store | GovStateStore |
Neutral JSON state helper primitive; production persistence remains host-owned. |
| experimental | govengine.surfaces | GovSurface, admission_policy_surface, domain_profile_sdk_surface, public_surface_index, runtime_contract_proofs_surface |
Machine-readable public surface registry. |
| adapter | govengine.triggers | TRIGGER_PLANNING_REQUEST_SCHEMA_VERSION, TriggerPlanningRequest, admit_trigger_planning, trigger_planning_admission_digest, trigger_planning_request_digest, validate_trigger_planning_admission, validate_trigger_planning_request |
Trigger-planning admission vocabulary over bounded event/rule digests only. It uses the shared planning-admission projection and carries no execution authority; RExecOp owns trigger mechanics, profiles own event meaning, and SCLite owns evidence truth. |
| adapter | govengine.supervisor_actions | SUPERVISOR_ACTION_REQUEST_SCHEMA_VERSION, SupervisorActionRequest, admit_supervisor_action, supervisor_action_admission_digest, supervisor_action_request_digest, validate_supervisor_action_admission, validate_supervisor_action_request |
Runtime-supervisor action admission vocabulary over bounded watchdog record digests and limits only. It uses the shared planning-admission projection and carries no execution authority; RExecOp owns watchdog mechanics, SCLite owns watchdog decision truth, and GovEngine owns admission/fail-closed policy. |
| adapter | govengine.supervisor_explain | SUPERVISOR_EXPLANATION_SCHEMA_VERSION, SupervisorActionExplanation, explain_supervisor_action |
Redacted supervisor admission explanations with recovery/triage reason codes, gate checks and bounded next actions; does not execute recovery or mutate runtime state. |
| adapter | govengine.automation | AUTOMATION_TRANSITION_REQUEST_SCHEMA_VERSION, SUPPORTED_AUTOMATION_CHAIN_SCHEMA_REF, AutomationTransitionRequest, admit_automation_transition, automation_transition_admission_digest, automation_transition_request_digest, validate_automation_transition_admission, validate_automation_transition_request |
Child-operation planning admission over bounded SCLite automation_chain.v0.1 refs, depth/child budgets, allowed child intent classes, approval refs and LLM proposal-only constraints. It uses the shared planning-admission projection and carries no execution authority; RExecOp owns graph traversal/runtime emission and SCLite owns automation-chain truth. |
| adapter | govengine.automation_explain | AUTOMATION_TRANSITION_EXPLANATION_SCHEMA_VERSION, AutomationTransitionExplanation, explain_automation_transition |
Redacted child-operation planning explanations with gate checks, reason codes and safe next actions; does not create operations, execute work, validate SCLite storage or grant LLM authority. |
| adapter | govengine.profile_governance | PROFILE_GOVERNANCE_REQUEST_SCHEMA_VERSION, PROFILE_GOVERNANCE_PROJECTION_SCHEMA_VERSION, PROFILE_CONNECTOR_COMPATIBILITY_SCHEMA_VERSION, ProfileGovernanceRequest, ProfileGovernanceProjection, ProfileConnectorCompatibilityReport, ProfileGovernanceBundle, validate_profile_governance_request, project_profile_governance, evaluate_profile_connector_compatibility, explain_profile_governance, profile_governance_request_digest |
Profile governance projection and profile/connector compatibility reports over bounded host projections; does not interpret domain semantics, execute connectors, or grant admission. |
| adapter | govengine.contract_compatibility | SUPPORTED_CONTRACT_REPORT_SCHEMA_VERSION, CONTRACT_COMPATIBILITY_REQUEST_SCHEMA_VERSION, ContractCompatibilityRequest, ContractCompatibilityReport, supported_contract_report, evaluate_contract_compatibility, validate_contract_compatibility_request, validate_supported_contract_version, contract_major_version |
Central supported-contract catalog and fail-closed consumer compatibility evaluation for stack hosts; does not execute work or validate SCLite storage. |
| v1-candidate | govengine.governance_trace | GOVERNANCE_TRACE_SCHEMA_VERSION, GovernanceTrace, policy_request_digest, project_governance_trace |
Digest-bound governance trace projection for truth-path consumers; binds policy request, verdict, enforcement plan, admission, controls and evidence requirements without storing SCLite artifacts or executing work. |
| v1-candidate | govengine.governance | GovernanceRequest, validate_governance_request |
Canonical v1 governance input binding a compiled policy pack, bounded execution facts/requested scope, independent scope-policy/operation-requirement/runtime-inventory records, opaque runtime-owned spec/payload/fencing digests, operation/step/attempt/runtime/lease identity and an optional independently validated approval attestation. Supporting G2-B record/decision classes remain module-scoped until the facade is reduced/reviewed. It is not a decision, permit, runtime claim or SCLite artifact. |
| v1-candidate | govengine.governance_decision | GovernanceDecision, evaluate_governance |
Canonical fail-closed composition of PolicyEngine enforcement/trace, approval trust and signature verification, policy activation, scope, and capability decisions. An allowed result carries a short-lived attempt/lease/fencing/inventory-bound consume-once authorization contract; module-scoped DecisionClaimPort defines the atomic digest-and-nonce handoff while RExecOp still owns its storage, recovery, final claim and runtime permits. Supporting ports, validation, digest and signed-decision authority helpers remain module-scoped. |
| adapter | govengine.typed_execution_governance | TYPED_EXECUTION_GOVERNANCE_REQUEST_SCHEMA_VERSION, TYPED_EXECUTION_GOVERNANCE_PROJECTION_SCHEMA_VERSION, TYPED_EXECUTION_CAPABILITY_COMPATIBILITY_SCHEMA_VERSION, TYPED_EXECUTION_STACK_COMPATIBILITY_SCHEMA_VERSION, TYPED_EXECUTION_CONTROL_CATALOG_SCHEMA_VERSION, RUNTIME_CAPABILITY_DESCRIPTOR_SCHEMA_VERSION, TypedExecutionGovernanceRequest, RuntimeCapabilityDescriptor, TypedExecutionGovernanceProjection, TypedExecutionCapabilityCompatibilityReport, TypedExecutionGovernanceBundle, TypedExecutionStackCompatibilityRequest, TypedExecutionStackCompatibilityReport, validate_typed_execution_governance_request, validate_runtime_capability_descriptor, validate_typed_execution_stack_compatibility_request, project_typed_execution_governance, project_typed_execution_policy_overlay, map_policy_verdict_to_typed_execution_controls, evaluate_typed_execution_capability_compatibility, evaluate_typed_execution_stack_compatibility, explain_typed_execution_governance, typed_execution_governance_request_digest, typed_execution_control_catalog, admit_typed_execution, typed_execution_admission_digest, validate_typed_execution_admission |
Typed execution governance projection, policy-pack control overlay, per-step capability compatibility and stack-level backend/control compatibility over digest-bound RExecOp runtime projections; does not execute connectors, resolve secrets, or grant live backend authority. |
| fixture | govengine.admission development adapter | JsonlAuditLedgerAdapter |
Development-only JSONL ledger adapter; production persistence and concurrency remain host-owned. |
| fixture | govengine.boundary profile fixtures | known_profile_contracts, ravenclaw_profile_contract |
Fixture/profile metadata retained for conformance only; not part of the v1 kernel. |
| fixture | govengine.context compatibility fixture | ravenclaw_context |
Legacy host-context fixture retained for compatibility testing. |
| fixture | govengine.profiles domain fixtures | ravenclaw_security_profile, tecrax_infra_ops_profile |
Domain profile fixtures; domain semantics remain in their owning products. |
| fixture | govengine.replay development adapters | InMemoryReplayClaimStore, record_guard_replay_file |
Non-production replay fixtures without durable atomicity guarantees. |
| internal-exposed | govengine.scope_assertion compatibility imports | build_scope_assertion, build_scope_decision, scope_decision_digest |
Explicit top-level compatibility imports consumed by RExecOp but intentionally excluded from govengine.__all__; migrate the consumer before removal or stable classification. |
Current summary:
- v1-candidate exports: 40
- adapter exports: 188
- experimental exports: 61
- fixture exports: 19
- remove exports: 0
- internal-exposed exports: 3