agenticdome-python-sdk 1.2.40__py3-none-any.whl → 1.2.43__py3-none-any.whl

{agenticdome_python_sdk-1.2.40.dist-info → agenticdome_python_sdk-1.2.43.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.40
+Version: 1.2.43
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -2845,10 +2845,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2865,7 +2862,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.40.dist-info → agenticdome_python_sdk-1.2.43.dist-info}/RECORD

@@ -1,17 +1,17 @@
-agenticdome_python_sdk-1.2.40.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-agenticdome_python_sdk-1.2.40.dist-info/licenses/NOTICE,sha256=obvKP6kV1Ny5R8_INFOpf0X5um9U2X43LGwQFobO9kg,550
+agenticdome_python_sdk-1.2.43.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+agenticdome_python_sdk-1.2.43.dist-info/licenses/NOTICE,sha256=obvKP6kV1Ny5R8_INFOpf0X5um9U2X43LGwQFobO9kg,550
 agenticdome_sdk/__init__.py,sha256=1JY5ELhtp0zg-82xhgt6NxZ7k5CWL5e_Tm6BrsuCFXc,1102
-agenticdome_sdk/_framework_firewall.py,sha256=W3gy7WsK50scE7ypJrmVJhHUOBsr0zAWQ85rghqaJk4,31963
+agenticdome_sdk/_framework_firewall.py,sha256=h_g2A5eqHeztTjURRNe-ZsUyFBw0oloLmHHNl3Kgt8Q,32748
 agenticdome_sdk/_mode.py,sha256=XvOgh5sW-FG8S39V483h3uLiFh8wSt14OmYXz_6eDO8,1283
 agenticdome_sdk/action_path_proof.py,sha256=5Zlghy7-LNhtRJM0Unb4NPUASzIsAC0LaWNVFR2yzzo,13497
 agenticdome_sdk/agno.py,sha256=L3yfjTBHW47xzT67a1DsjtwmvrAoYBkbxADpsr85Cp0,60766
 agenticdome_sdk/attestation.py,sha256=ij4cMff7nzLaIS0W02d2WURFcyKe72bcUlSz-dYkaLE,10310
 agenticdome_sdk/autogen.py,sha256=KP4qlIcsNXB-4ZT9D7Slc1xWEeWXRIWkc5HGW0U6k2c,29018
 agenticdome_sdk/aws_bedrock.py,sha256=2zD9j7xi0jna0sMeMf-hKZdc3Y4RPwzj6tMVOUGgIDQ,69581
-agenticdome_sdk/catalog_snapshot.json,sha256=OhMGmRF0oGAcCfj9XbVgX8NDc6TMOR1Mrc2l9S6qXCA,951
+agenticdome_sdk/catalog_snapshot.json,sha256=cYOcI2eG8pj5-h_VDZs5Ve3CtpaIHjZ9dhr-lHF-Lp8,955
 agenticdome_sdk/claude.py,sha256=XeY9AUu61SYcJjQVz_AtL_WaN6X4KqP5nprEbbr4Q6A,17456
-agenticdome_sdk/client.py,sha256=SQk7BROrcedyHAfubGiwGNNGycq7W7L-Ncjroj1ugBg,69815
-agenticdome_sdk/connect.py,sha256=MY30wXYA6OaZhs__E67KcFXEy7mZMBxMSV06BnlBjRg,18766
+agenticdome_sdk/client.py,sha256=cHeMnd6Jf5C4gxaPVaOXpNcAGt1r5Ht3GADmbzGlzk8,70207
+agenticdome_sdk/connect.py,sha256=WOh9hEOEy6OmX4zrJEWZPsgYJUbl3PR03ukODe3WC4Q,18864
 agenticdome_sdk/copilot_ir.py,sha256=zT13tOX8xu11yrOtIPMRFVud8CQ81Gu3WxsXxyQ4XT0,17928
 agenticdome_sdk/copilot_ir_collector.cjs,sha256=oxLY8ByONo7Es4YjYiJuRz_A7IKL65Sy486UXnu-4Rs,9681
 agenticdome_sdk/crewai.py,sha256=sSJQ49O7-8kqOAD2_jrsMtMOmBOcJmFkeOv7S3-ayMs,52490
@@ -20,27 +20,29 @@ agenticdome_sdk/existing_integration.py,sha256=be6xFqe3P9d98YOydHzDeyRSbuAim4bLB
 agenticdome_sdk/framework_edits.py,sha256=4BgWHxWKEkex8_DMhjVxjovpUVkrMF7TsCZzlS94mpA,23344
 agenticdome_sdk/generic_python.py,sha256=JtXRcYEZ6_Dgxnnv4QgqeMZR8dFVr8EqFDM-XYQ-GMA,6823
 agenticdome_sdk/google_adk.py,sha256=2TA-tUhY0lOnkGcs1BN9CUEz67ebVX4HJ7mnNoRPcZs,57258
-agenticdome_sdk/guided_integration.py,sha256=m7EsgLrPEJhfrVMaVWO2DtjYp6S8PwpCKDYZPNbVZ2o,52259
-agenticdome_sdk/hook_catalog.py,sha256=XRc_MeEE3LArX1R0xfO3Vo6nZbF3U-4cOkTOMfMOZS8,29272
+agenticdome_sdk/guided_integration.py,sha256=4NBCacAcwEQkVct86G8NGYwrcTNT7xaxXGZ21aPaygY,52449
+agenticdome_sdk/hook_catalog.py,sha256=u72GkY76XjsV8fC1AxUz89AvYWwiOvRFeowR_Dv91hY,29291
 agenticdome_sdk/identity.py,sha256=mrymGgZSVsKJ9THRde54qGmMT7j_uZHmPJ-HtWk7PXE,4635
 agenticdome_sdk/langgraph.py,sha256=FUvF6DSA5aZP3eoBoNeldgGtPrz-dO5xcVmrPPSBEhI,84312
-agenticdome_sdk/lifecycle.py,sha256=9LvxmUU1LC_tMchb5uVFBnZIkVFUxOv3VH9wG_9gPtA,12855
+agenticdome_sdk/lifecycle.py,sha256=obRIbJ9H90TPpfa46pZRTilg9Q8nhLTP5P2bsFbChbI,15210
 agenticdome_sdk/llamaindex.py,sha256=BHplSUIsgMi7k8tBztprzaV9iaOXiljXbdeMRax_2h8,42860
-agenticdome_sdk/mcp_host.py,sha256=T9ICAyz8SjOhssuhXaiEuav5fduWriDhuZ4U_e8Jh9w,69389
+agenticdome_sdk/mcp_host.py,sha256=4jze8c40o-kcVbX6ZSUpKM9Psyt02KfdrMa7G09o-Z8,70662
 agenticdome_sdk/mcp_http_gateway.py,sha256=XrTgj46ZHIKJ9xS3EQPsac2C9OGUZnrOXomcLdkMk_Y,13629
 agenticdome_sdk/mcp_rehearsal_server.py,sha256=cox4XqUTL8d0gaDzqxDZcEALkaz8otjOjOqHvoUeeCo,2118
 agenticdome_sdk/mcp_verification.py,sha256=WtRhAFVPTBqGOcHNf_db1m4jX9_TO0oxP98XWk4_ISY,14551
 agenticdome_sdk/microsoft_agent_framework.py,sha256=GfIIuk0n-VhsZaTyoB7P6ilpz9bFLD95TWuX0rFSWeU,67219
 agenticdome_sdk/microsoft_ai_foundry.py,sha256=YlO968s1dbAYcaEqhqufL92NFR66GuTtngnCv7-1mYc,56911
-agenticdome_sdk/onboarding_cli.py,sha256=F2xwFXQUOOohhLEQ5xQ5cSsU8DC6uHhCcsuE087DQno,163604
+agenticdome_sdk/onboarding_cli.py,sha256=8HK3xQ03Vp-SWZ_fZmxBXsgeZVKeUpFCZj-LmR6YbNI,169693
+agenticdome_sdk/onboarding_observations.py,sha256=M4UWdpYipMGi6Nw_eP7PvMLZsAv5UpXRYK0qR28qX6o,4498
 agenticdome_sdk/openai_agents.py,sha256=0z-7FDBIG4usxnILpan6yjQHF4zXIzm9YLsh3-bW8Lw,57678
 agenticdome_sdk/outcomes.py,sha256=jadWDzQaZXrHNvpPme8lQY0jihYLCoM3s4CihAq0JRo,2507
 agenticdome_sdk/proof.py,sha256=ECKc14xSE0V1HHmcpZjfVz8-Q2H_fooah3BfdblFV8M,2878
 agenticdome_sdk/pydantic.py,sha256=WKb8X0Fgydfid-ep8E-M8Yslz2pWcCP6w7n_aBxt1rI,54961
+agenticdome_sdk/report_scope.py,sha256=UVBkM6c_8ZUSdhcSyT3VMcravj5HLGrPZjlgdFanh5A,2939
 agenticdome_sdk/simulation.py,sha256=UCbZy3u9AzfxQCfY38SCV3CxGxhinV9EA4aHMPlK4mc,8426
 agenticdome_sdk/smolagents.py,sha256=wjMA1HVAQ-9wRNM38Jr9wlCpKMhF-9vxtTk6R-kwQhs,19094
-agenticdome_python_sdk-1.2.40.dist-info/METADATA,sha256=9ws0kO1NneHkTMz-MK7XYgZ0KYHp2ly0bo6x9R6_2vA,145642
-agenticdome_python_sdk-1.2.40.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-agenticdome_python_sdk-1.2.40.dist-info/entry_points.txt,sha256=cRfCphkr5gLrkGIzXJEtL50HdHLajoZLbZtcMLE8NoY,113
-agenticdome_python_sdk-1.2.40.dist-info/top_level.txt,sha256=LZbbjXco5mqDrGwlTJpIKI5Sp6R_njzHHjExxAs9c3s,16
-agenticdome_python_sdk-1.2.40.dist-info/RECORD,,
+agenticdome_python_sdk-1.2.43.dist-info/METADATA,sha256=a2nyawPHyq2HWXpRIwaxs7yXXKKy0_w8gKMd-NvZU9Q,146163
+agenticdome_python_sdk-1.2.43.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+agenticdome_python_sdk-1.2.43.dist-info/entry_points.txt,sha256=cRfCphkr5gLrkGIzXJEtL50HdHLajoZLbZtcMLE8NoY,113
+agenticdome_python_sdk-1.2.43.dist-info/top_level.txt,sha256=LZbbjXco5mqDrGwlTJpIKI5Sp6R_njzHHjExxAs9c3s,16
+agenticdome_python_sdk-1.2.43.dist-info/RECORD,,

agenticdome_sdk/_framework_firewall.py

@@ -202,7 +202,8 @@ class FrameworkFirewallBase:
             timeout=config.timeout_s,
         )
         self.token_store = token_store or build_token_store(config, logger)
-        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id)
+        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id, api_base=config.api_base, api_key=config.api_key,
+            sender=getattr(self.client, "report_action_evidence", None))
         self.denied_error = denied_error
         self.label = label
         self.logger = logger
@@ -623,14 +624,17 @@ class FrameworkFirewallBase:
                 decision = await self.aauthorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:
@@ -659,14 +663,17 @@ class FrameworkFirewallBase:
                 decision = self.authorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:

agenticdome_sdk/catalog_snapshot.json

@@ -2,22 +2,22 @@
     "schema": "agenticdome.catalog-snapshot.v1",
     "catalog_schema": "agenticdome.hook-catalog.v1",
     "verified_at": "2026-10-02",
-    "python_sdk_version": "1.2.40",
+    "python_sdk_version": "1.2.43",
     "published_packages": {
         "agenticdome-python-sdk": {
             "registry": "pypi",
-            "version": "1.2.40",
-            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.40/"
+            "version": "1.2.43",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.43/"
         },
         "agenticdome-sdk": {
             "registry": "npm",
-            "version": "0.6.3",
-            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.3"
+            "version": "0.6.14",
+            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.14"
         },
         "agenticdome-openclaw-security": {
             "registry": "npm",
-            "version": "1.0.2",
-            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.2"
+            "version": "1.0.13",
+            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.13"
         },
         "openclaw": {
             "registry": "npm",

agenticdome_sdk/client.py

@@ -375,6 +375,12 @@ class AgenticDomeClient:
         if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
             raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
+    def report_action_evidence(self, kind: str, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Use the existing tenant SDK transport; runtime durably relays evidence."""
+        if kind not in {"events", "outcomes"}:
+            raise ValueError("Evidence kind must be events or outcomes")
+        return self._request("POST", "/mesh/evidence/" + kind, json_body=payload, timeout=5)
+
     def _request(
         self,
         method: str,

agenticdome_sdk/connect.py

@@ -253,9 +253,9 @@ def run_connect(root: Path, args: Any) -> Dict[str, Any]:
     broker_setup["sdk_mode"] = effective_config.get("execution_broker_mode", "existing_sdk_or_environment_default")
     cross_part_review_required = semantic.get("workload_coverage", {}).get("cross_part_flow_proven") is False
     next_action = (
-        "Review the generated pull request and run agenticdome verify. Then review cross-part call paths and workload-specific tests in the portal before activation."
+        "Review the generated pull request and run agenticdome verify. Cross-part limitations will be recorded as optional observations in .agenticdome/DISCLAIMER.md; no acknowledgement is required solely for them."
         if args.open_pr else
-        "Review the generated patch, apply it on a branch, and run agenticdome verify. Then review cross-part call paths and workload-specific tests in the portal before activation."
+        "Review the generated patch, apply it on a branch, and run agenticdome verify. Cross-part limitations will be recorded as optional observations in .agenticdome/DISCLAIMER.md; no acknowledgement is required solely for them."
     ) if cross_part_review_required else (
         "Review the generated pull request and run agenticdome verify."
         if args.open_pr else "Review the generated patch, apply it on a branch, then run agenticdome verify."

agenticdome_sdk/guided_integration.py

@@ -490,9 +490,10 @@ def preview(root: Path, plan: Optional[Dict[str, Any]] = None, *, target: str =
         + ", A2A " + str(existing.get("a2a_call_candidates", 0))
         + ", MCP " + str(existing_surfaces.get("mcp", 0))
         + " (categories may overlap; no customer action was exercised)",
-        "- Action-required semantic findings: " + str(semantic_gate.get("action_required", "not assessed")),
-        "- Review-required semantic findings: " + str(semantic_gate.get("review_required", "not assessed")),
+        "- Raw semantic action candidates (lower severity may be optional): " + str(semantic_gate.get("action_required", "not assessed")),
+        "- Optional review observations: " + str(semantic_gate.get("review_required", "not assessed")),
         "",
+        "Optional observations are written to .agenticdome/DISCLAIMER.md on verification; high-severity and required protection/test failures remain blocking.", "",
         "## Framework hooks to attach or verify", "",
     ]
     for recommendation in plan.get("hook_recommendations", []):

agenticdome_sdk/hook_catalog.py

@@ -325,7 +325,7 @@ FRAMEWORK_HOOK_CATALOG: Dict[str, Dict[str, Any]] = {
         "adapter_module": "agenticdome-openclaw-security",
         "adapter_class": "OpenClawFirewall",
         "attachment_methods": ["protectedExecute", "sanitizeOutput"],
-        "native_hooks": ["before_agent_run", "before_tool_call", "tool_result_persist"],
+        "native_hooks": ["before_agent_run", "before_tool_call", "after_tool_call", "tool_result_persist"],
         "docs": "agenticdome-openclaw-security package README",
     },
     "mcp-ts": {

agenticdome_sdk/lifecycle.py

@@ -1,7 +1,7 @@
 """Privacy-bounded Verified Action lifecycle reporting.
 
 The runtime authorization path remains authoritative. This module reports only
-minimized lifecycle evidence through a separately scoped portal credential and
+minimized lifecycle evidence through the existing tenant runtime credential and
 never sends tool arguments, prompts, responses, credentials, or source code.
 """
 
@@ -15,9 +15,11 @@ import logging
 import os
 import queue
 import threading
+import time
+import urllib.error
 import urllib.request
 import uuid
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from datetime import datetime, timezone
 from typing import Any, Callable, Dict, Optional, TypeVar
 
@@ -72,33 +74,46 @@ class VerifiedActionDenied(RuntimeError):
 class VerifiedActionReporter:
     """Non-blocking, bounded reporter for one tenant's Verified Actions.
 
-    Configure ``AGENTICDOME_EVIDENCE_API_BASE`` and a portal token containing
-    only ``evidence:write``. Missing evidence credentials disable reporting;
-    they never weaken or bypass the primary AgenticDome authorization call.
+    SDK credentials enable reporting to the assigned runtime by default.
+    Explicit portal evidence credentials remain supported for existing callers.
     """
 
-    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256) -> None:
+    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256,
+                 runtime_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> None:
         self.portal = portal.rstrip("/")
         self.access_token = access_token.strip()
         self.tenant_id = tenant_id.strip()
+        self.runtime_base = runtime_base.rstrip("/")
+        self.api_key = api_key.strip()
+        self.sender = sender
+        self.runtime_mode = not (self.portal and self.access_token)
         self.timeout = max(1.0, min(float(timeout), 30.0))
         self._queue: "queue.Queue[tuple[str, Dict[str, Any]] | None]" = queue.Queue(maxsize=max(16, min(int(queue_size), 4096)))
         self._worker: Optional[threading.Thread] = None
         self._lock = threading.Lock()
+        self._stats = {"queued": 0, "delivered": 0, "failed": 0, "dropped": 0}
 
     @classmethod
-    def from_env(cls, *, tenant_id: str = "") -> "VerifiedActionReporter":
+    def from_env(cls, *, tenant_id: str = "", api_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> "VerifiedActionReporter":
+        if os.getenv("AGENTICDOME_EVIDENCE_ENABLED", "true").lower() in {"0", "false", "off", "no"}:
+            return cls()
         return cls(
             os.getenv("AGENTICDOME_EVIDENCE_API_BASE", ""),
             os.getenv("AGENTICDOME_EVIDENCE_TOKEN", ""),
             tenant_id=tenant_id or os.getenv("AGENTICDOME_TENANT_ID", ""),
             timeout=float(os.getenv("AGENTICDOME_EVIDENCE_TIMEOUT_S", "5") or "5"),
             queue_size=int(os.getenv("AGENTICDOME_EVIDENCE_QUEUE_SIZE", "256") or "256"),
+            runtime_base=api_base or os.getenv("AGENTICDOME_API_BASE", ""),
+            api_key=api_key or os.getenv("AGENTICDOME_API_KEY", ""), sender=sender,
         )
 
     @property
     def enabled(self) -> bool:
-        return bool(self.portal and self.access_token and self.tenant_id)
+        return bool(self.tenant_id and ((self.portal and self.access_token) or
+                    (self.runtime_base.startswith(("https://", "http://")) and self.api_key)))
+
+    def stats(self) -> Dict[str, Any]:
+        return dict(self._stats, pending=self._queue.unfinished_tasks, enabled=self.enabled, transport="runtime" if self.runtime_mode else "portal")
 
     def new_context(self, *, operation_type: str, tool_name: Optional[str] = None, tool_version: Optional[str] = None,
                     arguments: Any = None, destination: Optional[str] = None, chain_id: Optional[str] = None,
@@ -141,6 +156,10 @@ class VerifiedActionReporter:
         }
         return self._enqueue("/api/agentguard/verified-actions/events", payload)
 
+    def with_arguments(self, context: VerifiedActionContext, arguments: Any) -> VerifiedActionContext:
+        """Keep correlation IDs while hashing the arguments actually admitted for execution."""
+        return replace(context, arguments_sha256=_digest(arguments))
+
     def outcome(self, context: VerifiedActionContext, outcome_class: str, *, side_effect_reference: Optional[str] = None) -> bool:
         allowed = {"not_attempted", "rejected", "accepted", "succeeded", "partially_succeeded", "failed", "rolled_back", "unknown"}
         outcome = _token(outcome_class, allowed, "unknown")
@@ -150,8 +169,8 @@ class VerifiedActionReporter:
             "chain_id": context.chain_id, "action_id": context.action_id,
             "jti": "sdk_" + uuid.uuid4().hex, "outcome_class": outcome,
             "assurance_level": "sdk_reported", "authorised_action_sha256": context.arguments_sha256,
-            "observed_action_sha256": context.arguments_sha256, "destination_sha256": context.destination_sha256,
-            "side_effect_ref_sha256": _digest(side_effect_reference), "attempted_at": now, "completed_at": now,
+            "observed_action_sha256": None if outcome == "not_attempted" else context.arguments_sha256, "destination_sha256": context.destination_sha256,
+            "side_effect_ref_sha256": _digest(side_effect_reference), "completed_at": now,
         }
         return self._enqueue("/api/agentguard/verified-actions/outcomes", payload)
 
@@ -162,7 +181,7 @@ class VerifiedActionReporter:
         marker = {"_flush_event": completed}
         if not self._enqueue("", marker):
             return False
-        return completed.wait(max(0.1, timeout))
+        return completed.wait(max(0.1, timeout)) and self._stats["failed"] == 0
 
     def _enqueue(self, path: str, payload: Dict[str, Any]) -> bool:
         if not self.enabled:
@@ -170,8 +189,10 @@ class VerifiedActionReporter:
         self._ensure_worker()
         try:
             self._queue.put_nowait((path, payload))
+            if path:self._stats["queued"] += 1
             return True
         except queue.Full:
+            self._stats["dropped"] += 1
             logger.warning("Verified Action evidence queue is full; authorization behavior is unchanged.")
             return False
 
@@ -193,14 +214,27 @@ class VerifiedActionReporter:
                 if isinstance(marker, threading.Event):
                     marker.set()
                     continue
-                request = urllib.request.Request(
-                    self.portal + path, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST",
-                    headers={"Authorization": "Bearer " + self.access_token, "Content-Type": "application/json", "Accept": "application/json"},
-                )
-                with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310 - configured AgenticDome portal
-                    response.read(1)
+                for attempt in range(3):
+                    try:
+                        if self.runtime_mode and self.sender:
+                            self.sender(path.rsplit("/", 1)[-1], payload)
+                        else:
+                            endpoint = (self.runtime_base + "/mesh/evidence/" + path.rsplit("/", 1)[-1]) if self.runtime_mode else self.portal + path
+                            headers = {"Content-Type": "application/json", "Accept": "application/json", "X-Tenant-Id": self.tenant_id}
+                            headers.update({"X-API-Key": self.api_key} if self.runtime_mode else {"Authorization": "Bearer " + self.access_token})
+                            request = urllib.request.Request(endpoint, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST", headers=headers)
+                            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                                response.read(1)
+                        self._stats["delivered"] += 1
+                        break
+                    except Exception as exc:
+                        status = getattr(exc, "code", getattr(exc, "status_code", None))
+                        if attempt == 2 or status is not None and status not in {429, 500, 502, 503, 504}:
+                            raise
+                        time.sleep(.1 * (2 ** attempt))
             except Exception as exc:  # evidence must never alter the protected operation
-                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged: %s", exc)
+                self._stats["failed"] += 1
+                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged (%s)", type(exc).__name__)
             finally:
                 self._queue.task_done()
 

agenticdome_sdk/mcp_host.py

@@ -13,6 +13,7 @@ import time
 import uuid
 import re
 from collections import defaultdict, deque
+from contextvars import ContextVar
 from dataclasses import dataclass
 from datetime import date
 from inspect import isawaitable
@@ -23,6 +24,8 @@ from .client import AgenticDomeClient
 from ._mode import credentials_or_local_sim
 from .lifecycle import VerifiedActionReporter
 
+_lifecycle_decision: ContextVar[Optional[Dict[str, Any]]] = ContextVar("agenticdome_mcp_lifecycle_decision", default=None)
+
 try:
     from .exceptions import AgenticDomeHTTPError
 except Exception:  # pragma: no cover - compatibility with older package layouts
@@ -375,7 +378,8 @@ class AgenticDomeMCPHostFirewall:
             timeout=self.config.timeout_s,
         )
         self.token_store = token_store or _build_token_store(self.config)
-        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id)
+        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id,
+            api_base=self.config.api_base, api_key=self.config.api_key, sender=getattr(self.client, "report_action_evidence", None))
         self.provider_action_rules = dict(provider_action_rules or {})
         self.resolve_provider_facts = resolve_provider_facts
         self._rate_lock = Lock()
@@ -975,6 +979,9 @@ class AgenticDomeMCPHostFirewall:
         )
 
     async def _handle_blocking_decision(self, *, decision: Dict[str, Any], rid: Any, context: Dict[str, Any], method: str, operation: str) -> Optional[Dict[str, Any]]:
+        evidence = _lifecycle_decision.get()
+        if evidence is not None:
+            evidence.update(verdict=self._verdict(decision), reason=self._reason(decision))
         verdict = self._verdict(decision)
         if verdict == "ALLOWED" or (verdict == "REDACTED" and self._sanitized_args(decision, explicit_only=True) is not None):
             return None
@@ -1433,7 +1440,7 @@ class AgenticDomeMCPHostFirewall:
         lifecycle = self.lifecycle_reporter.new_context(
             operation_type="mcp_operation", tool_name=tool_name, arguments=arguments,
             destination=self.config.mcp_server_url or self.config.mcp_server_id,
-            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id")) or None,
+            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id") or local_context.get("chain_id")) or None,
             action_id=self._safe_str(local_context.get("verified_action_id") or local_context.get("action_id")) or None,
             parent_action_id=self._safe_str(local_context.get("parent_action_id")) or None,
             initiator_type="human" if self._safe_str(local_context.get("user_id")) else "agent",
@@ -1441,13 +1448,25 @@ class AgenticDomeMCPHostFirewall:
         )
         self.lifecycle_reporter.phase(lifecycle, "requested", "requested")
 
-        gated = await self.preflight_request(mcp_request=mcp_request, context=context)
+        local_context.update(chain_id=lifecycle.chain_id, action_id=lifecycle.action_id, decision_id=lifecycle.action_id)
+        decision_evidence: Dict[str, Any] = {}
+        decision_token = _lifecycle_decision.set(decision_evidence)
+        try:
+            gated = await self.preflight_request(mcp_request=mcp_request, context=local_context)
+        except Exception:
+            self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
+            raise
+        finally:
+            _lifecycle_decision.reset(decision_token)
         if isinstance(gated, dict) and "error" in gated:
             self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
             self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
             return gated
 
-        self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+        admitted_arguments = self._extract_tool_call(gated)[1] if method == "tools/call" else self._params(gated)
+        lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, admitted_arguments)
+        if decision_evidence.get("verdict") in {"ALLOWED", "REDACTED"} and decision_evidence.get("reason") != "fail-open":
+            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
         self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
         self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
 

agenticdome_sdk/onboarding_cli.py

@@ -1645,6 +1645,17 @@ def integration_plan(root: Path) -> Dict[str, Any]:
             hook["required_actions"].append("No candidate use of " + hook["recommended_attachment"]["method"] + " was observed in this selected source; attach it at the real execution path or document the external integration.")
     semantic_bypasses = semantic.get("bypass_risks", []) if isinstance(semantic, dict) else []
     semantic_reviews = semantic.get("review_findings", []) if isinstance(semantic, dict) else []
+    from .onboarding_observations import POLICY as observations_policy
+    workload_coverage = semantic.get("workload_coverage", {})
+    assessment_complete = (
+        workload_coverage.get("complete", True) is True
+        and all(item.get("severity") in {"high", "medium", "low"} for item in semantic_bypasses)
+        and workload_coverage.get("portal_display_capped") is not True
+        and not any(item in {"attachment_points", "bypass_risks", "review_findings"}
+                    for item in workload_coverage.get("result_lists_at_cap", []))
+        and (not workload_coverage.get("selected_parts")
+             or workload_coverage.get("selected_parts") == workload_coverage.get("analyzed_parts"))
+    )
     return {
         "schema": "agenticdome.integration-plan.v1",
         "inspection_report_sha256": _exportable_inspection(report).get("report_sha256"),
@@ -1684,10 +1695,12 @@ def integration_plan(root: Path) -> Dict[str, Any]:
             "unresolved_bypasses": len(semantic_bypasses),
             "high_severity_bypasses": sum(1 for item in semantic_bypasses if item.get("severity") == "high"),
             "review_required": len(semantic_reviews),
-            "production_ready": not semantic_bypasses and not semantic_reviews and semantic.get("confidence") in {"high", "partial"}
-            and semantic.get("workload_coverage", {}).get("cross_part_flow_proven", True)
-            and not any(item in {"attachment_points", "bypass_risks", "review_findings"}
-                        for item in semantic.get("workload_coverage", {}).get("result_lists_at_cap", [])),
+            "review_policy": "advisory",
+            "assessment_complete": assessment_complete,
+            "onboarding_policy": observations_policy,
+            "production_ready": not any(item.get("severity") == "high" for item in semantic_bypasses)
+            and semantic.get("confidence") in {"high", "partial"}
+            and assessment_complete,
             "cross_workload_review_required": semantic.get("workload_coverage", {}).get("cross_part_flow_proven") is False,
             "cross_part_edges_observed": int(semantic.get("workload_coverage", {}).get("cross_part_edges", {}).get("observed_count", 0)),
         },
@@ -2498,6 +2511,7 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
                    *, plan: Optional[Dict[str, Any]] = None) -> Tuple[int, Dict[str, Any]]:
     from .client import AgenticDomeClient
     from .action_path_proof import load_action_path_proof
+    from .onboarding_observations import POLICY as observations_policy, observations_summary
 
     plan = plan or integration_plan(root)
     config_path = _agenticdome_dir(root) / "config.json"
@@ -2548,10 +2562,18 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
     }
     semantic_gate = plan.get("semantic_gate", {})
     cross_part_review_required = bool(semantic_gate.get("cross_workload_review_required"))
+    observations = observations_summary(semantic_gate)
+    bypass_rows = plan.get("semantic_analysis", {}).get("bypass_risks", [])
+    if not isinstance(bypass_rows, list) or any(
+        not isinstance(row, dict) or row.get("severity") not in {"high", "medium", "low"}
+        for row in bypass_rows
+    ):
+        observations["classification_complete"] = False
     semantic_ready = (
         semantic_gate.get("confidence") in {"high", "partial"}
-        and int(semantic_gate.get("unresolved_bypasses", 0)) == 0
-        and int(semantic_gate.get("review_required", 0)) == 0
+        and observations["classification_complete"]
+        and int(semantic_gate.get("high_severity_bypasses", 0)) == 0
+        and semantic_gate.get("assessment_complete", True) is True
     )
     result = {
         "schema": "agenticdome.verification-result.v1",
@@ -2559,6 +2581,8 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
         "mode": "live_sidecar_fixed_payload" if live else "local_sim_fixed_payload",
         "source_upload": False,
         "framework_runtime_instantiated": False,
+        "onboarding_policy": observations_policy,
+        "onboarding_observations": observations,
         "decision_cases": outcomes,
         "static_coverage": plan["coverage"],
         "semantic_gate": {
@@ -2569,10 +2593,13 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
             "unresolved_bypasses": int(semantic_gate.get("unresolved_bypasses", 0)),
             "high_severity_bypasses": int(semantic_gate.get("high_severity_bypasses", 0)),
             "review_required": int(semantic_gate.get("review_required", 0)),
+            "review_policy": "advisory",
+            "review_owner": "coding_assistant_or_agenticdome",
+            "assessment_complete": semantic_gate.get("assessment_complete", True) is True,
             "passed": semantic_ready,
             "cross_part_review_required": cross_part_review_required,
             "cross_part_edges_observed": int(semantic_gate.get("cross_part_edges_observed", 0)),
-            "production_ready": semantic_ready and not cross_part_review_required,
+            "production_ready": semantic_ready,
         },
         "application_tests": application_tests,
         "action_path_proof": load_action_path_proof(root),
@@ -2580,17 +2607,39 @@ def verify_project(root: Path, live: bool = False, run_tests: bool = False,
             and not plan["coverage"]["gaps"]
             and (not run_tests or semantic_ready)
             and (not run_tests or application_tests["passed"] is True),
-        "clarification": "Decision cases use fixed payloads. ready=true means local checks passed, not production approval. Split analyses also require a tenant-admin review of cross-part paths, workload-specific integration tests and live runtime evidence; dynamic paths remain outside static proof.",
+        "clarification": "ready=true means required local checks passed, not production activation. Lower-severity static candidates, reviews and cross-part limitations are optional observations in .agenticdome/DISCLAIMER.md. High-severity findings, incomplete source, missing protection, failing tests and runtime proof failures remain blocking. Fixed decision cases do not execute customer actions.",
     }
     canonical = json.dumps(result, sort_keys=True, separators=(",", ":")).encode("utf-8")
     result["report_sha256"] = hashlib.sha256(canonical).hexdigest()
+    _write_onboarding_disclaimer(root, plan, result)
     return (0 if result["ready"] else 2), result
 
 
+def _write_onboarding_disclaimer(root: Path, plan: Dict[str, Any], verification: Dict[str, Any],
+                                 *, evidence_status: str = "Current local verification") -> None:
+    from .onboarding_observations import FILE, disclaimer_markdown
+    target = root / FILE
+    if target.is_symlink() or not target.resolve().is_relative_to(root.resolve()):
+        raise SystemExit("The disclaimer output is a symlink or leaves this workload; use a regular local output path.")
+    # Reject symlinked ancestors even when they happen to point inside the root.
+    if any(parent.is_symlink() for parent in target.parents if parent != root and root in parent.parents):
+        raise SystemExit("The disclaimer output directory is a symlink; use a regular local output path.")
+    _write_local_text(target, disclaimer_markdown(plan, verification, evidence_status=evidence_status))
+
+
 def _reconciliation_markdown(plan: Dict[str, Any], verification: Dict[str, Any], report_digest: str) -> str:
     """Give a bounded, source-free worklist without accepting AI claims as proof."""
     semantic = plan.get("semantic_analysis") if isinstance(plan.get("semantic_analysis"), dict) else {}
     gate = verification.get("semantic_gate") if isinstance(verification.get("semantic_gate"), dict) else {}
+    from .onboarding_observations import POLICY as observations_policy
+    bypass_rows = semantic.get("bypass_risks", [])
+    known_severities = isinstance(bypass_rows, list) and all(
+        isinstance(row, dict) and row.get("severity") in {"high", "medium", "low"}
+        for row in bypass_rows
+    )
+    optional_policy = (verification.get("onboarding_policy") == observations_policy
+                       and verification.get("onboarding_observations", {}).get("classification_complete") is True
+                       and known_severities)
 
     def groups(field: str) -> List[Tuple[str, str, int, List[int]]]:
         grouped: Dict[Tuple[str, str], List[int]] = {}
@@ -2598,6 +2647,8 @@ def _reconciliation_markdown(plan: Dict[str, Any], verification: Dict[str, Any],
         for item in rows[:100]:
             if not isinstance(item, dict):
                 continue
+            if optional_policy and field == "bypass_risks" and item.get("severity") != "high":
+                continue
             boundary = str(item.get("boundary") or "unknown")
             if boundary not in {"prompt_ingress", "tool_execution", "output_egress"}:
                 boundary = "unknown"
@@ -2627,11 +2678,16 @@ def _reconciliation_markdown(plan: Dict[str, Any], verification: Dict[str, Any],
         "This is a local, source-free worklist for the current validation run. It is not a bypass waiver, a code patch, or live tenant proof.",
         "The AI-authored AgenticDome_Integration.md remains an assertion until these checks and real-path tests pass.", "",
         f"- AI report SHA-256: `{report_digest}`",
-        f"- Action-required candidates: {int(gate.get('unresolved_bypasses', 0))}",
-        f"- Review-required internal or indirect paths: {int(gate.get('review_required', 0))}",
+        f"- Blocking findings: {int(gate.get('high_severity_bypasses' if optional_policy else 'unresolved_bypasses', 0))}",
+        f"- Advisory internal or indirect paths: {int(gate.get('review_required', 0))} (owner: coding assistant or AgenticDome; not a local readiness blocker)",
         f"- Semantic confidence: {gate.get('confidence', 'unavailable')}", "",
+        "## Who does what", "",
+        "The coding assistant traces grouped code candidates and runs real-path tests. The customer reviews the change summary, intended routes and deployment location—not scanner line numbers.",
+        "Lower-severity candidates and review notes are optional tenant observations in .agenticdome/DISCLAIMER.md. They do not require an acknowledgement or AgenticDome clearance before onboarding continues." if optional_policy else "If an action-required candidate is already protected in a real-path test, supply a minimal reproduction to AgenticDome. Stop unchanged retries; do not add duplicate guards or waive the finding.",
+        "Pending deployment settings and live proof belong to the service operator and are separate from optional observations.", "",
     ]
-    for field, title in (("bypass_risks", "Action required"), ("review_findings", "Trace and classify")):
+    sections = (("bypass_risks", "Action required"),) if optional_policy else (("bypass_risks", "Action required"), ("review_findings", "Trace and classify"))
+    for field, title in sections:
         lines.extend([f"## {title}", ""])
         found = groups(field)
         if not found:
@@ -2652,10 +2708,14 @@ def _reconciliation_markdown(plan: Dict[str, Any], verification: Dict[str, Any],
         lines.append("- The AI report itself says a relevant path was NOT ASSESSED or unprotected. Inspect and protect that path, then update the report; its zero-count rows cannot clear this scope gap.")
     if plan.get("coverage", {}).get("gaps"):
         lines.append("- Required boundary categories are missing from the inspected workload. Attach and test them before retrying.")
-    if gate.get("cross_part_review_required"):
+    if gate.get("assessment_complete") is False or not known_severities:
+        lines.append("- Source assessment or severity classification is incomplete. The coding assistant must resolve that required check; unclassified candidates are not optional observations.")
+    if gate.get("cross_part_review_required") and not optional_policy:
         lines.append("- Analysis was split across parts; trace cross-part calls and alternate entry paths. Separate parts are not a proof of guard dominance.")
     if tests.get("passed") is not True:
         lines.append("- Workload tests did not pass or were not detected. Run the local test command directly to see its output; no test log is uploaded.")
+    if report_scope.get("activation_pending"):
+        lines.append("- Local source assessment and operator activation are separate. Complete the report's exact runtime handoff and safe staging proof before production activation.")
     lines.extend([
         "- Give these grouped paths to your coding assistant together with the real source. Keep the assistant's changes reviewable and update only the canonical AgenticDome_Integration.md.",
         "- Rerun `agenticdome validate-report --report AgenticDome_Integration.md` after code and test changes. Do not edit the JSON evidence by hand.",
@@ -2688,7 +2748,19 @@ def validate_ai_integration_report(root: Path, report_path: Path) -> Tuple[int,
     scope = (quoted.group(1) if quoted else scope_match.group(1).split()[0]).strip().rstrip("/")
     if Path(scope).name.casefold() != root.name.casefold() or ".." in Path(scope).parts:
         raise SystemExit("The report's Workload scope does not match this workload root. Run from the correct deployable service.")
-    rows = re.findall(r"^\|\s*([1-8])\.([^\r\n]*)", markdown, re.MULTILINE)
+    # Numbered operator steps are not interception categories. Older reports
+    # without a table heading remain readable, with the original strict counts.
+    inventory_lines = []
+    has_header = bool(re.search(r"^\s*\|\s*Category\s*\|", markdown, re.MULTILINE))
+    in_inventory = not has_header
+    for line in markdown.splitlines():
+        if has_header and not line.lstrip().startswith("|"):
+            in_inventory = False
+        if re.match(r"^\s*\|\s*Category\s*\|", line):
+            in_inventory = True
+        if in_inventory:
+            inventory_lines.append(line)
+    rows = re.findall(r"^\s*\|\s*\*?\*?([1-8])\.([^\r\n]*)", "\n".join(inventory_lines), re.MULTILINE)
     if len(rows) != 8 or {number for number, _ in rows} != {str(index) for index in range(1, 9)}:
         raise SystemExit("The integration report needs one valid row for each of the eight interception categories.")
     reported_unprotected = 0
@@ -2700,7 +2772,9 @@ def validate_ai_integration_report(root: Path, report_path: Path) -> Tuple[int,
         if any(value > 10000 for value in (found, existing, new, unprotected, live)) or existing + new + unprotected != found or live > existing + new:
             raise SystemExit("The report counts do not reconcile. Correct the AI integration inventory before validation.")
         reported_unprotected += unprotected
-    scope_incomplete = bool(re.search(r"\bNOT ASSESSED\b", markdown, re.IGNORECASE))
+    from .report_scope import assessment_scope
+    report_scope = assessment_scope(markdown)
+    scope_incomplete = report_scope["scope_incomplete"]
     digest = hashlib.sha256(markdown.encode("utf-8")).hexdigest()
 
     inspection = _exportable_inspection(inspect_repository(root))
@@ -2719,6 +2793,7 @@ def validate_ai_integration_report(root: Path, report_path: Path) -> Tuple[int,
     local_checks_passed = exit_code == 0 and verification.get("ready") is True
     verification["ai_report_scope"] = {
         "scope_incomplete": scope_incomplete,
+        "activation_pending": report_scope["activation_pending"],
         "reported_unprotected": reported_unprotected,
     }
     if scope_incomplete or reported_unprotected:
@@ -2739,18 +2814,25 @@ def validate_ai_integration_report(root: Path, report_path: Path) -> Tuple[int,
     _write_json(inspection_path, inspection)
     _write_json(verification_path, verification)
     _write_local_text(reconciliation_path, _reconciliation_markdown(plan, verification, digest))
+    _write_onboarding_disclaimer(root, plan, verification)
+    has_observations = int(verification.get("onboarding_observations", {}).get("total_count", 0)) > 0
     partial_coverage = local_checks_passed and not verification["ready"]
     return exit_code, {
-        "status": "validation_passed" if verification["ready"] else (
+        "status": ("validation_passed_with_observations" if has_observations else "validation_passed") if verification["ready"] else (
             "partial_coverage" if partial_coverage else "validation_needs_attention"
         ),
         "inspection": str(inspection_path.relative_to(root)),
         "verification": str(verification_path.relative_to(root)),
         "reconciliation": str(reconciliation_path.relative_to(root)),
+        "disclaimer": ".agenticdome/DISCLAIMER.md",
+        "optional_observations": int(verification.get("onboarding_observations", {}).get("total_count", 0)),
         "ai_integration_report_sha256": digest,
         "ready": verification["ready"],
+        "local_status": ("passed_with_observations" if has_observations else "passed") if verification["ready"] else "needs_code_or_test_fix",
+        "activation_status": "pending_operator_checks",
+        "review_owner": "coding_assistant_or_agenticdome",
         "next_action": (
-            "Import both JSON files in Onboarding; then run the assigned-runtime check and test a real action path. No customer action executes in these fixed decision cases."
+            "Import both JSON files and continue tenant verification. Optional observations are in .agenticdome/DISCLAIMER.md; investigating them is the tenant's choice. Prove a safe real action before production activation."
             if verification["ready"] else (
                 "Import both JSON files as partial evidence and run a tenant-policy diagnostic if connected. "
                 "Open .agenticdome/RECONCILIATION.md, assess or protect the remaining paths, then rerun validate-report. "

agenticdome_sdk/onboarding_observations.py

@@ -0,0 +1,74 @@
+"""Optional static observations, separate from runtime enforcement and proof."""
+
+import re
+from pathlib import Path
+
+
+POLICY = "pass_with_observations_v1"
+SCHEMA = "agenticdome.onboarding-observations.v1"
+FILE = ".agenticdome/DISCLAIMER.md"
+
+
+def observations_summary(gate):
+    names = ("action_required", "unresolved_bypasses", "review_required", "high_severity_bypasses")
+    values = {name: gate.get(name, 0) for name in names}
+    valid = "high_severity_bypasses" in gate and all(
+        isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= 10000
+        for value in values.values()
+    )
+    counts = {name: value if isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= 10000 else 0
+              for name, value in values.items()}
+    actions = max(counts["action_required"], counts["unresolved_bypasses"])
+    high = counts["high_severity_bypasses"]
+    valid = valid and high <= actions
+    candidates = max(0, actions - high)
+    cross_part = bool(gate.get("cross_part_review_required") or gate.get("cross_workload_review_required"))
+    return {
+        "schema": SCHEMA, "policy": POLICY, "file": FILE,
+        "classification_complete": valid,
+        "candidate_count": candidates, "review_count": counts["review_required"],
+        "cross_part_note": cross_part,
+        "total_count": candidates + counts["review_required"] + int(cross_part),
+    }
+
+
+def disclaimer_markdown(plan, verification, *, evidence_status="Current local verification"):
+    gate = verification.get("semantic_gate", {})
+    observations = verification.get("onboarding_observations") or observations_summary(gate)
+    semantic = plan.get("semantic_analysis", {})
+    lines = [
+        "# AgenticDome onboarding observations and disclaimer", "",
+        f"Evidence status: {evidence_status}", "",
+        "These observations are optional. The tenant may investigate or improve these paths later; no acknowledgement or AgenticDome clearance is required to continue onboarding solely because of these observations.",
+        "Passing local checks does not certify every execution branch or activate production. High-severity bypass findings, missing protection, uninspected source, failed tests and runtime/tenant proof failures remain blocking. Runtime BLOCKED decisions, unknown verdicts and policy failures still stop execution.", "",
+        "| Observation | Count | Tenant action |",
+        "|---|---:|---|",
+        f"| Lower-severity analyzer candidates | {observations['candidate_count'] if observations['classification_complete'] else 0} | Optional investigation |",
+        f"| Review-only paths | {observations['review_count']} | Optional investigation |",
+        f"| Cross-part flow not automatically proven | {int(observations['cross_part_note'])} | Optional additional path tests |", "",
+        "## Optional locations", "",
+    ]
+    if not observations["classification_complete"]:
+        lines.extend(["Severity classification is incomplete. Unclassified candidates remain in RECONCILIATION.md for the coding assistant to resolve; they are not optional observations.", ""])
+    for field in ("bypass_risks", "review_findings"):
+        rows = semantic.get(field, [])
+        if not isinstance(rows, list):
+            continue
+        for item in rows[:100]:
+            if not isinstance(item, dict) or (field == "bypass_risks" and (
+                not observations["classification_complete"] or item.get("severity") not in {"medium", "low"}
+            )):
+                continue
+            raw = str(item.get("path") or "")[:500].replace("\\", "/")
+            if not raw or raw.startswith("/") or ".." in Path(raw).parts:
+                location = "[invalid relative path]"
+            else:
+                location = re.sub(r"[^A-Za-z0-9_./ -]", "_", raw)
+            line = item.get("line", 1)
+            line = max(1, min(line, 10000000)) if isinstance(line, int) and not isinstance(line, bool) else 1
+            kind = "analyzer candidate" if field == "bypass_risks" else "review-only path"
+            lines.append(f"- `{location}:{line}` — {kind}; static metadata may not observe an existing shared or downstream guard.")
+    if observations["total_count"] == 0:
+        lines.append("No optional observations in this run.")
+    lines.extend(["", "This file is replaced in place on verification; it is a local note, not a protection certificate or an authorization to execute a business action.", ""])
+    return "\n".join(lines)

agenticdome_sdk/report_scope.py

@@ -0,0 +1,58 @@
+"""Separate current source assessment from historical and operator handoff text.
+
+Markdown remains an assertion; inspection, semantic bypass and test gates still
+run independently. Unknown application read sites remain source gaps.
+"""
+import re
+
+
+OPERATOR_SECTIONS = {
+    "runtime configuration handoff", "must do steps to activate firewall",
+    "activation prerequisites", "production activation",
+}
+HISTORY_SECTIONS = {"preserved historical baseline and unique evidence", "historical evidence"}
+
+
+def assessment_scope(markdown):
+    headings = []
+    source_incomplete = False
+    activation_pending = False
+    source_rows = 0
+    structured = False
+    for line in markdown.splitlines():
+        match = re.match(r"^\s*(#{1,6})\s+(.+?)\s*$", line)
+        if match:
+            level, title = len(match[1]), match[2].casefold()
+            headings = [(depth, name) for depth, name in headings if depth < level]
+            headings.append((level, title))
+            structured = structured or title == "source assessment scope"
+            continue
+        sections = {name for _, name in headings}
+        if sections & HISTORY_SECTIONS:
+            continue
+        cells = [cell.strip().strip("*`").strip() for cell in line.strip().strip("|").split("|")] if line.lstrip().startswith("|") else []
+        if "source assessment scope" in sections and cells:
+            if cells[0].casefold() == "runtime source paths":
+                source_rows += 1
+                source_incomplete |= len(cells) < 2 or cells[1].upper() != "ASSESSED" or bool(re.search(r"\bNOT ASSESSED\b", line, re.I))
+                continue
+            if cells[0].casefold() == "production activation":
+                activation_pending |= len(cells) < 2 or cells[1].upper() != "VERIFIED"
+                continue
+        # A missing code read site is a source defect, even in an operator table.
+        if cells and cells[0].startswith(("AGENTICDOME_", "AGENTIC_ORCHESTRATOR_")):
+            if len(cells) < 2 or re.search(r"NOT ASSESSED|Not found|Unknown", cells[1], re.I):
+                source_incomplete = True
+        not_assessed = bool(re.search(r"\bNOT ASSESSED\b", line, re.I))
+        operator_row = bool(cells and (
+            cells[0].startswith(("AGENTICDOME_", "AGENTIC_ORCHESTRATOR_"))
+            or (len(cells) == 4 and re.match(r"^[1-6]\.", cells[0]))
+        ))
+        if sections & OPERATOR_SECTIONS:
+            activation_pending |= (not_assessed and operator_row) or bool(re.search(r"REQUIRED BEFORE LIVE|LIVE VERIFICATION PENDING|\bPENDING\b", line, re.I))
+            # Arbitrary uninspected source prose cannot be hidden in handoff.
+            source_incomplete |= not_assessed and not operator_row
+        else:
+            source_incomplete |= not_assessed
+    source_incomplete |= structured and source_rows != 1
+    return {"scope_incomplete": bool(source_incomplete), "activation_pending": bool(activation_pending)}