# CogNEXUS Labs — Developer Reference

ArtzAIn is the model-agnostic agent control plane. CogNEXUS Labs builds it. `artzain` is the Python client you install to talk to it; `@cognexuslabs/artzain` is the TypeScript client on npm.

The `artzain` SDK is free to install and run locally. The ArtzAIn control plane is an enterprise deployment — [request a pilot](https://cognexuslabs.ai/artzain#pilot).

This file is the current source of truth for the public SDK surface, versioned with the package.

## Links

- Website: https://cognexuslabs.ai
- ArtzAIn: https://cognexuslabs.ai/artzain
- Dashboard: https://cognexuslabs.ai/dashboard.html
- PyPI: https://pypi.org/project/artzain/
- npm: https://www.npmjs.com/package/@cognexuslabs/artzain
- Source: https://github.com/CogNEXUSlabs/cognexus-tools
- Support: hello@cognexuslabs.ai

## Installation

```
pip install artzain
pip install --upgrade artzain
artzain quickstart    # signup + starter integration
artzain login         # existing account
```

Python first (`artzain`, previously published as `cognexus`). A remote-only TypeScript client for Node ≥ 18 ships as `@cognexuslabs/artzain`:

```
npm i @cognexuslabs/artzain
```

Supply chain: PyPI releases publish via a Trusted Publisher (OIDC — no long-lived secrets); npm releases carry a provenance attestation bound to the public repo. The guards derive from Microsoft's MIT-licensed agent-governance-toolkit, with attribution.

## Key capabilities

- **Prompt Defender** — build-time + runtime prompt-injection screening (OWASP Agentic AI Top 10 #1), graded A–F.
- **Client Policy Enforcement** — actions cleared against configurable enterprise rules. Prebuilt RuleSet.FINANCIAL / RuleSet.LEGAL.
- **Destructive-Action Guard** — screens SQL / shell / git / cloud actions by severity (low → critical).
- **Agent Kill Switch** — panic-threshold auto-stop. CRITICAL → `trip_global()` → `AgentKilledError`. A kill-switch *event*, not a verdict.
- **Signed Decision Records** — per-record cryptographic signing on an append-only ledger; `verify_chain()` is offline and zero-trust.
- **Performance** — `184ms` median, end-to-end; 3,000+ decisions/hr per tenant.

Delegation of Authority is the governance framing these controls implement (the agent's row on your DOA matrix), not a separate shipping feature.

## Verdicts

`allow` · `deny` · `review` — lowercase, returned on the signed decision record.

`kill` is not a fourth verdict. `trip_global()` raises `AgentKilledError` and emits a kill-switch event on the ledger.

## SDK surface

### Screening

`screen_user_input()` · `evaluate_system_prompt()` · `augment_system_prompt()` · `screen_external_content()`

### Enforcement

`screen_client_policy()` · `screen_action()` · `screen_agent_action()` · `should_block()`

### Kill switch

`trip_global()` · `raise_if_killed()`

### Audit

`verify_chain()` · `post_generation_outcome()`

## AWS deployment

Two insertion points: input screening before the LLM (Bedrock / external) is called, and output guard + kill switch before any action or data write.

## Receipt verification

`verify_chain()` recomputes leaf hashes, chain linkage, and signatures against bundled public keys. No network, no server trust. Edit a single byte in any leaf and verification fails, naming the sequence number that broke.