Blind lanes round 2: sanitized export, receipt aliases, two-family adjudication - #145

…s onto #145 a4dfd99

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…staller agents, examples, committed project settings) (#196)

* Run every Claude child at max effort under an Ultracode main loop

Set effort: max in the five shipped agent definitions
(adoption/agents/claude/*.md), keeping their task-matched models; the
one-line change keeps them byte-identical to agent-lab's .claude/agents
copies, which receive the same edit.

Commit a project .claude/settings.json (byte-identical to the portable
ultracode example and agent-lab's committed project settings) so
single-repository cloud sessions on this repository start with Ultracode.
It carries neither effortLevel (a max there is silently dropped) nor
CLAUDE_CODE_EFFORT_LEVEL (any value but xhigh disables Ultracode, and max
there overrides every child's effort).

Update the Ultracode recipe: every child role at max with its task-matched
model, the coordinator at Ultracode (xhigh plus orchestration), the measured
constraints (max disables orchestration, cannot be persisted, and the
environment variable overrides all child efforts), the per-stage rule
(agent() calls pass effort: 'max'; a stage without it inherits xhigh) and
GitHub/cloud-session guidance (claude-code-action has no effort input: use
claude_args '--effort ultracode' or settings {"ultracode":true}, never
'--effort max' beside Ultracode). Note the child-effort change in the
native profile recipe.

Record the decision with its probes, alternatives and overturn conditions
in docs/decisions/2026-09-23-max-effort-default.md, linked from the Claude
user profile decision, and rehash the two recipes in manifests/evidence.json.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Carry max effort through the examples, vendored lane and docs; fix the review findings

Rebased onto the current main (v2026.09.23.1 pinned by #148). The five
adoption/agents/claude definitions differ from that release, so
adoption/bootstrap.md now says they "changed after `v2026.09.23.1`", and
tests/test_adoption_docs_consistency.py treats what install_claude_profile.py
copies (the agent and hook directories, the MCP template) as install inputs,
matching a directory by its path, never its last component. The stale
v2026.09.23 notes are dropped from the bootstrap, platform, README and
next-host pages: the pinned release contains everything they described.

Examples: the four example agents and every agent() stage of
review-changes.js, readiness-audit.js and layer-verdict-lane.js bind effort
max with models unchanged; the three scripts are byte-identical to agent-lab
915e73e. The vendored lane now names blind-lane-reviewer, vendored beside it
and pinned under required_agents in vendored-lanes.json; SHA256SUMS,
vendored-lanes.json and two appended lane-provenance.json entries rebind the
new bytes. The contract suite pins max in ROUTING (which also clears the
routing failure the old vendored lane already had on main) and now rejects a
stage or agent at any other effort, a second effort line, MODEL drift, a
routing table that restates an agent differently, CLAUDE_CODE_EFFORT_LEVEL
or an effort cap in the settings, and instructions without the
`effort: 'max'` literal; of 24 new mutations, 22 fail on their named
assertion and two harmless edits do not.
examples/claude-native/CLAUDE.md takes the host's current worker sentence,
and AGENTS.md tells the coordinator to pass effort: 'max' on ad-hoc agent()
calls and to stay at xhigh.

Recipes and decision record: GitHub runs are non-interactive Agent SDK
runs whose Workflow launches go through normal permission evaluation;
autoContinueAtUsageLimit is no cost control and headless, SDK, GitHub and
background runs fail at a usage limit; the claude-code-action pin is "read
2026-09-23" without an input count; the action's one CI smoke is cited and no
Ultracode or effort run is claimed; /effort max is marked as not probed;
Q1/Q2 replace the confounded P3/P4/P7/P8 as the evidence that a persisted
max is dropped, and Q3 adds that a stage's effort wins over the frontmatter;
CLAUDE_CODE_EFFORT_LEVEL is never set. catalogs/foundation/decisions.json's
lean-workflow-child-routing activation names the max efforts and cites the
decision. A new test requires one "effort: max" frontmatter line in each
shipped agent.

Checks (raw): validate.py, validate_catalogs.py, evidence_manifest.py
--check, new_host_grand_list.py --check, build_ecosystem.py --check and
release_due.py --strict-if-repinned origin/main (exit 0, not strict: no
re-pin, nothing due) pass; the example suites pass as CI runs them
(sha256sum --check) and as their README runs them (envelope 207/207,
mutations 47/47, child-usage 16/16, usage-receipts 18/18, codex-envelope,
check-syntax); the named unittest modules and the related ones pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Run the example contract suites in CI; fix the settings-example, adopt-step and concurrency wording

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Sync source-scout (maxTurns 100, foreground acceptance) and isolated-builder from agent-lab #46 (a7a67a3e)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Rebase onto #145 and v2026.09.24.1: merge the secret guard into project settings, blind-adjudicator routing row, current agent-lab pins

- .claude/settings.json keeps main's secret-read deny rules and guard hook and adds
  the ultracode keys; the recipe and decision no longer call it byte-identical.
- bootstrap.md marks adoption/agents/claude and adoption/hooks/claude as changed after
  v2026.09.24.1; the lane test and lane files are #145's.
- child-usage mirror synced from agent-lab; examples routing table lists blind-adjudicator.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Resolve the rebase review: current pin in the record, finish the macOS #94 cleanup, sync example agents

- The decision record names v2026.09.24.1 and the settings file main added (#182).
- The macOS step 4 re-pin note and next-host-stages' 'as the macOS page marks' go,
  since #94 is in the pinned tag.
- The four example agents are byte-identical to agent-lab's again (source-scout
  maxTurns 100 and the foreground-acceptance sentence), as the recipe states.
- The install-input docstring and comment name the secret-path guard's SHA256SUMS coverage.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

…ory assistant capture opt-in, ignore Claude Code local state (#159)

* Adoption hygiene: native Claude Code pin is a floor (2.1.281), ai-memory assistant capture is opt-in, ignore Claude Code local state

bootstrap-macos.sh's install_native ran `"$bin" install <pin>` even when Claude Code's
native auto-updater had already installed something newer, so re-running the bootstrap
downgraded it. It now keeps a ~/.local/bin/<bin> whose --version is at or above the pin
(logs "Kept", downloads and installs nothing); a missing, older or unreadable launcher
takes the unchanged checksum-verified install. The check lives inside install_native
because tests/test_adoption_bootstrap.py runs that function on its own. Bash 3.2 safe.

Both claude-code pins move to 2.1.281 together (shared components keep one version on
both platforms). darwin-arm64 a922981f... comes from the official 2.1.281 manifest.json
and matches, byte for byte, the copy the native updater installed on a Mac. linux-x64
56fe3da8... comes from the same manifest and was not re-hashed; fetch() checks it before
running anything. 2.1.281 fixes a recursive rm of command-substitution output running
unprompted in auto and --dangerously-skip-permissions mode. The macOS page's pin table
and the generated new-host grand list follow the pins.

The Claude settings template no longer passes --capture-assistant to ai-memory's Stop
hook. render_config.py adds it only when AI_MEMORY_CAPTURE_ASSISTANT=true (host value
file or --set) and rejects any value other than true, false or empty. defaultMode and
skipDangerousModePermissionPrompt are unchanged.

.gitignore adds .claude/settings.local.json and .claude/worktrees/.

Not included, because open PRs #116, #145 and #151 own these files: the
manifests/evidence.json re-hash of the 12 changed files, and the adoption/bootstrap.md
"changed after `v2026.09.23.1`" marker for the three changed install inputs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-hash evidence and mark the Claude Code floor in the bootstrap guide

Records the SHA-256/byte entries for every file this branch changes and
adds the "changed after `v2026.09.23.1`" note that the docs-consistency
test requires for the new install behavior (pins 2.1.281, floor instead
of unconditional reinstall). Both files are also edited by open PRs;
whichever lands later re-runs the same host_receipts.register_file helper.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: Scout <scout@local>

…loor (stacked on #159) (#177)

* Adoption hygiene: native Claude Code pin is a floor (2.1.281), ai-memory assistant capture is opt-in, ignore Claude Code local state

bootstrap-macos.sh's install_native ran `"$bin" install <pin>` even when Claude Code's
native auto-updater had already installed something newer, so re-running the bootstrap
downgraded it. It now keeps a ~/.local/bin/<bin> whose --version is at or above the pin
(logs "Kept", downloads and installs nothing); a missing, older or unreadable launcher
takes the unchanged checksum-verified install. The check lives inside install_native
because tests/test_adoption_bootstrap.py runs that function on its own. Bash 3.2 safe.

Both claude-code pins move to 2.1.281 together (shared components keep one version on
both platforms). darwin-arm64 a922981f... comes from the official 2.1.281 manifest.json
and matches, byte for byte, the copy the native updater installed on a Mac. linux-x64
56fe3da8... comes from the same manifest and was not re-hashed; fetch() checks it before
running anything. 2.1.281 fixes a recursive rm of command-substitution output running
unprompted in auto and --dangerously-skip-permissions mode. The macOS page's pin table
and the generated new-host grand list follow the pins.

The Claude settings template no longer passes --capture-assistant to ai-memory's Stop
hook. render_config.py adds it only when AI_MEMORY_CAPTURE_ASSISTANT=true (host value
file or --set) and rejects any value other than true, false or empty. defaultMode and
skipDangerousModePermissionPrompt are unchanged.

.gitignore adds .claude/settings.local.json and .claude/worktrees/.

Not included, because open PRs #116, #145 and #151 own these files: the
manifests/evidence.json re-hash of the 12 changed files, and the adoption/bootstrap.md
"changed after `v2026.09.23.1`" marker for the three changed install inputs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-hash evidence and mark the Claude Code floor in the bootstrap guide

Records the SHA-256/byte entries for every file this branch changes and
adds the "changed after `v2026.09.23.1`" note that the docs-consistency
test requires for the new install behavior (pins 2.1.281, floor instead
of unconditional reinstall). Both files are also edited by open PRs;
whichever lands later re-runs the same host_receipts.register_file helper.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Keep a newer native Claude Code on Linux/WSL2: the pin is a floor there too

adoption/bootstrap-linux.sh's install_native ran `"$bin" install <pin>`
unconditionally, so on a Linux/WSL2 host whose native updater (latest channel)
was ahead of the pin, re-running the bootstrap moved Claude Code back to the
pin and dropped newer fixes. install_native is now the same function as
bootstrap-macos.sh's (#159): a ~/.local/bin/<bin> whose --version first word
is a dotted numeric version at or above the pin is kept (nothing downloaded
or installed; install_pin logs "Kept installed ..." instead of "Installed
..."); a missing, older, non-numeric or failing launcher takes the unchanged
checksum-verified install.

Tests: NativeInstallFloorTests in tests/test_adoption_bootstrap.py run the
verbatim fetch/install_native/install_pin against a one-pin fixture (curl
shimmed; a shasum-backed sha256sum shim only where GNU --check --status is
missing), plus an identity check that both scripts share one install_native.

Docs: the Linux claude-code install_note describes the floor; bootstrap.md
step 2's stale "Linux/WSL2's script and pins are the same at v2026.09.23 as
on main" now says what differs at that tag; the claude-code floor notes on
bootstrap.md, linux-wsl2.md and macos-arm64.md name the currently pinned
release v2026.09.24.1 (#171), which the docs-consistency test requires.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* linux-wsl2.md: keep the changed-after marker on one line (docs-consistency)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: Scout <scout@local>

The command center's correction #145 found the host account name, inside
absolute home paths, in eleven public PR bodies and comments. The required
sota-sources job (both byte-identical copies) now also checks the current PR
body against scripts/validate.py's home-path and credential rules, written in
JavaScript, and fails closed naming only the rule ids. ~/, <user> and the
example home pass. A test runs every rule against its Python original on a
shared corpus; the new tests fail on the job before this change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The command center's correction #145 found the host account name, inside
absolute home paths, in eleven public PR bodies and comments. The required
sota-sources job (both byte-identical copies) now also checks the current PR
body against scripts/validate.py's home-path and credential rules, written in
JavaScript, and fails closed naming only the rule ids. ~/, <user> and the
example home pass. A test runs every rule against its Python original on a
shared corpus; the new tests fail on the job before this change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>