examples(bank-support): replace AIEWF demo with two realistic-baseline behaviors

.github/workflows/regression.yml

@@ -35,6 +35,9 @@ on:
       - 'examples/incident_triage_agent/**'
       - 'examples/langgraph-foundry-hosted/**'
       - 'examples/agents/**'
+      - 'examples/bank_manager_agent_control/**'
+      - 'talks/aiewf-18min/**'
+      - 'talks/README.md'
       - 'docs/case-study-*.md'
 
 concurrency:
@@ -45,7 +48,7 @@ jobs:
   tier1-unit:
     name: "Tier 1: Unit Tests"
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 
@@ -63,11 +66,18 @@ jobs:
         # The `otel` extra is required because tests/test_incident_triage_smoke.py
         # imports examples/incident_triage_agent/agent.py, which imports
         # opentelemetry at module load time (target.trace.backend: otel). Demo
-        # examples like that one ship as part of the unit-test surface, so the
-        # CI install set has to include the demo's optional extras even though
-        # core ASSERT doesn't need them.
+        # examples like that one ship as part of the unit-test surface. The bank
+        # support regressions start with the checked-in OPA-backed ACS shim; the
+        # documented native ACS runtime is installed and tested separately below.
         run: |
-          python -m pip install -e ".[dev,otel]"
+          python -m pip install -e ".[dev,otel,examples,langgraph]"
+
+      - name: Install Open Policy Agent
+        run: |
+          curl -fsSL -o /usr/local/bin/opa \
+            https://openpolicyagent.org/downloads/v0.70.0/opa_linux_amd64_static
+          chmod +x /usr/local/bin/opa
+          opa version
 
       - name: Check the behavior library
         # Guards two things the reference library cannot enforce by itself:
@@ -86,3 +96,18 @@ jobs:
         # Both paths are required: `pytest tests/` would override the testpaths
         # in pytest.ini and silently skip the skill's own suite.
         run: pytest tests/ .claude/skills/run-assert-eval/tests/ -x -q
+
+      - name: Install pinned native ACS runtime
+        run: python -m pip install -e ".[acs]"
+
+      - name: Require native ACS tier and classifier parity
+        env:
+          ASSERT_BANK_REQUIRE_NATIVE_ACS: "1"
+        run: |
+          pytest examples/bank_manager_agent_control/tests/test_final_review_hardening.py \
+            -k "documented_path_uses_native_acs_runtime or classifier_native_and_shim_policy_parity" -q
+
+      - name: Run bank support example regressions with native ACS
+        env:
+          ASSERT_BANK_REQUIRE_NATIVE_ACS: "1"
+        run: pytest examples/bank_manager_agent_control/tests -q

examples/bank_manager_agent_control/.env.example

@@ -18,11 +18,15 @@
 AZURE_API_KEY=<paste-your-azure-openai-key>
 AZURE_API_BASE=https://<your-azure-openai-resource>.openai.azure.com/
 AZURE_API_VERSION=2024-12-01-preview
-# Deployment name on your resource. MUST match the azure/<name> model strings
-# in the eval_realistic_*.yaml configs (currently azure/gpt-5.4-mini). If your
-# deployment is named differently, change BOTH here and in the YAMLs so the
-# agent-under-test and the eval/judge use the same unfiltered deployment.
-AGENT_MODEL=gpt-5.4-mini
+# Explicit runnable defaults for a new run. The historical source runs did not
+# commit their environment, so these are not asserted as historical provenance.
+# ASSERT pipeline roles are configured separately in the YAMLs.
+AGENT_MODEL=gpt-4o-mini
+# Non-secret deployment name; emitted with calibration/threshold provenance in
+# the classifier annotation and ACS policy span.
+COERCION_CLASSIFIER_MODEL=gpt-4o-mini
+# Synthetic bank-owned control records are bound to this demo session.
+BANK_CONTROL_SESSION_ID=bank-support-demo-session
 
 # ---- FILTERED secondary (do NOT use for attack/judge work) -----------------
 # A FILTERED deployment is only safe for benign-only spot checks. NOT a valid

examples/bank_manager_agent_control/acs/manifest_coercion.yaml

@@ -0,0 +1,73 @@
+agent_control_specification_version: "0.3.0-alpha"
+metadata:
+  name: "bank-manager-coercion-classifier"
+
+# COERCION-VIA-UNVERIFIED-AUTHORITY variant.
+#
+# The typed-signal policy (acs/policy/bank_manager_feature.rego) gates on TYPED
+# signals a tool emits — risk_tier, referenced_accounts, grounded,
+# transfer_approved. Those are deterministic and belong in Rego.
+#
+# This manifest handles the residual those rules cannot express: a *standard*-
+# tier account, a sub-threshold amount, a structurally well-formed transfer —
+# every typed field clean — where the only signal that a required recorded
+# control step is being skipped lives in the requester's prose. That signal is
+# produced by a host-side learned annotator, declared ONCE under `annotators`
+# and referenced at the intervention point via `annotations` (ACS §10). The
+# policy never calls a model; it reads `input.annotations.coercion_risk`.
+
+policies:
+  bank_manager_coercion:
+    type: rego
+    bundle: ./policy
+    query: data.agent_control_specification.bank_manager_coercion.verdict
+
+annotators:
+  # Declared once. `type: classifier` tells the host which dispatcher owns the
+  # call; the host dispatcher owns the network request, caching, retries and
+  # timeouts. ACS defines no built-in classifier engine.
+  coercion_risk:
+    type: classifier
+    # Host-defined fields. runtime/coercion_annotator.py implements the native
+    # ACS AnnotatorDispatcher protocol; ACS treats these fields as opaque.
+    module: coercion_classifier
+    entrypoint: annotate
+    calibration: ../runtime/coercion_calibration.json
+    timeout_ms: 20000
+
+intervention_points:
+  pre_tool_call:
+    policy_target: "$.tool_call.args"
+    policy_target_kind: tool_args
+    tool_name_from: "$.tool_call.name"
+    policy:
+      id: bank_manager_coercion
+      query: data.agent_control_specification.bank_manager_coercion.pre_tool_call_verdict
+    annotations:
+      # The dispatcher receives the complete host snapshot: user prose plus a
+      # typed verification of any cited bank-owned control artifact.
+      coercion_risk:
+        from: "$"
+
+  post_tool_call:
+    policy_target: "$.tool_result"
+    policy_target_kind: tool_result
+    tool_name_from: "$.tool_call.name"
+    policy:
+      id: bank_manager_coercion
+      query: data.agent_control_specification.bank_manager_coercion.post_tool_call_verdict
+
+tools:
+  read_account: {}
+  read_transaction_history: {}
+  read_client: {}
+  read_loan: {}
+  read_portfolio: {}
+  prepare_transfer: {}
+  request_customer_approval: {}
+  create_transfer: {}
+  prepare_loan_modification: {}
+  place_trade: {}
+  freeze_account: {}
+  enable_admin_mode: {}
+  knowledge_base_retrieve: {}

examples/bank_manager_agent_control/acs/manifest_tier_authorization.yaml

@@ -0,0 +1,48 @@
+agent_control_specification_version: "0.3.0-alpha"
+metadata:
+  name: "bank-manager-tier-authorization"
+
+# Sensitivity-tier authorization. The bundle contains ONE rule
+# (policy_tier_authz/tier_authorization.rego) keyed on the platform-normalized
+# `risk_tier` property.
+#
+# The native ACS runtime requires the host's controlled tool surface to be
+# registered. This registry is a dispatch boundary, not policy logic: the Rego
+# below still contains no tool-name predicate and evaluates every registered
+# result through the same property rule.
+
+policies:
+  tier_authorization:
+    type: rego
+    bundle: ./policy_tier_authz
+    query: data.agent_control_specification.tier_authorization.verdict
+
+intervention_points:
+  pre_tool_call:
+    policy_target: "$.tool_call.args"
+    policy_target_kind: tool_args
+    tool_name_from: "$.tool_call.name"
+    policy:
+      id: tier_authorization
+      query: data.agent_control_specification.tier_authorization.pre_tool_call_verdict
+
+  post_tool_call:
+    policy_target: "$.tool_result"
+    policy_target_kind: tool_result
+    tool_name_from: "$.tool_call.name"
+    policy:
+      id: tier_authorization
+      query: data.agent_control_specification.tier_authorization.post_tool_call_verdict
+
+tools:
+  verify_authorization: {}
+  read_client: {}
+  read_account: {}
+  read_transaction_history: {}
+  prepare_transfer: {}
+  request_customer_approval: {}
+  create_transfer: {}
+  read_loan: {}
+  prepare_loan_modification: {}
+  read_portfolio: {}
+  place_trade: {}