Saturation tracking loop: hash-chained per-layer ledger, weekly model-free report, one tracking issue - #166

Adds a saturation tracking loop for the SOTA landscape. It implements the stopping rule in docs/landscape-continuation.md:89-101, which defines saturation as a named candidate set for frozen requirements and a date. It needs no unattended model calls: catalogs/landscape/research-state.json keeps automatic_model_calls: false.

Parts

• catalogs/saturation/ledger.json, its schema and README. The ledger is append-only and hash-chained (prev_sha256 plus head_sha256). Each sweep records, per layer:
  • candidates that were proposed, known, new, survived and refuted, with both refuter votes;
  • reopen triggers;
  • the requirement and platform-profile hashes.
• Counting. A layer becomes a saturation candidate after 3 clean completed sweeps at least 7 days apart with an unchanged requirement. A stopped run neither counts nor resets. Any survivor, reopen trigger, changed requirement or platform, or pin_moved/stale receipt resets the count. A candidate is only an input to closure: the landscape owners still close layers in research-state.json closure_refs.
• scripts/saturation_ledger.py, with --check [--base REF], --report, --append RESULT.json and --derive-seed. It refuses to rewrite history. The writer can only write inside catalogs/saturation/.
• .github/workflows/saturation-tracking.yml, weekly on Monday at 07:53 plus workflow_dispatch dry_run:
  • it calls no model and has only contents: read;
  • harden-runner is the first step of each job;
  • the report combines the ledger, receipt_staleness.py --json and the latest catalog-freshness artifact;
  • one final job with only issues: write keeps one issue labelled saturation-tracking up to date.
• recipes/saturation-sweep.md. Sweeps are scoped to the layers that are due. Each sweep runs the existing landscape lane in a coordinator session, retains usage, stopped runs and votes, then appends.
• Seed. The seed covers the 2026-09-23 landscape sweep: the completed run wf_38aa6d5d-d6c and the stopped run wf_28d47bbc-1b5, which is kept with lower-bound usage. Every value is derived from retained files. No seed layer counts as clean, because the per-vote returns were not retained. It covers 32 layers and 11 survivors, each with a source review.

Separation. No verdict-review-gate trust path or data binding is touched. verdict_review_gate.py --base origin/main reports "no verdict rows changed". The change leaves research-state.json, catalog-freshness.yml, freshness_propose.py, receipt_staleness.py and adoption/* untouched.

Verification (on b0c65c5, merged with main at aa6fc79)

• 99 targeted tests OK (2 skipped: jsonschema and PyYAML are absent). The 42 ledger tests cover:
  • counting fixtures;
  • hash-chain tampering and --base rewrite detection;
  • binding every survivor to its manifest row and source review;
  • vote recomputation;
  • usage registration;
  • write confinement, enforced with an audit hook;
  • workflow permissions.
• validate.py, evidence_manifest.py --check, landscape.py --root . and host_receipts.py validate all pass.
• zizmor 1.30.1 finds nothing. actionlint 1.7.12, checked against its pinned sha256, exits 0.
• The full suite has one failure, the host-only test_effort_default_guard.test_shipped_guard_is_verbatim (a stale ~/.claude hook). It also fails on plain main.

Review. Two independent reviewers looked at gate separation and workflow security, and at ledger correctness and evidence honesty. They raised 10 findings, one of them high (a byte-for-byte seed test that would break after the first real append). The fix round a768186 fixed 8 and rejected 2 with stated reasons: current-state triggers stay stateless, and the stopped record keeps manifest_ref.

Not yet done. No live dry_run or real dispatch has run, and the first appended sweep, which is the loop's end-to-end acceptance, is still to come. Both happen after merge.

🤖 Generated with Claude Code