feat(server)!: implement recursive control condition trees

[lan17]

Summary

• replace flat control predicates with recursive condition trees across the shared models, engine, server, SDKs, and UI
• add pre-upgrade control migration tooling plus safe condition_trace metadata for composite evaluation
• bump package majors and regenerate the TypeScript SDK/API types for the new contract

Scope

• User-facing/API changes:
  • ControlDefinition now uses a top-level condition tree instead of top-level selector / evaluator
  • controls now support nested and / or / not composition with a hard API depth limit of 6
  • /api/v1 stays the same, but this is a major-version wire break and old SDK majors are unsupported against the new server
  • added make server-migrate-control-conditions MIGRATE_ARGS=--dry-run and make server-migrate-control-conditions MIGRATE_ARGS=--apply
• Internal changes:
  • recursive engine evaluation with short-circuiting and metadata.condition_trace
  • recursive server-side validation with nested field paths
  • Python SDK recursive leaf checks plus non-blocking server-version mismatch warnings
  • UI condition-tree builder with add/remove/convert/reorder actions and nested error rendering
• Out of scope:
  • runtime backward-compatibility shims for legacy flat control payloads
  • drag-and-drop tree editing

Risk and Rollout

• Risk level: high
• Rollback plan:
  • take a database backup before running the migration apply step
  • if rollout fails before migration, revert to the previous server/SDK major
  • if rollout fails after migration, restore the pre-migration database snapshot before rolling back the server major

Testing

• Added or updated automated tests
• Ran make check
• Manually verified behavior

make check passed, which covered:

• make server-test
• make engine-test
• make sdk-test
• make evaluators-test
• repo linting
• repo typechecking

Notes:

• the run emitted a few existing third-party warnings (sqlglot[rs] deprecation, Strands resource/deprecation warnings), but the full target passed cleanly

Checklist

• Linked issue/spec: sc-57582, sc-58429
• Updated docs/examples for user-facing changes
• Included any required follow-up tasks

[codecov]

Codecov Report

❌ Patch coverage is 75.22936% with 108 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ntrol_server/scripts/migrate_control_conditions.py	0.00%	61 Missing ⚠️
engine/src/agent_control_engine/core.py	87.09%	12 Missing ⚠️
models/src/agent_control_models/controls.py	87.34%	10 Missing ⚠️
...agent_control_server/services/control_migration.py	79.06%	9 Missing ⚠️
...erver/src/agent_control_server/endpoints/agents.py	84.09%	7 Missing ⚠️
...ver/src/agent_control_server/endpoints/controls.py	85.71%	7 Missing ⚠️
sdks/python/src/agent_control/evaluation.py	88.23%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!