New WSL clean install plan (NativeHorizonNY) and the host Claude config reconciliation - #1174

Scope

• What this PR changes, in one or two sentences: Two decision records. The first is the clean install plan for the next WSL distribution, NativeHorizonNY. It decides the base by evidence, binds every stage to the repository's recipe, install plan and client-config tool, lists every catalog layer with its bounded next action, and states the host isolation rules, the north-star trading target with its gates, the runtime workers and harness rows (stage H with its role-assignment matrix), GitHub access (stage G), horizon as the private home of the runtime ecosystem as code (Decision 1's recorded supersession), the owner acts, and a five-condition boundary for moving command-center authority. The second reconciles the live Claude Code user configuration of NativeStack2604 against the clean render, names only, row by row.
• Base commit: 8053f14e7
• Lane: lane:foundation
• Owned paths touched:
  • docs/decisions/2026-10-15-new-wsl-clean-install-plan.md (new);
  • docs/decisions/2026-10-15-claude-host-config-reconciliation.md (new).

No code, template, manifest or evidence file changes. Stages R and A ran on 2026-10-15, and interim stage C ran and is stopped; the plan's "Verification boundary" names their receipts (private, by name).

SOTA sources

• Layer-resolution protocol, docs/decisions/2026-10-11-layer-resolution-protocol.md at 8053f14e7, Decision steps 1-3 and "Terminal states and evidence".
• The repository's new-WSL route at 8053f14e7:
  • adoption/platforms/linux-wsl2-new-distro.md: R1, P1-P3, W1-W7, F1-F11, host-wide rules, "WSL 2 distributions share one network namespace", F3's owed-then-return rule (:954-961) and the recovery order (:705-710);
  • adoption/platforms/linux-wsl2.md, "Listeners and ports";
  • evidence/artifacts/new-wsl-install-plan-20261002/ (README, check_plan.py, install.sh start sites :380, :467, :725, :739, :830, :852, :930, :951);
  • tools/adoption/new_wsl_client_config.py; tools/adoption/apply_codex_lane.py:524 (codex app-server --listen stdio://);
  • adoption/templates/wsl/cloud-init.user-data.template:27-28.
• Claude Code native practice: .claude/skills/claude-native-practice/reference/slots.md (client 2.1.295, checked 2026-10-09), slots instruction-files and orchestration-frameworks; Practice skill currency: client 2.1.295 to 2.1.300, a source-cited delta of the slots the releases touch #1171 for 2.1.300.
• anthropics/claude-code CHANGELOG.md at 94506ff0; npm dist-tags for @anthropic-ai/claude-code on 2026-10-15: latest 2.1.300, next 2.1.301, stable 2.1.292 at drafting; latest and next 2.1.301 at 20:00:47Z. Installed clients on 2026-10-15: claude --version 2.1.301 on NativeStack2604, 2.1.300 on NativeHorizonNY; claude plugin install|enable|disable --scope user|project|local (2.1.301 help); codex plugin add (codex-cli 0.162.1 help).
• openai/skills README.md:1-2 at 49f948faa9258a0c61caceaf225e179651397431: the repository is deprecated in favor of openai/plugins.
• rtk-ai/rtk at e001f773f80b22b7dc4c7a79521b30e35aaef026 (v0.51.0), src/core/config.rs:298-313: RTK_SUPPRESS_HOOK_WARNING overrides the missing-hook warning.
• The install plan's dispatch at 8053f14e7: install.sh:42, :1155, :1183-1186, :1249-1250 and :844-852 (the engine path reached through Harbor and Docker Compose); config/omniroute.service:22-23 and config/otel.yaml:9, :464 (the extra listeners); README.md:41 and :553-554.
• typesafe-ai/typesafe-sdk-python at v0.7.2 (f078f1e208a0d885154dc758344ae4fce77ac168), as docs/decisions/2026-10-05-typesafe-sdk-transport.md:9-11 pins it.
• The install plan's checks at 8053f14e7: accept.sh:630, :1038, :1091-1110, :2087, :2438, :2446-2474; tools/research/gpt_researcher.sh:31; tools/adoption/runtime_profiles.py:44; tools/adoption/new_wsl_client_config.py:533.
• typesafe-ai/skills at 65a39f393687675ce170e6094757de20370365b9 (tag v0.5.7), skills/typesafe-ai/SKILL.md:19-23: Jev is TypeSafe's first System One model.
• MinerU 4.0.10, the installed client on both distributions: mineru server status --json (socket_path ~/.mineru/doclib.sock, tcp.enabled false).
• microsoft/WSL:
  • 3.0.1 release: distribution cgroup isolation (PR #40519) and namespaces (PR #41512);
  • PR #40621 (binfmt status mounted read-only);
  • tag 3.0.1, src/linux/init/timezone.cpp:22-110;
  • Basic commands for WSL.
• systemd at v259: man/systemd.resource-control.xml (CPUQuota=, MemoryMax=), man/systemd-run.xml (--user --scope) and man/systemctl.xml (set-property --runtime). Linux at v6.18: Documentation/admin-guide/cgroup-v2.rst (cpu.max, cpu.idle, memory.max, PSI).
• obra/superpowers README.md at v7.0.0, "Installation", and release v7.0.0: published 2026-10-10T00:28:58Z by the GitHub releases API; RELEASE-NOTES.md:3 at the tag dates it 2026-10-09.

Evidence-class table

Local commands run

At the final head 3e1ea6749, each in an idle-class scope:

$ python3 scripts/validate.py
{"components": 71, "hashed_files": 12139, "profiles": 4, "receipts": 240, "status": "passed"}   exit 0
$ python3 scripts/validate.py --scan-file <plan> --scan-file <reconciliation> --scan-file <this body>
{"matching_locations": 0, "scanned_files": 3, "source": "host", "status": "passed"}   exit 0
$ python3 tools/adoption/new_wsl_client_config.py --check
check passed (with the MCP_AUTO_OPEN_ENABLED warning)   exit 0
$ python3 scripts/new_host_grand_list.py --check
{"status": "passed", "layers": 32, "winners": 66}   exit 0
$ python3 scripts/final_stack.py --check
exit 0 (report-only flags)
$ python3 -B evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
OK: 84 rows: 63 installed (60 by the default run, 3 only when named), 2 measurement-only, 19 not installed; 193 commands and 113 acceptance entries agree with the scripts (2 additional checks included)   exit 0
$ python3 scripts/check_text_digests.py . <plan> <reconciliation> <this body>
exit 1

check_text_digests.py flags every hex run that is not an indexed file preimage, so it exits 1 on these records. Each flagged run resolves to one of these:

• a public commit or tag in this repository, in the typesafe-ai/skills, obra/superpowers, affaan-m/ECC, anthropics/claude-code, openai/skills or typesafe-sdk-python mirrors, or through the GitHub API (claude-plugins-official 8f814f49, MinerU c221cc41);
• the public Ubuntu image digest;
• a date;
• an Actions run id.

No private-record digest appears.

The earlier body listed python3 scripts/host_name_scan.py <the two records>. That module has no CLI entry point, so the command scanned nothing; validate.py --scan-file above replaces it (GPT full1r P3-3).

Review rounds

• Round 1, df8bc237e: the local Codex review at bc7439a9 (P1 2, P2 3), the CC's FULL read at bc7439a9, and the owner's 19:12Z direction with its first addendum. 8b28bbda7 applied the CC's addendum-02 of that direction, which arrived after the fold was pushed.
• Round 2, 56ac69f22, folded:
  • the GPT full1r read at bc7439a9 (CHANGES_REQUESTED: 0 P1, 2 P2, 6 P3 including two research items);
  • the CC's delta read of bc7439a9..8b28bbda7 (CHANGES_REQUESTED: P1-A, P2-B, P3-a to P3-e);
  • the CC's 19:46Z direction: every paper lane moves to NativeHorizonNY, the north-star trading target, harness additions, and the CC moves at the boundary. Its addendum-01 puts Jev off the order path;
  • addenda 03 and 04 to the 19:12Z direction: the full harness landscape as stage H, and a generated, versioned role-assignment matrix that enables each framework only for the roles it suits, with each role's start-up context cost and a plain control profile.
• Round 3, 55bda29a1, after the CC's adjudication of the open items, folded:
  • the local Codex review at 56ac69f2 ("patch is incorrect": P1 1, P2 3);
  • the CC's delta read of 8b28bbda7..56ac69f2 (PASS, no P1; P2-C to P2-E, P3-f, P3-g);
  • the GPT delta read of bc7439a9..56ac69f2 (CHANGES_REQUESTED: one P2 blocker; P3 follow-ups 2 to 4; research items 5 to 7);
  • the co-op's RQ7 record (Jev's off-path producer and frozen-artifact read);
  • addenda 05 to 09 to the 19:12Z direction: per-family stacks and SDK workers, horizon as the private home of the runtime ecosystem with local-first enforcement and lander-posted statuses, and a GitHub access stage. With them comes the recorded supersession of Decision 1's "a new repository: not now".
• Round 4, 269a06359, folded: the CC's delta read of 56ac69f22..55bda29a1 (CHANGES_REQUESTED: P1, P2, two P3s; its two confirmations: GitHub access inside condition 2, and condition 1 read per row), the local Codex review at 55bda29a (three P2s), the GPT delta read of 56ac69f2..55bda29a, and the CC's citation rule.
• The final commit, this one, follows the CC's adjudication of 269a0635 after the bounded rounds: one P1 restructure, two P2s and three one-line P3s. It also carries addendum-10's PROPOSAL routing line, which the CC routed, and the fixes for the local Codex review at 269a0635 (two P2s), which the CC's addendum-01 to that adjudication disposes as fixed in this landing.

Follow-ups

• GPT RQ7 (where Jev's inference sits) is answered by the co-op's RQ7 record of 2026-10-15, folded into Decision 4: an off-path producer of frozen artifacts, a deterministic read at the cutoff, and acceptance owned by us-equities/judgment-features. Conformance is unproved until the JEV-OFFPATH-FEATURE-ACCEPTANCE receipt exists. Whether the features improve decisions stays OPEN under the preregistration standard.

• Layer completion and pin closure (GPT RQ8): 0 FINAL; five winners with unpinned verdicts and seven without run pins; 28 report-only drift flags. These go to F1 and the FINAL wave.

• The installer-side regression for service starts, transient and dependency-dispatched ones included (Harbor and Docker Compose reach container-engine), is the install-nostart lane's check_plan.py start inventory. Cite it when it lands.

• Mirrors: the co-op added microsoft/WSL 3.0.1, Linux v6.18 (cgroup-v2.rst), MinerU c221cc41, edgartools v5.58.0, ai-memory v2.6.6, rtk v0.51.0, ECC's full history and the Python TypeSafe SDK v0.7.2 (the plan's Jev pin) on 2026-10-15, with an npm dist-tag capture at 20:00:47Z. Still unmirrored: the WSL release and PR pages, Microsoft's basic-commands page and the superpowers release page.

• The harness landscape (stage H) waits for the co-op's screen tables, its named input.

• The role-assignment matrix's generator and first version land by pull request. Its per-role enablement enters the client-config map before any re-apply of stage D.

• The 24.04.5 rollback comparison needs a new preregistration (recipe R1 names a bootstrap route that F9 retires).

• trading-cc's north-star trading spec is the named input of Decision 4, and the engine-compare verdict is the input of the engine row.

• horizon: api-actions owns its landing mode, the repository-topology decision record, the transfer to the owner's account, and the access manifest that stage G consumes (Decision 10).

• The install-nostart lane carries the per-listener ports, the dialled-port ownership check and the after_sign_in gateway routing (its ADDENDUM 1). The plan's stage S and the boundary wait for it.

• From the GPT read of 3e1ea674 (follow-ups 2 to 5), after the micro commit 8d8345c33 corrected the session analytics port to 21808:

  • the install plan's archive README.md:442 still says 8080, while config/agentsview.toml:4 and install-plan.json:2888-2890 say 21808; a separate correction checks the README against those two sources;
  • fail-first evidence for the final commit's corrections stays with the implementing lanes, linked here when they land; prose-only dispositions keep their stated limit;
  • activation, retry and restore need their implementing receipts. install.sh:633 keeps an existing AgentsView configuration, so restart and restore acceptance inspects the configuration actually in effect, not only the template;
  • missing primary captures limit verification and stay listed in the read's source inventory.

• From the local Codex review at 8d8345c3, which the CC's adjudication addendum-02 disposed with nothing reopened:

  • In no-start mode, stage D's plain claude launch and its client probes call services that stay down until stage S (OTLP export, the ai-memory SessionStart hook, HTTP MCP). The next plan revision moves those probes to stage S or states their expected failure in D.
  • The documentation exemption from fail-first (the record's own statement) stays a follow-up, as GPT holds it.
  • The 2604 distro-name literal in the Codex config template is routed to the install-nostart lane's fold, with its own fail-first test.

Decision record

• docs/decisions/2026-10-15-new-wsl-clean-install-plan.md
• docs/decisions/2026-10-15-claude-host-config-reconciliation.md

Owner directions of 2026-10-15 enter as dated paraphrases. Private coordination records are cited by name only.

Checklist

• No GitHub Actions change.
• No workflow change.
• No secrets printed, logged or committed. The reconciliation is names only: no env value, no permission-rule text with paths.
• No new paid hosting, subscription or billing surface. The engine row keeps any QuantConnect tier behind the engine comparison's verdict, and TradingView behind its TRIAL.
• Peer-owned untracked files and worktrees preserved.

🤖 Generated with Claude Code