Record SocratiCode and ai-memory use receipts on nativestack-5975wx-20260925 - #257

Scope

• What this PR changes:
  • Two use-stage host receipts for host nativestack-5975wx-20260925 (the WSL2 Threadripper PRO 5975WX / RTX 4090 workstation recorded by Record the nativestack-5975wx-20260925 WSL2 workstation: measured profile and 21 host receipts #231), in three files under evidence/hosts/nativestack-5975wx-20260925/: socraticode (the first recording and a -2 generation that supersedes it) and ai-memory. All three pass, are native_proven, and carry only the recorder's self review (see Host evidence).
  • The regenerated catalogs/landscape/component-evidence-matrix.json and docs/component-evidence-matrix.md, and the manifests/evidence.json registrations. The new-host grand list is unchanged by these receipts.
• Base commit: b792d6e6 (Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177). The receipts were recorded from a worktree at 720e294b (then origin/main), so catalog_revision stays reachable after a squash merge. Each rebase, onto f036e96e (Bind host receipts to landscape winner ids: refuse stack-id aliases, list unbound Mac receipts #214, which changed the receipt binding rules), d2daa169 and b792d6e6, followed the docs/lanes.md hot-file protocol: main's manifests/evidence.json, the three receipts re-registered, both reports regenerated with main's generators, and the checks below rerun.
• Lane: lane:foundation (evidence/hosts/** and generated foundation reports; the manifest change is registrations only).
• Owned paths touched: the files above only.

Evidence-class table

Paths are evidence/hosts/nativestack-5975wx-20260925/nativestack-5975wx-20260925--<component>--use--20260925[-2].json. Each command exits 0 only when its check holds.

What these do not show. SocratiCode: one real question with a fixed two-file oracle, not a recall benchmark. The question uses the repository's own terms (gate ladder, flip); before recording, three paraphrases without "gate" or "ladder" returned neither oracle file in their top eight. Indexing, update, watcher, removal and recovery (the requirement's recoverable-state part) were not exercised; the index already existed and is kept by other processes. No native Claude or Codex MCP call is part of the receipt. ai-memory: FTS5 search on a scratch store with embeddings disabled. Hybrid retrieval, the MCP tools, native lifecycle capture, consolidation, handoffs, backup, restore and recovery were not exercised.

Rehearsal. Every command was rehearsed through the recorder's own execution path (/bin/sh from the repository root, sanitized 400-character excerpt) before recording. The rehearsal found that on this host ai-memory --data-dir <scratch> alone does not isolate a probe: AI_MEMORY_SERVER_URL routes the CLI to the host's service, and a status with only --data-dir reported the host store. The recorded probe therefore runs its own server and sets AI_MEMORY_SERVER_URL and --data-dir on every call. Of the recorded commands, only the first calls the host service, for the read-only status. As a separate check after recording, a read-only ai-memory search --workspace nsr-probe --project nsr-probe 'nsrprobe*' against the host service returned workspace 'nsr-probe' not found, so no probe page from rehearsal or recording reached the host store.

Not recorded, and why

• Alert route (Prometheus, Alertmanager, ntfy, Grafana). Alertmanager and ntfy are observation-inference alternatives (conditional) and Grafana is an alternative (overlap); none is a landscape winner, so a receipt under their ids binds to nothing. The route's winner, prometheus, already has today's independently agreed use receipt (Record the nativestack-5975wx-20260925 WSL2 workstation: measured profile and 21 host receipts #231), and a same-day alert-delivery receipt would have to supersede it. Not run: ~/.config/ecosystem-observability/acceptance-targets.json was not touched (still []), and no notification was produced.
• Grand-dashboard emitter acceptance. Not a stack component or landscape winner. observability/grand-dashboard/README.md records acceptance through committed receipts (receipt.json, passwordless.json, capacity-recovery-20260921.json), not dated per-host notes, and acceptance.py writes to a private output by design, so there is no existing host-note format to add to. Nothing was added, and the earlier 10/10 queries and 3/3 generation checks were not repeated here.
• Dagu dashboard on 18525 (GET /api/v1/dags 200 without a challenge, API run POST 403). There is no separate component or stage for it: serving requests is use, and dagu already has today's use receipt (Record the nativestack-5975wx-20260925 WSL2 workstation: measured profile and 21 host receipts #231).
• Skills (skills-ref validate of typesafe-ai, gh-fix-ci and security-best-practices). The instructions-skills winners candidate:typesafe-ai-skills and candidate:openai-skills are pinned unpinned, which pin_matches never binds, and Agent Skills reference tools (skills-ref) is an alternative, not a winner. Not run.
• gitleaks guarded launcher. Not a separate component; Record the nativestack-5975wx-20260925 WSL2 workstation: measured profile and 21 host receipts #231's gitleaks use receipt already checks the launcher's hashes.

Deferred: the memory-stack rationale defect (no commit)

In catalogs/foundation/memory-stack-20260925.json, the OpenViking and Basic Memory rows repeat Honcho's rationale. A two-line correction was prepared, with its manifest rehash, and validate.py passed on it. It is not in this PR:

1. evidence/artifacts/memory-stack-20260925/experiment.json observation recorder-artifact-check pins the catalog's sha256 (a5d2b964…). With the edit, python3 scripts/validate_convergence.py --all-recorded (a step of the validate.yml CI job) fails: record.observations[23].artifacts[2]: SHA-256 mismatch. Passing it means re-pinning that sealed record, then updating its README hash table, its SHA256SUMS and the matching manifests/evidence.json entries. That goes beyond a rationale-only change.
2. The file's skeptic_corrections note says any field not listed in corrected_fields or updated_fields is the convergence table's cell verbatim. Row 8 has one cell covering Honcho, OpenViking and Basic Memory together, so the repeated rationale is that documented transcription. Changing it silently would make the note false for these rows.

Fixing it needs a decision on how to record the correction, for example a dated re-pin note like #242's for a frozen source. The proposed text, supported by the lane returns and the convergence stage-one notes:

• OpenViking: "AGPL-3.0 conflicts with a trading lane that may become commercial. The lanes found only vendor LoCoMo QA figures for OpenViking and no LongMemEval score, although its repository has a LongMemEval harness; the Codex lane also lists provenance through extraction and Codex hook/version restrictions as risks"
• Basic Memory: "AGPL-3.0 conflicts with a trading lane that may become commercial. Basic Memory was on neither lane's shortlist; the lanes found only a vendor LoCoMo R@5 figure for it and no LongMemEval result"

Local commands run

System python3 ran every command below; none needed the uv fallback.

$ python3 scripts/host_receipts.py record ...   # socraticode use, then --supersedes it as -2, then ai-memory use: result=pass each
$ gitleaks dir evidence/hosts/nativestack-5975wx-20260925 --no-banner --redact   # all 24 receipts, ~176.4 KB scanned, no leaks found
$ git config --show-origin --get core.hooksPath   # file:.../.git/config  scripts/git-hooks (relative)
$ git commit ...                                 # pre-commit gitleaks: ~33.6 KB scanned, no leaks found
$ python3 scripts/component_matrix.py --write     # {"flip_rule_violations": 0, "rows": 32, "status": "written"}
$ python3 scripts/new_host_grand_list.py --write  # {"status": "written", "layers": 32, "winners": 66}
$ python3 scripts/host_receipts.py validate       # {"receipts": 40, "status": "passed"}
$ python3 scripts/evidence_manifest.py --check    # {"files": 5448, "status": "passed"}
$ python3 scripts/validate.py                     # passed: 69 components, 5448 hashed files, 4 profiles, 146 receipts
$ python3 scripts/verdict_review_gate.py --base origin/main   # passed: 0 changed rows, 0 violations
$ python3 scripts/validate_convergence.py --all-recorded --root . --json   # valid (22 records)
$ python3 scripts/component_matrix.py --check && python3 scripts/new_host_grand_list.py --check   # checked, passed
$ python3 scripts/receipt_staleness.py            # 35 buckets, 0 flagged; ai-memory and socraticode 2/2 bound
$ python3 scripts/verdict_flip_candidates.py      # 19 candidates, none for socraticode or ai-memory (both already accepted on linux-wsl2)
$ python3 scripts/landscape.py --root . && python3 scripts/validate_catalogs.py && python3 scripts/validate_foundation.py --root . --json   # passed
$ python3 scripts/build_ecosystem.py --check && python3 tools/sota-convergence/build_verdicts.py --check   # passed, checked
$ python3 scripts/release_due.py --strict-if-repinned origin/main   # exit 0 (non-strict), reports release_due
$ python3 -m unittest                             # on d2daa169 + this change: Ran 5239 tests in 413.6s: OK (skipped=659); not rerun after the last rebase, whose three commits (#177, #252, #255) change no receipt, receipt tool, generator or generated report

core.hooksPath printed the absolute form that #231's Finding 6 describes at the start of this session. By the first commit it printed the relative scripts/git-hooks, so the pre-commit gitleaks hook ran on every commit here. This session did not change the setting.

Decision record

None. This PR records host evidence only. It selects no winner, records no verdict and flips no platform_status.

Host evidence

• python3 scripts/host_receipts.py validate passes for every new receipt (40 receipts, passed).
• Independent review is recorded (scripts/host_receipts.py review) or explicitly requested in this PR. Requested; needs an independent_session review before merge. Each receipt carries only the recorder's self review. A reviewer in a separate Claude Code session, a Codex session or a person should check the four points in docs/contributing-evidence.md step 8 (layer role, positive control, backed claims, bound to the winner) for the socraticode -2 and ai-memory receipts and append a review. The recording identity (7d328d4b…, the same session that recorded Record the nativestack-5975wx-20260925 WSL2 workstation: measured profile and 21 host receipts #231) is refused as a reviewer. Codex cross-family review is skipped: the Codex account's usage limit runs until 2026-09-30.
• No platform_status change is made from a host receipt alone. catalogs/landscape/{foundation,us-equities}.json and adoption/manifest.json are unchanged.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment. No workflow changes.
• New/changed workflows declare top-level permissions: contents: read. No workflow changes.
• No secrets are printed, logged or committed; no new required secret was added. The receipts were re-read and scanned with validate.PRIVATE_CONTENT (no home paths, usernames, UUIDs or token patterns), and gitleaks found no leaks. No credential store was read, and no ai-memory page, session or observation content was printed.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved. This work ran in its own worktree, and the alert acceptance fixture and the indexed clone were only read.

🤖 Generated with Claude Code