Bind the no-git archive check to the release; report new-machine content drift in release_due; run step 6 under Python 3.13 by seathatflowsinourveins · Pull Request #163 · native-agent-stack/native-agent-stack

seathatflowsinourveins · 2026-09-24T06:15:00Z

Two new-machine readiness gaps in v2026.09.23.1, found by the 2026-09-24 readiness sweep and reproduced here. The release owner plans to cut the next release from main once this merges.

1. The no-git archive check was not bound to the release

adoption/bootstrap.md step 0's archive path ran gh attestation verify with only --repo and --signer-workflow. Reproduced with gh 2.101.0:

Archive saved as `native-agent-stack-40828dfe….tar.gz`	Command	Exit
Attested archive of unreleased commit `41d39b39` (workflow_dispatch run 35803145596)	documented command	0
same	`+ --source-digest 40828dfe…`	1 ("expected SourceRepositoryDigest to be `40828df`…, got `41d39b3`…")
same	`gh release verify-asset v2026.09.23.1 …`	1
genuine release asset (`gh release download`)	`verify-asset`, then attestation with `--source-ref refs/tags/v2026.09.23.1 --source-digest 40828dfe…`	0, 0

The step now downloads the archive from the GitHub Release, runs gh release verify-asset, and binds the attestation to the tag and commit. adoption/update.md, SECURITY.md and docs/catalog-provenance.md already bound it this way. The default clone + tag checkout + commit check path is unchanged.

2. `release_due.py` said `current` while new-machine files had changed

release_due.py only tested whether documented paths exist. It printed current with due: [] while new-machine files differed from the release.

It now tracks the new-machine files, which are:

the new-host documents and platform pages;
every file they, or README's Start here section, name by extension-matched path, relative Markdown link or bare path;
every file named by a referenced install guide (Markdown under adoption/ or recipes/), one hop further.

It reports two lists:

due: any of these files absent from the release, now including new platform pages.
changed: any present at both whose (mode, object kind, object id) differs between main's HEAD tree and the release, plus README's Start here section (README.md#start-here).
- adoption/manifest.json is compared without source.release_tag, source.release_commit and updated_at, so a profile or command change counts and a re-pin alone does not.
- manifests/evidence.json is exempt.

Other behaviour:

Status is content_changed when only content differs.
--strict, and a re-pin under --strict-if-repinned, fail on either list. Default mode stays report-only.
git output is decoded as UTF-8 in any locale.

At main vs v2026.09.23.1: 160 new-machine files, 22 changed, among them:

the bounded runner and gitleaks-guarded;
the effort-guard hook and its SHA256SUMS;
bootstrap.md and recipes/README.md;
recipes/claude-native-profile.md.

due lists the #161 evidence file that recipes/README.md links and the release lacks.

3. Step 6 ran under the wrong Python

On Ubuntu 24.04, python3 scripts/adoption_status.py … is Python 3.12. The manifest supports only 3.13, so the command reports prerequisites_missing and exits 2 (reproduced). The step now uses uv run --no-project --python 3.13 python scripts/adoption_status.py … (exit 0), as adoption/README.md already does. This applies to bootstrap.md step 6, both platform pages, update.md and README's Start here.

Reviews

Codex's four P2 findings on 2a15a14: all fixed in c45bd06, each with a test that fails on the previous version.
The independent Opus review lens found 7 findings on 2a15a14, and a verifier reproduced each medium one (F1–F3):
- fixed: F1 (manifest), F2 (extensionless, linked and one-hop files), F4 (locale), F5 (the exemptions are now exercised), F6 (modes) and F7 (the pin without a clone, and gh sign-in);
- F3 (a re-pin can merge on an outdated green check, because the ruleset doesn't require an up-to-date branch and the post-merge push run isn't strict) is documented in update.md. The structural fix, a strict ruleset or a push-mode base in validate.yml, is a follow-up.

Tests

ReleaseDueContentDriftTests builds a throwaway repository with a copy of the script. It has 10 cases, each failing on the previous version of the script:
- a re-pin alone (pin fields, updated_at, evidence.json) is current;
- a changed script;
- changed pages and the Start here section;
- extensionless files reached by bare path or link;
- a file named only by an install guide;
- a mode or symlink change with the same bytes;
- the manifest's non-pin fields;
- a missing path or platform page is due;
- --strict-if-repinned;
- a non-ASCII Start here section under LC_ALL=C PYTHONUTF8=0.
CatalogAttestationBindingTests:
- every documented attestation check signed by publish-catalog.yml binds --source-digest;
- bootstrap.md also binds the tag and runs verify-asset;
- a mutant test.
Mutation checks:
- reverting bootstrap.md fails 2 of the 3 new docs tests;
- main's release_due.py fails the drift tests;
- an empty DRIFT_EXEMPT fails 8;
- dropping the install-guide hop fails 1;
- dropping UTF-8 decoding fails 1.

Local results (Linux, this host)

tests.test_release_pin_contents, tests.test_adoption_docs_consistency and tests.test_adoption_bootstrap: 81 OK (1 existing skip) on Python 3.12.3 and 3.13.15.
Full suite on 5ef8eaf: 3671 OK (363 skipped).
scripts/validate.py and every other validator step in validate.yml exit 0, including release_due.py --strict-if-repinned origin/main, which reports only because this PR does not re-pin.
Guarded gitleaks over origin/main..HEAD (4 commits): no leaks.

🤖 Generated with Claude Code

…ent drift in release_due Readiness sweep of v2026.09.23.1 (2026-09-24), both reproduced: - adoption/bootstrap.md's no-git archive check ran `gh attestation verify` with only --repo and --signer-workflow. It exited 0 for the attested archive of unreleased commit 41d39b3 (workflow_dispatch run 35803145596) saved under the v2026.09.23.1 file name. The step now downloads the file from the GitHub Release, runs `gh release verify-asset`, and binds the attestation with --source-ref refs/tags/<release_tag> --source-digest <release_commit>, as adoption/update.md, SECURITY.md and docs/catalog-provenance.md already did. With the flags the substitute exits 1 ("expected SourceRepositoryDigest"); the genuine release asset exits 0 on all three commands. - scripts/release_due.py only tested whether documented paths exist, so it printed "current" while ten new-machine files differed from the release (the shipped effort guard, bootstrap.md, recipes/README.md ...). It now also lists `changed`: new-host documents, platform pages, README's Start here section and every path they reference whose content differs from the release (adoption/manifest.json and manifests/evidence.json, which a re-pin always changes, are not compared). Status "content_changed" when only content differs; --strict and a re-pin under --strict-if-repinned fail on either list. Tests: a throwaway-repository fixture for the drift report (five cases) and a docs-consistency check that every documented attestation check of the catalog's publication binds --source-digest, with bootstrap.md also binding the tag and running verify-asset. Reverting bootstrap.md fails 2 of the 3 new docs tests; the previous release_due fails all 5 drift tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-24T06:15:06Z

Local full suite on this head (2a15a14, Linux, Python 3.12.3): Ran 3666 tests in 200.752s / OK (skipped=363), exit 0.

chatgpt-codex-connector · 2026-09-24T06:15:11Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T07:11:47.899801Z	`0879839`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a15a14e07

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

adoption/manifest.json supports Python 3.13 only. On Ubuntu 24.04, plain `python3` is 3.12, so `python3 scripts/adoption_status.py --profile foundation-cpu --json` reported prerequisites_missing and exited 2 (reproduced on this host: 3.12.3, exit 2). `uv run --no-project --python 3.13 python ...`, the form adoption/README.md already documents, reported prerequisites_present and exited 0. Found by the 2026-09-24 readiness critic (agent-lab-87). Switches bootstrap.md step 6, the Linux and macOS pages, update.md's move step and README's Start here to that form. uv is a Linux step-1 prerequisite and is installed by the macOS bootstrap before this step. CI already installs 3.13 before its own status step (tests/test_adoption_bootstrap.py). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-24T06:31:35Z

Added e76eb1a: the step-6 prerequisite report now runs under the manifest's Python 3.13 (uv run --no-project --python 3.13 python scripts/adoption_status.py …, the form adoption/README.md already uses) in bootstrap.md, the Linux and macOS pages, update.md and README's Start here. Reproduced on this host: plain python3 (3.12.3) exits 2 with prerequisites_missing; the uv form exits 0 with prerequisites_present. Found by the 2026-09-24 readiness critic. Local checks after the commit: docs-consistency, release-pin and bootstrap test modules 77 OK on 3.12.3 and 3.13.15; validate.py passes; guarded gitleaks clean.

…ifest's non-pin fields, new pages as due Codex review of 2a15a14 (four P2 findings, each reproduced by a new test that fails on the previous version): - Candidates came only from PATH_RE's extension list, so the bounded runner (adoption/tools/ecosystem-bounded-run) and adoption/hooks/claude/SHA256SUMS never took part although both differ from v2026.09.23.1. New-machine files now also include relative Markdown link targets (resolved against the document) and bare repository paths that name a file. - Only blob ids were compared. Entries now compare (mode, object kind, object id) from main's HEAD tree against the release, so a chmod-only change or a file replaced by a symlink with the same bytes is drift, as it is in the git archive the release ships. - adoption/manifest.json was exempt as a whole. It is now compared without source.release_tag, source.release_commit and updated_at, so a profile, command or default_profile change is drift; a re-pin alone is not. - A new-host document or platform page absent from the release was silently skipped. It is now due. At main vs v2026.09.23.1: 95 new-machine files; 17 changed, including the bounded runner, the hook checksums and docs/token-session-handbook.md; none due. Full suite 3669 OK; every validate.yml validator exits 0. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-24T06:38:56Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c45bd06476

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…t as UTF-8; document the no-git pin and the re-pin update Independent review of 2a15a14 (Opus lens, each medium finding reproduced by a verifier); F1 (manifest), F6 (modes) and most of F2 were already in c45bd06: - F2: files named only by a referenced install guide (a Markdown file under adoption/ or recipes/) were missed, e.g. adoption/tools/gitleaks-guarded (installed per adoption/tools/README.md) and recipes/claude-native-profile.md. Such guides are now followed one more hop. At main vs v2026.09.23.1: 160 new-machine files, 22 changed; due lists the #161 evidence file that recipes/README.md links and v2026.09.23.1 lacks. - F4: git() decoded output with the locale codec, so README's Start here section (em dashes) crashed under LC_ALL=C PYTHONUTF8=0. It now decodes UTF-8. - F5: the fixture's bootstrap.md names adoption/manifest.json and links manifests/evidence.json, as the real one does, so an empty DRIFT_EXEMPT now fails 8 of the 10 drift tests. - F7: bootstrap.md's no-git path says how to read the pin without a clone (gh api raw contents, run as documented: v2026.09.23.1 40828df...) and that verify-asset and attestation verify need a signed-in gh. - F3: update.md tells the release owner to update the re-pin branch from main right before merging: the main ruleset does not require an up-to-date branch and the post-merge push run of validate.yml is not strict. A structural fix (a strict ruleset or a push-mode base) is left for a follow-up. New tests: a file named only by an install guide; a non-ASCII Start here read under LC_ALL=C PYTHONUTF8=0; each fails on the previous version. Full suite 3671 OK; every validate.yml validator exits 0. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-24T06:47:51Z

@codex review

chatgpt-codex-connector · 2026-09-24T06:51:48Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 5ef8eaf9d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…acked guide, mark step 6 as changed after v2026.09.23.1 Codex re-review of c45bd06/5ef8eaf (three P2 findings): - release_due follows referenced install guides (Markdown under adoption/ or recipes/) to closure with a visited set, not one hop, so a file named only by a guide that another guide names (bootstrap.md -> tools/README.md -> ...) is compared (new fixture test; fails on 5ef8eaf). - CatalogAttestationBindingTests reads every tracked Markdown file outside the dated-record directories instead of a fixed list, so docs/github-automation.md's publication check is covered; removing its --source-digest now fails the test. - bootstrap.md step 6 and both platform pages mark the Python 3.13 status command "changed after `v2026.09.23.1`" (that release's step runs plain python3) and say to run this form on a checkout of that release too. Full suite 3672 OK; every validate.yml validator exits 0. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-24T07:03:40Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0879839b5f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…-level directory Codex review of 0879839 (P2): - A new-host guide that links a directory (adoption/templates/, adoption/agents/claude/, examples/) contributed nothing, because repo_file() rejects directories. A linked directory now contributes its tracked files (evidence/ excepted: records, not install inputs). - Bare paths were recognized only under a fixed list of top-level directories, so recipes/README.md's fixtures/before.py, fixtures/after.py and similar inputs were missed. Any repository-relative token with a directory part now counts when it names a file here; a URL never matches. At main vs v2026.09.23.1: 240 new-machine files, 23 changed, 1 due (#161's evidence file). New fixture test; it fails on 0879839. Not in this PR (tracked as a follow-up): extending the pinned release's self-consistency test to this discovery. A trial showed guide prose naming another repository's file (agent-lab's docs/native-token-workflow.md) and JSON method names in fenced blocks (tools/call) read as missing paths, so it needs a reference form that is precise at a commit without the files present. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Point new machines at the attested release v2026.09.24.1 v2026.09.24.1 (tag object ec94e8a -> 81385fe) carries the working plugin-install commands (#161), the guarded-job CPU cap (#158) and the release-bound no-git archive check with release_due content-drift reporting (#163). release_due --strict reports current. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Set the manifest's updated_at to the re-pin date (Codex review) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: seathatflowsinourveins <234074349+seathatflowsinourveins@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…ASCII and the scope list The command center's confirmation micro of #1001 at bdf60fc (research-cc-role-20261008/pr1001-claude-micro-bdf60fc6.md: blockers 1 and 2, P3s) and its correction #163 of 2026-10-11T16:18Z on Codex's three threads of 15:39:21Z. No code of the guard changes in this commit. - Blocker 2: the module said that it stays ASCII and held one U+2026 in a comment (added by efaa077). It is three full stops now, and test_the_source_of_this_module_is_printable_ascii pins the claim; it fails on the module of bdf60fc (['U+2026'] != []). - Blocker 1 (the pull request description, and this message corrects the message of bdf60fc): the earlier statement that the 37 modules ran "without its nine tests.test_local_pages_* modules" was false. They are the first 37 modules of the 46-module list, and the nine left out are its last nine (tests.test_local_pages_fleet_execution to tests.test_local_pages_workstation, 144 tests, run and counted); 29 of the 46 are local-pages modules. - Codex :92 (an exclamation mark or a question mark does not end a unit) is not patched: the sentence splitter has drawn findings in five consecutive rounds (the lowercase clause, "e.g.", the joined lines, the closers, the exclamation mark and the question mark) and was patched four times, so rule 4 of the convergence ruling closes the class the way line 48 closed. The module docstring states exactly what the guard accepts as a unit end and that review reads everything else; test_the_unit_ends_and_the_scope_of_the_name_patterns_are_documented pins the sentence and the behavior, and fails on the module of bdf60fc, where the sentence is missing. A pinned upstream sentence segmenter is a research-queue item (rule 8, layer instructions-skills). - Codex :51 (a carrier-first name of the managed Code Review app) is confirmed within the closed class: the same scope paragraph says that reordered phrasings of a pinned artifact are out of the guard's scope. - P3-1: the scope list named 11 of the 17 patterns; it names all 17 now, and test_the_scope_of_the_name_patterns_names_every_pattern compares the list itself with PATTERNS (it fails on the module of bdf60fc). P3-2: the right single quotation mark closer is tested (its mutant survived). P3-3: the comment at the sentence pattern says what the code does. - Codex :170 (retired.on is checked for its shape only) is a follow-up under rule 5: the shipped value is the date of the record, so 2099-12-31 is a mutant and not a reproduced failure of the shipped state. 88 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v9.py). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

@claude

…ew (#1001) * Retire the skill's Claude-in-GitHub rows and point them to local review The claude-native-practice skill still selected the route that docs/decisions/2026-10-10-retire-in-github-claude-review.md retired: the github-action row (anthropics/claude-code-action at a pin) and the Actions part of pr-review-pre-cue. - slots.json, slots.md and the layer pages: `retired` joins the status vocabulary; github-action becomes retired with a dated block (record, correction #141, scope, the three workflows, the former default, route, alternatives, evidence and notes as a snapshot, the revisit triggers); pr-review-pre-cue becomes default (scoped) and lists the routes available now (local Claude reads, GPT reads, Codex's GitHub review, the required verdict-review-gate) apart from the open #953 worker. - The scope is the owner's repositories (the command center's ruling of 2026-10-10), not "this repository": a hermetic A/B showed a session in another repository concluding that the action was still fine there. The same ruling retires the managed Claude Code Review GitHub App. - Stale texts the independent pre-read and the stricter check found: the release-tracking note (Dependabot as the action's tracker), the scheduled-tasks route (GitHub Actions schedules only for jobs that run no model) and its source mapping, the usage-cost-monitoring note (Actions under WIF), and the pre-cue source mapping (in Actions through #909). The pre-cue route no longer lists a read the record does not name. - tests/test_native_practice_retired_routes.py: no current row selects a retired route; a retired route is named elsewhere only in a sentence or list item that says it is retired; every line of slots.json, slots.md, the layer pages and cross-client.md is read (duplicates kept, the source mappings of live slots included); only the dated snapshots are exempt. Positive controls are the rows as they stood; the mutation table is in the pull request description. - The slot manifest of #923 is relabeled against the new slots.json bytes, so the exact-difference check of the provenance test runs again instead of skipping. - docs/decisions/2026-10-09-claude-code-native-practice.md: a dated pointer to the retirement, as #981 did for the older records. Source read for this change: anthropics/claude-code-action at 2dca132ff0e0c4094ce6048b422c6915a071210b, base-action/src/ parse-sdk-options.ts:283-284 (CLAUDE_CODE_ENTRYPOINT is set to claude-code-github-action). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Close the holes in the retirement guard and qualify the one-default rule for retired slots Answers the Codex review in GitHub of #1001 at ba6ab3a (four P2s) and the co-op's GPT first read at the same head (three P2s, the first three below); each was reproduced before the change. - Sentence units split at a full stop or a semicolon whatever follows, and at a line break: "This route was retired; the current default is claude-code-action." was one unit that said retired. - The generic phrases "in Actions", "through Actions" and "under WIF" count as the retired route only with Claude context, judged per leaf string; the named workflows, "through #909" and the managed app count everywhere. The routes the decision retains (every bullet of its "What remains" section, a catalog job in GitHub Actions, a non-model gate under WIF) are accepted. - The skill's entry point SKILL.md is scanned, and a test requires every file of the skill folder to be read by a check. - The one-default rule names the retired exception in slots.json, in the slots.md copy and in step 3 of SKILL.md (a retired row has none and says what replaced the route). - The ruled default text is pinned exactly (the read's measured boundary: the date changed on all three surfaces passed), and a check compares every row's Overturn when across slots.json, the index and the layer pages (one step wider than the review of #1005, where an edit left the index cell behind). Each finding fails its own test when its fix is undone alone, and 43 single-edit mutations are caught; the old guard accepts the four bad scenarios of the read and rejects its two legitimate ones. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Bind the manifest label to the shipped slots file and close the remaining holes of the retirement guard Answers the CC's Claude first read of #1001 at 6e97620 (two P2s, six P3s) and Codex's second review in GitHub of the same head (two P2 threads); each was reproduced before the change. - P2-1: the slot manifest was labeled against the slots.json of ba6ab3a, so the exact-difference check of the provenance test skipped at the head (OK, skipped=1). The label is the sha256 of the shipped file again, the check no longer skips, and a new test fails when a change to slots.json does not carry its label (the CC's ruling: a silent skip is this defect's class, so it fails loud). - P2-2: a live source mapping (skills-library, primary_sources[5]) still ran `claude -p` "in a GitHub workflow ... plus a nightly cron"; the guard had no such form. It is reworded to say the run is retired, and "in a GitHub workflow" (also from, via, through, using, as) counts as the retired route when the sentence is about Claude. - P3-1: the Claude Code GitHub Action, /install-github-app and an @claude mention are the retired route under other names (claude-code-security-review stays out: a documented rejection). - P3-4: the Former default exemption of a layer page applies to a retired slot only. - P3-5: a retired slot's own source mapping is read, and now says retired. - P3-2: "e.g." and "i.e." no longer end a sentence, and wrapped lines of prose are one paragraph (the slots.md prose and SKILL.md were judged line by line). - P3-6: the manifest prose lists the fields beyond the exported ones that differ from the snapshot. - P3-7: the entry point directs ("a retired row has no default, so follow the replacement it names"), and the step-3 pin no longer fails with an IndexError on a renumbering. Each correction fails its own test when it is undone alone, and the mutation table is extended. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Judge retired-route prose one physical line at a time and close the guard's other gaps Answers the command center's Claude micro of #1001 at ef3f3e7 (P2-1, P3-1 to P3-5) and Codex's four threads of the same head (:43, :63, :122, :211). Each case was reproduced before the change: compare-guards-ef3f3e7b-vs-third-commit.txt runs 19 scenarios through the guard of ef3f3e7 and this one; the old guard is wrong on 13 (it accepts a retired route that is reintroduced), this one on none. - P2-1 (correction #160): joining wrapped lines into one paragraph let "Retired 2026-10-10" followed by a line that says the current default is claude-code-action pass on four prose surfaces (SKILL.md, slots.md, cross-client.md, layer-page preambles), the scenario Codex raised at ba6ab3a line 41. Prose is judged one physical line at a time again, a line break ends a unit, and the message of every line-judged surface states the rule (RULE; the legend of slots.md states it too and a test pins the two to each other). - P3-1 and Codex :43: three more names of the same route, all in the vendor's own text: the page's title "Claude Code GitHub Actions" and its "installs the Claude GitHub App" (code.claude.com/docs/en/github-actions.md, capture sha256 87b99aef, lines 5, 9, 33, 63-64), the mirror claude-code-base-action (anthropics/claude-code-action@2dca132ff0e0: .github/scripts/check_workflow_hardening.py:18, .github/workflows/sync-base-action.yml:1 and 43, CLAUDE.md:20) and the carrier named first ("Use the GitHub Action for Claude reviews", generic like "in Actions": it counts when the field or unit is about Claude). The families "in Actions" and "through Actions" take on, with, inside and via. - Codex :122 and the command center's P3-3 and P3-5: a unit that negates the retirement outright ("not retired", "never retired", "no longer retired", "isn't retired", "unretired") no longer counts as saying retired. The other half of that scenario, "was retired, but is now current", is the boundary the command center ruled (the guard is a tripwire for stale text; review reads what it accepts); the module names it. - Codex :211 and P3-3: a layer-page section with a label twice (a second Route or Overturn when bullet) is a violation, because the page-to-slots.json comparison keeps the first bullet only. - Codex :63 and P3-4: the target of every slots.md row is checked against <page>#<id>, from the layer of the slot. - The description line of SKILL.md names the topic that invokes the skill; it is pinned by sha256 to the text the routing was measured with and read as a topic, not as a route. - Scheduled-tasks (Codex on #1005, scheduling-supervision.md:9, and the command center's ruling): the route no longer bans every model-backed job. The retirement record (docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) retires Claude review inside GitHub and keeps Codex's GitHub review, so the route says GitHub Actions schedules repository jobs and a scheduled Claude task runs locally; a test pins the wording on slots.json, the layer page and the alternatives. The label of claude-native-slot-manifest.json equals the sha256 of the shipped slots.json again (relabel last); test_the_label_names_the_shipped_slots_file and test_no_other_exported_field_differs (no skip) are unchanged from ef3f3e7. 72 of 72 single-edit mutants of the guard and its data are caught and 5 controls pass (mutations-v4-forward-commit-3.md). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Align the manifest's scheduled-tasks note, state the rule in every explaining unit, split units after a closing delimiter and pin the scope of the name patterns The final fix round of #1001 under the command center's convergence ruling: its Claude micro at efaa077 (blockers B1 to B3, P3-2) and its adjudication of 2026-10-11T13:50Z of Codex's third review. Each item was reproduced on that head before the change. - claude-native-slot-manifest.json:47 (Codex P2, B1, a text of this PR that is false at the head): the note on the differences from the snapshot still said the route of scheduled-tasks was narrowed "to jobs that run no model", while the shipped route says that GitHub Actions schedules repository jobs, that Claude runs inside GitHub are retired (2026-10-10, docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) and that a scheduled Claude task runs locally. The note says so now, and test_the_scheduled_tasks_route_retires_the_claude_routes_and_not_every_model_backed_job reads the manifest as well as the route (fails with the note undone: M79). - B2: the module claims that the message of every line-judged surface states the rule, and it did not for the labelled bullets of a layer page or for the Overturn when cell of an index row. Every explaining unit states it now (a selecting field names no unit and states nothing); the three expected messages carry the rule and test_every_explaining_unit_of_a_layer_page_and_of_the_index_states_the_rule_and_a_selecting_field_does_not pins all three kinds (mutants M83 to M85). - tests/test_native_practice_retired_routes.py:83 (Codex P2, P3-2): a closing quote, parenthesis or bracket between the full stop and the white space kept `The route was "retired." The current default is claude-code-action.` in one unit that said retired. The sentence pattern takes closing delimiters (the curly quotes are built with chr(), so the file stays ASCII); test_a_closing_quote_parenthesis_or_bracket_after_the_full_stop_does_not_join_two_claims fails without it (M78, M82) and keeps `claude-code-action was retired (see the record.) No row selects it.` accepted (control C6). - :48 (Codex P2, workflow-first phrasing) is a follow-up and the class closes (rule 4 of the convergence ruling): the module states that the guard pins the named retired artifacts and the retired slot rows, that generic phrasing of a Claude run in a GitHub workflow cannot be enumerated and is out of its scope (the retirement record governs it), and test_generic_workflow_phrasing_is_out_of_scope_and_the_module_says_so pins the boundary. No pattern is added. - B3 is the description: the two earlier command blocks name the 37 modules they ran (the 46 of the first block without the nine tests.test_local_pages_* modules). 80 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v6.py). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Close the sentence-splitter class by documentation, pin the module's ASCII and the scope list The command center's confirmation micro of #1001 at bdf60fc (research-cc-role-20261008/pr1001-claude-micro-bdf60fc6.md: blockers 1 and 2, P3s) and its correction #163 of 2026-10-11T16:18Z on Codex's three threads of 15:39:21Z. No code of the guard changes in this commit. - Blocker 2: the module said that it stays ASCII and held one U+2026 in a comment (added by efaa077). It is three full stops now, and test_the_source_of_this_module_is_printable_ascii pins the claim; it fails on the module of bdf60fc (['U+2026'] != []). - Blocker 1 (the pull request description, and this message corrects the message of bdf60fc): the earlier statement that the 37 modules ran "without its nine tests.test_local_pages_* modules" was false. They are the first 37 modules of the 46-module list, and the nine left out are its last nine (tests.test_local_pages_fleet_execution to tests.test_local_pages_workstation, 144 tests, run and counted); 29 of the 46 are local-pages modules. - Codex :92 (an exclamation mark or a question mark does not end a unit) is not patched: the sentence splitter has drawn findings in five consecutive rounds (the lowercase clause, "e.g.", the joined lines, the closers, the exclamation mark and the question mark) and was patched four times, so rule 4 of the convergence ruling closes the class the way line 48 closed. The module docstring states exactly what the guard accepts as a unit end and that review reads everything else; test_the_unit_ends_and_the_scope_of_the_name_patterns_are_documented pins the sentence and the behavior, and fails on the module of bdf60fc, where the sentence is missing. A pinned upstream sentence segmenter is a research-queue item (rule 8, layer instructions-skills). - Codex :51 (a carrier-first name of the managed Code Review app) is confirmed within the closed class: the same scope paragraph says that reordered phrasings of a pinned artifact are out of the guard's scope. - P3-1: the scope list named 11 of the 17 patterns; it names all 17 now, and test_the_scope_of_the_name_patterns_names_every_pattern compares the list itself with PATTERNS (it fails on the module of bdf60fc). P3-2: the right single quotation mark closer is tested (its mutant survived). P3-3: the comment at the sentence pattern says what the code does. - Codex :170 (retired.on is checked for its shape only) is a follow-up under rule 5: the shipped value is the date of the record, so 2099-12-31 is a mutant and not a reproduced failure of the shipped state. 88 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v9.py). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

seathatflowsinourveins mentioned this pull request Sep 24, 2026

Grand catalog finalization (2026-09-23): live board #140

Open

9 of 22 tasks

chatgpt-codex-connector Bot reviewed Sep 24, 2026

View reviewed changes

Comment thread scripts/release_due.py Outdated

Comment thread scripts/release_due.py Outdated

Comment thread scripts/release_due.py Outdated

Comment thread scripts/release_due.py Outdated

chatgpt-codex-connector Bot reviewed Sep 24, 2026

View reviewed changes

Comment thread scripts/release_due.py Outdated

Comment thread tests/test_adoption_docs_consistency.py Outdated

Comment thread adoption/bootstrap.md Outdated

seathatflowsinourveins changed the title ~~Bind the no-git archive check to the release; report new-machine content drift in release_due~~ Bind the no-git archive check to the release; report new-machine content drift in release_due; run step 6 under Python 3.13 Sep 24, 2026

chatgpt-codex-connector Bot reviewed Sep 24, 2026

View reviewed changes

Comment thread scripts/release_due.py

Comment thread scripts/release_due.py Outdated

Comment thread scripts/release_due.py

seathatflowsinourveins mentioned this pull request Sep 24, 2026

Extend the pinned-release self-consistency test to release_due's new-machine discovery #168

Open

seathatflowsinourveins merged commit 81385fe into main Sep 24, 2026
24 of 25 checks passed

seathatflowsinourveins deleted the claude/release-binding-drift-20260924 branch September 24, 2026 07:37

seathatflowsinourveins mentioned this pull request Sep 24, 2026

Point new machines at the attested release v2026.09.24.1 #171

Merged

seathatflowsinourveins mentioned this pull request Oct 11, 2026

Retire the skill's Claude-in-GitHub rows and point them to local review #1001

Merged

5 tasks done

Conversation

seathatflowsinourveins commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1. The no-git archive check was not bound to the release

2. release_due.py said current while new-machine files had changed

3. Step 6 ran under the wrong Python

Reviews

Tests

Local results (Linux, this host)

Uh oh!

seathatflowsinourveins commented Sep 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seathatflowsinourveins commented Sep 24, 2026

Uh oh!

seathatflowsinourveins commented Sep 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seathatflowsinourveins commented Sep 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 24, 2026

Uh oh!

seathatflowsinourveins commented Sep 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seathatflowsinourveins commented Sep 24, 2026 •

edited

Loading

2. `release_due.py` said `current` while new-machine files had changed

chatgpt-codex-connector Bot commented Sep 24, 2026 •

edited

Loading