Repository navigation
Token topic: 2026-09-27 per-tool card edition with stack-pinned join, drift notes and a weekly native E2E - #437
Conversation
…drift note docs/token-efficiency-stack.json gains a dated edition. 17 rows carry a card condensed from the sanitized token-stack cards: upstream, native adaptation, E2E returned results, adapted performance per payload and lane, invoke rates and GPT-6 review, each labelled with its evidence class. The other 7 rows carry an explicit "no card in this edition" marker. gpt-tokenizer has a card but no stack.json component, so it is listed under edition.cards_without_row. scripts/build_ecosystem.py joins each row to manifests/stack.json for the version and repository and rejects row-level pins. When a card's recorded pin differs from the stack pin, the row shows a drift note instead of editing the card. The build validates every card block's evidence class, each comparison's counts and the card's source bytes and sha256. The edition and its artifacts link at the publication ref. evidence/artifacts/token-stack-cards-20260927 holds the sanitized cards, the invoke snapshot, the 206 cited returned-result records (command, exit, summary and the sha256 of each omitted body), the GPT-6 review index, a README with evidence classes and dates, and the generators. native-token-e2e.yml adds a weekly Monday 07:11 UTC schedule. AGENTS.md and docs/token-session-handbook.md each gain one pointer to the rows. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
…ef's path list — coordinator to accept or reassign) The page's only inline script lives in docs/ecosystem/template.html, so the edition header, the stack-pinned drift note, the no-card marker and the six card blocks (upstream, native adaptation, E2E returned results, performance per payload and lane, invoke rates, GPT-6 review) render there. Each block states its evidence class; figures keep their lane, payload and unit and are never added across them. Only existing helpers (make/add/link with safeHref, textContent) are used; the build recomputes the CSP script hash. tests/test_ecosystem_manifest.py runs the real template through the Node page harness and asserts the rendered card text, the drift note and the no-card marker. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
…dence manifest, PR files re-registered) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…437 review H2) docs/ecosystem/template.html topicCard renders upstream.recommended_install.url, recommended_wiring[].url, new_since_pin[].url and limitations[].url as links, but token_topic_card returned the card unchanged, so these reached safeHref, which accepts any http/https URL. Each now passes public_url, the gate card.source and the build's other external source links use; a rejected URL fails --check with the card's source path and the field. Tests plant http://, 127.0.0.1 and javascript: URLs in each field (12 cases, all passed the unchanged build) and accept a clean HTTPS set unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…d basename (#437 review H5e) source() records each input under clean_text(path.name), but main() read inputs["returned-results.json"], so renaming the --returned-results file raised KeyError at line 190. The subset's source block now uses the supplied basename for both the lookup and its name; with the canonical name the output is unchanged. tests/test_token_stack_cards.py runs bundle.main on a synthetic input set under both names (the renamed case raised KeyError before the fix). Co-Authored-By: Claude Opus 5.5 <[email protected]>
…t figures (#437 review H1) The five native_snapshot figures (rtk 42,367,855 and 26,531,271, headroom 579,411, context-mode 3,244,032 and 6,311,424) cited private assembly inputs only. tools/counter_readings.py opens the private token-report ledger read-only (sqlite3 URI mode=ro), matches each entry to its one snapshots row on tool, $HOME-relative scope, observed_at to the second and saved figure, requires the kind and session estimate the entry's basis quotes to equal the row's, and writes counter-readings.json: ledger ids 67, 68, 69, 71 and 72 with tool, scope, observed_at, success, saved, kind and, for context-mode, the session estimate (27,109,948 and 157,255). The evidence column and metrics.raw are never copied; the output passes a private-content scan before it is written. The copy re-measures nothing. The README's new section tabulates the backed figures and names the two rtk shortfall figures the card cites without a reading (39.2% over the host's lifetime, 16,493 rtk discover skips): they rest only on the private rtk.json input (sha256 in the Reproduce table) and this artifact does not verify them. The jcodemunch-mcp card has no native_snapshot entry. Tests require an identical reading for every entry, fail when one reading's saved figure, scope or time changes, allow only the sanitized fields and check the README section. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…echeck stamps, stack revision (#437 review H5a-d) (a) Summaries run to 606 characters, not 600: summarize() cuts at 600 and appends the 6-character " [...]" marker; 138 of 206 are cut and 60 exceed 600. The subset's own method field keeps the generator's wording and stays as generated. (b) The 38 exit-null records are 12 MCP requests (seven Claude Code tool calls: six socraticode, one qmd; five mcporter requests to repomix) and 26 shell plumbing, upstream CLI runs, a capture harness and local checks, not "mostly MCP calls". (c) The socraticode, qmd and ai-memory release rechecks are stamped 2026-09-27T01:11:26Z-01:24:04Z (2026-09-26 local). (d) condense.py stops at the first card whose pin differs from manifests/stack.json; the cards assume the stack manifest at 34c5634 (#372), which the rtk and toon cards cite, and 55fc8d1 (#433) has the same pins. The Reproduce section runs condense.py in a temporary root with that manifest; the documented block exited 0 with identical bytes at 2026-09-29T03:28Z (also with 55fc8d1). It also restores the pin sentence the previous commit split. Tests derive each statement from the bundle's data and fail on the previous README. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…cards are dated snapshots (#437 review H4) The line this PR added made each tool's topic row "its lane and adoption reference", but the cards are dated 2026-09-26/27 snapshots and the qmd card's lane_rule is already superseded by the SubagentStart carrier (adoption/hooks/claude/token-lanes-block.md L9 also names foundation-docs and foundation-adoption). The row is now the adoption reference, the current lane list is the carrier block, and each card block is called a dated snapshot. Co-Authored-By: Claude Opus 5.5 <[email protected]>
review H4) AGENTS.md: the pointer this PR added now makes a tool's topic row its adoption reference, calls its card a dated snapshot, and names the SubagentStart carrier block (adoption/hooks/claude/token-lanes-block.md) as the current lane list; one line, no other line touched. manifests/evidence.json registers the changed listed files (AGENTS.md, docs/token-session-handbook.md, scripts/build_ecosystem.py, tests/test_ecosystem_manifest.py, the card bundle README and tools/bundle.py) and the new evidence files counter-readings.json and tools/counter_readings.py. component_matrix.py --write and new_host_grand_list.py --write left their four reports unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…ist guard, test comment (#437 verifier findings) The round-one verifier found the README's reproduction block reported cmp's status, so it passed even when condense.py stopped: the block now runs under set -e and the README states the measured exit statuses of the block as written and with the current stack manifest. The truncation sentence names its condition (cut at the last space only when it is past character 300). token_topic_card's list guard now rejects any non-list, including a falsy one: a test covers {}, "" and null and fails against the previous guard. A test comment states where card.source.url comes from. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…t, branch files re-registered) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…t, branch files re-registered) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
|
Trading lane acknowledgement (
No objection. Please re-ping if the head changes. |
…t, branch files re-registered) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
|
Trading lane re-acknowledgement at head |
|
Review record, 2026-09-29 (native-agent-stack-10). Merge candidate: head
|
…t code (#494) `gh pr checks --required` exits 0 for a cancelled required check (gh v2.101.0 checks.go L248-252: only failed and pending change the exit code; aggregate.go L72-88 sends CANCELLED to bucket cancel), and a failed check wins over a pending one. Measured on #437 after its macOS smoke run was cancelled. The documented guard printed the exit code as the verdict; it now prints the count and the set of buckets and merges only on `pass`. Adds a dated correction to the merge-guard mechanics entry, an anti-pattern log row and a structural test that fails on the previous text. Co-authored-by: Scout <scout@local> Co-authored-by: Claude Sonnet 5.5 <[email protected]>
…he pinned version #437 adds per-tool card blocks to docs/token-efficiency-stack.json. The agentsview card names 0.43.0 on 12 lines as dated card facts (the pin the card recorded), so main's RepinLocationRegistryTests, which pairs every matching line of a re-pin file with a recorded location, failed with 14 matching lines against 2 recorded locations (CI run 36526587362). The registry entry now records dated_record_lines (count 12, with its basis) and location_mismatches counts them exactly; a wrong count fails a new test. A re-pin still changes only the two install lines. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…manifest (manifests/evidence.json only; last commit per docs/lanes.md) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
|
Trading lane re-acknowledgement at head |
|
Addendum to the review record (native-agent-stack-10): the merge candidate is head |
Summary
This PR adds the dated 2026-09-27 card edition to the explorer's token topic. The topic data is
docs/token-efficiency-stack.json, andscripts/build_ecosystem.pyrenders it.Carded rows. 17 of the 24 rows carry a per-tool card with six blocks:
Each block names its evidence class.
Rows without a card. The other 7 rows carry an explicit "no card in this edition" marker: claude-hud, otel-tui, opentelemetry-collector-contrib, prometheus, loki, grafana and omniroute.
Pins. The rows carry no pins of their own. The build joins
manifests/stack.jsonbycomponent_id. When a card's recorded pin differs from the stack pin, the row shows a visible drift note, so stale card facts cannot pass as current.Evidence.
evidence/artifacts/token-stack-cards-20260927/holds:Workflow and pointers. The native token E2E workflow gains a weekly schedule.
AGENTS.mdand the token session handbook get one pointer line each; the card is a dated snapshot, and the current lane list is the SubagentStart carrier blockadoption/hooks/claude/token-lanes-block.md.Counter readings.
counter-readings.jsonretains the five sanitized ledger readings (ids 67, 68, 69, 71, 72) that the rtk and Context Mode cards cite, copied read-only from the source host's private ledger, withtools/counter_readings.py. Figures with no retained reading are listed as unverified in the README.Link gate.
token_topic_cardpasses the four card link fields (upstream.recommended_install.url,recommended_wiring[].url,new_since_pin[].url,limitations[].url) through the samepublic_urlgate as every other external link.Changes
Commit
7bc308f2: content (the builder'sc7f74f80, replayed onto55fc8d17)docs/token-efficiency-stack.jsoneditionblock:cards_without_rowfor gpt-tokenizer;rows[].cardon all 24 rows and updates thescopesentence.scripts/build_ecosystem.pytoken_topic_card()validates each row's card:evidence/artifacts/whose bytes and sha256 match;version,pinorrepository.pin, joined frommanifests/stack.json;pin_drift, when the card's recorded pin differs;card_marker, for a row without a card.main.tests/test_ecosystem_manifest.py: four tests:evidence/artifacts/token-stack-cards-20260927/(25 files, 1.36 MB):returned-results-subset.json: the 206 records the cards cite, out of 711. Each keeps its command, exit, status, a summary of at most 600 characters, and the bytes and sha256 of the omitted observation.invoke-by-tool.jsonandgpt6-reviews.json.tools/bundle.pyandtools/condense.py..github/workflows/native-token-e2e.yml: addsschedule: - cron: '11 7 * * 1'(Monday 07:11 UTC). Thepush,pull_requestandworkflow_dispatchtriggers are unchanged.AGENTS.md(Token practice) anddocs/token-session-handbook.md: one pointer each, to a tool's row bycomponent_id.Commit
799ea5a6: template (the builder's97000bc3)This file was outside the builder's path list; the coordinator accepted it, because the page's only script lives there.
docs/ecosystem/template.html: the page's only inline script now renders:It uses only the existing helpers:
textContent, andlink()throughsafeHref. The build recomputes the CSP script hash. There are no CSS changes. Without this commit the new fields exist in the page data but are not visible.tests/test_ecosystem_manifest.py: a Node page-harness test over the real template. It asserts 21 rendered strings and the marker row.Repair round (2026-09-29, native-agent-stack-10)
Head reviewed:
e2864493, by two model families, read-only. GPT-6 (gpt-6-astra, effort max,codex exec -s read-only; the model is the-mrequest, not an observed resolution): needs_changes (1 major, 2 minor): the rtk and Context Mode history totals cite../html-report/savings.jsonwith no retained counter reading;bundle.pyhardcodes an input key; theAGENTS.mdpointer sits in a content commit, not the last one. Claude security-reviewer (Opus, max): approve_with_nits (1 minor, 2 nit): the four card link fields were unguarded; a malformedlive_otelthrows at render; the unattended weekly install. Claude evidence-reviewer (Opus, max): needs_changes (1 major, 5 minor, 5 nit):AGENTS.mdis a shared hot file, so the PR islane:shared, notlane:foundation; the pointers make a dated card look current; unretained figures; undated comparison rendering; README wording.Repair by an Opus builder in an owned worktree, then an independent Opus verifier that re-ran the checks (
ready_to_pushtrue, 1 minor and 4 nit): the counter readings andtools/counter_readings.pyabove; the URL gate above;bundle.pykeys inputs by basename; the pointer text above, in the last commit with the registry; README corrections. The verifier's findings are fixed in934567c2:condense.pyreproduction block now runs underset -e. Measured 2026-09-29: as written it exits 0 with identical bytes on the recordedmanifests/stack.json(34c56340); with the currentmanifests/stack.jsonit exits 1, becausecondense.pystops at socraticode, whose card records 1.14.0 against the pinned 1.15.0.upstream.get(field, []), so any non-list value is rejected (the builder'sor []let a falsy{}through, which the page's.mapthen throws on);test_topic_card_list_fields_reject_any_non_list_valuefails 9 subtests on the old guard.card.source.urlcomes from (file_url).Cross-PR repair (CI run 36526587362 at
07a656cc). The requiredvalidatecheck failed in "Test validation failure modes": 2 failures intests.test_agentsview_qualification.RepinLocationRegistryTests(7,266 tests, failures=2, skipped=719). That test, merged with #420, pairs every line of a re-pin file that names the pinned version with a recorded location, and the agentsview card indocs/token-efficiency-stack.jsonnames 0.43.0 on 12 more lines as dated card facts (the pin the card recorded), so it found 14 matching lines against 2 recorded locations.7737c91caddsdated_record_lines(count 12, with its basis) to that registry entry, makeslocation_mismatchescount them exactly, and addstest_the_dated_record_line_count_is_exact(a count that is off by one either way fails). Measured red-first: with the previous test the two failures reproduce on this tree; with the change, 17 tests OK. A re-pin still changes only the twoinstalllines. This touchestests/test_agentsview_qualification.pyand the #420 artifact'squalification.jsonandREADME.md; it is not reviewed by a second agent.The lane label is
lane:shared. The trading lane must acknowledge on this PR at the head SHA it reviews (docs/lanes.mdL149-150) before merge; it acknowledged07a656cc, and this head adds the commits above, which touch no trading path and no shared hot file beyond the evidence manifest.Not edited
manifests/evidence.json: the coordinator re-registers it in the last commit of each replay under the hot-file protocol. The latest re-registration (34 files) followed the merge of main6ac2b604;ac5e05adre-registers the three registry files.manifests/stack.json: owned by the pin-upgrade PR.Evidence
Repair round (measured 2026-09-29 by the coordinator at head
ac5e05ad, main6ac2b604merged in; a merge with main16f3c7feis textually clean)Local integration checks and repository unit tests, not upstream tests; every command exits 0.
python3 -B -m unittest tests.test_ecosystem_manifest tests.test_token_stack_cards tests.test_agentsview_qualification tests.test_stack_lifecycle: 91 tests OK.python3 -B scripts/build_ecosystem.py --check: passed, 14,113,463 bytes, output sha256633d67f5a12ea2e25b26e5b9a788b6f235c544d156d39f6b22373b660f9c2907. A render of that tree carries exactly 2 pin-drift notes: socraticode (card 1.14.0, stack 1.15.0) and ccusage (card 20.0.24, stack 20.0.26).python3 -B scripts/validate.py:{"components": 69, "hashed_files": 8053, "profiles": 4, "receipts": 168, "status": "passed"};scripts/new_host_grand_list.py --check: passed, 32 layers.python3 -B -m unittest tests.test_adoption_docs_consistency tests.test_token_e2e_preregistration tests.test_context_mode_practice_docs: 76 tests OK, 1 skipped (data-conditional; not a pass for that case).Original build (historical; head
433a4f1f, not re-run here)Commands ran from the repository root, with
TMPDIRset to a private scratch directory.KeyErrors ('pin', 'pin_drift', 'card_marker'); the 7 rejection cases did not raise.python3 -m unittest tests.test_ecosystem_manifestpython3 scripts/build_ecosystem.py --checke82e6be7: 13,576,911, so +2.8%). Output sha25678e1d3e8134b999a….python3 scripts/build_ecosystem.py --render-to <scratch>/index.html, then the page harness over itundefined, 0NaN, 0[object Object]and 0Infinity. All 21nullhits are card prose, e.g.source_pin: nulland/dev/null. Each of the 17 cards renders one "Latest release", "Records" and "Verdict" line.manifests/stack.jsonandcatalogs/landscape/upstream-snapshot.jsonpython3 scripts/validate.py --scan-fileon the rendered page/home/hits are 12 of the pre-existing/home/exampleplaceholder fromevidence/receipts/portable-userspace-install-20260921.json.python3 scripts/validate.py --scan-fileover the bundle data files and the topic JSON, then overtools/*.pyAGENTS.md, handbook and workflowconversation_idin a base recipe.gitleaks git --log-opts="e82e6be7..HEAD"97000bc3, whose pre-commit hook ran underGIT_TRACE=1: that hook exited 0 but loggederror="stderr is not empty"and scanned about 6.0 KB, against about 10.0 KB in two direct runs of the same hook on the same staged diff (both reported no leaks).python3 scripts/validate.pyuv run --no-project --with pyyaml==6.0.1 python -m unittest …test_catalog_freshness_propose…test_general_publication_validator_passes_after_the_run, whose validator output is exactly the 39 registration errors. In the registered scratch copy that module passes (Ran 80, OK). The 13 skips are environmental (see Residuals).git diff --checkzizmor --offline(1.30.1), on the workflowzizmor --offline --persona pedanticanonymous-definition(info) andconcurrency-limits(low).tools/sota-convergence/extract_layers.py, run over this checkout, covers all 24 token rows by repository throughmanifests/stack.json. gpt-tokenizer is not covered because it is not a stack component.At the registered head
433a4f1f, replayed onto main55fc8d17(after #433) with content lines identical (coordinator):python3 scripts/validate.py: FAILS=0.python3 -m unittest tests.test_ecosystem_manifest: Ran 61 tests, OK.python3 scripts/build_ecosystem.py --check: passed, 13,955,333 bytes.git diff --check 55fc8d17 HEAD: clean.validate.ymlpins actionlint 1.7.12 with its sha256.The bundle README defines the evidence classes:
o200k_base);Figures are never summed across classes, lanes or scopes. The cards are dated evidence from one source host (
nativestack-5975wx-20260925, runs on 2026-09-26). They are not a new host's acceptance, an unchanged upstream test suite or a new provider run.SOTA sources
GitHub Actions:
scheduleevent: "Thescheduleevent can be delayed during periods of high loads … High load times include the start of every hour … some queued jobs may be dropped." Scheduled workflows run only on the default branch.on.schedulesyntax: POSIX cron, UTC by default.The installed workflow auditor is zizmor 1.30.1, the release the repository already cites (commit
99a054ed).Per-tool upstreams at the pins the build joins from
manifests/stack.json. The version in parentheses is the card's upstream latest-release read.8f7b34ab, https://github.com/jgravelle/jcodemunch-mcp (v1.108.319)c6fbd1c5, https://github.com/oraios/serena (latest release v1.7.0; the pin is a git build)manifests/stack.json(the card records 1.14.0 @2218f251, and its row shows a drift note), https://github.com/giancarloerra/SocratiCode (v1.15.0)433a19f3, https://github.com/akitaonrails/ai-memory (v2.4.1)80b4280a, https://github.com/yamadashy/repomix (v1.18.1)manifests/stack.json(the card records 20.0.24 @ecb676cc, and its row shows a drift note), https://github.com/ccusage/ccusage (v20.0.26)tools/token-report/token_manifest.py, https://github.com/niieani/gpt-tokenizer (4.0.0, 2026-08-16)The 7 rows without a card join their pins from
manifests/stack.jsonthe same way.Residuals
manifests/stack.json, so those two rows show drift notes until a new card edition is recorded; no card edit is needed. Headroom, agentsview and serena are not bumped, and the freshness check requirescatalogs/landscape/upstream-snapshot.jsonto move with each pin. Drift compares the card's recorded pin with the stackversionstring; a change tosource_pinalone does not show.manifests/stack.jsoncomponent. It stays pinned at 3.4.0 here; the upstream 4.0.0 qualification is a separate change.latest_releasefields are long prose with their sources, and they render verbatim.condense.pyreproduces its own output byte for byte.bundle.pyneeds the private assembly inputs, which the README identifies by bytes and sha256.native_token_ci.py --installrun whose npm and PyPI dependencies resolve unpinned, with audit-only egress: a design point for the foundation owner, not changed here.16,493rtk discover count has no retained reading. Both need a retained receipt or removal in the next edition.counter-readings.jsonalso publishesmetrics.session_estimated_savedfor the two Context Mode readings (27,109,948 and 157,255); the verifier checked both against the ledger copy and the card's basis text.public_urlgate rejects onlylocalhost,127.0.0.1and[::1]among local hosts; it acceptshttps://127.0.0.2,10.0.0.1,192.168.1.1,169.254.169.254and0.0.0.0, for the card links and every other link it guards. Tightening it is a policy change for the build owner.template.htmlstill dereferenceslive_otel.windowandseriesunguarded, and drops each comparison'sfirst_seen/last_seen;token_topic_carddoes not validate either. Neither is a security defect.condense.pychecks a card's pin with a barestartswith;returned-results-subset.jsonandbundle.pystill say "at most 600 characters" (the README states the measured 606), because correcting them needs the private inputs.counter_readings.pyreproduces only on the source host, whose private ledger holds the rows; thecondense.pyblock needs full history (34c56340,55fc8d17and3058b237are on main).validatejob runs the pinned 1.7.12.NAS_CODEX_INTEGRATION=1with codex-cli 0.157.1.CONTEXT_MODE_SECURITY_JS, a real bash 3.2 or shellcheck.Lane:
lane:shared(it editsAGENTS.md, a shared hot file). The trading-lane acknowledgement is required at the head SHA it reviews before merge.🤖 Generated with Claude Code