Retire PR #392 (macOS token-efficiency receipts) with a dated record - #657

Scope

• Retire Add macOS host receipts for 9 token-efficiency components + jcodemunch-mcp (issue #276) #392 unmerged after this dated record lands. Preserve the September 27 Mac component versions, coverage findings, bounded child/worker verifier tally, recording lessons and fresh-recording path. The old receipts and E2E artifact stay outside main.
• Base commit: 4ced2923063db6a6dcafa9f25af5ee05a4153c75, main at publication. The record and its registry entry were prepared and first checked on its parent, 9b0b8d6d25f9e3fb8f71770500e774170423315e. Main then gained one commit, an AGENTS.md wording fix with its registry hash row, so main's registry copy was restored and the registration replayed, as the contract's hot-file protocol requires.
• Builder HEAD for the builder commands: 9b0b8d6d25f9e3fb8f71770500e774170423315e, with the two changes in the working tree. Publication HEAD: f1401d2bd908cbd79a367d31a250dd5e0e433fe5, two commits on the base above. Review-round HEAD: 028f15474e738c80bb1484986612aee43cdfb5dc, four further fast-forward commits on the same base (two record edits, each followed by the registry replay); see Review round.
• Lane: lane:foundation. Documentation is foundation-owned; hash registration alone requires no other-lane acknowledgement under docs/lanes.md, “Labels and PRs.”
• Owned paths touched: docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md and manifests/evidence.json.

SOTA sources

• Repository evidence policy at the base: append-only native recordings; acceptance policy distinguishes source review, structural checks and host execution.
• Native registration function and lane hot-file protocol: main's registry copy followed only by register_file; the record is committed first and the registry last.
• #392, pinned head 34b878771b3d1e040c74cb957ff8b4118169ece8: only its Scope, SOTA sources, Evidence-class table, Coverage and configuration, Findings and Round 3 sections, plus the comments of September 27 14:23:29Z, September 27 15:13:46Z, September 29 04:46:33Z and September 29 05:15:39Z. No receipt text or withdrawn text is reproduced.
• Custody notice, posted October 3 at 08:21:53Z: the window ended at 10:21:53Z. The builder's later reads found no objection on Add macOS host receipts for 9 token-efficiency components + jcodemunch-mcp (issue #276) #392, in coordination or on Client configuration for the new distribution: wire only what the definitive manifest installs (map, tool, F9) #608.
• Roadmap at the base, especially lines 178, 206 and 235, read with the line 193 table header: pending landing work, and row F-2W-6 assigned to the Mac coordinator, depending on a Mac session.
• #492, main commit c0ca46d1294ea2b286f629aa9550a7cae3be9e6b, and current digest implementation, lines 1012–1019: new recordings hash the published sanitized excerpt. This does not repair old receipt bytes.
• Foundation landscape, Mac pins and stack pins: unchanged selections and the six untested Mac platform statuses.
• New-target defaults, current ccusage and context-supply rows, context-supply discussion and current install-plan rows 26/27: no context-supply installation and no ccusage installation on the new target. The plan's earlier offsets are stale; the older explanatory sentence retaining ccusage (line 292) differs from the current decided table and plan, and predates both: git blame at the base attributes it to New WSL definitive defaults: one default per slot from a blind decision round in both model families #591, the two table rows to Definitive manifest, next version: the blind GPT round combined with the Claude record (one job per row, 31 definitive, 4 split) #602 and the plan rows to Install plan for the new WSL distribution: 64 rows from the merged manifest, validated on a real throwaway distribution #606.
• Legacy-host scope, token-skills-orchestration, later Mac client snapshot, lines 109–111, and workflow status rule: dated execution and current source review remain separate.
• GitHub sensitive-data removal documentation, read live on October 3: PR references retain history, refs/pull/ is read-only and removal is a separate operation. Closing Add macOS host receipts for 9 token-efficiency components + jcodemunch-mcp (issue #276) #392 is not a purge.

Evidence-class table

Local commands run

The first block holds the sandboxed builder's results; the builder ran no git writes. All builder acceptance commands ran at HEAD 9b0b8d6d25f9e3fb8f71770500e774170423315e, with the two working-tree changes present. The second block holds the publication results.

$ rtk proxy git show origin/main:manifests/evidence.json > manifests/evidence.json
exit 0; restored the observed base registry

$ rtk python3 -c 'import sys; from pathlib import Path; sys.path.insert(0, "scripts"); import host_receipts
for p in sys.argv[1:]: host_receipts.register_file(Path("."), p)' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 0; one new file entry only

$ rtk python3 scripts/validate.py
exit 0
{"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}
Integrity and scope checks only; no live provider or GPU execution.

$ rtk python3 scripts/validate_convergence.py --all-recorded
exit 0; record[0]: valid through record[25]: valid

$ rtk python3 scripts/component_matrix.py --check
exit 0
{"rows": 32, "status": "checked"}

$ rtk python3 scripts/new_host_grand_list.py --check
exit 0
{"status": "passed", "layers": 32, "winners": 66}

$ rtk git diff --check origin/main...HEAD
exit 0; no output, but the committed range is still empty

$ rtk git diff --name-only origin/main...HEAD
exit 0; no output, so the committed two-file assertion remains pending

$ rtk proxy grep -n -E '/User[s]/|/hom[e]/|~/|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 1; no matches, no output or error (the two home-directory prefixes are written as one-character classes in this body only, so it does not repeat them literally)

$ rtk git status --short
exit 0
 M manifests/evidence.json
?? docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md

The tracked registry whitespace check returned 0 with no diagnostics. The new record's native no-index whitespace comparison returned 1 with no diagnostics because the file differs from the empty input. Independent JSON comparison found exactly one new registry entry, matching the record's SHA-256 and 15,311-byte length. Both generated-report checks passed without rewriting a report.

$ rtk scripts/git-hooks/pre-commit
exit 1
Guarded Gitleaks launcher line 22: mandatory runtime lock is on a read-only filesystem.
No scan started; no bypass used.

This required check failed for a reason outside the two owned files, so the builder stopped and handed back. The coordinator must run the guarded hook on the actual staged changes in its authorized environment, repeat both committed-range commands on the final publication head, and retain the independent review and required-check results before merge. No staged-scan pass or committed-range acceptance is claimed by this builder block; the publication block below supplies them.

Publication results, run by the publishing step after the main refresh. Publication HEAD f1401d2bd908cbd79a367d31a250dd5e0e433fe5 on base 4ced2923063db6a6dcafa9f25af5ee05a4153c75. The native hooks were active on both commits (no bypass), and TMPDIR was set to a scratch directory outside the repository.

$ git ls-remote origin refs/heads/main
exit 0; live main is 4ced2923063db6a6dcafa9f25af5ee05a4153c75, one commit after the builder's base (an AGENTS.md wording fix and its registry hash row); the branch did not yet exist on the remote

$ git rebase origin/main
exit 0; fast-forward of the still-empty local branch from 9b0b8d6d25f9e3fb8f71770500e774170423315e to 4ced2923063db6a6dcafa9f25af5ee05a4153c75

$ git commit -F <message file>      [pre-commit gitleaks hook, record only]
exit 0; 1d7a65e84f018fd87498c010209c2448e8f4daa3 "Retire PR #392 macOS token receipts with a dated decision record"; staged scan: about 15311 bytes scanned, no leaks found

$ git show origin/main:manifests/evidence.json > manifests/evidence.json
exit 0; restored main's registry copy

$ python3 -c '<the register_file call above>' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 0; one new file entry. Independent JSON comparison: the registry minus that entry equals main's registry; the entry equals the builder's (sha256 005fa9ee0041ce9a40f6f4ac08db0523866f1a059ac446f7340b6db353f86e90, 15,311 bytes); receipts and convergence_records are unchanged.

$ git commit -F <message file>      [pre-commit gitleaks hook, registry only]
exit 0; f1401d2bd908cbd79a367d31a250dd5e0e433fe5 "Register the PR #392 retirement decision record"; staged scan: about 197 bytes scanned, no leaks found

$ python3 scripts/validate.py
exit 0
{"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}
Integrity and scope checks only; no live provider or GPU execution.

$ python3 -B -m unittest tests.test_osv_lockfile_coverage.LockfileInventoryTests.test_every_tracked_lockfile_and_manifest_is_listed tests.test_blind_checkout.RepositoryClassificationTests.test_every_blueprint_value_under_a_label_key_is_classified tests.test_workflow_security_coverage.NewWorkflowSecurityCoverageTests.test_all_published_workflows_are_listed_and_covered
exit 0; Ran 3 tests, OK, no skips (the three pre-push registry tests)

$ python3 scripts/validate_convergence.py --all-recorded
exit 0; record[0]: valid through record[25]: valid

$ python3 scripts/component_matrix.py --check
exit 0
{"rows": 32, "status": "checked"}

$ python3 scripts/new_host_grand_list.py --check
exit 0
{"status": "passed", "layers": 32, "winners": 66}

$ git diff --check origin/main...HEAD
exit 0; no output

$ git diff --name-only origin/main...HEAD
exit 0
docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
manifests/evidence.json

$ grep -n -E '/User[s]/|/hom[e]/|~/|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 1; no matches, no output (same one-character-class spelling as above)

These are local structural and integration checks, not upstream host execution or a new model run. The publishing step did not run the independent review or wait for the required checks; Review round below records the review, the repair round and its checks.

Decision record

docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md names the evidence, alternatives, history-exposure boundary and overturn condition. A Mac owner can use a new PR for fresh selected-component receipts recorded from main at or after #492, with catalog_revision set to a commit on main. #276 remains open for that work.

Host evidence

Not applicable: this PR adds no host receipt, changes no host receipt and changes no platform status. The historical classifications are quoted as reported metadata only.

Independent review: approve, from one Opus read-only review of the record against its sources at f1401d2bd908cbd79a367d31a250dd5e0e433fe5, with eight minor findings. One repair round followed; dispositions, checks and residuals are in Review round. Builder self-check is not substituted for this gate.

Review round

One independent read-only Opus review of the record against its sources, at f1401d2bd908cbd79a367d31a250dd5e0e433fe5, returned approve with eight minor findings: five text fixes and three verification gaps, none blocking or should-fix. One repair round followed, as four fast-forward commits on the published branch, each record edit followed by a registry replay. 0908b116a8408815819eb71a3b6135581ad1300c applies the five text fixes, and 742abc1d556a994795c172baec8bf6b248b80638 restores main's registry copy and replays the contract's register_file call. Then 5e5f3cfb9959046386387ec8d12d27fcdc160030 clarifies one sentence that the first edit added (row 9), and 028f15474e738c80bb1484986612aee43cdfb5dc repeats the registry replay. The record's registry row now reads sha256 2c73507dea5faf517e4068b7a6efad57483250e0eb51f3dcba781d4fd922dfe9, 16,044 bytes; the publication block above keeps the values that were true at f1401d2b. Nothing was force-pushed, and #392 is untouched.

Review-round commands, on final HEAD 028f15474e738c80bb1484986612aee43cdfb5dc and base 4ced2923063db6a6dcafa9f25af5ee05a4153c75 (main unchanged since publication). The checks after the commits ran on 742abc1d556a994795c172baec8bf6b248b80638 and again on 028f15474e738c80bb1484986612aee43cdfb5dc with the same results, except the commit count of the range scan; the values shown are from 028f15474e738c80bb1484986612aee43cdfb5dc. TMPDIR pointed to a scratch directory outside every repository, the native hooks were active (no bypass), and every exit code was read directly, not through a pipe.

$ git commit -F <message file>      [record only; pre-commit gitleaks hook]
exit 0; 0908b116a8408815819eb71a3b6135581ad1300c, 1 file changed

$ git checkout origin/main -- manifests/evidence.json
exit 0

$ python3 -c '<the register_file call above>' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 0; independent JSON comparison: files[] minus the record row equals main's, the one row equals the record's sha256 and byte count, files[] stays sorted, and every other top-level key equals main's

$ git commit -F <message file>      [registry only; pre-commit gitleaks hook]
exit 0; 742abc1d556a994795c172baec8bf6b248b80638; staged scan: about 105 bytes scanned, no leaks found

$ git commit -F <message file>      [record only, second edit; pre-commit gitleaks hook]
exit 0; 5e5f3cfb9959046386387ec8d12d27fcdc160030, 1 file changed; staged scan: about 344 bytes scanned, no leaks found

$ git checkout origin/main -- manifests/evidence.json; python3 -c '<the register_file call above>' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 0, exit 0; the same independent JSON comparison passed against the record's new sha256 and byte count

$ git commit -F <message file>      [registry only; pre-commit gitleaks hook]
exit 0; 028f15474e738c80bb1484986612aee43cdfb5dc; staged scan: about 105 bytes scanned, no leaks found

$ python3 scripts/validate.py
exit 0
{"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}
Integrity and scope checks only; no live provider or GPU execution.

$ python3 scripts/validate_convergence.py --all-recorded --root . --json
exit 0; "valid": true, 26 records, 0 errors

$ git diff --check origin/main...HEAD
exit 0; no output

$ git diff --name-only origin/main...HEAD
exit 0
docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
manifests/evidence.json

$ python3 scripts/component_matrix.py --check
exit 0
{"rows": 32, "status": "checked"}

$ python3 scripts/new_host_grand_list.py --check
exit 0
{"status": "passed", "layers": 32, "winners": 66}

$ python3 -c '<the pre-push hook runner>' <the three pre-push registry tests>
exit 0; Ran 3 tests, OK, no skips

$ grep -n -E '/User[s]/|/hom[e]/|~/|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' docs/decisions/2026-10-03-retire-pr-392-mac-token-receipts.md
exit 1; no matches, no output (same one-character-class spelling as above)

$ gitleaks git --redact --no-banner --config .gitleaks.toml --log-opts=origin/main..HEAD .
exit 0; 6 commits scanned, about 18,013 bytes, no leaks found (4 commits, about 17,564 bytes, on 742abc1d)

$ python3 <counts-only re-derivation script>      [prints counts, never receipt text]
exit 0; 17 receipts for 10 components and 3 E2E artifact files; 10 of 17 receipts not ancestors of the base or of main; 6 distinct revisions, all reachable from receipt-revision/* tags; 31 of 48 digest mismatches

$ git ls-remote origin refs/heads/main refs/heads/foundation/retire-pr-392-20261003 refs/pull/392/head
exit 0 before each push; main 4ced2923 and pull/392/head 34b87877 both times; the branch was f1401d2b before the first push and 742abc1d before the second

$ git push origin HEAD:foundation/retire-pr-392-20261003      [first push]
exit 0; fast-forward f1401d2b..742abc1d; the pre-push hook ran the three registry tests on 742abc1d: OK

$ git push origin HEAD:foundation/retire-pr-392-20261003      [second push]
exit 0; fast-forward 742abc1d..028f1547; the pre-push hook ran the three registry tests on 028f1547: OK

Residuals:

1. The required checks restart on 028f15474e738c80bb1484986612aee43cdfb5dc. Each body edit fires validate.yml's edited trigger (line 9). Its concurrency group, keyed by workflow, event name and PR number with cancel-in-progress for pull requests (lines 15–17), cancels the push's in-flight run, so validate re-runs on the same head; a cancelled validate run on this branch is therefore expected, not a failure. The coordinator must confirm every required check green on that head before the squash merge.
2. The two publication commits carry a Sonnet 5.5 co-author trailer, and the four review-round commits carry an Opus 5.5 trailer. Changing the earlier commits would need a force-push, which this round may not do. The squash merge's commit message decides the trailer that lands on main.
3. The record's links stay pinned to its verification base 9b0b8d6d. Main at 4ced2923 differs from that base only in AGENTS.md and its registry row, so no cited line moved.

Checklist

• No GitHub Actions changed; action pinning and permission items are not applicable.
• The record contains no private values, receipt body, output excerpt or withdrawn file name, and introduces no secret requirement.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned files, worktrees, coordination state and the preserved Add macOS host receipts for 9 token-efficiency components + jcodemunch-mcp (issue #276) #392 branch were not edited.
• Final publication head, two-file committed diff, staged pre-commit scan, independent review and complete required checks are recorded before merge.

🤖 Generated with Claude Code