Scan large CI secret targets with an explicit explorer exclusion - #964

The three removed workflows were in the local-pages repository grants. At the
landing base, main eb31d23 (93 grants after #964), the test's own derivation
(grants.inventory_paths over git ls-files) gives 90 for this branch, equal to
the policy's repository grants, and the test pins 90. At the earlier base
9d4c00c the same derivation gave 89.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Generate the per-layer final-stack manifest with is_definitive and run_pin (W4 PR 2)

scripts/final_stack.py joins the landscape verdict rows, the planned layers,
the committed component evidence matrix, the completed saturation-ledger sweeps
and report, research state, the verdict-wave registry, the newest seeds file and
the run-pin sources (the trading uv.lock, the adoption pin files,
manifests/stack.json and runtime-target.json#/engine) into
catalogs/landscape/final-stack.json: deterministic, no clock, every read inside
the repository root. Status is the first match of unswept, no-winner, reopened,
converged, current; v1 is 30 reopened, 2 no-winner, 2 unswept, 0 current,
0 converged. Free-text pins parse only in four exact forms and are otherwise
flagged unpinned or unparsed. --check fails on byte drift, a changed source
hash, a layer without exactly one landscape, research-state or matrix row, a
planned-layer collision, an inconsistent index or private content; run-pin and
drift flags and --today next_review flags exit 0 in v1.

catalogs/landscape/planned-layers.json adds catalysts-sentiment and
judgment-features from the approved north-star plan's ten-layer table. CI runs
the check and a report-only freshness step after the new-host grand list; the
adoption-bootstrap path filters list the script. The two new landscape JSON
files are granted as Architecture supplements and the script as an inventory
grant (count 93 -> 94, as #964 did), so the Architecture refresh keeps reading
every landscape file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(catalog): close final-stack review boundaries

Fold both review families with failing-first privacy and reuse checks, ranked run precedence, exact uv root selection, explicit query and report semantics, and derived Architecture exclusions. Preserve pure data construction and reuse shared native publication mechanisms.

* fix(catalog): scan publication with native decoder rules

Fold CC, Astra and Codex micro findings with failing-first native account and email plants, deterministic check mode, preserved publication failure state, covered planned layers and corrected dependent citations. Retain pinned captures and adjacent caller evidence for review.

* fix(final-stack): retain complete publication tokens and source bindings

* fix(final-stack): scan publication entries through native stdin

* fix(final-stack): bound native scans to publication records and retain source pins

* fix(final-stack): retain classified temp reads and accurate publication claims

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>