[timeleft--]

Moves Ansari from the committed SAGA candidate tarballs to the published 1.0.0-rc.1 (npm next). This is the step #12 left for publication.

Change

• @saga-a2ui/react-mcp-stack is pinned to 1.0.0-rc.1, resolved with its four siblings from the public registry.
• apps/mcp/candidates/, the five SAGA overrides in the root pnpm-workspace.yaml and the Dockerfile copy step are removed. The SDK's documented dompurify and @hono/node-server overrides stay.
• The packaging test is registry-only again. It checks the lockfile against integrity values read from npm (npm view @saga-a2ui/<name>@1.0.0-rc.1 dist.integrity), and the lockfile records exactly those values. The candidate-only paths in the test and in scripts/sdk-identity.mjs are deleted.
• The card's SDK identity is registry / 1.0.0-rc.1.
• The README and walkthrough describe the registry install. App version is 0.17.1.

The card stays at ui://views/answer-card.v1.html.

Verification

• pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp... succeeds.
• pnpm mcp verify passes: lint, typecheck, 145 tests and 78 browser checks.
• bash apps/mcp/scripts/verify-container.sh passes; the root-context Docker build serves ui://views/answer-card.v1.html.
• pnpm check:release --target beta passes, verifying all five packages against the npm registry. --target production refuses the prerelease, so Production waits for the stable SAGA release.

🤖 Generated with Claude Code

[yia-mw-agent]

Reviewed the full merge-base-to-head diff (merge-base c6c6938 = develop tip, 14 files) at 07f7616. No material defects.

Verified:

• The five SAGA integrity values in pnpm-lock.yaml and apps/mcp/test/packaging.test.ts match npm view @saga-a2ui/<name>@1.0.0-rc.1 dist.integrity for core, components, mcp, react and react-mcp-stack.
• The file: overrides, apps/mcp/candidates/ tarballs and the Dockerfile COPY step are fully removed. The lockfile has no remaining file:/tarball SAGA entries. The dompurify, @hono/node-server and @a2ui/markdown-it overrides are kept.
• pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp... succeeds.
• ansari-mcp lint and typecheck pass.
• pnpm --filter ansari-mcp test (build, worker build, unit and packaging tests) passes.
• Browser checks: 78 checks, 0 errors.
• check:release --target beta passes, with all five packages verified against the registry. --target production correctly refuses the prerelease, as the description states.
• Version bump to 0.17.1 is consistent across package.json and version.ts, and the walkthrough text matches. The walkthrough SOURCE_BASE commit 0536407 is an ancestor of the head.

Non-blocking: apps/mcp/scripts/check-release.mjs still carries candidate/candidates/ tolerance logic and Dev messaging. It is harmless, since the repository commits no candidates, but it could be trimmed in a follow-up.

Helmet-Review-Request: #14 (comment)