nemo-relay: update packages

.github/workflows/build-nemo-relay.yml

@@ -108,8 +108,16 @@ jobs:
           CIBW_ENVIRONMENT_LINUX: >-
             PATH="$PATH:$HOME/.cargo/bin"
             PROTOC_INCLUDE=/usr/include
-          CIBW_TEST_REQUIRES: pytest>=8 pytest-asyncio>=0.26 pydantic>=2 typing_extensions
-          CIBW_TEST_SOURCES: pyproject.toml python/tests
+          # opentelemetry-proto (pure Python, pulls in protobuf) is imported at
+          # module scope by python/tests/test_observability_plugin.py; without
+          # it that file fails collection with ModuleNotFoundError: opentelemetry.
+          CIBW_TEST_REQUIRES: pytest>=8 pytest-asyncio>=0.26 pydantic>=2 typing_extensions opentelemetry-proto
+          # Three tests added in 0.11.0 read repo files outside python/tests (a scope-stack
+          # fixture, the diagnostics query contract and the diagnostics example); none of
+          # them exists in the 0.9/0.10 tags, and cibuildwheel errors on a missing test
+          # source, so they are only staged for later versions. The non-empty value sits
+          # in the && branch because an empty string is falsy in `a && '' || b`.
+          CIBW_TEST_SOURCES: pyproject.toml python/tests ${{ !startsWith(matrix.version, '0.9.') && !startsWith(matrix.version, '0.10.') && 'crates/types/tests/fixtures/scope_stack_snapshot.json crates/core/tests/fixtures/diagnostics_query_contract.json examples/diagnostics/python.py' || '' }}
           # python/tests/integrations needs optional framework extras nemo-relay
           # ships as PyPI extras (upstream's own test-python excludes this
           # directory too); python/tests/plugin and test_dynamic_plugin_host.py

docs/packages/nemo-relay.yaml

@@ -37,3 +37,10 @@ versions:
   - filename: nemo_relay-0.9.3-cp311-abi3-manylinux_2_39_riscv64.whl
     sha256: aa052d9c32f2a32410d920b30e388b7373c372ee765852a939ddc52e0ba1c05a
     requires-python: '>=3.11'
+- version: 0.9.4
+- version: 0.10.0
+- version: 0.10.1
+- version: 0.10.2
+- version: 0.10.3
+- version: 0.10.4
+- version: 0.11.0

patches/nemo-relay/0.10.0/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.10.1/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.10.2/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.10.3/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.10.4/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.11.0/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 8bf3a86..b765910 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+     prost.boxed(".nemo.relay.worker.v1.LlmInvocation.execution_codec_context");
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;

patches/nemo-relay/0.9.4/0001-worker-proto-fall-back-to-prost-build-s-own-protoc-l.patch

@@ -0,0 +1,39 @@
+From 7d7539c7e835dd8fd9cabd470748296a7a8bad72 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 09:43:30 +0200
+Subject: [PATCH] worker-proto: fall back to prost-build's own protoc lookup on
+ riscv64
+
+Upstream-Status: Inappropriate [protoc-bin-vendored ships no riscv64 binary; prost_build::Config::new() already defaults protoc_executable to its own PROTOC-env/PATH lookup, so simply not overriding it on unsupported platforms is the whole fix]
+
+protoc_bin_vendored::protoc_bin_path() returns Err on any platform outside
+its small enum of prebuilt targets (x86, x86_64, aarch64, ppc64le, s390x,
+macOS, Windows), which the crate's build.rs propagated with ?, aborting
+the build before prost_build ever got a chance to look for a protoc on
+PATH or via $PROTOC. Only calling protoc_executable() when the vendored
+lookup succeeds restores that fallback, which is documented in
+prost-build's own "Sourcing protoc" section.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ crates/worker-proto/build.rs | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/crates/worker-proto/build.rs b/crates/worker-proto/build.rs
+index 5fddbc74..888ec366 100644
+--- a/crates/worker-proto/build.rs
++++ b/crates/worker-proto/build.rs
+@@ -7,7 +7,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     let proto = "proto/nemo/relay/worker/v1/plugin_worker.proto";
+     let include = "proto";
+     let mut prost = prost_build::Config::new();
+-    prost.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    // protoc-bin-vendored ships no riscv64 binary; falling through leaves
++    // prost_build's own PROTOC-env/PATH lookup in charge, which resolves to
++    // the system protoc installed alongside this crate's build on that arch.
++    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
++        prost.protoc_executable(protoc);
++    }
+
+     tonic_prost_build::configure().compile_with_config(prost, &[proto], &[include])?;
+     Ok(())