agentrust-py 0.0.3a1__tar.gz → 0.0.4__tar.gz

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/PKG-INFO

@@ -1,11 +1,11 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: agentrust-py
-Version: 0.0.3a1
+Version: 0.0.4
 Summary: AgentTrust Edge — Full Governance Platform. Policy Engine + MAD Classifier + HITL + Kill Switch.
 Project-URL: Homepage, https://agentrust.io
 Project-URL: Documentation, https://docs.agentrust.io
-Project-URL: Repository, https://github.com/agentrust/agentrust
-Project-URL: Changelog, https://github.com/agentrust/agentrust/blob/main/CHANGELOG.md
+Project-URL: Repository, https://github.com/agent-trust-os/agent-trust-sdk
+Project-URL: Changelog, https://github.com/agent-trust-os/agent-trust-sdk/blob/main/CHANGELOG.md
 License: Apache-2.0
 License-File: LICENSE
 Keywords: agents,ai,audit,compliance,governance,llm,safety,trust

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/__init__.py

@@ -145,4 +145,4 @@ __all__ = [
     "validate",
 ]
 
-__version__ = "0.0.3a1"
+__version__ = "0.0.4"

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/adapters/crewai.py

@@ -8,9 +8,6 @@ from __future__ import annotations
 import logging
 from typing import Any, Callable
 
-from agentrust_sdk.client import AgentTrustClient
-from agentrust_sdk.decorator import BlockedError, _check_decision
-
 logger = logging.getLogger(__name__)
 
 
@@ -51,7 +48,7 @@ class AgentTrustCallback:
         base_url: str = "http://localhost:8000",
         api_key: str | None = None,
         user: str = "crewai",
-        block_on_block: bool = False,
+        block_on_block: bool = True,
         block_on_review: bool = False,
         framework: str = "CrewAI",
     ) -> None:
@@ -66,6 +63,9 @@ class AgentTrustCallback:
         self._last_result: Any = None
 
     def on_task_complete(self, output: Any) -> Any:
+        from agentrust_sdk.client import AgentTrustClient
+        from agentrust_sdk.decorator import BlockedError, _check_decision
+
         raw = output
         if hasattr(output, "raw"):
             raw = output.raw
@@ -80,8 +80,8 @@ class AgentTrustCallback:
                     output=payload,
                     framework=self._framework,
                 )
-            self._last_result = resp.model_dump()
             _check_decision(resp, self._block_on_block, self._block_on_review)
+            self._last_result = resp
         except BlockedError:
             raise
         except Exception as exc:

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/adapters/langgraph.py

@@ -8,9 +8,6 @@ from __future__ import annotations
 import logging
 from typing import Any
 
-from agentrust_sdk.client import AgentTrustClient, AsyncAgentTrustClient
-from agentrust_sdk.decorator import BlockedError, _check_decision
-
 logger = logging.getLogger(__name__)
 
 
@@ -68,6 +65,9 @@ class AgentTrustNode:
         self._framework = framework
 
     def __call__(self, state: dict[str, Any]) -> dict[str, Any]:
+        from agentrust_sdk.client import AgentTrustClient
+        from agentrust_sdk.decorator import BlockedError, _check_decision
+
         output = state.get(self._output_key, {})
         if not isinstance(output, dict):
             output = {"result": str(output)}
@@ -90,6 +90,9 @@ class AgentTrustNode:
             return state
 
     async def ainvoke(self, state: dict[str, Any]) -> dict[str, Any]:
+        from agentrust_sdk.client import AsyncAgentTrustClient
+        from agentrust_sdk.decorator import BlockedError, _check_decision
+
         output = state.get(self._output_key, {})
         if not isinstance(output, dict):
             output = {"result": str(output)}

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/autoload.py

@@ -28,7 +28,7 @@ Three ways to activate without editing application code
 
 **5. `[autoload]` setuptools extra:**
 
-    pip install agentrust-sdk[autoload]
+    pip install agentrust-py[autoload]
 
     Then in your app's own `sitecustomize.py` or startup:
         import agentrust_sdk.autoload

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/client.py

@@ -64,6 +64,7 @@ except ImportError:
 try:
     from tenacity import (
         retry,
+        retry_if_exception_type,
         stop_after_attempt,
         wait_exponential,
     )
@@ -123,14 +124,16 @@ def _build_gateway_payload(req: ValidateRequest) -> dict[str, Any]:
         "sdk_version": SDK_CONFIG.sdk_version,
         "sdk_min_gateway_version": SDK_CONFIG.min_gateway_version,
     }
+    if req.callback_url:
+        payload["callback_url"] = req.callback_url
     return payload
 
 
 def _build_pre_check_payload(
     agent_id: str, action: str, params: dict[str, Any], user: str, input: str,
-    framework: str, model: str,
+    framework: str, model: str, callback_url: str | None = None,
 ) -> dict[str, Any]:
-    return {
+    payload = {
         "agent_id": agent_id,
         "framework": framework,
         "action": action,
@@ -139,11 +142,15 @@ def _build_pre_check_payload(
         "input": input,
         "model": model,
     }
+    if callback_url:
+        payload["callback_url"] = callback_url
+    return payload
 
 
 def _build_post_check_payload(
     pre_check_envelope_id: str, output: dict[str, Any], model: str,
     tools_called: list[dict[str, Any]], latency_ms: float, tokens: int,
+    callback_url: str | None = None,
 ) -> dict[str, Any]:
     tool_results = [
         {
@@ -155,7 +162,7 @@ def _build_post_check_payload(
         for t in tools_called
         if t.get("result") is not None or t.get("error") is not None
     ]
-    return {
+    payload = {
         "pre_check_envelope_id": pre_check_envelope_id,
         "execution": {
             "model": model,
@@ -167,6 +174,9 @@ def _build_post_check_payload(
         "output": output,
         "sdk_version": SDK_CONFIG.sdk_version,
     }
+    if callback_url:
+        payload["callback_url"] = callback_url
+    return payload
 
 
 def _warn_tier(capability: Capability) -> None:
@@ -175,7 +185,7 @@ def _warn_tier(capability: Capability) -> None:
 
 
 def _noop_response() -> ValidateResponse:
-    """Return a pass-through ValidateResponse used when SDK is disabled (kill-switch)."""
+    """Return a pass-through ValidateResponse used when SDK is disabled."""
     from .models import DecisionResult, RiskResult, ValidationResult
     return ValidateResponse(
         envelope_id="disabled",
@@ -187,19 +197,6 @@ def _noop_response() -> ValidateResponse:
     )
 
 
-def _unavailable_response() -> ValidateResponse:
-    """Return a pass-through ValidateResponse used when gateway is unreachable."""
-    from .models import DecisionResult, RiskResult, ValidationResult
-    return ValidateResponse(
-        envelope_id="unavailable",
-        validation=ValidationResult(schema_score=100.0, final_confidence=100.0, failures=[]),
-        risk=RiskResult(),
-        decision=DecisionResult(outcome="approve", reason="AgentTrust gateway unreachable — fail-open"),
-        latency_ms=0.0,
-        tier_info="unavailable",
-    )
-
-
 # ---------------------------------------------------------------------------
 # Local queue for failure_mode=queue
 # ---------------------------------------------------------------------------
@@ -259,7 +256,7 @@ def drain_queue(
 
     headers: dict[str, str] = {
         "Content-Type": "application/json",
-        "X-Agentrust-SDK-Version": SDK_CONFIG.sdk_version,
+        "X-AgentTrust-SDK-Version": SDK_CONFIG.sdk_version,
     }
     if _key:
         headers["X-AgentTrust-Token"] = _key
@@ -288,22 +285,12 @@ def drain_queue(
 # Retry helper
 # ---------------------------------------------------------------------------
 
-def _is_retryable_error(exc: Exception) -> bool:
-    """Return True for transport/timeout errors and 5xx HTTP status errors."""
-    if isinstance(exc, (httpx.TransportError, httpx.TimeoutException)):
-        return True
-    if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code >= 500:
-        return True
-    return False
-
-
 def _make_sync_retry():
     """Return a tenacity retry decorator for sync HTTP calls, or identity if tenacity missing."""
     if not _HAS_TENACITY:
         return lambda f: f
-    from tenacity import retry_if_exception
     return retry(
-        retry=retry_if_exception(_is_retryable_error),
+        retry=retry_if_exception_type((httpx.TransportError, httpx.TimeoutException)),
         stop=stop_after_attempt(SDK_CONFIG.retry_attempts),
         wait=wait_exponential(multiplier=SDK_CONFIG.retry_backoff_sec, min=0.1, max=30),
         reraise=True,
@@ -313,9 +300,8 @@ def _make_sync_retry():
 def _make_async_retry():
     if not _HAS_TENACITY:
         return lambda f: f
-    from tenacity import retry_if_exception
     return retry(
-        retry=retry_if_exception(_is_retryable_error),
+        retry=retry_if_exception_type((httpx.TransportError, httpx.TimeoutException)),
         stop=stop_after_attempt(SDK_CONFIG.retry_attempts),
         wait=wait_exponential(multiplier=SDK_CONFIG.retry_backoff_sec, min=0.1, max=30),
         reraise=True,
@@ -378,7 +364,7 @@ class AgentTrustClient:
 
         headers = {
             "Content-Type": "application/json",
-            "X-Agentrust-SDK-Version": SDK_CONFIG.sdk_version,
+            "X-AgentTrust-SDK-Version": SDK_CONFIG.sdk_version,
         }
         if self._key_info.key:
             headers["X-AgentTrust-Token"] = self._key_info.key
@@ -458,12 +444,12 @@ class AgentTrustClient:
         framework: str = "REST",
         model: str = "unknown",
         tools_called: list[dict] | None = None,
-        tool_results: list[dict] | None = None,
         latency_ms: float = 0.0,
         tokens: int = 0,
         parent_envelope_id: str | None = None,
         session_id: str | None = None,
         metadata: dict[str, Any] | None = None,
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         # ── kill-switch ──────────────────────────────────────────────────────
         if not SDK_CONFIG.enabled:
@@ -484,15 +470,13 @@ class AgentTrustClient:
             latency_ms=latency_ms, tokens=tokens,
             parent_envelope_id=parent_envelope_id,
             session_id=session_id, metadata=metadata or {},
+            callback_url=callback_url,
         )
 
         if self._key_info.tier == Tier.OSS:
             return _oss_schema_only(req)
 
         payload = _build_gateway_payload(req)
-        # If caller provided explicit tool_results, override the auto-derived ones.
-        if tool_results is not None:
-            payload["execution"]["tool_results"] = tool_results
         result = self._call_with_resilience(payload, req)
 
         # ── Webhook fan-out (Team tier and above) ────────────────────────────
@@ -526,6 +510,7 @@ class AgentTrustClient:
         input: str = "",
         framework: str = "REST",
         model: str = "unknown",
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         """"Can we call this?" — deterministic pre-check, before the real call executes.
 
@@ -538,7 +523,7 @@ class AgentTrustClient:
             return _noop_response()
 
         payload = _build_pre_check_payload(
-            agent_id, action, params or {}, user, input, framework, model
+            agent_id, action, params or {}, user, input, framework, model, callback_url
         )
 
         @_make_sync_retry()
@@ -547,7 +532,7 @@ class AgentTrustClient:
             if resp.status_code == 426:
                 raise GatewayVersionError(
                     f"Gateway requires SDK upgrade. Current SDK: {SDK_CONFIG.sdk_version}. "
-                    f"Upgrade: pip install --upgrade agentrust-sdk"
+                    f"Upgrade: pip install --upgrade agentrust-py"
                 )
             resp.raise_for_status()
             return ValidateResponse.model_validate(resp.json())
@@ -569,6 +554,7 @@ class AgentTrustClient:
         tools_called: list[dict[str, Any]] | None = None,
         latency_ms: float = 0.0,
         tokens: int = 0,
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         """"Is this output safe to release?" — governs release only; it
         cannot undo whatever the pre-check already approved."""
@@ -576,7 +562,8 @@ class AgentTrustClient:
             return _noop_response()
 
         payload = _build_post_check_payload(
-            pre_check_envelope_id, output or {}, model, tools_called or [], latency_ms, tokens
+            pre_check_envelope_id, output or {}, model, tools_called or [], latency_ms, tokens,
+            callback_url,
         )
 
         @_make_sync_retry()
@@ -585,7 +572,7 @@ class AgentTrustClient:
             if resp.status_code == 426:
                 raise GatewayVersionError(
                     f"Gateway requires SDK upgrade. Current SDK: {SDK_CONFIG.sdk_version}. "
-                    f"Upgrade: pip install --upgrade agentrust-sdk"
+                    f"Upgrade: pip install --upgrade agentrust-py"
                 )
             resp.raise_for_status()
             return ValidateResponse.model_validate(resp.json())
@@ -607,17 +594,13 @@ class AgentTrustClient:
         def _do_request() -> ValidateResponse:
             @_make_sync_retry()
             def _inner():
-                resp = self._http.post(
-                    _VALIDATE_PATH,
-                    json=payload,
-                    headers={"X-Agent-ID": req.agent_id},
-                )
+                resp = self._http.post(_VALIDATE_PATH, json=payload)
                 # 426 = version mismatch
                 if resp.status_code == 426:
                     raise GatewayVersionError(
                         f"Gateway requires SDK upgrade. "
                         f"Current SDK: {SDK_CONFIG.sdk_version}. "
-                        f"Upgrade: pip install --upgrade agentrust-sdk"
+                        f"Upgrade: pip install --upgrade agentrust-py"
                     )
                 resp.raise_for_status()
                 return ValidateResponse.model_validate(resp.json())
@@ -662,7 +645,7 @@ class AgentTrustClient:
             _enqueue_failed_request(payload)
         else:  # open (default)
             logger.warning("[AgentTrust] Gateway unreachable (fail-open): %s", exc)
-        return _unavailable_response()
+        return _noop_response()
 
     def close(self) -> None:
         self._http.close()
@@ -715,7 +698,7 @@ class AsyncAgentTrustClient:
 
         headers = {
             "Content-Type": "application/json",
-            "X-Agentrust-SDK-Version": SDK_CONFIG.sdk_version,
+            "X-AgentTrust-SDK-Version": SDK_CONFIG.sdk_version,
         }
         if self._key_info.key:
             headers["X-AgentTrust-Token"] = self._key_info.key
@@ -763,12 +746,12 @@ class AsyncAgentTrustClient:
         framework: str = "REST",
         model: str = "unknown",
         tools_called: list[dict] | None = None,
-        tool_results: list[dict] | None = None,
         latency_ms: float = 0.0,
         tokens: int = 0,
         parent_envelope_id: str | None = None,
         session_id: str | None = None,
         metadata: dict[str, Any] | None = None,
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         if not SDK_CONFIG.enabled:
             return _noop_response()
@@ -788,15 +771,13 @@ class AsyncAgentTrustClient:
             latency_ms=latency_ms, tokens=tokens,
             parent_envelope_id=parent_envelope_id,
             session_id=session_id, metadata=metadata or {},
+            callback_url=callback_url,
         )
 
         if self._key_info.tier == Tier.OSS:
             return _oss_schema_only(req)
 
         payload = _build_gateway_payload(req)
-        # If caller provided explicit tool_results, override the auto-derived ones.
-        if tool_results is not None:
-            payload["execution"]["tool_results"] = tool_results
         result = await self._call_with_resilience(payload, req)
 
         # ── Async webhook fan-out (Team tier and above) ───────────────────────
@@ -831,13 +812,14 @@ class AsyncAgentTrustClient:
         input: str = "",
         framework: str = "REST",
         model: str = "unknown",
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         """Async counterpart of AgentTrustClient.pre_check — see that docstring."""
         if not SDK_CONFIG.enabled:
             return _noop_response()
 
         payload = _build_pre_check_payload(
-            agent_id, action, params or {}, user, input, framework, model
+            agent_id, action, params or {}, user, input, framework, model, callback_url
         )
 
         @_make_async_retry()
@@ -846,7 +828,7 @@ class AsyncAgentTrustClient:
             if resp.status_code == 426:
                 raise GatewayVersionError(
                     f"Gateway requires SDK upgrade. Current SDK: {SDK_CONFIG.sdk_version}. "
-                    f"Upgrade: pip install --upgrade agentrust-sdk"
+                    f"Upgrade: pip install --upgrade agentrust-py"
                 )
             resp.raise_for_status()
             return ValidateResponse.model_validate(resp.json())
@@ -868,13 +850,15 @@ class AsyncAgentTrustClient:
         tools_called: list[dict[str, Any]] | None = None,
         latency_ms: float = 0.0,
         tokens: int = 0,
+        callback_url: str | None = None,
     ) -> ValidateResponse:
         """Async counterpart of AgentTrustClient.post_check — see that docstring."""
         if not SDK_CONFIG.enabled:
             return _noop_response()
 
         payload = _build_post_check_payload(
-            pre_check_envelope_id, output or {}, model, tools_called or [], latency_ms, tokens
+            pre_check_envelope_id, output or {}, model, tools_called or [], latency_ms, tokens,
+            callback_url,
         )
 
         @_make_async_retry()
@@ -883,7 +867,7 @@ class AsyncAgentTrustClient:
             if resp.status_code == 426:
                 raise GatewayVersionError(
                     f"Gateway requires SDK upgrade. Current SDK: {SDK_CONFIG.sdk_version}. "
-                    f"Upgrade: pip install --upgrade agentrust-sdk"
+                    f"Upgrade: pip install --upgrade agentrust-py"
                 )
             resp.raise_for_status()
             return ValidateResponse.model_validate(resp.json())
@@ -904,15 +888,11 @@ class AsyncAgentTrustClient:
         async def _do_request() -> ValidateResponse:
             @_make_async_retry()
             async def _inner():
-                resp = await self._http.post(
-                    _VALIDATE_PATH,
-                    json=payload,
-                    headers={"X-Agent-ID": req.agent_id},
-                )
+                resp = await self._http.post(_VALIDATE_PATH, json=payload)
                 if resp.status_code == 426:
                     raise GatewayVersionError(
                         f"Gateway requires SDK upgrade. Current: {SDK_CONFIG.sdk_version}. "
-                        f"Upgrade: pip install --upgrade agentrust-sdk"
+                        f"Upgrade: pip install --upgrade agentrust-py"
                     )
                 resp.raise_for_status()
                 return ValidateResponse.model_validate(resp.json())
@@ -956,7 +936,7 @@ class AsyncAgentTrustClient:
             _enqueue_failed_request(payload)
         else:
             logger.warning("[AgentTrust] Async gateway unreachable (fail-open): %s", exc)
-        return _unavailable_response()
+        return _noop_response()
 
     async def close(self) -> None:
         await self._http.aclose()

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/config.py

@@ -47,20 +47,9 @@ from pathlib import Path
 logger = logging.getLogger(__name__)
 
 _VALID_FAILURE_MODES = frozenset({"open", "closed", "queue"})
-_SDK_VERSION = "0.0.3a1"
+_SDK_VERSION = "0.0.4"
 _MIN_GATEWAY_VERSION = "0.0.1a1"
 
-# Keys that tests may override via SDK_CONFIG.__dict__["key"] = value.
-# __getattribute__ checks instance __dict__ first for these keys so that
-# direct dict assignment works as an in-process override (tests and runtime
-# overrides) without needing to mutate os.environ.
-_OVERRIDABLE_KEYS = frozenset({
-    "enabled", "gateway_url", "api_key", "timeout_sec", "retry_attempts",
-    "retry_backoff_sec", "failure_mode", "queue_db",
-    "webhook_url", "webhook_events", "webhook_db", "webhook_timeout",
-    "webhook_auto_dispatch",
-})
-
 
 def _bool(key: str, default: bool) -> bool:
     val = os.environ.get(key, "").lower()
@@ -102,12 +91,6 @@ class _SDKConfig:
     on each attribute access so runtime mutations (secrets managers, test
     fixtures) take effect without a process restart.
 
-    In-process overrides (for tests or runtime hot-patching) are supported by
-    directly writing to the instance dict:
-
-        SDK_CONFIG.__dict__["failure_mode"] = "closed"  # overrides env var
-        del SDK_CONFIG.__dict__["failure_mode"]          # restore env-var reading
-
     Call reload() to invalidate any cached state (currently a no-op since
     nothing is cached, but provided for forward-compat and test ergonomics).
     """
@@ -116,31 +99,10 @@ class _SDKConfig:
     sdk_version: str = _SDK_VERSION
     min_gateway_version: str = _MIN_GATEWAY_VERSION
 
-    # ---------------------------------------------------------------------------
-    # Instance-dict override support
-    # ---------------------------------------------------------------------------
-
-    def __getattribute__(self, name: str):  # type: ignore[override]
-        # For the known config keys, honour a value stored directly in the
-        # instance __dict__ first (written by tests or runtime overrides via
-        # SDK_CONFIG.__dict__["key"] = value).  This lets test code bypass
-        # env-var mutation while keeping the singleton's lazy-env behaviour for
-        # every key that has NOT been explicitly overridden.
-        if name in _OVERRIDABLE_KEYS:
-            instance_dict = object.__getattribute__(self, "__dict__")
-            if name in instance_dict:
-                return instance_dict[name]
-        return object.__getattribute__(self, name)
-
     @property
     def enabled(self) -> bool:
         return _bool("AGENTRUST_ENABLED", True)
 
-    @enabled.setter
-    def enabled(self, value: bool) -> None:
-        # Honour direct attribute assignment (used by monkeypatch.setattr).
-        os.environ["AGENTRUST_ENABLED"] = "true" if value else "false"
-
     @property
     def gateway_url(self) -> str:
         return os.environ.get("AGENTRUST_GATEWAY_URL", "http://localhost:8000")
@@ -241,6 +203,3 @@ class _SDKConfig:
 
 # Module-level singleton — import as `from .config import SDK_CONFIG`
 SDK_CONFIG = _SDKConfig()
-
-# Public alias (some tests import `SDKConfig` without the leading underscore).
-SDKConfig = _SDKConfig

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/agentrust_sdk/models.py

@@ -35,6 +35,11 @@ class DecisionResult(BaseModel):
     outcome: str = "pending"  # "pending" = not computed (tier too low)
     reason: str = ""
     policy_version: str = ""
+    # Set by newer gateways; absent (None / False) from older ones.
+    mode: Optional[str] = None               # alert | hitl | block, when the agent's mode applied
+    original_outcome: Optional[str] = None   # what the engine decided before the mode changed it
+    reason_code: Optional[str] = None        # e.g. low_confidence, tool_trust, mode_review
+    hard_gate: bool = False                  # True: no mode can soften this block
 
 
 class ValidateRequest(BaseModel):
@@ -51,6 +56,9 @@ class ValidateRequest(BaseModel):
     tokens: int = 0
     session_id: Optional[str] = None
     metadata: Dict[str, Any] = Field(default_factory=dict)
+    # Where the gateway should send one signed message if a person later decides
+    # on the review case this check creates. Optional.
+    callback_url: Optional[str] = None
 
 
 class ValidateResponse(BaseModel):

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-py"
-version = "0.0.3a1"
+version = "0.0.4"
 description = "AgentTrust Edge — Full Governance Platform. Policy Engine + MAD Classifier + HITL + Kill Switch."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -75,8 +75,8 @@ agentrust = "agentrust_sdk.cli:main"
 [project.urls]
 Homepage      = "https://agentrust.io"
 Documentation = "https://docs.agentrust.io"
-Repository    = "https://github.com/agentrust/agentrust"
-Changelog     = "https://github.com/agentrust/agentrust/blob/main/CHANGELOG.md"
+Repository    = "https://github.com/agent-trust-os/agent-trust-sdk"
+Changelog     = "https://github.com/agent-trust-os/agent-trust-sdk/blob/main/CHANGELOG.md"
 
 [tool.hatch.build.targets.wheel]
 packages = ["agentrust_sdk", "agentrust"]

agentrust_py-0.0.4/tests/_cfg.py

@@ -0,0 +1,32 @@
+"""Helpers to override SDK_CONFIG values.
+
+SDK_CONFIG properties are read-only and resolved from environment variables on
+each access, so overrides go through os.environ. The autouse ``reset_env``
+fixture in conftest.py restores the keys it manages; ``restore_env`` (autouse,
+below in conftest) restores the rest.
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+_ENV = {
+    "enabled": "AGENTRUST_ENABLED",
+    "failure_mode": "AGENTRUST_FAILURE_MODE",
+    "retry_attempts": "AGENTRUST_RETRY_ATTEMPTS",
+    "queue_db": "AGENTRUST_QUEUE_DB",
+}
+
+
+def set_cfg(name: str, value) -> None:
+    key = _ENV[name]
+    if value is None:
+        os.environ.pop(key, None)
+    elif isinstance(value, bool):
+        os.environ[key] = "true" if value else "false"
+    else:
+        os.environ[key] = str(value)
+
+
+def unset_cfg(name: str) -> None:
+    os.environ.pop(_ENV[name], None)

{agentrust_py-0.0.3a1 → agentrust_py-0.0.4}/tests/conftest.py

@@ -4,18 +4,9 @@ from __future__ import annotations
 import os
 import pytest
 
-# Config keys that tests may override via SDK_CONFIG.__dict__ — cleared before
-# each test so no state leaks between tests.
-_SDK_CONFIG_OVERRIDE_KEYS = (
-    "enabled", "gateway_url", "api_key", "timeout_sec", "retry_attempts",
-    "retry_backoff_sec", "failure_mode", "queue_db",
-    "webhook_url", "webhook_events", "webhook_db", "webhook_timeout",
-    "webhook_auto_dispatch",
-)
-
 
 @pytest.fixture(autouse=True)
-def reset_env(monkeypatch):
+def reset_env(monkeypatch, tmp_path_factory):
     """Ensure each test starts with a clean environment."""
     for key in (
         "AGENTRUST_ENABLED",
@@ -24,15 +15,15 @@ def reset_env(monkeypatch):
         "AGENTRUST_RETRY_ATTEMPTS",
         "AGENTRUST_GATEWAY_URL",
         "AGENTRUST_KEY",
+        "AGENTRUST_QUEUE_DB",
+        "AGENTRUST_RETRY_BACKOFF",
     ):
         monkeypatch.delenv(key, raising=False)
-
-    # Clear any in-process SDK_CONFIG overrides left by previous tests.
-    # These are set via SDK_CONFIG.__dict__["key"] = value in test bodies.
-    from agentrust_sdk.config import SDK_CONFIG
-    for key in _SDK_CONFIG_OVERRIDE_KEYS:
-        SDK_CONFIG.__dict__.pop(key, None)
-
+    # Isolate from any developer key in ~/.agentrust/config.yaml or a project
+    # .agentrust/config.yaml so key-less (OSS) behaviour is deterministic.
+    from agentrust_sdk import auth
+    monkeypatch.setattr(auth, "_GLOBAL_CONFIG", tmp_path_factory.mktemp("noconf") / "config.yaml")
+    monkeypatch.setattr(auth, "_project_config", lambda: None)
     yield
 
 
@@ -78,3 +69,9 @@ def mock_block_response() -> dict:
         "confidence_rationale": None,
         "trust_chain": None,
     }
+
+
+@pytest.fixture
+def gateway_key(monkeypatch):
+    """A syntactically valid non-OSS key so clients take the HTTP path."""
+    monkeypatch.setenv("AGENTRUST_KEY", "at_free_test")