**Status:** stable · **Owner:** Developer Relations · **License:** Apache-2.0 # `agentcore-adapter` — wrap a cloud agent-gateway verdict with KYE evidence Starter that runs an AWS Bedrock AgentCore gateway admission decision, maps the verdict onto the **locked KYE DecisionOutcome set**, then wraps the agent session with KYE authority evidence — carrying the raw gateway verdict into the sealed evidence so it is replay-verifiable. This is an **integration**, not a replacement: the gateway keeps making its routing/admission decision; KYE governs the AgentCore-run agent as a principal and adds the authority dimension on top. KYE never becomes the agent runtime (§0.30 / §32). The production reference is [`@kye/connector-agentcore`](../../connector-agentcore/). Companion playbook: [agentcore-and-kye](../../playbooks/agentcore-and-kye.md). ## Run ```bash kye agent new my-agent --template agentcore-adapter cd my-agent && npm install && npm start ``` The gateway client seam (`src/mock-gateway.ts`) ships an injected `GatewayQuery` with a deterministic stand-in. Inject a real `@aws-sdk/client-bedrock-agentcore` client wrapper and the KYE wrap in `src/agent.ts` is unchanged. ## What it emits | When | Envelope | Schema | |---|---|---| | task-start | binding | `kye.agent.governance.v1` | | gateway verdict | tool-call (carries the raw verdict) | `kye.evidence.tool_call.v1` | | task-end | completion | `kye.agent.completion.v1` | The carried gateway verdict is sealed alongside KYE's outcome, exactly like a policy-engine verdict — see [`public/examples/policy-engine-adapters/`](../../../examples/policy-engine-adapters/) for the `records_raw_*_verdict` discipline. ## Files - `src/agent.ts` — the KYE-wrapped session + the locked-outcome mapping. - `src/mock-gateway.ts` — the injected `GatewayQuery` seam (deterministic stand-in). - `package.json` — depends on `@kye/agent-dev-kit`.