docs+test: move ⚠️ warnings to top of evaluate docstring; harden malformed-response test

- Move both ⚠️ warnings (low-level primitive, fail-open default) to the top
  of the evaluate() docstring so developers scanning quickly see them first
- Pin test_saas_malformed_response_raises to ActionDeniedException only
  (missing approved+pending → ActionDeniedException is the exact code path,
  not a coincidental raise — documents the guarantee)
- Case-insensitive Bearer header lookup in bearer token test (urllib capitalizes
  header keys, making case-sensitive get() fragile across Python versions)
- Update stale comment in test_evaluate_importable_from_public_api to reference
  the renamed test and correct behavior (raise, not warn)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: node9ai

node9/_client.py

@@ -267,6 +267,15 @@ def _evaluate_cloud(tool_name: str, args: dict[str, Any], run_id: str = "") -> N
 
 def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
     """
+    ⚠️  evaluate() is a low-level primitive. Unlike @protect it does NOT run DLP
+    scanning or inject agent context (run_id, agent_name) automatically. Use
+    @protect for full protection; use evaluate() only when decorator composition
+    is not possible (e.g. dynamic tool dispatch in custom frameworks).
+
+    ⚠️  Default is fail-open: when neither daemon nor API key is available,
+    actions are auto-approved (offline audit mode). The exception is
+    policy == "require_approval" which raises DaemonNotFoundError (fail-closed).
+
     Sends the action to node9 for audit / approval.
 
     Routing (first match wins):
@@ -277,9 +286,7 @@ def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
 
     Fail behaviour:
       - Daemon unreachable at call time     → offline mode (fail-open, auto-approve)
-        ⚠️  Exception: policy == "require_approval" → DaemonNotFoundError (fail-closed).
-        Auto-approving when approval is explicitly required would be a silent
-        security bypass; operators must fix the connectivity issue instead.
+        Exception: policy == "require_approval" → DaemonNotFoundError (fail-closed).
       - Daemon dies mid-request             → DaemonNotFoundError or ActionDeniedException
         (fail-closed: no auto-approve path exists once a request_id is acquired)
       - Daemon timeout / connection closed  → ActionDeniedException (fail-closed)
@@ -288,11 +295,6 @@ def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
     Timeouts: see _CHECK_TIMEOUT (initial connection) and _WAIT_TIMEOUT
     (human decision wait) module constants for current values.
 
-    ⚠️  evaluate() is a low-level primitive. Unlike @protect it does NOT run DLP
-    scanning or inject agent context (run_id, agent_name) automatically. Use
-    @protect for full protection; use evaluate() only when decorator composition
-    is not possible (e.g. dynamic tool dispatch in custom frameworks).
-
     Raises ActionDeniedException if the action is denied.
     """
     if _SKIP:

tests/test_client.py

@@ -16,9 +16,9 @@ def test_evaluate_importable_from_public_api():
     separately to verify the export is intentional and discoverable by linters
     and import-* consumers.
 
-    Fail-open / offline-mode coverage lives in TestOfflineMode (4 tests), which
-    verifies auto-approve behavior, audit log writes, and the require_approval
-    RuntimeWarning path.
+    Fail-open / offline-mode coverage lives in TestOfflineMode, which verifies
+    auto-approve behavior, audit log writes, and require_approval fail-closed path
+    (raises DaemonNotFoundError — see test_offline_with_require_approval_policy_raises).
     """
     import node9
     from node9 import evaluate as pub_evaluate
@@ -380,7 +380,10 @@ def capturing_urlopen(req, timeout):
                 mock_check.assert_not_called()
 
         assert captured_headers, "urlopen was never called"
-        auth = captured_headers[0].get("Authorization", "")
+        # urllib capitalizes header keys (e.g. "authorization" → "Authorization"),
+        # so use case-insensitive lookup to avoid false negatives.
+        headers_lower = {k.lower(): v for k, v in captured_headers[0].items()}
+        auth = headers_lower.get("authorization", "")
         assert auth == "Bearer test-key-abc", f"Expected Bearer token, got: {auth!r}"
 
     def test_saas_denial_raises_action_denied_exception(self, monkeypatch):
@@ -395,14 +398,17 @@ def test_saas_denial_raises_action_denied_exception(self, monkeypatch):
         assert "Blocked by policy" in str(exc.value)
 
     def test_saas_malformed_response_raises(self, monkeypatch):
-        """SaaS response missing 'approved' key must not silently auto-approve."""
+        """SaaS response missing 'approved' key must raise ActionDeniedException, not auto-approve.
+
+        _evaluate_cloud logic: approved missing → falsy; pending missing → falsy →
+        raises ActionDeniedException("Denied by Node9 policy"). No fall-through to offline mode.
+        """
         monkeypatch.setenv("NODE9_API_KEY", "test-key")
         monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
 
-        # Missing both 'approved' and 'pending' — should raise, not auto-approve
         malformed = _make_response({"status": "unknown"})
         with patch("urllib.request.urlopen", return_value=malformed):
-            with pytest.raises((ActionDeniedException, RuntimeError)):
+            with pytest.raises(ActionDeniedException):
                 evaluate("bash", {"command": "ls"})
 
     def test_saas_run_id_defaults_to_empty_string(self, monkeypatch):