[pportal2]

Continues Pierre Portal's original Govern implementation in this PR and incorporates his original skill commits from #173. All 15 original commits retain their hashes and authorship. The integration commit also includes Pierre's co-author trailer; retain that attribution if squash-merging.

This replaces #195. The validated Govern file tree is unchanged, and #196 now follows this PR.

Add 86 public SDK Govern operations to the shared discovery/execution interface introduced in #194. Govern tasks can inspect and mutate artifacts, blueprints, signoffs, permissions, time series and supporting administration without registering additional MCP tools.

Stacks on #194 (feat/product-api-operations). Merge #179, then #194, before this PR. Rebase and retarget to release/0.9.0 after the parent merges. Agent Management follows separately in #196.

Scope

• Add the Govern SDK adapter, structural argument schemas, operation declarations and domain guides. Reuse the four existing v2 tools; the catalog now contains 99 actions (13 Deployer + 86 Govern), with 135 MCP tools throughout.
• Enable Govern v2 policy and connection checks using GovernClient over stdio. Preserve the selected profile's API key/ticket and certificate settings.
• Reject Govern HTTP execution before backend token exchange. HTTP connection status reports unsupported_authentication without constructing a Govern client; no custom bearer-token implementation or endpoint fallback is added.
• Upgrade dataiku-api-client to 15.2.0 in project/runtime dependencies and locks for the validated public SDK contract.
• Keep Agent Management deferred. Design/Automation v1 policy and Deployer behavior remain unchanged.

Validation

• Locked dependency sync, pre-commit, PEP 723 lock, license-header and Conventional Commit checks
• uv run pytest: 881 passed on Python 3.14
• uv build; isolated installed-wheel smoke: 135 tools and 99 operations
• Catalog/schema validation, Govern SDK routing, transport rejection, destructive intent, response redaction and asynchronous request context tests

No live-instance validation. Full GitHub CI runs after retargeting this stacked draft to a main/release branch.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[pportal2]

I have read the CLA Document and I hereby sign the CLA

[yjouini]

Make draft blueprint versions discoverable, list_blueprint_versions uses the regular SDK listing, which excludes DRAFT versions. Please expose a designer listing path while preserving ordinary reader access

[pportal2]

Fixed in 55eef4d. list_blueprint_versions has a new optional include_drafts argument. When it is not set, the operation uses the reader listing as before. With include_drafts: true, it uses the designer listing, which also returns DRAFT versions and needs designer rights.

Also in 1a21fe8: Govern errors now return the server message to the agent instead of one generic text. Before, the agent could not tell a wrong ID from a workflow rule, such as the danger_zone refusal or "sign-off already exists". The message is cut at 1000 characters. A failed write also tells the agent to re-read the object before it retries. This reverses the Deployer pattern for Govern only, because no Govern operation reads or writes secrets.