…, framework-only can_handle)

Mirror radu's LangChain-adapter review across the Pydantic AI adapter:
- __init__: drop the import-time registration side-effect; registration only via the uipath.governance.adapters entry point.
- can_handle: claim only a real pydantic_ai.Agent; remove the duck-typed (model/run/iter) fallback.
- docstring: 'governance host' instead of uipath-runtime internals.
- tests: a duck-typed look-alike is now rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

These files were swept into the branch by a broad add; they are unrelated to the governance adapter. Reverting/removing them so the PR contains only governance changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

An earlier cleanup commit compared against a stale local main and wrongly removed SETUP.MD and reverted the LlamaIndex docs change. Both files come from main (PRs #352/#356), not this branch. Restore them to the main version so this PR is governance-only with no spurious deletions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… message models

Replace the duck-typed `_part_kind` string-discriminator with isinstance
checks against pydantic_ai.messages public types (UserPromptPart,
ToolReturnPart, ToolCallPart, BuiltinToolCallPart, TextPart), matching
the typed-extraction pattern from the LangChain adapter review (#899).
Drops the `_part_kind` helper and the getattr fallbacks; attribute
access is now type-checked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Core PR #1761 removed BaseAdapter from uipath-core. Migrate to the
factory-evaluator pattern (matching #899):

- governance/adapter.py -> model.py: replace the BaseAdapter subclass
  (name/can_handle/attach/detach) with module-level install_governance();
  keep GovernanceModel + GovernanceCallbacks. File named for its seam
  (the model wrapper), like LangChain's callbacks.py.
- runtime/factory.py: new_runtime reads `evaluator` from kwargs and
  calls install_governance on the resolved agent.
- governance/__init__.py: drop register_governance_adapter + registry
  import; expose install_governance. No import-time side effects.
- pyproject.toml: remove the uipath.governance.adapters entry point.
- tests (test_adapter.py -> test_model.py): drop can_handle/attach/
  detach; cover install_governance + factory wiring.

ruff + mypy clean; 17 governance tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…, tool_call_id

Review findings (Viswa) for PR #359:

- Streaming AFTER_MODEL now runs in a finally *inside* the request_stream
  async-with, so it fires even if the consumer's `async for` raises partway
  through, and while the stream context is still open. Documented that
  streaming governance is inherently post-hoc (tokens are already emitted by
  the time the response is complete; a DENY aborts the run but cannot un-send
  them).
- _latest_request now scans from the end for the last ModelRequest instead of
  blindly taking messages[-1] — a history ending in a ModelResponse (mid
  tool round-trip) would otherwise scan the wrong side of the exchange.
- Pass tool_call_id through to evaluate_tool_call / evaluate_after_tool so the
  evaluator can correlate a call with its result.
- Bounded joins (_join_within_cap) for request/response/content text and a
  capped _stringify, so an oversized tool-return can't build a multi-megabyte
  string before the final slice.
- Drop the per-callbacks uuid trace_id (identical for every call); trace
  correlation is owned by the layer below, matching LangChain. Requires
  uipath-core >= 0.5.20 (removed trace_id from EvaluatorProtocol) — bumped.
- Count llm/tool calls only after governance passes (no inflation on block).
- Documented that agent.model is a property whose setter the agent re-reads
  per run (no stale ref), and that a per-run model override bypasses the wrap.

Tests: added streaming happy-path (finalized response governed), streaming
finally-on-consumer-error, ModelRequest-filter, and tool_call_id passthrough.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Follow-up to the #359 review pass — the earlier commit covered the blockers
+ page-3 majors; these are the page-4 minors:

- model.py:239 — BuiltinToolReturnPart now fires AFTER_TOOL (symmetric with
  the built-in TOOL_CALL). A provider-executed built-in tool carries both its
  call and result inline in the response, so AFTER_TOOL for built-ins fires
  from on_response, not the next request.
- model.py:371 — _coerce_args preserves malformed JSON as {"_raw": args}
  instead of dropping it to {}, so an arg-based policy can still scan it (a
  malformed payload must not slip past governance).
- model.py:229 — tool_name fallback to "unknown" now logs a warning via a
  shared _tool_name() helper (used by all three tool-part call sites).

Not changed: runtime/factory.py:271 kwargs.get("evaluator") — this is the
same magic-string kwarg LangChain #899's factory uses (factory.py:281); it's
the host-dispatch contract shared by all adapters, so kept for parity.

Tests: added built-in-tool-result AFTER_TOOL coverage; updated _coerce_args
variant assertion. 82 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Same pre-existing CI-lint failure as the other packages (mypy runs over tests):
- FakeEvaluator evaluate_* -> (self, *args, **kwargs) -> Any so it satisfies
  EvaluatorProtocol; bare dict -> dict[str, Any].
- corrected the FakeWrapped stub ignore ([attr-defined] -> [assignment]) and
  added arg-type ignores where None is passed for ModelRequestParameters in
  the request/request_stream bracket tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

New-code coverage ~89% -> lift over the 90% gate. Added: non-block-error
swallow on the response/tool paths, on_request with only a ModelResponse
(empty-input branch), and _content_text/_stringify/_tool_name helper edges.
governance/model.py: 82% -> 96%.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>