A Strands-based finance research agent that calls paid Heurist x402 endpoints
for real-time prices, SEC filings, and macro indicators. The
AgentCorePaymentsPlugin intercepts HTTP 402 responses, asks the AgentCore
payment manager to generate a payment proof against the configured payment
instrument and payment session, and retries automatically — tool code stays
an ordinary http_request call. Data is analyzed in AgentCore Code Interpreter
and exported as charts and reports.

Highlights:
- HTTP 402 payment processing via AgentCorePaymentsPlugin — no manual
  payment code in tools
- Embedded wallet (Coinbase CDP) with USDC as the settlement asset
- AgentCore Code Interpreter for pandas/matplotlib analysis and artifact
  export
- Public PyPI dependencies only (bedrock-agentcore==1.9.0) — no bundled or
  file-based SDK components
- Targets x402 on Base mainnet (Heurist endpoints settle on Base)

Adds:
- 01-tutorials/13-AgentCore-payments/02-use-cases/pay-for-data/
  - pay-for-data.ipynb (notebook walkthrough)
  - heurist_finance_agent/ (agent, catalog, config, artifact_export)
  - scripts/ (sync_registry, run CLI entry points)
  - requirements.txt, .env.example, README.md, .gitignore

Updates:
- 01-tutorials/13-AgentCore-payments/README.md: add Use Cases table entry
- 01-tutorials/13-AgentCore-payments/02-use-cases/README.md: add use case
  overview and highlights

1. Fix requirements.txt: bedrock-agentcore[strands-agents]==1.9.0 (extras
   install required for AgentCorePaymentsPlugin)
2. Change default prompt to non-crypto macroeconomic query (FredMacroAgent
   GDP/unemployment summary) in run.py and README
3. Remove 'no bundled/file-based SDK' line from README, 02-use-cases/README,
   and tutorial-level README table entry
4. Expand notebook: add architecture diagram (ASCII), AgentCore payments
   capabilities table (payment manager, instrument, session, processing,
   limits), step-by-step payment flow explanation, and restructure into
   numbered steps
5. Add cleanup section (local cache + artifacts) and shared responsibility
   model table to notebook

- agent.py: remove redundant 'No manual payment logic is needed' from docstring
- artifact_export.py: replace multi-strategy JSON fallback parser with a
  single json.loads — the Code Interpreter runs our own script that always
  emits print(json.dumps(payload)), so the output is deterministic JSON
- catalog.py: warn (via logging.warning) when a requested agent ID is not
  found in the live catalog, so renames or removals surface immediately
  rather than silently loading zero tools
- requirements.txt: pin strands-agents==1.36.0, strands-agents-tools==0.5.0,
  boto3==1.43.1, botocore==1.43.3 to match PR awslabs#1459 versions; keep
  bedrock-agentcore[strands-agents]==1.9.0 (newer than awslabs#1459)
- catalog.py line 199 (f-string suggestion): left as-is — the lines.append
  + join pattern is idiomatic for multi-line table construction and already
  uses f-strings inside the loop

Deploy the Heurist finance agent to AgentCore Runtime with full feature
parity: AgentCore Code Interpreter, S3 artifact storage, and automatic
observability via CloudWatch GenAI Observability.

## What's new

### runtime_agent.py (new)
AgentCore Runtime entry point using BedrockAgentCoreApp. Key design:

- Stateless, payload-driven: all payment config (manager ARN, session ID,
  instrument ID) comes from the invocation payload. The container holds no
  credentials. The app backend (ManagementRole) creates payment sessions with
  spending limits; the execution role (ProcessPaymentRole) can only spend
  within those limits.

- AgentCore Code Interpreter: AgentCoreCodeInterpreter is a remote AWS API
  and works identically from a Runtime container. pandas/matplotlib analysis
  and chart generation are fully supported.

- S3 artifact storage: two @tool functions replace local disk writes —
  export_artifact_to_s3 (binary files from CI sandbox) and save_report_to_s3
  (text/CSV/markdown). Both upload to S3 and return presigned URLs in the
  invocation response:
    {"response": "...", "artifacts": [{"name": "chart.png", "url": "...", "expires_in": 3600}]}
  If CI_ARTIFACTS_BUCKET is not set the agent degrades gracefully: charts
  become markdown tables, text returns inline.

- Thread-local state (threading.local) for per-invocation CI session name
  and artifact list — correct for concurrent Runtime requests.

- Observability: agentcore deploy configures the container to run under
  opentelemetry-instrument, automatically emitting OTel traces and logs to
  CloudWatch GenAI Observability. No instrumentation code required.

### pay-for-data.ipynb (rewritten)
Runtime-only, 8-step notebook:
  1. Configure credentials
  2. Sync Heurist catalog (bundled in container image at build time)
  3. Create private S3 artifacts bucket
  4. Install agentcore CLI, scaffold project, copy files, deploy
  5. Add IAM permissions to execution role (payment + CI + S3)
  6. Invoke deployed agent, inspect response + session spend
  7. View CloudWatch GenAI Observability dashboard
  8. Cleanup (Runtime stack + S3 bucket)

### README.md (rewritten)
Runtime-only documentation:
- Architecture diagram reflects the deployed topology
- Quick Start maps to the 8-step notebook
- Runtime agent section covers: stateless design, Code Interpreter, S3
  artifact response shape, graceful degradation, IAM permissions table
- Prerequisites updated (Node.js 20+, Docker, CDK)

## IAM permissions added to execution role

  PaymentDataPlaneAccess:
    bedrock-agentcore: ProcessPayment, GetPaymentInstrument,
      GetPaymentInstrumentBalance, GetPaymentSession, GetResourcePaymentToken
    Resource: payment-manager/*

  CodeInterpreterAccess:
    bedrock-agentcore: StartCodeInterpreterSession,
      StopCodeInterpreterSession, InvokeCodeInterpreter
    Resource: code-interpreter/*

  S3ArtifactsAccess:
    s3: PutObject, GetObject
    Resource: <bucket>/heurist-finance-artifacts/*

The execution role does not receive CreateSession, CreateInstrument, or
any control-plane payment permissions.

…orial path