chore(release): prepare 0.27.0b1

[stephen-wang24]

Summary

• prepare an isolated agentex-sdk beta containing only the observability changes from feat(obs): wire sgp-obs from the SDK for traces, metrics and logs #518
• exclude the unrelated feat(tracing): stamp __commit_sha__ automatically when AGENT_COMMIT_SHA is set #507 and feat(registration): report the agent's commit and source repo at registration #508 changes currently included in chore: release main #520
• set the Python package versions to 0.27.0b1
• use the SemVer-equivalent 0.27.0-b1 in the release-please manifest

Release scope

This PR prepares the beta release but does not publish it. Do not run publish-pypi.yml until the intended public-vs-private distribution path has been confirmed. If public PyPI is selected, dispatch the workflow for agentex-sdk only.

Validation

• uv sync --all-packages --all-extras
• uv run ruff check .
• uv run pyright -p .
• uv run pytest (1679 passed, 1622 skipped)
• uv build --all-packages --wheel
• verified both wheel metadata versions canonicalize to 0.27.0b1

Confidence Score: 2/5

This PR is not safe to merge until the private-index token is isolated and observability shutdown is bounded.

Findings

1.   Dependency builds can steal tokens ▶
2.  Exporter flush can block shutdown ▶
3.  Sync LiteLLM calls skip metrics ▶
4.  Startup failures skip cleanup ▶

Fix with agent prompt

### Issue 1
src/agentex/lib/cli/templates/default/Dockerfile.j2:40-44
`requirements.txt` can choose a source package whose build code runs inside this same `RUN`. That code inherits the credentialed `UV_DEFAULT_INDEX` and can read `codeartifact-pip-conf` while it is mounted. Keep the secret out of dependency build processes, or install only trusted private artifacts before running project-controlled builds. The same pattern appears in the other requirements-based Dockerfile templates.

**How this was verified:** Project-controlled requirements run build code while the private-index secret and credentialed environment value are both available.

### Issue 2
src/agentex/lib/core/observability/sgp_obs_setup.py:339
`sgp_obs.shutdown` does blocking exporter work, but this await has no deadline. If an exporter or collector stalls, ACP and Temporal shutdown can wait past the pod grace period. `asyncio.to_thread` also leaves a stalled default-executor thread to be joined at process exit. Give the whole flush a hard budget and use an exit path that cannot be held open by the worker thread.

### Issue 3
src/agentex/lib/core/adapters/llm/adapter_litellm.py:22-30
Only the async methods use `inference_call`. A caller using the public sync `completion` or `completion_stream` API with a native LiteLLM provider gets no GenAI timing, usage, or failure metrics because that route never reaches the OpenAI client instrumentor. Wrap both sync paths with the matching recorder and add sync tests.

### Issue 4
src/agentex/lib/core/temporal/workers/worker.py:237-239
`init_sgp_obs` runs before the cleanup `try`. If health startup, registration, client creation, workflow checks, or `Worker` construction fails, the new providers never reach `shutdown_sgp_obs`, so buffered startup telemetry and exporter resources are left behind. Start the `try` immediately after initialization so every later exit drains what was created.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Agentex now supports optional sgp-obs observability and private package installs while preparing both packages for the 0.27.0b1 beta release. The observability setup stays inactive unless an agent installs the private package and enables the matching environment settings.

• Adds metrics, traces, logs, and shutdown flushing across ACP and Temporal runtimes.
• Adds vendor-aware, fail-open GenAI metrics around litellm calls.
• Lets scaffold Dockerfiles use an optional CodeArtifact secret for private packages.
• Updates package and release metadata for the beta version.

Diagram

sequenceDiagram
    participant Build as Agent image build
    participant Broker as Package broker
    participant UV as uv install
    participant ACP as ACP server
    participant Worker as Temporal worker
    participant Obs as sgp-obs
    participant Backend as Telemetry backend

    Broker-->>Build: Mount private index secret
    Build->>UV: Install project dependencies
    UV->>UV: Run selected package build code
    Build->>ACP: Start server
    ACP->>Obs: init_sgp_obs(app)
    Build->>Worker: Start worker process
    Worker->>Obs: init_sgp_obs()
    ACP->>Worker: Dispatch Temporal work
    Worker->>Obs: Record model and runtime telemetry
    Obs->>Backend: Export signals
    par ACP shutdown
        ACP->>ACP: Drain async and sync spans
        ACP->>Obs: shutdown_sgp_obs()
    and Worker shutdown
        Worker->>Worker: Drain sync spans
        Worker->>Obs: shutdown_sgp_obs()
    end

Loading

_{Reviews (1) · Last reviewed commit: "chore(release): prepare 0.27.0b1"}

[stephen-wang24]

@greptileai

[greptile-apps]

requirements.txt can choose a source package whose build code runs inside this same RUN. That code inherits the credentialed UV_DEFAULT_INDEX and can read codeartifact-pip-conf while it is mounted. Keep the secret out of dependency build processes, or install only trusted private artifacts before running project-controlled builds. The same pattern appears in the other requirements-based Dockerfile templates.

How this was verified: Project-controlled requirements run build code while the private-index secret and credentialed environment value are both available.

Knowledge Base Used: Command-line workflows

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/cli/templates/default/Dockerfile.j2
Line: 40-44

Comment:
`requirements.txt` can choose a source package whose build code runs inside this same `RUN`. That code inherits the credentialed `UV_DEFAULT_INDEX` and can read `codeartifact-pip-conf` while it is mounted. Keep the secret out of dependency build processes, or install only trusted private artifacts before running project-controlled builds. The same pattern appears in the other requirements-based Dockerfile templates.

**How this was verified:** Project-controlled requirements run build code while the private-index secret and credentialed environment value are both available.

**Knowledge Base Used:** [Command-line workflows](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/command-line-workflows.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

sgp_obs.shutdown does blocking exporter work, but this await has no deadline. If an exporter or collector stalls, ACP and Temporal shutdown can wait past the pod grace period. asyncio.to_thread also leaves a stalled default-executor thread to be joined at process exit. Give the whole flush a hard budget and use an exit path that cannot be held open by the worker thread.

Knowledge Base Used:

• Observability
• Tracing pipeline

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/core/observability/sgp_obs_setup.py
Line: 339

Comment:
`sgp_obs.shutdown` does blocking exporter work, but this await has no deadline. If an exporter or collector stalls, ACP and Temporal shutdown can wait past the pod grace period. `asyncio.to_thread` also leaves a stalled default-executor thread to be joined at process exit. Give the whole flush a hard budget and use an exit path that cannot be held open by the worker thread.

**Knowledge Base Used:**
- [Observability](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/observability.md)
- [Tracing pipeline](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/tracing-pipeline.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

init_sgp_obs runs before the cleanup try. If health startup, registration, client creation, workflow checks, or Worker construction fails, the new providers never reach shutdown_sgp_obs, so buffered startup telemetry and exporter resources are left behind. Start the try immediately after initialization so every later exit drains what was created.

Knowledge Base Used:

• Temporal execution
• Observability

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/core/temporal/workers/worker.py
Line: 237-239

Comment:
`init_sgp_obs` runs before the cleanup `try`. If health startup, registration, client creation, workflow checks, or `Worker` construction fails, the new providers never reach `shutdown_sgp_obs`, so buffered startup telemetry and exporter resources are left behind. Start the `try` immediately after initialization so every later exit drains what was created.

**Knowledge Base Used:**
- [Temporal execution](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/temporal-execution.md)
- [Observability](https://app.greptile.com/scale-ai/-/custom-context/knowledge-base/scaleapi/scale-agentex-python/-/docs/observability.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[stephen-wang24]

https://github.com/scaleapi/scale-agentex-python/actions/runs/35035099786 published to public pypi landed https://pypi.org/project/agentex-sdk/#history