feat: Governance runtime implementation

[viswa-uipath]

Dependent on : UiPath/uipath-python#1761 for uipath-core package

Summary

Adds a LangChain / LangGraph governance adapter to uipath-langchain. It lets UiPath governance evaluate what a LangChain chain or LangGraph agent does at the model and tool level, and block disallowed actions, without the agent author writing governance code. This package contains only the LangChain-specific bridge.

What it does

• Detects LangChain Runnable and LangGraph CompiledStateGraph objects and wraps them with a governance proxy.
• Hooks the model and tool lifecycle via LangChain's callback system and maps each event to a governance check:

  LangChain event	Governance hook
  on_llm_start / on_chat_model_start	BEFORE_MODEL
  on_llm_end	AFTER_MODEL
  on_tool_start	TOOL_CALL
  on_tool_end	AFTER_TOOL

• Enforces by letting a GovernanceBlockException (raised on a DENY decision) propagate to stop the model call or tool. Any other error in the hook is logged and swallowed, so a governance failure cannot break an otherwise-healthy run.

What it does not do

• Does not fire agent-level boundaries (BEFORE_AGENT / AFTER_AGENT); those are owned by the governance host.
• Does not depend on platform, auth, transport, or runtime internals — only on the shared governance contracts.

Development Package

• Use uipath pack --nolock to get the latest dev build from this PR (requires version range).
• Add this package as a dependency in your pyproject.toml:

[project]
dependencies = [
  # Exact version:
  "uipath-langchain==0.13.13.dev1008995099",

  # Any version from PR
  "uipath-langchain>=0.13.13.dev1008990000,<0.13.13.dev1009000000"
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath-langchain = { index = "testpypi" }

[tool.uv]
override-dependencies = [
    "uipath-langchain>=0.13.13.dev1008990000,<0.13.13.dev1009000000",
]

[Copilot]

Pull request overview

Adds a LangChain/LangGraph governance integration layer to uipath-langchain, wiring UiPath’s governance evaluator into LangChain callbacks and exposing registration via an entry point so uipath-runtime can discover the adapter.

Changes:

• Introduces a LangChainAdapter + governed proxy wrapper and a callback handler that calls EvaluatorProtocol hooks for model/tool events.
• Adds governance adapter registration (uipath.governance.adapters entry point) with import-time idempotent self-registration.
• Updates dependency/lock configuration to pull in updated uipath-core and a dev/test build of uipath-runtime (currently with non-portable lockfile sources).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 9 comments.

File	Description
src/uipath_langchain/governance/adapter.py	Implements the LangChain/LangGraph adapter, wrapper, and callback handler that triggers governance evaluations.
src/uipath_langchain/governance/__init__.py	Registers the governance adapter on import and exposes an entry-point registration function.
pyproject.toml	Adds governance adapter entry point; bumps uipath-core; pins uipath-runtime to a dev build and adds a uv TestPyPI source override.
uv.lock	Updates locked dependencies, but currently includes a machine-local Windows editable uipath-runtime source.

[radu-mocanu]

please squash into 1 commit and rebase on top of main. make sure to bump the uipath-langchain version and regenerate the uv.lock

[radu-mocanu]

please fix #899 (comment) and remove the test pypi index from pyproject

[radu-mocanu]

This must be True for governance DENY to block execution. LangChain catches callback exceptions and only re-raises them when handler.raise_error is true, so with the current value a GovernanceBlockException raised by the evaluator is logged by LangChain and the model/tool call continues.

Please add a focused test that exercises LangChain callback dispatch, not only direct handler calls. Minimal shape:

from langchain_core.callbacks.manager import handle_event

handler = GovernanceCallbackHandler(evaluator, "agent", "session")
evaluator.evaluate_before_model.side_effect = GovernanceBlockException("blocked")

with pytest.raises(GovernanceBlockException):
    handle_event([handler], "on_llm_start", "ignore_llm", {}, ["deny me"])

The same behavior should hold for async callback dispatch as well.

[viswa-uipath]

We are in audit mode now. We dont want to raise exceptions now. We will do it once we go with enforce mode . Post the private preview

[radu-mocanu]

can we add a todo comment at least?

[radu-mocanu]

Please also bump the package version for this logic-changing PR. This adds runtime governance behavior to uipath-langchain, and these packages publish on merge, so keeping 0.13.12 makes the change ride an existing version.

[viswa-uipath]

We have to keep this PR open till the runtime changes are merged and the version is released. Will update the version post that.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud