fix(core): fix dependency pins blocking agent-governance-toolkit-core installs

CHANGELOG.md

@@ -26,6 +26,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - **.NET numeric equality/inequality in policy-rule conditions** — `PolicyRule` conditions such as `count == 5` and `score != 3.14` now evaluate numeric literals (integers, decimals, and negatives) instead of failing to match, and numeric `!=` matches when the field is missing or non-numeric so deny rules fail closed. Numeric operands are parsed with the invariant culture so evaluation is deterministic across host locales (#3205).
+- **`agent-governance-toolkit-core` and `[full]` no longer require `agt-policies`
+  as a base dependency.** `agt-policies>=5.1.0` (requiring an unpublished
+  `agent-control-specification>=0.4.0b0`) had become a base dependency, blocking
+  `pip install`. Moved `agt-policies` to an opt-in `migrate` extra — existing
+  `agt migrate` users now need `pip install agent-governance-toolkit-core[migrate]`
+  — and made `agent-control-specification>=0.4.0b0,<0.5.0` a direct base
+  dependency instead, matching the version `agent_os` actually requires. A
+  resolvable PyPI install of `agent-governance-toolkit-core` still depends on
+  `agent-control-specification` 0.4.0b0 and `agt-policies` 5.1.0 being
+  published — tracked in #4019.
 - **Spell check no longer reports the base branch's own history as a
   contributor's changes** — `scripts/ci/changed_lines.py` diffed from the tip of
   the base branch, so on a branch behind `main` every line `main` had since

agent-governance-python/agent-governance-toolkit-core/pyproject.toml

@@ -1,3 +1,3 @@
 [build-system]
 requires = ["hatchling>=1.18"]
 build-backend = "hatchling.build"
@@ -38,8 +38,11 @@
 
 # Merged dependencies from agent-os-kernel, agentmesh-primitives,
 # agentmesh-runtime, agent-hypervisor, and agentmesh-platform.
+#
+# agent-control-specification is declared directly: agent_os (force-included
+# below) imports it, and it previously arrived only transitively via agt-policies.
 dependencies = [
-    "agt-policies>=5.1.0,<6.0",
+    "agent-control-specification>=0.4.0b0,<0.5.0",
     "pydantic[email]>=2.5.0,<3.0",
     "pyyaml>=6.0,<7.0",
     "rich>=13.0.0,<16.0",
@@ -100,6 +103,13 @@
     "grpcio-tools>=1.60.0,<2.0",
 ]
 
+# agt-policies backs only the `agt migrate` CLI; the govern() runtime doesn't import it.
+# This pin is currently unresolvable on its own (agt-policies>=5.1.0 is not published);
+# see #4019.
+migrate = [
+    "agt-policies>=5.1.0,<6.0",
+]
+
 # --- Bundles ---
 full = [
     "agent-governance-toolkit-core[cmvk,iatp,amb,observability,mcp,nexus,api,otel,server,storage]",

tests/ci/test_release_tooling.py

@@ -158,7 +158,7 @@ def test_python_manifest_producers_require_the_retargeted_sdk() -> None:
     )["project"]
     policy_requirement = next(
         Requirement(value)
-        for value in core["dependencies"]
+        for value in core["optional-dependencies"]["migrate"]
         if Requirement(value).name == "agt-policies"
     )
     assert Version("5.1.0") in policy_requirement.specifier