feat: Rego WASM governance — wire models, platform service, CLI bootstrap

[evanbijoy251]

Summary

End-to-end plumbing for the Rego/WASM governance evaluator across three packages:

uipath-core — wire models + feature flag

• HookBundle and AllPoliciesResponse Pydantic models for the /all-policies/{tenant_id} endpoint, alongside PolicyResponse
• REGO_FEATURE_FLAG = "EnablePythonGovernanceRegoEvaluator" and is_rego_enabled() mirroring the existing GOVERNANCE_FEATURE_FLAG / is_governance_enabled() pattern exactly

uipath-platform — GovernanceService methods

• retrieve_all_policies() / retrieve_all_policies_async() — GET /{org}/agenticgovernance_/api/v1/all-policies/{tenant_id}
• download_bundle() / download_bundle_async() — plain httpx GET to pre-signed CDN URLs (no platform auth)

uipath (CLI) — governance bootstrap wiring

• GovernanceBootstrap.rego_evaluator field added
• wrap_runtime() passes it to UiPathGovernedRuntime
• resolve_governance() calls build_rego_evaluator_async(sdk.governance) when is_rego_enabled() — no background threads, same inline pattern as the native evaluator

Commits

1. feat: add Rego wire models and feature flag to core — uipath-core 0.5.31
2. feat: add retrieve_all_policies and download_bundle to GovernanceService — uipath-platform 0.2.7
3. feat: wire Rego evaluator into governance CLI bootstrap

Dependencies

Depends on UiPath/uipath-runtime-python#feat/rego-evaluator-v2 for RegoEvaluator and build_rego_evaluator_async.

Test plan

• uv run pytest packages/uipath-platform/tests/services/test_governance_service.py — 59 tests pass
• UIPATH_FEATURE_EnablePythonGovernanceRegoEvaluator=true uipath run agent.py triggers Rego bootstrap
• Missing UIPATH_ORGANIZATION_ID / UIPATH_TENANT_ID → ValueError from retrieve_all_policies
• CDN 4xx → httpx.HTTPStatusError from download_bundle

Generated with Claude Code

Development Packages

uipath

[project]
dependencies = [
  # Exact version (copy-paste ready):
  "uipath==2.13.9.dev1018077232",

  # Any version from this PR (uncomment to use a range instead):
  # "uipath>=2.13.9.dev1018070000,<2.13.9.dev1018080000",
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath = { index = "testpypi" }
uipath-platform = { index = "testpypi" }
uipath-core = { index = "testpypi" }

[tool.uv]
override-dependencies = ["uipath-platform==0.2.7.dev1018077232", "uipath-core==0.5.31.dev1018077232"]

uipath-core

[project]
dependencies = [
  # Exact version (copy-paste ready):
  "uipath-core==0.5.31.dev1018077232",

  # Any version from this PR (uncomment to use a range instead):
  # "uipath-core>=0.5.31.dev1018070000,<0.5.31.dev1018080000",
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath-core = { index = "testpypi" }

[sonarqubecloud]

Quality Gate failed

Failed conditions
74.5% Coverage on New Code (required ≥ 90%)

See analysis details on SonarQube Cloud