[AAASM-6439] 📝 (python-sdk-docs): Resync quick-start snippets with the examples' enforcement_mode

docs/quick-start.md

@@ -104,6 +104,10 @@ below is the part that wires in governance.
 Every example runs **offline** in `mode="sdk-only"` against a local policy, so you can try it
 with no API keys and no outbound network.
 
+These offline snippets also pass `enforcement_mode="observe"`, a demo posture for running
+offline against a local policy. Before you copy a snippet into a real service, remove
+`enforcement_mode="observe"` and `mode="sdk-only"`, and point the SDK at your gateway.
+
 <!-- BEGIN GENERATED: quickstart-framework-tabs -->
 
 === "Agno"
@@ -119,6 +123,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="agno-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -165,6 +172,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="autogen-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -196,6 +206,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="crewai-research-crew",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -235,6 +248,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="custom-tool-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -271,6 +287,9 @@ with no API keys and no outbound network.
             api_key=api_key,
             agent_id="google-adk-demo-agent",
             mode="sdk-only",
+            # No gateway here: the default posture fails closed when registration
+            # can't reach one, so an offline demo must name its dry-run posture.
+            enforcement_mode="observe",
         ) as ctx:
             print(f"  Agent:    {ctx.client.agent_id}")
             print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -299,6 +318,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="haystack-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -344,6 +366,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="langchain-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -375,6 +400,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="langchain-research-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -407,6 +435,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="langgraph-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -444,6 +475,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="llamaindex-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -507,6 +541,9 @@ with no API keys and no outbound network.
             api_key=api_key,
             agent_id="microsoft-agent-framework-demo-agent",
             mode="sdk-only",
+            # No gateway here: the default posture fails closed when registration
+            # can't reach one, so an offline demo must name its dry-run posture.
+            enforcement_mode="observe",
         ) as ctx:
             print(f"  Agent:    {ctx.client.agent_id}")
             print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -536,6 +573,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="openai-agents-demo",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -564,6 +604,9 @@ with no API keys and no outbound network.
             api_key=api_key,
             agent_id="pydantic-ai-demo-agent",
             mode="sdk-only",
+            # No gateway here: the default posture fails closed when registration
+            # can't reach one, so an offline demo must name its dry-run posture.
+            enforcement_mode="observe",
         ) as ctx:
             print(f"  Agent:    {ctx.client.agent_id}")
             print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -592,6 +635,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="semantic-kernel-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -621,6 +667,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="smolagents-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")
@@ -653,6 +702,9 @@ with no API keys and no outbound network.
         api_key=api_key,
         agent_id="strands-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/agno-tool-policy.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="agno-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/autogen-tool-policy.py

@@ -7,6 +7,9 @@
     api_key=api_key,
     agent_id="autogen-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/crewai-research-crew.py

@@ -9,6 +9,9 @@
     api_key=api_key,
     agent_id="crewai-research-crew",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/custom-tool-policy.py

@@ -13,6 +13,9 @@
     api_key=api_key,
     agent_id="custom-tool-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/google-adk.py

@@ -14,6 +14,9 @@
         api_key=api_key,
         agent_id="google-adk-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/haystack-tool-policy.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="haystack-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/langchain-basic-agent.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="langchain-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/langchain-research-agent.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="langchain-research-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/langgraph.py

@@ -9,6 +9,9 @@
     api_key=api_key,
     agent_id="langgraph-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/llamaindex-tool-policy.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="llamaindex-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/microsoft-agent-framework-tool-policy.py

@@ -24,6 +24,9 @@
         api_key=api_key,
         agent_id="microsoft-agent-framework-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/openai-agents-sdk.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="openai-agents-demo",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/pydantic-ai.py

@@ -13,6 +13,9 @@
         api_key=api_key,
         agent_id="pydantic-ai-demo-agent",
         mode="sdk-only",
+        # No gateway here: the default posture fails closed when registration
+        # can't reach one, so an offline demo must name its dry-run posture.
+        enforcement_mode="observe",
     ) as ctx:
         print(f"  Agent:    {ctx.client.agent_id}")
         print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/semantic-kernel-tool-policy.py

@@ -8,6 +8,9 @@
     api_key=api_key,
     agent_id="semantic-kernel-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/smolagents-tool-policy.py

@@ -14,6 +14,9 @@
     api_key=api_key,
     agent_id="smolagents-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

quickstart_snippets/strands-agents-tool-policy.py

@@ -7,6 +7,9 @@
     api_key=api_key,
     agent_id="strands-demo-agent",
     mode="sdk-only",
+    # No gateway here: the default posture fails closed when registration
+    # can't reach one, so an offline demo must name its dry-run posture.
+    enforcement_mode="observe",
 ) as ctx:
     print(f"  Agent:    {ctx.client.agent_id}")
     print(f"  Gateway:  {ctx.client.gateway_url}")

test/unit/test_quickstart_claim_bindings.py

@@ -598,6 +598,12 @@ class ClaimBinding:
         "Names what the [runtime] extra adds to the install. Packaging composition; whether that binary is actually reachable is a separate, bound claim."
     ),
     "You have three options:": ("A list lead-in with no predicate of its own."),
+    'These offline snippets also pass `enforcement_mode="observe"`, a demo posture for running offline against a local policy.': (
+        "Names the argument the offline snippets pass and the setting they are meant for. States no behaviour of observe mode; what that mode does is documented and bound elsewhere."
+    ),
+    'Before you copy a snippet into a real service, remove `enforcement_mode="observe"` and `mode="sdk-only"`, and point the SDK at your gateway.': (
+        "An instruction to change two demo arguments and add a gateway endpoint when moving off the offline setup. An imperative about configuration, with no claim about what the SDK or gateway then does."
+    ),
     "**Let the SDK auto-start one.**": (
         "The bold label of a bullet. The behavioural claim it introduces is the next sentence, which is bound and registered unproven."
     ),