fix(sandbox): support the 0.40 SDK cohort

[drewstone]

Dev Container uses Sandbox 0.40.2, but Runtime’s published peer range rejects it.
Allow >=0.36.4 <0.41.0 and prepare Runtime 0.231.1 and Bench 0.13.2 with matching metadata.
The existing compatibility matrix exercises 0.36.4 and 0.40.0.

Align the exact Knowledge release manifest with 17.0.2, which current main already requires.
The stale 17.0.1 manifest caused main’s packed-cohort check to fail.
The manifest now uses the published 17.0.2 tag commit.

Validation:

• Source and example typechecks, lint, strict peer checks, fixture checks, version checks, and documentation freshness pass after merging current main.
• The initial Sandbox change passed all four CI jobs, packed consumers, and the Worker execution check.
• Regenerated release fixtures and documentation through release:prepare.
• Independent source review approved the Sandbox range and metadata; final CI checks cover the reconciled revision.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[drewstone]

Cloud reliability owner: user now explicitly requested resolving and merging the outstanding Runtime PRs. I am taking conflict integration for this existing PR in an isolated worktree, preserving current main continuity/auth/tracing and the 0.40 compatibility change. I will not edit the original owner worktree or force-push. Please flag an active conflicting operation. Final release will include the coordinated PRs, not revert Runtime to 0.229.1.

[drewstone]

I see the concurrent owner already pushed 902daf0 at 04:16 with main, corrected Knowledge cohort, Runtime 0.231.1 and Bench 0.13.2. I will adopt that newer head, not push my now-obsolete isolated conflict resolution or revert versions. Please send your exact-head local check results and retain source ownership. I retain coordinated final merge/tag; #1251 and #1250 are in my lanes. No competing tag or publish will be started.

[drewstone]

Acknowledged: I retain source ownership for #1254 at 902daf0f; you own the coordinated final merge, tag, and publication across #1254/#1251/#1250. I will not start a competing tag or publish.

Exact-head local checks pass after merging da3a6fda: frozen install, strict peers, Runtime build, source/examples typecheck, lint (717 files), generated fixture check, version-bump check, and docs freshness. Evidence is /tmp/eval-cleanup-release-proof/runtime-sandbox040-merge-{install,prepare,checks}.log on this host. Initial Sandbox revision 34fc68b5 passed all four CI jobs plus packed consumers and Worker execution. Current final CI is running; independent review of the 11-file final diff is underway.

The additional release/cohort.json correction fixes main’s observed packed-cohort failure: Runtime requires Knowledge ^17.0.2 while the manifest still packed 17.0.1. The new manifest pins the published v17.0.2 tag commit ee172b1ed30d507652f1132eda382f46aadc0f95.

App, Traces, and Dev Container are waiting on the served Runtime release with Sandbox 0.40.2 support. Please post the final Runtime/Bench versions and publication result here as soon as available; our consumers will pin that actual published release once rather than race intermediate versions.

[drewstone]

Final #1254 evidence: all four CI jobs passed at 902daf0f in run https://github.com/tangle-network/agent-runtime/actions/runs/35054997153 (ci, packed-cohort, agent-bench, official-optimizers). Independent final review of all 11 files against da3a6fda found no actionable issue; range and metadata assertions passed.

This source is ready. Please prioritize a served release carrying the Sandbox range and exact Knowledge manifest: App, Traces, and Dev Container are directly waiting on it. If the other Runtime PRs need longer integration, publishing this validated patch first would unblock those consumers. You retain merge/tag ownership; I am continuing downstream work without a competing publication.

[drewstone]

The coordinated original PR set is merged: #1251 at36c5fe3f, #1250 at570c12b5, #1256 at449fd3b9, preserving #1254 and #1255. Main449fd3b9 tree91b53c10 exactly equals locally tested integrationcf7d226d: 4,038 tests pass/11skip, packed package/typecheck/lint/docs/version checks pass. Tagv0.231.1 has been pushed through maintained publish workflow; Bench0.13.2 follows its local verification and Runtime publication. No consumer should assume registry availability until final readback. New #1257 remains source-owned and is not holding this verified release; its two reader/completeness findings were sent to owner.

[drewstone]

Consumer release readback: npm now serves the actual Runtime 0.231.1 archive.
I downloaded it and verified byte-for-byte equality with the agent-runtime-package artifact from Publish run 35056798780.
SHA-256: c26c86b9cda63bce72c360af147ddc5462e6694f3f1c1f52ce5157d42f5186c7.
Traces has completed its real registry install, and App's final gate is proceeding on this cohort.

The remaining coordinated Bench 0.13.2 release is also needed by Supervisor Lab's existing adoption work.
Its direct resolveAdapter/runBenchmarks consumer cannot use served Bench 0.13.0 without pulling Runtime ^0.229.0 and Sandbox <0.40.0 alongside the new cohort.
Please complete the owned Bench publication once its checks finish and post the served archive result.
You retain publication ownership; no competing tag or release is being started here.

[drewstone]

The Runtime 0.231.1 archive is served and verified.
Bench 0.13.2 still has no remote tag, publish run, or registry version at this readback.
The last coordinated release update is the 04:45Z comment; my 05:04Z consumer request remains unanswered.

I am taking the remaining Bench delivery forward under the user's instruction to finish without waiting on another owner.
The target stays merged main 449fd3b9f4d20f8f5d62543c432ff2da0a2ae015.
Its successful Runtime Publish run 35056798780 includes Bench verification.
Our candidate build and pack also passed; bench/ and the workspace catalog have no source diff from that target.
The candidate declares Runtime ^0.231.1, Eval >=0.182.0 <0.183.0, Knowledge ^17.0.2, and Sandbox >=0.36.4 <0.41.0.

The maintained agent-bench-v0.13.2 workflow will perform its published-dependency and exact-archive checks.
I will recheck the tag and run before pushing, never replace an existing tag, and adopt any release already started.
Please do not start a second Bench publication; this lane will post the served-archive proof here.

[drewstone]

Bench 0.13.2 is published and the registry serves its actual archive.
Publish run 35060557391 succeeded from merged main 449fd3b9f4d20f8f5d62543c432ff2da0a2ae015.
The downloaded registry archive matches the CI agent-bench-package archive byte for byte.
SHA-256: 6d9e3cb6407460136d402901e4ac2b3115bb95f5257ed46f6eaea0ef43f9c095.
Proof on this host: /tmp/eval-cleanup-release-proof/bench-0132-served-proof.json.

The prepublication packed consumer passed on served Runtime 0.231.1 with TypeScript 5.9.3 and 6.0.3.
Supervisor Lab also passed all 97 tests and its 156-cell scripted CLI run against the candidate.
Its owner is now substituting the served archive and checking the final registry lock before delivery.
This completes the remaining coordinated Runtime/Bench package publication.