Complete 0.7 release proof, scale, MCP E2E and live-provider protocol

.github/workflows/integration-compat.yml

@@ -4,18 +4,24 @@ on:
   push:
     paths:
       - 'agentweave/integrations/**'
+      - 'agentweave/composition.py'
+      - 'agentweave/application.py'
       - 'agentweave/runtime.py'
       - 'agentweave/runtime_types.py'
       - 'pyproject.toml'
       - 'tests/test_upstream_integration_compat.py'
+      - 'tests/test_mcp_real_e2e.py'
       - '.github/workflows/integration-compat.yml'
   pull_request:
     paths:
       - 'agentweave/integrations/**'
+      - 'agentweave/composition.py'
+      - 'agentweave/application.py'
       - 'agentweave/runtime.py'
       - 'agentweave/runtime_types.py'
       - 'pyproject.toml'
       - 'tests/test_upstream_integration_compat.py'
+      - 'tests/test_mcp_real_e2e.py'
       - '.github/workflows/integration-compat.yml'
   workflow_dispatch:
 
@@ -50,3 +56,6 @@ jobs:
         run: python -m pip freeze | grep -Ei '^(mcp|langgraph|autogen-agentchat|autogen-core)='
       - name: Run upstream compatibility smoke
         run: pytest -q tests/test_upstream_integration_compat.py -k '${{ matrix.test }}'
+      - name: Run real MCP end-to-end runtime proof
+        if: matrix.name == 'mcp'
+        run: pytest -q tests/test_mcp_real_e2e.py

.github/workflows/issue38-provider-live.yml

@@ -0,0 +1,88 @@
+name: Issue 38 Real Provider Study
+
+on:
+  push:
+    paths:
+      - 'evaluation/issue38_live.py'
+      - 'tests/test_issue38_live_harness.py'
+      - '.github/workflows/issue38-provider-live.yml'
+  pull_request:
+    paths:
+      - 'evaluation/issue38_live.py'
+      - 'tests/test_issue38_live_harness.py'
+      - '.github/workflows/issue38-provider-live.yml'
+  workflow_dispatch:
+    inputs:
+      provider:
+        description: Provider label for evidence metadata
+        required: true
+        default: openai-compatible
+        type: string
+      base_url:
+        description: OpenAI-compatible API base URL including /v1 when required
+        required: true
+        type: string
+      model:
+        description: Provider model identifier
+        required: true
+        type: string
+      trials:
+        description: Repeated trials per scenario/strategy and ablation
+        required: true
+        default: '3'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  protocol-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - run: pip install -e '.[dev]'
+      - run: pytest -q tests/test_issue38_live_harness.py
+      - name: Freeze the planned protocol without calling a provider
+        run: python evaluation/issue38_live.py --validate-only --output issue38-live-plan.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: issue38-live-protocol
+          path: issue38-live-plan.json
+
+  provider-live:
+    if: github.event_name == 'workflow_dispatch'
+    needs: protocol-validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      AGENTWEAVE_PROVIDER_API_KEY: ${{ secrets.AGENTWEAVE_PROVIDER_API_KEY }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - run: pip install -e '.[dev]'
+      - name: Require an explicit provider credential
+        run: |
+          if [ -z "$AGENTWEAVE_PROVIDER_API_KEY" ]; then
+            echo "::error::AGENTWEAVE_PROVIDER_API_KEY is not configured; refusing to claim a live-provider result."
+            exit 2
+          fi
+      - name: Run real provider strategy and ablation study
+        run: |
+          python evaluation/issue38_live.py \
+            --provider '${{ inputs.provider }}' \
+            --base-url '${{ inputs.base_url }}' \
+            --model '${{ inputs.model }}' \
+            --trials '${{ inputs.trials }}' \
+            --api-key-env AGENTWEAVE_PROVIDER_API_KEY \
+            --output issue38-live-results.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: always()
+        with:
+          name: issue38-real-provider-evidence-${{ inputs.provider }}
+          path: issue38-live-results.json
+          if-no-files-found: warn

.github/workflows/package-smoke.yml

@@ -0,0 +1,77 @@
+name: Package Installation Smoke
+
+on:
+  push:
+    paths:
+      - 'agentweave/**'
+      - 'agentweave_byom/**'
+      - 'pyproject.toml'
+      - '.github/workflows/package-smoke.yml'
+  pull_request:
+    paths:
+      - 'agentweave/**'
+      - 'agentweave_byom/**'
+      - 'pyproject.toml'
+      - '.github/workflows/package-smoke.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-wheel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: twine check dist/*
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: release-wheel
+          path: dist/*.whl
+
+  install-smoke:
+    needs: build-wheel
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        extra: [base, mcp, langgraph, autogen]
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: release-wheel
+          path: dist
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - name: Install wheel in a fresh virtual environment
+        run: |
+          python -m venv /tmp/agentweave-smoke
+          WHEEL=$(ls dist/*.whl)
+          if [ '${{ matrix.extra }}' = 'base' ]; then
+            /tmp/agentweave-smoke/bin/pip install "$WHEEL"
+          else
+            /tmp/agentweave-smoke/bin/pip install "${WHEEL}[${{ matrix.extra }}]"
+          fi
+      - name: Verify canonical imports and CLI
+        run: |
+          /tmp/agentweave-smoke/bin/python - <<'PY'
+          import agentweave
+          from agentweave import AgentWeaveApplication, AgentWeaveRuntime, ToolSpec
+          print(agentweave.__version__)
+          assert AgentWeaveApplication and AgentWeaveRuntime and ToolSpec
+          PY
+          /tmp/agentweave-smoke/bin/agentweave version
+      - name: Verify selected integration import
+        if: matrix.extra != 'base'
+        run: |
+          case '${{ matrix.extra }}' in
+            mcp) /tmp/agentweave-smoke/bin/python -c 'from mcp import Client; from agentweave.integrations.mcp import MCPToolCatalog' ;;
+            langgraph) /tmp/agentweave-smoke/bin/python -c 'from langgraph.graph import StateGraph; from agentweave.integrations.langgraph import AgentWeaveLangGraphNode' ;;
+            autogen) /tmp/agentweave-smoke/bin/python -c 'import autogen_agentchat; from agentweave.integrations.autogen import AgentWeaveAutoGenSelector' ;;
+          esac

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Test supported upstream integrations
         run: |
           pip install -e '.[dev,all-integrations]'
-          pytest -q tests/test_upstream_integration_compat.py
+          pytest -q tests/test_upstream_integration_compat.py tests/test_mcp_real_e2e.py
       - name: Verify release version metadata
         run: |
           python - <<'PY'
@@ -68,6 +68,23 @@ jobs:
         run: python -m build
       - name: Validate distributions
         run: twine check dist/*
+      - name: Smoke-install the built wheel with supported integrations
+        run: |
+          python -m venv /tmp/agentweave-release-smoke
+          WHEEL=$(ls dist/*.whl)
+          /tmp/agentweave-release-smoke/bin/pip install "${WHEEL}[all-integrations]"
+          /tmp/agentweave-release-smoke/bin/python - <<'PY'
+          import agentweave
+          from agentweave import AgentWeaveApplication, AgentWeaveRuntime, ToolSpec
+          from agentweave.integrations.mcp import MCPToolCatalog
+          from agentweave.integrations.langgraph import AgentWeaveLangGraphNode
+          from agentweave.integrations.autogen import AgentWeaveAutoGenSelector
+          assert agentweave.__version__
+          assert AgentWeaveApplication and AgentWeaveRuntime and ToolSpec
+          assert MCPToolCatalog and AgentWeaveLangGraphNode and AgentWeaveAutoGenSelector
+          print('wheel smoke ok', agentweave.__version__)
+          PY
+          /tmp/agentweave-release-smoke/bin/agentweave version
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: python-distributions
@@ -85,7 +102,7 @@ jobs:
           gh release create "$TAG" dist/* --generate-notes --title "AgentWeave $TAG"
 
   publish-pypi:
-    if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_pypi == true && startsWith(github.ref, 'refs/tags/v') }}
+    if: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || (github.event_name == 'workflow_dispatch' && inputs.publish_pypi == true && startsWith(github.ref, 'refs/tags/v')) }}
     needs: build-test-release
     runs-on: ubuntu-latest
     permissions:

.github/workflows/runtime-proof.yml

@@ -0,0 +1,58 @@
+name: Runtime Security and Scale Proof
+
+on:
+  push:
+    paths:
+      - 'agentweave/runtime.py'
+      - 'agentweave/runtime_types.py'
+      - 'agentweave/composition.py'
+      - 'agentweave/application.py'
+      - 'agentweave/integrations/mcp.py'
+      - 'evaluation/runtime_scale.py'
+      - 'tests/test_runtime_redteam_07.py'
+      - 'tests/test_mcp_real_e2e.py'
+      - '.github/workflows/runtime-proof.yml'
+  pull_request:
+    paths:
+      - 'agentweave/runtime.py'
+      - 'agentweave/runtime_types.py'
+      - 'agentweave/composition.py'
+      - 'agentweave/application.py'
+      - 'agentweave/integrations/mcp.py'
+      - 'evaluation/runtime_scale.py'
+      - 'tests/test_runtime_redteam_07.py'
+      - 'tests/test_mcp_real_e2e.py'
+      - '.github/workflows/runtime-proof.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  runtime-redteam:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - run: pip install -e '.[dev,mcp]'
+      - name: Run runtime boundary red-team tests
+        run: pytest -q tests/test_runtime_redteam_07.py tests/test_mcp_real_e2e.py
+
+  routing-scale:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+      - run: pip install -e '.[dev]'
+      - name: Run 100 to 100k tool routing scale study
+        run: python evaluation/runtime_scale.py --sizes 100,1000,10000,100000 --budgets 8 --output runtime-scale-results.json
+      - name: Upload scale evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: runtime-scale-evidence
+          path: runtime-scale-results.json

CHANGELOG.md

@@ -6,7 +6,7 @@ All notable changes to AgentWeave are documented here. The project follows Seman
 
 ### Planned
 - Additional independently hosted A2A endpoints and physical edge-hardware evidence as environments become available.
-- Additional production-provider integration fixtures and external reproductions.
+- Additional external provider/model reproductions using the credentialed Issue #38 live protocol.
 
 ## [0.7.0] - 2026-09-23
 
@@ -16,10 +16,17 @@ All notable changes to AgentWeave are documented here. The project follows Seman
 - Canonical tool identity separate from model-visible function aliases, preventing silent cross-provider name collapse.
 - JSON Schema validation before authorization/execution and argument-aware authorization context/hooks.
 - First-class MCP catalog/executor integration with reusable shared session lifecycle and policy metadata mapping.
+- Plug-and-play `AgentWeaveApplication.from_mcp()` / `.from_mcps()` factories, multi-catalog composition, collision-safe aliases, and canonical-key executor dispatch.
+- Real MCP in-process server/client end-to-end CI, including two MCP servers exposing the same native tool name.
 - First-class LangGraph and AutoGen adapters backed only by the public runtime API.
 - Centralized `SafeHttpTransport` across AgentWeave-owned HTTP integrations.
 - Typed runtime configuration, builder/factory, versioned plugin component registry, and lifecycle-owned `AgentWeaveApplication`.
 - Real upstream MCP, LangGraph, and AutoGen compatibility CI in addition to local test doubles.
+- Runtime red-team coverage for malformed JSON, invalid schemas, argument escalation, hidden high-risk tool selection, and execution-gate bypass attempts.
+- Routing scale evidence harness covering 100, 1,000, 10,000, and 100,000 tool catalogs with wall-clock latency and Python peak-memory reporting.
+- Separate real-provider Issue #38 strategy/ablation harness reporting provider token usage and wall-clock latency without modifying the frozen controlled artifact.
+- Built-wheel installation smoke matrix for base, MCP, LangGraph, and AutoGen extras.
+- 0.7 quickstart, live-provider protocol documentation, and explicit road-to-1.0 compatibility/release gates.
 - Confidence-aware adaptive routing, abstention/deferred search, and the controlled hybrid-selection evaluation.
 
 ### Changed
@@ -28,11 +35,13 @@ All notable changes to AgentWeave are documented here. The project follows Seman
 - Deferred discovery candidates are re-scoped before routing/model exposure.
 - Tool execution recovery tracks canonical tool identity rather than display name.
 - Runtime and plugin lifecycles are idempotent and fail safely on partial startup.
+- Release tags now gate on core tests, supported upstream integrations, real MCP end-to-end proof, distribution validation, and a fresh built-wheel install before GitHub release/PyPI publication.
 
 ### Security
 - Mandatory Agent Card payload binding and explicit trusted/untrusted registration boundaries.
 - Redirect/DNS-rebinding SSRF hardening and cross-origin credential stripping for AgentWeave-owned HTTP traffic.
 - Model-hallucinated, schema-invalid, scope-denied, and authorization-denied calls fail closed before the executor.
+- Multi-MCP execution is dispatched by canonical tool identity so same-name tools cannot silently cross provider/server boundaries.
 
 ## [0.6.0] - 2026-08-25