agent-custody 0.1.2__tar.gz

agent_custody-0.1.2/.gitignore

@@ -0,0 +1,4 @@
+.venv/
+__pycache__/
+*.egg-info/
+dist/

agent_custody-0.1.2/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.5
+Name: agent-custody
+Version: 0.1.2
+Summary: Signed, verifiable receipts for AI agent tool calls, from Python, through the agent-custody sidecar
+License-Expression: Apache-2.0
+Requires-Python: >=3.9
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.3; extra == 'langchain'
+Provides-Extra: openai-agents
+Requires-Dist: openai-agents>=0.1; extra == 'openai-agents'
+Provides-Extra: test
+Requires-Dist: langchain-core>=0.3; extra == 'test'
+Requires-Dist: openai-agents>=0.1; extra == 'test'
+Requires-Dist: pytest>=8; extra == 'test'
+Description-Content-Type: text/markdown
+
+# agent-custody (Python)
+
+Signed, verifiable receipts for AI agent tool calls, from Python. The key, the Cedar policy, and the Merkle log live in the agent-custody sidecar, a local process from the npm package; this client talks to it over HTTP with the standard library only.
+
+```bash
+npm install -g @agent-custody/receipts && agent-custody keygen --dir keys --name app
+agent-custody serve --config sdk.json          # loopback, port 8788
+pip install agent-custody
+```
+
+```python
+from agent_custody import Client, PolicyDeniedError
+
+client = Client()                                # http://127.0.0.1:8788/
+refund = client.wrap("stripe.refund", lambda args: stripe.refund(**args))
+refund({"amount": 5000})                         # decide, run, record; raises PolicyDeniedError on deny
+```
+
+Adapters, each tested against the real package: `agent_custody.langchain.ReceiptCallbackHandler` (record-only), `agent_custody.openai_agents.wrap_tools` (enforce and record), `agent_custody.claude_agent_sdk.claude_hook` (PreToolUse deny, PostToolUse record). Receipts are verified by the TypeScript verifier; the tests do exactly that.
+
+Everything recorded is `claimed`: the sidecar trusts what this process reports, the same as the in-process TypeScript SDK. For enforcement the agent cannot skip, put the gateway in front of the tools instead; it is an MCP server and needs nothing from this package.
+
+```bash
+uv run --extra test pytest        # from packages/python; starts a sidecar with node from ../receipts
+```

agent_custody-0.1.2/README.md

@@ -0,0 +1,25 @@
+# agent-custody (Python)
+
+Signed, verifiable receipts for AI agent tool calls, from Python. The key, the Cedar policy, and the Merkle log live in the agent-custody sidecar, a local process from the npm package; this client talks to it over HTTP with the standard library only.
+
+```bash
+npm install -g @agent-custody/receipts && agent-custody keygen --dir keys --name app
+agent-custody serve --config sdk.json          # loopback, port 8788
+pip install agent-custody
+```
+
+```python
+from agent_custody import Client, PolicyDeniedError
+
+client = Client()                                # http://127.0.0.1:8788/
+refund = client.wrap("stripe.refund", lambda args: stripe.refund(**args))
+refund({"amount": 5000})                         # decide, run, record; raises PolicyDeniedError on deny
+```
+
+Adapters, each tested against the real package: `agent_custody.langchain.ReceiptCallbackHandler` (record-only), `agent_custody.openai_agents.wrap_tools` (enforce and record), `agent_custody.claude_agent_sdk.claude_hook` (PreToolUse deny, PostToolUse record). Receipts are verified by the TypeScript verifier; the tests do exactly that.
+
+Everything recorded is `claimed`: the sidecar trusts what this process reports, the same as the in-process TypeScript SDK. For enforcement the agent cannot skip, put the gateway in front of the tools instead; it is an MCP server and needs nothing from this package.
+
+```bash
+uv run --extra test pytest        # from packages/python; starts a sidecar with node from ../receipts
+```

agent_custody-0.1.2/agent_custody/__init__.py

@@ -0,0 +1,95 @@
+"""Receipts for tool calls, from Python.
+
+The signing key, the policy, and the log live in the agent-custody sidecar, `agent-custody serve --config sdk.json`,
+a local process. This client talks to it over HTTP with nothing but the standard library. Everything recorded is
+claimed, exactly as with the in-process TypeScript SDK: the sidecar trusts what this process reports.
+"""
+from __future__ import annotations
+
+import base64
+import json
+import urllib.error
+import urllib.request
+from typing import Any, Callable, Dict, Optional
+
+__all__ = ["Client", "PolicyDeniedError", "SidecarError", "receipt_id_of"]
+
+DEFAULT_URL = "http://127.0.0.1:8788/"
+
+
+class SidecarError(RuntimeError):
+    """The sidecar refused or could not complete a request. No receipt was written."""
+
+
+class PolicyDeniedError(PermissionError):
+    def __init__(self, tool: str, reason: str, receipt_id: str):
+        super().__init__(f"Denied by policy: {reason} (receipt {receipt_id})")
+        self.tool = tool
+        self.reason = reason
+        self.receipt_id = receipt_id
+
+
+def receipt_id_of(bundle: Dict[str, Any]) -> str:
+    payload = json.loads(base64.b64decode(bundle["envelope"]["payload"]))
+    return payload["predicate"]["receiptId"]
+
+
+def _event(tool: str, args: Optional[Dict[str, Any]], model: Optional[str], session: Optional[Dict[str, Optional[str]]]) -> Dict[str, Any]:
+    ev: Dict[str, Any] = {"tool": tool, "args": args or {}}
+    if model is not None:
+        ev["model"] = model
+    if session is not None:
+        ev["session"] = session
+    return ev
+
+
+class Client:
+    def __init__(self, url: str = DEFAULT_URL, timeout: float = 10.0):
+        self.url = url if url.endswith("/") else url + "/"
+        self.timeout = timeout
+
+    def _post(self, path: str, body: Any) -> Any:
+        req = urllib.request.Request(self.url + path, data=json.dumps(body).encode(), headers={"content-type": "application/json"}, method="POST")
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as res:
+                return json.loads(res.read())
+        except urllib.error.HTTPError as e:
+            try:
+                detail = json.loads(e.read()).get("error", "")
+            except Exception:
+                detail = ""
+            raise SidecarError(f"sidecar {path}: {e.code} {detail}".strip()) from None
+        except urllib.error.URLError as e:
+            raise SidecarError(f"sidecar unreachable at {self.url}: {e.reason}") from None
+
+    def health(self) -> Dict[str, Any]:
+        with urllib.request.urlopen(self.url + "health", timeout=self.timeout) as res:
+            return json.loads(res.read())
+
+    def decide(self, tool: str, args: Optional[Dict[str, Any]] = None, *, model: Optional[str] = None, session: Optional[Dict[str, Optional[str]]] = None) -> Optional[Dict[str, Any]]:
+        """The configured policy's decision for this call, or None when the sidecar has no policy."""
+        return self._post("decide", _event(tool, args, model, session))
+
+    def record(self, tool: str, args: Optional[Dict[str, Any]], outcome: Dict[str, Any], policy: Optional[Dict[str, Any]] = None, *, model: Optional[str] = None, session: Optional[Dict[str, Optional[str]]] = None) -> Dict[str, Any]:
+        """Issues one receipt. `outcome` is {"status": "executed"|"failed", "result": ...}, {"status": "denied", "reason": ...}, or {"status": "error", "error": ...}."""
+        return self._post("record", {"event": _event(tool, args, model, session), "outcome": outcome, "policy": policy})
+
+    def wrap(self, tool: str, fn: Callable[[Dict[str, Any]], Any], *, model: Optional[str] = None) -> Callable[[Dict[str, Any]], Any]:
+        """decide, run, record. Raises PolicyDeniedError on deny, after recording the denial."""
+
+        def wrapped(args: Dict[str, Any]) -> Any:
+            policy = self.decide(tool, args, model=model)
+            if policy and policy["decision"] == "deny":
+                reason = "; ".join(policy["reasons"] + policy["errors"]) or "no permit policy matched"
+                bundle = self.record(tool, args, {"status": "denied", "reason": reason}, policy, model=model)
+                raise PolicyDeniedError(tool, reason, receipt_id_of(bundle))
+            try:
+                result = fn(args)
+            except Exception as e:
+                self.record(tool, args, {"status": "error", "error": str(e)}, policy, model=model)
+                raise
+            self.record(tool, args, {"status": "executed", "result": result}, policy, model=model)
+            return result
+
+        wrapped.__name__ = getattr(fn, "__name__", tool)
+        return wrapped

agent_custody-0.1.2/agent_custody/claude_agent_sdk.py

@@ -0,0 +1,47 @@
+"""Claude Agent SDK (Python) hooks. Same contract as the TypeScript adapter and the Claude Code command hook.
+
+PreToolUse: evaluate policy; on deny, record a denial receipt and block. On allow or no policy return no decision,
+so the host's own permission flow still applies. This never auto-approves. PostToolUse / PostToolUseFailure record.
+
+    from claude_agent_sdk import HookMatcher
+    hooks = {event: [HookMatcher(hooks=[claude_hook(client)])] for event in ("PreToolUse", "PostToolUse", "PostToolUseFailure")}
+"""
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Optional
+
+from . import Client, receipt_id_of
+
+
+def _event(input_data: Dict[str, Any]) -> Dict[str, Any]:
+    raw = input_data.get("tool_input")
+    args = raw if isinstance(raw, dict) else {"input": raw}
+    return {"tool": input_data["tool_name"], "args": args, "session": {"id": input_data.get("session_id"), "toolUseId": input_data.get("tool_use_id")}}
+
+
+def handle_hook_event(client: Client, input_data: Dict[str, Any]) -> Dict[str, Any]:
+    ev = _event(input_data)
+    name = input_data.get("hook_event_name")
+    if name == "PreToolUse":
+        policy = client.decide(ev["tool"], ev["args"], session=ev["session"])
+        if policy and policy["decision"] == "deny":
+            reason = "; ".join(policy["reasons"] + policy["errors"]) or "no permit policy matched"
+            bundle = client.record(ev["tool"], ev["args"], {"status": "denied", "reason": reason}, policy, session=ev["session"])
+            return {"continue": True, "hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": f"agent-custody: {reason} (receipt {receipt_id_of(bundle)})"}}
+        return {}
+    if name == "PostToolUse":
+        client.record(ev["tool"], ev["args"], {"status": "executed", "result": input_data.get("tool_response")}, client.decide(ev["tool"], ev["args"]), session=ev["session"])
+        return {}
+    if name == "PostToolUseFailure":
+        client.record(ev["tool"], ev["args"], {"status": "failed", "result": input_data.get("error", input_data.get("tool_response"))}, client.decide(ev["tool"], ev["args"]), session=ev["session"])
+        return {}
+    return {}
+
+
+def claude_hook(client: Client) -> Callable[[Dict[str, Any], Optional[str], Any], Any]:
+    """A hook callable in the shape the Claude Agent SDK expects: (input_data, tool_use_id, context) -> dict."""
+
+    async def hook(input_data: Dict[str, Any], tool_use_id: Optional[str], context: Any) -> Dict[str, Any]:
+        return handle_hook_event(client, input_data)
+
+    return hook

agent_custody-0.1.2/agent_custody/langchain.py

@@ -0,0 +1,61 @@
+"""LangChain / LangGraph adapter: a callback handler that records a receipt for every tool run it sees.
+
+Observe-only. Callbacks cannot block a tool, so this evaluates no policy. For enforcement wrap the function before
+turning it into a tool: `tool(client.wrap("name", fn))`. Do not combine both on one tool, or it is recorded twice.
+"""
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, Optional
+from uuid import UUID
+
+from langchain_core.callbacks import BaseCallbackHandler
+
+from . import Client
+
+
+def _parse_args(input_str: str, inputs: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    if isinstance(inputs, dict):
+        return inputs
+    try:
+        v = json.loads(input_str)
+        return v if isinstance(v, dict) else {"input": v}
+    except (TypeError, ValueError):
+        return {"input": input_str}
+
+
+def _unwrap(output: Any) -> Any:
+    content = getattr(output, "content", None) if hasattr(output, "tool_call_id") else None
+    if content is None:
+        return output
+    if isinstance(content, str):
+        try:
+            return json.loads(content)
+        except ValueError:
+            return content
+    return content
+
+
+class ReceiptCallbackHandler(BaseCallbackHandler):
+    name = "agent-custody"
+
+    def __init__(self, client: Client):
+        super().__init__()
+        self.client = client
+        self._pending: Dict[UUID, Dict[str, Any]] = {}
+
+    def on_tool_start(self, serialized: Dict[str, Any], input_str: str, *, run_id: UUID, parent_run_id: Optional[UUID] = None, tags=None, metadata=None, inputs: Optional[Dict[str, Any]] = None, **kwargs: Any) -> None:
+        name = kwargs.get("name") or (serialized or {}).get("name") or "unknown"
+        self._pending[run_id] = {"tool": name, "args": _parse_args(input_str, inputs), "session": {"id": None, "toolUseId": kwargs.get("tool_call_id")}}
+
+    def on_tool_end(self, output: Any, *, run_id: UUID, **kwargs: Any) -> None:
+        ev = self._pending.pop(run_id, None)
+        if ev is None:
+            return
+        self.client.record(ev["tool"], ev["args"], {"status": "executed", "result": _unwrap(output)}, None, session=ev["session"])
+
+    def on_tool_error(self, error: BaseException, *, run_id: UUID, **kwargs: Any) -> None:
+        ev = self._pending.pop(run_id, None)
+        if ev is None:
+            return
+        self.client.record(ev["tool"], ev["args"], {"status": "error", "error": str(error)}, None, session=ev["session"])

agent_custody-0.1.2/agent_custody/openai_agents.py

@@ -0,0 +1,54 @@
+"""OpenAI Agents SDK (Python) adapter: wraps each FunctionTool's on_invoke_tool. Decides, runs, records.
+
+A denied call never runs; the model receives the denial text as the tool result and the run continues.
+"""
+from __future__ import annotations
+
+import dataclasses
+import json
+from typing import Any, Dict, List
+
+from agents import FunctionTool
+
+from . import Client, receipt_id_of
+
+
+def _parse(input_json: str) -> Dict[str, Any]:
+    try:
+        v = json.loads(input_json) if input_json else {}
+        return v if isinstance(v, dict) else {"input": v}
+    except ValueError:
+        return {"input": input_json}
+
+
+def _result(v: Any) -> Any:
+    if not isinstance(v, str):
+        return v
+    try:
+        return json.loads(v)
+    except ValueError:
+        return v
+
+
+def wrap_tools(client: Client, tools: List[FunctionTool]) -> List[FunctionTool]:
+    out: List[FunctionTool] = []
+    for t in tools:
+        original = t.on_invoke_tool
+
+        async def invoke(ctx: Any, input_json: str, _t: FunctionTool = t, _orig=original) -> Any:
+            args = _parse(input_json)
+            policy = client.decide(_t.name, args)
+            if policy and policy["decision"] == "deny":
+                reason = "; ".join(policy["reasons"] + policy["errors"]) or "no permit policy matched"
+                bundle = client.record(_t.name, args, {"status": "denied", "reason": reason}, policy)
+                return f"Denied by policy: {reason} (receipt {receipt_id_of(bundle)})"
+            try:
+                result = await _orig(ctx, input_json)
+            except Exception as e:
+                client.record(_t.name, args, {"status": "error", "error": str(e)}, policy)
+                raise
+            client.record(_t.name, args, {"status": "executed", "result": _result(result)}, policy)
+            return result
+
+        out.append(dataclasses.replace(t, on_invoke_tool=invoke))
+    return out

agent_custody-0.1.2/pyproject.toml

@@ -0,0 +1,23 @@
+[project]
+name = "agent-custody"
+version = "0.1.2"
+description = "Signed, verifiable receipts for AI agent tool calls, from Python, through the agent-custody sidecar"
+readme = "README.md"
+license = "Apache-2.0"
+requires-python = ">=3.9"
+dependencies = []
+
+[project.optional-dependencies]
+langchain = ["langchain-core>=0.3"]
+openai-agents = ["openai-agents>=0.1"]
+test = ["pytest>=8", "langchain-core>=0.3", "openai-agents>=0.1"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["agent_custody"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

agent_custody-0.1.2/tests/conftest.py

@@ -0,0 +1,48 @@
+# Every test runs against a real sidecar: `node ../receipts/src/cli.ts serve`, started here on a free port with an
+# application key and a policy generated for the session. No mocks of the sidecar; it is the thing being integrated.
+import json
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+import pytest
+
+from agent_custody import Client
+
+RECEIPTS = Path(__file__).resolve().parents[2] / "receipts"
+POLICY = 'permit(principal, action == Action::"customer.lookup", resource);\npermit(principal, action == Action::"stripe.refund", resource) when { context.args.amount <= 100000 };\n'
+
+
+@pytest.fixture(scope="session")
+def sidecar():
+    node = shutil.which("node")
+    assert node, "node is required: the sidecar is the agent-custody CLI"
+    d = Path(tempfile.mkdtemp(prefix="agent-custody-py-"))
+    subprocess.run([node, str(RECEIPTS / "src/cli.ts"), "keygen", "--dir", str(d / "keys"), "--name", "app"], check=True, capture_output=True)
+    (d / "policy.cedar").write_text(POLICY)
+    (d / "sdk.json").write_text(json.dumps({"agentId": "py-bot", "principalId": "user_456", "identity": {"keyFile": "keys/app.key"}, "policyFile": "policy.cedar", "receiptsDir": "receipts", "logFile": "log.jsonl", "framework": "python"}))
+    p = subprocess.Popen([node, str(RECEIPTS / "src/cli.ts"), "serve", "--config", str(d / "sdk.json"), "--port", "0"], stderr=subprocess.PIPE, text=True)
+    line = p.stderr.readline()
+    m = re.search(r"(http://[^ ]+)", line)
+    assert m, f"sidecar did not start: {line}"
+    yield {"url": m.group(1), "dir": d, "receipts": d / "receipts", "app_pub": d / "keys" / "app.pub", "log": d / "log.jsonl", "node": node}
+    p.terminate()
+    p.wait(timeout=10)
+
+
+@pytest.fixture
+def client(sidecar):
+    return Client(sidecar["url"])
+
+
+def receipt_count(sidecar) -> int:
+    return len(list(sidecar["receipts"].glob("*.json"))) if sidecar["receipts"].exists() else 0
+
+
+def verify(sidecar, receipt_id: str) -> dict:
+    """The TypeScript verifier is the reference; a receipt from Python must pass it."""
+    out = subprocess.run([sidecar["node"], str(RECEIPTS / "src/cli.ts"), "verify", str(sidecar["receipts"] / f"{receipt_id}.json"), "--issuer-key", str(sidecar["app_pub"]), "--log", str(sidecar["log"]), "--json"], capture_output=True, text=True)
+    return json.loads(out.stdout)

agent_custody-0.1.2/tests/test_claude_hooks.py

@@ -0,0 +1,19 @@
+# The documented Claude Agent SDK hook contract, driven the way the SDK drives it.
+import asyncio
+
+from agent_custody.claude_agent_sdk import claude_hook, handle_hook_event
+from conftest import receipt_count, verify
+
+
+def test_pretooluse_denies_with_a_receipt_and_never_auto_approves(client, sidecar):
+    out = handle_hook_event(client, {"hook_event_name": "PreToolUse", "session_id": "s1", "tool_use_id": "t1", "tool_name": "stripe.refund", "tool_input": {"amount": 999999}})
+    assert out["hookSpecificOutput"]["permissionDecision"] == "deny"
+    rid = out["hookSpecificOutput"]["permissionDecisionReason"].split("receipt ")[1].rstrip(")")
+    assert verify(sidecar, rid)["statement"]["predicate"]["execution"]["status"] == "denied"
+    assert handle_hook_event(client, {"hook_event_name": "PreToolUse", "tool_name": "stripe.refund", "tool_input": {"amount": 1}}) == {}
+
+
+def test_posttooluse_records_through_the_async_hook_callable(client, sidecar):
+    before = receipt_count(sidecar)
+    out = asyncio.run(claude_hook(client)({"hook_event_name": "PostToolUse", "tool_name": "customer.lookup", "tool_input": {"id": "c1"}, "tool_response": {"name": "Dana"}}, "t2", None))
+    assert out == {} and receipt_count(sidecar) == before + 1

agent_custody-0.1.2/tests/test_client.py

@@ -0,0 +1,55 @@
+import pytest
+
+from agent_custody import PolicyDeniedError, SidecarError, receipt_id_of
+from conftest import receipt_count, verify
+
+
+def test_health_names_the_agent(client):
+    h = client.health()
+    assert h["agentId"] == "py-bot" and h["log"]["kind"] == "file"
+
+
+def test_decide_runs_the_policy_on_args(client):
+    assert client.decide("stripe.refund", {"amount": 500})["decision"] == "allow"
+    assert client.decide("stripe.refund", {"amount": 500000})["decision"] == "deny"
+
+
+def test_record_produces_a_receipt_the_typescript_verifier_accepts(client, sidecar):
+    policy = client.decide("stripe.refund", {"amount": 500})
+    bundle = client.record("stripe.refund", {"amount": 500}, {"status": "executed", "result": {"refund_id": "re_1"}}, policy, session={"id": "s1", "toolUseId": "t1"})
+    v = verify(sidecar, receipt_id_of(bundle))
+    assert v["ok"], [c for c in v["checks"] if not c["ok"]]
+    p = v["statement"]["predicate"]
+    assert p["issuer"]["kind"] == "sdk" and p["issuer"]["framework"] == "python"
+    assert p["session"] == {"id": "s1", "toolUseId": "t1", "provenance": "claimed"}
+    assert p["policy"]["decision"] == "allow"
+
+
+def test_wrap_decides_runs_records_and_denies(client, sidecar):
+    calls = []
+    refund = client.wrap("stripe.refund", lambda args: calls.append(args) or {"ok": True, **args})
+    before = receipt_count(sidecar)
+    assert refund({"amount": 500}) == {"ok": True, "amount": 500}
+    with pytest.raises(PolicyDeniedError) as e:
+        refund({"amount": 500000})
+    assert calls == [{"amount": 500}], "the denied call never ran"
+    assert receipt_count(sidecar) == before + 2
+    assert verify(sidecar, e.value.receipt_id)["statement"]["predicate"]["execution"]["status"] == "denied"
+
+
+def test_wrap_records_an_error_and_rethrows(client, sidecar):
+    def boom(args):
+        raise RuntimeError("upstream down")
+
+    lookup = client.wrap("customer.lookup", boom)
+    before = receipt_count(sidecar)
+    with pytest.raises(RuntimeError, match="upstream down"):
+        lookup({"id": "c1"})
+    assert receipt_count(sidecar) == before + 1
+
+
+def test_a_malformed_record_is_refused_and_nothing_is_written(client, sidecar):
+    before = receipt_count(sidecar)
+    with pytest.raises(SidecarError, match="400"):
+        client.record("t", {}, {"status": "maybe"})
+    assert receipt_count(sidecar) == before

agent_custody-0.1.2/tests/test_langchain.py

@@ -0,0 +1,31 @@
+# Against the real langchain-core: a StructuredTool invoked with the handler in the config. No model, no network.
+from langchain_core.tools import tool
+
+from agent_custody.langchain import ReceiptCallbackHandler
+from conftest import receipt_count, verify
+
+
+@tool
+def refund(amount: int) -> dict:
+    """Refund an amount."""
+    return {"refund_id": "re_lc", "amount": amount}
+
+
+@tool
+def flaky(id: str) -> dict:
+    """Always fails."""
+    raise RuntimeError("upstream down")
+
+
+def test_every_tool_run_gets_a_receipt(client, sidecar):
+    handler = ReceiptCallbackHandler(client)
+    before = receipt_count(sidecar)
+    assert refund.invoke({"amount": 7}, config={"callbacks": [handler]}) == {"refund_id": "re_lc", "amount": 7}
+    try:
+        flaky.invoke({"id": "c1"}, config={"callbacks": [handler]})
+    except RuntimeError:
+        pass
+    assert receipt_count(sidecar) == before + 2
+    newest = sorted(sidecar["receipts"].glob("*.json"), key=lambda p: p.stat().st_mtime)[-2:]
+    statuses = {verify(sidecar, p.stem)["statement"]["predicate"]["execution"]["status"] for p in newest}
+    assert statuses == {"executed", "error"}

agent_custody-0.1.2/tests/test_openai_agents.py

@@ -0,0 +1,26 @@
+# Against the real openai-agents package: a FunctionTool built by @function_tool, invoked the way the runner invokes it.
+import asyncio
+
+from agents import RunConfig, function_tool
+from agents.tool_context import ToolContext
+
+from agent_custody.openai_agents import wrap_tools
+from conftest import receipt_count, verify
+
+
+@function_tool(name_override="stripe.refund")
+def refund(amount: int) -> dict:
+    """Refund an amount."""
+    return {"refund_id": "re_oa", "amount": amount}
+
+
+def test_wrapped_tool_enforces_and_records(client, sidecar):
+    wrapped = wrap_tools(client, [refund])[0]
+    ctx = lambda input_json: ToolContext(context=None, tool_name="stripe.refund", tool_call_id="call-1", tool_arguments=input_json, run_config=RunConfig())
+    before = receipt_count(sidecar)
+    ok = asyncio.run(wrapped.on_invoke_tool(ctx('{"amount": 9}'), '{"amount": 9}'))
+    denied = asyncio.run(wrapped.on_invoke_tool(ctx('{"amount": 900000}'), '{"amount": 900000}'))
+    assert "re_oa" in str(ok)
+    assert str(denied).startswith("Denied by policy:")
+    assert receipt_count(sidecar) == before + 2
+    assert wrapped.name == refund.name and wrapped.params_json_schema == refund.params_json_schema