chore: promote staging 6da13c3 to production

[agentex-sdk-sync]

Automated promote from the staging trunk, opened by stlc-promote.yml.

Approve this pull request - do not click Merge. Squash and rebase both rewrite SHAs, which forks the production trunk away from staging and blocks all codegen until someone reconciles them by hand. Merge commits are disabled on this repo.

Once CI is green here and this has one approval, re-run stlc-promote.yml in the config repo. It fast-forwards main onto these exact commits, GitHub closes this pull request as merged, and the trunks stay byte-identical.

Confidence Score: 0/5

This PR is not safe to promote. It breaks agent builds and startup paths, loses tracing, and trusts mutable CI code with all secrets.

Findings

1.  Private packages lose their index ▶
2.  Large logs freeze local agents ▶
3.  OpenAI model spans disappear ▶
4.  Workers skip telemetry lifecycle ▶
5.  Timeout settings are ignored ▶
6.  Mutable workflow gets all secrets ▶
7.  Workflow logs replay twice ▶
8.  Registration drops source provenance ▶

Fix with agent prompt

### Issue 1
src/agentex/lib/cli/templates/default/Dockerfile-uv.j2:33-34
The generated Dockerfiles no longer read `codeartifact-pip-conf`. An agent that declares a private package such as `sgp-obs` now runs `uv sync` against the public path, so the image build fails or can resolve the wrong same-name package. Restore the secret mount and the separate settings for `pyproject.toml` and `requirements.txt` templates.

### Issue 2
src/agentex/lib/cli/handlers/run_handlers.py:246-253
`readline()` and UTF-8 decoding now sit under one outer `except`. One oversized or invalid child log line ends the only task draining the merged stdout pipe. The child keeps running, fills that pipe, and then blocks on its next writes. Keep the larger shared stream limit and recover from bad lines instead of ending the reader.

### Issue 3
src/agentex/lib/cli/templates/default-openai-agents/project/acp.py.j2:37-40
`set_tracing_disabled(True)` stops OpenAI Agents from creating spans at all. The SGP processor configured below can still receive AgentEx spans, but it cannot receive model and tool spans that were never created. Remove only the OpenAI exporter with `set_trace_processors([])`, as the other tracing path expects.

### Issue 4
src/agentex/lib/core/temporal/workers/worker.py:264-268
`AgentexWorker.run` now awaits the worker directly. It no longer starts configured `sgp-obs`, and it has no `finally` block to drain the async span queue and processors. Worker-side model telemetry is absent, and spans still queued when the process stops are lost. Restore the worker observability setup and bounded shutdown sequence.

### Issue 5
src/agentex/lib/adk/utils/_modules/client.py:29-31
`create_async_agentex_client` no longer reads the released `AGENTEX_CLIENT_*_TIMEOUT_SECONDS` settings. Deployments that raised the connect timeout for a busy backend silently fall back to the client default and start failing around the old short limit. Restore the environment timeout builder while keeping an explicit `timeout=` authoritative.

### Issue 6
.github/workflows/opengrep-ci.yml:17-18
This job loads executable workflow code from a branch name and gives it every available caller secret. Anyone who can move that branch, or an attacker who compromises it, can read repository secrets and use the job's write and OIDC permissions. Pin the reusable workflow to a reviewed commit SHA and pass only named secrets.

**How this was verified:** The same job uses a mutable `@opengrep-4core-runner` ref and `secrets: inherit`.

### Issue 7
src/agentex/lib/core/temporal/workflows/workflow.py:10-13
Workflow code now uses the ordinary `make_logger`. It does not suppress output during Temporal replay and does not add structured `workflow_id` or `run_id` fields. Keep the workflow-aware logger for the base class and generated Temporal templates.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 8
src/agentex/lib/utils/registration.py:36-45
Registration metadata now keeps only `deployment_id` and `agent_card`. It drops the released `commit_sha` and normalized `source_repo` fields, so the backend cannot link an agent registration to its source build. Restore those fields with the existing SHA check and credential-stripping normalization.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This promotion updates the SDK snapshot with runtime cleanup, simpler generated agent containers, and new production automation. It removes several built-in observability and metadata paths while adding release and security workflows for the production repository.

• Generated containers no longer read the private package-index secret during builds.
• OpenAI Agents templates disable the native exporter while keeping Agentex tracing available.
• LiteLLM, Temporal workers, logging, registration, and commit stamping now use smaller runtime paths.
• Release, Bandit, OpenGrep, and TruffleHog workflows are added or updated.

Diagram

sequenceDiagram
    actor Developer
    participant CLI
    participant Docker
    participant PublicIndex as Public package index
    participant ACP
    participant Worker as Temporal worker
    participant AgentEx
    participant Telemetry

    Developer->>CLI: init and build agent
    CLI->>Docker: Render Dockerfile without private-index binding
    Docker->>PublicIndex: Resolve all dependencies
    PublicIndex-->>Docker: Public packages or missing private package
    Developer->>CLI: run agent locally
    CLI->>ACP: Start with one stdout pipe
    CLI->>Worker: Start with one stdout pipe
    ACP->>AgentEx: Register card without metadata provenance
    Worker->>AgentEx: Register without agent card
    Worker->>Telemetry: Run without observability setup
    Worker-->>CLI: Emit logs
    Note over CLI,Worker: One unreadable line ends the only pipe reader
    Worker-->>Worker: Exit without draining queued spans

Loading

_{Reviews (1) · Last reviewed commit: "ci(lint-pr): exempt the SDK automation A..."}

[greptile-apps]

The generated Dockerfiles no longer read codeartifact-pip-conf. An agent that declares a private package such as sgp-obs now runs uv sync against the public path, so the image build fails or can resolve the wrong same-name package. Restore the secret mount and the separate settings for pyproject.toml and requirements.txt templates.

Knowledge Base Used: Command-line workflows

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/cli/templates/default/Dockerfile-uv.j2
Line: 33-34

Comment:
The generated Dockerfiles no longer read `codeartifact-pip-conf`. An agent that declares a private package such as `sgp-obs` now runs `uv sync` against the public path, so the image build fails or can resolve the wrong same-name package. Restore the secret mount and the separate settings for `pyproject.toml` and `requirements.txt` templates.

**Knowledge Base Used:** [Command-line workflows](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/command-line-workflows.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

readline() and UTF-8 decoding now sit under one outer except. One oversized or invalid child log line ends the only task draining the merged stdout pipe. The child keeps running, fills that pipe, and then blocks on its next writes. Keep the larger shared stream limit and recover from bad lines instead of ending the reader.

Knowledge Base Used: Command-line workflows

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/cli/handlers/run_handlers.py
Line: 246-253

Comment:
`readline()` and UTF-8 decoding now sit under one outer `except`. One oversized or invalid child log line ends the only task draining the merged stdout pipe. The child keeps running, fills that pipe, and then blocks on its next writes. Keep the larger shared stream limit and recover from bad lines instead of ending the reader.

**Knowledge Base Used:** [Command-line workflows](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/command-line-workflows.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

set_tracing_disabled(True) stops OpenAI Agents from creating spans at all. The SGP processor configured below can still receive AgentEx spans, but it cannot receive model and tool spans that were never created. Remove only the OpenAI exporter with set_trace_processors([]), as the other tracing path expects.

Knowledge Base Used: Command-line workflows

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/cli/templates/default-openai-agents/project/acp.py.j2
Line: 37-40

Comment:
`set_tracing_disabled(True)` stops OpenAI Agents from creating spans at all. The SGP processor configured below can still receive AgentEx spans, but it cannot receive model and tool spans that were never created. Remove only the OpenAI exporter with `set_trace_processors([])`, as the other tracing path expects.

**Knowledge Base Used:** [Command-line workflows](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/command-line-workflows.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

AgentexWorker.run now awaits the worker directly. It no longer starts configured sgp-obs, and it has no finally block to drain the async span queue and processors. Worker-side model telemetry is absent, and spans still queued when the process stops are lost. Restore the worker observability setup and bounded shutdown sequence.

Knowledge Base Used:

• Observability
• Temporal execution

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/core/temporal/workers/worker.py
Line: 264-268

Comment:
`AgentexWorker.run` now awaits the worker directly. It no longer starts configured `sgp-obs`, and it has no `finally` block to drain the async span queue and processors. Worker-side model telemetry is absent, and spans still queued when the process stops are lost. Restore the worker observability setup and bounded shutdown sequence.

**Knowledge Base Used:**
- [Observability](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/observability.md)
- [Temporal execution](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/temporal-execution.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Workflow code now uses the ordinary make_logger. It does not suppress output during Temporal replay and does not add structured workflow_id or run_id fields. Keep the workflow-aware logger for the base class and generated Temporal templates.

Knowledge Base Used: Temporal execution

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/core/temporal/workflows/workflow.py
Line: 10-13

Comment:
Workflow code now uses the ordinary `make_logger`. It does not suppress output during Temporal replay and does not add structured `workflow_id` or `run_id` fields. Keep the workflow-aware logger for the base class and generated Temporal templates.

**Knowledge Base Used:** [Temporal execution](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/temporal-execution.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

create_async_agentex_client no longer reads the released AGENTEX_CLIENT_*_TIMEOUT_SECONDS settings. Deployments that raised the connect timeout for a busy backend silently fall back to the client default and start failing around the old short limit. Restore the environment timeout builder while keeping an explicit timeout= authoritative.

Knowledge Base Used: Python client library

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/adk/utils/_modules/client.py
Line: 29-31

Comment:
`create_async_agentex_client` no longer reads the released `AGENTEX_CLIENT_*_TIMEOUT_SECONDS` settings. Deployments that raised the connect timeout for a busy backend silently fall back to the client default and start failing around the old short limit. Restore the environment timeout builder while keeping an explicit `timeout=` authoritative.

**Knowledge Base Used:** [Python client library](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/client-library.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

This job loads executable workflow code from a branch name and gives it every available caller secret. Anyone who can move that branch, or an attacker who compromises it, can read repository secrets and use the job's write and OIDC permissions. Pin the reusable workflow to a reviewed commit SHA and pass only named secrets.

How this was verified: The same job uses a mutable @opengrep-4core-runner ref and secrets: inherit.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/opengrep-ci.yml
Line: 17-18

Comment:
This job loads executable workflow code from a branch name and gives it every available caller secret. Anyone who can move that branch, or an attacker who compromises it, can read repository secrets and use the job's write and OIDC permissions. Pin the reusable workflow to a reviewed commit SHA and pass only named secrets.

**How this was verified:** The same job uses a mutable `@opengrep-4core-runner` ref and `secrets: inherit`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Registration metadata now keeps only deployment_id and agent_card. It drops the released commit_sha and normalized source_repo fields, so the backend cannot link an agent registration to its source build. Restore those fields with the existing SHA check and credential-stripping normalization.

Knowledge Base Used: Observability

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/utils/registration.py
Line: 36-45

Comment:
Registration metadata now keeps only `deployment_id` and `agent_card`. It drops the released `commit_sha` and normalized `source_repo` fields, so the backend cannot link an agent registration to its source build. Restore those fields with the existing SHA check and credential-stripping normalization.

**Knowledge Base Used:** [Observability](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/observability.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Agent card filters stop matching src/agentex/lib/types/agent_card.py:33 ▶

  AgentCard no longer has metadata, and both builder methods dropped that argument. Yet agents.list(agent_card_metadata=...) still filters on registration_metadata.agent_card.metadata. Existing builders now raise on metadata=, while direct model construction can silently discard it, so no matching value reaches registration. Restore the field, builder arguments, and encoding helper.

•  Worker card argument now crashes src/agentex/lib/core/temporal/workers/worker.py:181 ▶

  The public AgentexWorker constructor no longer accepts agent_card, and _register_agent no longer forwards it. Existing Temporal agents that use this released registration path fail immediately with an unexpected keyword argument. Restore the constructor field and registration forwarding.

•  Deployments lose agent versions src/agentex/lib/cli/handlers/deploy_handlers.py:395 ▶

  The merge no longer fills global.agent.version from global.image.tag when AGENT_VERSION is absent. That was the default deployment path that fed EnvironmentVariables.AGENT_VERSION, so generated deployments now omit __agent_version__ from spans unless every project adds the variable itself. Restore the image-tag fallback after environment overrides are merged.

•  Configured debug logs stay hidden src/agentex/lib/utils/logging.py:49 ▶

  make_logger now always sets logging.INFO. This ignores LOG_LEVEL=DEBUG, undoing the released way to turn on existing SDK diagnostics. Resolve the configured level and keep INFO only as the fallback.

[agentex-sdk-sync]

Superseded: the staging trunk advanced to 73ea73e while this was open. Closing rather than force-pushing, because an approval here would otherwise carry over to commits nobody reviewed.