Cross-Provider Policy

One operation, eight provider formats

Chio separates a model provider’s tool-call syntax from the authority to execute an operation. That separation lets an agentic operating system govern tools across model runtimes. This project examines the translation layer: eight saved exchanges request get_weather for San Francisco in Celsius and carry an allow verdict.

Run it to compare those recorded fields and catch a fixture-contract mismatch. It is an offline verifier: the command makes no model request, performs no weather lookup, and signs no new kernel receipt. For an application you can connect to a model, start with the provider and LangChain project or the complete Rust host.

Run the comparison

Fetch the project and run it. You need Rust; rust-toolchain.toml selects the compiler and Cargo fetches the conformance crate with its recorded fixtures. You can also download the project.

chio new cross-provider-policy --example cross-provider-policy
cd cross-provider-policy
cargo run --locked --quiet -- --dry-run

The command prints eight comparison records, then this captured summary. A successful exit means their selected fields match the configured fixture contract and each other.

cross-provider verdict equality: 8 receipts validated for policy cross-provider-policy-demo

Download the complete captured stdout or all eight comparison records as JSON. The required --dry-run flag makes the command’s offline role explicit.

Follow the weather request

Read the example’s contract

The file below is the project's complete configuration. Its fixture_contract names the expected operation, exact arguments and recorded verdict. The example’s own parser reads this subset; it does not load the full HushSpec guard engine. Keep this verifier configuration separate from an application’s runtime policy.

hushspec: "0.1.0"
name: cross-provider-policy-demo
description: Dry-run policy proving equivalent tool verdicts across native provider adapters.

rules:
  tool_access:
    enabled: true
    default: block
    allow:
      - get_weather
  fixture_contract:
    scenario_id: weather_lookup_allow
    required_tool: get_weather
    required_arguments:
      location: "San Francisco, CA"
      unit: celsius
    expected_verdict: allow

Distinguish the two input paths

Inspect a complete comparison record

This is the first record from the executed command. Its receipt_id identifies a fixture record. The object has no kernel signature, signer key or content hash; use it for comparison, rather than as a signed execution receipt.

{
  "receipt_id": "rcpt_openai_basic_single_tool_call_allow",
  "body": {
    "policy_id": "cross-provider-policy-demo",
    "scenario_id": "weather_lookup_allow",
    "tool_name": "get_weather",
    "arguments": {
      "location": "San Francisco, CA",
      "unit": "celsius"
    },
    "verdict": {
      "verdict": "allow",
      "reason": null,
      "redactions": []
    },
    "provenance": {
      "provider": "open_ai",
      "request_id": "call_weather_1",
      "api_version": "responses.2026-04-25",
      "principal": {
        "kind": "open_ai_org",
        "org_id": "org_chio_demo"
      },
      "received_at": "2026-04-25T00:00:01.150Z"
    }
  }
}

Make a mismatch visible

Copy the contract so the original stays available:

cp policy.yaml comparison.yaml

In comparison.yaml, change only rules.fixture_contract.expected_verdict:

expected_verdict: deny

cargo run --locked --quiet -- \
  --dry-run --policy comparison.yaml

fixture rcpt_openai_basic_single_tool_call_allow verdict Allow did not match policy verdict Deny

The captured request still says allow. Changing the expected verdict makes the verifier reject that mismatch; it does not reevaluate the request and turn it into a denied invocation. Restore expected_verdict: allow to pass again.

Compare the fields that should agree

The comparison removes provider provenance and the outer receipt identifier, then serializes the remaining body as canonical JSON. Every selected record reduces to these fields:

{
  "policy_id": "cross-provider-policy-demo",
  "scenario_id": "weather_lookup_allow",
  "tool_name": "get_weather",
  "arguments": {
    "location": "San Francisco, CA",
    "unit": "celsius"
  },
  "verdict": {
    "verdict": "allow",
    "reason": null,
    "redactions": []
  }
}

Connect provider syntax to the recorded invocation

The OpenAI fixture contains four NDJSON records. This is the complete provider response payload from its second record; arguments arrive as an encoded JSON string.

{
  "id": "resp_openai_basic_single_tool_call",
  "object": "response",
  "output": [
    {
      "type": "message",
      "content": [
        {
          "type": "output_text",
          "text": "Checking the forecast."
        }
      ]
    },
    {
      "type": "function_call",
      "call_id": "call_weather_1",
      "name": "get_weather",
      "arguments": "{\"location\":\"San Francisco, CA\",\"unit\":\"celsius\"}"
    }
  ]
}

The third record stores the normalized invocation and the captured verdict. Adapter replay checks that the provider request lifts into this invocation. It does not independently authorize the weather lookup.

{
  "ts": "2026-04-25T00:00:01.150Z",
  "schema": "chio-provider-conformance.capture.v1",
  "fixture_id": "openai_basic_single_tool_call",
  "family": "tool_use_basic",
  "api_snapshot": "2026-04-25",
  "direction": "kernel_verdict",
  "provider": "openai",
  "invocation_id": "call_weather_1",
  "verdict": "allow",
  "receipt_id": "rcpt_openai_basic_single_tool_call_allow",
  "payload": {
    "invocation": {
      "provider": "open_ai",
      "tool_name": "get_weather",
      "arguments": {
        "location": "San Francisco, CA",
        "unit": "celsius"
      },
      "provenance": {
        "provider": "open_ai",
        "request_id": "call_weather_1",
        "api_version": "responses.2026-04-25",
        "principal": {
          "kind": "open_ai_org",
          "org_id": "org_chio_demo"
        },
        "received_at": "2026-04-25T00:00:01.150Z"
      }
    }
  }
}

Interpret a passing result

See where the paths converge

Extend the check you actually need

Add captured cases to examine different argument shapes or provider translations. A denial case needs a captured denial and the matching expected contract. To test a new runtime guard, send the request through a configured kernel in your application and inspect its actual decision.

Adding an egress rule to this file does not test egress enforcement. A control run with an extra blocking egress rule still passes because the example’s parser ignores that section. Use Write a Policy for an executed policy edit and receipt verification for signed evidence.

Keep the comparison output

cargo run --locked --quiet -- \
  --dry-run > comparison.out
cat comparison.out

Each record includes provider provenance, followed by a provenance.provider line. The complete output is useful when a change needs inspection; its fixture identifiers should not be passed to a kernel receipt verifier.

Inspect the verifier implementation

The source checks each record against the expected tool, arguments and verdict, then compares canonical bytes. These details support maintenance of the verifier after the complete run above works.

fn enforce_policy(policy: &DemoPolicy, receipt: &DemoReceipt) -> Result<(), DemoError> {
    let contract = &policy.rules.fixture_contract;
    if receipt.body.tool_name != contract.required_tool {
        return Err(DemoError::ToolMismatch {
            fixture_id: receipt.receipt_id.clone(),
            expected: contract.required_tool.clone(),
            actual: receipt.body.tool_name.clone(),
        });
    }
    if receipt.body.arguments != contract.required_arguments {
        return Err(DemoError::ArgumentsMismatch {
            fixture_id: receipt.receipt_id.clone(),
        });
    }
    if receipt.body.verdict.verdict != contract.expected_verdict {
        return Err(DemoError::VerdictMismatch {
            fixture_id: receipt.receipt_id.clone(),
            expected: contract.expected_verdict,
            actual: receipt.body.verdict.verdict,
        });
    }
    Ok(())
}

fn body_without_provenance(body: &ReceiptBody) -> ReceiptBodyWithoutProvenance {
    ReceiptBodyWithoutProvenance {
        policy_id: body.policy_id.clone(),
        scenario_id: body.scenario_id.clone(),
        tool_name: body.tool_name.clone(),
        arguments: body.arguments.clone(),
        verdict: body.verdict.clone(),
    }
}

fn assert_receipt_equivalence(receipts: &[DemoReceipt]) -> Result<(), DemoError> {
    let Some(first) = receipts.first() else {
        return Ok(());
    };

    let first_body = body_without_provenance(&first.body);
    let first_body_bytes = canonical_json_bytes_for("first receipt body", &first_body)?;
    let first_verdict_bytes =
        canonical_json_bytes_for("first normalized verdict", &first.body.verdict)?;

    for receipt in receipts.iter().skip(1) {
        let body = body_without_provenance(&receipt.body);
        let body_bytes = canonical_json_bytes_for("normalized receipt body", &body)?;
        assert_canonical_bytes_eq(
            "receipt body excluding provenance",
            &first_body_bytes,
            &body_bytes,
        )?;

        let verdict_bytes = canonical_json_bytes_for("normalized verdict", &receipt.body.verdict)?;
        assert_canonical_bytes_eq("normalized verdict", &first_verdict_bytes, &verdict_bytes)?;
    }

    Ok(())
}

cargo run --locked --quiet

--dry-run is required; this example never calls live provider APIs

cargo run --locked --quiet -- --dry-run > out.txt
wc -l < out.txt
grep -c '^provenance.provider' out.txt
tail -1 out.txt

227
8
cross-provider verdict equality: 8 receipts validated for policy cross-provider-policy-demo

{
  "receipt_id": "rcpt_openai_basic_single_tool_call_allow",
  "body": {
    "policy_id": "cross-provider-policy-demo",
    "scenario_id": "weather_lookup_allow",
    "tool_name": "get_weather",
    "arguments": {
      "location": "San Francisco, CA",
      "unit": "celsius"
    },
    "verdict": {
      "verdict": "allow",
      "reason": null,
      "redactions": []
    },
    "provenance": {
      "provider": "open_ai",
      "request_id": "call_weather_1",
      "api_version": "responses.2026-04-25",
      "principal": {
        "kind": "open_ai_org",
        "org_id": "org_chio_demo"
      },
      "received_at": "2026-04-25T00:00:01.150Z"
    }
  }
}
provenance.provider: "open_ai"
{