agentmandate 0.1.0__tar.gz

agentmandate-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,162 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+          - "3.14"
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+      - name: Test
+        run: python -m pytest -q
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check .
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+      - name: Enforce statement coverage
+        run: >-
+          python -m pytest -q
+          --cov=agentmandate
+          --cov-report=term-missing
+          --cov-fail-under=90
+
+  no-dependency-install:
+    name: Core has no runtime dependency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install without extras
+        run: python -m pip install .
+      # A JSON manifest must work with nothing else installed. The YAML reader
+      # is an extra, and the error when it is missing has to name the fix.
+      - name: Analyse a JSON manifest with no extras present
+        run: |
+          cd "${RUNNER_TEMP}"
+          cat > m.json <<'JSON'
+          {"agent": "a", "limits": {"total": {"amount": 10, "currency": "GBP"}},
+           "tools": [{"name": "seed", "effect": "read", "produces": "case",
+                      "unbounded": true},
+                     {"name": "pay", "effect": "irreversible", "requires": ["case"],
+                      "value_arg": "amount", "scope_key": "case",
+                      "requires_approval": true,
+                      "ceiling": {"amount": 10, "currency": "GBP"}}]}
+          JSON
+          mandate reach m.json && exit 1
+          echo "reach correctly exited non-zero on a reachable breach"
+
+  package:
+    name: Package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install build tools
+        run: python -m pip install build twine
+      - name: Build distributions
+        run: python -m build
+      - name: Check distribution metadata
+        run: python -m twine check dist/*
+      - name: Install wheel
+        run: python -m pip install --force-reinstall "dist/$(ls dist | grep '\.whl$')[yaml]"
+      - name: Smoke-test installed package
+        run: |
+          export PACKAGE_VERSION
+          PACKAGE_VERSION="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")"
+          cd "${RUNNER_TEMP}"
+          python -c "import importlib.metadata as m, os; import agentmandate; assert m.version('agentmandate') == os.environ['PACKAGE_VERSION']"
+          mandate --help
+
+  gate:
+    name: CI gate
+    runs-on: ubuntu-latest
+    needs:
+      - test
+      - lint
+      - coverage
+      - no-dependency-install
+      - package
+    # Runs even when a needed job fails, so the gate reports a real failure
+    # instead of being skipped and leaving the required check pending forever.
+    if: always()
+    steps:
+      - name: Require every upstream job to succeed
+        env:
+          TEST_RESULT: ${{ needs.test.result }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          COVERAGE_RESULT: ${{ needs.coverage.result }}
+          NODEPS_RESULT: ${{ needs.no-dependency-install.result }}
+          PACKAGE_RESULT: ${{ needs.package.result }}
+        run: |
+          echo "test:     ${TEST_RESULT}"
+          echo "lint:     ${LINT_RESULT}"
+          echo "coverage: ${COVERAGE_RESULT}"
+          echo "no-deps:  ${NODEPS_RESULT}"
+          echo "package:  ${PACKAGE_RESULT}"
+          for result in \
+            "${TEST_RESULT}" \
+            "${LINT_RESULT}" \
+            "${COVERAGE_RESULT}" \
+            "${NODEPS_RESULT}" \
+            "${PACKAGE_RESULT}"; do
+            if [ "${result}" != "success" ]; then
+              echo "::error::a required job did not succeed"
+              exit 1
+            fi
+          done

agentmandate-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Release
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Verify release tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          PACKAGE_VERSION="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")"
+          test "${RELEASE_TAG}" = "v${PACKAGE_VERSION}"
+      - name: Install build tools
+        run: python -m pip install build twine
+      - name: Build distributions
+        run: python -m build
+      - name: Check distribution metadata
+        run: python -m twine check dist/*
+      - uses: actions/upload-artifact@v7
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/agentmandate
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distributions
+        uses: pypa/gh-action-pypi-publish@release/v1

agentmandate-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+.venv/
+*.egg-info/
+.pytest_cache/
+.coverage
+.ruff_cache/
+build/
+dist/

agentmandate-0.1.0/CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
+[semantic versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+## 0.1.0 - 2026-07-28
+
+First release.
+
+### Added
+
+- `mandate reach`, a bounded breadth-first search over the authority graph that
+  reports a legal call sequence breaching a declared limit, as a counterexample
+  rather than a score.
+- `mandate diff`, a comparison of the effective authority of two manifests,
+  classified widening, narrowing, or neutral, exiting non-zero on widening.
+- `mandate lint`, single-manifest control checks covering separation of duties,
+  ungated irreversible effects, service-account principals, ceilings scoped to
+  something the tool does not require, and mixed currencies.
+- `mandate verify`, replay of recorded tool calls against the manifest,
+  reporting undeclared tools, exceeded ceilings, missing approvals, wrong
+  principals, and run totals.
+- A manifest schema carrying the three facts an ordinary tool schema omits:
+  effect class, the value-bearing argument, and the scope a ceiling is measured
+  against.
+- Worked examples for a payment-dispute agent, including the release pair where
+  adding one read-only tool takes extractable value from 500 to 2000 GBP.
+- `--json` on every analysis command, and exit codes suitable for a CI gate.
+- `mandate scan`, which derives a manifest skeleton from an MCP `tools/list`
+  catalogue. Effects are guessed from the tool name and default to
+  `irreversible`, and every guess carries a `REVIEW` marker, because a tool
+  schema cannot supply reversibility, the value argument, or the scope a
+  ceiling is measured against.
+- A second breach class in `reach`: an irreversible effect reachable with no
+  approval is now reported with the call sequence that reaches it, rather than
+  only as a name in the authority summary.
+- `mandate diff --record`, a markdown change record for a change advisory
+  board, with the authority section derived rather than asserted.
+- A `currency_mismatch` violation in `verify`, so a call spending one currency
+  against a ceiling declared in another is reported rather than silently summed.
+- Status badges, an exit-code table, and the pull-request workflow snippet for
+  gating on an authority diff against the default branch.

agentmandate-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contributing
+
+AgentMandate uses a pull-request-only workflow for `main`.
+
+1. Create a branch from the latest `main`:
+
+   ```bash
+   git switch main
+   git pull --ff-only
+   git switch -c feature/short-description
+   ```
+
+2. Keep the change focused and add tests for behavioural changes.
+
+3. Run the local quality gate:
+
+   ```bash
+   python -m pytest -q
+   python -m pytest -q --cov=agentmandate --cov-fail-under=90
+   ruff check .
+   ```
+
+4. Push the branch and open a pull request:
+
+   ```bash
+   git push -u origin feature/short-description
+   ```
+
+Direct pushes, force pushes, and deletion of `main` are blocked. Merge only
+after CI passes and all review conversations are resolved.
+
+Maintainers should follow [RELEASING.md](RELEASING.md) when publishing a
+version.
+
+## Useful first contributions
+
+The authority model is the part that most needs contact with real systems.
+Good first contributions include:
+
+- a manifest for a tool graph this models badly, with a note on what it gets
+  wrong. A graph the model cannot express is more useful than a new rule
+- an extractor that derives a manifest from an MCP server or a framework's
+  tool registry, so manifests stop being hand-authored
+- a lint rule that maps to a named control, with the control cited
+- a counterexample the search should find and does not
+
+Open an issue before a large extractor. Describe the source of truth it reads,
+what it can and cannot infer, and what a human still has to annotate.
+
+Do not include customer prompts, model outputs, credentials, real account
+identifiers, or trace identifiers in an issue or a fixture.

agentmandate-0.1.0/DESIGN.md

@@ -0,0 +1,126 @@
+# Design
+
+## The problem this exists for
+
+An agent's authority is not written down in one place. It is spread across tool
+schemas, framework configuration, the IAM roles the tools run under, and a
+prompt that asks nicely. Nobody can answer "what can this agent do" by reading
+any single one of those, and nobody can answer "what changed" by reading a pull
+request, because reachability composes and text does not.
+
+Existing agent scanners check one tool at a time. That finds the tool with no
+approval gate, which is worth finding. It cannot find the case where every tool
+passes and a sequence of them does not, because that defect does not live in
+any one tool.
+
+## The authority model
+
+A mandate is a set of tools over a set of scopes.
+
+A **scope** is a type of resource the agent can hold a binding to, such as
+`case` or `ledger`. Scopes are types, not instances: the analysis reasons about
+"a case", never about case 4471.
+
+A **tool** may require bindings to act, may produce a binding, may spend value,
+and carries an effect class and a principal.
+
+The three fields that make compound analysis possible, and that an ordinary
+tool schema does not carry:
+
+| Field | Why it is needed |
+|---|---|
+| `effect` | read, write, or irreversible. Reversibility is what decides where a gate belongs, and it cannot be inferred from a name |
+| `value_arg` | which argument spends money. Without it there is nothing to accumulate |
+| `scope_key` | what a ceiling is measured against. A ceiling with no scope is not a bound |
+
+Full preconditions and postconditions would be more expressive. They would also
+not get written, and an unwritten annotation buys nothing. This is the smallest
+set that supports the analysis.
+
+### `unbounded` is the whole game
+
+A per-scope ceiling is only a bound when the scope itself is bounded. A tool
+marked `unbounded` can be called repeatedly to mint fresh bindings, so a
+£500-per-case ceiling becomes £500 times as many cases as the agent cares to
+open.
+
+That is the defect the package exists to find, and it is invisible tool by
+tool. Both halves look correct in isolation. Only the composition is wrong.
+
+## The search
+
+Breadth-first over states, where a state is the bindings held and the value
+already spent per (tool, scope, binding).
+
+Breadth-first rather than depth-first for one reason: the shortest
+counterexample is the most useful one. A four-call sequence gets fixed and a
+forty-call sequence gets argued about.
+
+States are canonicalised so the walk memoises, and a transition that changes
+nothing is not enqueued. Without that, any manifest with a read-only tool
+produces an infinite frontier.
+
+The search is bounded by `limits.depth`. Results are a lower bound: no breach at
+depth 8 is not proof that none exists at depth 20, and the report says so when
+it truncated. Claiming otherwise would require a completeness argument this
+model does not support.
+
+## Why effective authority, not declared policy
+
+`diff` compares what two manifests *permit*, computed by running the search over
+both, rather than comparing their text. The two come apart routinely, which is
+the entire argument for the command:
+
+- Adding a read-only tool changes no permission and can make a money ceiling
+  unenforceable. This is the shipped example.
+- Renaming a tool changes every line of the config diff and no authority.
+- Relaxing one enum in a schema is one character and can open a scope.
+
+Effective authority is summarised as reachable tools, effect-on-scope pairs,
+ungated irreversible effects, service-principal tools, maximum extractable
+value, and reachable breach kinds. A gain in any of those is widening.
+
+## Why `verify` ships in the first version
+
+A declaration nobody checks is a wish. The implementation drifts from the
+manifest the moment somebody ships a connector change, and every finding this
+tool produces is worthless if the manifest stopped describing the agent six
+weeks ago.
+
+`verify` replays recorded calls and reports what the mandate does not permit.
+It is the cheapest available answer to "why should I believe your manifest",
+and without it the rest would be a YAML linter with opinions.
+
+## Deliberate overlap
+
+`lint` covers ground that AgentWard, AgentShield, and AgentGuard already cover.
+That is on purpose. A tool that reported only compound findings would need one
+of those running alongside it to be usable at all, and the first thing anyone
+does with a new analysis tool is run it on its own.
+
+The overlap is the floor. The contribution is `reach` and the diff built on it.
+
+## What was left out, and why
+
+**Data-flow reachability.** Finding that a read tool feeds an exfiltration path
+needs taint labels on arguments and returns. The manifest does not carry them,
+and inventing them would mean asking for annotations nobody would write. Left
+out rather than approximated, because a taint analysis with guessed labels
+produces confident false positives, which is worse than no analysis.
+
+**Enforcement.** No proxy, no runtime interception. That is a large maintenance
+surface, it is well covered by others, and mixing analysis with enforcement
+makes both harder to reason about.
+
+**Model behaviour.** Whether an agent *would* take a path is a different
+question from whether it *may*. This measures permission. The behavioural
+question needs the agent in the loop and belongs in a testing tool.
+
+**Inferring the fields that matter.** `mandate scan` reads an MCP catalogue and
+writes the skeleton, which removes the typing. It cannot remove the thinking,
+because the three fields the model needs are exactly the ones a tool schema
+omits. It guesses conservatively, defaults anything that is not clearly a read
+to `irreversible`, and marks every guess `REVIEW`. Extract then annotate, never
+extract and trust. Inferring reversibility from a description with a model was
+considered and rejected: a confident wrong answer about whether an action can be
+undone is worse than no answer.

agentmandate-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.