…, framework-only can_handle)

Mirror radu's LangChain-adapter review across the MS Agent Framework adapter:
- __init__: drop the import-time registration side-effect; registration only via the uipath.governance.adapters entry point.
- can_handle: claim only a real agent_framework.BaseAgent; remove the duck-typed (middleware + run/workflow) fallback.
- docstring: 'governance host' instead of uipath-runtime internals.
- tests: can_handle uses a real BaseAgent; duck-typed look-alikes are now rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The model/model_id chat-client tweak in runtime/schema.py is unrelated to the governance adapter and was bundled in accidentally. Revert it to main so this PR is governance-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

These files were swept into the branch by a broad add; they are unrelated to the governance adapter. Reverting/removing them so the PR contains only governance changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

An earlier cleanup commit compared against a stale local main and wrongly removed SETUP.MD and reverted the LlamaIndex docs change. Both files come from main (PRs #352/#356), not this branch. Restore them to the main version so this PR is governance-only with no spurious deletions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Record that payload text is read via `.text` rather than isinstance on
agent-framework message/response models, since those shapes are still
pre-release (rc) and not stable public types.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…valuator

Core PR #1761 removed BaseAdapter from uipath-core. Migrate to the
factory-evaluator pattern (matching #899):

- governance/adapter.py -> middleware.py: replace the BaseAdapter
  subclass (name/can_handle/attach/detach) with module-level
  install_governance() that appends the governance middleware to each
  agent's middleware list (walking WorkflowAgent executors); keep the
  middleware classes + callbacks. File named for its seam (middleware).
- runtime/factory.py: new_runtime reads `evaluator` from kwargs and
  calls install_governance.
- governance/__init__.py: drop register_governance_adapter + registry
  import; expose install_governance. No import-time side effects.
- pyproject.toml: remove the uipath.governance.adapters entry point.
- tests (test_adapter.py -> test_middleware.py): drop can_handle/attach/
  detach; cover install_governance + factory wiring.

ruff + mypy clean; 14 governance tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Review findings (Viswa) for PR #361:

- AFTER_MODEL / AFTER_TOOL now run inside a try/finally around call_next,
  so they still fire (audit + rules observe the turn) when the model or
  tool call raises. GovernanceBlockException from before_* still aborts
  before call_next; the underlying error still propagates after the finally.
- Streaming AFTER_MODEL: on a streaming ChatContext, context.result is a
  ResponseStream after call_next (reading it yielded empty text). We now
  register a stream_result_hook so AFTER_MODEL runs on the finalized
  ChatResponse the framework assembles once the stream is consumed.
- Drop the per-callbacks uuid trace_id (identical for every call); trace
  correlation is owned by the layer below, matching LangChain. Requires
  uipath-core >= 0.5.20 (removed trace_id from EvaluatorProtocol) — bumped.
- Count llm/tool calls only after governance passes: a DENY raised before
  the bump, inflating the counter on blocked calls.
- Cap _stringify output so an oversized tool result / message can't hand a
  multi-megabyte string to the evaluator.
- Trailing newline (W292).

Note: agents are not cached by the factory (each runtime gets a fresh
instance to avoid concurrent-Workflow reuse), so the cached-agent
re-attach concern does not apply here — the idempotency guard is only a
double-install safety net. The PR description's entry-point claim is stale
(factory-evaluator uses no governance entry-point) and will be corrected.

Tests: added finally-on-error (model + tool), streaming result-hook, and
no-inflation-on-block coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Follow-up to the #361 review pass — the earlier commit covered streaming
(stream_result_hook), try/finally, trace_id, counters, and the _stringify cap;
these are the rest:

- middleware.py:113 (walk gap — page-2 theme + minor 8) — _iter_agents now
  RECURSES through nested WorkflowAgents (workflow-of-workflows). Before it
  stopped one level down, so a nested workflow's inner agents ran ungoverned.
  Converted to an explicit stack walk with a _MAX_GRAPH_NODES cap that logs
  when it trips (was a silent inline `len(seen) < 1000`).
- middleware.py:326 (_coerce_args) — log a warning when model_dump() fails
  instead of silently dropping the tool args from governance visibility.
- middleware.py:135 (nit) — inverted the empty-targets check to a guard clause.

Tests: nested-workflow recursion + cycle-safety (self-referential executor);
streaming + AFTER_MODEL-on-error were added in the earlier pass. 141 pass.

Acknowledged, unchanged: latest-message-only scan (same documented tradeoff as
#899); cached-agent re-attach does not apply — this factory does not cache
agents (fresh per runtime) and trace_id is no longer held.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Same pre-existing CI-lint failure (mypy runs over tests):
- FakeEvaluator evaluate_* -> (self, *args, **kwargs) -> Any; bare dict ->
  dict[str, Any].
- typed the duck-typed contexts as  so passing a SimpleNamespace
  to process()'s ChatContext/FunctionInvocationContext param type-checks
  (one inline context keeps an arg-type ignore).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…overage)

New-code coverage ~89% -> over the 90% gate. Added non-block swallow on every
callback, _message_text/_response_text/_latest_message_text edges, and
_coerce_args variants incl. the model_dump-failure warn branch.
governance/middleware.py: 85% -> 97%.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>