feat(studio): scaffold package and isolated CI validation

.cspell-repo-terms.txt

@@ -1306,3 +1306,9 @@ ITAR
 bssn
 uncued
 undelimited
+tseslint
+autoprefixer
+vite
+vitejs
+tanstack
+maxfail

.github/CODEOWNERS

@@ -2,9 +2,11 @@
 #
 # Every pull request requires an approving review from one of the owners
 # below (enforced by branch protection + the "Protect" ruleset:
-# require_code_owner_review). This is the maintainer-approval gate — it
-# replaces the former require-maintainer-approval.yml CI workflow.
+# require_code_owner_review). This is the maintainer-approval gate —
+# it replaces the former require-maintainer-approval.yml CI workflow.
 #
 # Only the project lead can bypass this requirement or push without a PR.
 
 * @MohammadHaroonAbuomar @liamcrumm @prayagupa
+
+/agent-governance-studio/ @MohammadHaroonAbuomar @liamcrumm @prayagupa

.github/dependabot.yml

@@ -61,6 +61,7 @@ updates:
       - "/agent-governance-typescript"
       - "/agent-governance-antigravity-cli"
       - "/agent-governance-codex-cli"
+      - "/agent-governance-studio/web"
     schedule:
       interval: "weekly"
     cooldown:

.github/workflows/ci.yml

@@ -23,6 +23,7 @@ jobs:
       python: ${{ steps.filter.outputs.python }}
       dotnet: ${{ steps.filter.outputs.dotnet }}
       typescript: ${{ steps.filter.outputs.typescript }}
+      studio: ${{ steps.filter.outputs.studio }}
       integrations: ${{ steps.filter.outputs.integrations }}
       rust: ${{ steps.filter.outputs.rust }}
       go: ${{ steps.filter.outputs.go }}
@@ -76,6 +77,9 @@ jobs:
               - 'agent-governance-python/agent-os/extensions/**'
               - 'agent-governance-python/agentmesh-integrations/mastra-agentmesh/**'
               - 'agent-governance-python/agentmesh-integrations/copilot-governance/**'
+            studio:
+              - 'agent-governance-studio/**'
+              - '.github/workflows/ci.yml'
             integrations:
               - 'agent-governance-python/agentmesh-integrations/**'
               - 'examples/flowise-governance/**'
@@ -1260,6 +1264,71 @@ jobs:
             echo "No tests configured"
           fi
 
+  build-studio:
+    needs: changes
+    if: needs.changes.outputs.studio == 'true' || github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11'
+
+      - name: Install Python lint tooling
+        run: |
+          pip install --no-cache-dir --require-hashes \
+            -r agent-governance-python/requirements/ci-lint.txt
+
+      - name: Install Python test tooling
+        run: |
+          pip install --no-cache-dir --require-hashes \
+            -r agent-governance-python/requirements/ci-test.txt
+
+      - name: Install Python build tooling
+        run: |
+          pip install --no-cache-dir --require-hashes \
+            -r agent-governance-python/requirements/ci-build.txt
+
+      - name: Install Studio package
+        run: |
+          pip install --no-cache-dir -e agent-governance-studio
+
+      - name: Run Python lint
+        run: |
+          ruff check agent-governance-studio/src agent-governance-studio/tests --select E,F,W --ignore E501
+
+      - name: Run Python tests
+        run: |
+          python -m pytest agent-governance-studio/tests -q --maxfail=1
+
+      - name: Build Python package
+        run: |
+          python -m build agent-governance-studio
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '20'
+
+      - name: Install frontend dependencies
+        run: |
+          npm ci --ignore-scripts --prefix agent-governance-studio/web
+
+      - name: Run frontend lint
+        run: |
+          npm run lint --prefix agent-governance-studio/web
+
+      - name: Run frontend tests
+        run: |
+          npm test --prefix agent-governance-studio/web
+
+      - name: Build frontend
+        run: |
+          npm run build --prefix agent-governance-studio/web
+
   # ── Rust build + test (only when Rust files change) ──────────────────
   build-rust:
     needs: changes
@@ -1447,6 +1516,7 @@ jobs:
         workflow-security,
         test-integrations-ts,
         build-npm,
+        build-studio,
         build-rust,
         build-go,
         docker-compose-test,

.github/workflows/supply-chain-check.yml

@@ -185,7 +185,7 @@ jobs:
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
-          python3 scripts/check_install_scripts.py --base "origin/${BASE_REF}" --strict
+          python3 scripts/check_install_scripts.py --base "origin/${BASE_REF}" --strict --max-deps 0 --total-deadline-sec 300 --allow fsevents
 
   # ------------------------------------------------------------------
   # G3 (H5): build-hook (setup.py / build.rs) addition flagger.

agent-governance-studio/.gitignore

@@ -0,0 +1,11 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.pytest_cache/
+
+# Frontend
+web/node_modules/
+web/dist/

agent-governance-studio/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agent-governance-studio/MANIFEST.in

@@ -0,0 +1,10 @@
+include README.md
+include LICENSE
+include pyproject.toml
+recursive-include src *.py
+recursive-include tests *.py
+global-exclude __pycache__
+global-exclude *.py[co]
+global-exclude .DS_Store
+global-exclude *.swp
+global-exclude *.swo

agent-governance-studio/README.md

@@ -0,0 +1,40 @@
+# AGT Studio
+
+AGT Studio is the unified UI for the Agent Governance Toolkit.
+
+## Status
+
+Public Preview.
+
+## Scope
+
+This package provides the initial Python package and frontend scaffold for AGT Studio. Product UI capabilities, Engine API integration, transport abstractions, navigation, and operational workflows are deferred to later issues.
+
+## Related design
+
+- [AGT Studio Epic #2729](https://github.com/microsoft/agent-governance-toolkit/issues/2729)
+- [ADR 0028 — AGT Studio unified UI](../../docs/adr/0028-agt-studio-unified-ui.md)
+- [Studio sidecar security posture](../../docs/studio/sidecar-security-posture.md)
+
+## Development
+
+### Python
+
+```bash
+python -m build agent-governance-studio
+python -m pytest agent-governance-studio/tests -q
+ruff check agent-governance-studio/src agent-governance-studio/tests --select E,F,W --ignore E501
+```
+
+### Frontend
+
+```bash
+npm ci --prefix agent-governance-studio/web
+npm run lint --prefix agent-governance-studio/web
+npm test --prefix agent-governance-studio/web
+npm run build --prefix agent-governance-studio/web
+```
+
+## Deferred work
+
+The initial scaffold does not include `agt ui`, `agt serve`, Engine API calls, transport abstractions, policy screens, navigation, or operational write-path actions. These are addressed by subsequent AGT Studio issues.

agent-governance-studio/pyproject.toml

@@ -0,0 +1,32 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+[build-system]
+requires = ["setuptools>=78.1.1,<85.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "agent-governance-studio"
+version = "5.0.0"
+description = "Public Preview — Agent Governance Toolkit Studio"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.11"
+authors = [
+    { name = "Microsoft Corporation", email = "agentgovtoolkit@microsoft.com" },
+]
+maintainers = [
+    { name = "Agent Governance Toolkit Team", email = "agentgovtoolkit@microsoft.com" },
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/microsoft/agent-governance-toolkit"
+Repository = "https://github.com/microsoft/agent-governance-toolkit"
+Documentation = "https://github.com/microsoft/agent-governance-toolkit/tree/main/docs"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]

agent-governance-studio/src/agent_governance_studio/__init__.py

@@ -0,0 +1,6 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+"""AGT Studio Python package."""
+
+__version__ = "5.0.0"

agent-governance-studio/tests/test_package.py

@@ -0,0 +1,10 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+"""Tests for the AGT Studio Python package."""
+
+import agent_governance_studio
+
+
+def test_package_import_and_version() -> None:
+    assert agent_governance_studio.__version__ == "5.0.0"

agent-governance-studio/web/eslint.config.js

@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import eslint from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import reactHooks from 'eslint-plugin-react-hooks';
+
+export default tseslint.config(
+  {
+    ignores: ['dist', 'coverage', 'node_modules'],
+  },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['**/*.{ts,tsx}'],
+    languageOptions: {
+      globals: {
+        console: 'readonly',
+        document: 'readonly',
+        window: 'readonly',
+      },
+    },
+    plugins: {
+      'react-hooks': reactHooks,
+    },
+    rules: {
+      'react-hooks/rules-of-hooks': 'error',
+      'react-hooks/exhaustive-deps': 'warn',
+    },
+  },
+);

agent-governance-studio/web/index.html

@@ -0,0 +1,17 @@
+<!--
+Copyright (c) Microsoft Corporation.
+Licensed under the MIT License.
+-->
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="description" content="Agent Governance Toolkit Studio" />
+    <title>AGT Studio</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>