openadapt-verify 0.2.0__py3-none-any.whl

openadapt_verify/__init__.py

@@ -0,0 +1,65 @@
+"""Public facade over OpenAdapt's canonical verifier and receipt formats.
+
+WriteResult describes the store's outcome. LocalSealVerification and
+PortableReceiptVerification describe different signature formats; neither
+substitutes for the store result or a caller's pinned issuer trust.
+"""
+
+from typing import TYPE_CHECKING, Any
+
+from openadapt_flow.offline_seal import LocalSealVerification, verify_local_seal
+from openadapt_flow.verifier import (
+    Actor,
+    AlreadyWritten,
+    Contract,
+    Outcome,
+    Scope,
+    WriteBlocked,
+    WriteResult,
+    begin_write,
+    issue_write_receipt,
+    recheck,
+    verify_write,
+)
+from openadapt_flow.write_receipt import ReceiptError
+from openadapt_flow.write_receipt import Verification as PortableReceiptVerification
+from openadapt_flow.write_receipt import verify as verify_receipt
+
+from openadapt_verify.guard import checked_write, verified
+
+__version__ = "0.2.0"
+
+__all__ = [
+    "Actor",
+    "AlreadyWritten",
+    "Contract",
+    "LocalSealVerification",
+    "Outcome",
+    "PortableReceiptVerification",
+    "ReceiptError",
+    "Scope",
+    "WriteBlocked",
+    "WriteGuard",
+    "WriteResult",
+    "begin_write",
+    "checked_write",
+    "issue_write_receipt",
+    "recheck",
+    "verify_local_seal",
+    "verified",
+    "verify_receipt",
+    "verify_write",
+]
+
+
+if TYPE_CHECKING:
+    from openadapt_flow.integrations.agents import WriteGuard
+
+
+def __getattr__(name: str) -> Any:
+    if name == "WriteGuard":
+        from openadapt_flow.integrations.agents import WriteGuard
+
+        globals()[name] = WriteGuard
+        return WriteGuard
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

openadapt_verify/__main__.py

@@ -0,0 +1,3 @@
+from openadapt_verify.cli import main
+
+raise SystemExit(main())

openadapt_verify/_ledger_config.py

@@ -0,0 +1,21 @@
+"""Refuse protected operation when the installed Flow cannot select it."""
+
+import os
+
+_PROTECTED_CONFIG_ENV = "OPENADAPT_LEDGER_AUTHORITY_CONFIG"
+
+
+class ProtectedLedgerUnsupported(RuntimeError):
+    """The installed Flow lacks the configured protected default."""
+
+
+def require_protected_default_support() -> None:
+    if _PROTECTED_CONFIG_ENV not in os.environ:
+        return
+    from openadapt_flow import write_ledger
+
+    if (
+        getattr(write_ledger, "PROTECTED_LEDGER_CONFIG_ENV", None)
+        != _PROTECTED_CONFIG_ENV
+    ):
+        raise ProtectedLedgerUnsupported("ledger_authority_unsupported")

openadapt_verify/adapters/__init__.py

@@ -0,0 +1 @@
+"""Opt-in write wrappers. Calls outside a wrapper are not protected."""

openadapt_verify/adapters/browser_use.py

@@ -0,0 +1,39 @@
+"""Wrap a typed async action before registering it with browser-use Tools."""
+
+from __future__ import annotations
+
+import inspect
+from functools import wraps
+from typing import Any, Callable
+
+from openadapt_flow.integrations.agents import WriteGuard, reply_text
+
+
+def verified(
+    action: Callable[..., Any], *, contract: Any, **options: Any
+) -> Callable[..., Any]:
+    """Return tool text from a guarded action; other browser actions stay outside.
+
+    Register the returned function with ``tools.action(...)``. Its parameter
+    names and evaluated annotations are preserved, including browser_session.
+    """
+    if not inspect.iscoroutinefunction(action):
+        raise TypeError("browser-use verified actions must be async functions")
+    signature = inspect.signature(action, eval_str=True)
+    guard = WriteGuard(contract, **options)
+
+    @wraps(action)
+    async def checked(*args: Any, **kwargs: Any) -> str:
+        bound = signature.bind(*args, **kwargs)
+        bound.apply_defaults()
+        reply = await guard.arun(bound.arguments, lambda: action(*args, **kwargs))
+        return reply_text(reply)
+
+    checked.__signature__ = signature.replace(return_annotation=str)  # type: ignore[attr-defined]
+    checked.__annotations__ = {
+        name: parameter.annotation
+        for name, parameter in signature.parameters.items()
+        if parameter.annotation is not inspect.Parameter.empty
+    }
+    checked.__annotations__["return"] = str
+    return checked

openadapt_verify/adapters/claude_sdk.py

@@ -0,0 +1,5 @@
+"""The existing Claude Agent SDK tool adapter; install the claude extra."""
+
+from openadapt_flow.integrations.agents.claude_sdk import only, verified
+
+__all__ = ["only", "verified"]

openadapt_verify/adapters/openai_agents.py

@@ -0,0 +1,5 @@
+"""The existing OpenAI Agents SDK tool adapter; install the openai extra."""
+
+from openadapt_flow.integrations.agents.openai_agents import verified
+
+__all__ = ["verified"]

openadapt_verify/adapters/stagehand.py

@@ -0,0 +1,32 @@
+"""Explicit single-act guard for a caller-owned Stagehand Python session."""
+
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from openadapt_flow.integrations.agents import WriteGuard
+
+
+class VerifiedSession:
+    """Only this object's act call is checked; the original session is unchanged.
+
+    ``values`` bind the operator's existing verification contract. Stagehand's
+    response is tool output, never evidence that the record was persisted.
+    """
+
+    def __init__(self, session: Any, *, contract: Any, **options: Any) -> None:
+        if not callable(getattr(session, "act", None)):
+            raise TypeError("a Stagehand session with an async act method is required")
+        self._session = session
+        self._guard = WriteGuard(contract, **options)
+
+    async def act(
+        self, *, values: Mapping[str, Any], input: Any, **options: Any
+    ) -> dict:
+        return await self._guard.arun(
+            values, lambda: self._session.act(input=input, **options)
+        )
+
+
+def verified(session: Any, *, contract: Any, **options: Any) -> VerifiedSession:
+    return VerifiedSession(session, contract=contract, **options)