fix(ag-ui): relative imports in subagents topic + deploy boot gate (#899)

The subagents topic's 'from src.streaming...' absolute imports resolve
in dev (uvicorn runs from the topic dir) but not in the aggregated
deployment layout, so every Railway image built since 2026-06-16 has
crashed on import. 'railway up --detach' reports success at upload
time, so CI never saw it: Railway kept serving the last good image,
/agent/subagents has been 404 in production since June, and today's
MAF topic could not appear.

- Make both imports package-relative (works in dev and deployed).
- Regenerate the staged deps/ copies.
- Add a deploy boot gate: install the exact requirements union into a
  venv and 'import server' before railway up, so a boot failure fails
  the workflow instead of silently keeping a stale image.

Verified: the boot repro that reproduced the production failure now
prints 'BOOT OK' with 20 routes, including the MAF mount.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: blove

.github/workflows/deploy-ag-ui.yml

@@ -45,6 +45,24 @@ jobs:
             exit 1
           fi
 
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Boot gate — the aggregated server must import with the pinned deps
+        # `railway up --detach` reports success at upload time, so a build or
+        # boot failure on Railway is invisible to CI and the last good image
+        # keeps serving. That hid a broken deploy for 2.5 months (subagents
+        # topic 404 in prod since 2026-06-16; see blove/fix-ag-ui-deploy-boot).
+        # Importing server.py against the exact requirements union reproduces
+        # the container's boot locally and fails the workflow instead.
+        working-directory: deployments/ag-ui-dev
+        run: |
+          python -m venv /tmp/bootgate-venv
+          /tmp/bootgate-venv/bin/pip install --quiet -r requirements.txt
+          AG_UI_INTERNAL_TOKEN=bootgate OPENAI_API_KEY=sk-bootgate \
+            /tmp/bootgate-venv/bin/python -c "import server; print('boot ok:', len(server.app.routes), 'routes')"
+
       - name: Install Railway CLI
         run: npm install -g @railway/cli@4.68.0
 

cockpit/ag-ui/subagents/python/src/graph.py

@@ -25,7 +25,7 @@
 from langgraph.prebuilt import ToolNode
 from langgraph_sdk import get_client
 
-from src.streaming.subagent_stream_handler import SubagentStreamHandler
+from .streaming.subagent_stream_handler import SubagentStreamHandler
 
 PROMPTS_DIR = Path(__file__).parent.parent / "prompts"
 

cockpit/ag-ui/subagents/python/src/streaming/activity_emitting_agent.py

@@ -2,7 +2,7 @@
 native AG-UI ACTIVITY events at the bridge's 1:1 dispatch point. Owned transport
 adapter — keeps the wire protocol-native without patching the bridge."""
 from ag_ui_langgraph import LangGraphAgent
-from src.streaming.activity_transform import subagent_custom_to_activity
+from .activity_transform import subagent_custom_to_activity
 
 
 class ActivityEmittingAgent(LangGraphAgent):

deployments/ag-ui-dev/deps/subagents/src/graph.py

@@ -25,7 +25,7 @@
 from langgraph.prebuilt import ToolNode
 from langgraph_sdk import get_client
 
-from src.streaming.subagent_stream_handler import SubagentStreamHandler
+from .streaming.subagent_stream_handler import SubagentStreamHandler
 
 PROMPTS_DIR = Path(__file__).parent.parent / "prompts"
 

deployments/ag-ui-dev/deps/subagents/src/streaming/activity_emitting_agent.py

@@ -2,7 +2,7 @@
 native AG-UI ACTIVITY events at the bridge's 1:1 dispatch point. Owned transport
 adapter — keeps the wire protocol-native without patching the bridge."""
 from ag_ui_langgraph import LangGraphAgent
-from src.streaming.activity_transform import subagent_custom_to_activity
+from .activity_transform import subagent_custom_to_activity
 
 
 class ActivityEmittingAgent(LangGraphAgent):

libs/licensing/src/lib/license-public-key.generated.ts

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: MIT
+// AUTOGENERATED by libs/licensing/scripts/generate-public-key.mjs — do not edit.
+// Source: dev-fixture
+export const LICENSE_PUBLIC_KEY_HEX = '793132582f3d39dcd46cc6fd010c6c4b10f1225132e7de71fbcb45788ea5afde' as const;