Decision record: zero tolerance for stale models, runtimes and repositories by seathatflowsinourveins · Pull Request #1237 · native-agent-stack/native-agent-stack

seathatflowsinourveins · 2026-10-17T02:45:10Z

Scope

What this PR changes, in one or two sentences: it adds one draft decision record,
docs/decisions/2026-10-17-zero-tolerance-currency.md, for the owner's currency directions of 2026-10-15 to
2026-10-17 (each point dated by the day it was given; paraphrased, not quoted), and registers it in
manifests/evidence.json through scripts/host_receipts.py register_file. It changes no CI check, unit
template, catalog row, model setting or host file. This is a draft for the CC's review; this lane does not land it.
Base commit: 90471d63f20918efa3a63ef949caffd8c012656c
Lane: lane:foundation
Owned paths touched: docs/decisions/2026-10-17-zero-tolerance-currency.md (new) and one files[] entry in
manifests/evidence.json.
Head: a746a113af8386d458cb34b314b98e48800faaed. Commits:
- the record (232d93b6);
- fold 1, the CC's first rulings (46fd06a6);
- fold 2, the Claude-family read of 46fd06a6 and CC rulings 1 to 7 (03f93bbc);
- fold 3, the CC's ruling on the pending-age note (bf2b4761);
- fold 4, the Claude-family delta read of bf2b4761, CC ruling 8 and the correction to ruling 6 (8421adc7);
  Muse's read of bf2b4761 passed with no findings;
- fold 5, the Claude-family delta read of 8421adc7 (CHANGES_REQUESTED, one P3) and the citation-check fix it
  asked for (a746a113). Muse's read of 8421adc7 passed with no findings; per the CC, its reader checked the
  record against the repository at that head rather than the diff, and it re-reads fold 5 with full paths.
CC rulings, as the record cites them ("CC ruling N"): rulings 1 to 7 at Decision record: zero tolerance for stale models, runtimes and repositories #1237 (comment), ruling 8 at Decision record: zero tolerance for stale models, runtimes and repositories #1237 (comment), and the
correction to ruling 6 at Decision record: zero tolerance for stale models, runtimes and repositories #1237 (comment).

Superseded (the record cites each by path:line at the base and the record's sha256):

a proposal or notice as the end state (the first clause of docs/model-currency.md:15, :119-120, and the
2026-09-30 record's due-file line at :151-152);
the 2026-10-15 record's successor wording (:44, :54-55): the trial that produces the evidence is dispatched at
once;
a same-publisher search as a pick's landscape (2026-10-15 record :21-25);
waiting on a release, for the selection in use only: NautilusTrader 2.0.0rc5 moves to v2.0.0rc7 through the
trading lane's screen and the foundation re-pin (Q-NT1); Lumibot stays a reviewed candidate and the
alpaca-mcp-server trigger stays (2026-10-13 record :37-43, :150-151);
release age beyond the upstream's own window, including an age buffer of ours such as the 2026-09-25 seven-day
tool cooldown where it is longer (2026-09-25 record :237-238, 2026-09-27 record :494-496).

The existing date-compared failures: the 2026-10-15 direction covers every date-compared failure inside the
required validate check, which needs every shard of the validate matrix, 0 to 7, to succeed
(.github/workflows/validate.yml:26,454,476-480). Two are known in scripts/validate.py, which shard 0 runs
(.github/workflows/validate.yml:173-178), and the modules it imports:

the model-currency age failure (scripts/validate.py:73-75,246-248): the record endorses foundation: report currency age and check model-route references #1201, which turns it
into a notice; until it lands, each landscape_check is renewed by its lane's refresh, which the daily run prompts
on day five (docs/model-currency.md:108-112; ruling 6 as corrected);
validate_pending_age (scripts/validate.py:698-701, scripts/public_starred.py:139-155): it needs the same
conversion in a follow-up PR owned by the public-starred maintainers; until that lands, each PENDING entry is
dispositioned within seven days of its first observation, and a refresh alone cannot keep it inside the window,
because the refresh keeps each row's first observation (scripts/public_starred.py:142; also :254-259, :319;
ruling 8).

Kept: the 42-day and seven-day windows (#1201 keeps them); each upstream's own cooldown and supply-chain gates
(mise's minimum_release_age, the lanes' release, security and integrity gates); our 7-day Dependabot cooldown
(.github/dependabot.yml:40-43) as a named control, untouched; the read-only collectors; date bases; no startup
audit; each replacement's screen, convergence, re-pin and trading-lane gates; the layer-resolution protocol, with a
daily-run finding triggering the layer's targeted sweep and a FINAL layer reopening only through it (:62-63).

Fold 5, 2 of 2 findings of the delta read covered:

P3, :63: "which shard 0 runs" now cites .github/workflows/validate.yml:173-178 in full; the bare :173-178
resolved to scripts/validate.py. Done.
Process: the citation check hard-coded each citation's intended file, so its pass checked what was meant, not what
the text points to. It now walks the record in reading order and resolves each bare :N to the last path the
text names before it (a relative link, a tracked repository path in backticks, or a GitHub blob link); every
resolved range must be a checked entry, every checked entry must be reached, and a locator on a short file name
fails. Its first run exposed 13 more locator tokens in six places, all fixed in this fold:
- the 2026-10-15 record's :4,48-49 (now linked);
- the 2026-10-13 record's three re-pin triggers (now linked);
- the 2026-09-27 record's holds, :67-84 (now linked);
- the protocol's :62-63 and :92-94 in Enforcement 4 (now linked);
- the 2026-10-07 record's :56-57 in Alternatives (now linked);
- five locators on short unit names, now written with their adoption/templates/systemd/ paths.
  Three mutants each make it exit 1: the fold-4 bare :173-178, a short unit name with a locator, and a record label
  without its link before a bare locator. Done.

Notes for the CC:

Host wiring, read only with systemctl --user show at 2026-10-17T02:19:57Z: the live-clone fast-forward exists only
as a user drop-in on the workstation. In stack-currency.service its fetch and --ff-only merge run after
freshness_propose.py --model-currency, so on a day the paper-window check skips the watch, the model proposals
read the clone before the fast-forward.
A pointer from docs/model-currency.md to this record waits for foundation: report currency age and check model-route references #1201 and Haiku 5.5 takes cheap exact extraction: record the 2026-10-07 repeat trial (land after 2026-10-08T17:18Z) #840, which edit that guide.
Fold 4's commit message ends "Not pushed: a read of bf2b476 is still running", which was true when it was
committed; it was pushed as it stands, as ruled.

SOTA sources

huggingface/huggingface_hub at bd4a76030582d118e28dc9ad6c7a5911ea76176b:
src/huggingface_hub/hf_api.py:799-801 (created_at is the repository's creation on the Hub),
src/huggingface_hub/cli/models.py:223-237 (hf models info), src/huggingface_hub/constants.py:60 (default
revision main).
Anthropic models list API, https://platform.claude.com/docs/en/api/models/list (created_at, the model's release
time), read 2026-10-17.
PyPI JSON API, https://docs.pypi.org/api/json/ (upload_time_iso_8601); GitHub REST "Get the latest release",
https://docs.github.com/en/rest/releases/releases#get-the-latest-release (published_at; created_at is the
commit date); npm registry document, https://registry.npmjs.org/@anthropic-ai/claude-code (time); all read
2026-10-17.
GitHub's Dependabot options reference, cooldown,
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-
(a 3-day default cooldown for version updates even when cooldown is not configured), read 2026-10-17.
jdx/mise at v2026.10.12 (commit de922674adb7aa8927e0c6a425e252053dbeb03c), the installed client: settings.toml:2090-2096
(minimum_release_age holds back newly published versions to limit supply-chain risk), read 2026-10-17.
GitHub releases API for nautechsystems/nautilus_trader, read 2026-10-17: v2.0.0rc7, published
2026-10-15T21:07:45Z, annotated tag peeled to commit 55c0e82053142bce3a5cba4de4221d3929c2d3bc.
PR foundation: report currency age and check model-route references #1201 at head 459bf4fd4dd0f90f76eb5af2bbce7e3d82a72a50: scripts/validate.py:867-869, :1088 (age findings as notices) and
:73-74,167-170 (the 42-day and seven-day policy kept).
git/git at v2.53.0, the installed client: Documentation/merge-options.adoc:79-81 (--ff-only).
systemd/systemd at v259.5 (commit b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a): man/systemd.service.xml:1443-1444 (the - prefix).
Michael Nygard, Documenting Architecture Decisions (2011-11-15),
https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions: supersession rather than erasure.

Evidence-class table

Claim	Evidence class	Command / receipt
Every locator in the record, read as a reader resolves it, holds what the record says	`local_integration`	the reader-resolving check: 80 locator ranges in the text resolve to 68 repository entries at `90471d63` and 10 upstream entries, each reached, plus 1 page check, 12 quotes and 5 pins: exit 0; three mutants each exit 1
The superseded records' sha256 values	`local_integration`	computed from `git show 90471d63:<path>` and compared with their `manifests/evidence.json` entries; the 2026-09-30 record has none
Hub, Anthropic, PyPI, GitHub, npm, Dependabot, mise, git and systemd semantics	`source_review`	the primary pages and pinned files above, re-read 2026-10-17
NautilusTrader's newest release and #1201's notice lines	`source_review`	GitHub releases and contents APIs, read 2026-10-17
The required check's shard rule, the pending-age check and its refresh behavior	`source_review`	`.github/workflows/validate.yml:26,454,476-480`, `scripts/validate.py:698-701` and `scripts/public_starred.py:62-68,139-155,254-259,303,319` at the base
The live-clone fast-forward drop-ins and their step order on the workstation	`source_review` (a read-only host observation)	`systemctl --user show` at 2026-10-17T02:19:57Z; no receipt
The rule changes behavior	not claimed	no unit, catalog, setting or model changed, and no run measured it

Local commands run

On the fold commit a746a113:

$ python3 scripts/validate.py
exit 0; {"components": 71, "hashed_files": 12285, "profiles": 4, "receipts": 240, "status": "passed"}
$ python3 scripts/validate.py --registration-base origin/main
exit 0; status passed
$ python3 scripts/evidence_manifest.py --check
exit 0; {"files": 12285, "status": "passed"}
$ python3 scripts/validate.py --scan-file docs/decisions/2026-10-17-zero-tolerance-currency.md
exit 0; {"matching_locations": 0, "scanned_files": 1, "source": "host", "status": "passed"}
$ python3 -m unittest tests.test_adoption_contract tests.test_adoption_docs_consistency tests.test_model_currency tests.test_model_currency_propose tests.test_resolution_protocol_docs tests.test_provenance_digest_custody tests.test_published_digest_privacy tests.test_runtime_worker_openhands_push_gate
exit 0; Ran 271 tests, OK (skipped=2)
$ git fetch origin && git merge-tree --write-tree origin/main a746a113
exit 0; clean merge, tree 274fdcdeafd61323bce5d0956a54a9dbdcb4abf0 (origin/main at 90471d63)

Decision record

docs/decisions/2026-10-17-zero-tolerance-currency.md. Evidence: the repository mechanisms at the base and the
upstream sources above. Alternatives: a date-compared required check, new or kept; notices and proposals alone; and a
timer that switches. Overturn: the owner rewords the direction, or a recorded incident shows a stale pick that the
daily runs, the CC's review and dispatch all missed.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

New/changed GitHub Actions are pinned to a full commit SHA with a
version comment (no floating tags). None changed.
New/changed workflows declare top-level permissions: {} and grant each job
only what it needs. None changed.
No secrets are printed, logged or committed; no new required secret was
added without a documented owner.
No new paid hosting, subscription or billing surface was introduced.
Peer-owned untracked files and worktrees were preserved (not deleted,
moved or overwritten).

🤖 Generated with Claude Code

… repositories Draft decision record for the CC's review, on the owner's direction of 2026-10-17 (paraphrased, not quoted). A stale verdict now starts replacement work at once (the successor through the layer's screen, a smoke test, a measured trial, the switch, then removal with the inverse recorded) instead of ending at a proposal or a notice. It supersedes the proposal-only reading of docs/model-currency.md, normal review pace for a known successor, a same-publisher search as a pick's landscape, release watches that wait, and release age as a reason to keep an older pick. It keeps the 42-day/7-day rule in scripts/validate.py as is and adds no CI gate. The record is registered in manifests/evidence.json through scripts/host_receipts.py register_file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

…record Fold for the CC's 2026-10-17 rulings on #1237. Cooldown scope narrowed: each upstream's own documented cooldown and supply-chain gates stay (Dependabot's cooldown, a tool's minimum release age such as mise's minimum_release_age, the lanes' security and integrity gates). Inside such a window the pick is the newest release past it, and a security fix that exists only in the newer release overrides it. The record ends release age as a reason to keep an older pick beyond the upstream's window, including an age buffer of our own such as the 2026-09-25 seven-day tool cooldown where it is longer. Dates: each point is dated by the day the owner gave it (paraphrased): the no-new-mechanical-gate point 2026-10-15, the no-stale-pick and newer-release-fit points 2026-10-16, zero tolerance with immediate replacement 2026-10-17. The record's manifests/evidence.json entry is re-registered through scripts/host_receipts.py register_file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

seathatflowsinourveins · 2026-10-17T03:15:30Z

Command center rulings on this record (2026-10-17), for the fold after the Claude-family read of 46fd06a

These rulings are the locator the record cites for "the CC's 2026-10-17 review rulings".

Cooldowns. Keep each upstream's own documented cooldown and supply-chain gates. Within such a window the pick is the newest release past it, and a security fix that exists only in the newer release overrides the window. Release age stops being a reason to keep an older pick once the upstream's window has passed. Dependabot's 7-day cooldown (.github/dependabot.yml:40-43, default-days: 7) is our own deliberate supply-chain control, longer than Dependabot's 3-day default. This record does not touch it, as the first commit said; list it under Kept as a named control.
Dates. Date each point by the day it was given: no new mechanical gate 2026-10-15; no stale pick and newer-release fit 2026-10-16; zero tolerance with immediate replacement 2026-10-17. Paraphrase only.
Daily-run findings and the resolution protocol. A newer release that a daily run finds is a trigger. It schedules the layer's sweep at once (a targeted sweep run), and a FINAL layer still reopens only through that sweep (docs/decisions/2026-10-11-layer-resolution-protocol.md:62-63, unchanged).
Review scope. The CC's review fails a change that introduces, re-records, or touches and leaves stale a model, runtime or repository pin. A change that does not touch a pin is not held for it.
Release watches. Supersede waiting only for selections in use: NautilusTrader 2.0.0rc5 moves to rc7 now, through the trading lane's screen and the foundation re-pin (queue item Q-NT1). Lumibot 4.6.11 stays a reviewed candidate, and the alpaca-mcp-server re-pin trigger (a named MCP role must first pass the execution layer's screen) is kept. Cite the 2026-10-13 record's rows at lines 37-43.
The 2026-10-15 direction covers the existing age failure. The model-currency age failure in scripts/validate.py compares release dates with the current date inside a required check, so a stale landscape_check fails every pull request at a rollover. That is the breakage the 2026-10-15 direction rules out. This record therefore endorses PR foundation: report currency age and check model-route references #1201, which turns that failure into a notice. Until foundation: report currency age and check model-route references #1201 lands, the daily runs keep each landscape_check fresh. Enforcement stays with the daily runs, the CC's review and immediate replacement work.
The P3s. Apply all seven: narrow the superseded docs/model-currency.md ranges to the first clause of line 15 and lines 119-120; drop "normal pace" and the inserted "only" for the 2026-10-15 record; add the 2026-09-30 due-file line number; cite scripts/currency_due.py:116,119; replace "failed every pull request" with the 2026-10-15 record's own account (its lines 48-49); quote the 2026-10-07 record's words exactly; cite merge-options.adoc:79-81 alone; and drop the claim that the new WSL install renders these units, or cite where it does.

…rance record Fold for the Claude-family read of 46fd06a (CHANGES_REQUESTED) and the CC's rulings posted on #1237 (issuecomment-6228929765), now cited in the record as its locator for "CC ruling N". 1. Dependabot's 7-day cooldown (.github/dependabot.yml:40-43) is listed under Kept as our own named supply-chain control, longer than Dependabot's 3-day default (GitHub's options reference), untouched. 2. Dates stay as the first fold set them. 3. A newer release a daily run finds triggers its layer's targeted sweep at once; a FINAL layer still reopens only through that sweep (protocol :62-63, unchanged). 4. Enforcement 3: the CC's review fails a change that introduces, re-records, or touches and leaves stale a pin; a change that touches no pin is not held for it. 5. Release watches: waiting ends only for the selection in use; NautilusTrader 2.0.0rc5 moves to v2.0.0rc7 through the trading lane's screen and the foundation re-pin (Q-NT1); Lumibot stays a reviewed candidate; the alpaca-mcp-server trigger stays; cites :37-43. 6. New section "The existing age failure": the record endorses #1201, which turns the age failure into a notice; until it lands, the daily runs keep each landscape_check fresh. 7. P3s: model-currency.md ranges narrowed to :15 (first clause) and :119-120; "normal pace" and the inserted "only" dropped; the 2026-09-30 line (:151-152) added; currency_due.py:116,119 cited; the 2026-10-15 record's own account (:4,48-49) replaces "failed every pull request"; the 2026-10-07 record quoted exactly (:56-57, :10); merge-options.adoc cited at :79-81 alone; the new WSL install claim replaced by the lifecycle install commands (:246-251). The record's manifests/evidence.json entry is re-registered through scripts/host_receipts.py register_file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

Fold for the CC's 2026-10-17 ruling on the pending-age note in #1237: the 2026-10-15 direction covers every date-compared failure inside the required check. The section "The existing age failure" becomes "The existing date-compared failures" and names both known instances with their lines: - the model-currency age failure (scripts/validate.py:73-75,246-248), which PR #1201 converts to a notice; until it lands, the daily runs keep each landscape_check fresh; - validate_pending_age (scripts/validate.py:698-701, scripts/public_starred.py:139-155), which needs the same conversion in a follow-up PR owned by the public-starred maintainers; until that lands, the starred refresh keeps PENDING entries inside their window, each dispositioned within seven days of its first observation, since a refresh keeps the first observation (scripts/public_starred.py:142). No code change. The record's manifests/evidence.json entry is re-registered through scripts/host_receipts.py register_file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

seathatflowsinourveins · 2026-10-17T03:54:53Z

Command center ruling 8 on this record (2026-10-17), on the builder's note about validate_pending_age

The 2026-10-15 direction covers every date-compared failure inside the required check, not only the model-currency age failure. The record names both known instances: the model-currency age failure (PR #1201 converts it to a notice) and validate_pending_age (scripts/validate.py:698-701, scripts/public_starred.py:139-155), which needs the same conversion in a follow-up PR owned by the public-starred maintainers. Until that lands, each PENDING entry is dispositioned within seven days of its first observation; a refresh alone cannot keep it inside the window, because the refresh keeps each row's first observation (scripts/public_starred.py:142). This PR adds no code change.

seathatflowsinourveins · 2026-10-17T04:04:49Z

Command center correction to ruling 6 (2026-10-17), from the Claude-family read of bf2b476

Ruling 6 said that until #1201 lands "the daily runs keep each landscape_check fresh". That is wrong: the daily runs do not renew a check date. They open refresh_landscape on day five, and the lane's own refresh renews the date (docs/model-currency.md:108-112, "These are review requests; they do not renew the check date"). Corrected ruling 6: until #1201 lands, each landscape_check is renewed by its lane's refresh, which the daily run prompts on day five. This comment is the locator for that correction; ruling 8's locator is issuecomment-6229313250.

…e record Fold 4 for the Claude-family delta read of bf2b476 (CHANGES_REQUESTED) and the CC's comments on #1237. - P2: ruling 8 in its own order. Each PENDING entry is dispositioned within seven days of its first observation; a refresh alone cannot keep it inside the window, because the refresh keeps each row's first observation (scripts/public_starred.py:142; also :254-259 and :319). - P3: ruling 8 cited by its locator, issuecomment-6229313250, as "CC ruling 8". - P3: the required validate check needs every shard 0..7 (.github/workflows/validate.yml:26,454,476-480); "two are known" is scoped to scripts/validate.py and the modules it imports. - P3: ruling 6 as corrected by issuecomment-6229421934: until #1201 lands, each landscape_check is renewed by its lane's refresh, which the daily run prompts on day five (docs/model-currency.md:108-112). - P3: the base line names its exception: the PR #1201 citations are at its head 459bf4f. The record's manifests/evidence.json entry is re-registered through scripts/host_receipts.py register_file. Not pushed: a read of bf2b476 is still running. Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ves it Fold 5 for the Claude-family delta read of the fold-4 head (CHANGES_REQUESTED, one P3); Muse's read of that head passed with no findings. - P3: "which shard 0 runs" now cites .github/workflows/validate.yml:173-178 in full; the bare :173-178 resolved to scripts/validate.py. - The citation check now resolves each bare :N to the last path the text names before it, as a reader does, and requires every resolved range to be a checked entry and every checked entry to be reached. Its first run exposed 13 more locator tokens in six places, fixed here: - the 2026-10-15 record's :4,48-49 (now linked); - the 2026-10-13 record's three re-pin triggers (now linked); - the 2026-09-27 record's holds, :67-84 (now linked); - the protocol's :62-63 and :92-94 in Enforcement 4 (now linked); - the 2026-10-07 record's :56-57 in Alternatives (now linked); - five locators on short unit names, now written with their adoption/templates/systemd/ paths. The record's manifests/evidence.json entry is re-registered through scripts/host_receipts.py register_file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 17, 2026

seathatflowsinourveins and others added 2 commits October 16, 2026 23:33

seathatflowsinourveins and others added 2 commits October 17, 2026 00:08

seathatflowsinourveins marked this pull request as ready for review October 17, 2026 04:57

seathatflowsinourveins merged commit f00d478 into main Oct 17, 2026
34 checks passed

seathatflowsinourveins deleted the docs/zero-tolerance-currency-20261017 branch October 17, 2026 05:23

Navigation Menu

Repository navigation

Decision record: zero tolerance for stale models, runtimes and repositories - #1237

Decision record: zero tolerance for stale models, runtimes and repositories#1237
seathatflowsinourveins merged 6 commits into
mainfrom
docs/zero-tolerance-currency-20261017

seathatflowsinourveins commented Oct 17, 2026 •

edited

Loading

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seathatflowsinourveins commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope

SOTA sources

Evidence-class table

Local commands run

Decision record

Host evidence

Checklist

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

seathatflowsinourveins commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seathatflowsinourveins commented Oct 17, 2026 •

edited

Loading