chore(stainless): add stlc workspace config and custom-code tracking

[aringuyen3]

Commits the stlc workspace so SDK generation is reproducible from this repo.

The workspace directory existed locally but had never been checked in, so stlc status reported the Python target as unable to seal its custom-code integration state.

What's added

File	Purpose
stainless/workspace.json	Points at the OpenAPI spec (../agentex/openapi.yaml), the config, and the SDK output dir
stainless/stainless.yml	The SDK generation config — resources, models, pagination, auth, and the language targets
stainless/.gitignore	Excludes generated SDK output (sdks/) and build manifests (builds/)
stainless/custom-code/**	Per-target tracking files that record the seal points custom code is replayed against

The tracking files are how hand-written SDK code survives regeneration — without them in version control, a later stlc build can't tell which commits its patches apply on top of. The Python tracking file is updated to the current seal.

Scope

No application code, no spec changes, no migrations. Everything is under stainless/, and generated output stays ignored.

🤖 Generated with Claude Code

Greptile Summary

Commits the Stainless workspace, generation configuration, ignored output paths, and custom-code replay seals for reproducible Python and TypeScript SDK generation.

• Defines SDK resources, models, authentication, pagination, environments, and language targets.
• Tracks Python and TypeScript custom-code integration baselines.
• Ignores generated SDK and build output.

Confidence Score: 3/5

The production endpoint and bearer-credential routing need to be corrected before merging; the identifying employee metadata should also be replaced.

Generated clients can route nominal production requests and their configured bearer credentials to localhost rather than the deployed AgentEx service.

Files Needing Attention: stainless/stainless.yml and stainless/custom-code/python/2026-09-02T22-00-32-303Z-custom-code.json

Security Review

The production SDK environment is configured to use localhost while generated clients can attach an environment-provided bearer credential. A default production request can therefore fail locally or expose the credential to an unrelated process listening on port 5003. How this was verified: The production URL was traced from the new environments map to the generated client's bearer-auth configuration, and repository deployment documentation identifies localhost:5003 as development-only.

Important Files Changed

Filename	Overview
stainless/stainless.yml	Adds the complete generation contract, but incorrectly maps the production environment to localhost and includes an individual employee contact.
stainless/workspace.json	Correctly connects the checked-in OpenAPI specification and Stainless configuration to the ignored SDK output directory.
stainless/custom-code/python/2026-09-02T22-00-32-303Z-custom-code.json	Tracks the refreshed Python custom-code seal but includes an identifying personal branch handle.
stainless/custom-code/python/2026-09-02T18-57-23-317Z-custom-code.json	Adds an earlier Python custom-code integration seal with no independently established functional defect.
stainless/custom-code/typescript/2026-09-02T18-57-22-747Z-custom-code.json	Adds the TypeScript custom-code integration seal with no independently established defect.
stainless/.gitignore	Excludes generated SDK and build directories as intended.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Workspace[workspace.json] --> Spec[agentex/openapi.yaml]
  Workspace --> Config[stainless.yml]
  Config --> Python[Generated Python SDK]
  Config --> TypeScript[Generated TypeScript SDK]
  Seals[custom-code tracking seals] --> Python
  Seals --> TypeScript
  Python --> Localhost[production: localhost:5003]
  TypeScript --> Localhost

Loading

Prompt To Fix All With AI

### Issue 1
stainless/stainless.yml:35-36
**Production SDK targets localhost**

When a generated client uses the production environment without overriding its base URL, it sends requests to `http://localhost:5003` rather than the deployed AgentEx service, causing connection failures or requests to an unrelated local process; when `AGENTEX_SDK_API_KEY` is configured, that process also receives the bearer credential.

**How this was verified:** The production URL was traced from the new environments map to the generated client's bearer-auth configuration, while repository deployment documentation identifies localhost:5003 as development-only.

### Issue 2
stainless/stainless.yml:10
**Employee identity enters public metadata**

The checked-in SDK configuration exposes an individual employee's internal email address, while the Python seal also records a personal branch handle. Replace these with team-owned, non-identifying metadata to avoid publishing employee details.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "chore(stainless): commit stlc workspace ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - CLAUDE.md (source)

[greptile-apps]

Production SDK targets localhost

When a generated client uses the production environment without overriding its base URL, it sends requests to http://localhost:5003 rather than the deployed AgentEx service, causing connection failures or requests to an unrelated local process; when AGENTEX_SDK_API_KEY is configured, that process also receives the bearer credential.

How this was verified: The production URL was traced from the new environments map to the generated client's bearer-auth configuration, while repository deployment documentation identifies localhost:5003 as development-only.

Prompt To Fix With AI

This is a comment left during a code review.
Path: stainless/stainless.yml
Line: 35-36

Comment:
**Production SDK targets localhost**

When a generated client uses the production environment without overriding its base URL, it sends requests to `http://localhost:5003` rather than the deployed AgentEx service, causing connection failures or requests to an unrelated local process; when `AGENTEX_SDK_API_KEY` is configured, that process also receives the bearer credential.

**How this was verified:** The production URL was traced from the new environments map to the generated client's bearer-auth configuration, while repository deployment documentation identifies localhost:5003 as development-only.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.