# Governance — langchain-anthropic-langchain-ope-6af681

> Fallback governance document generated by GOSCE. In production this is
> regenerated by the C2MD service (https://c2md.getvda.ai) at deploy time (Phase 8).

- **Agent:** `langchain-anthropic-langchain-ope-6af681`
- **Combination:** `ai-infrastructure_opt_063` (zone `ai-infrastructure`, system `PYPI`)
- **Public URL:** https://llm-orchestration-agent-openai.getvda.ai
- **Version:** 0.1.1
- **Generated:** 2026-07-31T20:38:47+00:00

## Capability declaration

This agent composes the following permissively-licensed packages:

| Package | Capability category |
|---------|---------------------|
| `langchain-anthropic` | orchestration |
| `langchain-openai` | orchestration |
| `openai` | llm-client |


## License chain attestation

Every constituent package passed the GOSCE license filter: only **GREEN**
licenses (MIT / Apache-2.0 / BSD / ISC / Unlicense / 0BSD) enter a combination;
any GPL/AGPL/SSPL/BSL/EUPL component excludes the package. No RED-licensed code
is bundled. (Per-package SPDX identifiers are attached by C2MD in production.)

## Data flow

```
client → https://llm-orchestration-agent-openai.getvda.ai/{mcp | a2a}
       → capability dispatch (langchain-anthropic + langchain-openai + openai)
       → response
```

No data is persisted by the scaffold; capability handlers are stateless. Any
package that calls an external API (e.g. an LLM provider) forwards only the
request payload it is given.

## Compliance status

| Item | Status |
|------|--------|
| License compatibility | ✅ all GREEN |
| Governance document | ⚠️ fallback (C2MD pending) |
| Data retention | none (stateless scaffold) |
| Authentication | per deployment (payment wrapper added in Phase 8) |

## Distribution

- **Listed on Smithery:** https://smithery.ai/servers/a2a/llm-orchestration-agent-openai
- **MCP endpoint:** https://llm-orchestration-agent-openai.getvda.ai/mcp
- **Agent Card:** https://llm-orchestration-agent-openai.getvda.ai/.well-known/agent.json

## Identity & verification

This agent's identity is cryptographically signed. Verify at
**https://agents.getvda.ai/.well-known/jwks.json**

The Agent Card carries a detached **Ed25519 / EdDSA** JWS (RFC 7515) in its `proof`
member, issued by the GOSCE factory at build time. The agent itself never holds the
signing key, so a compromised agent cannot issue a card for any other agent.

- **Verification method:** see `proof.verificationMethod` on the Agent Card
- **Public keys (JWKS, RFC 7517):** https://agents.getvda.ai/.well-known/jwks.json
- **Step-by-step instructions:** `GET https://llm-orchestration-agent-openai.getvda.ai/verify` (free)
- **Signed bytes:** the Agent Card with `proof` removed, serialised as JSON with
  sorted keys, separators `(',',':')`, UTF-8

An unsigned card is not evidence of forgery — it means the agent predates signing.

## Provider

VDA / GOSCE — https://getvda.ai · Portfolio: https://getvda.ai/agents