fix(agent-definitions): enforce provider-compatible authority

[adrianwebb]

Outcome

Prevent structurally valid but stale agent definitions from failing only during capacity-provider admission, and establish one PR submission record for human and agent work.

Work authority

• Work item / Issue: Platform SDK-first cutover Gate 0; tracked by docs: record SDK standards cutover and agent boundary platform#10
• Proposal / decision: Approved SDK-first standards, GitHub, and cluster cutover plan
• Assignment / checkpoint: Agent-definition compatibility canary; current draft review checkpoint
• Actor: Codex task /root
• Human authority: @adrianwebb
• Agent / capacity provider: Codex Desktop / local Codex capacity provider
• Exact base ref: staging at 6e1a7345e6ec1c75d8020ce4c08c68bea7ad99e7
• Exact head ref: codex/agent-definition-compatibility at b6f07113536d8420f0ac6c0e1c445dc38947062c

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

1. Normalize the package-owned agent definitions against the shipped SDK schema.
2. Evaluate effective authority against representative local and remote capacity providers.
3. Add package-owned regression coverage and publish the evidence for independent review.
4. Keep the PR draft until hosted checks, independent review, and human checkpoints complete.

Current status: the accepted SDK staging identity is adopted; local and hosted verification are green and independent review found no remaining findings.

Changes and commits

• Aligned every shipped Agent package definition with the current SDK authority and capacity-provider contract.
• Pinned the exact SDK compatibility evaluator commit and added a package-owned regression check.
• Added the default durable PR template for human and agent submissions.

The branch commit history is the authoritative commit record; the exact current head is recorded above. The declared SDK dependency and lock both resolve accepted staging 92a66135fbda5575bee058b0ab25339c6c7d6398.

Verification

• Shared audit: 32 definitions passing, 0 findings.
• Full npm ci passed.
• Package-owned Vitest compatibility check passed without the unrelated shared-fixture setup.

Risk and rollback

The primary risk is rejecting a previously tolerated stale definition. Roll back by reverting the bounded compatibility/template commits on this branch; do not weaken provider admission or schema validation to restore a stale definition.

Completion summary

The package consumes accepted SDK staging 92a66135…, explicitly runs its internal compatibility evaluator, and carries the corrected exact-SHA PR contract. Exact-head hosted evidence and independent review are complete; the PR is ready for staging integration.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.