Record NativeStack workstation acceptance and retained failures - #160

…20260925 (#262)

* Record 31 host receipts on nativestack-5975wx-20260925 (component-stages only the 09-24 record held)

The 2026-09-24 NativeStack record (#160) held 66 receipts under a second host
id for this machine; #231's canonical record held 21. The component-stages
only #160 proved are re-recorded fresh on current pins under the canonical
host id, by host_receipts.py record: 8 observability/recovery, 10 tools,
6 trading-lane libraries, 7 clients and scanners. Recovery stages ran on
owned instances only; use stages meet the four review points (layer role,
positive control, backed claims, winner binding). 16 historical pairs were
not re-recorded, each for a stated reason (no landscape winner to bind,
unpinned catalog pin, already on main, or Codex usage-limited until
2026-09-30). The vllm install receipt waits for the 0.30.0 pin.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keep the 26 independently agreed receipts; drop five for re-recording from a published commit

Independent headless review sessions agreed on 26 receipts. Five are
withdrawn before publication: mcp-inspector, poppler, serena and lean were
re-recorded on an unpublished local commit (catalog_revision not on GitHub),
and claude-code use shows none of the workers layer's job. They will be
re-recorded from a published origin/main commit and reviewed again.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

…uard's other gaps

Answers the command center's Claude micro of #1001 at ef3f3e7 (P2-1, P3-1 to P3-5) and Codex's four threads of the same head (:43, :63, :122, :211). Each case was reproduced before the change:
compare-guards-ef3f3e7b-vs-third-commit.txt runs 19 scenarios through the guard of ef3f3e7 and this one; the old guard is wrong on 13 (it accepts a retired route that is reintroduced), this one on none.
- P2-1 (correction #160): joining wrapped lines into one paragraph let "Retired 2026-10-10" followed by a line that says the current default is claude-code-action pass on four prose surfaces (SKILL.md, slots.md,
  cross-client.md, layer-page preambles), the scenario Codex raised at ba6ab3a line 41. Prose is judged one physical line at a time again, a line break ends a unit, and the message of every line-judged surface
  states the rule (RULE; the legend of slots.md states it too and a test pins the two to each other).
- P3-1 and Codex :43: three more names of the same route, all in the vendor's own text: the page's title "Claude Code GitHub Actions" and its "installs the Claude GitHub App"
  (code.claude.com/docs/en/github-actions.md, capture sha256 87b99aef, lines 5, 9, 33, 63-64), the mirror claude-code-base-action (anthropics/claude-code-action@2dca132ff0e0:
  .github/scripts/check_workflow_hardening.py:18, .github/workflows/sync-base-action.yml:1 and 43, CLAUDE.md:20) and the carrier named first ("Use the GitHub Action for Claude reviews", generic
  like "in Actions": it counts when the field or unit is about Claude). The families "in Actions" and "through Actions" take on, with, inside and via.
- Codex :122 and the command center's P3-3 and P3-5: a unit that negates the retirement outright ("not retired", "never retired", "no longer retired", "isn't retired", "unretired") no longer counts as saying
  retired. The other half of that scenario, "was retired, but is now current", is the boundary the command center ruled (the guard is a tripwire for stale text; review reads what it accepts); the module names it.
- Codex :211 and P3-3: a layer-page section with a label twice (a second Route or Overturn when bullet) is a violation, because the page-to-slots.json comparison keeps the first bullet only.
- Codex :63 and P3-4: the target of every slots.md row is checked against <page>#<id>, from the layer of the slot.
- The description line of SKILL.md names the topic that invokes the skill; it is pinned by sha256 to the text the routing was measured with and read as a topic, not as a route.
- Scheduled-tasks (Codex on #1005, scheduling-supervision.md:9, and the command center's ruling): the route no longer bans every model-backed job. The retirement record
  (docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) retires Claude review inside GitHub and keeps Codex's GitHub review, so the route says GitHub Actions schedules repository jobs and a
  scheduled Claude task runs locally; a test pins the wording on slots.json, the layer page and the alternatives.
The label of claude-native-slot-manifest.json equals the sha256 of the shipped slots.json again (relabel last); test_the_label_names_the_shipped_slots_file and test_no_other_exported_field_differs
(no skip) are unchanged from ef3f3e7. 72 of 72 single-edit mutants of the guard and its data are caught and 5 controls pass (mutations-v4-forward-commit-3.md).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ew (#1001)

* Retire the skill's Claude-in-GitHub rows and point them to local review

The claude-native-practice skill still selected the route that
docs/decisions/2026-10-10-retire-in-github-claude-review.md retired:
the github-action row (anthropics/claude-code-action at a pin) and the
Actions part of pr-review-pre-cue.

- slots.json, slots.md and the layer pages: `retired` joins the status
  vocabulary; github-action becomes retired with a dated block (record,
  correction #141, scope, the three workflows, the former default, route,
  alternatives, evidence and notes as a snapshot, the revisit triggers);
  pr-review-pre-cue becomes default (scoped) and lists the routes
  available now (local Claude reads, GPT reads, Codex's GitHub review,
  the required verdict-review-gate) apart from the open #953 worker.
- The scope is the owner's repositories (the command center's ruling of
  2026-10-10), not "this repository": a hermetic A/B showed a session in
  another repository concluding that the action was still fine there.
  The same ruling retires the managed Claude Code Review GitHub App.
- Stale texts the independent pre-read and the stricter check found: the
  release-tracking note (Dependabot as the action's tracker), the
  scheduled-tasks route (GitHub Actions schedules only for jobs that run
  no model) and its source mapping, the usage-cost-monitoring note
  (Actions under WIF), and the pre-cue source mapping (in Actions through
  #909). The pre-cue route no longer lists a read the record does not name.
- tests/test_native_practice_retired_routes.py: no current row selects a
  retired route; a retired route is named elsewhere only in a sentence or
  list item that says it is retired; every line of slots.json, slots.md,
  the layer pages and cross-client.md is read (duplicates kept, the source
  mappings of live slots included); only the dated snapshots are exempt.
  Positive controls are the rows as they stood; the mutation table is in
  the pull request description.
- The slot manifest of #923 is relabeled against the new slots.json
  bytes, so the exact-difference check of the provenance test runs again
  instead of skipping.
- docs/decisions/2026-10-09-claude-code-native-practice.md: a dated
  pointer to the retirement, as #981 did for the older records.

Source read for this change: anthropics/claude-code-action at
2dca132ff0e0c4094ce6048b422c6915a071210b, base-action/src/
parse-sdk-options.ts:283-284 (CLAUDE_CODE_ENTRYPOINT is set to
claude-code-github-action).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Close the holes in the retirement guard and qualify the one-default rule for retired slots

Answers the Codex review in GitHub of #1001 at ba6ab3a (four P2s) and the co-op's GPT first read at the same head (three P2s, the first three below); each was reproduced before the change.
- Sentence units split at a full stop or a semicolon whatever follows, and at a line break: "This route was retired; the current default is claude-code-action." was one unit that said retired.
- The generic phrases "in Actions", "through Actions" and "under WIF" count as the retired route only with Claude context, judged per leaf string; the named workflows, "through #909" and the managed app count
  everywhere. The routes the decision retains (every bullet of its "What remains" section, a catalog job in GitHub Actions, a non-model gate under WIF) are accepted.
- The skill's entry point SKILL.md is scanned, and a test requires every file of the skill folder to be read by a check.
- The one-default rule names the retired exception in slots.json, in the slots.md copy and in step 3 of SKILL.md (a retired row has none and says what replaced the route).
- The ruled default text is pinned exactly (the read's measured boundary: the date changed on all three surfaces passed), and a check compares every row's Overturn when across slots.json, the index and the
  layer pages (one step wider than the review of #1005, where an edit left the index cell behind).
Each finding fails its own test when its fix is undone alone, and 43 single-edit mutations are caught; the old guard accepts the four bad scenarios of the read and rejects its two legitimate ones.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Bind the manifest label to the shipped slots file and close the remaining holes of the retirement guard

Answers the CC's Claude first read of #1001 at 6e97620 (two P2s, six P3s) and Codex's second review in GitHub of the same head (two P2 threads); each was reproduced before the change.
- P2-1: the slot manifest was labeled against the slots.json of ba6ab3a, so the exact-difference check of the provenance test skipped at the head (OK, skipped=1). The label is the sha256 of the shipped file again,
  the check no longer skips, and a new test fails when a change to slots.json does not carry its label (the CC's ruling: a silent skip is this defect's class, so it fails loud).
- P2-2: a live source mapping (skills-library, primary_sources[5]) still ran `claude -p` "in a GitHub workflow ... plus a nightly cron"; the guard had no such form. It is reworded to say the run is retired,
  and "in a GitHub workflow" (also from, via, through, using, as) counts as the retired route when the sentence is about Claude.
- P3-1: the Claude Code GitHub Action, /install-github-app and an @claude mention are the retired route under other names (claude-code-security-review stays out: a documented rejection).
- P3-4: the Former default exemption of a layer page applies to a retired slot only.
- P3-5: a retired slot's own source mapping is read, and now says retired.
- P3-2: "e.g." and "i.e." no longer end a sentence, and wrapped lines of prose are one paragraph (the slots.md prose and SKILL.md were judged line by line).
- P3-6: the manifest prose lists the fields beyond the exported ones that differ from the snapshot.
- P3-7: the entry point directs ("a retired row has no default, so follow the replacement it names"), and the step-3 pin no longer fails with an IndexError on a renumbering.
Each correction fails its own test when it is undone alone, and the mutation table is extended.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Judge retired-route prose one physical line at a time and close the guard's other gaps

Answers the command center's Claude micro of #1001 at ef3f3e7 (P2-1, P3-1 to P3-5) and Codex's four threads of the same head (:43, :63, :122, :211). Each case was reproduced before the change:
compare-guards-ef3f3e7b-vs-third-commit.txt runs 19 scenarios through the guard of ef3f3e7 and this one; the old guard is wrong on 13 (it accepts a retired route that is reintroduced), this one on none.
- P2-1 (correction #160): joining wrapped lines into one paragraph let "Retired 2026-10-10" followed by a line that says the current default is claude-code-action pass on four prose surfaces (SKILL.md, slots.md,
  cross-client.md, layer-page preambles), the scenario Codex raised at ba6ab3a line 41. Prose is judged one physical line at a time again, a line break ends a unit, and the message of every line-judged surface
  states the rule (RULE; the legend of slots.md states it too and a test pins the two to each other).
- P3-1 and Codex :43: three more names of the same route, all in the vendor's own text: the page's title "Claude Code GitHub Actions" and its "installs the Claude GitHub App"
  (code.claude.com/docs/en/github-actions.md, capture sha256 87b99aef, lines 5, 9, 33, 63-64), the mirror claude-code-base-action (anthropics/claude-code-action@2dca132ff0e0:
  .github/scripts/check_workflow_hardening.py:18, .github/workflows/sync-base-action.yml:1 and 43, CLAUDE.md:20) and the carrier named first ("Use the GitHub Action for Claude reviews", generic
  like "in Actions": it counts when the field or unit is about Claude). The families "in Actions" and "through Actions" take on, with, inside and via.
- Codex :122 and the command center's P3-3 and P3-5: a unit that negates the retirement outright ("not retired", "never retired", "no longer retired", "isn't retired", "unretired") no longer counts as saying
  retired. The other half of that scenario, "was retired, but is now current", is the boundary the command center ruled (the guard is a tripwire for stale text; review reads what it accepts); the module names it.
- Codex :211 and P3-3: a layer-page section with a label twice (a second Route or Overturn when bullet) is a violation, because the page-to-slots.json comparison keeps the first bullet only.
- Codex :63 and P3-4: the target of every slots.md row is checked against <page>#<id>, from the layer of the slot.
- The description line of SKILL.md names the topic that invokes the skill; it is pinned by sha256 to the text the routing was measured with and read as a topic, not as a route.
- Scheduled-tasks (Codex on #1005, scheduling-supervision.md:9, and the command center's ruling): the route no longer bans every model-backed job. The retirement record
  (docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) retires Claude review inside GitHub and keeps Codex's GitHub review, so the route says GitHub Actions schedules repository jobs and a
  scheduled Claude task runs locally; a test pins the wording on slots.json, the layer page and the alternatives.
The label of claude-native-slot-manifest.json equals the sha256 of the shipped slots.json again (relabel last); test_the_label_names_the_shipped_slots_file and test_no_other_exported_field_differs
(no skip) are unchanged from ef3f3e7. 72 of 72 single-edit mutants of the guard and its data are caught and 5 controls pass (mutations-v4-forward-commit-3.md).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Align the manifest's scheduled-tasks note, state the rule in every explaining unit, split units after a closing delimiter and pin the scope of the name patterns

The final fix round of #1001 under the command center's convergence ruling: its Claude micro at efaa077 (blockers B1 to B3, P3-2) and its adjudication of 2026-10-11T13:50Z of Codex's third review. Each item was reproduced on that
head before the change.
- claude-native-slot-manifest.json:47 (Codex P2, B1, a text of this PR that is false at the head): the note on the differences from the snapshot still said the route of scheduled-tasks was narrowed "to jobs that run no model",
  while the shipped route says that GitHub Actions schedules repository jobs, that Claude runs inside GitHub are retired (2026-10-10, docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) and that a scheduled
  Claude task runs locally. The note says so now, and test_the_scheduled_tasks_route_retires_the_claude_routes_and_not_every_model_backed_job reads the manifest as well as the route (fails with the note undone: M79).
- B2: the module claims that the message of every line-judged surface states the rule, and it did not for the labelled bullets of a layer page or for the Overturn when cell of an index row. Every explaining unit states it now
  (a selecting field names no unit and states nothing); the three expected messages carry the rule and test_every_explaining_unit_of_a_layer_page_and_of_the_index_states_the_rule_and_a_selecting_field_does_not pins all three
  kinds (mutants M83 to M85).
- tests/test_native_practice_retired_routes.py:83 (Codex P2, P3-2): a closing quote, parenthesis or bracket between the full stop and the white space kept `The route was "retired." The current default is claude-code-action.` in one
  unit that said retired. The sentence pattern takes closing delimiters (the curly quotes are built with chr(), so the file stays ASCII); test_a_closing_quote_parenthesis_or_bracket_after_the_full_stop_does_not_join_two_claims fails
  without it (M78, M82) and keeps `claude-code-action was retired (see the record.) No row selects it.` accepted (control C6).
- :48 (Codex P2, workflow-first phrasing) is a follow-up and the class closes (rule 4 of the convergence ruling): the module states that the guard pins the named retired artifacts and the retired slot rows, that generic phrasing of a
  Claude run in a GitHub workflow cannot be enumerated and is out of its scope (the retirement record governs it), and test_generic_workflow_phrasing_is_out_of_scope_and_the_module_says_so pins the boundary. No pattern is added.
- B3 is the description: the two earlier command blocks name the 37 modules they ran (the 46 of the first block without the nine tests.test_local_pages_* modules).
80 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v6.py).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Close the sentence-splitter class by documentation, pin the module's ASCII and the scope list

The command center's confirmation micro of #1001 at bdf60fc (research-cc-role-20261008/pr1001-claude-micro-bdf60fc6.md: blockers 1 and 2, P3s) and its correction #163 of 2026-10-11T16:18Z on Codex's three threads of 15:39:21Z.
No code of the guard changes in this commit.
- Blocker 2: the module said that it stays ASCII and held one U+2026 in a comment (added by efaa077). It is three full stops now, and test_the_source_of_this_module_is_printable_ascii pins the claim; it fails on the module
  of bdf60fc (['U+2026'] != []).
- Blocker 1 (the pull request description, and this message corrects the message of bdf60fc): the earlier statement that the 37 modules ran "without its nine tests.test_local_pages_* modules" was false. They are the first 37
  modules of the 46-module list, and the nine left out are its last nine (tests.test_local_pages_fleet_execution to tests.test_local_pages_workstation, 144 tests, run and counted); 29 of the 46 are local-pages modules.
- Codex :92 (an exclamation mark or a question mark does not end a unit) is not patched: the sentence splitter has drawn findings in five consecutive rounds (the lowercase clause, "e.g.", the joined lines, the closers,
  the exclamation mark and the question mark) and was patched four times, so rule 4 of the convergence ruling closes the class the way line 48 closed. The module docstring states exactly what the guard accepts as a unit end
  and that review reads everything else; test_the_unit_ends_and_the_scope_of_the_name_patterns_are_documented pins the sentence and the behavior, and fails on the module of bdf60fc, where the sentence is missing.
  A pinned upstream sentence segmenter is a research-queue item (rule 8, layer instructions-skills).
- Codex :51 (a carrier-first name of the managed Code Review app) is confirmed within the closed class: the same scope paragraph says that reordered phrasings of a pinned artifact are out of the guard's scope.
- P3-1: the scope list named 11 of the 17 patterns; it names all 17 now, and test_the_scope_of_the_name_patterns_names_every_pattern compares the list itself with PATTERNS (it fails on the module of bdf60fc).
  P3-2: the right single quotation mark closer is tested (its mutant survived). P3-3: the comment at the sentence pattern says what the code does.
- Codex :170 (retired.on is checked for its shape only) is a follow-up under rule 5: the shipped value is the date of the record, so 2099-12-31 is a mutant and not a reproduced failure of the shipped state.
88 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v9.py).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>