feat(sdk): add step_type as input parameter to the control decorator and evaluate_controls function

[namrataghadi-galileo]

Summary

• Added support for arbitrary custom step types such as retriever, trace, and session across the Python SDK, telemetry, observability models, TypeScript SDK, and UI API types.
  Existing llm/tool inference remains unchanged.
  This is to accomodate controls at different levels especially Luna but not restricted to Galileo levels only.

Scope

User-facing/API changes:- Added step_type: str | None to @agent_control.control().

• Widened evaluate_controls(step_type) to accept custom strings.
• Updated generated TypeScript/UI API artifacts.

Internal changes:- Preserved custom decorator arguments and telemetry classifications.

• Added step-type normalization and validation.
• Added endpoint and regression tests.

Out of scope:- Google ADK and Strands adapters remain intentionally limited to LLM/tool lifecycle events.

Risk and Rollout

Risk level: low
Rollback plan: Revert this commit.

Testing

• [ x] Added or updated automated tests
• [ x] Ran make check (or explained why not)
• [x ] Manually verified behavior

Checklist

• Linked issue/spec (if applicable)
• [ x] Updated docs/examples for user-facing changes
• Included any required follow-up tasks

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[josjeon]

Question:

So my understanding is that an unknown type/typo like step_type="sesion" passes through and matches no controls, and process() early returns is_safe=True, confidence=1.0 like:

agent-control/engine/src/agent_control_engine/core.py

Lines 642 to 649 in bd90753

	if not applicable:
	confidence = 0.0 if precheck_errors else 1.0
	return EvaluationResponse(
	is_safe=True,
	confidence=confidence,
	matches=None,
	errors=precheck_errors or None,
	)

so it reads the same as a genuine pass. Assuming that's intentional for now?

[namrataghadi-galileo]

@josjeon Yes—that is intentional with the current generic string-based design.
step_type="sesion" is accepted as a non-empty custom type. If no controls apply to that type, the engine returns:

• is_safe=True
• confidence=1.0 when there are no precheck errors
• no matches
  This preserves support for arbitrary custom step types, but means typos can silently bypass controls scoped to "session". Controls without a step-type restriction may still apply. A future strict mode or registered step-type vocabulary could detect typos, but that is not part of this change.