trustmodel 3.3.0__tar.gz → 3.3.2__tar.gz

{trustmodel-3.3.0 → trustmodel-3.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustmodel
-Version: 3.3.0
+Version: 3.3.2
 Summary: Official Python SDK for TrustModel AI evaluation platform
 Project-URL: Homepage, https://trustmodel.ai
 Author-email: TrustModel <info@predixtions.com>

{trustmodel-3.3.0 → trustmodel-3.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trustmodel"
-version = "3.3.0"
+version = "3.3.2"
 authors = [
     {name = "TrustModel", email = "info@predixtions.com"},
 ]

{trustmodel-3.3.0 → trustmodel-3.3.2}/src/trustmodel/__init__.py

@@ -16,10 +16,13 @@ except ImportError:
 
 from .client import TrustModelClient
 from .exceptions import (
+    AgentCertInvalidRunTypeError,
+    AgentCertRunNotCompletedError,
     APIError,
     AuthenticationError,
     ConnectionValidationError,
     EdgeUnreachableError,
+    EvaluationNotFoundError,
     InsufficientCreditsError,
     RateLimitError,
     TrustModelError,
@@ -60,6 +63,9 @@ __all__ = [
     "InsufficientCreditsError",
     "ConnectionValidationError",
     "EdgeUnreachableError",
+    "EvaluationNotFoundError",
+    "AgentCertInvalidRunTypeError",
+    "AgentCertRunNotCompletedError",
     "Decision",
     "OAuthClientCredentials",
     "PKCEAuthorizationCode",

{trustmodel-3.3.0 → trustmodel-3.3.2}/src/trustmodel/endpoints/agentcert.py

@@ -18,9 +18,14 @@ Contract: agentcert/docs/api-v0.md. Ticket: TRUS-1228 (EPIC TRUS-1219).
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Optional, Tuple
-
-from ..exceptions import APIError
+from typing import TYPE_CHECKING, Any, Optional, Tuple
+
+from ..exceptions import (
+    AgentCertInvalidRunTypeError,
+    AgentCertRunNotCompletedError,
+    APIError,
+    EvaluationNotFoundError,
+)
 from ..models.agentcert import AgentCertificate, AgentCertVerification
 
 if TYPE_CHECKING:
@@ -37,6 +42,51 @@ _VERIFY_PATH = "/v1/verify/{agent}/"
 # a legitimate "not found" answer, surfaced as a result, not an exception.
 _NOT_FOUND_STATUS = 404
 
+# TRUS-1643 — mint 400 error codes → typed exception class. Two body
+# shapes exist in the wild:
+#   1. Legacy handler-emitted: ``{"error": "...", "code": "issuance_failed"}``
+#      (from ``AgentCertView`` catching ``IssuanceError``).
+#   2. DRF ValidationError-emitted (TRUS-1643): field-level shape —
+#      ``{"evaluation_run_id": ["..."], "code": ["invalid_run_type_for_agentcert"]}``.
+# The gateway ``code`` is either a plain string or a single-element list;
+# ``_extract_error_code`` normalises to a plain string so callers get a
+# stable typed exception either way.
+_MINT_ERROR_CODE_TO_EXC = {
+    "invalid_run_type_for_agentcert": AgentCertInvalidRunTypeError,
+    "run_not_completed_for_agentcert": AgentCertRunNotCompletedError,
+    "evaluation_run_not_found": EvaluationNotFoundError,
+}
+
+
+def _extract_error_code(exc: APIError) -> Optional[str]:
+    """Return the machine-parseable ``code`` from a mint 400 body, or None.
+
+    Handles both the legacy flat ``code`` string and the DRF-serializer
+    flattened ``code`` list. Falls back to ``exc.response`` when the
+    client-level ``exc.error_code`` didn't preserve the list shape.
+
+    Edge cases that intentionally return ``None`` (caller must fall
+    through to raising the plain ``APIError``):
+      * empty string ``""`` — degenerate legacy body
+      * ``[""]`` — degenerate DRF body
+      * ``[]`` / non-string first element — malformed body
+    None of the ``_MINT_ERROR_CODE_TO_EXC`` keys are empty, so a ``""``
+    lookup misses the routing table and falls through anyway.
+    """
+    # ``raw`` is typed ``Any`` because the two source shapes disagree:
+    # ``APIError.error_code`` is declared ``Optional[str]`` (legacy handler
+    # shape), but the DRF ValidationError body arrives with ``code`` as a
+    # single-element list. Both survive here — the isinstance checks below
+    # narrow at runtime.
+    raw: Any = exc.error_code
+    if raw is None and isinstance(exc.response, dict):
+        raw = exc.response.get("code")
+    if isinstance(raw, str) and raw:
+        return raw
+    if isinstance(raw, list) and raw and isinstance(raw[0], str):
+        return raw[0]
+    return None
+
 
 class AgentCertEndpoint:
     """Issue, verify, and certify AgentCerts. Mounted as ``client.agentcert``."""
@@ -58,6 +108,12 @@ class AgentCertEndpoint:
         Calls ``POST /sdk/v1/agentcert/issue/`` (the API-key-authed wrapper).
         The org is derived from the API key server-side.
 
+        **Eligible run types (TRUS-1643):** the eval run must be an
+        ``agent-evaluation-run`` or ``agentic-trace-run`` in ``completed``
+        status. Standard model evals, leaderboard runs, data-scan runs, and
+        RAG corpus runs are rejected with a stable 400 error code so callers
+        can route the user back to picking a compatible run.
+
         Args:
             ans_name: Agent Naming Service binding (e.g. ``helpbot.cisco.com``).
             evaluation_run_id: Source eval run id (must belong to the org).
@@ -71,7 +127,14 @@ class AgentCertEndpoint:
 
         Raises:
             ValueError: ``ans_name`` or ``evaluation_run_id`` missing.
-            APIError: e.g. 400 issuance failed, 404 eval run not found/owned.
+            AgentCertInvalidRunTypeError: run's ``run_type`` isn't eligible
+                (TRUS-1643 — see the note above). Subclass of :class:`APIError`.
+            AgentCertRunNotCompletedError: run exists but hasn't reached
+                ``status=completed`` yet. Subclass of :class:`APIError`.
+            EvaluationNotFoundError: run id isn't visible in the caller's
+                org (or doesn't exist). Subclass of :class:`APIError`.
+            APIError: any other non-2xx (e.g. 400 issuance_failed,
+                500 internal_issuance_error, 429).
         """
         if not ans_name:
             raise ValueError("agentcert.issue(): `ans_name` is required")
@@ -86,7 +149,22 @@ class AgentCertEndpoint:
         if validity_days is not None:
             data["validity_days"] = validity_days
 
-        response = self._client.post(_ISSUE_PATH, data=data)
+        try:
+            response = self._client.post(_ISSUE_PATH, data=data)
+        except APIError as exc:
+            code = _extract_error_code(exc)
+            # ``exc_class`` (was ``typed`` — shadowed the ``typing`` module
+            # name and read poorly at a glance). None-safe: unknown / empty
+            # codes miss the routing table and fall through to ``raise``.
+            exc_class = _MINT_ERROR_CODE_TO_EXC.get(code or "")
+            if exc_class is not None:
+                raise exc_class(
+                    exc.message,
+                    status_code=exc.status_code,
+                    response=exc.response,
+                    error_code=code,
+                ) from exc
+            raise
         return AgentCertificate(**response)
 
     def verify(self, agent: str) -> AgentCertVerification:

{trustmodel-3.3.0 → trustmodel-3.3.2}/src/trustmodel/endpoints/agentic.py

@@ -115,6 +115,7 @@ class AgenticEndpoint:
         goal_achieved: Optional[bool] = None,
         frameworks: Optional[List[str]] = None,
         control_ids: Optional[List[str]] = None,
+        governed_agent: Optional[str] = None,
     ) -> AgenticEvaluation:
         """
         Evaluate an agent execution trace.
@@ -136,6 +137,13 @@ class AgenticEndpoint:
             control_ids: Optional list of control IDs to scope the compliance
                 evaluation. Defaults server-side to all controls of the
                 selected frameworks.
+            governed_agent: Optional GovernedAgent slug OR UUID to bind this
+                run to (TRUS-1640). When supplied, the resulting
+                ``ReportEvaluationRun`` is stamped with the FK so the agent's
+                badge / TrustScore history picks up this run. Must belong to
+                the caller's organization or the server returns HTTP 400
+                ``governed_agent_not_found``. When omitted, the run lands
+                standalone (pre-TRUS-1640 behavior).
 
         Returns:
             Evaluation creation response with run ID and status.
@@ -227,6 +235,11 @@ class AgenticEndpoint:
             eval_data["frameworks"] = frameworks
         if control_ids:
             eval_data["control_ids"] = control_ids
+        # TRUS-1640 — SDK peer of aurora-gateway PR #512. The BE resolves the
+        # supplied slug/UUID to a GovernedAgent and stamps the FK on create;
+        # omit when None so pre-1640 behavior (standalone runs) is preserved.
+        if governed_agent:
+            eval_data["governed_agent"] = governed_agent
 
         response = self._client.post("/sdk/v1/agentic/evaluate/", data=eval_data)
 

{trustmodel-3.3.0 → trustmodel-3.3.2}/src/trustmodel/exceptions.py

@@ -71,7 +71,38 @@ class ModelNotFoundError(APIError):
 
 
 class EvaluationNotFoundError(APIError):
-    """Raised when a requested evaluation is not found."""
+    """Raised when a requested evaluation is not found.
+
+    TRUS-1643: also raised by ``client.agentcert.issue()`` when the mint
+    endpoint returns 400 with ``code=evaluation_run_not_found`` (i.e. the
+    run id exists globally but not in the caller's org).
+    """
+
+    pass
+
+
+class AgentCertInvalidRunTypeError(APIError):
+    """Raised when ``client.agentcert.issue()`` targets a run whose ``run_type``
+    is not certifiable as an agent (TRUS-1643).
+
+    Only ``agent-evaluation-run`` and ``agentic-trace-run`` are accepted by
+    the mint endpoint; ``standard-run`` / ``leaderboard-run`` /
+    ``data-scan-run`` / ``rag-corpus-run`` all raise this error. Callers
+    should catch this to surface a "pick an Agent Evaluation run"
+    message rather than a generic 400.
+    """
+
+    pass
+
+
+class AgentCertRunNotCompletedError(APIError):
+    """Raised when ``client.agentcert.issue()`` targets an eval run that has
+    not reached ``status=completed`` yet (TRUS-1643).
+
+    The mint endpoint requires a terminal-successful run so the score
+    snapshot is stable. Callers should wait for the run to complete (or
+    poll) before retrying.
+    """
 
     pass