Runtime Governance Records

What gets recorded

The runtime governance profile covers six record families under theorg.peacprotocol/runtime-governance namespace. Each event maps to one of the six type URIs in the extension registry.

Install

pnpm add @peac/adapter-runtime-governance @peac/protocol

Basic Usage

The adapter accepts your runtime's governance event output and maps it to a structured PEAC record. Pass the record to issue()with your signing key to produce a compact JWS.

import {
  normalizeRuntimeGovernanceEvent,
  issueRuntimeGovernanceRecord,
} from '@peac/adapter-runtime-governance';
import { generateKeypair } from '@peac/crypto';

const { privateKey } = await generateKeypair();

// Normalize your governance runtime's output into a runtime-governance event
const event = normalizeRuntimeGovernanceEvent({
  provider: 'your-governance-runtime',
  occurred_at: new Date().toISOString(),
  payload: {
    family: 'policy_decision',
    action: 'tool.call',
    matched_rule: 'agent-safety-v2',
    reason: 'scope_permitted',
  },
});

// Issue a signed runtime-governance record (compact JWS)
const { jws } = await issueRuntimeGovernanceRecord(event, {
  iss: 'https://governance.example.com',
  privateKey,
  kid: 'peac-2026-03',
});

// Carry jws in a PEAC-Receipt header or A2A metadata
console.log(jws);

Record shape

Each record carries governance-specific fields inside the extension block. All identifiers are opaque references — no raw policy text, agent identity strings, or runtime-internal data is stored inline.

// Decoded JWS payload (the typ header "interaction-record+jwt" lives in the JOSE header)
{
  "peac_version": "0.2",
  "kind": "evidence",
  "type": "org.peacprotocol/runtime-governance-policy-decision",
  "iss": "https://governance.example.com",
  "iat": 1747008000,
  "jti": "rg-9f2c1a7b",
  "pillars": ["safety", "compliance"],
  "extensions": {
    "org.peacprotocol/runtime-governance": {
      "provider": "your-governance-runtime",
      "action": "tool.call",
      "matched_rule": "agent-safety-v2",
      "reason": "scope_permitted",
      "upstream_artifact": {
        "source_system": "your-governance-runtime",
        "source_event_id": "evt-2026-06-01-001"
      }
    }
  }
}

The upstream_artifact block preserves the raw source attribution from the governance runtime without synthesizing additional semantics.

Microsoft AGT / AAIF Compatibility

The adapter ships a mapper, mapAgtEvent, for Microsoft AGT runtime governance events. It normalizes those events into the six canonical runtime-governance families below, preserving the upstream source attribution verbatim.

import { mapAgtEvent, issueRuntimeGovernanceRecord } from '@peac/adapter-runtime-governance';
import { generateKeypair } from '@peac/crypto';

const { privateKey } = await generateKeypair();

// Map a Microsoft AGT governance event into a runtime-governance event
const event = mapAgtEvent(agtEvent);

const { jws } = await issueRuntimeGovernanceRecord(event, {
  iss: 'https://governance.example.com',
  privateKey,
  kid: 'peac-2026-03',
});

Upstream artifact preservation

PEAC never synthesizes governance outcomes from incomplete data. Theupstream_artifact block is required on all RTGOV records and preserves the source runtime's attribution without interpretation.

Conformance — Section 27 (RTGOV)

Seven requirements cover the observable emitted-record semantics for runtime governance records.

Resources