feat: consume v1 resources in sdk and managed agents runtime

.agents/README.md

@@ -1,5 +1,15 @@
 # `.agents/` — engineering record of the python-sdk repository
 
+- [Agents API delivery operations](notes/proposed/process/2026-11-12-agents-api-delivery-operations.md) · [record-placement verification](evidence/verify/2026-11-12-agents-api-delivery-operations.md).
+
+- [Standalone server policy documentation](notes/proposed/feature/2026-11-12-standalone-policy-docs.md) · [verification](evidence/verify/2026-11-12-standalone-policy-docs.md).
+
+- [Shared YAML Core reader](notes/proposed/feature/2026-11-12-template-yaml-core-reader.md) · [verification](evidence/verify/2026-11-12-template-yaml-core-reader.md).
+
+- [Managed Session response projection](notes/proposed/feature/2026-11-12-managed-session-projection.md) · [verification](evidence/verify/2026-11-12-managed-session-projection.md).
+
+- [Canonical v1 runtime consumers](notes/proposed/feature/2026-11-12-template-v1-runtime.md) · [first freeze](evidence/verify/2026-11-12-template-v1-runtime.md) · [ports and process-domain comparison](evidence/verify/2026-11-12-template-v1-runtime-ports.md) · [final local gates](evidence/verify/2026-11-12-template-v1-runtime-final-local.md).
+
 - [Managed Agent input and saved-configuration contract](notes/proposed/feature/2026-11-12-managed-agent-input-contract.md) · [verification](evidence/verify/2026-11-12-managed-agent-input-contract.md).
 
 ## Recent changes — 2026-11-10

.agents/evidence/verify/2026-11-12-agents-api-delivery-operations.md

@@ -0,0 +1,34 @@
+# Verification: python-sdk Agents API record placement
+
+Date: 2026-11-12. Source before this record-only follow-up: c4d43a24f40412bb8ab303509a7cb5bf7030da3c.
+Result: PASS for local record-placement checks only. The overall cloud/topic delivery
+remains incomplete. No product/runtime/post/CI/configuration changes are part of this follow-up.
+
+## Scope
+
+Add the owner operations note, index and any explicitly retained small local probe sources.
+Necessary continuation instructions no longer require a workspace-only plan. Previously
+committed evidence and original captures remain history; no old result is rewritten as a new run.
+Cross-owner requirements use absolute GitHub links. Credentials, raw sensitive logs, installed
+dependencies, caches and distribution binaries are excluded.
+
+## Verification
+
+- PASS: only owner .agents paths changed; 5 Markdown, 6 JSON and 1 retained Python sources checked.
+- PASS: local links remain within this standalone repository, all seven note sections are in order, and retained source SHA256 values match exact originals.
+- PASS: new record contents contain no configured private credential/endpoint values or workstation-specific source paths.
+- Final `bash scripts/check-repo-health.sh --quiet`:106 PASS /1 existing recommendation /0 FAIL. Initial run105 PASS /1 WARN /1 FAIL reported the new dated probe-directory reference as a missing evidence slug; a conventional adjacent dated Markdown entry now owns that directory. No health gate was changed.
+- PASS: staged whitespace and configured-private-value checks. CLI/SDK existing hygiene gates also pass; normal commit hooks run below. These outcomes remain independent of the earlier product CI checkpoint.
+
+Copying an original script is archival work, not a repeated model/cloud test. Retained probe
+sources were syntax-checked without importing/executing them; no paid model or cloud operation
+was performed for this follow-up. The audit environment used Python3.13.13 with the owner's
+pinned record-validation dependencies. New exact-head remote CI remains a separate gate.
+
+## Remaining delivery
+
+Record-only local verification does not complete Managed FC deploy/update/old-Session/cleanup,
+Codex tool-round acceptance, source publication or the two topics. Follow the
+[owner operations](../../notes/proposed/process/2026-11-12-agents-api-delivery-operations.md) and its links for prerequisites and normal delivery gates.
+
+The normal secret hook initially rejected the archived constant synthetic loopback token. An explicit test-fixture comment resolves that classification under the existing rule; Python AST equivalence and original/retained SHA256 values are recorded. No hook/allowlist configuration was weakened and no model/cloud test was rerun.

.agents/evidence/verify/2026-11-12-agents-api-interoperability.md

@@ -0,0 +1,25 @@
+# Retained official SDK interoperability probe
+
+The accompanying directory retains the original probe execution semantics, actual distribution identity and before/after
+typed results. It was not rerun during record placement. sources.json identifies every retained
+byte sequence. No wheel, model request/response, credential or raw stderr is committed.
+
+The [recorded alignment table](2026-11-12-agents-api-interoperability/alignment.md) keeps the prior capability and topology decisions
+with the SDK owner instead of requiring a workspace-only report.
+
+Use a separate local test environment with the matching reviewed client source and its
+managed-agents dependencies, plus the actual official openai3.49.0 distribution identified in
+distribution.json. Run `python .agents/evidence/verify/2026-11-12-agents-api-interoperability/probe.py` from the repository root and save any new typed result in a
+new dated evidence file. OpenAI is not a product dependency. The probe binds only loopback,
+uses temporary SQLite and a synthetic local token, starts no Worker and calls no model/cloud.
+Review the source before execution; its create/retrieve/list result is not full API coverage.
+
+The after-projection result records default decoding success and remaining strict
+Agent/harness/environment validation differences. A permissive default decoder is not a full
+compatibility contract. The [SDK owner operations](../../notes/proposed/process/2026-11-12-agents-api-delivery-operations.md)
+describe actual product gates and limits. Existing source versions/test results remain scoped
+to their own captures, not an unexecuted current-head full run.
+
+The retained model-protocol-preflight.json is a separate configured-endpoint synthetic check: Chat tool-result200 and Responses tool-result400 for the selected model. It is not a general claim about all providers/models, an actual Codex task, or a new probe during record placement. The template owner separately holds the real local Qwen task results.
+
+The initial normal commit hook rejected the historical constant loopback token as a hardcoded assignment. The retained probe adds only an explicit synthetic test-fixture comment; its Python AST is identical to the original. sources.json preserves both byte hashes and that adaptation. No scanner rule was changed, no real credential was involved, and the recorded SDK result was not rerun or relabeled.

.agents/evidence/verify/2026-11-12-agents-api-interoperability/alignment.md

@@ -0,0 +1,38 @@
+# Recorded Agents API alignment boundary
+
+This is the 2026-11-12 review snapshot for SDK source
+c4d43a24f40412bb8ab303509a7cb5bf7030da3c and official Python SDK3.49.0. It archives the
+earlier comparison, not a new official-API lookup, model run or cloud acceptance.
+Beta references and later source must be checked again before extending claims.
+
+The project runs the complete Agent CLI/model/tool loop inside Sandbox. The official hosted
+harness with a self-hosted exec-server connection is a different topology. A matching URL
+path does not establish that topology or its behavior.
+
+| Surface | Recorded Managed implementation and boundary |
+| --- | --- |
+| Model/runtime/capability discovery | Explicit admitted Codex/Qwen mapping and project capability endpoint. Adapter classes do not admit other runtimes to HTTP. One ordinary deployment has one actual model binding. |
+| Saved Agent and Session | Selected owner-scoped resource subset; create201 and supported initial text. Saved Agent plus inline supported overrides creates a Session snapshot without changing the saved object. The earlier mutual-exclusion hypothesis was rejected. |
+| Typed input | String/user input_text subset and optional message discriminator. Unsupported image/audio/tool forms are rejected rather than implied. |
+| Active input | Cannot steer the current native turn through this path; busy input is rejected. Explicit durable submissions enqueue a later turn and are a project extension. |
+| Turns/items/events | Implemented persistent query/event paths and replay boundaries. Actual FC realtime streaming still needs a live streaming ingress check; a completed buffered response is insufficient. |
+| Input files/artifacts | Fixed input snapshots and immutable per-turn output bytes with budgets and retention. These are project-managed extensions, distinct from official hosted files and from the older broad local server's in-memory files. |
+| Cancel and uncertainty | Cancellation needs confirmed stop; uncertain native delivery remains reconcilable. Lease expiry or a database receipt alone does not prove remote side effects stopped or exactly-once execution. |
+| Close/delete | Close releases compute while retaining published results; DELETE removes public access and has separate busy/cleanup rules. Do not describe retained close results as resources still available after DELETE. |
+| Official SDK decoding | Actual loopback HTTP/SQLite create/retrieve/list decode in default mode. Strict response validation still fails on Agent/harness/environment fields. See retained typed results; no Worker/model was started. |
+| Narrow response projection | Public integer timestamps and truthful empty required_actions/vault_ids; internal clock precision is retained. No invented remote_url, inline saved-Agent ID, service tier, reasoning or multi-agent state. |
+| Other known differences | Metadata limits and future-turn configuration do not match the full official reference. Arbitrary external tools/MCP, subagents, automations, webhooks, vault and trace are not delivered by this Managed subset. |
+| Broad local server | Separate persistence, input/lifecycle and saved-Agent override behavior remain. Managed fixes cannot be described as fixes to every server entrypoint. |
+
+Recorded primary references:
+
+- [Official architecture](https://developers.openai.com/api/docs/guides/agents-api/architecture).
+- [Session semantics](https://developers.openai.com/api/docs/guides/agents-api/sessions).
+- [Create Session reference](https://developers.openai.com/api/reference/resources/beta/subresources/agents/subresources/sessions/methods/create).
+- [Files/environments](https://developers.openai.com/api/docs/guides/agents-api/environments/files).
+
+The model protocol prerequisite is separately retained in model-protocol-preflight.json:
+the configured model's Chat tool-result probe returned200 and Responses tool-result400.
+That is not a general conclusion about other accounts/services, and not a real Codex task.
+New FC/Qwen/Codex acceptance, revision routing and cleanup still require the owner operations
+and their separate dated evidence. No success article is authorized by this comparison alone.

.agents/evidence/verify/2026-11-12-agents-api-interoperability/distribution.json

@@ -0,0 +1,10 @@
+{
+  "version": "3.49.0",
+  "wheels": [
+    {
+      "filename": "openai-3.49.0-py3-none-any.whl",
+      "url": "https://files.pythonhosted.org/packages/fe/45/de8fbd25a1ca0a46f9641604a7cb991123daa7f292c27625223d685d9bac/openai-3.49.0-py3-none-any.whl",
+      "sha256": "3977754792115027ba80ae16996ba3366478b5b228e1ab58e2660bd7ac8c3d78"
+    }
+  ]
+}

.agents/evidence/verify/2026-11-12-agents-api-interoperability/model-protocol-preflight.json

@@ -0,0 +1,17 @@
+{
+  "scope": "Configured endpoint minimal synthetic tool-result protocol probes, not Agent/cloud business E2E",
+  "results": [
+    {
+      "probe": "chat-tool-result",
+      "model": "qwen3-coder-flash",
+      "httpStatus": 200,
+      "hasOutput": true
+    },
+    {
+      "probe": "responses-tool-result",
+      "model": "qwen3-coder-flash",
+      "httpStatus": 400,
+      "toolRoleRejected": true
+    }
+  ]
+}

.agents/evidence/verify/2026-11-12-agents-api-interoperability/probe.py

@@ -0,0 +1,43 @@
+"""Read-only local official SDK boundary probe; no Worker or cloud/model invocation."""
+import hashlib, inspect, json, pathlib, tempfile, threading
+import openai
+from agent_sandbox.managed_agents import ManagedConfig, ManagedService, ManagedStore
+from agent_sandbox.managed_agents.http import TokenAuthenticator, make_server
+
+out = {'sdkVersion': openai.__version__, 'sdkModule': str(pathlib.Path(openai.__file__).name), 'operations': [], 'workerStarted': False, 'cloudCalls': 0}
+with tempfile.TemporaryDirectory(prefix='abx-sdk-interop-') as tmp:
+ config = ManagedConfig.from_dict({'revision':'local-probe','template':'fixture-only','models':{'fixture-model':'qwen-code'}})
+ service = ManagedService(ManagedStore('sqlite:///'+tmp+'/state.db', local=True), config)
+ token = 'local-only-probe-token'  # synthetic test-only loopback fixture
+ auth = TokenAuthenticator({'tokens':[{'sha256':hashlib.sha256(token.encode()).hexdigest(),'owner':'local-probe','scopes':['agents:read','agents:write']}]})
+ server = make_server(service, auth, port=0)
+ thread = threading.Thread(target=server.serve_forever, daemon=True); thread.start()
+ sid = None
+ try:
+  for strict in (False, True):
+   with openai.OpenAI(api_key=token,base_url=f'http://127.0.0.1:{server.server_port}/v1',max_retries=0,timeout=5,_strict_response_validation=strict) as client:
+    ops = [('create', lambda: client.beta.agents.sessions.create(environment={'type':'self_hosted'},agent={'model':'fixture-model'},input=[{'type':'message','role':'user','content':[{'type':'input_text','text':'typed local prompt'}]}]))] if sid is None or strict else []
+    ops += [('retrieve',lambda:client.beta.agents.sessions.retrieve(sid)),('list',lambda:client.beta.agents.sessions.list(limit=10))]
+    for name, operation in ops:
+     row={'strict':strict,'operation':name}
+     try:
+      value=operation(); row['decodedClass']=type(value).__name__
+      body=value.model_dump(mode='json'); row['decodedFields']=sorted(body)
+      if name=='create':
+       sid=value.id; row['status']=value.status
+      if name=='list':row['count']=len(value.data)
+      if name=='retrieve':row['sameId']=value.id==sid
+     except Exception as exc:
+      row['errorClass']=type(exc).__name__
+      if isinstance(exc,openai.APIResponseValidationError):
+       row['statusCode']=exc.status_code
+       cause=exc.__cause__
+       if hasattr(cause,'errors'): row['validationErrors']=[{'loc':list(e['loc']),'type':e['type']} for e in cause.errors()]
+      else: row['message']=str(exc)
+     out['operations'].append(row)
+  with service.store.transaction() as tx:
+   out['acceptedTypedPrompt']=any(r.get('_prompt')=='typed local prompt' for r in tx.list('submission','local-probe'))
+   out['sessionCount']=len(tx.list('session','local-probe'))
+ finally:
+  server.shutdown();server.server_close();thread.join(timeout=3)
+print(json.dumps(out,indent=2))