agentgov-core 0.1.0__tar.gz

agentgov_core-0.1.0/.gitignore

@@ -0,0 +1,54 @@
+# --- secrets / credentials (NEVER commit) ---
+.env
+.env.*
+# the template IS committed (no real secrets in it) — keep this negation on its own line;
+# git does NOT support inline comments, so a trailing `# ...` here would break the un-ignore.
+!.env.example
+*.pem
+*.key
+*_secret*
+**/secrets/**
+.mcp.json               # contains per-user OAuth; keep a .mcp.json.example instead
+aws-credentials*
+okta-token*
+servicenow-creds*
+
+# --- python ---
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+.pytest_cache/
+*.egg-info/
+
+# --- node / react ---
+node_modules/
+dist/
+build/
+.vite/
+*.tsbuildinfo
+
+# --- terraform (not used, but ignore if anyone adds it) ---
+*.tfstate
+*.tfstate.*
+.terraform/
+
+# --- os / editor ---
+.DS_Store
+.idea/
+.vscode/*
+!.vscode/extensions.json
+*.log
+
+# --- local dev harness (dev-only; see local/README.md) ---
+local/identity/keys/
+local/*.pid
+local/*.log
+local/.signoz_state.json
+
+# --- local data / scratch (synthetic seed IS committed; local dumps are not) ---
+/tmp/
+*.local.json
+seed/**/local-*
+# large binaries — track via LFS or attach separately, not inline
+docs/design/*.docx

agentgov_core-0.1.0/PKG-INFO

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: agentgov-core
+Version: 0.1.0
+Summary: Shared invoke-boundary core for agent-governance-demo: host adapters, entitlement/policy resolution, the governance envelope, and the registry Postgres schema. Not published to PyPI yet — built as a local wheel and installed into registry-api/services-workflows images (Phase 5 §5.8).
+Author-email: "receptor.bio" <oss@receptor.bio>
+License: Apache-2.0
+Requires-Python: >=3.10
+Requires-Dist: botocore
+Requires-Dist: cryptography
+Requires-Dist: fastapi
+Requires-Dist: httpx
+Requires-Dist: psycopg[binary]
+Requires-Dist: pyjwt
+Description-Content-Type: text/markdown
+
+# agentgov-core
+
+Shared invoke-boundary core for [`agent-governance-demo`](https://github.com/receptor-bio/agent-governance-demo):
+per-platform host adapters (`hosts/`), the governance envelope (`envelope.py`), entitlement/policy
+resolution (`openfga.py`, `cedar.py`), the registry Postgres access layer + schema (`db.py`,
+`schema.sql`), and the shared URN/tuple helpers (`urns.py`, `tuples.py`) that `registry-api` and
+`services/workflows` both consume — replacing the `sys.path` trick `services/workflows/activities.py`
+previously used to reach `registry-api`'s app code directly.
+
+**Not published to PyPI yet.** Built as a local wheel in each consuming Dockerfile's multi-stage
+build, and installed with `pip install -e packages/agentgov-core` for local dev. See
+`docs/PHASE_STATUS.md`'s Phase 5 §5.8 entry for the plan to publish it for real via PyPI Trusted
+Publishing (the same OIDC pattern `receptor-bio/axiom-sc` already uses) — deferred, not blocking.
+
+Not a general-purpose library: this package's boundary is driven entirely by what
+`services/workflows/activities.py` and `services/registry-api/app/` actually import, not by any
+external API-design goal.

agentgov_core-0.1.0/README.md

@@ -0,0 +1,17 @@
+# agentgov-core
+
+Shared invoke-boundary core for [`agent-governance-demo`](https://github.com/receptor-bio/agent-governance-demo):
+per-platform host adapters (`hosts/`), the governance envelope (`envelope.py`), entitlement/policy
+resolution (`openfga.py`, `cedar.py`), the registry Postgres access layer + schema (`db.py`,
+`schema.sql`), and the shared URN/tuple helpers (`urns.py`, `tuples.py`) that `registry-api` and
+`services/workflows` both consume — replacing the `sys.path` trick `services/workflows/activities.py`
+previously used to reach `registry-api`'s app code directly.
+
+**Not published to PyPI yet.** Built as a local wheel in each consuming Dockerfile's multi-stage
+build, and installed with `pip install -e packages/agentgov-core` for local dev. See
+`docs/PHASE_STATUS.md`'s Phase 5 §5.8 entry for the plan to publish it for real via PyPI Trusted
+Publishing (the same OIDC pattern `receptor-bio/axiom-sc` already uses) — deferred, not blocking.
+
+Not a general-purpose library: this package's boundary is driven entirely by what
+`services/workflows/activities.py` and `services/registry-api/app/` actually import, not by any
+external API-design goal.

agentgov_core-0.1.0/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "agentgov-core"
+version = "0.1.0"
+description = "Shared invoke-boundary core for agent-governance-demo: host adapters, entitlement/policy resolution, the governance envelope, and the registry Postgres schema. Not published to PyPI yet — built as a local wheel and installed into registry-api/services-workflows images (Phase 5 §5.8)."
+readme = "README.md"
+license = {text = "Apache-2.0"}
+# >=3.10, not >=3.11: local dev's .venv (created by run_phase0.sh via `uv venv`) is 3.10.19 — Docker
+# images (python:3.11-slim) satisfy this too, so this is the real floor, not the container version.
+requires-python = ">=3.10"
+authors = [{name = "receptor.bio", email = "oss@receptor.bio"}]
+dependencies = [
+    "psycopg[binary]",
+    "httpx",
+    "fastapi",
+    "pyjwt",
+    "cryptography",
+    "botocore",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agentgov_core"]

agentgov_core-0.1.0/src/agentgov_core/cedar.py

@@ -0,0 +1,56 @@
+"""cedar-agent client (permitio/cedar-agent HTTP API).
+
+Runs schemaless locally: we load the policy set and evaluate with an inline context
+carrying { employment, classification }. A Cedar *forbid* overrides *permit*, which is
+how the contractor+RESTRICTED denial works.
+"""
+import re
+
+import httpx
+
+from .config import settings
+
+TIMEOUT = 10.0
+
+
+def split_statements(text: str) -> list[str]:
+    """cedar-agent stores ONE Cedar statement per policy entry. Strip // comments and
+    split the policy set on statement terminators (';' only ends statements here)."""
+    no_comments = "\n".join(re.sub(r"//.*$", "", line) for line in text.splitlines())
+    return [s.strip() + ";" for s in no_comments.split(";") if s.strip()]
+
+
+class Cedar:
+    def __init__(self, base_url=None):
+        self.base = (base_url or settings.CEDAR_URL).rstrip("/")
+
+    def load_policies(self, policy_text: str | None = None):
+        """Replace the cedar-agent policy set with services/policy/policies.cedar."""
+        if policy_text is None:
+            with open(settings.CEDAR_POLICIES_PATH) as f:
+                policy_text = f.read()
+        # cedar-agent stores a list of {id, content}, one statement each. PUT replaces the set.
+        body = [{"id": f"agentgov_{i}", "content": s} for i, s in enumerate(split_statements(policy_text))]
+        r = httpx.put(f"{self.base}/v1/policies", json=body, timeout=TIMEOUT)
+        r.raise_for_status()
+        return r.json()
+
+    def is_authorized(self, principal_id: str, action: str, resource_id: str, context: dict,
+                      resource_type: str = "Agent") -> bool:
+        """Return True on Allow. action is 'discover' | 'use'. ``resource_type`` is ``Agent``
+        or (Phase 2) ``McpServer`` — the classification/contractor policies are written
+        resource-agnostic on purpose, so a governed MCP server is judged by exactly the same
+        rules as an agent."""
+        body = {
+            "principal": f'User::"{principal_id}"',
+            "action": f'Action::"{action}"',
+            "resource": f'{resource_type}::"{resource_id}"',
+            "context": context,
+        }
+        r = httpx.post(f"{self.base}/v1/is_authorized", json=body, timeout=TIMEOUT)
+        r.raise_for_status()
+        decision = r.json().get("decision", "Deny")
+        return str(decision).lower() == "allow"
+
+
+cedar = Cedar()

agentgov_core-0.1.0/src/agentgov_core/config.py

@@ -0,0 +1,128 @@
+"""Runtime configuration for registry-api (env-driven; local defaults for docker-compose)."""
+import os
+
+
+class Settings:
+    # Path-prefix awareness (BUILD_PLAN §9). Locally the api answers at /assets/registry/api.
+    ROOT_PATH = os.getenv("ROOT_PATH", "/assets/registry/api")
+
+    # Postgres (spine).
+    DB_URL = os.getenv(
+        "DB_URL", "postgresql://agentgov:dev@localhost:5432/agentgov"
+    )
+
+    # OpenFGA (spine). Store is resolved by name so ids need not be plumbed around.
+    OPENFGA_API_URL = os.getenv("OPENFGA_API_URL", "http://localhost:8080")
+    OPENFGA_STORE_NAME = os.getenv("OPENFGA_STORE_NAME", "agentgov")
+
+    # Cedar (spine).
+    CEDAR_URL = os.getenv("CEDAR_URL", "http://localhost:8180")
+    # Local-dev-only convenience default (Cedar.load_policies() reads this when called with no
+    # explicit policy_text, which is how registry-api's own startup calls it — see main.py).
+    # `services/policy/` is an outer-repo fixture this shared package has no business locating via
+    # __file__ trickery (that broke when this module moved out of services/registry-api/app/ in
+    # Phase 5 §5.8 — __file__ no longer sits inside the repo tree at a fixed depth). Relative-to-cwd
+    # is correct here because run_phase*.sh always launches registry-api's uvicorn process with cwd
+    # = services/registry-api (`cd services/registry-api && ... exec uvicorn ...`), never repo root.
+    # NOT reachable at all inside the deployed Docker image today (services/policy/ isn't copied in)
+    # — pre-existing gap, not introduced or fixed by this change; real deployments would need it
+    # added to the Dockerfile if/when this startup call needs to succeed there too.
+    CEDAR_POLICIES_PATH = os.getenv("CEDAR_POLICIES_PATH", "../policy/policies.cedar")
+
+    # Local mock-Okta JWT verification. In real Okta this is a JWKS URL; locally we verify
+    # against a PEM public key on disk (no network dependency for the demo). Same cwd-relative
+    # reasoning as CEDAR_POLICIES_PATH above — real deployments never hit this path at all, they
+    # set JWT_JWKS_URL instead.
+    JWT_PUBLIC_KEY_PATH = os.getenv("JWT_PUBLIC_KEY_PATH", "../../local/identity/keys/public.pem")
+    JWT_ISSUER = os.getenv("JWT_ISSUER", "https://mock-okta.receptor.local/oauth2")
+    JWT_AUDIENCE = os.getenv("JWT_AUDIENCE", "agent-registry")
+    # Real Okta: set JWT_JWKS_URL to the authz server's JWKS
+    # (https://<domain>/oauth2/<authServerId>/v1/keys) and JWT_ISSUER to its issuer.
+    # When set, tokens are verified against Okta's rotating keys instead of the local PEM;
+    # when empty (default), the local mock PEM path is used. Nothing else changes.
+    JWT_JWKS_URL = os.getenv("JWT_JWKS_URL", "")
+    # Allow disabling signature verification only for offline unit poking; default on.
+    JWT_VERIFY = os.getenv("JWT_VERIFY", "1") == "1"
+
+    # OTel. If no OTLP endpoint is set we still emit spans to stdout (ConsoleSpanExporter)
+    # so the Phase-0 DoD ("discover emits a trace w/ authz span-event") is observable locally.
+    OTLP_ENDPOINT = os.getenv("OTEL_EXPORTER_OTLP_ENDPOINT", "")
+    OTEL_CONSOLE = os.getenv("OTEL_CONSOLE", "1") == "1"
+    SERVICE_NAME = os.getenv("OTEL_SERVICE_NAME", "registry-api")
+    # Phase 3 — the SDK default (60s) makes SigNoz-backed usage assertions slow to observe
+    # locally; the local test harness shortens this the same way it shortens ACCESS_TTL_MINUTES.
+    OTEL_METRIC_EXPORT_INTERVAL_MS = int(os.getenv("OTEL_METRIC_EXPORT_INTERVAL_MS", "60000"))
+
+    # Phase 1 — Temporal (spine).
+    TEMPORAL_ADDRESS = os.getenv("TEMPORAL_ADDRESS", "localhost:7233")
+    TEMPORAL_TASK_QUEUE = os.getenv("TEMPORAL_TASK_QUEUE", "agentgov-access")
+
+    # Phase 1 — ServiceNow. Local dev talks to the mock shim (local/servicenow_mock);
+    # swap SERVICENOW_URL to the real PDI once provisioned, hook contract stays identical.
+    SERVICENOW_URL = os.getenv("SERVICENOW_URL", "http://localhost:8300")
+    # Shared secret authenticating the ServiceNow -> registry-api webhook (dev-only default;
+    # real deployments source this from AWS Secrets Manager per CLAUDE.md).
+    SERVICENOW_WEBHOOK_SECRET = os.getenv("SERVICENOW_WEBHOOK_SECRET", "local-dev-servicenow-secret")
+
+    # Governance policy knobs (BUILD_PLAN Phase 1 DoD: "10-min TTL expiry"). Configurable via
+    # env so the local test harness can shrink them for fast iteration; the demo/prod default
+    # is the real 10-minute TTL. Never accepted as a per-request client override.
+    ACCESS_TTL_MINUTES = float(os.getenv("ACCESS_TTL_MINUTES", "10"))
+    ACCESS_SLA_MINUTES = float(os.getenv("ACCESS_SLA_MINUTES", "60"))
+
+    # ---------------------------------------------------------------- Phase 1 seam: real ServiceNow
+    # Table-API auth for the real PDI (docs/setup/servicenow.md §4/§6). Empty = the local mock,
+    # which needs no auth and returns bare records; set both to switch to the real instance.
+    SERVICENOW_USER = os.getenv("SERVICENOW_USER", "")
+    SERVICENOW_PASSWORD = os.getenv("SERVICENOW_PASSWORD", "")
+
+    # ---------------------------------------------------------------- Phase 2: four hosts
+    # 'mock' points every adapter at local/hosts_mock (same contract, no cloud spend);
+    # 'real' points at the platforms themselves. Only URLs/credentials differ — BUILD_PLAN §Phase 2.
+    HOSTS_MODE = os.getenv("AGENTGOV_HOSTS_MODE", "mock")
+    HOSTS_MOCK_URL = os.getenv("AGENTGOV_HOSTS_MOCK_URL", "http://localhost:8400")
+
+    LITELLM_URL = os.getenv("LITELLM_URL", "")            # real: http://litellm:4000
+    LITELLM_MASTER_KEY = os.getenv("LITELLM_MASTER_KEY", "sk-agentgov-local-master")
+
+    # AgentCore: the GATEWAY's credentials. Never the user's, and never a static key in real mode —
+    # app/hosts/agentcore.py::_gateway_credentials() resolves the ECS task role's temporary STS
+    # credentials from the ambient AWS chain instead (§5.7). These two are MOCK-ONLY fallbacks
+    # (local/hosts_mock doesn't touch real AWS, so fixed demo values are fine there).
+    AGENTCORE_URL = os.getenv("AGENTCORE_URL", "")
+    AGENTCORE_REGION = os.getenv("AGENTCORE_REGION", "us-east-1")
+    AGENTCORE_ACCESS_KEY_ID = os.getenv("AGENTCORE_ACCESS_KEY_ID", "AKIAAGENTGOVDEMO0000")
+    AGENTCORE_SECRET_ACCESS_KEY = os.getenv("AGENTCORE_SECRET_ACCESS_KEY", "agentgov-local-dev-agentcore-secret")
+
+    DATABRICKS_URL = os.getenv("DATABRICKS_URL", "")      # real: https://<workspace>.cloud.databricks.com
+    DATABRICKS_UC_SECURABLE = os.getenv("DATABRICKS_UC_SECURABLE", "iops.manufacturing")
+    # Privileged admin bearer (PAT or OAuth token scoped to SCIM + Unity Catalog + Apps) the
+    # GATEWAY uses for JIT identity: SCIM CREATE USER + UC GRANT/REVOKE. Never a user token.
+    # Empty in mock (the mock host doesn't check it).
+    DATABRICKS_TOKEN = os.getenv("DATABRICKS_TOKEN", "")
+
+    SNOWFLAKE_URL = os.getenv("SNOWFLAKE_URL", "")        # real: https://<account>.snowflakecomputing.com
+    SNOWFLAKE_ROLE_SCOPE = os.getenv("SNOWFLAKE_ROLE_SCOPE", "session:role:GD_CLINICAL_READER")
+    # Privileged key-pair for JIT CREATE USER / GRANT / REVOKE (the gateway's admin identity).
+    # Store the PRIVATE KEY, not a pre-minted JWT — key-pair JWTs expire in <=1h, so the adapter
+    # signs a fresh one per call (app/hosts/snowflake.py::_admin_jwt). Never a user token.
+    # Secret: agentgov/prod/snowflake-admin {account,user,private_key,private_key_passphrase}.
+    SNOWFLAKE_ADMIN_ACCOUNT = os.getenv("SNOWFLAKE_ADMIN_ACCOUNT", "")           # e.g. AULMROR-NLC43968
+    SNOWFLAKE_ADMIN_USER = os.getenv("SNOWFLAKE_ADMIN_USER", "")                # SECURITYADMIN-capable user
+    SNOWFLAKE_ADMIN_ROLE = os.getenv("SNOWFLAKE_ADMIN_ROLE", "SECURITYADMIN")
+    SNOWFLAKE_ADMIN_PRIVATE_KEY = os.getenv("SNOWFLAKE_ADMIN_PRIVATE_KEY", "")   # PKCS8 PEM
+    SNOWFLAKE_ADMIN_PRIVATE_KEY_PASSPHRASE = os.getenv("SNOWFLAKE_ADMIN_PRIVATE_KEY_PASSPHRASE", "")
+
+    # HostDiscoverySync (Temporal Schedule). Shrunk by the local harness so a scheduled sync
+    # is observable during a test run; the demo/prod default is hourly.
+    HOST_SYNC_INTERVAL_MINUTES = float(os.getenv("HOST_SYNC_INTERVAL_MINUTES", "60"))
+    PULL_HOSTS = [h.strip() for h in os.getenv(
+        "AGENTGOV_PULL_HOSTS", "bedrock-agentcore,databricks,snowflake").split(",") if h.strip()]
+
+    # Browser origins allowed to call the API (the local registry-ui page; the deployed UI is
+    # same-origin behind the ALB path prefix, so this stays a dev convenience).
+    CORS_ORIGINS = [o.strip() for o in os.getenv(
+        "CORS_ORIGINS", "http://localhost:8500,http://127.0.0.1:8500").split(",") if o.strip()]
+
+
+settings = Settings()