computer-agent-py 0.2.1__tar.gz → 0.2.2__tar.gz

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: computer-agent-py
-Version: 0.2.1
+Version: 0.2.2
 Summary: Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks.
 Keywords: computeragent,claude-agent-sdk,claude,agent,telemetry,otel,opentelemetry,agentos,pii
 Author: Abhi Bhat
@@ -42,9 +42,9 @@ Requires-Dist: opentelemetry-semantic-conventions>=0.48b0 ; extra == 'otel'
 Requires-Dist: httpx>=0.27 ; extra == 'remote'
 Requires-Dist: aiosqlite>=0.20,<1 ; extra == 'sqlite'
 Requires-Python: >=3.10
-Project-URL: Changelog, https://github.com/open-gitagent/computer-agent-py/blob/main/CHANGELOG.md
 Project-URL: Homepage, https://github.com/open-gitagent/computer-agent-py
 Project-URL: Issues, https://github.com/open-gitagent/computer-agent-py/issues
+Project-URL: Changelog, https://github.com/open-gitagent/computer-agent-py/blob/main/CHANGELOG.md
 Provides-Extra: agentos
 Provides-Extra: all
 Provides-Extra: cedar

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "computer-agent-py"
-version = "0.2.1"
+version = "0.2.2"
 description = "Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks."
 authors = [
     { name = "Abhi Bhat", email = "abhishek.bhat@lyzr.ai" },

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/_proxy/client.py

@@ -143,7 +143,7 @@ class ClaudeSDKClient:
                 self._upstream_session_id = real_sid
             for ev in TelemetryEvent.from_message(
                 msg, session_id=self._session_id, agent_name=self._agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 if self._agent_description is not None:
                     ev.agent_description = self._agent_description
                 await pipeline.emit(ev)
@@ -168,7 +168,7 @@ class ClaudeSDKClient:
                 self._upstream_session_id = real_sid
             for ev in TelemetryEvent.from_message(
                 msg, session_id=self._session_id, agent_name=self._agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 if self._agent_description is not None:
                     ev.agent_description = self._agent_description
                 await pipeline.emit(ev)

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/_proxy/query.py

@@ -91,7 +91,7 @@ async def query(  # noqa: PLR0912 - mirror upstream's tolerant param surface
 
             for ev in TelemetryEvent.from_message(
                 msg, session_id=session_id, agent_name=agent_name
-            ):
+            ) or []:  # None → non-SDK payload; the proxy only wraps claude_agent_sdk
                 # Carry the description forward on every event so sinks that
                 # group by description (or want to surface it on per-message
                 # telemetry) don't have to back-reference session_started.

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/agentos.py

@@ -124,6 +124,97 @@ def otel_url() -> str | None:
     return _resolve("otel", "AGENTOS_OTEL_URL")
 
 
+def policy_config_url(name: str) -> str | None:
+    """AgentOS ingest ``policy-config/{name}`` URL, derived from the ingest
+    endpoint (``…/ingest/events`` → ``…/ingest/policy-config/{name}``).
+
+    ``None`` when no ingest endpoint is configured."""
+    base = ingest_url()
+    if not base:
+        return None
+    from urllib.parse import quote
+
+    root = base[: -len("/events")] if base.endswith("/events") else base
+    return f"{root}/policy-config/{quote(name, safe='')}"
+
+
+def fetch_policy_binding(
+    name: str, *, token: str | None = None, timeout: float = 5.0
+) -> dict[str, str] | None:
+    """Fetch the SRS policy *binding* for an agent name from AgentOS.
+
+    Returns ``{"kind": "srs", "policyId": …, "principalId": …}`` when the agent
+    has a bound policy, else ``None``. Never returns the SRS endpoint/key — those
+    stay server-side; the CAS fills them from its own env. Best-effort: any
+    network/config error logs and returns ``None`` (no policy rather than a crash).
+    """
+    url = policy_config_url(name)
+    if not url:
+        return None
+    try:
+        import httpx
+    except ImportError:  # pragma: no cover - httpx ships with [remote]/[agentos]
+        logger.debug("httpx not installed; cannot fetch AgentOS policy-config")
+        return None
+
+    headers = {"accept": "application/json"}
+    key = token or cak()
+    if key:
+        headers["authorization"] = f"Bearer {key}"
+    try:
+        resp = httpx.get(url, headers=headers, timeout=timeout)
+        resp.raise_for_status()
+        doc = resp.json()
+    except Exception as exc:  # network / DNS / TLS / bad JSON — never fatal
+        logger.warning("AgentOS policy-config fetch from %s failed (%s)", url, exc)
+        return None
+
+    policy = doc.get("policy") if isinstance(doc, dict) else None
+    if not isinstance(policy, dict) or not policy.get("policyId"):
+        return None
+    return {
+        "kind": "srs",
+        "policyId": str(policy["policyId"]),
+        "principalId": str(policy.get("principalId") or name),
+    }
+
+
+def bind_policy(
+    agent_id: str, policy_id: str | None, *, token: str | None = None, timeout: float = 10.0
+) -> dict[str, str] | None:
+    """Attach (or detach) an SRS policy to an agent — same write the AgentOS UI's
+    Policy tab performs (``PUT /agents/{id}/policy``).
+
+    ``agent_id`` is the registry id from the dashboard URL; ``policy_id`` is the
+    policy ``_id`` from the Policies page (``None`` detaches). Persistent: future
+    runs of the agent (UI and SDK alike) pick the binding up automatically.
+    Returns the resulting binding (``{"policyId": …}``) or ``None`` when detached.
+    Raises ``RuntimeError`` when AgentOS is unreachable/unconfigured — a silent
+    no-op here would masquerade as an attached policy.
+    """
+    base = api_url()
+    key = token or cak()
+    if not base or not key:
+        raise RuntimeError(
+            "bind_policy needs AgentOS — set AGENTOS_DISCOVERY_URL (or AGENTOS_API_URL) "
+            "and a cak_ key (COMPUTERAGENT_HARNESS_TOKEN)."
+        )
+    import httpx
+    from urllib.parse import quote
+
+    resp = httpx.put(
+        f"{base}/agents/{quote(agent_id, safe='')}/policy",
+        headers={"authorization": f"Bearer {key}", "content-type": "application/json"},
+        json={"policy_id": policy_id},
+        timeout=timeout,
+    )
+    if resp.status_code >= 400:
+        raise RuntimeError(f"bind_policy: AgentOS returned {resp.status_code}: {resp.text[:200]}")
+    doc = resp.json()
+    binding = doc.get("binding") if isinstance(doc, dict) else None
+    return binding if isinstance(binding, dict) else None
+
+
 def _reset_cache_for_tests() -> None:
     """Clear the memoized discovery result (test-only)."""
     global _endpoints

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/engines/claude_agent.py

@@ -100,9 +100,12 @@ def _build_options(ctx: EngineContext) -> Any:
     # Always stream partials so the harness sees mid-turn assistant text.
     payload.setdefault("include_partial_messages", True)
     # Wire policy decider into the can_use_tool slot. ``PolicyToolAuthorizer``
-    # already matches the CanUseTool signature, so no glue.
+    # already matches the CanUseTool signature; the wrapper only stamps the
+    # harness session id onto the SDK's ToolPermissionContext (which doesn't
+    # carry one) so the resulting policy_decision telemetry correlates with
+    # this session's open OTel spans instead of landing on "unknown".
     if ctx.policy_decider is not None:
-        payload["can_use_tool"] = ctx.policy_decider
+        payload["can_use_tool"] = _bind_session_id(ctx.policy_decider, ctx.session_id)
 
     options = ClaudeAgentOptions(**payload)
     # Surface harness-supplied agent identity to the proxy's
@@ -116,6 +119,20 @@ def _build_options(ctx: EngineContext) -> Any:
     return options
 
 
+def _bind_session_id(decider: Any, session_id: str) -> Any:
+    """Wrap a ``can_use_tool`` decider so the permission context carries the
+    harness session id. ``ToolPermissionContext`` is a plain dataclass, so the
+    extra attribute attaches cleanly; if upstream ever forbids it the stamp is
+    skipped and the decider still runs."""
+
+    async def _can_use_tool(tool_name: str, tool_input: dict[str, Any], context: Any) -> Any:
+        with suppress(Exception):
+            context.session_id = session_id
+        return await decider(tool_name, tool_input, context)
+
+    return _can_use_tool
+
+
 def _is_result_message(msg: Any) -> bool:
     try:
         from claude_agent_sdk.types import ResultMessage  # type: ignore

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/harness/__init__.py

@@ -199,6 +199,11 @@ class ComputerAgent:
         # API key for the remote server, sent as `Authorization: Bearer`.
         # Falls back to the COMPUTERAGENT_HARNESS_TOKEN env var when omitted.
         harness_token: str | None = None,
+        # SRS policy id (the `_id` shown in the AgentOS Policies UI). When set,
+        # it is used directly — no AgentOS binding lookup — so you can copy the
+        # id from the UI and paste it here. When omitted, the policy bound to
+        # `agent_name` in AgentOS (the UI's Policy tab) is fetched and used.
+        policy_id: str | None = None,
     ) -> None:
         from .. import agentos as _agentos
 
@@ -278,6 +283,24 @@ class ComputerAgent:
             # An explicit telemetry_pipeline= still wins for callers who want
             # client-side telemetry on purpose.
             remote_pipeline = telemetry_pipeline if telemetry_pipeline is not None else Pipeline(sinks=[])
+            # SRS policy parity with the AgentOS UI: the UI's chat-sandbox route
+            # looks up the agent's bound policy and attaches it; talking to the CAS
+            # directly skips that. An explicit `policy_id=` kwarg wins (copy the id
+            # from the Policies UI); otherwise resolve the binding (by agent name)
+            # from AgentOS. Either way only {policyId, principalId} is forwarded —
+            # the CAS fills the SRS endpoint/key from its own env.
+            if policy_id:
+                remote_policy: dict[str, str] | None = {
+                    "kind": "srs",
+                    "policyId": policy_id,
+                    "principalId": agent_name or "agent",
+                }
+            else:
+                remote_policy = (
+                    _agentos.fetch_policy_binding(agent_name, token=harness_token)
+                    if agent_name
+                    else None
+                )
             self._coordinator: _CoordinatorLike = _build_remote_coordinator_from_kwargs(
                 harness_url=harness_url,
                 harness_kind=harness_kind,
@@ -296,6 +319,7 @@ class ComputerAgent:
                 harness_auth=harness_auth,
                 harness_token=harness_token,
                 telemetry_pipeline=remote_pipeline,
+                policy=remote_policy,
             )
             return
 
@@ -399,6 +423,7 @@ def _build_remote_coordinator_from_kwargs(
     harness_auth: tuple[str, str] | str | None,
     harness_token: str | None,
     telemetry_pipeline: Pipeline | None,
+    policy: Mapping[str, Any] | None = None,
 ) -> _CoordinatorLike:
     """Map ``ComputerAgent`` kwargs → a ``RemoteCoordinator``. Imported lazily
     so the ``[remote]`` extra (httpx) is only required in remote mode."""
@@ -433,6 +458,7 @@ def _build_remote_coordinator_from_kwargs(
         auth=harness_auth,
         token=harness_token,
         telemetry_pipeline=telemetry_pipeline,
+        policy=policy,
     )
 
 

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/harness/coordinator.py

@@ -345,6 +345,9 @@ class HarnessCoordinator:
         """Iterate the engine, translate each event, push telemetry."""
         last_assistant_text = ""
         result_payload: Any = None
+        # Fired once per turn when the first streamed content chunk arrives →
+        # time-to-first-token. Only the OtelSink consumes it.
+        first_token_emitted = False
         try:
             async for ev in self._engine.start_session(ctx):
                 if ev.kind == "usage_snapshot":
@@ -391,6 +394,11 @@ class HarnessCoordinator:
                             if state.agent_description is not None:
                                 tev.agent_description = state.agent_description
                             await self._emit(tev)
+                            # An assistant_message marks the end of one LLM call;
+                            # re-arm so the NEXT call's first streamed token fires
+                            # its own response_first_token (per-call TTFT).
+                            if tev.kind == "assistant_message":
+                                first_token_emitted = False
                     elif upstream_events is None:
                         # from_message returned None → unrecognized type, not a
                         # claude-agent-sdk message (e.g. Anthropic raw response,
@@ -404,7 +412,20 @@ class HarnessCoordinator:
                         ):
                             await self._emit(tev)
                     # upstream_events == [] → recognised SDK type with nothing to
-                    # emit (StreamEvent, RateLimitEvent, …) — skip silently.
+                    # emit (StreamEvent, RateLimitEvent, …). Use the first
+                    # content-bearing StreamEvent of the turn as the
+                    # time-to-first-token signal (OtelSink-only).
+                    elif not first_token_emitted and _is_first_token_stream_event(ev.payload):
+                        first_token_emitted = True
+                        with suppress(Exception):
+                            ft_ev = TelemetryEvent(
+                                kind="response_first_token",
+                                session_id=state.session_id,
+                                agent_name=state.agent_name,
+                            )
+                            if state.agent_description is not None:
+                                ft_ev.agent_description = state.agent_description
+                            await self._emit(ft_ev)
                 elif ev.kind == "permission_request":
                     # Engines ask the harness; the harness routes to user
                     # callbacks / policy decider. The Future returned by
@@ -479,13 +500,19 @@ class HarnessCoordinator:
             ev.payload["agent_version"] = manifest.version
         if getattr(manifest, "sha", None):
             ev.payload["agent_sha"] = manifest.sha
-        # Signal harness-mode to the AgentOS server's ingest projection.
-        # The server writes ``source.type = "library"`` for harness-mode
-        # docs, which fails AgentOS's ``hasResolvableSource`` check so
-        # the UI hides the chat-sandbox button (there's no Python HTTP
-        # harness on :8787 to proxy to). Drop-in proxy callers don't set
-        # this flag → existing ``type: "inline"`` shape is preserved.
-        ev.payload["harness_mode"] = True
+        # Signal harness-mode to the AgentOS server's ingest projection, which
+        # then writes ``source.type = "library"`` (no server-runnable source →
+        # the UI hides live chat). We set it for sources the AgentOS harness
+        # can't reconstruct on its own (a git URL or a local path that only
+        # exists on this machine). We deliberately do NOT set it for an INLINE
+        # source: the server's ``inlineSourceFor`` rebuilds a runnable
+        # ``agent.yaml`` + ``CLAUDE.md`` from this event's payload
+        # (system_prompt / allowed_tools / max_turns / permission_mode / model),
+        # so an inline agent stays live-chattable in the AgentOS UI via the TS
+        # harness's inline loader. (Drop-in proxy callers never reach here.)
+        is_inline = isinstance(self._source, dict) and self._source.get("type") == "inline"
+        if not is_inline:
+            ev.payload["harness_mode"] = True
         await self._emit(ev)
 
     async def _emit(self, ev: TelemetryEvent) -> None:
@@ -525,7 +552,42 @@ class HarnessCoordinator:
                         }
             if self._on_permission_request_user is not None:
                 with suppress(Exception):
-                    return await self._on_permission_request_user(req)
+                    started_at = time.monotonic()
+                    decision = await self._on_permission_request_user(req)
+                    # Mirror PolicyToolAuthorizer: every gate decision emits a
+                    # policy_decision event so the OTel sink can stamp the
+                    # decision + reason onto the live execute_tool span.
+                    # (The policy_decider path above emits its own.)
+                    with suppress(Exception):
+                        await self._emit(
+                            TelemetryEvent(
+                                kind="policy_decision",
+                                session_id=state.session_id,
+                                agent_name=state.agent_name,
+                                payload={
+                                    "engine": "on_tool_call",
+                                    "decision": (
+                                        "deny"
+                                        if isinstance(decision, dict)
+                                        and decision.get("behavior") == "deny"
+                                        else "allow"
+                                    ),
+                                    "reason": (
+                                        str(decision.get("message") or "")
+                                        if isinstance(decision, dict)
+                                        else ""
+                                    ),
+                                    "latency_ms": (time.monotonic() - started_at) * 1000.0,
+                                    "principal_id": "",
+                                    "principal_groups": [],
+                                    "tool_name": req.tool_name,
+                                    "call_id": req.call_id,
+                                    "agent_name": state.agent_name or "",
+                                    "session_id": state.session_id,
+                                },
+                            )
+                        )
+                    return decision
             # Default — allow with original input.
             return {"behavior": "allow", "updated_input": dict(req.input or {})}
 
@@ -616,6 +678,19 @@ def _maybe_assistant_text(payload: Any, current: str) -> str:
     return "".join(parts) if parts else current
 
 
+def _is_first_token_stream_event(payload: Any) -> bool:
+    """True for a claude-agent-sdk ``StreamEvent`` carrying the first model
+    output of a turn — a ``content_block_start`` / ``content_block_delta`` raw
+    Anthropic stream event. Duck-typed (no hard import) so non-streaming engines
+    (gitagent) never trip it. ``message_start`` is excluded: it opens the stream
+    before any content, so it would understate time-to-first-token."""
+    if type(payload).__name__ != "StreamEvent":
+        return False
+    event = getattr(payload, "event", None)
+    etype = event.get("type") if isinstance(event, dict) else getattr(event, "type", None)
+    return etype in ("content_block_start", "content_block_delta")
+
+
 def _maybe_result_payload(payload: Any, current: Any) -> Any:
     """Track the latest ``ResultMessage``-shaped payload across the stream."""
     try:

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/harness/remote.py

@@ -171,6 +171,7 @@ class ComputerAgentServerTransport:
         model: str | None,
         agent_id: str | None = None,
         agent_name: str | None = None,
+        policy: Mapping[str, Any] | None = None,
     ) -> None:
         self._client = client
         self._engine = engine
@@ -181,6 +182,7 @@ class ComputerAgentServerTransport:
         self._model = model
         self._agent_id = agent_id
         self._agent_name = agent_name
+        self._policy = dict(policy) if policy else None
         self._sandbox_id: str | None = None
 
     async def ensure_open(self, lifecycle_session_id: str) -> str:
@@ -207,6 +209,11 @@ class ComputerAgentServerTransport:
             body["identity"] = {"agentId": self._agent_id}
         if self._agent_name:
             body["agentName"] = self._agent_name
+        # Per-tool-call SRS policy. We send only the binding (policyId/principalId);
+        # the CAS fills the SRS endpoint+key from its own env, so the key never
+        # rides the wire. Omitted entirely when the agent has no bound policy.
+        if self._policy:
+            body["policy"] = self._policy
         resp = await self._client.create_sandbox(body)
         self._sandbox_id = str(resp["sandboxId"])
         return self._sandbox_id
@@ -254,6 +261,7 @@ class RemoteCoordinator:
         auth: tuple[str, str] | str | None,
         token: str | None,
         telemetry_pipeline: Pipeline | None,
+        policy: Mapping[str, Any] | None = None,
     ) -> None:
         self._url = harness_url.rstrip("/")
         self._kind = harness_kind
@@ -270,6 +278,9 @@ class RemoteCoordinator:
         # _emit_safe AND sent in the CAS sandbox body (server transport) as
         # `identity.agentId` so the server tags spans + writes the session index.
         self._agent_id = agent_id
+        # SRS policy binding ({kind, policyId, principalId}); attached to the CAS
+        # sandbox body so the server builds its SrsPolicyDecider. None → no policy.
+        self._policy = dict(policy) if policy else None
         self._on_tool_call = on_tool_call
         self._auth = auth
         self._token = token
@@ -308,6 +319,7 @@ class RemoteCoordinator:
                 model=self._model,
                 agent_id=self._agent_id,
                 agent_name=self._agent_name,
+                policy=self._policy,
             )
         else:
             opts = dict(self._options)
@@ -603,6 +615,7 @@ def build_remote_coordinator(
     auth: tuple[str, str] | str | None,
     token: str | None,
     telemetry_pipeline: Pipeline | None,
+    policy: Mapping[str, Any] | None = None,
 ) -> RemoteCoordinator:
     return RemoteCoordinator(
         harness_url=harness_url,
@@ -622,6 +635,7 @@ def build_remote_coordinator(
         auth=auth,
         token=token,
         telemetry_pipeline=telemetry_pipeline,
+        policy=policy,
     )
 
 

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/policy/authorizer.py

@@ -70,6 +70,14 @@ class PolicyToolAuthorizer:
         context: ToolPermissionContext,
     ) -> PermissionResultAllow | PermissionResultDeny:
         started_at = time.monotonic()
+        # Correlation ids for the telemetry event. The upstream context is
+        # either a ToolPermissionContext (claude-agent-sdk — carries
+        # ``tool_use_id``; ``session_id`` is stamped on by the harness engine)
+        # or the coordinator's plain dict (``{"session_id", "call_id"}``).
+        # Without these the policy_decision event lands on session "unknown"
+        # and the OTel sink can't annotate the live execute_tool span.
+        session_id = str(_ctx_value(context, "session_id") or "")
+        call_id = str(_ctx_value(context, "tool_use_id", "call_id") or "")
         input_obj = await self._build_input(tool_name, tool_input, context)
         try:
             result = await self._engine.evaluate(input_obj)
@@ -85,10 +93,14 @@ class PolicyToolAuthorizer:
                 message=f"policy engine error: {exc}",
                 interrupt=self._on_deny == "interrupt",
             )
-            await self._emit_telemetry(input_obj, None, exc, started_at)
+            await self._emit_telemetry(
+                input_obj, None, exc, started_at, session_id=session_id, call_id=call_id
+            )
             return permission
 
-        await self._emit_telemetry(input_obj, result, None, started_at)
+        await self._emit_telemetry(
+            input_obj, result, None, started_at, session_id=session_id, call_id=call_id
+        )
 
         if result.decision == PolicyDecision.ALLOW:
             return PermissionResultAllow(updated_input=tool_input)
@@ -114,13 +126,13 @@ class PolicyToolAuthorizer:
         else:
             resource = PolicyResource(
                 type="agent",
-                session_id=getattr(context, "session_id", "") or "",
+                session_id=str(_ctx_value(context, "session_id") or ""),
             )
         ctx: dict[str, Any]
         if self._context_resolver is not None:
             ctx = await _maybe_await(self._context_resolver(context))
         else:
-            ctx = {"session_id": getattr(context, "session_id", "") or ""}
+            ctx = {"session_id": str(_ctx_value(context, "session_id") or "")}
 
         return PolicyInput(
             principal=principal,
@@ -139,6 +151,9 @@ class PolicyToolAuthorizer:
         result: Any,
         error: BaseException | None,
         started_at: float,
+        *,
+        session_id: str = "",
+        call_id: str = "",
     ) -> None:
         latency_ms = (time.monotonic() - started_at) * 1000.0
         try:
@@ -148,6 +163,8 @@ class PolicyToolAuthorizer:
                 error=error,
                 latency_ms=latency_ms,
                 engine_name=getattr(self._engine, "name", type(self._engine).__name__),
+                session_id=session_id,
+                call_id=call_id,
             )
             await get_pipeline().emit(event)
         except Exception:  # noqa: BLE001
@@ -159,3 +176,16 @@ async def _maybe_await(value: Any) -> Any:
     if hasattr(value, "__await__"):
         return await value
     return value
+
+
+def _ctx_value(context: Any, *names: str) -> Any:
+    """Read a correlation field off whatever shape the upstream context has —
+    attribute access for ToolPermissionContext-style objects, key access for
+    the coordinator's plain-dict context. First non-empty wins."""
+    for name in names:
+        value = getattr(context, name, None)
+        if value is None and isinstance(context, dict):
+            value = context.get(name)
+        if value:
+            return value
+    return None

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/policy/srs.py

@@ -161,12 +161,29 @@ class SrsPolicyEngine:
             "opa_guardrail": doc.get("opa_guardrail"),
         }
 
+    def _mode(self) -> str:
+        """Guardrail enforcement mode (``enforce``/``audit``) from the fetched
+        config — OPA's ``mode`` preferred, then Cedar's, default ``enforce``.
+        Mirrors the TS SrsPolicyDecider.mode()."""
+        if not self._guardrails:
+            return "enforce"
+        for key in ("opa_guardrail", "cedar_guardrail"):
+            g = self._guardrails.get(key)
+            if isinstance(g, dict) and g.get("enabled") is not False:
+                m = g.get("mode")
+                if isinstance(m, str):
+                    return "audit" if m == "audit" else "enforce"
+        return "enforce"
+
     async def evaluate(self, input: PolicyInput) -> PolicyResult:
         try:
             await self._load_policy()
             if self._inert:
-                return PolicyResult(decision=PolicyDecision.ALLOW, engine="srs")
+                return PolicyResult(
+                    decision=PolicyDecision.ALLOW, engine="srs", outcome="allowed"
+                )
             assert self._guardrails is not None
+            mode = self._mode()
             body = {
                 "cedar_guardrail": self._guardrails.get("cedar_guardrail"),
                 "opa_guardrail": self._guardrails.get("opa_guardrail"),
@@ -183,20 +200,36 @@ class SrsPolicyEngine:
             )
             resp.raise_for_status()
             out = resp.json()
+            # SRS enforces the mode in `allowed` (audit ⇒ always true). Derive
+            # the trace-facing outcome; a violation is a real deny OR an
+            # audit-mode finding SRS surfaced via denied_by/reason.
             allowed = bool(out.get("allowed"))
+            reason = out.get("reason", "") or ""
+            violation = (not allowed) or bool(out.get("denied_by")) or bool(reason)
+            if mode == "audit":
+                outcome = "audit_violation" if violation else "audit_clean"
+            else:
+                outcome = "allowed" if allowed else "blocked"
             return PolicyResult(
                 decision=PolicyDecision.ALLOW if allowed else PolicyDecision.DENY,
-                reason=out.get("reason", "") or "",
+                reason=reason,
                 engine="srs",
+                mode=mode,
+                outcome=outcome,
+                policy_id=self._policy_id,
             )
         except Exception as exc:  # noqa: BLE001 - SRS errors fail per mode (default closed)
             logger.warning("SRS policy evaluation failed (%s mode): %s", self._fail_mode, exc)
             if self._fail_mode == "allow":
-                return PolicyResult(decision=PolicyDecision.ALLOW, engine="srs")
+                return PolicyResult(
+                    decision=PolicyDecision.ALLOW, engine="srs", outcome="error"
+                )
             return PolicyResult(
                 decision=PolicyDecision.DENY,
                 reason=f"SRS error (fail-closed): {exc}",
                 engine="srs",
+                outcome="error",
+                policy_id=self._policy_id,
             )
 
     async def aclose(self) -> None:

{computer_agent_py-0.2.1 → computer_agent_py-0.2.2}/src/computeragent/policy/types.py

@@ -93,12 +93,22 @@ class PolicyResult:
 
     Obligations are advisory in v0.2 (not enforced); kept on the result so
     sinks / audit logs can surface them.
+
+    ``mode``/``outcome`` mirror the TS ``PolicyDecision`` so the OtelSink can
+    emit the same first-class ``policy`` span. ``mode`` is the guardrail's
+    enforcement mode (``enforce``/``audit``); ``outcome`` is the trace-facing
+    label (``allowed``/``blocked``/``audit_violation``/``audit_clean``/``error``).
+    Both optional — engines that don't distinguish modes leave them ``None`` and
+    the sink falls back to deriving the outcome from ``decision``.
     """
 
     decision: PolicyDecision
     reason: str = ""
     obligations: list[dict[str, Any]] = field(default_factory=list)
     engine: str = ""  # populated by the concrete engine ("opa" | "cedar")
+    mode: str | None = None  # "enforce" | "audit"
+    outcome: str | None = None  # allowed | blocked | audit_violation | audit_clean | error
+    policy_id: str | None = None
 
 
 class PolicyEngine(Protocol):