[AAASM-3737] 🔧 (python): Pin python examples to published SDK 0.0.1b5

[Chisanan232]

What changed

Aligned every Python example under python/ with the published SDK release agent-assembly 0.0.1b5 on PyPI.

• Dropped the [tool.uv.sources] git-master override from the 5 examples that pinned agent-assembly to git = "https://github.com/ai-agent-assembly/python-sdk.git", branch = "master": agno-tool-policy, haystack-tool-policy, llamaindex-tool-policy, microsoft-agent-framework-tool-policy, smolagents-tool-policy. This was a pre-b5 override that was never reverted — it resolved to an unreleased b4-from-git build instead of the published PyPI b5.
• Raised the dependency floor to agent-assembly>=0.0.1b5 in all 13 examples' [project].dependencies (previously >=0.0.1b2 on 8 examples and >=0.0.1b4 on agno). The b5 prerelease component in the specifier lets uv pick the published prerelease.
• Regenerated every uv.lock with uv lock. All 13 now resolve agent-assembly at 0.0.1b5 from source = { registry = "https://pypi.org/simple" } (no git source remains).

No framework extras (agent-assembly[...]) were in use, so none needed preserving. The microsoft-agent-framework example keeps its existing [tool.uv] prerelease = "allow" for its live extra's prerelease transitive tree.

Why

The published Python SDK is agent-assembly 0.0.1b5 on PyPI, but the examples still pointed at git-master or an older b2/b4 floor — a release-hygiene defect (AAASM-3737). Users following these examples would not install the actual released SDK.

How to verify

# No git source remains anywhere under python/
grep -rn 'python-sdk.git' python/   # -> empty

# Every lock resolves the published b5
grep -rl 'version = "0.0.1b5"' python/*/uv.lock | wc -l   # -> 13

# A frozen sync installs the published b5 cleanly
cd python/custom-tool-policy && uv sync --frozen && uv pip show agent-assembly   # Version: 0.0.1b5

Validated uv sync --frozen on custom-tool-policy, agno-tool-policy, and microsoft-agent-framework-tool-policy — all install agent-assembly 0.0.1b5.

Closes AAASM-3737

🤖 Generated with Claude Code

[Chisanan232]

🔍 Code Review — Claude Code

Reviewed against ticket AAASM-3737 (MAJOR: 5 examples pin git-master, 8 lock to 0.0.1b2 instead of PyPI 0.0.1b5). Branch tip 0d53790, diff +125/-117 across 26 files.

CI status

All 22 checks GREEN — Analyze (go/js/python), CodeQL, SonarCloud, and every per-example job (agno, crewai, custom, google-adk, haystack, langchain-basic, langchain-research, langgraph, llamaindex, microsoft, openai, pydantic, smolagents) pass. No non-Sonar/coverage failure.

Scope coverage (vs ticket AC)

The fix in the ticket has three parts; all three are satisfied and independently verified against the fetched branch:

1. Drop [tool.uv.sources] git-master block — git grep python-sdk.git FETCH_HEAD -- python/ returns zero matches (exit 1). All 5 git-pinned examples (agno, haystack, llamaindex, microsoft, smolagents) had the [tool.uv.sources] block removed from pyproject.toml and the git = "...python-sdk.git?branch=master" lock entry replaced with specifier = ">=0.0.1b5". The llamaindex internal contradiction (b5 floor + git override → b4) is resolved.
2. Floor >=0.0.1b5 — all 13/13 pyproject.toml carry agent-assembly>=0.0.1b5; grep for any non-b5 floor returns nothing. (Was >=0.0.1b2 on 8, >=0.0.1b4 on agno; a stale AAASM-3537-branch comment was also removed.)
3. Regenerate every uv.lock to resolve published b5 — all 13/13 locks resolve agent-assembly to version = "0.0.1b5" from source = { registry = "https://pypi.org/simple" }; no git source remains in any lock. The b5 sdist/wheel hashes carry upload-time 2026-06-25, matching the published PyPI release.

Example completeness: exactly 13 python examples exist under python/, all 13 are covered — none missed.

Side-effect analysis

This is an examples repo (no product logic); the only risk is broken resolution/runtime. Per-example CI is green for every example, which is strong evidence. Two contained observations, neither blocking:

• Lockfile revision header flipped revision = 3 → revision = 2 on the regenerated locks — the uv lock was run with an older uv than produced the prior b4 lock. Forward-compatible and CI-validated; cosmetic tooling-version inconsistency only.
• Transitive drift: regenerating the microsoft example lock incidentally bumped github-copilot-sdk 1.0.3 → 1.0.4 (and added an httpx dep). Natural uv lock re-resolution drift, unrelated to the SDK pin; that example job passes.

Note: verify-python.yml runs uv sync --extra dev (non-frozen), so CI is a slightly weaker guard than --frozen would be; the author additionally ran uv sync --frozen on 3 examples per the PR body. Diff is strictly limited to pyproject.toml + uv.lock — no stray non-pin changes (verified: every changed path matches (pyproject\.toml|uv\.lock)$).

Verdict

✅ Ready to approve & merge. Ticket AC fully met: git-master sources removed (0 remaining), all 13 floors at >=0.0.1b5, all 13 locks resolve published PyPI 0.0.1b5. CI fully green; side-effects are benign lock-refresh drift.

Automated review by Claude Code.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud