[AAASM-2459] 🐛 (release): Sync pyproject.toml + __init__.py version from dispatch payload before maturin builds

[Chisanan232]

Summary

release-python.yml is fired by repository_dispatch from
AI-agent-assembly/agent-assembly
with client_payload.release_tag: v0.0.1-alpha.X, but it never syncs the
version files inside this repo before maturin reads them. As a result,
maturin builds the wheel using whatever version = "..." is currently
checked in on master (today: 0.0.2, because the upstream Chisanan232
bumper bumped past the alpha line — tracked separately as AAASM-2460).
That wheel filename collides with the already-published 0.0.2 on PyPI
and the publish step hard-fails.

This PR adds a tiny composite action that rewrites pyproject.toml and
agent_assembly/__init__.py to the PEP-440 form of the dispatch payload
before maturin runs, so alpha-4 actually publishes as 0.0.1a4.

What changes

• New composite action: .github/actions/sync-version-from-dispatch/action.yml
• release-python.yml: invokes the action in all 5 jobs (1 sdist + 4 wheels)
  right after Stage aasm sidecar binary / setup-python, immediately
  before the maturin Build wheel / Build source distribution step.

PEP-440 conversion table

Upstream git tag	PEP-440 form
v0.0.1-alpha.4	0.0.1a4
v0.0.1-beta.2	0.0.1b2 (future-proofing; not used today)
v0.0.1-rc.1	0.0.1rc1 (future-proofing; not used today)
v1.2.3	1.2.3
(empty — dry-run mode)	(no-op; files stay at master values)

Verified locally:

v0.0.1-alpha.4 -> 0.0.1a4
v0.0.1-beta.2  -> 0.0.1b2
v0.0.1-rc.1    -> 0.0.1rc1
v1.2.3         -> 1.2.3
v0.0.1-alpha.10 -> 0.0.1a10

Recovery sequence (Group 1, alpha-4)

This is one of three pieces of the alpha-4 recovery; the others are
tracked independently:

• AAASM-2454 — yank the broken 0.0.2 upload from PyPI
• AAASM-2459 — this PR; sync the version into the python-sdk build
• AAASM-2460 — fix the upstream Chisanan232 bumper so it stops
  jumping past the alpha line in the first place

Even with the upstream bumper still wrong, this PR alone is enough to
make the alpha-4 republish succeed end-to-end: maturin will trust the
dispatch payload, not the stale master files.

Test plan

• CI lint passes (workflow YAML schema, action.yml schema)
• Re-fire the upstream alpha-4 dispatch after merge; confirm
  agent_assembly-0.0.1a4-*.whl appears in dist/ and uploads to PyPI
• Confirm workflow_dispatch dry-run path still builds (with no version
  rewrite, since release_tag is empty)

🤖 Generated with Claude Code

[Chisanan232]

Claude Code review — AAASM-2459

CI state — green for merge (7 SUCCESS + 6 SKIPPED, 0 failures)

mergeable: MERGEABLE, mergeStateStatus: CLEAN. Same Complete Release Validation Process / * path-filtered skips as PR #74 — those sub-jobs trigger on Python source / Dockerfiles / package config and correctly skip themselves for a workflow-only diff.

Scope vs. acceptance criteria

AC (from AAASM-2459 ticket)	Status	Evidence
New version-sync step runs in all 4 wheel-build jobs + sdist job	✅	Commit a25a6ded wires the composite action into all 5 jobs (4 platform wheel builds + sdist) immediately before the maturin build step
When fired by repository_dispatch with release_tag: v0.0.1-alpha.4, the step writes version = "0.0.1a4" to pyproject.toml AND __version__ = "0.0.1a4" to agent_assembly/__init__.py BEFORE maturin runs	✅	Composite action's PEP-440 logic: pep440="${AASM_TAG#v}" then pep440="${pep440//-alpha./a}". Local test by implementer: v0.0.1-alpha.4 → 0.0.1a4 confirmed
When fired by workflow_dispatch (dry-run, empty release_tag), the step is a no-op	✅	Skip conditional on AASM_TAG empty
maturin builds produce wheels named agent_assembly-0.0.1a4-*.whl	⏳ post-merge	Live verification on re-trigger
Published wheel's agent_assembly.__version__ reads 0.0.1a4	⏳ post-merge	Same

PEP-440 conversion coverage

Implementer's local test confirms the conversion handles all 4 prerelease cases plus multi-digit numbers:

Input tag	Output PEP-440
v0.0.1-alpha.4 ← the alpha-4 case	0.0.1a4
v0.0.1-beta.2	0.0.1b2
v0.0.1-rc.1	0.0.1rc1
v1.2.3 (no prerelease)	1.2.3
v0.0.1-alpha.10 (multi-digit)	0.0.1a10

Implementation quality

• Composite action approach — .github/actions/sync-version-from-dispatch/action.yml keeps one source of truth. Each call site is 4 lines. Editing the PEP-440 logic in the future is a single-file change. Right call over inline-in-each-job.

• BSD/GNU-portable sed — sed -i.bak … && rm -f *.bak. Works on the macos-arm64 + macos-x86_64 runners (BSD sed) AND the linux-x86_64 + linux-aarch64 runners (GNU sed). Important detail not in the original spec.

• Anchored substitutions — s|^version = "[^"]*"|version = "${pep440}"| and s|^__version__ = "[^"]*"|__version__ = "${pep440}"| are line-anchored. Grep confirmed no second declaration of either symbol in the repo, so the substitutions are uniquely targeted.

• pyproject.toml confirmed clean static version — no dynamic version backend (Hatch VCS, etc.), no second declaration. The sed edit is safe.

Coupling with AAASM-2460

This PR alone is NOT sufficient to publish alpha-4 to PyPI. The companion PR python-sdk#76 must also merge — that PR deletes the broken release.yml/release-staging.yml/release-validate.yml workflows that contain the upstream Chisanan232 bumper. Without #76 merging, the next coordinated release will run those workflows, re-bump pyproject.toml to 0.0.2, and undo this PR's per-job sync.

Plus the operator actions (PyPI 0.0.2 yank, Trusted Publisher policy verification) are still needed.

Verdict

Ready for human approval and merge. All 3 immediate ACs delivered; 2 post-merge ACs require live verification. Implementation is the right structural choice (composite action, BSD-portable sed). Commits granular: 1 for action definition, 1 for wiring — bisectable.

— Claude Code (Opus 4.7, 1M context)