agentrust-py 0.0.5__tar.gz → 0.0.6__tar.gz

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/CHANGELOG.md

@@ -7,6 +7,22 @@ Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ---
 
+## [0.0.6] - 2026-10-26
+
+### Added
+- **CrewAI tool calls are checked before they run.** `governed_tools(tools, agent_id=...)` (`agentrust_sdk.adapters.crewai`) wraps the tools given to a CrewAI `Agent`: each call is pre-checked (tool trust, kill switch, trust chain), held for a person when the decision is `escalate`, then post-checked. A refused call reaches the agent as the tool's result (`Blocked by AgentTrust: ...`), so the crew finishes. Proven against real CrewAI by the same C1–C10 conformance suite as LangGraph.
+- `guardrail(agent_id=...)` for `Task(guardrail=...)`: a blocked task output returns `(False, "Blocked by AgentTrust: ...")`, so CrewAI asks the agent for a new answer instead of ending the crew.
+- `examples/crewai_quickstart.py`, the calculator crew governed by AgentTrust.
+
+### Changed
+- **`agentrust-py[crewai]` now needs CrewAI 1.x** (`crewai>=1.0,<2.0`). CrewAI 0.x is no longer supported.
+- **`AgentTrustCallback`:** the gateway URL defaults to `AGENTRUST_GATEWAY_URL` instead of a hardcoded `http://localhost:8000`; with `AGENTRUST_FAILURE_MODE=closed` an unreachable gateway now raises `GatewayUnavailableError` instead of passing the output through. Its constructor arguments and its behaviour in open mode are unchanged.
+
+### Fixed
+- **Console agent keys (`at_live_...`) were refused by the SDK's client-side tier check** with `<framework> adapter requires Team tier`, a paying Team customer's included, so a connection needed `AGENTRUST_ENV=development`. Only a JWT key states its tier, so only a JWT key is checked on the client; for any other key the gateway, which knows the owner's plan, decides. Affects `governed_tools` for LangGraph and the CrewAI adapter.
+
+---
+
 ## [0.0.5] - 2026-10-26
 
 ### Added

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentrust-py
-Version: 0.0.5
+Version: 0.0.6
 Summary: AgentTrust Edge — Full Governance Platform. Policy Engine + MAD Classifier + HITL + Kill Switch.
 Project-URL: Homepage, https://agentrust.io
 Project-URL: Documentation, https://docs.agentrust.io
@@ -25,8 +25,9 @@ Requires-Dist: pydantic<3.0.0,>=2.0.0
 Requires-Dist: pyyaml<7.0,>=6.0.3
 Provides-Extra: autoload
 Provides-Extra: crewai
-Requires-Dist: crewai<1.0.0,>=0.80.0; extra == 'crewai'
+Requires-Dist: crewai<2.0,>=1.0; extra == 'crewai'
 Provides-Extra: dev
+Requires-Dist: crewai<2.0,>=1.0; extra == 'dev'
 Requires-Dist: fastapi>=0.137.1; extra == 'dev'
 Requires-Dist: httpx<1.0.0,>=0.27.0; extra == 'dev'
 Requires-Dist: langgraph<2.0.0,>=0.2.0; extra == 'dev'

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/agentrust_sdk/__init__.py

@@ -147,4 +147,4 @@ __all__ = [
     "validate",
 ]
 
-__version__ = "0.0.5"
+__version__ = "0.0.6"

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/agentrust_sdk/adapters/_core.py

@@ -28,7 +28,7 @@ import logging
 import os
 import time
 from contextvars import ContextVar
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from typing import Any, Awaitable, Callable, Literal
 
 from .. import client as _client
@@ -71,6 +71,8 @@ class Refused:
     envelope_id: str | None = None
     reason_code: str | None = None
     outcome: str = "block"
+    # The gateway answer behind a refused output check, when there is one.
+    response: ValidateResponse | None = None
 
 
 def _real_envelope(envelope_id: str | None) -> str | None:
@@ -80,12 +82,14 @@ def _real_envelope(envelope_id: str | None) -> str | None:
 def check_adapter_tier(capability: Capability, api_key: str | None = None) -> None:
     """Raise RuntimeError when *api_key*'s tier does not include *capability*.
 
-    Skipped in development/demo/test environments, without a key, and for
-    keys that are not AgentTrust ``at_`` keys (e.g. an embedded gateway token).
+    Only a JWT key states its tier, so only a JWT key is checked here. An
+    opaque key, such as a console agent key (``at_live_...``), carries no
+    tier: the gateway knows the owner's plan and decides. Also skipped in
+    development/demo/test environments and without a key.
     """
     env = os.environ.get("AGENTRUST_ENV", "production").lower()
     key = api_key or SDK_CONFIG.api_key
-    if env in ("development", "dev", "demo", "test") or not key or not key.startswith("at_"):
+    if env in ("development", "dev", "demo", "test") or not key or key.count(".") != 2:
         return
     from ..auth import resolve_key
 
@@ -281,10 +285,10 @@ class Governor:
 
     def _output_verdict(self, resp: ValidateResponse) -> Allowed | Refused:
         if resp.decision.outcome == "block":
-            return self._refused(
+            return replace(self._refused(
                 resp.decision.reason, _real_envelope(resp.envelope_id), resp.decision.reason_code,
                 outcome="block", raise_blocked=False,
-            )
+            ), response=resp)
         return Allowed(resp, _real_envelope(resp.envelope_id))
 
     def _hold(self, client: Any, pre: ValidateResponse) -> Refused | None:

agentrust_py-0.0.6/agentrust_sdk/adapters/crewai.py

@@ -0,0 +1,237 @@
+"""
+CrewAI adapter.
+
+- ``governed_tools(tools, agent_id=...)`` wraps each tool so every call is
+  pre-checked before it runs (tool trust, kill switch, review holds,
+  fail-closed) and its result post-checked. A refused call reaches the agent
+  as the tool's result text, so the crew keeps running.
+- ``AgentTrustCallback`` validates a task's output after the task finished.
+
+Requires Team tier. Gated at construction time.
+"""
+from __future__ import annotations
+
+import asyncio
+import inspect
+import logging
+from functools import lru_cache
+from typing import Any, Callable, Sequence
+
+from ._core import Allowed, Governor, OnBlock, Refused, check_adapter_tier
+from ..client import GatewayUnavailableError
+from ..tiers import Capability
+
+logger = logging.getLogger(__name__)
+
+_FRAMEWORK = "CrewAI"
+
+
+def governed_tools(
+    tools: Sequence[Any],
+    *,
+    agent_id: str,
+    on_block: OnBlock = "refuse",
+    review_timeout_s: float = 300.0,
+    user: str = "crewai",
+    base_url: str | None = None,
+    api_key: str | None = None,
+    governor: Governor | None = None,
+) -> list[Any]:
+    """Wrap CrewAI tools so AgentTrust governs every call.
+
+    Accepts ``BaseTool`` instances (subclasses and the ``@tool`` decorator)
+    and plain functions with a docstring. Each wrapped tool keeps its name,
+    description and argument schema, so the agent sees the same definition as
+    before. Pass the result as the ``Agent``'s ``tools=``.
+    """
+    check_adapter_tier(Capability.CREWAI_ADAPTER, api_key)
+    gov = governor or Governor(
+        agent_id,
+        framework=_FRAMEWORK,
+        on_block=on_block,
+        review_timeout_s=review_timeout_s,
+        user=user,
+        base_url=base_url,
+        api_key=api_key,
+    )
+    from crewai.tools import BaseTool, tool as as_tool
+
+    wrapper = _governed_tool_class()
+    return [
+        wrapper.wrap(t if isinstance(t, BaseTool) else as_tool(t), gov)
+        for t in tools
+    ]
+
+
+def _describe_call(name: str, args: dict[str, Any]) -> str:
+    """The proposed call as the pre-check's request input."""
+    return f"tool call {name}({', '.join(f'{k}={v!r}' for k, v in args.items())})"
+
+
+def _never_cache(*_: Any, **__: Any) -> bool:
+    # A cached call skips ``_run``, so it would skip the pre-check too.
+    return False
+
+
+def _runs_async(tool: Any) -> bool:
+    """True when the tool has a real ``_arun`` rather than the base stub."""
+    func = getattr(tool, "func", None)
+    if func is not None:
+        return inspect.iscoroutinefunction(func)
+    from crewai.tools import BaseTool
+
+    return type(tool)._arun is not BaseTool._arun
+
+
+@lru_cache(maxsize=None)
+def _governed_tool_class() -> type:
+    """Build GovernedTool on first use, so crewai stays optional."""
+    from crewai.tools import BaseTool
+
+    class GovernedTool(BaseTool):
+        """A tool whose every call goes through an AgentTrust Governor."""
+
+        inner: Any
+        governor: Any
+
+        @classmethod
+        def wrap(cls, inner: BaseTool, governor: Governor) -> "GovernedTool":
+            return cls(
+                name=inner.name,
+                description=inner.description,
+                args_schema=inner.args_schema,
+                result_as_answer=inner.result_as_answer,
+                cache_function=_never_cache,
+                inner=inner,
+                governor=governor,
+            )
+
+        def _run(self, *args: Any, **kwargs: Any) -> Any:
+            outcome = self.governor.guard_tool(
+                self.name, kwargs,
+                lambda: self.inner.run(**kwargs),
+                input=_describe_call(self.name, kwargs),
+            )
+            return self._unwrap(outcome)
+
+        async def _arun(self, *args: Any, **kwargs: Any) -> Any:
+            async def call() -> Any:
+                if _runs_async(self.inner):
+                    return await self.inner.arun(**kwargs)
+                return await asyncio.to_thread(lambda: self.inner.run(**kwargs))
+
+            outcome = await self.governor.aguard_tool(
+                self.name, kwargs, call, input=_describe_call(self.name, kwargs),
+            )
+            return self._unwrap(outcome)
+
+        @staticmethod
+        def _unwrap(outcome: Allowed | Refused) -> Any:
+            # The refusal text is the observation the agent reads next.
+            return outcome.message if isinstance(outcome, Refused) else outcome.result
+
+    return GovernedTool
+
+
+def _task_payload(output: Any) -> dict[str, Any]:
+    """A task's output as the dict /validate expects."""
+    raw = getattr(output, "raw", output)
+    return raw if isinstance(raw, dict) else {"result": str(raw)}
+
+
+def guardrail(
+    *,
+    agent_id: str,
+    user: str = "crewai",
+    base_url: str | None = None,
+    api_key: str | None = None,
+    governor: Governor | None = None,
+) -> Callable[[Any], tuple[bool, Any]]:
+    """A ``Task(guardrail=...)`` that checks the task's output with AgentTrust.
+
+    Approved output passes through. A blocked output returns
+    ``(False, "Blocked by AgentTrust: ...")``, so CrewAI hands the refusal to
+    the agent and asks it to try again. In closed mode a gateway outage raises
+    ``GatewayUnavailableError``.
+    """
+    check_adapter_tier(Capability.CREWAI_ADAPTER, api_key)
+    gov = governor or Governor(
+        agent_id, framework=_FRAMEWORK, user=user, base_url=base_url, api_key=api_key,
+    )
+
+    # No return annotation: CrewAI checks it at runtime and rejects the string
+    # form that ``from __future__ import annotations`` produces.
+    def check(output):
+        verdict = gov.check_output(input="crewai-task", output=_task_payload(output))
+        if isinstance(verdict, Refused):
+            return False, verdict.message
+        return True, output
+
+    return check
+
+
+class AgentTrustCallback:
+    """
+    CrewAI task callback that validates output via AgentTrust.
+
+    Requires Team tier ($149/mo). Prefer ``guardrail()`` when a blocked output
+    should send the agent back to try again rather than raise.
+
+    Usage::
+
+        from crewai import Task
+        from agentrust_sdk.adapters.crewai import AgentTrustCallback
+
+        cb = AgentTrustCallback(agent_id="research-crew")
+        task = Task(description="...", callback=cb.on_task_complete)
+    """
+
+    def __init__(
+        self,
+        agent_id: str,
+        *,
+        base_url: str | None = None,
+        api_key: str | None = None,
+        user: str = "crewai",
+        block_on_block: bool = True,
+        block_on_review: bool = False,
+        framework: str = _FRAMEWORK,
+        governor: Governor | None = None,
+    ) -> None:
+        check_adapter_tier(Capability.CREWAI_ADAPTER, api_key)
+        self._agent_id = agent_id
+        self._block_on_block = block_on_block
+        self._block_on_review = block_on_review
+        self._governor = governor or Governor(
+            agent_id, framework=framework, user=user, base_url=base_url, api_key=api_key,
+        )
+        self._last_result: Any = None
+
+    def on_task_complete(self, output: Any) -> Any:
+        from agentrust_sdk.decorator import _check_decision
+
+        try:
+            verdict = self._governor.check_output(input="crewai-task", output=_task_payload(output))
+        except GatewayUnavailableError:
+            raise  # closed mode: the caller must stop
+        except Exception as exc:  # kept from before: an unexpected client error is not fatal
+            logger.warning("[AgentTrust] CrewAI callback failed (non-fatal): %s", exc)
+            return output
+        resp = verdict.response if isinstance(verdict, Refused) else verdict.result
+        self._last_result = resp
+        _check_decision(resp, self._block_on_block, self._block_on_review)
+        return output
+
+    def task_callback(self, fn: Callable) -> Callable:
+        import functools
+
+        @functools.wraps(fn)
+        def wrapper(output: Any) -> Any:
+            self.on_task_complete(output)
+            return fn(output)
+
+        return wrapper
+
+    @property
+    def last_result(self) -> Any:
+        return self._last_result

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/agentrust_sdk/config.py

@@ -47,7 +47,7 @@ from pathlib import Path
 logger = logging.getLogger(__name__)
 
 _VALID_FAILURE_MODES = frozenset({"open", "closed", "queue"})
-_SDK_VERSION = "0.0.5"
+_SDK_VERSION = "0.0.6"
 _MIN_GATEWAY_VERSION = "0.0.1a1"
 
 

{agentrust_py-0.0.5 → agentrust_py-0.0.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-py"
-version = "0.0.5"
+version = "0.0.6"
 description = "AgentTrust Edge — Full Governance Platform. Policy Engine + MAD Classifier + HITL + Kill Switch."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -40,7 +40,7 @@ llm = [
 ]
 # Framework adapters (optional, tier-gated)
 langgraph = ["langgraph>=0.2.0,<2.0.0"]
-crewai    = ["crewai>=0.80.0,<1.0.0"]
+crewai    = ["crewai>=1.0,<2.0"]
 openai    = ["openai>=2.41.1,<3.0.0"]
 langchain = ["langchain>=0.2.0,<1.0.0"]
 # Retry/backoff (recommended for production)
@@ -68,6 +68,7 @@ dev = [
     "uvicorn>=0.29.0",
     "httpx>=0.27.0,<1.0.0",
     "langgraph>=0.2.0,<2.0.0",
+    "crewai>=1.0,<2.0",
 ]
 
 [project.scripts]

agentrust_py-0.0.6/tests/adapters/_crews.py

@@ -0,0 +1,29 @@
+"""Small real CrewAI crews shared by the CrewAI binding tests."""
+from __future__ import annotations
+
+import json
+from typing import Any
+
+
+def tool_call(name: str, args: dict[str, Any]) -> str:
+    """The ReAct reply in which the agent calls a tool."""
+    return f"Thought: I should use {name}\nAction: {name}\nAction Input: {json.dumps(args)}"
+
+
+def final(text: str = "done") -> str:
+    return f"Thought: I now know the final answer\nFinal Answer: {text}"
+
+
+def one_agent_crew(tools, llm, *, guardrail=None, max_iter=25):
+    """One agent, one task, the given tools. ``max_iter`` caps the agent's LLM turns."""
+    from crewai import Agent, Crew, Task
+
+    agent = Agent(
+        role="Tester", goal="Use the tools", backstory="A test agent.",
+        tools=list(tools), llm=llm, allow_delegation=False, verbose=False, max_iter=max_iter,
+    )
+    task = Task(
+        description="Do the work.", expected_output="A short answer.",
+        agent=agent, guardrail=guardrail,
+    )
+    return Crew(agents=[agent], tasks=[task], verbose=False)

agentrust_py-0.0.6/tests/adapters/test_crewai_baseline.py

@@ -0,0 +1,28 @@
+"""Baseline: the harness runs a real CrewAI crew with no governance."""
+from __future__ import annotations
+
+import pytest
+
+from tests.adapters._crews import final, one_agent_crew, tool_call
+
+pytest.importorskip("crewai")
+pytestmark = pytest.mark.framework
+
+
+def test_real_crew_runs_a_tool_and_finishes(scripted_crewai_llm):
+    from crewai.tools import tool
+
+    calls: list[float] = []
+
+    @tool
+    def refund(amount: float) -> str:
+        """Refund an amount to the customer."""
+        calls.append(amount)
+        return f"refunded {amount}"
+
+    llm = scripted_crewai_llm(tool_call("refund", {"amount": 50}), final("all done"))
+    output = one_agent_crew([refund], llm).kickoff()
+
+    assert calls == [50.0]
+    assert "all done" in output.raw
+    assert any("refunded 50.0" in p for p in llm.prompts)

agentrust_py-0.0.6/tests/adapters/test_crewai_failure_modes.py

@@ -0,0 +1,107 @@
+"""Kill switch and gateway failure modes through governed CrewAI tools."""
+from __future__ import annotations
+
+import json
+import logging
+import sqlite3
+
+import pytest
+
+pytest.importorskip("crewai")
+pytestmark = pytest.mark.framework
+
+from crewai.tools import tool
+
+from agentrust_sdk.adapters.crewai import governed_tools
+from tests.adapters._crews import final, one_agent_crew, tool_call
+from tests.conftest import _free_port
+
+AGENT = "crew-failure-agent"
+
+
+def _tools(calls):
+    @tool
+    def lookup(order_id: str) -> str:
+        """Look up an order."""
+        calls.append(("lookup", order_id))
+        return f"order {order_id} shipped"
+
+    @tool
+    def refund(amount: float) -> str:
+        """Refund an amount."""
+        calls.append(("refund", amount))
+        return f"refunded {amount}"
+
+    return [lookup, refund]
+
+
+def _run(scripted_crewai_llm, calls):
+    llm = scripted_crewai_llm(
+        tool_call("lookup", {"order_id": "42"}),
+        tool_call("refund", {"amount": 5}),
+        final(),
+    )
+    output = one_agent_crew(governed_tools(_tools(calls), agent_id=AGENT), llm).kickoff()
+    return output, llm
+
+
+@pytest.fixture
+def dead_gateway(monkeypatch):
+    from agentrust_sdk.embedded import _make_embedded_jwt
+
+    monkeypatch.setenv("AGENTRUST_KEY", _make_embedded_jwt("team"))
+    monkeypatch.setenv("AGENTRUST_GATEWAY_URL", f"http://127.0.0.1:{_free_port()}")
+    monkeypatch.setenv("AGENTRUST_RETRY_ATTEMPTS", "1")
+    monkeypatch.setenv("AGENTRUST_TIMEOUT_SEC", "1")
+
+
+def test_kill_switch_blocks_every_tool(embedded_gw, scripted_crewai_llm):
+    from agentrust_sdk.governance.kill_switch import get_kill_switch
+
+    embedded_gw()
+    get_kill_switch().kill_agent(AGENT, "incident 7")
+    calls: list = []
+
+    output, llm = _run(scripted_crewai_llm, calls)
+
+    assert calls == []
+    assert sum("Kill switch" in p for p in llm.prompts) >= 1
+    assert "done" in output.raw
+
+
+def test_closed_mode_gateway_down_runs_no_tool(monkeypatch, dead_gateway, scripted_crewai_llm):
+    monkeypatch.setenv("AGENTRUST_FAILURE_MODE", "closed")
+    calls: list = []
+
+    output, llm = _run(scripted_crewai_llm, calls)
+
+    assert calls == []
+    assert any("gateway unavailable" in p for p in llm.prompts)
+    assert "done" in output.raw
+
+
+def test_open_mode_gateway_down_runs_tool_and_warns(
+    monkeypatch, dead_gateway, scripted_crewai_llm, caplog,
+):
+    monkeypatch.setenv("AGENTRUST_FAILURE_MODE", "open")
+    calls: list = []
+
+    with caplog.at_level(logging.WARNING):
+        _run(scripted_crewai_llm, calls)
+
+    assert calls == [("lookup", "42"), ("refund", 5.0)]
+    assert "fail-open" in caplog.text
+
+
+def test_queue_mode_gateway_down_buffers_request(
+    monkeypatch, dead_gateway, scripted_crewai_llm, tmp_path,
+):
+    monkeypatch.setenv("AGENTRUST_FAILURE_MODE", "queue")
+    monkeypatch.setenv("AGENTRUST_QUEUE_DB", str(tmp_path / "q.db"))
+    calls: list = []
+
+    _run(scripted_crewai_llm, calls)
+
+    assert len(calls) == 2
+    rows = sqlite3.connect(tmp_path / "q.db").execute("SELECT payload FROM queue").fetchall()
+    assert sorted(json.loads(r[0])["action"] for r in rows) == ["lookup", "refund"]