[gibbsie]

fix(intake): report build status from the live registry record instead of a fabrication-time snapshot

Problem

check_fabrication_status derived its "built and approved" / "awaiting approval" text from registryApprovalStatus on the DynamoDB job row — a write-once snapshot stamped at fabrication time. After a human approved (or rejected) the agent on the Approvals page, or when the agent was never submitted for approval (DRAFT), the status text was wrong: a freshly-approved agent still said "awaiting approval", and a DRAFT agent showed as "built and approved".

The initial live-registry fix used ListRegistryRecords(name=agentName) on the bedrock-agentcore-control client, but the live service rejected the top-level name kwarg: 'Unknown parameter in input: name, must be one of: registryId, maxResults, nextToken, filters'.

Root cause

Two botocore service models for the same registry API:

• bedrock-agentcore-control (older) — exposes name as a query-string parameter
• agent-registry-control (newer) — exposes filters (the shape the live service accepts)

The service was using the older model; the fabricator already used the newer one.

Fix

1. Switch _get_registry_client() in postfab.py from bedrock-agentcore-control to agent-registry-control (matching arbiter/fabricator/index.py)
2. Use filters=[{name:'recordType',values:['CUSTOM']},{name:'name',values:[agent_name]}] exactly as _find_existing_record_id does (the fabricator's source of truth)

Registry status	User-facing text
DRAFT	"built, not yet submitted for approval"
PENDING_APPROVAL	"awaiting approval on the Approvals page"
APPROVED	"built and approved"
REJECTED	"built, but the approval was rejected"
DEPRECATED	"built, but has been deprecated"

Registry reads are sequential and bounded to 5 agents per call. Fallback to job row snapshot when registry is unreachable.

Live verification

_resolve_registry_status('arbiter-agent', 'Default')
  -> registry 7wjYVSCFgfe63ATN (us-west-2)
  -> LIVE STATUS: DRAFT

Files changed

• service/agent_intake_single/tools/postfab.py — switched to agent-registry-control client, use filters instead of top-level name
• service/agent_intake_single/tests/test_postfab_live_registry.py — updated Stubber + response fixtures to agent-registry-control model; added TestParamValidatorRejectsTopLevelName (validates built kwargs against real botocore model, proves old shape rejected / new shape accepted)

Testing

• 19 tests in test_postfab_live_registry.py — all pass (including 2 new ParamValidator tests)
• pytest service/ -v --tb=short — 466 passed, 0 failed

Deployment

Services stack container rebuild required (Python source changed in service/agent_intake_single/).