[anycodes]

Description

Add five canonical application authentication vectors and verify the existing Python ServerClient behavior. CLI and Node consumers pin the same fixture. SDK runtime, public exports and configuration remain unchanged; there is no SDK configuration command.

Refs Alibaba-Agent-Sandbox/agent-sandbox#189. Consumers: Alibaba-Agent-Sandbox/agent-sandbox#190 and Alibaba-Agent-Sandbox/nodejs-sdk#21.

Type of Change

• Tests
• Documentation

Changes

• Keep test-only vectors under contracts/testing, separate from runtime package contracts.
• Cover anonymous/application authentication and preservation of case-insensitive gateway headers.
• Include English/Chinese configuration scope docs, changelog and indexed note/evidence.

Testing

• Application binding and new fixture tests: 52 passed
• Final standalone client full run: 2340 passed, 27 conditional skips
• Standalone server full run: 875 passed, 1 conditional skip
• Required pinned provider-engine scenario: 4 passed
• Real local HTTP/server E2E: 22 passed
• Real Express lifecycle/files/process/interpreter E2E: 1 passed, owned cleanup
• Lint, format, mypy, distributions and clean combined installation
• All 13 latest-head CI checks, including Python 3.10/3.11/3.12 client/server matrix and both Docker runtime fixtures

Checklist / Definition of Done

• Tests, actual component E2E and cleanup recorded without credentials
• Indexed seven-section note and dated evidence
• English/Chinese docs and CHANGELOG
• Repository health and hygiene

Evidence: .agents/evidence/verify/2026-10-26-application-auth-vectors.md preserves initial workspace/PTY failures and successful final reruns. No runtime behavior, package version or publication changes.