From 3d7bd63d00e19e93902f0457786891324df71851 Mon Sep 17 00:00:00 2001
From: seathatflowsinourveins
<234074349+seathatflowsinourveins@users.noreply.github.com>
Date: Sun, 20 Sep 2026 00:23:46 -0400
Subject: [PATCH 1/5] Freeze native worker dependency planner acceptance
fixture
---
.../native-worker/seed/TASK.md | 16 +++++
.../native-worker/seed/planner.py | 6 ++
.../native-worker/seed/test_planner.py | 59 +++++++++++++++++++
3 files changed, 81 insertions(+)
create mode 100644 blueprints/convergence-practice/native-worker/seed/TASK.md
create mode 100644 blueprints/convergence-practice/native-worker/seed/planner.py
create mode 100644 blueprints/convergence-practice/native-worker/seed/test_planner.py
diff --git a/blueprints/convergence-practice/native-worker/seed/TASK.md b/blueprints/convergence-practice/native-worker/seed/TASK.md
new file mode 100644
index 000000000..609181240
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/seed/TASK.md
@@ -0,0 +1,16 @@
+# Dependency planner repair
+
+Implement `order_tasks(dependencies)` in `planner.py` using only the Python
+standard library. Input is a mapping from task-name strings to lists of
+prerequisite task-name strings. Return every declared task exactly once, after
+all its prerequisites. At each step choose the lexicographically smallest
+currently ready task. Duplicate prerequisite names count once. Raise `ValueError`
+for an undeclared prerequisite or any cycle, including a disconnected cycle.
+Do not mutate the mapping or its lists. Empty input returns an empty list.
+
+You own only `planner.py`. Preserve this specification and `test_planner.py`.
+Run `python3 -m unittest -v test_planner` and report the actual result, source
+revision, working directory and changed paths. Do not commit, change settings,
+install dependencies, contact external services, write durable memory or create
+another subagent. The test oracle is visible; this is an integration acceptance
+fixture, not a blinded benchmark or an efficiency comparison.
diff --git a/blueprints/convergence-practice/native-worker/seed/planner.py b/blueprints/convergence-practice/native-worker/seed/planner.py
new file mode 100644
index 000000000..27b0120c7
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/seed/planner.py
@@ -0,0 +1,6 @@
+"""A deliberately incorrect dependency planner for the frozen repair fixture."""
+
+
+def order_tasks(dependencies):
+ """Return task names; the seed ignores prerequisite and validation rules."""
+ return sorted(dependencies)
diff --git a/blueprints/convergence-practice/native-worker/seed/test_planner.py b/blueprints/convergence-practice/native-worker/seed/test_planner.py
new file mode 100644
index 000000000..afb689276
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/seed/test_planner.py
@@ -0,0 +1,59 @@
+"""Frozen acceptance oracle, visible to the worker; not a held-out benchmark."""
+import copy
+import unittest
+
+from planner import order_tasks
+
+
+class PlannerAcceptance(unittest.TestCase):
+ def test_empty(self):
+ self.assertEqual(order_tasks({}), [])
+
+ def test_one(self):
+ self.assertEqual(order_tasks({"build": []}), ["build"])
+
+ def test_dependency_before_alphabetic_name(self):
+ self.assertEqual(order_tasks({"a": ["z"], "z": []}), ["z", "a"])
+
+ def test_ready_ties_are_lexicographic(self):
+ self.assertEqual(order_tasks({"z": [], "b": [], "a": ["b"]}), ["b", "a", "z"])
+
+ def test_diamond(self):
+ self.assertEqual(order_tasks({"ship": ["test", "package"], "test": ["build"],
+ "package": ["build"], "build": []}),
+ ["build", "package", "test", "ship"])
+
+ def test_duplicate_dependencies(self):
+ self.assertEqual(order_tasks({"a": ["z", "z"], "z": []}), ["z", "a"])
+
+ def test_unknown_dependency(self):
+ with self.assertRaises(ValueError):
+ order_tasks({"build": ["missing"]})
+
+ def test_self_cycle(self):
+ with self.assertRaises(ValueError):
+ order_tasks({"build": ["build"]})
+
+ def test_multi_node_cycle(self):
+ with self.assertRaises(ValueError):
+ order_tasks({"a": ["b"], "b": ["a"]})
+
+ def test_cycle_in_disconnected_component(self):
+ with self.assertRaises(ValueError):
+ order_tasks({"ready": [], "a": ["b"], "b": ["a"]})
+
+ def test_input_unchanged(self):
+ data = {"a": ["z", "z"], "z": []}
+ before = copy.deepcopy(data)
+ order_tasks(data)
+ self.assertEqual(data, before)
+
+ def test_mapping_insertion_order_does_not_matter(self):
+ left = {"d": ["b", "c"], "b": ["a"], "c": ["a"], "a": []}
+ right = dict(reversed(list(left.items())))
+ self.assertEqual(order_tasks(left), ["a", "b", "c", "d"])
+ self.assertEqual(order_tasks(left), order_tasks(right))
+
+
+if __name__ == "__main__":
+ unittest.main()
From 163199595e678c26e3b0582f2e992b5564b5e484 Mon Sep 17 00:00:00 2001
From: seathatflowsinourveins
<234074349+seathatflowsinourveins@users.noreply.github.com>
Date: Sun, 20 Sep 2026 00:23:46 -0400
Subject: [PATCH 2/5] Enforce convergence evidence and add native workflow
security checks
---
.../contract-reference.md | 108 +++++++
.../convergence-practice/contract.schema.json | 85 ++++++
docs/convergence-architecture.md | 231 +++++++++++++++
scripts/validate_convergence.py | 215 ++++++++++++++
.../fixtures/workflow-security/unsafe.yml.txt | 11 +
tests/test_convergence_contract.py | 279 ++++++++++++++++++
tests/test_workflow_security.py | 63 ++++
7 files changed, 992 insertions(+)
create mode 100644 blueprints/convergence-practice/contract-reference.md
create mode 100644 blueprints/convergence-practice/contract.schema.json
create mode 100644 docs/convergence-architecture.md
create mode 100644 scripts/validate_convergence.py
create mode 100644 tests/fixtures/workflow-security/unsafe.yml.txt
create mode 100644 tests/test_convergence_contract.py
create mode 100644 tests/test_workflow_security.py
diff --git a/blueprints/convergence-practice/contract-reference.md b/blueprints/convergence-practice/contract-reference.md
new file mode 100644
index 000000000..46a2b66b2
--- /dev/null
+++ b/blueprints/convergence-practice/contract-reference.md
@@ -0,0 +1,108 @@
+# Executable convergence records
+
+Design v1: one record describes a planned or observed experiment in one lane of
+[protocol.json](protocol.json). The existing fifteen evidence fields remain
+required. [contract.schema.json](contract.schema.json) defines their shape;
+`scripts/validate_convergence.py` additionally checks local artifact hashes and
+cross-field consistency. It uses only Python's standard library, reads files,
+and never executes a recorded command, installs a tool or calls a model.
+
+```sh
+python3 scripts/validate_convergence.py path/to/experiment.json --root . --json
+```
+
+Record and artifact paths are canonical repository-relative paths. Absolute
+paths, traversal, symlink files and symlink parents are refused. Source and input
+files, evaluation rules and observed outputs must have actual SHA-256 matches.
+The base revision and primary source revisions are immutable 40- or 64-character
+hex identities; the validator does not fetch them or establish that a declared
+revision supplied those bytes. Likewise, hashes prove retained byte identity,
+not source authenticity, observation truth or that a freeze preceded execution.
+
+## Minimal planned example
+
+This example is valid after creating `fixture.txt` containing exactly `abc`
+(without a newline) and saving this JSON as an experiment under the same root.
+Its synthetic source/revision and one reused artifact illustrate structure;
+they do not qualify a real implementation. Actual experiments retain distinct
+source, input and evaluation artifacts where their contents differ.
+
+```json
+{
+ "schema_version": 1,
+ "kind": "convergence_experiment",
+ "status": "planned",
+ "lane": "native-agent-engineering",
+ "task_and_failure": "Synthetic patch fixture; correctness is not observed yet.",
+ "primary_sources_and_pins": [{"url": "https://example.org/fixture", "revision": "0000000000000000000000000000000000000000"}],
+ "discovery_provenance": ["A measured local workflow gap."],
+ "license_and_compatibility": "Synthetic public fixture; no dependencies.",
+ "baseline_and_candidate": {"baseline": "full context", "candidate": "scoped context"},
+ "frozen_inputs": {
+ "base_revision": "0000000000000000000000000000000000000000",
+ "tasks": ["patch-a"], "roles": ["worker"],
+ "sources": [{"path": "fixture.txt", "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"}],
+ "inputs": [{"path": "fixture.txt", "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"}],
+ "evaluation": [{"path": "fixture.txt", "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"}]
+ },
+ "predeclared_metrics": {"quality_rule": "Patch passes held-out tests and review.", "usage_rule": "Keep unknown usage null; no savings claim."},
+ "runtime_and_platform": {"platform": "disposable fixture", "tools": [{"name": "python", "version": "3.13.15"}], "isolation": "Separate project workspace."},
+ "commands": ["python3 -m unittest"],
+ "observations": [],
+ "failures_and_skips": [],
+ "limitations": ["Synthetic plan; no execution or model outcome."],
+ "decision_and_scope": {"decision": "trial", "scope": "fixture only", "qualification_run_ids": []},
+ "rollback": "Retain the accepted workflow; discard the disposable candidate.",
+ "next_decision_changing_test": "Execute the frozen patch fixture.",
+ "usage_assessment": {"claim": "none", "coverage": "partial", "expected_run_ids": [], "coverage_artifact": null}
+}
+```
+
+## Observations and decisions
+
+An observed record contains at least one run. Each run names a unique `id`, a
+declared `task` and `role`, `condition` (`baseline` or `candidate`), positive
+`attempt`, `command_index` into `commands`, `evidence_class`, exact `scope`,
+`status` (`passed`, `failed` or `skipped`), nullable `exit_code`, `quality`
+(`semantic` and `contract`, each boolean or null), nonempty hashed `artifacts`,
+and `usage`. Every non-passed run also appears once in `failures_and_skips` as
+`{"run_id": "…", "reason": "…"}`. Pre-execution or unparsed failures may have
+unknown exit status. A process exit of zero does not imply semantic acceptance.
+
+Planned records have no runs, failures, qualifications or usage claim.
+`adopt_within_scope` requires observed, passed candidate runs with exit zero,
+both quality checks true, matching decision scope, and an execution evidence
+class (`offline_artifact_check`, `native_cli_execution`, `model_task_execution`
+or `recovery_execution`). Discovery and source review cannot qualify adoption.
+This is a necessary evidence check, not authority to install or promote globally.
+
+## Usage and matched comparisons
+
+Every run has the same nullable, nonnegative integer fields in `usage`:
+`uncached_input`, `cache_creation`, `cache_read`, `output`,
+`reasoning_in_output`, `total`, and `native_retries`. The three input categories
+are **disjoint**; output already includes reasoning. When all four disjoint
+categories are known, their sum must equal `total`. Reasoning cannot exceed
+output. Unknown provider fields remain null; deterministic no-model work may
+record observed zeros, but missing telemetry must not be converted to zero.
+Usage is the aggregate for one invocation, including any known native retries;
+an outer resubmission is a separate numbered attempt, never counted twice.
+
+`usage_assessment.coverage = complete` requires an exact list of observed run IDs
+and a hashed JSON `coverage_artifact` containing exactly
+`{"run_ids": ["…"], "complete": true}`. This is an explicit audit assertion;
+software cannot discover omitted external calls. `whole_task_token_savings`
+additionally requires every declared task/role in both conditions, consecutive
+attempt numbers from one, execution evidence in the declared scope, complete
+known usage/retry categories, passed quality for every attempt, and strictly
+lower summed candidate tokens. All coordinator,
+preparation, review and other roles in the actual task boundary must be declared;
+excluded roles or attempts make coverage partial; any unknown usage prevents
+this claim even when the attempt inventory is complete.
+
+Matching uses the record's frozen tasks, source/input/evaluation references and
+quality rule. The validator cannot establish independent grading, comparable
+native account/hook/cache conditions, a truly exhaustive task boundary, causal
+savings, billing savings or general superiority. Retain those limitations and
+inspect the underlying evidence. Report per-task observations before drawing
+broader conclusions; a cheaper failed answer is not accepted efficiency.
diff --git a/blueprints/convergence-practice/contract.schema.json b/blueprints/convergence-practice/contract.schema.json
new file mode 100644
index 000000000..c1584274e
--- /dev/null
+++ b/blueprints/convergence-practice/contract.schema.json
@@ -0,0 +1,85 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "title": "Convergence experiment v1",
+ "description": "Structural schema; validate_convergence.py also enforces evidence integrity and conditional claim requirements.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": ["schema_version", "kind", "status", "lane", "task_and_failure", "primary_sources_and_pins", "discovery_provenance", "license_and_compatibility", "baseline_and_candidate", "frozen_inputs", "predeclared_metrics", "runtime_and_platform", "commands", "observations", "failures_and_skips", "limitations", "decision_and_scope", "rollback", "next_decision_changing_test", "usage_assessment"],
+ "properties": {
+ "schema_version": {"type": "integer", "enum": [1]},
+ "kind": {"type": "string", "enum": ["convergence_experiment"]},
+ "status": {"type": "string", "enum": ["planned", "observed"]},
+ "lane": {"type": "string", "enum": ["retrieval", "native-agent-engineering", "memory", "access-recovery", "local-inference", "research-application"]},
+ "task_and_failure": {"$ref": "#/$defs/text"},
+ "primary_sources_and_pins": {"type": "array", "minItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["url", "revision"], "properties": {"url": {"type": "string", "pattern": "^https://[^\\s]+$"}, "revision": {"$ref": "#/$defs/revision"}}}},
+ "discovery_provenance": {"$ref": "#/$defs/texts"},
+ "license_and_compatibility": {"$ref": "#/$defs/text"},
+ "baseline_and_candidate": {"type": "object", "additionalProperties": false, "required": ["baseline", "candidate"], "properties": {"baseline": {"$ref": "#/$defs/text"}, "candidate": {"$ref": "#/$defs/text"}}},
+ "frozen_inputs": {
+ "type": "object", "additionalProperties": false,
+ "required": ["base_revision", "tasks", "roles", "sources", "inputs", "evaluation"],
+ "properties": {
+ "base_revision": {"$ref": "#/$defs/revision"},
+ "tasks": {"$ref": "#/$defs/ids"}, "roles": {"$ref": "#/$defs/ids"},
+ "sources": {"$ref": "#/$defs/artifacts"}, "inputs": {"$ref": "#/$defs/artifacts"}, "evaluation": {"$ref": "#/$defs/artifacts"}
+ }
+ },
+ "predeclared_metrics": {"type": "object", "additionalProperties": false, "required": ["quality_rule", "usage_rule"], "properties": {"quality_rule": {"$ref": "#/$defs/text"}, "usage_rule": {"$ref": "#/$defs/text"}}},
+ "runtime_and_platform": {
+ "type": "object", "additionalProperties": false, "required": ["platform", "tools", "isolation"],
+ "properties": {
+ "platform": {"$ref": "#/$defs/text"}, "isolation": {"$ref": "#/$defs/text"},
+ "tools": {"type": "array", "minItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["name", "version"], "properties": {"name": {"$ref": "#/$defs/text"}, "version": {"$ref": "#/$defs/text"}}}}
+ }
+ },
+ "commands": {"$ref": "#/$defs/texts"},
+ "observations": {"type": "array", "items": {"$ref": "#/$defs/run"}},
+ "failures_and_skips": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["run_id", "reason"], "properties": {"run_id": {"$ref": "#/$defs/id"}, "reason": {"$ref": "#/$defs/text"}}}},
+ "limitations": {"$ref": "#/$defs/texts"},
+ "decision_and_scope": {"type": "object", "additionalProperties": false, "required": ["decision", "scope", "qualification_run_ids"], "properties": {"decision": {"type": "string", "enum": ["retain", "trial", "adopt_within_scope", "defer", "reject"]}, "scope": {"$ref": "#/$defs/text"}, "qualification_run_ids": {"type": "array", "uniqueItems": true, "items": {"$ref": "#/$defs/id"}}}},
+ "rollback": {"$ref": "#/$defs/text"},
+ "next_decision_changing_test": {"$ref": "#/$defs/text"},
+ "usage_assessment": {
+ "type": "object", "additionalProperties": false, "required": ["claim", "coverage", "expected_run_ids", "coverage_artifact"],
+ "properties": {
+ "claim": {"type": "string", "enum": ["none", "whole_task_token_savings"]},
+ "coverage": {"type": "string", "enum": ["partial", "complete"]},
+ "expected_run_ids": {"type": "array", "uniqueItems": true, "items": {"$ref": "#/$defs/id"}},
+ "coverage_artifact": {"$ref": "#/$defs/optional_artifact"}
+ }
+ }
+ },
+ "$defs": {
+ "text": {"type": "string", "minLength": 1, "pattern": "[\\s\\S]*\\S[\\s\\S]*"},
+ "texts": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/text"}},
+ "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,79}$"},
+ "ids": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/$defs/id"}},
+ "revision": {"type": "string", "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$"},
+ "artifact": {"type": "object", "additionalProperties": false, "required": ["path", "sha256"], "properties": {"path": {"$ref": "#/$defs/text"}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}},
+ "optional_artifact": {"type": ["object", "null"], "additionalProperties": false, "required": ["path", "sha256"], "properties": {"path": {"$ref": "#/$defs/text"}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}},
+ "artifacts": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/$defs/artifact"}},
+ "count": {"type": ["integer", "null"], "minimum": 0},
+ "usage": {
+ "type": "object", "additionalProperties": false,
+ "required": ["uncached_input", "cache_creation", "cache_read", "output", "reasoning_in_output", "total", "native_retries"],
+ "properties": {
+ "uncached_input": {"$ref": "#/$defs/count"}, "cache_creation": {"$ref": "#/$defs/count"}, "cache_read": {"$ref": "#/$defs/count"},
+ "output": {"$ref": "#/$defs/count"}, "reasoning_in_output": {"$ref": "#/$defs/count"}, "total": {"$ref": "#/$defs/count"}, "native_retries": {"$ref": "#/$defs/count"}
+ }
+ },
+ "run": {
+ "type": "object", "additionalProperties": false,
+ "required": ["id", "task", "role", "condition", "attempt", "command_index", "evidence_class", "scope", "status", "exit_code", "quality", "artifacts", "usage"],
+ "properties": {
+ "id": {"$ref": "#/$defs/id"}, "task": {"$ref": "#/$defs/id"}, "role": {"$ref": "#/$defs/id"},
+ "condition": {"type": "string", "enum": ["baseline", "candidate"]},
+ "attempt": {"type": "integer", "minimum": 1}, "command_index": {"type": "integer", "minimum": 0},
+ "evidence_class": {"type": "string", "enum": ["discovery", "pinned_source_review", "offline_artifact_check", "native_cli_execution", "model_task_execution", "recovery_execution"]},
+ "scope": {"$ref": "#/$defs/text"}, "status": {"type": "string", "enum": ["passed", "failed", "skipped"]},
+ "exit_code": {"type": ["integer", "null"]},
+ "quality": {"type": "object", "additionalProperties": false, "required": ["semantic", "contract"], "properties": {"semantic": {"type": ["boolean", "null"]}, "contract": {"type": ["boolean", "null"]}}},
+ "artifacts": {"$ref": "#/$defs/artifacts"}, "usage": {"$ref": "#/$defs/usage"}
+ }
+ }
+ }
+}
diff --git a/docs/convergence-architecture.md b/docs/convergence-architecture.md
new file mode 100644
index 000000000..5df59a80e
--- /dev/null
+++ b/docs/convergence-architecture.md
@@ -0,0 +1,231 @@
+# Convergence architecture for native engineering work
+
+Start with one engineering outcome and the evidence needed to accept it. This
+guide connects research, implementation, native Codex/Claude workers, validation
+and recovery. It applies to an ordinary software repository before adding a
+specialized research, data or GPU layer. The financial blueprints remain useful
+worked examples; their data and broker gates do not become general engineering
+prerequisites.
+
+Use the [adoption manifest](../adoption/manifest.json) to select an existing
+profile, the [update protocol](../adoption/update.md) to preserve an accepted
+installation, and the [convergence blueprint](../blueprints/convergence-practice/README.md)
+to evaluate a proposed change. Source pins live in
+[the stack manifest](../manifests/stack.json); evidence classes and publication
+limits live in [the evidence guide](evidence.md).
+
+The working sequence is:
+
+```text
+Outcome + acceptance test
+ ↓
+Current baseline + one decision-changing gap
+ ↓
+Primary-source review + frozen task envelope
+ ↓
+Native worker in an owned checkout
+ ↓
+Independent checks + complete attempt record
+ ↓
+Retain / trial / adopt within scope / defer / reject
+ ↓
+Recoverable handoff + next unresolved gate
+```
+
+## 1. Make the task envelope the entry point
+
+Before a worker starts, give it a compact contract: the requested result, exact
+repository revision, allowed paths, relevant source references, acceptance
+commands, task owner, available runtime, limits, output destination and stop
+conditions. Include only the project rules that affect this task. Resolve
+missing prerequisites before asking an agent to rediscover the whole ecosystem.
+
+For a small bug fix, the envelope should identify the failing behavior and
+meaningful regression test, rather than prescribe every edit. For research,
+freeze the question, corpus, scoring rule and required uncertainty handling.
+Keep complete logs and source bytes outside the prompt, with precise locators
+and hashes in the handoff.
+
+The proposed [contract reference](../blueprints/convergence-practice/contract-reference.md)
+and [schema](../blueprints/convergence-practice/contract.schema.json) accompany
+the [convergence validator](../scripts/validate_convergence.py) in this integration
+wave:
+
+```sh
+python3 scripts/validate_convergence.py RECORD.json --root . --json
+```
+
+`RECORD.json` means the selected contract/receipt described by that reference.
+Schema validation checks recorded structure and evidence references; it does
+not enforce permissions, reserve resources or run the acceptance task. These
+links are integration dependencies until the coordinator includes those files.
+
+## 2. Review a component against the gap it would close
+
+Use owned repositories, stars and curated lists to discover candidates. Read
+the current primary documentation and exact source/release before adoption.
+Record license, platform and dependency compatibility, overlap with the current
+stack, installation scope, rollback and the result that would justify a switch.
+A newer release can reopen a decision without changing the accepted pin.
+
+Compare the working baseline with the smallest useful alternative. The existing
+[external retrieval experiment](../blueprints/convergence-practice/arb-trace2code/README.md)
+and [local documentation experiment](../blueprints/convergence-practice/local-fixture/evaluation.md)
+favor different rankers on different tasks. That supports evaluating the target
+workload, not selecting a universal retrieval winner. A catalog entry alone
+never triggers installation or qualifies another machine.
+
+## 3. Keep instructions, retrieval and durable state distinct
+
+Keep the always-loaded repository contract short. Load detailed skills for the
+current operation. Start a known-code question with exact identifiers or syntax
+search; use the selected conceptual index for cross-file questions and the
+selected document collection for source material. Verify retrieved passages
+against the actual revision before editing. An empty, stale or wrong-project
+result should remain visible rather than be replaced with a plausible answer.
+
+Save approved decisions with project scope, rationale, source revision and the
+condition that would reopen them. Preserve unfinished proposals in an explicit
+outbox. Do not turn every conversation into permanent guidance or copy another
+host's live memory/index database into the worker. Reuse a decision only while
+its assumptions still apply.
+
+The [memory lifecycle fixture](../blueprints/us-equities/memory-lifecycle/README.md)
+demonstrates scoped retrieval and explicit deletion in a disposable store. Its
+expiry observation is narrower than immediate access revocation. Historical
+native hooks and memory receipts retain their original scope; this guide does
+not silently enable capture or claim those earlier configurations were absent.
+
+## 4. Give each native worker one owner and an actual base
+
+The coordinator owns requirements and integration. Each writing worker owns one
+checkout and a bounded set of paths. Accounts, global settings and shared
+services need a separate designated writer because worktrees do not isolate
+them. Read-only research workers should return findings and evidence, leaving
+implementation to the assigned writer.
+
+Codex roles without model/effort overrides inherit those settings from the
+parent; explicit spawn or role settings can change them. Claude's
+`model: inherit` and omitted `effort` preserve the session choices, subject to
+its native override rules. Inspect actual behavior rather than assuming a
+configuration name proves inheritance. Claude's native worktree isolation can
+start from the default branch, so compare its actual Git base with the task
+envelope before edits. [Codex subagents](https://learn.chatgpt.com/docs/agent-configuration/subagents),
+[Claude subagents](https://code.claude.com/docs/en/sub-agents).
+
+Delegate independent work when it improves the task. A child has its own model
+and tool activity, so parallelism can increase total usage. Avoid nested workers
+and repeated reviews without a concrete unresolved question. Permission settings
+enforce access; prose such as “read only” is not itself an isolation mechanism.
+
+## 5. Preserve native context and cache behavior
+
+Treat model choice, reasoning effort, orchestration and authentication as
+separate settings. Codex's native Ultra supports parallel work. Its experimental
+same-task context management uses
+`features.context_management.experimental_mode = true` for eligible accounts
+and requires a new task. Configuration presence alone is not activation evidence.
+[Codex models](https://learn.chatgpt.com/docs/models).
+
+Claude Ultracode combines `xhigh` reasoning with dynamic workflows. The native
+setting is `ultracode: true`; it is not an external repository or a persisted
+`effortLevel` value. Model capability and workflow availability still apply.
+Keep the requested model and record the one that actually ran. The `best` alias
+can resolve to Fable, whose usage-credit behavior requires an account-specific
+check before unattended work. [Claude model configuration](https://code.claude.com/docs/en/model-config).
+
+Keep stable prefixes, deferred tool discovery and native compaction. Ordinary
+Claude subagents build their own caches; a fork carries the parent's context
+and can reuse its prefix. Subscription main-conversation cache lifetime and
+worker cache lifetime differ. Matching workflow agents can share their initial
+prefix; the native stagger helps that reuse. Do not remove it or extend cache
+lifetime merely because a longer value sounds better. Measure the intended
+workload before changing defaults. [Prompt caching](https://code.claude.com/docs/en/prompt-caching),
+[dynamic workflows](https://code.claude.com/docs/en/workflows).
+
+## 6. Count every attempt and preserve failed conditions
+
+Record task correctness, retrieved text, elapsed time, provider usage and billing
+as separate quantities. For Codex, cached input is a subset of reported input;
+for Claude, ordinary input, cache creation and cache reads are separate
+categories. Reasoning can be a subset of output. Choose one authoritative
+aggregate for an attempt and do not add cumulative snapshots or per-model totals
+to it again. [Existing accounting conventions](evidence.md#token-measurements).
+
+An efficiency comparison needs matched inputs and quality criteria, all parents
+and children, retries, failed attempts, cache conditions and explicit exclusions.
+Unknown usage stays unknown. A short failed answer is not accepted efficiency.
+The [prepared-context comparison](../blueprints/us-equities/research-efficiency/README.md)
+retains eight native answers, structural failures and provider categories. It
+also excludes coordinator/preparation/reviewer usage, so it cannot establish
+savings for the enclosing workflow.
+
+Keep bounded retries for a diagnosed recoverable failure. Authentication,
+entitlement and unchanged quota refusals need a changed condition, not an
+automatic loop or paid fallback. Native `/usage` cost estimates and account
+credit spend answer different questions; a print-mode dollar cap is not proof
+that no usage credits can be spent. [Claude usage accounting](https://code.claude.com/docs/en/costs).
+
+## 7. Separate deterministic checks from live qualification
+
+Let deterministic code own arithmetic, schema validation, source hashes and
+test assertions. Ask an agent to investigate and implement; independently
+inspect its patch and rerun the checks relevant to the changed behavior. A
+fixture should catch a real failure, not simply restate implementation details.
+
+Use the repository's existing offline checks:
+
+```sh
+python3 scripts/validate.py
+python3 scripts/validate_catalogs.py
+python3 scripts/build_ecosystem.py --check
+python3 -m unittest
+```
+
+These are the commands in [the current CI workflow](../.github/workflows/validate.yml).
+Validate the exact integrated commit, including negative tests that demonstrate
+malformed or contradictory evidence is rejected. A hosted pass checks the
+publication and its deterministic behavior. A native model run, GPU operation,
+client activation or another host requires its own observed acceptance.
+
+**Integration checkpoint, pending:** this wave plans a bounded native-worker
+patch fixture and a deliberate CI failure/rejection case. The coordinator will
+add the final paths and outcomes after execution and review. Until then, neither
+is a passed result of this guide. Existing receipts remain the evidence baseline.
+
+## 8. Close the task with a recoverable decision
+
+Choose retain, trial, adopt within scope, defer or reject. State the accepted
+host/component/task scope and the next observation that would change it. The
+handoff includes the source revision, patch, actual checks, unresolved work,
+attempt accounting and a rollback boundary. Save this compact decision; resume
+the native task when its working context is needed.
+
+Test recovery in layers. Reopening a task, stopping a local process tree,
+resuming application work and restoring state on an independent host are
+different checks. The [worker-supervision fixture](../blueprints/us-equities/worker-supervision/README.md)
+observed local descendant termination and a fresh successful launch; it did not
+prove remote provider cancellation or exactly-once effects. The
+[state-recovery receipts](../blueprints/us-equities/state-recovery/README.md)
+exercise selected application data while retaining an independent-host/key
+recovery gap.
+
+Preserve the accepted environment while a candidate is tested. After an
+interruption, reconcile the native task identity and any external effects
+before resubmitting. A successful same-host restore or a service that restarts
+does not certify an entire Mac/WSL ecosystem after power loss or network change.
+
+## Apply the loop to the next repository
+
+For an application bug: select the existing engineering profile, record its
+current setup/test commands, freeze a useful failing case, assign one native
+worker the relevant files, verify the patch, and save the resulting decision.
+Add retrieval, GPU execution or another framework only when that task exposes a
+specific gap and the candidate passes the corresponding acceptance lane.
+
+For a research question: freeze the corpus and question, retrieve a bounded
+packet with negative cases, require source-grounded output, score correctness
+and completeness, then compare usage within the same provider/task conditions.
+Promote only the demonstrated change. That makes the ecosystem useful for
+building complex systems while keeping evidence, ownership and recovery small
+enough to inspect.
diff --git a/scripts/validate_convergence.py b/scripts/validate_convergence.py
new file mode 100644
index 000000000..441ae11c4
--- /dev/null
+++ b/scripts/validate_convergence.py
@@ -0,0 +1,215 @@
+#!/usr/bin/env python3
+"""Check declared convergence evidence offline; never execute or certify it."""
+
+import argparse
+from collections import defaultdict
+import hashlib
+import json
+from pathlib import Path
+import re
+
+if __package__:
+ from .validate import Validator, _json_without_duplicates
+else:
+ from validate import Validator, _json_without_duplicates
+
+REPO = Path(__file__).resolve().parents[1]
+CONTRACT = REPO / "blueprints/convergence-practice"
+EXECUTION = {"offline_artifact_check", "native_cli_execution", "model_task_execution", "recovery_execution"}
+INPUT_OUTPUT = ("uncached_input", "cache_creation", "cache_read", "output")
+
+
+def read_json(path):
+ return json.loads(path.read_text(encoding="utf-8"), object_pairs_hook=_json_without_duplicates)
+
+
+def structure(value, schema, definitions, label, errors):
+ """Implement only the schema vocabulary used by the checked-in contract."""
+ if "$ref" in schema:
+ schema = definitions[schema["$ref"].removeprefix("#/$defs/")]
+ types = schema.get("type", [])
+ types = [types] if isinstance(types, str) else types
+ kind = {dict: "object", list: "array", str: "string", int: "integer", bool: "boolean", type(None): "null"}.get(type(value))
+ if kind not in types:
+ errors.append(f"{label}: invalid type")
+ return
+ if "enum" in schema and value not in schema["enum"]:
+ errors.append(f"{label}: unsupported value")
+ if kind == "object":
+ properties = schema.get("properties", {})
+ if set(schema.get("required", [])) - value.keys():
+ errors.append(f"{label}: missing required fields")
+ if schema.get("additionalProperties") is False and value.keys() - properties.keys():
+ errors.append(f"{label}: unknown fields")
+ for key in sorted(properties.keys() & value.keys()):
+ structure(value[key], properties[key], definitions, f"{label}.{key}", errors)
+ elif kind == "array":
+ if len(value) < schema.get("minItems", 0):
+ errors.append(f"{label}: too few items")
+ if schema.get("uniqueItems") and len({json.dumps(item, sort_keys=True) for item in value}) != len(value):
+ errors.append(f"{label}: duplicate items")
+ for index, item in enumerate(value):
+ structure(item, schema["items"], definitions, f"{label}[{index}]", errors)
+ elif kind == "string":
+ if len(value) < schema.get("minLength", 0) or ("pattern" in schema and re.fullmatch(schema["pattern"], value) is None):
+ errors.append(f"{label}: invalid text format")
+ elif kind == "integer" and "minimum" in schema and value < schema["minimum"]:
+ errors.append(f"{label}: below minimum")
+
+
+def check_artifacts(value, validator, label="record"):
+ if isinstance(value, dict):
+ if set(value) == {"path", "sha256"}:
+ path = validator.path(value["path"], label)
+ if path is not None:
+ try:
+ with path.open("rb") as handle:
+ actual = hashlib.file_digest(handle, "sha256").hexdigest()
+ if actual != value["sha256"]:
+ validator.error(f"{label}: SHA-256 mismatch")
+ except OSError:
+ validator.error(f"{label}: artifact unreadable")
+ else:
+ for key, item in value.items():
+ check_artifacts(item, validator, f"{label}.{key}")
+ elif isinstance(value, list):
+ for index, item in enumerate(value):
+ check_artifacts(item, validator, f"{label}[{index}]")
+
+
+def accepted(run):
+ return (run["status"] == "passed" and run["exit_code"] == 0
+ and all(value is True for value in run["quality"].values()))
+
+
+def consistency(record, validator):
+ error = validator.error
+ protocol = read_json(CONTRACT / "protocol.json")
+ if not set(protocol["required_experiment_fields"]) <= record.keys():
+ error("record: missing protocol evidence fields")
+ if record["lane"] not in {lane["id"] for lane in protocol["lanes"]}:
+ error("record: unsupported protocol lane")
+ decision = record["decision_and_scope"]
+ if decision["decision"] not in protocol["adoption_decisions"]:
+ error("record: unsupported protocol decision")
+ runs, assessment = record["observations"], record["usage_assessment"]
+ by_id = {run["id"]: run for run in runs}
+ if len(by_id) != len(runs):
+ error("observations: duplicate run ID")
+ failures = [item["run_id"] for item in record["failures_and_skips"]]
+ if len(set(failures)) != len(failures) or set(failures) != {run["id"] for run in runs if run["status"] != "passed"}:
+ error("failures_and_skips: must cover every non-passed run exactly once")
+ if record["status"] == "planned":
+ if runs or failures or decision["qualification_run_ids"] or assessment != {
+ "claim": "none", "coverage": "partial", "expected_run_ids": [], "coverage_artifact": None}:
+ error("planned record: observations, qualifications or usage assertions forbidden")
+ elif not runs:
+ error("observed record: at least one run required")
+ if record["baseline_and_candidate"]["baseline"] == record["baseline_and_candidate"]["candidate"]:
+ error("baseline_and_candidate: distinct conditions required")
+ attempts = defaultdict(list)
+ for index, run in enumerate(runs):
+ label = f"observations[{index}]"
+ if run["task"] not in record["frozen_inputs"]["tasks"] or run["role"] not in record["frozen_inputs"]["roles"]:
+ error(f"{label}: undeclared task or role")
+ if run["command_index"] >= len(record["commands"]):
+ error(f"{label}: undeclared command")
+ if run["evidence_class"] not in protocol["evidence_classes"]:
+ error(f"{label}: unsupported evidence class")
+ attempts[(run["task"], run["role"], run["condition"])].append(run["attempt"])
+ if run["status"] == "passed" and (run["exit_code"] != 0 or False in run["quality"].values()):
+ error(f"{label}: passed run contradicts exit or quality")
+ if run["status"] == "skipped" and (run["exit_code"] is not None or any(value is not None for value in run["quality"].values())):
+ error(f"{label}: skipped run cannot have exit or graded quality")
+ usage = run["usage"]
+ if usage["total"] is not None:
+ known_sum = sum(usage[key] for key in INPUT_OUTPUT if usage[key] is not None)
+ if known_sum > usage["total"]:
+ error(f"{label}: known usage categories exceed total")
+ elif all(usage[key] is not None for key in INPUT_OUTPUT) and known_sum != usage["total"]:
+ error(f"{label}: disjoint usage categories do not equal total")
+ if usage["reasoning_in_output"] is not None and usage["output"] is not None and usage["reasoning_in_output"] > usage["output"]:
+ error(f"{label}: reasoning exceeds inclusive output")
+ if any(len(values) != len(set(values)) for values in attempts.values()):
+ error("observations: duplicate task/role/condition attempt")
+ qualifications = decision["qualification_run_ids"]
+ if decision["decision"] == "adopt_within_scope" and (record["status"] != "observed" or not qualifications):
+ error("adopt_within_scope: observed scoped qualification required")
+ for identifier in qualifications:
+ run = by_id.get(identifier)
+ if (run is None or not accepted(run) or run["condition"] != "candidate"
+ or run["scope"] != decision["scope"] or run["evidence_class"] not in EXECUTION):
+ error("qualification_run_ids: successful candidate execution in exact scope required")
+ expected = assessment["expected_run_ids"]
+ if not set(expected) <= by_id.keys():
+ error("usage_assessment: expected run IDs include absent observations")
+ if assessment["coverage"] == "complete":
+ artifact = assessment["coverage_artifact"]
+ if not runs or set(expected) != by_id.keys() or artifact is None:
+ error("usage_assessment: complete coverage needs every run and audit artifact")
+ else:
+ path = validator.path(artifact["path"], "usage_assessment.coverage_artifact")
+ if path is not None:
+ try:
+ ledger = read_json(path)
+ if (not isinstance(ledger, dict) or set(ledger) != {"run_ids", "complete"}
+ or ledger["complete"] is not True or ledger["run_ids"] != expected):
+ error("usage_assessment: coverage artifact disagrees with declared run IDs")
+ except (OSError, ValueError):
+ error("usage_assessment: invalid coverage JSON")
+ if assessment["claim"] == "whole_task_token_savings":
+ required = {(task, role, condition) for task in record["frozen_inputs"]["tasks"]
+ for role in record["frozen_inputs"]["roles"] for condition in ("baseline", "candidate")}
+ known = all(all(value is not None for value in run["usage"].values()) for run in runs)
+ if assessment["coverage"] != "complete" or set(attempts) != required:
+ error("savings claim: complete matched task/role/condition coverage required")
+ if any(sorted(values) != list(range(1, len(values) + 1)) for values in attempts.values()):
+ error("savings claim: consecutive attempt coverage required")
+ if not runs or not known or not all(accepted(run) for run in runs):
+ error("savings claim: every attempt needs passing quality and complete known usage")
+ elif any(run["evidence_class"] not in EXECUTION or run["scope"] != decision["scope"] for run in runs):
+ error("savings claim: scoped execution evidence required for every attempt")
+ elif sum(run["usage"]["total"] for run in runs if run["condition"] == "candidate") >= sum(run["usage"]["total"] for run in runs if run["condition"] == "baseline"):
+ error("savings claim: candidate total must be lower than baseline")
+
+
+def validate_record(root, relative_path):
+ validator = Validator(root)
+ if Path(root).is_symlink():
+ return {"valid": False, "errors": ["root: symlinks are forbidden"], "observations": 0}
+ path = validator.path(relative_path, "record")
+ record = None
+ if path is not None:
+ try:
+ record = read_json(path)
+ schema = read_json(CONTRACT / "contract.schema.json")
+ structure(record, schema, schema["$defs"], "record", validator.errors)
+ if not validator.errors:
+ check_artifacts(record, validator)
+ consistency(record, validator)
+ except (OSError, ValueError):
+ validator.error("record: unreadable or invalid JSON")
+ return {"valid": not validator.errors, "errors": validator.errors,
+ "observations": len(record.get("observations", [])) if isinstance(record, dict) and isinstance(record.get("observations"), list) else 0}
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("records", nargs="+", help="Canonical paths relative to --root")
+ parser.add_argument("--root", type=Path, default=REPO)
+ parser.add_argument("--json", action="store_true")
+ args = parser.parse_args()
+ results = [validate_record(args.root, path) for path in args.records]
+ valid = all(item["valid"] for item in results)
+ if args.json:
+ print(json.dumps({"valid": valid, "records": results}, sort_keys=True))
+ else:
+ for index, result in enumerate(results):
+ print(f"record[{index}]: {'valid' if result['valid'] else 'invalid'}")
+ for error in result["errors"]:
+ print(f" {error}")
+ return 0 if valid else 1
+
+
+if __name__ == "__main__":
+ raise SystemExit(main())
diff --git a/tests/fixtures/workflow-security/unsafe.yml.txt b/tests/fixtures/workflow-security/unsafe.yml.txt
new file mode 100644
index 000000000..1a332b75c
--- /dev/null
+++ b/tests/fixtures/workflow-security/unsafe.yml.txt
@@ -0,0 +1,11 @@
+# Deliberately unsafe input for static analysis only. Never run this workflow.
+name: Unsafe analysis fixture
+on: pull_request
+permissions:
+ contents: read
+jobs:
+ unsafe:
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@main
+ - run: echo '${{ github.event.pull_request.title }}'
diff --git a/tests/test_convergence_contract.py b/tests/test_convergence_contract.py
new file mode 100644
index 000000000..ac187fab3
--- /dev/null
+++ b/tests/test_convergence_contract.py
@@ -0,0 +1,279 @@
+"""Synthetic evidence tests; never start a native client or execute record commands."""
+
+import copy
+import hashlib
+import json
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+
+from scripts.validate_convergence import CONTRACT, REPO, validate_record
+
+
+class ConvergenceContractTests(unittest.TestCase):
+ def setUp(self):
+ temporary = tempfile.TemporaryDirectory()
+ self.addCleanup(temporary.cleanup)
+ self.root = Path(temporary.name)
+ self.artifact = self.write("fixture.txt", b"abc")
+ reference = (CONTRACT / "contract-reference.md").read_text(encoding="utf-8")
+ self.record = json.loads(re.search(r"```json\n(.*?)\n```", reference, re.S).group(1))
+
+ def write(self, path, raw):
+ target = self.root / path
+ target.parent.mkdir(parents=True, exist_ok=True)
+ target.write_bytes(raw)
+ return {"path": path, "sha256": hashlib.sha256(raw).hexdigest()}
+
+ def result(self):
+ self.write("record.json", json.dumps(self.record).encode())
+ return validate_record(self.root, "record.json")
+
+ def assert_invalid(self, fragment):
+ result = self.result()
+ self.assertFalse(result["valid"], result)
+ self.assertIn(fragment, "\n".join(result["errors"]))
+
+ def run_record(self, identifier="candidate-1", condition="candidate"):
+ return {
+ "id": identifier, "task": "patch-a", "role": "worker", "condition": condition,
+ "attempt": 1, "command_index": 0, "evidence_class": "offline_artifact_check",
+ "scope": "fixture only", "status": "passed", "exit_code": 0,
+ "quality": {"semantic": True, "contract": True}, "artifacts": [copy.deepcopy(self.artifact)],
+ "usage": {key: None for key in ("uncached_input", "cache_creation", "cache_read", "output", "reasoning_in_output", "total", "native_retries")},
+ }
+
+ def observed(self):
+ self.record["status"] = "observed"
+ self.record["observations"] = [self.run_record()]
+
+ def savings(self):
+ self.observed()
+ self.record["observations"].insert(0, self.run_record("baseline-1", "baseline"))
+ for index, run in enumerate(self.record["observations"]):
+ run["usage"] = {"uncached_input": 50 if index == 0 else 10, "cache_creation": 5,
+ "cache_read": 20, "output": 10, "reasoning_in_output": 4,
+ "total": 85 if index == 0 else 45, "native_retries": 0}
+ self.coverage()
+
+ def coverage(self):
+ identifiers = [run["id"] for run in self.record["observations"]]
+ artifact = self.write("coverage.json", json.dumps({"run_ids": identifiers, "complete": True}).encode())
+ self.record["usage_assessment"] = {"claim": "whole_task_token_savings", "coverage": "complete",
+ "expected_run_ids": identifiers, "coverage_artifact": artifact}
+
+ def test_documented_minimal_plan_is_valid_and_not_executed(self):
+ self.record["commands"] = ["this command must never execute"]
+ self.assertEqual(self.result(), {"valid": True, "errors": [], "observations": 0})
+
+ def test_all_protocol_evidence_fields_are_required(self):
+ original = copy.deepcopy(self.record)
+ protocol = json.loads((CONTRACT / "protocol.json").read_text())
+ for field in protocol["required_experiment_fields"]:
+ with self.subTest(field=field):
+ self.record = copy.deepcopy(original)
+ del self.record[field]
+ self.assert_invalid("missing required fields")
+
+ def test_unknown_fields_do_not_echo_values_or_keys(self):
+ self.record["DO_NOT_ECHO_SECRET_KEY"] = "DO_NOT_ECHO_SECRET_VALUE"
+ result = self.result()
+ self.assertFalse(result["valid"])
+ self.assertNotIn("DO_NOT_ECHO", json.dumps(result))
+
+ def test_boolean_counts_and_invalid_pins_rejected(self):
+ self.observed()
+ for field in ("attempt", "command_index", "exit_code"):
+ with self.subTest(field=field):
+ original = self.record["observations"][0][field]
+ self.record["observations"][0][field] = True
+ self.assert_invalid("invalid type")
+ self.record["observations"][0][field] = original
+ self.record["frozen_inputs"]["base_revision"] = "main"
+ self.assert_invalid("invalid text format")
+
+ def test_artifact_bytes_must_match_actual_hash(self):
+ (self.root / "fixture.txt").write_bytes(b"abd")
+ self.assert_invalid("SHA-256 mismatch")
+
+ def test_artifact_path_boundaries(self):
+ for path in ("/tmp/fixture.txt", "../fixture.txt", "a/../fixture.txt", "./fixture.txt",
+ "a//fixture.txt", "C:\\fixture.txt", ".git/config", "missing.txt"):
+ with self.subTest(path=path):
+ self.record["frozen_inputs"]["sources"][0]["path"] = path
+ self.assert_invalid("canonical" if path != "missing.txt" else "file missing")
+
+ def test_symlink_file_and_parent_refused_even_inside_root(self):
+ (self.root / "linked.txt").symlink_to(self.root / "fixture.txt")
+ (self.root / "linked-dir").symlink_to(self.root, target_is_directory=True)
+ for path in ("linked.txt", "linked-dir/fixture.txt"):
+ with self.subTest(path=path):
+ self.record["frozen_inputs"]["sources"][0]["path"] = path
+ self.assert_invalid("symlinks are forbidden")
+
+ def test_record_path_itself_is_confined(self):
+ self.result()
+ for path in ("../record.json", str(self.root / "record.json")):
+ self.assertFalse(validate_record(self.root, path)["valid"])
+ (self.root / "alias.json").symlink_to(self.root / "record.json")
+ self.assertIn("symlinks", " ".join(validate_record(self.root, "alias.json")["errors"]))
+
+ def test_duplicate_json_and_malformed_shapes_fail_cleanly(self):
+ for raw in (b'{"schema_version":1,"schema_version":1}', b'[]', b'{"observations":false}', b'NaN'):
+ with self.subTest(raw=raw):
+ self.write("record.json", raw)
+ self.assertFalse(validate_record(self.root, "record.json")["valid"])
+
+ def test_plans_cannot_contain_executed_or_adopted_claims(self):
+ self.record["observations"] = [self.run_record()]
+ self.assert_invalid("planned record")
+ self.record["observations"] = []
+ self.record["decision_and_scope"]["decision"] = "adopt_within_scope"
+ self.assert_invalid("observed scoped qualification required")
+
+ def test_observed_record_requires_actual_runs(self):
+ self.record["status"] = "observed"
+ self.assert_invalid("at least one run required")
+
+ def test_scoped_execution_can_qualify_without_known_usage(self):
+ self.observed()
+ self.record["decision_and_scope"].update(decision="adopt_within_scope", qualification_run_ids=["candidate-1"])
+ self.assertTrue(self.result()["valid"])
+ self.assertTrue(all(value is None for value in self.record["observations"][0]["usage"].values()))
+
+ def test_scope_baseline_discovery_or_unknown_quality_cannot_qualify(self):
+ self.observed()
+ self.record["decision_and_scope"].update(decision="adopt_within_scope", qualification_run_ids=["candidate-1"])
+ original = copy.deepcopy(self.record["observations"][0])
+ changes = ({"scope": "different host"}, {"condition": "baseline"},
+ {"evidence_class": "discovery"}, {"evidence_class": "pinned_source_review"},
+ {"quality": {"semantic": None, "contract": True}})
+ for change in changes:
+ with self.subTest(change=change):
+ self.record["observations"][0] = original | change
+ self.assert_invalid("successful candidate execution in exact scope required")
+
+ def test_failed_and_skipped_runs_are_preserved_exactly_once(self):
+ self.observed()
+ run = self.record["observations"][0]
+ run.update(status="failed", exit_code=1, quality={"semantic": False, "contract": None})
+ self.assert_invalid("every non-passed run exactly once")
+ self.record["failures_and_skips"] = [{"run_id": run["id"], "reason": "Synthetic test failure."}]
+ self.assertTrue(self.result()["valid"])
+ self.record["failures_and_skips"].append(copy.deepcopy(self.record["failures_and_skips"][0]))
+ self.assert_invalid("every non-passed run exactly once")
+
+ def test_skips_cannot_claim_exits_or_quality(self):
+ self.observed()
+ run = self.record["observations"][0]
+ run.update(status="skipped", exit_code=None, quality={"semantic": None, "contract": None})
+ self.record["failures_and_skips"] = [{"run_id": run["id"], "reason": "Missing prerequisite."}]
+ self.assertTrue(self.result()["valid"])
+ run["exit_code"] = 0
+ self.assert_invalid("skipped run cannot have exit")
+
+ def test_zero_exit_does_not_override_failed_contract(self):
+ self.observed()
+ self.record["observations"][0]["quality"]["contract"] = False
+ self.assert_invalid("passed run contradicts exit or quality")
+
+ def test_runs_must_use_declared_tasks_roles_commands_and_unique_attempts(self):
+ self.observed()
+ original = copy.deepcopy(self.record["observations"][0])
+ for change in ({"task": "unknown"}, {"role": "unknown"}, {"command_index": 1}):
+ with self.subTest(change=change):
+ self.record["observations"][0] = original | change
+ self.assert_invalid("undeclared")
+ self.record["observations"] = [original, copy.deepcopy(original)]
+ self.assert_invalid("duplicate run ID")
+ self.record["observations"][1]["id"] = "other"
+ self.assert_invalid("duplicate task/role/condition attempt")
+
+ def test_cache_and_reasoning_are_not_double_counted(self):
+ self.savings()
+ self.assertTrue(self.result()["valid"])
+ usage = self.record["observations"][0]["usage"]
+ usage["total"] += usage["reasoning_in_output"]
+ self.assert_invalid("disjoint usage categories do not equal total")
+ usage["total"] -= usage["reasoning_in_output"]
+ usage["reasoning_in_output"] = usage["output"] + 1
+ self.assert_invalid("reasoning exceeds inclusive output")
+
+ def test_partial_or_unknown_usage_never_supports_savings(self):
+ self.savings()
+ for key in self.record["observations"][0]["usage"]:
+ with self.subTest(key=key):
+ original = self.record["observations"][0]["usage"][key]
+ self.record["observations"][0]["usage"][key] = None
+ self.assert_invalid("complete known usage")
+ self.record["observations"][0]["usage"][key] = original
+ self.record["usage_assessment"]["coverage"] = "partial"
+ self.assert_invalid("complete matched task/role/condition coverage")
+
+ def test_known_usage_subset_cannot_exceed_total_even_with_unknown_categories(self):
+ self.observed()
+ self.record["observations"][0]["usage"].update(cache_read=20, total=10)
+ self.assert_invalid("known usage categories exceed total")
+
+ def test_savings_require_execution_evidence_in_same_scope(self):
+ self.savings()
+ run = self.record["observations"][0]
+ run["scope"] = "different task boundary"
+ self.assert_invalid("scoped execution evidence required")
+ run["scope"] = "fixture only"
+ run["evidence_class"] = "pinned_source_review"
+ self.assert_invalid("scoped execution evidence required")
+
+ def test_uncovered_role_or_task_invalidates_whole_task_claim(self):
+ self.savings()
+ self.record["frozen_inputs"]["roles"].append("coordinator")
+ self.assert_invalid("complete matched task/role/condition coverage")
+ self.record["frozen_inputs"]["roles"].remove("coordinator")
+ self.record["frozen_inputs"]["tasks"].append("patch-b")
+ self.assert_invalid("complete matched task/role/condition coverage")
+
+ def test_missing_attempt_and_changed_coverage_ledger_rejected(self):
+ self.savings()
+ self.record["observations"][0]["attempt"] = 2
+ self.assert_invalid("consecutive attempt coverage")
+ self.record["observations"][0]["attempt"] = 1
+ self.record["usage_assessment"]["coverage_artifact"] = self.write("coverage.json", b'{"run_ids":[],"complete":true}')
+ self.assert_invalid("coverage artifact disagrees")
+
+ def test_coverage_must_list_every_attempt(self):
+ self.savings()
+ self.record["usage_assessment"]["expected_run_ids"].pop()
+ self.assert_invalid("complete coverage needs every run")
+
+ def test_cheaper_failed_or_ungraded_result_is_not_accepted_efficiency(self):
+ self.savings()
+ run = self.record["observations"][1]
+ run["quality"]["semantic"] = None
+ self.assert_invalid("every attempt needs passing quality")
+ run.update(status="failed", exit_code=0, quality={"semantic": True, "contract": False})
+ self.record["failures_and_skips"] = [{"run_id": run["id"], "reason": "Word limit failed."}]
+ self.assert_invalid("every attempt needs passing quality")
+
+ def test_equal_or_more_expensive_candidate_does_not_claim_savings(self):
+ self.savings()
+ self.record["observations"][1]["usage"] = copy.deepcopy(self.record["observations"][0]["usage"])
+ self.assert_invalid("candidate total must be lower")
+
+ def test_cli_json_and_exit_status(self):
+ self.result()
+ command = [sys.executable, str(REPO / "scripts/validate_convergence.py"), "record.json", "--root", str(self.root), "--json"]
+ passed = subprocess.run(command, capture_output=True, text=True, timeout=10, check=False)
+ self.assertEqual(passed.returncode, 0, passed.stderr)
+ self.assertTrue(json.loads(passed.stdout)["valid"])
+ self.record["status"] = "observed"
+ self.result()
+ failed = subprocess.run(command, capture_output=True, text=True, timeout=10, check=False)
+ self.assertEqual(failed.returncode, 1)
+ self.assertFalse(json.loads(failed.stdout)["valid"])
+
+
+if __name__ == "__main__":
+ unittest.main()
diff --git a/tests/test_workflow_security.py b/tests/test_workflow_security.py
new file mode 100644
index 000000000..b697c0bda
--- /dev/null
+++ b/tests/test_workflow_security.py
@@ -0,0 +1,63 @@
+"""Use native offline analysis; the unsafe workflow is never executed."""
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+ZIZMOR = shutil.which("zizmor")
+
+
+@unittest.skipUnless(ZIZMOR, "native zizmor unavailable; CI installs the pinned analyzer")
+class WorkflowSecurityTests(unittest.TestCase):
+ def analyze(self, workflow, directory):
+ # No credential is needed for offline, local static analysis.
+ environment = {
+ key: value for key, value in os.environ.items()
+ if key not in {"GH_TOKEN", "GITHUB_TOKEN", "ZIZMOR_GITHUB_TOKEN"}
+ }
+ result = subprocess.run(
+ [ZIZMOR, "--offline", "--no-config", "--no-ignores", "--no-progress",
+ "--persona", "regular", "--strict-collection", "--format", "json",
+ "--cache-dir", str(directory / "cache"), str(workflow)],
+ cwd=directory, env=environment, stdin=subprocess.DEVNULL,
+ capture_output=True, text=True, timeout=30, check=False,
+ )
+ try:
+ findings = json.loads(result.stdout)
+ except json.JSONDecodeError:
+ self.fail(f"zizmor did not return JSON (exit {result.returncode}): "
+ f"{result.stderr[:2000]}")
+ self.assertIsInstance(findings, list)
+ return result, findings
+
+ def test_published_workflow_has_no_offline_findings(self):
+ with tempfile.TemporaryDirectory() as temporary:
+ result, findings = self.analyze(
+ ROOT / ".github/workflows/validate.yml", Path(temporary),
+ )
+ self.assertEqual(result.returncode, 0, result.stderr[:2000])
+ self.assertEqual(findings, [])
+
+ def test_unsafe_fixture_reports_injection_and_unpinned_action(self):
+ fixture = ROOT / "tests/fixtures/workflow-security/unsafe.yml.txt"
+ with tempfile.TemporaryDirectory() as temporary:
+ directory = Path(temporary)
+ workflow = directory / "unsafe.yml"
+ original = fixture.read_bytes()
+ workflow.write_bytes(original)
+ result, findings = self.analyze(workflow, directory)
+ self.assertEqual(workflow.read_bytes(), original)
+ self.assertEqual(result.returncode, 14, result.stderr[:2000])
+ identifiers = {finding["ident"] for finding in findings}
+ self.assertTrue({"template-injection", "unpinned-uses"} <= identifiers,
+ identifiers)
+
+
+if __name__ == "__main__":
+ unittest.main()
From ebb250e9cbe2de96a61d26daee37ae2e15fed2f7 Mon Sep 17 00:00:00 2001
From: seathatflowsinourveins
<234074349+seathatflowsinourveins@users.noreply.github.com>
Date: Sun, 20 Sep 2026 00:27:42 -0400
Subject: [PATCH 3/5] Reject unmatched savings and superseded qualification
claims
---
.../contract-reference.md | 13 ++++--
scripts/validate_convergence.py | 7 +++
tests/test_convergence_contract.py | 45 +++++++++++++++++++
3 files changed, 62 insertions(+), 3 deletions(-)
diff --git a/blueprints/convergence-practice/contract-reference.md b/blueprints/convergence-practice/contract-reference.md
index 46a2b66b2..9554d8204 100644
--- a/blueprints/convergence-practice/contract-reference.md
+++ b/blueprints/convergence-practice/contract-reference.md
@@ -74,6 +74,9 @@ Planned records have no runs, failures, qualifications or usage claim.
both quality checks true, matching decision scope, and an execution evidence
class (`offline_artifact_check`, `native_cli_execution`, `model_task_execution`
or `recovery_execution`). Discovery and source review cannot qualify adoption.
+Each qualification must be the latest numbered candidate attempt for its
+task/role/scope. A later failed or skipped attempt prevents reuse of an earlier
+success; an earlier failure followed by a qualifying success remains recorded.
This is a necessary evidence check, not authority to install or promote globally.
## Usage and matched comparisons
@@ -93,9 +96,13 @@ and a hashed JSON `coverage_artifact` containing exactly
`{"run_ids": ["…"], "complete": true}`. This is an explicit audit assertion;
software cannot discover omitted external calls. `whole_task_token_savings`
additionally requires every declared task/role in both conditions, consecutive
-attempt numbers from one, execution evidence in the declared scope, complete
-known usage/retry categories, passed quality for every attempt, and strictly
-lower summed candidate tokens. All coordinator,
+attempt numbers from one, equal passing attempt counts for each task/role pair,
+execution evidence in the declared scope, complete known usage/retry categories,
+passed quality for every attempt, and strictly lower summed candidate tokens.
+Unequal outer resubmission counts remain reportable observations, but this v1
+contract conservatively refuses their savings claim. Extra baseline attempts
+must not manufacture a saving. Failed attempts remain retained and also prevent
+accepted efficiency. All coordinator,
preparation, review and other roles in the actual task boundary must be declared;
excluded roles or attempts make coverage partial; any unknown usage prevents
this claim even when the attempt inventory is complete.
diff --git a/scripts/validate_convergence.py b/scripts/validate_convergence.py
index 441ae11c4..c87f3e181 100644
--- a/scripts/validate_convergence.py
+++ b/scripts/validate_convergence.py
@@ -140,6 +140,10 @@ def consistency(record, validator):
if (run is None or not accepted(run) or run["condition"] != "candidate"
or run["scope"] != decision["scope"] or run["evidence_class"] not in EXECUTION):
error("qualification_run_ids: successful candidate execution in exact scope required")
+ elif any(other["condition"] == "candidate" and other["task"] == run["task"]
+ and other["role"] == run["role"] and other["scope"] == run["scope"]
+ and other["attempt"] > run["attempt"] for other in runs):
+ error("qualification_run_ids: latest candidate attempt in task/role/scope required")
expected = assessment["expected_run_ids"]
if not set(expected) <= by_id.keys():
error("usage_assessment: expected run IDs include absent observations")
@@ -165,6 +169,9 @@ def consistency(record, validator):
error("savings claim: complete matched task/role/condition coverage required")
if any(sorted(values) != list(range(1, len(values) + 1)) for values in attempts.values()):
error("savings claim: consecutive attempt coverage required")
+ if any(len(attempts.get((task, role, "baseline"), [])) != len(attempts.get((task, role, "candidate"), []))
+ for task in record["frozen_inputs"]["tasks"] for role in record["frozen_inputs"]["roles"]):
+ error("savings claim: equal passing attempt counts required per task and role")
if not runs or not known or not all(accepted(run) for run in runs):
error("savings claim: every attempt needs passing quality and complete known usage")
elif any(run["evidence_class"] not in EXECUTION or run["scope"] != decision["scope"] for run in runs):
diff --git a/tests/test_convergence_contract.py b/tests/test_convergence_contract.py
index ac187fab3..97da20431 100644
--- a/tests/test_convergence_contract.py
+++ b/tests/test_convergence_contract.py
@@ -156,6 +156,29 @@ def test_scope_baseline_discovery_or_unknown_quality_cannot_qualify(self):
self.record["observations"][0] = original | change
self.assert_invalid("successful candidate execution in exact scope required")
+ def test_later_failed_or_skipped_candidate_invalidates_earlier_qualification(self):
+ self.observed()
+ self.record["decision_and_scope"].update(decision="adopt_within_scope", qualification_run_ids=["candidate-1"])
+ later = self.run_record("candidate-2")
+ later.update(attempt=2, status="failed", exit_code=1, quality={"semantic": False, "contract": False})
+ self.record["observations"].append(later)
+ self.record["failures_and_skips"] = [{"run_id": "candidate-2", "reason": "Later attempt failed."}]
+ self.assert_invalid("latest candidate attempt in task/role/scope required")
+ later.update(status="skipped", exit_code=None, quality={"semantic": None, "contract": None})
+ self.record["failures_and_skips"][0]["reason"] = "Later attempt skipped."
+ self.assert_invalid("latest candidate attempt in task/role/scope required")
+
+ def test_later_success_can_qualify_with_earlier_failure_retained(self):
+ self.observed()
+ earlier = self.record["observations"][0]
+ earlier.update(status="failed", exit_code=1, quality={"semantic": False, "contract": False})
+ later = self.run_record("candidate-2")
+ later["attempt"] = 2
+ self.record["observations"].append(later)
+ self.record["failures_and_skips"] = [{"run_id": "candidate-1", "reason": "Earlier attempt failed."}]
+ self.record["decision_and_scope"].update(decision="adopt_within_scope", qualification_run_ids=["candidate-2"])
+ self.assertTrue(self.result()["valid"])
+
def test_failed_and_skipped_runs_are_preserved_exactly_once(self):
self.observed()
run = self.record["observations"][0]
@@ -262,6 +285,28 @@ def test_equal_or_more_expensive_candidate_does_not_claim_savings(self):
self.record["observations"][1]["usage"] = copy.deepcopy(self.record["observations"][0]["usage"])
self.assert_invalid("candidate total must be lower")
+ def test_extra_passing_baseline_attempt_cannot_manufacture_savings(self):
+ self.savings()
+ baseline = copy.deepcopy(self.record["observations"][0])
+ baseline.update(id="baseline-2", attempt=2)
+ self.record["observations"].append(baseline)
+ # Each baseline costs85; the sole candidate costs105. Summing the two
+ # baseline attempts would incorrectly make the worse candidate look cheaper.
+ self.record["observations"][1]["usage"].update(uncached_input=70, total=105)
+ self.coverage()
+ self.assert_invalid("equal passing attempt counts required per task and role")
+
+ def test_matching_passing_attempt_counts_use_known_aggregate_sums(self):
+ self.savings()
+ second = copy.deepcopy(self.record["observations"])
+ for run in second:
+ run.update(id=f'{run["condition"]}-2', attempt=2)
+ self.record["observations"].extend(second)
+ self.coverage()
+ self.assertEqual(sum(run["usage"]["total"] for run in self.record["observations"] if run["condition"] == "baseline"), 170)
+ self.assertEqual(sum(run["usage"]["total"] for run in self.record["observations"] if run["condition"] == "candidate"), 90)
+ self.assertTrue(self.result()["valid"])
+
def test_cli_json_and_exit_status(self):
self.result()
command = [sys.executable, str(REPO / "scripts/validate_convergence.py"), "record.json", "--root", str(self.root), "--json"]
From ba30cc80caef9ce32909c2e6f7d152f1e0edee98 Mon Sep 17 00:00:00 2001
From: seathatflowsinourveins
<234074349+seathatflowsinourveins@users.noreply.github.com>
Date: Sun, 20 Sep 2026 00:35:21 -0400
Subject: [PATCH 4/5] Publish scoped native engineering convergence with
observed child repair
---
.github/requirements-ci.lock | 5 +
.github/workflows/validate.yml | 13 +
AGENTS.md | 5 +
README.md | 8 +-
adoption/manifest.json | 7 +-
blueprints/convergence-practice/README.md | 7 +
.../ci-security/README.md | 33 ++
.../ci-security/experiment.json | 123 ++++++
.../ci-security/observation.json | 24 ++
.../ci-security/receipt.json | 15 +
.../native-worker/README.md | 72 ++++
.../native-worker/accepted/planner.py | 54 +++
.../native-worker/checks.json | 32 ++
.../native-worker/experiment.json | 198 ++++++++++
.../native-worker/independent-review.json | 61 +++
.../native-worker/independent_review.py | 184 +++++++++
.../native-worker/plan.json | 29 ++
.../native-worker/prompt.txt | 1 +
.../native-worker/receipt.json | 16 +
.../native-worker/test-output.txt | 17 +
.../native-worker/usage.json | 66 ++++
.../convergence-practice/validation.json | 47 +++
.../architecture-wave/README.md | 43 ++
.../UKGovernmentBEIS__inspect_ai.json | 127 ++++++
.../architecture-wave/astral-sh__uv.json | 158 ++++++++
.../architecture-wave/dagucloud__dagu.json | 179 +++++++++
.../eyuansu62__agent-retrieval-bench.json | 157 ++++++++
.../harbor-framework__harbor.json | 128 ++++++
.../jaywcjlove__awesome-mac.json | 162 ++++++++
.../jgravelle__jcodemunch-mcp.json | 155 ++++++++
.../architecture-wave/own-repository.json | 14 +
.../architecture-wave/public-star-delta.json | 368 ++++++++++++++++++
.../architecture-wave/sigstore__cosign.json | 138 +++++++
.../architecture-wave/source-review.json | 275 +++++++++++++
.../architecture-wave/tobi__qmd.json | 185 +++++++++
.../architecture-wave/zizmorcore__zizmor.json | 126 ++++++
catalogs/us-equities/README.md | 2 +-
catalogs/us-equities/decision-index.json | 87 ++++-
catalogs/us-equities/manifest.json | 8 +-
docs/convergence-architecture.md | 19 +-
docs/ecosystem/README.md | 2 +-
docs/ecosystem/index.html | 2 +-
manifests/evidence.json | 283 ++++++++++++--
manifests/stack.json | 26 +-
observability/grand-dashboard/state.json | 16 +-
tests/test_native_worker_fixture.py | 37 ++
46 files changed, 3667 insertions(+), 47 deletions(-)
create mode 100644 .github/requirements-ci.lock
create mode 100644 blueprints/convergence-practice/ci-security/README.md
create mode 100644 blueprints/convergence-practice/ci-security/experiment.json
create mode 100644 blueprints/convergence-practice/ci-security/observation.json
create mode 100644 blueprints/convergence-practice/ci-security/receipt.json
create mode 100644 blueprints/convergence-practice/native-worker/README.md
create mode 100644 blueprints/convergence-practice/native-worker/accepted/planner.py
create mode 100644 blueprints/convergence-practice/native-worker/checks.json
create mode 100644 blueprints/convergence-practice/native-worker/experiment.json
create mode 100644 blueprints/convergence-practice/native-worker/independent-review.json
create mode 100644 blueprints/convergence-practice/native-worker/independent_review.py
create mode 100644 blueprints/convergence-practice/native-worker/plan.json
create mode 100644 blueprints/convergence-practice/native-worker/prompt.txt
create mode 100644 blueprints/convergence-practice/native-worker/receipt.json
create mode 100644 blueprints/convergence-practice/native-worker/test-output.txt
create mode 100644 blueprints/convergence-practice/native-worker/usage.json
create mode 100644 blueprints/convergence-practice/validation.json
create mode 100644 catalogs/convergence-practice/architecture-wave/README.md
create mode 100644 catalogs/convergence-practice/architecture-wave/UKGovernmentBEIS__inspect_ai.json
create mode 100644 catalogs/convergence-practice/architecture-wave/astral-sh__uv.json
create mode 100644 catalogs/convergence-practice/architecture-wave/dagucloud__dagu.json
create mode 100644 catalogs/convergence-practice/architecture-wave/eyuansu62__agent-retrieval-bench.json
create mode 100644 catalogs/convergence-practice/architecture-wave/harbor-framework__harbor.json
create mode 100644 catalogs/convergence-practice/architecture-wave/jaywcjlove__awesome-mac.json
create mode 100644 catalogs/convergence-practice/architecture-wave/jgravelle__jcodemunch-mcp.json
create mode 100644 catalogs/convergence-practice/architecture-wave/own-repository.json
create mode 100644 catalogs/convergence-practice/architecture-wave/public-star-delta.json
create mode 100644 catalogs/convergence-practice/architecture-wave/sigstore__cosign.json
create mode 100644 catalogs/convergence-practice/architecture-wave/source-review.json
create mode 100644 catalogs/convergence-practice/architecture-wave/tobi__qmd.json
create mode 100644 catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json
create mode 100644 tests/test_native_worker_fixture.py
diff --git a/.github/requirements-ci.lock b/.github/requirements-ci.lock
new file mode 100644
index 000000000..724097897
--- /dev/null
+++ b/.github/requirements-ci.lock
@@ -0,0 +1,5 @@
+# Linux x86_64 / Python >=3.10. Official PyPI wheel, reviewed 2026-09-20.
+# zizmor has no Python distribution dependencies at this version.
+# https://pypi.org/pypi/zizmor/1.30.1/json
+zizmor==1.30.1 \
+ --hash=sha256:eee12266b793cb87ad4a7e3af2e72404f8a63e3de5eb099b80bf7b1cfd232a8e
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 4596787b8..b2b36733f 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -17,10 +17,23 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
+ - name: Install checksum-locked CI analyzer
+ run: >-
+ python3 -m pip install --disable-pip-version-check --no-input
+ --only-binary=:all: --require-hashes
+ --index-url https://pypi.org/simple
+ -r .github/requirements-ci.lock
+ - name: Audit GitHub workflows without network or credentials
+ run: zizmor --offline --no-config --no-ignores --persona regular --strict-collection .github/workflows
- name: Validate manifests and evidence integrity
run: python3 scripts/validate.py
- name: Validate catalog evidence and coverage joins
run: python3 scripts/validate_catalogs.py
+ - name: Validate declared convergence evidence and scope
+ run: >-
+ python3 scripts/validate_convergence.py
+ blueprints/convergence-practice/ci-security/experiment.json
+ blueprints/convergence-practice/native-worker/experiment.json --root . --json
- name: Check offline ecosystem explorer rebuild
run: python3 scripts/build_ecosystem.py --check
- name: Test validation failure modes
diff --git a/AGENTS.md b/AGENTS.md
index 212ac2117..962ff9bde 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,6 +13,11 @@ Use upstream executables and supported integration formats. Keep client accounts
One coordinator integrates. Writing workers need separate worktrees and bounded file ownership. Evidence belongs in compact sanitized receipts; no raw conversations, tokens, personal paths or machine-specific active client configuration.
+For general engineering and ecosystem changes, start with
+`docs/convergence-architecture.md`. New convergence claims use
+`scripts/validate_convergence.py` with a scoped experiment record. Preserve failed
+attempts and unknown usage; the checker verifies declared consistency, not truth.
+
The north star is US-equities research/backtesting followed by Alpaca paper.
Read `catalogs/us-equities/README.md` for selection and `blueprints/us-equities/north-star.md`
for boundaries; load only the layer needed for the current task. The native
diff --git a/README.md b/README.md
index ea0dbdddf..0c3a05a4c 100644
--- a/README.md
+++ b/README.md
@@ -16,10 +16,16 @@ executed external retrieval comparison and a reusable acceptance protocol for
native agent work, recovery and local inference. Research findings remain
separate from a new host's runtime acceptance.
+For general software work, start with the **[convergence architecture](docs/convergence-architecture.md)**.
+It connects compact task contracts, native workers, scoped retrieval, complete
+attempt records and recoverable decisions. The latest wave adds executable
+claim checks, a verified Claude child repair, and pinned workflow-security
+analysis. [Ten-source review and current star delta](catalogs/convergence-practice/architecture-wave/README.md).
+
The **[US-equities grand catalog](catalogs/us-equities/README.md)** now covers
**147 unique repositories in 152 layer decision cards**, **20 model entries**,
and an auditable **342-star coverage ledger**. Its combined index includes
-**504 repository identities** across all 342 public stars and 162 beyond them,
+**505 repository identities** across all 342 public stars and 163 beyond them,
with typed, validated pointers to decisions and evidence. The latest
[architecture research wave](catalogs/us-equities/architecture/README.md) adds
source reviews, awesome-list coverage and official Alpaca constraints.
diff --git a/adoption/manifest.json b/adoption/manifest.json
index d02f09c44..6bd1984fc 100644
--- a/adoption/manifest.json
+++ b/adoption/manifest.json
@@ -44,7 +44,9 @@
"ecosystem_explorer_guide": "docs/ecosystem/README.md",
"current_lifecycle_sample": "blueprints/us-equities/lifecycle-sample/native-receipt.json",
"current_frozen_catalyst_protocol": "blueprints/us-equities/catalyst-experiment/protocol.json",
- "current_native_efficiency": "blueprints/us-equities/research-efficiency/native-receipt.json"
+ "current_native_efficiency": "blueprints/us-equities/research-efficiency/native-receipt.json",
+ "current_engineering_convergence": "docs/convergence-architecture.md",
+ "current_native_child_acceptance": "blueprints/convergence-practice/native-worker/receipt.json"
},
"recipe_map": {
"affaan-m/ECC": "recipes/README.md",
@@ -98,7 +100,8 @@
"pandas": "blueprints/us-equities/nanosecond-replay/README.md",
"systemd": "blueprints/us-equities/worker-supervision/README.md",
"skfolio": "blueprints/us-equities/research-evaluation/README.md",
- "edgartools": "blueprints/us-equities/catalyst-provenance/README.md"
+ "edgartools": "blueprints/us-equities/catalyst-provenance/README.md",
+ "zizmor": "blueprints/convergence-practice/ci-security/README.md"
},
"profiles": [
{
diff --git a/blueprints/convergence-practice/README.md b/blueprints/convergence-practice/README.md
index 424f6d93d..a65a992b6 100644
--- a/blueprints/convergence-practice/README.md
+++ b/blueprints/convergence-practice/README.md
@@ -13,6 +13,13 @@ It does not replace those receipts or transfer their acceptance to a new host.
SOTA is the research direction; this publication makes no universal best-stack
or end-to-end autonomous-system claim.
+The subsequent [architecture wave](../../catalogs/convergence-practice/architecture-wave/README.md)
+adds the [general engineering guide](../../docs/convergence-architecture.md), an
+[executable evidence contract](contract-reference.md),
+[native child repair](native-worker/README.md) and
+[workflow security qualification](ci-security/README.md). It retains the earlier
+retrieval results below and does not convert them into patch-success or savings claims.
+
## This wave's evidence
The [source review](../../catalogs/convergence-practice/source-review.md) refreshed
diff --git a/blueprints/convergence-practice/ci-security/README.md b/blueprints/convergence-practice/ci-security/README.md
new file mode 100644
index 000000000..9f80a3742
--- /dev/null
+++ b/blueprints/convergence-practice/ci-security/README.md
@@ -0,0 +1,33 @@
+# Native workflow security qualification
+
+The public CI now installs **zizmor 1.30.1** from a SHA-256-locked official PyPI
+wheel and analyzes workflows offline. It adds no persistent service or account.
+The Linux x86_64 wheel is isolated to GitHub's disposable Ubuntu runner; its
+[lock](../../../.github/requirements-ci.lock) is not a portable Mac install recipe.
+
+The [source review](../../../catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json)
+records the release commit, README and MIT license identity. The
+[native observation](observation.json) records the separately tested Mac binary.
+The current workflow has no findings under the regular persona. The deliberately
+unsafe fixture returns exit 14 with `template-injection`, `unpinned-uses` and
+`artipacked`. The fixture is inert text outside `.github`; it is never executed.
+
+Replay with the selected native executable available:
+
+```sh
+python3 -m unittest -v tests.test_workflow_security
+python3 scripts/validate_convergence.py blueprints/convergence-practice/ci-security/experiment.json --root . --json
+```
+
+The tests skip explicitly if zizmor is absent locally. CI installs the exact
+wheel first and fails if installation or analysis fails. Offline regular analysis
+does not cover all vulnerabilities, online advisories, secrets or supply-chain
+provenance. Pedantic analysis also reports missing job names and concurrency
+limits in the existing workflow; those advisory findings are outside this
+adopted regular-persona gate. The wheel checksum is integrity evidence, not a
+signature-verification claim. Changing versions requires source review, a new
+wheel hash and replay of both accepted and rejected cases.
+
+Rollback removes the selected CI analyzer step, lock and its tests together;
+the existing evidence and catalog validation remain the baseline. Public CI
+results qualify that runner only; another host must run its own acceptance.
diff --git a/blueprints/convergence-practice/ci-security/experiment.json b/blueprints/convergence-practice/ci-security/experiment.json
new file mode 100644
index 000000000..33fe6c6e3
--- /dev/null
+++ b/blueprints/convergence-practice/ci-security/experiment.json
@@ -0,0 +1,123 @@
+{
+ "schema_version": 1,
+ "kind": "convergence_experiment",
+ "status": "observed",
+ "lane": "native-agent-engineering",
+ "discovery_provenance": [
+ "Measured gap in public native workflow acceptance; stars and awesome lists used only for discovery."
+ ],
+ "license_and_compatibility": "See pinned source review; original fixture under repository MIT license. No new native authentication or model default.",
+ "predeclared_metrics": {
+ "quality_rule": "Preserve frozen acceptance oracle and inspect actual exit, changes and intended failure cases.",
+ "usage_rule": "Known native fields retained separately; unknown stays null; no savings claim."
+ },
+ "commands": [
+ "python3 -m unittest -v tests.test_workflow_security"
+ ],
+ "observations": [
+ {
+ "id": "ci-regular-pair",
+ "task": "workflow-analysis",
+ "role": "static-verifier",
+ "condition": "candidate",
+ "attempt": 1,
+ "command_index": 0,
+ "evidence_class": "native_cli_execution",
+ "scope": "Offline regular workflow analysis using native zizmor1.30.1 on macOS arm64",
+ "status": "passed",
+ "exit_code": 0,
+ "quality": {
+ "semantic": true,
+ "contract": true
+ },
+ "artifacts": [
+ {
+ "path": "blueprints/convergence-practice/ci-security/observation.json",
+ "sha256": "aebb8c8dd1b5d269fbbc1b3a3e66a591d3b7ea9f2caff23891ba6270ab55232f"
+ }
+ ],
+ "usage": {
+ "uncached_input": 0,
+ "cache_creation": 0,
+ "cache_read": 0,
+ "output": 0,
+ "reasoning_in_output": 0,
+ "total": 0,
+ "native_retries": 0
+ }
+ }
+ ],
+ "failures_and_skips": [],
+ "usage_assessment": {
+ "claim": "none",
+ "coverage": "partial",
+ "expected_run_ids": [],
+ "coverage_artifact": null
+ },
+ "task_and_failure": "Public CI lacked static workflow security analysis and a known-unsafe regression fixture.",
+ "primary_sources_and_pins": [
+ {
+ "url": "https://github.com/zizmorcore/zizmor",
+ "revision": "99a054ed9283c90abdd2d5b9fb5101d27dde9783"
+ }
+ ],
+ "baseline_and_candidate": {
+ "baseline": "Existing evidence and catalog validation only",
+ "candidate": "Pinned native offline workflow analysis with positive and negative fixture checks"
+ },
+ "frozen_inputs": {
+ "base_revision": "327d9badff0ad09ec0c1266e70b4ad361743c77f",
+ "tasks": [
+ "workflow-analysis"
+ ],
+ "roles": [
+ "static-verifier"
+ ],
+ "sources": [
+ {
+ "path": "catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json",
+ "sha256": "25c5ead3bb9660aeae390f7c0f3076e3db26014c3ac31d9f1686849d803ab679"
+ }
+ ],
+ "inputs": [
+ {
+ "path": ".github/workflows/validate.yml",
+ "sha256": "7f1657842cd563b64474a3c44bd0a24ce4aa2df81ad6cf977e193d9af11d13d9"
+ },
+ {
+ "path": "tests/fixtures/workflow-security/unsafe.yml.txt",
+ "sha256": "9e1c6130a396200387a0b9f1d445a33dbf154370db5460a3b50e086321bb737a"
+ }
+ ],
+ "evaluation": [
+ {
+ "path": "tests/test_workflow_security.py",
+ "sha256": "2c260c8d7fd58e747819037177ec9e077ee1cac7dc1e8ebd1ff7ddd1c405266b"
+ }
+ ]
+ },
+ "runtime_and_platform": {
+ "platform": "macOS arm64",
+ "tools": [
+ {
+ "name": "zizmor",
+ "version": "1.30.1"
+ }
+ ],
+ "isolation": "Local offline static analysis; unsafe workflow inert in disposable directory."
+ },
+ "limitations": [
+ "Offline regular analysis is scoped static evidence, not absence of every vulnerability or signature verification.",
+ "Mac binary and the checksum-locked Linux CI wheel are distinct artifacts; new runner execution is established by its own CI result.",
+ "The unsafe fixture was analyzed but never executed. No model calls, broker actions or savings measurement."
+ ],
+ "decision_and_scope": {
+ "decision": "adopt_within_scope",
+ "scope": "Offline regular workflow analysis using native zizmor1.30.1 on macOS arm64",
+ "qualification_run_ids": [
+ "ci-regular-pair"
+ ]
+ },
+ "rollback": "Remove analyzer step, lock and matching CI tests together; preserve prior validators.",
+ "next_decision_changing_test": "Run exact Linux wheel and both fixtures in public CI; broader persona or signature checks need separate evidence."
+}
diff --git a/blueprints/convergence-practice/ci-security/observation.json b/blueprints/convergence-practice/ci-security/observation.json
new file mode 100644
index 000000000..80cd322ba
--- /dev/null
+++ b/blueprints/convergence-practice/ci-security/observation.json
@@ -0,0 +1,24 @@
+{
+ "schema_version": 1,
+ "kind": "native_static_analysis_observation",
+ "platform": "macOS arm64",
+ "zizmor_version": "1.30.1",
+ "binary_sha256": "0717f7c8878caf12f3c8bdb99841bd5dff97e26f0481bba98f59169d414edc34",
+ "persona": "regular",
+ "network": "offline analysis; prior installation separate",
+ "published_workflow": {
+ "exit_code": 0,
+ "findings": []
+ },
+ "unsafe_fixture": {
+ "exit_code": 14,
+ "finding_identifiers": [
+ "artipacked",
+ "template-injection",
+ "unpinned-uses"
+ ]
+ },
+ "model_calls": 0,
+ "fixture_execution": false,
+ "scope": "Static analysis of retained workflow and synthetic unsafe fixture; not proof that all vulnerabilities are absent."
+}
diff --git a/blueprints/convergence-practice/ci-security/receipt.json b/blueprints/convergence-practice/ci-security/receipt.json
new file mode 100644
index 000000000..031a6ff44
--- /dev/null
+++ b/blueprints/convergence-practice/ci-security/receipt.json
@@ -0,0 +1,15 @@
+{
+ "schema_version": 1,
+ "id": "native-ci-security-20260920",
+ "kind": "native_cli_e2e",
+ "component_ids": [
+ "zizmor"
+ ],
+ "claim": "Native zizmor1.30.1 on macOS accepts the published workflow under offline regular analysis and rejects an inert unsafe fixture with three findings; two executable regression checks pass.",
+ "limitations": [
+ "Offline regular analysis is scoped static evidence, not absence of every vulnerability or signature verification.",
+ "Mac binary and the checksum-locked Linux CI wheel are distinct artifacts; new runner execution is established by its own CI result.",
+ "The unsafe fixture was analyzed but never executed. No model calls, broker actions or savings measurement."
+ ],
+ "recorded_at_utc": "2026-09-20T04:30:41.591503+00:00"
+}
diff --git a/blueprints/convergence-practice/native-worker/README.md b/blueprints/convergence-practice/native-worker/README.md
new file mode 100644
index 000000000..78662ec66
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/README.md
@@ -0,0 +1,72 @@
+# Native Claude child-worker acceptance
+
+On September 20, 2026, native Claude Code **2.1.278** ran one foreground
+`ecosystem-worker` child on a clean Ubuntu 24.04 WSL2 runtime. The invocation
+used **Opus 5** through the existing native Max sign-in, with Ultracode requested.
+The strongest configured default was preserved; no global model setting changed.
+
+The [frozen plan](plan.json), [prompt](prompt.txt) and [seed](seed/TASK.md) preceded
+the model call. The original dependency planner fails eight of twelve visible
+tests. The child verified its base, repaired only `planner.py` in its native
+worktree and passed all twelve unchanged tests. The native coordinator and the
+outer coordinator independently reran the oracle. The primary checkout stayed
+clean. [Observed checks](checks.json), [accepted source](accepted/planner.py),
+[test output](test-output.txt), [receipt](receipt.json).
+
+An independent permutation oracle also checked all **65,536 directed four-node
+graphs**, including self-edges, in **131,072** order/duplicate representations.
+It accepted 543 acyclic graphs and rejected 64,993 cyclic graphs, with input
+immutability checks and six unknown-prerequisite cases.
+[Review script](independent_review.py), [retained result](independent-review.json).
+
+The invocation completed in 81.192 seconds: one child at depth one, no background
+worker, no timeout, four parent turns. CLI success, child isolation, source
+identity, patch quality and the requested effort are separate observations.
+This run does not prove that a dynamic workflow was selected, that the worker's
+prose constraints were an OS sandbox, or that another host is qualified.
+
+## Reproduce the artifact check
+
+```sh
+python3 -m unittest -v tests.test_native_worker_fixture
+python3 scripts/validate_convergence.py blueprints/convergence-practice/native-worker/experiment.json --root . --json
+```
+
+This offline replay preserves the eight failing seed tests and twelve passing
+accepted tests. It does not launch a model or reconstruct a historical session.
+The oracle is author-written and visible to the worker, not a held-out benchmark.
+
+For a new native execution, create an owned disposable Git repository whose
+default branch contains exactly the seed files, record its actual commit and
+substitute that commit in a **new** prompt/plan. A child worktree may start from
+the default branch, so stop on any base mismatch. Install the reviewed native
+role with `model: inherit`, `isolation: worktree`, and `maxTurns: 16`; delegate
+with the native Agent tool. `--agent` would instead select a main role and would
+not reproduce this parent/child test. Never reuse another host's credentials.
+
+The observed native command selected `--model claude-opus-5 --effort ultracode`,
+`--max-turns 12`, `--output-format stream-json --verbose`, explicit
+`Bash,Read,Edit,Write,Agent` tools and `--permission-mode dontAsk`. The existing
+[POSIX supervisor](../../us-equities/research-runtime/run_worker.py) bounded the
+owned process group to 300 seconds. Its finance-specific environment helper was
+not used; native HOME/PATH and the selected project context were retained.
+Native logs stay private; only sanitized outcome and usage fields are published.
+
+## Usage and save boundaries
+
+The [usage receipt](usage.json) retains three native views separately. Terminal
+categories sum to **105,297** tokens, `modelUsage` categories to **277,732**, and
+the child task summary reports **27,865**. They are not interchangeable totals
+and must not be added. Stream message blocks repeat usage fields, making naive
+event summation incorrect. Native retry coverage and the enclosing Desktop
+task's usage remain unknown. There is no matched baseline model invocation and
+no token-savings or billing-savings claim. The list-price estimate is not evidence
+of an additional charge to the subscription.
+
+The durable handoff is the frozen task, exact source, accepted patch, checks and
+decision. No transcript becomes automatic memory. The historical native worktree
+and private logs remain available for local inspection; deleting the owned fixture
+is the rollback. This is not a full host backup, a crash-resume test, remote
+provider-cancellation proof or an application/GPU benchmark. The next useful
+trial is a real repository issue with predeclared quality and complete matched
+parent/child/retry/cache accounting.
diff --git a/blueprints/convergence-practice/native-worker/accepted/planner.py b/blueprints/convergence-practice/native-worker/accepted/planner.py
new file mode 100644
index 000000000..ffee491e5
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/accepted/planner.py
@@ -0,0 +1,54 @@
+"""Dependency planner: deterministic topological ordering of declared tasks."""
+
+import heapq
+
+
+def order_tasks(dependencies):
+ """Return every declared task once, each after all of its prerequisites.
+
+ ``dependencies`` maps a task name to a list of prerequisite task names.
+ Among the tasks that are ready at a given step, the lexicographically
+ smallest name is emitted first. Duplicate prerequisites count once. A
+ prerequisite that is not itself a declared task, or any dependency cycle
+ (including one in a disconnected component), raises ``ValueError``.
+
+ The mapping and its lists are never mutated.
+ """
+ prerequisites = {}
+ for task, prereqs in dependencies.items():
+ unique = set(prereqs)
+ unknown = unique - dependencies.keys()
+ if unknown:
+ raise ValueError(
+ "task {!r} requires undeclared prerequisite(s): {}".format(
+ task, ", ".join(repr(name) for name in sorted(unknown))
+ )
+ )
+ prerequisites[task] = unique
+
+ remaining = {task: len(prereqs) for task, prereqs in prerequisites.items()}
+ dependents = {task: [] for task in prerequisites}
+ for task, prereqs in prerequisites.items():
+ for prereq in prereqs:
+ dependents[prereq].append(task)
+
+ ready = [task for task, count in remaining.items() if count == 0]
+ heapq.heapify(ready)
+
+ order = []
+ while ready:
+ task = heapq.heappop(ready)
+ order.append(task)
+ for dependent in dependents[task]:
+ remaining[dependent] -= 1
+ if remaining[dependent] == 0:
+ heapq.heappush(ready, dependent)
+
+ if len(order) != len(prerequisites):
+ blocked = sorted(task for task in prerequisites if remaining[task] > 0)
+ raise ValueError(
+ "dependency cycle among: {}".format(
+ ", ".join(repr(name) for name in blocked)
+ )
+ )
+ return order
diff --git a/blueprints/convergence-practice/native-worker/checks.json b/blueprints/convergence-practice/native-worker/checks.json
new file mode 100644
index 000000000..7b6e48bd5
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/checks.json
@@ -0,0 +1,32 @@
+{
+ "child_count": 1,
+ "spawn_depths": [
+ 1
+ ],
+ "roles": [
+ "ecosystem-worker"
+ ],
+ "backgrounded": [
+ false
+ ],
+ "parent_clean": true,
+ "child_base": "5699a1c8026796f8350d5549f62aa012ee5c6332",
+ "changed_paths": [
+ "planner.py"
+ ],
+ "unchanged_oracles": {
+ "TASK.md": true,
+ "test_planner.py": true
+ },
+ "independent_test_exit": 0,
+ "tests": 12,
+ "test_pass": true,
+ "cli_terminal_success": true,
+ "parent_turns": 4,
+ "timeout": false,
+ "outer_exit": 0,
+ "elapsed_seconds": 81.192,
+ "observed_models": [
+ "claude-opus-5"
+ ]
+}
diff --git a/blueprints/convergence-practice/native-worker/experiment.json b/blueprints/convergence-practice/native-worker/experiment.json
new file mode 100644
index 000000000..173ed9641
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/experiment.json
@@ -0,0 +1,198 @@
+{
+ "schema_version": 1,
+ "kind": "convergence_experiment",
+ "status": "observed",
+ "lane": "native-agent-engineering",
+ "discovery_provenance": [
+ "Measured gap in public native workflow acceptance; stars and awesome lists used only for discovery."
+ ],
+ "license_and_compatibility": "See pinned source review; original fixture under repository MIT license. No new native authentication or model default.",
+ "predeclared_metrics": {
+ "quality_rule": "Preserve frozen acceptance oracle and inspect actual exit, changes and intended failure cases.",
+ "usage_rule": "Known native fields retained separately; unknown stays null; no savings claim."
+ },
+ "commands": [
+ "python3 -m unittest -v test_planner",
+ "claude -p --model claude-opus-5 --effort ultracode --max-turns 12 --output-format stream-json --verbose --tools Bash,Read,Edit,Write,Agent --allowedTools Bash,Read,Edit,Write,Agent --permission-mode dontAsk --permission-prompts none < prompt.txt"
+ ],
+ "observations": [
+ {
+ "id": "seed-oracle",
+ "task": "dependency-planner",
+ "role": "verifier",
+ "condition": "baseline",
+ "attempt": 1,
+ "command_index": 0,
+ "evidence_class": "offline_artifact_check",
+ "scope": "Frozen dependency-planner seed",
+ "status": "failed",
+ "exit_code": 1,
+ "quality": {
+ "semantic": false,
+ "contract": true
+ },
+ "artifacts": [
+ {
+ "path": "blueprints/convergence-practice/native-worker/seed/planner.py",
+ "sha256": "ba9155fd203a5d23e12ea7f842ccc5ac033249db4a64ec525374fa2db9d71082"
+ },
+ {
+ "path": "tests/test_native_worker_fixture.py",
+ "sha256": "e4bd5345e9d23a338602fd0f6f34a67d959af51cb7939f4112dced74bcb01301"
+ }
+ ],
+ "usage": {
+ "uncached_input": 0,
+ "cache_creation": 0,
+ "cache_read": 0,
+ "output": 0,
+ "reasoning_in_output": 0,
+ "total": 0,
+ "native_retries": 0
+ }
+ },
+ {
+ "id": "native-child-repair",
+ "task": "dependency-planner",
+ "role": "native-parent-and-child",
+ "condition": "candidate",
+ "attempt": 1,
+ "command_index": 1,
+ "evidence_class": "model_task_execution",
+ "scope": "One frozen dependency-planner repair by native Claude Opus5 parent and isolated child on Ubuntu24.04 WSL2",
+ "status": "passed",
+ "exit_code": 0,
+ "quality": {
+ "semantic": true,
+ "contract": true
+ },
+ "artifacts": [
+ {
+ "path": "blueprints/convergence-practice/native-worker/checks.json",
+ "sha256": "5716e42cbb9b9d31b16defe18a7ab3a91f134c7f71b9883480929e586690b817"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/accepted/planner.py",
+ "sha256": "3a33c48346221e2a103d4fb89d5675d2edaa97e651b7f08cf3a79b7ce0b8d7ef"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/test-output.txt",
+ "sha256": "9896d8ab33fe7dabf8c6d21517a86c830aff3502817eee8110cbb3bdf45635df"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/usage.json",
+ "sha256": "db253301dc4f69db52c9607878f6d6c72ea11c1d58b86eac0c4858847d6f319d"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/independent_review.py",
+ "sha256": "3196a23d66c1f60bcd9e9520d12d6c87bdc4c956d27ea78524534681aa6022a6"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/independent-review.json",
+ "sha256": "7751cec857832486f8b460b450d282c5679af061e807351947c118ef3fab0c76"
+ }
+ ],
+ "usage": {
+ "uncached_input": null,
+ "cache_creation": null,
+ "cache_read": null,
+ "output": null,
+ "reasoning_in_output": null,
+ "total": null,
+ "native_retries": null
+ }
+ }
+ ],
+ "failures_and_skips": [
+ {
+ "run_id": "seed-oracle",
+ "reason": "Expected8 failures in12tests expose the original defect; failed seed is retained, not a model-efficiency baseline."
+ }
+ ],
+ "usage_assessment": {
+ "claim": "none",
+ "coverage": "partial",
+ "expected_run_ids": [],
+ "coverage_artifact": null
+ },
+ "task_and_failure": "Clean WSL native Claude child editing, exact-base isolation and real correctness had not been demonstrated by authentication or version checks.",
+ "primary_sources_and_pins": [
+ {
+ "url": "https://github.com/anthropics/claude-code",
+ "revision": "bf7d404e26a5fb6167d21b46c93a2bf6c22ab274"
+ },
+ {
+ "url": "https://github.com/seathatflowsinourveins/native-agent-stack",
+ "revision": "3d7bd63d00e19e93902f0457786891324df71851"
+ }
+ ],
+ "baseline_and_candidate": {
+ "baseline": "Frozen planner stub; deterministic tests only, no model baseline",
+ "candidate": "One bounded native parent delegates the exact repair to its configured child"
+ },
+ "frozen_inputs": {
+ "base_revision": "3d7bd63d00e19e93902f0457786891324df71851",
+ "tasks": [
+ "dependency-planner"
+ ],
+ "roles": [
+ "verifier",
+ "native-parent-and-child"
+ ],
+ "sources": [
+ {
+ "path": "blueprints/convergence-practice/native-worker/seed/planner.py",
+ "sha256": "ba9155fd203a5d23e12ea7f842ccc5ac033249db4a64ec525374fa2db9d71082"
+ }
+ ],
+ "inputs": [
+ {
+ "path": "blueprints/convergence-practice/native-worker/seed/TASK.md",
+ "sha256": "0807600d365213edbbc2a65c4e2833e1b997b66b932adc88b2542fab638a4bd8"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/prompt.txt",
+ "sha256": "643713536c3711d1f7135579eb81fc0e4e942c628da012e0f75aef7d0aefe6f1"
+ }
+ ],
+ "evaluation": [
+ {
+ "path": "blueprints/convergence-practice/native-worker/seed/test_planner.py",
+ "sha256": "ee6c07d845bb60545786b2e7507f6b3836c46e005d5ce2b9b60b616e325e0937"
+ },
+ {
+ "path": "blueprints/convergence-practice/native-worker/plan.json",
+ "sha256": "84b46b5b3f996e0ae7dcb80ba4b45d675a3e47150959880d23071f5ce759fcec"
+ }
+ ]
+ },
+ "runtime_and_platform": {
+ "platform": "Ubuntu24.04 WSL2 x86_64",
+ "tools": [
+ {
+ "name": "claude-code",
+ "version": "2.1.278"
+ },
+ {
+ "name": "model",
+ "version": "claude-opus-5"
+ }
+ ],
+ "isolation": "One native child worktree at frozen fixture base; global configuration not isolated by worktrees."
+ },
+ "limitations": [
+ "One synthetic visible-oracle fixture, not a held-out benchmark, real application or GPU acceptance.",
+ "Ultracode was requested; observed native delegation does not establish dynamic-workflow selection or an OS sandbox.",
+ "Three native usage views retain different scopes; native retries and whole Desktop usage are unknown. No matched model baseline or savings claim.",
+ "Local supervision completed without timeout; provider cancellation, crash recovery and full-host backup were not tested."
+ ],
+ "decision_and_scope": {
+ "decision": "adopt_within_scope",
+ "scope": "One frozen dependency-planner repair by native Claude Opus5 parent and isolated child on Ubuntu24.04 WSL2",
+ "qualification_run_ids": [
+ "native-child-repair"
+ ]
+ },
+ "rollback": "Preserve accepted source and receipt; retire only the owned disposable native fixture.",
+ "next_decision_changing_test": "A real repository issue with frozen quality and complete matched coordinator, child, retry and cache accounting."
+}
diff --git a/blueprints/convergence-practice/native-worker/independent-review.json b/blueprints/convergence-practice/native-worker/independent-review.json
new file mode 100644
index 000000000..7e146b29b
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/independent-review.json
@@ -0,0 +1,61 @@
+{
+ "accepted_frozen_tests": {
+ "errors": 0,
+ "failures": 0,
+ "passed": true,
+ "tests": 12
+ },
+ "acyclic_graphs": 543,
+ "cyclic_graphs": 64993,
+ "directed_graphs_including_self_edges": 65536,
+ "graph_nodes": [
+ "a",
+ "b",
+ "c",
+ "d"
+ ],
+ "graph_oracle": "First valid permutation in independently enumerated lexicographic order.",
+ "input_immutability_checked_on_success_and_rejection": true,
+ "kind": "offline_independent_planner_review",
+ "limitations": [
+ "Exhaustive only for directed graphs over four named nodes; larger graphs are not exhaustively tested.",
+ "Input contract is string task names mapped to lists of string prerequisites; malformed types are outside scope.",
+ "Independent offline code/oracle review; no native model, account, remote host or provider call was repeated.",
+ "Matching plan hashes verifies current bytes, not independently attested pre-execution chronology.",
+ "Native worker/runtime claims rely on their separate execution evidence.",
+ "No matched model baseline, whole-workflow token savings or billing reduction is established."
+ ],
+ "outcome": "passed",
+ "plan_seed_and_prompt_hashes_match": true,
+ "representations_checked": 131072,
+ "reviewed_bytes_unchanged": true,
+ "reviewed_files_sha256": {
+ "accepted/planner.py": "3a33c48346221e2a103d4fb89d5675d2edaa97e651b7f08cf3a79b7ce0b8d7ef",
+ "plan.json": "84b46b5b3f996e0ae7dcb80ba4b45d675a3e47150959880d23071f5ce759fcec",
+ "prompt.txt": "643713536c3711d1f7135579eb81fc0e4e942c628da012e0f75aef7d0aefe6f1",
+ "seed/TASK.md": "0807600d365213edbbc2a65c4e2833e1b997b66b932adc88b2542fab638a4bd8",
+ "seed/planner.py": "ba9155fd203a5d23e12ea7f842ccc5ac033249db4a64ec525374fa2db9d71082",
+ "seed/test_planner.py": "ee6c07d845bb60545786b2e7507f6b3836c46e005d5ce2b9b60b616e325e0937",
+ "usage.json": "db253301dc4f69db52c9607878f6d6c72ea11c1d58b86eac0c4858847d6f319d"
+ },
+ "reviewer_script_sha256": "3196a23d66c1f60bcd9e9520d12d6c87bdc4c956d27ea78524534681aa6022a6",
+ "schema_version": 1,
+ "second_representation": "Reversed mapping/prerequisite order with duplicated prerequisites.",
+ "seed_negative_control": {
+ "errors": 0,
+ "failures": 8,
+ "passed": false,
+ "tests": 12
+ },
+ "undeclared_prerequisite_cases": 6,
+ "usage_scope_review": {
+ "child_summary_total": 27865,
+ "cost_basis": "list",
+ "model_usage_category_sum": 277732,
+ "native_retries": null,
+ "relationship": "Different native scopes remain unreconciled; do not add these totals.",
+ "savings_claim": null,
+ "terminal_category_sum": 105297,
+ "whole_desktop_task_usage": null
+ }
+}
diff --git a/blueprints/convergence-practice/native-worker/independent_review.py b/blueprints/convergence-practice/native-worker/independent_review.py
new file mode 100644
index 000000000..e977c08d7
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/independent_review.py
@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Offline independent review; --root names the native-worker fixture directory."""
+
+import argparse
+import copy
+import hashlib
+import io
+import itertools
+import json
+from pathlib import Path
+import sys
+import types
+import unittest
+
+
+def sha256(path):
+ return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def require(condition, message):
+ if not condition:
+ raise AssertionError(message)
+
+
+def load_module(path, name):
+ module = types.ModuleType(name)
+ exec(compile(path.read_text(), path.name, "exec"), module.__dict__)
+ return module
+
+
+def run(root):
+ reviewed = (
+ "seed/planner.py", "seed/test_planner.py", "seed/TASK.md",
+ "accepted/planner.py", "prompt.txt", "plan.json", "usage.json",
+ )
+ before = {name: sha256(root / name) for name in reviewed}
+ plan = json.loads((root / "plan.json").read_text())
+ for name, expected_hash in plan["fixture_hashes"].items():
+ require(name in {"planner.py", "test_planner.py", "TASK.md"},
+ "unexpected seed filename in plan")
+ require(sha256(root / "seed" / name) == expected_hash,
+ "seed hash does not match plan")
+ require(sha256(root / "prompt.txt") == plan["prompt_sha256"],
+ "prompt hash does not match plan")
+
+ accepted = load_module(root / "accepted/planner.py", "planner")
+ implementation = accepted.order_tasks
+ names = ("a", "b", "c", "d")
+ edges = tuple(itertools.product(names, repeat=2))
+ # Independent oracle: enumerate every candidate output permutation in
+ # lexicographic order. A permutation permits only edges from earlier
+ # prerequisites to later tasks, so no self-edge is permitted.
+ orders = []
+ for permutation in itertools.permutations(names):
+ positions = {name: i for i, name in enumerate(permutation)}
+ allowed = sum(1 << i for i, (task, prerequisite) in enumerate(edges)
+ if positions[prerequisite] < positions[task])
+ orders.append((allowed, permutation))
+
+ acyclic = cyclic = representations = 0
+ for mask in range(1 << len(edges)):
+ expected = next((list(order) for allowed, order in orders
+ if not mask & ~allowed), None)
+ acyclic += expected is not None
+ cyclic += expected is None
+ original = {
+ task: [prerequisite for i, (target, prerequisite) in enumerate(edges)
+ if target == task and mask & (1 << i)]
+ for task in names
+ }
+ variants = (
+ original,
+ {key: list(reversed(value)) + value
+ for key, value in reversed(list(original.items()))},
+ )
+ for dependencies in variants:
+ snapshot = copy.deepcopy(dependencies)
+ try:
+ actual = implementation(dependencies)
+ except ValueError:
+ require(expected is None, "valid graph was rejected")
+ else:
+ require(actual == expected, "ordering differs from oracle")
+ require(dependencies == snapshot, "input was mutated")
+ representations += 1
+
+ unknown_cases = 0
+ for unknown in ("unknown", "", "\u03bb"):
+ for dependencies in (
+ {"a": [unknown]},
+ {"a": [], "b": ["a", unknown, unknown]},
+ ):
+ snapshot = copy.deepcopy(dependencies)
+ try:
+ implementation(dependencies)
+ except ValueError:
+ pass
+ else:
+ raise AssertionError("undeclared prerequisite accepted")
+ require(dependencies == snapshot, "invalid input was mutated")
+ unknown_cases += 1
+
+ sys.modules["planner"] = accepted
+ frozen_tests = load_module(root / "seed/test_planner.py", "acceptance_oracle")
+
+ def test_result(function):
+ frozen_tests.order_tasks = function
+ result = unittest.TextTestRunner(stream=io.StringIO(), verbosity=0).run(
+ unittest.defaultTestLoader.loadTestsFromModule(frozen_tests)
+ )
+ return {
+ "tests": result.testsRun,
+ "failures": len(result.failures),
+ "errors": len(result.errors),
+ "passed": result.wasSuccessful(),
+ }
+
+ accepted_tests = test_result(implementation)
+ seed = load_module(root / "seed/planner.py", "seed")
+ seed_tests = test_result(seed.order_tasks)
+ require(accepted_tests == {"tests": 12, "failures": 0, "errors": 0,
+ "passed": True}, "accepted frozen tests failed")
+ require(seed_tests == {"tests": 12, "failures": 8, "errors": 0,
+ "passed": False}, "seed negative control changed")
+
+ usage = json.loads((root / "usage.json").read_text())
+ terminal = usage["native_terminal_usage"]
+ model = usage["native_model_usage"]["claude-opus-5"]
+ accounting = {
+ "terminal_category_sum": sum(terminal[key] for key in (
+ "input_tokens", "cache_creation_input_tokens",
+ "cache_read_input_tokens", "output_tokens")),
+ "model_usage_category_sum": sum(model[key] for key in (
+ "inputTokens", "cacheCreationInputTokens",
+ "cacheReadInputTokens", "outputTokens")),
+ "child_summary_total": usage["native_child_task_summary_usage"][0]["total_tokens"],
+ "relationship": "Different native scopes remain unreconciled; do not add these totals.",
+ "cost_basis": model["costBasis"],
+ "native_retries": usage["native_retries"],
+ "whole_desktop_task_usage": usage["whole_desktop_task_usage"],
+ "savings_claim": usage["savings_claim"],
+ }
+ require(before == {name: sha256(root / name) for name in reviewed},
+ "reviewed fixture bytes changed")
+ return {
+ "schema_version": 1,
+ "kind": "offline_independent_planner_review",
+ "outcome": "passed",
+ "reviewer_script_sha256": sha256(Path(__file__)),
+ "reviewed_files_sha256": before,
+ "graph_oracle": "First valid permutation in independently enumerated lexicographic order.",
+ "graph_nodes": list(names),
+ "directed_graphs_including_self_edges": 1 << len(edges),
+ "acyclic_graphs": acyclic,
+ "cyclic_graphs": cyclic,
+ "representations_checked": representations,
+ "second_representation": "Reversed mapping/prerequisite order with duplicated prerequisites.",
+ "undeclared_prerequisite_cases": unknown_cases,
+ "input_immutability_checked_on_success_and_rejection": True,
+ "accepted_frozen_tests": accepted_tests,
+ "seed_negative_control": seed_tests,
+ "plan_seed_and_prompt_hashes_match": True,
+ "reviewed_bytes_unchanged": True,
+ "usage_scope_review": accounting,
+ "limitations": [
+ "Exhaustive only for directed graphs over four named nodes; larger graphs are not exhaustively tested.",
+ "Input contract is string task names mapped to lists of string prerequisites; malformed types are outside scope.",
+ "Independent offline code/oracle review; no native model, account, remote host or provider call was repeated.",
+ "Matching plan hashes verifies current bytes, not independently attested pre-execution chronology.",
+ "Native worker/runtime claims rely on their separate execution evidence.",
+ "No matched model baseline, whole-workflow token savings or billing reduction is established.",
+ ],
+ }
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument("--root", type=Path, default=Path("."))
+ args = parser.parse_args()
+ print(json.dumps(run(args.root), indent=2, sort_keys=True))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/blueprints/convergence-practice/native-worker/plan.json b/blueprints/convergence-practice/native-worker/plan.json
new file mode 100644
index 000000000..7e854f706
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/plan.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": 1,
+ "kind": "native_child_patch_acceptance_plan",
+ "frozen_before_model_execution": true,
+ "public_source_base": "327d9badff0ad09ec0c1266e70b4ad361743c77f",
+ "remote_fixture_base": "5699a1c8026796f8350d5549f62aa012ee5c6332",
+ "fixture_hashes": {
+ "planner.py": "ba9155fd203a5d23e12ea7f842ccc5ac033249db4a64ec525374fa2db9d71082",
+ "test_planner.py": "ee6c07d845bb60545786b2e7507f6b3836c46e005d5ce2b9b60b616e325e0937",
+ "TASK.md": "0807600d365213edbbc2a65c4e2833e1b997b66b932adc88b2542fab638a4bd8"
+ },
+ "prompt_sha256": "643713536c3711d1f7135579eb81fc0e4e942c628da012e0f75aef7d0aefe6f1",
+ "task": "dependency-planner",
+ "intended_model": "claude-opus-5",
+ "effort": "ultracode",
+ "account_route": "native claude.ai subscription; no API key or paid fallback",
+ "parent_max_turns": 12,
+ "configured_child_max_turns": 16,
+ "timeout_seconds": 300,
+ "outer_attempts": 1,
+ "quality_rule": "Original12 tests all pass; only planner.py changes; exact base and separate child worktree observed; root independently reruns unchanged oracle and reviews patch.",
+ "usage_rule": "Retain native parent/child categories when available; unknown stays null. No whole-task savings claim.",
+ "limitations": [
+ "Visible author-written fixture, not held-out benchmark.",
+ "No matched baseline model invocation.",
+ "Native process cleanup does not establish remote provider cancellation.",
+ "Model effort requested does not by itself prove dynamic workflow execution."
+ ]
+}
diff --git a/blueprints/convergence-practice/native-worker/prompt.txt b/blueprints/convergence-practice/native-worker/prompt.txt
new file mode 100644
index 000000000..3009d8873
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/prompt.txt
@@ -0,0 +1 @@
+Complete this one native child-worker acceptance test. Delegate exactly one task to @agent-ecosystem-worker using the native Agent tool with subagent_type ecosystem-worker. The child must verify Git HEAD equals 5699a1c8026796f8350d5549f62aa012ee5c6332 before editing. Its sole task is TASK.md and its sole writable source file is planner.py. The child must use its configured native isolated worktree, read the local specification/test oracle, implement the repair, run python3 -m unittest -v test_planner, report actual results and its exact worktree path, and spawn no further children. Do not use background execution. You are the coordinator: do not edit source or tests and do not duplicate the implementation. After the child finishes, report its source revision, worktree path, changed paths, test exit, and any limitations in no more than 250 words. Do not install packages, change native account/global settings, write durable memory, browse the web, or commit changes. Preserve failures. This is one synthetic correctness/mechanics test, not a savings comparison.
diff --git a/blueprints/convergence-practice/native-worker/receipt.json b/blueprints/convergence-practice/native-worker/receipt.json
new file mode 100644
index 000000000..d0bb03a88
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/receipt.json
@@ -0,0 +1,16 @@
+{
+ "schema_version": 1,
+ "id": "native-claude-child-patch-20260920",
+ "kind": "native_model_e2e",
+ "component_ids": [
+ "claude-code"
+ ],
+ "claim": "Native Claude Code2.1.278 on Ubuntu24.04 WSL2 used Opus5 through Max for one foreground isolated child repair. Only planner.py changed; all12 frozen visible tests pass independently after8 seed failures.",
+ "limitations": [
+ "One synthetic visible-oracle fixture, not a held-out benchmark, real application or GPU acceptance.",
+ "Ultracode was requested; observed native delegation does not establish dynamic-workflow selection or an OS sandbox.",
+ "Three native usage views retain different scopes; native retries and whole Desktop usage are unknown. No matched model baseline or savings claim.",
+ "Local supervision completed without timeout; provider cancellation, crash recovery and full-host backup were not tested."
+ ],
+ "recorded_at_utc": "2026-09-20T04:30:41.591503+00:00"
+}
diff --git a/blueprints/convergence-practice/native-worker/test-output.txt b/blueprints/convergence-practice/native-worker/test-output.txt
new file mode 100644
index 000000000..b73fcae2a
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/test-output.txt
@@ -0,0 +1,17 @@
+test_cycle_in_disconnected_component (test_planner.PlannerAcceptance.test_cycle_in_disconnected_component) ... ok
+test_dependency_before_alphabetic_name (test_planner.PlannerAcceptance.test_dependency_before_alphabetic_name) ... ok
+test_diamond (test_planner.PlannerAcceptance.test_diamond) ... ok
+test_duplicate_dependencies (test_planner.PlannerAcceptance.test_duplicate_dependencies) ... ok
+test_empty (test_planner.PlannerAcceptance.test_empty) ... ok
+test_input_unchanged (test_planner.PlannerAcceptance.test_input_unchanged) ... ok
+test_mapping_insertion_order_does_not_matter (test_planner.PlannerAcceptance.test_mapping_insertion_order_does_not_matter) ... ok
+test_multi_node_cycle (test_planner.PlannerAcceptance.test_multi_node_cycle) ... ok
+test_one (test_planner.PlannerAcceptance.test_one) ... ok
+test_ready_ties_are_lexicographic (test_planner.PlannerAcceptance.test_ready_ties_are_lexicographic) ... ok
+test_self_cycle (test_planner.PlannerAcceptance.test_self_cycle) ... ok
+test_unknown_dependency (test_planner.PlannerAcceptance.test_unknown_dependency) ... ok
+
+----------------------------------------------------------------------
+Ran 12 tests in 0.001s
+
+OK
diff --git a/blueprints/convergence-practice/native-worker/usage.json b/blueprints/convergence-practice/native-worker/usage.json
new file mode 100644
index 000000000..0d7186bd0
--- /dev/null
+++ b/blueprints/convergence-practice/native-worker/usage.json
@@ -0,0 +1,66 @@
+{
+ "native_terminal_usage": {
+ "input_tokens": 8,
+ "cache_creation_input_tokens": 27444,
+ "cache_read_input_tokens": 74277,
+ "output_tokens": 3568,
+ "output_tokens_details": {
+ "thinking_tokens": 1592
+ },
+ "server_tool_use": {
+ "web_search_requests": 0,
+ "web_fetch_requests": 0
+ },
+ "service_tier": "standard",
+ "cache_creation": {
+ "ephemeral_1h_input_tokens": 27444,
+ "ephemeral_5m_input_tokens": 0
+ },
+ "inference_geo": "not_available",
+ "iterations": [
+ {
+ "input_tokens": 2,
+ "output_tokens": 647,
+ "cache_read_input_tokens": 26761,
+ "cache_creation_input_tokens": 683,
+ "cache_creation": {
+ "ephemeral_5m_input_tokens": 0,
+ "ephemeral_1h_input_tokens": 683
+ },
+ "type": "message"
+ }
+ ],
+ "speed": "standard"
+ },
+ "native_model_usage": {
+ "claude-opus-5": {
+ "inputTokens": 22,
+ "outputTokens": 6786,
+ "cacheReadInputTokens": 216553,
+ "cacheCreationInputTokens": 54371,
+ "webSearchRequests": 0,
+ "costUSD": 0.7207702500000002,
+ "contextWindow": 1000000,
+ "maxOutputTokens": 64000,
+ "thinkingTokens": 1895,
+ "canonicalModel": "claude-opus-5",
+ "provider": "firstParty",
+ "costBasis": "list"
+ }
+ },
+ "native_child_task_summary_usage": [
+ {
+ "total_tokens": 27865,
+ "tool_uses": 8,
+ "duration_ms": 35184
+ }
+ ],
+ "native_child_status": [
+ "completed"
+ ],
+ "field_scope": "Terminal usage and modelUsage are retained separately; task summary total is not additive with modelUsage. Stream message blocks repeat usage and must not be summed naively.",
+ "native_retries": null,
+ "outer_attempts": 1,
+ "whole_desktop_task_usage": null,
+ "savings_claim": null
+}
diff --git a/blueprints/convergence-practice/validation.json b/blueprints/convergence-practice/validation.json
new file mode 100644
index 000000000..f1f58c97f
--- /dev/null
+++ b/blueprints/convergence-practice/validation.json
@@ -0,0 +1,47 @@
+{
+ "schema_version": 1,
+ "kind": "integration_validation_record",
+ "recorded_at_utc": "2026-09-20T04:35:19.970224+00:00",
+ "scope": "Integrated public working tree; exact immutable publication head is checked again by GitHub CI. No new provider run is implied by test replay.",
+ "runs": [
+ {
+ "id": "partial-private-python-profile",
+ "status": "failed",
+ "command": "python -m unittest",
+ "tests": 404,
+ "errors": 10,
+ "skipped": 24,
+ "reason": "Selecting the private tool environment activated optional DuckDB tests but that environment lacked pytz. This environment is not the public SDK profile; no global package mutation was made."
+ },
+ {
+ "id": "public-stdlib-profile",
+ "status": "passed",
+ "command": "python3 -m unittest (explicit CPython3.14.7; zizmor1.30.1 on PATH)",
+ "tests": 404,
+ "errors": 0,
+ "skipped": 47,
+ "reason": "Optional SDK/data/platform tests explicitly skip without their selected dependencies. All new convergence, fixture and native static-analysis checks execute."
+ },
+ {
+ "id": "convergence-focused",
+ "status": "passed",
+ "tests": 35,
+ "skipped": 0,
+ "scope": "31contract checks,2nativezizmor checks,2frozenpatch replays."
+ }
+ ],
+ "independent_review": {
+ "contract_findings_fixed": [
+ "Unequal passing repetition counts can no longer produce a savings claim.",
+ "An earlier passing candidate cannot qualify after a later failure or skip in its same task/role/scope."
+ ],
+ "regression_tests": 4,
+ "verification": "Independent reproductions rejected after fix.",
+ "patch_review": "native-worker/independent-review.json"
+ },
+ "limitations": [
+ "Local stdlib pass is not acceptance of every optional dependency profile.",
+ "The failed partial-profile attempt remains recorded; no savings claim uses these validation runs.",
+ "Native model evidence is in native-worker/receipt.json, not inferred from offline replays."
+ ]
+}
diff --git a/catalogs/convergence-practice/architecture-wave/README.md b/catalogs/convergence-practice/architecture-wave/README.md
new file mode 100644
index 000000000..85862189b
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/README.md
@@ -0,0 +1,43 @@
+# September 20 architecture convergence review
+
+The public [owned repository](own-repository.json) was reviewed at immutable
+base `327d9badff0ad09ec0c1266e70b4ad361743c77f`. A fresh
+[342-star identity comparison](public-star-delta.json) found no additions or
+removals. That metadata check does not mean every starred implementation was
+audited. The earlier pinned awesome-list coverage remains available in the
+[preceding source review](../source-review.md).
+
+This wave rechecked ten relevant upstreams at explicit source commits. The
+[ledger](source-review.json) links dated repository metadata, release identity,
+README/license hashes and source lines. Its depth is README, license and
+supporting overview review; it is not a full security or implementation audit.
+The combined index now contains **505 identities**, including all **342 stars**
+and **163 beyond them**. Only zizmor is new to that union.
+
+| Reviewed source | Result of this wave |
+| --- | --- |
+| [zizmor](zizmorcore__zizmor.json) | Add pinned offline CI analysis and known-unsafe acceptance; native evidence is separate from this source ledger. |
+| [uv](astral-sh__uv.json) | Retain the existing locked environments and shared package cache; avoid another environment manager. |
+| [Dagu](dagucloud__dagu.json) | Retain persisted workflow state; actual workload restart remains distinct from process relaunch. |
+| [Inspect](UKGovernmentBEIS__inspect_ai.json) | Retain as an evaluation candidate for held-out task scoring; no provider run in this source review. |
+| [ARB](eyuansu62__agent-retrieval-bench.json) | Reuse existing external failure-trace results; retrieval scores do not establish agent repair quality. |
+| [QMD](tobi__qmd.json) | Retain scoped collection retrieval; an index must match the intended project and revision. |
+| [Cosign](sigstore__cosign.json) | Keep signature identity and tamper rejection as a selected-artifact gate; no signature pass is inferred from checksums. |
+| [Harbor](harbor-framework__harbor.json) | Defer broader execution adoption until a relevant workload and containment acceptance justify its operational cost. |
+| [jCodeMunch](jgravelle__jcodemunch-mcp.json) | Reject installation in this wave because of overlap and the reviewed Dual Use license boundary. |
+| [awesome-mac](jaywcjlove__awesome-mac.json) | Refresh pinned discovery coverage; list membership is not permission to install or evidence of quality. |
+
+Three concrete gaps changed: the public protocol now has an executable evidence
+validator; the clean WSL Claude role now has an observed isolated patch task;
+and CI now checks workflow security with positive and negative cases. The
+[architecture guide](../../../docs/convergence-architecture.md) connects those
+results with native caching, bounded retrieval, task ownership, durable scoped
+decisions and recovery. More tools become candidates only when a task exposes a
+specific remaining gap.
+
+Current limits remain visible: the worker fixture is small and visible to the
+model, the three native usage views are not a reconciled whole-task ledger,
+offline CI analysis is not exhaustive security assurance, and full independent
+host/application recovery is not proved by a successful local process restart.
+No automatic installation, transcript capture, broker action or universal SOTA
+claim follows from this catalog refresh.
diff --git a/catalogs/convergence-practice/architecture-wave/UKGovernmentBEIS__inspect_ai.json b/catalogs/convergence-practice/architecture-wave/UKGovernmentBEIS__inspect_ai.json
new file mode 100644
index 000000000..e6d411bec
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/UKGovernmentBEIS__inspect_ai.json
@@ -0,0 +1,127 @@
+{
+ "repository": "UKGovernmentBEIS/inspect_ai",
+ "requested_repository": "UKGovernmentBEIS/inspect_ai",
+ "checked_at": "2026-09-20T04:10:41.320145+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/UKGovernmentBEIS/inspect_ai",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-19T13:21:18Z",
+ "description": "Inspect: A framework for large language model evaluations",
+ "license": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ }
+ },
+ "default_head": "ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "release": null,
+ "source_commit": "ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "source_basis": "default branch HEAD",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai/releases/latest",
+ "exit_code": 1,
+ "error": "gh: Not Found (HTTP 404)"
+ },
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai/commits/ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai/readme?ref=ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/UKGovernmentBEIS/inspect_ai/license?ref=ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/ukgovernmentbeis/inspect_ai",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "catalog_card",
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/source-review.json",
+ "pointer": "/candidates/1",
+ "decision": "investigate",
+ "review_level": "source_review",
+ "evidence_level": "pinned_source_review"
+ },
+ {
+ "kind": "catalog_card",
+ "path": "catalogs/us-equities/agents-operations.json",
+ "pointer": "/entries/30",
+ "id": "inspect-ai",
+ "decision": "default",
+ "evidence_level": "source_review"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/README.md",
+ "sha256": "a9a1e07b955d869137d8ad109f1c238268f361dcdfac30cfcc94983a51a99b17",
+ "git_blob_sha": "1e58c142b2e05faf2e3dba9a487450c0845c4576",
+ "bytes": 3099,
+ "matched_excerpts": [
+ {
+ "term": "evaluat",
+ "line": 3,
+ "url": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/README.md#L3"
+ },
+ {
+ "term": "evaluat",
+ "line": 5,
+ "url": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/README.md#L5"
+ },
+ {
+ "term": "agent",
+ "line": 11,
+ "url": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/README.md#L11"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/LICENSE",
+ "metadata": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ },
+ "sha256": "c593c2afc81388521eaeb03f0d1a4b01bc3e5147ed9cb16c1f129e5be353b6af",
+ "bytes": 1081
+ },
+ "decision": {
+ "disposition": "retain-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing evaluation candidate can standardize task/scorer/log receipts; missing acceptance is resumability and bounded failure behavior, not another framework identity.",
+ "next_acceptance": "One mock-model task with deterministic scoring, bounded concurrency/retries, retained failure log, interruption and resume; no provider request.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/astral-sh__uv.json b/catalogs/convergence-practice/architecture-wave/astral-sh__uv.json
new file mode 100644
index 000000000..582a1f9a1
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/astral-sh__uv.json
@@ -0,0 +1,158 @@
+{
+ "repository": "astral-sh/uv",
+ "requested_repository": "astral-sh/uv",
+ "checked_at": "2026-09-20T04:10:43.071886+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/astral-sh/uv",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-20T00:43:09Z",
+ "description": "An extremely fast Python package and project manager, written in Rust.",
+ "license": {
+ "key": "apache-2.0",
+ "name": "Apache License 2.0",
+ "spdx_id": "Apache-2.0",
+ "url": "https://api.github.com/licenses/apache-2.0",
+ "node_id": "MDc6TGljZW5zZTI="
+ }
+ },
+ "default_head": "7b090fba99bc89a6670a23de5368d48d2418a756",
+ "release": {
+ "tag_name": "0.12.17",
+ "published_at": "2026-09-18T18:59:24Z",
+ "html_url": "https://github.com/astral-sh/uv/releases/tag/0.12.17",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "635500036e1705961315e86447f0fab0a8ddb309",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/commits/0.12.17",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/readme?ref=635500036e1705961315e86447f0fab0a8ddb309",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/license?ref=635500036e1705961315e86447f0fab0a8ddb309",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/astral-sh/uv/contents/LICENSE-MIT?ref=635500036e1705961315e86447f0fab0a8ddb309",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/astral-sh/uv",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "adoption/research.json",
+ "pointer": "/candidates/1",
+ "decision": "required_reuse_existing_native_python_layer"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md",
+ "sha256": "57a84a5a635f30e3a26541ebc16ca690944a7750f05713b1af92d3170b58f704",
+ "git_blob_sha": "66caaf9ccc62add8c63de8e71184c9b7677377ad",
+ "bytes": 9859,
+ "matched_excerpts": [
+ {
+ "term": "lockfile",
+ "line": 27,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L27"
+ },
+ {
+ "term": "lockfile",
+ "line": 89,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L89"
+ },
+ {
+ "term": "cache",
+ "line": 18,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L18"
+ },
+ {
+ "term": "cache",
+ "line": 36,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L36"
+ },
+ {
+ "term": "projects",
+ "line": 26,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L26"
+ },
+ {
+ "term": "projects",
+ "line": 27,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L27"
+ },
+ {
+ "term": "workspace",
+ "line": 34,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L34"
+ },
+ {
+ "term": "workspace",
+ "line": 89,
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md#L89"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE-APACHE",
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/LICENSE-APACHE",
+ "metadata": {
+ "key": "other",
+ "name": "Other",
+ "spdx_id": "NOASSERTION",
+ "url": null,
+ "node_id": "MDc6TGljZW5zZTA="
+ },
+ "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+ "bytes": 11357
+ },
+ "supplemental_sources": [
+ {
+ "path": "LICENSE-MIT",
+ "url": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/LICENSE-MIT",
+ "sha256": "860e3d7a86b84e6a7012c7a635fc64df475cebc6cce34dfeb73a5982ec58176c",
+ "bytes": 1077
+ }
+ ],
+ "decision": {
+ "disposition": "retain-native",
+ "license_text_classification": "MIT OR Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing exact 0.12.17 route already provides lockfiles and shared dependency cache. A second environment manager would duplicate this layer.",
+ "next_acceptance": "Use project-owned locks and compare source/dependency fingerprints before cross-host runs; retain isolated environments and caches.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/dagucloud__dagu.json b/catalogs/convergence-practice/architecture-wave/dagucloud__dagu.json
new file mode 100644
index 000000000..bfb863b07
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/dagucloud__dagu.json
@@ -0,0 +1,179 @@
+{
+ "repository": "dagucloud/dagu",
+ "requested_repository": "dagucloud/dagu",
+ "checked_at": "2026-09-20T04:10:43.242091+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/dagucloud/dagu",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-19T16:09:43Z",
+ "description": "Self-hostable workflow orchestrator for teams whose main work isn't orchestration. Declarative YAML over your scripts, SSH commands, containers, etc; keep workflows separate from business logic. One binary, no database, runs on limited H/W resources. Alternative to Airflow / Cron / Job Scheduler.",
+ "license": {
+ "key": "gpl-3.0",
+ "name": "GNU General Public License v3.0",
+ "spdx_id": "GPL-3.0",
+ "url": "https://api.github.com/licenses/gpl-3.0",
+ "node_id": "MDc6TGljZW5zZTk="
+ }
+ },
+ "default_head": "0a8edff8e55c281c2f217ef4383fbf5262138def",
+ "release": {
+ "tag_name": "v2.16.6",
+ "published_at": "2026-09-14T14:45:57Z",
+ "html_url": "https://github.com/dagucloud/dagu/releases/tag/v2.16.6",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "58fed633d58c1dd1319091fdb2c2f6158ecfa053",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu/commits/v2.16.6",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu/readme?ref=58fed633d58c1dd1319091fdb2c2f6158ecfa053",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/dagucloud/dagu/license?ref=58fed633d58c1dd1319091fdb2c2f6158ecfa053",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/dagucloud/dagu",
+ "aliases": [
+ "dagu-org/dagu"
+ ],
+ "public_star": false,
+ "record_types": [
+ "catalog_card",
+ "component_record",
+ "legacy_candidate",
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "catalog_card",
+ "path": "catalogs/us-equities/agents-operations.json",
+ "pointer": "/entries/6",
+ "id": "dagu",
+ "decision": "conditional",
+ "evidence_level": "native_proven"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/us-equities/architecture/foundation.json",
+ "pointer": "/repositories/4",
+ "decision": "retain",
+ "evidence_depth": "pinned_primary_source_review"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/us-equities/convergence-program/hosting.json",
+ "pointer": "/candidates/0",
+ "decision": "retain",
+ "evidence_depth": "selected_primary_source_review"
+ },
+ {
+ "kind": "legacy_candidate",
+ "path": "manifests/candidates.json",
+ "pointer": "/candidates/17",
+ "decision": "Conditional: select when a real multi-step local refresh/report workflow needs persisted run state, retries or human tasks. No persistent job proposed this turn."
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/44",
+ "id": "dagu"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md",
+ "sha256": "153ec405b99603e6d52772eb152f00505c24c02ec24b463691dcbd7cb4fc2658",
+ "git_blob_sha": "0e8a3c0a0e9cef9c71f864608f4b0d1108cbac76",
+ "bytes": 50594,
+ "matched_excerpts": [
+ {
+ "term": "retry",
+ "line": 318,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L318"
+ },
+ {
+ "term": "retry",
+ "line": 405,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L405"
+ },
+ {
+ "term": "persist",
+ "line": 142,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L142"
+ },
+ {
+ "term": "persist",
+ "line": 191,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L191"
+ },
+ {
+ "term": "YAML",
+ "line": 8,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L8"
+ },
+ {
+ "term": "YAML",
+ "line": 18,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L18"
+ },
+ {
+ "term": "distributed",
+ "line": 190,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L190"
+ },
+ {
+ "term": "distributed",
+ "line": 191,
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md#L191"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/LICENSE",
+ "metadata": {
+ "key": "gpl-3.0",
+ "name": "GNU General Public License v3.0",
+ "spdx_id": "GPL-3.0",
+ "url": "https://api.github.com/licenses/gpl-3.0",
+ "node_id": "MDc6TGljZW5zZTk="
+ },
+ "sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986",
+ "bytes": 35149
+ },
+ "decision": {
+ "disposition": "retain-existing-workflow",
+ "license_text_classification": "GPL-3.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing adopted workflow engine already has persisted run state and workers. Remaining public gate concerns actual workload interruption/recovery and unattended host availability.",
+ "next_acceptance": "Reuse one real bounded workflow and prove restart/cancellation on the intended host; do not introduce another scheduler.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/eyuansu62__agent-retrieval-bench.json b/catalogs/convergence-practice/architecture-wave/eyuansu62__agent-retrieval-bench.json
new file mode 100644
index 000000000..f627bf592
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/eyuansu62__agent-retrieval-bench.json
@@ -0,0 +1,157 @@
+{
+ "repository": "eyuansu62/agent-retrieval-bench",
+ "requested_repository": "eyuansu62/agent-retrieval-bench",
+ "checked_at": "2026-09-20T04:10:41.321629+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/eyuansu62/agent-retrieval-bench",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-08-04T04:01:12Z",
+ "description": "Agentic code retrieval benchmark for coding agents",
+ "license": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ }
+ },
+ "default_head": "07014c986f3deadb1548c62b32c0ffbe6a81465d",
+ "release": {
+ "tag_name": "v0.2.1",
+ "published_at": "2026-07-26T01:08:48Z",
+ "html_url": "https://github.com/eyuansu62/agent-retrieval-bench/releases/tag/v0.2.1",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "b487f3866cc13dd971819cb902517a6a50282404",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench/commits/v0.2.1",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench/readme?ref=b487f3866cc13dd971819cb902517a6a50282404",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/eyuansu62/agent-retrieval-bench/license?ref=b487f3866cc13dd971819cb902517a6a50282404",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/eyuansu62/agent-retrieval-bench",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "catalog_card",
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/source-review.json",
+ "pointer": "/candidates/0",
+ "decision": "investigate",
+ "review_level": "source_review",
+ "evidence_level": "pinned_source_review"
+ },
+ {
+ "kind": "catalog_card",
+ "path": "catalogs/us-equities/foundation-memory.json",
+ "pointer": "/entries/33",
+ "id": "foundation-agent-retrieval-bench",
+ "decision": "conditional",
+ "evidence_level": "source_review"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md",
+ "sha256": "494b73638318f3e8958422e6ac49e6c62d13973c0e4d947c186ed3b305c3dbc4",
+ "git_blob_sha": "d5be7aaea6e17ace0a36b319c03e71199aa84ef6",
+ "bytes": 9985,
+ "matched_excerpts": [
+ {
+ "term": "trace2code",
+ "line": 26,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L26"
+ },
+ {
+ "term": "trace2code",
+ "line": 55,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L55"
+ },
+ {
+ "term": "all_files",
+ "line": 47,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L47"
+ },
+ {
+ "term": "all_files",
+ "line": 183,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L183"
+ },
+ {
+ "term": "retriev",
+ "line": 1,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L1"
+ },
+ {
+ "term": "retriev",
+ "line": 3,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L3"
+ },
+ {
+ "term": "benchmark",
+ "line": 18,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L18"
+ },
+ {
+ "term": "benchmark",
+ "line": 53,
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md#L53"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/LICENSE",
+ "metadata": {
+ "key": "other",
+ "name": "Other",
+ "spdx_id": "NOASSERTION",
+ "url": null,
+ "node_id": "MDc6TGljZW5zZTA="
+ },
+ "sha256": "f821747bf0011218a8d18a6030b3343384a2c68478e643e26e057732fc89aa31",
+ "bytes": 1091
+ },
+ "decision": {
+ "disposition": "retain-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing exact-release trace2code replay measures file retrieval; root-cause file ranking does not establish edits or lower total provider cost.",
+ "next_acceptance": "Add separate held-out patch/test acceptance after retrieval; preserve all_files and corpus/source pins.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/harbor-framework__harbor.json b/catalogs/convergence-practice/architecture-wave/harbor-framework__harbor.json
new file mode 100644
index 000000000..3286a23df
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/harbor-framework__harbor.json
@@ -0,0 +1,128 @@
+{
+ "repository": "harbor-framework/harbor",
+ "requested_repository": "harbor-framework/harbor",
+ "checked_at": "2026-09-20T04:10:41.321531+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/harbor-framework/harbor",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-19T18:59:40Z",
+ "description": "Framework for evaluating and improving agents ",
+ "license": {
+ "key": "apache-2.0",
+ "name": "Apache License 2.0",
+ "spdx_id": "Apache-2.0",
+ "url": "https://api.github.com/licenses/apache-2.0",
+ "node_id": "MDc6TGljZW5zZTI="
+ }
+ },
+ "default_head": "71c77fdd119df12eb6ab56e5bc0f29bf62fad338",
+ "release": {
+ "tag_name": "v0.23.0",
+ "published_at": "2026-09-12T04:55:17Z",
+ "html_url": "https://github.com/harbor-framework/harbor/releases/tag/v0.23.0",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "1e5c5c6db929a10a140d05e606882c671ae20729",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor/commits/v0.23.0",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor/readme?ref=1e5c5c6db929a10a140d05e606882c671ae20729",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/harbor-framework/harbor/license?ref=1e5c5c6db929a10a140d05e606882c671ae20729",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/harbor-framework/harbor",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/source-review.json",
+ "pointer": "/candidates/2",
+ "decision": "investigate",
+ "review_level": "source_review",
+ "evidence_level": "pinned_source_review"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md",
+ "sha256": "687e4f416b43e1ab28afb3cd48f556d7a9f4d664ac78ac1a2a07a7ab9b95b1b7",
+ "git_blob_sha": "4ae345184f65e2c0ff8cce8e496a8fdcc439f9bc",
+ "bytes": 2984,
+ "matched_excerpts": [
+ {
+ "term": "sandbox",
+ "line": 14,
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md#L14"
+ },
+ {
+ "term": "evaluat",
+ "line": 10,
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md#L10"
+ },
+ {
+ "term": "evaluat",
+ "line": 12,
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md#L12"
+ },
+ {
+ "term": "Docker",
+ "line": 41,
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md#L41"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/LICENSE",
+ "metadata": {
+ "key": "apache-2.0",
+ "name": "Apache License 2.0",
+ "spdx_id": "Apache-2.0",
+ "url": "https://api.github.com/licenses/apache-2.0",
+ "node_id": "MDc6TGljZW5zZTI="
+ },
+ "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+ "bytes": 11357
+ },
+ "decision": {
+ "disposition": "defer-install",
+ "license_text_classification": "Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing source-reviewed comparator packages runnable agent tasks and deterministic verification. It adds Docker or a cloud environment before a selected benchmark needs it.",
+ "next_acceptance": "Revisit only for a named container task; use oracle-only packaging test first and preserve cleanup evidence.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/jaywcjlove__awesome-mac.json b/catalogs/convergence-practice/architecture-wave/jaywcjlove__awesome-mac.json
new file mode 100644
index 000000000..8007e431d
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/jaywcjlove__awesome-mac.json
@@ -0,0 +1,162 @@
+{
+ "repository": "jaywcjlove/awesome-mac",
+ "requested_repository": "jaywcjlove/awesome-mac",
+ "checked_at": "2026-09-20T04:10:41.318940+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/jaywcjlove/awesome-mac",
+ "default_branch": "master",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-17T08:01:12Z",
+ "description": "\uf8ff This project is dedicated to collecting high-quality macOS software and organizing them systematically by different categories for easy search and use.",
+ "license": {
+ "key": "cc0-1.0",
+ "name": "Creative Commons Zero v1.0 Universal",
+ "spdx_id": "CC0-1.0",
+ "url": "https://api.github.com/licenses/cc0-1.0",
+ "node_id": "MDc6TGljZW5zZTY="
+ }
+ },
+ "default_head": "31718871dfbac3cc17139b3958759f5a3e47675c",
+ "release": {
+ "tag_name": "v2.1.0",
+ "published_at": "2026-03-30T16:52:39Z",
+ "html_url": "https://github.com/jaywcjlove/awesome-mac/releases/tag/v2.1.0",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "31718871dfbac3cc17139b3958759f5a3e47675c",
+ "source_basis": "default branch HEAD for current discovery list; release metadata retained separately",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/commits/master",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/commits/v2.1.0",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/readme?ref=cf291a7aa96f21f8d2afcf031fca80e867c15751",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/license?ref=cf291a7aa96f21f8d2afcf031fca80e867c15751",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/readme?ref=31718871dfbac3cc17139b3958759f5a3e47675c",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jaywcjlove/awesome-mac/license?ref=31718871dfbac3cc17139b3958759f5a3e47675c",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/jaywcjlove/awesome-mac",
+ "aliases": [],
+ "public_star": true,
+ "record_types": [
+ "public_star",
+ "research_supplement",
+ "star_review"
+ ],
+ "references": [
+ {
+ "kind": "public_star",
+ "path": "catalogs/us-equities/coverage.json",
+ "pointer": "/stars/138",
+ "disposition": "no_catalog_card"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/us-equities/simulation-data-review.json",
+ "pointer": "/decisions/11",
+ "decision": "discovery_only",
+ "evidence_level": "readme_and_license"
+ },
+ {
+ "kind": "star_review",
+ "path": "catalogs/us-equities/star-audit.json",
+ "pointer": "/entries/341",
+ "decision": "discovery_only",
+ "review_level": "source_review",
+ "review_depth": "readme_license_overview"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md",
+ "sha256": "e3929967dd724f29d153f7b0202e7ccfcffaa1cfa40ee5bf9319f3131ff90b35",
+ "git_blob_sha": "2f6b8848ec7eea06afbd0960921cfc7828c2ef3b",
+ "bytes": 262869,
+ "matched_excerpts": [
+ {
+ "term": "Ghostty",
+ "line": 642,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L642"
+ },
+ {
+ "term": "Ghostty",
+ "line": 650,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L650"
+ },
+ {
+ "term": "OrbStack",
+ "line": 578,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L578"
+ },
+ {
+ "term": "Podman",
+ "line": 580,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L580"
+ },
+ {
+ "term": "Raycast",
+ "line": 1473,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L1473"
+ },
+ {
+ "term": "Raycast",
+ "line": 1474,
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md#L1474"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/LICENSE",
+ "metadata": {
+ "key": "cc0-1.0",
+ "name": "Creative Commons Zero v1.0 Universal",
+ "spdx_id": "CC0-1.0",
+ "url": "https://api.github.com/licenses/cc0-1.0",
+ "node_id": "MDc6TGljZW5zZTY="
+ },
+ "sha256": "36ffd9dc085d529a7e60e1276d73ae5a030b020313e6c5408593a6ae2af39673",
+ "bytes": 6555
+ },
+ "release_source_snapshot": "cf291a7aa96f21f8d2afcf031fca80e867c15751",
+ "decision": {
+ "disposition": "retain-discovery",
+ "license_text_classification": "CC0-1.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Current list supplies Mac terminal/container/launcher leads. Existing Mac terminal and Apple container plus remote Linux already cover those roles; no demonstrated gap supports a second app layer.",
+ "next_acceptance": "Read only the selected category and verify each actual publisher before any separate adoption.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/jgravelle__jcodemunch-mcp.json b/catalogs/convergence-practice/architecture-wave/jgravelle__jcodemunch-mcp.json
new file mode 100644
index 000000000..973eba4a1
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/jgravelle__jcodemunch-mcp.json
@@ -0,0 +1,155 @@
+{
+ "repository": "jgravelle/jcodemunch-mcp",
+ "requested_repository": "jgravelle/jcodemunch-mcp",
+ "checked_at": "2026-09-20T04:10:43.035192+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/jgravelle/jcodemunch-mcp",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-20T04:02:26Z",
+ "description": "Cut AI token costs 95%+ on code exploration. The leading MCP server for precise, symbol-level GitHub code retrieval via tree-sitter AST. Works with Claude Code, Cursor & any MCP client. 313B+ tokens saved.",
+ "license": {
+ "key": "other",
+ "name": "Other",
+ "spdx_id": "NOASSERTION",
+ "url": null,
+ "node_id": "MDc6TGljZW5zZTA="
+ }
+ },
+ "default_head": "5c97b0f0725e7decc90ddd61d8c4c09c7bd055c0",
+ "release": {
+ "tag_name": "v1.108.319",
+ "published_at": "2026-09-16T14:04:32Z",
+ "html_url": "https://github.com/jgravelle/jcodemunch-mcp/releases/tag/v1.108.319",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "8f7b34abe16fb459e0bf1c04747d584216dfe32e",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp/commits/v1.108.319",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp/readme?ref=8f7b34abe16fb459e0bf1c04747d584216dfe32e",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/jgravelle/jcodemunch-mcp/license?ref=8f7b34abe16fb459e0bf1c04747d584216dfe32e",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/jgravelle/jcodemunch-mcp",
+ "aliases": [],
+ "public_star": true,
+ "record_types": [
+ "public_star",
+ "star_review"
+ ],
+ "references": [
+ {
+ "kind": "public_star",
+ "path": "catalogs/us-equities/coverage.json",
+ "pointer": "/stars/141",
+ "disposition": "no_catalog_card"
+ },
+ {
+ "kind": "star_review",
+ "path": "catalogs/us-equities/star-audit.json",
+ "pointer": "/entries/153",
+ "decision": "obsolete_or_ineligible",
+ "review_level": "source_review",
+ "review_depth": "readme_license_overview"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md",
+ "sha256": "8388d31c6e30f7fb298abf262faebe08d563c982d63721f996f27f962f8b2405",
+ "git_blob_sha": "36204d47c06e60f655c1d396f85493a102a880ca",
+ "bytes": 26987,
+ "matched_excerpts": [
+ {
+ "term": "license",
+ "line": 15,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L15"
+ },
+ {
+ "term": "license",
+ "line": 23,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L23"
+ },
+ {
+ "term": "symbol",
+ "line": 32,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L32"
+ },
+ {
+ "term": "symbol",
+ "line": 36,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L36"
+ },
+ {
+ "term": "retriev",
+ "line": 3,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L3"
+ },
+ {
+ "term": "retriev",
+ "line": 32,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L32"
+ },
+ {
+ "term": "token",
+ "line": 3,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L3"
+ },
+ {
+ "term": "token",
+ "line": 6,
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md#L6"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/LICENSE",
+ "metadata": {
+ "key": "other",
+ "name": "Other",
+ "spdx_id": "NOASSERTION",
+ "url": null,
+ "node_id": "MDc6TGljZW5zZTA="
+ },
+ "sha256": "66ed60bbc2a646e4bf7cde22a636b1a7ddeef514bb95b3b88af1e944457d6f38",
+ "bytes": 4384
+ },
+ "decision": {
+ "disposition": "retain-rejection",
+ "license_text_classification": "Dual-Use License 1.1",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Current release still overlaps accepted code retrieval; non-commercial/commercial terms remain an unresolved boundary for the trading ecosystem. Publisher token-savings claims are not local evidence.",
+ "next_acceptance": "Do not install or add duplicate server; reopen only after scope/license and a precision gap are explicitly resolved.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/own-repository.json b/catalogs/convergence-practice/architecture-wave/own-repository.json
new file mode 100644
index 000000000..8782487d5
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/own-repository.json
@@ -0,0 +1,14 @@
+{
+ "full_name": "seathatflowsinourveins/native-agent-stack",
+ "html_url": "https://github.com/seathatflowsinourveins/native-agent-stack",
+ "private": false,
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-20T04:10:21Z",
+ "updated_at": "2026-09-20T03:40:55Z",
+ "default_branch": "main",
+ "description": "Evidence-backed native Codex and Claude stack: scoped memory, automatic local code RAG, context efficiency, upstream recipes and reproducible receipts.",
+ "checked_at": "2026-09-20T04:27:06.523330+00:00",
+ "selected_base": "327d9badff0ad09ec0c1266e70b4ad361743c77f",
+ "review_scope": "Current public branch architecture inspected; private companion repository is not exported."
+}
diff --git a/catalogs/convergence-practice/architecture-wave/public-star-delta.json b/catalogs/convergence-practice/architecture-wave/public-star-delta.json
new file mode 100644
index 000000000..b7f9f8b8d
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/public-star-delta.json
@@ -0,0 +1,368 @@
+{
+ "schema_version": 1,
+ "kind": "public_star_identity_delta",
+ "checked_at": "2026-09-20T04:09:38.490765+00:00",
+ "base_commit": "327d9badff0ad09ec0c1266e70b4ad361743c77f",
+ "baseline_path": "catalogs/convergence-practice/public-starred.json",
+ "command": [
+ "gh",
+ "api",
+ "--paginate",
+ "--slurp",
+ "users/seathatflowsinourveins/starred?per_page=100"
+ ],
+ "exit_code": 0,
+ "baseline_count": 342,
+ "current_count": 342,
+ "nonpublic_filtered": 0,
+ "added": [],
+ "removed": [],
+ "repositories": [
+ "Storybloq/storybloq",
+ "Nexting-ai/nexting",
+ "tw93/Mole",
+ "clash-verge-rev/clash-verge-rev",
+ "jaywcjlove/awesome-mac",
+ "enaqx/awesome-react",
+ "tech-leads-club/agent-skills",
+ "Tencent/WeKnora",
+ "n8n-io/n8n",
+ "cline/cline",
+ "alphaXiv/OpenResearch",
+ "alibaba/open-code-review",
+ "toon-format/toon",
+ "xbtlin/ai-berkshire",
+ "screenpipe/screenpipe",
+ "Leonxlnx/taste-skill",
+ "nextlevelbuilder/ui-ux-pro-max-skill",
+ "langgenius/dify",
+ "magnitudedev/magnitude",
+ "fmtlib/fmt",
+ "loopx-project/loopx",
+ "paperswithbacktest/awesome-systematic-trading",
+ "fmzquant/strategies",
+ "bbfamily/abu",
+ "asavinov/intelligent-trading-bot",
+ "kernc/backtesting.py",
+ "whchien/ai-trader",
+ "jdx/mise",
+ "pola-rs/polars",
+ "warp-tech/warpgate",
+ "ZSeven-W/openpencil",
+ "eugr/spark-vllm-docker",
+ "llm-d/llm-d",
+ "gastownhall/beads",
+ "superplanehq/superplane",
+ "gitleaks/gitleaks",
+ "infiniflow/ragflow",
+ "ollama/ollama",
+ "cli/cli",
+ "flyteorg/flyte",
+ "livekit/agents",
+ "ayghri/i-have-adhd",
+ "unclebob/swarm-forge",
+ "omacom/omarchy",
+ "public-apis/public-apis",
+ "awesome-foss/awesome-sysadmin",
+ "avelino/awesome-go",
+ "awesome-selfhosted/awesome-selfhosted",
+ "sdras/awesome-actions",
+ "e2b-dev/awesome-ai-agents",
+ "wilsonfreitas/awesome-quant",
+ "abhisheknaiidu/awesome-github-profile-readme",
+ "veggiemonk/awesome-docker",
+ "alebcay/awesome-shell",
+ "github/awesome-copilot",
+ "goabstract/Awesome-Design-Tools",
+ "docker/awesome-compose",
+ "DovAmir/awesome-design-patterns",
+ "tiimgreen/github-cheat-sheet",
+ "fffaraz/awesome-cpp",
+ "sindresorhus/awesome-nodejs",
+ "sindresorhus/awesome",
+ "Osmantic/ODS",
+ "JetBrains/go-modern-guidelines",
+ "THU-MAIC/OpenMAIC",
+ "bilawalsidhu/gods-eye-view",
+ "abi/screenshot-to-code",
+ "bigskysoftware/htmx",
+ "google/googletest",
+ "weave-os/router",
+ "apache/maka",
+ "PostHog/posthog",
+ "actions/checkout",
+ "chaitanyagiri/munder-difflin",
+ "browser-use/browser-use",
+ "tt-a1i/archify",
+ "VeejaLiu/ScienceFictionCollection",
+ "virgiliojr94/book-to-skill",
+ "bradautomates/claude-video",
+ "donnemartin/system-design-primer",
+ "volcengine/OpenViking",
+ "immich-app/immich",
+ "AlexsJones/llmfit",
+ "akitaonrails/ai-memory",
+ "opengeos/GeoLibre",
+ "paperclipai/paperclip",
+ "cursor/plugins",
+ "cordiverse/cordis",
+ "TencentCloud/TencentDB-Agent-Memory",
+ "vitali87/code-graph-rag",
+ "NVIDIA-NeMo/Switchyard",
+ "PrimeIntellect-ai/prime-agent",
+ "cathrynlavery/diagram-design",
+ "ankitects/anki",
+ "dependabot/dependabot-core",
+ "usekaneo/kaneo",
+ "Chachamaru127/claude-code-harness",
+ "VoltAgent/awesome-claude-design",
+ "SeemSeam/claude_codex_bridge",
+ "deta/surf",
+ "KnockOutEZ/wigolo",
+ "eugeniughelbur/obsidian-second-brain",
+ "atilaahmettaner/tradingview-mcp",
+ "0xNyk/council-of-high-intelligence",
+ "open-compass/VLMEvalKit",
+ "looplj/axonhub",
+ "tradesdontlie/tradingview-mcp",
+ "brianpetro/obsidian-smart-connections",
+ "uditgoenka/autoresearch",
+ "tw93/Waza",
+ "open-multi-agent/open-multi-agent",
+ "firecrawl/firecrawl-mcp-server",
+ "open-compass/opencompass",
+ "di-sukharev/opencommit",
+ "NirDiamant/Prompt_Engineering",
+ "omnigent-ai/omnigent",
+ "google-labs-code/stitch-skills",
+ "nexu-io/html-anything",
+ "cobusgreyling/loop-engineering",
+ "mcp-use/mcp-use",
+ "1jehuang/jcode",
+ "khoj-ai/khoj",
+ "composio-community/awesome-claude-plugins",
+ "Maciek-roboblog/Claude-Code-Usage-Monitor",
+ "zebbern/claude-code-guide",
+ "tradermonty/claude-trading-skills",
+ "drona23/claude-token-efficient",
+ "FlorianBruniaux/claude-code-ultimate-guide",
+ "awarexone/Agentic-Bug-Hunter",
+ "ykdojo/claude-code-tips",
+ "frankbria/ralph-claude-code",
+ "SuperClaude-Org/SuperClaude_Framework",
+ "musistudio/claude-code-router",
+ "anthropics/claude-quickstarts",
+ "anthropics/claude-plugins-official",
+ "catchorg/Catch2",
+ "kvcache-ai/ktransformers",
+ "earendil-works/pi",
+ "OtterMind/Chat2DB",
+ "diegosouzapw/OmniRoute",
+ "yorukot/superfile",
+ "citrolabs/ego-lite",
+ "likec4/likec4",
+ "langchain-ai/openwiki",
+ "nashsu/llm_wiki",
+ "dgunning/edgartools",
+ "tirth8205/code-review-graph",
+ "stablyai/orca",
+ "Zackriya-Solutions/meetily",
+ "wonderwhy-er/DesktopCommanderMCP",
+ "virattt/ai-hedge-fund",
+ "ColeMurray/background-agents",
+ "Crosstalk-Solutions/project-nomad",
+ "PrefectHQ/prefect",
+ "giancarloerra/SocratiCode",
+ "graykode/abtop",
+ "bytebase/dbhub",
+ "lsdefine/GenericAgent",
+ "jgravelle/jcodemunch-mcp",
+ "BuilderIO/agent-native",
+ "DeusData/codebase-memory-mcp",
+ "HKUDS/Vibe-Trading",
+ "dbt-labs/dbt",
+ "topoteretes/cognee",
+ "ripienaar/free-for-dev",
+ "unclecode/crawl4ai",
+ "D4Vinci/Scrapling",
+ "searxng/searxng",
+ "h4ckf0r0day/obscura",
+ "trailofbits/skills",
+ "AgriciDaniel/claude-obsidian",
+ "tursodatabase/turso",
+ "agentskills/agentskills",
+ "microsoft/SkillOpt",
+ "mlflow/mlflow",
+ "ClickHouse/ClickHouse",
+ "MiroMindAI/MiroThinker",
+ "JuliusBrussee/caveman",
+ "NVIDIA-NeMo/Speech",
+ "virattt/dexter",
+ "restic/restic",
+ "pytest-dev/pytest",
+ "Kong/insomnia",
+ "google-research/timesfm",
+ "DietrichGebert/ponytail",
+ "SigNoz/signoz",
+ "Lumiwealth/lumibot",
+ "odysseus-dev/odysseus",
+ "openai/plugins",
+ "x1xhlol/system-prompts-and-models-of-ai-tools",
+ "microsoft/PowerToys",
+ "LMCache/LMCache",
+ "kenn-io/agentsview",
+ "Panniantong/Agent-Reach",
+ "router-for-me/CLIProxyAPI",
+ "anthropics/claude-code",
+ "microsoft/markitdown",
+ "revfactory/harness",
+ "lfnovo/open-notebook",
+ "phuryn/pm-skills",
+ "Andyyyy64/whichllm",
+ "refactoringhq/tolaria",
+ "codejunkie99/agentic-stack",
+ "NousResearch/hermes-agent-self-evolution",
+ "0xNyk/awesome-hermes-agent",
+ "anthropics/claude-agent-sdk-python",
+ "openai/openai-agents-python",
+ "walkinglabs/learn-harness-engineering",
+ "headroomlabs-ai/headroom",
+ "modelcontextprotocol/modelcontextprotocol",
+ "modelcontextprotocol/servers",
+ "mvanhorn/last30days-skill",
+ "aquasecurity/trivy",
+ "HKUDS/AI-Trader",
+ "pydantic/pydantic",
+ "VoltAgent/awesome-openclaw-skills",
+ "yusufkaraaslan/Skill_Seekers",
+ "VoltAgent/awesome-claude-code-subagents",
+ "oraios/serena",
+ "blader/humanizer",
+ "K-Dense-AI/scientific-agent-skills",
+ "davila7/claude-code-templates",
+ "xingkongliang/skills-manager",
+ "HKUDS/RAG-Anything",
+ "mindfold-ai/Trellis",
+ "humanlayer/humanlayer",
+ "BigPizzaV3/CodexPlusPlus",
+ "openai/skills",
+ "farion1231/cc-switch",
+ "breferrari/obsidian-mind",
+ "nyldn/claude-octopus",
+ "VoltAgent/awesome-codex-subagents",
+ "max-sixty/worktrunk",
+ "getagentseal/codeburn",
+ "UfoMiao/zcf",
+ "smtg-ai/claude-squad",
+ "Yeachan-Heo/oh-my-codex",
+ "kepano/obsidian-skills",
+ "can1357/oh-my-pi",
+ "nautechsystems/nautilus_trader",
+ "shanraisshan/codex-cli-best-practice",
+ "modelscope/FunASR",
+ "Open-LLM-VTuber/Open-LLM-VTuber",
+ "supermemoryai/supermemory",
+ "Orchestra-Research/AI-Research-SKILLs",
+ "assafelovic/gpt-researcher",
+ "bytedance/deer-flow",
+ "Piebald-AI/claude-code-system-prompts",
+ "teng-lin/notebooklm-py",
+ "openai/codex-plugin-cc",
+ "VoltAgent/awesome-agent-skills",
+ "yamadashy/repomix",
+ "Yeachan-Heo/oh-my-claudecode",
+ "sickn33/agentic-awesome-skills",
+ "code-yeongyu/oh-my-openagent",
+ "LearningCircuit/local-deep-research",
+ "DenisSergeevitch/agents-best-practices",
+ "EveryInc/compound-engineering-plugin",
+ "anthropics/claude-cookbooks",
+ "paperless-ngx/paperless-ngx",
+ "Fincept-Corporation/FinceptTerminal",
+ "anthropics/knowledge-work-plugins",
+ "Untrivial-ai/agent-orchestrator",
+ "Graphify-Labs/graphify",
+ "OpenHands/OpenHands",
+ "OthmanAdi/planning-with-files",
+ "Egonex-AI/Understand-Anything",
+ "ComposioHQ/composio",
+ "oven-sh/bun",
+ "CloakHQ/CloakBrowser",
+ "tinyhumansai/openhuman",
+ "Imbad0202/academic-research-skills",
+ "colbymchenry/codegraph",
+ "HKUDS/CLI-Anything",
+ "rohitg00/ai-engineering-from-scratch",
+ "rohitg00/agentmemory",
+ "punkpeye/awesome-mcp-servers",
+ "ComposioHQ/awesome-claude-skills",
+ "f/prompts.chat",
+ "addyosmani/agent-skills",
+ "Open-Dev-Society/OpenStock",
+ "akfamily/akshare",
+ "ZhuLinsen/daily_stock_analysis",
+ "wangzhe3224/awesome-systematic-trading",
+ "rtk-ai/rtk",
+ "composio-community/awesome-codex-skills",
+ "warpdotdev/warp",
+ "sirmalloc/ccstatusline",
+ "vercel-labs/agent-skills",
+ "multica-ai/multica",
+ "rowboatlabs/rowboat",
+ "mksglu/context-mode",
+ "zilliztech/claude-context",
+ "HKUDS/DeepTutor",
+ "AsyncFuncAI/deepwiki-open",
+ "aaif-goose/goose",
+ "thedotmack/claude-mem",
+ "coleam00/Archon",
+ "shiyu-coder/Kronos",
+ "mem0ai/mem0",
+ "Tracer-Cloud/opensre",
+ "garrytan/gbrain",
+ "MemPalace/mempalace",
+ "vinta/awesome-python",
+ "alirezarezvani/claude-skills",
+ "unslothai/unsloth",
+ "hesreallyhim/awesome-claude-code",
+ "mattpocock/skills",
+ "TauricResearch/TradingAgents",
+ "onyx-dot-app/onyx",
+ "luongnv89/claude-howto",
+ "google-ai-edge/gallery",
+ "google-ai-edge/LiteRT-LM",
+ "YishenTu/claudian",
+ "multica-ai/andrej-karpathy-skills",
+ "Shubhamsaboo/awesome-llm-apps",
+ "HKUDS/OpenHarness",
+ "quemsah/awesome-claude-plugins",
+ "karpathy/autoresearch",
+ "shanraisshan/claude-code-best-practice",
+ "abhigyanpatwari/GitNexus",
+ "vectorize-io/hindsight",
+ "wanshuiyin/Auto-claude-code-research-in-sleep",
+ "wshobson/agents",
+ "EverMind-AI/EverOS",
+ "promptfoo/promptfoo",
+ "langchain-ai/deepagents",
+ "NousResearch/hermes-agent",
+ "pbakaus/impeccable",
+ "andrewyng/context-hub",
+ "msitarzewski/agency-agents",
+ "lightpanda-io/browser",
+ "666ghj/MiroFish",
+ "shareAI-lab/learn-claude-code",
+ "obra/superpowers",
+ "langchain-ai/open-swe",
+ "jarrodwatts/claude-hud",
+ "koala73/worldmonitor",
+ "VectifyAI/PageIndex",
+ "ruvnet/ruflo",
+ "comet-ml/opik",
+ "affaan-m/ECC"
+ ],
+ "limits": [
+ "Public identity enumeration only; stars do not qualify source, quality or runtime."
+ ],
+ "reduction": "Public repository identities retained without duplicated mutable descriptions; primary ten-source reviews are separate."
+}
diff --git a/catalogs/convergence-practice/architecture-wave/sigstore__cosign.json b/catalogs/convergence-practice/architecture-wave/sigstore__cosign.json
new file mode 100644
index 000000000..1fc906cea
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/sigstore__cosign.json
@@ -0,0 +1,138 @@
+{
+ "repository": "sigstore/cosign",
+ "requested_repository": "sigstore/cosign",
+ "checked_at": "2026-09-20T04:10:43.394776+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/sigstore/cosign",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-18T20:34:09Z",
+ "description": "Code signing and transparency for containers and binaries",
+ "license": {
+ "key": "apache-2.0",
+ "name": "Apache License 2.0",
+ "spdx_id": "Apache-2.0",
+ "url": "https://api.github.com/licenses/apache-2.0",
+ "node_id": "MDc6TGljZW5zZTI="
+ }
+ },
+ "default_head": "0c66ecdff337f647bbcb0259efe61a81e33a76e8",
+ "release": {
+ "tag_name": "v3.1.3",
+ "published_at": "2026-08-06T01:09:23Z",
+ "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.1.3",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "11926fa5bbbbde47e88fc006b625a17769b743b2",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign/commits/v3.1.3",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign/readme?ref=11926fa5bbbbde47e88fc006b625a17769b743b2",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/sigstore/cosign/license?ref=11926fa5bbbbde47e88fc006b625a17769b743b2",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/sigstore/cosign",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "catalog_card"
+ ],
+ "references": [
+ {
+ "kind": "catalog_card",
+ "path": "catalogs/us-equities/agents-operations.json",
+ "pointer": "/entries/36",
+ "id": "cosign",
+ "decision": "conditional",
+ "evidence_level": "source_review"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md",
+ "sha256": "b7adc8494040172cdd057fc1cc73126fab0ae2421b4014cbdf4da0ba8176d017",
+ "git_blob_sha": "263924dfec9d5a6779fd692184654755d3f3caa6",
+ "bytes": 34433,
+ "matched_excerpts": [
+ {
+ "term": "verify",
+ "line": 81,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L81"
+ },
+ {
+ "term": "verify",
+ "line": 115,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L115"
+ },
+ {
+ "term": "sign",
+ "line": 2,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L2"
+ },
+ {
+ "term": "sign",
+ "line": 5,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L5"
+ },
+ {
+ "term": "bundle",
+ "line": 153,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L153"
+ },
+ {
+ "term": "bundle",
+ "line": 155,
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md#L155"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/LICENSE",
+ "metadata": {
+ "key": "other",
+ "name": "Other",
+ "spdx_id": "NOASSERTION",
+ "url": null,
+ "node_id": "MDc6TGljZW5zZTA="
+ },
+ "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+ "bytes": 11357
+ },
+ "decision": {
+ "disposition": "retain-reference-close-gap",
+ "license_text_classification": "Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing catalog candidate can verify publisher identity and signed bundles. Existing public Syft receipt explicitly records signature_verified:false; checksum agreement alone leaves this boundary open.",
+ "next_acceptance": "Verify one upstream signed artifact/bundle against expected issuer and identity, then require tampered-artifact and wrong-identity rejection. No signing/publishing or installation implied.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/source-review.json b/catalogs/convergence-practice/architecture-wave/source-review.json
new file mode 100644
index 000000000..96dc653b0
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/source-review.json
@@ -0,0 +1,275 @@
+{
+ "schema_version": 1,
+ "kind": "bounded_discovery_convergence_review",
+ "checked_at": "2026-09-20T04:12:51.649654+00:00",
+ "public_base": "327d9badff0ad09ec0c1266e70b4ad361743c77f",
+ "scope": "Ten pinned README/license/overview reviews, not ten deep code audits. Native CI execution is recorded separately; stars and list positions do not confer adoption.",
+ "star_delta_file": "public-star-delta.json",
+ "reviewed_repositories": [
+ {
+ "repository": "UKGovernmentBEIS/inspect_ai",
+ "evidence_file": "UKGovernmentBEIS__inspect_ai.json",
+ "source_commit": "ec4dfc6953784dc45b79de3147530c89868c6e26",
+ "release": null,
+ "decision": {
+ "disposition": "retain-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing evaluation candidate can standardize task/scorer/log receipts; missing acceptance is resumability and bounded failure behavior, not another framework identity.",
+ "next_acceptance": "One mock-model task with deterministic scoring, bounded concurrency/retries, retained failure log, interruption and resume; no provider request.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/README.md",
+ "license": "https://github.com/UKGovernmentBEIS/inspect_ai/blob/ec4dfc6953784dc45b79de3147530c89868c6e26/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-19T13:21:18Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "astral-sh/uv",
+ "evidence_file": "astral-sh__uv.json",
+ "source_commit": "635500036e1705961315e86447f0fab0a8ddb309",
+ "release": {
+ "tag_name": "0.12.17",
+ "published_at": "2026-09-18T18:59:24Z",
+ "html_url": "https://github.com/astral-sh/uv/releases/tag/0.12.17",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-native",
+ "license_text_classification": "MIT OR Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing exact 0.12.17 route already provides lockfiles and shared dependency cache. A second environment manager would duplicate this layer.",
+ "next_acceptance": "Use project-owned locks and compare source/dependency fingerprints before cross-host runs; retain isolated environments and caches.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/README.md",
+ "license": "https://github.com/astral-sh/uv/blob/635500036e1705961315e86447f0fab0a8ddb309/LICENSE-APACHE",
+ "archived": false,
+ "pushed_at": "2026-09-20T00:43:09Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "dagucloud/dagu",
+ "evidence_file": "dagucloud__dagu.json",
+ "source_commit": "58fed633d58c1dd1319091fdb2c2f6158ecfa053",
+ "release": {
+ "tag_name": "v2.16.6",
+ "published_at": "2026-09-14T14:45:57Z",
+ "html_url": "https://github.com/dagucloud/dagu/releases/tag/v2.16.6",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-existing-workflow",
+ "license_text_classification": "GPL-3.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing adopted workflow engine already has persisted run state and workers. Remaining public gate concerns actual workload interruption/recovery and unattended host availability.",
+ "next_acceptance": "Reuse one real bounded workflow and prove restart/cancellation on the intended host; do not introduce another scheduler.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/README.md",
+ "license": "https://github.com/dagucloud/dagu/blob/58fed633d58c1dd1319091fdb2c2f6158ecfa053/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-19T16:09:43Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "eyuansu62/agent-retrieval-bench",
+ "evidence_file": "eyuansu62__agent-retrieval-bench.json",
+ "source_commit": "b487f3866cc13dd971819cb902517a6a50282404",
+ "release": {
+ "tag_name": "v0.2.1",
+ "published_at": "2026-07-26T01:08:48Z",
+ "html_url": "https://github.com/eyuansu62/agent-retrieval-bench/releases/tag/v0.2.1",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing exact-release trace2code replay measures file retrieval; root-cause file ranking does not establish edits or lower total provider cost.",
+ "next_acceptance": "Add separate held-out patch/test acceptance after retrieval; preserve all_files and corpus/source pins.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/README.md",
+ "license": "https://github.com/eyuansu62/agent-retrieval-bench/blob/b487f3866cc13dd971819cb902517a6a50282404/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-08-04T04:01:12Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "harbor-framework/harbor",
+ "evidence_file": "harbor-framework__harbor.json",
+ "source_commit": "1e5c5c6db929a10a140d05e606882c671ae20729",
+ "release": {
+ "tag_name": "v0.23.0",
+ "published_at": "2026-09-12T04:55:17Z",
+ "html_url": "https://github.com/harbor-framework/harbor/releases/tag/v0.23.0",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "defer-install",
+ "license_text_classification": "Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing source-reviewed comparator packages runnable agent tasks and deterministic verification. It adds Docker or a cloud environment before a selected benchmark needs it.",
+ "next_acceptance": "Revisit only for a named container task; use oracle-only packaging test first and preserve cleanup evidence.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/README.md",
+ "license": "https://github.com/harbor-framework/harbor/blob/1e5c5c6db929a10a140d05e606882c671ae20729/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-19T18:59:40Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "jaywcjlove/awesome-mac",
+ "evidence_file": "jaywcjlove__awesome-mac.json",
+ "source_commit": "31718871dfbac3cc17139b3958759f5a3e47675c",
+ "release": {
+ "tag_name": "v2.1.0",
+ "published_at": "2026-03-30T16:52:39Z",
+ "html_url": "https://github.com/jaywcjlove/awesome-mac/releases/tag/v2.1.0",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-discovery",
+ "license_text_classification": "CC0-1.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Current list supplies Mac terminal/container/launcher leads. Existing Mac terminal and Apple container plus remote Linux already cover those roles; no demonstrated gap supports a second app layer.",
+ "next_acceptance": "Read only the selected category and verify each actual publisher before any separate adoption.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/README.md",
+ "license": "https://github.com/jaywcjlove/awesome-mac/blob/31718871dfbac3cc17139b3958759f5a3e47675c/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-17T08:01:12Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "jgravelle/jcodemunch-mcp",
+ "evidence_file": "jgravelle__jcodemunch-mcp.json",
+ "source_commit": "8f7b34abe16fb459e0bf1c04747d584216dfe32e",
+ "release": {
+ "tag_name": "v1.108.319",
+ "published_at": "2026-09-16T14:04:32Z",
+ "html_url": "https://github.com/jgravelle/jcodemunch-mcp/releases/tag/v1.108.319",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-rejection",
+ "license_text_classification": "Dual-Use License 1.1",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Current release still overlaps accepted code retrieval; non-commercial/commercial terms remain an unresolved boundary for the trading ecosystem. Publisher token-savings claims are not local evidence.",
+ "next_acceptance": "Do not install or add duplicate server; reopen only after scope/license and a precision gap are explicitly resolved.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/README.md",
+ "license": "https://github.com/jgravelle/jcodemunch-mcp/blob/8f7b34abe16fb459e0bf1c04747d584216dfe32e/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-20T04:02:26Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "sigstore/cosign",
+ "evidence_file": "sigstore__cosign.json",
+ "source_commit": "11926fa5bbbbde47e88fc006b625a17769b743b2",
+ "release": {
+ "tag_name": "v3.1.3",
+ "published_at": "2026-08-06T01:09:23Z",
+ "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.1.3",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-reference-close-gap",
+ "license_text_classification": "Apache-2.0",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing catalog candidate can verify publisher identity and signed bundles. Existing public Syft receipt explicitly records signature_verified:false; checksum agreement alone leaves this boundary open.",
+ "next_acceptance": "Verify one upstream signed artifact/bundle against expected issuer and identity, then require tampered-artifact and wrong-identity rejection. No signing/publishing or installation implied.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/README.md",
+ "license": "https://github.com/sigstore/cosign/blob/11926fa5bbbbde47e88fc006b625a17769b743b2/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-18T20:34:09Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "tobi/qmd",
+ "evidence_file": "tobi__qmd.json",
+ "source_commit": "facd35e01359e59d938bc9418e93fb9318addee3",
+ "release": {
+ "tag_name": "v2.8.3",
+ "published_at": "2026-08-16T22:30:34Z",
+ "html_url": "https://github.com/tobi/qmd/releases/tag/v2.8.3",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "retain-current-route",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing on-device BM25/vector/reranking route addresses explicit document collections. Public open gate still records weak held-out retrieval; another MCP index would not close it.",
+ "next_acceptance": "Freeze new judgments and compare existing lexical/hybrid query shaping on the same collection with quality and usage reported separately.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md",
+ "license": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-09T20:51:56Z",
+ "present_in_baseline": true
+ },
+ {
+ "repository": "zizmorcore/zizmor",
+ "evidence_file": "zizmorcore__zizmor.json",
+ "source_commit": "99a054ed9283c90abdd2d5b9fb5101d27dde9783",
+ "release": {
+ "tag_name": "v1.30.1",
+ "published_at": "2026-09-09T05:34:10Z",
+ "html_url": "https://github.com/zizmorcore/zizmor/releases/tag/v1.30.1",
+ "prerelease": false,
+ "draft": false
+ },
+ "decision": {
+ "disposition": "adopt-as-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Only new identity in this ten-repository public-index comparison. Public CI checks evidence and data joins but does not run CI configuration security analysis; private ecosystem already has this capability.",
+ "next_acceptance": "Port a pinned optional/CI recipe and test a safe workflow plus deliberately unsafe fixture; require findings for injection/unpinned actions and retain false positives. No installation in this review.",
+ "installation_performed": false,
+ "model_calls": 0
+ },
+ "readme": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md",
+ "license": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/LICENSE",
+ "archived": false,
+ "pushed_at": "2026-09-18T06:06:01Z",
+ "present_in_baseline": false
+ }
+ ],
+ "new_public_index_identities": [
+ "zizmorcore/zizmor"
+ ],
+ "access_limits": [
+ "Inspect GitHub releases/latest returned HTTP404; recorded source HEAD ec4dfc6953784dc45b79de3147530c89868c6e26 rather than inventing a release. No package version was fetched.",
+ "Some GitHub license classifiers return NOASSERTION although selected license source declares MIT or Apache2.0; metadata and source classifications remain separate.",
+ "Awesome-mac release v2.1.0 is older than its default branch; current discovery source is pinned default HEAD31718871dfbac3cc17139b3958759f5a3e47675c.",
+ "All ten currently report archived=false; activity alone does not prove quality, compatibility, safe installation or best-in-class status.",
+ "This is one bounded selection pass, not exhaustive star source review or universal SOTA ranking."
+ ],
+ "native_followup": "blueprints/convergence-practice/ci-security/receipt.json"
+}
diff --git a/catalogs/convergence-practice/architecture-wave/tobi__qmd.json b/catalogs/convergence-practice/architecture-wave/tobi__qmd.json
new file mode 100644
index 000000000..82e98fe8d
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/tobi__qmd.json
@@ -0,0 +1,185 @@
+{
+ "repository": "tobi/qmd",
+ "requested_repository": "tobi/qmd",
+ "checked_at": "2026-09-20T04:10:41.323452+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/tobi/qmd",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-09T20:51:56Z",
+ "description": "mini cli search engine for your docs, knowledge bases, meeting notes, whatever. Tracking current sota approaches while being all local",
+ "license": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ }
+ },
+ "default_head": "04e4dbd8245c527a88f1a8f0bda547aef9ca81fb",
+ "release": {
+ "tag_name": "v2.8.3",
+ "published_at": "2026-08-16T22:30:34Z",
+ "html_url": "https://github.com/tobi/qmd/releases/tag/v2.8.3",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "facd35e01359e59d938bc9418e93fb9318addee3",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd/commits/v2.8.3",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd/readme?ref=facd35e01359e59d938bc9418e93fb9318addee3",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/tobi/qmd/license?ref=facd35e01359e59d938bc9418e93fb9318addee3",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [
+ {
+ "repository": "https://github.com/tobi/qmd",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "catalog_card",
+ "component_record",
+ "legacy_candidate",
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/source-review.json",
+ "pointer": "/candidates/6",
+ "decision": "retain",
+ "review_level": "source_review",
+ "evidence_level": "pinned_source_review"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/us-equities/architecture/foundation.json",
+ "pointer": "/repositories/2",
+ "decision": "retain",
+ "evidence_depth": "pinned_primary_source_review"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/us-equities/convergence-program/foundation.json",
+ "pointer": "/repositories/3",
+ "decision": "retain",
+ "evidence_level": "pinned_primary_source_reuse"
+ },
+ {
+ "kind": "catalog_card",
+ "path": "catalogs/us-equities/foundation-memory.json",
+ "pointer": "/entries/3",
+ "id": "foundation-qmd",
+ "decision": "default",
+ "evidence_level": "native_proven"
+ },
+ {
+ "kind": "legacy_candidate",
+ "path": "manifests/candidates.json",
+ "pointer": "/candidates/7",
+ "decision": "First evaluate semantic mode of existing install"
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/25",
+ "id": "qmd"
+ }
+ ]
+ }
+ ],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md",
+ "sha256": "24c049f59408d3d021fbee70d4cd5dd744cdb51f5caea956b417f4dfe7e26880",
+ "git_blob_sha": "2c697f3ee9cdb7f53aea1b41342563a88887f7d4",
+ "bytes": 50056,
+ "matched_excerpts": [
+ {
+ "term": "hybrid",
+ "line": 56,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L56"
+ },
+ {
+ "term": "hybrid",
+ "line": 408,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L408"
+ },
+ {
+ "term": "collection",
+ "line": 40,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L40"
+ },
+ {
+ "term": "collection",
+ "line": 41,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L41"
+ },
+ {
+ "term": "search",
+ "line": 3,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L3"
+ },
+ {
+ "term": "search",
+ "line": 5,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L5"
+ },
+ {
+ "term": "MCP",
+ "line": 89,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L89"
+ },
+ {
+ "term": "MCP",
+ "line": 91,
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/README.md#L91"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/tobi/qmd/blob/facd35e01359e59d938bc9418e93fb9318addee3/LICENSE",
+ "metadata": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ },
+ "sha256": "24c446836e7e2cdea13a914de10c88c553e6297366061ba24013b8ce73c8f7fa",
+ "bytes": 1072
+ },
+ "decision": {
+ "disposition": "retain-current-route",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Existing on-device BM25/vector/reranking route addresses explicit document collections. Public open gate still records weak held-out retrieval; another MCP index would not close it.",
+ "next_acceptance": "Freeze new judgments and compare existing lexical/hybrid query shaping on the same collection with quality and usage reported separately.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json b/catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json
new file mode 100644
index 000000000..dff7a188e
--- /dev/null
+++ b/catalogs/convergence-practice/architecture-wave/zizmorcore__zizmor.json
@@ -0,0 +1,126 @@
+{
+ "repository": "zizmorcore/zizmor",
+ "requested_repository": "zizmorcore/zizmor",
+ "checked_at": "2026-09-20T04:10:43.259941+00:00",
+ "source_depth": "pinned_README_license_overview_only",
+ "metadata": {
+ "html_url": "https://github.com/zizmorcore/zizmor",
+ "default_branch": "main",
+ "archived": false,
+ "disabled": false,
+ "pushed_at": "2026-09-18T06:06:01Z",
+ "description": "Static analysis for GitHub Actions",
+ "license": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ }
+ },
+ "default_head": "e5b9690d7341830c494cdd24f1803623917873d9",
+ "release": {
+ "tag_name": "v1.30.1",
+ "published_at": "2026-09-09T05:34:10Z",
+ "html_url": "https://github.com/zizmorcore/zizmor/releases/tag/v1.30.1",
+ "prerelease": false,
+ "draft": false
+ },
+ "source_commit": "99a054ed9283c90abdd2d5b9fb5101d27dde9783",
+ "source_basis": "latest release",
+ "access": [
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/commits/main",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/releases/latest",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/commits/v1.30.1",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/readme?ref=99a054ed9283c90abdd2d5b9fb5101d27dde9783",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/license?ref=99a054ed9283c90abdd2d5b9fb5101d27dde9783",
+ "exit_code": 0
+ },
+ {
+ "endpoint": "https://api.github.com/repos/zizmorcore/zizmor/contents/README.md?ref=99a054ed9283c90abdd2d5b9fb5101d27dde9783",
+ "exit_code": 0
+ }
+ ],
+ "baseline_index_matches": [],
+ "readme": {
+ "path": "README.md",
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md",
+ "sha256": "770432131713e73537e4e4752497087cfbc0827c4a056c2de1a9baa179a05848",
+ "git_blob_sha": "cb6b574efe50994a7b9c7902d7958991c0fbd01e",
+ "bytes": 4146,
+ "matched_excerpts": [
+ {
+ "term": "static",
+ "line": 10,
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md#L10"
+ },
+ {
+ "term": "Actions",
+ "line": 4,
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md#L4"
+ },
+ {
+ "term": "Actions",
+ "line": 12,
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md#L12"
+ },
+ {
+ "term": "audit",
+ "line": 21,
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md#L21"
+ },
+ {
+ "term": "security",
+ "line": 12,
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md#L12"
+ }
+ ]
+ },
+ "license_at_source": {
+ "path": "LICENSE",
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/LICENSE",
+ "metadata": {
+ "key": "mit",
+ "name": "MIT License",
+ "spdx_id": "MIT",
+ "url": "https://api.github.com/licenses/mit",
+ "node_id": "MDc6TGljZW5zZTEz"
+ },
+ "sha256": "a6fd1bd18da7cec8284639d5b0d351b90934317be1b9f9ea94a077621c6f35af",
+ "bytes": 1109
+ },
+ "supplemental_sources": [
+ {
+ "path": "README.md",
+ "url": "https://github.com/zizmorcore/zizmor/blob/99a054ed9283c90abdd2d5b9fb5101d27dde9783/README.md",
+ "sha256": "770432131713e73537e4e4752497087cfbc0827c4a056c2de1a9baa179a05848",
+ "bytes": 4146
+ }
+ ],
+ "decision": {
+ "disposition": "adopt-as-reference",
+ "license_text_classification": "MIT",
+ "classification_scope": "Observed source license declaration; not dependency/license/legal approval",
+ "concrete_gap_or_overlap": "Only new identity in this ten-repository public-index comparison. Public CI checks evidence and data joins but does not run CI configuration security analysis; private ecosystem already has this capability.",
+ "next_acceptance": "Port a pinned optional/CI recipe and test a safe workflow plus deliberately unsafe fixture; require findings for injection/unpinned actions and retain false positives. No installation in this review.",
+ "installation_performed": false,
+ "model_calls": 0
+ }
+}
diff --git a/catalogs/us-equities/README.md b/catalogs/us-equities/README.md
index 967928598..614612024 100644
--- a/catalogs/us-equities/README.md
+++ b/catalogs/us-equities/README.md
@@ -2,7 +2,7 @@
**Dated decision catalog: September 20, 2026.** The north star is native, token-efficient research → reproducible backtesting → Alpaca paper automation. This is an examined selection across layers, not a universal final SOTA ranking or a claim that every listed framework runs together.
-The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **504 repository identities**, including all 342 public stars and 162 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,037 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material.
+The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **505 repository identities**, including all 342 public stars and 163 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,051 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material.
The newest [security-identity review](security-identity-review.md) examines Alpaca,
Zipline, Qlib, NautilusTrader, LEAN and WRDS. It separates engine identity/lifetime
diff --git a/catalogs/us-equities/decision-index.json b/catalogs/us-equities/decision-index.json
index cdb7bf41a..e987cff40 100644
--- a/catalogs/us-equities/decision-index.json
+++ b/catalogs/us-equities/decision-index.json
@@ -8,6 +8,12 @@
"repository_field": "repository",
"kind": "research_supplement"
},
+ {
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "collection": "/reviewed_repositories",
+ "repository_field": "repository",
+ "kind": "research_supplement"
+ },
{
"path": "catalogs/convergence-practice/source-review.json",
"collection": "/candidates",
@@ -155,16 +161,16 @@
"zep-ai/graphiti": "getzep/graphiti"
},
"counts": {
- "repositories": 504,
+ "repositories": 505,
"public_star_repositories": 342,
- "beyond_public_stars": 162,
- "references": 1040,
+ "beyond_public_stars": 163,
+ "references": 1051,
"repositories_by_record_type": {
"catalog_card": 147,
- "component_record": 52,
+ "component_record": 53,
"legacy_candidate": 19,
"public_star": 342,
- "research_supplement": 100,
+ "research_supplement": 103,
"star_review": 342
}
},
@@ -1657,6 +1663,11 @@
"path": "adoption/research.json",
"pointer": "/candidates/1",
"decision": "required_reuse_existing_native_python_layer"
+ },
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/1"
}
]
},
@@ -3047,6 +3058,11 @@
"research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/2"
+ },
{
"kind": "catalog_card",
"path": "catalogs/us-equities/agents-operations.json",
@@ -4062,6 +4078,11 @@
"research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/3"
+ },
{
"kind": "research_supplement",
"path": "catalogs/convergence-practice/source-review.json",
@@ -5005,6 +5026,11 @@
"research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/4"
+ },
{
"kind": "research_supplement",
"path": "catalogs/convergence-practice/source-review.json",
@@ -5523,6 +5549,11 @@
"star_review"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/5"
+ },
{
"kind": "public_star",
"path": "catalogs/us-equities/coverage.json",
@@ -5625,9 +5656,15 @@
"public_star": true,
"record_types": [
"public_star",
+ "research_supplement",
"star_review"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/6"
+ },
{
"kind": "public_star",
"path": "catalogs/us-equities/coverage.json",
@@ -10340,9 +10377,15 @@
"aliases": [],
"public_star": false,
"record_types": [
- "catalog_card"
+ "catalog_card",
+ "research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/7"
+ },
{
"kind": "catalog_card",
"path": "catalogs/us-equities/agents-operations.json",
@@ -11217,6 +11260,11 @@
"research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/8"
+ },
{
"kind": "research_supplement",
"path": "catalogs/convergence-practice/source-review.json",
@@ -11690,6 +11738,11 @@
"research_supplement"
],
"references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/0"
+ },
{
"kind": "research_supplement",
"path": "catalogs/convergence-practice/source-review.json",
@@ -13066,6 +13119,28 @@
}
]
},
+ {
+ "repository": "https://github.com/zizmorcore/zizmor",
+ "aliases": [],
+ "public_star": false,
+ "record_types": [
+ "component_record",
+ "research_supplement"
+ ],
+ "references": [
+ {
+ "kind": "research_supplement",
+ "path": "catalogs/convergence-practice/architecture-wave/source-review.json",
+ "pointer": "/reviewed_repositories/9"
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/52",
+ "id": "zizmor"
+ }
+ ]
+ },
{
"repository": "https://github.com/zseven-w/openpencil",
"aliases": [],
diff --git a/catalogs/us-equities/manifest.json b/catalogs/us-equities/manifest.json
index b791e7919..f45aab3dc 100644
--- a/catalogs/us-equities/manifest.json
+++ b/catalogs/us-equities/manifest.json
@@ -43,13 +43,15 @@
"catalogs/us-equities/lifecycle-source-review.json",
"blueprints/us-equities/lifecycle-sample/native-receipt.json",
"blueprints/us-equities/catalyst-experiment/receipt.json",
- "blueprints/us-equities/research-efficiency/native-receipt.json"
+ "blueprints/us-equities/research-efficiency/native-receipt.json",
+ "blueprints/convergence-practice/ci-security/receipt.json",
+ "blueprints/convergence-practice/native-worker/receipt.json"
],
"north_star": "blueprints/us-equities/north-star.md",
"harness_contract": "blueprints/us-equities/harness-contract.json",
"broader_reference_union": 171,
"star_audit_file": "catalogs/us-equities/star-audit.json",
- "grand_index_repositories": 504,
- "grand_index_beyond_stars": 162,
+ "grand_index_repositories": 505,
+ "grand_index_beyond_stars": 163,
"decision_index_file": "catalogs/us-equities/decision-index.json"
}
diff --git a/docs/convergence-architecture.md b/docs/convergence-architecture.md
index 5df59a80e..f377584ab 100644
--- a/docs/convergence-architecture.md
+++ b/docs/convergence-architecture.md
@@ -46,7 +46,7 @@ freeze the question, corpus, scoring rule and required uncertainty handling.
Keep complete logs and source bytes outside the prompt, with precise locators
and hashes in the handoff.
-The proposed [contract reference](../blueprints/convergence-practice/contract-reference.md)
+The [contract reference](../blueprints/convergence-practice/contract-reference.md)
and [schema](../blueprints/convergence-practice/contract.schema.json) accompany
the [convergence validator](../scripts/validate_convergence.py) in this integration
wave:
@@ -57,8 +57,9 @@ python3 scripts/validate_convergence.py RECORD.json --root . --json
`RECORD.json` means the selected contract/receipt described by that reference.
Schema validation checks recorded structure and evidence references; it does
-not enforce permissions, reserve resources or run the acceptance task. These
-links are integration dependencies until the coordinator includes those files.
+not enforce permissions, reserve resources or run the acceptance task. The executable validator also checks artifact hashes, matching conditions,
+retained failures and the latest scoped qualification; it does not certify that
+a declaration is truthful.
## 2. Review a component against the gap it would close
@@ -188,10 +189,14 @@ malformed or contradictory evidence is rejected. A hosted pass checks the
publication and its deterministic behavior. A native model run, GPU operation,
client activation or another host requires its own observed acceptance.
-**Integration checkpoint, pending:** this wave plans a bounded native-worker
-patch fixture and a deliberate CI failure/rejection case. The coordinator will
-add the final paths and outcomes after execution and review. Until then, neither
-is a passed result of this guide. Existing receipts remain the evidence baseline.
+The [native child repair](../blueprints/convergence-practice/native-worker/README.md)
+now records one Opus5 parent/child execution in WSL: twelve unchanged tests pass,
+only the assigned file changes, and independent exhaustive four-node checks pass.
+The [CI security qualification](../blueprints/convergence-practice/ci-security/README.md)
+accepts the published workflow and rejects an inert unsafe fixture under a pinned
+native analyzer. Thirty-one contract tests include unequal comparison counts and
+later-failed qualification cases discovered during independent review. These
+results retain their exact fixture, host, persona and accounting limits.
## 8. Close the task with a recoverable decision
diff --git a/docs/ecosystem/README.md b/docs/ecosystem/README.md
index 06bfaedf5..2d246aca4 100644
--- a/docs/ecosystem/README.md
+++ b/docs/ecosystem/README.md
@@ -8,7 +8,7 @@ download the file to view it locally. The same file can be served by an existing
static host, but this change does not configure GitHub Pages or paid hosting.
The four views connect a layered ecosystem map, the canonical repository explorer,
-token-efficiency policy, and evidence with dated source provenance. All 504 public
+token-efficiency policy, and evidence with dated source provenance. All 505 public
index identities and the existing 342-star snapshot are retained. The separate
current-integrations lane makes newly observed Tavily setup searchable without
silently enlarging the canonical index or accepted component manifest. Stars and
diff --git a/docs/ecosystem/index.html b/docs/ecosystem/index.html
index 4f2edf787..7b7e050cb 100644
--- a/docs/ecosystem/index.html
+++ b/docs/ecosystem/index.html
@@ -60,7 +60,7 @@
-
+