release: workflow-exec-engine 0.0.9

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.py]
+indent_style = space
+indent_size = 4
+
+[{*.yml,*.yaml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -14,6 +14,11 @@
 #    under the License.
 
 # A2A-T SDK Configuration
+
+# Opt-in full protocol diagnostics. The second switch exposes credentials and cookies;
+# use it only for controlled local troubleshooting.
+WORKFLOW_ENGINE_PROTOCOL_LOGGING=false
+WORKFLOW_ENGINE_PROTOCOL_INCLUDE_SENSITIVE_HEADERS=false
 # Copy this file to .env and fill in your values
 
 # Prompt runtime
@@ -35,6 +40,8 @@ A2AT_LLM_BASE_URL=https://api.deepseek.com
 A2AT_LLM_MAX_TOKENS=2000
 A2AT_LLM_TEMPERATURE=0
 A2AT_LLM_TIMEOUT_SECONDS=60
+# none/minimal/low/medium/high/xhigh — set to "none" to disable reasoning on reasoning models
+A2AT_LLM_REASONING_EFFORT=none
 A2AT_LLM_HISTORY_WINDOW=10
 A2AT_LLM_SESSION_MAX_TOTAL=300
 A2AT_LLM_SESSION_MAX_PER_PROVIDER=100

.gitattributes

@@ -0,0 +1,8 @@
+* text=auto
+
+*.py text eol=lf
+*.md text eol=lf
+*.toml text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.json text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,25 @@
+name: Bug report
+description: Report a reproducible defect in the Python SDK
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include credentials, tokens, private AgentCards, or unredacted protocol dumps.
+  - type: input
+    id: version
+    attributes:
+      label: SDK version or commit
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include Python version, expected result, and actual result.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted logs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+Describe what changed and why.
+
+## Compatibility
+
+- [ ] No public API or protocol compatibility impact
+- [ ] Breaking changes are documented with a migration path
+
+## Verification
+
+- [ ] `python -m pytest -q`
+- [ ] `python -m build`
+- [ ] Tests added or updated
+- [ ] Logs and examples contain no credentials or production data
+- [ ] Commit includes a DCO sign-off (`git commit -s`)

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13"]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
+      - name: Test
+        run: python -m pytest -q
+      - name: Build distributions
+        run: python -m build

.github/workflows/dependency-review.yml

@@ -0,0 +1,18 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+        # Temporary: this repository has not enabled Dependency graph yet.
+        continue-on-error: true

.github/workflows/release.yml

@@ -0,0 +1,67 @@
+name: Release to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Test, publish, and create GitHub release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
+
+      - name: Validate release version
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          PROJECT_VERSION="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          if [[ "${VERSION}" != "${PROJECT_VERSION}" ]]; then
+            echo "Tag v${VERSION} does not match pyproject version ${PROJECT_VERSION}"
+            exit 1
+          fi
+
+      - name: Test
+        run: python -m pytest -q
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Publish distributions
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+
+      - name: Create GitHub release
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          NOTES="$(awk -v ver="$VERSION" '
+            index($0, "## [" ver "]") == 1 { found = 1; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md)"
+          gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1 || \
+            gh release create "${GITHUB_REF_NAME}" --verify-tag \
+              --title "${GITHUB_REF_NAME}" --notes "${NOTES}"
+          gh release upload "${GITHUB_REF_NAME}" dist/* --clobber

CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.9] - 2026-09-18
+
+### Changed
+- Align the business callback contract with the Java engine: callbacks prepare final content and never receive the transport client.
+- Replace rendered Markdown predecessor context with typed `WorkflowInput` and ordered task outputs.
+- Evaluate every conditional outgoing edge independently; unconditional edges always pass and a node may activate zero through N successors.
+- Integrate `a2a-t-sdk>=1.0.9,<2` core metadata types while keeping content generation and semantic validation in host code; remove implicit Task-T handlers and legacy negotiation schemas.
+- Install development dependencies directly through the editable dev extras and remove the temporary bootstrap file.
+
+### Added
+- Structured response evidence, protocol-to-business result mapping, safe `BusinessFailure`, and standard A2A error mapping.
+- Remote `get_task`, `list_tasks`, `cancel_task`, and `subscribe_to_task` operations.
+- Explicit `NotificationSubscription` acknowledgement, completion, close, heartbeat, and health lifecycle.
+- mTLS/CRL transport configuration and fail-closed TLS file validation.
+- Reusable per-agent credential profiles with nested overrides and fail-fast configuration checks.
+
+### Fixed
+- Preserve message, task, and artifact metadata at their original levels and process status/artifact stream updates.
+- Detect duplicate graph edges, invalid history sources, duplicate AgentCards, and conflicting authentication headers.
+- Use the current A2A interceptor contract so activated extension and complete authentication requirement headers reach the wire.
+- Close only resources owned by the high-level runner.
+- Read canonical `negotiationContext` metadata and enforce current Propose/Accept/Reject/Abort context and round rules.
+- Serialize protobuf message parts as their JSON fields in workflow events instead of leaking descriptor internals.
+
 ## [0.0.3] - 2026-08-10
 
 ### Fixed

CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of Conduct
+
+We are committed to a welcoming, harassment-free community. Be respectful,
+focus criticism on the work, and do not disclose private information.
+
+Maintainers may moderate contributions that violate these expectations.
+Reports should be sent privately to the maintainers listed in
+[MAINTAINERS.md](MAINTAINERS.md). Security vulnerabilities must follow
+[SECURITY.md](SECURITY.md).

CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing to workflow-engine-sdk-python
+
+Thank you for contributing. Development requires Python 3.12 or newer.
+
+## Setup
+
+```bash
+python -m venv .venv
+python -m pip install -e ".[dev]"
+python -m pytest -q
+python -m build
+```
+
+Keep Java and Python protocol behavior aligned when changing workflow models,
+events, routing, Task-T, or Negotiation-T. Add regression tests for both SDKs
+when a change affects shared semantics.
+
+Do not commit `.env` files, credentials, tokens, certificates, private
+AgentCards, or production protocol payloads. INFO logs must contain lifecycle
+metadata only; payload diagnostics are opt-in and must be redacted before they
+are attached to an issue or pull request.
+
+Use conventional commit messages and add a DCO sign-off:
+
+```bash
+git commit -s -m "fix: describe the change"
+```
+
+Pull requests should explain motivation, compatibility impact, tests, and any
+required migration. Security reports must follow [SECURITY.md](SECURITY.md).