Vouch is a community trust management system that lets open-source projects gatekeep contributions behind an explicit vouching mechanism. It maintains a VOUCHED.td file (a flat text format called Trustdown) listing trusted and denounced users. The system provides a Nushell-based CLI for local management, and eight composite GitHub Actions for full GitHub integration: checking issues/PRs on open/reopen, managing vouches via issue or discussion comments, syncing CODEOWNERS, and installing the CLI. The entire implementation is in Nushell script, making it dependency-light (only requires `nu` and `gh`) while achieving surprising sophistication in API handling, retry logic, and file parsing. Architecturally, Vouch is modular: `vouch/file.nu` handles the custom TD file format with full comment/whitespace preservation; `vouch/lib.nu` provides pure-data operations (add, remove, check, denounce) that operate on parsed tables; `vouch/github.nu` wraps the GitHub REST and GraphQL APIs with exponential-backoff retry, collaborator permission checking, and automated commit/push workflows; and `vouch/template.nu` provides a simple template engine for custom response messages. The GitHub Actions in `action/` are composite actions that invoke these Nushell modules directly. The quality of the codebase is notably high for a Nushell project: it follows a disciplined module structure, has comprehensive tests (both fast unit tests and slow integration tests against the live mitchellh/vouch repository), uses typed flags and structured error handling, and implements patterns like retry with rebase for concurrent edits. The TD file parser (`from td`/`to td`) is a particularly well-crafted component that could be extracted as a standalone Nushell module for any project needing a simple, human-readable trust list format. The comment parsing regex patterns are robust against injection and multiline attacks. Overall, Vouch is a well-engineered, self-dogfooded tool that solves a real open-source moderation problem with minimal external dependencies.
This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.