feat: add Jungle Grid GPU execution agent demo

[dejaguarkyng]

Summary

• Add a project-based Jungle Grid execution demo for OpenAgents.
• Request a cost estimate before submission.
• Require explicit human approval before any billable job is submitted.
• Monitor asynchronous job lifecycle updates and store logs/artifact metadata as project artifacts.
• Add mocked tests covering estimation, approval, submission, polling, artifacts, cancellation, API errors, timeouts, and secret redaction.

Architecture

This contribution is intentionally a runnable WorkerAgent demo rather than a core provider integration, launcher type, credential type, or mod. It uses OpenAgents' existing project workflow, messaging, and artifact primitives to demonstrate external asynchronous GPU workload delegation safely.

Safety and credentials

• Reads JUNGLE_GRID_API_KEY only from the environment.
• Never submits during estimation.
• Requires exact APPROVE <estimate-id> approval from a human identity before billable submission.
• Requires exact CANCEL <job-id> cancellation from a human identity.
• Resolves workload environment values from environment_from_env references only after approval.
• Sanitizes API errors and redacts secrets from shared output.
• Does not perform paid live requests in CI.

Testing

Passed:

• pytest tests/agents/test_jungle_grid_executor.py -q - 37 passed
• ruff check sdk/demos/09_jungle_grid_gpu_execution tests/agents/test_jungle_grid_executor.py
• ruff format --check sdk/demos/09_jungle_grid_gpu_execution tests/agents/test_jungle_grid_executor.py
• UV_CACHE_DIR=/tmp/uv-cache UV_TOOL_DIR=/tmp/uv-tools uvx ruff==0.6.9 check sdk/demos/09_jungle_grid_gpu_execution tests/agents/test_jungle_grid_executor.py
• UV_CACHE_DIR=/tmp/uv-cache UV_TOOL_DIR=/tmp/uv-tools uvx ruff==0.6.9 format --check sdk/demos/09_jungle_grid_gpu_execution tests/agents/test_jungle_grid_executor.py
• MYPYPATH=sdk/src mypy --follow-untyped-imports sdk/demos/09_jungle_grid_gpu_execution/agents/jungle_grid_executor.py
• load_network_config("sdk/demos/09_jungle_grid_gpu_execution/network.yaml") - loaded as JungleGridGPUExecution

No live Jungle Grid validation was performed because a temporary JUNGLE_GRID_API_KEY was not available to the execution environment. No billable workload was submitted.

Related issue/discussion

Closes #432

Known unrelated repository limitations

• A bounded repository-wide pytest --tb=short -q run timed out after 300 seconds after reporting existing A2A errors and unrelated failures.
• A bounded tests/agents run timed out after 300 seconds at 83% with no failure in this contribution's focused test module.
• pytest --tb=short -q tests/mods/test_project_mode.py fails because the existing tests reference missing /examples/test_configs/project_mode.yaml.
• mkdocs build --strict fails because the existing mkdocs.yml references missing docs/overrides.

[vercel]

@dejaguarkyng is attempting to deploy a commit to the Raphael's projects Team on Vercel.

A member of the Team first needs to authorize it.

[QuanCheng-QC]

Overall this is a positive review: the demo's API integration, human-approval gate, secret redaction, concurrency control, and test coverage all look solid.

That said, I see one high-probability blocking issue around agent group authorization. The project template restricts execution to agent_groups: [executors], but OpenAgents appears to resolve group authorization from the runtime topology.agent_group_membership, not from the static allowlist under agent_groups.executors.metadata.agents in network.yaml.

With the README's current startup command, I don't see how the executor agent joins the executors group via group/password. My read is that it would likely land in the default guest group. If so, _get_agents_in_group("executors") would return empty, project.notification.started would not be delivered to the executor, and the demo would not trigger as documented.

This is based on a source read rather than an end-to-end run, so please correct me if there's an authorization path I missed. References for checking:

• Group resolution: _get_agents_in_group() reads network.topology.agent_group_membership in sdk/src/openagents/mods/workspace/project/mod.py
• Group assignment at connect time: _assign_to_requested_group / _legacy_assign_by_password in sdk/src/openagents/sdk/topology.py
• Reference pattern: sdk/demos/08_alternative_service_project/agents/coordinator.py:213 joins the coordinators group via password_hash

Suggested fixes, following demo 08:

1. Add a password_hash to the executors group in network.yaml;
2. Pass the corresponding password_hash in main() / async_start(...);
3. Or provide an end-to-end run showing that the static agents allowlist is converted into real runtime group membership.

Any of these would resolve my concern. If the static allowlist does get converted into real membership, the fastest way to clear this up would be to attach an end-to-end run showing: human starts a project → executor receives the estimate.

Once this is resolved, the rest are mostly minor nits: env var naming consistency (JUNGLE_GRID_API_KEY vs JUNGLEGRID_API_BASE), documenting the single-executor assumption, and optionally redacting the _error_detail code as well as the message.