agenticdome-python-sdk 1.2.6__tar.gz → 1.2.8__tar.gz

{agenticdome_python_sdk-1.2.6/agenticdome_python_sdk.egg-info → agenticdome_python_sdk-1.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.6
+Version: 1.2.8
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License: Proprietary

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8/agenticdome_python_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.6
+Version: 1.2.8
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License: Proprietary

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/agenticdome_python_sdk.egg-info/SOURCES.txt

@@ -36,6 +36,7 @@ tests/test_aws_bedrock_integration.py
 tests/test_claude_integration.py
 tests/test_client.py
 tests/test_crewai_integration.py
+tests/test_execution_broker.py
 tests/test_google_adk_integration.py
 tests/test_identity_context.py
 tests/test_langgraph_integration.py

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/agenticdome_sdk/_framework_firewall.py

@@ -63,6 +63,8 @@ class DecisionTokenRecord:
     source_agent_id: str
     created_at: float
     token_hmac: str = ""
+    tool_version: str = ""
+    tool_digest: str = ""
 
 
 def _stable_json(value: Any) -> str:
@@ -213,6 +215,22 @@ class FrameworkFirewallBase:
         except Exception:
             pass
 
+    def register_tool_provenance(
+        self,
+        tool_name: str,
+        *,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
+        tool_platform: Optional[str] = None,
+    ) -> None:
+        """Cache precomputed provenance once for this firewall's client."""
+        self.client.register_tool_provenance(
+            tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=tool_platform or self.config.default_tool_platform,
+        )
+
     @staticmethod
     def serialize(value: Any) -> str:
         return value if isinstance(value, str) else _stable_json(value)
@@ -372,6 +390,8 @@ class FrameworkFirewallBase:
         tool_args: Dict[str, Any],
         text: str = "",
         tool_platform: Optional[str] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         policy_context: Optional[Dict[str, Any]] = None,
         source_agent_id: Optional[str] = None,
     ) -> Dict[str, Any]:
@@ -392,6 +412,8 @@ class FrameworkFirewallBase:
                 tool_platform=tool_platform or self.config.default_tool_platform,
                 tool_name=tool_name,
                 tool_args=clean_args,
+                tool_version=tool_version,
+                tool_digest=tool_digest,
                 policy_context=self._policy_context(session_id, f"{self.config.platform}_tool_call", policy_context, tool_name=tool_name),
             )
             if self.verdict(response) == "BLOCKED":
@@ -421,6 +443,8 @@ class FrameworkFirewallBase:
         tool_args: Dict[str, Any],
         text: str = "",
         tool_platform: Optional[str] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         policy_context: Optional[Dict[str, Any]] = None,
     ) -> Dict[str, Any]:
         clean_args = self.strip_private_args(tool_args)
@@ -435,6 +459,8 @@ class FrameworkFirewallBase:
                 tool_platform=tool_platform or self.config.default_tool_platform,
                 tool_name=tool_name,
                 tool_args=clean_args,
+                tool_version=tool_version,
+                tool_digest=tool_digest,
                 session_id=session_id,
                 direction="outbound",
                 policy_context=self._policy_context(
@@ -456,7 +482,7 @@ class FrameworkFirewallBase:
                     target_agent_id=specialist_agent_id,
                     tool_name=tool_name,
                     tool_args=clean_args,
-                    record=DecisionTokenRecord(token, manager_agent_id, time.time(), self._token_hmac(token)),
+                    record=DecisionTokenRecord(token, manager_agent_id, time.time(), self._token_hmac(token), tool_version or "", tool_digest or ""),
                     ttl_s=self.config.handoff_token_ttl_s,
                 )
             return env
@@ -475,6 +501,8 @@ class FrameworkFirewallBase:
         tool_args: Dict[str, Any],
         decision_token: Optional[str] = None,
         source_agent_id: Optional[str] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
     ) -> Dict[str, Any]:
         clean_args = self.strip_private_args(tool_args)
         record = None
@@ -488,6 +516,12 @@ class FrameworkFirewallBase:
             if record:
                 decision_token = record.decision_token
                 source_agent_id = source_agent_id or record.source_agent_id
+                if tool_version and record.tool_version and tool_version != record.tool_version:
+                    raise self.denied_error("AgenticDome delegated tool version differs from the authorized version.")
+                if tool_digest and record.tool_digest and tool_digest != record.tool_digest:
+                    raise self.denied_error("AgenticDome delegated tool digest differs from the authorized digest.")
+                tool_version = tool_version or record.tool_version or None
+                tool_digest = tool_digest or record.tool_digest or None
         if record and self.config.token_hmac_secret:
             expected = self._token_hmac(record.decision_token)
             if not record.token_hmac or not hmac.compare_digest(record.token_hmac, expected):
@@ -500,6 +534,8 @@ class FrameworkFirewallBase:
                 decision_token,
                 tool_name=tool_name,
                 tool_args=clean_args,
+                tool_version=tool_version,
+                tool_digest=tool_digest,
                 agent_id=specialist_agent_id,
                 source_agent_id=source_agent_id,
                 platform=self.config.platform,
@@ -611,4 +647,3 @@ class FrameworkFirewallBase:
         def decorator(fn: Callable[..., Any]) -> Callable[..., Any]:
             return self.wrap_tool_handler(tool_name=tool_name or fn.__name__, handler=fn, **options)
         return decorator
-

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/agenticdome_sdk/client.py

@@ -1,6 +1,8 @@
 import base64
+import hashlib
 import os
-from typing import Optional, Dict, List, Any, Tuple, Union
+import re
+from typing import Optional, Dict, List, Any, Tuple, Union, Mapping
 
 import requests
 from requests.adapters import HTTPAdapter
@@ -58,6 +60,8 @@ class AgentGuardClient:
         pool_maxsize: int = 100,
         pool_block: bool = False,
         service_token: Optional[str] = None,
+        tool_provenance: Optional[Mapping[str, Mapping[str, str]]] = None,
+        execution_broker_mode: Optional[str] = None,
     ):
         self.api_base = self._require_nonempty("api_base", api_base).rstrip("/")
         self.api_key = self._require_nonempty(
@@ -84,6 +88,21 @@ class AgentGuardClient:
             default=5.0,
         )
         self.user_agent = user_agent
+        broker_mode = str(
+            execution_broker_mode
+            if execution_broker_mode is not None
+            else os.getenv("AGENTICDOME_EXECUTION_BROKER_MODE", "off")
+        ).strip().lower()
+        if broker_mode not in {"off", "observe", "enforce"}:
+            raise ValueError("execution_broker_mode must be off, observe, or enforce")
+        self.execution_broker_mode = broker_mode
+        self._tool_provenance: Dict[str, Dict[str, str]] = {}
+        for registered_name, provenance in dict(tool_provenance or {}).items():
+            self.register_tool_provenance(
+                registered_name,
+                tool_version=(provenance or {}).get("tool_version") or (provenance or {}).get("version"),
+                tool_digest=(provenance or {}).get("tool_digest") or (provenance or {}).get("digest"),
+            )
 
         self.session = requests.Session()
         retry = Retry(
@@ -158,6 +177,55 @@ class AgentGuardClient:
         s = str(value).strip()
         return s or None
 
+    def register_tool_provenance(
+        self,
+        tool_name: str,
+        *,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
+        tool_platform: Optional[str] = None,
+    ) -> None:
+        """Register precomputed provenance once; request-time lookup is local O(1)."""
+        name = self._require_nonempty("tool_name", tool_name)
+        version = self._normalize_optional_string(tool_version)
+        digest = self._normalize_optional_string(tool_digest)
+        if digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", digest):
+            raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
+        if version is None and digest is None:
+            raise ValueError("tool_version or tool_digest is required")
+        key = f"{self._normalize_optional_string(tool_platform)}:{name}" if tool_platform else name
+        self._tool_provenance[key] = {"tool_version": version or "", "tool_digest": digest or ""}
+
+    def unregister_tool_provenance(self, tool_name: str, *, tool_platform: Optional[str] = None) -> None:
+        name = self._require_nonempty("tool_name", tool_name)
+        key = f"{self._normalize_optional_string(tool_platform)}:{name}" if tool_platform else name
+        self._tool_provenance.pop(key, None)
+
+    def _resolve_tool_provenance(
+        self,
+        *,
+        tool_name: Optional[str],
+        tool_version: Optional[str],
+        tool_digest: Optional[str],
+        tool_platform: Optional[str] = None,
+        policy_context: Optional[Dict[str, Any]] = None,
+    ) -> Tuple[Optional[str], Optional[str]]:
+        if not tool_name:
+            return tool_version, tool_digest
+        context = policy_context or {}
+        context_provenance = context.get("tool_provenance") if isinstance(context.get("tool_provenance"), dict) else {}
+        key = f"{tool_platform}:{tool_name}" if tool_platform else ""
+        registered = self._tool_provenance.get(key) or self._tool_provenance.get(str(tool_name)) or {}
+        version = self._normalize_optional_string(tool_version) or self._normalize_optional_string(
+            context.get("tool_version") or context_provenance.get("tool_version") or context_provenance.get("version") or registered.get("tool_version")
+        )
+        digest = self._normalize_optional_string(tool_digest) or self._normalize_optional_string(
+            context.get("tool_digest") or context_provenance.get("tool_digest") or context_provenance.get("digest") or registered.get("tool_digest")
+        )
+        if digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", digest):
+            raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
+        return version, digest
+
     def _positive_float(self, name: str, value: Any, *, default: float) -> float:
         try:
             parsed = float(value)
@@ -257,6 +325,7 @@ class AgentGuardClient:
         token: str,
         tool_name: Optional[str] = None,
         tool_args: Optional[Dict[str, Any]] = None,
+        tool_digest: Optional[str] = None,
     ) -> None:
         """
         Validate decision-token verification inputs.
@@ -268,6 +337,8 @@ class AgentGuardClient:
             raise ValueError("'tool_args' is required when 'tool_name' is provided")
         if tool_args is not None and not tool_name:
             raise ValueError("'tool_name' is required when 'tool_args' is provided")
+        if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
+            raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
     def _request(
         self,
@@ -453,6 +524,8 @@ class AgentGuardClient:
         tool_platform: Optional[str] = None,
         tool_name: Optional[str] = None,
         tool_args: Optional[Dict[str, Any]] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         policy_context: Optional[Dict[str, Any]] = None,
         reasoning_trace: Optional[str] = None,
         agent_instance_id: Optional[str] = None,
@@ -465,12 +538,23 @@ class AgentGuardClient:
         actual_role: Optional[str] = None,
         source_agent_role: Optional[str] = None,
         target_agent_role: Optional[str] = None,
+        actor_chain: Optional[List[Dict[str, Any]]] = None,
+        scopes: Optional[List[str]] = None,
+        permissions: Optional[List[str]] = None,
+        parent_jti: Optional[str] = None,
+        root_jti: Optional[str] = None,
+        policy_id: Optional[str] = None,
+        policy_version: Optional[str] = None,
+        policy_hash: Optional[str] = None,
+        proof_thumbprint: Optional[str] = None,
         redact_pii: Optional[bool] = None,
         redact_secrets: Optional[bool] = None,
         block_on_sensitive_output: Optional[bool] = None,
         trusted_destination_domains: Optional[List[str]] = None,
         allowed_destination_domains: Optional[List[str]] = None,
         attachments: Optional[List[str]] = None,
+        execution_broker: Optional[bool] = None,
+        execution_boundary_id: Optional[str] = None,
         tenant_id: Optional[Union[str, int]] = None,
     ) -> Dict[str, Any]:
         """
@@ -491,6 +575,13 @@ class AgentGuardClient:
         Delegation rule:
           - source_agent_id requires source_platform
         """
+        tool_version, tool_digest = self._resolve_tool_provenance(
+            tool_name=tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=tool_platform,
+            policy_context=policy_context,
+        )
         normalized_direction = self._validate_guardrail_args(
             text=text,
             agent_id=agent_id,
@@ -502,6 +593,8 @@ class AgentGuardClient:
             source_platform=source_platform,
             user_id=user_id,
         )
+        if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
+            raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
         merged_policy_context = self._merge_policy_context(
             policy_context,
@@ -511,6 +604,8 @@ class AgentGuardClient:
             tool_platform=tool_platform,
             tool_name=tool_name,
             tool_args=tool_args,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
             reasoning_trace=reasoning_trace,
             agent_instance_id=agent_instance_id,
             user_id=user_id,
@@ -522,6 +617,15 @@ class AgentGuardClient:
             actual_role=actual_role,
             source_agent_role=source_agent_role,
             target_agent_role=target_agent_role,
+            actor_chain=actor_chain,
+            scopes=scopes,
+            permissions=permissions,
+            parent_jti=parent_jti,
+            root_jti=root_jti,
+            policy_id=policy_id,
+            policy_version=policy_version,
+            policy_hash=policy_hash,
+            proof_thumbprint=proof_thumbprint,
             redact_pii=redact_pii,
             redact_secrets=redact_secrets,
             block_on_sensitive_output=block_on_sensitive_output,
@@ -540,6 +644,8 @@ class AgentGuardClient:
                 "tool_platform": tool_platform,
                 "tool_name": tool_name,
                 "tool_args": tool_args,
+                "tool_version": tool_version,
+                "tool_digest": tool_digest,
                 "policy_context": merged_policy_context,
                 "reasoning_trace": reasoning_trace,
                 "agent_instance_id": agent_instance_id,
@@ -552,6 +658,15 @@ class AgentGuardClient:
                 "actual_role": actual_role,
                 "source_agent_role": source_agent_role,
                 "target_agent_role": target_agent_role,
+                "actor_chain": actor_chain,
+                "scopes": scopes,
+                "permissions": permissions,
+                "parent_jti": parent_jti,
+                "root_jti": root_jti,
+                "policy_id": policy_id,
+                "policy_version": policy_version,
+                "policy_hash": policy_hash,
+                "proof_thumbprint": proof_thumbprint,
                 "redact_pii": redact_pii,
                 "redact_secrets": redact_secrets,
                 "block_on_sensitive_output": block_on_sensitive_output,
@@ -561,12 +676,33 @@ class AgentGuardClient:
             }
         )
 
-        return self._request(
-            "POST",
-            "/tools/guardrail/validate",
-            json_body=payload,
-            tenant_id=tenant_id,
+        broker_enabled = bool(
+            tool_name
+            and (self.execution_broker_mode in {"observe", "enforce"} or execution_broker is True)
         )
+        if broker_enabled:
+            boundary_id = self._normalize_optional_string(execution_boundary_id)
+            if boundary_id is None:
+                material = "|".join([
+                    str(platform or "unknown"),
+                    str(agent_id),
+                    str(tool_name),
+                    str(session_id or "stateless"),
+                ])
+                boundary_id = "sdk:" + hashlib.sha256(material.encode("utf-8")).hexdigest()[:32]
+            payload["boundary_id"] = boundary_id
+
+        path = "/tools/execution/authorize" if broker_enabled else "/tools/guardrail/validate"
+        response = self._request("POST", path, json_body=payload, tenant_id=tenant_id)
+        if broker_enabled:
+            broker = response.get("broker") if isinstance(response.get("broker"), dict) else {}
+            verified = bool(broker.get("verified")) and bool(broker.get("token_consumed"))
+            must_enforce = self.execution_broker_mode == "enforce" or execution_broker is True
+            if must_enforce and not verified:
+                raise AgentGuardError(
+                    "AgenticDome execution broker did not return a verified, atomically consumed decision"
+                )
+        return response
 
     # Backward compatibility alias
     def guardrail_check(
@@ -585,6 +721,13 @@ class AgentGuardClient:
             policy_context=policy_context,
         )
 
+    def get_tool_provenance_status(
+        self,
+        tenant_id: Optional[Union[str, int]] = None,
+    ) -> Dict[str, Any]:
+        """Return the tenant's signed provenance cache readiness and tool count."""
+        return self._request("GET", "/tools/provenance/status", tenant_id=tenant_id)
+
     # ------------------------------------------------------------------
     # Mesh
     # ------------------------------------------------------------------
@@ -780,6 +923,8 @@ class AgentGuardClient:
         source_platform: str,
         tool_name: str,
         tool_args: Dict[str, Any],
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         tool_platform: Optional[str] = None,
         policy_context: Optional[Dict[str, Any]] = None,
         session_id: Optional[str] = None,
@@ -830,6 +975,15 @@ class AgentGuardClient:
         self._require_nonempty("source_agent_id", source_agent_id)
         self._require_nonempty("source_platform", source_platform)
         self._require_nonempty("tool_name", tool_name)
+        tool_version, tool_digest = self._resolve_tool_provenance(
+            tool_name=tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=tool_platform,
+            policy_context=policy_context,
+        )
+        if tool_digest is not None and not re.fullmatch(r"sha256:[0-9a-f]{64}", str(tool_digest)):
+            raise ValueError("'tool_digest' must be sha256 followed by 64 lowercase hexadecimal characters")
 
         normalized_direction = self._validate_guardrail_args(
             text=text,
@@ -851,6 +1005,8 @@ class AgentGuardClient:
             source_agent_id=source_agent_id,
             tool_name=tool_name,
             tool_args=tool_args,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
             request_purpose=request_purpose,
             purpose=purpose,
             intent=intent,
@@ -887,6 +1043,8 @@ class AgentGuardClient:
                 "tool_platform": tool_platform,
                 "tool_name": tool_name,
                 "tool_args": tool_args,
+                "tool_version": tool_version,
+                "tool_digest": tool_digest,
                 "policy_context": merged_policy_context,
                 "source_agent_id": source_agent_id,
                 "request_purpose": request_purpose,
@@ -937,6 +1095,8 @@ class AgentGuardClient:
         *,
         tool_name: Optional[str] = None,
         tool_args: Optional[Dict[str, Any]] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         agent_id: Optional[str] = None,
         source_agent_id: Optional[str] = None,
         platform: Optional[str] = None,
@@ -958,10 +1118,17 @@ class AgentGuardClient:
           - platform
           - source_agent_id (for delegated sensitive flows)
         """
+        tool_version, tool_digest = self._resolve_tool_provenance(
+            tool_name=tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=platform,
+        )
         self._validate_decision_verify_args(
             token=token,
             tool_name=tool_name,
             tool_args=tool_args,
+            tool_digest=tool_digest,
         )
 
         payload = self._drop_none(
@@ -969,6 +1136,8 @@ class AgentGuardClient:
                 "token": token,
                 "tool_name": tool_name,
                 "tool_args": tool_args,
+                "tool_version": tool_version,
+                "tool_digest": tool_digest,
                 "agent_id": agent_id,
                 "source_agent_id": source_agent_id,
                 "platform": platform,
@@ -989,6 +1158,8 @@ class AgentGuardClient:
         *,
         tool_name: Optional[str] = None,
         tool_args: Optional[Dict[str, Any]] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         agent_id: Optional[str] = None,
         source_agent_id: Optional[str] = None,
         platform: Optional[str] = None,
@@ -1011,10 +1182,17 @@ class AgentGuardClient:
           - platform
           - source_agent_id (for delegated sensitive flows)
         """
+        tool_version, tool_digest = self._resolve_tool_provenance(
+            tool_name=tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=platform,
+        )
         self._validate_decision_verify_args(
             token=token,
             tool_name=tool_name,
             tool_args=tool_args,
+            tool_digest=tool_digest,
         )
 
         arguments = self._drop_none(
@@ -1022,6 +1200,8 @@ class AgentGuardClient:
                 "token": token,
                 "tool_name": tool_name,
                 "tool_args": tool_args,
+                "tool_version": tool_version,
+                "tool_digest": tool_digest,
                 "agent_id": agent_id,
                 "source_agent_id": source_agent_id,
                 "platform": platform,
@@ -1111,6 +1291,8 @@ class AgentGuardClient:
         tool_platform: Optional[str] = None,
         tool_name: Optional[str] = None,
         tool_args: Optional[Dict[str, Any]] = None,
+        tool_version: Optional[str] = None,
+        tool_digest: Optional[str] = None,
         policy_context: Optional[Dict[str, Any]] = None,
         direction: str = "outbound",
         source_agent_id: Optional[str] = None,
@@ -1149,6 +1331,13 @@ class AgentGuardClient:
         Delegation rule:
           - source_agent_id requires source_platform
         """
+        tool_version, tool_digest = self._resolve_tool_provenance(
+            tool_name=tool_name,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
+            tool_platform=tool_platform,
+            policy_context=policy_context,
+        )
         normalized_direction = self._validate_guardrail_args(
             text=text,
             agent_id=agent_id,
@@ -1170,6 +1359,8 @@ class AgentGuardClient:
             user_id=user_id,
             tool_name=tool_name,
             tool_args=tool_args,
+            tool_version=tool_version,
+            tool_digest=tool_digest,
             reasoning_trace=reasoning_trace,
             request_purpose=request_purpose,
             purpose=purpose,
@@ -1195,6 +1386,8 @@ class AgentGuardClient:
                 "tool_platform": tool_platform,
                 "tool_name": tool_name,
                 "tool_args": tool_args,
+                "tool_version": tool_version,
+                "tool_digest": tool_digest,
                 "policy_context": merged_policy_context,
                 "source_agent_id": source_agent_id,
                 "user_id": user_id,
@@ -1214,6 +1407,41 @@ class AgentGuardClient:
             }
         )
 
+        # In broker mode the official MCP adapter uses the same one-request
+        # execution boundary as REST. This preserves immediate decision
+        # consumption without adding a second network round trip.
+        if tool_name and self.execution_broker_mode in {"observe", "enforce"}:
+            return self.guardrail_validate(
+                text=text,
+                agent_id=agent_id,
+                platform=platform,
+                source_platform=source_platform,
+                tool_platform=tool_platform,
+                tool_name=tool_name,
+                tool_args=tool_args,
+                tool_version=tool_version,
+                tool_digest=tool_digest,
+                policy_context=policy_context,
+                direction=direction,
+                source_agent_id=source_agent_id,
+                user_id=user_id,
+                reasoning_trace=reasoning_trace,
+                request_purpose=request_purpose,
+                purpose=purpose,
+                intent=intent,
+                claimed_role=claimed_role,
+                actual_role=actual_role,
+                source_agent_role=source_agent_role,
+                target_agent_role=target_agent_role,
+                redact_pii=redact_pii,
+                redact_secrets=redact_secrets,
+                block_on_sensitive_output=block_on_sensitive_output,
+                trusted_destination_domains=trusted_destination_domains,
+                allowed_destination_domains=allowed_destination_domains,
+                execution_broker=True,
+                tenant_id=tenant_id,
+            )
+
         return self.mcp_tool_call(
             "guardrail.validate",
             arguments,

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agenticdome-python-sdk"
-version = "1.2.6"
+version = "1.2.8"
 description = "Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement."
 readme = "README.md"
 requires-python = ">=3.9"

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/tests/test_autogen_integration.py

@@ -20,6 +20,10 @@ class FakeClient:
         self.mesh_calls = []
         self.incidents = []
         self.revocations = []
+        self.provenance = {}
+
+    def register_tool_provenance(self, tool_name, **kwargs):
+        self.provenance[tool_name] = kwargs
 
     def guardrail_validate(self, **kwargs):
         self.guardrail_calls.append(kwargs)
@@ -69,6 +73,24 @@ def test_autogen_requires_agenticdome_runtime_configuration():
         AgenticDomeAutoGenFirewall(FirewallConfig(api_base="", api_key="", tenant_id=""))
 
 
+def test_autogen_forwards_explicit_tool_provenance_and_supports_cached_registration():
+    fw, client = firewall()
+    digest = "sha256:" + "c" * 64
+    fw.register_tool_provenance("crm.lookup", tool_version="3.0.0", tool_digest=digest)
+    fw.authorize_tool_call(
+        session_id="tool-provenance",
+        agent_id="planner",
+        tool_name="crm.lookup",
+        tool_args={"customer_id": "42"},
+        tool_version="3.0.0",
+        tool_digest=digest,
+    )
+
+    assert client.provenance["crm.lookup"]["tool_digest"] == digest
+    assert client.guardrail_calls[-1]["tool_version"] == "3.0.0"
+    assert client.guardrail_calls[-1]["tool_digest"] == digest
+
+
 def test_conversation_window_sends_family_two_metrics_and_redacts_output():
     fw, client = firewall()
 

{agenticdome_python_sdk-1.2.6 → agenticdome_python_sdk-1.2.8}/tests/test_client.py

@@ -90,6 +90,65 @@ def test_guardrail_validate_success(mock_request, client):
     assert payload["platform"] == "microsoft"
 
 
+@patch("agenticdome_sdk.client.requests.Session.request")
+def test_registered_tool_provenance_is_forwarded_without_runtime_hashing(mock_request, client):
+    digest = "sha256:" + "a" * 64
+    mock_request.return_value = make_response(200, {"verdict": "ALLOWED"})
+    client.register_tool_provenance("crm.lookup", tool_version="4.2.1", tool_digest=digest, tool_platform="mcp")
+
+    client.guardrail_validate(
+        text="lookup customer",
+        agent_id="support-agent",
+        direction="outbound",
+        platform="langgraph",
+        tool_platform="mcp",
+        tool_name="crm.lookup",
+        tool_args={"customer_id": "42"},
+    )
+
+    payload = mock_request.call_args.kwargs["json"]
+    assert payload["tool_version"] == "4.2.1"
+    assert payload["tool_digest"] == digest
+    assert payload["policy_context"]["tool_digest"] == digest
+
+
+@patch("agenticdome_sdk.client.requests.Session.request")
+def test_registered_provenance_is_bound_to_authorize_and_verify(mock_request, client):
+    digest = "sha256:" + "b" * 64
+    mock_request.return_value = make_response(200, {"jsonrpc": "2.0", "id": "1", "result": {"verdict": "ALLOWED", "valid": True}})
+    client.register_tool_provenance("payments.refund", tool_version="2.0.0", tool_digest=digest)
+
+    client.a2a_authorize_tool(
+        text="delegate refund",
+        agent_id="billing-agent",
+        platform="autogen",
+        source_agent_id="manager-agent",
+        source_platform="autogen",
+        tool_name="payments.refund",
+        tool_args={"amount": 25},
+    )
+    authorize = mock_request.call_args.kwargs["json"]["params"]["arguments"]
+    assert authorize["tool_version"] == "2.0.0"
+    assert authorize["tool_digest"] == digest
+
+    client.a2a_verify_decision_token_rpc(
+        "decision-token",
+        tool_name="payments.refund",
+        tool_args={"amount": 25},
+        agent_id="billing-agent",
+        source_agent_id="manager-agent",
+        platform="autogen",
+    )
+    verify = mock_request.call_args.kwargs["json"]["params"]["arguments"]
+    assert verify["tool_version"] == "2.0.0"
+    assert verify["tool_digest"] == digest
+
+
+def test_invalid_registered_tool_digest_fails_before_network(client):
+    with pytest.raises(ValueError, match="tool_digest"):
+        client.register_tool_provenance("unsafe.tool", tool_digest="sha256:not-a-real-digest")
+
+
 @patch("agenticdome_sdk.client.requests.Session.request")
 def test_guardrail_validate_blocks_invalid_tool_pairing(mock_request, client):
     with pytest.raises(ValueError, match="'tool_args' is required"):
@@ -297,6 +356,26 @@ def test_mcp_guardrail_validate(mock_request, client):
     assert arguments["tool_name"] == "mcp.execute_remote_patch"
 
 
+@patch("agenticdome_sdk.client.requests.Session.request")
+def test_mcp_guardrail_uses_registered_tool_provenance(mock_request, client):
+    digest = "sha256:" + "d" * 64
+    mock_request.return_value = make_response(200, {"jsonrpc": "2.0", "id": "1", "result": {"verdict": "ALLOWED"}})
+    client.register_tool_provenance("mcp.customer.lookup", tool_version="1.8.0", tool_digest=digest, tool_platform="mcp")
+
+    client.mcp_guardrail_validate(
+        text="lookup customer",
+        agent_id="mcp-agent",
+        platform="mcp",
+        tool_platform="mcp",
+        tool_name="mcp.customer.lookup",
+        tool_args={"customer_id": "42"},
+    )
+
+    arguments = mock_request.call_args.kwargs["json"]["params"]["arguments"]
+    assert arguments["tool_version"] == "1.8.0"
+    assert arguments["tool_digest"] == digest
+
+
 @patch("agenticdome_sdk.client.requests.Session.request")
 def test_mesh_validate(mock_request, client):
     mock_request.return_value = make_response(

agenticdome_python_sdk-1.2.8/tests/test_execution_broker.py

@@ -0,0 +1,75 @@
+from agenticdome_sdk.client import AgentGuardClient, AgentGuardError
+
+
+def _client(mode="enforce"):
+    return AgentGuardClient(
+        "https://sidecar.example",
+        api_key="test-key",
+        tenant_id="tenant-1",
+        execution_broker_mode=mode,
+        max_retries=0,
+    )
+
+
+def test_tool_authorization_uses_one_request_broker_and_requires_receipt(monkeypatch):
+    client = _client()
+    observed = {}
+
+    def request(method, path, **kwargs):
+        observed.update({"method": method, "path": path, **kwargs})
+        return {"verdict": "ALLOWED", "broker": {"verified": True, "token_consumed": True}}
+
+    monkeypatch.setattr(client, "_request", request)
+    response = client.guardrail_validate(
+        text="lookup customer",
+        agent_id="support-agent",
+        platform="custom_python",
+        source_agent_id="support-manager",
+        source_platform="microsoft",
+        tool_name="crm.lookup",
+        tool_args={"id": "123"},
+        actor_chain=[
+            {"id": "support-manager", "framework": "microsoft"},
+            {"id": "support-agent", "framework": "custom_python"},
+        ],
+        scopes=["crm.customer.read"],
+        permissions=["case.status.read"],
+        parent_jti="parent-decision",
+        root_jti="root-decision",
+        policy_id="support-policy",
+        policy_version="3",
+        policy_hash="sha256:" + "a" * 64,
+        proof_thumbprint="proof-thumbprint",
+    )
+
+    assert response["verdict"] == "ALLOWED"
+    assert observed["path"] == "/tools/execution/authorize"
+    assert observed["json_body"]["boundary_id"].startswith("sdk:")
+    assert observed["json_body"]["actor_chain"][1]["id"] == "support-agent"
+    assert observed["json_body"]["scopes"] == ["crm.customer.read"]
+    assert observed["json_body"]["permissions"] == ["case.status.read"]
+    assert observed["json_body"]["parent_jti"] == "parent-decision"
+    assert observed["json_body"]["root_jti"] == "root-decision"
+    assert observed["json_body"]["policy_id"] == "support-policy"
+    assert observed["json_body"]["policy_version"] == "3"
+    assert observed["json_body"]["policy_hash"] == "sha256:" + "a" * 64
+    assert observed["json_body"]["proof_thumbprint"] == "proof-thumbprint"
+    assert observed["json_body"]["policy_context"]["actor_chain"][0]["id"] == "support-manager"
+
+
+def test_enforced_broker_fails_closed_without_consumed_receipt(monkeypatch):
+    client = _client()
+    monkeypatch.setattr(client, "_request", lambda *args, **kwargs: {"verdict": "ALLOWED"})
+
+    try:
+        client.guardrail_validate(
+            text="lookup customer",
+            agent_id="support-agent",
+            platform="custom_python",
+            tool_name="crm.lookup",
+            tool_args={"id": "123"},
+        )
+    except AgentGuardError as exc:
+        assert "atomically consumed" in str(exc)
+    else:
+        raise AssertionError("missing broker receipt did not fail closed")