agenticdome-python-sdk 1.2.41__tar.gz → 1.2.45__tar.gz

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.41
+Version: 1.2.45
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -21,11 +21,11 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
@@ -113,6 +113,11 @@ Dynamic: license-file
 
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -573,7 +578,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1323,7 +1328,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 
@@ -2845,10 +2850,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2865,7 +2867,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/README.md

@@ -1,5 +1,10 @@
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -460,7 +465,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1210,7 +1215,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 
@@ -2732,10 +2737,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2752,7 +2754,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.41
+Version: 1.2.45
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -21,11 +21,11 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
@@ -113,6 +113,11 @@ Dynamic: license-file
 
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -573,7 +578,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1323,7 +1328,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 
@@ -2845,10 +2850,7 @@ Plus, for every production deployment:
 
 Use `VerifiedActionReporter` for executable tool calls, function calls, MCP operations and external side effects that should appear in **Verified Actions**. It is not intended for health checks or every policy lookup.
 
-```bash
-export AGENTICDOME_EVIDENCE_API_BASE="https://your-control-plane.example"
-export AGENTICDOME_EVIDENCE_TOKEN="<portal-token-scoped-to-evidence:write>"
-```
+Framework tool wrappers and the MCP host report lifecycle evidence automatically using the existing `AGENTICDOME_API_BASE`, `AGENTICDOME_API_KEY` and `AGENTICDOME_TENANT_ID`. No separate portal credential is required. Upgrade both the SDK and assigned runtime to use automatic reporting. Set `AGENTICDOME_EVIDENCE_ENABLED=false` to opt out.
 
 ```python
 from agenticdome_sdk import VerifiedActionReporter, verified_action
@@ -2865,7 +2867,9 @@ def refresh_customer_record(customer_id: str):
     ...
 ```
 
-The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The dedicated evidence token is separate from the Runtime / SDK key: authorization stays on the assigned sidecar and evidence-delivery failure never changes its allow/deny decision. Integrations built on the shared framework `secure_tool` / `wrap_tool_handler` boundary and the MCP host/gateway wrapper report the same lifecycle automatically when these optional evidence variables are present; other custom boundaries can use the decorator above.
+The reporter uses a bounded, non-blocking queue and retains hashes plus normalized lifecycle metadata only. It never sends raw arguments, results, prompts, source, or credentials. The runtime queues accepted records in persistent Redis; its delivery worker relays them to the owning control plane using the existing per-sidecar service token. Network and storage failures remain pending for retry. Inspect `evidence.stats()` and call `evidence.flush()` before a short-lived process exits. SDK delivery failures and dropped records are counted and never change the protected operation's allow/deny decision.
+
+Retained outcomes are labeled `sdk_reported`. Policy lookups alone do not prove execution, and streaming acceptance does not prove final completion. Existing `AGENTICDOME_EVIDENCE_API_BASE` plus `AGENTICDOME_EVIDENCE_TOKEN` remains an explicit legacy portal override. Automatic reporting starts with new wrapped calls; it does not backfill historical telemetry.
 
 ---
 

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/__init__.py

@@ -1,4 +1,4 @@
-from .client import AgenticDomeClient, AgenticDomeError, AgenticDomeHTTPError
+from .client import AgenticDomeClient, AgenticDomeError, AgenticDomeHTTPError, ApprovalRequired
 from .identity import IDENTITY_CONTEXT_VERSION, canonicalize_identity_context, enrich_policy_context
 from .proof import create_dpop_proof, generate_rsa_proof_key, jwk_thumbprint
 from ._mode import LIVE_MODE, LOCAL_SIM_MODE, is_local_sim_mode, resolve_mode
@@ -10,6 +10,7 @@ __all__ = [
     "AgenticDomeClient",
     "AgenticDomeError",
     "AgenticDomeHTTPError",
+    "ApprovalRequired",
     "IDENTITY_CONTEXT_VERSION",
     "canonicalize_identity_context",
     "enrich_policy_context",

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/_framework_firewall.py

@@ -15,7 +15,7 @@ from dataclasses import dataclass
 from threading import Lock, Thread
 from typing import Any, Awaitable, Callable, Deque, Dict, Optional, Tuple, Type
 
-from .client import AgenticDomeClient
+from .client import AgenticDomeClient, ApprovalRequired
 from .lifecycle import VerifiedActionReporter
 from ._mode import credentials_or_local_sim
 
@@ -202,7 +202,8 @@ class FrameworkFirewallBase:
             timeout=config.timeout_s,
         )
         self.token_store = token_store or build_token_store(config, logger)
-        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id)
+        self.lifecycle_reporter = VerifiedActionReporter.from_env(tenant_id=config.tenant_id, api_base=config.api_base, api_key=config.api_key,
+            sender=getattr(self.client, "report_action_evidence", None))
         self.denied_error = denied_error
         self.label = label
         self.logger = logger
@@ -334,6 +335,8 @@ class FrameworkFirewallBase:
                     self._circuit_open_until = 0.0
                 return result
             except Exception as exc:
+                if isinstance(exc, ApprovalRequired):
+                    raise
                 last_error = exc
                 with self._circuit_lock:
                     self._circuit_failures += 1
@@ -345,6 +348,8 @@ class FrameworkFirewallBase:
         raise last_error
 
     def _failure(self, context: str, exc: Exception, fallback: Any) -> Any:
+        if isinstance(exc, ApprovalRequired):
+            raise exc
         if isinstance(exc, self.denied_error):
             raise exc
         if self.config.fail_closed:
@@ -623,14 +628,17 @@ class FrameworkFirewallBase:
                 decision = await self.aauthorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:
@@ -659,14 +667,17 @@ class FrameworkFirewallBase:
                 decision = self.authorize_tool_call(
                     session_id=sid, agent_id=aid, tool_name=tool_name, tool_args=call_args,
                     tool_platform=tool_platform, text=f"[{self.label}] {aid} calls {tool_name}",
+                    policy_context={"chain_id": lifecycle.chain_id, "action_id": lifecycle.action_id, "decision_id": lifecycle.action_id},
                 )
             except Exception:
                 self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
                 self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
                 raise
-            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
-            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             clean = self.sanitized_args(decision, call_args)
+            lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, clean)
+            if self.verdict(decision) in {"ALLOWED", "REDACTED"} and self.reason(decision) != "fail-open":
+                self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+            self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
             self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
             try:
                 if kwargs:

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/catalog_snapshot.json

@@ -2,22 +2,22 @@
     "schema": "agenticdome.catalog-snapshot.v1",
     "catalog_schema": "agenticdome.hook-catalog.v1",
     "verified_at": "2026-10-02",
-    "python_sdk_version": "1.2.41",
+    "python_sdk_version": "1.2.45",
     "published_packages": {
         "agenticdome-python-sdk": {
             "registry": "pypi",
-            "version": "1.2.41",
-            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.41/"
+            "version": "1.2.45",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.45/"
         },
         "agenticdome-sdk": {
             "registry": "npm",
-            "version": "0.6.3",
-            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.3"
+            "version": "0.6.14",
+            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.14"
         },
         "agenticdome-openclaw-security": {
             "registry": "npm",
-            "version": "1.0.2",
-            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.2"
+            "version": "1.0.13",
+            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.13"
         },
         "openclaw": {
             "registry": "npm",

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/client.py

@@ -1,5 +1,7 @@
 import base64
 import hashlib
+import json
+import uuid
 import logging
 import os
 import re
@@ -41,6 +43,36 @@ class AgenticDomeHTTPError(AgenticDomeError):
         super().__init__(f"[{status_code}] {message}")
 
 
+class ApprovalRequired(AgenticDomeError):
+    """A prepared action is paused. Preserve it and resume only after review."""
+
+    def __init__(self, response: Dict[str, Any], prepared_request: Dict[str, Any]):
+        context = response.get("context") or {}
+        self.request_id = str((context.get("approval") or {}).get("id") or "")
+        self.approval_url = str(context.get("approval_url") or "")
+        self.response = response
+        # Freeze the prepared body independently of mutable handler arguments.
+        self._prepared_json = json.dumps(prepared_request, sort_keys=True, allow_nan=False)
+        super().__init__("Approval required" + (": " + self.request_id if self.request_id else ""))
+
+    def resume(self, client: "AgenticDomeClient", executor):
+        return client.resume_approved_action(self, executor)
+
+    def export_prepared_action(self):
+        """Contains original arguments: encrypt in host storage and never log it."""
+        prepared = json.loads(self._prepared_json)
+        return {"schema": "agenticdome.sdk-prepared-approval.v1", "approval": {"id": self.request_id, "url": self.approval_url},
+                "prepared_request": prepared, "tenant_id": prepared.get("tenant_id")}
+
+    @classmethod
+    def restore_prepared_action(cls, record):
+        prepared = record.get("prepared_request") if isinstance(record, dict) else None
+        approval = record.get("approval") if isinstance(record, dict) else None
+        if not isinstance(record, dict) or record.get("schema") != "agenticdome.sdk-prepared-approval.v1" or not isinstance(prepared, dict) or not prepared.get("tool_name") or not isinstance(approval, dict) or not approval.get("id"):
+            raise ValueError("Invalid prepared approval record")
+        return cls({"context": {"approval": {"id": approval["id"]}, "approval_url": approval.get("url", "")}}, record["prepared_request"])
+
+
 class AgenticDomeClient:
     """
     Official Python SDK for the AgenticDome Action Firewall.
@@ -375,6 +407,12 @@ class AgenticDomeClient:
         if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
             raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
+    def report_action_evidence(self, kind: str, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Use the existing tenant SDK transport; runtime durably relays evidence."""
+        if kind not in {"events", "outcomes"}:
+            raise ValueError("Evidence kind must be events or outcomes")
+        return self._request("POST", "/mesh/evidence/" + kind, json_body=payload, timeout=5)
+
     def _request(
         self,
         method: str,
@@ -788,10 +826,14 @@ class AgenticDomeClient:
                     raise ValueError("'workload_id' must be a non-empty SPIFFE ID up to 512 characters")
                 payload["workload_id"] = normalized_workload
 
+        if tool_name:
+            payload["policy_context"].setdefault("approval_action_id", str(uuid.uuid4()))
         path = "/tools/execution/authorize" if broker_enabled else "/tools/guardrail/validate"
         if broker_enabled and resolved_broker_mode == "policy" and execution_broker is not True:
             path = "/tools/execution/resolve"
         response = self._request("POST", path, json_body=payload, tenant_id=tenant_id)
+        if str(response.get("verdict") or "").upper() == "APPROVAL_REQUIRED":
+            raise ApprovalRequired(response, payload)
         if broker_enabled:
             if path == "/tools/execution/resolve":
                 contract = response.get("execution_broker_policy") or {}
@@ -813,6 +855,28 @@ class AgenticDomeClient:
             )
         return response
 
+    def resume_approved_action(self, pending: ApprovalRequired, executor):
+        """Revalidate and consume one exact-action grant before invoking executor(args).
+
+        The caller retains the prepared request; the portal never holds payloads.
+        Approval does not execute anything until this explicit continuation runs.
+        """
+        if not isinstance(pending, ApprovalRequired) or not callable(executor):
+            raise ValueError("A prepared approval request and executor are required")
+        request_id = str(uuid.UUID(pending.request_id))
+        payload = json.loads(pending._prepared_json)
+        tenant = payload.get("tenant_id")
+        grant = self._request("GET", f"/tools/approvals/{request_id}/grant", tenant_id=tenant).get("approval_grant")
+        if not isinstance(grant, str) or not grant:
+            raise AgenticDomeError("No current approval grant was returned")
+        payload["policy_context"] = {**(payload.get("policy_context") or {}), "approval_grant": grant}
+        payload.setdefault("boundary_id", "sdk:approval:" + request_id)
+        response = self._request("POST", "/tools/execution/authorize", json_body=payload, tenant_id=tenant)
+        broker = response.get("broker") or {}
+        if response.get("verdict") != "ALLOWED" or not broker.get("verified") or not broker.get("token_consumed") or broker.get("approval_request_id") != request_id or not response.get("execution_receipt"):
+            raise AgenticDomeError("The approved action could not be revalidated and consumed")
+        return executor(json.loads(pending._prepared_json)["tool_args"])
+
     @staticmethod
     def enforcement_headers(result: Dict[str, Any], *, workload_id: Optional[str] = None) -> Dict[str, str]:
         """Build headers for an AgenticDome egress gateway from a broker result."""

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/hook_catalog.py

@@ -49,6 +49,12 @@ PUBLISHED_AGENTICDOME_PACKAGES: Dict[str, Dict[str, str]] = {
     if isinstance(row, dict)
 }
 
+# Prepared artifacts are kept separate from registry-verified published releases.
+RELEASE_CANDIDATE_PACKAGES = {
+    'agenticdome-python-sdk': {'version': '1.2.44', 'status': 'unpublished'},
+    'agenticdome-sdk': {'version': '0.6.15', 'status': 'unpublished'},
+}
+
 
 def _python_contract(
     label: str,
@@ -325,7 +331,7 @@ FRAMEWORK_HOOK_CATALOG: Dict[str, Dict[str, Any]] = {
         "adapter_module": "agenticdome-openclaw-security",
         "adapter_class": "OpenClawFirewall",
         "attachment_methods": ["protectedExecute", "sanitizeOutput"],
-        "native_hooks": ["before_agent_run", "before_tool_call", "tool_result_persist"],
+        "native_hooks": ["before_agent_run", "before_tool_call", "after_tool_call", "tool_result_persist"],
         "docs": "agenticdome-openclaw-security package README",
     },
     "mcp-ts": {

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/lifecycle.py

@@ -1,7 +1,7 @@
 """Privacy-bounded Verified Action lifecycle reporting.
 
 The runtime authorization path remains authoritative. This module reports only
-minimized lifecycle evidence through a separately scoped portal credential and
+minimized lifecycle evidence through the existing tenant runtime credential and
 never sends tool arguments, prompts, responses, credentials, or source code.
 """
 
@@ -15,9 +15,11 @@ import logging
 import os
 import queue
 import threading
+import time
+import urllib.error
 import urllib.request
 import uuid
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from datetime import datetime, timezone
 from typing import Any, Callable, Dict, Optional, TypeVar
 
@@ -72,33 +74,46 @@ class VerifiedActionDenied(RuntimeError):
 class VerifiedActionReporter:
     """Non-blocking, bounded reporter for one tenant's Verified Actions.
 
-    Configure ``AGENTICDOME_EVIDENCE_API_BASE`` and a portal token containing
-    only ``evidence:write``. Missing evidence credentials disable reporting;
-    they never weaken or bypass the primary AgenticDome authorization call.
+    SDK credentials enable reporting to the assigned runtime by default.
+    Explicit portal evidence credentials remain supported for existing callers.
     """
 
-    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256) -> None:
+    def __init__(self, portal: str = "", access_token: str = "", *, tenant_id: str = "", timeout: float = 5.0, queue_size: int = 256,
+                 runtime_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> None:
         self.portal = portal.rstrip("/")
         self.access_token = access_token.strip()
         self.tenant_id = tenant_id.strip()
+        self.runtime_base = runtime_base.rstrip("/")
+        self.api_key = api_key.strip()
+        self.sender = sender
+        self.runtime_mode = not (self.portal and self.access_token)
         self.timeout = max(1.0, min(float(timeout), 30.0))
         self._queue: "queue.Queue[tuple[str, Dict[str, Any]] | None]" = queue.Queue(maxsize=max(16, min(int(queue_size), 4096)))
         self._worker: Optional[threading.Thread] = None
         self._lock = threading.Lock()
+        self._stats = {"queued": 0, "delivered": 0, "failed": 0, "dropped": 0}
 
     @classmethod
-    def from_env(cls, *, tenant_id: str = "") -> "VerifiedActionReporter":
+    def from_env(cls, *, tenant_id: str = "", api_base: str = "", api_key: str = "", sender: Optional[Callable[..., Any]] = None) -> "VerifiedActionReporter":
+        if os.getenv("AGENTICDOME_EVIDENCE_ENABLED", "true").lower() in {"0", "false", "off", "no"}:
+            return cls()
         return cls(
             os.getenv("AGENTICDOME_EVIDENCE_API_BASE", ""),
             os.getenv("AGENTICDOME_EVIDENCE_TOKEN", ""),
             tenant_id=tenant_id or os.getenv("AGENTICDOME_TENANT_ID", ""),
             timeout=float(os.getenv("AGENTICDOME_EVIDENCE_TIMEOUT_S", "5") or "5"),
             queue_size=int(os.getenv("AGENTICDOME_EVIDENCE_QUEUE_SIZE", "256") or "256"),
+            runtime_base=api_base or os.getenv("AGENTICDOME_API_BASE", ""),
+            api_key=api_key or os.getenv("AGENTICDOME_API_KEY", ""), sender=sender,
         )
 
     @property
     def enabled(self) -> bool:
-        return bool(self.portal and self.access_token and self.tenant_id)
+        return bool(self.tenant_id and ((self.portal and self.access_token) or
+                    (self.runtime_base.startswith(("https://", "http://")) and self.api_key)))
+
+    def stats(self) -> Dict[str, Any]:
+        return dict(self._stats, pending=self._queue.unfinished_tasks, enabled=self.enabled, transport="runtime" if self.runtime_mode else "portal")
 
     def new_context(self, *, operation_type: str, tool_name: Optional[str] = None, tool_version: Optional[str] = None,
                     arguments: Any = None, destination: Optional[str] = None, chain_id: Optional[str] = None,
@@ -141,6 +156,10 @@ class VerifiedActionReporter:
         }
         return self._enqueue("/api/agentguard/verified-actions/events", payload)
 
+    def with_arguments(self, context: VerifiedActionContext, arguments: Any) -> VerifiedActionContext:
+        """Keep correlation IDs while hashing the arguments actually admitted for execution."""
+        return replace(context, arguments_sha256=_digest(arguments))
+
     def outcome(self, context: VerifiedActionContext, outcome_class: str, *, side_effect_reference: Optional[str] = None) -> bool:
         allowed = {"not_attempted", "rejected", "accepted", "succeeded", "partially_succeeded", "failed", "rolled_back", "unknown"}
         outcome = _token(outcome_class, allowed, "unknown")
@@ -150,8 +169,8 @@ class VerifiedActionReporter:
             "chain_id": context.chain_id, "action_id": context.action_id,
             "jti": "sdk_" + uuid.uuid4().hex, "outcome_class": outcome,
             "assurance_level": "sdk_reported", "authorised_action_sha256": context.arguments_sha256,
-            "observed_action_sha256": context.arguments_sha256, "destination_sha256": context.destination_sha256,
-            "side_effect_ref_sha256": _digest(side_effect_reference), "attempted_at": now, "completed_at": now,
+            "observed_action_sha256": None if outcome == "not_attempted" else context.arguments_sha256, "destination_sha256": context.destination_sha256,
+            "side_effect_ref_sha256": _digest(side_effect_reference), "completed_at": now,
         }
         return self._enqueue("/api/agentguard/verified-actions/outcomes", payload)
 
@@ -162,7 +181,7 @@ class VerifiedActionReporter:
         marker = {"_flush_event": completed}
         if not self._enqueue("", marker):
             return False
-        return completed.wait(max(0.1, timeout))
+        return completed.wait(max(0.1, timeout)) and self._stats["failed"] == 0
 
     def _enqueue(self, path: str, payload: Dict[str, Any]) -> bool:
         if not self.enabled:
@@ -170,8 +189,10 @@ class VerifiedActionReporter:
         self._ensure_worker()
         try:
             self._queue.put_nowait((path, payload))
+            if path:self._stats["queued"] += 1
             return True
         except queue.Full:
+            self._stats["dropped"] += 1
             logger.warning("Verified Action evidence queue is full; authorization behavior is unchanged.")
             return False
 
@@ -193,14 +214,27 @@ class VerifiedActionReporter:
                 if isinstance(marker, threading.Event):
                     marker.set()
                     continue
-                request = urllib.request.Request(
-                    self.portal + path, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST",
-                    headers={"Authorization": "Bearer " + self.access_token, "Content-Type": "application/json", "Accept": "application/json"},
-                )
-                with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310 - configured AgenticDome portal
-                    response.read(1)
+                for attempt in range(3):
+                    try:
+                        if self.runtime_mode and self.sender:
+                            self.sender(path.rsplit("/", 1)[-1], payload)
+                        else:
+                            endpoint = (self.runtime_base + "/mesh/evidence/" + path.rsplit("/", 1)[-1]) if self.runtime_mode else self.portal + path
+                            headers = {"Content-Type": "application/json", "Accept": "application/json", "X-Tenant-Id": self.tenant_id}
+                            headers.update({"X-API-Key": self.api_key} if self.runtime_mode else {"Authorization": "Bearer " + self.access_token})
+                            request = urllib.request.Request(endpoint, data=json.dumps(payload, separators=(",", ":")).encode("utf-8"), method="POST", headers=headers)
+                            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                                response.read(1)
+                        self._stats["delivered"] += 1
+                        break
+                    except Exception as exc:
+                        status = getattr(exc, "code", getattr(exc, "status_code", None))
+                        if attempt == 2 or status is not None and status not in {429, 500, 502, 503, 504}:
+                            raise
+                        time.sleep(.1 * (2 ** attempt))
             except Exception as exc:  # evidence must never alter the protected operation
-                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged: %s", exc)
+                self._stats["failed"] += 1
+                logger.warning("Verified Action evidence delivery failed; authorization behavior is unchanged (%s)", type(exc).__name__)
             finally:
                 self._queue.task_done()
 

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/mcp_host.py

@@ -13,6 +13,7 @@ import time
 import uuid
 import re
 from collections import defaultdict, deque
+from contextvars import ContextVar
 from dataclasses import dataclass
 from datetime import date
 from inspect import isawaitable
@@ -23,6 +24,8 @@ from .client import AgenticDomeClient
 from ._mode import credentials_or_local_sim
 from .lifecycle import VerifiedActionReporter
 
+_lifecycle_decision: ContextVar[Optional[Dict[str, Any]]] = ContextVar("agenticdome_mcp_lifecycle_decision", default=None)
+
 try:
     from .exceptions import AgenticDomeHTTPError
 except Exception:  # pragma: no cover - compatibility with older package layouts
@@ -375,7 +378,8 @@ class AgenticDomeMCPHostFirewall:
             timeout=self.config.timeout_s,
         )
         self.token_store = token_store or _build_token_store(self.config)
-        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id)
+        self.lifecycle_reporter = lifecycle_reporter or VerifiedActionReporter.from_env(tenant_id=self.config.tenant_id,
+            api_base=self.config.api_base, api_key=self.config.api_key, sender=getattr(self.client, "report_action_evidence", None))
         self.provider_action_rules = dict(provider_action_rules or {})
         self.resolve_provider_facts = resolve_provider_facts
         self._rate_lock = Lock()
@@ -975,6 +979,9 @@ class AgenticDomeMCPHostFirewall:
         )
 
     async def _handle_blocking_decision(self, *, decision: Dict[str, Any], rid: Any, context: Dict[str, Any], method: str, operation: str) -> Optional[Dict[str, Any]]:
+        evidence = _lifecycle_decision.get()
+        if evidence is not None:
+            evidence.update(verdict=self._verdict(decision), reason=self._reason(decision))
         verdict = self._verdict(decision)
         if verdict == "ALLOWED" or (verdict == "REDACTED" and self._sanitized_args(decision, explicit_only=True) is not None):
             return None
@@ -1433,7 +1440,7 @@ class AgenticDomeMCPHostFirewall:
         lifecycle = self.lifecycle_reporter.new_context(
             operation_type="mcp_operation", tool_name=tool_name, arguments=arguments,
             destination=self.config.mcp_server_url or self.config.mcp_server_id,
-            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id")) or None,
+            chain_id=self._safe_str(local_context.get("verified_chain_id") or local_context.get("action_chain_id") or local_context.get("chain_id")) or None,
             action_id=self._safe_str(local_context.get("verified_action_id") or local_context.get("action_id")) or None,
             parent_action_id=self._safe_str(local_context.get("parent_action_id")) or None,
             initiator_type="human" if self._safe_str(local_context.get("user_id")) else "agent",
@@ -1441,13 +1448,25 @@ class AgenticDomeMCPHostFirewall:
         )
         self.lifecycle_reporter.phase(lifecycle, "requested", "requested")
 
-        gated = await self.preflight_request(mcp_request=mcp_request, context=context)
+        local_context.update(chain_id=lifecycle.chain_id, action_id=lifecycle.action_id, decision_id=lifecycle.action_id)
+        decision_evidence: Dict[str, Any] = {}
+        decision_token = _lifecycle_decision.set(decision_evidence)
+        try:
+            gated = await self.preflight_request(mcp_request=mcp_request, context=local_context)
+        except Exception:
+            self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
+            raise
+        finally:
+            _lifecycle_decision.reset(decision_token)
         if isinstance(gated, dict) and "error" in gated:
             self.lifecycle_reporter.phase(lifecycle, "authorised", "blocked")
             self.lifecycle_reporter.outcome(lifecycle, "not_attempted")
             return gated
 
-        self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
+        admitted_arguments = self._extract_tool_call(gated)[1] if method == "tools/call" else self._params(gated)
+        lifecycle = self.lifecycle_reporter.with_arguments(lifecycle, admitted_arguments)
+        if decision_evidence.get("verdict") in {"ALLOWED", "REDACTED"} and decision_evidence.get("reason") != "fail-open":
+            self.lifecycle_reporter.phase(lifecycle, "authorised", "allowed")
         self.lifecycle_reporter.phase(lifecycle, "admitted", "admitted")
         self.lifecycle_reporter.phase(lifecycle, "attempted", "attempted")
 

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/docs/customer-onboarding.md

@@ -54,6 +54,23 @@ and final verification. It does not silently apply code changes.
 
 ### Already integrated with your coding assistant?
 
+The AI instruction first identifies the workload's actual local interpreter,
+package manager and dependency manifest, checks the latest stable compatible
+published SDK, and reconciles an older installation or mismatched SDK pin.
+It records the tested exact SDK version and preserves unrelated pins, existing
+hooks and configuration. An already aligned SDK is not reinstalled. The shared
+production interpreter/image remains a separate operator installation target.
+
+On a rerun, show current local tests, fresh validation and production activation
+separately. Missing planning configuration means **AWAITING CONFIGURATION**, with
+fresh readiness **NOT RUN**; a saved `ready=false` is historical rather than a
+new code rejection. Replace current report sections in place and keep one
+historical evidence section. Use only fresh matching JSON for the current verdict.
+If the workload provides a reviewed local verification runner, use it for these
+steps. An explicit planning-file option may load only the planning fields without
+printing them; the CLI itself does not automatically load the application `.env`.
+The Runtime / SDK key cannot replace the separately scoped Copilot key.
+
 The alternative AI Instruction path does not require repeating `init`,
 `integrate preview` or guided apply. From the root of the one deployable
 application workload, create and review the canonical

{agenticdome_python_sdk-1.2.41 → agenticdome_python_sdk-1.2.45}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agenticdome-python-sdk"
-version = "1.2.41"
+version = "1.2.45"
 description = "Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement."
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.11"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 
@@ -36,10 +36,10 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
-    "Programming Language :: Python :: 3.12"
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14"
 ]
 
 dependencies = [
@@ -175,9 +175,9 @@ agenticdome_sdk = ["*.cjs", "catalog_snapshot.json"]
 
 [tool.ruff]
 line-length = 120
-target-version = "py39"
+target-version = "py311"
 
 [tool.mypy]
-python_version = "3.9"
+python_version = "3.11"
 ignore_missing_imports = true
 strict = false