Update the new-WSL Harbor profile to 0.24.0 - #927

Scope

Update the new-WSL Harbor recommendation to 0.24.0 across the direct CLI owner and Inspect Scout ATIF companion. Profile, plan, executable mirrors, source records, generated projections and handbook agree. Preserve the historical 0.23.0 owner selection separately from the dated current maintenance amendment. Operational guidance binds the current source receipt and the complete inverse.

Historical regression inputs are retained as byte fixtures with explicit PR #927 pre-squash capture provenance, independent of the old branch commit's continued availability. Length, SHA-256 and Git blob ID checks precede expected content rejection, whose message is specific to the intended guard. A repository revision declared by a fixture manifest must be main-reachable when history is available. The check resolves the exact remote-main commit before testing ancestry, so a local branch named origin/main cannot shadow it. A native synthetic-repository regression exercises accepted-main, rejected-branch and unknown-object outcomes under that shadow.

• Base commit: 86bb669ad6c81b9adafdb222d545a1bf2aa95218, including Raise jCodeMunch file cap to 8000 with measured consolidation headroom #962's raised file cap.
• Publication sequence: rebase the original reviewed head onto the cap-containing current main, then one forward test/citation commit. The initially prepared c8a29c3 attempt was unpushed and explicitly discarded under the retarget cue; final acceptance was rerun on the replacement target.
• Published candidate head: 8bc2b65c1c8854fd9619cf501063596799067c5b, with the single optional P3 commit directly on rebased reviewed head 0e1e0c113aadb0365183bbff5ce4174a825cdc2c.
• Lane: lane:foundation.
• Owned paths: Harbor profile/owner/plan inputs and mirrors, source records, generated defaults/handbook, telemetry references, source/content contracts and retained fixtures, OSV fixture inventory and evidence bindings.
• Native regeneration resolves only the conflicting handbook receipt and evidence registry. All other reviewed tree content matches the native merged reference, apart from the optional synthetic ancestry test/resolved-SHA change and exact blob-header citation. Existing historical receipt rows from main and the reviewed branch are preserved.

SOTA sources

• harbor-framework/harbor v0.24.0, upstream peeled commit b53b8134e1241686dca7759af188f987ecc48e8b, and versioned PyPI metadata. The dated Harbor receipt retains primary release/tag/wheel/source evidence. Installation and vendor runtime acceptance remain unrun.
• CPython v3.13.16: unittest exception assertions and hashlib. Inputs are retrieved/validated outside the expected content-rejection context; assertRaisesRegex binds the guard message.
• Git v2.53.0: revision-name precedence, merge-base ancestry, Git object header, hash-object and show. The ancestry check passes the resolved remote SHA; the object-details reference documents the blob <length>\0 header used for retained byte integrity.
• Native synthetic-repository reference: #952 ancestry control on main. The added test follows its Git commit-tree/update-ref approach while using isolated fixture configuration and a shadowing local branch.
• Historical fixture manifest: archived pre-squash capture metadata and retained byte artifacts, not a durable pin to the old PR branch.
• Main-pinned handbook builder, evidence registration and sorted manifest normalization supply regenerated bindings. No current hash is hand-merged.

Evidence-class table

Local commands run

git rebase 86bb669ad6c81b9adafdb222d545a1bf2aa95218
Retargeted publication rebase of the original reviewed head; native continuations resolve only the two known generated hash carriers
python3 -B scripts/build_new_wsl_handbook.py --write
exit 0; receipt/current hashes derived through native render/digest
python3 -B scripts/evidence_manifest.py --write
exit 0; affected bindings supplied through native register_file
python3 -B -m unittest tests.test_harbor_currency_contracts.HarborPredecessorEvidenceTests.test_repository_revision_uses_remote_main_despite_a_shadowing_local_branch
Before resolved-SHA fix: exit 1, one test/one failed subcase
python3 -B -m unittest tests.test_harbor_currency_contracts
After fix and at clean final head: exit 0, 14 tests, no skips
python3 -B -m unittest tests.test_harbor_currency_contracts tests.test_new_wsl_definitive_defaults tests.test_new_wsl_handbook tests.test_adoption_docs_consistency tests.test_evidence_manifest tests.test_osv_lockfile_coverage tests.test_release_pin_contents
exit 0, 361 tests, four existing skips
python3 -B scripts/validate.py
Actual-target FULL final candidate and clean committed head: each exit 0
gitleaks git --redact=100 --log-opts='86bb669ad6c81b9adafdb222d545a1bf2aa95218..HEAD'
PR range only, 100% redaction, exit 0/no leaks
git diff --cached --check
exit 0

The original Git-free fixture route remains and performs no old-commit lookup. The new synthetic control exercises the repository-pin ancestry branch independently of the pre-squash manifest's early return. The earlier whole-unittest-shard qualification remains recorded; this module evidence does not relabel it as a broad pass. An initial 60-second context executor timeout produced no suite verdict; the native shell run completed the whole 361-test affected suite in 140 seconds. Fresh required hosted CI applies after the landing rebase, not the earlier conflicting-head rollup.

Decision record

Harbor profile decision and complete inverse. The fixture manifest records archival capture provenance and version-specific Git/unittest contracts. Private landing receipts retain the original baseline, native whole-tree same-change comparison, regression and complete FULL validation logs.

Host evidence

No host receipt or platform-status change. Tests and native Git commands establish repository contract/integrity evidence. No provider, agent, broker, gateway or Harbor/Scout runtime operation was performed.

Checklist

• One retained publication rebase after explicitly discarding the unpushed superseded target; current generated hash carriers regenerated through native tooling.
• Reviewed content preserved with only explained optional P3 test/citation changes.
• The main-shadow regression failed before the fix and the complete contract module passes.
• All touched/source/inventory modules and FULL candidate validation pass.
• Peer/protected lanes and historical records preserved.
• Fresh hosted CI, co-op per-file same-change check, micros and CC landing after Raise jCodeMunch file cap to 8000 with measured consolidation headroom #962/Retain Claude federation diagnostics and pinned vendor documentation #961.