Raise Claude Code floor to 2.1.295 and classify plugin notifications - #922

### Scope

- What this PR changes, in one or two sentences: the Claude settings template and the repository's project settings now start the secret-path guard with `/usr/bin/python3` instead of the first `python3` on `PATH`, so a broken or inactive interpreter shim can no longer make every guarded Bash call exit 1; the new-WSL renderer admits that one absolute path as a practice-hook command word, with tests that it still refuses every other interpreter path.
- Base commit: `22e3ef6ffd53b09f3cb335c46f7c696093521274` (main after #920)
- Lane: `lane:foundation`
- Owned paths touched: `adoption/templates/claude.settings.template.json` (one command), `.claude/settings.json` (the project guard command, folded in at the command center's request), `tools/adoption/new_wsl_client_config.py` (`BASE_COMMAND_WORDS` and its comment), `tests/test_install_claude_profile.py`, `tests/test_new_wsl_client_config.py`, `docs/decisions/2026-10-08-guard-hook-fails-closed.md` (append-only addendum), `manifests/evidence.json` (re-registration).

Successor to #920, scoped by the command center on 2026-10-09: the interpreter pin, the allowlist entry for that one path, the jq refusal and missing-script exit 2 kept, and a test with no mise shim on `PATH`.

### SOTA sources

- Claude Code hooks: exit code 2 blocks a PreToolUse call and other non-zero codes are non-blocking (https://code.claude.com/docs/en/hooks, read 2026-10-09); `onFailure: "block"` added in 2.1.295 (`anthropics/claude-code@602df92bf481ed904533e95c09f740f40aab5aed` CHANGELOG.md line 5: "a hook that can't start, times out, or exits with an unexpected code blocks the action instead of letting it through").
- POSIX Shell Command Language, 2.8.2 Exit Status for Commands: a command that is not found exits 127 (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/V3_chap02.html).
- jq 1.7 manual, `halt_error(exit_code)` (https://jqlang.org/manual/v1.7/), unchanged from #920.
- Python `ast.parse(..., feature_version=...)` (https://docs.python.org/3/library/ast.html#ast.parse), used to check the guard parses as 3.9 through 3.14.
- `docs/decisions/2026-10-08-guard-hook-fails-closed.md` and the Claude Code native practice record of 2026-10-09 (#923, slot `hooks`).

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Unpinned, a failing `python3` first on `PATH` makes the guard return 1 for a credential-file read and for `git status`; pinned, 2 and 0 | `local_integration` | rendered template + installed guard in a temporary home, `PATH` = a directory holding only `jq` and a failing `python3` stub |
| The rendered hook blocks before and after install with no working `python3` on `PATH` | `local_integration` | new `test_rendered_hook_runs_the_system_interpreter_without_a_working_python3_on_path`; fails when the template is unpinned |
| The renderer admits `/usr/bin/python3` and refuses `/usr/local/bin/python3`, `/usr/bin/python3.14`, `/usr/bin/python`, `/bin/python3`, `/tmp/python3`, `./python3`, `/usr/bin//python3`, `/usr/bin/../bin/python3`, `/usr/bin/env` | `local_integration` | new `test_a_practice_hook_may_name_only_the_pinned_system_interpreter_by_absolute_path`; fails when the allowlist entry is removed, and `--check` on the shipped template then reports the guard |
| The project hook in `.claude/settings.json` takes the same form: a checkout without the script gives 2 and the refusal; the repository's guard gives 2 for a credential-file read and 0 for `git status`, behind the same failing-`python3` `PATH` | `local_integration` | new `test_project_hook_runs_the_system_interpreter_and_refuses_a_missing_script`; fails when the hook is unpinned and when its refusal is removed |
| The guard uses the standard library only and parses as Python 3.9 to 3.14 | `source_review` | imports at `scripts/hooks/secret_path_guard.py:108-115`; `ast.parse` with `feature_version` 3.9 through 3.14, run by `/usr/bin/python3` 3.14.4; the suite ran under 3.13.16 |

### Local commands run

```
$ python3 -E -s -B -m unittest tests.test_apply_claude_settings tests.test_currency_due_notice tests.test_install_claude_profile tests.test_new_wsl_client_config tests.test_observability_tool_names tests.test_observability_writer_identity tests.test_render_config tests.test_secret_path_guard tests.test_skills_manifest tests.test_token_lanes_session_start tests.test_upstream_surface_watch tests.test_windows_terminal_defaults tests.test_adoption_status tests.test_credential_status tests.test_adoption_docs_consistency
Ran 1016 tests; FAILED (failures=2, skipped=16)
  K4GuardTests.test_k4_hook_process_and_hints failed its 3-second timing assertion under load; it starts the guard with
  sys.executable, not a settings command, and passed 3 of 3 alone and in the full tests.test_secret_path_guard rerun (90 tests OK)
  the one failure is the pre-existing F10, OverlayTests.test_the_installed_client_knows_no_notification_type_without_a_decision
  (plugin_notification on the installed 2.1.295); it fails the same way on clean main and is owned by the currency floor PR #922
$ python3 -E -s -B -m unittest tests.test_new_wsl_definitive_defaults tests.test_new_wsl_profile tests.test_new_wsl_handbook tests.test_new_wsl_gateway_composition tests.test_new_wsl_mcp_conformance_lifecycle tests.test_adoption_docs_consistency tests.test_adoption_contract
Ran 314 tests; OK (skipped=4)
$ python3 -E -s -B tools/adoption/new_wsl_client_config.py --check
check passed (two pre-existing mcp-inspector warnings)
$ python3 -E -s -B scripts/validate.py
{"components": 70, "hashed_files": 10939, "profiles": 4, "receipts": 239, "status": "passed"}
$ python3 -E -s -B scripts/evidence_manifest.py --check
{"files": 10939, "status": "passed"}
$ python3 -E -s -B scripts/validate_convergence.py --all-recorded --root . --json
valid: true
$ python3 -E -s -B scripts/component_matrix.py --write && python3 -E -s -B scripts/new_host_grand_list.py --write
written; no diff in the generated reports
```

### Decision record

`docs/decisions/2026-10-08-guard-hook-fails-closed.md`, new addendum "the guard runs the system interpreter": the measurement, the allowlist scope, the project hook and the limits. A host without `/usr/bin/python3`, or a missing script with no `jq` on `PATH`, exits 127, which `onFailure: "block"` turns into a block from 2.1.295 (the floor raise is the currency lane's change). After this lands, the command center aligns the host's user settings to the rendered form; until then the host keeps its own pinned form.

### Host evidence

Not applicable: no file under `evidence/hosts/` changes.

### Checklist

- [x] New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). (none changed)
- [x] New/changed workflows declare top-level `permissions: {}` and grant each job only what it needs. (none changed)
- [x] No secrets are printed, logged or committed; no new required secret was added without a documented owner.
- [x] No new paid hosting, subscription or billing surface was introduced.
- [x] Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Apply the three scoped corrections from the CC PASS_WITH_P3 micro on
25af188, plus its five cheap folds, in ONE
commit with no rebase or source-branch merge.

Must-fix items under docs/decisions/:
- 2026-09-27-omniroute-account-pool.md:302 records only that the owner
  overrode both settings recommendations; the record's risk remains at :290.
- 2026-09-30-omniroute-rebuild.md:285-286 separates the relayed owner quality
  condition from the record's own saving/regression/exact-tool-text requirement.
- 2026-09-25-skills-trial-and-usage.md:863 restores the evidence/research
  delegation and grant to complete the work on the coordinator's end, with
  full access; no new peer-convergence attribution.

Cheap folds from the same micro:
- 2026-09-28-ecosystem-roadmap.md:311 removes duplicated recorded wording.
- 2026-09-28-top-rule-templates.md:5 preserves the operator's own file and
  edited 2026-09-28 07:34Z, with loading versus behavior evidence unchanged.
- 2026-09-29-key-management.md:41 restores the owner-statements basis for
  the every-key rule, rather than attributing it to a design-brief reading.
- 2026-09-27-omniroute-account-pool.md:304 preserves the gateway route
  without introducing native-Codex wording.
- 2026-09-25-top-rule-sota-sources.md:22-25 restores the exact historical
  instruction block from22e3ef6ffd53b09f3cb335c46f7c696093521274. The direct
  owner speech at :18-20 remains paraphrased; frozen audit inputs are untouched.

All seven physical line counts and source locators are preserved. Native
register_file updates only their seven existing sha256/bytes rows. The
original P1 commit-pinned anchors, protected model-currency sections, source
gaps and owner-gate repairs remain intact. No test or F10 implementation
change: the CC assigns plugin_notification clearance to the later landing
rebase onto main containing #922.

FULL precommit validate returned0 at2026-10-09T18:20:57Z:10949 hashed files,
70 components,4 profiles,239 receipts, under a capped native systemd scope.
This is source integrity, not a newly executed merged-suite or CC micro.

Generated by OpenAI Codex; reasoning effort max.

Apply the three scoped corrections from the CC PASS_WITH_P3 micro on
25af188, plus its five cheap folds, in ONE
commit with no rebase or source-branch merge.

Must-fix items under docs/decisions/:
- 2026-09-27-omniroute-account-pool.md:302 records only that the owner
  overrode both settings recommendations; the record's risk remains at :290.
- 2026-09-30-omniroute-rebuild.md:285-286 separates the relayed owner quality
  condition from the record's own saving/regression/exact-tool-text requirement.
- 2026-09-25-skills-trial-and-usage.md:863 restores the evidence/research
  delegation and grant to complete the work on the coordinator's end, with
  full access; no new peer-convergence attribution.

Cheap folds from the same micro:
- 2026-09-28-ecosystem-roadmap.md:311 removes duplicated recorded wording.
- 2026-09-28-top-rule-templates.md:5 preserves the operator's own file and
  edited 2026-09-28 07:34Z, with loading versus behavior evidence unchanged.
- 2026-09-29-key-management.md:41 restores the owner-statements basis for
  the every-key rule, rather than attributing it to a design-brief reading.
- 2026-09-27-omniroute-account-pool.md:304 preserves the gateway route
  without introducing native-Codex wording.
- 2026-09-25-top-rule-sota-sources.md:22-25 restores the exact historical
  instruction block from22e3ef6ffd53b09f3cb335c46f7c696093521274. The direct
  owner speech at :18-20 remains paraphrased; frozen audit inputs are untouched.

All seven physical line counts and source locators are preserved. Native
register_file updates only their seven existing sha256/bytes rows. The
original P1 commit-pinned anchors, protected model-currency sections, source
gaps and owner-gate repairs remain intact. No test or F10 implementation
change: the CC assigns plugin_notification clearance to the later landing
rebase onto main containing #922.

FULL precommit validate returned0 at2026-10-09T18:20:57Z:10949 hashed files,
70 components,4 profiles,239 receipts, under a capped native systemd scope.
This is source integrity, not a newly executed merged-suite or CC micro.

Generated by OpenAI Codex; reasoning effort max.

Apply the three scoped corrections from the CC PASS_WITH_P3 micro on
25af188, plus its five cheap folds, in ONE
commit with no rebase or source-branch merge.

Must-fix items under docs/decisions/:
- 2026-09-27-omniroute-account-pool.md:302 records only that the owner
  overrode both settings recommendations; the record's risk remains at :290.
- 2026-09-30-omniroute-rebuild.md:285-286 separates the relayed owner quality
  condition from the record's own saving/regression/exact-tool-text requirement.
- 2026-09-25-skills-trial-and-usage.md:863 restores the evidence/research
  delegation and grant to complete the work on the coordinator's end, with
  full access; no new peer-convergence attribution.

Cheap folds from the same micro:
- 2026-09-28-ecosystem-roadmap.md:311 removes duplicated recorded wording.
- 2026-09-28-top-rule-templates.md:5 preserves the operator's own file and
  edited 2026-09-28 07:34Z, with loading versus behavior evidence unchanged.
- 2026-09-29-key-management.md:41 restores the owner-statements basis for
  the every-key rule, rather than attributing it to a design-brief reading.
- 2026-09-27-omniroute-account-pool.md:304 preserves the gateway route
  without introducing native-Codex wording.
- 2026-09-25-top-rule-sota-sources.md:22-25 restores the exact historical
  instruction block from22e3ef6ffd53b09f3cb335c46f7c696093521274. The direct
  owner speech at :18-20 remains paraphrased; frozen audit inputs are untouched.

All seven physical line counts and source locators are preserved. Native
register_file updates only their seven existing sha256/bytes rows. The
original P1 commit-pinned anchors, protected model-currency sections, source
gaps and owner-gate repairs remain intact. No test or F10 implementation
change: the CC assigns plugin_notification clearance to the later landing
rebase onto main containing #922.

FULL precommit validate returned0 at2026-10-09T18:20:57Z:10949 hashed files,
70 components,4 profiles,239 receipts, under a capped native systemd scope.
This is source integrity, not a newly executed merged-suite or CC micro.

Generated by OpenAI Codex; reasoning effort max.

* Ground G6c-A decision records in primary sources

* docs: resolve G6c-A dated-record review findings

* Restore decision authority and historical source meaning in #885

Restore who decided, their scope and reasons, open owner gates, and recorded
source gaps as paraphrase. Keep upstream loading/configuration mechanisms
distinct from local decision authority; introduce no owner quotation.

CC verdict: pr885-claude-read-8eb4b532.md
SHA256 a1a626db8739b50ea5ec48b1436f571bb7d9ba44d138e95fb0b4a3f8901779c8.

P1: docs/decisions/2026-10-03-sweep-gpt6-route-settlement.md:9,19,20,23,27,31,127,132
pins 46 historical source locators and three links to the immutable
22e3ef6 revision, preserving Gate B's basis.

P2-2: 2026-09-25-top-rule-sota-sources.md:3-5,18-25 restores the decided
all-action stop-and-report rule and original task-record provenance.
P2-3: 2026-09-28-ecosystem-roadmap.md:106,305 removes the false Gate A
custody correction; :311,344 restores the criterion authority and citations.
P2-4: 2026-09-25-skills-trial-and-usage.md:1214-1223 restores the M4
readers, non-independence qualification and L16 conflict; removes invented receipts.
P2-5: 2026-09-25-skills-trial-and-usage.md:1510,1644-1645 preserves the
owner's choice under condition 6, consistent with :1160.
P2-6: restore owner gates, recorded reasons and decision authority at
2026-09-27-model-currency.md:62,65;
2026-09-30-skills-llm-native-listing.md:240-241;
2026-09-30-omniroute-rebuild.md:284-286;
2026-10-01-definitive-sota-wsl-program.md:128-130;
2026-09-29-max-default-effort.md:11-12;
2026-09-23-max-effort-default.md:289;
2026-09-29-key-management.md:47-51;
2026-09-28-terminal-experience.md:557;
2026-09-27-omniroute-account-pool.md:301-302;
2026-09-28-delegated-decisions.md:44;
2026-09-29-retire-polaris.md:3.
P2-7: 2026-09-30-rule-text-every-layer.md:32-33,178 restores the explicit
north-star-action source gap and the authority/reason for the budget exception.
P2-8: retain requests and unproved work as open at
2026-10-01-definitive-sota-wsl-program.md:11,25;
2026-09-28-top-rule-templates.md:5;
2026-10-01-new-wsl-architecture-edition.md:109-111.

Related P3 repairs retain authority and qualifiers across all 29 original
records; restore agent-ecosystem#28 at mac-single-writer-staged.md:12,
PR#528 at sol-primary-quality-defaults.md:89-90, PREREGISTRATION L9 at
ecosystem-roadmap.md:344, coordination citations at skills-trial-and-usage.md:1214-1218,
Decision point 9 at skills-llm-native-listing.md:36, Gate A re-aim at
definitive-sota-wsl-program.md:352, and source bases at
claude-harness-settings.md:145 and model-currency.md:62.

All 30 record line counts stay unchanged. The complete protected October 4
model-currency ending and both October 9 sections remain byte-identical.
Native register_file updates only these 30 rows' sha256/bytes fields,
preserving registry membership, order and all other keys.

Precommit FULL scripts/validate.py: rc 0, 10949 hashed files, 70 components,
4 profiles and 239 receipts, 2026-10-09T17:14:04Z. Genuine merged-tree suite
and CC/GPT micros remain required before push/cue; no rebase is performed.

Generated by OpenAI Codex; reasoning effort max.

* Clarify the remaining #885 attribution boundaries from the CC micro

Apply the three scoped corrections from the CC PASS_WITH_P3 micro on
25af188, plus its five cheap folds, in ONE
commit with no rebase or source-branch merge.

Must-fix items under docs/decisions/:
- 2026-09-27-omniroute-account-pool.md:302 records only that the owner
  overrode both settings recommendations; the record's risk remains at :290.
- 2026-09-30-omniroute-rebuild.md:285-286 separates the relayed owner quality
  condition from the record's own saving/regression/exact-tool-text requirement.
- 2026-09-25-skills-trial-and-usage.md:863 restores the evidence/research
  delegation and grant to complete the work on the coordinator's end, with
  full access; no new peer-convergence attribution.

Cheap folds from the same micro:
- 2026-09-28-ecosystem-roadmap.md:311 removes duplicated recorded wording.
- 2026-09-28-top-rule-templates.md:5 preserves the operator's own file and
  edited 2026-09-28 07:34Z, with loading versus behavior evidence unchanged.
- 2026-09-29-key-management.md:41 restores the owner-statements basis for
  the every-key rule, rather than attributing it to a design-brief reading.
- 2026-09-27-omniroute-account-pool.md:304 preserves the gateway route
  without introducing native-Codex wording.
- 2026-09-25-top-rule-sota-sources.md:22-25 restores the exact historical
  instruction block from22e3ef6ffd53b09f3cb335c46f7c696093521274. The direct
  owner speech at :18-20 remains paraphrased; frozen audit inputs are untouched.

All seven physical line counts and source locators are preserved. Native
register_file updates only their seven existing sha256/bytes rows. The
original P1 commit-pinned anchors, protected model-currency sections, source
gaps and owner-gate repairs remain intact. No test or F10 implementation
change: the CC assigns plugin_notification clearance to the later landing
rebase onto main containing #922.

FULL precommit validate returned0 at2026-10-09T18:20:57Z:10949 hashed files,
70 components,4 profiles,239 receipts, under a capped native systemd scope.
This is source integrity, not a newly executed merged-suite or CC micro.

Generated by OpenAI Codex; reasoning effort max.

* Clarify delegated item authority and adjacent provenance in #885

* Restore the September 30 effort amendment terms in #885

---------

Co-authored-by: seathatflowsinourveins <[email protected]>