agenticdome-python-sdk 1.2.36__tar.gz → 1.2.37__tar.gz

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.36
+Version: 1.2.37
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -182,7 +182,16 @@ certified onboarding path, obtain the assigned sidecar and a dedicated
 local exact diff and change summary, explicitly approve a supported edit or
 attach other boundaries manually, then run
 `agenticdome verify --run-tests --output .agenticdome/verification.json`.
-Preview obtains the private, signed, catalog-bound semantic plan and keeps
+
+If a coding assistant has already made and tested the application edits,
+import its canonical `AgenticDome_Integration.md` in the customer portal and
+run `agenticdome validate-report --report AgenticDome_Integration.md` from
+that same deployable workload. Import the two generated, hash-bound JSON files
+in Onboarding. This avoids repeating the guided edit plan; the Markdown counts
+remain AI-reported and a real action-path test is still required before
+claiming protection. See the [customer onboarding guide](docs/customer-onboarding.md).
+
+For the Pilot path, preview obtains the private, signed, catalog-bound semantic plan and keeps
 application source on your machine. `agenticdome integrate apply` creates a
 local Git review branch but never commits, pushes or deploys. Existing-source
 automatic edits cover unambiguous CrewAI bootstrap, PydanticAI `Agent(...)`,

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/README.md

@@ -69,7 +69,16 @@ certified onboarding path, obtain the assigned sidecar and a dedicated
 local exact diff and change summary, explicitly approve a supported edit or
 attach other boundaries manually, then run
 `agenticdome verify --run-tests --output .agenticdome/verification.json`.
-Preview obtains the private, signed, catalog-bound semantic plan and keeps
+
+If a coding assistant has already made and tested the application edits,
+import its canonical `AgenticDome_Integration.md` in the customer portal and
+run `agenticdome validate-report --report AgenticDome_Integration.md` from
+that same deployable workload. Import the two generated, hash-bound JSON files
+in Onboarding. This avoids repeating the guided edit plan; the Markdown counts
+remain AI-reported and a real action-path test is still required before
+claiming protection. See the [customer onboarding guide](docs/customer-onboarding.md).
+
+For the Pilot path, preview obtains the private, signed, catalog-bound semantic plan and keeps
 application source on your machine. `agenticdome integrate apply` creates a
 local Git review branch but never commits, pushes or deploys. Existing-source
 automatic edits cover unambiguous CrewAI bootstrap, PydanticAI `Agent(...)`,

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.36
+Version: 1.2.37
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -182,7 +182,16 @@ certified onboarding path, obtain the assigned sidecar and a dedicated
 local exact diff and change summary, explicitly approve a supported edit or
 attach other boundaries manually, then run
 `agenticdome verify --run-tests --output .agenticdome/verification.json`.
-Preview obtains the private, signed, catalog-bound semantic plan and keeps
+
+If a coding assistant has already made and tested the application edits,
+import its canonical `AgenticDome_Integration.md` in the customer portal and
+run `agenticdome validate-report --report AgenticDome_Integration.md` from
+that same deployable workload. Import the two generated, hash-bound JSON files
+in Onboarding. This avoids repeating the guided edit plan; the Markdown counts
+remain AI-reported and a real action-path test is still required before
+claiming protection. See the [customer onboarding guide](docs/customer-onboarding.md).
+
+For the Pilot path, preview obtains the private, signed, catalog-bound semantic plan and keeps
 application source on your machine. `agenticdome integrate apply` creates a
 local Git review branch but never commits, pushes or deploys. Existing-source
 automatic edits cover unambiguous CrewAI bootstrap, PydanticAI `Agent(...)`,

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/agenticdome_sdk/catalog_snapshot.json

@@ -1,13 +1,13 @@
 {
     "schema": "agenticdome.catalog-snapshot.v1",
     "catalog_schema": "agenticdome.hook-catalog.v1",
-    "verified_at": "2026-09-29",
-    "python_sdk_version": "1.2.36",
+    "verified_at": "2026-10-02",
+    "python_sdk_version": "1.2.37",
     "published_packages": {
         "agenticdome-python-sdk": {
             "registry": "pypi",
-            "version": "1.2.36",
-            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.36/"
+            "version": "1.2.37",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.37/"
         },
         "agenticdome-sdk": {
             "registry": "npm",
@@ -21,8 +21,8 @@
         },
         "openclaw": {
             "registry": "npm",
-            "version": "2026.9.6",
-            "url": "https://www.npmjs.com/package/openclaw/v/2026.9.6"
+            "version": "2026.9.7",
+            "url": "https://www.npmjs.com/package/openclaw/v/2026.9.7"
         }
     }
 }

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/agenticdome_sdk/hook_catalog.py

@@ -39,7 +39,7 @@ CATALOG_VERIFIED_AT = str(_CATALOG_SNAPSHOT["verified_at"])
 
 
 _OPENCLAW_RUNTIME_MIN_VERSION = "2026.7.1-2"
-_OPENCLAW_RUNTIME_MAX_VERSION = "2026.9.6"
+_OPENCLAW_RUNTIME_MAX_VERSION = "2026.9.7"
 _OPENCLAW_RUNTIME_VERSION = _OPENCLAW_RUNTIME_MAX_VERSION
 _OPENCLAW_NODE_RANGE = ">=24.16.0 <25 || >=26.1.0"
 

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/agenticdome_sdk/onboarding_cli.py

@@ -2471,6 +2471,77 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
     return (0 if result["ready"] else 2), result
 
 
+def validate_ai_integration_report(root: Path, report_path: Path) -> Tuple[int, Dict[str, Any]]:
+    """Validate an AI-assisted edit with the existing semantic and test gates.
+
+    Markdown is a customer-authored inventory, never an authorization or proof
+    source. Only its digest is added to the source-free evidence exports.
+    """
+    if report_path.name != "AgenticDome_Integration.md" or report_path.is_symlink() or not report_path.is_file():
+        raise SystemExit("Select this workload's AgenticDome_Integration.md (regular file, exact name).")
+    if not report_path.resolve().is_relative_to(root) or report_path.stat().st_size > 524288:
+        raise SystemExit("The integration report must be inside this workload and no larger than 512 KB.")
+    try:
+        markdown = report_path.read_text(encoding="utf-8")
+    except (UnicodeError, OSError) as exc:
+        raise SystemExit("Read AgenticDome_Integration.md as UTF-8 and retry; the file could not be read safely.") from exc
+    if not markdown or "\x00" in markdown:
+        raise SystemExit("AgenticDome_Integration.md is empty or contains unsupported binary content.")
+    scope_match = re.search(r"^Workload scope:\s*([^\r\n]+)", markdown, re.IGNORECASE | re.MULTILINE)
+    if not scope_match:
+        raise SystemExit("Add a Workload scope line naming this deployable workload to AgenticDome_Integration.md.")
+    quoted = re.search(r"`([^`]+)`", scope_match.group(1))
+    scope = (quoted.group(1) if quoted else scope_match.group(1).split()[0]).strip().rstrip("/")
+    if Path(scope).name.casefold() != root.name.casefold() or ".." in Path(scope).parts:
+        raise SystemExit("The report's Workload scope does not match this workload root. Run from the correct deployable service.")
+    rows = re.findall(r"^\|\s*([1-8])\.([^\r\n]*)", markdown, re.MULTILINE)
+    if len(rows) != 8 or {number for number, _ in rows} != {str(index) for index in range(1, 9)}:
+        raise SystemExit("The integration report needs one valid row for each of the eight interception categories.")
+    for _, cells_text in rows:
+        cells = [cell.strip().replace("*", "").replace(",", "") for cell in cells_text.strip().strip("|").split("|")]
+        if len(cells) != 6 or any(not re.fullmatch(r"\d{1,5}", cell) for cell in cells[1:]):
+            raise SystemExit("Each interception row needs five non-negative counts after its category.")
+        found, existing, new, unprotected, live = (int(cell) for cell in cells[1:])
+        if any(value > 10000 for value in (found, existing, new, unprotected, live)) or existing + new + unprotected != found or live > existing + new:
+            raise SystemExit("The report counts do not reconcile. Correct the AI integration inventory before validation.")
+    digest = hashlib.sha256(markdown.encode("utf-8")).hexdigest()
+
+    inspection = _exportable_inspection(inspect_repository(root))
+    if inspection.get("scope", {}).get("complete") is not True:
+        raise SystemExit(_scope_gap_message(inspection))
+    if inspection.get("mcp_protection", {}).get("detected") is True or inspection.get("openclaw_protection", {}).get("ready") is True:
+        raise SystemExit("This workload needs the specialist MCP or OpenClaw onboarding path. Keep the AI report for review, then use that journey's verification commands.")
+    inspection["ai_integration_report_sha256"] = digest
+    inspection.pop("report_sha256", None)
+    inspection["report_sha256"] = hashlib.sha256(
+        json.dumps(inspection, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+    plan = integration_plan(root)
+    plan["inspection_report_sha256"] = inspection["report_sha256"]
+    exit_code, verification = verify_project(root, run_tests=True, plan=plan)
+    verification["ai_integration_report_sha256"] = digest
+    verification.pop("report_sha256", None)
+    verification["report_sha256"] = hashlib.sha256(
+        json.dumps(verification, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+
+    inspection_path = root / "agenticdome-inspection.json"
+    verification_path = root / ".agenticdome" / "verification.json"
+    for output in (inspection_path, verification_path):
+        if output.is_symlink() or not output.resolve().is_relative_to(root):
+            raise SystemExit("An evidence output path is a symlink or leaves this workload; remove that path and retry.")
+    _write_json(inspection_path, inspection)
+    _write_json(verification_path, verification)
+    return exit_code, {
+        "status": "validation_passed" if verification["ready"] else "validation_needs_attention",
+        "inspection": str(inspection_path.relative_to(root)),
+        "verification": str(verification_path.relative_to(root)),
+        "ai_integration_report_sha256": digest,
+        "ready": verification["ready"],
+        "next_action": "Import both JSON files in Onboarding; then run the assigned-runtime check and test a real action path. No customer action executes in these fixed decision cases.",
+    }
+
+
 def _print(value: Any, as_json: bool = False) -> None:
     if as_json or isinstance(value, (dict, list)):
         print(json.dumps(value, indent=2, sort_keys=True))
@@ -2575,6 +2646,11 @@ def build_parser() -> argparse.ArgumentParser:
     )
     verify_parser.add_argument("--output")
 
+    ai_validate_parser = subparsers.add_parser(
+        "validate-report", help="Validate a coding-assistant integration report against this workload; no source upload or code edit."
+    )
+    ai_validate_parser.add_argument("--report", default="AgenticDome_Integration.md")
+
     action_parser = subparsers.add_parser(
         "verify-action",
         help="Run one safe customer test and correlate the real SDK hook, live verdict and handler spy.",
@@ -2754,6 +2830,13 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         record_verification(root, result)
         _print(result)
         return exit_code
+    if args.command == "validate-report":
+        report_path = Path(args.report)
+        if not report_path.is_absolute():
+            report_path = root / report_path
+        exit_code, result = validate_ai_integration_report(root, report_path)
+        _print(result)
+        return exit_code
     if args.command == "verify-action":
         from .action_path_proof import run_action_path_test
         command = list(args.test_command)

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/docs/customer-onboarding.md

@@ -36,7 +36,7 @@ runtime before activation.
 
 ## What is required
 
-For a Developer Integration:
+For a Developer Integration using the AgenticDome Onboarding Pilot:
 
 1. **Required — initialise locally.** Discover frameworks and likely prompt,
    tool, delegation, retrieval and output boundaries without uploading source.
@@ -52,6 +52,32 @@ For a Developer Integration:
 The same discovery logic feeds the guided preview, optional advanced scaffold
 and final verification. It does not silently apply code changes.
 
+### Already integrated with your coding assistant?
+
+The alternative AI Instruction path does not require repeating `init`,
+`integrate preview` or guided apply. From the root of the one deployable
+application workload, create and review the canonical
+`AgenticDome_Integration.md` with all eight interception categories and an
+explicit `Workload scope:`. Import it under Onboarding > Discover. Its counts
+are displayed as **AI-reported**, not independently verified. Then set the
+assigned `AGENTICDOME_API_BASE`, `AGENTICDOME_TENANT_ID` and dedicated
+`AGENTICDOME_COPILOT_API_KEY` in your local shell and run:
+
+```bash
+agenticdome validate-report --report AgenticDome_Integration.md
+```
+
+This does not edit the application. It checks current source-free structure,
+requests the tenant-bound semantic assessment and runs detected workload tests.
+Import both generated files, `agenticdome-inspection.json` and
+`.agenticdome/verification.json`, together in the same onboarding workload.
+Their hashes bind them to the exact Markdown report. A changed report requires
+rerunning validation. The portal then performs its separate assigned-runtime
+check; test the actual customer action path before activation. MCP and
+OpenClaw workloads use their specialist onboarding journeys rather than this
+application shortcut. The validation command cannot turn an AI report or a
+fixed synthetic decision into proof that real customer traffic is intercepted.
+
 The local Integration Assistant collects source-free structure and prepares a
 reviewable local diff. Guided `integrate preview` obtains a signed, tenant-bound
 plan through the assigned sidecar; only source-free structural IR reaches the

{agenticdome_python_sdk-1.2.36 → agenticdome_python_sdk-1.2.37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agenticdome-python-sdk"
-version = "1.2.36"
+version = "1.2.37"
 description = "Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement."
 readme = "README.md"
 requires-python = ">=3.9"