Guarded LangChain tool calls, with evidence you can verify.
Keep LangChain responsible for agent planning and native tool dispatch. LoopGrid records signed decision evidence and evaluates the real Core policy before consequential tools run. Your trusted application supplies authority, verifies human review and observes external outcomes.
loopgrid-langchain==0.1.0 · Python 3.10+ · LangChain >=1.2,<2 · validated with LangChain 1.4.5 and Core 0.8.1-design-partner.
A tool result is not a payment receipt. The middleware records native handler returns separately from verified external execution and business outcomes.
Install the released native LangChain middleware.
python -m pip install loopgrid-langchain==0.1.0
Use create_loopgrid_middleware() with a LangChain 1.x create_agent. This is a native AgentMiddleware integration with both wrap_tool_call and awrap_tool_call, not a renamed LangGraph StateGraph adapter. The Python package needs a running LoopGrid Core service, an authorized workspace/service key and a host-managed policy for actual evidence recording.
Already using StateGraph nodes or checkpoint interrupt/resume? Keep the separate LangGraph integration. Neither integration requires replacing the other.
Attach the guard to the real tool-execution boundary.
from langchain.agents import create_agent
from loopgrid_langchain import (
CoreClient, LangChainBridge, HostBinding,
create_loopgrid_middleware,
LocalSqliteDispatchLease, LocalAsyncSqliteDispatchLease,
)
# Replace host-provided values with authentic application configuration.
client = CoreClient(
base_url=CORE_URL,
workspace_id=WORKSPACE_ID,
service_key=SERVICE_KEY,
)
# Single-host development only, not a distributed lease.
lease_file = "./sandbox-dispatch.sqlite"
bridge = LangChainBridge(
client,
dispatch_lease=LocalSqliteDispatchLease(lease_file),
async_dispatch_lease=LocalAsyncSqliteDispatchLease(lease_file),
)
def host_binding(request):
# Never read authority, policy, or reviewer identity from model text.
return HostBinding(
run_id=RUN_ID,
agent_id="sandbox-agent",
policy_id=APPLICATION_POLICY_ID,
authority={"role": "sandbox"},
model={"name": "host-selected-model"},
context={"prompt_version": "v1"},
)
middleware = create_loopgrid_middleware(bridge, host_binding)
agent = create_agent(
model=MODEL, tools=[SANDBOX_TOOL], middleware=[middleware],
)Host-integration sketch, not standalone runnable code: CORE_URL, WORKSPACE_ID, SERVICE_KEY, RUN_ID, APPLICATION_POLICY_ID, MODEL and SANDBOX_TOOL must come from your application. Use only disposable sandbox tools until policy and reviewer authentication are tested. The upstream native E2E script ↗ is an executable no-provider-key example with synthetic model output.
Place the LoopGrid middleware last/innermost if other middleware rewrites native tool arguments. The default guards all tool names; an optional protected_tools selection intentionally excludes other tools, so it must be chosen carefully.
One consequential tool call, distinct evidence claims.
Read the actual LangChain tool call and host-supplied run, model, policy, identity and delegation. Commit an exact immutable argument snapshot and SHA-256 digest. Model text cannot grant authority.
Core returns signed versioned policy evidence. Where approval is required, only an authenticated host review recorded by Core can authorize continued execution. A signed rejection remains terminal.
A required shared lease and tool_requested reservation precede the native sync/async tool handler. An ambiguous dispatch must be reconciled, not automatically replayed.
The ToolMessage or supported native Command is recorded as tool_result. A successful handler return alone is not evidence of a confirmed external transaction.
After checking an external provider, a trusted host can call record_execution() to record a confirmed receipt and later record_outcome() for separately observed state.
Core verifies the signed workspace chain and captured lifecycle. To make an independent offline cryptographic claim, export the evidence and use a separately pinned signer public key and offline verifier.
Approval cannot be invented by the model; retries cannot duplicate an action.
tool_requested or unknown result is a no-replay barrier. Reconcile with the authoritative external system.Not globally exactly-once: a distributed lease, provider idempotency and external reconciliation remain the host application's responsibility. The adapter does not authenticate users or control unwrapped agent tools.
Keep credentials, external truth and reviewer identity with the host.
Raw service credentials must never be included in prompts, tool calls or signed evidence. Redacted fields are tied to source values using commitments; SHA-256 is not anonymization for low-entropy data. Use HTTPS for remote Core. Signed integrity authenticates captured records; it does not prove that the underlying model claim is true, every action was captured, or a financial transaction settled.
observe_model() only for genuinely observed completed model output, not an inferred or simulated provider response.tool_result; do not relabel them as third-party execution receipts.Native LangChain, real Core and public PyPI passed.
create_agent passed synchronous and asynchronous guarded synthetic tool execution and replay refusal.evidence_complete, signed verification true and no failures.Tests used deterministic synthetic model outputs and synthetic external actions: no actual money moved, and no live paid model-provider invocation was demonstrated. See the validation record ↗, integration contract ↗ and security boundaries ↗.
Start with synthetic tools. Connect authoritative evidence later.
Run native_agent_e2e.py ↗ against an installed LangChain SDK, then test native_core_agent_e2e.py ↗ on a disposable Core workspace. Add real application policy and authenticated review, use a production shared lease and provider idempotency, and only then connect downstream business actions with independently checked receipts and outcomes.
Unlike the separate LangGraph StateGraph adapter, this integration protects LangChain create_agent native tool middleware. It is an independent, community-built integration; no official LangChain endorsement or certification is claimed.
Give consequential tool calls a signed evidence trail.
Begin with a real Core workspace, a synthetic LangChain tool and trusted host policy. Keep authorization and downstream business truth separate from model output.