[AAASM-4252] 🐛 (openai-agents): Fix fail-open bug in _is_governance_error

[Chisanan232]

Description

Fixes a security vulnerability in the OpenAI Agents adapter where _is_governance_error() unconditionally returned True, causing ALL exceptions during governance checks to be swallowed. This made the system fail-open instead of fail-closed.

The fix changes _is_governance_error() to properly detect governance-specific errors by checking if the exception is an instance of AssemblyError (the base class for all SDK governance exceptions like GatewayError, PolicyError, etc.).

Before (buggy):

• ANY exception during governance check → swallowed → tool executes (fail-open)

After (fixed):

• AssemblyError subclasses → handled → tool executes (intended fail-open for known governance errors)
• Other exceptions (RuntimeError, ValueError, network errors) → propagate → tool blocked (fail-closed)

Type of Change

• ✨ New feature
• 🔧 Bug fix
• ♻️ Refactoring
• 🍀 Performance improvement
• 📚 Documentation update
• 🚀 Release

Breaking Changes

Does this PR introduce any breaking changes?

• No
• Yes (please describe below)

Note: This is a security fix that changes fail-open to fail-closed behavior for non-governance errors. This is the intended, more secure behavior.

Related Issues

• Related JIRA ticket: AAASM-4252

Testing

Describe the testing performed for this PR:

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No tests required (explain why)

Updated tests to verify:

1. test_non_governance_error_propagates_fail_closed - RuntimeError propagates (fail-closed)
2. test_governance_error_allows_fail_open - GatewayError (AssemblyError subclass) allows fail-open
3. test_value_error_propagates_fail_closed - ValueError propagates (fail-closed)

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed
• All tests passing

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

🤖 Claude Code Review

CI Status

✅ All checks PASS: CodeQL, SonarCloud, codecov, all test matrix jobs, LangChain contract test, dependency audit

Scope Verification

✅ Covers ticket AAASM-4252: _is_governance_error always returns True — fail-open bug

Changes reviewed:

• agent_assembly/adapters/openai_agents/patch.py:
  • _is_governance_error() now checks isinstance(error, AssemblyError) instead of returning True
  • Added docstring explaining fail-closed security rationale
• test/unit/adapters/openai_agents/test_patch.py:
  • test_non_governance_error_propagates_fail_closed: RuntimeError propagates (fail-closed)
  • test_governance_error_allows_fail_open: GatewayError allows fail-open (intentional)
  • test_value_error_propagates_fail_closed: ValueError propagates (fail-closed)

Security Analysis

✅ Critical security fix: System now maintains fail-closed posture for unexpected errors
✅ Intentional fail-open preserved: Known governance errors (AssemblyError subclasses) still allow fail-open
✅ Well-tested: Three test cases cover both security paths

Side Effects Analysis

⚠️ Behavior change (intentional): Non-governance exceptions now propagate instead of being swallowed
✅ This is the correct, secure behavior: Aligns with documented fail-closed security posture

Recommendation

Ready for approval and merge ✅

---

🤖 Reviewed by Claude Code