agent-trust-plane 0.3.2__py3-none-any.whl

agent_trust_plane-0.3.2.dist-info/METADATA

@@ -0,0 +1,143 @@
+Metadata-Version: 2.5
+Name: agent-trust-plane
+Version: 0.3.2
+Summary: Authorization boundary and security regression testing for AI agent tool calls (MCP): decide on arguments against delegated authority, bind decisions to single-use grants, replay, and pin denials as CI tests. Experimental.
+Project-URL: Homepage, https://github.com/TimelessVisions/agent-trust-plane
+Project-URL: Repository, https://github.com/TimelessVisions/agent-trust-plane
+Project-URL: Issues, https://github.com/TimelessVisions/agent-trust-plane/issues
+Project-URL: Documentation, https://github.com/TimelessVisions/agent-trust-plane/tree/main/docs
+Project-URL: Changelog, https://github.com/TimelessVisions/agent-trust-plane/blob/main/CHANGELOG.md
+Project-URL: Security, https://github.com/TimelessVisions/agent-trust-plane/blob/main/SECURITY.md
+Author-email: George Gakravyi <george@agentcommercegateway.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent-security,ai-agents,authorization,llm-security,mcp,model-context-protocol,regression-testing,security-testing
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: fastapi>=0.115
+Requires-Dist: httpx>=0.28
+Requires-Dist: mcp<3,>=2.2
+Requires-Dist: pydantic-settings>=2.7
+Requires-Dist: pydantic>=2.10
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: uvicorn[standard]>=0.34
+Description-Content-Type: text/markdown
+
+# Agent Trust Plane
+
+**Put a real authorization boundary between your AI agent and its tools, and turn every dangerous action into a regression test so it cannot silently come back.**
+
+![Real transcript of `atp demo wrap`: a write is allowed, a delete is denied before it reaches the server, the denial is explained, pinned as a regression test, and the test passes](https://raw.githubusercontent.com/TimelessVisions/agent-trust-plane/main/docs/images/demo-wrap.svg)
+
+```bash
+uv run atp demo wrap                        # a real MCP server, wrapped; one ALLOW, one DENY, one regression test
+uv run atp mcp init -- <your mcp server>    # then: atp mcp wrap   (Streamable HTTP upstreams: --url)
+uv run atp regression add <trace> && uv run atp test atp-regression.yaml
+```
+
+> **Status: experimental, v0.3.2, no users yet, not independently audited.** Every claim below is backed by a test in this repository or says otherwise. What it does *not* protect is in [docs/security/threat-model.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/threat-model.md).
+
+## Why this exists
+
+Agents act on tool calls, and the tool call is where prompt injection turns into damage: pay this account, delete that file, move this repo. Gateways in front of MCP servers authenticate the caller and allow tools by *name*; most cannot decide on the *arguments* (amount, path, destination) and none replay a recorded decision or keep it fixed in CI ([research, with citations](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/research/competitive-code-review.md)). ATP does that part and only that part: it is a decision-and-evidence layer, not a gateway ([why-atp.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/why-atp.md)).
+
+## How it works
+
+```
+agent / MCP client ──stdio──▶ atp mcp wrap ──▶ upstream MCP server (stdio or Streamable HTTP)
+                                   │
+                    authenticate the agent; resolve HUMAN → agent delegation (capabilities,
+                    resource scope, limits — a child can only narrow)
+                    build an ActionEnvelope from the call (paths normalised, args bounded)
+                    decide: kernel policies + your declared policy set   →  ALLOW / DENY / WOULD_DENY
+                    ALLOW  → single-use grant over the exact action hash → forward → record outcome
+                    DENY   → refuse (enforce)  |  forward and record WOULD_DENY (shadow)
+                    everything on a hash-chained trace in .atp/
+```
+
+Then, offline: `atp trace list` · `atp policy explain TRACE` · `atp regression add TRACE` · `atp test` · `atp policy impact --from A --to B` · `atp mutate TRACE` · `atp evidence export TRACE`.
+
+## Quickstart (measured: [docs/first-user-test-v2.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/first-user-test-v2.md))
+
+Prerequisites: Python ≥ 3.12 and [uv](https://docs.astral.sh/uv/). No API keys, no Docker, no database setup, no secrets to copy.
+
+```bash
+git clone <this repository> && cd agent-trust-plane
+uv run atp demo wrap          # syncs the workspace on first run; 37 s cold on the maintainer machine
+```
+
+The same commands work in PowerShell. `uv run atp doctor` explains anything missing. Other demos: `atp demo injection` (an injected invoice tries to pay $12,500 on a $1,000 delegation), `atp demo regression` (a permitted payment reveals a policy hole; replay under the fix flips it), `atp demo mcp` (the proxy against a remote-style gateway) — [docs/demos.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/demos.md).
+
+## Wrap your own MCP server
+
+```bash
+uv run atp mcp init --name fs -- npx -y @modelcontextprotocol/server-filesystem /abs/sandbox
+#   reads tools/list; proposes capabilities from the server's annotations (unverified: review them);
+#   writes atp-mcp.yaml and .atp/policies.yaml (declared set fs-v1)
+uv run atp mcp wrap --mode shadow      # observe first: denials are recorded as WOULD_DENY and forwarded
+uv run atp mcp wrap                    # enforce
+```
+
+Tools the server itself marks destructive (`write_file`, `edit_file`, `move_file` on the reference server) get `fs:destroy`, which is **not delegated by default**: the first write is denied with `CAPABILITY_NOT_GRANTED` until you add `fs:destroy` to `authority.capabilities` in `atp-mcp.yaml` — a deliberate fail-closed default, and the one thing the first-user test tripped over.
+
+Point your MCP client at the wrap command instead of the server ([config example](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/integrations/frameworks.md)). Verified upstreams: this repo's notes server (stdio and Streamable HTTP, every CI run) and the reference `@modelcontextprotocol/server-filesystem` (opt-in test, run 2026-09-17). Everything else is listed as *not verified* in [docs/integrations/compatibility.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/integrations/compatibility.md).
+
+Scope paths, not just tool names: `resource_scope: ["path:/abs/sandbox/*"]` with `..`, separators and (optionally) case normalised before matching. Argument limits go in [`.atp/policies.yaml`](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/policies/policies.md):
+
+```yaml
+rules:
+  - id: no-large-writes
+    applies_to: {tool: mcp.fs, action: write_file}
+    kind: argument_max_length
+    argument: content
+    max_length: 20000
+```
+
+## Security regression tests
+
+```bash
+uv run atp trace list                                   # what was ALLOWed / DENIED / WOULD_DENY
+uv run atp policy explain 457328bdd4ef                  # which constraint failed, and what would need to change
+uv run atp regression add 457328bdd4ef --name "delete stays denied"
+uv run atp test atp-regression.yaml                     # exit 1 if the decision ever changes; --junit/--json for CI
+uv run atp policy impact --from fs-v1 --to fs-v2        # which recorded actions flip; DENY -> ALLOW first
+uv run atp mutate 457328bdd4ef                          # perturb the recorded action; authorize only, never execute
+```
+
+A suite is YAML: principals, a delegation graph, cases with the expected outcome / reason / policy. Runs use an ephemeral in-process gateway and call only `/authorize` — a spy on `execute` sees zero calls. CI example without secrets: [examples/regression-suite](https://github.com/TimelessVisions/agent-trust-plane/tree/main/examples/regression-suite/) and a copy-in [composite action](https://github.com/TimelessVisions/agent-trust-plane/tree/main/examples/github-action/). Guide: [docs/regression/regression-testing.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/regression/regression-testing.md).
+
+## Architecture
+
+Protocol-neutral kernel (`atp_core` envelope/decision, `atp_identity` credentials + delegation chains, `atp_policy` engine + declared sets, `atp_audit` hash chain, `atp_gateway` service/grants/API) with adapters on the edge (`atp_adapter_mcp` proxy, `atp_adapter_http` client) and the `atp` CLI. One distribution, `agent-trust-plane`, installs everything (`uvx --from <wheel-or-git-url> atp …`). The kernel imports nothing from MCP — a test enforces it. Details: [docs/architecture/architecture.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/architecture/architecture.md), [first principles](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/architecture/first-principles.md), [ADRs](https://github.com/TimelessVisions/agent-trust-plane/tree/main/docs/adr/).
+
+Overhead ([docs/benchmarks.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/benchmarks.md), single machine, sequential): policy engine 0.26 ms; `atp mcp wrap` adds ~11 ms p50 to an MCP tool call with durable SQLite evidence; the HTTP-gateway proxy path adds ~21 ms.
+
+## Security model and limitations
+
+Guarantees, assumptions, deployment requirements, non-guarantees and known gaps are separated in [docs/security/threat-model.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/threat-model.md); attempted attacks and results in [docs/red-team/architecture-attacks.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/red-team/architecture-attacks.md); the self-review with severities in [docs/security/security-review.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/security-review.md). Headlines:
+
+- **Only the mediated path is protected.** An agent that can reach the tool without the proxy is not stopped — a test shows it on purpose. Whether that can happen is a deployment property: [docs/security/enforcing-the-boundary.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/enforcing-the-boundary.md).
+- **The operator (and `.atp/keys.env`) is omnipotent**; agent credentials are bearer tokens with expiry and revocation, no proof of possession.
+- **Single-use grants prove one release, not exactly-once external effects**: [docs/security/idempotency.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/idempotency.md).
+- The hash chain catches edits by non-writers; a DB writer can recompute it: [docs/security/trace-integrity.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/security/trace-integrity.md).
+- Declared policies are limit/equality rules; use OPA/Cedar for more ([why-not-just-opa.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/policies/why-not-just-opa.md)). Prompt injection is bounded, not detected.
+
+Evidence for what *is* handled: 439 tests including property-based tests (delegation monotonicity, scope-algebra soundness, a stateful grant lifecycle with tampering and revocation interleaved), an exhaustive check of the grant state machine ([spec](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/formal/grant-lifecycle.md)), eight adversarial evals, and real-protocol MCP end-to-end tests.
+
+## Contributing
+
+[CONTRIBUTING.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/CONTRIBUTING.md), [DEVELOPMENT.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/DEVELOPMENT.md) (module map, invariants not to break, how to add a policy or adapter), [ROADMAP.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/ROADMAP.md), [docs/good-first-issues.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/good-first-issues.md), [SECURITY.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/SECURITY.md) for reporting a vulnerability, [CHANGELOG.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/CHANGELOG.md). [MIT licensed](https://github.com/TimelessVisions/agent-trust-plane/blob/main/LICENSE) (dependency and copyright record: [docs/release/licensing.md](https://github.com/TimelessVisions/agent-trust-plane/blob/main/docs/release/licensing.md)). No telemetry.

agent_trust_plane-0.3.2.dist-info/RECORD

@@ -0,0 +1,98 @@
+atp_adapter_http/__init__.py,sha256=cayabsdf7y-SCOyTvjfpAb8aQy6zG8tMnwQ1z-NTUSA,373
+atp_adapter_http/client.py,sha256=vOdB8Cd0o_vx3OzdzGCKwWLBQjDu03DM4pBCfES_R1w,12089
+atp_adapter_http/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_adapter_mcp/__init__.py,sha256=yIcqDGrtt44o9JQtSPwxcVNrrZkngGSttFS2P-0I0yw,817
+atp_adapter_mcp/__main__.py,sha256=6nT2r0nwRpalNxRBOyAcOasKt6RYNiw8nbUJ9Cwq-gE,159
+atp_adapter_mcp/config.py,sha256=_O0oe0gA9RjFybPKNqLctbi9Dkz52CUsV3yld0s9I7E,7388
+atp_adapter_mcp/discovery.py,sha256=v4eSyVzxSexqhsWjZRhl9JtfAek0ljFQZKlZinT7REk,6908
+atp_adapter_mcp/mapping.py,sha256=Pc4GVajMRSCvnRfVWpMs71zt7zvSg9DQP0ojar0Y4e0,5742
+atp_adapter_mcp/proxy.py,sha256=032C1oUrUlqxQpzD5JXYFLDoz-ya7cjB-QDe0W9W-4Y,15397
+atp_adapter_mcp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+finance_agent/__init__.py,sha256=qh2iGwaRkaDiAcpeZumMhu_FQLa9_BG16txHo_VhDbk,1049
+finance_agent/__main__.py,sha256=5UT3THST_Wr2wQ59vldph44d_RxjUfVo5JngX2HO6hE,3225
+finance_agent/agent.py,sha256=Gbh7PEfJT6CmBAJEhTOsaNnYZOQD0NPgQVb8Wj4Y0gU,6101
+finance_agent/invoices.py,sha256=ucmCFZfaTAHcaAekCz4aTUYkeyH2Ob56oiC_ybZef_c,2597
+finance_agent/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+finance_agent/runner.py,sha256=GuLbyH_ab3NZBdHQ3NnqHdpiZIn02uciJ61-A9dU_c0,5387
+finance_agent/scenario.py,sha256=BMWFQJzhsMuoHWwSXkMp9eNc938qS4Q_8EjjxXhPmrQ,5684
+notes_mcp_server/__init__.py,sha256=9_Ea2pyTp5avA0Gti3aHSXuGrgHE9LxHIwtCt6ikHfc,2445
+notes_mcp_server/__main__.py,sha256=ZXP75ar_BovRn47BIZw_CTbDamfyqFKBe-DTQ_JsLUM,73
+notes_mcp_server/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_audit/__init__.py,sha256=MPMorkdLw6FeX5q8Dy00pHXOcoZCkSs3Wy6wDsu-15A,461
+atp_audit/events.py,sha256=89xVGMcdhBvH6KcltbC6QylcW_GsSwbKBDFEsJtFEFA,2757
+atp_audit/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_audit/store.py,sha256=VCTbZgF_lQDpCysAh7nna4rnzXHmCEJmhYqJ6tQTf70,9204
+atp_cli/__init__.py,sha256=ZwGz11lkrOGo7JfZ14zj3ZlYEBkbyB6rbjIh-Sctj0o,28
+atp_cli/demos.py,sha256=585CYONG8YM3H-v1fAWKLAaQ91CRd64JniLRJhTwE6I,17610
+atp_cli/doctor.py,sha256=Ofb20WK_b2685ddgzkwLSq3HtqyJSu3jKEesBekIbCE,3809
+atp_cli/home.py,sha256=ZP9cZLmmPV8pzn3nsrbyyXmuxleOgIiFkaDimM8vEBo,5173
+atp_cli/main.py,sha256=-6PNqhODsQjLEgNbGewPxVWc7CoIB8dZLkS3B3kC9vQ,28155
+atp_cli/mcp_cmds.py,sha256=SNxxlLVGZe8UYpEWFWMquOCIZzSUEZgWcUQDLaYiMrE,7773
+atp_cli/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_core/__init__.py,sha256=BFqVDlN7KnXpqTsCUDEsPShnMDN5QpCyQuSD-6zddkM,1823
+atp_core/authority.py,sha256=vLuX9iJ4IcboPHsNqYWHlaMTUIZytqvYHND65PxlLnU,2017
+atp_core/canonical.py,sha256=ZZi44Dr889CXANQpnENwPYA4_HESyH1KaEc6oOoxx58,1335
+atp_core/decision.py,sha256=-EeevrnT66lPXFCAPydL0eNOGsh2A742r-Roe1XSwEc,4011
+atp_core/envelope.py,sha256=1ZhdueqRxTseZ0B0oNU8D2s0oizaRMgxz2PiFfrD5-A,5270
+atp_core/errors.py,sha256=qILZdMm7RDSYr74hTj80Dn-fe3FeGTxqvHsUHasWI40,750
+atp_core/files.py,sha256=LRjqQjTlTthZ3-VC93kKbfSLhlMkSHsEOa50e8TnVBY,643
+atp_core/ids.py,sha256=oD9dR_M4I1jMk9RgZgCVzIXriH-qm3DgcqHgXeN4S1k,369
+atp_core/money.py,sha256=derCJcyhIXTM2gS6SRWzikfXsYhxFnktB18At2oW4-I,2320
+atp_core/principals.py,sha256=UqQLMCZJAiMwTS9nCCfXGqDUhwKWYHSteJcs-GHjas8,558
+atp_core/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_core/reasons.py,sha256=QVcvvZWKoEJB3ZlcM0WSKGCFEVjk5MIfYHBjVTbh_7w,4741
+atp_core/resources.py,sha256=rS1F69qdgQjchxQq5ZVgY4wKaWlGT-DD001xxyHbZbI,662
+atp_core/sqlite.py,sha256=jCzlpSlq3W8VR8CjCkOTx9eF0xCAD2m29a-VN3I8SLs,1912
+atp_core/timeutil.py,sha256=pqBed32JiE2kR9vDmXdQ95G63rPZEh3GCO04LIjx5sI,450
+atp_evals/__init__.py,sha256=S334F8N68dzJ1sE5UMhIrycgn8TOyXGEHlLaTMJZypI,541
+atp_evals/__main__.py,sha256=mz9p12DK2UTXHSgrq_aHcZYcDDkDvvz8UOJ8nt71fnA,2145
+atp_evals/analysis.py,sha256=Y4ea3g-0hdzgrTylxJup0klo-I-8c18dwUzPXOS_DLk,16520
+atp_evals/harness.py,sha256=jWJvfI-xn1gGBUc4q0Nfg6Rol8yKm9mmUfA4KcfgPBA,3048
+atp_evals/model.py,sha256=Atlv6buNFPALimTJshGafElYXOzcOUHcImFg8lYmmhA,1656
+atp_evals/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_evals/runner.py,sha256=1DNdfSOoqiXdJuqP52bNdkHcOK2Its8LwHyb4YxYxro,3976
+atp_evals/scenarios.py,sha256=kESq9OJ2G-VQN2DZRKtTqej7LCw40HWObwMVZ51n6Wc,22895
+atp_evals/regression/__init__.py,sha256=Xxl3bV4KtfYv_KxG2JyOaZ4qkMWTiCTbpluCMlKj0oc,850
+atp_evals/regression/format.py,sha256=672U_P1q0tMD_VimqpKyxLAaRTqJqRDVAvYnbiLpmyo,7355
+atp_evals/regression/record.py,sha256=AmVCw4FvUOn3Js3cw73Tly5oCgL9Fx62kih1lPDe88A,6094
+atp_evals/regression/runner.py,sha256=ZOT0iymqOUHd-Nr-tt7q7OwsTxP2O1wedrPTbMr7T4U,10923
+atp_identity/__init__.py,sha256=SEEbef1rBdbygguHwqG331d8-au5uWJBEWGjzWCV9gI,1161
+atp_identity/credentials.py,sha256=xaXC0miMWGa6jYrEZxRiSOYelR-P32OVqZ66LsCEzK4,9725
+atp_identity/grants.py,sha256=2tjIwC7alchG4rZfQhhFU7ccgj6kOUWsx1pH4K9b2Ng,3163
+atp_identity/provider.py,sha256=j1mU-2xC7L-eGIdLTBojMXrsYM4EhK6JkbPKHCHSv04,2897
+atp_identity/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_identity/scope.py,sha256=-4pPwv_yEgijxGsDRHnhBGYnBusrLIjKcOQ2eUWGqwI,4133
+atp_identity/service.py,sha256=MYh1rvGZ79I4ORFfqSWIpZfW7siwiCSSTzClhJK-Zd8,11881
+atp_identity/store.py,sha256=gSjmV0awEqf41nwbZ-nifUbp1IYhUXd5IOXOOPx2duQ,4471
+atp_policy/__init__.py,sha256=Bvjb0XhztNxx4phvJTlcAQMO0jL0-5IdcsQDazQDWrk,1038
+atp_policy/analysis.py,sha256=vbAH8ydEh7AGjB3QSgeenkgtZ3kJ9WEoZTIpXCCG3iU,6768
+atp_policy/base.py,sha256=UZp4dxxSrqouI0DJW6UQknhax819wmXRq3-RksWQ-9I,3052
+atp_policy/declarative.py,sha256=AN5s02XVGylQO0xAtnQbz_GqnIFgKznhJGZBRUcwdho,15596
+atp_policy/directory.py,sha256=3y_eVAFYoayFwW0Qbz7Ngj0sufWt-mkM-bzo9R-_q68,1390
+atp_policy/engine.py,sha256=JC5NCE6GHoupCh1D8iJQfbYpLokgt941Q2J1L2ew4ts,2403
+atp_policy/explain.py,sha256=dZ-WeE8h8lxidK--taKmlxwCxy5dcDza-_YIoS8QFYs,10246
+atp_policy/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_policy/registry.py,sha256=5HnTJLlLUEiG3kNXSXtgOwaN7rMMIYQe4MZUABWeQnU,4105
+atp_policy/policies/__init__.py,sha256=9JSxomjd4mThRnPB_OUaBZV8MfBNsph0Fz-oRpsH0gU,670
+atp_policy/policies/authority.py,sha256=vwbjM-Vd4HKpvXESXCz-opxnTOaj2xPLIoGLKdemSrk,3241
+atp_policy/policies/payments.py,sha256=hLYk40yNmax1R041ZJs15PO40hw7VUWQTrlRhTp1f6c,9505
+atp_gateway/__init__.py,sha256=ELYFCJmXJGrCf3B26JAoN9eP6M_QzfXtuDG0o9zQm_4,565
+atp_gateway/__main__.py,sha256=hOmM2QKRzs-gKm-ecfXS6eLJ_Ub0OO2rbi-Zr7fIWCE,2108
+atp_gateway/api.py,sha256=j5WFcGkkHvszrlPNF-JwVl3PyvU5l7DanLfuAngRuLo,13202
+atp_gateway/app.py,sha256=SKnfh9IEzD5rBugW4diWvEV36LCtITXvgTymoaKTMK0,3032
+atp_gateway/auth.py,sha256=U5YAkt4Zoi4az0MPWl7FRYvXbw4jF67Ycgd7ArwSxPE,2718
+atp_gateway/evidence.py,sha256=MnGI6qXVjum97kFfJCrE4sG7WyyLUzHYS-OK_sWgvVA,4713
+atp_gateway/grants.py,sha256=CRwLpwAuTGLwGixe7n6eW7kfOLPNByq9jljAbItfHUo,9785
+atp_gateway/local.py,sha256=6IwKOapxiv-_A4EY4rOZ7JWAEXPOjPCOmZ1z6J6k4kk,6059
+atp_gateway/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+atp_gateway/reports.py,sha256=a1L7zaREp-92JAQ6XO3Ax2dbQcvRwd4yTUcxq4f8GZI,1842
+atp_gateway/schemas.py,sha256=qQ5c4lcWVloRRV-hvNIn8HszLlpueKZgf91eg5ijIrY,2984
+atp_gateway/service.py,sha256=uR4WehiKFVxwmY1PYsuBRauPfImGFfYRRuyMNykSwjg,29321
+atp_gateway/settings.py,sha256=Xx6Sa6AJ19Y-qoJKw4vsPmu38R25tRGbqB1luweb778,3556
+atp_gateway/tools.py,sha256=V_n43dsTaPQP5WQx5Si_poey903ED3cxvPZq5F9HnCQ,5882
+atp_gateway/wiring.py,sha256=yAAuhJQd0NN1Ct_TvkwZg2JJY0qodedDCUSpfQPXkNs,4928
+agent_trust_plane-0.3.2.dist-info/METADATA,sha256=HvZp5tIJ3uAO7sxF_2JP2_B6At5h8mZtwGaWgYnvtps,13085
+agent_trust_plane-0.3.2.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+agent_trust_plane-0.3.2.dist-info/entry_points.txt,sha256=NjniUmUvyMYvXV0HmfGGGc2gLSP1v8OtI9jYUL5gQZA,80
+agent_trust_plane-0.3.2.dist-info/licenses/LICENSE,sha256=reFTCTIZRQSFNzHX10QcDeTgX4s2ddAlE9TF14fEbpM,1072
+agent_trust_plane-0.3.2.dist-info/RECORD,,

agent_trust_plane-0.3.2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

agent_trust_plane-0.3.2.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+agent-trust-plane = atp_cli.main:main
+atp = atp_cli.main:main

agent_trust_plane-0.3.2.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 George Gakravyi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

atp_adapter_http/__init__.py

@@ -0,0 +1,19 @@
+"""HTTP client SDK for agents talking to the trust gateway."""
+
+from atp_adapter_http.client import (
+    AgentClient,
+    AuthorizeResponse,
+    ExecuteResponse,
+    ExecutionGrant,
+    GatewayError,
+    TrustPlaneClient,
+)
+
+__all__ = [
+    "AgentClient",
+    "AuthorizeResponse",
+    "ExecuteResponse",
+    "ExecutionGrant",
+    "GatewayError",
+    "TrustPlaneClient",
+]

atp_adapter_http/client.py

@@ -0,0 +1,334 @@
+"""Agent-side client for the trust gateway.
+
+An agent framework integrates by building an ``ActionEnvelope`` for every
+consequential tool call and going through ``authorize`` then ``execute``.
+The client never decides anything; it transports envelopes and grants.
+
+``TrustPlaneClient`` speaks HTTP. It can also be pointed at an ASGI app
+in-process (``TrustPlaneClient.for_app(app)``), which is how the eval harness
+exercises the real API without a network.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import weakref
+from typing import Any, Protocol
+
+import httpx
+from pydantic import BaseModel, ConfigDict
+
+from atp_core import ActionEnvelope, Decision, ReasonCode
+
+
+class GatewayError(Exception):
+    def __init__(self, status_code: int, reason_code: str, message: str) -> None:
+        super().__init__(f"{status_code} {reason_code}: {message}")
+        self.status_code = status_code
+        self.reason_code = reason_code
+        self.message = message
+
+
+class ExecutionGrant(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    token: str
+    grant_id: str
+    expires_at: str
+
+
+class AuthorizeResponse(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    decision: Decision
+    execution_grant: ExecutionGrant | None = None
+
+
+class ExecuteResponse(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    trace_id: str
+    envelope_id: str
+    status: str
+    reason_code: ReasonCode
+    message: str
+    result: dict[str, Any] | None = None
+
+    @property
+    def executed(self) -> bool:
+        return self.status == "completed"
+
+
+class AgentClient(Protocol):
+    """The agent-facing subset of the client, implemented over HTTP by
+    ``TrustPlaneClient`` and in-process by ``atp_gateway.local.InProcessAgentClient``.
+    Adapters (the MCP proxy) depend on this, not on a transport."""
+
+    def authorize(
+        self, envelope: ActionEnvelope, *, policy_set_version: str | None = None
+    ) -> AuthorizeResponse: ...
+
+    def execute(
+        self, envelope: ActionEnvelope, grant: ExecutionGrant | str | None
+    ) -> ExecuteResponse: ...
+
+    def report_outcome(
+        self, grant_id: str, *, succeeded: bool, summary: dict[str, Any]
+    ) -> dict[str, Any]: ...
+
+    def report_shadow_outcome(
+        self, trace_id: str, *, succeeded: bool, summary: dict[str, Any]
+    ) -> dict[str, Any]: ...
+
+
+class _SyncASGITransport(httpx.BaseTransport):
+    """Drive an ASGI app from synchronous code over one long-lived event loop.
+
+    httpx's ASGITransport is async-only. A blocking portal keeps a single
+    loop alive in a background thread for the client's lifetime, so each
+    request costs a thread hop rather than a fresh event loop (which made
+    `atp mcp wrap` slower than going over HTTP before v0.3.0).
+    """
+
+    def __init__(self, app: Any) -> None:
+        from anyio.from_thread import start_blocking_portal
+
+        self._asgi = httpx.ASGITransport(app=app)
+        self._portal_cm = start_blocking_portal()
+        self._portal = self._portal_cm.__enter__()
+        # The portal thread is not a daemon; make sure an unclosed client
+        # cannot keep the interpreter alive.
+        weakref.finalize(self, _close_portal, self._portal_cm)
+
+    async def _run(self, request: httpx.Request) -> httpx.Response:
+        response = await self._asgi.handle_async_request(request)
+        await response.aread()
+        return response
+
+    def handle_request(self, request: httpx.Request) -> httpx.Response:
+        response = self._portal.call(self._run, request)
+        return httpx.Response(
+            status_code=response.status_code,
+            headers=response.headers,
+            content=response.content,
+            request=request,
+        )
+
+    def close(self) -> None:
+        _close_portal(self._portal_cm)
+
+
+def _close_portal(cm: Any) -> None:
+    with contextlib.suppress(Exception):
+        cm.__exit__(None, None, None)
+
+
+class TrustPlaneClient:
+    def __init__(
+        self,
+        base_url: str = "http://127.0.0.1:8000",
+        *,
+        timeout: float = 10.0,
+        operator_key: str | None = None,
+        agent_token: str | None = None,
+    ) -> None:
+        self._http = httpx.Client(base_url=base_url, timeout=timeout)
+        self._operator_key = operator_key
+        self._agent_token = agent_token
+
+    @classmethod
+    def for_app(
+        cls, app: Any, *, operator_key: str | None = None, agent_token: str | None = None
+    ) -> TrustPlaneClient:
+        """In-process client over an ASGI app (no sockets, real routing)."""
+        client = cls.__new__(cls)
+        client._http = httpx.Client(
+            transport=_SyncASGITransport(app), base_url="http://trust-plane"
+        )
+        client._operator_key = operator_key
+        client._agent_token = agent_token
+        return client
+
+    @classmethod
+    def from_http(
+        cls, http: httpx.Client, *, operator_key: str | None = None, agent_token: str | None = None
+    ) -> TrustPlaneClient:
+        client = cls.__new__(cls)
+        client._http = http
+        client._operator_key = operator_key
+        client._agent_token = agent_token
+        return client
+
+    def as_agent(self, agent_token: str) -> TrustPlaneClient:
+        """A client sharing this transport but authenticating as an agent.
+        Operator privileges are deliberately not carried over."""
+        client = TrustPlaneClient.__new__(TrustPlaneClient)
+        client._http = self._http
+        client._operator_key = None
+        client._agent_token = agent_token
+        return client
+
+    def as_operator(self, operator_key: str) -> TrustPlaneClient:
+        client = TrustPlaneClient.__new__(TrustPlaneClient)
+        client._http = self._http
+        client._operator_key = operator_key
+        client._agent_token = None
+        return client
+
+    def with_operator(self, operator_key: str) -> TrustPlaneClient:
+        """Keep the agent identity and add operator privileges (operator tooling only)."""
+        client = TrustPlaneClient.__new__(TrustPlaneClient)
+        client._http = self._http
+        client._operator_key = operator_key
+        client._agent_token = self._agent_token
+        return client
+
+    @property
+    def agent_token(self) -> str | None:
+        return self._agent_token
+
+    @property
+    def operator_key(self) -> str | None:
+        return self._operator_key
+
+    def close(self) -> None:
+        self._http.close()
+
+    def __enter__(self) -> TrustPlaneClient:
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()
+
+    # ---------------------------------------------------------------- helpers
+    def _request(self, method: str, path: str, **kwargs: Any) -> Any:
+        headers: dict[str, str] = dict(kwargs.pop("headers", None) or {})
+        if self._agent_token:
+            headers.setdefault("Authorization", f"Bearer {self._agent_token}")
+        if self._operator_key:
+            headers.setdefault("X-ATP-Operator-Key", self._operator_key)
+        response = self._http.request(method, path, headers=headers, **kwargs)
+        if response.status_code >= 400:
+            try:
+                body = response.json()
+            except ValueError:
+                body = {}
+            raise GatewayError(
+                response.status_code,
+                str(body.get("reason_code", "HTTP_ERROR")),
+                str(body.get("message") or body.get("detail") or response.text),
+            )
+        return response.json()
+
+    # ------------------------------------------------------------ operations
+    def authorize(
+        self, envelope: ActionEnvelope, *, policy_set_version: str | None = None
+    ) -> AuthorizeResponse:
+        params = {"policy_set_version": policy_set_version} if policy_set_version else None
+        data = self._request(
+            "POST", "/authorize", json=envelope.model_dump(mode="json"), params=params
+        )
+        return AuthorizeResponse.model_validate(data)
+
+    def execute(
+        self, envelope: ActionEnvelope, grant: ExecutionGrant | str | None
+    ) -> ExecuteResponse:
+        token = grant.token if isinstance(grant, ExecutionGrant) else grant
+        data = self._request(
+            "POST",
+            "/execute",
+            json={"envelope": envelope.model_dump(mode="json"), "execution_grant": token},
+        )
+        return ExecuteResponse.model_validate(data)
+
+    def record_event(
+        self, trace_id: str, event_type: str, payload: dict[str, Any]
+    ) -> dict[str, Any]:
+        """Record provenance as the authenticated agent."""
+        result: dict[str, Any] = self._request(
+            "POST",
+            f"/traces/{trace_id}/events",
+            json={"event_type": event_type, "payload": payload},
+        )
+        return result
+
+    def report_outcome(
+        self, grant_id: str, *, succeeded: bool, summary: dict[str, Any]
+    ) -> dict[str, Any]:
+        """External executor: report the result of a released execution."""
+        result: dict[str, Any] = self._request(
+            "POST",
+            f"/executions/{grant_id}/outcome",
+            json={"succeeded": succeeded, "summary": summary},
+        )
+        return result
+
+    def report_shadow_outcome(
+        self, trace_id: str, *, succeeded: bool, summary: dict[str, Any]
+    ) -> dict[str, Any]:
+        """Shadow mode: report that a WOULD_DENY action was executed anyway."""
+        result: dict[str, Any] = self._request(
+            "POST",
+            f"/traces/{trace_id}/shadow-outcome",
+            json={"succeeded": succeeded, "summary": summary},
+        )
+        return result
+
+    # ----------------------------------------------------------- credentials
+    def issue_credential(
+        self, agent: dict[str, str], label: str, expires_at: str | None = None
+    ) -> dict[str, Any]:
+        """Operator-only. The returned token is shown once."""
+        result: dict[str, Any] = self._request(
+            "POST",
+            f"/agents/{agent['id']}/credentials",
+            json={"agent": agent, "label": label, "expires_at": expires_at},
+        )
+        return result
+
+    def list_credentials(self, agent_id: str) -> list[dict[str, Any]]:
+        """Operator-only. Metadata only; never tokens."""
+        result: list[dict[str, Any]] = self._request("GET", f"/agents/{agent_id}/credentials")
+        return result
+
+    def revoke_credential(self, credential_id: str) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("POST", f"/credentials/{credential_id}/revoke")
+        return result
+
+    def get_trace(self, trace_id: str) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("GET", f"/traces/{trace_id}")
+        return result
+
+    def list_traces(self, limit: int = 50) -> list[dict[str, Any]]:
+        result: list[dict[str, Any]] = self._request("GET", "/traces", params={"limit": limit})
+        return result
+
+    def replay(self, trace_id: str, *, policy_set_version: str | None = None) -> dict[str, Any]:
+        result: dict[str, Any] = self._request(
+            "POST", f"/replay/{trace_id}", json={"policy_set_version": policy_set_version}
+        )
+        return result
+
+    def issue_delegation(self, request: dict[str, Any]) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("POST", "/delegations", json=request)
+        return result
+
+    def revoke_delegation(self, grant_id: str) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("POST", f"/delegations/{grant_id}/revoke")
+        return result
+
+    def policy_sets(self) -> list[dict[str, Any]]:
+        result: list[dict[str, Any]] = self._request("GET", "/policy-sets")
+        return result
+
+    def run_evals(self) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("POST", "/evals/run")
+        return result
+
+    def ledger(self) -> list[dict[str, Any]]:
+        result: list[dict[str, Any]] = self._request("GET", "/ledger/payments")
+        return result
+
+    def health(self) -> dict[str, Any]:
+        result: dict[str, Any] = self._request("GET", "/health")
+        return result