test(google-adk): add PR #6605 as a static tool-surface regression fixture

[pengfei-threemoonslab]

Motivation

google/adk-python#6605 is a compact, realistic Google ADK change that can become a durable, offline regression fixture. It adds support_agent with two function tools:

• lookup_account(user_id)
• delete_account(user_id)

The sample also includes runtime agent-hooks governance. That runtime behavior is intentionally out of scope for Agents Shipgate's static contract, which makes this a useful boundary test as well as an adapter test.

Observed static result with 0.16.0b7

After a local shipgate.yaml declared the two Google ADK source files, doctor --json found:

• one Google ADK agent;
• two function tools;
• two Python entry points;
• 2/2 catalog tools reachable and no source-loader warnings.

A static scan --suggest-patches then produced:

• release_decision.decision = insufficient_evidence;
• no policy findings and no blockers;
• two medium/low-confidence tool observations;
• six semantic gaps over the two actions;
• 0/2 actions pass-eligible;
• suggested-inventory.json and reviewed declaration stubs.

This is the desired fail-closed outcome: AST discovery proves a structural root-to-tool binding, but does not invent semantic effect, authority, or approval evidence.

Fixture requirements

Please add a minimized, vendored fixture modeled on the relevant sample; do not fetch GitHub, import the app, execute agent code, make tool calls, or require an LLM/API key.

The fixture should cover:

1. Google ADK root extraction from LlmAgent(name="support_agent", tools=[...]).
2. Function extraction, source locations, input shape, and the 2/2 root-reachable binding graph.
3. The deterministic result insufficient_evidence when only static function definitions and an otherwise minimal manifest are supplied.
4. Generated inventory/declaration guidance, without auto-filling effect or authority claims.
5. The static-verdict disclaimer: runtime hooks are not treated as proof that destructive actions are governed.
6. A companion trigger fixture for the positive routing expected by bug(trigger): recognize Google ADK LlmAgent tools=[...] changes as tool-surface changes #315.

Expected policy assertions

• delete_account may receive a conservative destructive-risk heuristic, but it must not receive a proven effect/authority/approval claim without explicit evidence.
• lookup_account may remain semantically unknown until the declared inventory/effect evidence is supplied.
• A fixture must not treat an exit code of 0 in advisory mode as passed.

Value

This adds a real supported-framework sample between tiny synthetic cases and a full external clone, and guards both the Google ADK adapter and the evidence-boundary contract against regression.

[pengfei-threemoonslab]

Triage note: labeled blocked on #315, since fixture requirement 6 — the companion trigger fixture for positive routing — cannot be written until the ADK trigger exists. Requirements 1–5 are independent and can proceed now.

The observed static result is the right outcome and worth pinning exactly as described: AST discovery proving a 2/2 root-to-tool binding while release_decision.decision stays insufficient_evidence is the evidence boundary working, not a shortfall. The explicit assertion that "a fixture must not treat an exit code of 0 in advisory mode as passed" is a good guard to have in the fixture itself.

Two notes for whoever builds it.

This is the second fixture of this exact shape — #310 does the same thing for OpenAI Agents SDK via Strix #791, down to the structure (minimized vendored sample, no clone, no execution, static assertions only). Worth building them against a shared harness rather than twice, and deciding once how a vendored external sample is attributed and kept minimized. Doing #310 first and #316 against whatever it establishes will cost less than the reverse.

Requirement 5 is the one with lasting value. Asserting that runtime agent-hooks governance is not treated as proof that destructive actions are governed is a boundary test, and it is the criterion most likely to catch a future regression — a later change that starts crediting runtime hooks as evidence would break exactly here and nowhere else. Worth making it a named test rather than an assertion folded into a larger fixture run.

[pengfei-threemoonslab]

PM dependency update: no longer blocked because #315 is closed. Sequence this after #310 so both external-PR fixtures use one minimized, local-only harness.