Landscape sweep 2026-09-29 record: 20 foundation layers, 188 candidates, 37 survivors, manifest-20260929 (six layers reopened by Codex 429s) - #506

Scope

• What this PR changes: records the 2026-09-29 landscape sweep of the 20 foundation layers as evidence and appends it to the saturation ledger. It adds catalogs/sota-convergence/manifest-20260929.json (188 candidates, the lane merged into the dated manifest), 37 per-survivor upstream source reviews and the sanitized returns (evidence/artifacts/landscape-sweep-20260929/), three usage records (evidence/artifacts/landscape-sweep-20260929-attempts/: the full run, the passed one-layer smoke and the smoke stopped at its start), one ledger record, and the regenerated component matrix. It changes no selection, pin or winner: a survivor is a candidate that neither refuter refuted, and adopting one still needs the preregistered head-to-head against the incumbent.
• Base commit: df412368
• Lane: lane:shared. catalogs/sota-convergence/* and manifests/evidence.json are shared hot files (docs/lanes.md), as in the 2026-09-26 sweep record (Landscape sweep 2026-09-26 record: all 32 layers, 56 survivors, manifest-20260926 for the verdict wave (11 lane limits) #357). The 12 us-equities layers were not swept; the trading lane's acknowledgement is requested before merge.
• Owned paths touched: catalogs/sota-convergence/manifest-20260929.json (new), catalogs/saturation/ledger.json, evidence/artifacts/landscape-sweep-20260929/ (new, 38 files), evidence/artifacts/landscape-sweep-20260929-attempts/ (new, 3 files), catalogs/landscape/component-evidence-matrix.json and docs/component-evidence-matrix.md (regenerated with scripts/component_matrix.py --write), catalogs/landscape/new-host-grand-list.json and docs/new-host-grand-list.md (regenerated with scripts/new_host_grand_list.py --write, no change), manifests/evidence.json (registrations only), .gitleaks.toml and tests/test_gitleaks_config.py (the by-value allowlist of the catalog pin ids gains this manifest's exact path; see the secret-scan note below).

SOTA sources

• The packaged sweep harness and its runbook: tools/sota-convergence/landscape-sweep/README.md (unchanged between the staged commit 16f3c7fe and the base), recipes/saturation-sweep.md and recipes/sota-convergence-practice.md (the six commands). Every step below is the harness's own command; nothing was written for this record.
• Upstream freshness and facts come from the workers' own reads, retained in returns.json: 870 gh api calls on the Claude side and 750 on the GPT-6 side (GitHub REST: releases, READMEs, advisories, 90-day commits), 130 and 184 page fetches, and 138 WebSearch calls (none refused by the session cap). Each survivor's source review names its repository, the reviewed commit and the README path (evidence/artifacts/landscape-sweep-20260929/<owner>-<repo>.json, written by source_reviews.py through gh api).
• Usage accounting: ccusage 20.0.26 (ccusage claude session --json --offline, https://github.com/ccusage/ccusage) and the vendored child-usage.mjs through usage_record.py.

Evidence-class table

Local commands run

$ python3 tools/sota-convergence/landscape-sweep/usage_record.py --transcript-dir <run transcripts> --out <W>/child-usage-wf_08a5b367-311.json
exit 0  status complete, 131 children, 0 incomplete, 0 effort mismatches
$ python3 tools/sota-convergence/landscape-sweep/convert.py --workflow-output <W>/run-wf_08a5b367-311.json --work-dir <W> --usage <child-usage> --out <W>/out --limit ...
exit 3  4 possible private strings by pointer and kind (never the text); redacted 7 strings (below), re-run clean
$ python3 tools/sota-convergence/build_manifest.py --work-dir <W>/work --lanes <W>/out/lanes.json --out <W>/manifest-20260929.json --checked-at 2026-09-29 --id sota-convergence-20260929
exit 0
$ python3 tools/sota-convergence/landscape-sweep/source_reviews.py --survivors <W>/out/survivors.json --out evidence/artifacts/landscape-sweep-20260929 --lane landscape-sweep-20260929
exit 0  37 reviews
$ python3 tools/sota-convergence/landscape-sweep/make_result.py --layers ... --reopen <W>/reopen.json ... > <W>/RESULT.json
exit 0
$ python3 scripts/saturation_ledger.py --append <W>/RESULT.json && python3 scripts/saturation_ledger.py --check --base origin/main
appended; "ok: 5 sweep record(s), chain intact, bindings verified"
$ python3 scripts/validate.py
exit 0  {"components": 69, "hashed_files": 8125, "profiles": 4, "receipts": 171, "status": "passed"}
$ gitleaks git --pre-commit --staged --redact --no-banner --config .gitleaks.toml .
first run: 192 findings (191 sourcegraph-access-token on bare 40-hex commit ids, 1 generic-api-key on a prose string); after the changes below: no leaks found
$ TMPDIR=/dev/shm/effort-tmp python3 -m unittest tests.test_gitleaks_config tests.test_saturation_ledger tests.test_landscape_sweep_harness tests.test_evidence_manifest tests.test_landscape tests.test_verdict_review_gate
Ran 487 tests ... OK (skipped=4)

Decision record

None new: this PR records a sweep and changes no selection. Redactions and edits made before retention, so nothing is silent:

• convert.py reported four possible private strings by pointer and kind. Seven strings were replaced before retention in worker notes and evidence lists: 3 scratch-directory paths that carried a session identifier (<claude-scratch>), 1 home path (~/) and 3 mentions of the host account name (<user>). Nothing else in the returns was edited. The same statement is in the run's lane limits.
• One documentation excerpt was dropped from the abhigyanpatwari/GitNexus source review: an image URL (github.com/user-attachments/assets/<uuid>) with no informational content, which the validator's session-identifier pattern flags.
• The aborted smoke's usage record is retained with status incomplete (exit 1), as a stopped run.

Secret-scan handling, as for the 2026-09-26 record (.gitleaks.toml, sourcegraph-access-token block): the secrets-credentials refuters' reasoning names the rule id, which makes every bare 40-hex value in the file a candidate. So (1) the lane's free-text 40-hex commit ids were shortened to their first 12 characters in the converted output before the manifest was built (521 in the returns and 127 in the lanes; the retained returns hold none, and each survivor's source review keeps its full reviewed_commit); (2) the manifest's 60 pin values, copied by the generator from the catalog layer files, are the same 39 distinct commit ids that the 2026-09-26 allowlist pins by value (checked value by value: none added, none removed), so only the exact path catalogs/sota-convergence/manifest-20260929.json joins that allowlist, and tests/test_gitleaks_config.py test_d3 and test_d4 now run for both manifests (an unreviewed id, the uppercase form, an sgp_ token and the reviewed ids in any other file stay detected); (3) one worker string, (token-efficiency: <owner>/<repo> and ..., matched generic-api-key as a key/value shape, and its separator was changed to -. The pre-shortening output is kept in the private work directory.

CI on the first head failed two tests/test_agentsview_qualification.py checks (RepinLocationRegistryTests): the new manifest copies the catalog pin of the held agentsview version and was not classified in the hold record's repository_pin_locations. The second commit adds it there as a dated_record, like the other dated convergence manifests (one JSON entry plus its hash registration); the record's search counts still describe the 2026-09-28 tree, and the entry says so.

Flags for the owners:

• flag (Codex capacity): the follow-up GPT-6 votes are missing for the six reopened layers. They need a new Codex account or the weekly reset (2026-10-04T00:35Z); until then those layers stay reopened, as the ledger requires. The user is asked to sign in with a new account.
• flag (not adoptions): the 18 targeted_candidate survivors, for example openai/codex (workers), boxlite-ai/boxlite (isolation), docling-project/docling and opendatalab/mineru (document-retrieval), minishlab/semble, lightonai/next-plaid and ollama/ollama (semantic-rag), mempalace/mempalace, rohitg00/agentmemory and vshulcz/deja-vu (durable-memory), ojuschugh1/sqz (token-efficiency), ukgovernmentbeis/inspect_ai (quality-evaluation), betterleaks/betterleaks (secrets-credentials) and ataraxy-labs/sem (git-github-automation), each carry a comparison_that_would_overturn in the manifest. None is installed or wired by this PR.

Host evidence

Not applicable (no evidence/hosts/ files).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (none changed).
• New/changed workflows declare top-level permissions: contents: read (none changed).
• No secrets are printed, logged or committed; the host account name, home paths and scratch paths were redacted, and the retained files were scanned for user name, home path, scratch path and email patterns (0 matches).
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code