python-sdk: align pinned runtime bootstrap and drop sample image (2026-03-16)

- bump the repo-managed runtime bootstrap to rust-v0.116.0-alpha.1 so example and integration paths match the current SDK thread/start schema
- make release artifact download more robust by retrying metadata lookups without stale auth and preferring deterministic release asset URLs
- refresh generated Python artifacts and signature expectations so artifact drift tests pass on the current branch shape
- replace the checked-in local image asset with a generated temporary PNG used by the examples and notebook local-image flow
- add lightweight tests for pinned runtime doc drift and invalid-auth fallback in runtime metadata resolution

Co-authored-by: Codex <noreply@openai.com>

sdk/python/tests/test_artifact_workflow_and_binaries.py

@@ -2,9 +2,11 @@ from __future__ import annotations
 
 import ast
 import importlib.util
+import io
 import json
 import sys
 import tomllib
+import urllib.error
 from pathlib import Path
 
 import pytest
@@ -23,6 +25,17 @@ def _load_update_script_module():
     return module
 
 
+def _load_runtime_setup_module():
+    runtime_setup_path = ROOT / "_runtime_setup.py"
+    spec = importlib.util.spec_from_file_location("_runtime_setup", runtime_setup_path)
+    if spec is None or spec.loader is None:
+        raise AssertionError(f"Failed to load runtime setup module: {runtime_setup_path}")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
 def test_generation_has_single_maintenance_entrypoint_script() -> None:
     scripts = sorted(p.name for p in (ROOT / "scripts").glob("*.py"))
     assert scripts == ["update_sdk_artifacts.py"]
@@ -146,6 +159,39 @@ def test_runtime_package_template_has_no_checked_in_binaries() -> None:
     ) == ["__init__.py"]
 
 
+def test_examples_readme_matches_pinned_runtime_version() -> None:
+    runtime_setup = _load_runtime_setup_module()
+    readme = (ROOT / "examples" / "README.md").read_text()
+    assert (
+        f"Current pinned runtime version: `{runtime_setup.pinned_runtime_version()}`"
+        in readme
+    )
+
+
+def test_release_metadata_retries_without_invalid_auth(monkeypatch: pytest.MonkeyPatch) -> None:
+    runtime_setup = _load_runtime_setup_module()
+    authorizations: list[str | None] = []
+
+    def fake_urlopen(request):
+        authorization = request.headers.get("Authorization")
+        authorizations.append(authorization)
+        if authorization is not None:
+            raise urllib.error.HTTPError(
+                request.full_url,
+                401,
+                "Unauthorized",
+                hdrs=None,
+                fp=None,
+            )
+        return io.StringIO('{"assets": []}')
+
+    monkeypatch.setenv("GH_TOKEN", "invalid-token")
+    monkeypatch.setattr(runtime_setup.urllib.request, "urlopen", fake_urlopen)
+
+    assert runtime_setup._release_metadata("1.2.3") == {"assets": []}
+    assert authorizations == ["Bearer invalid-token", None]
+
+
 def test_runtime_package_is_wheel_only_and_builds_platform_specific_wheels() -> None:
     pyproject = tomllib.loads(
         (ROOT.parent / "python-runtime" / "pyproject.toml").read_text()

sdk/python/tests/test_public_api_signatures.py

@@ -40,6 +40,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
     expected = {
         Codex.thread_start: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -64,6 +65,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         Codex.thread_resume: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -76,6 +78,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         Codex.thread_fork: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -88,6 +91,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         Thread.turn: [
             "approval_policy",
+            "approvals_reviewer",
             "cwd",
             "effort",
             "model",
@@ -99,6 +103,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         AsyncCodex.thread_start: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -123,6 +128,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         AsyncCodex.thread_resume: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -135,6 +141,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         AsyncCodex.thread_fork: [
             "approval_policy",
+            "approvals_reviewer",
             "base_instructions",
             "config",
             "cwd",
@@ -147,6 +154,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
         ],
         AsyncThread.turn: [
             "approval_policy",
+            "approvals_reviewer",
             "cwd",
             "effort",
             "model",

sdk/python/tests/test_real_app_server_integration.py

@@ -133,6 +133,24 @@ def _run_python(
     )
 
 
+def _runtime_compatibility_hint(
+    runtime_env: PreparedRuntimeEnv,
+    *,
+    stdout: str,
+    stderr: str,
+) -> str:
+    combined = f"{stdout}\n{stderr}"
+    if "ThreadStartResponse" in combined and "approvalsReviewer" in combined:
+        return (
+            "\nCompatibility hint:\n"
+            f"Pinned runtime {runtime_env.runtime_version} returned a thread/start payload "
+            "that is older than the current SDK schema and is missing "
+            "`approvalsReviewer`. Bump `sdk/python/_runtime_setup.py` to a matching "
+            "released runtime version.\n"
+        )
+    return ""
+
+
 def _run_json_python(
     runtime_env: PreparedRuntimeEnv,
     source: str,
@@ -142,7 +160,10 @@ def _run_json_python(
 ) -> dict[str, object]:
     result = _run_python(runtime_env, source, cwd=cwd, timeout_s=timeout_s)
     assert result.returncode == 0, (
-        f"Python snippet failed.\nSTDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"
+        "Python snippet failed.\n"
+        f"STDOUT:\n{result.stdout}\n"
+        f"STDERR:\n{result.stderr}"
+        f"{_runtime_compatibility_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
     )
     return json.loads(result.stdout)
 
@@ -389,6 +410,7 @@ def test_real_examples_run_and_assert(
         f"Example failed: {folder}/{script}\n"
         f"STDOUT:\n{result.stdout}\n"
         f"STDERR:\n{result.stderr}"
+        f"{_runtime_compatibility_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
     )
 
     out = result.stdout