feat: add agent learning governance core

[ctava-msft]

Summary

Adds the Public Preview agent_learning_gov core package for policy-controlled Microsoft Agent Learning 0.8.x capture, reward shaping, offline learning, evaluation, provenance, audit, and staged promotion.

This supersedes #3727. It addresses the review feedback by adding ADR-0033 and limiting this PR to the core package, focused tests, and core contract documentation. Dashboard, example, and notebook surfaces are in a separate follow-up PR.

Related Issue

No linked issue. Supersedes closed PR #3727.

Problem & Solution

Problem: Agent Learning workflows need reusable governance around action capture, reward shaping, offline policy updates, and rollout. Without a dedicated integration, learned candidates can lack consistent policy checks, auditable lineage, and fail-closed promotion semantics.

Solution: Add a first-party adapter package that preserves Agent Learning's learned-policy and Bayesian decision routes while AGT owns policy enforcement, governance metadata, audit evidence, candidate validation, and promotion gates.

Design

ADR-0033 records the scope, dependency choice, governance model, alternatives, and delivery boundary:

• agent-learning>=0.8.0,<0.9.0 is a direct bounded dependency because the adapter relies on the pre-1.0 episode, policy, store, and dual decision-route contracts. Supporting a new upstream minor requires explicit compatibility review.
• Runtime action and tool checks fail closed by default.
• Blocked episodes and Bayesian decisions are excluded from REINFORCE updates.
• Learning operates on an isolated policy copy; the active pointer is unchanged until staged promotion succeeds.
• Decision certificates, candidates, and promotion receipts carry signed provenance.
• Production promotion requires durable run state, audit support, staged rollout, and rollback capability.

Impact on Your Work

Consumers get reusable and testable governance controls without modifying Agent Learning itself. Unwrapped Agent Learning calls remain outside this enforcement boundary, and operators remain responsible for durable storage, secret management, deployment callbacks, and monitoring.

Timeline

None.

Alternatives Considered

• A docs-only example was rejected because it cannot provide reusable enforcement, provenance, or rollback semantics.
• Modifying Agent Learning directly was rejected because it would couple its release cadence to AGT policy.
• Structural look-alikes without a direct dependency were rejected because silent drift in pre-1.0 decision and storage contracts would be unsafe.

Changes

Area	What changed
agent-governance-python/agent-learning/src/agent_learning_gov/	Governed capture, policy adapters, reward shaping, offline learning, evaluation, promotion, provenance, and audit.
agent-governance-python/agent-learning/tests/	Focused unit coverage and a version-gated Agent Learning 0.8.x lifecycle suite.
agent-governance-python/agent-learning/pyproject.toml	Public Preview package metadata and bounded Agent Learning and AGT core dependencies.
docs/adr/0033-agent-learning-governance-integration.md	Scope, dependency rationale, governance boundaries, alternatives, and review split.
docs/integrations/ and docs/packages/	Core architecture, operational limits, and API documentation.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

Shared / other:

• agent-learning (new Public Preview package)
• docs / root

Testing

Unit Testing

• python -m pytest agent-governance-python/agent-learning/tests -q: 77 passed, 1 skipped.
• The skip is the version-gated Agent Learning 0.8.x lifecycle suite because the active environment has a different agent_learning version.

Manual Testing

• python scripts/docs/check_links.py: 295 files, 2,575 links, 0 new broken.
• python scripts/docs/check_frontmatter.py --strict: 282 files, 0 findings.
• git diff --check upstream2/main...HEAD: passed.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All available package tests pass (one disclosed version-gated skip)
• I have updated documentation as needed
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects:

• Microsoft Agent Learning v0.8.0 (MIT) defines the public API and lifecycle integrated here. The package docs and ADR preserve its learned-policy and Bayesian decision routes.

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

GitHub Copilot assisted with validation, Git operations, ADR preparation, and PR preparation. All generated changes require contributor review.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.