Point new machines at the attested release v2026.09.25.2 - #286

Scope

• What this PR changes: points new machines at the attested release v2026.09.25.2. It sets adoption/manifest.json source.release_tag to v2026.09.25.2 and release_commit to f5812d3f2266399b0c3df3ea76aa6720c7f3e598, and re-registers the file's hash in manifests/evidence.json.
• What the release adds over v2026.09.25.1:
  • the token-efficiency profile and adoption_status.py --client-wiring (Token-efficiency coverage check: adoption profile plus value-free --client-wiring for every host #264);
  • the Hugging Face native credential, guard and SHA256SUMS (Hugging Face sign-in as a value-free native credential: status rows, guard, deny rules, per-host token policy #268, Bootstrap page: mark adoption/hooks/claude/ as changed after v2026.09.25.1 (fixes the docs-consistency test on main) #271);
  • host roles and host-request systemd templates (Host request lane: other PCs ask the GPU workstation for memory/RAG/model-hosting work through GitHub issues #266);
  • client template changes (Client templates: stop MCP Inspector opening a browser when an agent runs it (mcp-inspector --version popups) #275, Portable Claude profile: no silent fallback to an older model; StructuredOutput fields at the top level #272) and the token-report hook engine (Token report: take the Codex hook engine from the stable hooks flag; drop the removed plugin_hooks step #265);
  • two release-relative instructions made durable (Keep two release-relative instructions true after the next release #279).
• Release window: merges that touch new-machine files were held by native-agent-stack-8c, native-agent-stack-e7, cleanup-wsl-audit-nativestack and token-efficiency-foundation-catalog. Portable Claude profile: no silent fallback to an older model; StructuredOutput fields at the top level #272 merged during the window, so the tag moved from cd17bda2 to f5812d3f to include it.

Release evidence (verified 2026-09-25)

• Tag v2026.09.25.2 (annotated object dd48d5c1) points at f5812d3f, whose main CI passed: validate, token report, adoption bootstrap smoke, published evidence, security scan and Scorecard.
• publish-catalog run 36187069785 succeeded (publish and release jobs). The release is immutable, not a draft and not a prerelease.
• gh attestation verify, with --signer-workflow .../publish-catalog.yml --source-ref refs/tags/v2026.09.25.2 --source-digest f5812d3f... --deny-self-hosted-runners, succeeded for:
  • the .tar.gz, SLSA provenance v1, sha256 f3b739be2a7b4441e720cd78ba38b7ae38045be6cbf67eea5538dc2646eba63f;
  • the .spdx.json, predicate https://spdx.dev/Document, sha256 184c57adce203c618e5bf06168c625fd1e7f764115104ec19da4a18807204c67.
• gh release verify-asset succeeded for both assets, and gh release verify v2026.09.25.2 succeeded.

Checks run on this branch

• scripts/release_due.py --strict-if-repinned origin/main: status current.
• tests/test_adoption_docs_consistency.py, tests/test_adoption_contract.py and tests/test_release_pin_contents.py: 63 passed, 1 skipped. The skip is expected: no profile's coverage differs between the pinned release and HEAD.
• scripts/validate.py: passed. This covers integrity and scope only, with no live provider or GPU execution.

🤖 Generated with Claude Code