agentgovern 2.3.0__tar.gz → 2.4.0__tar.gz

{agentgovern-2.3.0 → agentgovern-2.4.0}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 2.4.0 — release date is the `sdk-v2.4.0` tag's (prepared 2026-09-30)
+
+### Change — the SDK reaches the policy engine at a stable name, `https://engine.zirahn.com`
+
+`evaluate_input()` (Gate 1) and Gate 2's output checks call the policy engine
+directly. **Versions 2.3.0 and earlier call it at
+`https://agentgovern.onrender.com`, a hostname Render issued for one specific
+service.** Render cannot move a service to another region: a new service
+means a new hostname. So an SDK pinned to that name cannot follow the engine
+if it moves.
+
+- The default `policy_engine_url` is now **`https://engine.zirahn.com`**. It
+  is a custom domain pointing at the same engine today, so **latency and
+  behaviour are unchanged**. What changes is that a future move of the engine
+  needs no SDK release.
+- **2.3.0 and earlier keep working.** `agentgovern.onrender.com` still
+  serves the same engine, and it will not be removed while any supported
+  version defaults to it. Upgrading moves you to the stable name:
+  `pip install --upgrade agentgovern`.
+- **Overrides are unchanged.** The `policy_engine_url` argument to `init()`,
+  then the `AGENTGOVERN_POLICY_ENGINE_URL` environment variable, still take
+  precedence over the default. **If you set either yourself, you are not
+  affected.**
+- The Claude Code hook is unaffected. It reaches the engine through the
+  dashboard's API, not directly.
+
 ## 2.3.0 — release date is the `sdk-v2.3.0` tag's (prepared 2026-09-29)
 
 ### Security — the Claude Code hook now sees every tool call, but only after you reinstall it (NAGT-187)

{agentgovern-2.3.0 → agentgovern-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgovern
-Version: 2.3.0
+Version: 2.4.0
 Summary: Compliance-as-code middleware for agentic AI workflows.
 Project-URL: Homepage, https://agentgovern.zirahn.com
 Project-URL: Repository, https://github.com/ahmedkhan-zirahn/agentgovern
@@ -190,8 +190,15 @@ Enable policy packs from the [AgentGovern dashboard](https://agentgovern.zirahn.
 | `api_key` | required | SDK ingest key from the dashboard |
 | `base_url` | `https://agentgovern.zirahn.com` | API endpoint |
 | `environment` | `"production"` | `"production"` \| `"staging"` \| `"development"` |
+| `policy_engine_url` | `https://engine.zirahn.com` | Policy engine endpoint for Gate 1 (`evaluate_input`) and Gate 2 checks. Override with this argument or the `AGENTGOVERN_POLICY_ENGINE_URL` env var |
 | `fail_silently` | `True` | If `True`, SDK errors never raise into your agent |
 
+**Policy engine address (2.4.0).** The default engine address is now the stable name
+`https://engine.zirahn.com`. Versions 2.3.0 and earlier call `https://agentgovern.onrender.com`
+directly. That address keeps working, so nothing breaks if you stay on an older version, but only
+the stable name can follow the engine if it moves. Upgrade with `pip install --upgrade agentgovern`.
+If you set `policy_engine_url` or `AGENTGOVERN_POLICY_ENGINE_URL` yourself, it still takes precedence.
+
 ## Claude Code Hook
 
 The SDK ships a built-in CLI for installing the AgentGovern hook into Claude Code. The hook

{agentgovern-2.3.0 → agentgovern-2.4.0}/README.md

@@ -147,8 +147,15 @@ Enable policy packs from the [AgentGovern dashboard](https://agentgovern.zirahn.
 | `api_key` | required | SDK ingest key from the dashboard |
 | `base_url` | `https://agentgovern.zirahn.com` | API endpoint |
 | `environment` | `"production"` | `"production"` \| `"staging"` \| `"development"` |
+| `policy_engine_url` | `https://engine.zirahn.com` | Policy engine endpoint for Gate 1 (`evaluate_input`) and Gate 2 checks. Override with this argument or the `AGENTGOVERN_POLICY_ENGINE_URL` env var |
 | `fail_silently` | `True` | If `True`, SDK errors never raise into your agent |
 
+**Policy engine address (2.4.0).** The default engine address is now the stable name
+`https://engine.zirahn.com`. Versions 2.3.0 and earlier call `https://agentgovern.onrender.com`
+directly. That address keeps working, so nothing breaks if you stay on an older version, but only
+the stable name can follow the engine if it moves. Upgrade with `pip install --upgrade agentgovern`.
+If you set `policy_engine_url` or `AGENTGOVERN_POLICY_ENGINE_URL` yourself, it still takes precedence.
+
 ## Claude Code Hook
 
 The SDK ships a built-in CLI for installing the AgentGovern hook into Claude Code. The hook

agentgovern-2.4.0/RELEASING.md

@@ -0,0 +1,72 @@
+# Releasing agentgovern to PyPI
+
+Releases are automated via `.github/workflows/publish-sdk.yml` using PyPI trusted publishing (OIDC — no API tokens needed). Pushing a `sdk-v*` tag triggers a build and publish automatically.
+
+## Prerequisites (one-time PyPI setup)
+
+Before the first automated publish, configure trusted publishing on PyPI:
+
+1. Go to https://pypi.org/manage/project/agentgovern/settings/publishing/
+2. Add a new trusted publisher with these exact values:
+
+   | Field             | Value                        |
+   |-------------------|------------------------------|
+   | Owner             | ZirahnAI                     |
+   | Repository name   | agentgovern                  |
+   | Workflow filename | publish-sdk.yml              |
+   | Environment name  | pypi                         |
+
+   **Note:** the repository moved from `ahmedkhan-zirahn` to `ZirahnAI` in September 2026. A publisher for the old owner existed and was **deleted on 2026-09-14**. A trusted publisher that names a path the organisation no longer controls is a standing binding to a namespace someone else could later claim. See NAGT-314 in `docs/ROADMAP.md`.
+
+3. Save. No API token needed after this.
+
+Also create the `pypi` environment in GitHub, and restrict it to release tags:
+- Go to https://github.com/ZirahnAI/agentgovern/settings/environments
+- Create the environment named `pypi`.
+- Under **Deployment branches and tags**, choose **Selected branches and tags** and add a **tag** rule `sdk-v*`. The publish job carries `environment: pypi`, so it can only run from an `sdk-v*` tag.
+- **Required reviewers is not available here.** GitHub offers it for environments in private repositories only on Enterprise, and this repository is private on the Team plan (operator-confirmed 2026-09-30). So the publish does not pause for approval. **Pushing the tag is the release decision.**
+- Optionally, add a repository **tag ruleset** on `refs/tags/sdk-v*` that restricts creation to admins. One named "sdk release tags" exists. It was **not enforced** when checked on 2026-09-30, so it has no effect until its enforcement is set to Active.
+
+Check the environment with `gh api repos/ZirahnAI/agentgovern/environments/pypi/deployment-branch-policies`, which should list `{"name": "sdk-v*", "type": "tag"}`.
+
+## Release steps
+
+1. **Bump the version** in two places:
+   ```
+   packages/sdk-python/agentgovern/_version.py   → __version__ = "0.X.Y"
+   packages/sdk-python/pyproject.toml             → version = "0.X.Y"
+   ```
+
+2. **Add a CHANGELOG entry** (if `CHANGELOG.md` exists) describing what changed.
+
+3. **Commit the version bump:**
+   ```bash
+   git add packages/sdk-python/agentgovern/_version.py packages/sdk-python/pyproject.toml
+   git commit -m "chore(sdk): bump version to 0.X.Y"
+   git push
+   ```
+
+4. **Tag the merged commit and push that one tag.** Never `git push --tags`, which pushes every local tag, and any stray `sdk-v*` among them would publish:
+   ```bash
+   git fetch origin
+   git tag sdk-v0.X.Y <merged-commit-sha>
+   git push origin sdk-v0.X.Y
+   ```
+
+   The `publish-sdk.yml` workflow triggers on the tag push. It builds, checks the wheel's declared dependencies, installs that exact wheel in a clean venv, and then publishes to PyPI. **There is no approval step** (see above). PyPI never accepts a version twice, so a mistaken tag uses up that version for good.
+
+5. **Verify** at https://pypi.org/project/agentgovern/ — the new version should appear within a few minutes.
+
+## Manual fallback (workflow_dispatch)
+
+To re-run a publish after a failed run, trigger the workflow manually **from the release tag**:
+
+1. Go to https://github.com/ZirahnAI/agentgovern/actions/workflows/publish-sdk.yml
+2. Click **Run workflow**, choose the **tag** `sdk-v0.X.Y` under "Use workflow from", then **Run workflow**.
+
+**A run dispatched from `main` (or any branch) cannot publish.** Its build job runs, but the publish job targets the `pypi` environment, which only accepts `sdk-v*` tags. That comes from the environment restriction above, per GitHub's documented behaviour; it has not been tested by dispatching from `main`. The run publishes whatever version `pyproject.toml` says at that ref.
+
+## Trusted-publisher history
+
+- **2026-09-14:** run `34876650141` (dispatched from `main`) authenticated through the `ZirahnAI/agentgovern` publisher. PyPI then refused to re-upload 2.2.1 (`400 File already exists`), so the run's conclusion was `failure`.
+- **2026-09-30:** 2.3.0 was the first version published end to end from the `ZirahnAI` repository, by run `36667118357` from tag `sdk-v2.3.0`.

{agentgovern-2.3.0 → agentgovern-2.4.0}/agentgovern/__init__.py

@@ -151,7 +151,7 @@ def init(
         base_url: Vercel deployment URL (action ingest + agent registration).
         policy_engine_url: Render policy engine URL (Gate 1 evaluate/input).
             Defaults to ``AGENTGOVERN_POLICY_ENGINE_URL`` env var, then
-            ``https://agentgovern.onrender.com``.
+            ``https://engine.zirahn.com``.
         fail_silently: If ``True``, SDK errors never raise into your agent,
             after initialisation. It does not affect this function.
     """

agentgovern-2.4.0/agentgovern/_version.py

@@ -0,0 +1 @@
+__version__ = "2.4.0"

{agentgovern-2.3.0 → agentgovern-2.4.0}/agentgovern/client.py

@@ -53,6 +53,13 @@ def _iso_timestamp_utc(dt: datetime | None = None) -> str:
     return dt.strftime("%Y-%m-%dT%H:%M:%S.") + f"{dt.microsecond // 1000:03d}Z"
 
 
+# The policy engine's stable name. SDK <= 2.3.0 defaulted to the Render-issued
+# hostname https://agentgovern.onrender.com, which names one Render service and
+# cannot follow the engine to a new one (Render cannot change a service's
+# region: docs/audit-reports/engine-region-move-phase1-2026-09-30.md). A custom
+# domain can be re-pointed, so a future engine move needs no SDK release.
+DEFAULT_POLICY_ENGINE_URL = "https://engine.zirahn.com"
+
 _FLUSH_INTERVAL = 1.0  # seconds between automatic flushes
 _BATCH_SIZE = 100  # flush early when buffer hits this
 _BUFFER_MAXLEN = 10_000  # drop oldest when full
@@ -107,7 +114,7 @@ class AgentGovernClient:
         self.policy_engine_url = (
             policy_engine_url
             or os.environ.get("AGENTGOVERN_POLICY_ENGINE_URL")
-            or "https://agentgovern.onrender.com"
+            or DEFAULT_POLICY_ENGINE_URL
         ).rstrip("/")
         self.fail_silently = fail_silently
         self.batch_size = batch_size

{agentgovern-2.3.0 → agentgovern-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentgovern"
-version = "2.3.0"
+version = "2.4.0"
 description = "Compliance-as-code middleware for agentic AI workflows."
 readme = "README.md"
 license = { text = "MIT" }

agentgovern-2.4.0/tests/test_policy_engine_url.py

@@ -0,0 +1,79 @@
+"""How the SDK resolves the policy engine URL (2.4.0: default moved to engine.zirahn.com).
+
+Precedence is unchanged: the ``policy_engine_url`` argument, then the
+``AGENTGOVERN_POLICY_ENGINE_URL`` env var, then the default. No network call is
+made: nothing is queued, and flush_interval=999 keeps the periodic flush asleep.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+import pytest
+
+import agentgovern
+from agentgovern import client as client_mod
+from agentgovern.client import DEFAULT_POLICY_ENGINE_URL, AgentGovernClient
+
+ENV = "AGENTGOVERN_POLICY_ENGINE_URL"
+
+
+@pytest.fixture
+def make_client() -> Iterator:
+    made: list[AgentGovernClient] = []
+
+    def _make(**kwargs) -> AgentGovernClient:
+        c = AgentGovernClient(
+            api_key="ag_test_key",
+            environment="development",
+            base_url="http://localhost:3000",
+            flush_interval=999,
+            **kwargs,
+        )
+        made.append(c)
+        return c
+
+    yield _make
+    for c in made:
+        c.shutdown(timeout=2.0)
+
+
+def test_default_is_the_stable_custom_domain(make_client, monkeypatch) -> None:
+    monkeypatch.delenv(ENV, raising=False)
+    assert make_client().policy_engine_url == "https://engine.zirahn.com"
+
+
+def test_default_is_no_longer_the_render_hostname(make_client, monkeypatch) -> None:
+    monkeypatch.delenv(ENV, raising=False)
+    assert "onrender.com" not in make_client().policy_engine_url
+    assert "onrender.com" not in DEFAULT_POLICY_ENGINE_URL
+
+
+def test_env_var_overrides_the_default(make_client, monkeypatch) -> None:
+    monkeypatch.setenv(ENV, "https://engine.example.test/")
+    assert make_client().policy_engine_url == "https://engine.example.test"
+
+
+def test_argument_overrides_env_and_default(make_client, monkeypatch) -> None:
+    monkeypatch.setenv(ENV, "https://from-env.example.test")
+    c = make_client(policy_engine_url="https://from-arg.example.test")
+    assert c.policy_engine_url == "https://from-arg.example.test"
+
+
+def test_old_host_still_selectable_explicitly(make_client, monkeypatch) -> None:
+    # Pinning the pre-2.4.0 host keeps working: the override path is unchanged.
+    monkeypatch.delenv(ENV, raising=False)
+    c = make_client(policy_engine_url="https://agentgovern.onrender.com")
+    assert c.policy_engine_url == "https://agentgovern.onrender.com"
+
+
+def test_init_docstring_names_the_actual_default() -> None:
+    # Derived from the constant, so the docstring cannot drift from the code.
+    assert DEFAULT_POLICY_ENGINE_URL in (agentgovern.init.__doc__ or "")
+
+
+def test_no_other_default_literal_in_client_source() -> None:
+    # The constant is the single source: no second hard-coded engine host.
+    src = open(client_mod.__file__, encoding="utf-8").read()
+    assert src.count(f'"{DEFAULT_POLICY_ENGINE_URL}"') == 1
+    assert '"https://agentgovern.onrender.com"' not in src

agentgovern-2.3.0/RELEASING.md

@@ -1,65 +0,0 @@
-# Releasing agentgovern to PyPI
-
-Releases are automated via `.github/workflows/publish-sdk.yml` using PyPI trusted publishing (OIDC — no API tokens needed). Pushing a `sdk-v*` tag triggers a build and publish automatically.
-
-## Prerequisites (one-time PyPI setup)
-
-Before the first automated publish, configure trusted publishing on PyPI:
-
-1. Go to https://pypi.org/manage/project/agentgovern/settings/publishing/
-2. Add a new trusted publisher with these exact values:
-
-   | Field             | Value                        |
-   |-------------------|------------------------------|
-   | Owner             | ZirahnAI                     |
-   | Repository name   | agentgovern                  |
-   | Workflow filename | publish-sdk.yml              |
-   | Environment name  | pypi                         |
-
-   **Note:** the repository moved from `ahmedkhan-zirahn` to `ZirahnAI` in September 2026. A publisher for the old owner existed and was **deleted on 2026-09-14**. A trusted publisher that names a path the organisation no longer controls is a standing binding to a namespace someone else could later claim. See NAGT-314 in `docs/ROADMAP.md`.
-
-3. Save. No API token needed after this.
-
-Also create the `pypi` environment in GitHub:
-- Go to https://github.com/ZirahnAI/agentgovern/settings/environments
-- Create environment named `pypi` (no protection rules required)
-
-## Release steps
-
-1. **Bump the version** in two places:
-   ```
-   packages/sdk-python/agentgovern/_version.py   → __version__ = "0.X.Y"
-   packages/sdk-python/pyproject.toml             → version = "0.X.Y"
-   ```
-
-2. **Add a CHANGELOG entry** (if `CHANGELOG.md` exists) describing what changed.
-
-3. **Commit the version bump:**
-   ```bash
-   git add packages/sdk-python/agentgovern/_version.py packages/sdk-python/pyproject.toml
-   git commit -m "chore(sdk): bump version to 0.X.Y"
-   git push
-   ```
-
-4. **Tag and push:**
-   ```bash
-   git tag sdk-v0.X.Y
-   git push --tags
-   ```
-
-   The `publish-sdk.yml` workflow triggers automatically on the tag push and publishes to PyPI.
-
-5. **Verify** at https://pypi.org/project/agentgovern/ — the new version should appear within a few minutes.
-
-## Manual fallback (workflow_dispatch)
-
-If you need to publish without tagging (e.g., to re-publish after a failed run), trigger the workflow manually:
-
-1. Go to https://github.com/ZirahnAI/agentgovern/actions/workflows/publish-sdk.yml
-2. Click **Run workflow** → select branch `main` → **Run workflow**
-
-The manual run builds and publishes whatever version is currently in `packages/sdk-python/pyproject.toml`. Make sure the version in `pyproject.toml` and `_version.py` match before triggering.
-
-## First smoke test
-
-Ahmed will run the first publish manually via `workflow_dispatch` before tagging any release. This confirms the OIDC trusted publisher config is wired correctly end-to-end.

agentgovern-2.3.0/agentgovern/_version.py

@@ -1 +0,0 @@
-__version__ = "2.3.0"