Install receipts for promptfoo and inspect-ai on the workstation (GPT-6 reviewed and repaired) - #317

Summary

Adds install-stage receipts for the two evaluation tools on the workstation, nativestack-5975wx-20260925. Before this, both had only use receipts. The rows below come from the receipt JSON.

Review and repair

GPT-6 cross-family review. Codex gpt-6-astra at effort max reviewed the originals and found three defects:

1. inspect-ai's commands exited 0 even when a step failed. This was reproduced with inspect --version forced to exit 73.
2. Both receipts claimed installer commands and settings without keeping any installer output.
3. The generated matrix was stale.

Repair (Opus). The -2 receipts make every step fail closed and print the status line first. Their claims are narrowed to what the native readbacks show:

• the pins and registry digests;
• npm ls --global --prefix;
• uv tool list --show-paths;
• uv pip check, with a deliberately broken venv as its control;
• --version and importlib.metadata.

Each of 34 single-step mutations fails closed with rc=1. The review and the mutation log are committed, sanitized, under evidence/artifacts/eval-install-repairs-20260926/.

Independent review. A separate headless claude -p session on claude-opus-5-5 re-ran every command, plus one mutated command, and recorded the four reviews in the table.

New finding recorded in the promptfoo receipt: npm ls --all reports one problem, invalid: [email protected]. [email protected] declares an optional peer range of ^3.3.0, while promptfoo 0.123.1 pins chokidar 5.0.0. The command fails on any other problem.

Residuals

• The merged promptfoo and inspect-ai use receipts, …--use--20260925-2, say "this host's existing install", but their own output shows temporary installs. Receipts can't be edited. The GPT-6 repair round for Token-profile install receipts and a MCPorter use receipt on the workstation (MCPorter host_verified) #277/Grand-catalog evidence bank on the workstation: 7 WSL winner rows to accepted, local-model eval E2E (promptfoo, Inspect) #281 supersedes those use receipts.
• The matrix counts superseded passes, so the pass count goes from 2 to 4 per platform. That is how the generator works, and it doesn't change the derived status.

Verification

• scripts/validate.py, host_receipts.py validate, component_matrix.py --check, new_host_grand_list.py --check, evidence_manifest.py --check, validate_catalogs.py and build_verdicts.py --check: all pass.
• verdict_review_gate.py: passed (0 changed rows).
• Related unit tests: 402 OK.

SOTA sources

• promptfoo 0.123.1: https://www.npmjs.com/package/promptfoo/v/0.123.1 (npm registry dist.integrity/dist.shasum); https://www.promptfoo.dev/docs/installation/
• inspect-ai 0.3.266: https://pypi.org/project/inspect-ai/0.3.266/ (PyPI-declared wheel sha256); https://inspect.aisi.org.uk/
• uv tool management: https://docs.astral.sh/uv/concepts/tools/

🤖 Generated with Claude Code