agenticdome-python-sdk 1.2.43__tar.gz → 1.2.45__tar.gz

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.43
+Version: 1.2.45
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -21,11 +21,11 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
@@ -113,6 +113,11 @@ Dynamic: license-file
 
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -573,7 +578,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1323,7 +1328,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/README.md

@@ -1,5 +1,10 @@
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -460,7 +465,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1210,7 +1215,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.43
+Version: 1.2.45
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -21,11 +21,11 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
@@ -113,6 +113,11 @@ Dynamic: license-file
 
 # AgenticDome Python SDK
 
+Python 3.11+ is required from SDK 1.2.44. Release certification gates cover
+CPython 3.11–3.14 using the same built wheel; newer interpreters require a
+separate qualification run. Framework compatibility also depends on that
+framework's supported versions and resolved dependencies.
+
 [![PyPI version](https://img.shields.io/pypi/v/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![Python Versions](https://img.shields.io/pypi/pyversions/agenticdome-python-sdk.svg)](https://pypi.org/project/agenticdome-python-sdk/)
 [![CI](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/agenticdome/agenticdome-python-sdk/actions/workflows/ci.yml)
@@ -573,7 +578,7 @@ pip install agenticdome-python-sdk
 | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
 | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
 | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
-| Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
+| Microsoft AutoGen AgentChat / Core (Python 3.11+) | `pip install "agenticdome-python-sdk[autogen]"` |
 | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
 | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
 | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
@@ -1323,7 +1328,7 @@ from agenticdome_sdk.microsoft_agent_framework import (
 AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
 
 ```bash
-# AutoGen AgentChat requires Python 3.10+.
+# This SDK requires Python 3.11+.
 pip install "agenticdome-python-sdk[autogen]"
 ```
 

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/__init__.py

@@ -1,4 +1,4 @@
-from .client import AgenticDomeClient, AgenticDomeError, AgenticDomeHTTPError
+from .client import AgenticDomeClient, AgenticDomeError, AgenticDomeHTTPError, ApprovalRequired
 from .identity import IDENTITY_CONTEXT_VERSION, canonicalize_identity_context, enrich_policy_context
 from .proof import create_dpop_proof, generate_rsa_proof_key, jwk_thumbprint
 from ._mode import LIVE_MODE, LOCAL_SIM_MODE, is_local_sim_mode, resolve_mode
@@ -10,6 +10,7 @@ __all__ = [
     "AgenticDomeClient",
     "AgenticDomeError",
     "AgenticDomeHTTPError",
+    "ApprovalRequired",
     "IDENTITY_CONTEXT_VERSION",
     "canonicalize_identity_context",
     "enrich_policy_context",

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/_framework_firewall.py

@@ -15,7 +15,7 @@ from dataclasses import dataclass
 from threading import Lock, Thread
 from typing import Any, Awaitable, Callable, Deque, Dict, Optional, Tuple, Type
 
-from .client import AgenticDomeClient
+from .client import AgenticDomeClient, ApprovalRequired
 from .lifecycle import VerifiedActionReporter
 from ._mode import credentials_or_local_sim
 
@@ -335,6 +335,8 @@ class FrameworkFirewallBase:
                     self._circuit_open_until = 0.0
                 return result
             except Exception as exc:
+                if isinstance(exc, ApprovalRequired):
+                    raise
                 last_error = exc
                 with self._circuit_lock:
                     self._circuit_failures += 1
@@ -346,6 +348,8 @@ class FrameworkFirewallBase:
         raise last_error
 
     def _failure(self, context: str, exc: Exception, fallback: Any) -> Any:
+        if isinstance(exc, ApprovalRequired):
+            raise exc
         if isinstance(exc, self.denied_error):
             raise exc
         if self.config.fail_closed:

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/catalog_snapshot.json

@@ -2,12 +2,12 @@
     "schema": "agenticdome.catalog-snapshot.v1",
     "catalog_schema": "agenticdome.hook-catalog.v1",
     "verified_at": "2026-10-02",
-    "python_sdk_version": "1.2.43",
+    "python_sdk_version": "1.2.45",
     "published_packages": {
         "agenticdome-python-sdk": {
             "registry": "pypi",
-            "version": "1.2.43",
-            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.43/"
+            "version": "1.2.45",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.45/"
         },
         "agenticdome-sdk": {
             "registry": "npm",

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/client.py

@@ -1,5 +1,7 @@
 import base64
 import hashlib
+import json
+import uuid
 import logging
 import os
 import re
@@ -41,6 +43,36 @@ class AgenticDomeHTTPError(AgenticDomeError):
         super().__init__(f"[{status_code}] {message}")
 
 
+class ApprovalRequired(AgenticDomeError):
+    """A prepared action is paused. Preserve it and resume only after review."""
+
+    def __init__(self, response: Dict[str, Any], prepared_request: Dict[str, Any]):
+        context = response.get("context") or {}
+        self.request_id = str((context.get("approval") or {}).get("id") or "")
+        self.approval_url = str(context.get("approval_url") or "")
+        self.response = response
+        # Freeze the prepared body independently of mutable handler arguments.
+        self._prepared_json = json.dumps(prepared_request, sort_keys=True, allow_nan=False)
+        super().__init__("Approval required" + (": " + self.request_id if self.request_id else ""))
+
+    def resume(self, client: "AgenticDomeClient", executor):
+        return client.resume_approved_action(self, executor)
+
+    def export_prepared_action(self):
+        """Contains original arguments: encrypt in host storage and never log it."""
+        prepared = json.loads(self._prepared_json)
+        return {"schema": "agenticdome.sdk-prepared-approval.v1", "approval": {"id": self.request_id, "url": self.approval_url},
+                "prepared_request": prepared, "tenant_id": prepared.get("tenant_id")}
+
+    @classmethod
+    def restore_prepared_action(cls, record):
+        prepared = record.get("prepared_request") if isinstance(record, dict) else None
+        approval = record.get("approval") if isinstance(record, dict) else None
+        if not isinstance(record, dict) or record.get("schema") != "agenticdome.sdk-prepared-approval.v1" or not isinstance(prepared, dict) or not prepared.get("tool_name") or not isinstance(approval, dict) or not approval.get("id"):
+            raise ValueError("Invalid prepared approval record")
+        return cls({"context": {"approval": {"id": approval["id"]}, "approval_url": approval.get("url", "")}}, record["prepared_request"])
+
+
 class AgenticDomeClient:
     """
     Official Python SDK for the AgenticDome Action Firewall.
@@ -794,10 +826,14 @@ class AgenticDomeClient:
                     raise ValueError("'workload_id' must be a non-empty SPIFFE ID up to 512 characters")
                 payload["workload_id"] = normalized_workload
 
+        if tool_name:
+            payload["policy_context"].setdefault("approval_action_id", str(uuid.uuid4()))
         path = "/tools/execution/authorize" if broker_enabled else "/tools/guardrail/validate"
         if broker_enabled and resolved_broker_mode == "policy" and execution_broker is not True:
             path = "/tools/execution/resolve"
         response = self._request("POST", path, json_body=payload, tenant_id=tenant_id)
+        if str(response.get("verdict") or "").upper() == "APPROVAL_REQUIRED":
+            raise ApprovalRequired(response, payload)
         if broker_enabled:
             if path == "/tools/execution/resolve":
                 contract = response.get("execution_broker_policy") or {}
@@ -819,6 +855,28 @@ class AgenticDomeClient:
             )
         return response
 
+    def resume_approved_action(self, pending: ApprovalRequired, executor):
+        """Revalidate and consume one exact-action grant before invoking executor(args).
+
+        The caller retains the prepared request; the portal never holds payloads.
+        Approval does not execute anything until this explicit continuation runs.
+        """
+        if not isinstance(pending, ApprovalRequired) or not callable(executor):
+            raise ValueError("A prepared approval request and executor are required")
+        request_id = str(uuid.UUID(pending.request_id))
+        payload = json.loads(pending._prepared_json)
+        tenant = payload.get("tenant_id")
+        grant = self._request("GET", f"/tools/approvals/{request_id}/grant", tenant_id=tenant).get("approval_grant")
+        if not isinstance(grant, str) or not grant:
+            raise AgenticDomeError("No current approval grant was returned")
+        payload["policy_context"] = {**(payload.get("policy_context") or {}), "approval_grant": grant}
+        payload.setdefault("boundary_id", "sdk:approval:" + request_id)
+        response = self._request("POST", "/tools/execution/authorize", json_body=payload, tenant_id=tenant)
+        broker = response.get("broker") or {}
+        if response.get("verdict") != "ALLOWED" or not broker.get("verified") or not broker.get("token_consumed") or broker.get("approval_request_id") != request_id or not response.get("execution_receipt"):
+            raise AgenticDomeError("The approved action could not be revalidated and consumed")
+        return executor(json.loads(pending._prepared_json)["tool_args"])
+
     @staticmethod
     def enforcement_headers(result: Dict[str, Any], *, workload_id: Optional[str] = None) -> Dict[str, str]:
         """Build headers for an AgenticDome egress gateway from a broker result."""

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/agenticdome_sdk/hook_catalog.py

@@ -49,6 +49,12 @@ PUBLISHED_AGENTICDOME_PACKAGES: Dict[str, Dict[str, str]] = {
     if isinstance(row, dict)
 }
 
+# Prepared artifacts are kept separate from registry-verified published releases.
+RELEASE_CANDIDATE_PACKAGES = {
+    'agenticdome-python-sdk': {'version': '1.2.44', 'status': 'unpublished'},
+    'agenticdome-sdk': {'version': '0.6.15', 'status': 'unpublished'},
+}
+
 
 def _python_contract(
     label: str,

{agenticdome_python_sdk-1.2.43 → agenticdome_python_sdk-1.2.45}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agenticdome-python-sdk"
-version = "1.2.43"
+version = "1.2.45"
 description = "Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement."
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.11"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 
@@ -36,10 +36,10 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
-    "Programming Language :: Python :: 3.12"
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14"
 ]
 
 dependencies = [
@@ -175,9 +175,9 @@ agenticdome_sdk = ["*.cjs", "catalog_snapshot.json"]
 
 [tool.ruff]
 line-length = 120
-target-version = "py39"
+target-version = "py311"
 
 [tool.mypy]
-python_version = "3.9"
+python_version = "3.11"
 ignore_missing_imports = true
 strict = false