feat(governance): platform self-resolves trace_id when caller leaves it empty

Lets the runtime layer (uipath-runtime-python) stop carrying ``trace_id``
through ``UiPathGovernedRuntime`` / ``GuardrailCompensator``. The runtime
emits compensation requests with ``trace_id=""`` and the platform fills
in the canonical agent trace id at HTTP-call time via the existing
``resolve_trace_id()`` helper — same fallback ``track_event`` (PR #1745)
already uses.

uipath-core
- ``GovernRequest.trace_id`` relaxes from required ``str`` to ``str = ""``
  default. Docstring documents the platform-side self-resolve contract
  so wire callers know an empty value is legitimate.

uipath-platform
- ``GovernanceService._compensate`` / ``_compensate_async`` now call a
  new ``_resolve_request_trace_id()`` helper before the POST. When
  ``request.trace_id`` is empty the helper resolves via
  ``resolve_trace_id()`` (env → LLMOps external span → OTel current
  span). Caller-supplied values win — the runtime captures live OTel
  context across its background-pool hop via
  ``contextvars.copy_context()``, so when the worker calls
  ``provider.compensate(...)`` the platform-side resolver sees the
  agent's live span and returns the same canonical id.

Caller-supplied non-empty trace ids continue to pass through unchanged.

Tests
- uipath-core governance suite: 32 passed.
- uipath-platform governance service suite: 27 passed.
- ruff + mypy clean on ``src/uipath/core/governance`` and
  ``src/uipath/platform/governance``.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: viswa-uipath

packages/uipath-core/src/uipath/core/governance/providers.py

@@ -106,6 +106,13 @@ class GovernRequest(BaseModel):
     them by leaving them ``None``. How unset fields are resolved (e.g.
     auto-filled from environment) is the concrete provider's concern,
     not part of this wire contract.
+
+    ``trace_id`` is also optional — when the caller passes an empty
+    string (or omits the field), the concrete provider is expected to
+    resolve the canonical trace id itself at HTTP-call time (typically
+    via :func:`uipath.platform.common._base_service.resolve_trace_id`).
+    Hosts that already hold a resolved value pass it in; hosts that
+    don't can let the provider do the work.
     """
 
     model_config = ConfigDict(populate_by_name=True)
@@ -114,7 +121,7 @@ class GovernRequest(BaseModel):
     rules: list[FiredRule]
     data: dict[str, Any]
     hook: str
-    trace_id: str = Field(alias="traceId")
+    trace_id: str = Field(default="", alias="traceId")
     src_timestamp: str  # wire key is intentionally snake_case
     agent_name: str = Field(alias="agentName")
     runtime_id: str = Field(alias="runtimeId")

packages/uipath-platform/src/uipath/platform/governance/_governance_service.py

@@ -22,7 +22,7 @@
     PolicyResponse,
 )
 
-from ..common._base_service import BaseService
+from ..common._base_service import BaseService, resolve_trace_id
 from ..common._config import UiPathConfig
 from ..common._service_url_overrides import (
     inject_routing_headers,
@@ -262,18 +262,46 @@ def _compensate(self, request: GovernRequest) -> None:
         to satisfy :class:`uipath.core.governance.GovernanceCompensationProvider`
         without unpacking the request. The public ergonomic counterpart
         is :meth:`compensate`.
+
+        When ``request.trace_id`` is empty the service resolves the
+        canonical trace id itself via :func:`resolve_trace_id` — same
+        fallback ``track_event`` uses. Callers that have a resolved
+        value still pass it in; callers that don't (e.g. the runtime
+        layer, which intentionally stays env-free) leave it empty and
+        let the service do the work.
         """
+        request = self._resolve_request_trace_id(request)
         url, headers = self._build_org_scoped_request(GOVERN_API_PATH)
         payload = self._build_govern_payload(request)
         self.request("POST", url=url, headers=headers, json=payload)
 
     @traced(name="governance_compensate", run_type="uipath")
     async def _compensate_async(self, request: GovernRequest) -> None:
-        """Async variant of :meth:`_compensate`."""
+        """Async variant of :meth:`_compensate`.
+
+        Same ``trace_id`` self-resolution behavior as the sync variant.
+        """
+        request = self._resolve_request_trace_id(request)
         url, headers = self._build_org_scoped_request(GOVERN_API_PATH)
         payload = self._build_govern_payload(request)
         await self.request_async("POST", url=url, headers=headers, json=payload)
 
+    @staticmethod
+    def _resolve_request_trace_id(request: GovernRequest) -> GovernRequest:
+        """Fill ``request.trace_id`` from :func:`resolve_trace_id` when empty.
+
+        Caller-supplied values win — the runtime captures on the hook
+        thread (via ``contextvars.copy_context`` for the background
+        pool) and the resolver here only fires when nothing was
+        captured.
+        """
+        if request.trace_id:
+            return request
+        resolved = resolve_trace_id()
+        if not resolved:
+            return request
+        return request.model_copy(update={"trace_id": resolved})
+
     # ── Internals ────────────────────────────────────────────────────
 
     def _build_org_scoped_request(self, path: str) -> tuple[str, dict[str, str]]: