Cleanup H01: stage-1 receipts of the live WSL distros and NativeHorizonNY's rehearsal - #1235

39ab807

Scope

• What this PR changes, in one or two sentences: it adds the stage-1 receipts of the two live WSL distributions and of NativeHorizonNY's rehearsal, in the form adoption/platforms/linux-wsl2-new-distro.md:1240-1274 prescribes: evidence/receipts/wsl-new-distro-stage1-nativestack2604-20261002.json, …-nativehorizonny-20261015.json and …-nativehorizonny-r1-20261015.json, with their receipts[] rows. Each receipt is filled only from its own private stage-1 transcript, which stays on Z:. This is step H01 of the command center's 2026-10-17 Z: cleanup plan.
• Base commit: 90471d63f20918efa3a63ef949caffd8c012656c
• Lane: lane:foundation
• Owned paths touched:
  • Three new files under evidence/receipts/.
  • In the shared hot file manifests/evidence.json: their three files[] and three receipts[] rows, plus the re-registered hashes of the next two files.
  • tools/local-pages/source_policy.json: three exact architecture_receipt grants.
  • tests/test_local_pages_policy_grants.py: three POST_PIN_RECEIPT_GRANTS ledger entries.

History of this PR

The first commit, 21bee5f5, committed sanitized copies of the three transcripts. The CC ruled that adoption/platforms/linux-wsl2-new-distro.md:1247 keeps the raw stage-1 log private and never committed, redacted or not, and that the documented record is a receipt. The fold commit c4c5242e applies that ruling. It removes the copies and their files[] rows, and the manifest passes through a state byte-identical to the base's before the new rows go in. The repository allows squash merges only, so main gets the receipts and never the transcripts. The sanitized copies stay visible in this PR's first commit.

The fold was first pushed as b72d3d64. CI run 39001649622 failed it in validate-shard-6: tests.test_local_pages_architecture_landscape_exclusions reported that the Architecture build has no grant for the new receipts. The CC asked for one fold commit, so the grant fix was amended into it and pushed with --force-with-lease against b72d3d64. That commit's registrations are covered by NATIVE_AGENT_REGISTRATION_BEFORE below.

Claude and Muse then each read c4c5242e and requested changes. The fold commit 39ab8072, on top of it, covers all 13 findings; see "Findings folded" below. The receipts are rebuilt by the same generator, and their files[] and receipts[] rows are re-registered.

Review point: three new Architecture grants

The local-pages Architecture reader refuses any registered receipt without an exact grant, and every committed catalog build then fails. This PR adds one exact {"root": "repo", "path": …} row per new receipt to tools/local-pages/source_policy.json (architecture.architecture_receipt, 4654 to 4657 rows). It also adds one ledger entry each to POST_PIN_RECEIPT_GRANTS in tests/test_local_pages_policy_grants.py, whose reason cites this PR, the failing CI run and the refusal. This follows the post-pin grant precedent of #1047, #1060, #1119, #1178 and #1191. The test module requires a reviewed reason for any grant beyond the pinned reviewed union, so these three grants need the CC's or a reader's review. Before the fix the module fails locally at b72d3d64, as in CI; after it, the module and tests.test_local_pages_policy_grants pass (34 tests).

SOTA sources

• Receipt form: adoption/platforms/linux-wsl2-new-distro.md:1240-1274 (Raw log, Sanitize, Content, Contribute) and the template adoption/templates/wsl/stage1-receipt.example.json, both at the base. Its 212 recipe steps are carried in order, with <Name> and <RELEASE> filled. The precedent is evidence/artifacts/new-wsl-rehearsal-20261002/stage1-receipt.json (artifact_class local_integration_check; null fields and steps marked as not run).
• The image every transcript verifies: https://releases.ubuntu.com/26.04.1/ubuntu-26.04.1-wsl-amd64.wsl, sha256 48d56724b5c8e60f24893e83e73bbb58c60b3ca22fba3da977075420acd54104 (adoption/new-wsl-profile.json:29-34). Each W2 block prints it as computed, published and listed.
• WSL: https://github.com/microsoft/WSL/releases/tag/3.0.1 (adoption/new-wsl-profile.json:4866). On the recording host, wsl.exe --version prints WSL version: 3.0.3.0. The transcripts do not hold these lines; the receipts record host.wsl_version as null.
• The transcript: PowerShell Start-Transcript (adoption/platforms/linux-wsl2-new-distro.md:68).
• Sanitizing: adoption/platforms/linux-wsl2-new-distro.md:1248-1250, plus <win-host> from docs/decisions/2026-10-09-host-name-scan.md:160-161. The transcripts hold no GUID.
• Scanner: scripts/host_name_scan.py, which runs Betterleaks 1.9.0 from betterleaks/betterleaks@81aff7a638638aae3a659845d089043e1d8fe9ac (scripts/host_name_scan.py:1-4).

What the receipts hold, and what they cannot

• Every value is copied from a transcript line. The generator asserts each transcript line it uses and each cited doc line.
• Fields the transcript has no record of stay null. Each receipt's limitations names every null field with its reason, and the generator fails if any null field goes unnamed.
• Rows the transcript records have <Name> and <RELEASE> filled. Every other row keeps the template's text (:1269-1270), so no R1 row and no unobserved removal or export names a production distribution (:167-168, :172).
• An exit value is recorded only where the transcript labels one.
• NativeStack2604 (2026-10-02, Windows PowerShell 5.1): native command output is not captured, only markers such as [exit=N] and [ok=True]. W2's three hashes and W3's user-data lines and hash are recorded, along with the labeled exit values of W1, W3, W4's list, W5 and W7: 39 of the 212 steps. The unlabeled 0 lines in the W4 and W5 blocks are not read as exits.
• NativeHorizonNY and NativeHorizonNY-r1 (2026-10-15, PowerShell 7.6.7): the step scripts print labeled summaries such as install exit 0, windows_region US and owner 1000:1000, not commands.
• NativeHorizonNY-r1 is taken as NativeHorizonNY's R1 rehearsal. The grounds are in rehearsal.basis: its name, its r1-remove.ps1 block (list, unregister exit 0, interop ok, no export line), and its timing. Its last End time, 14:37:42 EDT, is 18:37:42Z, the stage R removal time in docs/decisions/2026-10-15-new-wsl-clean-install-plan.md:914-915. NativeHorizonNY's own receipt points to it with the same hedge and does not assert the identity.
• All three transcripts show cloud-init status --long exiting 2 without its output, so the receipts do not record the reason.

Evidence-class table

Local commands run

$ python3 scripts/validate.py
{"components": 71, "hashed_files": 12287, "profiles": 4, "receipts": 243, "status": "passed"}  exit 0
$ python3 scripts/evidence_manifest.py --check
{"files": 12287, "status": "passed"}                                                          exit 0
$ python3 scripts/validate.py --scan-file <each of the 3 receipts>
{"matching_locations": 0, "scanned_files": 3, "source": "host", "status": "passed"}            exit 0
$ python3 scripts/validate.py --scan-tracked
{"matching_locations": 0, "scanned_files": 13166, "source": "host", "status": "passed"}        exit 0
$ python3 scripts/validate.py --scan-history 0000000000000000000000000000000000000000 39ab80729ddb1c0d0838e5afeee1386549e46f61
{"matching_locations": 0, "scanned_files": 0, "source": "host", "status": "passed"}            exit 0
$ NATIVE_AGENT_REGISTRATION_BASE=origin/main NATIVE_AGENT_REGISTRATION_BEFORE="21bee5f5c5d14c964d30ca2b912977394eba486a b72d3d64bb9564377ccfc8376b82cafed02334b5 c4c5242ec31c1831ec5679f08d988b94d9445583" python3 scripts/validate.py
{"components": 71, "hashed_files": 12287, "profiles": 4, "receipts": 243, "status": "passed"}  exit 0
$ python3 scripts/host_receipts.py validate                 -> {"receipts": 183, "status": "passed"}   exit 0
$ python3 scripts/validate_catalogs.py                      -> exit 0
$ python3 scripts/validate_foundation.py --root . --json    -> "ok": true                      exit 0
$ <CI requirements venv> scripts/component_matrix.py --check -> {"rows": 32, "status": "checked"}   exit 0
$ <CI requirements venv> scripts/final_stack.py --check      -> exit 0 (report-only pin-drift flags unchanged)
$ <CI requirements venv> scripts/landscape.py --root .; tools/sota-convergence/build_verdicts.py --check; blueprints/blind-catalog-convergence/audit_reports.py --check -> exit 0 each
$ <CI requirements venv> python -m unittest tests.test_validate tests.test_evidence_manifest tests.test_wsl_new_distro_recipe tests.test_component_matrix tests.test_ecosystem_manifest tests.test_final_stack tests.test_receipt_staleness tests.test_receipt_sha256_key_custody tests.test_new_wsl_handbook tests.test_new_wsl_definitive_defaults tests.test_host_receipts tests.test_local_pages_policy_grants tests.test_local_pages_architecture_landscape_exclusions
Ran 924 tests in 462.800s; OK (skipped=3)   exit 0
$ <CI requirements venv> python -m unittest tests.test_local_pages_architecture_landscape_exclusions   # at b72d3d64 (fail-before)
FAILED: "Architecture role/path has no independent approval: architecture_receipt" (the CI shard-6 failure)
# Not run cleanly on this host: tests.test_local_pages_architecture_{public_names,read_boundary,sources}
# need /usr/bin/zstd, which this host lacks; they raise the same 55 FileNotFoundError errors at the base 90471d63.
$ git merge-tree --write-tree origin/main 39ab80729ddb1c0d0838e5afeee1386549e46f61        # origin/main f00d47801fa50746a63629c52359ff6f49777009
4e46b9d39b77e63d325f38adc66014e69c23497b                                                  exit 0 (clean)
$ git merge --no-ff --no-commit 39ab80729ddb1c0d0838e5afeee1386549e46f61 in a temporary worktree of origin/main; python3 scripts/validate.py; python3 scripts/evidence_manifest.py --check
{"components": 71, "hashed_files": 12288, "profiles": 4, "receipts": 243, "status": "passed"}  exit 0
{"files": 12288, "status": "passed"}                                                          exit 0

Decision record

No new decision record: the receipts follow the recipe's documented form, as the CC ruled.

Not in this PR: H02, the harvest of sota-resolution-20261002.tar. The run receipt first records it as deferred at 2026-10-17T02:16:40Z, because the ALSO REQUIRED condition of gwin W was unmet. It ran from 02:28:15Z, after the CC relayed both confirmations, and the tar's sha256 matched the plan's value. The CC closed it at 03:21:07Z with nothing harvested: none of the unique records backs a layer verdict, a catalog run or a cited record. H02 therefore has no PR and no branch. The tar stays on Z:.

Host evidence

Not applicable: nothing under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (No Actions changed.)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (No workflows changed.)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

Findings folded at 39ab8072 (reads of c4c5242e)

13 of 13 findings covered.

Findings folded at 5ed31f69 (CC verdict on 39ab8072)

2 of 2 findings covered.

Findings folded at 6acb380e (CC verdict on 5ed31f69)

1 of 1 findings covered.

🤖 Generated with Claude Code