fix(ag-ui): relative imports in subagents topic + deploy boot gate

The subagents topic's 'from src.streaming...' absolute imports resolve
in dev (uvicorn runs from the topic dir) but not in the aggregated
deployment layout, so every Railway image built since 2026-06-16 has
crashed on import. 'railway up --detach' reports success at upload
time, so CI never saw it: Railway kept serving the last good image,
/agent/subagents has been 404 in production since June, and today's
MAF topic could not appear.

- Make both imports package-relative (works in dev and deployed).
- Regenerate the staged deps/ copies.
- Add a deploy boot gate: install the exact requirements union into a
  venv and 'import server' before railway up, so a boot failure fails
  the workflow instead of silently keeping a stale image.

Verified: the boot repro that reproduced the production failure now
prints 'BOOT OK' with 20 routes, including the MAF mount.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: blove

.github/workflows/deploy-ag-ui.yml

@@ -45,6 +45,24 @@ jobs:
             exit 1
           fi
 
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Boot gate — the aggregated server must import with the pinned deps
+        # `railway up --detach` reports success at upload time, so a build or
+        # boot failure on Railway is invisible to CI and the last good image
+        # keeps serving. That hid a broken deploy for 2.5 months (subagents
+        # topic 404 in prod since 2026-06-16; see blove/fix-ag-ui-deploy-boot).
+        # Importing server.py against the exact requirements union reproduces
+        # the container's boot locally and fails the workflow instead.
+        working-directory: deployments/ag-ui-dev
+        run: |
+          python -m venv /tmp/bootgate-venv
+          /tmp/bootgate-venv/bin/pip install --quiet -r requirements.txt
+          AG_UI_INTERNAL_TOKEN=bootgate OPENAI_API_KEY=sk-bootgate \
+            /tmp/bootgate-venv/bin/python -c "import server; print('boot ok:', len(server.app.routes), 'routes')"
+
       - name: Install Railway CLI
         run: npm install -g @railway/cli@4.68.0
 

cockpit/ag-ui/subagents/python/src/graph.py

@@ -25,7 +25,7 @@
 from langgraph.prebuilt import ToolNode
 from langgraph_sdk import get_client
 
-from src.streaming.subagent_stream_handler import SubagentStreamHandler
+from .streaming.subagent_stream_handler import SubagentStreamHandler
 
 PROMPTS_DIR = Path(__file__).parent.parent / "prompts"
 

cockpit/ag-ui/subagents/python/src/streaming/activity_emitting_agent.py

@@ -2,7 +2,7 @@
 native AG-UI ACTIVITY events at the bridge's 1:1 dispatch point. Owned transport
 adapter — keeps the wire protocol-native without patching the bridge."""
 from ag_ui_langgraph import LangGraphAgent
-from src.streaming.activity_transform import subagent_custom_to_activity
+from .activity_transform import subagent_custom_to_activity
 
 
 class ActivityEmittingAgent(LangGraphAgent):

deployments/ag-ui-dev/deps/subagents/src/graph.py

@@ -25,7 +25,7 @@
 from langgraph.prebuilt import ToolNode
 from langgraph_sdk import get_client
 
-from src.streaming.subagent_stream_handler import SubagentStreamHandler
+from .streaming.subagent_stream_handler import SubagentStreamHandler
 
 PROMPTS_DIR = Path(__file__).parent.parent / "prompts"
 

deployments/ag-ui-dev/deps/subagents/src/streaming/activity_emitting_agent.py

@@ -2,7 +2,7 @@
 native AG-UI ACTIVITY events at the bridge's 1:1 dispatch point. Owned transport
 adapter — keeps the wire protocol-native without patching the bridge."""
 from ag_ui_langgraph import LangGraphAgent
-from src.streaming.activity_transform import subagent_custom_to_activity
+from .activity_transform import subagent_custom_to_activity
 
 
 class ActivityEmittingAgent(LangGraphAgent):

libs/licensing/src/lib/license-public-key.generated.ts

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: MIT
+// AUTOGENERATED by libs/licensing/scripts/generate-public-key.mjs — do not edit.
+// Source: dev-fixture
+export const LICENSE_PUBLIC_KEY_HEX = '793132582f3d39dcd46cc6fd010c6c4b10f1225132e7de71fbcb45788ea5afde' as const;