feat: add Python SDK WebSocket primitives

[rgarcia]

summary

• seal synchronous and asynchronous Python exec and cp APIs with typed results, bounded WebSocket support, safe extraction, metadata handling, progress callbacks, and protocol-focused tests
• add Python staging promotion/back-sync workflows and a next to main release-please flow, including first-release initialization for the empty production repository
• document the promotion flow and the one-time staging workflow dispatch

tests

• Generate SDKs with stlc / generate (integrated build, bootstrap, lint/typecheck, tests, and clean-worktree validation for Python, Go, and TypeScript)
• pytest -n auto with the locked Python SDK environment (507 passed, 1265 skipped)
• pytest -n auto with Pydantic 1 (494 passed, 1278 skipped)
• pyright with the locked Python SDK environment
• mypy . with the locked Python SDK environment
• ruff check .
• ruff format --check .
• pytest -n 0 tests/lib/test_websocket_lib.py (33 passed)
• go test ./lib/system/guest_agent
• .github/scripts/normalize-sdk-commit-message.test.sh

go test ./cmd/api/api could not compile locally because the repository checkout does not contain the embedded guest-agent, Caddy, and Cloud Hypervisor binaries required by that package.

CI is green on the latest commit: SDK generation, Linux, Darwin, end-to-end install, lint, typecheck, unit, and security checks pass.

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

114 files generated at 47fbfba (pushed)

go get github.com/kernel/hypeman-go-staging@47fbfba37c6a093c8b07f2fddb117bb08aa5f900

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

221 files generated at bc9139b (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

136 files generated at f46f742 (pushed)

Diagnostics: ❗ 0 new / 1 total error, ⚠️ 0 new / 1 total warning, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_769Dgsh7-rare-buckle
Timestamp	2026-08-17T17:03:19.432Z
stlc	8413509
Spec hash	ff143be503cd
Config hash	6c5ca8dbb79e

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-17 17:03:40 UTC

[rgarcia]

@cursor please review the latest commit.

[rgarcia]

@cursor review

[rgarcia]

@cursor please review the latest commit.

[cursor]

Findings

No issues found in the latest commit (0016ac9b).

Open questions / assumptions

• Assumed the new integrated SHA (caf71961faafb465db0d8f7c00de1d40e56ba731) is valid and available in the upstream integration history that consumes this manifest; this repo-only review can’t independently verify that external object.

Change summary

• The commit only updates one metadata field in:
  • stainless/custom-code/python/2026-08-17T14-04-38-940Z-custom-code.json:3
• Specifically, it changes "integrated" from dec9f143... to caf71961..., with no code-path or behavior changes in this repository.