Adopt native Claude profile with pinned community practice and review evidence - #33

…ane authorization, immutable waves, sealed refutations, retained packets (#124)

* Fix the #122 review findings before the 32-row re-record: bind rows to their sealed wave

Independent review of catalog #122 (head 2f19193), findings 1, 2, 3, 5 and 6, plus 7 and 9.
Each has a regression test that fails on 97a56e2.

1. landscape.py recomputes a new-wave row's agreement from both sealed returns' winner_keys,
   resolved through the retained packet, and requires a recorded row's winners to equal the
   chosen lane's set (same_winner/codex_absent: claude; disagree: the adjudication's
   winner_lane); an unrecorded new-wave row carries no winners.
2. --allow-single-lane needs a dated docs/decisions/ record carrying the line
   "single-lane-authorization: <catalog>/<layer_id>"; the record's sha256 is stored on the row
   (lanes.single_lane_decision_sha256) and re-checked in CI.
3. A new wave's --write refuses once its run-manifest.json exists unless --append-rows names only
   absent rows, and never overwrites a sealed file with other bytes. Rows store
   lanes.run_manifest_sha256 and lanes.adjudication_sha256; landscape.py verifies both and rejects
   any file in a new wave's sealed folder that no row or the run manifest references.
5. Re-vendor layer-verdict-lane.js from agent-lab 6aab001 (sha256 2eb9c10d...), registered in
   lane-provenance.json; the return schema gains the refutation summary, claude_lane.py copies it,
   codex_lane.py drops it from the strict copy, and record_verdicts.py and landscape.py reject a
   Claude return whose final was refuted or unknown or lacks a lens vote.
6. --write retains the wave's packets and SHA256SUMS under <sealed_base>/packets/ (manifest
   retained_packets) and refuses withheld keys; CI re-checks hashes and withheld keys with the
   policy lane_packets.py now imports from landscape.py.
7. claude_lane.py and codex_lane.py write <lane>/failures.json; the run manifest records a
   "failed" outcome with its reason.
9. The kept "adopted" marker is documented; the candidate-only note is withheld.

Findings 4 and 8 are left for a later PR. GRANDFATHERED_RUN_IDS and every 20260922 artifact are
unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fix the fix-round review: recursive withheld-key check, manifest-bound adjudications, stray wave folders

Independent review of fcee72b:

- MEDIUM: withheld_packet_keys checked only the positions withhold_popularity
  strips, so nested release/popularity keys, a top-level newcomers list, a
  non-null review_status and decisions[].selection passed CI and --write.
  scripts/landscape.py now walks the whole packet (is_withheld_packet_key,
  shared with lane_packets.withhold_popularity, which strips at any depth),
  rejects the disposition labels on candidate/component copies, and requires
  the always-listed policy labels in withheld[] (proof of --withhold-labels).
  Exemptions: requirement-gated archived/license and the packet's checked_at.
  Real 2026-09-23 packets leaked upstream.latest_flag (tag release/2025-11-28);
  it is now withheld. Default 2026-09-22 packets are byte-identical.
- LOW: the run manifest entry lists a sealed adjudication's sha256; landscape.py
  requires it to equal the row's lanes.adjudication_sha256 and re-hashes the file.
- LOW: a layer-verdicts-<id> folder with a non-alphanumeric id is rejected, not skipped.
- INFO (lane policy edge): kept deliberately and recorded in
  docs/decisions/2026-09-23-verdict-integrity.md with its overturn condition.

Regression tests (fail on fcee72b): test_lane_packets RecursiveWithheldKeyTests;
test_landscape test_retained_packets_are_checked_at_every_depth,
test_a_sealed_adjudication_is_bound_by_the_run_manifest,
test_a_layer_verdicts_folder_no_row_can_name_is_rejected; test_record_verdicts
ReviewOf122Tests test_a_packet_carrying_a_disposition_label_or_a_nested_withheld_key_is_refused,
test_the_run_manifest_lists_each_sealed_adjudication.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Point the vendored lane at its merged agent-lab commit e6953e5 (#33)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Update the SHA256SUMS entry for vendored-lanes.json after pointing it at e6953e5

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Resolve the five Codex review threads on #124

- claude_lane: delete a layer's previous return when its layer now fails
  or its packet is lost, before failures.json is written.
- codex_lane: delete the old output for a layer whose attempts all fail.
- record_verdicts: --append-rows fails before writing when a named row has
  no packet or lane return in the work dir.
- landscape: a retained SHA256SUMS must list every retained packet exactly
  once with its hash; malformed or duplicate lines are rejected.
- landscape: a sealed winner key must name an adopted candidate.

Each fix has a regression test that fails on the previous code. The new
codex_lane.py hash is appended to lane-provenance.json.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Refuse to seal a wave whose SHA256SUMS the landscape check rejects

record_verdicts now applies landscape.py's retained-SHA256SUMS rule before
any write: exactly the retained packets, each once, with its actual sha256.
A --write can no longer seal a wave CI would reject, since a sealed wave is
never re-recorded. The test PacketWriter keeps one line per packet, as
lane_packets.py does, and the three SHA256SUMS tests now expect the refusal
and still check landscape.py against a wave tampered after sealing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>