axor-proxy 0.1.0__tar.gz

axor_proxy-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.egg-info/
+.venv/
+.env
+node_modules/
+dist/
+*.kuzu/
+traces/
+axor-traces/

axor_proxy-0.1.0/PKG-INFO

@@ -0,0 +1,46 @@
+Metadata-Version: 2.4
+Name: axor-proxy
+Version: 0.1.0
+Summary: Observe-only tool proxy: passthrough auth, fault injection, trace recording.
+Project-URL: Homepage, https://github.com/Bucha11/axor-control-plane
+Project-URL: Documentation, https://github.com/Bucha11/axor-control-plane#readme
+Project-URL: Issues, https://github.com/Bucha11/axor-control-plane/issues
+License: Apache-2.0
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.12
+Requires-Dist: anyio>=4.0
+Requires-Dist: axor-core<0.10,>=0.9.2
+Requires-Dist: axor-eval<0.2,>=0.1.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: starlette>=0.37
+Requires-Dist: uvicorn>=0.29
+Description-Content-Type: text/markdown
+
+# axor-proxy
+
+Observe-only tool proxy (Starlette + httpx). Sits in front of the agent's tools;
+forwards auth byte-for-byte, and only ever does two things: inject a declared
+fault (armed scenario), record an observation (status/sizes/hashes — never raw
+bodies). It never blocks the agent.
+
+Run: `uv run axor-proxy --demo --backend-url http://127.0.0.1:8400`
+(`--demo` registers mock broken tools, zero creds; `--backend-url` auto-uploads
+runs so Eval/Replay/Regression light up).
+
+Modules:
+
+| Module | Responsibility |
+|---|---|
+| `app.py` | routes: `/t/{tool}` passthrough, `/axor/runs` arm→claim, `/axor/runs/{id}/simulate`, `/axor/governed/spawn`, preflight/health |
+| `runs.py` | run lifecycle; fault semantics from `axor_eval`; EvidenceCase construction |
+| `faults.py` / `mock_tools.py` | fault application; demo mock tools |
+| `agent.py` | scripted agent — drives a run to completion over the proxy's own HTTP surface (the in-app "run an experiment") |
+| `recorder.py` / `upload.py` | JSONL trace writer; best-effort upload + auto-pin to the backend |
+| `governed.py` | **demo governed node**: a real `axor_core` IntentLoop (per-value taint enforcement) that produces an adapter-fidelity trace and stays live on the plane (heartbeats + desired-state), so Control shows it and interventions reach it |
+
+Endpoints are disarmed (503) unless a run is armed; the trace file on disk is the
+system of record even if upload fails.
+
+Tests: `uv run pytest packages/axor-proxy`.

axor_proxy-0.1.0/README.md

@@ -0,0 +1,26 @@
+# axor-proxy
+
+Observe-only tool proxy (Starlette + httpx). Sits in front of the agent's tools;
+forwards auth byte-for-byte, and only ever does two things: inject a declared
+fault (armed scenario), record an observation (status/sizes/hashes — never raw
+bodies). It never blocks the agent.
+
+Run: `uv run axor-proxy --demo --backend-url http://127.0.0.1:8400`
+(`--demo` registers mock broken tools, zero creds; `--backend-url` auto-uploads
+runs so Eval/Replay/Regression light up).
+
+Modules:
+
+| Module | Responsibility |
+|---|---|
+| `app.py` | routes: `/t/{tool}` passthrough, `/axor/runs` arm→claim, `/axor/runs/{id}/simulate`, `/axor/governed/spawn`, preflight/health |
+| `runs.py` | run lifecycle; fault semantics from `axor_eval`; EvidenceCase construction |
+| `faults.py` / `mock_tools.py` | fault application; demo mock tools |
+| `agent.py` | scripted agent — drives a run to completion over the proxy's own HTTP surface (the in-app "run an experiment") |
+| `recorder.py` / `upload.py` | JSONL trace writer; best-effort upload + auto-pin to the backend |
+| `governed.py` | **demo governed node**: a real `axor_core` IntentLoop (per-value taint enforcement) that produces an adapter-fidelity trace and stays live on the plane (heartbeats + desired-state), so Control shows it and interventions reach it |
+
+Endpoints are disarmed (503) unless a run is armed; the trace file on disk is the
+system of record even if upload fails.
+
+Tests: `uv run pytest packages/axor-proxy`.

axor_proxy-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[project]
+name = "axor-proxy"
+version = "0.1.0"
+description = "Observe-only tool proxy: passthrough auth, fault injection, trace recording."
+requires-python = ">=3.12"
+readme = "README.md"
+license = { text = "Apache-2.0" }
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3.12",
+]
+dependencies = ["axor-core>=0.9.2,<0.10", "axor-eval>=0.1.0,<0.2", "httpx>=0.27", "anyio>=4.0", "starlette>=0.37", "uvicorn>=0.29"]
+
+[project.urls]
+Homepage = "https://github.com/Bucha11/axor-control-plane"
+Documentation = "https://github.com/Bucha11/axor-control-plane#readme"
+Issues = "https://github.com/Bucha11/axor-control-plane/issues"
+
+[project.scripts]
+axor-proxy = "axor_proxy.main:cli"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[dependency-groups]
+dev = ["axor-backend"]
+
+[tool.uv.sources]
+axor-backend = { workspace = true }

axor_proxy-0.1.0/src/axor_proxy/__init__.py

@@ -0,0 +1,9 @@
+"""axor-proxy: passthrough proxy with fault injection and observation.
+
+Spec section 6 rules, in order of importance:
+- Auth is passthrough, byte-for-byte. The proxy never parses, substitutes,
+  or stores credentials.
+- Exactly two intervention points: inject fault (scenario), record observation.
+- Observe-only: never blocks the agent.
+- No raw bodies persisted by default (persist_inputs=False mirror).
+"""

axor_proxy-0.1.0/src/axor_proxy/agent.py

@@ -0,0 +1,65 @@
+"""Scripted agent — our agent, for the in-app "run an experiment" loop.
+
+The proxy sits in front of tools; the *agent* calls them. For the user's own
+agent that agent is theirs (they point it at the proxy). But the demo-mode path
+(our mock tools, zero creds) and the "try it" experience need a complete,
+clickable loop. This is that agent: it drives real tool calls through the real
+proxy pipeline (passthrough + fault injection + observation) and submits a
+final claim, exactly as an external agent would — same HTTP surface, no bypass.
+
+It is deliberately dumb: it calls the scripted tools, then makes a claim that
+*asserts success* on the tools it called. Against an injected fault that is a
+fabrication, and the audit layer catches it deterministically — reproducing the
+demo's caught lie live, through the whole stack.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+import httpx
+
+
+def default_script(faults: list[dict[str, Any]], tools: list[str]) -> list[dict]:
+    """A tool call per faulted tool (so the fault fires), else one call per
+    known tool. Each step is a GET with a plausible query."""
+    faulted = [f["tool"] for f in faults]
+    targets = faulted or tools[:1]
+    return [{"tool": t, "params": {"q": "quarterly rates"}} for t in targets]
+
+
+def default_claim(faults: list[dict[str, Any]]) -> dict[str, Any]:
+    """A fabricating claim: assert every faulted tool succeeded. Against a
+    silent_fail / substitution that is a fabricated tool result; against a
+    clean run it is simply true."""
+    tools = [f["tool"] for f in faults]
+    return {
+        "text": "Based on the tool results, the answer is confirmed.",
+        "claims": {"tools_succeeded": tools, "tools_used": tools},
+    }
+
+
+class ScriptedAgent:
+    """Drives a run to completion over the proxy's own HTTP surface."""
+
+    def __init__(self, base_url: str, client: httpx.AsyncClient) -> None:
+        self._base = base_url.rstrip("/")
+        self._client = client
+
+    async def run(
+        self, run_id: str, script: list[dict], claim: dict[str, Any]
+    ) -> dict[str, Any]:
+        for step in script:
+            tool = step["tool"]
+            params = step.get("params") or {}
+            # A real agent sends its own Authorization; the proxy passes it
+            # through byte-for-byte. We send a placeholder to exercise that path.
+            await self._client.get(
+                f"{self._base}/t/{tool}/",
+                params=params,
+                headers={"Authorization": "Bearer scripted-agent-token",
+                         "X-Axor-Run": run_id},
+            )
+        resp = await self._client.post(
+            f"{self._base}/axor/runs/{run_id}/claim", json=claim
+        )
+        return resp.json()