feat(bb-agent): run the streaming loop on AgentCore Runtime (keep Realtime)

[pjkroker]

Stacked PR 3 of 3 — the migration. Base: agentcore-rt/2-realtime-grant (#367), which stacks on #366.

Problem

The Agent BB ran its Strands loop inside an AsyncJob (SQS → Lambda), capped by Lambda's 15-min per-invocation limit — long / multi-step agents weren't achievable.

What

Move the loop to a Bedrock AgentCore Runtime (sessions up to 8h) while keeping the Realtime BB as the streaming transport — chunks reach the browser over Realtime exactly as before (per doc 104 §3.2; not AgentCore /ws). stream() / resume() call InvokeAgentRuntime, which starts the turn as a background async task (addAsyncTask → /ping HealthyBusy) and returns immediately, so the microVM keeps running while the loop publishes chunks to Realtime. Locally the loop still runs in-process against the mock Realtime.

• No client-facing API change — stream/resume/getChannel, the chunks channel, and the useChat subscribe contract are unchanged. (The createChat client redesign — doc 106 — is a separate follow-up.)
• New runtime config flag ('agentcore', the default) records the runtime as an explicit seam.
• AgentCore provisioning is self-contained in AgentCoreRuntime (synth-time co-bundle of the app backend + serve() harness, Runtime via fromCodeAsset, Node 22 CodeZip) so it can later become an AgentCoreCompute.
• The loop runs as the shared BlocksRole (needs feat(core): expose backendModulePath; trust bedrock-agentcore on the shared role #366 + feat(bb-realtime): add Realtime.grantPublish() for external publishers #367), so it inherits every Building Block's grants — including other BBs an agent's tools touch (KVStore, tables). Only Bedrock + Realtime-publish + InvokeAgentRuntime are added, once per stack (guarded, so N agents don't duplicate grants).
• Removes the internal AsyncJob (+ the @aws-blocks/bb-async-job dependency); bumps @strands-agents/sdk to ^1.7.0; adds bedrock-agentcore + @aws-sdk/client-bedrock-agentcore.

Validation

build + bb-agent tests (78 unit + 3 CDK synth incl. multi-agent grant-dedup) + conditional-export parity + lint:deps pass. Validated on a real AWS sandbox (us-west-2): all 7 AgentCore runtimes deploy; the full Agent BB e2e suite passes — including tool-uses-another-BB and per-call-context (which failed with AccessDenied before the shared-role design), long-running >29s, and HITL interrupt/resume. API.md + DESIGN.md updated. Changeset (minor).

Deployment note: changes the deployed infra shape (adds an AgentCore Runtime, removes the agent's SQS queue).

Draft for review. Depends on #367 → #366; merge bottom-up.

[changeset-bot]

🦋 Changeset detected

Latest commit: 6c5d0c3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@aws-blocks/bb-agent	Minor
@aws-blocks/blocks	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR