Read governance evidence
Touba exposes governance information through source, AIR, manifests, locks and traces. Use the CLI, VS Code and project server API to inspect these artifacts and connect them to your application's operational needs.
Where authority lives
The runtime enforces contracts and refusals. An editor or API client cannot create authority outside those contracts. Source declares the program; manifests bind tools and host grants; traces describe actual execution.
Inspect with the CLI and VS Code
Use CLI commands to compile, inspect and audit. The VS Code extension provides diagnostics, navigation and commands based on the same compiler and CLI.
Review capabilities, callers, memory scopes and budgets before running. After execution, correlate the trace with the matching AIR and source.
Integrate the project API
The project server API exposes run states, human requests and events. An application can combine these contracts with its own authentication and user experience. It remains responsible for presenting information clearly and requesting only authorized actions.
Semantic changes use proposals validated by the server. A client does not keep a competing authority model or rewrite runtime evidence.
Follow execution
Read run states and events to distinguish completion, refusal, pause, cancellation and budget exhaustion. Use native trace exports and trace audit to inspect the sequence.
A successful transport response is not a successful business operation. Likewise, a well-founded refusal is evidence of a control, not completion of the requested task.
Handle human decisions
Use human validation for mandatory approval or agent-requested review. Bind each decision to its actual request and occurrence. The runtime validates it before resumption; an approval does not grant undeclared tool permissions.
Keep private context and checkpoints in authorized storage. Do not expose resolved secrets through client messages or diagnostic views. The expiration guide explains rejected, cancelled and expired requests.
Scope
These artifacts make represented contracts and execution inspectable. Regulatory assessment, legal attribution and review of host handlers remain responsibilities of the people and organizations operating the application.