replylayer 0.21.0__tar.gz → 0.22.0__tar.gz

{replylayer-0.21.0 → replylayer-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: replylayer
-Version: 0.21.0
+Version: 0.22.0
 Summary: Official Python SDK for ReplyLayer — email for AI agents
 License-Expression: MIT
 Keywords: agent,ai,email,mailbox,replylayer,sdk,webhook
@@ -443,6 +443,28 @@ if not status["active"] and status["privacy_ok"]:
 
 If `privacy_ok` is `False` the account's accepted privacy policy predates the disclosed sub-processor — re-accept the current Privacy Policy first (`enable_link_scanning` would otherwise raise a `409 PRIVACY_VERSION_TOO_OLD`). The async client exposes the same methods (`await rl.account.get_link_scanning_status()` / `await rl.account.enable_link_scanning(...)`).
 
+## Trusted instruction sources
+
+Every inbound message read carries `agent_safety_context` with `untrusted_content` `True` — the body is external data, not instructions for the agent to act on. Trusted instruction sources is an opt-in, **read-path-only** relaxation of that default for one specific, customer-designated, *verified* sender address per mailbox (address-grain only — there is no domain-wide grant). It does not change what a resulting send is allowed to do; the only related send-side control is a per-mailbox strict-recipient toggle, configured outside the SDK.
+
+The relaxation only applies on a read when **every** layer is satisfied, entirely on the server side: the platform feature is enabled, the mailbox's instruction-trust mode is on, the designated sender's message passed Mailgun sender verification (`verified_aligned`), the message scanned clean and is `available`, and the reading API key is a `role="agent"` key with the per-key capability enabled. There is no client-side opt-in — the SDK does not send any header or constructor flag to request this; a message either qualifies under the operator's configuration or it doesn't, and the response reflects that automatically:
+
+```python
+result = rl.messages.wait(mailbox["id"])
+msg = result["message"]
+ctx = msg.get("agent_safety_context") if msg else None
+if ctx and ctx.get("instruction_trust"):
+    # Gate passed: guidance was REPLACED with trusted-instruction wording (the
+    # agent may act on this verified sender's own explicit request in this
+    # message). untrusted_content is still True — this is metadata, not a
+    # content-safety judgment.
+    print(ctx["guidance"])
+    print(ctx["instruction_trust"])
+    # {"version": "v1", "match": "address", "verified_domain": ..., "verdict": "verified_aligned", "provenance": "mailgun"}
+```
+
+A human account owner enables the mailbox mode and the key's capability, and designates the trusted sender, from the dashboard (each a loosening change requiring session re-auth). Both the mailbox mode and the per-key capability default to off, so existing integrations are unaffected until a customer opts in. This is a read-path signal only — a copied or hijacked API key cannot self-grant the capability, and there is nothing for a client to set to request it.
+
 ## Mailbox identifiers
 
 Every SDK method that takes a `mailbox_id` argument accepts **either the mailbox's UUID or its name**. The server resolves names against the authenticated account's active mailboxes. `rl.messages.list("support-bot")` and `rl.messages.list("a1b2-…")` are equivalent.

{replylayer-0.21.0 → replylayer-0.22.0}/README.md

@@ -426,6 +426,28 @@ if not status["active"] and status["privacy_ok"]:
 
 If `privacy_ok` is `False` the account's accepted privacy policy predates the disclosed sub-processor — re-accept the current Privacy Policy first (`enable_link_scanning` would otherwise raise a `409 PRIVACY_VERSION_TOO_OLD`). The async client exposes the same methods (`await rl.account.get_link_scanning_status()` / `await rl.account.enable_link_scanning(...)`).
 
+## Trusted instruction sources
+
+Every inbound message read carries `agent_safety_context` with `untrusted_content` `True` — the body is external data, not instructions for the agent to act on. Trusted instruction sources is an opt-in, **read-path-only** relaxation of that default for one specific, customer-designated, *verified* sender address per mailbox (address-grain only — there is no domain-wide grant). It does not change what a resulting send is allowed to do; the only related send-side control is a per-mailbox strict-recipient toggle, configured outside the SDK.
+
+The relaxation only applies on a read when **every** layer is satisfied, entirely on the server side: the platform feature is enabled, the mailbox's instruction-trust mode is on, the designated sender's message passed Mailgun sender verification (`verified_aligned`), the message scanned clean and is `available`, and the reading API key is a `role="agent"` key with the per-key capability enabled. There is no client-side opt-in — the SDK does not send any header or constructor flag to request this; a message either qualifies under the operator's configuration or it doesn't, and the response reflects that automatically:
+
+```python
+result = rl.messages.wait(mailbox["id"])
+msg = result["message"]
+ctx = msg.get("agent_safety_context") if msg else None
+if ctx and ctx.get("instruction_trust"):
+    # Gate passed: guidance was REPLACED with trusted-instruction wording (the
+    # agent may act on this verified sender's own explicit request in this
+    # message). untrusted_content is still True — this is metadata, not a
+    # content-safety judgment.
+    print(ctx["guidance"])
+    print(ctx["instruction_trust"])
+    # {"version": "v1", "match": "address", "verified_domain": ..., "verdict": "verified_aligned", "provenance": "mailgun"}
+```
+
+A human account owner enables the mailbox mode and the key's capability, and designates the trusted sender, from the dashboard (each a loosening change requiring session re-auth). Both the mailbox mode and the per-key capability default to off, so existing integrations are unaffected until a customer opts in. This is a read-path signal only — a copied or hijacked API key cannot self-grant the capability, and there is nothing for a client to set to request it.
+
 ## Mailbox identifiers
 
 Every SDK method that takes a `mailbox_id` argument accepts **either the mailbox's UUID or its name**. The server resolves names against the authenticated account's active mailboxes. `rl.messages.list("support-bot")` and `rl.messages.list("a1b2-…")` are equivalent.

{replylayer-0.21.0 → replylayer-0.22.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "replylayer"
-version = "0.21.0"
+version = "0.22.0"
 description = "Official Python SDK for ReplyLayer — email for AI agents"
 readme = "README.md"
 license = "MIT"

{replylayer-0.21.0 → replylayer-0.22.0}/replylayer/__init__.py

@@ -28,6 +28,7 @@ from .types import (
     ThreadStarResponse,
     # WS6-SDK — async optimistic-ack (0.16.0).
     AsyncSendAck,
+    WebhookEventType,
     WebhookSummary,
     WebhookDeliverySummary,
     WebhookDeliveryStatus,
@@ -49,6 +50,9 @@ from .types import (
     GetUploadAttachmentResponse,
     # Migration 036 — recipient allowlist types.
     RecipientPolicyMode,
+    # Single "agent sends" control — derived view types.
+    AgentSendPolicy,
+    AgentSendRestrictedBy,
     AllowlistEntry,
     ListAllowlistResponse,
     AddAllowlistResponse,
@@ -70,6 +74,11 @@ from .types import (
     EnableLinkScanningResponse,
     EnableLinkScanningDisclosure,
     AgentSafetyContext,
+    InstructionTrustBasis,
+    # R5 — verified-sender signal.
+    SenderAuthVerdict,
+    SenderAuthentication,
+    SenderAuthenticationCompact,
     # Governed Email-Effect Contract v1 (Track 2).
     EmailEffect,
     EffectStatus,
@@ -92,7 +101,7 @@ from .types import (
     ScannerPolicy,
 )
 
-__version__ = "0.21.0"
+__version__ = "0.22.0"
 
 __all__ = [
     # Message delete response (0.20.0).
@@ -126,6 +135,7 @@ __all__ = [
     "EmailEffectRetryableError",
     "EmailEffect",
     "EffectStatus",
+    "WebhookEventType",
     "WebhookSummary",
     "WebhookDeliverySummary",
     "WebhookDeliveryStatus",
@@ -146,6 +156,8 @@ __all__ = [
     "ConsumedAttachmentResponse",
     "GetUploadAttachmentResponse",
     "RecipientPolicyMode",
+    "AgentSendPolicy",
+    "AgentSendRestrictedBy",
     "AllowlistEntry",
     "ListAllowlistResponse",
     "AddAllowlistResponse",
@@ -164,6 +176,10 @@ __all__ = [
     "EnableLinkScanningResponse",
     "EnableLinkScanningDisclosure",
     "AgentSafetyContext",
+    "InstructionTrustBasis",
+    "SenderAuthVerdict",
+    "SenderAuthentication",
+    "SenderAuthenticationCompact",
     "MessageReceivedSafetySignal",
     "MessageReceivedWebhookPayload",
     # PR 6 — HITL review queue.

{replylayer-0.21.0 → replylayer-0.22.0}/replylayer/_http.py

@@ -9,7 +9,7 @@ import httpx
 
 from .errors import ReplyLayerError, error_from_response
 
-_VERSION = "0.21.0"
+_VERSION = "0.22.0"
 _USER_AGENT = f"replylayer-sdk-py/{_VERSION}"
 _PROTECTED_HEADER_KEYS = frozenset({"authorization", "content-type", "user-agent"})
 

{replylayer-0.21.0 → replylayer-0.22.0}/replylayer/resources/mailboxes.py

@@ -5,6 +5,7 @@ from urllib.parse import quote
 
 from .._http import AsyncHttpClient, SyncHttpClient
 from ..types import (
+    AgentSendPolicy,
     AttachmentAccessResponse,
     AttachmentAllowedFileFamilyRequest,
     AttachmentExposureMode,
@@ -456,6 +457,16 @@ class SyncMailboxes:
         # Migration 085 — thread-scoped reply bypass toggle. None means "do not
         # include the field in the PATCH".
         allow_thread_replies: bool | None = None,
+        # Migration 096 — R3 agent-send-containment opt-out (session/admin-only).
+        # None means "do not include the field in the PATCH".
+        agent_send_containment: bool | None = None,
+        # Single "agent sends" convenience control. None means "do not include
+        # the field". Mutually exclusive with raw recipient_policy_mode/
+        # agent_send_containment in the same call (the server returns 400).
+        agent_send_policy: AgentSendPolicy | None = None,
+        # Consent for opening the agent on an allowlist mailbox (also opens
+        # human sends). None/False omits it.
+        confirm_open_human_sends: bool | None = None,
         # PR 8.1 — per-detector redaction visibility. Pass {} to reset to
         # platform default; pass a partial map (e.g.
         # {"EMAIL_ADDRESS": {"redact": False}}) to disable redaction on
@@ -479,6 +490,12 @@ class SyncMailboxes:
             body["hitl_mode"] = hitl_mode
         if allow_thread_replies is not None:
             body["allow_thread_replies"] = allow_thread_replies
+        if agent_send_containment is not None:
+            body["agent_send_containment"] = agent_send_containment
+        if agent_send_policy is not None:
+            body["agent_send_policy"] = agent_send_policy
+        if confirm_open_human_sends:
+            body["confirm_open_human_sends"] = True
         if pii_redaction_config is not None:
             body["pii_redaction_config"] = pii_redaction_config
         return self._http.request("PATCH", f"/v1/mailboxes/{id}", body=body)
@@ -515,6 +532,41 @@ class SyncMailboxes:
         """
         return self.update(id, allow_thread_replies=allow)
 
+    def set_agent_send_containment(self, id: str, enabled: bool) -> dict[str, Any]:
+        """Migration 096 — toggle R3 agent-send-containment for this mailbox.
+
+        When ``True`` (the default), an agent-key send (NOT human/admin/session)
+        on a native-blocklist mailbox is run through the allowlist +
+        thread-participant gate so a hijacked agent can't exfiltrate to a new
+        recipient. Set ``False`` to deliberately open an uncontained agent send
+        path. Session/admin only server-side.
+        """
+        return self.update(id, agent_send_containment=enabled)
+
+    def set_agent_send_policy(
+        self,
+        id: str,
+        policy: AgentSendPolicy,
+        *,
+        confirm_open_human_sends: bool = False,
+    ) -> dict[str, Any]:
+        """Single "agent sends" control — the thin front door over
+        ``recipient_policy_mode`` + ``agent_send_containment`` (no separate
+        stored field). ``"open"`` lets the agent send to any new recipient;
+        ``"restricted"`` gates it. Session/admin only server-side.
+
+        Opening on an allowlist mailbox also opens human sends, so the server
+        returns 409 ``OPEN_AGENT_REQUIRES_OPEN_MAILBOX`` (with
+        ``details.also_opens_human_sends = True``) on the first call. Re-issue
+        with ``confirm_open_human_sends=True`` to atomically flip the mailbox to
+        blocklist + containment off.
+        """
+        return self.update(
+            id,
+            agent_send_policy=policy,
+            confirm_open_human_sends=confirm_open_human_sends,
+        )
+
     def set_sender_policy(
         self,
         id: str,
@@ -648,6 +700,16 @@ class AsyncMailboxes:
         # Migration 085 — thread-scoped reply bypass toggle. None = do not
         # include in the PATCH.
         allow_thread_replies: bool | None = None,
+        # Migration 096 — R3 agent-send-containment opt-out (session/admin-only).
+        # None = do not include in the PATCH.
+        agent_send_containment: bool | None = None,
+        # Single "agent sends" convenience control. None = do not include.
+        # Mutually exclusive with raw recipient_policy_mode/agent_send_containment
+        # in the same call (the server returns 400).
+        agent_send_policy: AgentSendPolicy | None = None,
+        # Consent for opening the agent on an allowlist mailbox (also opens
+        # human sends). None/False omits it.
+        confirm_open_human_sends: bool | None = None,
         # PR 8.1 — per-detector redaction visibility. Pass {} to reset to
         # platform default; pass a partial map to disable redaction on
         # selected detectors. None = do not include in the PATCH.
@@ -668,6 +730,12 @@ class AsyncMailboxes:
             body["hitl_mode"] = hitl_mode
         if allow_thread_replies is not None:
             body["allow_thread_replies"] = allow_thread_replies
+        if agent_send_containment is not None:
+            body["agent_send_containment"] = agent_send_containment
+        if agent_send_policy is not None:
+            body["agent_send_policy"] = agent_send_policy
+        if confirm_open_human_sends:
+            body["confirm_open_human_sends"] = True
         if pii_redaction_config is not None:
             body["pii_redaction_config"] = pii_redaction_config
         return await self._http.request("PATCH", f"/v1/mailboxes/{id}", body=body)
@@ -706,6 +774,39 @@ class AsyncMailboxes:
         """
         return await self.update(id, allow_thread_replies=allow)
 
+    async def set_agent_send_containment(self, id: str, enabled: bool) -> dict[str, Any]:
+        """Migration 096 — toggle R3 agent-send-containment for this mailbox (async).
+
+        When ``True`` (the default), an agent-key send on a native-blocklist
+        mailbox is run through the allowlist + thread-participant gate. Set
+        ``False`` to deliberately open an uncontained agent send path.
+        Session/admin only server-side.
+        """
+        return await self.update(id, agent_send_containment=enabled)
+
+    async def set_agent_send_policy(
+        self,
+        id: str,
+        policy: AgentSendPolicy,
+        *,
+        confirm_open_human_sends: bool = False,
+    ) -> dict[str, Any]:
+        """Single "agent sends" control — the thin front door over
+        ``recipient_policy_mode`` + ``agent_send_containment`` (async).
+
+        ``"open"`` lets the agent send to any new recipient; ``"restricted"``
+        gates it. Session/admin only server-side. Opening on an allowlist
+        mailbox also opens human sends, so the server returns 409
+        ``OPEN_AGENT_REQUIRES_OPEN_MAILBOX``; re-issue with
+        ``confirm_open_human_sends=True`` to atomically flip to blocklist +
+        containment off.
+        """
+        return await self.update(
+            id,
+            agent_send_policy=policy,
+            confirm_open_human_sends=confirm_open_human_sends,
+        )
+
     async def set_sender_policy(
         self,
         id: str,

{replylayer-0.21.0 → replylayer-0.22.0}/replylayer/types.py

@@ -72,6 +72,8 @@ WebhookEventType = Literal[
     # matching endpoint commits the state transition. Subscribable via
     # POST/PATCH /v1/webhooks.enabled_events.
     "message.review.queued", "message.review.approved", "message.review.denied",
+    # Trusted-instruction-sources — customer grant/revoke of a trusted sender.
+    "trusted_source.granted", "trusted_source.revoked",
     "webhook.test",
 ]
 ApiKeyRole = Literal["admin", "agent"]
@@ -164,6 +166,21 @@ SubaddressMode = Literal["reply_to", "from", "none"]
 #     still runs first (wins on overlap).
 RecipientPolicyMode = Literal["blocklist", "allowlist"]
 
+# Single "agent sends" control — a DERIVED convenience view over
+# recipient_policy_mode + agent_send_containment (no separate stored field).
+#   - "open": the agent may send to any new recipient (blocklist mailbox with
+#     containment off).
+#   - "restricted": the agent is gated (see restricted_by for why).
+# See plans/agent-sends-policy-control-2026-06-26.md.
+AgentSendPolicy = Literal["restricted", "open"]
+
+# When agent_send_policy == "restricted", WHY:
+#   - "mailbox_allowlist": the whole mailbox is allowlist (humans too); opening
+#     the agent would also open human sends.
+#   - "agent_containment": blocklist mailbox + the R3 containment overlay.
+#   - None: agent_send_policy == "open".
+AgentSendRestrictedBy = Literal["mailbox_allowlist", "agent_containment"] | None
+
 # Per-mailbox INBOUND sender firewall mode (migration 047). Symmetric
 # counterpart to RecipientPolicyMode for the inbound side.
 #   - blocklist (default): inbound_sender_blocklists is the only ingest gate.
@@ -381,6 +398,12 @@ class CreateMailboxResponse(TypedDict):
     hitl_mode: HitlMode
     # Migration 085 — thread-scoped reply bypass flag; new mailboxes default True.
     allow_thread_replies: bool
+    # Migration 096 — R3 agent-send-containment opt-out; new mailboxes default True.
+    agent_send_containment: bool
+    # Single "agent sends" control — DERIVED from the two raw fields above.
+    agent_send_policy: AgentSendPolicy
+    # Why the agent is restricted (None when agent_send_policy == "open").
+    restricted_by: AgentSendRestrictedBy
 
 
 class Mailbox(TypedDict):
@@ -426,6 +449,18 @@ class Mailbox(TypedDict):
     # in allowlist mode permits a reply/follow-up to a visible inbound thread
     # participant without a standing grant.
     allow_thread_replies: bool
+    # Migration 096 — R3 agent-send-containment opt-out. When True (the default),
+    # an agent-key send on a native-blocklist mailbox is run through the
+    # allowlist + thread-participant gate. Strict no-op on native-allowlist.
+    agent_send_containment: bool
+    # Trusted-instruction-sources — per-mailbox master switch + strict-recipient
+    # policy. NotRequired for rollout tolerance (a pre-slice-6b server omits them).
+    instruction_trust_mode: NotRequired[Literal["disabled", "enabled"]]
+    instruction_trust_strict_recipient: NotRequired[bool]
+    # Single "agent sends" control — DERIVED from the two raw fields above.
+    agent_send_policy: AgentSendPolicy
+    # Why the agent is restricted (None when agent_send_policy == "open").
+    restricted_by: AgentSendRestrictedBy
     # PR 8.1 — per-detector redaction visibility. None = platform default
     # (all 13 detectors redact with `<TYPE>` placeholder). Populated value
     # is a partial map keyed by detector type; tier-gated Pro+ for any
@@ -467,6 +502,12 @@ class UpdateMailboxResponse(TypedDict):
     hitl_mode: HitlMode
     # Migration 085 — thread-scoped reply bypass flag.
     allow_thread_replies: bool
+    # Migration 096 — R3 agent-send-containment opt-out.
+    agent_send_containment: bool
+    # Single "agent sends" control — DERIVED from the two raw fields above.
+    agent_send_policy: AgentSendPolicy
+    # Why the agent is restricted (None when agent_send_policy == "open").
+    restricted_by: AgentSendRestrictedBy
     # PR 8.1 — per-detector redaction visibility (None = platform default).
     pii_redaction_config: PiiRedactionConfig | None
 
@@ -705,6 +746,8 @@ class MessageSummary(TypedDict, total=False):
     scan: NotRequired["ScanSummary | None"]
     # Phase 5 — inbound untrusted-body contract (present even on a clean scan); null/absent for outbound.
     agent_safety_context: NotRequired["AgentSafetyContext | None"]
+    # R5 — compact verified-sender signal {verdict}; None = not evaluated.
+    sender_authentication: NotRequired["SenderAuthenticationCompact | None"]
     # Migration 035 — may be `<REDACTED>` under mailbox pii_mode=redacted.
     subaddress_instance_id: Required[str | None]
     # Migration 047 — present (non-null) only on state='firewall_blocked'.
@@ -973,6 +1016,26 @@ class ScanSummary(TypedDict):
     findings: list[ScanFinding]
 
 
+class InstructionTrustBasis(TypedDict):
+    """Trusted-instruction-sources — thin BASIS metadata on a trusted-instruction
+    message (plan §4). Present ONLY when the customer designated this verified
+    sender as a trusted instruction source AND the reading credential is a
+    ``role='agent'`` key with the per-key capability enabled. Relaxation is
+    gated purely by operator server-side config (mailbox instruction-trust
+    mode + per-key capability + a live trusted-source grant) plus the
+    message's authenticity/scan state — there is no client-sent opt-in header
+    or constructor flag. The behavioural contract is in
+    ``AgentSafetyContext.guidance`` (REPLACED on a trusted message); this is
+    metadata only. ``untrusted_content`` stays True."""
+
+    version: Literal["v1"]
+    match: Literal["address"]
+    # Verified sender's domain; None under pii_mode=redacted.
+    verified_domain: str | None
+    verdict: Literal["verified_aligned"]
+    provenance: Literal["mailgun"]
+
+
 class AgentSafetyContext(TypedDict):
     """Top-level standing safety contract on inbound message reads + the
     ``message.received`` webhook. Present (untrusted_content=True) on every
@@ -981,6 +1044,41 @@ class AgentSafetyContext(TypedDict):
 
     untrusted_content: bool
     guidance: str
+    # Present ONLY on a trusted-instruction message (gate passed + opted-in
+    # credential). When present, ``guidance`` carries the trusted-message
+    # instruction; this is thin metadata, not the contract.
+    instruction_trust: NotRequired[InstructionTrustBasis]
+
+
+# R5 — verified-sender verdict. High-confidence DOMAIN authenticity, NOT
+# certainty: ``verified_aligned`` means the message genuinely originated from
+# its From domain (Mailgun DMARC pass + alignment); it does NOT prove the
+# person/account, lookalike-safety, or content-safety, and never relaxes the
+# inbound-untrusted contract. Tolerant reader: treat an unknown value as
+# unverified. ``None`` (the whole object) = not evaluated.
+SenderAuthVerdict = Literal[
+    "verified_aligned",
+    "authenticated_unaligned",
+    "failed",
+    "none",
+    "error",
+]
+
+
+class SenderAuthentication(TypedDict):
+    """Full verified-sender signal on the detail surface. ``from_domain`` +
+    ``signing_domain`` are nulled under ``pii_mode='redacted'``."""
+
+    verdict: SenderAuthVerdict
+    from_domain: str | None
+    signing_domain: str | None
+    provenance: Literal["mailgun", "self_hosted_imap"]
+
+
+class SenderAuthenticationCompact(TypedDict):
+    """Compact verified-sender signal on the list/wait surfaces."""
+
+    verdict: SenderAuthVerdict
 
 
 ScanView = Literal["summary", "verbose"]
@@ -1017,6 +1115,9 @@ class GetMessageResponse(TypedDict, total=False):
     attachments: Required[list[MessageAttachment]]
     scan: Required[ScanSummary | None]
     agent_safety_context: NotRequired["AgentSafetyContext | None"]
+    # R5 — full verified-sender signal; domains nulled under pii_mode=redacted;
+    # None = not evaluated.
+    sender_authentication: NotRequired["SenderAuthentication | None"]
     # Governed Email-Effect Contract v1 (Track 2). Outbound-only derived VIEW;
     # OMITTED (key absent) on inbound rows (which carry agent_safety_context) and
     # on never-sent / pre-dispatch-transient outbound rows.
@@ -1650,6 +1751,9 @@ class ApiKeySummary(TypedDict):
     mailbox_ids: list[str]
     created_at: str
     last_used_at: str | None
+    # Trusted-instruction-sources — the per-key opt-in capability (slice 6b).
+    # Only an agent key can hold it. NotRequired for rollout tolerance.
+    instruction_trust_enabled: NotRequired[bool]
 
 
 class ListApiKeysResponse(TypedDict):

{replylayer-0.21.0 → replylayer-0.22.0}/tests/test_async.py

@@ -233,6 +233,59 @@ async def test_async_mailboxes_create_with_self_hosted_imap_folder():
     await rl.aclose()
 
 
+# ── Single "agent sends" control — set_agent_send_policy body shape (async) ──
+# plans/agent-sends-policy-control-2026-06-26.md.
+
+
+@respx.mock
+@pytest.mark.asyncio
+async def test_async_set_agent_send_policy_sends_policy_alone_without_confirm():
+    """Async helper sends ONLY agent_send_policy when no confirm flag is passed."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    rl = async_sdk()
+    await rl.mailboxes.set_agent_send_policy("m1", "restricted")
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "restricted"}
+    assert "confirm_open_human_sends" not in payload
+    await rl.aclose()
+
+
+@respx.mock
+@pytest.mark.asyncio
+async def test_async_set_agent_send_policy_includes_confirm_only_when_true():
+    """Async helper forwards confirm_open_human_sends=True on the open-allowlist
+    confirmation path."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    rl = async_sdk()
+    await rl.mailboxes.set_agent_send_policy(
+        "m1", "open", confirm_open_human_sends=True,
+    )
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "open", "confirm_open_human_sends": True}
+    await rl.aclose()
+
+
+@respx.mock
+@pytest.mark.asyncio
+async def test_async_set_agent_send_policy_omits_confirm_when_false():
+    """A falsy confirm_open_human_sends does NOT add the flag to the async body."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    rl = async_sdk()
+    await rl.mailboxes.set_agent_send_policy(
+        "m1", "restricted", confirm_open_human_sends=False,
+    )
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "restricted"}
+    assert "confirm_open_human_sends" not in payload
+    await rl.aclose()
+
+
 @respx.mock
 @pytest.mark.asyncio
 async def test_async_mailboxes_set_attachment_access_posts_legacy_shape_without_unset_keys():

replylayer-0.22.0/tests/test_instruction_trust.py

@@ -0,0 +1,37 @@
+"""
+Python SDK — trusted-instruction-sources READ MIRROR.
+
+Design change (option 2): relaxation is gated purely by operator server-side
+config (mailbox instruction_trust_mode + per-key instruction_trust_enabled +
+a live trusted-source grant) plus the message's authenticity/scan state.
+There is no client-sent opt-in header or constructor flag anymore — the SDK
+only reads and types the ``instruction_trust`` basis the server may attach to
+``agent_safety_context`` on a response.
+"""
+
+from replylayer import InstructionTrustBasis
+
+
+def test_instruction_trust_basis_type_is_exported():
+    # The read-mirror type is part of the public surface (parity with the TS SDK).
+    basis: InstructionTrustBasis = {
+        "version": "v1",
+        "match": "address",
+        "verified_domain": "partner.com",
+        "verdict": "verified_aligned",
+        "provenance": "mailgun",
+    }
+    assert basis["verified_domain"] == "partner.com"
+
+
+def test_webhook_event_types_include_trusted_source():
+    # P2 drift pin — the SDK WebhookEventType mirror must carry the slice-4b
+    # trusted-source events (parity with shared/server), else typed callers
+    # cannot subscribe without casts.
+    import typing
+
+    from replylayer import WebhookEventType
+
+    members = set(typing.get_args(WebhookEventType))
+    assert "trusted_source.granted" in members
+    assert "trusted_source.revoked" in members

{replylayer-0.21.0 → replylayer-0.22.0}/tests/test_resources.py

@@ -550,6 +550,51 @@ def test_set_recipient_policy_passes_scanner_policy_when_provided():
     }
 
 
+# ── Single "agent sends" control — set_agent_send_policy body shape (sync) ──
+# plans/agent-sends-policy-control-2026-06-26.md.
+
+
+@respx.mock
+def test_set_agent_send_policy_sends_policy_alone_without_confirm():
+    """The convenience helper sends ONLY agent_send_policy when no confirm flag
+    is passed — confirm_open_human_sends must NOT ride along (default False)."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    sdk().mailboxes.set_agent_send_policy("m1", "restricted")
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "restricted"}
+    assert "confirm_open_human_sends" not in payload
+
+
+@respx.mock
+def test_set_agent_send_policy_includes_confirm_only_when_true():
+    """confirm_open_human_sends=True is forwarded; the consent flag rides along
+    only on the open-allowlist confirmation path."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    sdk().mailboxes.set_agent_send_policy(
+        "m1", "open", confirm_open_human_sends=True,
+    )
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "open", "confirm_open_human_sends": True}
+
+
+@respx.mock
+def test_set_agent_send_policy_omits_confirm_when_false():
+    """A falsy confirm_open_human_sends does NOT add the flag to the body."""
+    route = respx.patch(f"{BASE}/v1/mailboxes/m1").mock(
+        return_value=httpx.Response(200, json={"id": "m1", "name": "support"}),
+    )
+    sdk().mailboxes.set_agent_send_policy(
+        "m1", "restricted", confirm_open_human_sends=False,
+    )
+    payload = json.loads(route.calls[0].request.content)
+    assert payload == {"agent_send_policy": "restricted"}
+    assert "confirm_open_human_sends" not in payload
+
+
 # ── PR 8.1 — pii_redaction_config request forwarding (round-5 audit fix #3) ──