Run Serena's own script from the MCP templates; attribute pin observations to their host; record sparse-VHD, gitleaks-order and WSL lessons - #230

The user-scope Claude MCP template (adoption/mcp/claude-user.json) and the project Codex template launched Serena through ${ECO_ROOT}/bin/serena-context. That wrapper existed only on the 2026-09-23 recording host: it set SERENA_HOME (gap-wave2 MCP-surfaces receipts), and no recipe, bootstrap step or tool in this repository creates it. The WSL workstation has only ${ECO_ROOT}/bin/serena, and its live Claude sessions run that script. Four Linux pin notes said "this host already has ..." about the same recording host; the workstation has none of orx, tvly or agent-browser. The workstation pages still recommended sparseVhd, which WSL itself disables, and docs/secret-storage.md enabled the gitleaks hook before the guarded launcher was installed.

Change.

• Serena and jcodemunch. Both templates run ${ECO_ROOT}/bin/serena with unchanged arguments. adoption/bootstrap.md step 4a installs Serena (git pin c6fbd1c5) and jcodemunch-mcp 1.108.319 as uv tools with the uv-tool layout bootstrap-linux.sh uses (UV_TOOL_DIR=${ECO_ROOT}/python-tools, UV_TOOL_BIN_DIR=${ECO_ROOT}/bin), before the MCP registration. The recipes/README.md serena row points there and keeps uvx for one-off runs. Serena reads SERENA_HOME itself, so no wrapper is needed. The review asked only about Serena; jcodemunch-mcp is added because the template names it too and nothing installed it.
• Release notes on the pages. bootstrap.md names the MCP template and the project Codex template among the files changed after v2026.09.24.1: the tag's serena entry runs a wrapper nothing installs. The macOS page's step 3 says the same.
• Re-registration. install_claude_profile.py --replace-mcp re-registers every differing server, and claude mcp add refuses a name that already exists. The documented sequence is to remove each server that should change (claude mcp remove <name> -s user), then run install_claude_profile.py --only mcp without the flag.
• ai-memory. The template keeps 127.0.0.1:49374, the default in every repository source. The host's registration and rendered hook commands must name the port its own unit binds: claude mcp remove ai-memory -s user, then claude mcp add ... http://127.0.0.1:<port>/mcp. The workstation's nativestack-memory binds 49474, because another distribution holds 49374.
• tests/test_install_claude_profile.py follows the template. It keeps the 2026-09-23 claude mcp get recording as SERENA_CONTEXT_20260923, adds a 2026-09-25 recording of the new registration, and checks that the older registration is reported as differing.
• adoption/pins-linux-x86_64.json: the markitdown, tavily-cli, orx and agent-browser install_notes attribute their "installed" observation to the host that recorded New-PC Claude Code user profile: native claude-code pin, guard, agents, user-scope MCP, settings apply #139 on 2026-09-23. Versions, URLs and hashes are unchanged. bootstrap.md and the macOS page disclose this (13af3fe).
• VHD notes. docs/next-host-stages.md and docs/new-workstation-runtime-profile-20260922.md get dated notes; the projection is unchanged. sparseVhd=true has no effect: WSL 2.7.14 creates every new VHD non-sparse while a data-corruption issue is open, and enabling sparse needs --set-sparse true --allow-unsafe (Sparse VHD support is currently disabled due to potential data corruption. microsoft/WSL#13075). Reclaim space with fstrim, then an offline, elevated diskpart compact vdisk, or Mount-VHD -ReadOnly with Optimize-VHD -Mode Full. The workstation's live .wslconfig is compared with each projected value.
• gitleaks, step 5 of docs/secret-storage.md. 5a extracts the checksum-verified binary into $ECO_INSTALL_ROOT/tools/gitleaks-8.30.1/ and installs the guarded launcher and its gitleaks link. It covers the payload/ layout (GITLEAKS_NATIVE or a relative link) and says how gitleaks resolves to gitleaks-guarded-macos on macOS. 5b checks core.hooksPath, then runs git hook run pre-commit in a throwaway worktree: once clean (exit 0) and once with a planted, generated AWS-style key (exit 1). It notes that the hook is absent at v2026.09.24.1. The macOS install in adoption/tools/README.md adds the gitleaks link and its pass criterion.
• adoption/platforms/linux-wsl2.md: "Windows-side commands from WSL" and "Listeners and ports", each item with its upstream source. vLLM's wildcard TCPStore listener is recorded as a known upstream limitation that the Hyper-V firewall mitigates, citing vLLM's docs/usage/security.md at v0.25.0. [BugFix] Bind RayExecutorV2 TCPStore before publishing its port vllm-project/vllm#50969 is about a RayExecutorV2 port race, not firewall guidance, so it is not cited.
• docs/acceptance-evidence-policy.md: discriminating controls. For a new claim, the failing control run is recorded next to the passing one; the planted-key hook check is the example. Existing unchanged-upstream-test evidence keeps its class.
• manifests/evidence.json re-registers every changed hash-listed file.

Checks (WSL2 workstation, Python 3.13 via uv run --no-project --python 3.13 --with jsonschema --with pyyaml, head cbad6a8):

• python3 scripts/evidence_manifest.py --write, then --check: {"files": 5338, "status": "passed"}. python3 scripts/validate.py: {"components": 69, "hashed_files": 5338, "profiles": 4, "receipts": 145, "status": "passed"}. python3 scripts/verdict_review_gate.py --base origin/main: no verdict rows changed (base aa0812b1d80e).
• python -m unittest tests.test_install_claude_profile tests.test_adoption_docs_consistency: 67 tests, OK (skipped=1). The tests that read the edited files (14 more modules, including the guarded runners, render_config, bootstrap, release-pin contents and secret guard): 501 tests, OK (skipped=15). build_ecosystem.py --check, new_host_grand_list.py --check and component_matrix.py --check passed.
• Merged with origin/main 6568f47 in a throwaway worktree (clean merge): evidence_manifest --check passed with 5344 files, validate.py passed, and the acceptance modules plus test_catalog_freshness_propose ran 147 tests, OK (skipped=1).
• Mutations (discriminating controls). With the template command set back to serena-context, tests.test_install_claude_profile fails 3 tests. With the macOS page's "changed after" note removed, test_pages_mentioning_a_changed_install_input_say_so fails naming adoption/mcp/claude-user.json. Both were restored and pass.
• Native install paths (scratch prefixes):
  • The step 4a commands installed serena (Serena 2.0.0.dev0) and jcodemunch-mcp (jcodemunch-mcp 1.108.319) into ${ECO_ROOT}/bin.
  • Under a temporary CLAUDE_CONFIG_DIR (claude 2.1.282), a second claude mcp add of ai-memory exited 1 with MCP server ai-memory already exists in user config. Remove-then-add registered port 49474.
  • With a tag-era serena-context registration present, install_claude_profile.py --only mcp left ai-memory and serena unchanged as differing. After claude mcp remove serena -s user, the rerun registered serena, kept ai-memory at 49474, and claude mcp get reported ✔ Connected for serena and jcodemunch.
• gitleaks, 5a on Linux: the pinned archive passed sha256sum --check. The extracted binary's sha256 is 88f91962…, matching installation-wsl.json. Through the launcher pair and link, command -v gitleaks gave the link, readlink gave gitleaks-guarded, and gitleaks version printed 8.30.1.
• gitleaks, 5a on macOS, checked off macOS with a stand-in HOME: the gitleaks → gitleaks-guarded-macos link resolved, and gitleaks version printed 8.30.1. GITLEAKS_NATIVE set to the link and a scan off macOS were each refused with 78.
• 5b, in a throwaway worktree: git config --get core.hooksPath printed scripts/git-hooks. With a clean file staged, git hook run pre-commit scanned 11 bytes, found no leaks, and exited 0. With a planted generated key, it reported leaks found: 1 and exited 1. In a worktree at v2026.09.24.1 it failed with cannot find a hook named pre-commit.
• The commit's own pre-commit hook, now through the relative core.hooksPath, printed scanned ~13858 bytes, no leaks found.
• CI on fcff41a failed only on the disclosure test, which 13af3fe fixed. CI on cbad6a8 passed every check. validate ran 4744 tests, OK (skipped=551), on the merge with main; validate-macos, secret-scan, verdict-review-gate, the three bootstrap jobs and CodeQL also passed.

Residuals (not fixed in this PR):

• adoption/hardware-profiles.json (lines 110-112) and catalogs/landscape/new-host-grand-list.json:162 still carry sparseVhd: true in the projected workstation profile.
• No bootstrap pin installs Serena or jcodemunch-mcp; step 4a documents a manual install. A Serena pin needs a git-source uv-tool kind: install_uv_tool takes only id==version.
• The recipes/README.md jCodeMunch section still gives plain uv tool install jcodemunch-mcp==1.108.319. That lands outside ${ECO_ROOT}/bin, and this round could edit only the serena row.
• scripts/credential_status.py checks that gitleaks is on PATH, not that it resolves to the guarded launcher.
• scripts/git-hooks/pre-commit is not in v2026.09.24.1. A clone at the pinned tag with core.hooksPath=scripts/git-hooks commits without any hook until a release carries it; 5b now says so and its check fails there.
• Not run on a Mac: the macOS gitleaks link and scan path. Not reproduced by this agent: the PowerShell and wsl.exe items, because the worktree guard refuses Windows interop commands; they rest on the linked upstream docs and source plus the coordinator's observation. Also unverified: the workstation's Hyper-V firewall state, VHD compaction, and the Codex template in a Codex session.
• tests.test_adoption_guarded_runners.BoundedRunCpuQuotaTests (launcher='dropped') failed twice locally in the first round. The runner refused with memory.max is not enforced where the test expects cpu.max. It passed in this round and in CI. Neither the test nor adoption/tools/ scripts are changed here.
• Cross-family Codex review was skipped because of a Codex usage limit through 2026-09-30. This round answers an independent review.

🤖 Generated with Claude Code