[dbhurley]

Summary

Brings the .NET SDK to feature parity with the Python and JavaScript SDKs.

Changes

New Typed Exceptions

• MeshGuardException - Base exception with TraceId support
• AuthenticationException - Raised on 401 errors
• PolicyDeniedException - Raised on 403 with full context (action, policy, rule, reason)
• RateLimitException - Raised on 429 errors

Core Governance APIs

• CheckAsync(action, resource) - Returns PolicyDecision (never throws on deny)
• EnforceAsync(action, resource) - Throws PolicyDeniedException on deny
• GovernAsync<T>(action, fn) - Execute function only if allowed (lambda pattern)

Admin APIs (require admin token)

• ListAgentsAsync() - List all agents
• CreateAgentAsync(options) - Create new agent
• UpdateAgentAsync(agentId, updates) - Update existing agent
• RevokeAgentAsync(agentId) - Delete/revoke agent
• ListPoliciesAsync() - List all policies
• GetAuditLogAsync(options) - Query audit log entries

Proxy Request Methods

• GetAsync(path, action)
• PostAsync(path, action, content)
• PostJsonAsync<T>(path, action, body)
• PutAsync(path, action, content)
• PutJsonAsync<T>(path, action, body)
• DeleteAsync(path, action)

Health & Info

• GetHealthAsync() - Get health status
• IsHealthyAsync() - Quick boolean check

Semantic Kernel Integration

• MeshGuardFilter - IFunctionInvocationFilter implementation
• AddMeshGuardGovernance() - DI extension for IKernelBuilder
• Configurable action format, audit logging, throw-on-deny behavior

Other Improvements

• TraceId support for request correlation
• Full XML documentation comments
• Backward compatibility via [Obsolete] attributes on old types
• Unit tests for exceptions, models, and client

Testing

Unit tests added (requires dotnet to run):

dotnet test

Breaking Changes

None - all existing APIs preserved with [Obsolete] warnings to guide migration.

Closes #9