Claude Code native practice, 2026-10: one evidenced default per role slot - #923

### Scope

- What this PR changes, in one or two sentences: the Claude settings template and the repository's project settings now start the secret-path guard with `/usr/bin/python3` instead of the first `python3` on `PATH`, so a broken or inactive interpreter shim can no longer make every guarded Bash call exit 1; the new-WSL renderer admits that one absolute path as a practice-hook command word, with tests that it still refuses every other interpreter path.
- Base commit: `22e3ef6ffd53b09f3cb335c46f7c696093521274` (main after #920)
- Lane: `lane:foundation`
- Owned paths touched: `adoption/templates/claude.settings.template.json` (one command), `.claude/settings.json` (the project guard command, folded in at the command center's request), `tools/adoption/new_wsl_client_config.py` (`BASE_COMMAND_WORDS` and its comment), `tests/test_install_claude_profile.py`, `tests/test_new_wsl_client_config.py`, `docs/decisions/2026-10-08-guard-hook-fails-closed.md` (append-only addendum), `manifests/evidence.json` (re-registration).

Successor to #920, scoped by the command center on 2026-10-09: the interpreter pin, the allowlist entry for that one path, the jq refusal and missing-script exit 2 kept, and a test with no mise shim on `PATH`.

### SOTA sources

- Claude Code hooks: exit code 2 blocks a PreToolUse call and other non-zero codes are non-blocking (https://code.claude.com/docs/en/hooks, read 2026-10-09); `onFailure: "block"` added in 2.1.295 (`anthropics/claude-code@602df92bf481ed904533e95c09f740f40aab5aed` CHANGELOG.md line 5: "a hook that can't start, times out, or exits with an unexpected code blocks the action instead of letting it through").
- POSIX Shell Command Language, 2.8.2 Exit Status for Commands: a command that is not found exits 127 (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/V3_chap02.html).
- jq 1.7 manual, `halt_error(exit_code)` (https://jqlang.org/manual/v1.7/), unchanged from #920.
- Python `ast.parse(..., feature_version=...)` (https://docs.python.org/3/library/ast.html#ast.parse), used to check the guard parses as 3.9 through 3.14.
- `docs/decisions/2026-10-08-guard-hook-fails-closed.md` and the Claude Code native practice record of 2026-10-09 (#923, slot `hooks`).

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Unpinned, a failing `python3` first on `PATH` makes the guard return 1 for a credential-file read and for `git status`; pinned, 2 and 0 | `local_integration` | rendered template + installed guard in a temporary home, `PATH` = a directory holding only `jq` and a failing `python3` stub |
| The rendered hook blocks before and after install with no working `python3` on `PATH` | `local_integration` | new `test_rendered_hook_runs_the_system_interpreter_without_a_working_python3_on_path`; fails when the template is unpinned |
| The renderer admits `/usr/bin/python3` and refuses `/usr/local/bin/python3`, `/usr/bin/python3.14`, `/usr/bin/python`, `/bin/python3`, `/tmp/python3`, `./python3`, `/usr/bin//python3`, `/usr/bin/../bin/python3`, `/usr/bin/env` | `local_integration` | new `test_a_practice_hook_may_name_only_the_pinned_system_interpreter_by_absolute_path`; fails when the allowlist entry is removed, and `--check` on the shipped template then reports the guard |
| The project hook in `.claude/settings.json` takes the same form: a checkout without the script gives 2 and the refusal; the repository's guard gives 2 for a credential-file read and 0 for `git status`, behind the same failing-`python3` `PATH` | `local_integration` | new `test_project_hook_runs_the_system_interpreter_and_refuses_a_missing_script`; fails when the hook is unpinned and when its refusal is removed |
| The guard uses the standard library only and parses as Python 3.9 to 3.14 | `source_review` | imports at `scripts/hooks/secret_path_guard.py:108-115`; `ast.parse` with `feature_version` 3.9 through 3.14, run by `/usr/bin/python3` 3.14.4; the suite ran under 3.13.16 |

### Local commands run

```
$ python3 -E -s -B -m unittest tests.test_apply_claude_settings tests.test_currency_due_notice tests.test_install_claude_profile tests.test_new_wsl_client_config tests.test_observability_tool_names tests.test_observability_writer_identity tests.test_render_config tests.test_secret_path_guard tests.test_skills_manifest tests.test_token_lanes_session_start tests.test_upstream_surface_watch tests.test_windows_terminal_defaults tests.test_adoption_status tests.test_credential_status tests.test_adoption_docs_consistency
Ran 1016 tests; FAILED (failures=2, skipped=16)
  K4GuardTests.test_k4_hook_process_and_hints failed its 3-second timing assertion under load; it starts the guard with
  sys.executable, not a settings command, and passed 3 of 3 alone and in the full tests.test_secret_path_guard rerun (90 tests OK)
  the one failure is the pre-existing F10, OverlayTests.test_the_installed_client_knows_no_notification_type_without_a_decision
  (plugin_notification on the installed 2.1.295); it fails the same way on clean main and is owned by the currency floor PR #922
$ python3 -E -s -B -m unittest tests.test_new_wsl_definitive_defaults tests.test_new_wsl_profile tests.test_new_wsl_handbook tests.test_new_wsl_gateway_composition tests.test_new_wsl_mcp_conformance_lifecycle tests.test_adoption_docs_consistency tests.test_adoption_contract
Ran 314 tests; OK (skipped=4)
$ python3 -E -s -B tools/adoption/new_wsl_client_config.py --check
check passed (two pre-existing mcp-inspector warnings)
$ python3 -E -s -B scripts/validate.py
{"components": 70, "hashed_files": 10939, "profiles": 4, "receipts": 239, "status": "passed"}
$ python3 -E -s -B scripts/evidence_manifest.py --check
{"files": 10939, "status": "passed"}
$ python3 -E -s -B scripts/validate_convergence.py --all-recorded --root . --json
valid: true
$ python3 -E -s -B scripts/component_matrix.py --write && python3 -E -s -B scripts/new_host_grand_list.py --write
written; no diff in the generated reports
```

### Decision record

`docs/decisions/2026-10-08-guard-hook-fails-closed.md`, new addendum "the guard runs the system interpreter": the measurement, the allowlist scope, the project hook and the limits. A host without `/usr/bin/python3`, or a missing script with no `jq` on `PATH`, exits 127, which `onFailure: "block"` turns into a block from 2.1.295 (the floor raise is the currency lane's change). After this lands, the command center aligns the host's user settings to the rendered form; until then the host keeps its own pinned form.

### Host evidence

Not applicable: no file under `evidence/hosts/` changes.

### Checklist

- [x] New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). (none changed)
- [x] New/changed workflows declare top-level `permissions: {}` and grant each job only what it needs. (none changed)
- [x] No secrets are printed, logged or committed; no new required secret was added without a documented owner.
- [x] No new paid hosting, subscription or billing surface was introduced.
- [x] Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

The addendum and slots.json state counts from the 31-source reading (248
practices, 195 kept, 56 agree, 127 extend, 3 contradict, 9 not covered; 186
mapped to 24 slots and 9 to none; 19 measured; 124 for both clients). A
published figure should come from the published events by code that runs
every time, as the first read of #923 found for a different rate. The new
test recounts each figure from primary-source-reading.json, compares each
slot's total and listed sources with the reading, and asserts the addendum's
sentence built from the recounted values. It fails on four mutations (a
changed addendum figure, a by_slot_kept count off by one, a differing sha256,
the old wording).

The addendum said "9 match no slot" for the practices the defaults do not
cover; the nine with no slot are a different set (5 extend, 4 not covered).
The sentence now says 9 are not covered by any default, and that 186 map to a
role slot and 9 to none.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… label the baseline exports

The co-op's Astra read of this PR at 7d634e5 found two gaps (P2-1, P2-2).

P2-1: test_primary_source_reading_counts compared the reading's own prose with itself, so changing the addendum's "reader at
xhigh" or "refuter at max" to "low" left every test green (reproduced at 7d634e5: 14 of 14 mutations of the addendum,
template, manifest, reading locators and slots.json pass). The reading now records the models and efforts the run's children
were measured at (usage.by_phase: 31 Read children at xhigh, 31 Refute children at max, all claude-opus-5-5), copied from
child-usage.mjs's output for wf_bee0b670-035 with the tool's commit, sha256, command and exit code; the exit 1 under
--require-effort max lists exactly the 31 readers, which run at xhigh by design. The test derives "an Opus 5.5 reader at
xhigh" and "an Opus 5.5 refuter at max" from that record, compares the addendum and the reading's run text with it, and
carries mutations of each setting, of the model and of a second statement. The same file's retention paragraph now has a
test that the addendum's 180 is the settings template's value; the 13:50:06Z deletion time is left unchecked because the
deletion receipt has no time field to recount it from.

P2-2: the slot manifest is the W2 data file built on 2026-10-09 from reference/slots.json as merged in #923 (a30c218,
sha256 a7d87f9a...), before this PR extended it; the reading's relations are relative to those rows, and its page:line
locators were read from a checkout whose reference pages are byte-identical to that revision's. The manifest now carries a
snapshot block (kind baseline, revision, the baseline hash, the current decision source and the six fields in which it now
differs), and the reading a local_references block binding its locators to the same revision, with the recorded model
output untouched. tests/test_native_practice_snapshot_provenance.py checks the label, that each listed difference holds, that
no other exported field differs while slots.json has the labeled bytes, and, where the history holds the revision, that the
manifest rows are the baseline's and that the six locators that quote a phrase find it at their cited line at that revision
(they do for 6 of 6 there and for 2 of 6 at this PR's head). The decision record gains one paragraph saying what the exports
describe.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ss-client mapping (#958)

* Ground the practice in primary sources and one cross-client mapping

A 31-source reading (Anthropic engineering and Claude blog posts on code and
workflow quality, the Agent Skills specification, the Codex docs and
OpenAI's harness-engineering post), each practice read by an Opus reader and
refuted by default by an Opus max refuter, adds re-checkable primary sources
to 24 slots (fetch time and sha256 of the bytes read). The command center's
rulings land with it: one practice for Claude Code and Codex with native
execution per client (reference/cross-client.md), four default extensions,
three contradictions held as candidates, the model and effort routing with
its 2.1.295 keys, and cleanupPeriodDays 180 in the template. The agentsview
retention probe, the old-archive coverage check and deletion, and the M1
sandbox measurements are recorded as evidence.

Two doc fixes: the agentsview data directory (the unit serves the directory its
launcher sets; the bullet cites the upstream v0.44.0 source line and the host
launcher path) and the workflows README's adopt step (the installer's own
flags; the first step's directory resolves from the README). Each has a test
that fails on the pre-fix text (tests/test_native_practice_doc_corrections.py).
The README edit moves the line the surface-watch disposition row for
CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS cites, so that row follows it (1083 to
1089).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Recompute the reading's published counts in a test

The addendum and slots.json state counts from the 31-source reading (248
practices, 195 kept, 56 agree, 127 extend, 3 contradict, 9 not covered; 186
mapped to 24 slots and 9 to none; 19 measured; 124 for both clients). A
published figure should come from the published events by code that runs
every time, as the first read of #923 found for a different rate. The new
test recounts each figure from primary-source-reading.json, compares each
slot's total and listed sources with the reading, and asserts the addendum's
sentence built from the recounted values. It fails on four mutations (a
changed addendum figure, a by_slot_kept count off by one, a differing sha256,
the old wording).

The addendum said "9 match no slot" for the practices the defaults do not
cover; the nine with no slot are a different set (5 extend, 4 not covered).
The sentence now says 9 are not covered by any default, and that 186 map to a
role slot and 9 to none.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Recount the addendum's remaining published figures in the same test

The co-op's read of #958 asks that the recount catch any published figure it
does not recount. The addendum also states: the split of the 31 sources into
22 Anthropic posts and 9 cross-client sources, that all were readable, the run
id and the reader and refuter settings, the $63.87 spend, the 54% and 16%
figures of Anthropic's code-review post, the 2,501 archive sessions and the
1,784,512,512 deleted bytes with their 2026-10-23 leftovers date, and the 24
credential stores of the sandbox measurement. Each is now recounted from the
reading or the probe artifact and asserted in the addendum's own words (nine
tests now). Eleven mutations of the record or an artifact each fail the test.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Check the addendum's reader and refuter settings against the run, and label the baseline exports

The co-op's Astra read of this PR at 7d634e5 found two gaps (P2-1, P2-2).

P2-1: test_primary_source_reading_counts compared the reading's own prose with itself, so changing the addendum's "reader at
xhigh" or "refuter at max" to "low" left every test green (reproduced at 7d634e5: 14 of 14 mutations of the addendum,
template, manifest, reading locators and slots.json pass). The reading now records the models and efforts the run's children
were measured at (usage.by_phase: 31 Read children at xhigh, 31 Refute children at max, all claude-opus-5-5), copied from
child-usage.mjs's output for wf_bee0b670-035 with the tool's commit, sha256, command and exit code; the exit 1 under
--require-effort max lists exactly the 31 readers, which run at xhigh by design. The test derives "an Opus 5.5 reader at
xhigh" and "an Opus 5.5 refuter at max" from that record, compares the addendum and the reading's run text with it, and
carries mutations of each setting, of the model and of a second statement. The same file's retention paragraph now has a
test that the addendum's 180 is the settings template's value; the 13:50:06Z deletion time is left unchecked because the
deletion receipt has no time field to recount it from.

P2-2: the slot manifest is the W2 data file built on 2026-10-09 from reference/slots.json as merged in #923 (a30c218,
sha256 a7d87f9a...), before this PR extended it; the reading's relations are relative to those rows, and its page:line
locators were read from a checkout whose reference pages are byte-identical to that revision's. The manifest now carries a
snapshot block (kind baseline, revision, the baseline hash, the current decision source and the six fields in which it now
differs), and the reading a local_references block binding its locators to the same revision, with the recorded model
output untouched. tests/test_native_practice_snapshot_provenance.py checks the label, that each listed difference holds, that
no other exported field differs while slots.json has the labeled bytes, and, where the history holds the revision, that the
manifest rows are the baseline's and that the six locators that quote a phrase find it at their cited line at that revision
(they do for 6 of 6 there and for 2 of 6 at this PR's head). The decision record gains one paragraph saying what the exports
describe.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Count the run's advisor calls in the published spend, and recompute the spend in the test

The command center's read of this PR at 8ca5d82 (CHANGES_REQUESTED, one P2): the addendum's
"$63.87 at API list price" is the executors' tokens only. The run's children also called the
advisor tool, a claude-fable-5-1 advisor, and advisor calls bill at the advisor model's rates
outside the top-level usage (the advisor tool's "Usage and billing": "Top-level usage fields
reflect executor tokens only. Advisor tokens are not rolled into the top-level totals because
they are billed at a different rate"). Re-derived from the retained child-usage record and the
raw transcripts, not from the read: 63 advisor calls, 29 answered (8 by readers, 21 by
refuters, in 28 children; 1,499,557 input and 252,949 output tokens, no cache tokens) and 34
refused as too_many_requests, which carry no usage. At the pricing page's rates as read
2026-10-10 (Opus 5.5 $4 input, $5 5-minute cache write, $0.20 cache hit, $20 output; Fable 5.1
$10, $12.50, $0.25, $50 per million tokens) the executors cost $63.87 and the advisor $27.64:
the spend is $91.51, and the published figure was 30% low.

The reading now carries the advisor's tokens by model and its calls by phase, the executors'
cache creation split into its 5-minute and 1-hour tokens (all 5-minute, from each message's
own split), the rate table with the two pages' sha256 and read time, and the executor, advisor
and total spend; its run description and the addendum name the advisor and its calls, and the
addendum gives the total with both shares and says the first figure counted the executors only.

tests/test_primary_source_reading_counts.py recomputes the spend from the recorded tokens and
the recorded rates, holds the recorded rates to an independent literal of the pricing table,
checks that the addendum states the total with its two shares and that the run description and
the addendum name the advisor with calls that add up (by phase, answered, refused). Run against
the previous head's artifacts the four new tests error (the advisor fields are absent); twelve
mutations of the artifact or the addendum (the total set back to $63.87 or to the executors'
spend, the advisor's tokens removed or increased, a lower advisor rate, a changed executor
rate, an extra answered call, a changed child count, the advisor missing from the run
description or the addendum, a cache split that no longer adds up) each fail the test and the
unmutated files pass.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

…d raise the listing ceiling to 11,000 (#972)

The command center's ruling (option (a) of four, 2026-10-10): the repository's own
claude-native-practice skill (#923, #958) becomes a row of adoption/skills/manifest.json at #958's
landed commit, listed on for Claude Code and enabled in Codex, and the manifest's own ceiling on
the on-listed description sum moves from 10,500 to 11,000 characters. The sum goes from 10,374 to
10,723 (+349, 277 characters left), the Codex enabled and catalog sums from 10,055 to 10,404, and
the Codex catalog from 27 to 28 skills, 3,171 estimated tokens against the 6,000 setting. The row
costs about 90 tokens in every session whose listing includes it.

The row is computed from the landed commit's own bytes (tree, SKILL.md sha256 and size, description
length) and carries first_party: true, because a skill of this repository has no skills.sh page:
its audits.url says it is reviewed in the pull request that changes it. tests.test_skills_manifest
holds a first-party row to this repository as its source and to that form while every other row
keeps the skills.sh requirement.

Follows from the row: the Claude template's skillOverrides entry, the Codex template comment's count,
the runtime-worker exclusion (adoption_ref, with a reason and an overturn) and its README count, the
landscape catalog's source and its agent-docs task, and the dispositions row that cites a manifest
line. The decision record gives the listing check, the three declared test changes, the inverse and
the revisit (the ceiling comes back down when the wave's skills-slot verdicts land).

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

…ew (#1001)

* Retire the skill's Claude-in-GitHub rows and point them to local review

The claude-native-practice skill still selected the route that
docs/decisions/2026-10-10-retire-in-github-claude-review.md retired:
the github-action row (anthropics/claude-code-action at a pin) and the
Actions part of pr-review-pre-cue.

- slots.json, slots.md and the layer pages: `retired` joins the status
  vocabulary; github-action becomes retired with a dated block (record,
  correction #141, scope, the three workflows, the former default, route,
  alternatives, evidence and notes as a snapshot, the revisit triggers);
  pr-review-pre-cue becomes default (scoped) and lists the routes
  available now (local Claude reads, GPT reads, Codex's GitHub review,
  the required verdict-review-gate) apart from the open #953 worker.
- The scope is the owner's repositories (the command center's ruling of
  2026-10-10), not "this repository": a hermetic A/B showed a session in
  another repository concluding that the action was still fine there.
  The same ruling retires the managed Claude Code Review GitHub App.
- Stale texts the independent pre-read and the stricter check found: the
  release-tracking note (Dependabot as the action's tracker), the
  scheduled-tasks route (GitHub Actions schedules only for jobs that run
  no model) and its source mapping, the usage-cost-monitoring note
  (Actions under WIF), and the pre-cue source mapping (in Actions through
  #909). The pre-cue route no longer lists a read the record does not name.
- tests/test_native_practice_retired_routes.py: no current row selects a
  retired route; a retired route is named elsewhere only in a sentence or
  list item that says it is retired; every line of slots.json, slots.md,
  the layer pages and cross-client.md is read (duplicates kept, the source
  mappings of live slots included); only the dated snapshots are exempt.
  Positive controls are the rows as they stood; the mutation table is in
  the pull request description.
- The slot manifest of #923 is relabeled against the new slots.json
  bytes, so the exact-difference check of the provenance test runs again
  instead of skipping.
- docs/decisions/2026-10-09-claude-code-native-practice.md: a dated
  pointer to the retirement, as #981 did for the older records.

Source read for this change: anthropics/claude-code-action at
2dca132ff0e0c4094ce6048b422c6915a071210b, base-action/src/
parse-sdk-options.ts:283-284 (CLAUDE_CODE_ENTRYPOINT is set to
claude-code-github-action).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Close the holes in the retirement guard and qualify the one-default rule for retired slots

Answers the Codex review in GitHub of #1001 at ba6ab3a (four P2s) and the co-op's GPT first read at the same head (three P2s, the first three below); each was reproduced before the change.
- Sentence units split at a full stop or a semicolon whatever follows, and at a line break: "This route was retired; the current default is claude-code-action." was one unit that said retired.
- The generic phrases "in Actions", "through Actions" and "under WIF" count as the retired route only with Claude context, judged per leaf string; the named workflows, "through #909" and the managed app count
  everywhere. The routes the decision retains (every bullet of its "What remains" section, a catalog job in GitHub Actions, a non-model gate under WIF) are accepted.
- The skill's entry point SKILL.md is scanned, and a test requires every file of the skill folder to be read by a check.
- The one-default rule names the retired exception in slots.json, in the slots.md copy and in step 3 of SKILL.md (a retired row has none and says what replaced the route).
- The ruled default text is pinned exactly (the read's measured boundary: the date changed on all three surfaces passed), and a check compares every row's Overturn when across slots.json, the index and the
  layer pages (one step wider than the review of #1005, where an edit left the index cell behind).
Each finding fails its own test when its fix is undone alone, and 43 single-edit mutations are caught; the old guard accepts the four bad scenarios of the read and rejects its two legitimate ones.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Bind the manifest label to the shipped slots file and close the remaining holes of the retirement guard

Answers the CC's Claude first read of #1001 at 6e97620 (two P2s, six P3s) and Codex's second review in GitHub of the same head (two P2 threads); each was reproduced before the change.
- P2-1: the slot manifest was labeled against the slots.json of ba6ab3a, so the exact-difference check of the provenance test skipped at the head (OK, skipped=1). The label is the sha256 of the shipped file again,
  the check no longer skips, and a new test fails when a change to slots.json does not carry its label (the CC's ruling: a silent skip is this defect's class, so it fails loud).
- P2-2: a live source mapping (skills-library, primary_sources[5]) still ran `claude -p` "in a GitHub workflow ... plus a nightly cron"; the guard had no such form. It is reworded to say the run is retired,
  and "in a GitHub workflow" (also from, via, through, using, as) counts as the retired route when the sentence is about Claude.
- P3-1: the Claude Code GitHub Action, /install-github-app and an @claude mention are the retired route under other names (claude-code-security-review stays out: a documented rejection).
- P3-4: the Former default exemption of a layer page applies to a retired slot only.
- P3-5: a retired slot's own source mapping is read, and now says retired.
- P3-2: "e.g." and "i.e." no longer end a sentence, and wrapped lines of prose are one paragraph (the slots.md prose and SKILL.md were judged line by line).
- P3-6: the manifest prose lists the fields beyond the exported ones that differ from the snapshot.
- P3-7: the entry point directs ("a retired row has no default, so follow the replacement it names"), and the step-3 pin no longer fails with an IndexError on a renumbering.
Each correction fails its own test when it is undone alone, and the mutation table is extended.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Judge retired-route prose one physical line at a time and close the guard's other gaps

Answers the command center's Claude micro of #1001 at ef3f3e7 (P2-1, P3-1 to P3-5) and Codex's four threads of the same head (:43, :63, :122, :211). Each case was reproduced before the change:
compare-guards-ef3f3e7b-vs-third-commit.txt runs 19 scenarios through the guard of ef3f3e7 and this one; the old guard is wrong on 13 (it accepts a retired route that is reintroduced), this one on none.
- P2-1 (correction #160): joining wrapped lines into one paragraph let "Retired 2026-10-10" followed by a line that says the current default is claude-code-action pass on four prose surfaces (SKILL.md, slots.md,
  cross-client.md, layer-page preambles), the scenario Codex raised at ba6ab3a line 41. Prose is judged one physical line at a time again, a line break ends a unit, and the message of every line-judged surface
  states the rule (RULE; the legend of slots.md states it too and a test pins the two to each other).
- P3-1 and Codex :43: three more names of the same route, all in the vendor's own text: the page's title "Claude Code GitHub Actions" and its "installs the Claude GitHub App"
  (code.claude.com/docs/en/github-actions.md, capture sha256 87b99aef, lines 5, 9, 33, 63-64), the mirror claude-code-base-action (anthropics/claude-code-action@2dca132ff0e0:
  .github/scripts/check_workflow_hardening.py:18, .github/workflows/sync-base-action.yml:1 and 43, CLAUDE.md:20) and the carrier named first ("Use the GitHub Action for Claude reviews", generic
  like "in Actions": it counts when the field or unit is about Claude). The families "in Actions" and "through Actions" take on, with, inside and via.
- Codex :122 and the command center's P3-3 and P3-5: a unit that negates the retirement outright ("not retired", "never retired", "no longer retired", "isn't retired", "unretired") no longer counts as saying
  retired. The other half of that scenario, "was retired, but is now current", is the boundary the command center ruled (the guard is a tripwire for stale text; review reads what it accepts); the module names it.
- Codex :211 and P3-3: a layer-page section with a label twice (a second Route or Overturn when bullet) is a violation, because the page-to-slots.json comparison keeps the first bullet only.
- Codex :63 and P3-4: the target of every slots.md row is checked against <page>#<id>, from the layer of the slot.
- The description line of SKILL.md names the topic that invokes the skill; it is pinned by sha256 to the text the routing was measured with and read as a topic, not as a route.
- Scheduled-tasks (Codex on #1005, scheduling-supervision.md:9, and the command center's ruling): the route no longer bans every model-backed job. The retirement record
  (docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) retires Claude review inside GitHub and keeps Codex's GitHub review, so the route says GitHub Actions schedules repository jobs and a
  scheduled Claude task runs locally; a test pins the wording on slots.json, the layer page and the alternatives.
The label of claude-native-slot-manifest.json equals the sha256 of the shipped slots.json again (relabel last); test_the_label_names_the_shipped_slots_file and test_no_other_exported_field_differs
(no skip) are unchanged from ef3f3e7. 72 of 72 single-edit mutants of the guard and its data are caught and 5 controls pass (mutations-v4-forward-commit-3.md).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Align the manifest's scheduled-tasks note, state the rule in every explaining unit, split units after a closing delimiter and pin the scope of the name patterns

The final fix round of #1001 under the command center's convergence ruling: its Claude micro at efaa077 (blockers B1 to B3, P3-2) and its adjudication of 2026-10-11T13:50Z of Codex's third review. Each item was reproduced on that
head before the change.
- claude-native-slot-manifest.json:47 (Codex P2, B1, a text of this PR that is false at the head): the note on the differences from the snapshot still said the route of scheduled-tasks was narrowed "to jobs that run no model",
  while the shipped route says that GitHub Actions schedules repository jobs, that Claude runs inside GitHub are retired (2026-10-10, docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) and that a scheduled
  Claude task runs locally. The note says so now, and test_the_scheduled_tasks_route_retires_the_claude_routes_and_not_every_model_backed_job reads the manifest as well as the route (fails with the note undone: M79).
- B2: the module claims that the message of every line-judged surface states the rule, and it did not for the labelled bullets of a layer page or for the Overturn when cell of an index row. Every explaining unit states it now
  (a selecting field names no unit and states nothing); the three expected messages carry the rule and test_every_explaining_unit_of_a_layer_page_and_of_the_index_states_the_rule_and_a_selecting_field_does_not pins all three
  kinds (mutants M83 to M85).
- tests/test_native_practice_retired_routes.py:83 (Codex P2, P3-2): a closing quote, parenthesis or bracket between the full stop and the white space kept `The route was "retired." The current default is claude-code-action.` in one
  unit that said retired. The sentence pattern takes closing delimiters (the curly quotes are built with chr(), so the file stays ASCII); test_a_closing_quote_parenthesis_or_bracket_after_the_full_stop_does_not_join_two_claims fails
  without it (M78, M82) and keeps `claude-code-action was retired (see the record.) No row selects it.` accepted (control C6).
- :48 (Codex P2, workflow-first phrasing) is a follow-up and the class closes (rule 4 of the convergence ruling): the module states that the guard pins the named retired artifacts and the retired slot rows, that generic phrasing of a
  Claude run in a GitHub workflow cannot be enumerated and is out of its scope (the retirement record governs it), and test_generic_workflow_phrasing_is_out_of_scope_and_the_module_says_so pins the boundary. No pattern is added.
- B3 is the description: the two earlier command blocks name the 37 modules they ran (the 46 of the first block without the nine tests.test_local_pages_* modules).
80 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v6.py).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Close the sentence-splitter class by documentation, pin the module's ASCII and the scope list

The command center's confirmation micro of #1001 at bdf60fc (research-cc-role-20261008/pr1001-claude-micro-bdf60fc6.md: blockers 1 and 2, P3s) and its correction #163 of 2026-10-11T16:18Z on Codex's three threads of 15:39:21Z.
No code of the guard changes in this commit.
- Blocker 2: the module said that it stays ASCII and held one U+2026 in a comment (added by efaa077). It is three full stops now, and test_the_source_of_this_module_is_printable_ascii pins the claim; it fails on the module
  of bdf60fc (['U+2026'] != []).
- Blocker 1 (the pull request description, and this message corrects the message of bdf60fc): the earlier statement that the 37 modules ran "without its nine tests.test_local_pages_* modules" was false. They are the first 37
  modules of the 46-module list, and the nine left out are its last nine (tests.test_local_pages_fleet_execution to tests.test_local_pages_workstation, 144 tests, run and counted); 29 of the 46 are local-pages modules.
- Codex :92 (an exclamation mark or a question mark does not end a unit) is not patched: the sentence splitter has drawn findings in five consecutive rounds (the lowercase clause, "e.g.", the joined lines, the closers,
  the exclamation mark and the question mark) and was patched four times, so rule 4 of the convergence ruling closes the class the way line 48 closed. The module docstring states exactly what the guard accepts as a unit end
  and that review reads everything else; test_the_unit_ends_and_the_scope_of_the_name_patterns_are_documented pins the sentence and the behavior, and fails on the module of bdf60fc, where the sentence is missing.
  A pinned upstream sentence segmenter is a research-queue item (rule 8, layer instructions-skills).
- Codex :51 (a carrier-first name of the managed Code Review app) is confirmed within the closed class: the same scope paragraph says that reordered phrasings of a pinned artifact are out of the guard's scope.
- P3-1: the scope list named 11 of the 17 patterns; it names all 17 now, and test_the_scope_of_the_name_patterns_names_every_pattern compares the list itself with PATTERNS (it fails on the module of bdf60fc).
  P3-2: the right single quotation mark closer is tested (its mutant survived). P3-3: the comment at the sentence pattern says what the code does.
- Codex :170 (retired.on is checked for its shape only) is a follow-up under rule 5: the shipped value is the date of the record, so 2099-12-31 is a mutant and not a reproduced failure of the shipped state.
88 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v9.py).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

…ith tests

Unset workflow agents do not inherit the session model. The workflows page
(Cost section) and the sub-agents page (Choose a model), read 2026-10-11
against Claude Code 2.1.296, resolve a workflow agent's model as a model the
script names, then the definition, then CLAUDE_CODE_SUBAGENT_MODEL, then the
session model, and adoption/templates/claude.settings.template.json:27 sets
CLAUDE_CODE_SUBAGENT_MODEL to opus. The reason of the
CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL row and the record's workflow-agent bullet
now say so, and the dispositions catalog is re-registered in
manifests/evidence.json. Only that row's reason text changed in the catalog;
keys, dispositions, sources and versions are identical, and the watch's counts
do not read the reason.

The record said this repository's CLAUDE.md (8 lines) imports AGENTS.md (14
lines). AGENTS.md has 25 lines at 8c95a50 (#944 grew it before the rebase), and
a count of a file other PRs edit goes stale in a record that is kept, so the
record now states only the import. It also dated the first watch run "at the PR
base", which every rebase moves; the row now names the original base, a7bb4a5
(main after #941, committed 53 s before the run), as the PR's body recorded it.

Two tests in DispositionCitationTests guard these claims:
- test_unset_workflow_agents_are_not_said_to_inherit_the_session_model
- test_the_record_pins_no_instruction_file_line_count_and_no_relative_base
  (no line count after CLAUDE.md or AGENTS.md, no "the PR base", the run row
  names a commit, and CLAUDE.md still imports AGENTS.md through its @AGENTS.md
  line, which keeps the one relationship the record states true).
On the tree of 37b9008 plus the test file, the two fail five sub-assertions
(the row and the record say the agents inherit the session model, the row does
not name CLAUDE_CODE_SUBAGENT_MODEL, the record pins "(8 lines)", and the record
says "the PR base"); on this commit they pass. tests/test_upstream_surface_watch.py
is re-registered in manifests/evidence.json.

The record called #923 a draft; #923 landed in a30c218, its skill pins
client_version 2.1.295 (reference/slots.json:3), and "Cloud routines" is a
ranked alternative of the scheduled-tasks slot (reference/slots.json:1625). The
record now says so, re-dates its exact-case search of the skill's pages, and adds
the sub-agents and workflows pages read on 2026-10-11, with their body digests,
to its SOTA sources. Its scope sentences and its evidence counts (233 tests with
the two new ones) now name the regression tests.

Not run: a probe of workflow-agent model precedence; the corrected sentences
rest on the documentation, and the tests guard the committed text, not the client.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ith tests

Unset workflow agents do not inherit the session model. The workflows page
(Cost section) and the sub-agents page (Choose a model), read 2026-10-11
against Claude Code 2.1.296, resolve a workflow agent's model as a model the
script names, then the definition, then CLAUDE_CODE_SUBAGENT_MODEL, then the
session model, and adoption/templates/claude.settings.template.json:27 sets
CLAUDE_CODE_SUBAGENT_MODEL to opus. The reason of the
CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL row and the record's workflow-agent bullet
now say so, and the dispositions catalog is re-registered in
manifests/evidence.json. Only that row's reason text changed in the catalog;
keys, dispositions, sources and versions are identical, and the watch's counts
do not read the reason.

The record said this repository's CLAUDE.md (8 lines) imports AGENTS.md (14
lines). AGENTS.md has 25 lines at 8c95a50 (#944 grew it before the rebase), and
a count of a file other PRs edit goes stale in a record that is kept, so the
record now states only the import. It also dated the first watch run "at the PR
base", which every rebase moves; the row now names the original base, a7bb4a5
(main after #941, committed 53 s before the run), as the PR's body recorded it.

Two tests in DispositionCitationTests guard these claims:
- test_unset_workflow_agents_are_not_said_to_inherit_the_session_model
- test_the_record_pins_no_instruction_file_line_count_and_no_relative_base
  (no line count after CLAUDE.md or AGENTS.md, no "the PR base", the run row
  names a commit, and CLAUDE.md still imports AGENTS.md through its @AGENTS.md
  line, which keeps the one relationship the record states true).
On the tree of 37b9008 plus the test file, the two fail five sub-assertions
(the row and the record say the agents inherit the session model, the row does
not name CLAUDE_CODE_SUBAGENT_MODEL, the record pins "(8 lines)", and the record
says "the PR base"); on this commit they pass. tests/test_upstream_surface_watch.py
is re-registered in manifests/evidence.json.

The record called #923 a draft; #923 landed in a30c218, its skill pins
client_version 2.1.295 (reference/slots.json:3), and "Cloud routines" is a
ranked alternative of the scheduled-tasks slot (reference/slots.json:1625). The
record now says so, re-dates its exact-case search of the skill's pages, and adds
the sub-agents and workflows pages read on 2026-10-11, with their body digests,
to its SOTA sources. Its scope sentences and its evidence counts (233 tests with
the two new ones) now name the regression tests.

Not run: a probe of workflow-agent model precedence; the corrected sentences
rest on the documentation, and the tests guard the committed text, not the client.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… rust-v0.162.1 (#950)

* Resolve the upstream-surface backlog to Claude Code 2.1.296 and Codex rust-v0.162.1

Disposition the 49 open names plus two the docs do not list yet, re-review the
Claude memory and skills document rows, advance the baseline from 2.1.289 and
rust-v0.160.0, and record the gaps, the page-digest rows not added and the
hand-offs in one decision record. Data only: no code, instruction text,
setting, hook or unit changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Record the command center's rulings on the four open upstream-surface rows

Leave CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL unset (declined); decline
ultrafast_mode (plan-gated, dropped client-side by the OmniRoute profile);
keep the Codex cyber access programs as owner information only; decline the
model_providers capabilities rows until the currency lane's trial after #943.
Rows, decision record and the re-registered catalog hash change together.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Name an owner for each follow-up and hand-off in the gap-resolution record

The page-URL diffs go to the command center (through the daily watch service it
installs after #943), the changelog-name report to the currency lane, and the
settings-drift inventory to cc-native-practice. The weekly practice pass, the
TeammateIdle gate, the cost-data check and the WebSearch interaction now say who
acts or that nothing is scheduled.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Correct four claims in the gap-resolution record; guard two of them with tests

Unset workflow agents do not inherit the session model. The workflows page
(Cost section) and the sub-agents page (Choose a model), read 2026-10-11
against Claude Code 2.1.296, resolve a workflow agent's model as a model the
script names, then the definition, then CLAUDE_CODE_SUBAGENT_MODEL, then the
session model, and adoption/templates/claude.settings.template.json:27 sets
CLAUDE_CODE_SUBAGENT_MODEL to opus. The reason of the
CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL row and the record's workflow-agent bullet
now say so, and the dispositions catalog is re-registered in
manifests/evidence.json. Only that row's reason text changed in the catalog;
keys, dispositions, sources and versions are identical, and the watch's counts
do not read the reason.

The record said this repository's CLAUDE.md (8 lines) imports AGENTS.md (14
lines). AGENTS.md has 25 lines at 8c95a50 (#944 grew it before the rebase), and
a count of a file other PRs edit goes stale in a record that is kept, so the
record now states only the import. It also dated the first watch run "at the PR
base", which every rebase moves; the row now names the original base, a7bb4a5
(main after #941, committed 53 s before the run), as the PR's body recorded it.

Two tests in DispositionCitationTests guard these claims:
- test_unset_workflow_agents_are_not_said_to_inherit_the_session_model
- test_the_record_pins_no_instruction_file_line_count_and_no_relative_base
  (no line count after CLAUDE.md or AGENTS.md, no "the PR base", the run row
  names a commit, and CLAUDE.md still imports AGENTS.md through its @AGENTS.md
  line, which keeps the one relationship the record states true).
On the tree of 37b9008 plus the test file, the two fail five sub-assertions
(the row and the record say the agents inherit the session model, the row does
not name CLAUDE_CODE_SUBAGENT_MODEL, the record pins "(8 lines)", and the record
says "the PR base"); on this commit they pass. tests/test_upstream_surface_watch.py
is re-registered in manifests/evidence.json.

The record called #923 a draft; #923 landed in a30c218, its skill pins
client_version 2.1.295 (reference/slots.json:3), and "Cloud routines" is a
ranked alternative of the scheduled-tasks slot (reference/slots.json:1625). The
record now says so, re-dates its exact-case search of the skill's pages, and adds
the sub-agents and workflows pages read on 2026-10-11, with their body digests,
to its SOTA sources. Its scope sentences and its evidence counts (233 tests with
the two new ones) now name the regression tests.

Not run: a probe of workflow-agent model precedence; the corrected sentences
rest on the documentation, and the tests guard the committed text, not the client.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>