fix(ci): restore read-all at workflow level for Scorecard verification (#327)

imran-siddique · Copilot · parsa-faraji · web-flow · commit 3fcd70dbe7e5 · 2026-03-21T09:27:42.000-07:00
* docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes #316 * ci: add markdown link checker workflow (#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (#309) (#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR #325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -6,12 +6,9 @@ on:
   schedule:
     - cron: "15 7 * * 1"
 
-# Minimum permissions required by OpenSSF Scorecard
-permissions:
-  security-events: write
-  id-token: write
-  contents: read
-  actions: read
+# Workflow-level permissions must be read-only for Scorecard verification.
+# Write permissions are scoped to the job level below.
+permissions: read-all
 
 jobs:
   analysis:
diff --git a/README.md b/README.md
@@ -271,6 +271,18 @@ Works with **12+ agent frameworks** including:
 | Human-Agent Trust Deficit | ASI-09 | ✅ Full audit trails + flight recorder |
 | Rogue Agents | ASI-10 | ✅ Kill switch + ring isolation + behavioral anomaly detection |
 
+Full mapping with implementation details and test evidence: **[OWASP-COMPLIANCE.md](docs/OWASP-COMPLIANCE.md)**
+
+### Regulatory Alignment
+
+| Regulation | Deadline | AGT Coverage |
+|------------|----------|-------------|
+| EU AI Act — High-Risk AI (Annex III) | August 2, 2026 | Audit trails (Art. 12), risk management (Art. 9), human oversight (Art. 14) |
+| Colorado AI Act (SB 24-205) | June 30, 2026 | Risk assessments, human oversight mechanisms, consumer disclosures |
+| EU AI Act — GPAI Obligations | Active | Transparency, copyright policies, systemic risk assessment |
+
+AGT provides **runtime governance** — what agents are allowed to do. For **data governance** and regulator-facing evidence export, see [Microsoft Purview DSPM for AI](https://learn.microsoft.com/purview/ai-microsoft-purview) as a complementary layer.
+
 ## Performance
 
 Governance adds **< 0.1 ms per action** — roughly 10,000× faster than an LLM API call.
diff --git a/docs/deployment/azure-foundry-agent-service.md b/docs/deployment/azure-foundry-agent-service.md
@@ -82,7 +82,7 @@ Each middleware works independently. Use any combination based on your requireme
 pip install agent-governance-toolkit[full]
 
 # Or install individual packages
-pip install agent-os agentmesh agent-sre
+pip install agent-os-kernel agentmesh-platform agent-sre
 ```
 
 ---
diff --git a/docs/tutorials/06-execution-sandboxing.md b/docs/tutorials/06-execution-sandboxing.md
@@ -55,7 +55,7 @@ layers of defense:
 
 - Python ≥ 3.11
 - `pip install agent-runtime` (v2.0.2+)
-- For capability guards: `pip install agent-os`
+- For capability guards: `pip install agent-os-kernel`
 
 ---
 
diff --git a/packages/agent-compliance/docs/submissions/adversa-mcp-security-submission.md b/packages/agent-compliance/docs/submissions/adversa-mcp-security-submission.md
@@ -88,7 +88,7 @@ Identifies malicious schema patterns:
 
 ```bash
 # Install
-pip install agent-os
+pip install agent-os-kernel
 
 # Scan an MCP configuration file
 mcp-scan scan mcp-config.json
diff --git a/packages/agent-compliance/docs/submissions/owasp-genai-implementation-guide.md b/packages/agent-compliance/docs/submissions/owasp-genai-implementation-guide.md
@@ -11,7 +11,7 @@ The stack consists of four components:
 
 | Component | Role | Install |
 |---|---|---|
-| **Agent OS** | Governance kernel — policy, sandbox, memory, MCP security | `pip install agent-os` |
+| **Agent OS** | Governance kernel — policy, sandbox, memory, MCP security | `pip install agent-os-kernel` |
 | **AgentMesh** | Identity & trust — DIDs, SPIFFE, handshake, reputation | `pip install agentmesh` |
 | **Agent SRE** | Observability — SLOs, anomaly detection, chaos, OpenTelemetry | `pip install agent-sre` |
 | **Agent Runtime** | Runtime control — kill switch, execution rings, saga rollback | `pip install agent-runtime` |
@@ -1044,7 +1044,7 @@ This implementation guide is a community contribution to the OWASP GenAI project
 To reproduce the examples, install the stack:
 
 ```bash
-pip install agent-os agentmesh agent-sre agent-runtime
+pip install agent-os-kernel agentmesh-platform agent-sre agent-runtime
 ```
 
 All source code is available under the MIT license. PRs and issues welcome at
diff --git a/packages/agent-os/assets/demo-terminal.svg b/packages/agent-os/assets/demo-terminal.svg
@@ -43,7 +43,7 @@
   <g class="terminal" transform="translate(20, 55)">
     <!-- Line 1: pip install -->
     <g class="line1">
-      <text y="0"><tspan class="prompt">$ </tspan><tspan class="command">pip install agent-os</tspan></text>
+      <text y="0"><tspan class="prompt">$ </tspan><tspan class="command">pip install agent-os-kernel</tspan></text>
     </g>
     
     <!-- Line 2: install output -->
diff --git a/packages/agent-os/docs/index.md b/packages/agent-os/docs/index.md
@@ -59,7 +59,7 @@ Learn by doing with our Jupyter notebooks:
 
 ```bash
 # Core package
-pip install agent-os
+pip install agent-os-kernel
 
 # With all features
 pip install agent-os-kernel[full]
diff --git a/packages/agent-os/docs/troubleshooting.md b/packages/agent-os/docs/troubleshooting.md
@@ -43,7 +43,7 @@ Common issues and solutions for Agent OS.
 
 2. **Install in the correct environment:**
    ```bash
-   python -m pip install agent-os
+   python -m pip install agent-os-kernel
    ```
 
 ### Import errors with optional dependencies
diff --git a/packages/agent-os/docs/tutorials/getting-started.md b/packages/agent-os/docs/tutorials/getting-started.md
@@ -10,7 +10,7 @@
 ## Step 1: Install (30 seconds)
 
 ```bash
-pip install agent-os
+pip install agent-os-kernel
 ```
 
 ## Step 2: Create Your First Agent (2 minutes)
diff --git a/packages/agent-os/docs/tutorials/vscode-extension.md b/packages/agent-os/docs/tutorials/vscode-extension.md
@@ -509,7 +509,7 @@ jobs:
           python-version: '3.11'
       
       - name: Install AgentOS
-        run: pip install agent-os
+        run: pip install agent-os-kernel
       
       - name: Run Policy Validation
         run: agent-os validate --policy policies/ --strict
diff --git a/packages/agent-os/docs/unified-vision.md b/packages/agent-os/docs/unified-vision.md
@@ -336,7 +336,7 @@ spec:
 ### Step 1: Start with Agent OS
 
 ```bash
-pip install agent-os
+pip install agent-os-kernel
 ```
 
 ```python
diff --git a/packages/agent-os/examples/crewai-safe-mode/crewai_safe_mode.py b/packages/agent-os/examples/crewai-safe-mode/crewai_safe_mode.py
@@ -15,7 +15,7 @@
 4. Your data stays safe ✓
 
 Run:
-    pip install agent-os crewai
+    pip install agent-os-kernel crewai
     python crewai_safe_mode.py
 
 Perfect for recording a 15-second GIF showing "Access Denied"!
diff --git a/packages/agent-os/examples/crewai-safe-mode/langchain_safe_mode.py b/packages/agent-os/examples/crewai-safe-mode/langchain_safe_mode.py
@@ -15,7 +15,7 @@
 4. Your data stays safe ✓
 
 Run:
-    pip install agent-os langchain
+    pip install agent-os-kernel langchain
     python langchain_safe_mode.py
 
 For PyPI package: pip install langchain-agent-os
diff --git a/packages/agent-os/examples/hello-world/README.md b/packages/agent-os/examples/hello-world/README.md
@@ -12,7 +12,7 @@ The simplest possible Agent OS example.
 
 ```bash
 # Install
-pip install agent-os
+pip install agent-os-kernel
 
 # Run
 python agent.py
diff --git a/packages/agent-os/examples/integrations/governance_quickstart.py b/packages/agent-os/examples/integrations/governance_quickstart.py
@@ -7,7 +7,7 @@
 audit trails) to every major agent framework with a unified API.
 
 Usage:
-    pip install agent-os
+    pip install agent-os-kernel
     python governance_quickstart.py
 """
 
diff --git a/packages/agent-os/extensions/copilot/src/agentGenerator.ts b/packages/agent-os/extensions/copilot/src/agentGenerator.ts
@@ -687,7 +687,7 @@ jobs:
       
       - name: Install dependencies
         run: |
-          pip install agent-os
+          pip install agent-os-kernel
           pip install -r requirements.txt
       
       - name: Run Agent
diff --git a/packages/agent-os/extensions/copilot/src/githubIntegration.ts b/packages/agent-os/extensions/copilot/src/githubIntegration.ts
@@ -199,7 +199,7 @@ jobs:
       
       - name: Install Agent OS
         run: |
-          pip install agent-os
+          pip install agent-os-kernel
           pip install -r requirements.txt || true
       
       - name: Validate policies
@@ -270,7 +270,7 @@ jobs:
           python-version: '3.11'
       - name: Run tests
         run: |
-          pip install agent-os pytest
+          pip install agent-os-kernel pytest
           pytest tests/test_${this.toSnakeCase(spec.name)}.py -v
 
   security-scan:
@@ -279,7 +279,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Security scan
         run: |
-          pip install agent-os
+          pip install agent-os-kernel
           agentos check agents/${this.toSnakeCase(spec.name)}.py --security
 
   deploy-staging:
@@ -465,7 +465,7 @@ gh workflow run ${this.toKebabCase(spec.name)}.yml
 ### Local Development
 \`\`\`bash
 # Install dependencies
-pip install agent-os
+pip install agent-os-kernel
 
 # Run locally
 python agents/${this.toSnakeCase(spec.name)}.py
diff --git a/packages/agent-os/extensions/vscode/src/enterprise/integration/cicdIntegration.ts b/packages/agent-os/extensions/vscode/src/enterprise/integration/cicdIntegration.ts
@@ -61,7 +61,7 @@ jobs:
           python-version: '3.11'
           
       - name: Install Agent OS
-        run: pip install agent-os
+        run: pip install agent-os-kernel
         
       - name: Run Policy Validation
         run: |
@@ -89,7 +89,7 @@ agent-os-check:
   stage: security
   image: python:3.11
   before_script:
-    - pip install agent-os
+    - pip install agent-os-kernel
   script:
     - agentos check --format json --output agent-os-report.json
     - agentos check --fail-on-violation
@@ -119,7 +119,7 @@ steps:
       versionSpec: '3.11'
       
   - script: |
-      pip install agent-os
+      pip install agent-os-kernel
     displayName: 'Install Agent OS'
     
   - script: |
@@ -147,7 +147,7 @@ steps:
     stages {
         stage('Setup') {
             steps {
-                sh 'pip install agent-os'
+                sh 'pip install agent-os-kernel'
             }
         }
         
@@ -189,7 +189,7 @@ jobs:
       - checkout
       - run:
           name: Install Agent OS
-          command: pip install agent-os
+          command: pip install agent-os-kernel
       - run:
           name: Run Security Check
           command: |
diff --git a/packages/agent-os/modules/emk/README.md b/packages/agent-os/modules/emk/README.md
@@ -12,7 +12,7 @@ emk provides a simple append-only store for recording agent experiences. Episode
 ## Installation
 
 ```bash
-pip install emk
+pip install agent-os-kernel[full]  # emk is included as a submodule
 ```
 
 ## Quick Start
diff --git a/packages/agent-os/modules/emk/emk/hf_utils.py b/packages/agent-os/modules/emk/emk/hf_utils.py
@@ -7,7 +7,7 @@
 results to/from the Hugging Face Hub for sharing and reproducibility.
 
 Requirements:
-    pip install emk[huggingface]
+    pip install agent-os-kernel[full]  # includes emk with huggingface support
 
 Example:
     >>> from emk.hf_utils import upload_episodes_to_hub
@@ -52,7 +52,7 @@ def _check_hf_hub() -> None:
     if not _HF_HUB_AVAILABLE:
         raise ImportError(
             "huggingface_hub is required for this functionality. "
-            "Install it with: pip install emk[huggingface]"
+            "Install it with: pip install agent-os-kernel[full]"
         )
 
 
diff --git a/packages/agent-os/src/agent_os/cli/__init__.py b/packages/agent-os/src/agent_os/cli/__init__.py
@@ -202,7 +202,7 @@ def handle_invalid_policy(name: str) -> str:
 
 def handle_missing_dependency(package: str, extra: str = "") -> str:
     """Error message when an optional dependency is missing."""
-    install_cmd = f"pip install agent-os[{extra}]" if extra else f"pip install {package}"
+    install_cmd = f"pip install agent-os-kernel[{extra}]" if extra else f"pip install {package}"
     return format_error(
         f"Required package not installed: {package}",
         suggestion=f"Install with: {install_cmd}",
diff --git a/packages/agent-os/tests/test_cli.py b/packages/agent-os/tests/test_cli.py
@@ -524,7 +524,7 @@ def test_handle_missing_dependency(self):
         from agent_os.cli import handle_missing_dependency
 
         msg = handle_missing_dependency("redis", extra="redis")
-        assert "pip install agent-os[redis]" in msg
+        assert "pip install agent-os-kernel[redis]" in msg
 
     def test_handle_connection_error(self):
         """Test connection-error helper includes host:port."""
diff --git a/packages/agentmesh-integrations/copilot-governance/README.md b/packages/agentmesh-integrations/copilot-governance/README.md
@@ -197,7 +197,7 @@ npm install @agentmesh/mastra
 
 **Python agents:**
 ```bash
-pip install agent-os
+pip install agent-os-kernel
 ```
 
 See the [Agent Governance Toolkit](https://github.com/microsoft/agent-governance-toolkit) for the full documentation.
diff --git a/packages/agentmesh-integrations/copilot-governance/src/reviewer.ts b/packages/agentmesh-integrations/copilot-governance/src/reviewer.ts
@@ -563,7 +563,7 @@ export function formatReviewResult(result: ReviewResult): string {
   lines.push(
     "> 📦 Add governance to your agent in minutes: " +
       "`npm install @agentmesh/mastra` (TypeScript) or " +
-      "`pip install agent-os` (Python)."
+      "`pip install agent-os-kernel` (Python)."
   );
 
   return lines.join("\n");
