curl -X POST https://console.regulator.ai/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your-email@company.com",
    "password": "your-password"
  }'

{
  "success": true,
  "data": {
    "operator": {
      "id": "op-7f3a2b1c",
      "email": "your-email@company.com",
      "role": "admin",
      "organization": "your-org"
    },
    "sessionId": "sess-a8b3c2d1-4e5f-6789-abcd-ef0123456789",
    "apiKey": "vos_live_k1_7f3a2b1c9d4e5f6789abcdef01234567",
    "expiresAt": "2026-03-26T21:35:00.000Z"
  }
}

const VIENNA_API_KEY = process.env.VIENNA_API_KEY;
const BASE_URL = "https://console.regulator.ai";

const headers = {
  "Content-Type": "application/json",
  Authorization: `Bearer ${VIENNA_API_KEY}`,
};

import os
import requests

VIENNA_API_KEY = os.environ["VIENNA_API_KEY"]
BASE_URL = "https://console.regulator.ai"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {VIENNA_API_KEY}",
}

curl -X POST https://console.regulator.ai/api/v1/fleet \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VIENNA_API_KEY" \
  -d '{
    "name": "support-agent-01",
    "description": "Customer support automation agent",
    "type": "autonomous",
    "trust_score": 50,
    "allowed_actions": ["send_email", "query_database", "create_ticket"],
    "metadata": {
      "framework": "langchain",
      "version": "0.1.0",
      "owner": "platform-team"
    }
  }'

{
  "success": true,
  "data": {
    "agent_id": "agt-9c8b7a6f-5e4d-3c2b-1a09-876543210fed",
    "name": "support-agent-01",
    "status": "active",
    "trust_score": 50,
    "api_key": "vos_agent_k1_9c8b7a6f5e4d3c2b1a09876543210fed",
    "created_at": "2026-03-25T21:35:00.000Z"
  }
}

curl -X POST https://console.regulator.ai/api/v1/agent/intent \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VIENNA_AGENT_KEY" \
  -d '{
    "action": "send_email",
    "source": {
      "platform": "langchain",
      "agent_id": "agt-9c8b7a6f"
    },
    "tenant_id": "your-org",
    "parameters": {
      "to": "customer@example.com",
      "subject": "Your support ticket #1234",
      "body": "Hi, your ticket has been resolved."
    },
    "context": {
      "ticket_id": "TKT-1234",
      "conversation_id": "conv-5678",
      "reason": "Ticket resolution notification"
    }
  }'

{
  "success": true,
  "data": {
    "intent_id": "int-2d4f6a8b-1c3e-5d7f-9a0b-c2d4e6f8a0b2",
    "status": "executed",
    "risk_tier": "T0",
    "execution_id": "exec-3e5f7a9b-2d4f-6a8c-0b1c-d3e5f7a9b1c3",
    "warrant": {
      "warrant_id": "wrt-4f6a8c0b-3e5f-7a9b-1c2d-e4f6a8c0b2d4",
      "scope": "send_email",
      "ttl": 300,
      "issued_at": "2026-03-25T21:35:01.000Z",
      "expires_at": "2026-03-25T21:40:01.000Z"
    },
    "verification": {
      "status": "passed",
      "scope_match": true,
      "verified_at": "2026-03-25T21:35:02.000Z"
    },
    "result": {
      "email_sent": true,
      "message_id": "msg-abc123"
    }
  }
}

{
  "success": true,
  "data": {
    "intent_id": "int-5a7b9c0d-4e6f-8a1b-2c3d-f5a7b9c0d1e2",
    "status": "pending_approval",
    "risk_tier": "T1",
    "approval": {
      "approval_id": "apr-6b8c0d1e-5a7b-9c2d-3e4f-a6b8c0d1e2f3",
      "required_approvers": 1,
      "current_approvals": 0,
      "expires_at": "2026-03-25T22:35:00.000Z"
    }
  }
}

async function submitIntent(action: string, parameters: Record<string, unknown>) {
  const response = await fetch(`${BASE_URL}/api/v1/agent/intent`, {
    method: "POST",
    headers,
    body: JSON.stringify({
      action,
      source: { platform: "custom", agent_id: "agt-9c8b7a6f" },
      tenant_id: "your-org",
      parameters,
    }),
  });

  const data = await response.json();

  if (data.data.status === "pending_approval") {
    console.log(`⏳ Waiting for approval: ${data.data.approval.approval_id}`);
    // Poll or use webhooks to wait for approval
    return data.data;
  }

  if (data.data.status === "executed") {
    console.log(`✅ Executed: ${data.data.execution_id}`);
    console.log(`🔒 Warrant: ${data.data.warrant.warrant_id}`);
    return data.data;
  }

  if (data.data.status === "denied") {
    console.log(`❌ Denied by policy: ${data.data.reason}`);
    throw new Error(data.data.reason);
  }
}

// Usage
await submitIntent("send_email", {
  to: "customer@example.com",
  subject: "Ticket resolved",
  body: "Your issue has been fixed.",
});

import requests

def submit_intent(action: str, parameters: dict) -> dict:
    response = requests.post(
        f"{BASE_URL}/api/v1/agent/intent",
        headers=headers,
        json={
            "action": action,
            "source": {"platform": "custom", "agent_id": "agt-9c8b7a6f"},
            "tenant_id": "your-org",
            "parameters": parameters,
        },
    )
    data = response.json()

    match data["data"]["status"]:
        case "executed":
            print(f"✅ Executed: {data['data']['execution_id']}")
            print(f"🔒 Warrant: {data['data']['warrant']['warrant_id']}")
        case "pending_approval":
            print(f"⏳ Awaiting approval: {data['data']['approval']['approval_id']}")
        case "denied":
            raise RuntimeError(f"❌ Denied: {data['data']['reason']}")

    return data["data"]

# Usage
submit_intent("send_email", {
    "to": "customer@example.com",
    "subject": "Ticket resolved",
    "body": "Your issue has been fixed.",
})

curl https://console.regulator.ai/api/v1/audit \
  -H "Authorization: Bearer $VIENNA_API_KEY" \
  -G \
  -d "limit=10" \
  -d "agent_id=agt-9c8b7a6f"

{
  "success": true,
  "data": {
    "entries": [
      {
        "id": "aud-7c9d0e1f",
        "timestamp": "2026-03-25T21:35:02.000Z",
        "type": "verification_complete",
        "intent_id": "int-2d4f6a8b",
        "execution_id": "exec-3e5f7a9b",
        "warrant_id": "wrt-4f6a8c0b",
        "agent_id": "agt-9c8b7a6f",
        "action": "send_email",
        "risk_tier": "T0",
        "result": "passed",
        "scope_compliance": true,
        "duration_ms": 847
      },
      {
        "id": "aud-6b8c0d1e",
        "timestamp": "2026-03-25T21:35:01.000Z",
        "type": "warrant_issued",
        "warrant_id": "wrt-4f6a8c0b",
        "scope": "send_email",
        "ttl": 300,
        "issuer": "system:auto-approve"
      }
    ],
    "total": 2,
    "has_more": false
  }
}

┌─────────────────────────────────────────────────┐
│                 Intent Gateway                   │
│                                                  │
│  ┌──────────┐  ┌────────────┐  ┌─────────────┐  │
│  │ Normalize │→ │  Validate  │→ │ Deduplicate │  │
│  └──────────┘  └────────────┘  └─────────────┘  │
│                                       │          │
│                                       ↓          │
│                              ┌─────────────┐     │
│                              │ Enrich with  │     │
│                              │   context    │     │
│                              └─────────────┘     │
│                                       │          │
│                                       ↓          │
│                              Policy Engine       │
└─────────────────────────────────────────────────┘

{
  "id": "pol-rule-001",
  "name": "Block high-value transactions after hours",
  "description": "Prevent financial actions over $10K outside business hours",
  "priority": 100,
  "enabled": true,
  "conditions": [
    {
      "field": "action",
      "operator": "equals",
      "value": "transfer_funds"
    },
    {
      "field": "parameters.amount",
      "operator": "gt",
      "value": 10000
    },
    {
      "field": "context.timestamp",
      "operator": "time_between",
      "value": ["18:00", "08:00"]
    }
  ],
  "action": {
    "type": "deny",
    "reason": "High-value transfers blocked outside business hours (8AM-6PM ET)"
  },
  "risk_tier_override": null
}

T1 — Single Operator Approval
─────────────────────────────
Intent → Policy Engine → T1 → Approval Queue
                                    │
                              ┌─────┴─────┐
                              │  Operator  │
                              │  Reviews   │
                              └─────┬─────┘
                                    │
                         ┌──────────┼──────────┐
                         │          │          │
                      Approve     Deny     Timeout
                         │          │          │
                      Warrant    Denied    Escalate
                      Issued     + Log    to T2 or
                         │                 Manager
                      Execute

T2 — Multi-Party Approval
─────────────────────────
Intent → Policy Engine → T2 → Approval Queue
                                    │
                   ┌────────────────┼────────────────┐
                   │                │                │
              Approver 1       Approver 2       Approver N
              (required)       (required)       (optional)
                   │                │                │
                   └────────────────┼────────────────┘
                                    │
                            All approved? ───No──→ Wait/Escalate
                                    │
                                   Yes
                                    │
                         Warrant Issued (strict TTL)
                                    │
                                 Execute

{
  "warrant_id": "wrt-4f6a8c0b-3e5f-7a9b-1c2d-e4f6a8c0b2d4",
  "intent_id": "int-2d4f6a8b-1c3e-5d7f-9a0b-c2d4e6f8a0b2",
  "scope": {
    "action": "send_email",
    "target": "smtp-gateway",
    "parameters": {
      "to": "customer@example.com",
      "subject": "Your support ticket #1234"
    }
  },
  "constraints": {
    "max_retries": 1,
    "max_recipients": 1,
    "allowed_domains": ["example.com"],
    "rollback_on_failure": true
  },
  "ttl": 300,
  "issued_at": "2026-03-25T21:35:01.000Z",
  "expires_at": "2026-03-25T21:40:01.000Z",
  "issuer": {
    "type": "operator",
    "id": "op-7f3a2b1c",
    "approval_id": "apr-6b8c0d1e"
  },
  "chain": {
    "parent_warrant": null,
    "depth": 0
  },
  "signature": "hmac-sha256:a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0"
}

Execution Complete
       │
       ↓
┌─────────────────┐
│ Load Warrant    │ ← Original warrant scope and constraints
│ Load Result     │ ← Actual execution result and side effects
└────────┬────────┘
         │
         ↓
┌─────────────────┐
│ Scope Check     │ ← Did the action match the warrant scope?
│ Parameter Check │ ← Were parameters within constraints?
│ Target Check    │ ← Was the correct target affected?
│ Side Effect     │ ← Any unauthorized side effects?
│ Detection       │
└────────┬────────┘
         │
    ┌────┴────┐
    │         │
  Pass      Fail
    │         │
  Log to    Generate Alert
  Audit     Flag Agent
  Trail     Log to Audit Trail
            Revoke future warrants (optional)

                        ┌──────────────────┐
                        │   Agent / Client  │
                        └────────┬─────────┘
                                 │
                                 ▼
                   ┌─────────────────────────┐
                   │     Intent Gateway       │
                   │  normalize · validate    │
                   │  deduplicate · enrich    │
                   └────────────┬────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │     Policy Engine        │
                   │  evaluate rules          │
                   │  assign risk tier        │
                   │  check rate limits       │
                   └────────────┬────────────┘
                                │
              ┌─────────────────┼─────────────────┐
              │                 │                 │
              ▼                 ▼                 ▼
       ┌────────────┐   ┌────────────┐   ┌────────────┐
       │  T0: Auto  │   │ T1: Single │   │ T2: Multi  │
       │  Approve   │   │  Approval  │   │  Approval  │
       └─────┬──────┘   └─────┬──────┘   └─────┬──────┘
              │                │                 │
              └─────────────────┼─────────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │    Warrant Authority     │
                   │  scope · ttl · sign      │
                   │  constraints · chain     │
                   └────────────┬────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │    Execution Router      │
                   │  warrant check · route   │
                   │  execute · capture       │
                   └────────────┬────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │   Verification Engine    │
                   │  scope compliance        │
                   │  parameter check         │
                   │  side effect detection   │
                   └────────────┬────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │      Audit Trail         │
                   │  append-only · hashed    │
                   │  tamper-evident · query  │
                   └─────────────────────────┘
                                │
                                ▼
                   ┌─────────────────────────┐
                   │      State Graph         │
                   │  SQLite / Postgres       │
                   │  persistent storage      │
                   └─────────────────────────┘

┌─────────────┐     ┌──────────────┐     ┌───────────────┐
│   Agents    │────→│   Intents    │────→│   Warrants    │
│             │     │              │     │               │
│ id          │     │ id           │     │ id            │
│ name        │     │ agent_id     │     │ intent_id     │
│ trust_score │     │ action       │     │ scope         │
│ status      │     │ parameters   │     │ ttl           │
│ allowed_    │     │ risk_tier    │     │ constraints   │
│   actions   │     │ status       │     │ signature     │
└─────────────┘     └──────┬───────┘     └───────┬───────┘
                           │                     │
                           ▼                     ▼
                    ┌──────────────┐     ┌───────────────┐
                    │  Executions  │     │  Audit Trail  │
                    │              │     │               │
                    │ id           │     │ id            │
                    │ intent_id    │     │ type          │
                    │ warrant_id   │     │ entity_id     │
                    │ result       │     │ data          │
                    │ duration_ms  │     │ hash          │
                    │ verified     │     │ prev_hash     │
                    └──────────────┘     └───────────────┘

┌──────────────┐     ┌──────────────┐     ┌───────────────┐
│   Policies   │     │ Action Types │     │  Approvals    │
│              │     │              │     │               │
│ id           │     │ id           │     │ id            │
│ name         │     │ name         │     │ intent_id     │
│ priority     │     │ schema       │     │ approver_id   │
│ conditions   │     │ risk_tier    │     │ status        │
│ action       │     │ description  │     │ expires_at    │
└──────────────┘     └──────────────┘     └───────────────┘

import { ViennaClient } from "./vienna-client";

const vienna = new ViennaClient({
  baseUrl: process.env.VIENNA_URL || "https://console.regulator.ai",
  apiKey: process.env.VIENNA_AGENT_KEY!,
  agentId: process.env.VIENNA_AGENT_ID!,
  tenantId: process.env.VIENNA_TENANT_ID!,
});

/**
 * Wrap any action in Vienna governance.
 * The action only executes if Vienna issues a warrant.
 */
async function governedAction(
  action: string,
  parameters: Record<string, unknown>,
  context?: Record<string, unknown>
) {
  // Submit intent to Vienna
  const intent = await vienna.submitIntent({
    action,
    parameters,
    context: {
      ...context,
      source_framework: "openclaw",
      timestamp: new Date().toISOString(),
    },
  });

  switch (intent.status) {
    case "executed":
      console.log(`✅ ${action} executed (warrant: ${intent.warrant.warrant_id})`);
      return intent.result;

    case "pending_approval":
      console.log(`⏳ ${action} awaiting approval (${intent.approval.approval_id})`);
      // Optionally wait for approval via webhook or polling
      return await vienna.waitForApproval(intent.approval.approval_id, {
        timeoutMs: 3600_000, // 1 hour
        pollIntervalMs: 5_000,
      });

    case "denied":
      throw new Error(`❌ ${action} denied: ${intent.reason}`);

    default:
      throw new Error(`Unexpected status: ${intent.status}`);
  }
}

// Usage in an OpenClaw agent
const result = await governedAction("send_email", {
  to: "customer@example.com",
  subject: "Your order has shipped",
  body: "Track your package at ...",
});

from langchain.tools import BaseTool
from typing import Optional, Type
from pydantic import BaseModel, Field
import requests
import os

VIENNA_URL = os.environ.get("VIENNA_URL", "https://console.regulator.ai")
VIENNA_KEY = os.environ["VIENNA_AGENT_KEY"]
AGENT_ID = os.environ["VIENNA_AGENT_ID"]
TENANT_ID = os.environ["VIENNA_TENANT_ID"]


class GovernedTool(BaseTool):
    """Base class for Vienna-governed LangChain tools.

    Subclass this instead of BaseTool. Your tool's _run method
    will only execute if Vienna issues a warrant.
    """

    vienna_action: str = ""  # Override in subclass

    def _call_vienna(self, parameters: dict) -> dict:
        """Submit intent to Vienna and handle the response."""
        response = requests.post(
            f"{VIENNA_URL}/api/v1/agent/intent",
            headers={
                "Content-Type": "application/json",
                "Authorization": f"Bearer {VIENNA_KEY}",
            },
            json={
                "action": self.vienna_action,
                "source": {"platform": "langchain", "agent_id": AGENT_ID},
                "tenant_id": TENANT_ID,
                "parameters": parameters,
            },
        )
        return response.json()["data"]

    def _run(self, **kwargs) -> str:
        # Check with Vienna first
        result = self._call_vienna(kwargs)

        if result["status"] == "denied":
            return f"Action denied by governance policy: {result['reason']}"

        if result["status"] == "pending_approval":
            return (
                f"Action requires approval (ID: {result['approval']['approval_id']}). "
                f"An operator must approve before execution."
            )

        # Warrant issued — proceed with actual execution
        return self._execute_with_warrant(result["warrant"], **kwargs)

    def _execute_with_warrant(self, warrant: dict, **kwargs) -> str:
        raise NotImplementedError("Override in subclass")


# Example: Governed email sender
class GovernedEmailTool(GovernedTool):
    name = "send_email"
    description = "Send an email (governed by Vienna OS)"
    vienna_action = "send_email"

    def _execute_with_warrant(self, warrant, **kwargs):
        # Your actual email sending logic here
        return f"Email sent (warrant: {warrant['warrant_id']})"


# Usage with LangChain agent
from langchain.agents import initialize_agent, AgentType
from langchain.llms import OpenAI

tools = [GovernedEmailTool()]
llm = OpenAI(temperature=0)
agent = initialize_agent(tools, llm, agent=AgentType.ZERO_SHOT_REACT_DESCRIPTION)

from crewai import Agent, Task, Crew
import requests, os

VIENNA_URL = os.environ.get("VIENNA_URL", "https://console.regulator.ai")
VIENNA_KEY = os.environ["VIENNA_AGENT_KEY"]

def governed_callback(output):
    """Submit task output to Vienna for governance before execution."""
    response = requests.post(
        f"{VIENNA_URL}/api/v1/agent/intent",
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Bearer {VIENNA_KEY}",
        },
        json={
            "action": output.get("action", "task_execution"),
            "source": {"platform": "crewai", "agent_id": output.get("agent", "unknown")},
            "tenant_id": os.environ["VIENNA_TENANT_ID"],
            "parameters": output,
        },
    )
    result = response.json()
    if not result.get("success") or result["data"]["status"] == "denied":
        raise Exception(f"Governance denied: {result.get('error', 'Policy violation')}")
    return result["data"]

# Define agents and tasks
researcher = Agent(role="Researcher", goal="Find market data", backstory="...")
analyst = Agent(role="Analyst", goal="Analyze trends", backstory="...")

research_task = Task(
    description="Research Q1 market trends",
    agent=researcher,
    callback=governed_callback,  # Vienna checks before execution
)

crew = Crew(agents=[researcher, analyst], tasks=[research_task])
result = crew.kickoff()

# Submit any agent action through governance
curl -X POST https://console.regulator.ai/api/v1/agent/intent \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VIENNA_AGENT_KEY" \
  -d '{
    "action": "your_custom_action",
    "source": {
      "platform": "your-framework",
      "agent_id": "your-agent-id"
    },
    "tenant_id": "your-tenant",
    "parameters": {
      "key": "value"
    }
  }'

# Response:
# {
#   "success": true,
#   "data": {
#     "intent_id": "int-abc123",
#     "status": "executed",
#     "execution_id": "exec-def456",
#     "warrant": { "warrant_id": "wrt-...", "scope": {...}, "ttl": 300 },
#     "audit_id": "aud-ghi789"
#   }
# }

import express from "express";
import crypto from "crypto";

const app = express();
app.use(express.json());

const WEBHOOK_SECRET = process.env.VIENNA_WEBHOOK_SECRET!;

// Verify HMAC-SHA256 signature
function verifySignature(payload: string, signature: string): boolean {
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post("/webhooks/vienna", (req, res) => {
  const signature = req.headers["x-vienna-signature"] as string;
  const rawBody = JSON.stringify(req.body);

  if (!verifySignature(rawBody, signature)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const event = req.body;

  switch (event.type) {
    case "approval_required":
      console.log("Approval needed:", event.data.action_type);
      // Notify your team via Slack, email, etc.
      break;
    case "action_executed":
      console.log("Action completed:", event.data.execution_id);
      break;
    case "policy_violation":
      console.log("ALERT:", event.data.agent_id, event.data.message);
      break;
  }

  res.json({ received: true });
});

app.listen(3001);

curl -X POST https://console.regulator.ai/api/v1/policies \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VIENNA_API_KEY" \
  -d '{
    "name": "High-Value Transaction Gate",
    "description": "Require T2 multi-party approval for transactions over $10,000",
    "conditions": [
      { "field": "action_type", "operator": "equals", "value": "financial_transaction" },
      { "field": "amount", "operator": "gt", "value": 10000 }
    ],
    "action_on_match": "require_approval",
    "approval_tier": "T2",
    "priority": 100,
    "enabled": true
  }'

{
  "name": "After-Hours High-Value Block",
  "conditions": [
    { "field": "action_type", "operator": "equals", "value": "financial_transaction" },
    { "field": "amount", "operator": "gt", "value": 50000 },
    { "field": "time_of_day", "operator": "time_between", "value": ["18:00", "06:00"] }
  ],
  "action_on_match": "deny",
  "priority": 200
}

{
  "name": "Prod DB Migration Gate",
  "conditions": [
    { "field": "action_type", "operator": "equals", "value": "database_migration" },
    { "field": "environment", "operator": "equals", "value": "production" }
  ],
  "action_on_match": "require_approval",
  "approval_tier": "T2",
  "required_approvers": ["operator-cto"],
  "priority": 150
}

{
  "name": "Trusted Agent Auto-Approve",
  "conditions": [
    { "field": "action_type", "operator": "contains", "value": "read" },
    { "field": "trust_score", "operator": "gt", "value": 80 }
  ],
  "action_on_match": "allow",
  "priority": 50
}

{
  "name": "Agent Rate Limiter",
  "conditions": [
    { "field": "rate", "operator": "gt", "value": 100 }
  ],
  "action_on_match": "rate_limit",
  "priority": 300
}

curl -X POST https://console.regulator.ai/api/v1/policies/evaluate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VIENNA_API_KEY" \
  -d '{
    "action_type": "financial_transaction",
    "amount": 75000,
    "agent_id": "billing-bot",
    "environment": "production",
    "time_of_day": "22:30"
  }'

# Response:
# {
#   "results": [
#     {
#       "rule_id": "...",
#       "rule_name": "After-Hours High-Value Block",
#       "matched": true,
#       "action": "deny",
#       "conditions_detail": [
#         { "field": "action_type", "passed": true },
#         { "field": "amount", "passed": true, "actual": 75000, "expected": "> 50000" },
#         { "field": "time_of_day", "passed": true, "actual": "22:30", "expected": "18:00-06:00" }
#       ]
#     }
#   ],
#   "final_action": "deny",
#   "matching_rule": "After-Hours High-Value Block"
# }

curl https://console.regulator.ai/api/v1/policies/templates \
  -H "Authorization: Bearer $VIENNA_API_KEY"

# Returns: financial_services, healthcare, devops, legal, general
# Each template contains 5-8 rules configured for that industry

{
  "warrant_id": "wrt-7f3a2b1c-e8d4-4a9f-b2c1-9d8e7f6a5b4c",
  "scope": {
    "action": "wire_transfer",
    "target": "payments-service",
    "parameters": {
      "amount": 75000,
      "currency": "USD",
      "recipient": "vendor-456"
    }
  },
  "constraints": {
    "max_amount": 75000,
    "allowed_recipients": ["vendor-456"],
    "max_retries": 0,
    "rollback_on_failure": true
  },
  "ttl_seconds": 300,
  "issued_at": "2026-03-25T21:30:00Z",
  "expires_at": "2026-03-25T21:35:00Z",
  "issuer": {
    "type": "multi_party",
    "operators": ["operator-jane", "operator-mike"],
    "approval_id": "appr-abc123"
  },
  "chain_of_custody": {
    "intent_id": "int-xyz789",
    "policy_match": "high-value-transfer-gate",
    "risk_tier": "T2",
    "approval_time_ms": 45200
  },
  "signature": "hmac-sha256:a1b2c3d4e5f67890..."
}

1. INTENT    → Agent submits action request
2. EVALUATE  → Policy Engine checks against rules
3. TIER      → Risk tier assigned (T0/T1/T2)
4. APPROVE   → Operator(s) approve (if T1/T2)
5. ISSUE     → Warrant Authority creates signed warrant
                - Scope locked to exact parameters
                - TTL set (300s default, configurable)
                - Constraints attached (max amount, allowed targets)
                - HMAC-SHA256 signature computed
6. EXECUTE   → Execution Router validates warrant, runs action
7. VERIFY    → Verification Engine checks:
                - Did action match warrant scope?
                - Was amount within constraints?
                - Was target in allowed list?
                - Was execution within TTL?
8. ARCHIVE   → Warrant + verification result → immutable audit trail

import crypto from "crypto";

function signWarrant(warrant: Omit<Warrant, "signature">, signingKey: string): string {
  const payload = JSON.stringify(warrant, Object.keys(warrant).sort());
  return "hmac-sha256:" + crypto
    .createHmac("sha256", signingKey)
    .update(payload)
    .digest("hex");
}

function verifyWarrant(warrant: Warrant, signingKey: string): boolean {
  const { signature, ...payload } = warrant;
  const expected = signWarrant(payload, signingKey);
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

# Pull the image
docker pull ghcr.io/risk-ai/vienna-os:latest

# Run with environment variables
docker run -d \
  --name vienna-os \
  -p 8080:8080 \
  -e VIENNA_ENV=prod \
  -e VIENNA_SECRET_KEY=your-secret-key \
  -e POSTGRES_URL=postgresql://user:pass@host:5432/vienna \
  -e VIENNA_SIMULATION=false \
  ghcr.io/risk-ai/vienna-os:latest

# Verify
curl http://localhost:8080/health
# {"status":"ok"}

# Create database
createdb vienna

# Run migrations (auto-runs on first boot, or manually)
cd apps/console/server
for f in src/db/migrations/*.sql; do
  psql vienna < "$f"
done

# Install flyctl
curl -L https://fly.io/install.sh | sh

# Launch (first time)
fly launch --name vienna-os --region iad

# Set secrets
fly secrets set VIENNA_SECRET_KEY=your-secret-key
fly secrets set POSTGRES_URL=your-connection-string

# Deploy
fly deploy

# Scale
fly scale count 2  # Run 2 instances for HA

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vienna-os
  labels:
    app: vienna-os
spec:
  replicas: 2
  selector:
    matchLabels:
      app: vienna-os
  template:
    metadata:
      labels:
        app: vienna-os
    spec:
      containers:
      - name: vienna-os
        image: ghcr.io/risk-ai/vienna-os:latest
        ports:
        - containerPort: 8080
        env:
        - name: VIENNA_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: vienna-secrets
              key: secret-key
        - name: POSTGRES_URL
          valueFrom:
            secretKeyRef:
              name: vienna-secrets
              key: postgres-url
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "2Gi"
            cpu: "2"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: vienna-os
spec:
  selector:
    app: vienna-os
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer