fix(temporal): connect to the namespace in TEMPORAL_NAMESPACE - #571

What

Temporal clients created by the SDK now connect to the namespace in TEMPORAL_NAMESPACE when it is set. Without it, they connect as before.

Why

The agentex-agent chart sets TEMPORAL_NAMESPACE from global.temporal.namespace on both the ACP and the temporal-worker Deployments, but the SDK never read it. Every agent therefore ran in Temporal's default namespace, whatever the deployment configured. On a server with namespace-scoped authorization, an agent whose identity holds a role only for its own namespace is denied in default.

How

connect_temporal_client is the single connect path for the ACP client and the worker. It adds namespace from TEMPORAL_NAMESPACE to the connect options unless the caller already passed one. Anonymous and Workload Identity connections both use it.

Verification

• New tests: the namespace reaches Client.connect on the anonymous and the authenticated path, and an explicit namespace is kept. Both fail on the previous release.
• Removing the namespace line, or the explicit-namespace check, turns the matching test red.
• The existing no-scope test now clears TEMPORAL_NAMESPACE and still asserts the exact legacy connect arguments.
• With TEMPORAL_NAMESPACE set, both the ACP client and the worker builders pass it to Client.connect; without it, neither passes a namespace.
• tests/lib/test_temporal_auth.py, test_temporal_utils.py, test_agentex_worker.py and test_payload_codec.py: 70 passed. Ruff check and format pass.

What could go wrong

A deployment that sets TEMPORAL_NAMESPACE to a namespace other than the one its workflows live in now moves to that namespace. Chart releases default global.temporal.namespace to default, so deployments that never set it are unchanged.

This PR carries the commits of #570 from a branch in this repository. The fork PR gets no repository secrets, so the tutorial tests fail there with no OpenAI API key.

🤖 Generated with Claude Code

Confidence Score: 5/5

Summary

Temporal clients now use TEMPORAL_NAMESPACE when the caller has not supplied namespace.

• Temporal connections use the configured namespace unless the caller chooses one.

No actionable issues found. Tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "test(temporal): clear TEMPORAL_NAMESPACE..." · Reviewed by Greptile}