Three helpers the pre-extraction AGT engine exposed have no equivalent in 0.4.0-alpha.1. Each is reimplementable over the public surface, which is what agent-governance-toolkit now does, but the reimplementations are the kind that drift.
Manifest::from_url(url, sha256). Loading a top-level manifest from a URL. The crate still fetches URLs during extends resolution, with redirect caps, size limits, and sha256 verification, so the capability is present but not reachable directly. AGT reaches it by writing a synthetic one-entry extends manifest to a temp file and loading that with Manifest::from_path_with_limits, which reuses the crate's own fetcher rather than adding an HTTP client. It works, and it is clearly a workaround.
Runtime::policy_labels(). Resolved policy_id and configured annotator names per interception point, read once at construction so telemetry events carry consistent labels. AGT rebuilds it from manifest.intervention_points. The output shape has to match what SDK consumers already parse, so the reimplementation is pinned to the original by a test rather than by the type system.
Manifest::validate_overlay. Validating the overlay-safe subset of manifest keys. AGT reimplements this in core/src/manifest_yaml.rs over the public manifest surface, which means the subset definition now lives in two places.
The first two are small additions. The third is the one most likely to diverge quietly, because the safe subset is a policy decision rather than a mechanical one.
Verified against the published 0.4.0-alpha.1 sources.
Three helpers the pre-extraction AGT engine exposed have no equivalent in 0.4.0-alpha.1. Each is reimplementable over the public surface, which is what agent-governance-toolkit now does, but the reimplementations are the kind that drift.
Manifest::from_url(url, sha256). Loading a top-level manifest from a URL. The crate still fetches URLs duringextendsresolution, with redirect caps, size limits, and sha256 verification, so the capability is present but not reachable directly. AGT reaches it by writing a synthetic one-entryextendsmanifest to a temp file and loading that withManifest::from_path_with_limits, which reuses the crate's own fetcher rather than adding an HTTP client. It works, and it is clearly a workaround.Runtime::policy_labels(). Resolvedpolicy_idand configured annotator names per interception point, read once at construction so telemetry events carry consistent labels. AGT rebuilds it frommanifest.intervention_points. The output shape has to match what SDK consumers already parse, so the reimplementation is pinned to the original by a test rather than by the type system.Manifest::validate_overlay. Validating the overlay-safe subset of manifest keys. AGT reimplements this incore/src/manifest_yaml.rsover the public manifest surface, which means the subset definition now lives in two places.The first two are small additions. The third is the one most likely to diverge quietly, because the safe subset is a policy decision rather than a mechanical one.
Verified against the published 0.4.0-alpha.1 sources.