trustmodel 3.3.2__tar.gz → 3.4.0__tar.gz

{trustmodel-3.3.2 → trustmodel-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustmodel
-Version: 3.3.2
+Version: 3.4.0
 Summary: Official Python SDK for TrustModel AI evaluation platform
 Project-URL: Homepage, https://trustmodel.ai
 Author-email: TrustModel <info@predixtions.com>

{trustmodel-3.3.2 → trustmodel-3.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trustmodel"
-version = "3.3.2"
+version = "3.4.0"
 authors = [
     {name = "TrustModel", email = "info@predixtions.com"},
 ]

{trustmodel-3.3.2 → trustmodel-3.4.0}/src/trustmodel/endpoints/agentcert.py

@@ -102,6 +102,7 @@ class AgentCertEndpoint:
         subject_agent_id: Optional[str] = None,
         auditor_slug: Optional[str] = None,
         validity_days: Optional[int] = None,
+        validation_level: Optional[str] = None,
     ) -> AgentCertificate:
         """Mint a new AgentCert from a completed evaluation run.
 
@@ -114,13 +115,24 @@ class AgentCertEndpoint:
         RAG corpus runs are rejected with a stable 400 error code so callers
         can route the user back to picking a compatible run.
 
+        **Validation tiers (TRUS-1673):** ``validation_level="DV"`` (default,
+        free) or ``"OV"`` (paid — requires the org to have OV entitlement in
+        the Marketplace plan AND the ``ans_name`` to be organization-validated
+        (``assurance_tier=OV``) in the ANS registry). Callers who omit the
+        kwarg get DV — byte-identical to pre-1673 behaviour. OV rejection
+        surfaces as one of three stable error codes that map to typed
+        exceptions (see ``Raises``).
+
         Args:
             ans_name: Agent Naming Service binding (e.g. ``helpbot.cisco.com``).
             evaluation_run_id: Source eval run id (must belong to the org).
             subject_agent_id: Optional agent identifier; derived from the eval
                 when omitted.
             auditor_slug: Optional auditor to link the cert to.
-            validity_days: Optional cert lifetime (1–825); backend default 90.
+            validity_days: Optional cert lifetime (1–825); backend picks a
+                per-tier default when omitted (DV=90, OV=365).
+            validation_level: Optional cert tier — ``"DV"`` (default) or
+                ``"OV"``. Omit for DV. See TRUS-1673.
 
         Returns:
             The minted :class:`AgentCertificate`.
@@ -133,8 +145,14 @@ class AgentCertEndpoint:
                 ``status=completed`` yet. Subclass of :class:`APIError`.
             EvaluationNotFoundError: run id isn't visible in the caller's
                 org (or doesn't exist). Subclass of :class:`APIError`.
-            APIError: any other non-2xx (e.g. 400 issuance_failed,
-                500 internal_issuance_error, 429).
+            APIError: any other non-2xx. TRUS-1673 introduces three new stable
+                codes for OV rejection surfaced on ``exc.error_code``:
+                ``unentitled_for_ov`` (403 — org's plan doesn't include OV),
+                ``validation_required`` (403 — ans_name isn't
+                ``assurance_tier=OV``), ``assurance_lookup_failed`` (502 —
+                ans-registry unreachable, retriable). Also
+                ``cannot_downgrade_active_cert`` (400) when re-minting at DV
+                over an existing active OV cert.
         """
         if not ans_name:
             raise ValueError("agentcert.issue(): `ans_name` is required")
@@ -148,6 +166,11 @@ class AgentCertEndpoint:
             data["auditor_slug"] = auditor_slug
         if validity_days is not None:
             data["validity_days"] = validity_days
+        # TRUS-1673 — send ``validation_level`` on the wire only when the
+        # caller opts in. Omitting matches pre-1673 wire body byte-for-byte,
+        # so the BE default (DV) applies and existing callers see no change.
+        if validation_level is not None:
+            data["validation_level"] = validation_level
 
         try:
             response = self._client.post(_ISSUE_PATH, data=data)