feat(policy): expose decisions in invoke results#492
Open
Subhasish1802 wants to merge 2 commits into
Open
Conversation
Signed-off-by: Subhasish1802 <subhasish1802@gmail.com>
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 15:43 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 15:43 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 15:43 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThe PR adds typed policy decision models and observability helpers, records decisions across policy enactment, HITL approval, CugaLite, and supervisor delegation flows, propagates them through graph state, and exposes them on SDK ChangesPolicy decision observability
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant SDKClient
participant CugaAgent
participant PolicyEnactment
participant ToolApprovalHandler
participant AgentState
SDKClient->>CugaAgent: invoke request
CugaAgent->>PolicyEnactment: check and enact policies
PolicyEnactment->>AgentState: append policy decisions
CugaAgent->>ToolApprovalHandler: process tool approval
ToolApprovalHandler->>AgentState: append approval outcome
AgentState-->>CugaAgent: serialized policy decisions
CugaAgent-->>SDKClient: InvokeResult with policy_decisions
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Subhasish1802
marked this pull request as ready for review
July 14, 2026 15:51
coderabbitai
Bot
added
complexity: medium
Author
|
Hi @sami-marreed , the external fork workflows are currently awaiting maintainer approval. Could you approve them when convenient? Thanks! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/cuga/sdk.py (1)
2728-2734: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winReset
policy_decisionsto prevent cross-turn leakage during streaming.The normal invocation path (in
CugaAgent.invoke) explicitly resetspolicy_decisionsto an empty list on new turns so the results strictly reflect the current request. However,CugaAgent.streamomits this reset when creating the initial state dictionary.When resuming or starting a new turn on an existing thread, LangGraph will merge this
initial_statewith the checkpoint. Without an explicit reset, the agent will inherit and leak policy decisions from previous turns.🐛 Proposed fix to align state construction
# Create initial state for HITL wrapper graph (uses AgentState format) initial_state = { "chat_messages": messages, "thread_id": thread_id, "input": messages[-1].content if messages else "", "url": "", # Required by AgentState (used for web navigation, empty for SDK) + "policy_decisions": [], }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/cuga/sdk.py` around lines 2728 - 2734, Update the initial_state construction in CugaAgent.stream to include policy_decisions initialized to an empty list, matching the reset performed by CugaAgent.invoke. Ensure this explicit value overwrites checkpointed decisions when starting or resuming a turn.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/cuga/backend/cuga_graph/nodes/cuga_lite/adapter/prepare_node.py`:
- Around line 648-650: Update the policy_decisions serialization in the relevant
node to call serialize_policy_decisions instead of invoking decision.model_dump
directly, preserving safe handling of checkpoint-restored dictionaries and model
instances. Import serialize_policy_decisions from
cuga.backend.cuga_graph.policy.observability if needed.
---
Outside diff comments:
In `@src/cuga/sdk.py`:
- Around line 2728-2734: Update the initial_state construction in
CugaAgent.stream to include policy_decisions initialized to an empty list,
matching the reset performed by CugaAgent.invoke. Ensure this explicit value
overwrites checkpointed decisions when starting or resuming a turn.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4ec0bbb6-d225-4ef3-b9a4-5b425eb2719a
📒 Files selected for processing (20)
src/cuga/__init__.pysrc/cuga/backend/cuga_graph/nodes/cuga_agent_core/policy/tool_approval_handler.pysrc/cuga/backend/cuga_graph/nodes/cuga_agent_core/tests/policy/test_policy_enactment_adapter.pysrc/cuga/backend/cuga_graph/nodes/cuga_agent_core/tests/policy/test_tool_approval_adapter.pysrc/cuga/backend/cuga_graph/nodes/cuga_lite/adapter/prepare_node.pysrc/cuga/backend/cuga_graph/nodes/cuga_lite/cuga_lite_graph.pysrc/cuga/backend/cuga_graph/nodes/cuga_lite/cuga_lite_node.pysrc/cuga/backend/cuga_graph/nodes/cuga_supervisor/cuga_supervisor_node.pysrc/cuga/backend/cuga_graph/nodes/cuga_supervisor/nodes/execute_agent_tool.pysrc/cuga/backend/cuga_graph/nodes/cuga_supervisor/nodes/prepare_agents_and_prompt.pysrc/cuga/backend/cuga_graph/nodes/cuga_supervisor/supervisor_graph_adapter.pysrc/cuga/backend/cuga_graph/nodes/cuga_supervisor/tests/test_delegation_recording.pysrc/cuga/backend/cuga_graph/policy/__init__.pysrc/cuga/backend/cuga_graph/policy/enactment.pysrc/cuga/backend/cuga_graph/policy/models.pysrc/cuga/backend/cuga_graph/policy/observability.pysrc/cuga/backend/cuga_graph/policy/tests/test_policy_observability.pysrc/cuga/backend/cuga_graph/state/agent_state.pysrc/cuga/sdk.pysrc/cuga/sdk_core/tests/test_invoke_result_policy_decisions.py
Signed-off-by: Subhasish1802 <subhasish1802@gmail.com>
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 16:03 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 16:03 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
Subhasish1802
requested a deployment
to
external-testing
July 14, 2026 16:03 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
coderabbitai
Bot
added
complexity: high
Author
|
Hi @sami-marreed and @offerakrabi, gentle follow-up on PR #492. The three external-fork workflows are still awaiting maintainer approval. The CodeRabbit finding has been addressed, Ruff passes, and the expanded local test suite reports 49 passed. When convenient, could you approve the pending workflows so CI can run? If you have any questions about the implementation, please contact me at subhasish1802@gmail.com. Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature
Closes #491
Related to #382
Summary
InvokeResultfor normal and HITL SDK paths.policy_decisionsto an empty list.Testing
uv run ruff formatuv run ruff checkSummary by CodeRabbit
policy_decisionsto agent and supervisor invocation results, including policy identity, stage, and outcome (with optional tool/agent context).