Qualify Codex 0.159.3 and align the SDK pair - #580

…#626

Configuration owner's round-3 condition for #626, so the JSON and adoption/new-wsl-profile.md agree on main.
Five lines change, the rest keeps the owner's wording:

- L4: the profile stays reconciled with accepted main 85543ef; one clause adds that its Codex CLI and Python SDK
  pins move to 0.160.0, pending PR #626 (basis: #626 and its convergence comment 5970286472).
- L12: Codex CLI and the Python SDK pin are 0.160.0, pending #626 and its cross-family convergence; 0.159.3
  followed the accepted merge of PR #580. The TypeScript SDK sentence is unchanged.
- L103, L191, L205: rust-v0.159.3 -> rust-v0.160.0 in the Codex and Python SDK links, and their table pins. The
  TypeScript SDK row is unchanged.

The md is not a handbook input (scripts/build_new_wsl_handbook.py reads the profile JSON and the distro page), so
nothing is regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n receipt, tests and checkpoint (#626)

* Codex 0.159.3 -> 0.160.0 with the Python SDK pair: pins, qualification receipt, tests and checkpoint

Moves the Linux Codex pin and the coupled SDK pair (openai-codex and openai-codex-cli-bin) to
rust-v0.160.0 (a956835d020762cb2b570053af06f643a11c0ecc), with a new qualification receipt
(runtime-sdk-20261003): npm wrapper integrity, native binary sha256, strict-hash SDK install from a
repository-root lock compile, and native-account, gateway SDK and gateway CLI marker canaries on this
host. macOS stays 0.155.1; the shared host launcher and daemon still run 0.159.3 until a coordinated
switch. Reviewed by Opus (changes-needed, repaired in one round) and GPT-6.1 Sol (accept).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Register the Codex 0.160.0 pin move's files and receipt (hot-file protocol, last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Review-bot repairs on the Codex 0.160.0 pin move: verified Linux platform binary, retained native records, worker guide

- adoption/bootstrap-linux.sh: npm pins with a platform_dependency now fetch the platform tarball, verify its sha256
  and the registry SHA-512 integrity, install it in place of npm's unverified optional copy, and check the installed
  executable's sha256 before linking (ported from bootstrap-macos.sh install_platform_dependency); the codex pin
  carries the 0.160.0 linux-x64 platform dependency (sha256 37a41d61..., binary 12eb3e81...). New offline tests.
- runtime-sdk-20261003: sanitized retained native records (canary outputs, CLI exec events, exec-help diff, npm
  metadata, exact invocations), a marker-check script with positive and negative controls, and hashes.
- blueprints/us-equities/workers/README.md: current SDK statements moved to 0.160.0; the 2026-09-30 result kept
  as history (trading acknowledgement requested on the PR).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-register the pin move's changed and new evidence files (hot-file protocol, last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Linux bootstrap security repair (independent Opus review S1-S3, M1-M7) and the macOS canonical-path test fix

- S1: before linking, the installed wrapper must map optionalDependencies[dep] to exactly
  npm:<platform package>@<version>, and node_modules may hold only the pinned packages; the alias target must be new
  and inside the prefix.
- S2: ignore_scripts on the Linux codex pin (neither package has lifecycle scripts); pins that keep scripts get a
  full extracted-tree comparison after rebuild, failing closed on any difference.
- S3: parity tests lock verify_sha256, fetch, canonical_path, prune_old_version, npm_package_name and install_npm
  between the Linux and macOS bootstraps (the macOS publication, pruning and cleanup paths took the shared fixes).
- M1-M7: python3 prerequisite, isolated SHA-512 check, archive verified before npm install, migration state cleared
  after the swap, fresh versioned prefix with pruning guarded, tightened assertions and new negative controls.
- A real bootstrap into a fresh isolated root exited 0 (4 verified, 0 failed); codex-cli 0.160.0, binary
  sha256 12eb3e81...
- tests/test_adoption_bootstrap.py: NpmIgnoreScriptsTests expect the canonical prefix (hosted validate-macos at
  ad9787c failed on /private/var vs /var); reproduced and cleared on Linux with a symlinked TMPDIR.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Register the bootstrap security repair files (hot-file protocol, last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Run the two GNU-dependent Linux bootstrap tests on Linux only (hosted validate-macos at ad02af0)

validate-macos at ad02af0 errored in two A4 tests of tests/test_adoption_bootstrap_linux_platform.py:
- test_failed_swap_restores_migrated_install_and_removes_unpublished_prefix: bootstrap-linux.sh restores a migrated
  install with GNU `mv -T` (lines 314 and 782); BSD mv has no -T, so the restore does not happen on macOS.
- LinuxPrerequisiteTests.test_missing_python3_names_the_prerequisite_before_any_write: the shim links GNU/util-linux
  tools (flock, sha256sum); shutil.which returns None for flock on macOS, so symlink_to(None) raised TypeError.
Both exercise behaviour of the Linux-only bootstrap; a GNU_ONLY skip with that reason keeps them on Linux, where they
still run and pass. The macOS bootstrap has its own suite (tests.test_adoption_bootstrap_macos).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-register the Linux bootstrap test module (hot-file protocol, last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* New-WSL profile: accepted Codex CLI and Python SDK pins move to the 0.160.0 pair of this PR

Configuration owner's per-PR conditions for #626 (f9 convergence comment, 2026-10-03T14:52Z):

- adoption/new-wsl-profile.json boundary: accepted_codex_cli_pin and accepted_python_sdk_pin 0.159.3 -> 0.160.0
  (adoption/pins-linux-x86_64.json codex 0.160.0; adoption/sdk/accepted-constraints.txt openai-codex==0.160.0).
  proposed_typescript_sdk_pin stays 0.159.3: this PR does not pin @openai/codex-sdk. No entry row changes.
- Provenance in the same edit: sdk_gate names #626, sdk_gate_status names #626 as pending with the f9
  convergence comment as its basis, accepted_main is main 59f8a1e
  (the commit this branch was refreshed onto, not a merge of #626).
- tests/test_new_wsl_profile.py: the accepted Python SDK pin expectation follows (L178). L177 and L179-180
  assert the Codex, Codex TypeScript SDK and Codex Python SDK entry rows, which stay at 0.159.3.
- docs/new-wsl-handbook.{json,md}: regenerated with scripts/build_new_wsl_handbook.py --write (profile hash).
- evidence/artifacts/new-wsl-handbook-20261001/receipt.json: hand-refreshed outputs sha256 (two fields) and
  profile_sha256, which tests/test_new_wsl_handbook.py:1279 binds to the profile.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Exempt the two retained codex exec --help captures from the trailing-space check

git diff --check origin/main...HEAD flagged trailing spaces on lines 23, 55 and 98 of
evidence/artifacts/runtime-sdk-20261003/exec-help-0.159.3.txt and exec-help-0.160.0.txt. Those spaces are in the
native help output, and retained-records.json binds both files by sha256 and bytes with no sanitization, so the
bytes stay. Following the existing .gitattributes practice for delivered tool output, only blank-at-eol is turned
off, for these two paths.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main 59f8a1e so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main 59f8a1e: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; this branch's registry rows in manifests/evidence.json, with the five files of the profile
pin move and .gitattributes re-registered; and in observability/grand-dashboard/state.json the 0.160.0 SDK-pair
gate beside main's new-wsl-distribution gate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* New-WSL profile: Codex and Codex Python SDK rows move to the 0.160.0 pair; accepted CLI pin asserted

Configuration owner's second-round conditions for #626:

- adoption/new-wsl-profile.json, Codex row: pin 0.160.0 with its version-bound fields (npm tarball name, URL and
  sha256 373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a; registry source; install command and
  README source at rust-v0.160.0; release tag, URL and published_at; source_commit a956835d; 4,902-byte launcher
  scope; native-update floor; the two rust-v0.160.0 release-asset digests from the GitHub release API). The
  `codex update --help` observation stays the dated 0.159.3 one.
- Codex Python SDK row: pin 0.160.0 with its wheel name, URL and sha256 61d2d855 (PyPI JSON, equal to the lock's
  wheel hash and to a rehash of the downloaded wheel), install, package and quickstart sources at rust-v0.160.0
  (README bytes identical to rust-v0.159.3), release and source_commit.
- Both rows' provisioning_reason carries the sdk_gate_status basis wording (PR #626, convergence comment
  5970286472, lands only with #626's own gates) and cite the runtime-sdk-20261003 receipt. The TypeScript SDK row
  stays 0.159.3; top-level source_head stays (profile-wide, bound by the test's HEAD constant).
- tests/test_new_wsl_profile.py: Codex row 0.160.0, accepted_codex_cli_pin asserted, the SDK loop split
  (Python 0.160.0, TypeScript 0.159.3).
- docs/new-wsl-handbook.{json,md}: build_new_wsl_handbook.py --write. Receipt: outputs and profile_sha256 refreshed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main 59f8a1e so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main 59f8a1e: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; this branch's registry rows in manifests/evidence.json, with the profile, test, handbook and
handbook-receipt files of the 0.160.0 row move re-registered; and in observability/grand-dashboard/state.json the
0.160.0 SDK-pair gate beside main's new-wsl-distribution gate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* New-WSL profile overview: Codex CLI and Python SDK at 0.160.0, pending #626

Configuration owner's round-3 condition for #626, so the JSON and adoption/new-wsl-profile.md agree on main.
Five lines change, the rest keeps the owner's wording:

- L4: the profile stays reconciled with accepted main 85543ef; one clause adds that its Codex CLI and Python SDK
  pins move to 0.160.0, pending PR #626 (basis: #626 and its convergence comment 5970286472).
- L12: Codex CLI and the Python SDK pin are 0.160.0, pending #626 and its cross-family convergence; 0.159.3
  followed the accepted merge of PR #580. The TypeScript SDK sentence is unchanged.
- L103, L191, L205: rust-v0.159.3 -> rust-v0.160.0 in the Codex and Python SDK links, and their table pins. The
  TypeScript SDK row is unchanged.

The md is not a handbook input (scripts/build_new_wsl_handbook.py reads the profile JSON and the distro page), so
nothing is regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main 59f8a1e so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main 59f8a1e: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; this branch's registry rows in manifests/evidence.json, with adoption/new-wsl-profile.md
re-registered; and in observability/grand-dashboard/state.json the 0.160.0 SDK-pair gate beside main's
new-wsl-distribution gate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main cac8700 so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main cac8700: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; main's registry with this branch's rows applied and the regenerated new-WSL handbook files
and handbook receipt rehashed in manifests/evidence.json; and in observability/grand-dashboard/state.json the
0.160.0 SDK-pair gate beside main's new-wsl-distribution gate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main 1f5a791 so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main 1f5a791: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; main's registry with this branch's rows applied, including the regenerated new-WSL handbook
files and handbook receipt, in manifests/evidence.json; and in observability/grand-dashboard/state.json the two
Codex 0.160.0 gate rows beside main's gates, with main's checkpoint time and its meaning extended by one passage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main e7c297e so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main e7c297e: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; main's registry with this branch's rows applied, including the regenerated new-WSL handbook
files and handbook receipt, in manifests/evidence.json; and in observability/grand-dashboard/state.json the two
Codex 0.160.0 gate rows beside main's gates, with main's checkpoint time and its meaning extended by one passage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Keep the new-WSL profile and handbook out of this PR (configuration owner's scope decision)

The configuration owner moves the replacement-WSL profile and its Codex handbook rows in their own follow-up, so
this PR no longer changes them:

- adoption/new-wsl-profile.json and adoption/new-wsl-profile.md: restored to main's copies
  (e7c297e).
- tests/test_new_wsl_profile.py: this PR's only hunk there, the 0.160.0 assertions for the profile's Codex CLI,
  accepted_codex_cli_pin and Python SDK pins, is reverted to main's lines. The file equals main's copy.
- docs/new-wsl-handbook.{md,json}: regenerated with python3 scripts/build_new_wsl_handbook.py --write. With main's
  profile both equal main's copies.
- evidence/artifacts/new-wsl-handbook-20261001/receipt.json: profile_sha256 and the two outputs hashes follow the
  restored profile and the regenerated files, so the receipt equals main's copy.
- manifests/evidence.json: the six files re-registered with host_receipts.register_file. Their rows equal main's.
  This PR's receipts[] row runtime-sdk-20261003 stays, and convergence_records equals main's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: take main's stack.json, evidence.json and state.json before the last commit

Sets the three shared hot files (docs/lanes.md) to origin/main fdd0a24 so that
the next and last commit carries this branch's whole hot-file delta against main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Restore this branch's stack.json, evidence.json and state.json (hot-file protocol, last commit)

Against main fdd0a24: the Codex 0.160.0 pin and receipt list in
manifests/stack.json; main's registry with this branch's rows and its runtime-sdk-20261003 receipt applied in
manifests/evidence.json; and in observability/grand-dashboard/state.json the two Codex 0.160.0 gate rows beside
main's gates, with main's checkpoint time and its meaning extended by one passage. The new-WSL profile, its test
and the handbook are main's copies, so the registry carries no row of this branch for them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: reset manifests/evidence.json manifests/stack.json observability/grand-dashboard/state.json to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Reapply this branch's manifests/evidence.json manifests/stack.json observability/grand-dashboard/state.json edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: reset manifests/evidence.json manifests/stack.json observability/grand-dashboard/state.json to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Reapply this branch's manifests/evidence.json manifests/stack.json observability/grand-dashboard/state.json edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <[email protected]>

… Opus 5.5 model (follow-up to #626) (#683)

* New-WSL profile: Codex CLI and Python SDK pins 0.159.3 -> 0.160.0 after #626

PR #626 (merged at f77a35e, 2026-10-04T06:53:20Z) moved the shared Linux
Codex pin and the openai-codex SDK pair to 0.160.0 and left the new-WSL
profile, handbook and receipt for this follow-up.

- adoption/new-wsl-profile.json: the Codex and Codex Python SDK rows and the
  boundary pins take the 0.160.0 values of #626's withdrawn profile commits
  (f51b3e0, fbbd939), each checked against main: npm tarball sha256
  37351776... and 4,902 bytes (adoption/pins-linux-x86_64.json and the
  runtime-sdk-20261003 receipt), wheel sha256 61d2d855...
  (adoption/sdk/requirements-linux-x86_64-py313.lock), source commit a956835d
  (manifests/stack.json), published_at (runtime-sdk-20261003
  qualification-facts.json) and the two rust-v0.160.0 release-asset digests
  (GitHub release API, read 2026-10-04). Both archives were downloaded and
  rehashed again on 2026-10-04. Provenance is #626's merged state on the #580
  pattern: sdk_gate #626, sdk_gate_status merged_at_2026-10-04T06:53:20Z,
  accepted_main f77a35e. The TypeScript SDK row (#626 pinned no
  @openai/codex-sdk), source_head and the dated `codex update --help`
  observation stay.
- adoption/new-wsl-profile.md: the overview sentences and the table follow.
- tests/test_new_wsl_profile.py: #626's withdrawn hunk, verbatim (9bb0b1e^).
- docs/new-wsl-handbook.{json,md}: python3 scripts/build_new_wsl_handbook.py
  --write, then --check (exit 0).
- evidence/artifacts/new-wsl-handbook-20261001/receipt.json: profile_sha256
  and the two outputs hashes follow the regenerated files (2026-10-01 handbook
  generator record, L665); generator_sha256 and the inventory are unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* New-WSL client config: main-checkout Codex trust grant and Opus 5.5 model

Codex trust grant (coordinator's decision of 2026-10-04, R16 review: Codex
0.160.0's folder-trust dialog stays, our root pre-trusted, unknown projects
still asked about; openai/codex #49160 is in rust-v0.160.0).
- adoption/new-wsl/client-config-map.json: the shared template's existing
  projects."${PROJECT_ROOT}".trust_level piece gets its own entry, classed
  authorization, so it is rendered and written only with
  --with-authorization-settings and never over a file's own answer.
  ${PROJECT_ROOT} is the main checkout on the new distribution (host
  template), and Codex looks a linked worktree's trust up under it by exact
  key (rust-v0.160.0: tui/src/config_update.rs L264-279 and L305-366,
  git-utils/src/trust.rs L12-24, core/src/git_info_tests.rs L829-968,
  config/src/loader/mod.rs L131-133). The publication checkout and every
  other projects.* piece stay not wired.
- tools/adoption/new_wsl_client_config.py: is_authorization_piece names
  codex/*/projects.*.trust_level (the one pattern the record's open
  observation asked for); the apply passes codex_home.py
  --keep-project-trust; the merge reports a piece whose key names a
  placeholder under the path the render filled (it reported such a grant as
  added even when the file had it); the default authorization line and the
  option's help name the grant.
- tools/adoption/codex_home.py: additive --keep-project-trust, the mirror of
  --keep-hook-trust, so a new Codex home keeps the grant the render holds and
  a later merge ends with the same file. The bootstrap passes neither flag;
  its output is unchanged.

Model: the user's choice of 2026-10-04 (question tool), Opus 5.5. A map entry
overrides the shared template's opus[1m] with claude-opus-5-5 for the new
distribution only (code.claude.com/docs/en/model-config, read 2026-10-04:
the full model name pins a version; opus resolves to Opus 5.5 on the
Anthropic API). The resolved model is the same as before; the new
distribution no longer follows the shared template. No repository file held
`sonnet` for it.

- docs/decisions/2026-10-02-new-wsl-client-configuration.md: tables from
  --check --markdown, counts (385 / 293 / 79 / 13) and an addendum of
  2026-10-04 with sources and overturn conditions.
- tests: the authorization class gains the grant; new tests for a new Codex
  home with the option, a file's own answer kept, the predicate rows, the
  rendered model and codex_home's flag. Mutation controls: dropping the
  placeholder fill fails 4 tests, dropping --keep-project-trust fails 2.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Register the new-WSL Codex 0.160.0 follow-up's files (hot-file protocol, last commit)

host_receipts.register_file for the seven changed files main's
manifests/evidence.json lists: adoption/new-wsl-profile.json and .md,
docs/new-wsl-handbook.json and .md, the new-wsl-handbook-20261001 receipt,
tests/test_bootstrap_full_profile.py and tests/test_new_wsl_profile.py.
component_matrix.py --write and new_host_grand_list.py --write changed
nothing. python3 scripts/validate.py: exit 0, status passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <[email protected]>

… row, held status, TUI notice key (#687)

* Codex dated holds (R6): one pin row with a host-agnostic 0.159.3 hold until 2026-11-04

- adoption/pins-linux-x86_64.json: the codex row carries holds[] with one entry, 0.159.3 until
  2026-11-04 (X18, the #626 landing exception). Wrapper URL and SHA-256 are the row's values before
  f77a35e (from 85543ef, #580), re-verified against a registry download; the linux-x64
  platform_dependency (row shape) is first recorded here from the npm registry.
- scripts/adoption_status.py --pinned-versions: a probe naming a hold's version before its until date
  (UTC) is held (hold_* fields, summary "held", "held until <date> (<reason>)"), not drift; on and
  after until it is mismatched with the expiry stated. Malformed holds are skipped. The default run,
  the exit code and the existing keys are unchanged.
- tools/adoption/apply_codex_lane.py still refuses any codex but CODEX_VERSION; the refusal now names
  a matching hold and its until date.
- tests/test_pin_holds.py: every hold complete, until a real date after today (UTC) and at most
  90 days away, at most one hold per row (the OSV ignoreUntil precedent), with mutants.
- adoption/templates/codex.config.template.toml: "gpt-6.1-sol" = 4 under [tui.model_availability_nux],
  cited from openai/codex rust-v0.160.0 (MODEL_AVAILABILITY_NUX_MAX_SHOW_COUNT = 4).
- docs/decisions/2026-10-04-codex-dated-holds.md: design, alternatives, precedent, overturn.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Codex dated holds: stack.json reference and evidence registry (hot-file protocol, last commit)

manifests/stack.json's codex row carries no install data, so its freshness refers to the pins row's
dated hold instead of copying it. manifests/evidence.json takes main's copy (6af8e55) and
re-registers this branch's changed files plus its new test and decision record, as #626 did;
component_matrix.py and new_host_grand_list.py --write reproduced their outputs unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* New-WSL client-config record: recount after the gpt-6.1-sol notice key (387 pieces, 80 not wired, 39 own entry)

The key under tui.model_availability_nux is one more not-wired piece (client state, not
configuration). Recounted on the tree merged with main 54eb892 (#674, #683, #686) by the GPT-6.1 Sol
worker; reviewed by the coordinator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Registry: re-register the PR-owned files after the recount (last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: reset manifests/evidence.json to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Reapply this branch's manifests/evidence.json edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* adoption_status: one hold schema for run time and the pins test (cross-family P1)

pin_holds() now keeps only holds that hold_schema_problems() accepts. The same validator is imported by
tests/test_pin_holds.py. It requires the wrapper url and sha256, and the platform package's shape, version,
url, digest and binary check when the pin has one. So a hold with malformed install metadata is ignored,
and the version is reported as drift instead of held. Failing-first: the three missing-field cases failed
before the fix; 16 malformed-metadata cases pass after it.

Built by the GPT-6.1 Sol worker; reviewed by the coordinator (Claude Opus).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Registry: re-register the fix's files (last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file protocol: reset manifests/evidence.json manifests/stack.json to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Reapply this branch's manifests/evidence.json manifests/stack.json edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <[email protected]>