feat(feat-029): governance identity — Principal + IdentityProvider + local driver

.github/workflows/ci-linux.yml

@@ -41,12 +41,12 @@ jobs:
       - name: Ruff lint
         run: uv run ruff check .
       - name: Mypy strict
-        run: uv run mypy --strict packages/agentforge-core/src packages/agentforge/src packages/agentforge-bedrock/src packages/agentforge-memory-sqlite/src packages/agentforge-memory-neo4j/src packages/agentforge-memory-kuzu/src packages/agentforge-memory-surrealdb/src packages/agentforge-memory-postgres/src packages/agentforge-eval-geval/src packages/agentforge-otel/src packages/agentforge-testing/src packages/agentforge-guard-llmguard/src packages/agentforge-guard-presidio/src packages/agentforge-guard-nemo/src packages/agentforge-guard-llamaguard/src packages/agentforge-mcp/src packages/agentforge-chat/src packages/agentforge-chat-http/src packages/agentforge-chat-history-postgres/src packages/agentforge-chat-history-redis/src packages/agentforge-chat-slack/src packages/agentforge-a2a/src packages/agentforge-statsd/src packages/agentforge-langfuse/src packages/agentforge-phoenix/src packages/agentforge-evidently/src packages/agentforge-reranker-sentence-transformers/src packages/agentforge-reranker-cohere/src packages/agentforge-reranker-voyage/src packages/agentforge-reranker-mixedbread/src packages/agentforge-anthropic/src packages/agentforge-openai/src packages/agentforge-voyage/src packages/agentforge-litellm/src packages/agentforge-ollama/src
+        run: uv run mypy --strict packages/agentforge-core/src packages/agentforge/src packages/agentforge-bedrock/src packages/agentforge-memory-sqlite/src packages/agentforge-memory-neo4j/src packages/agentforge-memory-kuzu/src packages/agentforge-memory-surrealdb/src packages/agentforge-memory-postgres/src packages/agentforge-eval-geval/src packages/agentforge-otel/src packages/agentforge-testing/src packages/agentforge-guard-llmguard/src packages/agentforge-guard-presidio/src packages/agentforge-guard-nemo/src packages/agentforge-guard-llamaguard/src packages/agentforge-mcp/src packages/agentforge-chat/src packages/agentforge-chat-http/src packages/agentforge-chat-history-postgres/src packages/agentforge-chat-history-redis/src packages/agentforge-chat-slack/src packages/agentforge-a2a/src packages/agentforge-statsd/src packages/agentforge-langfuse/src packages/agentforge-phoenix/src packages/agentforge-evidently/src packages/agentforge-governance/src packages/agentforge-reranker-sentence-transformers/src packages/agentforge-reranker-cohere/src packages/agentforge-reranker-voyage/src packages/agentforge-reranker-mixedbread/src packages/agentforge-anthropic/src packages/agentforge-openai/src packages/agentforge-voyage/src packages/agentforge-litellm/src packages/agentforge-ollama/src
       - name: Bandit
         # -c pyproject.toml so [tool.bandit] (skips B101) is honoured;
         # without it, the conformance suite's asserts in
         # agentforge_core.testing.conformance trip B101.
-        run: uv run bandit -q -c pyproject.toml -r packages/agentforge-core/src packages/agentforge/src packages/agentforge-bedrock/src packages/agentforge-memory-sqlite/src packages/agentforge-memory-neo4j/src packages/agentforge-memory-kuzu/src packages/agentforge-memory-surrealdb/src packages/agentforge-memory-postgres/src packages/agentforge-eval-geval/src packages/agentforge-otel/src packages/agentforge-testing/src packages/agentforge-guard-llmguard/src packages/agentforge-guard-presidio/src packages/agentforge-guard-nemo/src packages/agentforge-guard-llamaguard/src packages/agentforge-mcp/src packages/agentforge-chat/src packages/agentforge-chat-http/src packages/agentforge-chat-history-postgres/src packages/agentforge-chat-history-redis/src packages/agentforge-chat-slack/src packages/agentforge-a2a/src packages/agentforge-statsd/src packages/agentforge-langfuse/src packages/agentforge-phoenix/src packages/agentforge-evidently/src packages/agentforge-reranker-sentence-transformers/src packages/agentforge-reranker-cohere/src packages/agentforge-reranker-voyage/src packages/agentforge-reranker-mixedbread/src packages/agentforge-anthropic/src packages/agentforge-openai/src packages/agentforge-voyage/src packages/agentforge-litellm/src packages/agentforge-ollama/src
+        run: uv run bandit -q -c pyproject.toml -r packages/agentforge-core/src packages/agentforge/src packages/agentforge-bedrock/src packages/agentforge-memory-sqlite/src packages/agentforge-memory-neo4j/src packages/agentforge-memory-kuzu/src packages/agentforge-memory-surrealdb/src packages/agentforge-memory-postgres/src packages/agentforge-eval-geval/src packages/agentforge-otel/src packages/agentforge-testing/src packages/agentforge-guard-llmguard/src packages/agentforge-guard-presidio/src packages/agentforge-guard-nemo/src packages/agentforge-guard-llamaguard/src packages/agentforge-mcp/src packages/agentforge-chat/src packages/agentforge-chat-http/src packages/agentforge-chat-history-postgres/src packages/agentforge-chat-history-redis/src packages/agentforge-chat-slack/src packages/agentforge-a2a/src packages/agentforge-statsd/src packages/agentforge-langfuse/src packages/agentforge-phoenix/src packages/agentforge-evidently/src packages/agentforge-governance/src packages/agentforge-reranker-sentence-transformers/src packages/agentforge-reranker-cohere/src packages/agentforge-reranker-voyage/src packages/agentforge-reranker-mixedbread/src packages/agentforge-anthropic/src packages/agentforge-openai/src packages/agentforge-voyage/src packages/agentforge-litellm/src packages/agentforge-ollama/src
 
   test:
     name: Test (Linux, Python ${{ matrix.python-version }})
@@ -66,7 +66,7 @@ jobs:
       - name: Sync dependencies
         run: uv sync --all-extras --dev
       - name: Pytest unit
-        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
+        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-governance/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
       - name: Pytest integration
         run: uv run pytest -q -m "not live" packages/agentforge-bedrock/tests/integration tests/integration
       - name: Coverage

.github/workflows/ci-mac.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Sync dependencies
         run: uv sync --all-extras --dev
       - name: Pytest unit
-        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
+        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-governance/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
       - name: Pytest integration
         run: uv run pytest -q -m "not live" packages/agentforge-bedrock/tests/integration tests/integration
 

.github/workflows/ci-windows.yml

@@ -34,6 +34,6 @@ jobs:
       - name: Sync dependencies
         run: uv sync --all-extras --dev
       - name: Pytest unit
-        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
+        run: uv run pytest -q -m "not live" packages/agentforge-core/tests packages/agentforge/tests packages/agentforge-bedrock/tests/unit packages/agentforge-memory-sqlite/tests/unit packages/agentforge-memory-neo4j/tests/unit packages/agentforge-memory-kuzu/tests/unit packages/agentforge-memory-surrealdb/tests/unit packages/agentforge-memory-postgres/tests/unit packages/agentforge-eval-geval/tests/unit packages/agentforge-otel/tests/unit packages/agentforge-testing/tests/unit packages/agentforge-guard-llmguard/tests/unit packages/agentforge-guard-presidio/tests/unit packages/agentforge-guard-nemo/tests/unit packages/agentforge-guard-llamaguard/tests/unit packages/agentforge-mcp/tests/unit packages/agentforge-chat/tests/unit packages/agentforge-chat-http/tests/unit packages/agentforge-chat-history-postgres/tests/unit packages/agentforge-chat-history-redis/tests/unit packages/agentforge-chat-slack/tests/unit packages/agentforge-a2a/tests/unit packages/agentforge-statsd/tests/unit packages/agentforge-langfuse/tests/unit packages/agentforge-phoenix/tests/unit packages/agentforge-evidently/tests/unit packages/agentforge-governance/tests/unit packages/agentforge-reranker-sentence-transformers/tests/unit packages/agentforge-reranker-cohere/tests/unit packages/agentforge-reranker-voyage/tests/unit packages/agentforge-reranker-mixedbread/tests/unit packages/agentforge-anthropic/tests/unit packages/agentforge-openai/tests/unit packages/agentforge-voyage/tests/unit packages/agentforge-litellm/tests/unit packages/agentforge-ollama/tests/unit tests/unit
       - name: Pytest integration
         run: uv run pytest -q -m "not live" packages/agentforge-bedrock/tests/integration tests/integration