Skip to content

Legis — cheat-sheet

Git/CI governance and attestations. Violet thread. Authority: ~/legis · briefing: members/legis.md

What it does

Legis makes every agent action at the git/CI boundary that breaks a policy produce exactly one attributable, tamper-evident, identity-stable audit record instead of a silent pass — and it grades who must answer (self-record / LLM-judge / human sign-off) server-side, so the agent never chooses how cheaply it clears a gate.

It owns governance verdicts (CLEAR / VIOLATION / UNKNOWN with an honest provenance_gap), the 2×2 enforcement cells (chill / coached / structured / protected), HMAC-signed protected verdicts, and the SEI-keyed sign-off ledger. It is the federation's governance surface — "the one judge."

Quick-start

Legis runs as a service; agents drive it over MCP (and the HTTP surface).

legis serve     # start the HTTP governance service
legis mcp       # start the MCP stdio surface (read-mode tools)

policy_evaluate { change }      # CLEAR / VIOLATION / UNKNOWN verdict
policy_explain  { change }      # why the verdict, which cell
override_submit { ... }         # one verb routes all four enforcement cells
signoff_status_get { sei }      # SEI-keyed sign-off ledger state

override_submit is the unified verb across all four cells; NEED_INPUTS comes back as a guided non-error, not a failure.

How it composes

Legis governs change provenance whether Loomweave, Wardline, or Filigree are present — a verdict still resolves with identity_stable: false honestly flagged when a sibling capability is absent. Legis is a consumer of identity, never an authority, and never re-adjudicates trust ("Wardline analyses, Legis governs").

Federation role and consumer-side conformance: members/legis.md.

Snapshot — most-used commands & MCP verbs

snapshot 2026-06-06 — NOT authoritative here; see the repo

A curated subset, not the full surface. The endpoint list and policy grammar are Legis's authority. See ~/legis/README.md, ~/legis/src/legis/mcp.py, and ~/legis/CHANGELOG.md.

Surface Verb Does
CLI legis serve start the HTTP governance service
CLI legis mcp start the MCP stdio surface
MCP policy_evaluate produce a governance verdict
MCP policy_explain explain the verdict and enforcement cell
MCP override_submit submit an override (routes all four cells)
MCP signoff_status_get SEI-keyed sign-off ledger state
MCP git_rename_feed_get the git-rename provider seam
MCP scan_route route a scan finding into governance

Pointers