[AAASM-4014] 🐛 (sdk): Thread real interceptor through LangChain callback handler + fail-closed unknown

[Chisanan232]

What

Fixes AAASM-4014 [MED]: a LangChain co-install silently bypassed pre-execution governance for non-LangChain adapters, plus a related fail-open on unknown native decisions.

• Primary fix (adapters/langchain/callback_handler.py): AssemblyCallbackHandler now delegates missing attributes to its wrapped real interceptor via __getattr__. This routes check_tool_start, approval, timeout, and event entry points to genuine governance. Its explicit LangChain callback methods still take precedence, so LangChain's own dispatch is unaffected.
• Fail-closed unknown decision (core/runtime_interceptor.py): RuntimeQueryInterceptor.check_tool_start no longer defaults a missing/empty/unknown native decision to allow. Only allow/redact/unspecified are treated as authoritative allow; anything else routes through _on_query_failure (deny under enforce, proceed under observe).
• Defense-in-depth (crewai, pydantic_ai, llamaindex, haystack, google_adk, microsoft_agent_framework): the method-absent tool-check fallback now denies under enforce via a shared _missing_interceptor_decision helper instead of defaulting to {"status": "allow"}.

Why

When langchain is importable it registers first (registry priority 0) and core/assembly.py reassigns the governance interceptor to the AssemblyCallbackHandler, threading it to every subsequently-registered adapter. That handler exposed only the LangChain callback contract — no check_tool_start, no delegation — so adapters doing getattr(cbh, "check_tool_start", None) got None and fell back to allow, skipping pre-exec governance under enforce. Affected adapters: crewai, pydantic_ai, llamaindex, haystack, google_adk (and microsoft_agent_framework, same pattern). openai_agents and mcp already unwrap _interceptor and were unaffected.

Separately, the runtime interceptor defaulted an unrecognized native verdict to allow regardless of _enforce, an additional fail-open under enforce.

Reproduction

With langchain co-installed and enforcement enforce, register a non-LangChain adapter (e.g. crewai). A tool the runtime denies was allowed to run because the crewai patch's check_tool_start lookup on the threaded AssemblyCallbackHandler returned None. New test test_langchain_coinstall_denies_through_crewai_adapter reproduces this and asserts the tool is now denied.

How verified

• uv sync
• Full suite: .venv/bin/python -m pytest test/ → 740 passed, 15 skipped
• .venv/bin/mypy agent_assembly --ignore-missing-imports → clean
• Pre-commit gate (isort/autoflake/black/mypy) on changed files → all pass
• New tests: co-install deny-through-crewai, unknown/empty/missing decision deny-under-enforce (+ allow-under-observe), missing-interceptor fallback, callback-handler delegation, and no-recursion AttributeError.

Note: the UDS stat-then-connect TOCTOU in connect_runtime_client is advisory/low — SO_PEERCRED in aa-sdk-client is the authoritative check; not changed here.

Closes AAASM-4014

🤖 Generated with Claude Code

https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
80.8% Coverage on New Code
0.8% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 81.48148% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
agent_assembly/adapters/google_adk/patch.py	50.00%	1 Missing ⚠️
agent_assembly/adapters/haystack/patch.py	83.33%	1 Missing ⚠️
...nt_assembly/adapters/langchain/callback_handler.py	75.00%	1 Missing ⚠️
agent_assembly/adapters/llamaindex/patch.py	0.00%	1 Missing ⚠️
...sembly/adapters/microsoft_agent_framework/patch.py	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Chisanan232]

🤖 Claude Code review — approve

AAASM-4014 LangChain co-install bypass. Delegating __getattr__ on AssemblyCallbackHandler forwards missing attrs (incl. check_tool_start) to the wrapped _interceptor (with recursion guard) → non-LangChain adapters reach real governance. runtime_interceptor unknown/empty/missing decision → deny under enforce; method-absent fallback denies under enforce across crewai/pydantic_ai/llamaindex/haystack/google_adk/msaf. 740 pass incl. reproduce-then-fix.

Note: codecov/patch red = coverage-delta acceptance gate only — ignorable per policy.

[Chisanan232]

🤖 Claude Code — deep review: APPROVE (merge-ready)

CI: green except codecov/patch (acceptance-only). Scope: complete — delegating __getattr__ on AssemblyCallbackHandler (+ recursion guard) routes missing check_tool_start to the real _interceptor; runtime_interceptor unknown/empty/missing→deny under enforce; method-absent fallback denies under enforce across crewai/pydantic_ai/llamaindex/haystack/google_adk/msaf. openai_agents/mcp correctly untouched (already unwrap _interceptor).

Side-effects (regression check): the __getattr__ does NOT disturb the LangChain contract — BaseCallbackHandler defines every on_*/ignore_*/raise_error concretely on the class, so __getattr__ never fires for them (dispatch + ignore-flags unaffected); explicit callbacks shadow the base; enforce-detection uses is True so a synthesized-truthy stub can't fake enforce. Unknown→deny preserves observe-mode allow (tested). 740 pass, no prior flow expected allow. No regression.\n\nNon-blocking follow-up: langchain_core is NOT a test dep, so the __getattr__-vs-real-LangChain-base contract safety is argued, not CI-tested — add a langchain-installed test asserting ignore/dispatch resolve to the base and a co-installed crewai check denies end-to-end.