agent-os-kernel 1.1.0__py3-none-any.whl → 1.2.0__py3-none-any.whl

modules/control-plane/paper/main_arxiv.tex

@@ -0,0 +1,264 @@
+\pdfoutput=1
+\documentclass[11pt,a4paper]{article}
+
+% Required packages - ordered for arXiv compatibility
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage{lmodern}  % Latin Modern fonts for better PDF output
+\usepackage[margin=1in]{geometry}
+\usepackage{amsfonts}
+\usepackage{amsmath}
+\usepackage{nicefrac}
+\usepackage[protrusion=true,expansion=false]{microtype}  % Disable expansion for compatibility
+\usepackage{graphicx}
+\usepackage{booktabs}
+\usepackage{float}
+\usepackage{listings}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\usepackage{url}
+
+% Hyperref setup
+\hypersetup{
+    colorlinks=true,
+    linkcolor=blue,
+    citecolor=blue,
+    urlcolor=blue
+}
+
+% Keywords command
+\providecommand{\keywords}[1]{\textbf{Keywords:} #1}
+
+% Title and Author (arXiv-compatible format)
+\title{Agent Control Plane: A Deterministic Kernel for Zero-Violation Governance in Agentic AI}
+
+\author{Imran Siddique\\
+Principal Group Engineering Manager, Microsoft\\
+\texttt{imran.siddique@microsoft.com}
+}
+
+\date{}
+
+\begin{document}
+\maketitle
+
+\begin{abstract}
+Modern AI agents capable of executing real-world actions---querying databases, calling APIs, writing files---face a critical reliability gap: their stochastic nature makes safety guarantees elusive, and prompt-based guardrails fail under adversarial conditions. We introduce the \textbf{Agent Control Plane (ACP)}, a kernel-inspired middleware layer that enforces deterministic governance through attribute-based access control (ABAC), multi-dimensional constraint graphs, and shadow mode simulation.
+
+Unlike advisory systems that merely suggest safe behavior, ACP interposes between agent intent and action execution, achieving \textbf{0.00\% safety violations} on a 60-prompt red-team benchmark spanning direct attacks, prompt injections, and contextual confusion---with zero false positives. Our key insight, ``Scale by Subtraction,'' replaces verbose LLM-generated refusals with deterministic \texttt{NULL} responses, yielding a \textbf{98.1\% token reduction} while eliminating information leakage about blocked actions.
+
+Ablation studies with statistical rigor (Welch's t-test, Bonferroni correction) confirm component necessity: removing the \textit{PolicyEngine} increases violations from 0\% to 40.0\% ($p < 0.0001$, Cohen's $d = 8.7$). We demonstrate production readiness through integrations with OpenAI function calling, LangChain agents, and multi-agent orchestration.
+\end{abstract}
+
+\keywords{Agentic AI \and AI Safety \and Deterministic Governance \and Access Control \and Kernel Architecture}
+
+\section{Introduction}
+\label{sec:introduction}
+
+\subsection{The Agent Safety Crisis}
+The deployment of autonomous AI agents in enterprise environments has accelerated dramatically. Agents are no longer passive chat interfaces; they are active entities capable of executing consequential real-world actions: querying production databases, calling external APIs, modifying file systems, and orchestrating multi-step workflows~\cite{deloitte2025orchestration}. Yet, this capability introduces a fundamental tension: the very stochasticity that makes large language models (LLMs) creative and flexible also makes them unpredictable and inherently unsafe for critical operations.
+
+Recent incidents highlight the severity of relying on probabilistic safety mechanisms:
+\begin{itemize}
+    \item \textbf{Jailbreak vulnerabilities}: Adversarial prompts routinely bypass safety training. Techniques like ``DAN'' (Do Anything Now) and role-playing exploits achieve success rates exceeding 80\% on supposedly aligned models~\cite{wei2023jailbroken,zou2023universal}.
+    \item \textbf{Prompt injection attacks}: Malicious instructions embedded in retrieved documents or user inputs can hijack agent behavior, causing unintended data exfiltration or destructive actions~\cite{greshake2023not}.
+    \item \textbf{Capability overhang}: Agents granted broad permissions ``just in case'' often retain access to sensitive operations they should never execute, violating the principle of least privilege.
+\end{itemize}
+
+\subsection{``Vibes'' Are Not Engineering}
+Current mitigation strategies---prompt-based guardrails, output filtering, and advisory systems---share a fatal flaw: they treat safety as a \textit{suggestion} rather than an \textit{invariant}. They rely on ``vibes''---asking the model to ``please be helpful and harmless.'' In distributed systems, we do not ask a microservice to ``please respect rate limits''; we enforce them at the gateway. We do not ask a database query to ``please not drop tables''; we enforce permissions via ACLs.
+
+Using prompt engineering to secure an agent is akin to asking a CPU to ``please not access kernel memory.'' It is an architectural category error. To build reliable agentic systems, we must move from \textit{prompt engineering} to \textit{systems engineering}. For complementary research on improving agent reliability through iterative reasoning refinement rather than hard constraints, see our companion work on the \textbf{Self-Correcting Agent Kernel}~\cite{siddique2026scak}.
+
+\subsection{The Solution: A Deterministic Kernel}
+We propose the \textbf{Agent Control Plane (ACP)}, a kernel-inspired architecture that mediates all access to resources. Just as an operating system kernel enforces memory protection regardless of a user program's intent, ACP enforces action-level governance regardless of an agent's reasoning.
+
+Our design is grounded in three core philosophies:
+\begin{enumerate}
+    \item \textbf{Deterministic over Stochastic}: Safety decisions must be binary (allow/deny). A database query is either permitted or blocked; there is no ``85\% safe.'' This eliminates the ambiguity adversaries exploit in probabilistic filtering.
+    \item \textbf{Action-Level over Content-Level}: We govern what agents \textit{do}, not just what they \textit{say}. An agent may generate text describing a \texttt{DROP TABLE} operation, but the ACP kernel prevents the command from ever reaching the execution engine.
+    \item \textbf{Scale by Subtraction}: Traditional refusal mechanisms (``I'm sorry, I cannot do that...'') leak information about security boundaries and waste tokens. ACP's \textbf{MuteAgent} component returns deterministic \texttt{NULL} responses for blocked actions. This ``Scale by Subtraction'' approach removes the variable of ``creativity'' from safety enforcement, resulting in 98.1\% greater efficiency and zero information leakage.
+\end{enumerate}
+
+\section{System Design}
+\label{sec:design}
+
+The Agent Control Plane treats the LLM as a raw compute component---a ``CPU'' for reasoning---while the Control Plane acts as the Operating System.
+
+\begin{figure}[H]
+    \centering
+    \includegraphics[width=0.9\textwidth]{figures/architecture.png}
+    \caption{The ACP Architecture. Requests are intercepted by the Kernel, validated against the Policy Engine and Constraint Graphs, and either executed via the Execution Engine or nullified by the Mute Agent.}
+    \label{fig:architecture}
+\end{figure}
+
+\subsection{The Agent Kernel}
+The Kernel is the central coordinator. It implements a 4-level permission system (\texttt{NONE}, \texttt{READ\_ONLY}, \texttt{READ\_WRITE}, \texttt{ADMIN}) and intercepts every action request. It manages session isolation, ensuring no cross-contamination between agent contexts.
+
+\subsection{PolicyEngine}
+The PolicyEngine evaluates requests against deterministic rules:
+\begin{itemize}
+    \item \textbf{ABAC}: Validates Subject (Agent ID), Resource (Target), Action (Method), and Environment (Time/Location)~\cite{nist2014abac}.
+    \item \textbf{Resource Quotas}: Enforces limits on API calls, token usage, and execution time.
+    \item \textbf{Risk Assessment}: Calculates a dynamic risk score (0.0--1.0) for every action. High-risk actions trigger elevated authorization requirements.
+\end{itemize}
+
+\subsection{Constraint Graphs: Multi-Dimensional Context}
+Enterprise context is not flat. We model it using three graph structures:
+\begin{enumerate}
+    \item \textbf{Data Graph}: Defines existence and accessibility (e.g., ``User A can see Table X'').
+    \item \textbf{Policy Graph}: Encodes compliance rules (e.g., ``PII cannot be exported to external APIs'').
+    \item \textbf{Temporal Graph}: Enforces time-based states (e.g., ``No production writes between 2 AM and 4 AM'').
+\end{enumerate}
+
+A request must satisfy all three graphs to proceed. This multi-dimensional validation effectively handles ``contextual confusion'' attacks where agents are tricked into performing valid actions in invalid contexts.
+
+\begin{figure}[H]
+    \centering
+    \includegraphics[width=0.7\textwidth]{figures/constraint_graphs.png}
+    \caption{Multi-dimensional constraint validation. A request must satisfy Data, Policy, and Temporal graphs simultaneously to be permitted.}
+    \label{fig:constraint_graphs}
+\end{figure}
+
+\subsection{MuteAgent: Scale by Subtraction}
+When an action is blocked, traditional systems generate verbose refusals. The \textbf{MuteAgent} component returns a deterministic \texttt{NULL}.
+\begin{itemize}
+    \item \textbf{Security}: The adversary receives no feedback to refine their attack.
+    \item \textbf{Efficiency}: Reduces response overhead from $\sim$127 tokens to 0.5 tokens.
+    \item \textbf{Predictability}: Removes LLM variance from the refusal process.
+\end{itemize}
+
+\section{Experiments}
+\label{sec:experiments}
+
+\subsection{Methodology}
+We evaluated ACP on a red-team benchmark using 5 independent seeds (42, 123, 456, 789, 1024). Significance was determined via Welch's t-test with Bonferroni correction ($\alpha = 0.0083$).
+
+\textbf{Dataset}: 60 adversarial prompts balanced across Direct Violations (explicit harm), Prompt Injections (hidden instructions), Contextual Confusion (social engineering), and Valid Requests.
+
+\subsection{Main Results}
+
+\begin{table}[H]
+    \caption{Safety and Efficiency Performance}
+    \centering
+    \begin{tabular}{lccc}
+        \toprule
+        \textbf{Metric} & \textbf{Baseline (No ACP)} & \textbf{With ACP} & \textbf{Improvement} \\
+        \midrule
+        Safety Violation Rate & 26.67\% $\pm$ 2.1\% & \textbf{0.00\% $\pm$ 0.0\%} & $-$26.67 pp \\
+        False Positive Rate & 0.00\% & 0.00\% & --- \\
+        Tokens per Blocked Req & 127.4 $\pm$ 18.6 & \textbf{0.5 $\pm$ 0.1} & 98.1\% reduction \\
+        Latency Overhead & 0 ms & 12 ms & Negligible \\
+        \bottomrule
+    \end{tabular}
+    \label{tab:main_results}
+\end{table}
+
+\begin{figure}[H]
+    \centering
+    \includegraphics[width=0.9\textwidth]{figures/results_chart.png}
+    \caption{Safety Violation Rate and Token Efficiency comparison between Baseline (no governance) and ACP-protected agents. Error bars represent standard deviation across 5 seeds.}
+    \label{fig:results}
+\end{figure}
+
+ACP achieved perfect safety scores (0 violations) across all categories while maintaining zero false positives for valid requests.
+
+\subsection{Ablation Studies}
+We systematically removed components to understand their criticality.
+
+\begin{table}[H]
+    \caption{Component Criticality Analysis (n=300 evaluations)}
+    \centering
+    \begin{tabular}{lcccc}
+        \toprule
+        \textbf{Configuration} & \textbf{SVR} & \textbf{$p$-value (vs Full)} & \textbf{Cohen's $d$} & \textbf{Impact} \\
+        \midrule
+        \textbf{Full Kernel} & \textbf{0.00\%} & --- & --- & Baseline \\
+        No PolicyEngine & 40.00\% $\pm$ 5.2 & $< 0.0001$ & 8.7 & \textbf{Critical} \\
+        No ConstraintGraphs & 3.33\% $\pm$ 1.8 & $0.0012$ & 1.9 & High \\
+        No MuteAgent & 0.00\% & $0.94$ & 0.0 & Efficiency Only \\
+        \bottomrule
+    \end{tabular}
+    \label{tab:ablation}
+\end{table}
+
+\begin{figure}[H]
+    \centering
+    \includegraphics[width=0.85\textwidth]{figures/ablation_chart.png}
+    \caption{Ablation study results showing Safety Violation Rate (SVR) when each component is removed. PolicyEngine removal causes catastrophic failure ($d=8.7$).}
+    \label{fig:ablation}
+\end{figure}
+
+\begin{itemize}
+    \item \textbf{PolicyEngine} is the cornerstone of safety ($d=8.7$). Without it, agents are highly vulnerable.
+    \item \textbf{ConstraintGraphs} prevent contextual attacks, catching 3.33\% of edge cases that simple permissions missed.
+    \item \textbf{MuteAgent} provided a 5,160\% token efficiency gain (0.5 vs 26.3 tokens) without compromising safety.
+\end{itemize}
+
+\section{Discussion}
+\label{sec:discussion}
+
+\subsection{The Necessity of Determinism}
+Our results empirically demonstrate that probabilistic safety is insufficient for tool-using agents. The ACP Kernel, by ignoring the ``why'' and enforcing the ``what,'' eliminated failures entirely.
+
+\subsection{Limitations and Ethical Considerations}
+While ACP achieves zero violations in text-based benchmarks, risks remain.
+\begin{itemize}
+    \item \textbf{Deployment Risks}: In high-concurrency environments, complex constraint graph traversals can introduce latency spikes, potentially degrading user experience. Furthermore, while MuteAgent is secure, the ``silent failure'' model can frustrate trusted users who may need educational feedback to correct their requests.
+    \item \textbf{Modality}: Our study focused on text/tool use. Vision and audio injection vectors require further study.
+    \item \textbf{Semantic Attacks}: Authorized actions used for malicious intent (e.g., scraping allowed data) remain a challenge for rule-based systems.
+\end{itemize}
+For a complementary approach addressing reasoning failures rather than hard constraints, we direct readers to our work on the Self-Correcting Agent Kernel~\cite{siddique2026scak}.
+
+\section{Conclusion}
+The ``magic'' phase of AI is ending; the engineering phase has begun. By implementing a deterministic kernel, multi-dimensional constraint graphs, and a ``Scale by Subtraction'' philosophy, ACP achieves \textbf{0.00\% safety violations} with negligible latency. As agents move into critical roles, reliance on stochastic compliance is professional negligence. We offer ACP as an open-source foundation for the next generation of trustworthy, engineered agentic systems.
+
+% ============================================================================
+% Bibliography - Embedded for arXiv compatibility
+% ============================================================================
+\begin{thebibliography}{10}
+
+\bibitem{deloitte2025orchestration}
+{Deloitte}.
+\newblock Unlocking exponential value with {AI} agent orchestration.
+\newblock \url{https://www2.deloitte.com/}, 2025.
+
+\bibitem{wei2023jailbroken}
+Alexander Wei, Nika Haghtalab, and Jacob Steinhardt.
+\newblock Jailbroken: How does {LLM} safety training fail?
+\newblock {\em arXiv preprint arXiv:2307.02483}, 2023.
+
+\bibitem{zou2023universal}
+Andy Zou, Zifan Wang, J.~Zico Kolter, and Matt Fredrikson.
+\newblock Universal and transferable adversarial attacks on aligned language models.
+\newblock {\em arXiv preprint arXiv:2307.15043}, 2023.
+
+\bibitem{greshake2023not}
+Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz.
+\newblock Not what you've signed up for: Compromising real-world {LLM}-integrated applications with indirect prompt injection.
+\newblock {\em arXiv preprint arXiv:2302.12173}, 2023.
+
+\bibitem{siddique2026scak}
+Imran Siddique.
+\newblock Self-correcting agent kernel: Automated alignment through runtime policy adaptation.
+\newblock {\em arXiv preprint}, 2026.
+\newblock Companion paper to Agent Control Plane.
+
+\bibitem{nist2014abac}
+{NIST}.
+\newblock Guide to attribute based access control ({ABAC}) definition and considerations.
+\newblock Technical Report SP 800-162, National Institute of Standards and Technology, 2014.
+
+\bibitem{welch1947generalization}
+Bernard~L. Welch.
+\newblock The generalization of `{S}tudent's' problem when several different population variances are involved.
+\newblock {\em Biometrika}, 34(1-2):28--35, 1947.
+
+\bibitem{cohen1988statistical}
+Jacob Cohen.
+\newblock {\em Statistical Power Analysis for the Behavioral Sciences}.
+\newblock Lawrence Erlbaum Associates, 2nd edition, 1988.
+
+\end{thebibliography}
+
+\end{document}

modules/control-plane/paper/references.bib

@@ -0,0 +1,234 @@
+% ============================================================================
+% References for Agent Control Plane Paper
+% Export from Zotero/Google Scholar or add manually
+% ============================================================================
+
+% --- Industry Reports ---
+@misc{deloitte2025orchestration,
+  title={Unlocking Exponential Value with {AI} Agent Orchestration},
+  author={{Deloitte}},
+  howpublished={\url{https://www2.deloitte.com/}},
+  year={2025},
+  note={Industry report}
+}
+
+% --- Constitutional AI & Alignment ---
+@article{bai2022constitutional,
+  title={Constitutional AI: Harmlessness from AI Feedback},
+  author={Bai, Yuntao and Kadavath, Saurav and Kundu, Sandipan and others},
+  journal={arXiv preprint arXiv:2212.08073},
+  year={2022}
+}
+
+@article{ouyang2022training,
+  title={Training language models to follow instructions with human feedback},
+  author={Ouyang, Long and Wu, Jeffrey and Jiang, Xu and others},
+  journal={Advances in Neural Information Processing Systems},
+  volume={35},
+  pages={27730--27744},
+  year={2022}
+}
+
+% --- Guardrail Systems ---
+@misc{guardrailsai2023,
+  title={Guardrails AI: Adding guardrails to large language models},
+  author={{Guardrails AI}},
+  howpublished={\url{https://www.guardrailsai.com/}},
+  year={2023}
+}
+
+@misc{nvidia2023nemo,
+  title={NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications},
+  author={{NVIDIA}},
+  howpublished={\url{https://github.com/NVIDIA/NeMo-Guardrails}},
+  year={2023}
+}
+
+@article{inan2023llamaguard,
+  title={Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations},
+  author={Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and others},
+  journal={arXiv preprint arXiv:2312.06674},
+  year={2023}
+}
+
+% --- Agent Frameworks ---
+@misc{langchain2022,
+  title={LangChain: Building applications with LLMs through composability},
+  author={Chase, Harrison},
+  howpublished={\url{https://python.langchain.com/}},
+  year={2022}
+}
+
+@misc{autogpt2023,
+  title={AutoGPT: An Autonomous GPT-4 Experiment},
+  author={{Significant-Gravitas}},
+  howpublished={\url{https://github.com/Significant-Gravitas/AutoGPT}},
+  year={2023}
+}
+
+@misc{autogen2023,
+  title={AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation},
+  author={{Microsoft Research}},
+  howpublished={\url{https://microsoft.github.io/autogen/}},
+  year={2023}
+}
+
+@misc{crewai2024,
+  title={CrewAI: Framework for orchestrating role-playing AI agents},
+  author={{CrewAI}},
+  howpublished={\url{https://docs.crewai.com/}},
+  year={2024}
+}
+
+% --- Agent Safety & Evaluation ---
+@article{agentbench2024,
+  title={{AgentBench}: Evaluating {LLMs} as Agents},
+  author={Liu, Xiao and Yu, Hao and Zhang, Hanchen and Xu, Yifan and Lei, Xuanyu and Lai, Hanyu and Gu, Yu and Ding, Hangliang and Men, Kaiwen and Yang, Kejuan and others},
+  journal={arXiv preprint arXiv:2308.03688},
+  year={2023},
+  note={Published at ICLR 2024}
+}
+
+@article{chan2024visibility,
+  title={Visibility into {AI} Agents},
+  author={Chan, Alan and Ezell, Carson and Kaufmann, Max and Wei, Kevin and Hammond, Lewis and Bradley, Herbie and Bluemke, Emma and Rajkumar, Nitarshan and Krueger, David and Korbak, Tomasz and others},
+  journal={arXiv preprint arXiv:2401.13138},
+  year={2024},
+  note={ACM FAccT 2024}
+}
+
+@article{wildguard2024,
+  title={{WildGuard}: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of {LLMs}},
+  author={Han, Seungju and Rao, Kavel and Ettinger, Allyson and Jiang, Liwei and Lin, Bill Yuchen and Lambert, Nathan and Choi, Yejin and Dziri, Nouha},
+  journal={arXiv preprint arXiv:2406.18495},
+  year={2024},
+  note={NeurIPS 2024}
+}
+
+% --- Multi-Agent Systems ---
+@article{guo2024llmmultiagent,
+  title={Large Language Model based Multi-Agents: A Survey of Progress and Challenges},
+  author={Guo, Taicheng and Chen, Xiuying and Wang, Yaqi and Chang, Ruidi and Pei, Shichao and Chawla, Nitesh V. and Wiest, Olaf and Zhang, Xiangliang},
+  journal={arXiv preprint arXiv:2402.01680},
+  year={2024}
+}
+
+% --- Access Control ---
+@techreport{nist2014abac,
+  title={Guide to Attribute Based Access Control (ABAC) Definition and Considerations},
+  author={{NIST}},
+  institution={National Institute of Standards and Technology},
+  number={SP 800-162},
+  year={2014}
+}
+
+% --- Protocols ---
+@misc{anthropic2024mcp,
+  title={Model Context Protocol Specification},
+  author={{Anthropic}},
+  howpublished={\url{https://modelcontextprotocol.io/}},
+  year={2024}
+}
+
+% --- Governance ---
+@misc{openai2023governance,
+  title={Practices for Governing Agentic {AI} Systems},
+  author={{OpenAI}},
+  howpublished={\url{https://openai.com/index/practices-for-governing-agentic-ai-systems/}},
+  year={2023}
+}
+
+% --- Jailbreaking & Adversarial Attacks ---
+@article{wei2023jailbroken,
+  title={Jailbroken: How Does {LLM} Safety Training Fail?},
+  author={Wei, Alexander and Haghtalab, Nika and Steinhardt, Jacob},
+  journal={arXiv preprint arXiv:2307.02483},
+  year={2023}
+}
+
+@article{zou2023universal,
+  title={Universal and Transferable Adversarial Attacks on Aligned Language Models},
+  author={Zou, Andy and Wang, Zifan and Kolter, J. Zico and Fredrikson, Matt},
+  journal={arXiv preprint arXiv:2307.15043},
+  year={2023}
+}
+
+@article{greshake2023not,
+  title={Not What You've Signed Up For: Compromising Real-World {LLM}-Integrated Applications with Indirect Prompt Injection},
+  author={Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario},
+  journal={arXiv preprint arXiv:2302.12173},
+  year={2023}
+}
+
+% --- Books ---
+@book{russell2020artificial,
+  title={Artificial Intelligence: A Modern Approach},
+  author={Russell, Stuart and Norvig, Peter},
+  edition={4th},
+  publisher={Pearson},
+  year={2020}
+}
+
+@book{weiss2013multiagent,
+  title={Multiagent Systems},
+  author={Weiss, Gerhard},
+  edition={2nd},
+  publisher={MIT Press},
+  year={2013}
+}
+
+% --- Industry Reports ---
+% Note: deloitte2025orchestration moved to top of file
+
+% --- OpenAI Models ---
+@misc{openai2024gpt4,
+  title={GPT-4 Technical Report},
+  author={{OpenAI}},
+  journal={arXiv preprint arXiv:2303.08774},
+  year={2023}
+}
+
+% --- Claude ---
+@misc{anthropic2024claude,
+  title={Claude 3 Model Card},
+  author={{Anthropic}},
+  howpublished={\url{https://www.anthropic.com/}},
+  year={2024}
+}
+
+% --- Statistical Methods ---
+@article{welch1947generalization,
+  title={The generalization of 'Student's' problem when several different population variances are involved},
+  author={Welch, Bernard L},
+  journal={Biometrika},
+  volume={34},
+  number={1-2},
+  pages={28--35},
+  year={1947}
+}
+
+@book{cohen1988statistical,
+  title={Statistical Power Analysis for the Behavioral Sciences},
+  author={Cohen, Jacob},
+  edition={2nd},
+  publisher={Lawrence Erlbaum Associates},
+  year={1988}
+}
+
+% --- Companion Paper ---
+@misc{selfcorrecting2026,
+  author = {{Self-Correcting Agent Team}},
+  title = {Self-Correcting Agent Kernel: Automated Alignment via Differential Auditing and Semantic Memory Hygiene},
+  year = {2026},
+  note = {arXiv preprint (submitted; ID pending)},
+  url = {https://github.com/imran-siddique/self-correcting-agent-kernel}
+}
+
+% --- Anonymized Companion Paper (for double-blind review) ---
+@article{anonymous2026companion,
+  title={[Anonymized]: Companion Paper on Runtime Policy Adaptation},
+  author={Anonymous},
+  journal={arXiv preprint},
+  year={2026},
+  note={Under review}
+}

modules/control-plane/pyproject.toml

@@ -0,0 +1,124 @@
+[build-system]
+requires = ["setuptools>=45", "wheel", "setuptools_scm[toml]>=6.2"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "agent-control-plane"
+version = "0.4.0"
+description = "Layer 3: The Framework - A deterministic kernel for zero-violation governance in agentic AI systems with POSIX-style signals, VFS, and kernel/user space separation"
+readme = "README.md"
+requires-python = ">=3.8"
+license = "MIT"
+authors = [
+    {name = "Imran Siddique", email = "imran.siddique@microsoft.com"},
+]
+maintainers = [
+    {name = "Imran Siddique", email = "imran.siddique@microsoft.com"},
+]
+keywords = [
+    "ai",
+    "agents",
+    "governance",
+    "control-plane",
+    "safety",
+    "policy",
+    "framework",
+    "agentic-ai",
+    "llm",
+    "guardrails",
+    "deterministic",
+    "kernel",
+    "signals",
+    "vfs",
+    "syscall",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Science/Research",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Topic :: Security",
+    "Topic :: System :: Systems Administration",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Typing :: Typed",
+]
+
+# Core dependencies - standard library only for zero external deps
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/imran-siddique/agent-control-plane"
+Documentation = "https://github.com/imran-siddique/agent-control-plane/tree/main/docs"
+Repository = "https://github.com/imran-siddique/agent-control-plane"
+"Bug Tracker" = "https://github.com/imran-siddique/agent-control-plane/issues"
+
+[project.optional-dependencies]
+# Development dependencies
+dev = [
+    "pytest>=7.0.0",
+    "pytest-cov>=4.0.0",
+    "black>=23.0.0",
+    "flake8>=6.0.0",
+    "mypy>=1.0.0",
+    "pre-commit>=3.0.0",
+]
+
+# Hugging Face Hub integration (for datasets and model cards)
+hf = [
+    "huggingface_hub>=0.20.0",
+    "datasets>=2.14.0",
+]
+
+# Allowed Layer 2 protocol dependencies (optional integrations)
+# These are the ONLY external agent-related dependencies allowed
+protocols = [
+    # iatp: Inter-Agent Transport Protocol (for message security)
+    # "iatp>=1.0.0",
+    # cmvk: Cryptographic Message Verification Kit (for verification)
+    # "cmvk>=1.0.0",
+    # caas: Context-as-a-Service (for context routing)
+    # "caas>=1.0.0",
+]
+
+# Full installation with all protocol integrations
+full = [
+    # "iatp>=1.0.0",
+    # "cmvk>=1.0.0",
+    # "caas>=1.0.0",
+]
+
+# NOTE: The following dependencies are STRICTLY FORBIDDEN as hard imports:
+# - scak (Self-Correcting Agent Kernel) - should implement KernelInterface
+# - mute-agent - should use ValidatorInterface
+# These packages may depend on agent-control-plane, but NOT vice versa.
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]
+addopts = "-v --strict-markers"
+
+[tool.black]
+line-length = 100
+target-version = ['py38', 'py39', 'py310', 'py311', 'py312']
+include = '\.pyi?$'
+
+[tool.mypy]
+python_version = "3.8"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = false