refactor(v4-removal)!: replace the v4 policy language with ACS v5 across the Python runtime

.github/workflows/benchmarks.yml

@@ -25,10 +25,6 @@ jobs:
         working-directory: agent-governance-python/agent-sre
         run: pip install --no-cache-dir -e ".[dev]" --quiet  # Install local package (Scorecard: pinned via pyproject.toml)
 
-      - name: Run policy benchmarks
-        working-directory: agent-governance-python/agent-os
-        run: python benchmarks/bench_policy.py | tee /tmp/bench_policy.json
-
       - name: Run kernel benchmarks
         working-directory: agent-governance-python/agent-os
         run: python benchmarks/bench_kernel.py | tee /tmp/bench_kernel.json
@@ -37,10 +33,6 @@ jobs:
         working-directory: agent-governance-python/agent-os
         run: python benchmarks/bench_audit.py | tee /tmp/bench_audit.json
 
-      - name: Run adapter benchmarks
-        working-directory: agent-governance-python/agent-os
-        run: python benchmarks/bench_adapters.py | tee /tmp/bench_adapters.json
-
       - name: Run SRE benchmarks
         working-directory: agent-governance-python/agent-sre
         run: |

.github/workflows/ci-generation-check.yml

@@ -14,6 +14,8 @@ on:
     paths:
       - '.github/ci/**'
       - '.github/workflows/**'
+      - 'agent-governance-python/agt-policies/**'
+      - 'agent-governance-python/agent-governance-toolkit-core/pyproject.toml'
       - 'scripts/ci/generate_workflows.py'
       - 'tests/ci/**'
 

.github/workflows/ci.yml

@@ -353,7 +353,7 @@ jobs:
           pip install --no-cache-dir --no-deps -e agent-governance-python/agent-governance-toolkit-integrations
           pip install --no-cache-dir --no-deps -e agent-governance-python/agent-governance-toolkit-cli
           pip install --no-cache-dir --no-deps -e agent-governance-python/agent-governance-toolkit-protocols
-          # agt-policies backs the agent-os v5 runtime bridge. Install this
+          # agt-policies backs the native ACS runtime. Install this
           # local sibling without resolving agent-control-specification from
           # PyPI; the vendored native SDK is built below for the packages that
           # exercise the ACS-backed runtime. Keep its pure-Python runtime deps
@@ -379,7 +379,7 @@ jobs:
       - name: Build native ACS SDK (ACS-backed Python policy runtime)
         # agent-os and agt-policies route evaluations through the native
         # `agent_control_specification` Rust SDK (pyo3/maturin). Build & install
-        # it from the vendored policy-engine so bridge-backed tests run.
+        # it from the vendored policy-engine so native-runtime tests run.
         # The wheel is abi3-py311, so one build serves all agent-os matrix
         # Python versions (3.11-3.13). ubuntu-latest ships Rust + a C toolchain.
         if: steps.gate.outputs.run == 'true' && (matrix.package == 'agent-os' || matrix.package == 'agt-policies')
@@ -425,7 +425,7 @@ jobs:
         working-directory: agent-governance-python/agent-os
         run: |
           pytest tests/test_governance_parity.py \
-                 tests/test_spec_adapter_contract_conformance.py \
+                 tests/test_adapter_mediation_contract.py \
                  -v --tb=short
       - name: Test ${{ matrix.package }}
         if: steps.gate.outputs.run == 'true'
@@ -719,6 +719,10 @@ jobs:
           # All agentmesh-integrations packages declare a [dev] extra (audited
           # 2026-05). Deterministic install — no error-swallowing fallback.
           pip install --no-cache-dir -e ".[dev]"
+          # `.[dev]` resolves agt-policies from PyPI. Reinstall the local
+          # checkout afterwards so the integrations test against this commit's
+          # ACS policy API rather than the last published wheel.
+          pip install --no-cache-dir --no-deps --force-reinstall -e "$GITHUB_WORKSPACE/agent-governance-python/agt-policies"
           CI_TEST_REQS="$GITHUB_WORKSPACE/agent-governance-python/requirements/ci-test.txt"
           if [ -f "$CI_TEST_REQS" ]; then
             # Hash-pinned shared test deps. Previously swallowed errors with

.github/workflows/policy-validation.yml

@@ -23,7 +23,8 @@ jobs:
             policies:
               - '**/*.yaml'
               - '**/*.yml'
-              - 'agent-governance-python/agent-os/src/agent_os/policies/**'
+              - 'agent-governance-python/agt-policies/**'
+              - 'agent-governance-python/agent-compliance/src/agent_compliance/lint_policy.py'
 
   validate-policies:
     runs-on: ubuntu-latest
@@ -36,42 +37,50 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Install consolidated v4 packages (local, --no-deps)
-        # The deprecated shim packages (agent-primitives, agent-os, ...) all
-        # declare a hard dep on agent-governance-toolkit-core>=4.0, which is
-        # not yet on PyPI. Pre-install the local consolidated packages with
-        # --no-deps so the subsequent shim installs resolve without pip
-        # reaching out to PyPI for the unpublished names.
+      - name: Install native manifest linter
         run: |
-          pip install --no-cache-dir --no-deps \
-            -e agent-governance-python/agent-governance-toolkit-core \
-            -e agent-governance-python/agent-governance-toolkit-cli \
-            -e agent-governance-python/agent-governance-toolkit-integrations \
-            -e agent-governance-python/agent-governance-toolkit-protocols
+          pip install --no-cache-dir -e agent-governance-python/agent-compliance
+          pip install --no-cache-dir --no-deps -e agent-governance-python/agt-policies
 
-      - name: Install agent-primitives (local sibling)
-        run: pip install --no-cache-dir -e agent-governance-python/agent-primitives
-
-      - name: Install agent-os-kernel
-        working-directory: agent-governance-python/agent-os
-        run: |
-          pip install --no-cache-dir -e ".[dev]"
-          pip install --no-cache-dir --require-hashes -r "$GITHUB_WORKSPACE/agent-governance-python/requirements/ci-yaml.txt"
-
-      - name: Find and validate policy files
+      - name: Find and validate native ACS manifests
         run: |
-          EXIT_CODE=0
-          echo "::group::Validating policy files"
-          for f in $(find . -name '*.yaml' -o -name '*.yml' \
-                     | grep -i policy \
-                     | grep -v 'charts/.*/templates/' \
-                     | grep -v 'node_modules/' \
-                     | sort); do
-            echo "--- Validating: $f ---"
-            python -m agent_os.policies.cli validate "$f" || EXIT_CODE=1
-          done
-          echo "::endgroup::"
-          exit "$EXIT_CODE"
+          python - <<'PY'
+          from pathlib import Path
+          from agent_compliance.lint_policy import lint_file
+
+          # A manifest that omits agent_control_specification_version would skip
+          # validation silently, which is the wrong direction for a policy gate.
+          # intervention_points is the ACS-specific tell: policies and agents
+          # are also used by unrelated config formats in this repo.
+          def declares_hooks(text):
+              return text.startswith("intervention_points:") or "\nintervention_points:" in text
+
+          manifests = []
+          missing_version = []
+          for root in (Path("examples"), Path("agent-governance-python")):
+              for pattern in ("*.yaml", "*.yml"):
+                  for path in root.rglob(pattern):
+                      text = path.read_text(encoding="utf-8", errors="ignore")
+                      if "agent_control_specification_version:" in text:
+                          manifests.append(path)
+                      elif declares_hooks(text):
+                          missing_version.append(path)
+
+          failed = [
+              f"{path}: declares intervention_points but no "
+              "agent_control_specification_version, so it skips validation"
+              for path in sorted(missing_version)
+          ]
+          for path in sorted(manifests):
+              result = lint_file(path)
+              if not result.passed:
+                  failed.extend(result.errors)
+
+          print(f"Validated {len(manifests)} native ACS manifests.")
+          for finding in failed:
+              print(finding)
+          raise SystemExit(bool(failed))
+          PY
 
   test-policies:
     runs-on: ubuntu-latest
@@ -86,35 +95,17 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Install consolidated v4 packages (local, --no-deps)
-        if: needs.changes.outputs.policies == 'true'
-        # The deprecated shim packages (agent-primitives, agent-os, ...) all
-        # declare a hard dep on agent-governance-toolkit-core>=4.0, which is
-        # not yet on PyPI. Pre-install the local consolidated packages with
-        # --no-deps so the subsequent shim installs resolve without pip
-        # reaching out to PyPI for the unpublished names.
-        run: |
-          pip install --no-cache-dir --no-deps \
-            -e agent-governance-python/agent-governance-toolkit-core \
-            -e agent-governance-python/agent-governance-toolkit-cli \
-            -e agent-governance-python/agent-governance-toolkit-integrations \
-            -e agent-governance-python/agent-governance-toolkit-protocols
-
-      - name: Install agent-primitives (local sibling)
-        if: needs.changes.outputs.policies == 'true'
-        run: pip install --no-cache-dir -e agent-governance-python/agent-primitives
-
-      - name: Install agent-os-kernel
+      - name: Install native manifest test dependencies
         if: needs.changes.outputs.policies == 'true'
-        working-directory: agent-governance-python/agent-os
         run: |
-          pip install --no-cache-dir -e ".[dev]"
+          pip install --no-cache-dir -e agent-governance-python/agent-compliance
+          pip install --no-cache-dir --no-deps -e agent-governance-python/agt-policies
           pip install --no-cache-dir --require-hashes -r "$GITHUB_WORKSPACE/agent-governance-python/requirements/ci-policy-test.txt"
 
-      - name: Run policy CLI tests
+      - name: Run native manifest lint tests
         if: needs.changes.outputs.policies == 'true'
-        working-directory: agent-governance-python/agent-os
-        run: pytest tests/test_policy_cli.py -v --tb=short
+        working-directory: agent-governance-python/agent-compliance
+        run: pytest tests/test_lint_policy.py tests/test_agt_cli.py -k lint -v --tb=short
 
       - name: Skip (no policy changes)
         if: needs.changes.outputs.policies != 'true'