Linux bootstrap repairs for the GPT-6 findings on #299: socraticode ignore_scripts honoured, pinned headroom wheel verified and installed - #334

Summary

This PR repairs the two GPT-6 cross-family findings on merged #299, which covered Linux bootstrap pins for the token tools.

• 299-1: socraticode ignore_scripts was never honoured. adoption/bootstrap-linux.sh now passes the pin's ignore_scripts through the dispatcher, and install_npm adds --ignore-scripts. A test asserts the actual npm argv through the real install_pin dispatcher.
• 299-2: headroom's pinned wheel url and sha256 were never consumed. The bootstrap now downloads the pinned wheel, verifies its sha256 (exit 1 on a mismatch, before uv runs), and installs that local wheel with the [mcp] extra. Tests include a hash-mismatch rejection.
• This merges onto rtk 0.50.0 hook recipe: exclude git show REV:path in every global-option form and git branch #318 and Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence #314's bootstrap-linux.sh changes: the rtk exclude text check and the five-probe rtk hook check, both kept intact.

Evidence is in evidence/artifacts/bootstrap-integrity-20260926/. It is local_integration, because this is the repository's own script:

• e2e-check.txt covers four scenarios: pass, fixed script with a bad hash, HEAD's script with a bad hash, and a transition. Both bad-hash controls tell the fixed script apart from HEAD's.
• All 547 hashed RECORD entries of the pinned wheel match the installed files.
• The drivers are guarded against deleting a caller's WORK directory. The as-run originals keep their bytes under drivers/as-run/.
• The cheapest upstream-owned offline operations are added:
  • headroom evals adversarial, run twice: exit 0 both times, byte-identical JSON;
  • socraticode's MCP stdio launch: 26 tools, with a failing control.

New-machine input adoption/bootstrap-linux.sh changes here. Each doc unit that describes the changed behaviour carries a "changed after v2026.09.26" marker.

Review

1. GPT-6: reviewed Bootstrap installs the whole token-efficiency profile on Linux (repomix, toon, ccusage, headroom, socraticode, serena pins) #299.
2. Opus: repair, then an independent review, a finisher and a verification.
3. GPT-6 verification pass: 299-1 and 299-2 RESOLVED. The new findings were a stale README hash, the unguarded rm -rf, an upstream-E2E disclosure gap and a failed-attempts disclosure; all are addressed.
4. Tests: the guard tests failed first against the as-run drivers.

Residuals

• The two tools' upstream test suites are unverified. Neither headroom-ai 0.37.0 nor socraticode 1.14.0 ships its suite in the published package, and both suites run only from a repository checkout.
• The upstream-owned operations show the installed tools run offline, but they cannot tell the fixed script's install from HEAD's.
• Not retained: the commands, outputs and code revisions of two failed checker attempts. The README describes them.
• Only the headroom wheel is hash-verified; 72 of the 73 resolved packages come from the index unhashed. Tested on one WSL2 Ubuntu 24.04.5 glibc host only.

Verification

• scripts/validate.py, host_receipts.py validate, component_matrix.py --check, new_host_grand_list.py --check, evidence_manifest.py --check and validate_catalogs.py: all pass.
• bash -n and ShellCheck 0.11.0 are clean on the script.
• Full python -m unittest on this change before its final replay onto main: Ran 6066 tests, OK (skipped=635). After the replay, the related modules and every validator were re-run and pass.

SOTA sources

• npm --ignore-scripts: https://docs.npmjs.com/cli/v10/commands/npm-install#ignore-scripts
• uv tool install from a local wheel with extras: https://docs.astral.sh/uv/concepts/tools/ and https://docs.astral.sh/uv/reference/cli/#uv-tool-install
• PyPA wheel RECORD format: https://packaging.python.org/en/latest/specifications/recording-installed-packages/

🤖 Generated with Claude Code