From aebb1dff2a62efbe1df2c7157e13d350f0feb5b7 Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 24 Oct 2026 17:13:33 +0000 Subject: [PATCH] docs: record verified Python a5 public release --- .agents/README.md | 4 ++ .../2026-10-24-python-a5-public-release.md | 50 +++++++++++++++++++ .../2026-10-24-package-installation-docs.md | 3 +- CHANGELOG.md | 4 ++ 4 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 .agents/evidence/verify/2026-10-24-python-a5-public-release.md rename .agents/notes/{proposed => implemented}/process/2026-10-24-package-installation-docs.md (94%) diff --git a/.agents/README.md b/.agents/README.md index ee1d15a8..5057199b 100644 --- a/.agents/README.md +++ b/.agents/README.md @@ -127,3 +127,7 @@ Builtin transport: [direct HTTP](notes/implemented/architecture/2026-10-18-nativ - [Python alpha release](notes/proposed/process/2026-10-24-python-alpha-release.md) · [verification](evidence/verify/2026-10-24-python-alpha-release.md) - [Python alpha real-component acceptance](evidence/verify/2026-10-24-python-alpha-cloud.md). + +- [Managed native workflows](notes/implemented/feature/2026-10-24-managed-native-workflows.md) · [public a3 verification](evidence/verify/2026-10-24-python-a3-public-release.md). +- [Application proxy token](notes/implemented/feature/2026-10-24-application-proxy-token.md) · [runtime verification](evidence/verify/2026-10-24-application-proxy-token.md). +- [Accurate packaged installation guidance](notes/implemented/process/2026-10-24-package-installation-docs.md) · [public a5 release](evidence/verify/2026-10-24-python-a5-public-release.md). diff --git a/.agents/evidence/verify/2026-10-24-python-a5-public-release.md b/.agents/evidence/verify/2026-10-24-python-a5-public-release.md new file mode 100644 index 00000000..17fa569e --- /dev/null +++ b/.agents/evidence/verify/2026-10-24-python-a5-public-release.md @@ -0,0 +1,50 @@ +# Verification: public Python a5 release + +- Date: 2026-10-24 +- Result: PASS for publication, public artifact integrity and clean installation; this is not a complete template/model certification. +- Source: `1b235830bc4a8cbec275b530bf2dc2869e8d0c4b`, immutable `v0.3.1a5` tag. +- Changes: [PR #100](https://github.com/Alibaba-Agent-Sandbox/python-sdk/pull/100), [PR #102](https://github.com/Alibaba-Agent-Sandbox/python-sdk/pull/102); [Issue #99](https://github.com/Alibaba-Agent-Sandbox/python-sdk/issues/99), [Issue #101](https://github.com/Alibaba-Agent-Sandbox/python-sdk/issues/101). +- Environment: Linux, clean Python 3.12 virtualenv, official PyPI, no cached package install; credentials are not recorded. + +## What was verified + +Both 0.3.1a5 distributions are public. The client automatically installs exactly the matching server. All four downloaded artifacts match public SHA-256 values; the publication job also verifies those files against its preserved build artifacts. Both PyPI descriptions contain the corrected prerelease opt-in commands rather than the old a2 pin. + +The [release](https://github.com/Alibaba-Agent-Sandbox/python-sdk/releases/tag/v0.3.1a5) tag matches the actual merge commit. [Main CI 40114095872](https://github.com/Alibaba-Agent-Sandbox/python-sdk/actions/runs/40114095872) passed. [Publish 40114135163](https://github.com/Alibaba-Agent-Sandbox/python-sdk/actions/runs/40114135163), attempt 2, passed after all required reusable CI checks. + +## Commands and results + +The disposable virtualenv path is normalized below as ``. + +```bash +python3.12 -m venv +/bin/python -m pip install --no-cache-dir --index-url https://pypi.org/simple 'agent-sandbox-client==0.3.1a5' +/bin/python -m pip check +``` + +The fresh installation and `pip check` exited 0. Outside the source checkout, imports of `Sandbox`, `AsyncSandbox`, `ProviderSandbox`, `ServerClient` and `SandboxServer` passed. Distribution metadata reported client and server 0.3.1a5, and the loaded module came from the virtualenv's site-packages. + +Read the exact-version JSON for both distributions at `https://pypi.org/pypi//0.3.1a5/json`; download each returned file and compare `hashlib.sha256(content).hexdigest()` with `digests.sha256`. All four comparisons passed: + +| Artifact | SHA-256 | +| --- | --- | +| `agent_sandbox_client-0.3.1a5-py3-none-any.whl` | `cb27f4dcc5cf7a15dabba6f680868ab87478b6084b59c40ba938e3756618eb51` | +| `agent_sandbox_client-0.3.1a5.tar.gz` | `7814849399bc83678153e635ea78176b0235c0c50dbc3367ae39f962414d25cf` | +| `agent_sandbox_server-0.3.1a5-py3-none-any.whl` | `96405446aa84d4eb939536d90355f614bce468b745784def823b29781c638a1a` | +| `agent_sandbox_server-0.3.1a5.tar.gz` | `49f87ba4ad8552794eee43329b4ba1bfcdc07eb2dd502b5e0fb6707ceb0208f0` | + +Local record checks initially rejected an absolute scratch path in the command transcript. Normalizing that path fixed the record; no path or secret guard was relaxed. Corrected `make hygiene` and `git diff --check` passed; repository health reported 106 PASS, 1 existing warning and 0 failures. + +## Preserved failed attempt + +Publication attempt 1 uploaded both wheel/sdist pairs, then failed its post-upload readback. Metadata initially returned HTTP 404 and the subsequent clean pip resolution could not yet find server 0.3.1a5 in the public index. Independent later readback and a fresh no-cache install succeeded before requesting `rerun-failed-jobs`. Attempt 2 reran only the failed publication job, verified existing file digests and passed. No release artifact or tag was replaced. The initial failure remains visible in the workflow history; it is not counted as a pass. + +The [a4 stopped-upload history](2026-10-24-package-installation-docs.md) remains unchanged: that tag was preserved and no a4 PyPI upload executed. + +## Runtime evidence and limits + +[OpenSandbox T4 40110372103](https://github.com/Alibaba-Agent-Sandbox/awesome-providers/actions/runs/40110372103) verified default/direct, portable/direct and default/proxy application calls, independent Node HTTP calls and cleanup on the unchanged application runtime. The a5 change only corrects package instructions and version metadata. Public-package template runs are owned and recorded in the template repository; this release record does not claim all templates, model tasks, interpreters or PTY paths passed. + +## Cleanup + +These publication/readback checks created no cloud resources. They did not modify shared templates, images or account configuration. Existing runtime-run cleanup evidence remains in the linked T4 run. diff --git a/.agents/notes/proposed/process/2026-10-24-package-installation-docs.md b/.agents/notes/implemented/process/2026-10-24-package-installation-docs.md similarity index 94% rename from .agents/notes/proposed/process/2026-10-24-package-installation-docs.md rename to .agents/notes/implemented/process/2026-10-24-package-installation-docs.md index f496a0ac..14720fd4 100644 --- a/.agents/notes/proposed/process/2026-10-24-package-installation-docs.md +++ b/.agents/notes/implemented/process/2026-10-24-package-installation-docs.md @@ -1,6 +1,6 @@ # Decision: Keep packaged installation guidance accurate -Status: proposed +Status: implemented ## Problem @@ -41,3 +41,4 @@ Run package/release regressions and build/dist-check. Inspect the wheel metadata - [Issue #101](https://github.com/Alibaba-Agent-Sandbox/python-sdk/issues/101) - [Local packaging and stopped upload](../../../evidence/verify/2026-10-24-package-installation-docs.md) +- [Public a5 release and clean installation](../../../evidence/verify/2026-10-24-python-a5-public-release.md) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13a94e2d..20439ae2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/). ## [Unreleased] +### Documentation + +- Record the public 0.3.1a5 pair, artifact digests, clean installation and preserved propagation failure; link the current installation decision and proxy runtime evidence. / 记录公开的 0.3.1a5 配套双包、产物摘要、新环境安装及保留的索引传播失败，补齐安装决策和代理运行验证索引。 + ### Fixed - Native `ProviderSandbox.commands.run/start/stream(user=...)` now selects the requested envd OS account per request, preserving gateway credentials and concurrent/default identities. Prepare the matching client/server 0.3.1a2 alpha pair; publication is separate. / 原生进程调用按请求选择指定操作系统账号，保留网关凭据以及并发、默认身份；准备配套 0.3.1a2 alpha 双包，发布独立执行。