fred-runtime 3.3.7__tar.gz → 3.4.0__tar.gz

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.3.7
+Version: 3.4.0
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/app/agent_app.py

@@ -58,6 +58,7 @@ from fastapi.responses import StreamingResponse
 from fred_core.common.config_loader import get_config
 from fred_core.history.history_schema import ChatMessage
 from fred_core.kpi import KPIMiddleware
+from fred_core.kpi.kpi_runtime_stage_metric import runtime_stage_timer
 from fred_core.kpi.kpi_writer_structures import KPIActor
 from fred_core.logs.audit_log import emit_audit_log
 from fred_core.logs.log_setup import log_setup
@@ -88,6 +89,7 @@ from fred_sdk.contracts.context import (
     PortableContext,
     PortableEnvironment,
     RuntimeContext,
+    TeamOperationRouteRule,
 )
 from fred_sdk.contracts.eval import EvalStep, EvalTrace
 from fred_sdk.contracts.execution import (
@@ -967,6 +969,66 @@ class _McpCatalogResponse(BaseModel):
     servers: list[_McpCatalogEntry]
 
 
+class _ModelCatalogEntry(BaseModel):
+    id: str
+    provider: str
+    name: str
+    description: str | None = None
+    profile_ids: list[str] = Field(default_factory=list)
+    """Every `models_catalog.yaml` profile_id sharing this entry's
+    (provider, name) — TEAM-ROUTING-POLICY-RFC.md §7.1's id-space
+    translation: a routing policy picks by profile_id (finer-grained than
+    this capability id), so control-plane needs a way back from profile_id
+    to capability id for write-time enablement validation, and the
+    team-settings picker needs the reverse (which profile_ids this enabled
+    capability actually offers). Declaration order in the source YAML,
+    first-seen first — same order `default_profile_by_capability` favors."""
+
+
+class _ModelCatalogResponse(BaseModel):
+    models: list[_ModelCatalogEntry]
+
+
+def _project_model_catalog_entries(catalog: Any) -> list[_ModelCatalogEntry]:
+    """One `_ModelCatalogEntry` per distinct (provider, name) pair in a
+    loaded `ModelCatalog` (OBSERV-02 v3, `AGENT-CAPABILITY-RFC.md` §8.7).
+
+    Pulled out of `get_models_catalog` as a pure function so it is directly
+    unit-testable without a running app (`agent_app.py` has no existing
+    FastAPI TestClient harness — building one just for this route would be
+    disproportionate; this function is where the actual logic worth testing
+    lives). `catalog` is typed `Any` here to avoid a module-level
+    `..model_routing` import (see the route's own lazy import for why);
+    callers pass a real `ModelCatalog`.
+    """
+    from fred_sdk.contracts.capability.manifest import model_capability_id
+
+    seen: dict[tuple[str, str], _ModelCatalogEntry] = {}
+    for profile in catalog.profiles:
+        provider = profile.model.provider
+        name = profile.model.name
+        # ModelProfile.validate_model (contracts.py) already guarantees both
+        # are non-empty strings for every profile that exists — asserted
+        # (not a skip/continue) so this narrows the type instead of hiding
+        # an invariant violation the validator itself is supposed to prevent.
+        assert provider and name, (
+            f"ModelProfile {profile.profile_id!r} passed validation without provider/name"
+        )
+        key = (provider, name)
+        existing = seen.get(key)
+        if existing is None:
+            seen[key] = _ModelCatalogEntry(
+                id=model_capability_id(provider, name),
+                provider=provider,
+                name=name,
+                description=profile.description,
+                profile_ids=[profile.profile_id],
+            )
+        else:
+            existing.profile_ids.append(profile.profile_id)
+    return list(seen.values())
+
+
 class _ResolvedAgentInstance(BaseModel):
     agent_instance_id: str
     template_agent_id: str
@@ -1120,7 +1182,9 @@ async def _resolve_agent_instance(
     registry: Mapping[str, ReActAgentDefinition | GraphAgentDefinition],
     access_token: str | None,
     control_plane_url: str | None,
+    http_client: httpx.AsyncClient,
     team_id: str | None = None,
+    request_id: str | None = None,
 ) -> _ResolvedExecutionTarget:
     """
     Resolve a direct or managed execution target into a concrete definition.
@@ -1195,9 +1259,17 @@ async def _resolve_agent_instance(
         f"{control_plane_url.rstrip('/')}/teams/{team_id}/agent-instances/"
         f"{request.agent_instance_id}/runtime"
     )
-    headers = {"Authorization": f"Bearer {access_token}"} if access_token else None
-    async with httpx.AsyncClient(timeout=10.0) as client:
-        response = await client.get(url, headers=headers)
+    headers: dict[str, str] = {}
+    if access_token:
+        headers["Authorization"] = f"Bearer {access_token}"
+    if request_id:
+        # Correlates this pod-side call with the control-plane request it
+        # triggers — both sides stamp the same id as `trace.trace_id` on their
+        # `runtime.stage_latency_ms{runtime_stage=runtime_binding*}` event
+        # (TURN-01 evidence gap: no way to join a turn to its binding call
+        # besides timestamps).
+        headers["X-Request-Id"] = request_id
+    response = await http_client.get(url, headers=headers or None)
     if response.status_code == status.HTTP_404_NOT_FOUND:
         raise HTTPException(
             status_code=404, detail=response.text or "Unknown agent instance."
@@ -1507,7 +1579,8 @@ async def _authorize_and_resolve(
         )
     await _validate_session_checkpoint_access(request)
     await _enforce_session_ownership(request, authenticated_user, container)
-    await _authorize_execution_or_raise(request, authenticated_user, container)
+    async with runtime_stage_timer(container.get_kpi_writer(), "pod_authz"):
+        await _authorize_execution_or_raise(request, authenticated_user, container)
     internal_req = _to_internal_request(request)
     # Stamp the trusted service-agent verdict (never the caller-supplied
     # context) so per-tool-call re-authorization can mirror the bypass
@@ -1521,13 +1594,19 @@ async def _authorize_and_resolve(
     else:
         ctx.pop("is_service_agent", None)
     internal_req.context = ctx
-    target = await _resolve_agent_instance(
-        request=internal_req,
-        registry=registry,
-        access_token=access_token,
-        control_plane_url=get_runtime_context().config.control_plane_url,
-        team_id=request.effective_team_id(),
-    )
+    binding_request_id = str(uuid4())
+    async with runtime_stage_timer(
+        container.get_kpi_writer(), "runtime_binding", trace_id=binding_request_id
+    ):
+        target = await _resolve_agent_instance(
+            request=internal_req,
+            registry=registry,
+            access_token=access_token,
+            control_plane_url=get_runtime_context().config.control_plane_url,
+            http_client=container.get_control_plane_http_client(),
+            team_id=request.effective_team_id(),
+            request_id=binding_request_id,
+        )
     _validate_resolved_team(request, target.team_id, container)
     return internal_req, target
 
@@ -2401,8 +2480,8 @@ def _build_capability_block(
         # one. No production capability declares an active `HitlSpec` today,
         # so refusing here costs nothing real yet; reconciling Graph's own
         # node-level pause/resume with the per-tool HITL gate is real design
-        # work, deferred (id-legend.yaml CAPAB-02). Refusing loudly keeps the
-        # RFC §3.9 "never silently degrade" guarantee intact in the meantime
+        # work, deferred (see AGENT-CAPABILITY-RFC.md §3.9). Refusing loudly
+        # keeps the RFC's "never silently degrade" guarantee intact in the meantime
         # — a capability with `HitlSpec`s that silently ran ungated on Graph
         # would be exactly the kind of governance gap this platform exists to
         # prevent.
@@ -2472,6 +2551,19 @@ async def _iterate_runtime_event_payloads(
     ctx = request.context or {}
     correlation_id = ctx.get("correlation_id", request_id)
     resolved_team_id = team_id or ctx.get("team_id")
+    # kind="model" enforcement (OBSERV-02 v3, AGENT-CAPABILITY-RFC.md §8.7):
+    # computed ONCE per turn, here — never inside model-routing resolution,
+    # which runs multiple times per turn and must never itself make a ReBAC
+    # call. No team context (agent-to-agent invocation) → no restriction,
+    # the same posture _authorize_execution_or_raise already applies to a
+    # teamless request.
+    usable_model_ids: tuple[str, ...] | None = None
+    if resolved_team_id is not None:
+        from ..model_routing import usable_model_capability_ids
+
+        rebac = get_runtime_context().config.rebac_engine
+        ids = await usable_model_capability_ids(rebac, resolved_team_id)
+        usable_model_ids = tuple(ids) if ids is not None else None
     execution_action = ctx.get("execution_action") or (
         ExecutionGrantAction.RESUME.value
         if request.resume_payload is not None
@@ -2540,11 +2632,26 @@ async def _iterate_runtime_event_payloads(
         # When the final file is deleted this is absent, so the per-turn runtime
         # notice disappears without leaving a checkpointed system message behind.
         attachments_markdown=ctx.get("attachments_markdown"),
+        # Team routing policy snapshot (TEAM-ROUTING-POLICY-RFC.md §3/§8):
+        # control-plane resolves it once at prepare-execution and the frontend
+        # forwards it unchanged, same channel as context_prompt_text above — but
+        # it was also silently dropped here, so resolve_team_override in
+        # fred_runtime.model_routing.provider always saw None and no team's
+        # routing policy ever took effect on a real chat turn. ctx already holds
+        # the flat dict from to_legacy_context()'s model_dump(exclude_none=True);
+        # operation_route_rules needs re-validating back into typed rows.
+        chat_default_profile_id=ctx.get("chat_default_profile_id"),
+        operation_route_rules=[
+            TeamOperationRouteRule.model_validate(rule)
+            for rule in (ctx.get("operation_route_rules") or [])
+        ]
+        or None,
     )
 
     binding = BoundRuntimeContext(
         runtime_context=runtime_context,
         portable_context=portable_context,
+        usable_model_ids=usable_model_ids,
     )
 
     services = _build_runtime_services(
@@ -2944,6 +3051,42 @@ def _build_agent_router(
             ]
         )
 
+    @router.get("/models-catalog")
+    async def get_models_catalog() -> _ModelCatalogResponse:
+        """
+        Return this pod's routable models, one entry per distinct
+        (provider, name) pair (OBSERV-02 v3, `AGENT-CAPABILITY-RFC.md` §8.7).
+
+        Why this endpoint exists:
+        - control-plane's capability catalog aggregation
+          (`aggregate_capability_catalog`) has no other way to learn what
+          models this pod can route to — `models_catalog.yaml` is loaded
+          only here, for routing, with no prior control-plane consumer.
+        - one entry per (provider, name), not per catalog profile: a model
+          used for both the `chat` and `language` routing capability is one
+          admin enablement decision, not two.
+
+        Re-reads `models_catalog.yaml` fresh on every call (same file
+        `_build_chat_model_factory` loaded once at boot) rather than
+        caching the parsed catalog — this route is polled rarely (admin
+        catalog refresh), never per-turn, so the extra local file read is
+        immaterial and keeps this always consistent with whatever the pod
+        would actually resolve, with no separate cache to go stale.
+
+        How to use it:
+        - call from control-plane's `_model_capabilities_for_source`
+
+        Example:
+        - `GET /fred/agents/v2/agents/models-catalog`
+        """
+        from ..model_routing import load_model_catalog
+
+        catalog_path = get_runtime_context().config.models_catalog_path
+        if not catalog_path:
+            return _ModelCatalogResponse(models=[])
+        catalog = load_model_catalog(catalog_path)
+        return _ModelCatalogResponse(models=_project_model_catalog_entries(catalog))
+
     @router.post("/capabilities/{capability_id}/validate-config")
     async def validate_capability_config(
         capability_id: str,
@@ -3885,12 +4028,13 @@ def create_agent_app(
         # Boot order (must be preserved — each step depends on the previous):
         # 1. log_setup         — formatter/handlers ready for all subsequent logs
         # 2. initialize_kpi_writer — needed by bootstrap_observability
-        # 3. bootstrap_observability — global tracer + metrics provider
-        # 4. attach_pod_container — container in app.state before any request
-        # 5. initialize_sql    — async, may take time
-        # 6. start_metrics_exporter — prometheus thread, after KPI writer exists
-        # 7. start_kpi_tasks   — asyncio tasks, after SQL engine is known
-        # 8. set_runtime_context — wires all built parts into the global config
+        # 3. initialize_control_plane_client — sync, no network until first call
+        # 4. bootstrap_observability — global tracer + metrics provider
+        # 5. attach_pod_container — container in app.state before any request
+        # 6. initialize_sql    — async, may take time
+        # 7. start_metrics_exporter — prometheus thread, after KPI writer exists
+        # 8. start_kpi_tasks   — asyncio tasks, after SQL engine is known
+        # 9. set_runtime_context — wires all built parts into the global config
         log_setup(
             service_name=config.app.name,
             log_level=config.app.log_level,
@@ -3901,6 +4045,7 @@ def create_agent_app(
         )
         container = build_pod_container(config)
         container.initialize_kpi_writer()
+        container.initialize_control_plane_client()
         bootstrap_observability(
             config.observability, kpi_writer=container.get_kpi_writer()
         )
@@ -3918,7 +4063,11 @@ def create_agent_app(
         # every execution against OpenFGA; a disabled/Noop engine (dev) means
         # identity-only. Safe in all modes — the factory returns a Noop with a
         # KeycloackDisabled admin client when user/m2m auth is off.
-        rebac_engine = rebac_factory(security) if security is not None else None
+        rebac_engine = (
+            rebac_factory(security, kpi_writer=container.get_kpi_writer())
+            if security is not None
+            else None
+        )
         chat_factory = _build_chat_model_factory(config)
         await container.initialize_sql()
         container.start_metrics_exporter()
@@ -3939,6 +4088,7 @@ def create_agent_app(
                     checkpointer=checkpointer,
                     history_store=history_store,
                     mcp_configuration=config.get_mcp_configuration(),
+                    models_catalog_path=config.get_models_catalog_path(),
                     inprocess_toolkit_factory=build_inprocess_toolkit,
                     control_plane_url=config.platform.control_plane_url,
                     rebac_engine=rebac_engine,

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/app/context.py

@@ -23,6 +23,7 @@ from collections import deque
 from datetime import datetime, timezone
 from typing import TYPE_CHECKING, TypedDict
 
+import httpx
 from fred_core.kpi.base_kpi_writer import BaseKPIWriter
 from fred_core.kpi.kpi_factory import build_kpi_writer
 from fred_core.kpi.kpi_process import emit_process_kpis, emit_sql_pool_kpis
@@ -38,6 +39,14 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+# Dedicated to control-plane runtime-binding calls only (TURN-01) — a
+# per-turn resolution, not the LLM/KF traffic shape, hence deliberately
+# smaller pool bounds than fred_core.model.http_clients.
+_CONTROL_PLANE_CLIENT_TIMEOUT = httpx.Timeout(10.0)
+_CONTROL_PLANE_CLIENT_LIMITS = httpx.Limits(
+    max_connections=50, max_keepalive_connections=20, keepalive_expiry=10.0
+)
+
 
 # ---------------------------------------------------------------------------
 # TypedDicts for ring buffer entries
@@ -89,10 +98,11 @@ class PodApplicationContext:
     Call the initialize_* methods inside the FastAPI lifespan after log setup.
 
     Boot order (enforced by lifespan):
-    1. initialize_kpi_writer()   — sync, fast; needed by bootstrap_observability
-    2. initialize_sql()          — async; may take time on first start
-    3. start_metrics_exporter()  — sync; starts prometheus thread if configured
-    4. start_kpi_tasks()         — async; starts background asyncio tasks
+    1. initialize_kpi_writer()          — sync, fast; needed by bootstrap_observability
+    2. initialize_control_plane_client() — sync, fast; no network until first call
+    3. initialize_sql()                 — async; may take time on first start
+    4. start_metrics_exporter()         — sync; starts prometheus thread if configured
+    5. start_kpi_tasks()                — async; starts background asyncio tasks
     """
 
     def __init__(self, configuration: AgentPodConfig) -> None:
@@ -101,6 +111,7 @@ class PodApplicationContext:
         self._checkpointer: object | None = None
         self._history_store: HistoryStorePort | None = None
         self._kpi_writer: BaseKPIWriter | None = None
+        self._control_plane_http_client: httpx.AsyncClient | None = None
         self._metrics_exporter: tuple[object, ...] | None = None
         self._kpi_tasks: list[asyncio.Task[None]] = []
         self._kpi_turns_lock = threading.Lock()
@@ -122,6 +133,13 @@ class PodApplicationContext:
             log_level=config.app.log_level,
         )
 
+    def initialize_control_plane_client(self) -> None:
+        """Build the pod-wide async HTTP client for control-plane runtime-binding calls."""
+        self._control_plane_http_client = httpx.AsyncClient(
+            timeout=_CONTROL_PLANE_CLIENT_TIMEOUT,
+            limits=_CONTROL_PLANE_CLIENT_LIMITS,
+        )
+
     async def initialize_sql(self) -> None:
         """Build SQL engine, checkpointer, and history store (SQL-backed only)."""
         from fred_core.history.postgres_history_store import PostgresHistoryStore
@@ -135,8 +153,8 @@ class PodApplicationContext:
                 self.configuration.storage.postgres
             )
             init_user_store(engine)
-            checkpointer = FredSqlCheckpointer(engine)
-            history_store = PostgresHistoryStore(engine)
+            checkpointer = FredSqlCheckpointer(engine, kpi=self.get_kpi_writer())
+            history_store = PostgresHistoryStore(engine, kpi=self.get_kpi_writer())
             self._sql_engine = engine
             self._checkpointer = checkpointer
             self._history_store = history_store
@@ -199,6 +217,14 @@ class PodApplicationContext:
     def get_history_store(self) -> HistoryStorePort | None:
         return self._history_store
 
+    def get_control_plane_http_client(self) -> httpx.AsyncClient:
+        if self._control_plane_http_client is None:
+            raise RuntimeError(
+                "Control-plane HTTP client not initialized — "
+                "call initialize_control_plane_client() first"
+            )
+        return self._control_plane_http_client
+
     def get_kpi_writer(self) -> BaseKPIWriter:
         if self._kpi_writer is None:
             raise RuntimeError(
@@ -220,6 +246,8 @@ class PodApplicationContext:
         if self._sql_engine is not None:
             await self._sql_engine.dispose()
             logger.info("[fred-runtime] SQL engine disposed")
+        if self._control_plane_http_client is not None:
+            await self._control_plane_http_client.aclose()
         self._stop_metrics_exporter()
 
     def _stop_metrics_exporter(self) -> None:

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/app/openai_compat_router.py

@@ -67,6 +67,7 @@ from .agent_app import (
     _iterate_runtime_event_payloads,
     _resolve_agent_instance,
 )
+from .dependencies import get_pod_container_from_app
 
 logger = logging.getLogger(__name__)
 
@@ -228,6 +229,9 @@ def create_openai_compat_router(
             registry=registry,
             access_token=access_token,
             control_plane_url=get_runtime_context().config.control_plane_url,
+            http_client=get_pod_container_from_app(
+                http_request.app
+            ).get_control_plane_http_client(),
         )
 
         completion_id = f"chatcmpl-{uuid4().hex}"

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/capabilities/assembly.py

@@ -382,7 +382,21 @@ def build_capability_agent_block(
 
         for candidate in capability_tools:
             owner = tool_owner.get(candidate.name)
-            if owner is not None and owner != cap_id:
+            if owner is not None:
+                # PR #2067 review: this used to only check `owner != cap_id`
+                # (cross-capability), so a SINGLE capability's own tools()
+                # returning two tools with the same .name silently kept
+                # whichever came last in tools_by_name — and a `HitlSpec`
+                # naming that tool would then bind to whichever object won,
+                # not necessarily the one the author meant to gate. "Tools
+                # must be uniquely named" now means that literally, same
+                # capability or not.
+                if owner == cap_id:
+                    raise CapabilityAssemblyError(
+                        f"Tool '{candidate.name}' is returned twice by its own "
+                        f"capability's tools() ('{cap_id}'). Capability tools "
+                        "must be uniquely named."
+                    )
                 raise CapabilityAssemblyError(
                     f"Tool '{candidate.name}' is exposed by two capabilities "
                     f"('{owner}' and '{cap_id}'). Capability tools must be "

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/capabilities/errors.py

@@ -58,13 +58,17 @@ class DefaultOnRequiredSettingsError(CapabilityRegistrationError):
 
 class InvalidExecutionModelError(CapabilityRegistrationError):
     """
-    A capability overrides `middleware()` without implementing `tools()`, and
-    its manifest never explicitly set `execution_models` (CAPAB-02, RFC §3.2,
-    §3.9). Left at the class default (`("react", "graph")`), such a
+    A capability overrides `middleware()` without implementing `tools()` —
+    it has zero Graph-visible runtime contribution — yet its manifest's
+    `execution_models` contains `"graph"` (CAPAB-02, RFC §3.2, §3.9). This
+    fires in BOTH shapes of the mistake, not just one: the field was never
+    explicitly set and kept the class default (`("react", "graph")`), OR it
+    was explicitly written out that way on purpose. Either way, such a
     capability would silently contribute zero tools to any Graph agent that
-    selects it — the exact trap `execution_models` exists to make impossible.
-    Declare `execution_models=("react",)` explicitly, or implement `tools()`
-    for the plain-tool portion so the capability is genuinely Graph-visible.
+    selects it — the exact trap `execution_models` exists to make
+    impossible. Declare `execution_models=("react",)` explicitly, or
+    implement `tools()` for the plain-tool portion so the capability is
+    genuinely Graph-visible.
     """
 
 

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/graph/graph_runtime.py

@@ -47,6 +47,8 @@ from fred_sdk.contracts.context import (
     FsEntry,
     InvocationScope,
     PublishedArtifact,
+    ToolContentBlock,
+    ToolContentKind,
     ToolInvocationRequest,
     ToolInvocationResult,
 )
@@ -640,6 +642,7 @@ class _GraphNodeExecutionContext:
                 "call_id": call_id,
             },
         )
+        started_at = _time.monotonic()
         try:
             with _graph_phase_timer(
                 metrics=self.services.metrics,
@@ -681,6 +684,7 @@ class _GraphNodeExecutionContext:
                 is_error=result.is_error,
                 sources=result.sources,
                 ui_parts=result.ui_parts,
+                latency_ms=_elapsed_ms_since(started_at),
             )
         )
         return result
@@ -723,6 +727,7 @@ class _GraphNodeExecutionContext:
                 "tool_name": tool_name,
             },
         ) as kpi_dims:
+            started_at = _time.monotonic()
             try:
                 raw_result = await tool.ainvoke(arguments)
                 normalized = _normalize_runtime_tool_output(raw_result)
@@ -731,14 +736,18 @@ class _GraphNodeExecutionContext:
                 # §3.9 — a failing tool must never crash the turn). Read
                 # is_error/sources/ui_parts off the TYPED result — before
                 # normalization erases its identity — rather than off the
-                # normalized dict's `is_error` key, which any plain MCP tool
+                # normalized dict's `is_error` key, which any plain tool
                 # could coincidentally also carry for an unrelated reason.
-                # `raw_result` is the actual `ToolInvocationResult` instance
-                # for a capability tool (default "content" response_format
-                # survives a plain-dict `.ainvoke()` unchanged, per Phase 1);
-                # never true for an MCP-resolved tool, so this never
-                # misclassifies a business payload as this platform's own
-                # error contract.
+                # The safety is in the isinstance check itself, not in an
+                # assumption about which source produced `raw_result`: a
+                # bare `ToolInvocationResult` return (no `response_format`
+                # override) survives a plain-dict `.ainvoke()` unchanged
+                # (Phase 1) for ANY tool built that way — a capability tool
+                # or an in-process toolkit tool like `KfVectorSearchToolkit`
+                # (also `runtime_tools`-reachable) alike. Either is a
+                # legitimate, intentional hit, not a misclassification; a
+                # tool returning some other shape (a plain dict/string) just
+                # fails the isinstance check and falls through untouched.
                 typed_result = (
                     raw_result if isinstance(raw_result, ToolInvocationResult) else None
                 )
@@ -758,6 +767,7 @@ class _GraphNodeExecutionContext:
                         ui_parts=typed_result.ui_parts
                         if typed_result is not None
                         else (),
+                        latency_ms=_elapsed_ms_since(started_at),
                     )
                 )
                 if reported_error:
@@ -773,6 +783,7 @@ class _GraphNodeExecutionContext:
                         tool_name=tool_name,
                         content=str(exc),
                         is_error=True,
+                        latency_ms=_elapsed_ms_since(started_at),
                     )
                 )
                 if span is not None:
@@ -1968,7 +1979,15 @@ def _adapt_capability_tool_for_graph(source_tool: BaseTool) -> BaseTool:
       declared response_format (CAPAB-02), not "any 2-tuple" — a plain tool
       whose normal return value happens to be some unrelated 2-tuple must
       round-trip unchanged, not have its second element silently
-      reinterpreted as an artifact.
+      reinterpreted as an artifact. **If the artifact's own `blocks` are
+      empty, `content` is folded in as one `ToolContentBlock` before the
+      artifact is returned** (PR #2067 review): `document_access`'s tools
+      duplicate their answer into `blocks` themselves, but a tool like
+      `demo_echo` puts its actual answer only in `content`, with an artifact
+      carrying nothing but `ui_parts` — discarding `content` outright would
+      silently drop the answer for any such tool. This is a safety net, not
+      a substitute for a capability author populating `blocks` directly
+      (`document_access` is still the reference pattern to copy).
     - anything else (already a bare `ToolInvocationResult`, or any other
       capability tool return): pass through unchanged.
 
@@ -2015,7 +2034,30 @@ def _adapt_capability_tool_for_graph(source_tool: BaseTool) -> BaseTool:
     async def _invoke(**kwargs: object) -> object:
         raw = await coroutine(**kwargs)
         if is_content_and_artifact and isinstance(raw, tuple) and len(raw) == 2:
-            return raw[1]
+            content, artifact = raw
+            # PR #2067 review (Codex): keeping ONLY the artifact is correct
+            # for a tool like `document_access`'s, whose artifact duplicates
+            # its answer into `blocks` — but a tool like `demo_echo`'s puts
+            # the actual answer in `content` and an artifact carrying only
+            # `ui_parts` (a UI card), never `blocks`. Unwrapping to the
+            # artifact alone would silently drop the answer for any such
+            # tool. If the artifact has no `blocks` of its own, fold the
+            # discarded `content` in as one — never lose the answer just
+            # because a capability author didn't think to duplicate it.
+            if (
+                isinstance(artifact, ToolInvocationResult)
+                and not artifact.blocks
+                and isinstance(content, str)
+                and content
+            ):
+                artifact = artifact.model_copy(
+                    update={
+                        "blocks": (
+                            ToolContentBlock(kind=ToolContentKind.TEXT, text=content),
+                        )
+                    }
+                )
+            return artifact
         return raw
 
     return StructuredTool.from_function(
@@ -2041,6 +2083,14 @@ def _validated_handlers(
     return validated
 
 
+def _elapsed_ms_since(started_at: float) -> int:
+    """Milliseconds elapsed since a `time.monotonic()` reading (react_runtime.py's
+    same helper — mirrored here so `ToolResultRuntimeEvent.latency_ms` is populated
+    on the Graph tool paths too, not just the ReAct one)."""
+
+    return int((_time.monotonic() - started_at) * 1000)
+
+
 def _graph_phase_timer(
     *,
     metrics: MetricsProvider | None,

{fred_runtime-3.3.7 → fred_runtime-3.4.0}/fred_runtime/model_routing/__init__.py

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from .authz import usable_model_capability_ids
 from .catalog import (
     ModelCatalog,
     load_model_catalog,
@@ -21,6 +22,7 @@ from .contracts import (
     FrozenModel,
     MatchValue,
     ModelCapability,
+    ModelNotUsableError,
     ModelProfile,
     ModelRouteMatch,
     ModelRouteRule,
@@ -38,6 +40,7 @@ __all__ = [
     "MatchValue",
     "ModelCapability",
     "ModelCatalog",
+    "ModelNotUsableError",
     "ModelProfile",
     "ModelRouteMatch",
     "ModelRouteRule",
@@ -49,4 +52,5 @@ __all__ = [
     "RoutedChatModelFactory",
     "load_model_catalog",
     "load_model_routing_policy_from_catalog",
+    "usable_model_capability_ids",
 ]