feat(governance): guardrail-fallback compensation

pyproject.toml

@@ -122,10 +122,19 @@ exclude_lines = [
 
 [tool.uv]
 exclude-newer = "2 days"
+# Pin to the testpypi dev builds from uipath-python PR #1761
+# (refactor: drop AdapterRegistry + BaseAdapter; keep EvaluatorProtocol).
+# Local-only — does not affect the published wheel's Requires-Dist.
+override-dependencies = [
+  "uipath-core==0.5.24.dev1017616976"
+]
 
 [tool.uv.exclude-newer-package]
 uipath-core = false
 
+[tool.uv.sources]
+uipath-core = { index = "testpypi" }
+
 [[tool.uv.index]]
 name = "testpypi"
 url = "https://test.pypi.org/simple/"

src/uipath/runtime/governance/_audit/traces.py

@@ -3,7 +3,7 @@
 This sink creates OpenTelemetry spans for governance events. UiPath's
 OTel exporter (``uipath.tracing._otel_exporters.LlmOpsHttpExporter`` via
 ``_SpanUtils.otel_span_to_uipath_span``) is what ships them to the
-Orchestrator Traces UI and is also what reads ``UIPATH_TRACE_ID``,
+Orchestrator Traces UI and is also what reads
 ``UIPATH_ORGANIZATION_ID``, ``UIPATH_TENANT_ID``, ``UIPATH_FOLDER_KEY``
 and ``UIPATH_JOB_KEY`` from the process environment and stamps them onto
 the outgoing ``UiPathSpan``. We intentionally do **not** duplicate that

src/uipath/runtime/governance/native/__init__.py

@@ -0,0 +1,45 @@
+"""Native UiPath governance policy evaluator.
+
+YAML-defined rules evaluated in-process at each agent lifecycle hook.
+The host fetches the policy pack via the
+:class:`GovernancePolicyProvider` protocol and compiles it into a
+:class:`PolicyIndex` with :func:`build_policy_index_from_yaml` *before*
+constructing :class:`GovernanceRuntime` — so the runtime layer never
+performs I/O at construction time.
+
+This subpackage owns:
+
+- :class:`GovernanceEvaluator` – the evaluator implementation.
+- :func:`build_policy_index_from_yaml` – pure YAML → :class:`PolicyIndex`
+  compiler.
+- The native policy model: :class:`Rule`, :class:`Check`,
+  :class:`Condition`, :class:`PolicyIndex`.
+
+Shared output types (``Action``, ``AuditRecord``, …) live in
+:mod:`uipath.core.governance`.
+"""
+
+from ._yaml_to_index import build_policy_index_from_yaml
+from .evaluator import GovernanceEvaluator
+from .models import (
+    Check,
+    CheckContext,
+    Condition,
+    PolicyIndex,
+    PolicyPack,
+    Rule,
+    Severity,
+)
+
+__all__ = [
+    "GovernanceEvaluator",
+    "build_policy_index_from_yaml",
+    # Native policy model
+    "Check",
+    "CheckContext",
+    "Condition",
+    "PolicyIndex",
+    "PolicyPack",
+    "Rule",
+    "Severity",
+]

src/uipath/runtime/governance/native/_yaml_to_index.py

@@ -1,10 +1,11 @@
 """Runtime YAML → PolicyIndex parser.
 
-Mirrors the shape produced by ``packs/compile_packs.py`` but builds the
-PolicyIndex directly from parsed YAML data rather than generating Python
-source. Used by :mod:`uipath.runtime.governance.native.loader` to
-compile the YAML body returned by the registered policy provider into
-an in-memory index at startup.
+Mirrors the shape produced by ``packs/compile_packs.py`` but builds
+the :class:`PolicyIndex` directly from parsed YAML data rather than
+generating Python source. The host calls this to compile the YAML
+body returned by :meth:`GovernancePolicyProvider.get_policy_async`
+into an in-memory index, then hands the index to
+:class:`GovernanceRuntime`.
 
 Accepts either a single YAML document (one pack) or a multi-document
 stream (``---``-separated packs). Unknown check types and malformed