fix(trading): relock the LEAN Alpaca adapter onto MessagePack 3.1.9 (GHSA-qhrr-8q5h-9q3h) - #1178

)

GHSA-84m7-p3x7-pcfv (CVE-2026-59951: unbounded session accumulation in
the MCP Python SDK's Streamable HTTP transport; CVSS 3.1 7.5, GitHub
severity field medium) affects mcp >= 1.8.0, < 1.30.0 and >= 2.0.0,
< 2.2.0; the recipe lock pinned mcp 1.28.1. Sources, read 2026-10-15:
- gh api /advisories/GHSA-84m7-p3x7-pcfv (published 20:13:13Z, updated
  20:13:14Z, read 20:55:51Z), and the repository advisory it cites,
  GHSA-84m7-p3x7-pcfv
  (published 2026-09-30T20:53:30Z, the same ranges);
- the v1.30.0 release, gh api
  repos/modelcontextprotocol/python-sdk/releases/tags/v1.30.0: tag
  commit 8c2fa6eabacde869d75568e33b9d466b58c2f512; body lines 13-17
  ("Idle Streamable HTTP sessions now expire (#3426)"), 33 and 38 name
  the fix, #3426 at 92120b4b0f50385af096592d7cee932fc1d994e7;
- OSV.dev's record, modified 20:30:08Z, after the hosted osv-scanner
  job at 5561321 had passed (run 38801792191, job 116652403677,
  20:25:18Z to 20:25:41Z).

- Relock blueprints/runtime-workers/openhands/requirements.lock with
  the recipe's own paired uv 0.12.22 relock, #1060's procedure: the
  control, #1060's ten version-pinned upgrades on a fresh extraction of
  the pinned SDK archive, reproduces the committed lock byte for byte,
  and the new run adds one upgrade:

    uv lock --upgrade-package anyio==4.14.2 --upgrade-package click==8.5.0
      --upgrade-package pypdf==6.19.0 --upgrade-package soupsieve==2.9.2
      --upgrade-package pyjwt==2.15.0 --upgrade-package urllib3==2.8.0
      --upgrade-package litellm==1.93.2 --upgrade-package fsspec==2026.6.0
      --upgrade-package multidict==6.9.1 --upgrade-package oauthlib==4.0.0
      --upgrade-package mcp==1.30.0
    uv export --frozen --format requirements.txt --no-header
      --no-annotate --package openhands-tools --no-emit-workspace

  The flags at astral-sh/uv 0.12.22 (tag commit
  70fe1196a546e49148a73b1c592b2f74c33af80e):
  docs/concepts/projects/sync.md:157-182 (lock --upgrade-package
  <package>==<version>) and :35-50 (lock --check);
  docs/concepts/projects/export.md:43-55 (requirements.txt);
  crates/uv-cli/src/lib.rs:7506-7509 (--upgrade-package, in
  ResolverArgs, flattened into LockArgs at 4157-4158), 4102-4110
  (--check), 4757-4764 (--format), 4776-4780 (--package), 4811-4813
  (--no-annotate), 4818-4820 (--no-header), 4900-4913
  (--no-emit-workspace) and 4982-4986 (--frozen); the kept workspace
  settings at docs/concepts/resolution.md:142-173 (environments),
  303-309 (preferences), 846-852 (exclude-newer-package) and 891-921
  (the relative exclude-newer).
- Moved: mcp 1.28.1 -> 1.30.0, and nothing else. uv's change list
  differs from the control's by "Updated mcp v1.28.1 -> v1.30.0" only,
  uv.lock by the mcp entry only and the export by lines 365-367 only;
  both hashes are PyPI's 1.30.0 wheel and sdist (uploaded 2026-09-07,
  outside the 7-day exclude-newer window). 1.30.0 declares the same
  requirements as 1.28.1, and the lock's two dependents admit it:
  fastmcp 3.2.0 (mcp<2.0,>=1.24.0) and browser-use 0.11.9
  (mcp>=1.10.1). fastmcp's <2.0 keeps the 2.x fix out of reach.
- pins.json requirements_sha256: a3303759da2895ecb87e0a9fa7e45878bb2588208615e6a6059704a98e71e396
  (was 32bc153428aaef2018adcdca53337e4a74b464ca94a96b9905e1bc6174503400).

Fail-first: security-scan.yml's own "Scan every listed lockfile and
manifest" step (extracted at 5561321, bash --noprofile --norc -eo
pipefail, TZ=UTC, WRITE_SARIF=false, RUNNER_TEMP holding OSV-Scanner
2.6.0 checked against OSV_SCANNER_SHA256 ca69b3d3...) exits 1 with
exactly GHSA-84m7-p3x7-pcfv on requirements.lock at 5561321
(2026-10-15T20:58:30Z) and at main's a93ba0b (21:23:15Z, a detached
worktree, removed), and exits 0 on this change (21:25:47Z, preflight
23 tests OK, ordinary=0, No issues found over the 60 ordinary inputs).
A scan of this lock alone exits 1, then 0.

Tests, TZ=UTC, on this change's final tree (21:32:48Z to 21:39:30Z):
tests.test_osv_lockfile_coverage with
tests.test_wsl_retrieval.RetiredRunnerTests, 65 tests OK; the 16
modules that name the recipe or its lock outside local pages, with
tests.test_provenance_digest_custody, 950 tests OK (55 skipped); the 32
tests/test_local_pages*.py modules, tests.test_local_pages_policy_grants
among them, 547 tests OK. After the receipt's and the summary's last
edits, tests.test_receipt_sha256_key_custody,
tests.test_provenance_digest_custody and the 32 local-pages modules ran
again: 578 tests OK. validate.py passed (12148 hashed files);
evidence_manifest.py --check passed; git diff --check is clean. The
isolated hashed install (CPython 3.13.16), uv pip check (178
packages), the SDK import, an mcp 1.30.0 check (StreamableHTTPSessionManager
defaults session_idle_timeout 1800, max_sessions 10000) and a fastmcp
3.2.0 in-memory client smoke pass; the PyPI hash check exits 0;
resolver.py --help and run --help exit 0. Not run: run-e2e.sh and
e2e/ (the installed prefix, images, gateway and model calls) and
install.sh (a host install).

Record: the research.md section; the receipt
evidence/receipts/osv-openhands-mcp-relock-20261015.json, with its
exact architecture_receipt grant in tools/local-pages/source_policy.json
and its POST_PIN_RECEIPT_GRANTS row in
tests/test_local_pages_policy_grants.py; the returned outputs under the
relock-2026-10-15-mcp prefix beside the recipe; manifests/evidence.json.

The NuGet-digest P3 from the GPT read of #1178 lands in the next
commit, as the command center's 20:58Z ruling directs.

Co-authored-by: Claude Opus 5.5 <[email protected]>

…ipt (#1178 GPT read, P3) (#1196)

The GPT full read of #1178 (P3): build_environment.nuget_config in
evidence/receipts/osv-alpaca-messagepack-relock-20261015.json published
the sha256 of a task-scratch NuGet.Config that no repository file
holds, so nobody can check the digest from the repository (correction
#161's custody rule: docs/decisions/2026-10-12-harbor-parallel-runtimes.md,
"Custody of the run originals"). The key does not end in _sha256, so
tests.test_receipt_sha256_key_custody never reached it.

- The value now describes the file and carries no digest: "Task-owned
  public-only NuGet.Config: a cleared packageSources list plus the
  single nuget.org v3 source, passed with --configfile to every
  restore".
- manifests/evidence.json: the receipt's row re-hashed.

The command center's 20:58Z ruling keeps this fold in its own commit,
after the mcp relock.

Checks: validate.py passed (12148 hashed files); evidence_manifest.py
--check passed; git diff --check is clean; under TZ=UTC,
tests.test_receipt_sha256_key_custody, tests.test_provenance_digest_custody
and the 32 tests/test_local_pages*.py modules ran 578 tests, OK. No
other tracked file carries the removed digest (git grep).

Co-authored-by: Claude Opus 5.5 <[email protected]>

adoption/platforms/linux-wsl2-new-distro.md:1247 keeps the raw stage-1
transcript private and never committed, and :1240-1274 prescribe a
stage-1 receipt filled from adoption/templates/wsl/stage1-receipt.example.json
instead. So this commit:

- removes evidence/artifacts/live-distro-stage1-logs-20261017/ (the three
  redacted transcripts and their receipt.json) and its four files[] rows;
- adds one receipt per distribution under evidence/receipts/:
  wsl-new-distro-stage1-nativestack2604-20261002,
  wsl-new-distro-stage1-nativehorizonny-20261015 and
  wsl-new-distro-stage1-nativehorizonny-r1-20261015, each filled only
  from its own private transcript, with the template's 212 recipe steps,
  null where the transcript holds no record, and source_transcript giving
  the original's path, size and sha256 on Z:;
- registers the three files through scripts/host_receipts.py register_file
  and adds their receipts[] rows (same id, kind, component_ids, claim and
  limitations, plus path), as the recipe's Contribute step says.

Sanitizing follows :1248-1250 and <win-host>; the transcripts hold no GUID.

The Architecture build refuses a registered receipt that has no exact
grant (tests.test_local_pages_architecture_landscape_exclusions failed in
CI run 39001649622, validate-shard-6, at b72d3d6). Following the post-pin
grant precedent (#1047, #1060, #1178, #1191), this commit adds one exact
architecture_receipt row per new receipt to tools/local-pages/source_policy.json
and one POST_PIN_RECEIPT_GRANTS entry each, with its reason, to
tests/test_local_pages_policy_grants.py. Both files are re-registered
through register_file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…onNY's rehearsal (#1235)

* Harvest the live distros' Stage-1 transcripts as sanitized evidence (cleanup H01)

Add evidence/artifacts/live-distro-stage1-logs-20261017/ with sanitized copies
of the three Stage-1 PowerShell transcripts that existed only on Z:
(NativeStack2604, NativeHorizonNY and NativeHorizonNY-r1). Add receipt.json,
which gives each original's path, size, sha256 and mtime and lists every
redaction by line. The originals stay on Z: unchanged.

Sanitizing follows adoption/platforms/linux-wsl2-new-distro.md:1248-1250 and
docs/decisions/2026-10-09-host-name-scan.md:160-161. The placeholders are
<win-host>, <win-user>, %USERPROFILE% and <WSL_USER>, replaced inside lines
only: 66 lines change, and no line is added or removed. CRLF becomes LF
per .gitattributes:2. The four files are registered in manifests/evidence.json
through scripts/host_receipts.py register_file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rework H01 into stage-1 receipts per the WSL recipe's documented form

adoption/platforms/linux-wsl2-new-distro.md:1247 keeps the raw stage-1
transcript private and never committed, and :1240-1274 prescribe a
stage-1 receipt filled from adoption/templates/wsl/stage1-receipt.example.json
instead. So this commit:

- removes evidence/artifacts/live-distro-stage1-logs-20261017/ (the three
  redacted transcripts and their receipt.json) and its four files[] rows;
- adds one receipt per distribution under evidence/receipts/:
  wsl-new-distro-stage1-nativestack2604-20261002,
  wsl-new-distro-stage1-nativehorizonny-20261015 and
  wsl-new-distro-stage1-nativehorizonny-r1-20261015, each filled only
  from its own private transcript, with the template's 212 recipe steps,
  null where the transcript holds no record, and source_transcript giving
  the original's path, size and sha256 on Z:;
- registers the three files through scripts/host_receipts.py register_file
  and adds their receipts[] rows (same id, kind, component_ids, claim and
  limitations, plus path), as the recipe's Contribute step says.

Sanitizing follows :1248-1250 and <win-host>; the transcripts hold no GUID.

The Architecture build refuses a registered receipt that has no exact
grant (tests.test_local_pages_architecture_landscape_exclusions failed in
CI run 39001649622, validate-shard-6, at b72d3d6). Following the post-pin
grant precedent (#1047, #1060, #1178, #1191), this commit adds one exact
architecture_receipt row per new receipt to tools/local-pages/source_policy.json
and one POST_PIN_RECEIPT_GRANTS entry each, with its reason, to
tests/test_local_pages_policy_grants.py. Both files are re-registered
through register_file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fold both families' reads of c4c5242 into the three stage-1 receipts

The three receipts are rebuilt by the same transcript-line generator, and
their files[] and receipts[] rows are re-registered.

Claude family:
- P2-1 (two real-run receipts, the 29 R1 rows): rows the transcript does
  not record keep the template's text, so no R1 row names a production
  distribution (linux-wsl2-new-distro.md:167-168, :172, :1269-1270). The
  steps[] limitation states the R1 exception; in the r1 receipt only the
  recorded R1 rows carry its own name.
- P3-1 (nativestack2604 steps 90, 91, 94, 95): the unlabeled '0' lines are
  no longer read as exits; those exits are null and the excerpts say so.
- P3-2 (creation_path_basis and the 24 W6 excerpts): no "--from-file"
  claim; the basis is W3's '#cloud-config' output and the absent W6 block.
- P3-3 (nativehorizonny rehearsal block, its limitation and the 29 R1
  excerpts): the R1 identity is hedged as "taken as".
- P3-4 (r1 rehearsal.basis): cites
  docs/decisions/2026-10-15-new-wsl-clean-install-plan.md:914-915, whose
  18:37:42Z removal equals the transcript's last End time, and drops the
  "every proof held" implication.
- P3-5 (every null field): each receipt names every null field with its
  reason, and the generator asserts none is left unnamed.
- P3-6 (nativestack2604 rehearsal limitation): points to
  evidence/artifacts/new-wsl-rehearsal-20261002/ and says those records
  name StackRehearsal2604 and its e1, r2 and r3 runs, not NativeStack2604.

Muse family:
- P2 (nativehorizonny :15), P2 (nativehorizonny-r1 :15) and P2
  (nativestack2604 :15), with their manifest copies: covered by the full
  null-field naming above.
- P2 (nativestack2604 :19): the rehearsal block is described as present
  with null fields.
- P3 (each receipt :14): the sanitizing note lists only the placeholders
  in copied values, keeps the template's own placeholders apart, and says
  why <win-user> and <win-host> do not appear.
- P3 (nativehorizonny :20): same fix as Claude P3-3.

13 of 13 findings covered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Cleanup H01 fold: move three 2604 null fields to the no-line bucket, correct the sanitizing note

Closes both findings of the CC verdict on 39ab807
(/var/tmp/cc-cc-work/nas1235-micro/CC-DELTA-39ab8072.md, CHANGES_REQUESTED;
full read /var/tmp/cc-cc-work/nas1235-micro/MICRO-delta-39ab8072.md).

P3-A: in the NativeStack2604 stage-1 receipt, first_launch.user_prompt_marker,
first_launch.oobe_failed_marker and first_launch.systemd_user_session_warning
sat in the "shows the source command but not the output" null bucket (:17).
The transcript has no line for the W5 launch command (its W5 block shows only
an unlabeled '0' before its first labeled command, as the receipt's own launch
row says), so the three fields move to the "no line for the source command"
bucket (:18). The manifest row matches. The NativeHorizonNY receipts keep
their buckets: their launch is labeled.

P3-B: the sanitizing note (:14 of each of the three receipts) said the Windows
user name and computer name occur only in transcript header lines the receipt
does not copy. They also occur in transcript body paths and in the Host
Application header, of which each receipt copies a sanitized run-from path
(deviations[0] in 2604, deviations[1] in the NativeHorizonNY receipts). The
note now says so and names the replacements that remove them. The three
manifest copies match word for word.

The three receipt rows in manifests/evidence.json are re-registered with
host_receipts.register_file (sha256 and bytes). validate.py and
evidence_manifest.py --check pass.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Cleanup H01 fold 4: give each receipt's sanitizing note the facts its own transcript supports

Closes P3-1 of the CC verdict on 5ed31f6
(/var/tmp/cc-cc-work/nas1235-micro/CC-DELTA-5ed31f69.md, CHANGES_REQUESTED;
full read /var/tmp/cc-cc-work/nas1235-micro/MICRO-delta-5ed31f69.md).

The previous fold copied one sentence into all three receipts' :14 note. It
was true only for the Windows user name in the NativeStack2604 receipt. The
verdict records that the sentence came from the CC's earlier verdict.

NativeStack2604 receipt: the Windows user name appears in body paths, in the
Host Application header (copied only as the sanitized run-from path at
deviations[0]) and in the Username and RunAs User headers, and the listed
replacements remove it. The computer name appears only in the Username,
RunAs User and Machine headers, which the receipt does not copy.

NativeHorizonNY and r1 receipts: the user name appears in two body lines
(the user-data name line and the default= line, rendered <WSL_USER>) and in
the Username and RunAs User headers. The computer name appears only in the
Username, RunAs User and Machine headers. The Host Application header carries
neither name, and deviations[1] copies its run-from directory as it stands.

The three manifest copies (manifests/evidence.json, the limitations of each
receipt row) match the receipts word for word, and the three file rows are
re-registered with host_receipts.register_file (sha256 and bytes). No other
line changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>