PR-6: new-machine install path (WSL2 accepted, macOS arm64 drafted + hosted smoke) - #65

Append a bootstrap-macos job to .github/workflows/adoption-bootstrap.yml
without touching the existing bootstrap-linux job or the trigger block, and
record the unit in docs/tasks/2026-09-22-new-machine-install.md. The job runs
on macos-15, asserts uname -m is arm64, captures sw_vers, runs
adoption/bootstrap-macos.sh --profile macos-arm64-foundation
--skip-system-packages into $RUNNER_TEMP/eco, accepts only exit 0 or 2 from
scripts/adoption_status.py (2 is expected on darwin because
supported_platforms pins linux/x86_64), asserts with jq that no profile
command or recipe is absent and that platform.os/architecture/supported stay
darwin/arm64/false, renders the committed example host's configs, prints the
installed client versions, and uploads status.json, sw_vers.txt and
installed-versions.txt for 30 days.

Verified (evidence class: structural validation only; no macOS runner has
executed this job and adoption/bootstrap-macos.sh is a sibling unit's file):
python3 -m unittest tests.test_workflow_security
tests.test_workflow_security_coverage tests.test_adoption_bootstrap -v exit 0,
Ran 30 tests, OK, no skips; zizmor --offline --no-config --no-ignores
--persona regular --strict-collection .github/workflows exit 0, v1.30.1, 12
files, "No findings to report. Good job! (27 suppressed)"; yaml.safe_load exit
0 reporting jobs ['bootstrap-linux', 'bootstrap-macos']; grep for literal
/home or /Users paths exit 1 with no matches; python3 scripts/validate.py exit
1 with only the expected SHA-256 and byte-count mismatch for the changed
workflow, which the coordinator rehashes at integration. actionlint is not on
this host's PATH and was not run.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Copy ecosystem-bounded-run and gitleaks-guarded out of the private
codex-ecosystem bin directory so a new Linux/WSL2 host can install the
same containment. ecosystem-bounded-run is byte-for-byte identical to
its source (sha256 7680fe11...e17db, unchanged after copy). Only lines
5 and 6 of gitleaks-guarded differ from its source (sha256
66db06f6...c52f1): both held a literal personal home path, replaced by
the ECO_INSTALL_ROOT/GITLEAKS_NATIVE contract and by BASH_SOURCE-relative
runner resolution. Every /usr/bin tool path, every exit code (64/75/78)
and every memory/task/runtime limit is unchanged.

Verified on this WSL2 host (cgroup v2 plus a native systemd --user bus):

local_integration
- ecosystem-bounded-run sh -c 'exit 3' returned 3; ecosystem-bounded-run
  true returned 0; systemctl --user list-units 'ecosystem-job-*' --all
  --no-legend was empty afterwards. --collect is asynchronous, measured
  at 0.003s-0.032s, so the test polls to a deadline instead of sleeping.
- gitleaks-guarded version with GITLEAKS_NATIVE at a stub executable
  execed the stub directly: the stub's oracle file recorded argv
  ["version"] and an instrumented stand-in runner's oracle file was
  never created.
- A real delegated scan (gitleaks-guarded dir adoption/tools) ran inside
  the scope and returned upstream's own result, "no leaks found", exit 0.

structural
- shellcheck -S style clean on both scripts.
- No /home or /Users literal in the scripts, the README or the test.
- Strict mode present; usage with no arguments exits 64; a missing
  native binary refuses with 78.
- python3 scripts/validate.py passed; the new files are not hash-listed
  yet, which the coordinator registers at integration.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Resolves the independent review's two major findings and two minor
findings on the U-A docs unit:

- README.md WSL2 block no longer claims "a native acceptance receipt
  on Linux/WSL2 x86_64" for the documented bootstrap-linux.sh command
  sequence; it now names the actual receipt (adoption/receipt.json,
  a native uv SDK-reproduction run, not a run of this command
  sequence) and points readers to record a per-host receipt via
  adoption/bootstrap.md steps 6-7.
- README.md macOS heading no longer points at a nonexistent
  "hosted-runner smoke pending/green" manifest field; it quotes the
  real platform_profiles entry (macos-arm64: drafted_not_accepted,
  evidence_ref null) and keeps the hosted-runner-vs-local claim
  boundary.
- adoption/bootstrap.md's adoption/tools/README.md reference is now
  explicitly marked as added by a sibling unit, so the dead link is
  disclosed inline rather than only in the handoff limits.
- README.md heading corrected from "in six commands" to "in six
  steps" (the block has seven shell commands on six numbered lines).

Verified (source_review/structural + local_integration):
- python3 -m unittest tests.test_adoption_bootstrap tests.test_adoption_contract -v: Ran 32 tests, OK.
- python3 scripts/validate.py: SHA-256/byte-count mismatches confined to
  the three edited files (README.md, adoption/bootstrap.md,
  adoption/platforms/linux-wsl2.md), as expected before coordinator
  integration rehash.
- grep -n baseline_commit README.md adoption/bootstrap.md: matches in
  both files, all via the manifest field name, no hardcoded sha.
- grep -rn -E '/(home|Users)/[a-z]' README.md adoption/bootstrap.md
  adoption/platforms/linux-wsl2.md: no matches.
- git diff --name-only 445bc83..HEAD: still exactly the three owned
  files.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Independent review found the bootstrap-macos job's jq assertions passed
vacuously on any scripts/adoption_status.py error report: inspect_adoption
returns early with manifest.status "invalid", "profiles": [] and a non-empty
errors list and main() still exits 2, the code the job whitelists, so
[.profiles[].commands[] | select(.present == false)] | length == 0 is true over
an empty array and platform.supported is false by initialisation. A broken
macOS profile would have gone green.

Add a positive step before the emptiness assertions that checks the report is a
real macos-arm64-foundation report: manifest.status valid, errors empty,
exactly one profile with that id, non-empty commands and recipes arrays, and
profile status prerequisites_present. Comment the gh --version line to say it
normally reports the runner image's gh rather than a pinned install. Record the
correction, the gh labelling and the tests/test_adoption_bootstrap.py profile-id
coverage follow-up (outside this unit's owned paths) in the task record.

Verified, evidence classes: local integration check - python3 -m unittest on
tests.test_workflow_security, tests.test_workflow_security_coverage and
tests.test_adoption_bootstrap, 30 tests OK, no skips, on this WSL2 Linux host.
Structural validation - zizmor 1.30.1 --offline --strict-collection over
.github/workflows, no findings; yaml.safe_load parse; PRIVATE_CONTENT grep;
scripts/validate.py (expected SHA-256/byte-count mismatch only, coordinator
rehashes). Refutation probe - scripts/adoption_status.py --profile
not-a-real-profile now fails all three new assertions (exit 1 each) where the
old set returned true. The green-path jq set was exercised against a synthetic
report built from the real darwin schema, which is synthetic, not native
operation. NOT claimed: native_cli_e2e; no macOS runner has executed this job.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

adoption/bootstrap-macos.sh mirrors bootstrap-linux.sh section for section
with the macOS substitutions: Darwin/arm64 uname guard (resolved through
PATH so tests can shim it), shasum -a 256 instead of sha256sum, an atomic
mkdir lock instead of flock, cd + pwd -P instead of realpath, Homebrew only
for a missing jq, a gh zip installer, and a llama.cpp installer that copies
the whole archive directory and writes a DYLD_LIBRARY_PATH wrapper at
bin/llama-server. It stays bash 3.2 compatible (no mapfile) because a stock
Mac ships /bin/bash 3.2. A new --plan flag resolves the profile pins with no
network and still exits 1 on a null sha256. PATH exports bin_dir once before
the core node/uv/gh loop, keeping the Linux regression property.

Verified:
- Independent observation of publisher provenance for every pin in
  adoption/pins-macos-arm64.json: node 24.21.0 from nodejs.org SHASUMS256.txt,
  uv 0.12.17 and ai-memory 2.3.2 from their .sha256 sidecars, gh 2.101.0 from
  gh_2.101.0_checksums.txt; llama.cpp b11057 and qdrant 1.19.1 publish no
  checksum file, so each GitHub release asset digest was read and the asset was
  re-downloaded to a scratch directory and re-hashed with sha256sum (both
  agreed); the four npm tarballs were re-downloaded, hashed, matched to the
  linux-x86_64 pins byte for byte and cross-checked against npm dist.integrity.
  No hash is null or guessed.
- local_integration: shellcheck -S style clean, and
  python3 -m unittest tests.test_adoption_bootstrap_macos
  tests.test_adoption_bootstrap tests.test_adoption_contract ran 63 tests OK,
  including a shimmed --plan run on Linux that lists all ten pins and installs
  nothing, and a null-hash pins copy that exits 1 with "Refusing to install".
  tests.test_adoption_status, test_ecosystem_manifest, test_landscape,
  test_layer_verdicts and test_stack_lifecycle ran 131 tests OK after the
  manifest row change.
- Not established: no macOS host executed this script. The platform_profiles
  row stays drafted_not_accepted with evidence_ref null and records the hosted
  smoke job as pending_first_green_run; launchd, the Metal embedding
  acceptance and native sign-in remain unrun.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Review found the README claimed a symlinked gitleaks-guarded resolves its
runner beside the real script. Bash sets ${BASH_SOURCE[0]} to the invocation
path and does not resolve a symlinked file, so the runner is looked up beside
the link: a link outside the install directory refuses every scan with 78.
Verified by running a link in the same directory (exit 0, native stub reached)
and a link in another directory (exit 78, no scan path entered); both are now
unit tests rather than prose.

Also measured, while re-running acceptance, that a transient scope unit can
outlive its cgroup by more than 30s on this host. The surviving unit reported
TasksCurrent=0 and an already-removed control group, so it is systemd GC lag,
not an escaped job. The containment test now fails only when a surviving scope
still holds tasks, and the parser was checked against a deliberately busy scope
(TasksCurrent=1 detected). The README records that an immediate non-empty
list-units result is not by itself a containment failure.

Tighten the strict-mode regex to the bytes actually shipped, record the sha256
of the modified gitleaks-guarded copy, and document the per-user lock check
(a second concurrent scan exits 75 while the first runs).

Evidence class: local_integration on this WSL2 host for the symlink, scope
teardown and lock observations; structural for shellcheck, the path scan and
scripts/validate.py. No macOS evidence.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Review fix round on the guarded-runner unit. The scripts themselves are
untouched: exit codes 64/75/78 and every memory, task and runtime limit are
unchanged, and only the suite and the README moved.

MAJOR - the containment branch no longer proved containment. After the earlier
relaxation it asserted only exit-code propagation and that no surviving unit
held tasks, so it passed unchanged even if ecosystem-bounded-run had executed
the command uncontained. It now proves containment from inside the job. One job
writes three oracles - its own /proc/self/cgroup, the systemd properties of the
unit that cgroup names, and the kernel limit files of that cgroup - and the test
requires the cgroup v2 leaf to be an ecosystem-job-<uid>-<pid>-<random>.scope
(the launcher's own unit name), systemctl --user show to report that unit
running with TasksCurrent >= 1 and MemoryMax=6442450944 while the job is still
inside it, which is only true if systemd-run really created the unit, and the
cgroup's own memory.max/pids.max to read 6442450944/256. Ambient ECOSYSTEM_JOB_*
variables are stripped from the job environment so the documented defaults are
what is measured.

Mutation-checked on this host rather than assumed: a stand-in runner that execs
the command directly fails with "its own cgroup was '0::/init.scope'", and a
runner patched to MemoryMax=8G fails with "'8589934592' != '6442450944'".

minor - the post-exit check now polls for the release of only the unit name this
run used, derived from the oracle cgroup path, instead of inspecting every
ecosystem-job-* unit of the calling user; a concurrent guarded scan elsewhere can
no longer fail or mask it. The deadline is raised from 15s to 45s because
--collect teardown latency on this systemd is unbounded and over 30s was
observed; a unit still listed at the deadline fails only when that unit still
holds tasks.

minor - the CONTAINMENT_AVAILABLE probe is wrapped in try/except (OSError and
SubprocessError, which covers TimeoutExpired) with its existing 60s timeout, so
a host where systemd-run cannot even be executed takes the refusal branch
instead of raising at import and taking the whole module down.

minor - strict mode. The brief's acceptance item named "set -Eeuo pipefail", but
the shipped scripts contain "set -euo pipefail". The suite asserts that literal,
because the files are copied byte-for-byte from their source and adding -E would
break the byte-fidelity guarantee the provenance section records. It also now
asserts that neither script installs an ERR trap, which is the only reason the
missing -E is inert, so that exemption cannot go stale. The README evidence
paragraph states the divergence in those words.

minor - trailers. The two earlier commits of this unit (3f8ee9b, 044c4ab) carry
"Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>", which the
verify pass flagged as differing from the project's usual "Claude Fable 5.1"
line. History is not amended. This commit keeps the Opus 5 trailer because that
is the model that wrote it and the session's attribution mandate names that
exact line; recording a different model here would be a false provenance entry
in a catalog about provenance. Normalising the three trailers is the
coordinator's call at integration.

Acceptance re-run on this WSL2 host: shellcheck -S style clean on both scripts
(0); the personal-path scan found nothing (grep 1); python3 -m unittest
tests.test_adoption_guarded_runners -v ran 12 tests OK on the containment branch;
ecosystem-bounded-run sh -c 'cat /proc/self/cgroup' printed an
ecosystem-job-*.scope leaf; python3 scripts/validate.py passed.

Evidence class: local_integration on this WSL2 host (cgroup v2 plus a native
systemd --user bus) for containment, the limit values, the mutation checks and
the release latency; structural for shellcheck, the path scan and validate.py.
No macOS evidence, and no evidence for a host with a different systemd or cgroup
configuration.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

adoption/bootstrap-linux.sh gained --allow-unpinned, an exit-3 fail-closed
check for selected components with no pin, and an apt step that runs before
the prerequisite presence check with exit 4 when --skip-system-packages hides
it. adoption/bootstrap-macos.sh now carries the same contract:

- --allow-unpinned <id,id,...> and --allow-unpinned=<...>; every selected
  component without a pin in adoption/pins-macos-arm64.json fails closed with
  exit 3 before any install and before --plan prints a line, unless it is
  allowed, in which case it is skipped and echoed to the run log. socraticode,
  the one selected component this draft deliberately leaves unpinned, is
  carried as a documented skip so the shipped profile (and the hosted smoke
  job, which passes no flags) still exits 0; every other gap exits 3. The
  null-sha256 refusal stays exit 1.
- the brew jq install now runs before the curl/git/tar/shasum/unzip/jq/mktemp
  presence check; a missing prerequisite is listed once and exits 4, not 1.
- usage() documents --allow-unpinned, exit 3 and exit 4 in the Linux wording,
  and adoption/platforms/macos-arm64.md gains a usage plus exit-code table
  (0/1/2/3/4) naming the documented socraticode skip. Its "Drafted, not
  accepted" heading and every other section are unchanged.
- empty-array length tests were kept out of the script: a stock Mac's bash 3.2
  rejects some empty-array expansions under set -u, so the new code counts with
  integers and guards element expansions, matching this file's existing style.

Verified on Linux with the uname/sw_vers shim (no macOS host ran anything):
shellcheck -S style exit 0; python3 -m unittest tests.test_adoption_bootstrap_macos
tests.test_adoption_bootstrap tests.test_adoption_contract -> 80 tests OK (13 new
macOS tests: exit 3 in --plan, --allow-unpinned and its = form, partial allow,
missing flag value exit 2, documented skip, exit 4 with jq hidden from PATH plus
its control, and two source-order checks); --help exit 0 showing --allow-unpinned;
shimmed --plan on the shipped pins exit 0; no personal home paths; the only
option-set difference from bootstrap-linux.sh --help is --plan, by design.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Registers the macOS bootstrap, pins, portable guarded runners, their tests
and the task record in manifests/evidence.json (1,753 hashed files),
rehashes the seven edited publication files, regenerates
docs/ecosystem/index.html and drops the build-time wording from
adoption/bootstrap.md now that adoption/tools/README.md exists.

Gate on this tree: build_ecosystem --check passed; validate.py passed (69
components, 1,753 hashed files, 139 receipts); validate_catalogs,
validate_foundation (no errors) and validate_convergence --all-recorded
passed; python3 -m unittest 1,427 tests OK (210 skipped); token-manifest
test OK; guarded Gitleaks over d093a4c..HEAD with .gitleaks.toml: no leaks
(--max-target-megabytes 2 and --max-decode-depth 0 recorded as coverage
exclusions).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

The hosted validate job's shellcheck reports SC2317 (info: command appears
to be unreachable) for the bounded runner's trap-invoked cleanup function,
which shellcheck 0.11.0 on the WSL host does not; the structural test now
passes -e SC2317 with the reason recorded in adoption/tools/README.md, and
the scripts stay byte-faithful to their recorded provenance.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…note the merge-ref checkout

The run artifact lists both gh copies: the image's brew gh 2.100.0 and the
bootstrap's pinned 2.101.0 first on PATH, so the workflow comment, Decision 9
and the record's limit now say the pinned install was measured. The receipt
lists all nine pinned components observed at their pinned versions and notes
that a pull_request run checks out the synthesised merge ref. The 12-commit
guarded Gitleaks re-run after the fix commit is recorded.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>