feat: add first-class Python resource bindings

[alongubkin]

Python applications currently need provider-specific parsing or a companion process to consume Alien resources. This adds an async, typed alienplatform package backed by the existing Rust binding core, so Python workloads inherit the same provider selection, workload identity, credential refresh, and structured errors as other SDKs.

The package covers Storage, Queue, Vault, KV, Key, Postgres, AI, Container, Worker, and Sandbox. It includes SQLAlchemy/Postgres TLS helpers, redacted connection objects, an all-resource example, and unpublished ABI3 wheel artifacts for macOS and Linux.

Storage now exposes optional reads and atomic create-only writes in Python, plus the same create condition in the TypeScript binding. Concurrent writers use the provider-neutral object-store precondition; exactly one creates the object and conflicts return the stable STORAGE_OBJECT_ALREADY_EXISTS error without leaking provider details.

Python Container resources can now build directly from pyproject.toml and uv.lock with an explicit argv and optional uv workspace package. Prerelease builds can pass a target wheel through ALIEN_PYTHON_SDK_WHEEL; Alien stages it with a separate BuildKit context, includes its bytes in the artifact cache key, and does not require the application to commit the wheel. Worker and Daemon Python source builds fail clearly until their runtime adapters exist.

Validation:

• cargo check -p alien-bindings-python --no-default-features --features local
• cargo clippy -p alien-bindings-python --no-default-features --features local --no-deps -- -D warnings
• cargo clippy -p alien-bindings-node --lib --no-default-features --no-deps -- -D warnings
• cargo fmt -p alien-bindings-python --check
• clean Python 3.12 install from locally built ABI3 wheels
• pytest -q crates/alien-bindings-python/tests (10 passed)
• mypy crates/alien-bindings-python/python crates/alien-bindings-python/tests
• ruff check crates/alien-bindings-python/python crates/alien-bindings-python/tests
• pnpm --filter @alienplatform/bindings test:ts, build, and tests (129 passed against the rebuilt native addon)
• Python wheel CI across Python 3.10/3.13, macOS ARM64, Linux x64, and Linux ARM64
• AWS ARM64 Worker smoke: real Storage put/get/delete and public health response
• cargo test -p alien-build --lib (129 passed, 1 Docker/BuildKit secret test ignored)
• pnpm --filter @alienplatform/core test (94 passed) and test:ts
• schema regeneration via pnpm --filter @alienplatform/core generate
• current-branch CLI built examples/python-container for Linux ARM; the exact OCI image loaded and served alienplatform: ready

Linear: ALIEN-910, ALIEN-939

No package is published by this PR. The complete all-resource example still needs a cloud run, so the PR remains a draft.

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the previous findings fixed and no new actionable defects identified.

Summary

Adds typed, async Python resource bindings backed by the shared Rust implementation, alongside Python Container source builds and atomic create-only Storage writes.

• Python exposes resource operations, structured errors, PostgreSQL TLS helpers, and managed AI gateway connections.
• Python Container builds consume locked uv projects and optionally inject an SDK wheel through a separate build context.
• The latest changes add four-platform wheel qualification and promotion of those exact artifacts to PyPI, with identity and hash checks.
• All eight previous findings are fixed in the current code. No new actionable issues were identified.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Source[Release source commit] --> Qualify[Build four ABI3 wheels]
  Qualify --> Validate[Validate identity and smoke-test native targets]
  Validate --> Artifacts[Qualified wheel artifacts]
  Artifacts --> Check[Check existing PyPI hashes]
  Check --> Publish[Publish qualified wheels]
  Publish --> Verify[Verify published hashes]
  Verify --> Release[GitHub release gate]

Loading

_{Reviews (5) · Last reviewed commit: "ci: publish qualified Python wheels to P..."}

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review