admina-framework 0.12.1__tar.gz → 0.12.2__tar.gz

{admina_framework-0.12.1/admina_framework.egg-info → admina_framework-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-framework
-Version: 0.12.1
+Version: 0.12.2
 Summary: Admina — governed AI development framework
 Author-email: Stefano Noferi <info@admina.org>
 Maintainer-email: Stefano Noferi <info@admina.org>

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/__init__.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 
 from admina.sdk import ComplianceKit, GovernedAgent, GovernedData, GovernedModel
 
-__version__ = "0.12.1"
+__version__ = "0.12.2"
 
 __all__ = [
     "__version__",

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/dashboard/static/index.html

@@ -735,12 +735,14 @@
           </p>
           <p>
             Until you submit a real assessment, the dashboard renders all articles at 0% with a default
-            placeholder. To record your real coverage, POST your declared evidence to
-            <code class="inline">/api/compliance/gap-analysis</code>.
+            placeholder. To record your real coverage, send your declared evidence with a
+            <strong>POST</strong> request to <code class="inline">/api/compliance/gap-analysis</code>
+            on this host (the route accepts POST only: opening it in the browser answers
+            405 Method Not Allowed).
           </p>
           <p style="margin-bottom: 6px;"><strong>Example request:</strong></p>
           <button class="modal-copy-btn" @click="copyAssessmentCmd($event)">Copy command</button>
-          <pre class="modal-pre" id="assessment-cmd">curl -X POST http://localhost:8080/api/compliance/gap-analysis \
+          <pre class="modal-pre" id="assessment-cmd">curl -X POST <span x-text="apiBase"></span>/api/compliance/gap-analysis \
   -H "X-API-Key: $ADMINA_API_KEY" -H "Content-Type: application/json" \
   -d '{"risk_category": "high",
        "current_compliance": {
@@ -1153,6 +1155,12 @@ function dashboard() {
     },
 
     // ── Helpers ─────────────────────────────────────────
+    // The origin that served this page: the proxy itself, or the dashboard
+    // container that forwards /api/ to it.
+    get apiBase() {
+      return window.location.origin;
+    },
+
     copyAssessmentCmd(ev) {
       const pre = document.getElementById('assessment-cmd');
       if (!pre) return;

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/domains/compliance/forensic.py

@@ -24,6 +24,7 @@ import logging
 import os
 import threading
 import time
+from collections import deque
 from datetime import UTC, datetime
 from pathlib import Path
 
@@ -35,6 +36,8 @@ logger = logging.getLogger("admina.forensic_blackbox")
 _CHAIN_STATE_KEY = "_chain_state.json"
 # Sidecar holding the HMAC-SHA256 signature of the chain-state payload.
 _CHAIN_STATE_SIG_KEY = "_chain_state.json.sig"
+# Records kept in memory for recent_records(), newest last.
+RECENT_RECORDS_MAX = 1000
 
 
 class ForensicBlackBox(BaseForensicStore):
@@ -81,6 +84,10 @@ class ForensicBlackBox(BaseForensicStore):
         self.chain_head: str = "GENESIS"
         self.record_count: int = 0
         self._write_lock = threading.Lock()
+        # The last records written by this process, for readers that need
+        # recent activity without reading the backend back (the dashboard
+        # feed when no analytics store is configured).
+        self._recent: deque[dict] = deque(maxlen=RECENT_RECORDS_MAX)
         self._state_signing_key = state_signing_key or os.environ.get("ADMINA_FORENSIC_STATE_KEY")
         if self.filesystem_dir is not None:
             self.filesystem_dir.mkdir(parents=True, exist_ok=True)
@@ -346,6 +353,7 @@ class ForensicBlackBox(BaseForensicStore):
             # Store the record and persist the updated chain state
             self._store_to_s3(forensic_record)
             self._persist_chain_state()
+            self._recent.append(forensic_record)
 
             return {
                 "sequence_number": self.record_count,
@@ -354,6 +362,19 @@ class ForensicBlackBox(BaseForensicStore):
                 "stored": (self.boto3_client is not None or self.filesystem_dir is not None),
             }
 
+    def recent_records(self, limit: int = RECENT_RECORDS_MAX) -> list[dict]:
+        """Return up to *limit* records written by this process, newest first.
+
+        Only the last ``RECENT_RECORDS_MAX`` records are kept, in memory, with
+        every backend; records written before the process started are not
+        read back. Use :meth:`verify_chain` for the persisted chain.
+        """
+        if limit <= 0:
+            return []
+        with self._write_lock:
+            records = list(self._recent)
+        return records[::-1][:limit]
+
     def _store_to_s3(self, record: dict):
         """Persist a forensic record using the configured backend."""
         ts = datetime.now(UTC)

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/engines/presidio.py

@@ -57,6 +57,9 @@ _PRESIDIO_TO_ADMINA: dict[str, str] = {
 }
 
 # Languages Admina configures for Presidio, each mapped to its spaCy model.
+# The Presidio entity types requested from the analyzer.
+_ENTITIES: list[str] = list(_PRESIDIO_TO_ADMINA)
+
 _LANG_MODELS: dict[str, str] = {
     "en": "en_core_web_sm",
     "it": "it_core_news_sm",
@@ -111,9 +114,11 @@ class PresidioPIIEngine:
 
         # Union of per-language analyses: a recognizer registered for only one
         # language is missed by the other pass, so both are run and merged.
+        # Only the mapped entity types are requested: the other recognizers
+        # (URL among them, slow on text with many dots) would be discarded.
         raw = []
         for lang in self.languages:
-            raw.extend(self._analyzer.analyze(text=text, language=lang))
+            raw.extend(self._analyzer.analyze(text=text, language=lang, entities=_ENTITIES))
 
         spans: list[tuple[int, int, str, str]] = []
         for r in raw:

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/proxy/api/dashboard.py

@@ -27,7 +27,7 @@ import io as _io
 import json
 import logging
 import time
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from fastapi import APIRouter, Query, Response, WebSocket, WebSocketDisconnect
@@ -76,6 +76,122 @@ def _suggestions_to_csv(payload: dict) -> Response:
     return Response(content=buf.getvalue(), media_type="text/csv")
 
 
+# ── Recent forensic records (feed without ClickHouse) ─────────
+# Forensic record types that stand for one governed request, as a ClickHouse
+# governance_events row does. Other records (coordination verdicts, response
+# guard errors, events posted to /api/v1/audit) are not feed events.
+_FEED_EVENT_TYPES = frozenset({"mcp_request", "gateway_request"})
+# The source named in feed, trend and suggestions answers built from them.
+_FORENSIC_SOURCE = "forensic_recent"
+
+
+def _plain(value: Any) -> str:
+    """*value* as a plain string (the value of an enum member)."""
+    return str(getattr(value, "value", value) or "")
+
+
+def _parse_utc(value: Any) -> datetime | None:
+    """An ISO 8601 timestamp as an aware UTC datetime; None if unreadable."""
+    try:
+        parsed = datetime.fromisoformat(str(value))
+    except (TypeError, ValueError):
+        return None
+    return parsed if parsed.tzinfo else parsed.replace(tzinfo=UTC)
+
+
+def _row_from_forensic(record: dict) -> dict[str, Any] | None:
+    """A forensic record of a governed request in the shape of a ClickHouse
+    ``governance_events`` row; None for any other record.
+
+    ``details`` is the JSON of the record's governance checks, plus
+    ``would_action`` when set, as in the ClickHouse row. Hashes are left
+    empty: the forensic record of a request does not carry them.
+    """
+    event = record.get("event")
+    if not isinstance(event, dict) or _plain(event.get("event_type")) not in _FEED_EVENT_TYPES:
+        return None
+    details = dict(event.get("checks") or {})
+    if event.get("would_action") is not None:
+        details["would_action"] = _plain(event["would_action"])
+    return {
+        "event_id": str(event.get("event_id", "")),
+        "timestamp": str(record.get("timestamp_utc", "")),
+        "event_type": _plain(event.get("event_type")),
+        "agent_id": str(event.get("agent_id", "")),
+        "session_id": str(event.get("session_id", "")),
+        "method": str(event.get("method", "")),
+        "tool_name": str(event.get("tool_name", "")),
+        "action": _plain(event.get("action")).lower(),
+        "risk_level": _plain(event.get("risk_level")).lower(),
+        "details": json.dumps(details, default=str),
+        "latency_ms": event.get("governance_latency_ms", 0.0),
+        "request_hash": "",
+        "response_hash": "",
+    }
+
+
+def _recent_rows(forensic_box: Any) -> list[dict[str, Any]] | None:
+    """The governed requests among the recent records of *forensic_box*,
+    newest first, as ``governance_events`` rows; None when the store keeps
+    no recent records."""
+    recent = getattr(forensic_box, "recent_records", None)
+    if not callable(recent):
+        return None
+    rows = []
+    for record in recent():
+        row = _row_from_forensic(record)
+        if row is not None:
+            rows.append(row)
+    return rows
+
+
+def _rows_between(
+    rows: list[dict[str, Any]], start: datetime, end: datetime | None = None
+) -> list[dict[str, Any]]:
+    """The *rows* with a timestamp at or after *start* (and before *end*)."""
+    out = []
+    for row in rows:
+        ts = _parse_utc(row["timestamp"])
+        if ts is not None and ts >= start and (end is None or ts < end):
+            out.append(row)
+    return out
+
+
+def _trend_from_rows(
+    rows: list[dict[str, Any]], window_hours: int, bucket_minutes: int
+) -> dict[str, Any]:
+    """The ``/trend`` answer computed from ``governance_events`` rows: counts
+    per action in buckets of *bucket_minutes* (aligned to the Unix epoch, as
+    ClickHouse's ``toStartOfInterval``) over the last *window_hours*."""
+    bucket_s = bucket_minutes * 60
+    start = datetime.now(UTC) - timedelta(hours=window_hours)
+    buckets: dict[datetime, dict[str, int]] = {}
+    for row in _rows_between(rows, start):
+        ts = _parse_utc(row["timestamp"])
+        if ts is None:
+            continue
+        key = datetime.fromtimestamp(int(ts.timestamp()) // bucket_s * bucket_s, UTC)
+        counts = buckets.setdefault(key, {})
+        counts[row["action"]] = counts.get(row["action"], 0) + 1
+    series = [
+        {
+            "ts": key.isoformat(),
+            "allow": counts.get("allow", 0),
+            "block": counts.get("block", 0),
+            "circuit_break": counts.get("circuit_break", 0),
+            "redact": counts.get("redact", 0),
+            "total": sum(counts.values()),
+        }
+        for key, counts in sorted(buckets.items())
+    ]
+    return {
+        "window_hours": window_hours,
+        "bucket_minutes": bucket_minutes,
+        "bucket_count": len(series),
+        "buckets": series,
+    }
+
+
 # ── Governance score ─────────────────────────────────────────
 def _compute_governance_score(
     *,
@@ -295,10 +411,19 @@ def create_dashboard_endpoints(
         limit: int = Query(50, ge=1, le=1000),
         offset: int = Query(0, ge=0),
     ) -> dict[str, Any]:
-        """Recent governance events (paginated)."""
+        """Recent governance events (paginated).
+
+        Without ClickHouse the events are the governed requests among the
+        recent records of the forensic store, newest first (records written
+        since the proxy started, up to the store's in-memory limit).
+        """
         ch = get_clickhouse()
         if not ch:
-            return {"events": [], "count": 0, "error": "ClickHouse not available"}
+            rows = _recent_rows(get_forensic_box())
+            if rows is None:
+                return {"events": [], "count": 0, "error": "ClickHouse not available"}
+            events = rows[offset : offset + limit]
+            return {"events": events, "count": len(events), "source": _FORENSIC_SOURCE}
         try:
             loop = asyncio.get_running_loop()
             db = get_settings().CLICKHOUSE_DB
@@ -583,7 +708,8 @@ def create_dashboard_endpoints(
             min_count: skip categories with fewer than this many events.
         """
         ch = get_clickhouse()
-        if not ch:
+        recent = None if ch else _recent_rows(get_forensic_box())
+        if not ch and recent is None:
             return {
                 "window_hours": window_hours,
                 "events_analyzed": 0,
@@ -595,19 +721,28 @@ def create_dashboard_endpoints(
             loop = asyncio.get_running_loop()
             db = get_settings().CLICKHOUSE_DB
             mode = getattr(get_settings(), "GOVERNANCE_MODE", "enforce")
+            now = datetime.now(UTC)
+            window = timedelta(hours=window_hours)
 
             # Aggregate by action + risk + a flat category extracted from details.
             # Schema: (event_id, timestamp, event_type, agent_id, session_id,
             #          method, tool_name, action, risk_level, details, ...)
-            query = (
-                f"SELECT action, risk_level, details "
-                f"FROM {db}.governance_events "
-                f"WHERE timestamp >= now() - INTERVAL {int(window_hours)} HOUR"
-            )
-            async with _ch_lock:
-                result = await loop.run_in_executor(None, lambda: ch.query(query))
-
-            total = len(result.result_rows)
+            if ch:
+                query = (
+                    f"SELECT action, risk_level, details "
+                    f"FROM {db}.governance_events "
+                    f"WHERE timestamp >= now() - INTERVAL {int(window_hours)} HOUR"
+                )
+                async with _ch_lock:
+                    result = await loop.run_in_executor(None, lambda: ch.query(query))
+                window_rows = list(result.result_rows)
+            else:
+                window_rows = [
+                    (r["action"], r["risk_level"], r["details"])
+                    for r in _rows_between(recent, now - window)
+                ]
+
+            total = len(window_rows)
             if total == 0:
                 return {
                     "window_hours": window_hours,
@@ -630,7 +765,7 @@ def create_dashboard_endpoints(
             cat_total: dict[str, int] = {}
             cat_blocked: dict[str, int] = {}
             cat_would_blocked: dict[str, int] = {}
-            for row in result.result_rows:
+            for row in window_rows:
                 action, _risk, details_raw = row[0], row[1], row[2]
                 # Action is stored lowercase in ClickHouse — normalise once.
                 action_upper = (action or "").upper()
@@ -766,19 +901,27 @@ def create_dashboard_endpoints(
             # immediately-preceding equal window. If a category's blocked
             # rate has surged ≥2x with absolute count ≥ min_count, flag it.
             try:
-                prev_query = (
-                    f"SELECT details FROM {db}.governance_events "
-                    f"WHERE timestamp >= now() - INTERVAL {int(window_hours * 2)} HOUR "
-                    f"  AND timestamp <  now() - INTERVAL {int(window_hours)} HOUR "
-                    f"  AND lower(action) IN ('block','circuit_break')"
-                )
-                async with _ch_lock:
-                    prev_res = await loop.run_in_executor(
-                        None,
-                        lambda: ch.query(prev_query),
+                if ch:
+                    prev_query = (
+                        f"SELECT details FROM {db}.governance_events "
+                        f"WHERE timestamp >= now() - INTERVAL {int(window_hours * 2)} HOUR "
+                        f"  AND timestamp <  now() - INTERVAL {int(window_hours)} HOUR "
+                        f"  AND lower(action) IN ('block','circuit_break')"
                     )
+                    async with _ch_lock:
+                        prev_res = await loop.run_in_executor(
+                            None,
+                            lambda: ch.query(prev_query),
+                        )
+                    prev_rows = list(prev_res.result_rows)
+                else:
+                    prev_rows = [
+                        (r["details"],)
+                        for r in _rows_between(recent, now - 2 * window, now - window)
+                        if r["action"] in ("block", "circuit_break")
+                    ]
                 prev_blocked: dict[str, int] = {}
-                for (det_raw,) in prev_res.result_rows:
+                for (det_raw,) in prev_rows:
                     try:
                         d = json.loads(det_raw) if det_raw else {}
                     except (TypeError, ValueError):
@@ -848,6 +991,8 @@ def create_dashboard_endpoints(
                 "would_blocked_by_category": cat_would_blocked,
                 "suggestions": suggestions,
             }
+            if not ch:
+                payload["source"] = _FORENSIC_SOURCE
             if format == "csv":
                 return _suggestions_to_csv(payload)
             return payload
@@ -878,11 +1023,17 @@ def create_dashboard_endpoints(
         """
         ch = get_clickhouse()
         if not ch:
+            recent = _recent_rows(get_forensic_box())
+            if recent is None:
+                return {
+                    "window_hours": window_hours,
+                    "bucket_minutes": bucket_minutes,
+                    "buckets": [],
+                    "error": "ClickHouse not available",
+                }
             return {
-                "window_hours": window_hours,
-                "bucket_minutes": bucket_minutes,
-                "buckets": [],
-                "error": "ClickHouse not available",
+                **_trend_from_rows(recent, window_hours, bucket_minutes),
+                "source": _FORENSIC_SOURCE,
             }
         try:
             loop = asyncio.get_running_loop()

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/proxy/api/gateway.py

@@ -28,20 +28,152 @@ Routes (prefix /v1):
 from __future__ import annotations
 
 import asyncio
+import hashlib
 import json
+import logging
 import re
 import time
 import uuid
-from collections.abc import AsyncIterator
+from collections.abc import AsyncIterator, Awaitable, Callable
+from datetime import UTC, datetime
 from typing import Any
 
 import httpx
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse, StreamingResponse
 
-from admina.core.types import EventType
+from admina.core.event_bus import GovernanceEvent as BusGovernanceEvent
+from admina.core.event_bus import bus as governance_bus
+from admina.core.types import EventType, GovernanceAction, RiskLevel
 from admina.domains.agent_security.egress import resolve_egress_mode
-from admina.domains.governance import redact_response_result, run_pipeline, safe_serialize
+from admina.domains.governance import (
+    build_governance_details,
+    redact_response_result,
+    run_pipeline,
+    safe_serialize,
+)
+from admina.proxy.config import GovernanceEvent
+
+logger = logging.getLogger(__name__)
+
+# Strong references to fire-and-forget tasks, so they are not
+# garbage-collected before completion (see asyncio.create_task docs).
+_background_tasks: set[asyncio.Task] = set()
+
+
+def _spawn(coro: Any) -> asyncio.Task:
+    """Schedule *coro* as a background task and keep a strong ref."""
+    task = asyncio.create_task(coro)
+    _background_tasks.add(task)
+    task.add_done_callback(_background_tasks.discard)
+    return task
+
+
+def _decision_metadata(gov_response: Any) -> dict:
+    """Event-bus metadata for a gateway decision.
+
+    The same fields the /mcp surface publishes, minus ``content``: the
+    (redacted) request body never leaves the request on the bus, so live
+    subscribers (dashboard feed, alerts, OTel) see the decision only.
+    """
+    meta = gov_response.to_dict()
+    meta.pop("content", None)
+    return meta
+
+
+async def _emit_decision_safe(event: BusGovernanceEvent) -> None:
+    """Emit *event* on the governance bus; a failing subscriber is logged
+    and never propagates to the request."""
+    try:
+        await governance_bus.emit(event)
+    except Exception:
+        logger.warning("Gateway governance event emission failed", exc_info=True)
+
+
+def _emit_decision(gov_response: Any, session_id: str) -> None:
+    """Publish one GOVERNANCE_DECISION event for a gateway request,
+    fire-and-forget: it adds no latency and cannot fail the request."""
+    _spawn(
+        _emit_decision_safe(
+            BusGovernanceEvent(
+                event_type=EventType.GOVERNANCE_DECISION,
+                session_id=session_id,
+                action=gov_response.action,
+                risk_level=gov_response.risk_level,
+                domain="gateway",
+                metadata=_decision_metadata(gov_response),
+            )
+        )
+    )
+
+
+def _count_decision(state: Any, action: str, pii_count: int) -> None:
+    """Count a governed gateway request in the proxy counters (``/api/stats``
+    and ``/metrics``), as ``/mcp`` does: ``requests_total``, then
+    ``requests_blocked`` for BLOCK and CIRCUIT_BREAK or ``requests_allowed``
+    otherwise, and ``requests_redacted`` when PII was redacted."""
+    inc = getattr(state, "inc_metric", None)
+    if inc is None:
+        return
+    inc("requests_total")
+    if action in ("BLOCK", "CIRCUIT_BREAK"):
+        inc("requests_blocked")
+    else:
+        inc("requests_allowed")
+    if pii_count > 0:
+        inc("requests_redacted")
+
+
+def _observe_latency(state: Any, start: float) -> None:
+    """Add the time since *start* (``time.perf_counter()``) to the proxy's
+    average request latency."""
+    update = getattr(state, "update_avg_latency", None)
+    if update is not None:
+        update((time.perf_counter() - start) * 1000)
+
+
+def _enum_value(enum_cls: Any, value: Any, default: Any) -> Any:
+    """*value* (an enum member or its name or value, any case) as a member
+    of *enum_cls*; *default* when it is none of them."""
+    raw = str(getattr(value, "value", value) or "").lower()
+    try:
+        return enum_cls(raw)
+    except ValueError:
+        return default
+
+
+def _analytics_event(
+    pre: Any, *, event_id: str, agent_id: str, session_id: str, prompt_text: str
+) -> GovernanceEvent:
+    """The analytics row (ClickHouse ``governance_events``) of a gateway
+    request: the same columns as an ``/mcp`` row, with event type
+    ``gateway_request`` and method ``chat.completions``. Like the ``/mcp``
+    row it holds the governance checks and a truncated hash of the
+    prompt, never the prompt itself."""
+    return GovernanceEvent(
+        event_id=event_id,
+        timestamp=datetime.now(UTC).isoformat(),
+        event_type=EventType.GATEWAY_REQUEST,
+        agent_id=agent_id,
+        session_id=session_id,
+        method="chat.completions",
+        action=_enum_value(GovernanceAction, pre.action, GovernanceAction.ALLOW),
+        risk_level=_enum_value(RiskLevel, pre.risk_level, RiskLevel.LOW),
+        details=build_governance_details(pre),
+        latency_ms=pre.latency_ms,
+        request_hash=hashlib.sha256(prompt_text.encode()).hexdigest()[:32],
+    )
+
+
+async def _store_event_safe(
+    store_event: Callable[[GovernanceEvent], Awaitable[None]], event: GovernanceEvent
+) -> None:
+    """Store *event* with *store_event*; a failure is logged and never
+    reaches the request."""
+    try:
+        await store_event(event)
+    except Exception:
+        logger.warning("Gateway analytics event storage failed", exc_info=True)
 
 
 def _extract_prompt_text(messages: list) -> str:
@@ -262,6 +394,7 @@ def create_gateway_endpoints(
     *,
     get_state: Any,
     get_settings: Any,
+    store_event: Callable[[GovernanceEvent], Awaitable[None]] | None = None,
 ) -> APIRouter:
     """Create the OpenAI-compatible gateway router (prefix ``/v1``).
 
@@ -273,6 +406,9 @@ def create_gateway_endpoints(
             loop_breaker, egress_policy, governance_guards, forensic_box,
             http_client).
         get_settings: Callable returning the settings object.
+        store_event: Coroutine function storing a :class:`GovernanceEvent`
+            in the analytics store; called, fire-and-forget, for every
+            governed request while the state has a ``clickhouse`` client.
     """
     router = APIRouter(prefix="/v1", tags=["gateway"])
 
@@ -307,6 +443,7 @@ def create_gateway_endpoints(
         agent_id = re.sub(r"[\r\n]", "", request.headers.get("X-Agent-Id", "gateway"))[:128]
         prompt_text = _extract_prompt_text(messages)
         event_id = uuid.uuid4().hex
+        start = time.perf_counter()
 
         pre = await run_pipeline(
             body={"params": {"messages": messages}},
@@ -328,6 +465,8 @@ def create_gateway_endpoints(
             egress_mode=resolve_egress_mode(cfg.GOVERNANCE_MODE),
         )
         action = pre.gov_response.action  # uppercase: ALLOW/BLOCK/CIRCUIT_BREAK
+        pii_count = pre.checks.get("pii_redaction", {}).get("count", 0)
+        _count_decision(state, action, pii_count)
 
         await _record_forensic(
             state.forensic_box,
@@ -338,9 +477,24 @@ def create_gateway_endpoints(
             risk_level=pre.gov_response.risk_level,
             pre=pre,
         )
+        if store_event is not None and getattr(state, "clickhouse", None):
+            _spawn(
+                _store_event_safe(
+                    store_event,
+                    _analytics_event(
+                        pre,
+                        event_id=event_id,
+                        agent_id=agent_id,
+                        session_id=session_id,
+                        prompt_text=prompt_text,
+                    ),
+                )
+            )
 
         block_message = cfg.ADMINA_GATEWAY_BLOCK_MESSAGE
         if action in ("BLOCK", "CIRCUIT_BREAK"):
+            _emit_decision(pre.gov_response, session_id)
+            _observe_latency(state, start)
             if stream:
                 return StreamingResponse(
                     _aiter_list(_synthetic_stream(model, block_message)),
@@ -352,7 +506,6 @@ def create_gateway_endpoints(
         url = f"{upstream}/chat/completions"
         headers = {"X-Admina-Event-Id": event_id}
 
-        pii_count = pre.checks.get("pii_redaction", {}).get("count", 0)
         fwd_messages = pre.redacted_body["params"]["messages"] if pii_count > 0 else messages
         forward_body = {**body, "messages": fwd_messages}
 
@@ -378,6 +531,7 @@ def create_gateway_endpoints(
             try:
                 upstream_resp = await stream_cm.__aenter__()
             except httpx.ConnectError:
+                _emit_decision(pre.gov_response, session_id)
                 raise HTTPException(status_code=502, detail="Gateway upstream unreachable")
 
             async def _proxy() -> AsyncIterator[str]:
@@ -387,15 +541,22 @@ def create_gateway_endpoints(
                     ):
                         yield sse
                 finally:
+                    # One decision event per stream, at completion (or
+                    # client disconnect), never per chunk.
+                    _emit_decision(pre.gov_response, session_id)
+                    _observe_latency(state, start)
                     await stream_cm.__aexit__(None, None, None)
 
             return StreamingResponse(_proxy(), media_type="text/event-stream")
 
         # non-streaming passthrough
+        _emit_decision(pre.gov_response, session_id)
         try:
             resp = await state.http_client.post(url, json=forward_body, headers=headers)
         except httpx.ConnectError:
             raise HTTPException(status_code=502, detail="Gateway upstream unreachable")
+        finally:
+            _observe_latency(state, start)
         data = resp.json()
         if cfg.PII_REDACTION_ENABLED and isinstance(data.get("choices"), list):
             data["choices"], _ = redact_response_result(data["choices"], state.pii_redactor)

{admina_framework-0.12.1 → admina_framework-0.12.2}/admina/proxy/main.py

@@ -561,6 +561,7 @@ app.include_router(_integration_router)
 _gateway_router = create_gateway_endpoints(
     get_state=lambda: app.state.proxy,
     get_settings=lambda: settings,
+    store_event=lambda event: _store_event_async(app.state.proxy.clickhouse, event),
 )
 app.include_router(_gateway_router)
 

{admina_framework-0.12.1 → admina_framework-0.12.2/admina_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-framework
-Version: 0.12.1
+Version: 0.12.2
 Summary: Admina — governed AI development framework
 Author-email: Stefano Noferi <info@admina.org>
 Maintainer-email: Stefano Noferi <info@admina.org>