fix(runtime): require verified terminal failure handling

[drewstone]

Chat turns could appear successful after Runtime reported an upstream failure. Agent App’s peer range still excluded the Runtime correction.

Require Runtime 0.222.1 in the package and both generated templates. Refresh the playground lock and link README dependency guidance to the canonical manifest. No retry or execution code is added.

Validation: committed-source signoff passed all six steps, including two randomized suite runs and generated projects, on 3775839. CI and independent review passed. The verified Runtime npm artifact separately passed producer-failure and handled-tool-error checks.

[drewstone]

Independent release-fixture review

Verdict: pass; no release-blocking findings.

Agent-app PR 592

• 37758398 is clean and contains the intended two-file documentation/lock refresh.
• Original P1 is addressed: README.md removes duplicated peer ranges and links to package.json plus pnpm exec agent-app-peer-check.
• Original P2 is addressed: playground/package-lock.json updates all three stale metadata entries (0.47.18 → 0.47.22, Runtime 0.219.0 → 0.222.1, and the peer range to >=0.222.1 <0.223.0).
• git diff --check passes. The direct peer CLI passes with the intentional calibration fixtures excluded; the bare self-run reports only the committed fixture tarball. pnpm exec cannot resolve the package's own bin from this source checkout, which is expected for a consumer-facing installed-package command.

ADC PR 7363

• Final commit df9820c67d is clean and changes only the two requested integration tests; no production auth or tenant code changed.
• Upload fixture isolation is sound: uploadSessionStore.purge() runs before and after each test, the GC setup creates exactly a 10-byte reservation through the public route, and the clock spy is restored before sweepOnce(). Existing cross-workspace 404/commit behavior remains exercised.
• Auth setup is sound: vi.hoisted() sets auth env before static imports of the real app, avoiding the 15-second beforeAll import timeout without changing test/global timeouts. The real app still mounts authGuard() before /capabilities; unauthenticated requests remain 401 and wrong-scope JWTs remain 403. The reported six-file regression passed 72/72.

No full suites were run for this review.

[drewstone]

Committed-source signoff PASS for 377583988b8f3044c2b3a6fb527b9af5accf2b8b.

Node24.18.0; clean frozen-lockfile install. Every required step passed:

• typecheck: passed (1 run(s))
• incident-class gates: passed (1 run(s))
• build: passed (1 run(s))
• unit tests: passed (2 run(s))
• generated projects: passed (1 run(s))
• dead-surface (knip): passed (1 run(s))

Randomized suite seeds: 1249338092, 2089259199.
Proof SHA256: 73b006687f67cb3c62491a48479443832e7da01c6ec30f64c1063f51b2858436.
Reproduce: pnpm signoff --source head --seed 1101303448.

Independent review rechecked both findings on this commit and passed. Runtime0.222.1 was separately executed from its verified npm tarball; the correction remains in Runtime.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[drewstone]

Published and verified @tangle-network/agent-app@0.47.23 and @tangle-network/create-agent-app@0.47.23. Source build34807338880 and tagged publication34808228308 both completed successfully.

Downloaded both registry archives and compared them byte for byte with the source-build artifact. Agent App SHA256: 8cb91ee1ad313d6d8e69c4ef851451283baf26e4d0833e3de7892641ef03fcba. Scaffolder SHA256: 7c46572cfbb5912cb997a5954339e3c6fa3633c353a2913e01e7be560a0d9e0e. The published manifest requires Runtime >=0.222.1 <0.223.0; both shipped templates select 0.222.1.

This completes this package release. Consumer application deployment and retained-conversation proofs remain separate work; registry publication alone does not establish those outcomes. Local machine-readable proof: /tmp/agent-app-0.47.23-registry-proof.json.