trustmodel 3.3.2__tar.gz → 3.4.1__tar.gz

{trustmodel-3.3.2 → trustmodel-3.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustmodel
-Version: 3.3.2
+Version: 3.4.1
 Summary: Official Python SDK for TrustModel AI evaluation platform
 Project-URL: Homepage, https://trustmodel.ai
 Author-email: TrustModel <info@predixtions.com>

{trustmodel-3.3.2 → trustmodel-3.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trustmodel"
-version = "3.3.2"
+version = "3.4.1"
 authors = [
     {name = "TrustModel", email = "info@predixtions.com"},
 ]

{trustmodel-3.3.2 → trustmodel-3.4.1}/src/trustmodel/endpoints/agentcert.py

@@ -102,6 +102,7 @@ class AgentCertEndpoint:
         subject_agent_id: Optional[str] = None,
         auditor_slug: Optional[str] = None,
         validity_days: Optional[int] = None,
+        validation_level: Optional[str] = None,
     ) -> AgentCertificate:
         """Mint a new AgentCert from a completed evaluation run.
 
@@ -114,13 +115,24 @@ class AgentCertEndpoint:
         RAG corpus runs are rejected with a stable 400 error code so callers
         can route the user back to picking a compatible run.
 
+        **Validation tiers (TRUS-1673):** ``validation_level="DV"`` (default,
+        free) or ``"OV"`` (paid — requires the org to have OV entitlement in
+        the Marketplace plan AND the ``ans_name`` to be organization-validated
+        (``assurance_tier=OV``) in the ANS registry). Callers who omit the
+        kwarg get DV — byte-identical to pre-1673 behaviour. OV rejection
+        surfaces as one of three stable error codes that map to typed
+        exceptions (see ``Raises``).
+
         Args:
             ans_name: Agent Naming Service binding (e.g. ``helpbot.cisco.com``).
             evaluation_run_id: Source eval run id (must belong to the org).
             subject_agent_id: Optional agent identifier; derived from the eval
                 when omitted.
             auditor_slug: Optional auditor to link the cert to.
-            validity_days: Optional cert lifetime (1–825); backend default 90.
+            validity_days: Optional cert lifetime (1–825); backend picks a
+                per-tier default when omitted (DV=90, OV=365).
+            validation_level: Optional cert tier — ``"DV"`` (default) or
+                ``"OV"``. Omit for DV. See TRUS-1673.
 
         Returns:
             The minted :class:`AgentCertificate`.
@@ -133,8 +145,14 @@ class AgentCertEndpoint:
                 ``status=completed`` yet. Subclass of :class:`APIError`.
             EvaluationNotFoundError: run id isn't visible in the caller's
                 org (or doesn't exist). Subclass of :class:`APIError`.
-            APIError: any other non-2xx (e.g. 400 issuance_failed,
-                500 internal_issuance_error, 429).
+            APIError: any other non-2xx. TRUS-1673 introduces three new stable
+                codes for OV rejection surfaced on ``exc.error_code``:
+                ``unentitled_for_ov`` (403 — org's plan doesn't include OV),
+                ``validation_required`` (403 — ans_name isn't
+                ``assurance_tier=OV``), ``assurance_lookup_failed`` (502 —
+                ans-registry unreachable, retriable). Also
+                ``cannot_downgrade_active_cert`` (400) when re-minting at DV
+                over an existing active OV cert.
         """
         if not ans_name:
             raise ValueError("agentcert.issue(): `ans_name` is required")
@@ -148,6 +166,11 @@ class AgentCertEndpoint:
             data["auditor_slug"] = auditor_slug
         if validity_days is not None:
             data["validity_days"] = validity_days
+        # TRUS-1673 — send ``validation_level`` on the wire only when the
+        # caller opts in. Omitting matches pre-1673 wire body byte-for-byte,
+        # so the BE default (DV) applies and existing callers see no change.
+        if validation_level is not None:
+            data["validation_level"] = validation_level
 
         try:
             response = self._client.post(_ISSUE_PATH, data=data)

{trustmodel-3.3.2 → trustmodel-3.4.1}/src/trustmodel/endpoints/guardrails.py

@@ -254,6 +254,7 @@ class GuardrailsEndpoint:
                     subject=subject,
                     subject_attrs=dict(subject_attrs) if subject_attrs else None,
                     agent_id=agent_id,
+                    policy_name=resolved_policy_name,
                 )
                 raw = edge.post("/v1/decide", body, timeout=_EDGE_TIMEOUT_SECONDS)
                 return _decision_from_edge(raw)
@@ -325,8 +326,15 @@ def _build_edge_body(
     subject: Optional[str],
     subject_attrs: Optional[Dict[str, Any]],
     agent_id: Optional[str],
+    policy_name: str,
 ) -> Dict[str, Any]:
-    body: Dict[str, Any] = {"tool": tool, "args": args}
+    # TRUS-1715 — ``policy_name`` was missing from the Edge body pre-3.4.1.
+    # ``decide()`` validated the kwarg at the entry point and then silently
+    # discarded the value here, so Edge resolved against its fallback policy
+    # (``default``) regardless of what the caller asked for. Aurora carried
+    # it correctly on the parallel builder, so cross-transport parity was
+    # broken. Reported by Praga @ xspan against SDK 3.3.x.
+    body: Dict[str, Any] = {"tool": tool, "args": args, "policy_name": policy_name}
     if subject is not None:
         body["subject"] = subject
     if subject_attrs is not None: