Bump agentseam to 0.3.1 and regenerate the vendored runtimes

[jothimani-rajendran]

What

Bump chock's agentseam pin from 0.3.0 to 0.3.1 and regenerate everything derived from it.

Base note: this started from claude/epic-gauss-l6f2i4 (the head of #149), which merged into main shortly before this branch was pushed. main's tip (ff43d1e) is the merge of #149 with no other commits since, so origin/main is merged into this branch and the PR is based on main.

Why each file changed

• pyproject.toml, requirements/brand-assets.in / .txt: the agentseam==0.3.0 pin → 0.3.1 everywhere it's pinned (the hash-pinned brand-assets.txt regenerated with pip-compile --generate-hashes; both new sha256 hashes verified against PyPI's published digests for the 0.3.1 sdist/wheel). No other pin of agentseam==0.3.0 exists in the repo outside historical CHANGELOG prose, which is left alone.
• tests/fixtures/runtime_goldens/*.py and .chock/bin/*.py (10 vendors each): regenerated via CHOCK_REGEN_GOLDENS=1 pytest tests/test_runtime_goldens.py and chock sync --repo .. The diff is what 0.3.1's CHANGELOG explains: agentseam's own dispatch-equivalent now refuses a handler that raises, in the vendor's own dialect, instead of letting the exception escape — every vendored runtime's main() gains a _decide()/_report() wrapper that catches a raising handler and answers deny with the exception class named (never its message, which may quote policy-inspected content). dump() also now writes LF on every platform, but nothing chock imports (bundler, contract, matrix, adapters, packaging, instructions, matrix_terms) calls it, so it has no effect on this repo's output.
• gate/runtime_bundle.py's dispatch.py.tmpl handle() (chock's own try/except around _judge(), deny-on-exception) is now redundant with agentseam's new inner catch for every vendored runtime this repo emits — chock's handler never lets an exception past _judge() in the first place. Kept as-is for this release as defense in depth rather than removed in the same cycle as the version bump, per plan.
• CHANGELOG.md: one bullet under ## 0.9.1 describing the bump, what changed in the vendored runtimes and why, and that every adopter's next chock sync rewrites .chock/bin/*.py.
• src/chock/scaffold/recompile.py + tests/test_sync_wires_only_supported_agents.py, .chock/bin/antigravity.py (added in a follow-up commit): antigravity isn't in this repo's supported_agents, so chock sync's hook-wiring never called vendor_runtime() for it — the committed file just sat there unrewritten, and drifted the moment 0.3.1 changed the bundler output for it (chock sync --repo . --check and chock check --only verify both flagged it, since they check any .chock/bin/<vendor>.py found on disk regardless of supported_agents). Root-caused and fixed rather than deferred: recompile() now prunes a vendor's runtime the instant it falls out of the configured agent list, the same cleanup already applied to that vendor's other hook fragments — so a dropped vendor's runtime is deleted, not left to rot. .chock/bin/antigravity.py is removed as the first beneficiary. New test: test_a_vendor_dropped_from_supported_agents_has_its_runtime_pruned.

Not touched: .claude/settings.json, .codex/hooks.json, .devin/hooks.v1.json, .gemini/settings.json, .tabnine/agent/settings.json — chock sync re-bakes the running interpreter's absolute path (sys.executable) into these on every environment, which would have shown as pure noise from this sandbox; reverted both times since no check in the gate compares their content and they carry no agentseam-derived bytes.

Verification

python -m ruff check .                       All checks passed!
python -m ruff format --check .              286 files already formatted
python -m pytest -q                          1386 passed, 2 skipped
python -m pytest -q acceptance/              21 passed
chock check --repo .                         28 policies: 99 pass, 0 fail; matrix/mechanisms/index/conflicts all PASS
chock sync --repo . --check                  Compiled artifacts match their manifests.
chock check --only verify                    verify: all packs match lockfile
chock plugin build --check (5 built policies) Plugin output matches manifests (5 policies, format: agent-plugins)

chock.lock is unchanged: it hashes .agents/policies/* pack contents and .chock/compiled/<policy> trees, neither of which this bump touches; vendored-runtime freshness is checked live at verify time, not via a stored hash.

chock plugin build --check run only against the 5 policies that already have packaged output (18 of 24 policies have no plugin.json yet in this repo — pre-existing, unrelated to this bump); those 5 are unaffected by the agentseam bump.

CI note

The CI workflow never ran on this PR's first two commits: its pull_request trigger only fires on GitHub's default types (opened/synchronize/reopened) when the base matches [main, master, develop], and this PR's base changed to main via the API rather than a push, so no matching event ever fired (see the PR comment history). This commit's push is a genuine synchronize with base already main, so CI should now run for real.

Not in this PR

The v0.9.1 tag.

🤖 Generated with Claude Code

[jothimani-rajendran]

Heads up: the CI workflow (.github/workflows/ci.yml) has never run against this PR's head (c79a73c). ci.yml's pull_request trigger uses GitHub's default event types (opened, synchronize, reopened) with branches: [main, master, develop]; this PR was opened against claude/epic-gauss-l6f2i4 (matching #149's still-open head at the time) and only retargeted to main via the API afterward, and ready_for_review isn't one of the default types either — so no event ever fired that both matched the branch filter and was a type this workflow listens for. Security checks and Quick start ran fine (their triggers matched), but CI's dco/template-lint/test jobs are simply missing, not failing.

update_pull_request_branch confirms there's nothing to merge from main (this branch already contains its tip), so I can't trigger a genuine synchronize that way, and I'm not pushing an empty commit or closing/reopening to force it per the drive-to-green rules I'm operating under. The fix is a real synchronize event on this branch while its base is main — the simplest is a maintainer push (even routine) to this branch, or closing and reopening the PR if you're fine with that from your side. Let me know if you'd like me to add a real, in-scope commit instead (e.g. the antigravity drift-detection follow-up mentioned in the PR body) to naturally trigger it.

---

Generated by Claude Code

[jothimani-rajendran]

Pushed a real fix for the antigravity gap noted above (02dd00e): recompile() now prunes a vendor's .chock/bin/<vendor>.py the moment it drops out of supported_agents, instead of leaving it to rot; .chock/bin/antigravity.py is removed here as the first beneficiary, with a regression test. This also gave the branch a genuine synchronize event with base already main, so CI (run 35546509809) is now running for the first time on this PR.

---

Generated by Claude Code