Skip to content

New WSL distro recipe follow-up: rehearsal, signed sums, schema and storage pre-checks, ownership probe; three corrected facts - #582

Merged
seathatflowsinourveins merged 6 commits into
mainfrom
claude/new-wsl-distro-recipe-followup-20261001
Oct 1, 2026
Merged

seathatflowsinourveins merged 6 commits into
mainfrom
claude/new-wsl-distro-recipe-followup-20261001

Conversation

@seathatflowsinourveins

Copy link
Copy Markdown
Collaborator

Scope

SOTA sources

Read on 2026-10-01 by a research pass (eight questions, every fact with its source and quote) and re-checked by the builder where a command's output is claimed:

Evidence-class table

Claim Evidence class Command / receipt
The signed sums verify with the installed keyring, and the signed line carries the pinned image hash native operation on the authoring host (an artifact check, not a run of the recipe); a tampered copy fails with exit 1 step P1; record "Evidence classes"
The rendered user-data passes cloud-init's schema; an invalid one fails with exit 1 native operation on the authoring host (cloud-init 26.1-0ubuntu1~24.04.1) step P2
This host's kernel journal holds 21 storage-error lines in the current boot: one burst of write errors on 2026-09-24, the newest about 7.4 days old observation on the authoring host step P3; record "Evidence classes"
WSL 2.7.13 and 2.7.14 lack the fix for #40941; --from-file checks no hash source_review the cited WSL source and release notes
Recipe, record, checklist, receipt example and command table agree, including the new steps local_integration (structural) tests/test_wsl_new_distro_recipe.py: 48 tests; failing first twice (17 new tests failed before the first round's edits, 4 before the P3 change)
The rehearsal, stage 1 and the first boot work on a host not run; the rehearsal is the first run stage-1 receipt (future)

No unchanged upstream test suite was run.

What changes

  • Three corrected facts. (1) "WSL 2.7.14 and 3.0.1 change nothing about install, import or first launch" was wrong: the fix for #40941 ships in 2.9.8 and 3.0.1 only, so the page now terminates the new distribution once after the first launch and probes file ownership (W7). (2) The reason for not using wsl --install Ubuntu-24.04 was backwards: that path does check the catalog's hash, and --from-file checks none, which is why W2's own check exists. (3) W5's console lines are cited at the image's own wsl-setup revision.
  • Rehearsal first (R1). The page runs once on a throwaway name through F3 and records what no host has observed yet, then removes only that name.
  • Pre-checks in the workstation distribution (P1 to P3). Signed checksums with gpgv and no key import; the user-data schema before any boot; a storage-error baseline.
  • P3's rule. A bare count would block this host for good (21 lines from one old burst). The rule is a baseline, a recency test on the newest line by the kernel's own clock (under one hour stops the run; the threshold is this recipe's choice), and a second count after the first launch (growth is recorded and treated as exposure to #41482).
  • Idle behaviour. W1 reads the two idle keys of the global WSL configuration (read-only); F2 observes whether the distribution stays listed with nothing attached. The page says what happens on a host without the setting. The host-wide test now allows a plain read of that file and rejects writes, copies, editors, pipes, redirects and second statements.
  • Record. The critic section gives each of its 11 items an outcome; Learn pages are pinned by docs commit; the alternatives state the exclusions; the convergence record is re-pinned and stays planned.

Local commands run (head 4780fe4)

$ python3 -m unittest tests.test_wsl_new_distro_recipe
Ran 48 tests in 0.327s   OK   (exit 0)
$ python3 -m unittest tests.test_adoption_docs_consistency
Ran 39 tests in 10.946s   OK (skipped=1)   (exit 0)
$ python3 scripts/validate_convergence.py --all-recorded
(exit 0)
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 8819, "profiles": 4, "receipts": 182, "status": "passed"}   (exit 0)
$ git diff --check origin/main HEAD
(no output, exit 0)
$ python3 scripts/validate.py --scan-file <each changed file>
(exit 0 for all six)

validate.py first failed on a UUID-shaped literal in a test mutant (the validator rejects that shape in any published file); the mutant now builds the string at run time (commit 805a4134).

Decision record

docs/decisions/2026-10-01-new-wsl-distro-recipe.md: the corrected context and alternatives, the P3 rule with its two rejected options (a bare count, a wall-clock age), the rewritten open question on idle behaviour, new open questions on file ownership and on #41482, the critic table with outcomes, and the artifact checks with commands, exit codes and times.

Host evidence

Not applicable: nothing in stage 1 has run on any host, the rehearsal included.

Checklist

  • No GitHub Actions changed.
  • No workflows changed.
  • No secrets printed, logged or committed.
  • No paid hosting, subscription or billing surface.
  • Peer-owned untracked files and worktrees preserved.

🤖 Generated with Claude Code

Scout and others added 6 commits October 1, 2026 08:24
…iling first)

Adds a check, a passing test and a mutant test for each rule of the follow-up to
PR #569:
- B: P1 verifies the signed SHA256SUMS with gpgv and the installed archive keyring,
  no key import, before stage 1;
- C1: P2 renders the user-data the way W3 does and runs cloud-init schema -c before
  any boot, and W3 prints the Windows file's SHA-256 to compare;
- C2: W5 runs cloud-init schema --system as root on path A, and W6 skips it;
- D: P3 counts the current boot's hv_storvsc kernel journal lines without the
  driver's registration line and stops on a nonzero count;
- E1 and E2: W7 terminates <Name> once after the first launch, relaunches it and
  reads the owner of a file created from Windows;
- F: W1 reads the two idle keys and F2 observes <Name> with no client attached; the
  host-wide check now passes a plain Select-String or grep read of .wslconfig and
  rejects writes, copies, editors, pipes and redirects;
- G: R1, the page's first step, rehearses on a throwaway name and removes only it,
  exporting a failed rehearsal first.
Step headings now include R and P steps.

At this commit the 17 new tests fail against the unchanged recipe, record,
checklist, receipt example and experiment record (Ran 48, failures=17); the next
commit makes them pass.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…-checks, ownership probe

Follow-up to PR #569 on the completeness critic's findings and the research packet
of 2026-10-01. No command of the page has run on a host.

Recipe, checklist and receipt example:
- R1 rehearses the page on a throwaway name through F3 and removes only that name,
  after W6's export rule when the rehearsal failed.
- P1 verifies SHA256SUMS with gpgv and the installed Ubuntu archive keyring (no key
  import); P2 runs cloud-init schema -c on the render, its SHA-256 compared with
  W3's; P3 counts the current boot's hv_storvsc kernel journal lines without the
  driver's registration line and stops on any count (microsoft/WSL#41482).
- W5 runs cloud-init schema --system on path A; W6 skips it on path B.
- W7 terminates <Name> once after the first launch, relaunches it and probes the
  owner of a file created from Windows (microsoft/WSL#40941; the fix, PR #40977,
  ships from 2.9.8 and 3.0.1, not in 2.7.13 or 2.7.14).
- W1 reads the two idle keys of the global WSL configuration; F2 lists the running
  distributions for two minutes with no client attached.
- Corrected facts: WSL 3.0.1 does change the first launch; the online
  wsl --install checks the catalog's hash while --from-file checks none; W5's
  console lines come from the image's wsl-setup (Launchpad 74bfc891, lines 117-118).

Decision record: the critic's outcomes per item, Learn pages pinned by
git_commit_id with their displayed dates, the cloud-init CLI page at 26.1, the
alternatives' exclusions, rewritten open question 2, open questions 6 and 7, and
the artifact checks of P1 to P3 in the workstation distribution. P3 counted 21
lines on this host, so by the page's rule stage 1 stops here until the user decides.

Experiment record: re-pinned, next test starts with the rehearsal, the two
research passes' usage as text (usage_assessment stays the planned-record value);
status stays planned.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
… a second reading (failing first)

The coordinator replaced P3's stop on any nonzero count: a count over the current
boot cannot tell an old burst from errors that are happening now. The D check now
requires:
- P3 to record the hv_storvsc count (without the registration line) as a baseline,
  print the newest error line with its kernel time and /proc/uptime, stop only when
  that line is less than one hour old, and call the threshold the recipe's choice;
- W5 to count again in the workstation distribution after the launch, on both
  paths, with a larger count recorded as exposure to microsoft/WSL#41482 and a hold
  before stage 2;
- the record to say why a bare count was rejected, the checklist and the receipt
  example's storage_errors block to carry the baseline, the newest line's time and
  the second count, and R1 to include both readings.
New mutants: the old stop rule, no newest line, no uptime, no recency rule, no second
reading, a second reading on one path, no exposure rule, and lost record, checklist
and receipt fields.

At this commit 4 tests fail against the unchanged recipe, record, checklist and
receipt example (Ran 48, failures=4); the next commit makes them pass.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
… reading after W5

The coordinator's decision of 2026-10-01: a count over the current boot cannot tell
an old burst from storage errors that are happening now, and on this host one burst
seven days earlier would have blocked stage 1 for good. So:
- P3 records the hv_storvsc count (without the registration line) as a baseline,
  prints the newest error line with its kernel time and /proc/uptime, and stops the
  run only when that line is less than one hour old. The threshold is this recipe's
  choice, not an upstream figure. The kernel time decides because journald restamps
  kernel lines it re-reads after a distribution restart (measured here: one kernel
  message with three reception stamps); the two clocks agree within 37 s over about
  8 days on this host.
- W5 counts again in the workstation distribution right after the launch, on both
  paths and before W6 or W7: equal passes; a larger count is recorded with the new
  lines, a failed W5 counts as exposure to microsoft/WSL#41482, and nothing
  continues to stage 2 until that is decided.
- R1 includes both readings, so the first real one comes from the rehearsal.
- Checklist, receipt example (storage_errors: baseline, newest_line_time, swap,
  second_count, new_lines; rehearsal.storage_readings) and command table follow.
- Record: this host's readings as artifact checks (baseline 21 at 12:19:29Z, newest
  error line about 7.4 days old, so P3 does not stop the run), why the bare count was
  rejected (Alternatives 4), open question 7 kept open.
- Experiment record re-pinned; validate_convergence passes; status stays planned.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The mutant that searches for a device id instead of the driver's name carried a UUID-shaped literal, which the
publication validator rejects in any published file. The string is now built at run time; the check and its mutant
are unchanged. The experiment record is re-pinned to the test file's new hash.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 1, 2026
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@seathatflowsinourveins
seathatflowsinourveins merged commit b8dd81d into main Oct 1, 2026
25 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the claude/new-wsl-distro-recipe-followup-20261001 branch October 1, 2026 13:13
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
… merged (#582)

- cross:wsl-distro no longer says stage 1 waits for the follow-up: PR #582 merged as b8dd81d, and the recipe now
  starts with a rehearsal on a throwaway name and pre-checks in the workstation distribution. The install command,
  the new-host steps, the lane gate and the notes say so; nothing in the recipe has run on a host.
- The winner's pin_source follows the pinned hash to its new line in the recipe (250, was 99): the follow-up
  inserted sections above it, and the build checks a citation's bounds, not its content.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
… merged (#582)

- cross:wsl-distro no longer says stage 1 waits for the follow-up: PR #582 merged as b8dd81d, and the recipe now
  starts with a rehearsal on a throwaway name and pre-checks in the workstation distribution. The install command,
  the new-host steps, the lane gate and the notes say so; nothing in the recipe has run on a host.
- The winner's pin_source follows the pinned hash to its new line in the recipe (250, was 99): the follow-up
  inserted sections above it, and the build checks a citation's bounds, not its content.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
… merged (#582)

- cross:wsl-distro no longer says stage 1 waits for the follow-up: PR #582 merged as b8dd81d, and the recipe now
  starts with a rehearsal on a throwaway name and pre-checks in the workstation distribution. The install command,
  the new-host steps, the lane gate and the notes say so; nothing in the recipe has run on a host.
- The winner's pin_source follows the pinned hash to its new line in the recipe (250, was 99): the follow-up
  inserted sections above it, and the build checks a citation's bounds, not its content.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
seathatflowsinourveins added a commit that referenced this pull request Oct 1, 2026
…e); keys row, landed sources, distribution row (#583)

* Architecture edition: the keys lane's row after the canary proof merged; #578's sources as plain citations

The first update of the dated edition under its own overturn conditions 4 and 5.

- cross:credential-practice, in the keys lane owner's wording: the canary proof tool merged with #579 (e58850f)
  and its synthetic acceptance on the workstation is recorded (143 unit tests, 138 of 138 mutants, 531 suite tests
  with one failure by design); the acceptance names what the two receipts record, class local_integration_check;
  the end-to-end proof on the new distribution has not run on any host and stays a new-host step; closure c3 and c4
  reworded.
- The seven citations of PR #578, which merged as 65a7b03, become plain source paths; the record lists five merged
  pull requests and two open ones (#575, #535).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: the distribution row after the recipe follow-up merged (#582)

- cross:wsl-distro no longer says stage 1 waits for the follow-up: PR #582 merged as b8dd81d, and the recipe now
  starts with a rehearsal on a throwaway name and pre-checks in the workstation distribution. The install command,
  the new-host steps, the lane gate and the notes say so; nothing in the recipe has run on a host.
- The winner's pin_source follows the pinned hash to its new line in the recipe (250, was 99): the follow-up
  inserted sections above it, and the build checks a citation's bounds, not its content.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: selections follow the repositories' own quality, not the source host's legacy

The user's rule of 2026-10-01: evaluate each repository on its own quality and do not shape the new distribution by
what the source host has installed, pinned or failed to integrate.

- durable-memory: ai-memory is the reference arm, not a default (the 2026-09-27 decision). agentmemory joins with
  the one matched harness result on record (recall_all@5 0.821 against 0.570 on LongMemEval-S, Mac, descriptive),
  MemPalace as an arm, Hindsight as arm K1 judged fresh; the gate no longer treats this host's integration holds as
  evidence about the repository; the first new-host step installs every arm fresh.
- token-efficiency, in the Gate A owner's words: comparison_required; the 14-component profile is the source
  host's selection and one arm, the lean base an arm of equal standing, and the E2E decides which components stay.
- Trading rows, in the trading lane owner's words: the verdict selections that had been listed as alternatives for
  lacking a stack pin are winners of their layers (DVC, pandera, agent-retrieval-bench, Inspect AI, MLflow), each
  with its upstream install command and the class its recorded run supports.
- cross:runtime-workers: a candidate without a repository pin is a candidate, not an exclusion.
- Every comparison row carries the reason that its merit winner is undetermined and that the comparison selects.

Verdicts: 20 selection_of_record_open, 15 comparison_required, 2 new_host_required. 130 winner entries.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Architecture edition: the memory comparison is against ai-memory with its reranker off, not production

A cross-family audit corrected the wording of the one matched memory result. The 0.821 against 0.570 recall on
LongMemEval-S compares agentmemory's arm D2 with ai-memory's arm C3: the production embedder and query prefix with
the reranker off. ai-memory's production arm runs the LLM reranker (C4, amendment A14) and has not run, nor has
agentmemory through its shipped hooks (D2h); the arms' captures and embedders differ and the ai-memory build was a
2.5 pre-release. The durable-memory row and the record now say configuration-level evidence, not a production
head-to-head, and cite the convergence record itself (paired difference +0.251, 95% CI +0.203 to +0.299).
Overstating a challenger is the same bias the merit rule excludes.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* Re-register this branch's changed files in manifests/evidence.json (hot-file protocol)

Co-Authored-By: Claude Fable 5.1 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Fable 5.1 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant