revert(obs): remove sgp-obs beta changes

adk/pyproject.toml

@@ -65,7 +65,6 @@ dependencies = [
 # agentex/lib/* uses `from typing import override` (3.12+) in 19 files.
 # The slim agentex-client keeps 3.11 support.
 requires-python = ">= 3.12,<4"
-
 classifiers = [
   "Typing :: Typed",
   "Intended Audience :: Developers",
@@ -77,23 +76,6 @@ classifiers = [
   "License :: OSI Approved :: Apache Software License",
 ]
 
-# No `obs` extra, deliberately — do not add one for sgp-obs.
-#
-# sgp-obs is not on public PyPI (it is served from Scale's curated CodeArtifact
-# mirror), and declaring it in [project.optional-dependencies] makes THIS repo's uv
-# workspace unresolvable: `uv sync` re-locks, locking must resolve every declared
-# optional dependency of every workspace member, and there is no way to exempt one.
-# Measured: `uv lock --check`, `uv sync --all-extras`, plain `uv sync` with no extras,
-# and `uv sync --all-extras --no-extra obs` all fail (`--no-extra` filters what is
-# installed, not what is resolved); `uv lock` has no `--no-extra`; and
-# `[tool.uv] override-dependencies` does not exempt it either. Only `--frozen` works,
-# which would leave nobody able to re-lock this repo again.
-#
-# So the dependency is the AGENT's to declare — `sgp-obs[genai-auto,http,otlp]`
-# against the mirror — and the SDK wires it when it is importable. See
-# agentex/lib/core/observability/sgp_obs_setup.py; nothing imports sgp_obs outside a
-# try, so a plain `pip install agentex-sdk` is unaffected either way.
-
 [project.urls]
 Homepage = "https://github.com/scaleapi/scale-agentex-python"
 Repository = "https://github.com/scaleapi/scale-agentex-python"

src/agentex/lib/cli/templates/default-claude-code/Dockerfile-uv.j2

@@ -34,34 +34,14 @@ WORKDIR /app/{{ project_path_from_build_root }}
 COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present, so local
-# builds, CI builds, and agents that never opt in are unaffected.
-#
-# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting
-# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

src/agentex/lib/cli/templates/default-claude-code/Dockerfile.j2

@@ -33,19 +33,8 @@ COPY {{ project_path_from_build_root }}/requirements.txt /app/{{ project_path_fr
 
 WORKDIR /app/{{ project_path_from_build_root }}
 
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present.
-#
-# This variant installs from requirements.txt, so there is no pyproject.toml for uv to
-# read a named index out of; the credentialed URL is used directly and is deliberately
-# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
-#
 # Install the required Python packages
-RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-    fi; \
-    uv pip install --system -r requirements.txt
+RUN uv pip install --system -r requirements.txt
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

src/agentex/lib/cli/templates/default-codex/Dockerfile-uv.j2

@@ -34,34 +34,14 @@ WORKDIR /app/{{ project_path_from_build_root }}
 COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present, so local
-# builds, CI builds, and agents that never opt in are unaffected.
-#
-# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting
-# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

src/agentex/lib/cli/templates/default-codex/Dockerfile.j2

@@ -33,19 +33,8 @@ COPY {{ project_path_from_build_root }}/requirements.txt /app/{{ project_path_fr
 
 WORKDIR /app/{{ project_path_from_build_root }}
 
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present.
-#
-# This variant installs from requirements.txt, so there is no pyproject.toml for uv to
-# read a named index out of; the credentialed URL is used directly and is deliberately
-# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
-#
 # Install the required Python packages
-RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-    fi; \
-    uv pip install --system -r requirements.txt
+RUN uv pip install --system -r requirements.txt
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

src/agentex/lib/cli/templates/default-langgraph/Dockerfile-uv.j2

@@ -30,34 +30,14 @@ WORKDIR /app/{{ project_path_from_build_root }}
 COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present, so local
-# builds, CI builds, and agents that never opt in are unaffected.
-#
-# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting
-# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

src/agentex/lib/cli/templates/default-langgraph/Dockerfile.j2

@@ -29,19 +29,8 @@ COPY {{ project_path_from_build_root }}/requirements.txt /app/{{ project_path_fr
 
 WORKDIR /app/{{ project_path_from_build_root }}
 
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present.
-#
-# This variant installs from requirements.txt, so there is no pyproject.toml for uv to
-# read a named index out of; the credentialed URL is used directly and is deliberately
-# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
-#
 # Install the required Python packages
-RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-    fi; \
-    uv pip install --system -r requirements.txt
+RUN uv pip install --system -r requirements.txt
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

src/agentex/lib/cli/templates/default-openai-agents/Dockerfile-uv.j2

@@ -30,34 +30,14 @@ WORKDIR /app/{{ project_path_from_build_root }}
 COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present, so local
-# builds, CI builds, and agents that never opt in are unaffected.
-#
-# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting
-# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-      export UV_INDEX_SCALE_PYPI_USERNAME=aws; \
-      export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \
-        | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \
-    fi; \
     uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

src/agentex/lib/cli/templates/default-openai-agents/Dockerfile.j2

@@ -29,19 +29,8 @@ COPY {{ project_path_from_build_root }}/requirements.txt /app/{{ project_path_fr
 
 WORKDIR /app/{{ project_path_from_build_root }}
 
-# Optional private index for Scale-internal packages such as sgp-obs, injected by the
-# control-plane broker (SGPINF-1568). Inert unless the secret is present.
-#
-# This variant installs from requirements.txt, so there is no pyproject.toml for uv to
-# read a named index out of; the credentialed URL is used directly and is deliberately
-# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.
-#
 # Install the required Python packages
-RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \
-    if [ -s /run/secrets/codeartifact-pip-conf ]; then \
-      export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \
-    fi; \
-    uv pip install --system -r requirements.txt
+RUN uv pip install --system -r requirements.txt
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

src/agentex/lib/cli/templates/default-openai-agents/project/acp.py.j2

@@ -20,7 +20,7 @@ from dotenv import load_dotenv
 
 load_dotenv()
 
-from agents import Agent, Runner, function_tool, set_trace_processors
+from agents import Agent, Runner, function_tool, set_tracing_disabled
 
 from agentex.lib import adk
 from agentex.lib.types.acp import SendEventParams, CancelTaskParams, CreateTaskParams
@@ -34,17 +34,10 @@ from agentex.lib.core.harness.emitter import UnifiedEmitter
 from agentex.lib.adk import OpenAITurn
 from agentex.lib.core.tracing.tracing_processor_manager import add_tracing_processor_config
 
-# Drop the openai-agents SDK's own exporter, so it can't ship traces to
-# api.openai.com using OPENAI_API_KEY (which may be a gateway/proxy key and would 401).
-#
-# Clearing the processor list rather than disabling tracing outright: disabling stops
-# spans being produced AT ALL, which silently starves any processor added later —
-# including the sgp-obs bridge the SDK installs when observability is on, so a Runner
-# turn would contribute no model spans. Clearing instead removes the OpenAI exporter
-# (which otherwise stays registered and is merely never fed) while leaving the
-# machinery alive for the bridge to attach to.
-# Agentex/SGP tracing still runs via the tracing manager.
-set_trace_processors([])
+# Disable the openai-agents SDK's native tracer so it doesn't ship traces to
+# api.openai.com using OPENAI_API_KEY (which may be a LiteLLM proxy key).
+# SGP tracing below still runs via the Agentex tracing manager.
+set_tracing_disabled(True)
 
 logger = make_logger(__name__)