agent-control-evaluator-defenseclaw 8.3.0__tar.gz

agent_control_evaluator_defenseclaw-8.3.0/.gitignore

@@ -0,0 +1,93 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+venv/
+env/
+ENV/
+.venv
+
+# UV
+.uv/
+uv.lock
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+coverage-*.xml
+
+# Testing
+.pytest_cache/
+.coverage
+coverage-*.xml
+htmlcov/
+.tox/
+.mypy_cache/
+.ruff_cache/
+
+# Playwright
+playwright-report/
+playwright/.cache/
+test-results/
+
+# Environment variables
+.env
+.env.local
+.env.*.local
+
+# Logs
+*.log
+logs/
+
+# Database
+*.db
+*.sqlite3
+server/openapi.json
+server/.generated/
+
+# Temporary files
+tmp/
+temp/
+*.tmp
+.codex-doc-qa/
+.codex-doc-work/
+.pnpm-store/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Intellij
+*.iml
+
+## CLAUDE
+.claude
+
+# Local notes
+rearch_plan.md
+
+node_modules

agent_control_evaluator_defenseclaw-8.3.0/Makefile

@@ -0,0 +1,33 @@
+.PHONY: help sync test lint lint-fix typecheck check build
+
+PACKAGE := agent-control-evaluator-defenseclaw
+
+help:
+	@echo "Agent Control Evaluator - DefenseClaw - Makefile commands"
+	@echo "  make sync       - sync package dependencies"
+	@echo "  make test       - run pytest"
+	@echo "  make lint       - run ruff check"
+	@echo "  make lint-fix   - run ruff check --fix"
+	@echo "  make typecheck  - run mypy"
+	@echo "  make check      - run tests, lint, and typecheck"
+	@echo "  make build      - build package"
+
+sync:
+	uv sync
+
+test:
+	uv run --with pytest --with pytest-asyncio --with pytest-cov --package $(PACKAGE) pytest tests --cov=src --cov-report=xml:../../../coverage-evaluators-defenseclaw.xml -q
+
+lint:
+	uv run --with ruff --package $(PACKAGE) ruff check --config ../../../pyproject.toml src/ tests/
+
+lint-fix:
+	uv run --with ruff --package $(PACKAGE) ruff check --config ../../../pyproject.toml --fix src/ tests/
+
+typecheck:
+	uv run --with mypy --package $(PACKAGE) mypy --config-file ../../../pyproject.toml src/
+
+check: test lint typecheck
+
+build:
+	uv build

agent_control_evaluator_defenseclaw-8.3.0/PKG-INFO

@@ -0,0 +1,33 @@
+Metadata-Version: 2.4
+Name: agent-control-evaluator-defenseclaw
+Version: 8.3.0
+Summary: DefenseClaw evaluators for agent-control
+Author: Agent Control Team
+License: Apache-2.0
+Requires-Python: >=3.12
+Requires-Dist: agent-control-evaluators>=8.3.0
+Requires-Dist: agent-control-models>=8.3.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.8.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Requires-Dist: ruff>=0.1.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# DefenseClaw evaluators
+
+This package exposes two global external evaluators for Agent Control:
+
+- `defenseclaw.rule_pack` validates a versioned DefenseClaw rule pack.
+- `defenseclaw.opa_policy` validates a versioned DefenseClaw OPA policy configuration.
+
+Install both evaluators with:
+
+```bash
+pip install "agent-control-evaluators[defenseclaw]"
+```
+
+The configuration contracts and JSON Schemas are implemented and discoverable. Both evaluator
+classes intentionally execute as no-ops: they return `matched=False` without contacting or
+installing any DefenseClaw runtime or OSS package.

agent_control_evaluator_defenseclaw-8.3.0/README.md

@@ -0,0 +1,16 @@
+# DefenseClaw evaluators
+
+This package exposes two global external evaluators for Agent Control:
+
+- `defenseclaw.rule_pack` validates a versioned DefenseClaw rule pack.
+- `defenseclaw.opa_policy` validates a versioned DefenseClaw OPA policy configuration.
+
+Install both evaluators with:
+
+```bash
+pip install "agent-control-evaluators[defenseclaw]"
+```
+
+The configuration contracts and JSON Schemas are implemented and discoverable. Both evaluator
+classes intentionally execute as no-ops: they return `matched=False` without contacting or
+installing any DefenseClaw runtime or OSS package.

agent_control_evaluator_defenseclaw-8.3.0/pyproject.toml

@@ -0,0 +1,42 @@
+[project]
+name = "agent-control-evaluator-defenseclaw"
+version = "8.3.0"
+description = "DefenseClaw evaluators for agent-control"
+readme = "README.md"
+requires-python = ">=3.12"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Agent Control Team" }]
+dependencies = [
+    "agent-control-evaluators>=8.3.0",
+    "agent-control-models>=8.3.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0.0",
+    "pytest-asyncio>=0.23.0",
+    "pytest-cov>=4.0.0",
+    "ruff>=0.1.0",
+    "mypy>=1.8.0",
+]
+
+[project.entry-points."agent_control.evaluators"]
+"defenseclaw.rule_pack" = "agent_control_evaluator_defenseclaw.rule_pack:DefenseClawRulePackEvaluator"
+"defenseclaw.opa_policy" = "agent_control_evaluator_defenseclaw.opa_policy:DefenseClawOpaPolicyEvaluator"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_control_evaluator_defenseclaw"]
+
+[tool.uv.sources]
+agent-control-evaluators = { path = "../../builtin", editable = true }
+agent-control-models = { path = "../../../models", editable = true }
+
+[dependency-groups]
+dev = [
+    "pytest>=9.0.2",
+    "pytest-asyncio>=1.3.0",
+]

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/__init__.py

@@ -0,0 +1,28 @@
+"""Agent Control DefenseClaw external evaluators."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("agent-control-evaluator-defenseclaw")
+except PackageNotFoundError:
+    __version__ = "0.0.0.dev"
+
+from .common import Severity
+from .opa_policy import DefenseClawOpaPolicyConfig, DefenseClawOpaPolicyEvaluator, OpaPolicy
+from .rule_pack import (
+    DefenseClawRulePackConfig,
+    DefenseClawRulePackEvaluator,
+    RuleConfig,
+    RulePack,
+)
+
+__all__ = [
+    "DefenseClawOpaPolicyConfig",
+    "DefenseClawOpaPolicyEvaluator",
+    "DefenseClawRulePackConfig",
+    "DefenseClawRulePackEvaluator",
+    "OpaPolicy",
+    "RuleConfig",
+    "RulePack",
+    "Severity",
+]

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/common.py

@@ -0,0 +1,22 @@
+"""Shared DefenseClaw evaluator types and runtime behavior."""
+
+from __future__ import annotations
+
+from typing import Annotated, Literal
+
+from agent_control_models import EvaluatorResult
+from pydantic import ConfigDict, StringConstraints
+
+Severity = Literal["LOW", "MEDIUM", "HIGH", "CRITICAL"]
+NonEmptyString = Annotated[str, StringConstraints(strip_whitespace=True, min_length=1)]
+
+STRICT_PROVIDER_CONFIG = ConfigDict(extra="forbid")
+
+
+def no_op_result() -> EvaluatorResult:
+    """Return the intentional no-op evaluation result."""
+    return EvaluatorResult(
+        matched=False,
+        confidence=1.0,
+        message="DefenseClaw configuration accepted; evaluator execution is a no-op",
+    )

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/opa_policy/__init__.py

@@ -0,0 +1,6 @@
+"""DefenseClaw OPA-policy evaluator exports."""
+
+from .config import DefenseClawOpaPolicyConfig, OpaPolicy
+from .evaluator import DefenseClawOpaPolicyEvaluator
+
+__all__ = ["DefenseClawOpaPolicyConfig", "DefenseClawOpaPolicyEvaluator", "OpaPolicy"]

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/opa_policy/config.py

@@ -0,0 +1,34 @@
+"""Typed configuration for the DefenseClaw OPA-policy evaluator."""
+
+from __future__ import annotations
+
+from typing import Literal
+
+from agent_control_evaluators import EvaluatorConfig
+from pydantic import BaseModel
+
+from ..common import STRICT_PROVIDER_CONFIG, Severity
+
+
+class OpaPolicy(BaseModel):
+    """DefenseClaw OPA policy settings supported by the v1 contract.
+
+    See https://cisco-ai-defense.github.io/docs/defenseclaw/policy for the policy contract.
+    """
+
+    model_config = STRICT_PROVIDER_CONFIG
+
+    domain: Literal["guardrail"] = "guardrail"
+    block_at: Severity = "HIGH"
+    alert_at: Severity = "MEDIUM"
+    cisco_trust_level: Literal["full"] = "full"
+
+
+class DefenseClawOpaPolicyConfig(EvaluatorConfig):
+    """Configuration envelope for `defenseclaw.opa_policy`."""
+
+    # Reject unknown configuration fields so malformed DefenseClaw payloads fail validation.
+    model_config = STRICT_PROVIDER_CONFIG
+
+    schema_version: Literal[1] = 1
+    policy: OpaPolicy

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/opa_policy/evaluator.py

@@ -0,0 +1,35 @@
+"""DefenseClaw OPA-policy evaluator."""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+from typing import Any
+
+from agent_control_evaluators import Evaluator, EvaluatorMetadata, register_evaluator
+from agent_control_models import EvaluatorResult
+
+from ..common import no_op_result
+from .config import DefenseClawOpaPolicyConfig
+
+
+def _resolve_package_version() -> str:
+    try:
+        return version("agent-control-evaluator-defenseclaw")
+    except PackageNotFoundError:
+        return "0.0.0.dev"
+
+
+@register_evaluator
+class DefenseClawOpaPolicyEvaluator(Evaluator[DefenseClawOpaPolicyConfig]):
+    """Evaluate selected data with a typed DefenseClaw OPA policy."""
+
+    metadata = EvaluatorMetadata(
+        name="defenseclaw.opa_policy",
+        version=_resolve_package_version(),
+        description="DefenseClaw OPA-policy evaluation",
+    )
+    config_model = DefenseClawOpaPolicyConfig
+
+    async def evaluate(self, data: Any) -> EvaluatorResult:
+        """Return the intentional no-op result for all selected data."""
+        return no_op_result()

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/rule_pack/__init__.py

@@ -0,0 +1,11 @@
+"""DefenseClaw rule-pack evaluator exports."""
+
+from .config import DefenseClawRulePackConfig, RuleConfig, RulePack
+from .evaluator import DefenseClawRulePackEvaluator
+
+__all__ = [
+    "DefenseClawRulePackConfig",
+    "DefenseClawRulePackEvaluator",
+    "RuleConfig",
+    "RulePack",
+]

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/rule_pack/config.py

@@ -0,0 +1,50 @@
+"""Typed configuration for the DefenseClaw rule-pack evaluator."""
+
+from __future__ import annotations
+
+from typing import Literal, Self
+
+from agent_control_evaluators import EvaluatorConfig
+from pydantic import BaseModel, Field, model_validator
+
+from ..common import STRICT_PROVIDER_CONFIG, NonEmptyString, Severity
+
+
+class RuleConfig(BaseModel):
+    """One DefenseClaw rule."""
+
+    model_config = STRICT_PROVIDER_CONFIG
+
+    id: NonEmptyString
+    pattern: NonEmptyString
+    title: NonEmptyString
+    severity: Severity
+    confidence: float = Field(ge=0.0, le=1.0)
+    tags: list[NonEmptyString]
+
+
+class RulePack(BaseModel):
+    """Versioned DefenseClaw rule pack."""
+
+    model_config = STRICT_PROVIDER_CONFIG
+
+    version: Literal[1] = 1
+    category: Literal["agent-control"] = "agent-control"
+    rules: list[RuleConfig] = Field(min_length=1)
+
+    @model_validator(mode="after")
+    def validate_unique_rule_ids(self) -> Self:
+        """Reject ambiguous rule packs containing duplicate identifiers."""
+        rule_ids = [rule.id for rule in self.rules]
+        if len(rule_ids) != len(set(rule_ids)):
+            raise ValueError("rule ids must be unique within a rule pack")
+        return self
+
+
+class DefenseClawRulePackConfig(EvaluatorConfig):
+    """Configuration envelope for `defenseclaw.rule_pack`."""
+
+    model_config = STRICT_PROVIDER_CONFIG
+
+    schema_version: Literal[1] = 1
+    rule_pack: RulePack

agent_control_evaluator_defenseclaw-8.3.0/src/agent_control_evaluator_defenseclaw/rule_pack/evaluator.py

@@ -0,0 +1,35 @@
+"""DefenseClaw rule-pack evaluator."""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+from typing import Any
+
+from agent_control_evaluators import Evaluator, EvaluatorMetadata, register_evaluator
+from agent_control_models import EvaluatorResult
+
+from ..common import no_op_result
+from .config import DefenseClawRulePackConfig
+
+
+def _resolve_package_version() -> str:
+    try:
+        return version("agent-control-evaluator-defenseclaw")
+    except PackageNotFoundError:
+        return "0.0.0.dev"
+
+
+@register_evaluator
+class DefenseClawRulePackEvaluator(Evaluator[DefenseClawRulePackConfig]):
+    """Evaluate selected data with a typed DefenseClaw rule pack."""
+
+    metadata = EvaluatorMetadata(
+        name="defenseclaw.rule_pack",
+        version=_resolve_package_version(),
+        description="DefenseClaw rule-pack evaluation",
+    )
+    config_model = DefenseClawRulePackConfig
+
+    async def evaluate(self, data: Any) -> EvaluatorResult:
+        """Return the intentional no-op result for all selected data."""
+        return no_op_result()

agent_control_evaluator_defenseclaw-8.3.0/tests/test_configs.py

@@ -0,0 +1,155 @@
+"""Contract tests for the DefenseClaw evaluator configurations."""
+
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from agent_control_evaluator_defenseclaw import (
+    DefenseClawOpaPolicyConfig,
+    DefenseClawRulePackConfig,
+)
+
+
+def _rule_pack_config() -> dict[str, object]:
+    return {
+        "schema_version": 1,
+        "rule_pack": {
+            "version": 1,
+            "category": "agent-control",
+            "rules": [
+                {
+                    "id": "AC-CMD-RM-RF",
+                    "pattern": "rm\\s+-rf",
+                    "title": "Recursive deletion",
+                    "severity": "HIGH",
+                    "confidence": 0.99,
+                    "tags": ["filesystem"],
+                }
+            ],
+        },
+    }
+
+
+def test_rule_pack_example_round_trips_with_fixed_fields() -> None:
+    # Given: the supplied rule-pack example
+    config = _rule_pack_config()
+
+    # When: validating and serializing it
+    serialized = DefenseClawRulePackConfig.model_validate(config).model_dump()
+
+    # Then: fixed fields and nested rules are preserved
+    assert serialized == config
+
+
+def test_rule_pack_defaults_are_serialized() -> None:
+    # Given: a rule pack omitting fields with fixed v1 defaults
+    config = _rule_pack_config()
+    config.pop("schema_version")
+    rule_pack = config["rule_pack"]
+    assert isinstance(rule_pack, dict)
+    rule_pack.pop("version")
+    rule_pack.pop("category")
+
+    # When: validating and serializing it
+    serialized = DefenseClawRulePackConfig.model_validate(config).model_dump()
+
+    # Then: the wire-contract constants are materialized
+    assert serialized["schema_version"] == 1
+    assert serialized["rule_pack"]["version"] == 1
+    assert serialized["rule_pack"]["category"] == "agent-control"
+
+
+@pytest.mark.parametrize(
+    ("path", "value"),
+    [
+        (("schema_version",), 2),
+        (("rule_pack", "version"), 2),
+        (("rule_pack", "category"), "other"),
+        (("rule_pack", "rules", 0, "severity"), "URGENT"),
+        (("rule_pack", "rules", 0, "confidence"), -0.1),
+        (("rule_pack", "rules", 0, "confidence"), 1.1),
+    ],
+)
+def test_rule_pack_rejects_unsupported_values(path: tuple[object, ...], value: object) -> None:
+    # Given: a valid config with one unsupported nested value
+    config = _rule_pack_config()
+    target: object = config
+    for part in path[:-1]:
+        target = target[part]  # type: ignore[index]
+    target[path[-1]] = value  # type: ignore[index]
+
+    # When/Then: typed validation rejects it
+    with pytest.raises(ValidationError):
+        DefenseClawRulePackConfig.model_validate(config)
+
+
+def test_rule_pack_rejects_empty_and_duplicate_rules() -> None:
+    # Given: an empty rule list
+    empty = _rule_pack_config()
+    empty["rule_pack"]["rules"] = []  # type: ignore[index]
+
+    # When/Then: at least one rule is required
+    with pytest.raises(ValidationError):
+        DefenseClawRulePackConfig.model_validate(empty)
+
+    # Given: duplicate rule IDs
+    duplicate = _rule_pack_config()
+    first_rule = duplicate["rule_pack"]["rules"][0]  # type: ignore[index]
+    duplicate["rule_pack"]["rules"].append(dict(first_rule))  # type: ignore[index,union-attr]
+
+    # When/Then: duplicate IDs are rejected
+    with pytest.raises(ValidationError, match="rule ids must be unique"):
+        DefenseClawRulePackConfig.model_validate(duplicate)
+
+
+def test_rule_pack_rejects_blank_strings_and_unknown_fields() -> None:
+    # Given: whitespace-only required values and an unknown provider key
+    config = _rule_pack_config()
+    rule = config["rule_pack"]["rules"][0]  # type: ignore[index]
+    rule["id"] = "   "
+    rule["unknown"] = True
+
+    # When/Then: strict validation rejects both errors
+    with pytest.raises(ValidationError) as exc_info:
+        DefenseClawRulePackConfig.model_validate(config)
+    errors = exc_info.value.errors()
+    assert any(error["loc"][-1] == "id" for error in errors)
+    assert any(error["loc"][-1] == "unknown" for error in errors)
+
+
+def test_opa_policy_example_and_defaults() -> None:
+    # Given: the supplied policy example
+    config = {
+        "schema_version": 1,
+        "policy": {
+            "domain": "guardrail",
+            "block_at": "HIGH",
+            "alert_at": "MEDIUM",
+            "cisco_trust_level": "full",
+        },
+    }
+
+    # When: validating it and validating a default policy
+    serialized = DefenseClawOpaPolicyConfig.model_validate(config).model_dump()
+    defaults = DefenseClawOpaPolicyConfig.model_validate({"policy": {}}).model_dump()
+
+    # Then: both serialize to the canonical policy envelope
+    assert serialized == config
+    assert defaults == config
+
+
+@pytest.mark.parametrize(
+    "policy",
+    [
+        {"domain": "other"},
+        {"block_at": "URGENT"},
+        {"alert_at": "URGENT"},
+        {"cisco_trust_level": "partial"},
+        {"unexpected": True},
+    ],
+)
+def test_opa_policy_rejects_unsupported_values(policy: dict[str, object]) -> None:
+    # Given/When/Then: an unsupported provider value is rejected
+    with pytest.raises(ValidationError):
+        DefenseClawOpaPolicyConfig.model_validate({"policy": policy})

agent_control_evaluator_defenseclaw-8.3.0/tests/test_evaluators.py

@@ -0,0 +1,85 @@
+"""Behavior tests for the DefenseClaw no-op evaluators."""
+
+from __future__ import annotations
+
+import tomllib
+from pathlib import Path
+
+import pytest
+
+from agent_control_evaluator_defenseclaw import (
+    DefenseClawOpaPolicyEvaluator,
+    DefenseClawRulePackEvaluator,
+)
+
+
+def _rule_pack_config() -> dict[str, object]:
+    return {
+        "rule_pack": {
+            "rules": [
+                {
+                    "id": "rule-1",
+                    "pattern": "example",
+                    "title": "Example",
+                    "severity": "LOW",
+                    "confidence": 1.0,
+                    "tags": [],
+                }
+            ]
+        }
+    }
+
+
+def test_metadata_names_are_distinct_public_identifiers() -> None:
+    assert DefenseClawRulePackEvaluator.metadata.name == "defenseclaw.rule_pack"
+    assert DefenseClawOpaPolicyEvaluator.metadata.name == "defenseclaw.opa_policy"
+    assert DefenseClawRulePackEvaluator is not DefenseClawOpaPolicyEvaluator
+
+
+def test_entry_points_match_public_metadata_names() -> None:
+    # Given: the installed-package manifest contract
+    manifest_path = Path(__file__).parent.parent / "pyproject.toml"
+    manifest = tomllib.loads(manifest_path.read_text())
+
+    # When: reading evaluator entry points
+    entry_points = manifest["project"]["entry-points"]["agent_control.evaluators"]
+
+    # Then: both exact global names resolve to their distinct classes
+    assert entry_points == {
+        "defenseclaw.rule_pack": (
+            "agent_control_evaluator_defenseclaw.rule_pack:DefenseClawRulePackEvaluator"
+        ),
+        "defenseclaw.opa_policy": (
+            "agent_control_evaluator_defenseclaw.opa_policy:DefenseClawOpaPolicyEvaluator"
+        ),
+    }
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("data", [None, "", "selected data", {"tool": "rm"}])
+async def test_rule_pack_evaluation_is_a_no_op(data: object) -> None:
+    # Given: a valid rule-pack evaluator
+    evaluator = DefenseClawRulePackEvaluator.from_dict(_rule_pack_config())
+
+    # When: evaluating any selected data
+    result = await evaluator.evaluate(data)
+
+    # Then: execution is intentionally inert and healthy
+    assert result.matched is False
+    assert result.confidence == 1.0
+    assert result.error is None
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("data", [None, "", "selected data", {"tool": "rm"}])
+async def test_opa_policy_evaluation_is_a_no_op(data: object) -> None:
+    # Given: a valid OPA-policy evaluator
+    evaluator = DefenseClawOpaPolicyEvaluator.from_dict({"policy": {}})
+
+    # When: evaluating any selected data
+    result = await evaluator.evaluate(data)
+
+    # Then: execution is intentionally inert and healthy
+    assert result.matched is False
+    assert result.confidence == 1.0
+    assert result.error is None