[AAASM-4782] 🐛 (openai_agents): Fail closed on governance error and never downgrade a decided deny

[Chisanan232]

Description

openai_agents governed_invoke wrapped the check-and-deny in a broad try/except that caught any AssemblyError and then ran the tool unconditionally, with no enforce gate. Two defects:

1. Fail-open under enforce — a governance error (e.g. GatewayError) raised by check_tool_start was swallowed, so the tool ran ungoverned even under enforce. Every other adapter (and the shared _shared/tool_governance flow) fails closed here.
2. Deny silently downgraded — the deny branch called _record_async_tool_result before returning blocked_result, inside the same try. If that audit call raised an AssemblyError, the exception was caught and execution fell through to run the tool — turning a computed DENY into an ALLOW.

This PR makes openai_agents match the other 10 adapters:

• In the except handler, when the error is a governance error and the posture is enforce (via the adapter's existing _interceptor_enforces signal), it now returns a blocked/deny string instead of falling through to the original invoke. Under observe/disabled the current fall-through (fail-open by design) is unchanged.
• The deny-branch audit is routed through a guarded _record_denied_tool_result helper that swallows any audit failure, so a fault-prone audit call can never re-enter the run path and downgrade a decided deny.

Happy path and observe/disabled behavior are identical to before.

Type of Change

• 🔧 Bug fix

Breaking Changes

• No

Related Issues

• Related JIRA ticket: AAASM-4782

Fixes AAASM-4782

Testing

• Unit tests added/updated

Added regression tests under test/unit/adapters/openai_agents/:

• S1/S2 — under enforce, a GatewayError from check_tool_start → tool BLOCKED (deny string).
• S6 — check returns deny but record_result raises AssemblyError → tool still BLOCKED (deny not downgraded).
• Negative control — under observe (no enforce), a governance error still fails open (tool runs), unchanged.

How to verify:

uv sync
.venv/bin/python -m pytest test/unit/adapters/openai_agents -q

Result: 45 passed. ruff check, ruff format --check, and mypy agent_assembly on the changed files are all clean.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• All tests passing

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Chisanan232]

Claude Code — automated review

CI: green. Scope: matches the ticket. Side effects: none — green full-suite CI (incl. build/lint/impacted tests) validates no existing-function breakage. Front-End: no FE/dashboard code touched → no Playwright validation applies. Verdict: ✅ ready to approve & merge.
Fix: openai_agents governance-error now fails closed under enforce + deny cannot be downgraded by an audit fault. 45 tests pass, negative control confirmed.