openbox-sdk-python 1.3.0__tar.gz → 1.4.0__tar.gz

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/CHANGELOG.md

@@ -7,7 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Capture streamed text response bodies for sync/async `httpx` and `httpx2`
+  requests without consuming the stream ahead of the caller. Emit completed
+  telemetry once on EOF, close, or read failure, with bounded body capture and
+  the original span/activity identity preserved.
+
+## [1.4.0] - 2026-10-02
+
 ### Added
+- HTTP span capture for `httpx2.Client` and `httpx2.AsyncClient` when `httpx2`
+  is installed, alongside `httpx`, using the existing HTTP toggle and OpenBox
+  started/completed payload contract.
 - **Okta identity bootstrap** — an `okta_ai_agent` runtime now needs only
   `OPENBOX_API_URL`, `OPENBOX_API_KEY`, and `OPENBOX_OKTA_AGENT_PRIVATE_KEY`. The SDK
   fetches the remaining identity metadata (agent id, organization id, deployment id,
@@ -41,6 +52,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - No failure path downgrades to v1, to an unsigned request, or to a different identity
   method. A Core that predates the endpoint (`404`) produces actionable upgrade guidance.
 
+## [1.3.1] - 2026-09-17
+
+### Security
+- Require `cryptography>=50,<51` to address CVE-2026-69247. No OpenBox SDK API or
+  runtime behavior changes are included in this patch release.
+
 ## [1.3.0] - 2026-07-30
 
 ### Added

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openbox-sdk-python
-Version: 1.3.0
+Version: 1.4.0
 Summary: OpenBox base SDK - governance contracts, strict gate, identity/signing, evaluate client, context runtime, OTel span wire serialization, and generic instrumentation shared by every OpenBox framework SDK
 Author-email: OpenBox Team <tino@openbox.ai>
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
-Requires-Dist: cryptography<50,>=48.0.1
+Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1,>=0.28.0
 Requires-Dist: opentelemetry-api<1.40.0,>=1.38.0
 Requires-Dist: opentelemetry-sdk<1.40.0,>=1.38.0
@@ -82,6 +82,22 @@ uv sync --extra http    # + HTTP instrumentation targets
 uv sync --extra db      # + DB instrumentation targets
 ```
 
+HTTP instrumentation also captures `httpx2.Client` and `httpx2.AsyncClient`
+requests when `httpx2` is installed by the host application. It uses the same
+HTTP toggle and started/completed span payloads as `httpx`, including body
+capture and credential-header redaction.
+
+For streamed `httpx`/`httpx2` responses, completed telemetry is emitted when the
+caller finishes reading the decoded body or closes the response. Text chunks are
+copied as they pass through; the SDK does not drain or buffer the entire stream.
+SSE responses retain their raw event text in `response_body`. Capture respects
+`privacy.max_body_size` (characters); when that limit is disabled, streaming
+capture still uses a 65,536-character bound. Binary bodies are not captured.
+A response closed before transport EOF records the consumed prefix and sets
+`attributes["openbox.http.response_body.partial"]` to `true`. This includes clients
+that stop reading after an SSE end marker and then close the HTTP response.
+Stream read failures retain their original exception and report partial evidence.
+
 ## Okta AI Agent identity (`okta_ai_agent`)
 
 An agent whose OpenBox identity is verified against an Okta AI Agent credential

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/README.md

@@ -43,6 +43,22 @@ uv sync --extra http    # + HTTP instrumentation targets
 uv sync --extra db      # + DB instrumentation targets
 ```
 
+HTTP instrumentation also captures `httpx2.Client` and `httpx2.AsyncClient`
+requests when `httpx2` is installed by the host application. It uses the same
+HTTP toggle and started/completed span payloads as `httpx`, including body
+capture and credential-header redaction.
+
+For streamed `httpx`/`httpx2` responses, completed telemetry is emitted when the
+caller finishes reading the decoded body or closes the response. Text chunks are
+copied as they pass through; the SDK does not drain or buffer the entire stream.
+SSE responses retain their raw event text in `response_body`. Capture respects
+`privacy.max_body_size` (characters); when that limit is disabled, streaming
+capture still uses a 65,536-character bound. Binary bodies are not captured.
+A response closed before transport EOF records the consumed prefix and sets
+`attributes["openbox.http.response_body.partial"]` to `true`. This includes clients
+that stop reading after an SSE end marker and then close the HTTP response.
+Stream read failures retain their original exception and report partial evidence.
+
 ## Okta AI Agent identity (`okta_ai_agent`)
 
 An agent whose OpenBox identity is verified against an Okta AI Agent credential

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/openbox_core/__init__.py

@@ -37,7 +37,7 @@ from .errors import (
 # governance; eagerly it can deadlock package init as a circular import, and
 # lazily it can recurse unboundedly when a per-request header builder resolves
 # the version. Keep in sync with pyproject.toml on release.
-__version__ = "1.3.0"
+__version__ = "1.4.0"
 
 __all__ = [
     "__version__",

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/openbox_core/contracts/events.py

@@ -221,12 +221,19 @@ def workflow_completed(
     )
 
 
+def _error_payload(error: str | Mapping[str, Any]) -> dict[str, Any]:
+    """Core expects ErrorInfo for lifecycle failures, never a bare string."""
+    if isinstance(error, str):
+        return {"type": "Exception", "message": error}
+    return dict(error)
+
+
 def workflow_failed(
     *,
     workflow_id: str,
     run_id: str,
     workflow_type: str,
-    error: str | None = None,
+    error: str | Mapping[str, Any] | None = None,
     task_queue: str | None = None,
     multi_agent_session_id: str | None = None,
     timestamp: str | None = None,
@@ -237,7 +244,7 @@ def workflow_failed(
         workflow_id, run_id, workflow_type, task_queue, multi_agent_session_id, extra
     )
     if error is not None:
-        payload["error"] = error
+        payload["error"] = _error_payload(error)
     return EventEnvelope(
         event_type=EventType.WORKFLOW_FAILED, payload=payload, timestamp=timestamp
     )
@@ -283,7 +290,7 @@ def activity_completed(
     activity_type: str,
     task_queue: str | None = None,
     result: Any = None,
-    error: str | None = None,
+    error: str | Mapping[str, Any] | None = None,
     attempt: int | None = None,
     multi_agent_session_id: str | None = None,
     timestamp: str | None = None,
@@ -301,7 +308,7 @@ def activity_completed(
     if result is not None:
         payload["result"] = result
     if error is not None:
-        payload["error"] = error
+        payload["error"] = _error_payload(error)
     if attempt is not None:
         payload["attempt"] = attempt
     return EventEnvelope(

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/openbox_core/instrumentation/http.py

@@ -1,8 +1,8 @@
-"""HTTP wrappers — requests + httpx (sync/async) via OTel instrumentor hooks.
+"""HTTP wrappers — requests + httpx/httpx2 (sync/async).
 
-The instrumentor creates the OTel span and invokes our request hook BEFORE
-the real request is sent; raising from the hook (via hook runtime -> adapter)
-prevents the request. The wrapper itself never interprets verdicts.
+Each wrapper creates or receives an OTel span and invokes the hook runtime
+BEFORE the real request is sent; raising via the adapter prevents the request.
+The wrapper itself never interprets verdicts.
 
 Self-instrumentation guard: URLs under any ignored prefix (always including
 the OpenBox ``api_url``) are skipped so evaluate calls never govern
@@ -13,11 +13,15 @@ from __future__ import annotations
 
 import contextlib
 import contextvars
+import importlib
 import logging
 import time
 from typing import Any
 
+from ..context import activity_scope
 from ..contracts.otel_spans import HookType
+from ..hooks.events import resolve_context
+from .http_stream import capture_async_response_stream, capture_response_stream
 from .shared import get_hook_runtime
 
 logger = logging.getLogger(__name__)
@@ -33,6 +37,8 @@ __all__ = [
     "uninstall_httpx",
     "install_httpx_body_capture",
     "uninstall_httpx_body_capture",
+    "install_httpx2_body_capture",
+    "uninstall_httpx2_body_capture",
     "install_urllib3",
     "uninstall_urllib3",
     "install_urllib",
@@ -386,14 +392,17 @@ def uninstall_httpx() -> None:
         logger.debug("httpx uninstrument skipped", exc_info=True)
 
 
-# ── httpx body capture (Client.send / AsyncClient.send patch) ────────────────
+# ── httpx/httpx2 body capture (Client.send / AsyncClient.send patch) ──────────
 #
 # Separate from OTel instrumentation: OTel hooks receive streams that cannot be
 # consumed. Patching send lets us read the request body (buffered before send)
-# and the response body (cached by httpx after a non-streaming send) safely.
+# and the response body safely. Unread streams are observed as the caller reads
+# them; completed telemetry waits for stream consumption or explicit close.
 
-_original_httpx_send: Any = None
-_original_httpx_async_send: Any = None
+# Each library has distinct client classes. Keep its originals independent,
+# including in the wrapper closures, so installing/restoring one cannot affect
+# requests through the other.
+_original_httpx_sends: dict[str, tuple[Any, Any, Any]] = {}
 
 
 def _pop_httpx_span() -> Any:
@@ -486,31 +495,59 @@ def _httpx_completed_fields(
     }
 
 
+def _stream_completed_fields(
+    request: Any, response: Any, span: Any, start: float,
+    request_body: str | None, request_headers: dict | None,
+    body: str | None, error: str | None, partial: bool,
+) -> dict:
+    with contextlib.suppress(Exception):
+        span.set_attribute("openbox.http.response_body.partial", partial)
+    fields = _httpx_completed_fields(
+        request, response, int((time.perf_counter() - start) * 1e9),
+        request_body, request_headers, body, sanitize_headers(response.headers),
+    )
+    if error is not None:
+        fields["error"] = error
+    return fields
+
+
 def install_httpx_body_capture() -> bool:
-    """Patch httpx ``Client.send``/``AsyncClient.send`` for completed body
-    capture. Idempotent; must be installed AFTER ``install_httpx`` so the
-    captured original send already carries the OTel request hook."""
-    global _original_httpx_send, _original_httpx_async_send
-    if _original_httpx_send is not None:
+    """Capture both stages for httpx; install AFTER ``install_httpx``."""
+    return _install_httpx_body_capture("httpx")
+
+
+def install_httpx2_body_capture() -> bool:
+    """Capture both stages for httpx2 when installed, using the same wire shape.
+
+    The send wrapper creates its own OTel span, so this does not require a
+    newer OTel HTTPX instrumentor with native httpx2 support.
+    """
+    return _install_httpx_body_capture("httpx2")
+
+
+def _install_httpx_body_capture(module_name: str) -> bool:
+    if module_name in _original_httpx_sends:
         return True
     try:
-        import httpx
+        library = importlib.import_module(module_name)
     except ImportError:
-        logger.info("httpx not available for body capture — deferred")
+        logger.info("%s not available for body capture — deferred", module_name)
         return False
 
-    _original_httpx_send = httpx.Client.send
-    _original_httpx_async_send = httpx.AsyncClient.send
+    original_send = library.Client.send
+    original_async_send = library.AsyncClient.send
 
     def _patched_send(self: Any, request: Any, *args: Any, **kwargs: Any) -> Any:
         runtime = get_hook_runtime()
         url = str(getattr(request, "url", "") or "")
         if runtime is None or should_ignore_url(url):
-            return _original_httpx_send(self, request, *args, **kwargs)
+            return original_send(self, request, *args, **kwargs)
         request_body, request_headers = _capture_httpx_request(request)
         span = _start_httpx_span(request)
+        context = resolve_context(runtime._store, span)
         patch_token = _httpx_patch_span_var.set(span)
         start = time.perf_counter()
+        deferred = False
         try:
             runtime.preflight(
                 span,
@@ -523,7 +560,32 @@ def install_httpx_body_capture() -> bool:
                     "request_body": request_body,
                 },
             )
-            response = _original_httpx_send(self, request, *args, **kwargs)
+            response = original_send(self, request, *args, **kwargs)
+            if not response.is_stream_consumed:
+                # An unbound request must not acquire another activity's
+                # context just because its body is consumed later.
+                if context is None or not context.activity_id or not context.activity_type:
+                    return response
+
+                def complete(body: str | None, error: str | None, partial: bool) -> None:
+                    try:
+                        fields = _stream_completed_fields(
+                            request, response, span, start, request_body, request_headers,
+                            body, error, partial,
+                        )
+                        with activity_scope(context, store=runtime._store):
+                            runtime.completed(span, hook_type=HookType.HTTP_REQUEST, fields=fields)
+                    finally:
+                        span.end()
+
+                capture_response_stream(
+                    response,
+                    max_chars=runtime._runtime.config.privacy.max_body_size,
+                    capture_text=_is_text_content_type(response.headers.get("content-type")),
+                    complete=complete,
+                )
+                deferred = True
+                return response
             duration_ns = int((time.perf_counter() - start) * 1e9)
             response_body, response_headers = _capture_httpx_response(response)
             runtime.completed(
@@ -542,18 +604,21 @@ def install_httpx_body_capture() -> bool:
             return response
         finally:
             _httpx_patch_span_var.reset(patch_token)
-            with contextlib.suppress(Exception):
-                span.end()
+            if not deferred:
+                with contextlib.suppress(Exception):
+                    span.end()
 
     async def _patched_async_send(self: Any, request: Any, *args: Any, **kwargs: Any) -> Any:
         runtime = get_hook_runtime()
         url = str(getattr(request, "url", "") or "")
         if runtime is None or should_ignore_url(url):
-            return await _original_httpx_async_send(self, request, *args, **kwargs)
+            return await original_async_send(self, request, *args, **kwargs)
         request_body, request_headers = _capture_httpx_request(request)
         span = _start_httpx_span(request)
+        context = resolve_context(runtime._store, span)
         patch_token = _httpx_patch_span_var.set(span)
         start = time.perf_counter()
+        deferred = False
         try:
             await runtime.apreflight(
                 span,
@@ -566,7 +631,32 @@ def install_httpx_body_capture() -> bool:
                     "request_body": request_body,
                 },
             )
-            response = await _original_httpx_async_send(self, request, *args, **kwargs)
+            response = await original_async_send(self, request, *args, **kwargs)
+            if not response.is_stream_consumed:
+                if context is None or not context.activity_id or not context.activity_type:
+                    return response
+
+                async def complete(body: str | None, error: str | None, partial: bool) -> None:
+                    try:
+                        fields = _stream_completed_fields(
+                            request, response, span, start, request_body, request_headers,
+                            body, error, partial,
+                        )
+                        with activity_scope(context, store=runtime._store):
+                            await runtime.acompleted(
+                                span, hook_type=HookType.HTTP_REQUEST, fields=fields
+                            )
+                    finally:
+                        span.end()
+
+                capture_async_response_stream(
+                    response,
+                    max_chars=runtime._runtime.config.privacy.max_body_size,
+                    capture_text=_is_text_content_type(response.headers.get("content-type")),
+                    complete=complete,
+                )
+                deferred = True
+                return response
             duration_ns = int((time.perf_counter() - start) * 1e9)
             response_body, response_headers = _capture_httpx_response(response)
             await runtime.acompleted(
@@ -585,29 +675,37 @@ def install_httpx_body_capture() -> bool:
             return response
         finally:
             _httpx_patch_span_var.reset(patch_token)
-            with contextlib.suppress(Exception):
-                span.end()
+            if not deferred:
+                with contextlib.suppress(Exception):
+                    span.end()
 
-    httpx.Client.send = _patched_send
-    httpx.AsyncClient.send = _patched_async_send
+    library.Client.send = _patched_send
+    library.AsyncClient.send = _patched_async_send
+    _original_httpx_sends[module_name] = (library, original_send, original_async_send)
     return True
 
 
 def uninstall_httpx_body_capture() -> None:
     """Restore httpx send (idempotent). Call BEFORE ``uninstall_httpx`` so the
     original chain is unwound in reverse install order."""
-    global _original_httpx_send, _original_httpx_async_send
-    if _original_httpx_send is None:
+    _uninstall_httpx_body_capture("httpx")
+
+
+def uninstall_httpx2_body_capture() -> None:
+    """Restore httpx2 send independently of httpx (idempotent)."""
+    _uninstall_httpx_body_capture("httpx2")
+
+
+def _uninstall_httpx_body_capture(module_name: str) -> None:
+    originals = _original_httpx_sends.pop(module_name, None)
+    if originals is None:
         return
+    library, original_send, original_async_send = originals
     try:
-        import httpx
-
-        httpx.Client.send = _original_httpx_send
-        httpx.AsyncClient.send = _original_httpx_async_send
+        library.Client.send = original_send
+        library.AsyncClient.send = original_async_send
     except Exception:
-        logger.debug("httpx body-capture restore skipped", exc_info=True)
-    _original_httpx_send = None
-    _original_httpx_async_send = None
+        logger.debug("%s body-capture restore skipped", module_name, exc_info=True)
 
 
 # ── urllib3 (OTel URLLib3Instrumentor hooks) ─────────────────────────────────

openbox_sdk_python-1.4.0/openbox_core/instrumentation/http_stream.py

@@ -0,0 +1,185 @@
+"""Bounded response capture while HTTPX callers consume decoded stream bytes.
+
+Wrap response iterators instead of buffering the transport: HTTPX keeps ownership
+of decompression, backpressure, and connection cleanup. Its raw iterator closes
+the response before the decoded iterator flushes, so defer that internal close's
+completion until the outer iterator finishes. An explicit close between chunks
+completes immediately with the captured prefix.
+"""
+
+from __future__ import annotations
+
+import codecs
+import logging
+from collections.abc import Awaitable, Callable
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+
+class _Capture:
+    def __init__(self, response: Any, max_chars: int, capture_text: bool):
+        # Streaming capture must remain bounded even when ordinary body
+        # truncation is disabled. Keep one extra character for the wire gate's
+        # existing truncation diagnostic when a positive limit is configured.
+        self.limit = max_chars if max_chars and max_chars > 0 else 65536
+        self.remaining = self.limit + (1 if max_chars and max_chars > 0 else 0)
+        self.parts: list[str] = []
+        self.in_next = False
+        self.eof = False
+        self.finished = False
+        self.error: str | None = None
+        self.decoder = None
+        if capture_text:
+            try:
+                decoder = codecs.getincrementaldecoder(response.encoding or "utf-8")
+            except LookupError:
+                decoder = codecs.getincrementaldecoder("utf-8")
+            self.decoder = decoder(errors="replace")
+
+    def _append(self, text: str) -> None:
+        part = text[: self.remaining]
+        if part:
+            self.parts.append(part)
+            self.remaining -= len(part)
+
+    def feed(self, chunk: bytes) -> None:
+        if self.decoder is None or self.finished:
+            return
+        # Decode in bounded slices, including when a transport yields a large
+        # chunk. Incremental decoding preserves characters split across chunks.
+        for offset in range(0, len(chunk), 4096):
+            if self.remaining <= 0:
+                break
+            self._append(self.decoder.decode(chunk[offset : offset + 4096]))
+
+    def failed(self, error: BaseException) -> None:
+        if not isinstance(error, GeneratorExit) and self.error is None:
+            self.error = f"{type(error).__name__}: {error}"
+
+    def body(self) -> str | None:
+        if self.decoder is None:
+            return None
+        if self.remaining > 0:
+            self._append(self.decoder.decode(b"", final=True))
+        return "".join(self.parts)
+
+
+def capture_response_stream(
+    response: Any,
+    *,
+    max_chars: int,
+    capture_text: bool,
+    complete: Callable[[str | None, str | None, bool], None],
+) -> None:
+    """Capture sync decoded bytes and complete once at EOF, close, or error."""
+    capture = _Capture(response, max_chars, capture_text)
+    original_iter = response.iter_bytes
+    original_close = response.close
+
+    def finish() -> None:
+        if capture.finished or capture.in_next:
+            return
+        capture.finished = True
+        try:
+            complete(capture.body(), capture.error, not capture.eof)
+        except Exception:
+            logger.warning("stream completed-hook telemetry failed", exc_info=True)
+
+    def iter_bytes(*args: Any, **kwargs: Any):
+        iterator = iter(original_iter(*args, **kwargs))
+        try:
+            while True:
+                capture.in_next = True
+                try:
+                    chunk = next(iterator)
+                except StopIteration:
+                    capture.eof = True
+                    break
+                finally:
+                    capture.in_next = False
+                capture.feed(chunk)
+                yield chunk
+        except BaseException as exc:
+            capture.failed(exc)
+            raise
+        finally:
+            try:
+                capture.in_next = True
+                if hasattr(iterator, "close"):
+                    iterator.close()
+            finally:
+                capture.in_next = False
+                finish()
+
+    def close() -> None:
+        try:
+            original_close()
+        except BaseException as exc:
+            capture.failed(exc)
+            raise
+        finally:
+            finish()
+
+    response.iter_bytes = iter_bytes
+    response.close = close
+
+
+def capture_async_response_stream(
+    response: Any,
+    *,
+    max_chars: int,
+    capture_text: bool,
+    complete: Callable[[str | None, str | None, bool], Awaitable[None]],
+) -> None:
+    """Async counterpart; never prefetches chunks or schedules background work."""
+    capture = _Capture(response, max_chars, capture_text)
+    original_iter = response.aiter_bytes
+    original_close = response.aclose
+
+    async def finish() -> None:
+        if capture.finished or capture.in_next:
+            return
+        capture.finished = True
+        try:
+            await complete(capture.body(), capture.error, not capture.eof)
+        except Exception:
+            logger.warning("stream completed-hook telemetry failed", exc_info=True)
+
+    async def aiter_bytes(*args: Any, **kwargs: Any):
+        iterator = original_iter(*args, **kwargs).__aiter__()
+        try:
+            while True:
+                capture.in_next = True
+                try:
+                    chunk = await anext(iterator)
+                except StopAsyncIteration:
+                    capture.eof = True
+                    break
+                finally:
+                    capture.in_next = False
+                capture.feed(chunk)
+                yield chunk
+        except BaseException as exc:
+            capture.failed(exc)
+            raise
+        finally:
+            try:
+                capture.in_next = True
+                if hasattr(iterator, "aclose"):
+                    await iterator.aclose()
+            finally:
+                capture.in_next = False
+                await finish()
+
+    async def aclose() -> None:
+        try:
+            await original_close()
+        except BaseException as exc:
+            capture.failed(exc)
+            raise
+        finally:
+            await finish()
+
+    response.aiter_bytes = aiter_bytes
+    response.aclose = aclose

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/openbox_core/instrumentation/manager.py

@@ -77,6 +77,8 @@ class InstrumentationManager:
                 # the captured original send already carries the request hook.
                 if http_instrumentation.install_httpx_body_capture():
                     self._installed_targets.append("httpx_body_capture")
+            if http_instrumentation.install_httpx2_body_capture():
+                self._installed_targets.append("httpx2_body_capture")
             if http_instrumentation.install_urllib3():
                 self._installed_targets.append("urllib3")
             if http_instrumentation.install_urllib():
@@ -122,6 +124,7 @@ class InstrumentationManager:
         # Reverse install order: unwind the send patch before OTel httpx.
         http_instrumentation.uninstall_urllib()
         http_instrumentation.uninstall_urllib3()
+        http_instrumentation.uninstall_httpx2_body_capture()
         http_instrumentation.uninstall_httpx_body_capture()
         http_instrumentation.uninstall_httpx()
         http_instrumentation.uninstall_requests()

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openbox-sdk-python"
-version = "1.3.0"
+version = "1.4.0"
 description = "OpenBox base SDK - governance contracts, strict gate, identity/signing, evaluate client, context runtime, OTel span wire serialization, and generic instrumentation shared by every OpenBox framework SDK"
 authors = [
     { name = "OpenBox Team", email = "tino@openbox.ai" },
@@ -26,7 +26,7 @@ dependencies = [
     "opentelemetry-api>=1.38.0,<1.40.0",
     "opentelemetry-sdk>=1.38.0,<1.40.0",
     "httpx>=0.28.0,<1",
-    "cryptography>=48.0.1,<50",
+    "cryptography>=50,<51",
 ]
 
 [project.optional-dependencies]
@@ -53,6 +53,7 @@ db = [
 
 [dependency-groups]
 dev = [
+    "httpx2>=2.0.0,<3",
     "pytest>=8.2",
     "pytest-asyncio>=0.26.0,<0.27",
     "ruff>=0.8.0",

{openbox_sdk_python-1.3.0 → openbox_sdk_python-1.4.0}/tests/contracts/test_event_classify.py

@@ -142,7 +142,7 @@ class TestFactoriesValidation:
 
     def test_workflow_failed_carries_error(self):
         body = workflow_failed(**WF, error="boom").to_payload_dict()
-        assert body["error"] == "boom"
+        assert body["error"] == {"type": "Exception", "message": "boom"}
 
 
 class TestRfc3339: