feat(e2e): add Python governance scenarios and CI workflow

[prayagupa]

Description

Adds a Python end-to-end governance suite covering five production control boundaries:

• Policy denial prevents an unauthorized live budget mutation.
• Policy allowance permits a non-diagnostic record update.
• PII redaction removes sensitive data before model and tool boundaries.
• Prompt-injection detection blocks poisoned retrieval content before model invocation.
• Filesystem sandboxing prevents writes outside the configured workspace.

Adds a GitHub Actions workflow that runs the suite against Ollama and llama3.1. The workflow pins the Ollama release, verifies its archive checksum and model digest, caches the model, and uploads scenario results, JUnit output, and runtime metadata.

Also updates the v4 ratchet inventory, secret-scanning fixture allowlist, spell-check terms, and E2E documentation.

See example: https://github.com/microsoft/agent-governance-toolkit/actions/runs/29459498584/job/87499812340

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

• agent-os-kernel
• agent-mesh
• agent-runtime
• agent-sre
• agent-governance
• docs / root

Checklist

• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any):

None.

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

If AI tools materially shaped this change, briefly note what was used:

GitHub Copilot assisted with implementation, documentation, and validation. The contributor directed and reviewed the resulting changes.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

Related Issues

None.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/cache	55cc8345863c7cc4c66a329aec7e433d2d1c52a9	🟢 6.4	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches
actions/actions/checkout	df4cb1c069e1874edd31b4311f1884172cec0e10	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/setup-python	a309ff8b426b58ec0e2a45f0f869d46889d02405	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 9 11 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
actions/actions/upload-artifact	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
actions/dtolnay/rust-toolchain	29eef336d9b2848a0b548edc03f92a220660cdb8	🟢 4.6	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 1 2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Code-Review ⚠️ 0 Found 0/19 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 3 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/e2e-python.yml

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

Documentation is in sync.

[github-actions]

🤖 AI Agent: security-scanner — Security Review

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Security Review

Severity	Finding	Fix
High	The workflow downloads and executes a binary (ollama-linux-amd64.tgz) from an external URL without verifying its source authenticity beyond a checksum. This could allow an attacker to replace the binary with a malicious one if the source is compromised.	Use a trusted and verified source for downloading the binary, such as a package manager or a repository with signed releases. Alternatively, verify the binary's signature using a trusted public key.
Medium	The workflow uses a hardcoded SHA256 checksum (OLLAMA_V0_5_7_LINUX_AMD64_SHA256) to verify the downloaded binary. If the checksum is compromised, the verification can be bypassed.	Use a more secure method of verification, such as GPG signature verification, to ensure the binary's integrity and authenticity.
Medium	The ollama serve command starts a local server without any authentication or access control, potentially exposing it to unauthorized access if the CI environment is misconfigured.	Ensure the server is bound to localhost only and cannot be accessed externally. Consider implementing authentication for the server.
Medium	The ollama pull command fetches a model without verifying the integrity of the downloaded model file before use.	Add a verification step to ensure the integrity of the downloaded model file, such as verifying a cryptographic signature or checksum.
Low	The AGT_E2E_MODEL_DIGEST environment variable is used to verify the model digest, but it is not clear how this value is securely managed or updated.	Document the process for securely managing and updating this value to prevent potential misuse or errors.

[github-actions]

🤖 AI Agent: test-generator — `tests/e2e_python/scenarios/policy_deny/test_policy_deny.py`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

tests/e2e_python/scenarios/policy_deny/test_policy_deny.py

• test_policy_deny_unauthorized_mutation -- Validate denial of unauthorized budget mutation with edge cases for malformed requests.
• test_policy_deny_no_policy -- Ensure behavior when no policy is applied.

tests/e2e_python/scenarios/policy_allow/test_policy_allow.py

• test_policy_allow_valid_update -- Validate allowance of a valid non-diagnostic record update.
• test_policy_allow_invalid_update -- Ensure rejection of invalid updates or unauthorized fields.

tests/e2e_python/scenarios/pii_redaction/test_pii_redaction.py

• test_pii_redaction_completeness -- Verify all sensitive fields are redacted before model/tool boundaries.
• test_pii_redaction_edge_cases -- Test redaction of edge-case inputs like nested or malformed PII.

tests/e2e_python/scenarios/prompt_injection/test_prompt_injection.py

• test_prompt_injection_detection -- Validate detection and blocking of poisoned retrieval content.
• test_prompt_injection_false_positive -- Ensure legitimate content is not incorrectly flagged.

tests/e2e_python/scenarios/filesystem_escape/test_filesystem_escape.py

• test_filesystem_escape_prevention -- Validate sandbox prevents writes outside the workspace.
• test_filesystem_escape_edge_cases -- Test edge cases like symlink traversal or relative paths.

[github-actions]

🤖 AI Agent: code-reviewer — Action items:

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 2 warnings. The PR introduces a robust end-to-end governance test suite and CI workflow, but there are minor concerns regarding model verification and test coverage.

#	Sev	Issue	Where
1	⚠️	Model digest verification lacks fallback for failure scenarios.	.github/workflows/e2e-python.yml
2	⚠️	Test coverage for edge cases in governance scenarios is unclear.	tests/e2e_python/

Action items:

1. Add a fallback mechanism or alert for failed model digest verification in .github/workflows/e2e-python.yml.

Warnings (fine as follow-up PRs):

#	Issue	Where
1	Expand test coverage to include edge cases for all governance scenarios.	tests/e2e_python/

[MohammadHaroonAbuomar]

• .github/workflows/e2e-python.yml: the new uses: dtolnay/rust-toolchain@stable step is a mutable tag; this repo pins that exact action to dtolnay/rust-toolchain@29eef33 # stable in policy-engine-ci.yml (x2) and ci.yml:1074. SHA-pin it to match repo convention. Everything else in the ACS migration is verified sound (semantics preserved with default-deny strengthening; no fail-open at harness/SDK/Rust-core layers; ratchet exemption removal correct, ratchet passes locally; cache/upload-artifact bumps SHA-verified against upstream tags).