fix(llamaindex): observe per-run FunctionAgent tool requests #42

Workflow file for this run

.github/workflows/trace-adapters-tests.yml at 70d3bfa

	name: trace-adapters tests

	on:
	pull_request:
	paths:
	- "packages/agentrust-trace-adapters/**"
	- "integrations/decisionassure/**"
	- "integrations/otel-genai/**"
	- "integrations/langchain/**"
	- "integrations/llamaindex/**"
	- "integrations/google-adk/**"
	- "integrations/openshell/**"
	- "integrations/openai-agents/**"
	- ".github/workflows/trace-adapters-tests.yml"
	push:
	branches: [main]
	paths:
	- "packages/agentrust-trace-adapters/**"
	- "integrations/decisionassure/**"
	- "integrations/otel-genai/**"
	- "integrations/langchain/**"
	- "integrations/llamaindex/**"
	- "integrations/google-adk/**"
	- "integrations/openshell/**"
	- "integrations/openai-agents/**"
	- ".github/workflows/trace-adapters-tests.yml"

	permissions:
	contents: read

	jobs:
	unit:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.11", "3.12", "3.13"]
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: ${{ matrix.python-version }}
	- name: Test against the released TRACE model
	working-directory: packages/agentrust-trace-adapters
	run: \|
	pip install pytest .
	python -m pytest tests -q

	# The job that would have caught the defect this package was written to prevent.
	# The adapter it replaces emitted records failing TrustRecord validation on seven
	# counts, and nothing here validated its output.
	adapter-output-validates:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Build a record with the DecisionAssure adapter and validate it
	run: \|
	pip install ./packages/agentrust-trace-adapters
	python - <<'PY'
	import importlib.util, json
	from agentrust_trace.models import TrustRecord

	spec = importlib.util.spec_from_file_location(
	"da", "integrations/decisionassure/da_to_trace.py"
	)
	da = importlib.util.module_from_spec(spec)
	spec.loader.exec_module(da)

	record = da.map_trace(
	{"trace_id": "t-1", "final_decision": "ALLOW",
	"steps": [{"tool": "pay"}], "data_class": "pii"},
	subject="spiffe://example.org/agent/da-1",
	policy_bundle=b'{"rules":["deny-egress"]}',
	workload_digest="sha256:" + "c" * 64,
	jwk={"kty": "OKP", "crv": "Ed25519",
	"x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"},
	model_provider="anthropic", model_id="claude-sonnet-4-6",
	)
	parsed = TrustRecord.model_validate(record)

	# The three signals the downgrade rests on. A refactor that made any of
	# them settable would pass the schema and lose the argument.
	assert parsed.runtime.platform == "software-only", parsed.runtime.platform
	assert parsed.appraisal.status == "none", parsed.appraisal.status
	assert parsed.origin and parsed.origin.kind == "third-party-control-plane"
	assert "transparency" not in record, "unanchored records omit transparency"
	print(json.dumps(record, indent=2))
	PY

	otel-genai-adapter:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test the OTel GenAI adapter
	run: \|
	pip install ./packages/agentrust-trace-adapters pytest
	python -m pytest integrations/otel-genai/test_otel_to_trace.py -q

	# Pydantic AI needs no adapter of its own: it instruments through
	# OpenTelemetry and emits the GenAI conventions this adapter already maps.
	# Verified against the released package rather than asserted (issue #96).
	- name: Test released Pydantic AI coverage
	run: \|
	pip install "pydantic-ai-slim==2.35.1" "opentelemetry-sdk>=1.25"
	python -m pytest integrations/otel-genai/test_pydantic_ai_interop.py -q

	openshell-adapter:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test OpenShell evidence mapping against released TRACE
	run: \|
	pip install ./packages/agentrust-trace-adapters pytest
	python -m pytest packages/agentrust-trace-adapters/tests/test_openshell.py integrations/openshell/test_demo.py -q
	python integrations/openshell/demo/build_signed_record.py --output /tmp/signed-record.json

	langchain-adapter:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test evidence rules without framework extras
	run: \|
	# Keep the record builder and honesty rules usable without installing
	# an agent framework. Framework interoperability is a separate gate.
	pip install "agentrust-trace>=0.9" pytest
	python -m pytest \
	integrations/langchain/test_langchain_to_trace.py \
	integrations/llamaindex/test_llamaindex_to_trace.py \
	-q
	- name: Test released LangChain and LangGraph interoperability
	run: \|
	pip install "langchain-core==1.6.0" "langgraph==1.2.11"
	python -m pytest integrations/langchain/test_langgraph_interop.py -q

	llamaindex-workflow-adapter:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test released FunctionAgent workflow observation
	run: \|
	pip install -r integrations/llamaindex/requirements-interop.txt
	python -m pytest integrations/llamaindex -q

	openai-agents-adapter:
	# Two passes, on purpose. The first proves record construction and the
	# honesty rules work without the SDK installed; the second runs a real
	# released agent, which is what catches a renamed span field before it
	# silently empties a transcript.
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test the record rules without the SDK
	run: \|
	pip install "agentrust-trace==0.9.0" pytest
	python -m pytest integrations/openai-agents/test_openai_agents_to_trace.py -q
	- name: Test released OpenAI Agents SDK interoperability
	run: \|
	pip install "openai-agents==0.22.0"
	python -m pytest integrations/openai-agents -q

	google-adk-adapter:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Test evidence rules without Google ADK
	run: \|
	pip install "agentrust-trace==0.9.0" pytest
	python -m pytest integrations/google-adk/test_google_adk_to_trace.py -q
	- name: Test released Google ADK interoperability and evidence rules
	run: \|
	pip install "google-adk==2.7.1" "agentrust-trace-tests==0.5.0"
	python -m pytest \
	integrations/google-adk/test_google_adk_to_trace.py \
	integrations/google-adk/test_google_adk_interop.py \
	-q

Navigation Menu

Uh oh!

fix(llamaindex): observe per-run FunctionAgent tool requests #42

Workflow file

fix(llamaindex): observe per-run FunctionAgent tool requests #42

Uh oh!

Workflow file for this run