2026-09-24 community sweep: effort-guard SessionStart notice, working plugin-install commands, dated dispositions - #161

Resolves the manifests/evidence.json conflict with #161 by regenerating the
adoption/bootstrap.md entry through scripts/host_receipts.py register_file().

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…t as UTF-8; document the no-git pin and the re-pin update

Independent review of 2a15a14 (Opus lens, each medium finding reproduced by a
verifier); F1 (manifest), F6 (modes) and most of F2 were already in c45bd06:

- F2: files named only by a referenced install guide (a Markdown file under
  adoption/ or recipes/) were missed, e.g. adoption/tools/gitleaks-guarded
  (installed per adoption/tools/README.md) and recipes/claude-native-profile.md.
  Such guides are now followed one more hop. At main vs v2026.09.23.1: 160
  new-machine files, 22 changed; due lists the #161 evidence file that
  recipes/README.md links and v2026.09.23.1 lacks.
- F4: git() decoded output with the locale codec, so README's Start here section
  (em dashes) crashed under LC_ALL=C PYTHONUTF8=0. It now decodes UTF-8.
- F5: the fixture's bootstrap.md names adoption/manifest.json and links
  manifests/evidence.json, as the real one does, so an empty DRIFT_EXEMPT now
  fails 8 of the 10 drift tests.
- F7: bootstrap.md's no-git path says how to read the pin without a clone
  (gh api raw contents, run as documented: v2026.09.23.1 40828df...) and that
  verify-asset and attestation verify need a signed-in gh.
- F3: update.md tells the release owner to update the re-pin branch from main
  right before merging: the main ruleset does not require an up-to-date branch
  and the post-merge push run of validate.yml is not strict. A structural fix
  (a strict ruleset or a push-mode base) is left for a follow-up.

New tests: a file named only by an install guide; a non-ASCII Start here read
under LC_ALL=C PYTHONUTF8=0; each fails on the previous version. Full suite
3671 OK; every validate.yml validator exits 0.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…-level directory

Codex review of 0879839 (P2):

- A new-host guide that links a directory (adoption/templates/,
  adoption/agents/claude/, examples/) contributed nothing, because repo_file()
  rejects directories. A linked directory now contributes its tracked files
  (evidence/ excepted: records, not install inputs).
- Bare paths were recognized only under a fixed list of top-level directories,
  so recipes/README.md's fixtures/before.py, fixtures/after.py and similar inputs
  were missed. Any repository-relative token with a directory part now counts
  when it names a file here; a URL never matches.

At main vs v2026.09.23.1: 240 new-machine files, 23 changed, 1 due (#161's
evidence file). New fixture test; it fails on 0879839.

Not in this PR (tracked as a follow-up): extending the pinned release's
self-consistency test to this discovery. A trial showed guide prose naming
another repository's file (agent-lab's docs/native-token-workflow.md) and JSON
method names in fenced blocks (tools/call) read as missing paths, so it needs a
reference form that is precise at a commit without the files present.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ent drift in release_due; run step 6 under Python 3.13 (#163)

* Bind the no-git archive check to the release; report new-machine content drift in release_due

Readiness sweep of v2026.09.23.1 (2026-09-24), both reproduced:

- adoption/bootstrap.md's no-git archive check ran `gh attestation verify` with
  only --repo and --signer-workflow. It exited 0 for the attested archive of
  unreleased commit 41d39b3 (workflow_dispatch run 35803145596) saved under the
  v2026.09.23.1 file name. The step now downloads the file from the GitHub
  Release, runs `gh release verify-asset`, and binds the attestation with
  --source-ref refs/tags/<release_tag> --source-digest <release_commit>, as
  adoption/update.md, SECURITY.md and docs/catalog-provenance.md already did.
  With the flags the substitute exits 1 ("expected SourceRepositoryDigest");
  the genuine release asset exits 0 on all three commands.
- scripts/release_due.py only tested whether documented paths exist, so it
  printed "current" while ten new-machine files differed from the release
  (the shipped effort guard, bootstrap.md, recipes/README.md ...). It now also
  lists `changed`: new-host documents, platform pages, README's Start here
  section and every path they reference whose content differs from the
  release (adoption/manifest.json and manifests/evidence.json, which a re-pin
  always changes, are not compared). Status "content_changed" when only
  content differs; --strict and a re-pin under --strict-if-repinned fail on
  either list.

Tests: a throwaway-repository fixture for the drift report (five cases) and a
docs-consistency check that every documented attestation check of the
catalog's publication binds --source-digest, with bootstrap.md also binding
the tag and running verify-asset. Reverting bootstrap.md fails 2 of the 3 new
docs tests; the previous release_due fails all 5 drift tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Run the step-6 prerequisite report under the manifest's Python 3.13

adoption/manifest.json supports Python 3.13 only. On Ubuntu 24.04, plain
`python3` is 3.12, so `python3 scripts/adoption_status.py --profile
foundation-cpu --json` reported prerequisites_missing and exited 2 (reproduced
on this host: 3.12.3, exit 2). `uv run --no-project --python 3.13 python ...`,
the form adoption/README.md already documents, reported prerequisites_present
and exited 0. Found by the 2026-09-24 readiness critic (agent-lab-87).

Switches bootstrap.md step 6, the Linux and macOS pages, update.md's move step
and README's Start here to that form. uv is a Linux step-1 prerequisite and is
installed by the macOS bootstrap before this step. CI already installs 3.13
before its own status step (tests/test_adoption_bootstrap.py).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* release_due: extensionless and linked files, modes and kinds, the manifest's non-pin fields, new pages as due

Codex review of 2a15a14 (four P2 findings, each reproduced by a new test that
fails on the previous version):

- Candidates came only from PATH_RE's extension list, so the bounded runner
  (adoption/tools/ecosystem-bounded-run) and adoption/hooks/claude/SHA256SUMS
  never took part although both differ from v2026.09.23.1. New-machine files
  now also include relative Markdown link targets (resolved against the
  document) and bare repository paths that name a file.
- Only blob ids were compared. Entries now compare (mode, object kind, object
  id) from main's HEAD tree against the release, so a chmod-only change or a
  file replaced by a symlink with the same bytes is drift, as it is in the
  git archive the release ships.
- adoption/manifest.json was exempt as a whole. It is now compared without
  source.release_tag, source.release_commit and updated_at, so a profile,
  command or default_profile change is drift; a re-pin alone is not.
- A new-host document or platform page absent from the release was silently
  skipped. It is now due.

At main vs v2026.09.23.1: 95 new-machine files; 17 changed, including the
bounded runner, the hook checksums and docs/token-session-handbook.md; none
due. Full suite 3669 OK; every validate.yml validator exits 0.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* release_due: follow referenced install guides one hop, read git output as UTF-8; document the no-git pin and the re-pin update

Independent review of 2a15a14 (Opus lens, each medium finding reproduced by a
verifier); F1 (manifest), F6 (modes) and most of F2 were already in c45bd06:

- F2: files named only by a referenced install guide (a Markdown file under
  adoption/ or recipes/) were missed, e.g. adoption/tools/gitleaks-guarded
  (installed per adoption/tools/README.md) and recipes/claude-native-profile.md.
  Such guides are now followed one more hop. At main vs v2026.09.23.1: 160
  new-machine files, 22 changed; due lists the #161 evidence file that
  recipes/README.md links and v2026.09.23.1 lacks.
- F4: git() decoded output with the locale codec, so README's Start here section
  (em dashes) crashed under LC_ALL=C PYTHONUTF8=0. It now decodes UTF-8.
- F5: the fixture's bootstrap.md names adoption/manifest.json and links
  manifests/evidence.json, as the real one does, so an empty DRIFT_EXEMPT now
  fails 8 of the 10 drift tests.
- F7: bootstrap.md's no-git path says how to read the pin without a clone
  (gh api raw contents, run as documented: v2026.09.23.1 40828df...) and that
  verify-asset and attestation verify need a signed-in gh.
- F3: update.md tells the release owner to update the re-pin branch from main
  right before merging: the main ruleset does not require an up-to-date branch
  and the post-merge push run of validate.yml is not strict. A structural fix
  (a strict ruleset or a push-mode base) is left for a follow-up.

New tests: a file named only by an install guide; a non-ASCII Start here read
under LC_ALL=C PYTHONUTF8=0; each fails on the previous version. Full suite
3671 OK; every validate.yml validator exits 0.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Follow nested install guides, scope the attestation check to every tracked guide, mark step 6 as changed after v2026.09.23.1

Codex re-review of c45bd06/5ef8eaf (three P2 findings):

- release_due follows referenced install guides (Markdown under adoption/ or
  recipes/) to closure with a visited set, not one hop, so a file named only by a
  guide that another guide names (bootstrap.md -> tools/README.md -> ...) is
  compared (new fixture test; fails on 5ef8eaf).
- CatalogAttestationBindingTests reads every tracked Markdown file outside the
  dated-record directories instead of a fixed list, so docs/github-automation.md's
  publication check is covered; removing its --source-digest now fails the test.
- bootstrap.md step 6 and both platform pages mark the Python 3.13 status command
  "changed after `v2026.09.23.1`" (that release's step runs plain python3) and say
  to run this form on a checkout of that release too.

Full suite 3672 OK; every validate.yml validator exits 0.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* release_due: expand linked directories, recognize paths under any top-level directory

Codex review of 0879839 (P2):

- A new-host guide that links a directory (adoption/templates/,
  adoption/agents/claude/, examples/) contributed nothing, because repo_file()
  rejects directories. A linked directory now contributes its tracked files
  (evidence/ excepted: records, not install inputs).
- Bare paths were recognized only under a fixed list of top-level directories,
  so recipes/README.md's fixtures/before.py, fixtures/after.py and similar inputs
  were missed. Any repository-relative token with a directory part now counts
  when it names a file here; a URL never matches.

At main vs v2026.09.23.1: 240 new-machine files, 23 changed, 1 due (#161's
evidence file). New fixture test; it fails on 0879839.

Not in this PR (tracked as a follow-up): extending the pinned release's
self-consistency test to this discovery. A trial showed guide prose naming
another repository's file (agent-lab's docs/native-token-workflow.md) and JSON
method names in fenced blocks (tools/call) read as missing paths, so it needs a
reference form that is precise at a commit without the files present.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

* Point new machines at the attested release v2026.09.24.1

v2026.09.24.1 (tag object ec94e8a -> 81385fe) carries the working
plugin-install commands (#161), the guarded-job CPU cap (#158) and the
release-bound no-git archive check with release_due content-drift
reporting (#163). release_due --strict reports current.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Set the manifest's updated_at to the re-pin date (Codex review)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

…rd in pre-push (#1010 round 1)

B1 (CC adjudication of #1010 round 1): catalogs/north-star/readiness.json still pinned the pre-change sha256 of the three qualification receipts this PR re-pins, in 15 places. Each receipt had five: the repo:<receipt>@<digest> key, that entry's sha256 and expected_sha256, and two nested receipt objects. Rebuilt from the new bytes and a guessed name, each old receipt matched its pin, which is the second-order oracle of correction #161. Each pin now names the receipt's current sha256:
- markitdown-018: d9a1a348 -> 74d066a1;
- mcporter-0141: 5379b1e3 -> 9b69956e;
- rtk-050: 9de293b6 -> b47326a1.
Byte counts are unchanged. tools/north-star/build_readiness.py --write was not used, because it would also fold in readiness drift that predates this PR.

tests/test_published_digest_privacy.py:
- ReadinessPinTests needs no names. Every readiness binding of a receipt changed since the merge base with origin/main must hash that receipt's current bytes. It fails at 7a03593 (15 stale pins) and passes after.
- The guard is now enforced. scripts/git-hooks/pre-push runs it on each pushed tip with PUBLISHED_DIGEST_GUARD_HOST_NAMES=1, so the names come from scripts/host_name_scan.py host_names(), the runtime source of #934's scan (docs/decisions/2026-10-09-host-name-scan.md); NATIVE_AGENT_HOST_NAMES_JSON replaces them in fixtures. The hook's runner refuses a skip, and an unavailable source errors. CI keeps the name-free tests.
- The legacy check is one-directional, so it works in a clone whose names differ. An unlisted site fails. A listed site the names do not reproduce is reported only as a count. test_the_frozen_list_only_shrinks still fails, without names, once a listed digest is gone from its file.
- The mask set adds the repository's existing markers <user-home>, <SCRATCH_HOME>, %USERPROFILE% (as C:\Users\<name>, C:/Users/<name> or /mnt/c/Users/<name>), <WSL_USER> and <hostname>. Every subset of up to four present masks is tried; beyond four, all of them or one at a time.
  - Measured with LANDING_PROHIBITED_NAMES (3 names) and with host_names() (5 names), the guard finds exactly the 106 listed sites both times. There is no new site, so the list and LEGACY_COUNT are unchanged.
- Caching texts and resolved paths halves the whole-tree walk, from 24 s to 11 s with 3 names.

tests/test_pre_push_gate.py overlays the guard module on the fixture tip, as it does the scanner sources. A clean push runs the guard once. A committed receipt whose output_sha256 hashes its excerpt with the fixture home put back is refused without echoing the name.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ence, blueprints and manifests (#1010)

* Re-derive 10 published digests that hashed unmasked bytes, and guard evidence, blueprints and manifests

Correction #161: the 2026-10-11 masked-digest audit of main at 7b76a88 found 8 sha256 values under evidence/artifacts that hash bytes from before sanitization. Its residual list found 2 more under blueprints. Each sits beside a copy in which the home directory is replaced by ~ or the user name by <user>. Anyone could put a guessed value back, hash the result and confirm the guess offline.

Each value is now the sha256 of the published bytes. That is the basis scripts/host_receipts.py record has used for output_sha256 since #492 (scripts/host_receipts.py:1012-1029 at 7b76a88).

- sota-refresh-20260925 markitdown (2), mcporter (3) and rtk (1) results.json: files[].run_copy_sha256 is now the sha256 of the committed file, the same value as the entry's sha256. byte_identical_to_run_copy stays false. Each record gets a corrections entry; mcporter had no list, so one is added.
- The withdrawn nemotron vLLM use receipt -2: commands[1] and commands[4] output_sha256 are now the sha256 of output_excerpt (UTF-8), and its README records the change. This removes no oracle, because 4 registered evidence/hosts receipts keep the same digests (commands[1]'s in 4, commands[4]'s in 3).
- blueprints/retrieval-quality-v2/review-293-repro-20260926.json: inputs.files[0].as_run_sha256 is now the committed driver's sha256. A corrections entry in the record's own shape records the change.
- The withdrawn byterover-cli install receipt: commands[0].output_sha256 is now the excerpt digest. retained-outputs.json, the byterover-cli README and the trials README record the exception to "kept byte-for-byte".

The sha256 of a file before this change would confirm a guess the same way: rebuild the old file from a guess, hash it and compare. Every digest of an old file is therefore re-pinned or dropped:
- the three evidence/receipts qualification receipts re-pin results.json in provenance[], as #314 did;
- retained-outputs.json gives the new receipt bytes for both private_original and published;
- the review-293 correction records no as_recorded_sha256;
- manifests/evidence.json re-registers the 13 files through host_receipts.register_file.

tests/test_published_digest_privacy.py walks every JSON file under evidence/, blueprints/ and manifests/. It flags a 64-hex digest that hashes none of the published texts or files in its own or enclosing object, but does hash one of them once a home directory or name is put back. The masks are ~, <home>, <HOME>, <host-home>, $HOME, ${HOME}, <user>, <USER> and $USER, under /home/<name> and /Users/<name>. Names come from LANDING_PROHIBITED_NAMES. Without them, as in CI, that check skips.

LEGACY_SITES freezes the 106 remaining sites by path, key and 8-hex prefix, with a count assertion:
- 96 output_sha256 values in evidence/hosts receipts recorded before 2026-09-29, append-only since #492;
- 10 that the audit's probe could not reach, because it put back only ~ and <user> and read only files named in the digest's own object.

A new site fails. A listed site that is gone also fails until it is removed, so the list only shrinks. Two checks run in CI too: every listed site is still present, and the 10 fixed sites hash the published bytes.

Fail-before: on the 7b76a88 tree, the guard reports exactly the 10 fixed sites and the fixed-site check fails 10 subtests, with or without names. After this change, all 11 tests pass, or 10 pass and 1 skips without names.

Not changed: git history keeps the old digests. No rewrite is proposed, because the exposure is a home directory or account name, not a credential.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-pin readiness to the re-pinned receipts and enforce the digest guard in pre-push (#1010 round 1)

B1 (CC adjudication of #1010 round 1): catalogs/north-star/readiness.json still pinned the pre-change sha256 of the three qualification receipts this PR re-pins, in 15 places. Each receipt had five: the repo:<receipt>@<digest> key, that entry's sha256 and expected_sha256, and two nested receipt objects. Rebuilt from the new bytes and a guessed name, each old receipt matched its pin, which is the second-order oracle of correction #161. Each pin now names the receipt's current sha256:
- markitdown-018: d9a1a348 -> 74d066a1;
- mcporter-0141: 5379b1e3 -> 9b69956e;
- rtk-050: 9de293b6 -> b47326a1.
Byte counts are unchanged. tools/north-star/build_readiness.py --write was not used, because it would also fold in readiness drift that predates this PR.

tests/test_published_digest_privacy.py:
- ReadinessPinTests needs no names. Every readiness binding of a receipt changed since the merge base with origin/main must hash that receipt's current bytes. It fails at 7a03593 (15 stale pins) and passes after.
- The guard is now enforced. scripts/git-hooks/pre-push runs it on each pushed tip with PUBLISHED_DIGEST_GUARD_HOST_NAMES=1, so the names come from scripts/host_name_scan.py host_names(), the runtime source of #934's scan (docs/decisions/2026-10-09-host-name-scan.md); NATIVE_AGENT_HOST_NAMES_JSON replaces them in fixtures. The hook's runner refuses a skip, and an unavailable source errors. CI keeps the name-free tests.
- The legacy check is one-directional, so it works in a clone whose names differ. An unlisted site fails. A listed site the names do not reproduce is reported only as a count. test_the_frozen_list_only_shrinks still fails, without names, once a listed digest is gone from its file.
- The mask set adds the repository's existing markers <user-home>, <SCRATCH_HOME>, %USERPROFILE% (as C:\Users\<name>, C:/Users/<name> or /mnt/c/Users/<name>), <WSL_USER> and <hostname>. Every subset of up to four present masks is tried; beyond four, all of them or one at a time.
  - Measured with LANDING_PROHIBITED_NAMES (3 names) and with host_names() (5 names), the guard finds exactly the 106 listed sites both times. There is no new site, so the list and LEGACY_COUNT are unchanged.
- Caching texts and resolved paths halves the whole-tree walk, from 24 s to 11 s with 3 names.

tests/test_pre_push_gate.py overlays the guard module on the fixture tip, as it does the scanner sources. A clean push runs the guard once. A committed receipt whose output_sha256 hashes its excerpt with the fixture home put back is refused without echoing the name.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>

…mes, safe digests

The command center's Claude read and the co-op's GPT read (P1 B1, B2, B4;
P2 B3, C1; C2, C3), in one commit as the command center ruled:

- B1: a "(" after a match exempts nothing; the 7 tree matches it hid,
  decorator calls after an escaped newline, are reviewed entries.
- B2: the local part and its left boundary take every RFC 5322 atext
  character (rfc5322.txt:679-690), so a match is the whole dot-atom and
  private!<listed> is a different, unlisted match. A local part needs a
  letter or a digit (a code span of an @import names no mailbox).
- B3: the dead-entry check leaves the registry out.
- B4 (correction #161): native_token_ci.py publishes digests of sanitized
  text only; raw_sha256 and the stdout, stderr and MCP raw digests are gone.
- C1: RFC 2606's three names exactly, with their subdomains; example.*
  under other TLDs and chained labels are no longer exempt.
- C2: target is a TLD (IANA 2026101001), so it is no longer an exempt
  unit type.
- The registry is re-reviewed at main 3a8a846: 78 values, including
  #1003's URL-userinfo fixture; the record's counts are measured here.

Each regression fails on e0862d8 and passes here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…gests

The terminal commit of #1012 under the rule-4 ruling on 51f85b5, with
Astra's delta read of 51f85b5 (two P1s) folded in.

- B1: from each at sign, the walk back over atext stops after 256
  characters (RFC 5321 section 4.5.3.1.1 limits a local part to 64 octets)
  and never passes the address before it. The reviewer's three adversarial
  50,000-character forms (%40 and &#64 written in atext, and
  apostrophe-joined %252540 tokens) take 0.025, 0.023 and 0.023 s, where
  51f85b5 takes 12.1, 10.0 and 4.3 s (same host, load 29). The docstring
  and README now say the bound is what makes the cost linear, and that a
  local part over 256 characters keeps its leading part visible.
- B2: overlapping or touching matches merge from their earliest start, so
  "w1 [email protected]"@d2.example.org is omitted whole.
- C: a JSON-escaped quote (\") opens and closes a quoted local part, so
  \"w1 w2\"@d.example.org in serialized JSON masks like its decoded form.
  After masking, a value that still holds an at sign, raw or encoded (%40,
  %2540, @, @, \u0040), followed by a domain, directly after a
  word character or after a quote with only whitespace between, is dropped
  whole and reads RESIDUE_OMITTED. The command-center page counts those
  values in its header and names their sections partial.
- Astra P1 1: an empty quoted local part ("") and a punctuation-only
  dot-atom (!!!) are valid (CPython Lib/email/_parseaddr.py getaddrspec
  :365-385, getatom :475-493 and getdelimited :449 at v3.13.16, cbc944f4),
  so the mask takes any nonempty atext run and quoted strings of 0 to 256
  characters.
  Leading backticks open a Markdown code span, replacing the
  letter-or-digit rule, so `@AGENTS.md` stays.
- Astra P1 2 (#161): sources.html published the SHA-256 of private raw
  bytes: the seven command-center state inputs, cc-now.json and
  adoption-now.json. A digest of raw bytes would confirm a guessed masked
  value. The receipt marks those inputs private and keeps their digests;
  the composer's pages show "private state input; this page withholds its
  digest, which the nonserved receipt keeps". Out of this commit's scope,
  and unchanged from main: sources.html still shows the raw digests of the
  gap board, the roadmap inputs and 70 readiness receipts (20 of them
  expected_sha256 pins in tools/north-star/sources.json), and the
  architecture builder's custody table (architecture_view.py:311) shows
  cc-now.json's and adoption-now.json's. The PR's Follow-ups list them.

Nine new regressions. At 51f85b5 they fail (27 failures and 13 errors,
counting subtests) with the exported tree unchanged, and Astra's three
probes fail there and pass here. The 35 local-pages, skill-usage and
north-star modules pass (789 tests, 8 skipped). A live build takes 42.4 s,
against 44.3 s at 51f85b5, and its 43 pages carry no mask or residue
placeholder. On 284,875 unique strings from the live inputs, catalogs,
manifests and repository Markdown, 2 outputs differ from 51f85b5's (an
apostrophe-quoted '@AGENTS.md' now masks, in text no page renders), and
none is dropped as residue.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…mes, safe digests

The command center's Claude read and the co-op's GPT read (P1 B1, B2, B4;
P2 B3, C1; C2, C3), in one commit as the command center ruled:

- B1: a "(" after a match exempts nothing; the 7 tree matches it hid,
  decorator calls after an escaped newline, are reviewed entries.
- B2: the local part and its left boundary take every RFC 5322 atext
  character (rfc5322.txt:679-690), so a match is the whole dot-atom and
  private!<listed> is a different, unlisted match. A local part needs a
  letter or a digit (a code span of an @import names no mailbox).
- B3: the dead-entry check leaves the registry out.
- B4 (correction #161): native_token_ci.py publishes digests of sanitized
  text only; raw_sha256 and the stdout, stderr and MCP raw digests are gone.
- C1: RFC 2606's three names exactly, with their subdomains; example.*
  under other TLDs and chained labels are no longer exempt.
- C2: target is a TLD (IANA 2026101001), so it is no longer an exempt
  unit type.
- The registry is re-reviewed at main 3a8a846: 78 values, including
  #1003's URL-userinfo fixture; the record's counts are measured here.

Each regression fails on e0862d8 and passes here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…y digest of host state

The final commit of #1012 under the CC's ruling on Astra's three P1s at
3d7b1e7 (her VERDICT.md, sha256 e945d18d).

- P1 1: the atext walk takes all 81 RFC 5322 atext characters. The slash
  was left out and leading backticks were always skipped, so a lone slash,
  "x/" and a lone backtick before an at sign stayed readable on the pages
  and as token-tools-now.json keys and values, also as %2F, / and %60.
  CPython Lib/email/_parseaddr.py getatom (:475-493 at cbc944f4) accepts
  all 81. Three contexts are set aside, each positively identified: inside
  a URL (a scheme, "://", up to a space, angle bracket or quote; RFC 3986
  section 3.1) the slash ends the local part, so a path is no address and
  an address after a path segment masks from its own first character; an
  at sign right after a slash, with a name after it that a slash or an
  opening parenthesis follows, starts a path segment or a call, and the
  slash must be the character right before the at sign, which no mailbox
  has, so an address that is itself a path segment (gcloud's
  legacy_credentials/ plus an account address plus /adc.json, or x/ plus
  an address plus /y) masks whole, directory prefix included; and a
  backtick string that a string of equal length closes after the at sign
  opens a Markdown code span (CommonMark 0.31.2 spec.txt:5865-5872 and
  :6072-6073 at 9103e341), so `@AGENTS.md` stays and a backtick that
  nothing closes is part of the local part. A scheme-less host path with
  nothing after it now masks, like any slash-ended local part.
- P1 2 (#161): the new page's footer served the SHA-256 of the native
  builder's render of the state root, whose raw bytes held a private
  address (the gate owner), and sources.html served the raw digests of
  the gate receipt, the gap board, the roadmap inputs and 70 readiness
  receipts. A digest of private bytes confirms a guessed value offline.
  The composer now marks an input private by provenance, when its path is
  under the state root, and the role projection's registry files the same
  way, so 83 inputs are private where 9 were and the nonserved receipt
  keeps their digests. The Command center and Sources pages show
  "private, not published (host state)" for each of them and for the
  native manifest in the footer; repository inputs keep their SHA-256.
  Not in this commit: the Home, Readiness, Gap board, Roadmap and Fleet
  footers still print the manifest digest, and two architecture pages
  print cc-now.json's, adoption-now.json's and one readiness receipt's.
- P1 3: three comments wrote out a complete address at a delegated domain:
  two in sanitization.py, one of them a host path that the full atext
  grammar also reads as an address, and a punctuation-only address on the
  target domain in a test. They are prose now, and a test scans the
  local-pages and skill-usage sources and their tests for any address that
  is not a no-reply form or on a name RFC 2606 and RFC 6761 reserve.

Thirteen tests: eleven fail at an export of 3d7b1e7 (68 failures,
counting subtests) with the export unchanged, and two pin the URL,
Markdown and path controls and the cost. Astra's review_probes.py gives
FAILED (failures=10) on that export and OK here, review_static.py FAILED
(failures=1) and OK. Twelve mutations of the change each fail them. The
36 local-pages, skill-usage and north-star modules pass (812 tests, 8
skipped). A live build takes 37.2 s, against 40.3 s at 3d7b1e7 built
just before it from the same state root (load 17 to 25), and its 43
pages carry no mask or residue placeholder. On 1,288,538 unique strings
from the tracked tree and the live inputs, 4 outputs differ from
3d7b1e7's (two package URLs mask from their ecosystem segment, an
apostrophe-quoted import stays readable again, and the removed comment
now masks), none in text a page renders. The three adversarial
50,000-character forms take 0.025, 0.022 and 0.021 s, against 0.025,
0.021 and 0.021 s at 3d7b1e7, back to back at load 16 to 20.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… token is published unchecked

The fix commit of #1012 under the CC's ruling on the GPT fix3 verdict at
38302cd (fix3-pr1012-38302cd2a/VERDICT.md, CHANGES_REQUESTED, two P1s)
and the Claude micro at 38302cd (pr1012-claude-micro-38302cd2.md).

- BLOCKER 1 (#161): no page carries the native readiness manifest digest.
  Every composer page and every Architecture page prints "private, not
  published (host state)" in the footer, the Readiness heading does too,
  and the run summary names the nonserved receipt that keeps it. Before
  publication each page passes sanitization.withhold_digests with the
  SHA-256 of every record the refresh read from the state root, so no
  page carries such a digest or a prefix of one 7 or more hex characters
  long, content-addressed names included.
- The Architecture pages follow the same provenance rule (the micro's (c)
  and the verdict's exact fix): the custody table, the host-receipt
  table, the layer headers and every other cell withhold the digests of
  state-root records, the architecture receipt keeps them, and a detail
  page is named by the digest of the bytes it publishes.
- BLOCKER 2: a token over 4,096 characters is still masked in place
  without decoding (the cost bound), and is then decoded with the same two
  rounds and checked, so none is published unchecked. One that an address
  touches once decoded, or whose decoded text turns the character beside
  an in-place mask into part of the address, is omitted whole as
  "[email omitted]". One whose decoded text, or the text it encodes as hex
  or base64, holds a home path, a session id, a task handle, an account
  URL or the home name reads "[long token omitted: it decodes to private
  text]", and the command-center page counts those as it counts dropped
  values. The control decodes with CPython's html.unescape and
  email._parseaddr at cbc944f4 (v3.13.16, byte-identical to the installed
  files).
- The micro's (b), Codex's five threads at 38302cd: a run pin follows
  the same-layer final-stack winner's run field and shows its run_reason
  when it has none; a skill the Claude lanes report measured keeps those
  counts without a host row; a current daily projection makes an absent
  or stale hourly report it replaces "not used" rather than a gap; a read
  queue without a parseable updated_utc leaves Orchestration partial;
  each Adoption token-efficiency row is labelled by its case-folded name,
  RTK included.
- The verdict's follow-up 4: the two line citations of skill_usage.py in
  comments now read :603, :615 and :652 at 900835c. The micro's (d)1 and
  (d)2: the docstring, comments and README say RFC 5322 allows a local
  part ending in a slash, and that the code-span opener's letter-or-digit
  condition is this mask's own, stricter than CommonMark.

Fifteen new or changed tests each fail on an export of 38302cd with the
new tests copied in (54 failures and 4 errors, counting subtests) and
pass here. The verdict's review_probes.py gives FAILED (failures=13) on
that export and OK here. The 36 local-pages, skill-usage and north-star
modules pass (825 tests, 8 skipped). A live build from the state root
carries none of the 109 state-root digests it records, or a 7-character
prefix of one, on any of its 45 outputs, where 38302cd's carries them
on 42. Of 1,949,346 unique real strings, all 18 that hold a token over
4,096 characters and a fixed sample of 60,000 others sanitize as they
did at 38302cd.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…open rule as written

One commit for both reads of #1049 at ce11fbd (the GPT verdict and the
Claude read), after the registry-only rebase onto main 703d588.

- GPT P1 (#161): the decision record cites the CC's private rulings by
  name only, with no path and no digest; the PR body does the same.
- GPT P1 (licence): the hard disqualifiers are a missing required
  capability (an entitlement or terms conflict counts as one) and an
  abandoned project. Licence is a compliance note (SPDX id, source,
  read time), per the CC ruling ruling-licence-not-a-disqualifier-20261012.
  No rule surface named licence.
- Claude P2-1: the protocol's reopen rule is quoted as written (a FINAL
  layer reopens only when a sweep detects a change, bound to that
  sweep). The angle sources become sweep inputs, a named follow-up to
  recipes/saturation-sweep.md; review contradictions go through the
  corrections rule.
- Claude P2-2: docs/harness-defaults.md:9 reads "alone are not
  evidence", pinned by a new test that fails on the old line.
- P3s: on all six surfaces "the layer's screen (its requirements
  checked at a pin)" and "no single angle makes a candidate a default",
  carriers regenerated with --write-blocks; the presence test failed
  first (9 subtests); TOP_RULE_SHA256 re-derived (3,051 bytes); the
  startup ceilings re-derived to 8,480/8,586 with the Codex
  project_doc_max_bytes primary source (openai/codex rust-v0.162.1,
  config_toml.rs:75). CI checks angle records only once the freeze-wave
  PR lands; plans and host reports are labelled as such.
- manifests/evidence.json: the changed files re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ly through a converged harness (#1049)

* Rule text: use only converged candidates (foundation rule)

Append the owner's 2026-10-12 foundation rule to the end of the "Decide
by evidence" bullet on all six always-loaded rule surfaces: AGENTS.md,
the portable Claude block, the Codex template, the scaffold and the two
new-WSL carriers, regenerated with new_wsl_client_config.py
--write-blocks. A tool, runtime, model or skill is installed, run or
made a default only after the layer's own convergence passes it;
popularity, recency and vendor claims make it a lead, never an
admission.

- tests: a fail-first test that every layer and native renderer ends
  the bullet with the sentence once (9 failing subtests before the
  edit); CORE updated; the Codex top-rule pin re-derived with
  template_segments() (2,607 bytes); the startup byte ceilings raised by
  a dated comparison to 7,548/7,654.
- docs/decisions/2026-10-12-converged-candidates-only.md: the rule, its
  basis (owner direction, CC ruling addendum-01 with correction #192,
  the existing evidence rule), what it changes, surfaces, budget
  comparison, checks and overturn conditions. Supersession: none.
- manifests/evidence.json: the changed files registered with
  register_file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rule text: use models only through a converged harness

Append the owner's second 2026-10-12 foundation rule (20:15Z direction)
right after the converged-candidates sentence, at the end of the
"Decide by evidence" bullet, on all six rule surfaces; the two new-WSL
carriers regenerated with new_wsl_client_config.py --write-blocks. A
model runs only inside a converged harness with its full layers; a bare
API call is for measurement probes and smokes only, recorded as such.

- tests: the presence test now covers both sentences, in order (9
  failing subtests before this edit); CORE updated; the Codex top-rule
  pin re-derived with template_segments() (2,860 bytes); the startup
  ceilings raised by the dated comparison to 8,079/8,185.
- docs/decisions/2026-10-12-converged-candidates-only.md: the second
  sentence, its basis (owner direction 20:15Z, CC runtime-roadmap
  ruling), its change, the budget table and checks for both steps.
- manifests/evidence.json: the changed files re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rule text: a screen pass admits a trial; a default needs a measured win

Tighten the converged-candidates sentence on all six rule surfaces, on
the CC's direction: a candidate is installed or run for trial only
after the layer's own screen passes it, and becomes a default only
after a measured win on quality at no higher cost. The Stage A screen
checks documented capability at a pin and runs nothing, so a pass is
not quality evidence. The harness sentence after it is unchanged; the
two new-WSL carriers regenerated with new_wsl_client_config.py
--write-blocks.

- tests: CONVERGED (and with it CORE) carries the new wording; the
  presence test failed first (9 subtests); the Codex top-rule pin
  re-derived with template_segments() (2,864 bytes); the startup
  ceilings re-derived to 8,088/8,194.
- docs/decisions/2026-10-12-converged-candidates-only.md: the new
  wording, the earlier wording it replaces before landing, why a screen
  pass is trial-only (CC runtime-profiles addendum-01, Stage A and B),
  the budget table and checks.
- manifests/evidence.json: the changed files re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rule text: defaults need multi-angle convergence; one angle never admits

Final wording on the owner's 20:29Z direction (CC multi-angle
convergence ruling): on all six rule surfaces, the converged-candidates
sentence now admits a trial after the layer's screen and a default only
when the layer's multi-angle convergence agrees (capability at the pin,
upstream engineering quality, community consensus, net usage, published
evaluations and our own measured runs); where angles disagree, the
disputed dimension is measured first-hand, and no single angle admits a
candidate. The bullet's not-evidence clause reads "alone are not
evidence". The harness sentence is unchanged; the two new-WSL carriers
regenerated with new_wsl_client_config.py --write-blocks.

- tests: CONVERGED and CORE carry the final wording; the presence test
  also checks the "alone" clause in place and the old clause absent
  (9 failing subtests before the edit); PROCEDURE_PHRASES updated; the
  Codex top-rule pin re-derived (3,017 bytes); the startup ceilings
  re-derived to 8,409/8,515.
- docs/decisions/2026-10-12-converged-candidates-only.md: rewritten for
  the final text, with the branch's earlier wordings, the multi-angle
  basis and supersession, the budget comparison and every check.
- manifests/evidence.json: the changed files re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Record: how the rule applies to every layer, the freeze and the north star

Add "How the rule applies: every layer, the freeze and the north star"
to docs/decisions/2026-10-12-converged-candidates-only.md, on the CC's
direction: the six angles and per-layer weights, the scope across both
repositories, the wave cycle, the freeze in final-stack.json (current
counts: converged 0, reopened 30, no-winner 2, unswept 2; no angle
weights), what scripts/final_stack.py and CI check today, the revisit
triggers, the SOTA-sources pin rule and the trading north star. Facts
cited path:line at main 489b263, byte-identical at the base. No rule
surface, pin or ceiling changes.

- manifests/evidence.json: the record re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Review round 1: private digests out, licence never a disqualifier, reopen rule as written

One commit for both reads of #1049 at ce11fbd (the GPT verdict and the
Claude read), after the registry-only rebase onto main 703d588.

- GPT P1 (#161): the decision record cites the CC's private rulings by
  name only, with no path and no digest; the PR body does the same.
- GPT P1 (licence): the hard disqualifiers are a missing required
  capability (an entitlement or terms conflict counts as one) and an
  abandoned project. Licence is a compliance note (SPDX id, source,
  read time), per the CC ruling ruling-licence-not-a-disqualifier-20261012.
  No rule surface named licence.
- Claude P2-1: the protocol's reopen rule is quoted as written (a FINAL
  layer reopens only when a sweep detects a change, bound to that
  sweep). The angle sources become sweep inputs, a named follow-up to
  recipes/saturation-sweep.md; review contradictions go through the
  corrections rule.
- Claude P2-2: docs/harness-defaults.md:9 reads "alone are not
  evidence", pinned by a new test that fails on the old line.
- P3s: on all six surfaces "the layer's screen (its requirements
  checked at a pin)" and "no single angle makes a candidate a default",
  carriers regenerated with --write-blocks; the presence test failed
  first (9 subtests); TOP_RULE_SHA256 re-derived (3,051 bytes); the
  startup ceilings re-derived to 8,480/8,586 with the Codex
  project_doc_max_bytes primary source (openai/codex rust-v0.162.1,
  config_toml.rs:75). CI checks angle records only once the freeze-wave
  PR lands; plans and host reports are labelled as such.
- manifests/evidence.json: the changed files re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…delete the unused ignores

From the Claude read of e393356 (CHANGES_REQUESTED) and the GPT read of
e393356 (ACK, no blockers):

- P1, correction #161: delete the sha256 of the two scratch uv.lock files
  from the receipt (control_uv_lock_sha256, new_uv_lock_sha256), from
  relock.txt and from the relock script's sha256sum; uv_lock_diff and
  uv_change_list_delta carry the claim. Add
  tests/test_receipt_sha256_key_custody.py: every evidence/receipts key
  ending in _sha256 must hash a tracked file or name a public artifact
  (an https URL under url or a key of its own prefix, or a tracked pin
  record); 99 older receipts are frozen by count (702 keys). It fails at
  e393356 on exactly those two keys.
- P3: the post-pin grant reason and the receipt's cross_family_review
  cite #1060 and both reads.
- GPT read follow-up 1: delete the unused nltk and setuptools ignores
  (GHSA-8mgp-746c-j5xp, GHSA-h35f-9h28-mq5c), which would have failed the
  scan step's preflight on 2026-12-24, and their IGNORE_SCOPES rows; the
  guard's own tests keep the two scopes as GUARD_FIXTURE_SCOPES. No
  ordinary input pins a version they affect, and the ordinary config now
  holds no ignore.

Checks: validate.py passed (11872 hashed files); 11 modules under
TZ=UTC, 319 tests OK; the workflow's scan step exits 0, No issues found;
ignore_entry_problems with the date 2026-12-24 returns nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ignores (#1060)

* Relock OpenHands onto oauthlib 4.0.0 and delete the expired oauthlib ignores

From 2026-10-13T00:00Z the required osv-scanner check failed on every run:
the two oauthlib ignores (GHSA-hj66-6f7g-4r5v, GHSA-xpv3-w29h-x7cv) carried
ignoreUntil = 2026-10-13, and the scan step's unittest preflight rejects an
expired ignore (CI run 38326740785).

- Relock blueprints/runtime-workers/openhands/requirements.lock from oauthlib
  3.3.1 to 4.0.0, the first patched release of both advisories, with the
  recipe's paired uv 0.12.22 relock: the fsspec relock's nine version-pinned
  upgrades plus --upgrade-package oauthlib==4.0.0. The control reproduces the
  committed lock byte for byte; the new lock differs in the three oauthlib
  lines only, and both hashes are PyPI's 4.0.0 wheel and sdist. No other pin
  moves.
- Delete both ignores, their IGNORE_SCOPES rows and the lock's
  IGNORE_ALLOWED_LOCKS entry. The Lumibot lock they also covered has been
  excluded from the inventory since 2026-10-06 and is unchanged.
- Record it: research.md section, a dated supersession in the automation
  closure decision, receipt
  evidence/receipts/osv-openhands-oauthlib-relock-20261013.json, returned
  outputs under the relock-2026-10-13-oauthlib prefix, the pins.json digest,
  the receipt's Architecture grant and post-pin ledger entry, and
  manifests/evidence.json.

Checks: the workflow's own scan step exits 1 at 738fdf7 and 0 here; its
ordinary OSV-Scanner 2.6.0 scan exits 1 (the two oauthlib findings) and 0;
TZ=UTC unit runs of the coverage modules go from 4 failures to OK; the
hashed install, uv pip check, SDK import and requests-oauthlib 2.0.0's own
tests pass on the new lock.

Refs #518

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Review fixes for #1060: drop scratch digests, guard receipt digests, delete the unused ignores

From the Claude read of e393356 (CHANGES_REQUESTED) and the GPT read of
e393356 (ACK, no blockers):

- P1, correction #161: delete the sha256 of the two scratch uv.lock files
  from the receipt (control_uv_lock_sha256, new_uv_lock_sha256), from
  relock.txt and from the relock script's sha256sum; uv_lock_diff and
  uv_change_list_delta carry the claim. Add
  tests/test_receipt_sha256_key_custody.py: every evidence/receipts key
  ending in _sha256 must hash a tracked file or name a public artifact
  (an https URL under url or a key of its own prefix, or a tracked pin
  record); 99 older receipts are frozen by count (702 keys). It fails at
  e393356 on exactly those two keys.
- P3: the post-pin grant reason and the receipt's cross_family_review
  cite #1060 and both reads.
- GPT read follow-up 1: delete the unused nltk and setuptools ignores
  (GHSA-8mgp-746c-j5xp, GHSA-h35f-9h28-mq5c), which would have failed the
  scan step's preflight on 2026-12-24, and their IGNORE_SCOPES rows; the
  guard's own tests keep the two scopes as GUARD_FIXTURE_SCOPES. No
  ordinary input pins a version they affect, and the ordinary config now
  holds no ignore.

Checks: validate.py passed (11872 hashed files); 11 modules under
TZ=UTC, 319 tests OK; the workflow's scan step exits 0, No issues found;
ignore_entry_problems with the date 2026-12-24 returns nothing.

Follow-ups (CC gate, Claude delta at 4b23521, PASS_WITH_P3):
- Before 2026-12-24: the frozen disposition review_until "2026-12-24" (tests/test_osv_lockfile_coverage.py:99) fails the scan step's FrozenScanTests preflight that day. The fix is a disposition re-review, not a date bump.
- The receipt custody rule: freeze key paths instead of counts; walk receipts registered outside evidence/receipts/; accept a bare `url` only next to a single `*_sha256` key; cover relock.txt digests.
- A committed fail-before guard for unused ignores that hide no pin.
- Relabel the receipt's `tests.after` and the summary at :239, and record a final-tree run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Single-family (Claude) initial sweep of foundation/model-routes under the
CC's 2026-10-15T19:52Z ruling (A). Three landscape-sweep-worker stages ran on
Claude Opus 5.5 at effort max, staged by the harness's own build_args.py,
with a hand-built layer input because the layer is unregistered at
8053f14. 19 proposals (14 carried + 5 new), facts refuted 0, Claude fit
refuted 8, 0 survivors in this half (the GPT fit vote is missing by design,
so 11 are refuted only by absence). The critic's flagged follow-up was not
run under the $40 cap and is recorded as a retained failure. No catalog,
convergence or ledger file is edited; the merge with the GPT half (#1177)
follows MERGE-PLAN.md and supports TRIAL labels only.

Corrections from the CC's full read (verdict MICRO-full-afcc08cb.md):
- No digest of unpublished bytes remains (correction #161). The digests of
  the unmasked layer input, the three stage scripts as run, the merged
  proposal list and the CC direction record are removed. hashes.json keeps
  only published or recomputable values and names the private originals
  under unpublished_originals without any digest. The direction record and
  the Muse re-qualification receipt are cited by name only, and no
  abbreviated digest is left.
- The published decision_ref names the direction record without its
  digest, so requirement_sha256 is recomputed over the published fields
  with scripts/saturation_ledger.py requirement_sha256 (deviation 7).
- returns.json is reconverted with convert.py --usage over the three stage
  usage records, which join_usage.py joins unchanged into usage-joined.json
  (deviation 8). All 38 Claude votes now carry the measured claude-opus-5-5
  at effort max, and no effort_deviation or web_search_capped failure is
  retained. The counts are unchanged.
- The cost estimate states the 1-hour cache TTL as its assumption
  (prompt-caching.md:144 gives the rate for each TTL). MERGE-PLAN.md cites
  recipes/saturation-sweep.md:99 and :174-175 and labels the
  vendor-document capture a PROPOSAL.
- tests/test_provenance_digest_custody.py adds
  ModelRoutesClaudeHalfCustodyTests. Every 64-hex value in the record's two
  directories must hash a tracked file (as checked out or at 8053f14) or
  be prompts_sha256, requirement_sha256 or platform_profiles_sha256
  recomputed with the harness's own code at 8053f14. Private records are
  cited by name, and no abbreviated digest stands in for a value. The class
  fails on the first head's tree and passes here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ipt (#1178 GPT read, P3) (#1196)

The GPT full read of #1178 (P3): build_environment.nuget_config in
evidence/receipts/osv-alpaca-messagepack-relock-20261015.json published
the sha256 of a task-scratch NuGet.Config that no repository file
holds, so nobody can check the digest from the repository (correction
#161's custody rule: docs/decisions/2026-10-12-harbor-parallel-runtimes.md,
"Custody of the run originals"). The key does not end in _sha256, so
tests.test_receipt_sha256_key_custody never reached it.

- The value now describes the file and carries no digest: "Task-owned
  public-only NuGet.Config: a cleared packageSources list plus the
  single nuget.org v3 source, passed with --configfile to every
  restore".
- manifests/evidence.json: the receipt's row re-hashed.

The command center's 20:58Z ruling keeps this fold in its own commit,
after the mcp relock.

Checks: validate.py passed (12148 hashed files); evidence_manifest.py
--check passed; git diff --check is clean; under TZ=UTC,
tests.test_receipt_sha256_key_custody, tests.test_provenance_digest_custody
and the 32 tests/test_local_pages*.py modules ran 578 tests, OK. No
other tracked file carries the removed digest (git grep).

Co-authored-by: Claude Opus 5.5 <[email protected]>

Single-family (Claude) initial sweep of foundation/model-routes under the
CC's 2026-10-15T19:52Z ruling (A). Three landscape-sweep-worker stages ran on
Claude Opus 5.5 at effort max, staged by the harness's own build_args.py,
with a hand-built layer input because the layer is unregistered at
8053f14. 19 proposals (14 carried + 5 new), facts refuted 0, Claude fit
refuted 8, 0 survivors in this half (the GPT fit vote is missing by design,
so 11 are refuted only by absence). The critic's flagged follow-up was not
run under the $40 cap and is recorded as a retained failure. No catalog,
convergence or ledger file is edited; the merge with the GPT half (#1177)
follows MERGE-PLAN.md and supports TRIAL labels only.

Corrections from the CC's full read (verdict MICRO-full-afcc08cb.md):
- No digest of unpublished bytes remains (correction #161). The digests of
  the unmasked layer input, the three stage scripts as run, the merged
  proposal list and the CC direction record are removed. hashes.json keeps
  only published or recomputable values and names the private originals
  under unpublished_originals without any digest. The direction record and
  the Muse re-qualification receipt are cited by name only, and no
  abbreviated digest is left.
- The published decision_ref names the direction record without its
  digest, so requirement_sha256 is recomputed over the published fields
  with scripts/saturation_ledger.py requirement_sha256 (deviation 7).
- returns.json is reconverted with convert.py --usage over the three stage
  usage records, which join_usage.py joins unchanged into usage-joined.json
  (deviation 8). All 38 Claude votes now carry the measured claude-opus-5-5
  at effort max, and no effort_deviation or web_search_capped failure is
  retained. The counts are unchanged.
- The cost estimate states the 1-hour cache TTL as its assumption
  (prompt-caching.md:144 gives the rate for each TTL). MERGE-PLAN.md cites
  recipes/saturation-sweep.md:99 and :174-175 and labels the
  vendor-document capture a PROPOSAL.
- tests/test_provenance_digest_custody.py adds
  ModelRoutesClaudeHalfCustodyTests. Every 64-hex value in the record's two
  directories must hash a tracked file (as checked out or at 8053f14) or
  be prompts_sha256, requirement_sha256 or platform_profiles_sha256
  recomputed with the harness's own code at 8053f14. Private records are
  cited by name, and no abbreviated digest stands in for a value. The class
  fails on the first head's tree and passes here.

Co-authored-by: Claude Opus 5.5 <[email protected]>

### Scope

Correct Claude native-practice guidance that conflated release boundaries, described adopted hooks as proposals and treated available review-worker source as host qualification. Align the selected first-party skill and lifecycle source, remove private host-state digests from the public receipt, and retain the supported install of the corrected tree. Regenerate the final-stack view so its lifecycle source hash matches the corrected catalog.

- Base commit: `4f827e637f256fee4f0534f395431b722aabc43c`
- Lane: `lane:foundation`
- Owned paths: four skill reference files; skill manifest and first-party lifecycle catalog; dated adoption decision and Linux guide; snapshot label; two install artifacts; two practice test modules; two Atlas locators; derived final-stack view and evidence registry.

### SOTA sources

- [anthropics/claude-code](https://github.com/anthropics/claude-code/blob/c017428c8c27e604840435048d5bce6a9a22c040/CHANGELOG.md), `c017428c8c27e604840435048d5bce6a9a22c040` / v2.1.302: distinct rule-load releases (L1076, L670), interactive auto start (L1516), and adopted onFailure floor (L491). The npm locator remains bound to v2.1.295 at `602df92bf481ed904533e95c09f740f40aab5aed`, L7262.
- [Official hooks reference](https://code.claude.com/docs/en/hooks#block-the-action-when-a-hook-fails), current-page observation on 2026-10-18: onFailure scope and excluded completion events; not a versioned source.
- [native-agent-stack source](https://github.com/native-agent-stack/native-agent-stack/tree/99f82d7e0e0da2ddc075a5ca7c6a82aef292515f), `99f82d7e0e0da2ddc075a5ca7c6a82aef292515f`: corrected skill tree `995ae9d1c8c95533c9f61587d2b83b3d5748cf98`, existing supported installer and source-ordering rationale. The first-party pin contract and correction #161 follow the same repository at base `4f827e637f256fee4f0534f395431b722aabc43c`, `docs/decisions/2026-10-10-skills-claude-native-practice-row.md:82-86`, `tests/test_provenance_digest_custody.py` and `tests/test_published_digest_privacy.py`.
- [Native generated-view writer](https://github.com/native-agent-stack/native-agent-stack/blob/15f7a1bcf743cf388a6d96b65c07e04fe2943cd9/scripts/final_stack.py#L1465-L1505), `15f7a1bcf743cf388a6d96b65c07e04fe2943cd9`: supported `--write`, publication scanner and registry update; `docs/contributing-evidence.md:303-319` at that pin documents refreshing the derived views.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Correct source/release and cross-file pin boundaries | source_review | Pinned sources above and practice tests |
| Five new coherence checks fail before the fixes | local_integration | Existing locked CI interpreter; targeted regression cases |
| Native skill apply, check-only and 15 source-file comparisons pass | native_proven | `evidence/artifacts/claude-native-practice-refresh-20261018-reviewed/receipt.json` |
| Other 28 lock entries were unchanged | native_proven | Private in-memory host readback; preimages/digests withheld, not publicly reproducible |
| Derived final-stack hash now matches the lifecycle catalog | local_integration | Native `final_stack.py --check` fails before regeneration, passes after `--write`; all 91 existing final-stack tests pass |
| No model/runtime qualification follows from source installation | source_review | Explicit receipt limits; fresh full-head reviews remain required |

### Local commands run

The existing locked CI interpreter ran the native-practice, manifest, Atlas and evidence-privacy checks: 273 tests, 269 pass and four explicit skips. After selecting the repaired source, the final manifest/coherence group passes 42/42. `scripts/validate.py` passes: 71 components, 12,310 hashed files, four profiles, 243 receipts. `git diff --check` passes.

The supported installer ran with `--manifest adoption/skills/manifest.json --skills-bin <existing skills 1.7.0 binary> --only claude-native-practice --json`, followed by native check-only. Apply exit 0, 6.167 seconds; all fifteen installed files equal the selected Git blobs. All 33 role defaults/statuses and SKILL.md remain unchanged. Normal native pre-push registry/security and published-digest guards pass.

After the native freshness failure, `python3 -B scripts/final_stack.py --write` changes exactly one generated source hash plus the artifact's existing registry hash. `--check`, all 91 `tests.test_final_stack` tests (zero skips), publication validation and whitespace checks pass using the existing locked CI interpreter. The generated artifact SHA256 is `acc39e4c275b3c89453d8a592acde0ee3ca7ca9d600c1ff1fa4bb0ae847d975f`. No layer status, runtime choice or source logic changes.

### Decision record

`docs/decisions/2026-10-10-skills-claude-native-practice-row.md`, Reference repair and source ordering (2026-10-18). The predecessor source pin is not claimed to become a main ancestor through a squash merge. Earlier receipts and failed reviews remain historical; new-head verdicts are required before supported landing. No final-stack, memory or matched-performance verdict is asserted.

### Host evidence

No files under `evidence/hosts/` change. The scoped artifact receipt separates actual native host observations from public source reproducibility.

### Checklist

- [x] No GitHub Actions or permissions change.
- [x] No secrets or private lock digests are included in the new public receipt.
- [x] No new hosting, subscription or billing surface.
- [x] Peer-owned untracked files and worktrees preserved.