Repository navigation
Python: agent-hooks tool-seam halt keys on the host_error: prefix, catching composition-produced denies #7561
Description
The agent-hooks feature halts the run when a tool-seam deny carries a host_error:* reason (enforcement-layer failure — correct). But the check keys on the reason prefix, so it also fires for composition-produced denies like host_error:transform_conflict and host_error:composition_disagreement, which are policy outcomes of the configured profile rather than enforcement-layer failures — arguably those should follow the ordinary tool-deny path (reason-only error to the model, loop continues). Worth deciding deliberately either way; found during conformance cross-validation (responsibleai/agent-hooks conformance/claims/maf/REPORT.md).
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
eavanvalkenburg commentedon Nov 3, 2026
We will consider a core MAF refinement that distinguishes composition-policy denials from enforcement failures at the tool seams.
The existing ordinary tool-deny path already lets the agent continue with a tool error. The question is whether composition-generated reasons should use that path while actual enforcement failures still halt the run. This needs an agreed reason taxonomy and conformance/compatibility review before changing the current documented terminate posture. We are not committing to implementation or timing.
eavanvalkenburg commentedon Nov 3, 2026
/plan Investigate the core-accepted distinction between composition-policy denials and enforcement failures at the tool seams without weakening fail-closed enforcement.
Current main intentionally treats every
host_error:*tool-seam deny as terminal._agent_hooks.pydocuments this,_is_host_errorchecks the prefix,_maybe_haltraises the fatal tool-seam signal, and the declaration surface advertises/requirestool_seam_host_error: terminate. This is a policy/conformance change, not a confirmed tiny prefix bug.Determine the authoritative agent-hooks reason taxonomy and any structured provenance available for
host_error:transform_conflictandhost_error:composition_disagreement. Establish which are genuine configured-policy outcomes versus failed enforcement before choosing an implementation. Coordinate the shared contract rather than inventing Python-only string exceptions or treating all host errors as recoverable.Compare the smallest compatible integration change using the existing ordinary tool-deny result path. Preserve terminal handling for interceptor crashes/timeouts, invalid contexts, emitter/projection failures and unknown failures whose enforcement status cannot be established. Decide how the advertised declaration posture and any compatibility guidance must describe the refined behavior; do not silently accept the spec's continue posture while the implementation advertises terminate.
Define focused streaming/non-streaming regressions for pre/post-tool denials, both composition reasons, genuine enforcement failures, parallel and queued calls, cancellation, discarded tool results, caller-visible errors, and the unchanged buffered output/history gates. Do not promise exactly-once tool effects.
The issue remains a non-trivial design investigation with its existing assignee. Core consideration is not approval of a particular API, reason allowlist, implementation or release date; keep implementation readiness deferred.