seclab-taskflow-agent 0.2.0__tar.gz → 0.3.0__tar.gz

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/.github/workflows/publish-to-pypi.yaml

@@ -21,6 +21,7 @@ jobs:
     permissions:
       contents: write
       id-token: write  # For trusted publishing
+      attestations: write  # For artifact attestation
 
     steps:
     - name: Checkout repository
@@ -39,24 +40,22 @@ jobs:
     - name: Build the wheel
       run: python3 -m hatch build
 
+    - name: Attest build provenance
+      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+      with:
+        subject-path: ./dist/*
+
     - name: Upload artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       with:
         name: python-package-distributions
-        path: dist/
+        path: ./dist/
 
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
       with:
         verbose: true
 
-    - name: Sign with sigstore
-      uses: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c # v3.1.0
-      with:
-        inputs: >-
-          ./dist/*.tar.gz
-          ./dist/*.whl
-
     - name: Create GitHub Release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/.github/workflows/publish-to-testpypi.yaml

@@ -18,6 +18,7 @@ jobs:
     permissions:
       contents: write
       id-token: write  # For trusted publishing
+      attestations: write  # For artifact attestation
 
     steps:
     - name: Checkout repository
@@ -51,11 +52,16 @@ jobs:
     - name: Build the wheel
       run: python3 -m hatch build
 
+    - name: Attest build provenance
+      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+      with:
+        subject-path: ./dist/*
+
     - name: Upload artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       with:
         name: python-package-distributions
-        path: dist/
+        path: ./dist/
 
     - name: Publish to TestPyPI
       uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
@@ -63,13 +69,6 @@ jobs:
         repository-url: https://test.pypi.org/legacy/
         verbose: true
 
-    - name: Sign with sigstore
-      uses: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c # v3.1.0
-      with:
-        inputs: >-
-          ./dist/*.tar.gz
-          ./dist/*.whl
-
     - name: Create GitHub Release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: seclab-taskflow-agent
-Version: 0.2.0
+Version: 0.3.0
 Summary: A taskflow agent for the SecLab project, enabling secure and automated workflow execution.
 Project-URL: Source, https://github.com/GitHubSecurityLab/seclab-taskflow-agent
 Project-URL: Issues, https://github.com/GitHubSecurityLab/seclab-taskflow-agent/issues
@@ -8,25 +8,30 @@ Author-email: GitHub Security Lab <securitylab@github.com>
 License-Expression: MIT
 License-File: LICENSE
 License-File: NOTICE
+Keywords: agentic-workflows,mcp,openai-agents,pydantic,security-research,taskflow,yaml
 Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Requires-Python: >=3.10
 Requires-Dist: aiofiles==24.1.0
 Requires-Dist: annotated-types==0.7.0
 Requires-Dist: anyio==4.9.0
 Requires-Dist: attrs==25.3.0
-Requires-Dist: authlib==1.6.6
+Requires-Dist: authlib==1.6.9
 Requires-Dist: certifi==2025.6.15
 Requires-Dist: cffi==2.0.0
 Requires-Dist: charset-normalizer==3.4.2
 Requires-Dist: click==8.2.1
 Requires-Dist: colorama==0.4.6
-Requires-Dist: cryptography==46.0.5
+Requires-Dist: cryptography==46.0.6
 Requires-Dist: cyclopts==4.0.0
 Requires-Dist: distro==1.9.0
 Requires-Dist: dnspython==2.8.0
@@ -34,7 +39,7 @@ Requires-Dist: docstring-parser==0.17.0
 Requires-Dist: docutils==0.22
 Requires-Dist: email-validator==2.3.0
 Requires-Dist: exceptiongroup==1.3.0
-Requires-Dist: fastmcp==2.14.0
+Requires-Dist: fastmcp==2.14.2
 Requires-Dist: griffe==1.7.3
 Requires-Dist: h11==0.16.0
 Requires-Dist: httpcore==1.0.9
@@ -52,7 +57,7 @@ Requires-Dist: jsonschema==4.24.0
 Requires-Dist: lazy-object-proxy==1.12.0
 Requires-Dist: markdown-it-py==3.0.0
 Requires-Dist: markupsafe==3.0.2
-Requires-Dist: mcp==1.23.1
+Requires-Dist: mcp==1.24.0
 Requires-Dist: mdurl==0.1.2
 Requires-Dist: more-itertools==10.8.0
 Requires-Dist: openai-agents==0.2.11
@@ -70,7 +75,7 @@ Requires-Dist: pycparser==2.23
 Requires-Dist: pydantic-core==2.33.2
 Requires-Dist: pydantic-settings==2.10.1
 Requires-Dist: pydantic==2.11.7
-Requires-Dist: pygments==2.19.2
+Requires-Dist: pygments==2.20.0
 Requires-Dist: pyperclip==1.9.0
 Requires-Dist: python-dotenv==1.1.1
 Requires-Dist: python-lsp-jsonrpc==1.1.2
@@ -78,7 +83,7 @@ Requires-Dist: python-lsp-server==1.12.2
 Requires-Dist: python-multipart==0.0.22
 Requires-Dist: pyyaml==6.0.2
 Requires-Dist: referencing==0.36.2
-Requires-Dist: requests==2.32.4
+Requires-Dist: requests==2.33.0
 Requires-Dist: rfc3339-validator==0.1.4
 Requires-Dist: rich-rst==1.3.1
 Requires-Dist: rich==14.0.0
@@ -95,7 +100,7 @@ Requires-Dist: typer==0.16.0
 Requires-Dist: types-requests==2.32.4.20250611
 Requires-Dist: typing-extensions==4.15.0
 Requires-Dist: typing-inspection==0.4.1
-Requires-Dist: ujson==5.10.0
+Requires-Dist: ujson==5.12.0
 Requires-Dist: urllib3==2.6.3
 Requires-Dist: uvicorn==0.35.0
 Requires-Dist: zipp==3.23.0
@@ -103,9 +108,12 @@ Description-Content-Type: text/markdown
 
 # GitHub Security Lab Taskflow Agent
 
-The Security Lab Taskflow Agent is an MCP enabled multi-Agent framework.
+The Security Lab Taskflow Agent is an MCP-enabled multi-Agent framework for
+declarative, YAML-driven agentic workflows.
 
-The Taskflow Agent is built on top of the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/).
+Built on top of the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/),
+it uses [Pydantic](https://docs.pydantic.dev/) for grammar validation and
+[Jinja2](https://jinja.palletsprojects.com/) for template rendering.
 
 ## Core Concepts
 
@@ -119,6 +127,115 @@ Agents can cooperate to complete sequences of tasks through so-called [taskflows
 
 You can find a detailed overview of the taskflow grammar [here](doc/GRAMMAR.md) and example taskflows [here](examples/taskflows/).
 
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│                   CLI (cli.py)                      │
+│  Typer-based entry point: -p, -t, -l, -g, --resume │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│              Runner (runner.py)                      │
+│  Taskflow execution loop, model resolution,          │
+│  template rendering, session checkpointing           │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│          MCP Lifecycle (mcp_lifecycle.py)            │
+│  Server connection, cleanup, process management      │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│            Agent (agent.py)                          │
+│  TaskAgent wrapper, hooks, OpenAI Agents SDK bridge  │
+└─────────────────────────────────────────────────────┘
+
+Supporting modules:
+  models.py          — Pydantic v2 grammar models (validation)
+  session.py         — Task-level checkpoint / resume
+  available_tools.py — YAML resource loader with caching
+  template_utils.py  — Jinja2 template environment
+  mcp_utils.py       — MCP client parameter resolution
+  mcp_transport.py   — MCP transport implementations (stdio, streamable)
+  mcp_prompt.py      — System prompt construction
+  prompt_parser.py   — Legacy prompt argument parser
+  capi.py            — AI API endpoint and token management
+  path_utils.py      — Platform-aware data/log directories
+```
+
+### API Types
+
+The agent supports both the **Chat Completions** and **Responses** OpenAI APIs.
+The API type can be configured globally or per model in a `model_config` file:
+
+```yaml
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: model_config
+api_type: chat_completions        # default for all models
+models:
+  gpt_default: gpt-4.1
+  gpt_responses: gpt-5.1
+model_settings:
+  gpt_responses:
+    api_type: responses           # override for this model
+    endpoint: https://api.githubcopilot.com
+    token: CAPI_TOKEN             # env var name containing the API key
+```
+
+Per-model `model_settings` can include:
+- **`api_type`** — `"chat_completions"` (default) or `"responses"`
+- **`endpoint`** — API base URL override for this model
+- **`token`** — name of an environment variable containing the API key
+
+### Session Recovery
+
+Taskflow runs are automatically checkpointed at the task level. If a task
+fails after exhausting retries, the session is saved and can be resumed:
+
+```
+** 🤖💾 Session saved: abc123def456
+** 🤖💡 Resume with: --resume abc123def456
+```
+
+Resume from the last successful checkpoint:
+
+```bash
+python -m seclab_taskflow_agent --resume abc123def456
+```
+
+Failed tasks are automatically retried up to 3 times with increasing backoff
+before the session is saved. Session checkpoints are stored in the
+platform-specific application data directory.
+
+### Error Output
+
+By default, errors are shown as concise one-line messages. Use `--debug` (or
+set `TASK_AGENT_DEBUG=1`) for full tracebacks:
+
+```bash
+# Concise (default)
+Error: [BadRequestError] model 'foo' not found
+(use --debug for full traceback)
+
+# Full traceback
+python -m seclab_taskflow_agent --debug -t examples.taskflows.echo
+```
+
+### MCP Environment Denylist
+
+By default, MCP server subprocesses inherit the parent environment. To prevent
+specific variables from leaking to MCP servers, set `TASKFLOW_ENV_DENYLIST` to
+a comma-separated list of variable names:
+
+```bash
+export TASKFLOW_ENV_DENYLIST="MY_SECRET_TOKEN,PRIVATE_KEY,OTHER_CREDENTIAL"
+```
+
+Toolbox-level `env:` declarations in YAML still inject exactly what each server
+needs, so explicitly configured variables are unaffected.
+
 ## Use Cases and Examples
 
 The Seclab Taskflow Agent framework was primarily designed to fit the iterative feedback loop driven work involved in Agentic security research workflows and vulnerability triage tasks.

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/README.md

@@ -1,8 +1,11 @@
 # GitHub Security Lab Taskflow Agent
 
-The Security Lab Taskflow Agent is an MCP enabled multi-Agent framework.
+The Security Lab Taskflow Agent is an MCP-enabled multi-Agent framework for
+declarative, YAML-driven agentic workflows.
 
-The Taskflow Agent is built on top of the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/).
+Built on top of the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/),
+it uses [Pydantic](https://docs.pydantic.dev/) for grammar validation and
+[Jinja2](https://jinja.palletsprojects.com/) for template rendering.
 
 ## Core Concepts
 
@@ -16,6 +19,115 @@ Agents can cooperate to complete sequences of tasks through so-called [taskflows
 
 You can find a detailed overview of the taskflow grammar [here](doc/GRAMMAR.md) and example taskflows [here](examples/taskflows/).
 
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│                   CLI (cli.py)                      │
+│  Typer-based entry point: -p, -t, -l, -g, --resume │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│              Runner (runner.py)                      │
+│  Taskflow execution loop, model resolution,          │
+│  template rendering, session checkpointing           │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│          MCP Lifecycle (mcp_lifecycle.py)            │
+│  Server connection, cleanup, process management      │
+└─────────────────────┬───────────────────────────────┘
+                      │
+┌─────────────────────▼───────────────────────────────┐
+│            Agent (agent.py)                          │
+│  TaskAgent wrapper, hooks, OpenAI Agents SDK bridge  │
+└─────────────────────────────────────────────────────┘
+
+Supporting modules:
+  models.py          — Pydantic v2 grammar models (validation)
+  session.py         — Task-level checkpoint / resume
+  available_tools.py — YAML resource loader with caching
+  template_utils.py  — Jinja2 template environment
+  mcp_utils.py       — MCP client parameter resolution
+  mcp_transport.py   — MCP transport implementations (stdio, streamable)
+  mcp_prompt.py      — System prompt construction
+  prompt_parser.py   — Legacy prompt argument parser
+  capi.py            — AI API endpoint and token management
+  path_utils.py      — Platform-aware data/log directories
+```
+
+### API Types
+
+The agent supports both the **Chat Completions** and **Responses** OpenAI APIs.
+The API type can be configured globally or per model in a `model_config` file:
+
+```yaml
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: model_config
+api_type: chat_completions        # default for all models
+models:
+  gpt_default: gpt-4.1
+  gpt_responses: gpt-5.1
+model_settings:
+  gpt_responses:
+    api_type: responses           # override for this model
+    endpoint: https://api.githubcopilot.com
+    token: CAPI_TOKEN             # env var name containing the API key
+```
+
+Per-model `model_settings` can include:
+- **`api_type`** — `"chat_completions"` (default) or `"responses"`
+- **`endpoint`** — API base URL override for this model
+- **`token`** — name of an environment variable containing the API key
+
+### Session Recovery
+
+Taskflow runs are automatically checkpointed at the task level. If a task
+fails after exhausting retries, the session is saved and can be resumed:
+
+```
+** 🤖💾 Session saved: abc123def456
+** 🤖💡 Resume with: --resume abc123def456
+```
+
+Resume from the last successful checkpoint:
+
+```bash
+python -m seclab_taskflow_agent --resume abc123def456
+```
+
+Failed tasks are automatically retried up to 3 times with increasing backoff
+before the session is saved. Session checkpoints are stored in the
+platform-specific application data directory.
+
+### Error Output
+
+By default, errors are shown as concise one-line messages. Use `--debug` (or
+set `TASK_AGENT_DEBUG=1`) for full tracebacks:
+
+```bash
+# Concise (default)
+Error: [BadRequestError] model 'foo' not found
+(use --debug for full traceback)
+
+# Full traceback
+python -m seclab_taskflow_agent --debug -t examples.taskflows.echo
+```
+
+### MCP Environment Denylist
+
+By default, MCP server subprocesses inherit the parent environment. To prevent
+specific variables from leaking to MCP servers, set `TASKFLOW_ENV_DENYLIST` to
+a comma-separated list of variable names:
+
+```bash
+export TASKFLOW_ENV_DENYLIST="MY_SECRET_TOKEN,PRIVATE_KEY,OTHER_CREDENTIAL"
+```
+
+Toolbox-level `env:` declarations in YAML still inject exactly what each server
+needs, so explicitly configured variables are unaffected.
+
 ## Use Cases and Examples
 
 The Seclab Taskflow Agent framework was primarily designed to fit the iterative feedback loop driven work involved in Agentic security research workflows and vulnerability triage tasks.

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/doc/GRAMMAR.md

@@ -89,7 +89,7 @@ Tasks can optionally specify which Model to use on the configured inference endp
         This is a user prompt.
 ```
 
-Note that model identifiers may differ between OpenAI compatible endpoint providers, make sure you change your model identifier accordingly when switching providers. If not specified, a default LLM model (`gpt-4o`) is used.
+Note that model identifiers may differ between OpenAI compatible endpoint providers, make sure you change your model identifier accordingly when switching providers. If not specified, a default LLM model (such as `gpt-4.1`) is used.
 
 Parameters to the model can also be specified in the task using the `model_settings` section:
 
@@ -509,4 +509,39 @@ When `gpt_latest` is used in the taskflow to specify a model, the value `gpt-5`
 
 ```
 
-This provides a easy way to update model versions in a taskflow.
+This provides an easy way to update model versions in a taskflow.
+
+#### Per-model settings
+
+A `model_config` file can include per-model settings via `model_settings` and a
+global `api_type` that applies to all models unless overridden:
+
+```yaml
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: model_config
+api_type: chat_completions        # default for all models
+models:
+  gpt_default: gpt-4.1
+  gpt_responses: gpt-5.1
+model_settings:
+  gpt_default:
+    temperature: 0.7
+  gpt_responses:
+    api_type: responses           # use the Responses API for this model
+    endpoint: https://api.githubcopilot.com
+    token: CAPI_TOKEN             # env var name containing the API key
+    temperature: 0.5
+```
+
+The following keys in `model_settings` are handled by the engine and are not
+passed to the underlying model provider:
+
+| Key | Description | Default |
+|-----|-------------|---------|
+| `api_type` | `"chat_completions"` or `"responses"` | Inherited from top-level `api_type`, or `"chat_completions"` |
+| `endpoint` | API base URL for this model | The global `AI_API_ENDPOINT` env var |
+| `token` | Name of an environment variable containing the API key | Uses `AI_API_TOKEN` / `COPILOT_TOKEN` |
+
+All other keys (e.g. `temperature`, `top_p`) are passed through as model
+parameters to the OpenAI SDK.

{seclab_taskflow_agent-0.2.0 → seclab_taskflow_agent-0.3.0}/examples/model_configs/model_config.yaml

@@ -5,7 +5,5 @@ seclab-taskflow-agent:
   version: "1.0"
   filetype: model_config
 models:
-  sonnet_default: claude-sonnet-4
-  sonnet_latest: claude-sonnet-4.5
   gpt_default: gpt-4.1
-  gpt_latest: gpt-5
+

seclab_taskflow_agent-0.3.0/examples/model_configs/responses_api.yaml

@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: GitHub, Inc.
+# SPDX-License-Identifier: MIT
+
+# Example: per-model API type and endpoint configuration.
+# gpt_responses uses the Responses API on the CAPI endpoint,
+# reading its token from the CAPI_TOKEN env var.
+
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: model_config
+models:
+  gpt_responses: gpt-5.1
+model_settings:
+  gpt_responses:
+    api_type: responses
+    endpoint: https://api.githubcopilot.com
+    token: CAPI_TOKEN

seclab_taskflow_agent-0.3.0/examples/taskflows/comprehensive_test.yaml

@@ -0,0 +1,125 @@
+# SPDX-FileCopyrightText: GitHub, Inc.
+# SPDX-License-Identifier: MIT
+
+# Comprehensive test taskflow that exercises every grammar feature:
+#   - model_config reference with model aliases
+#   - globals (with CLI override via -g)
+#   - inputs (task-level template variables)
+#   - env (task-scoped environment variables)
+#   - must_complete
+#   - exclude_from_context
+#   - max_steps
+#   - MCP toolboxes (echo)
+#   - shell task (run)
+#   - repeat_prompt + async iteration
+#   - reusable tasks (uses)
+#   - reusable prompts ({% include %})
+#   - agent handoffs (multi-agent)
+#   - headless mode
+#   - blocked_tools
+
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: taskflow
+
+model_config: examples.model_configs.model_config
+
+globals:
+  topic: fruit
+  detail_level: brief
+
+taskflow:
+  # ---------------------------------------------------------------
+  # Task 1: Shell task — produces a JSON array for repeat_prompt
+  # Features: run, must_complete
+  # ---------------------------------------------------------------
+  - task:
+      name: generate-items
+      must_complete: true
+      run: |
+        echo '[{"name": "apple", "color": "red"}, {"name": "banana", "color": "yellow"}, {"name": "orange", "color": "orange"}]'
+
+  # ---------------------------------------------------------------
+  # Task 2: Repeat prompt over shell output, async iteration
+  # Features: repeat_prompt, async, async_limit, exclude_from_context,
+  #           model (alias), inputs, globals, env, max_steps
+  # ---------------------------------------------------------------
+  - task:
+      name: describe-items
+      repeat_prompt: true
+      async: true
+      async_limit: 3
+      exclude_from_context: true
+      must_complete: true
+      model: gpt_default
+      max_steps: 10
+      agents:
+        - examples.personalities.fruit_expert
+      inputs:
+        format: one-sentence
+      env:
+        FRUIT_MODE: "analysis"
+      user_prompt: |
+        The topic is {{ globals.topic }} at {{ globals.detail_level }} detail level.
+        Describe the {{ result.name }} (which is {{ result.color }}) in {{ inputs.format }} format.
+
+  # ---------------------------------------------------------------
+  # Task 3: MCP tool call with echo server
+  # Features: toolboxes, headless, blocked_tools
+  # ---------------------------------------------------------------
+  - task:
+      name: echo-test
+      must_complete: true
+      headless: true
+      agents:
+        - examples.personalities.echo
+      user_prompt: |
+        Echo the following message: "All {{ globals.topic }} items processed successfully"
+      blocked_tools:
+        - nonexistent_tool_to_test_filtering
+
+  # ---------------------------------------------------------------
+  # Task 4: Reusable task via `uses`
+  # Features: uses (inherits from single_step_taskflow)
+  # ---------------------------------------------------------------
+  - task:
+      name: reusable-task
+      uses: examples.taskflows.single_step_taskflow
+      model: gpt_default
+
+  # ---------------------------------------------------------------
+  # Task 5: Reusable prompt via {% include %}
+  # Features: Jinja2 include directive, reusable prompts
+  # ---------------------------------------------------------------
+  - task:
+      name: include-prompt
+      agents:
+        - examples.personalities.fruit_expert
+      model: gpt_default
+      max_steps: 5
+      user_prompt: |
+        Tell me about apples.
+
+        {% include 'examples.prompts.example_prompt' %}
+
+        Keep your answer to two sentences per fruit.
+
+  # ---------------------------------------------------------------
+  # Task 6: Agent handoffs (multi-agent)
+  # Features: multiple agents (first=primary, rest=handoff targets)
+  # ---------------------------------------------------------------
+  - task:
+      name: handoff-test
+      model: gpt_default
+      max_steps: 15
+      agents:
+        - examples.personalities.fruit_expert
+        - examples.personalities.apple_expert
+        - examples.personalities.banana_expert
+        - examples.personalities.orange_expert
+      user_prompt: |
+        You are a fruit coordinator. I need specific expert advice on each fruit.
+        Please hand off to the apple expert for a one-sentence fact about apples,
+        then to the banana expert for a one-sentence fact about bananas,
+        then to the orange expert for a one-sentence fact about oranges.
+        Each expert should provide exactly one interesting fact.

seclab_taskflow_agent-0.3.0/examples/taskflows/echo_responses_api.yaml

@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: GitHub, Inc.
+# SPDX-License-Identifier: MIT
+
+# Echo taskflow using the Responses API with MCP tool calls.
+
+seclab-taskflow-agent:
+  version: "1.0"
+  filetype: taskflow
+
+model_config: examples.model_configs.responses_api
+
+taskflow:
+  - task:
+      max_steps: 5
+      must_complete: true
+      agents:
+        - examples.personalities.echo
+      model: gpt_responses
+      user_prompt: |
+        Hello from the Responses API