Point new machines at the attested release v2026.09.23.1

[seathatflowsinourveins]

Re-pins step 0 for new machines. adoption/manifest.json source.release_tag goes from v2026.09.23 to v2026.09.23.1, and source.release_commit from 4970ba0 to 40828dfe. This follows adoption/update.md §2.

Release v2026.09.23.1 (40828df, main at tag time, all 20 checks green)

• publish-catalog run 35930806614: the publish and release jobs both succeeded. The release is immutable and was published at 2026-09-23T22:55:35Z.
• Assets, verified independently from a download:
  • native-agent-stack-40828dfe….tar.gz, sha256 f8fdc527…. gh attestation verify (signer publish-catalog.yml, --source-ref refs/tags/v2026.09.23.1 --source-digest 40828dfe…) exits 0, and gh release verify-asset succeeds. The archive holds 5472 files, matching the 5472 in the tag tree.
  • native-agent-stack-40828dfe….spdx.json, sha256 0672b4d9…. gh attestation verify --predicate-type https://spdx.dev/Document exits 0, and gh release verify-asset succeeds.
• What new PCs gain over v2026.09.23:
  • macOS arm64 clean install: Homebrew prerequisites, darwin pins, launchd agents (brew-services semantics), embedding acceptance, recording-tooling CI #94: macOS clean install (Homebrew, darwin pins, launchd agents, embedding acceptance);
  • Make the full test suite portable to macOS (symlinked temp paths, platform-specific tests) #126 and Make the macOS signal-injection tests target the script PID (not $PPID) #146: macOS full-suite portability, now gating, and deterministic signal tests;
  • New-PC Claude Code user profile: native claude-code pin, guard, agents, user-scope MCP, settings apply #139: the Claude Code user profile;
  • Derive platform status from host receipts; independent, pin-bound receipt reviews #117, Verdict-pipeline integrity before the 20260923 re-record: per-wave CI, unbiased packets, two-family rule, survivorship, receipt-backed status #122, Verdict integrity round 2: bind rows to sealed waves, strict single-lane authorization, immutable waves, sealed refutations, retained packets #124, Add the required verdict-review-gate: sealed cross-family evidence for every changed verdict row #135 and Make verdict-review-gate apply the landscape validator's withheld-key policy #144: host-evidence hardening and the verdict-integrity pipeline;
  • Make the new-PC install guides followable from the pinned release; add the release-move flow, a docs-consistency test and a receipt-staleness report #134 and Keep the grand catalogs current as new hosts and runtimes record evidence #130: the new-PC guides and the evidence loop;
  • Establish adaptive-paper-broker-trial on a main-built 1x paper trial (paper rung ready) #128 and Live record of paper runs: NautilusTrader JSON log, decision stream, read-only manifest #138: the paper rung.

Checks on this PR

• python3 scripts/release_due.py --strict reports "status": "current" with due: [].
• validate.py, evidence_manifest.py --check and build_ecosystem.py --check pass.
• tests.test_release_pin_contents, test_adoption_docs_consistency, test_adoption_status and test_workflow_hardening pass: 89 tests OK.

The "added after v2026.09.23" notes stay, per update.md §2 step 3: they name the release they were written against, so they remain true history.

Next: v2026.09.23.2 after agent-lab-17's 20260923 re-record and the ENFORCED_PLATFORMS widening. The Linux accepted figure in the grandfathered 20260922 wave is the declared value (33/66). platform_status() derives 20/66 from evidence.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T23:00:19.379960Z	89a9de1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Independent review (github-automation-gap-closure session): pass, no findings.

Diff. Only adoption/manifest.json source.release_tag (v2026.09.23 → v2026.09.23.1) and source.release_commit (4970ba0f → 40828dfe) change, plus the matching manifests/evidence.json re-registration. updated_at is already 2026-09-23.

Tag and release.

• The annotated tag d1357e2b peels to 40828dfe. All 20 check runs are green at that commit.
• The release is immutable, not a draft, not a prerelease, and has two assets.
• publish-catalog run 35930806614: publish and release both succeeded.

My own verification, from a fresh gh release download:

• The archive's sha256 is f8fdc527… and the SPDX file's is 0672b4d9…; both match the release digests.
• gh attestation verify on the archive (SLSA provenance, signer publish-catalog.yml, --source-ref refs/tags/v2026.09.23.1, --source-digest 40828dfe…): exit 0.
• gh attestation verify on the SPDX file with --predicate-type https://spdx.dev/Document, the predicate type the workflow uses; the /v2.3 suffix 404s: exit 0.
• gh release verify-asset for both assets: exit 0.
• The archive holds 5472 files, equal to the tag tree's 5472.

At the PR head 89a9de13:

• release_due.py --strict and --strict-if-repinned origin/main both report current.
• tests.test_release_pin_contents and tests.test_adoption_docs_consistency are OK. The one expected skip is "no profile's coverage differs between the pinned release and HEAD".
• validate.py and evidence_manifest.py --check pass.
• verdict_review_gate.py --base origin/main reports no verdict rows changed.

Once this merges, a new PC's bootstrap step 0 resolves to v2026.09.23.1.