Legis · git/CI governance & attestations · Python

One attributable, tamper-evident record — instead of a silent pass.

Every agent action at the git/CI boundary that breaks a policy produces exactly one identity-stable audit record — and Legis grades who must answer (self-record / LLM-judge / human sign-off) server-side, so the agent never chooses how cheaply it clears a gate.

See the 2×2 →

Read the repo →

$ legis policy_evaluate { policy, target }

verdict → one SEI-keyed record; identity_stable flagged honestly…

loomweave:eid:7f3a9c2e1b…

legispresent

loomweavepresent

warplinepresent

filigreeabsent

plainweaveunavailable

version snapshot v1.1.1 — the gold release line. Moving facts live in the repo.

What it is

The federation’s governance surface — the one judge.

Legis is the Weft authority for change provenance and governance over change: it answers what changed, in which branch/commit/PR/check context, and what governance or attestation state exists for that change? It owns the verdicts, the enforcement cells, the HMAC-signed protected records, and the SEI-keyed sign-off ledger.

Not a hardened security boundary or access control.

Legis is deconfliction-first, not security — a “forced me to do the right thing” discipline plus an attributable, tamper-evident record, never an access-control gate, and low-security by design. Its worth is the effort the threat model forces and the residual tiers it names honestly (raw DB-file write, model-robustness, response-integrity-rests-on-TLS) — not a claim to withstand an attacker who already holds those capabilities. Do not lean on it to keep anyone out, or for secure, regulated, or confidential data.

The governance 2×2 · graded enforcement

When a policy fires, the cell decides who answers.

Two independent, agent-set axes: how much governance structure you want (simple / complex), and whether an LLM judge sits inline (off / on). The base stays weightless — a solo project that never switches Legis on pays nothing — and every cell is genuinely useful.

chill simple · judge off

CI flags the violation; the agent self-reports a recordable override; the human reviews the trail asynchronously. No LLM, no crypto, no ceremony.

coached simple · judge on

The same flow, but an LLM judge evaluates the proposed override before it records — an interactive wall behind one config flag. The agent cannot self-clear past the judge.

structured complex · judge off

Block + escalate without a model in the loop: a designated human operator signs off before the gate clears. Hard gates, explicit human authority, no LLM in the critical path.

protected complex · judge on

The full machinery: HMAC-signed verdicts bound to source bytes + AST node, a decay sweep that re-runs suppressions through the judge, and the override-rate gate.

Key capabilities

What it gives an agent at the boundary.

Verdicts you can act on

policy_evaluate returns CLEAR / VIOLATION / UNKNOWN with an honest provenance_gap — a verdict resolves with identity_stable:false flagged when a sibling capability is absent, never silently rounded up to green.

One override verb, four cells

override_submit routes to the governing cell server-side and returns a discriminated outcome (ACCEPTED_SELF / ACCEPTED_BY_JUDGE / BLOCKED / ESCALATED_PENDING / NEED_INPUTS). NEED_INPUTS comes back as a guided non-error, not a failure.

SEI-keyed audit lineage

Every verdict, override, and sign-off lands in an append-only trail keyed on Stable Entity Identity, so the record survives rename and move. A tampered trail reads as AUDIT_INTEGRITY_FAILURE, never silently.

Git/CI provenance + the rename feed

Branch, commit, pull-request, and check context around the work — plus git_rename_feed_get, the contract-locked provider seam Loomweave’s SEI matcher consumes.

Usage snapshot

Legis runs as a service; agents drive it over MCP.

A curated quick-start, not the full surface. The complete CLI (nine subcommands) and the 21-tool MCP catalogue live in the repo — see the pointers below.

$ legis install # instruction block, skill, hook, .mcp.json

$ legis serve # start the HTTP governance service

$ legis mcp --agent-id <id> # attributable MCP stdio surface

$ legis doctor --fix # view + safe-repair install/config health

surface	verb	does
`MCP`	`policy_evaluate`	verdict (CLEAR / VIOLATION / UNKNOWN) without recording an override
`MCP`	`policy_explain`	which cell governs this policy/entity, and the move you may make next
`MCP`	`override_submit`	one verb routes all four cells; returns a discriminated outcome envelope
`MCP`	`signoff_status_get`	poll a structured sign-off request by `seq`
`MCP`	`git_rename_feed_get`	the contract-locked git-rename provider seam
`MCP`	`scan_route`	route a Wardline scan finding into governance

How it composes · Legis’s pairings

Each pair lights up a capability neither tool has alone.

Legis is a consumer of identity, never an authority, and never re-adjudicates trust — Wardline analyses, Legis governs: one judge, not two. A partial or planned pairing is never rendered as live.

Legis

Wardline

live

Agent-defined policy enforced at the CI/git boundary.

Legis

Loomweave

live

Governance attestations keyed to stable code identity.

Legis

Filigree

live

Governed issue lifecycle — sign-offs, RTM, verification.

Legis

Warpline

planned

Temporal change facts available to governance preflight.

Seam frozen; implementation fast-follow.

Status & honest limits

What it is, and what it is not.

Legis is at v1.1.1 — the gold release line; all four 2×2 cells work end-to-end. It is a governance-honesty tool, so it states its own residual limits in the open rather than leaving them in source comments.

Consumer of identity, never an authority. Legis treats loomweave:eid:7f3a9c2e1b… as opaque — never derived, parsed, or reinterpreted. Keys its facts on the SEI spine, treats it as opaque, and never mints it — Loomweave is the one identity authority. Read the SEI spine →
The coached cell is a model-robustness wall, not a cryptographic one. A prompt injection that persuades the judge clears it. For verdicts that must not rest on the model’s word, use the protected cell.
Tamper-evidence assumes the signing key is out of reach. It is not absolute against an actor with raw write access to the governance .db; keep the store on storage only the operator controls.
The git-rename seam is contract-locked, operative pending Loomweave. The provider seam is built; operative use is jointly gated on Loomweave driving a committed rev-range.

Links & pointers

The authoritative surfaces.

Repository — authority for the endpoint list and policy grammar (README.md, src/legis/mcp.py, CHANGELOG.md)
CLI reference — the nine subcommands, flags, exit codes
MCP tool reference — all 21 tools, key arguments, the error envelope
Configuration guide — what each cell costs to enable, env vars, escape hatches
SEI conformance — Legis’s consumer posture and obligations

Want to see it actually run?

make tour the whole federation against Lacuna, the demonstration specimen — governance routing over a small app with catalogued flaws, analyzed by every member at once.

See it on the specimen →

Read the doctrine →