chore(deps): materialize 0.13.1 + sandbox 0.19.4 — the cohort's last two stale pins

[drewstone]

The two publishes that unblock the last red jobs on main landed (ADC develop's own version train shipped both; my duplicate convergence PR there was closed unmerged):

• materialize 0.13.1 — interface peer widened to the 0.46 line → fixes official-optimizers' ERESOLVE, which was failing on that single pin.
• sandbox 0.19.4 — exact agent-core/agent-interface pins moved to 0.5.4/0.46.1 → fixes the ci packed-exports refusal (found 2 installed path(s) — 0.5.2 at sandbox/node_modules).

Local proof on this branch: typecheck, lint, build clean; 2397/0 tests; check:testing-fixture current. The packed-cohort script passed locally on this catalog family earlier tonight (#749); its re-run here died to a local corepack/pnpm TTY quirk in the script's temp-dir install, not a cohort fact — this PR's CI run of the identical script on a clean runner is the decisive check, and I'm holding merge for it.

With this, all four jobs on main should be green for the first time, and the runtime release that discovery-lab is waiting on (to drop its vendor/ tarball for #741/#747) can cut.

[tangletools]

✅ Auto-approved drewstone PR — c642c4f0

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-10T01:55:02Z}

[tangletools]

⚪ Value Audit — audit-incomplete

Verdict	audit-incomplete
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	90.0s (2 bridge agents)
Total	90.0s

💰 Value — error

value agent produced no parseable value-audit JSON.

• Model: opencode/deepseek/deepseek-v4-pro
• Bridge attempts: 3
• Bridge error: opencode/kimi-for-coding/k2p7: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":"queue_timeout","admission":{"active":20,"queued":7,"maxActive":20,"maxQueue":48}}}; opencode/zai-coding-plan/glm-5.2: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":

🎯 Usefulness — error

usefulness agent produced no parseable value-audit JSON.

• Model: opencode/deepseek/deepseek-v4-pro
• Bridge attempts: 3
• Bridge error: opencode/zai-coding-plan/glm-5.2: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":"queue_timeout","admission":{"active":20,"queued":6,"maxActive":20,"maxQueue":48}}}; opencode/kimi-for-coding/k2p7: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":

No PR concerns were produced because the value/usefulness agent pass did not complete. Treat this audit as incomplete, not as approval.

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260810T020212Z}

[drewstone]

This PR is now the 0.131.0 release: version + CHANGELOG (root package and bench), cohort bumps, and the version-bump gate passing locally: 2 consumer-visible change(s), paid for by 0.130.0 -> 0.131.0.

Full local chain on this exact content: typecheck, lint, build clean; 2397/0 tests; check:testing-fixture current; check:version-bump green. The last full CI run on this branch (c642c4f) had packed-cohort, official-optimizers, and agent-bench all green — the only red was this version gate, and the delta since is release metadata only. GitHub Actions stopped delivering PR runs for the last three pushes (no run objects created for 713a95f/014b4f3c/HEAD — an Actions-side stall, ci.yml is active and unchanged), so merging on the local chain per standing practice; the push-to-main run and the tag publish will re-verify everything on clean runners.

[drewstone]

Superseded: #754 landed the full 0.131.0 release on main in parallel — same cohort bumps (materialize 0.13.1, sandbox 0.19.4), version + CHANGELOG, and a deeper fix binding candidate system-prompt controls through the native harness plan (including opencode's generated primary agent, which my branch had left as a fail-closed refusal). Nothing here is missing from main. Remaining step is tag + publish.