Demos

Demo: behavioral anomaly detection with a signed monitoring envelope

Example status: illustrative, not runnable as written. The Python examples on this page are built on an embedded in-repo facade imported as core.eve_sdk (an EVE(...) object with govern_* methods). That module is not present in the current repository and is not published on any registry, so these snippets raise ModuleNotFoundError if run. They are kept because they show the intended governance flow. For code that runs today, use the published client: pip install eve-coreguard, then from eve_coreguard import CoreGuardClient and call client.evaluate(...), with offline evidence checking via client.verify_evidence(...) or the standalone verify_decision_record. See the CoreGuard integration guide and the Python SDK reference.

EVE detects behavioral anomalies using deterministic statistical detectors (rolling/robust z-score, EWMA, CUSUM) and produces signed monitoring envelopes summarizing agent behavior over a window. This demo feeds a stable baseline, then a spike, and shows the detector flagging the deviation. Monitoring is observational — the demo shows how to wire the flag to a deterministic enforcement action.

Synthetic fixtures. No production credentials.

Readiness

Behavioral anomaly detection + signed monitoring envelopes: PILOT_READY.
Python only (embedded(service) mode).

Setup

# demo_behavioral_anomaly.py — synthetic fixtures only
from core.eve_sdk import EVE

IDENT = {"tenant_id": "acme", "principal_id": "agent-1", "session_id": "sess-1"}
blocked_actions = []

eve = EVE(policy="lending_v1", mode="embedded")
monitor = eve.monitor(metric="calls_per_minute", detector="robust_zscore", z_threshold=3.0)

Code

# 1) Baseline: 20 windows near ~10 calls/min -> no anomaly.
for _ in range(20):
    monitor.observe(10)
assert not monitor.state().anomaly, "baseline must not flag"

# 2) Spike: a window at 300 calls/min -> statistical anomaly flagged.
event = monitor.observe(300)
assert event.anomaly, "spike must be flagged"
print("anomaly:", event.detector, round(event.z_score, 1), event.escalation)

# 3) Advisory -> enforcement: wire the flag to a deterministic BLOCK for further calls.
if event.escalation == "high":
    r = eve.govern_tool_call(tool="external_post", arguments={},
                             context={**IDENT, "monitor_escalation": "high"})
    if not r.allowed:
        blocked_actions.append(r.decision_id)

# 4) Signed monitoring envelope for the window.
envelope = monitor.build_envelope()
print("envelope signed:", envelope.certificate is not None)

Expected decision / detection

Step	Result
20 baseline windows (~10/min)	no anomaly
1 spike window (300/min)	anomaly flagged (z-score ≫ threshold)
escalation wired to governance	over-threshold action BLOCK

Expected evidence

Anomaly event and a signed monitoring envelope:

{"anomaly_event": {"detector": "robust_zscore", "z_score": 12.4, "escalation": "high"},
 "envelope": {"window": "...", "certificate": {"signature": "kms-ecdsa-p384-...", "canon": "jcs-1"}}}

Verification command

from core.eve_sdk import verify_evidence
v = verify_evidence("monitoring_envelope", envelope.certificate, expected_tenant="acme")
assert v["valid"], v.get("reason")
print("verify:", v["valid"])   # -> True

Zero-side-effect assertion

monitor.observe(...) only reads counters into detector state — it invokes no tool. The enforcement step routes through a deterministic governance verdict; blocked_actions records that the escalated action was BLOCKed rather than executed. No tool ran during monitoring.

Cleanup

blocked_actions.clear()

No external state created.

Limitations

Statistical detectors flag deviations and are advisory unless wired to a deterministic enforcement action (as shown in step 3). Detection is not free of false positives.
Monitoring is observational; enforcement decisions are made by CoreGuard / sequence / budget controls.
PILOT_READY, not production.