test(e2e): guard credential-delivery tests on server runtimeMetadata support

Released agentspan servers (through v0.4.2) do not implement the
TaskDef.runtimeMetadata credential-delivery contract (conductor-oss PR #1255) —
they drop the field — so worker credential injection cannot work there, and the
credential-delivery e2e tests would fail for a server-version reason unrelated to
the SDK.

Add a server-capability probe (does a registered TaskDef.runtimeMetadata persist?)
and a `requires_runtime_metadata` fixture that skips the credential-delivery tests
when unsupported. Applied to suite26 TestWorkerCredentials, suite2
test_credential_lifecycle, suite3 test_cli_credential_lifecycle. The CLI
spawn-safety test is left unguarded (server-independent).

Verified both ways: against the dev server (supports it) the tests RUN and pass;
against v0.4.2 (does not) they SKIP with a TODO to bump AGENTSPAN_VERSION once a
release ships runtimeMetadata.

Author: v1r3n

e2e/conftest.py

@@ -151,3 +151,63 @@ def get_task_by_name(execution_id: str, task_ref_prefix: str) -> list:
         for t in wf.get("tasks", [])
         if task_ref_prefix in t.get("referenceTaskName", "")
     ]
+
+
+# ── Server capability: TaskDef.runtimeMetadata (conductor-oss PR #1255) ──
+#
+# Worker credential delivery relies on the server persisting a worker's declared
+# TaskDef.runtimeMetadata and delivering the resolved values on Task.runtimeMetadata
+# at poll time. Released servers (through v0.4.2) do NOT implement this yet — they
+# drop the field — so the credential-delivery e2e tests would fail there for a
+# reason unrelated to the SDK. Probe the running server once and skip those tests
+# when unsupported.
+#
+# TODO: once agentspan cuts a release that implements runtimeMetadata, bump
+# AGENTSPAN_VERSION in .github/workflows/agent-e2e.yml — this guard then lets the
+# credential tests run automatically (no test change needed).
+
+_RUNTIME_METADATA_SUPPORT = None
+
+
+def _probe_runtime_metadata_support() -> bool:
+    import uuid
+
+    name = f"_rtmd_cap_probe_{uuid.uuid4().hex[:8]}"
+    try:
+        r = requests.post(
+            f"{BASE_URL}/api/metadata/taskdefs",
+            json=[{"name": name, "runtimeMetadata": ["PROBE"],
+                   "retryCount": 0, "timeoutSeconds": 0}],
+            timeout=8,
+        )
+        if r.status_code not in (200, 204):
+            return False
+        g = requests.get(f"{BASE_URL}/api/metadata/taskdefs/{name}", timeout=8)
+        return g.status_code == 200 and g.json().get("runtimeMetadata") == ["PROBE"]
+    except Exception:
+        return False
+    finally:
+        try:
+            requests.delete(f"{BASE_URL}/api/metadata/taskdefs/{name}", timeout=5)
+        except Exception:
+            pass
+
+
+def _server_supports_runtime_metadata() -> bool:
+    global _RUNTIME_METADATA_SUPPORT
+    if _RUNTIME_METADATA_SUPPORT is None:
+        _RUNTIME_METADATA_SUPPORT = _probe_runtime_metadata_support()
+    return _RUNTIME_METADATA_SUPPORT
+
+
+@pytest.fixture
+def requires_runtime_metadata():
+    """Skip a test unless the server implements the TaskDef.runtimeMetadata
+    credential-delivery contract (conductor-oss PR #1255)."""
+    if not _server_supports_runtime_metadata():
+        pytest.skip(
+            "server does not persist/deliver TaskDef.runtimeMetadata "
+            "(conductor-oss PR #1255) — worker credential injection requires it. "
+            "TODO: bump AGENTSPAN_VERSION in .github/workflows/agent-e2e.yml once a "
+            "release ships runtimeMetadata support."
+        )

e2e/test_suite26_worker_credentials.py

@@ -126,6 +126,7 @@ def _get_taskdef(name: str) -> dict | None:
 
 
 @pytest.mark.timeout(300)
+@pytest.mark.usefixtures("requires_runtime_metadata")
 class TestWorkerCredentials:
     def test_credential_injected_via_runtime_metadata(self, runtime, model):
         """The tool receives the server-resolved secret (Task.runtimeMetadata)."""

e2e/test_suite2_tool_calling.py

@@ -295,6 +295,7 @@ def _get_output_text(result) -> str:
 class TestSuite2ToolCalling:
     """Credential lifecycle: missing -> env ignored -> add -> update."""
 
+    @pytest.mark.usefixtures("requires_runtime_metadata")
     def test_credential_lifecycle(self, runtime, cli_credentials, model):
         """Full credential lifecycle test — sequential steps with cleanup."""
         try:

e2e/test_suite3_cli_tools.py

@@ -240,6 +240,7 @@ def _assert_run_completed(result, step_name: str):
 class TestSuite3CliTools:
     """CLI tools: credential lifecycle + command whitelist."""
 
+    @pytest.mark.usefixtures("requires_runtime_metadata")
     def test_cli_credential_lifecycle(self, runtime, cli_credentials, model):
         """Full CLI credential lifecycle — sequential steps with cleanup."""
         real_token = os.environ.get("GITHUB_TOKEN")