Add cross-agent policy federation

[lleonardo-franco]

Resolves agentguard-ai/tealtiger#123.

Summary:

• Adds a signed, transport-agnostic PolicyFederation token and child context helper for propagating parent constraints.
• Merges inherited budget ceilings, tool allowlists, data classification ceilings, and revocations into local TealEngine policy with the most restrictive rule winning.
• Adds federation-aware evaluation metadata plus unit and integration coverage for budget, tool, revocation, and cross-SDK token compatibility.

Validation:

• npx tsc --noEmit
• npm run build:types
• npm test -- --runTestsByPath src/core/engine/tests/PolicyFederation.test.ts src/core/engine/tests/TealEngine.test.ts src/core/engine/tests/TealEngine.properties.test.ts --runInBand --no-watchman
• npm test -- --runInBand --no-watchman

Note:

• The full Jest suite passes; it still prints the existing open-handle warning after reporting success.

[nagasatish007]

Hey @lleonardo-franco — this has merge conflicts with main (from the hot-reload PR #15 that just merged). Could you rebase your branch on main and resolve the conflicts? Both features touch TealEngine.ts in the same areas.

Key merge point: updatePolicies() should use your federation merge + the new applyPolicyReload() from hot-reload. Something like:

public updatePolicies(policies: TealPolicy): void {
const nextPolicies = this.federationConstraints
? PolicyFederation.mergePolicies(policies, this.federationConstraints)
: policies;
const result = this.applyPolicyReload(nextPolicies);
if (!result.success) {
throw new Error(TealEngine: Invalid policy configuration: ${result.error});
}
this.localPolicies = policies;
}
Once rebased and tests pass, this is approved to merge. Thanks!

[lleonardo-franco]

Rebased this branch onto main and integrated policy federation with the newly merged hot-reload path. updatePolicies() and federated constraint updates now run through applyPolicyReload(), so inherited constraints remain enforced while policy versioning and cache invalidation are preserved. I also added coverage for local policy reloads under inherited parent limits.

Validated with:

• npx tsc --noEmit
• npm run build:types
• npm test -- --runTestsByPath src/core/engine/__tests__/PolicyFederation.test.ts src/core/engine/__tests__/PolicyWatcher.test.ts src/core/engine/__tests__/TealEngine.test.ts src/core/engine/__tests__/TealEngine.properties.test.ts --runInBand --no-watchman
• npm test -- --runInBand --no-watchman

Could you please take another look?