feat: Rego WASM governance evaluator (v2)

[evanbijoy251]

Summary

• Ports the Rego/WASM governance evaluator from the old feat/rego-evaluator branch, rebased on main's DI-first architecture (no globals, no FF checks inside the class)
• Adds feature signal extractors (governance/features/) shared between native and Rego evaluators
• Adds RegoEvaluator — one OPAPolicy engine per LifecycleHook, receives AuditManager and EnforcementMode via DI constructor params
• Adds build_rego_evaluator_async(service) for platform-service-driven bootstrap — single async call, no background threads at startup, mirrors native evaluator bootstrap pattern exactly
• Integrates into UiPathGovernedRuntime via the existing rego_evaluator kwarg and sequential-merge pattern (both evaluators run per hook; first GovernanceBlockException raised)

Commits

• feat: port Rego evaluator to feat/rego-evaluator-v2 — full port of evaluator, features, bundle cache, api client, loader
• fix: remove native policy loading files — native policy loading moved to uipath-python under uipath-platform
• feat: add build_rego_evaluator_async to rego loader — async bootstrap builder; bumps to 0.12.3

Dependencies

Depends on UiPath/uipath-python#feat/rego-evaluator for:

• HookBundle / AllPoliciesResponse wire models (uipath.core.governance)
• GovernanceService.retrieve_all_policies_async() / download_bundle_async()
• REGO_FEATURE_FLAG / is_rego_enabled()

Test plan

• uv run pytest passes
• UIPATH_FEATURE_EnablePythonGovernanceRegoEvaluator=true with a valid bundle triggers Rego evaluation
• Missing bundles → fail-open (agent runs without Rego evaluation, warning logged)
• GovernanceBlockException from Rego returns FAULTED result with Governance.PolicyViolation code

Generated with Claude Code

Development Package

• Add this package as a dependency in your pyproject.toml:

[project]
dependencies = [
  # Exact version:
  "uipath-runtime==0.12.3.dev1001470653",

  # Any version from PR
  "uipath-runtime>=0.12.3.dev1001470000,<0.12.3.dev1001480000"
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath-runtime = { index = "testpypi" }

[sonarqubecloud]

Quality Gate failed

Failed conditions
49.8% Coverage on New Code (required ≥ 90%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!