SDK Status

Test suite state and release history for governance-sdk v0.11.2. Numbers below are as of 2026-04-16. Re-generate with cd packages/governance && npm test.

1,328

Tests passing

0 failures

276

Test suites

all passing

Runtime deps

zero-dep

4.2s

Suite runtime

Node 22 · local

Tested Capability Surfaces

1,328 tests across 276 suites

Core enforcement engine

src/governance*.test.ts + src/policy*.test.ts

Policy conditions + builder

src/condition-registry.test.ts + src/policy-*.test.ts

Injection detection (regex)

src/injection-*.test.ts (inc. 6,931-sample LIB benchmark)

Audit integrity chain

src/audit-integrity*.test.ts + src/audit-chain-e2e.test.ts

EU AI Act / ISO 42001 / NIST AI RMF

src/compliance*.test.ts + iso-42001.test.ts + nist-ai-rmf.test.ts

Kill switch + revive

src/kill-switch*.test.ts

Governance scoring (7-dim)

src/scorer*.test.ts + behavioral-scorer.test.ts

Mastra adapter (MW + processor)

src/plugins/mastra*.test.ts

Vercel AI SDK adapter

src/plugins/vercel-ai*.test.ts

LangChain adapter

src/plugins/langchain*.test.ts

OpenAI Agents adapter

src/plugins/openai-agents*.test.ts

Anthropic adapter

src/plugins/anthropic*.test.ts

Genkit / LlamaIndex / Mistral / Ollama adapters

src/plugins/{genkit,llamaindex,mistral,ollama}*.test.ts

MCP server governance

src/plugins/mcp*.test.ts

Bedrock entry-gate

src/plugins/bedrock.test.ts

Agent identity (Ed25519)

src/agent-identity*.test.ts

Supply chain + CycloneDX SBOM

src/supply-chain*.test.ts

Dry-run simulation

src/dry-run.test.ts

Event emitter

src/events.test.ts

Adversarial + edge cases

src/*-edge.test.ts + src/*-adversarial.test.ts

Per-suite test counts drift between releases; we deliberately don't hard-code them on this page. Run npm test locally for the full breakdown.

Performance

Governance runs in-process on the same event loop as your agent. There is no network round-trip, no spawned subprocess, and no dynamic code evaluation. In practice, enforcement overhead is dominated by the cost of the rules you evaluate — typical tool executions (50–500ms for an LLM call or external API) are orders of magnitude larger.

The one benchmark we ship with committed source data is the regex injection detector — F1 = 0.48 (precision 0.685, recall 0.373) on the 6,931-sample LIB corpus. See packages/governance/benchmark/data/lua-injection-benchmark-v1-regex-baseline.json and re-run with benchmark/scripts/run-benchmark.ts.

Recent Releases

v0.11.2latest2026-04-16README sync automationnotes →

v0.11.12026-04-16Sync npm README with reponotes →

v0.11.0stable2026-04-15Scope honesty pass 2 — 5 modules removed, 4 demotednotes →

Full release history: packages/governance/CHANGELOG.md