agenticdome-python-sdk 1.2.40__tar.gz → 1.2.43__tar.gz

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.40
+Version: 1.2.43
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -2845,10 +2845,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2865,7 +2862,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/README.md

@@ -2732,10 +2732,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2752,7 +2749,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.40
+Version: 1.2.43
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -2845,10 +2845,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2865,7 +2862,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_python_sdk.egg-info/SOURCES.txt

@@ -45,10 +45,12 @@ agenticdome_sdk/mcp_verification.py
 agenticdome_sdk/microsoft_agent_framework.py
 agenticdome_sdk/microsoft_ai_foundry.py
 agenticdome_sdk/onboarding_cli.py
+agenticdome_sdk/onboarding_observations.py
 agenticdome_sdk/openai_agents.py
 agenticdome_sdk/outcomes.py
 agenticdome_sdk/proof.py
 agenticdome_sdk/pydantic.py
+agenticdome_sdk/report_scope.py
 agenticdome_sdk/simulation.py
 agenticdome_sdk/smolagents.py
 docs/customer-onboarding.md

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/_framework_firewall.py

@@ -202,7 +202,8 @@ class FrameworkFirewallBase:
             timeout=config.timeout_s,
         )
         self.token_store = token_store or build_token_store(config, logger)
-        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id)
+        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id, api_base=config.api_base, api_key=config.api_key,
+            sender=getattr(self.client, "report_action_evidence", None))
         self.denied_error = denied_error
         self.label = label
         self.logger = logger
@@ -623,14 +624,17 @@ class FrameworkFirewallBase:
                 decision = await self.aauthorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:
@@ -659,14 +663,17 @@ class FrameworkFirewallBase:
                 decision = self.authorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/catalog_snapshot.json

@@ -2,22 +2,22 @@
     "schema": "agenticdome.catalog-snapshot.v1",
     "catalog_schema": "agenticdome.hook-catalog.v1",
     "verified_at": "2026-10-02",
-    "python_sdk_version": "1.2.40",
+    "python_sdk_version": "1.2.43",
     "published_packages": {
         "agenticdome-python-sdk": {
             "registry": "pypi",
-            "version": "1.2.40",
-            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.40/"
+            "version": "1.2.43",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.43/"
         },
         "agenticdome-sdk": {
             "registry": "npm",
-            "version": "0.6.3",
-            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.3"
+            "version": "0.6.14",
+            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.14"
         },
         "agenticdome-openclaw-security": {
             "registry": "npm",
-            "version": "1.0.2",
-            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.2"
+            "version": "1.0.13",
+            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.13"
         },
         "openclaw": {
             "registry": "npm",

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/client.py

@@ -375,6 +375,12 @@ class AgenticDomeClient:
         if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
             raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
+    def report_action_evidence(self, kind: str, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Use the existing tenant SDK transport; runtime durably relays evidence."""
+        if kind not in {"events", "outcomes"}:
+            raise ValueError("Evidence kind must be events or outcomes")
+        return self._request("POST", "/mesh/evidence/" + kind, json_body=payload, timeout=5)
+
     def _request(
         self,
         method: str,

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/connect.py

@@ -253,9 +253,9 @@ def run_connect(root: Path, args: Any) -> Dict[str, Any]:
     broker_setup["sdk_mode"] = effective_config.get("execution_broker_mode", "existing_sdk_or_environment_default")
     cross_part_review_required = semantic.get("workload_coverage", {}).get("cross_part_flow_proven") is False
     next_action = (
-        "Review the generated pull request and run agenticdome verify. Then review cross-part call paths and workload-specific tests in the portal before activation."
+        "Review the generated pull request and run agenticdome verify. Cross-part limitations will be recorded as optional observations in .agenticdome/DISCLAIMER.md; no acknowledgement is required solely for them."
         if args.open_pr else
-        "Review the generated patch, apply it on a branch, and run agenticdome verify. Then review cross-part call paths and workload-specific tests in the portal before activation."
+        "Review the generated patch, apply it on a branch, and run agenticdome verify. Cross-part limitations will be recorded as optional observations in .agenticdome/DISCLAIMER.md; no acknowledgement is required solely for them."
     ) if cross_part_review_required else (
         "Review the generated pull request and run agenticdome verify."
         if args.open_pr else "Review the generated patch, apply it on a branch, then run agenticdome verify."

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/guided_integration.py

@@ -490,9 +490,10 @@ def preview(root: Path, plan: Optional[Dict[str, Any]] = None, *, target: str =
         + ", A2A " + str(existing.get("a2a_call_candidates", 0))
         + ", MCP " + str(existing_surfaces.get("mcp", 0))
         + " (categories may overlap; no customer action was exercised)",
-        "- Action-required semantic findings: " + str(semantic_gate.get("action_required", "not assessed")),
-        "- Review-required semantic findings: " + str(semantic_gate.get("review_required", "not assessed")),
+        "- Raw semantic action candidates (lower severity may be optional): " + str(semantic_gate.get("action_required", "not assessed")),
+        "- Optional review observations: " + str(semantic_gate.get("review_required", "not assessed")),
         "",
+        "Optional observations are written to .agenticdome/DISCLAIMER.md on verification; high-severity and required protection/test failures remain blocking.", "",
         "## Framework hooks to attach or verify", "",
     ]
     for recommendation in plan.get("hook_recommendations", []):

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/hook_catalog.py

@@ -325,7 +325,7 @@ FRAMEWORK_HOOK_CATALOG: Dict[str, Dict[str, Any]] = {
         "adapter_module": "agenticdome-openclaw-security",
         "adapter_class": "OpenClawFirewall",
         "attachment_methods": ["protectedExecute", "sanitizeOutput"],
-        "native_hooks": ["before_agent_run", "before_tool_call", "tool_result_persist"],
+        "native_hooks": ["before_agent_run", "before_tool_call", "after_tool_call", "tool_result_persist"],
         "docs": "agenticdome-openclaw-security package README",
     },
     "mcp-ts": {

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/lifecycle.py

@@ -1,7 +1,7 @@
 """Privacy-bounded Verified Action lifecycle reporting.
 
 The runtime authorization path remains authoritative. This module reports only
-minimized lifecycle evidence through a separately scoped portal credential and
+minimized lifecycle evidence through the existing tenant runtime credential and
 never sends tool arguments, prompts, responses, credentials, or source code.
 """
 
@@ -15,9 +15,11 @@ import logging
 import os
 import queue
 import threading
+import time
+import urllib.error
 import urllib.request
 import uuid
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from datetime import datetime, timezone
 from typing import Any, Callable, Dict, Optional, TypeVar
 
@@ -72,33 +74,46 @@ class VerifiedActionDenied(RuntimeError):
 class VerifiedActionReporter:
     """Non-blocking, bounded reporter for one tenant's Verified Actions.
 
-    Configure ``AGENTICDOME_EVIDENCE_API_BASE`` and a portal token containing
-    only ``evidence:write``. Missing evidence credentials disable reporting;
-    they never weaken or bypass the primary AgenticDome authorization call.
+    SDK credentials enable reporting to the assigned runtime by default.
+    Explicit portal evidence credentials remain supported for existing callers.
     """
 
-    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256) -> None:
+    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256,
+                 runtime_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> None:
         self.portal = portal.rstrip("/")
         self.access_token = access_token.strip()
         self.tenant_id = tenant_id.strip()
+        self.runtime_base = runtime_base.rstrip("/")
+        self.api_key = api_key.strip()
+        self.sender = sender
+        self.runtime_mode = not (self.portal and self.access_token)
         self.timeout = max(1.0, min(float(timeout), 30.0))
         self._queue: "queue.Queue[tuple[str, Dict[str, Any]] | None]" = queue.Queue(maxsize=max(16, min(int(queue_size), 4096)))
         self._worker: Optional[threading.Thread] = None
         self._lock = threading.Lock()
+        self._stats = {"queued": 0, "delivered": 0, "failed": 0, "dropped": 0}
 
     @classmethod
-    def from_env(cls, *, tenant_id: str = "") -> "VerifiedActionReporter":
+    def from_env(cls, *, tenant_id: str = "", api_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> "VerifiedActionReporter":
+        if os.getenv("AGENTICDOME_EVIDENCE_ENABLED", "true").lower() in {"0", "false", "off", "no"}:
+            return cls()
         return cls(
             os.getenv("AGENTICDOME_EVIDENCE_API_BASE", ""),
             os.getenv("AGENTICDOME_EVIDENCE_TOKEN", ""),
             tenant_id=tenant_id or os.getenv("AGENTICDOME_TENANT_ID", ""),
             timeout=float(os.getenv("AGENTICDOME_EVIDENCE_TIMEOUT_S", "5") or "5"),
             queue_size=int(os.getenv("AGENTICDOME_EVIDENCE_QUEUE_SIZE", "256") or "256"),
+            runtime_base=api_base or os.getenv("AGENTICDOME_API_BASE", ""),
+            api_key=api_key or os.getenv("AGENTICDOME_API_KEY", ""), sender=sender,
         )
 
     @property
     def enabled(self) -> bool:
-        return bool(self.portal and self.access_token and self.tenant_id)
+        return bool(self.tenant_id and ((self.portal and self.access_token) or
+                    (self.runtime_base.startswith(("https://", "http://")) and self.api_key)))
+
+    def stats(self) -> Dict[str, Any]:
+        return dict(self._stats, pending=self._queue.unfinished_tasks, enabled=self.enabled, transport="runtime" if self.runtime_mode else "portal")
 
     def new_context(self, *, operation_type: str, tool_name: Optional[str] = None, tool_version: Optional[str] = None,
                     arguments: Any = None, destination: Optional[str] = None, chain_id: Optional[str] = None,
@@ -141,6 +156,10 @@ class VerifiedActionReporter:
         }
         return self._enqueue("/api/agentguard/verified-actions/events", payload)
 
+    def with_arguments(self, context: VerifiedActionContext, arguments: Any) -> VerifiedActionContext:
+        """Keep correlation IDs while hashing the arguments actually admitted for execution."""
+        return replace(context, arguments_sha256=_digest(arguments))
+
     def outcome(self, context: VerifiedActionContext, outcome_class: str, *, side_effect_reference: Optional[str] = None) -> bool:
         allowed = {"not_attempted", "rejected", "accepted", "succeeded", "partially_succeeded", "failed", "rolled_back", "unknown"}
         outcome = _token(outcome_class, allowed, "unknown")
@@ -150,8 +169,8 @@ class VerifiedActionReporter:
             "chain_id": context.chain_id, "action_id": context.action_id,
             "jti": "sdk_" + uuid.uuid4().hex, "outcome_class": outcome,
             "assurance_level": "sdk_reported", "authorised_action_sha256": context.arguments_sha256,
-            "observed_action_sha256": context.arguments_sha256, "destination_sha256": context.destination_sha256,
-            "side_effect_ref_sha256": _digest(side_effect_reference), "attempted_at": now, "completed_at": now,
+            "observed_action_sha256": None if outcome == "not_attempted" else context.arguments_sha256, "destination_sha256": context.destination_sha256,
+            "side_effect_ref_sha256": _digest(side_effect_reference), "completed_at": now,
         }
         return self._enqueue("/api/agentguard/verified-actions/outcomes", payload)
 
@@ -162,7 +181,7 @@ class VerifiedActionReporter:
         marker = {"_flush_event": completed}
         if not self._enqueue("", marker):
             return False
-        return completed.wait(max(0.1, timeout))
+        return completed.wait(max(0.1, timeout)) and self._stats["failed"] == 0
 
     def _enqueue(self, path: str, payload: Dict[str, Any]) -> bool:
         if not self.enabled:
@@ -170,8 +189,10 @@ class VerifiedActionReporter:
         self._ensure_worker()
         try:
             self._queue.put_nowait((path, payload))
+            if path:self._stats["queued"] += 1
             return True
         except queue.Full:
+            self._stats["dropped"] += 1
             logger.warning("Verified Action evidence queue is full; authorization behavior is unchanged.")
             return False
 
@@ -193,14 +214,27 @@ class VerifiedActionReporter:
                 if isinstance(marker, threading.Event):
                     marker.set()
                     continue
-                request = urllib.request.Request(
-                    self.portal + path, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST",
-                    headers={"Authorization": "Bearer " + self.access_token, "Content-Type": "application/json", "Accept": "application/json"},
-                )
-                with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310 - configured AgenticDome portal
-                    response.read(1)
+                for attempt in range(3):
+                    try:
+                        if self.runtime_mode and self.sender:
+                            self.sender(path.rsplit("/", 1)[-1], payload)
+                        else:
+                            endpoint = (self.runtime_base + "/mesh/evidence/" + path.rsplit("/", 1)[-1]) if self.runtime_mode else self.portal + path
+                            headers = {"Content-Type": "application/json", "Accept": "application/json", "X-Tenant-Id": self.tenant_id}
+                            headers.update({"X-API-Key": self.api_key} if self.runtime_mode else {"Authorization": "Bearer " + self.access_token})
+                            request = urllib.request.Request(endpoint, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST", headers=headers)
+                            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                                response.read(1)
+                        self._stats["delivered"] += 1
+                        break
+                    except Exception as exc:
+                        status = getattr(exc, "code", getattr(exc, "status_code", None))
+                        if attempt == 2 or status is not None and status not in {429, 500, 502, 503, 504}:
+                            raise
+                        time.sleep(.1 * (2 ** attempt))
             except Exception as exc:  # evidence must never alter the protected operation
-                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged: %s", exc)
+                self._stats["failed"] += 1
+                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged (%s)", type(exc).__name__)
             finally:
                 self._queue.task_done()
 

{agenticdome_python_sdk-1.2.40 → agenticdome_python_sdk-1.2.43}/agenticdome_sdk/mcp_host.py

@@ -13,6 +13,7 @@ import time
 import uuid
 import re
 from collections import defaultdict, deque
+from contextvars import ContextVar
 from dataclasses import dataclass
 from datetime import date
 from inspect import isawaitable
@@ -23,6 +24,8 @@ from .client import AgenticDomeClient
 from ._mode import credentials_or_local_sim
 from .lifecycle import VerifiedActionReporter
 
+_lifecycle_decision: ContextVar[Optional[Dict[str, Any]]] = ContextVar("agenticdome_mcp_lifecycle_decision", default=None)
+
 try:
     from .exceptions import AgenticDomeHTTPError
 except Exception:  # pragma: no cover - compatibility with older package layouts
@@ -375,7 +378,8 @@ class AgenticDomeMCPHostFirewall:
             timeout=self.config.timeout_s,
         )
         self.token_store = token_store or _build_token_store(self.config)
-        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id)
+        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id,
+            api_base=self.config.api_base, api_key=self.config.api_key, sender=getattr(self.client, "report_action_evidence", None))
         self.provider_action_rules = dict(provider_action_rules or {})
         self.resolve_provider_facts = resolve_provider_facts
         self._rate_lock = Lock()
@@ -975,6 +979,9 @@ class AgenticDomeMCPHostFirewall:
         )
 
     async def _handle_blocking_decision(self, *, decision: Dict[str, Any], rid: Any, context: Dict[str, Any], method: str, operation: str) -> Optional[Dict[str, Any]]:
+        evidence = _lifecycle_decision.get()
+        if evidence is not None:
+            evidence.update(verdict=self._verdict(decision), reason=self._reason(decision))
         verdict = self._verdict(decision)
         if verdict == "ALLOWED" or (verdict == "REDACTED" and self._sanitized_args(decision, explicit_only=True) is not None):
             return None
@@ -1433,7 +1440,7 @@ class AgenticDomeMCPHostFirewall:
         lifecycle = self.lifecycle_reporter.new_context(
             operation_type="mcp_operation", tool_name=tool_name, arguments=arguments,
             destination=self.config.mcp_server_url or self.config.mcp_server_id,
-            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id")) or None,
+            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id") or local_context.get("chain_id")) or None,
             action_id=self._safe_str(local_context.get("verified_action_id") or local_context.get("action_id")) or None,
             parent_action_id=self._safe_str(local_context.get("parent_action_id")) or None,
             initiator_type="human" if self._safe_str(local_context.get("user_id")) else "agent",
@@ -1441,13 +1448,25 @@ class AgenticDomeMCPHostFirewall:
         )
         self.lifecycle_reporter.phase(lifecycle, "requested", "requested")
 
-        gated = await self.preflight_request(mcp_request=mcp_request, context=context)
+        local_context.update(chain_id=lifecycle.chain_id, action_id=lifecycle.action_id, decision_id=lifecycle.action_id)
+        decision_evidence: Dict[str, Any] = {}
+        decision_token = _lifecycle_decision.set(decision_evidence)
+        try:
+            gated = await self.preflight_request(mcp_request=mcp_request, context=local_context)
+        except Exception:
+            self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
+            raise
+        finally:
+            _lifecycle_decision.reset(decision_token)
         if isinstance(gated, dict) and "error" in gated:
             self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
             self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
             return gated
 
-        self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+        admitted_arguments = self._extract_tool_call(gated)[1] if method == "tools/call" else self._params(gated)
+        lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, admitted_arguments)
+        if decision_evidence.get("verdict") in {"ALLOWED", "REDACTED"} and decision_evidence.get("reason") != "fail-open":
+            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
         self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
         self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")