feat(registration): report the agent's commit and source repo at registration

[max-parke-scale]

Agent registration now carries commit_sha and source_repo in registration_metadata, alongside the existing deployment_id and agent card. Registration is the one moment an agent built and deployed outside SGP (CLI Helm deploys, e.g. BP Wells' Azure DevOps → ACR → agentex agents deploy) tells SGP about itself, so it is the consistent place to record what is deployed right now without inventing a build row for a build SGP never performed. Part of AGX1-969.

What

• commit_sha: from AGENT_COMMIT_SHA, accepted only when it is a git object name, the same guard __commit_sha__ uses (code_revision.is_git_object_name, now public). A non-commit value logs a warning and is omitted, never forwarded.
• source_repo: from a new AGENT_SOURCE_REPO env var, normalized to host/path with build_provenance.normalize_remote (feat(lib): capture client-attested build provenance #454), so git@github.com:scaleapi/Demo.git and https://token@github.com/scaleapi/Demo both record as github.com/scaleapi/Demo.
• Keys appear only when known. Absence stays absence, the same rule scaleapi/sgp#5553 applies on the chart side.
• Metadata assembly moves into build_registration_metadata so it is testable without the HTTP round trip. register_agent behavior is otherwise unchanged; the backend stores registration_metadata as-is, so no server change.

Relation to #507 and #5553

Independent of #507: registration reports the deployment's declared commit whether or not the agent opted into span stamping. Today nothing sets AGENT_SOURCE_REPO; the chart follow-up is a global.agent.sourceRepo value rendered into that env var, in the #5553 contract. AGENT_COMMIT_SHA is set by #5553 from a SHA-shaped image tag or global.agent.commitSha.

Tests

tests/lib/utils/test_registration.py: empty metadata when nothing is known; commit and normalized repo when set; non-commit values (tag, semver, AWS composite, too short, blank) omitted; credential and scheme stripping; deployment id and agent card unchanged. ruff and pyright clean.

🧑‍💻🤖 — posted via Claude Code

Greptile Summary

Agent registration now reports validated source provenance while preserving existing deployment and agent-card metadata.

• Adds optional AGENT_COMMIT_SHA and AGENT_SOURCE_REPO environment configuration.
• Publishes Git object-name validation for reuse by registration metadata assembly.
• Normalizes source repositories and strips credentials, schemes, query strings, and fragments.
• Adds focused coverage for metadata construction, invalid commit values, repository normalization, and existing registration stubs.

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fully addressed and no new actionable issues remain.

The repository normalizer now removes query strings and fragments before source metadata is returned, and the existing registration test stub now supplies both newly required environment attributes. The added tests cover these fixes and the principal metadata behaviors.

Important Files Changed

Filename	Overview
src/agentex/lib/utils/registration.py	Centralizes registration metadata assembly and conditionally includes validated commit and normalized repository provenance.
src/agentex/lib/utils/build_provenance.py	Removes URL query strings and fragments before repository normalization, resolving the prior credential-exposure finding.
src/agentex/lib/core/tracing/code_revision.py	Exposes the existing Git object-name validation as a reusable public helper.
src/agentex/lib/environment_variables.py	Declares the optional source-repository environment variable used during registration.
tests/lib/test_agent_card.py	Extends the registration test stub with both new environment attributes, resolving the prior test failure.
tests/lib/test_build_provenance.py	Covers removal of credential-bearing query and fragment components.
tests/lib/utils/test_registration.py	Verifies conditional provenance metadata, validation, normalization, and preservation of existing fields.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Env[Environment variables] --> Validate[Validate commit SHA]
    Env --> Normalize[Normalize source repository]
    Validate --> Metadata[Registration metadata]
    Normalize --> Metadata
    Deployment[Deployment ID] --> Metadata
    Card[Agent card] --> Metadata
    Metadata --> Registration[Agent registration request]

Loading

_{Reviews (2): Last reviewed commit: "feat(registration): report the agent's c..." | Re-trigger Greptile}

[greptile-apps]

Repository Credentials Can Leak

If AGENT_SOURCE_REPO contains a credential in its query string or fragment, such as https://github.com/org/repo?access_token=SECRET, normalize_remote preserves that suffix. The credential is then sent in source_repo and included in the successful-registration log. Strip query strings and fragments before adding the repository to the metadata.

How this was verified: The environment value reaches the registration payload through normalize_remote, whose string processing never removes ? or # suffixes.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/utils/registration.py
Line: 40-42

Comment:
**Repository Credentials Can Leak**

If `AGENT_SOURCE_REPO` contains a credential in its query string or fragment, such as `https://github.com/org/repo?access_token=SECRET`, `normalize_remote` preserves that suffix. The credential is then sent in `source_repo` and included in the successful-registration log. Strip query strings and fragments before adding the repository to the metadata.

**How this was verified:** The environment value reaches the registration payload through `normalize_remote`, whose string processing never removes `?` or `#` suffixes.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[max-parke-scale]

Valid. Fixed at the layer that promises it: normalize_remote now drops the query string and fragment before any other processing (ee05394), with a table row for ?access_token=SECRET#frag. Same fix pushed to the Gitea copy of the normalizer in scaleapi/sgp#5720.

🤖 — posted via Claude Code

[greptile-apps]

New Fields Break Test Stubs

The new unconditional accesses to AGENT_COMMIT_SHA and AGENT_SOURCE_REPO break the existing register_agent tests. Their environment stub in tests/lib/test_agent_card.py defines neither attribute, so all three tests raise AttributeError before making their mocked HTTP requests. Update the fixture or read these optional fields defensively so the test suite can pass.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/utils/registration.py
Line: 31-40

Comment:
**New Fields Break Test Stubs**

The new unconditional accesses to `AGENT_COMMIT_SHA` and `AGENT_SOURCE_REPO` break the existing `register_agent` tests. Their environment stub in `tests/lib/test_agent_card.py` defines neither attribute, so all three tests raise `AttributeError` before making their mocked HTTP requests. Update the fixture or read these optional fields defensively so the test suite can pass.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[max-parke-scale]

Fixed in ee05394 by extending the EnvVars stub in test_agent_card.py with the two new fields. The accesses stay unconditional on purpose: EnvironmentVariables declares both fields, and a defensive getattr would hide a real typo in the model.

🤖 — posted via Claude Code