agentscore-commerce 1.8.0 — signer field + signer_sanctions surface

[vvillait88]

Summary

Python-side mirror of agentscore/node-commerce#18. Switches the assess call inside verify_wallet_signer_match (sync + async) to use the renamed signer field.

• identity/client.py: assess(..., resolve_signer=...) → assess(..., signer=...)
• agentscore-py peer-dep >=2.1.0 → >=2.2.0
• Version 1.7.0 → 1.8.0
• [tool.uv.sources] block routes uv to editable ../python-sdk for stacked-dev resolution (drops in a follow-up once python-sdk 2.2.0 publishes)

CI install will fail until python-sdk 2.2.0 publishes. Local tests pass via the editable source.

Out of scope

Renaming verify_wallet_signer_match → get_signer_verdict() synchronous getter is a deeper architectural refactor (6 framework adapters × cache evolution) and ships as its own minor bump once this wire contract settles.

Test plan

• uv run pytest tests/ — 902/902 pass (with --all-extras)
• uv run ruff check . clean
• uv run ty check agentscore_commerce/ clean
• CI green (after python-sdk 2.2.0 publishes)
• Publish 1.8.0 once python-sdk 2.2.0 is live (unblocks store dep bump)

🤖 Generated with Claude Code

[vvillait88]

Both inline comments from @github-code-quality are false positives:

vulture_whitelist.py:19 — The bare Signer # noqa: F821 statement is the established vulture-whitelist pattern in this file; every entry on lines 1-21 has the same shape. It references the type so vulture doesn't flag it as dead code (the actual usage is in string-literal cast("Signer", {...}) calls that vulture's AST walk doesn't follow). Tuple/list form would change file conventions unnecessarily.

client.py:48 — Both DecisionPolicy and Signer ARE used, just via string-literal casts:

• DecisionPolicy → cast("DecisionPolicy | None", ...) at lines 268 and 319
• Signer → cast("Signer", {...}) at lines 559 and 630

String-cast type references are valid Python (PEP 484) and resolve correctly under ty / mypy. The bot's linter only walks runtime references, hence the false positive. ty check clean confirms both imports are properly used at the type layer.

[vvillait88]

Followup on the third bot inline comment (types.py:6 "Network" is unused): also a false positive.

Network is re-exported via from agentscore import Network as Network so vendor code can do from agentscore_commerce.identity import Network. Internally it's used as a parameter type annotation in 7 adapter files (capture_wallet(..., network: Network, ...) etc.):

• fastapi.py:43, 349
• flask.py:36, 318
• django.py:37, 297
• aiohttp.py:36, 317
• sanic.py (same pattern)
• middleware.py:38, 349
• client.py:41, 445, 467

The bot's linter only walks runtime references inside expressions; PEP 484 as Name re-exports + cross-file type-annotation usage are both invisible to it. Real linters all pass: ruff check, ty check, vulture ✅.