Fail Agent runs cleanly after SDK auth recovery

[AnthonyRonning]

Summary

• Keep encrypted transport recovery owned by the OpenSecret SDK; Maple adds no second HTTP retry or token-refresh layer.
• Treat exhausted authentication, attestation, and secure-session failures as terminal Agent run failures.
• Treat provider 403 responses as ordinary request failures rather than authentication failures.
• Recognize only the exact versioned final session_not_found signal; malformed, duplicate, unknown, and legacy metadata remains generic.
• Stop terminal failures before Goose projects them as assistant messages, preventing error text from contaminating task history.

Published dependencies

• @opensecret/react 3.5.0
• opensecret 3.6.2
• maple-proxy 0.3.2

All three pins and lockfiles resolve published registry artifacts. No local dependency override is committed.

Backend contract: OpenSecretCloud/opensecret#287
SDK recovery: OpenSecretCloud/OpenSecret-SDK#108
Anonymous model discovery: OpenSecretCloud/OpenSecret-SDK#107
Proxy release: OpenSecretCloud/maple-proxy#56

Validation

• Frontend CI: formatting, linting, typechecking, and 739 tests passed
• Rust CI: 398 library tests passed, 2 ignored; 3 binary tests passed
• Rust formatting and strict Clippy passed
• PR-configured web build passed
• Exact workspace desktop at db4cee0 against local OpenSecret: Chat completed successfully; Agent completed before and after restarting OpenSecret to purge encrypted sessions
• Post-restart Agent result appeared in the same task as MAPLE_AGENT_AFTER_RESTART_OK with no authentication error or synthetic error row in history
• Earlier packaged source-equivalent smoke also covered Chat recovery after a server restart and combined expired-JWT plus purged-session recovery

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	db4cee0
Status:	✅  Deploy successful!
Preview URL:	https://6542b954.maple-ca8.pages.dev
Branch Preview URL:	https://codex-auth-recover-v2-maple.maple-ca8.pages.dev

View logs