Repository navigation
[DEPENDENCY] MUT-042: PyPI openai-agents>=0.19 floats past the workspace lock #81
Description
Problem
Workspace uv.lock pins openai-agents (audit: 0.19.4). The published extra is openai-agents>=0.19 with no upper bound. Isolated pip install mutiny-ai==0.2.0 resolved openai-agents 0.22.3 and openai 3.19.0 vs lock 0.19.4 / 2.53.0. Sample CLI still worked on 0.22.3. CI uses the lock.
This is not a confirmed break today. Confidence is highly likely: PyPI users float past the tested lock. Future Agents SDK breaks hit PyPI users first.
Why it matters
“Works on my machine” vs CI. Adapter #1 is the product path for live agents.
Evidence
- Audit ID: MUT-042 (MEDIUM, highly likely).
packages/mutiny_openai_agents/pyproject.tomlopenai-agents>=0.19.- Audit:
uv.lockvspip freezeafter PyPI install on the auditor’s machine.
Reproduction
Reproduction not independently re-run in this filing pass. Compare packages/mutiny_openai_agents/pyproject.toml to uv.lock and a clean pip install mutiny-ai.
Expected behavior
PyPI installs a tested minor range, or CI has a job that installs the wheel without the workspace lock so drift is visible.
Suggested implementation direction
Upper-bound or pin a tested minor (>=0.19,<0.20) and/or add a CI job that installs the PyPI wheel without the lock (can be a scheduled/nightly if too slow for every PR).
Acceptance criteria
- Constraint documents the supported
openai-agentsrange or CI fails when an unpinned latest install breaks samplemutiny run. - Workspace
uv.lockstill used for PR CI. - Sample offline CLI still passes on the locked version.
Scope
mutiny_openai_agents dependency + optional CI job. Out of scope: Next.js bump (MUT-002), Dependabot (#20).
Related audit findings
MUT-042.
Contributor notes
Generated from the Mutiny deep audit.
help wanted.
Activity
CodewithJha commentedon Oct 18, 2026
Status from review of #128 (changes requested, not merged):
PR #128 addresses: a bounded
openai-agentsrange inmutiny-openai-agents(the only place the SDK is declared). The workspace lock still drives PR CI, and the offline sample CLI passes on the locked 0.23.1.Still outstanding: the proposed
<0.24cap excludesopenai-agents0.24.0 (PyPI latest, 2026-10-15). 0.24.0 passes the full unit, integration, and reliability suites and the offline sample run, so the requested range is>=0.23,<0.25with the lock on 0.24.0.Correction to the audit evidence: "CI uses the lock" is only partly true. Since 2026-09-10,
package-build(scripts/verify_release_artifacts.sh) has installed the built wheels with plainpipand no lock, then run the offlinemutiny run/mutiny testgate. On main (68891a1) it resolvedopenai-agents0.24.0 and passed. So the "CI fails when an unpinned latest install breaks samplemutiny run" option was already partly covered on every PR and push. What it doesn't cover is SDK releases that land between PRs (no scheduled run). Once a cap lands, that job only exercises the capped range.