docs: select verified public a4 runtime for Node examples

.agents/README.md

@@ -6,7 +6,7 @@
 - Scope: application HTTP `ServerClient` and configuration-name exports. No cloud lifecycle, template build, provider engine, PTY or interpreter client is exported.
 - [Bound HTTP endpoint acceptance](evidence/verify/2026-10-23-bound-http-control-review.md) and [proxy-token acceptance](evidence/verify/2026-10-24-proxy-application-token.md) cover copied headers, preserved gateway URL/query, redirect refusal and no automatic credential retry.
 - The proxy record includes the actual OpenSandbox python-hello Node calls. The 92-case template matrix used CLI/Python/HTTP and does **not** establish a 92-case Node SDK test.
-- The [local runtime example](../examples/README.md) now installs the public Python server 0.4.0a3; its local health/process/file checks do not establish cloud lifecycle support.
+- The [local runtime example](../examples/README.md) now installs the public Python server 0.4.0a4; its local health/process/file checks do not establish cloud lifecycle support.
 
 [Documentation synchronization decision](notes/implemented/process/2026-10-24-current-docs-and-records.md) · [verification and acceptance reconciliation](evidence/verify/2026-10-24-current-docs-and-records.md).
 
@@ -53,4 +53,6 @@ state. A local/runtime result is not cloud acceptance or package publication.
 
 - [Example official PyPI index](notes/proposed/process/2026-10-25-example-official-index.md) · [verification](evidence/verify/2026-10-25-example-official-index.md).
 
-- [Current public server a3](notes/proposed/process/2026-10-25-current-public-server-a3.md) · [verification](evidence/verify/2026-10-25-current-public-server-a3.md).
+- [Current public server a3](notes/implemented/process/2026-10-25-current-public-server-a3.md) · [verification](evidence/verify/2026-10-25-current-public-server-a3.md).
+
+- [Public runtime a4](notes/proposed/process/2026-10-25-public-runtime-a4.md) · [verification](evidence/verify/2026-10-25-public-runtime-a4.md).

.agents/evidence/verify/2026-10-25-public-runtime-a4-local.json

@@ -0,0 +1,32 @@
+{
+  "base": "2308aec369c60e451be0cc9f9c34e245a93a3104",
+  "python_package_versions": {
+    "agent-sandbox-client": "0.4.0a4",
+    "agent-sandbox-server": "0.4.0a4"
+  },
+  "fresh_official_no_cache_install": true,
+  "no_pythonpath_source_injection": true,
+  "node_tests": {
+    "passed": 24,
+    "failed": 0,
+    "skipped": 0
+  },
+  "typecheck": "PASS",
+  "complete_config_schema": "equal",
+  "actual_example": {
+    "exit": 0,
+    "health": true,
+    "command_exit": 0,
+    "stdout": "4\n",
+    "file": "answer=4\n",
+    "server_exit": -15,
+    "observed_owned_processes": 1,
+    "independently_absent": 1
+  },
+  "pack_dry_run": "PASS",
+  "source_runtime_change": false,
+  "cloud_calls": 0,
+  "model_calls": 0,
+  "npm_publication": false,
+  "result": "PASS for local current documentation/runtime verification"
+}

.agents/evidence/verify/2026-10-25-public-runtime-a4.md

@@ -0,0 +1,40 @@
+# Public a4 runtime guidance verification
+
+Date: 2026-10-25
+Result: PARTIAL (public installation/local runtime PASS; latest-head CI/review/merge pending)
+
+Base: main 2308aec369c60e451be0cc9f9c34e245a93a3104. No Node implementation,
+export, dependency range or version change. Package remains source-only 0.1.0.
+The earlier a3 decision was accepted by PR18 and is moved to implemented; no
+merged evidence is rewritten.
+
+## Actual installation and checks
+
+Python 3.13.13 new virtual environment installed exact
+`agent-sandbox-client[all]==0.4.0a4` from official PyPI with `--no-cache-dir`;
+matching server installed automatically, imports resolved in that environment,
+and `pip check` passed. No repository PYTHONPATH was injected. Existing Node
+22.22.2/npm12.0.2 lockfile installation used `npm ci`.
+
+- `npm run typecheck`: PASS.
+- `npm test`: 24 PASS, zero fail/skip, including actual local Python runtime tests.
+- `node examples/agent-loop.mjs`: actual health true, shell stdout `4\n`, file
+  `answer=4\n`, and exact server exit -15 after SIGTERM. A read-only spawn
+  observer recorded the one explicit example server PID; a separate process
+  existence check confirmed it absent. Example source was unchanged.
+- Installed Python complete configuration-schema JSON equals src/config-keys.json.
+- `npm pack --dry-run`: PASS, ESM/type exports present. No upload.
+- `git diff --check` and record-link existence: PASS.
+
+[Structured local receipt](2026-10-25-public-runtime-a4-local.json).
+
+The Python publisher first failed after six metadata visibility checks over 50s,
+then completed its normal failed-job rerun successfully on the same tag. Original
+and rerun artifacts matched each other and public metadata/downloads. This record
+uses the independently installed public package after that successful recovery;
+it does not reinterpret the original failure as success. Producer:
+https://github.com/Alibaba-Agent-Sandbox/python-sdk/actions/runs/40215483508.
+
+No cloud resource or real model was used. This is not Node cloud lifecycle,
+all-template coverage or npm publication. Required Node20/22 checks and normal
+review/merge for this new source head remain pending.

.agents/notes/proposed/process/2026-10-25-current-public-server-a3.md → .agents/notes/implemented/process/2026-10-25-current-public-server-a3.md

@@ -1,6 +1,6 @@
 # Decision: Select the verified public a3 server for the local example
 
-Status: proposed
+Status: implemented
 
 ## Problem
 
@@ -40,3 +40,5 @@ Required latest-head CI and independent review precede verified normal merge.
 No cloud or npm publication claim is made.
 
 [Verification](../../../evidence/verify/2026-10-25-current-public-server-a3.md).
+
+Accepted by https://github.com/Alibaba-Agent-Sandbox/nodejs-sdk/pull/18 at 2308aec369c60e451be0cc9f9c34e245a93a3104. Previous verification receipts retain their a3 scope.

.agents/notes/proposed/process/2026-10-25-public-runtime-a4.md

@@ -0,0 +1,48 @@
+# Decision: Use the corrected public Python a4 help contract
+
+Status: proposed
+
+## Problem
+
+Python a3 help still documents retired provider arguments. A lockstep a4 patch
+corrects help without changing executable provider behavior. Maintained Node
+example installation and schema comparison should use the resulting public pair.
+
+## Decision
+
+Prepare the existing server installation and CI schema source for exact a4.
+Promote this guidance only after official publication and independent fresh
+installation, existing Node tests and actual local HTTP/process/file verification.
+Keep previous a3 receipts unchanged.
+
+## API Design
+
+No Node runtime, exported interface or package-version change. The SDK remains
+a source package at 0.1.0; no npm publication is implied.
+
+## Alternatives considered
+
+Adding aliases, a new installer or cloud lifecycle API is unrelated. Rewriting
+prior installation evidence would incorrectly change its tested version.
+
+## Dependencies
+
+https://github.com/Alibaba-Agent-Sandbox/python-sdk/pull/125
+
+https://github.com/Alibaba-Agent-Sandbox/python-sdk/releases/tag/v0.4.0a4
+
+## Test Strategy
+
+After actual public a4 readback, run lockfile installation, typecheck, all 24
+existing tests, the documented local example, package dry-run and complete schema
+comparison against installed Python. Verify the owned server exits. Wait for
+latest-head Node20/22 CI and independent review before normal merge.
+
+## Acceptance criteria
+
+Public a4 installation, complete schema and local runtime checks pass; required
+CI/review and normal merge pass. No cloud or npm publication claim.
+
+## Evidence
+
+[Verification](../../../evidence/verify/2026-10-25-public-runtime-a4.md).

.github/workflows/ci.yml

@@ -22,13 +22,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: Alibaba-Agent-Sandbox/python-sdk
-          ref: v0.4.0a3
+          ref: v0.4.0a4
           path: vendor/python-sdk
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - run: python -m pip install --index-url https://pypi.org/simple "agent-sandbox-server==0.4.0a3"
+      - run: python -m pip install --index-url https://pypi.org/simple "agent-sandbox-server==0.4.0a4"
       - run: python -c "import agent_sandbox.server"
       - name: Compare the complete Python and Node configuration schema
         run: |

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Documentation
 
+- Select the verified public Python a4 runtime and matching configuration-source tag; preserve prior a3 verification as history. / 本地示例与配置对照统一公开 Python a4，保留原 a3 验证记录。
+
 - Select verified public Python server 0.4.0a3 in the local example and CI, with its matching configuration-schema release tag.
 
 - Use the official PyPI index for the local example's exact public server 0.4.0a2 installation, matching CI.

examples/README.md

@@ -40,7 +40,7 @@ The current example uses an installed Python runtime and preserves caller
 `PYTHONPATH`; it adds no fixed repository paths. Install the server before running:
 
 ```bash
-python3 -m pip install --index-url https://pypi.org/simple 'agent-sandbox-server==0.4.0a3'
+python3 -m pip install --index-url https://pypi.org/simple 'agent-sandbox-server==0.4.0a4'
 npm ci
 npm test
 node examples/agent-loop.mjs
@@ -53,6 +53,6 @@ node examples/agent-loop.mjs
 
 ## Fresh published-runtime verification — 2026-10-25
 
-A fresh Python 3.13 environment (no repository source injection) with public `agent-sandbox-server==0.4.0a3`, followed by the documented `npm ci`, `npm run build` and `node examples/agent-loop.mjs`, passed. The shell returned `4\n`, the downloaded file matched `answer=4\n`, and the owned server process exited after SIGTERM. `npm run typecheck` and all 24 Node tests passed. No cloud resource or model API was used.
+A fresh Python 3.13 environment (no repository source injection) with public `agent-sandbox-server==0.4.0a4`, followed by the documented `npm ci`, `npm run build` and `node examples/agent-loop.mjs`, passed. The shell returned `4\n`, the downloaded file matched `answer=4\n`, and the owned server process exited after SIGTERM. `npm run typecheck` and all 24 Node tests passed. No cloud resource or model API was used.
 
-2026-10-25 已从全新环境安装公开 Python 服务端 0.4.0a3，再按上述命令构建和运行示例。命令输出、文件内容和服务进程清理均通过；类型检查及 24 个测试通过。本次是实际本地 HTTP 运行，不代表云端或模型调用测试。
+2026-10-25 已从全新环境安装公开 Python 服务端 0.4.0a4，再按上述命令构建和运行示例。命令输出、文件内容和服务进程清理均通过；类型检查及 24 个测试通过。本次是实际本地 HTTP 运行，不代表云端或模型调用测试。