…-pin-20261003

Refresh onto main cac8700 (#651, #628, #647, #661, #648) under the docs/lanes.md
hot-file protocol.

- Handbook: main's docs/new-wsl-handbook.{md,json} and evidence/artifacts/new-wsl-handbook-20261001/receipt.json
  (#647) are the base; scripts/build_new_wsl_handbook.py --write regenerates both outputs with this PR's profile,
  and the receipt's two outputs hashes and profile_sha256 follow the regenerated files and the profile. Nothing
  else in the receipt changes.
- manifests/evidence.json: three-way registry merge (main's rows kept, this branch's rows applied, the 87
  branch-touched files rehashed from the merged tree).
- #628's Codex SDK worker pins openai-codex and openai-codex-cli-bin 0.160.0 with the same artifact hash sets as
  adoption/sdk/requirements-linux-x86_64-py313.lock and cites rust-v0.160.0 a956835d; it changes none of
  manifests/stack.json, adoption/pins-linux-x86_64.json, tools/adoption/apply_codex_lane.py or adoption/templates.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…record

Commit 1 moved examples/openhands-native-capabilities/requirements.lock to
aiohttp 3.14.4. The convergence record
evidence/artifacts/native-runtime-role-resolution-20260930/experiment.json
froze that lock's earlier bytes as frozen_inputs.sources[3] (sha256 16e1a44e...),
so hosted validate-shard-0 failed in `scripts/validate_convergence.py
--all-recorded` with "record.frozen_inputs.sources[3]: SHA-256 mismatch".

This follows ecea286 (#628), which kept the frozen inputs of the OmniRoute
records the same way. The lock's bytes at 30ab2e3 are retained, byte for byte,
as evidence/artifacts/aiohttp-3.14.4-relock-20261020/historical/examples/
openhands-native-capabilities/requirements.lock.source.txt. The record's single
reference now points there with its sha256 unchanged. The copy is listed as an
excluded evidence fixture in .github/osv-scanner-lockfiles.json, with its reason
and the record as evidence, like the f451 fixture in commit 2 (the repository's
pre-push registry test requires that listing). manifests/evidence.json refreshes
the record's and the inventory's entries and registers the retained copy. No
measurement, verdict or other field of the record changes.

Checks, run with python3 -B in a scratch CPython 3.12.3 venv built from
.github/requirements-ci.txt with --require-hashes:
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed (71 components, 12,328 hashed files, 243 receipts);
- scripts/evidence_manifest.py --check: passed (12,328 files);
- unittest of test_osv_lockfile_coverage (61 tests, OK after the listing),
  test_convergence_contract, test_evidence_manifest,
  test_osv_lockfile_coverage, test_receipt_sha256_key_custody,
  test_research_convergence_practice and test_sota_convergence: 271 tests, OK.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…HSA-494j) (#1265)

* Pin aiohttp 3.14.4 in three available runtime locks

Regenerate the memory and example locks through uv and reproduce the OpenHands worker frozen export. Move yarl to 1.25.1 as required by aiohttp 3.14.4. Refresh inventory and evidence digest bindings.

The trading lock remains at aiohttp 3.14.3: its exact Python 3.12.3 interpreter is unavailable, and no new installation is authorized. This is a partial repair and re-pins no trading plan.

* Re-pin the trading-2604 runtime lock to aiohttp 3.14.4

GHSA-2g87-pp6c-29x5, GHSA-5wr8-gcqf-gqf3 and GHSA-494j-54xm-rwp3 affect
aiohttp <=3.14.3 and are fixed in 3.14.4. The trading-2604 lock was the last
scanned lock at 3.14.3.

Lock delta (aiohttp only):
- Relock: UV_PYTHON_DOWNLOADS=never uv lock --python <uv-managed CPython
  3.12.3> --upgrade-package aiohttp==3.14.4, uv 0.13.1.
- aiohttp 3.14.3 -> 3.14.4 (sdist and wheels, 18 -> 19 wheels; dependencies
  unchanged). yarl stays 1.25.1. 192 entries before and after; the other 191
  entries and the `revision = 5` header are byte-identical.
- Lock sha256 f451ef979cdb1ae3686a30df1c883c257402b32753478c1f9c686c057e9c3989
  -> a1413f202937aa05625bad34b35d4ad75c9ab637805c3747abc4fb8b0f85634a
  (308332 -> 308625 bytes). The manifest aa370e42 is unchanged.
- uv lock --check passes under uv 0.13.1 and under the installer's pinned
  uv 0.12.17 (`uv --no-config lock --check`, release archive verified against
  validate.yml's SHA256). A relock with uv 0.12.17 resolves the same packages
  but rewrites the header to `revision = 3`, so it was not used.

Bindings refreshed:
- install-trading-2604.sh: lock_hash -> a1413f20. Following #873 (a484989),
  the October 8 published pair f451/aa370e42 becomes one more recorded
  migration input and inverse record (published_lock_hash /
  published_project_hash, a sixth column of the existing-file check), never
  acceptance. Completion marker no-dvc-r4 and sync vector (8b8aa38e) are
  unchanged, as in #873.
- accept-trading-2604.sh:15 and adaptive-paper/scheduled_trial.sh:54 require
  a1413f20, so a runtime still at f451 is refused.
- tests/test_scheduled_trial.py scratch acceptance fixture lock_hash.
  tests/test_trading_2604_lock.py derives every hash from the bytes and pins
  none, so it is unchanged.
- runtime-2604/README.md: current-lock statements. The 24/24 native acceptance
  is bound to f451 and does not transfer; acceptance of a1413f20 is pending
  and runs under the North Star plan's C05.
- .github/osv-scanner-lockfiles.json trading entry sha256.
- adaptive-paper/source-hashes.json (scheduled_trial.sh, test_scheduled_trial.py).
- catalogs/landscape/final-stack.json, regenerated by
  scripts/final_stack.py --write (sources hash of the lock only).
- manifests/evidence.json entries of every changed file.

Retained f451 bytes: tests/test_receipt_sha256_key_custody requires every
receipt *_sha256 to hash a tracked file. The October 8 final-lock and 24/24
receipts bind f451, so its bytes are retained byte-identical (git show
30ab2e3) as evidence/artifacts/trading-2604-aiohttp-repin-20261020/
published-f451-trading-2604-runtime.lock, an excluded evidence fixture in the
osv inventory (not an install input; the active lock is scanned), following the
engine-baseline.lock exclusion precedent.

Records left unchanged (they record what was true then):
event-anchored-ranking/*, catalyst-provenance/README.md,
catalogs/convergence-practice/sources/starred-protected-20261011.json,
catalogs/convergence-practice/starred-convergence-20261010.json,
evidence/artifacts/runtime-final-lock-binding-20261008/*,
evidence/receipts/runtime-final-lock-binding-20261008.json,
evidence/receipts/runtime-final-native-24-acceptance-20261008.json,
catalogs/north-star/readiness.json (receipt values),
catalogs/us-equities/catalog-refresh-20261009.{json,md},
catalogs/us-equities/runtime-target.json#/final_native_acceptance.
Stale current claims left for the catalog assembler, as #873 routed catalog
reconciliation: runtime-target.json#/current_runtime and data-research.md:175.

Checks (python -B, scratch CPython 3.12.3 venv from .github/requirements-ci.txt
with --require-hashes):
- tests.test_trading_2604_lock tests.test_osv_lockfile_coverage
  tests.test_wsl_retrieval.RetiredRunnerTests: 78 tests, OK.
- 25 related modules (scheduled_trial, trading_2604_source_acceptance,
  runtime_directory_identity, install_claude_profile, final_stack,
  receipt_sha256_key_custody, frozen_evidence_reporting, adaptive_paper_*,
  lane_b_r3_*, local_pages_*, trading_gates_bindings and others reading the
  changed files): 814 tests: 727 pass, 86 skipped,
  1 failure. The failure,
  test_gitleaks_config...test_repository_pre_commit_refuses_old_fixture_commit...,
  fails identically at base 14df31f with no change applied (its scratch-repo
  pre-commit hook run reports no "leaks found" on this host); it touches none
  of the changed files.
- Scratch probe of the installer's locked-project block only (no uv, sync,
  Docker or host path): an existing f451 lock is admitted and replaced with
  a1413f20 (rc 0); an unknown lock is refused with exit 73.
- scripts/evidence_manifest.py --check, scripts/validate.py,
  scripts/final_stack.py --check: pass. git diff --check: clean.
- osv-scanner 2.6.0 (sha256 ca69b3d3 verified), ordinary group as
  security-scan.yml builds it: 60 inputs, No issues found, rc 0.

No install-trading-2604.sh, accept-trading-2604.sh or scheduled_trial.sh run;
no host state, broker or paper contact. LIVE remains NO-GO.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Retain the pre-bump OpenHands example lock for its 2026-09-30 frozen record

Commit 1 moved examples/openhands-native-capabilities/requirements.lock to
aiohttp 3.14.4. The convergence record
evidence/artifacts/native-runtime-role-resolution-20260930/experiment.json
froze that lock's earlier bytes as frozen_inputs.sources[3] (sha256 16e1a44e...),
so hosted validate-shard-0 failed in `scripts/validate_convergence.py
--all-recorded` with "record.frozen_inputs.sources[3]: SHA-256 mismatch".

This follows ecea286 (#628), which kept the frozen inputs of the OmniRoute
records the same way. The lock's bytes at 30ab2e3 are retained, byte for byte,
as evidence/artifacts/aiohttp-3.14.4-relock-20261020/historical/examples/
openhands-native-capabilities/requirements.lock.source.txt. The record's single
reference now points there with its sha256 unchanged. The copy is listed as an
excluded evidence fixture in .github/osv-scanner-lockfiles.json, with its reason
and the record as evidence, like the f451 fixture in commit 2 (the repository's
pre-push registry test requires that listing). manifests/evidence.json refreshes
the record's and the inventory's entries and registers the retained copy. No
measurement, verdict or other field of the record changes.

Checks, run with python3 -B in a scratch CPython 3.12.3 venv built from
.github/requirements-ci.txt with --require-hashes:
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed (71 components, 12,328 hashed files, 243 receipts);
- scripts/evidence_manifest.py --check: passed (12,328 files);
- unittest of test_osv_lockfile_coverage (61 tests, OK after the listing),
  test_convergence_contract, test_evidence_manifest,
  test_osv_lockfile_coverage, test_receipt_sha256_key_custody,
  test_research_convergence_practice and test_sota_convergence: 271 tests, OK.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Rename the retained example lock so dependency review does not read it as a manifest

At f662439 the required dependency-review check failed. GitHub's dependency
graph parsed the retained copy from commit 3, whose basename began with
"requirements" and ended in ".txt", as a pip manifest. It then reported its
aiohttp 3.14.3 as a newly added vulnerable dependency (GHSA-2g87-pp6c-29x5 and
GHSA-5wr8-gcqf-gqf3, high). The copy is an evidence fixture, not an install
input.

The copy is renamed to .../historical/examples/openhands-native-capabilities/
pinned-at-30ab2e3a.source.txt. Its bytes are unchanged (sha256 16e1a44e...). Like
ecea286's worker.py.lock.source.txt, the name matches no lockfile or manifest
pattern. The record's single reference moves with it.

Because the new name is not a lockfile candidate, tests.test_osv_lockfile_coverage
refuses an exclusion for it ("is excluded but is not a tracked lockfile"). The
exclusion commit 3 added is therefore removed, and .github/osv-scanner-lockfiles.json
is byte-identical to 3449e04 again. manifests/evidence.json unregisters the old
path, registers the new one, and refreshes the record's and the inventory's
entries. No dependency-review allowance or OSV ignore is added.

Checks on this head, run with python3 -B in a scratch CPython 3.12.3 venv built
from .github/requirements-ci.txt with --require-hashes:
- scripts/validate_convergence.py --all-recorded: 33 records, all valid;
- scripts/validate.py: passed (71 components, 12,328 hashed files, 243 receipts);
- scripts/evidence_manifest.py --check: passed;
- unittest of test_osv_lockfile_coverage, test_convergence_contract,
  test_evidence_manifest, test_receipt_sha256_key_custody,
  test_research_convergence_practice and test_sota_convergence: OK.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Test the trading-2604 installer's admission of the published f451 lock

The native Codex review of a6cb6b8 (P2) and the GPT review's L2 asked for a committed regression
test of the migration input that commit 2 added to install-trading-2604.sh: an install still at
the October 8 published lock f451ef97 must be admitted and moved to the current lock, never
accepted as current. All 13 lock and vector tests passed with that admission removed.

tests/test_trading_2604_migration.py runs only the installer's hash definitions and its
step=locked-project admission and copy block, verbatim, against a temporary project (no uv, sync,
network or host-runtime command), and checks:
- the retained fixture is byte-for-byte the published lock the installer names;
- the published lock is admitted and replaced by the current lock;
- the current lock passes unchanged;
- an unknown lock is refused with exit 73 and left in place;
- with the published admission line removed (the reviewer's mutant), the published lock is refused.

It is a new module: tests/test_trading_2604_lock.py is hash-bound by the 2026-10-08 record
evidence/artifacts/runtime-final-lock-binding-20261008/legacy-migration-source-repair.json and stays
unchanged.

Checks: the new module, test_trading_2604_lock, test_scheduled_trial and test_osv_lockfile_coverage
pass; scripts/validate.py passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>