[AAASM-3540] ✨ (examples): Add Haystack tool-policy example

[Chisanan232]

Description

Adds python/haystack-tool-policy/ — a runnable governance demo for a real Haystack agent using the SDK's native Haystack adapter (AAASM-3540, companion to python-sdk#160 and integration-tests#106).

The example installs the native HaystackPatch (which hooks haystack.tools.Tool.invoke) against a local policy, then drives three real haystack.tools.Tool instances through a genuine haystack.components.tools.ToolInvoker — the exact component a Haystack Agent uses to execute a model-chosen tool call. An allowed tool (query_index) runs; the denied execute_sql tool is short-circuited before its body executes. This is genuine governance, not a no-op — the EXECUTED ledger and the test_denied_tool_body_never_runs smoke test prove the denied tool function never ran.

Offline by default: tools are driven via a hand-built ToolCall, so no LLM or API key is needed (matching the other native-adapter examples like pydantic-ai / google-adk).

Also adds the example to both gallery indexes and a haystack-tool-policy job to verify-python.yml.

Type of Change

• ✨ New example

Related Issues

• Related Jira ticket: AAASM-3540 (parent AAASM-3535)

Testing

Validated locally against the python-sdk Haystack branch (the adapter is not yet in a published SDK):

uv run pytest tests/ -v   → 6 passed
uv run python src/main.py → query_index ✅ ALLOWED, summarize_docs ✅ ALLOWED,
                            execute_sql ❌ BLOCKED; executed=['query_index','summarize_docs']

The --mock/offline smoke is the CI path (uv sync --extra dev).

Known release-ordering note

uv sync resolves agent-assembly from PyPI, where the Haystack adapter has not shipped yet (it lands with python-sdk#160). Until a new agent-assembly release includes agent_assembly.adapters.haystack, the CI verify-python job for this example will fail import — exactly as any new native-adapter example does before its SDK release. This PR should merge after the SDK adapter is released (or the smoke importorskips on the adapter if reviewers prefer; happy to adjust).

Checklist

• No secrets — .env.example only
• haystack-ai pinned >=2.0.0,<3.0 (not a bare >=)
• Self-review of diff completed
• Commits follow the Gitmoji convention

🤖 Generated with Claude Code

[Chisanan232]

Claude Code — review result (Haystack example)

⚠️ The haystack-tool-policy smoke job is red for release-ordering only, not a defect:

ModuleNotFoundError: No module named 'agent_assembly.adapters.haystack'

The adapter ships only in python-sdk #160 (unmerged) — so the example's import resolves once #160 merges and a python-sdk release publishes to PyPI. The agent validated the example locally against the #160 branch (real Haystack agent governed via a ToolInvoker; execute_sql blocked, body never runs; 6 smoke tests pass).

Merge order: LAST — after python-sdk #160 merges + b5 release. I'll re-confirm this job goes green once b5 is on PyPI. Full cross-repo review on AAASM-3535.

[Chisanan232]

Claude Code — SonarCloud new-code review (round 2)

Found + fixed 1 finding: S7632 MAJOR tests/test_smoke.py:25 — malformed # noqa comment (trailing prose). Cleaned to # noqa: ANN201.

✅ Sonar gate OK; 0 new-code issues. (Reminder: the haystack-tool-policy smoke job remains red for release-ordering only — resolves after python-sdk #160 + a b5 release; unrelated to Sonar.)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud