Pin ai-memory 2.4.1 and mcporter 0.14.1 on Linux; workstation SOTA refresh record (headroom 0.39.0 qualified, not switched)

[seathatflowsinourveins]

Summary

This PR moves the Linux x86_64 pins to ai-memory 2.4.1 and mcporter 0.14.1, both already switched on the workstation nativestack-5975wx-20260925. It also records the rest of the user-requested 2026-09-25 workstation SOTA refresh, with evidence for every decision.

ai-memory, two production cutovers, each approved by the user:

• 2.3.2 → 2.4.0, 2026-09-25 20:43–20:46Z:
  • V64 → V66 migration; the fingerprint showed 0 pages changed and 0 observations missing.
  • The hook rewrite changed only the binary path, on 8 Claude and 7 Codex commands.
  • A real-client capture was verified.
• 2.4.0 → 2.4.1, 2026-09-26 00:14–00:21Z:
  • V66 → V67; 0 pages changed and 0 observations missing.
  • The Record skill provenance and native catalog limits #792 fd-leak fix is live: live sockets show TCP keepalive, and in the rehearsal 60 of 60 vanished peers were reclaimed within 75 s, where 2.4.0 still held all 60.
• Process for each: an at-rest cold copy first, then a rehearsal on a restored copy, then an independent verifier.
• Pending: the user trusts the changed Codex hooks in Codex /hooks.

mcporter 0.13.13 → 0.14.1:

• A/B: 37/37 checks pass on both versions.
• Live calls work after the switch.
• Limitation: ps must be on the daemon's PATH.

headroom 0.39.0: qualified, not switched. It stays on 0.37.0.

• The source of headroom/transforms/log_compressor.py:461-487 at v0.39.0 counts log levels over all lines but prints them as "[N lines omitted: …]". So "[593 lines omitted: 1 ERROR]" reports the kept CRITICAL line as omitted.
• The Rust detector still lacks the #3736 guard.
• Bootstrap installs the whole token-efficiency profile on Linux (repomix, toon, ccusage, headroom, socraticode, serena pins) #299 pins 0.37.0.
• Overturn: when upstream counts only the omitted lines, or when a measured answer-quality check on log inputs shows net value.

Recorded in docs/decisions/2026-09-25-workstation-sota-refresh.md:

• socraticode 1.15.0 is qualified, with the cutover deferred to on or after 2026-10-01.
• dagu 2.17.2 is held by the trading lane.
• llama.cpp b11146 has provenance only.
• qmd, qdrant, ccusage, worktrunk and vLLM stay; they are already the latest.
• The embedding and generation models stay: no stronger candidate that fits was found.
• The ai-memory embedder is evaluation-only, via [mac-coordinator] other: commit the memory-stack LongMemEval harness and preregistration for the NativeStack rerun #274.

docs/decisions/2026-09-25-ai-memory-2-4-0-release-review.md gets a dated correction section and a pointer at the top.

SOTA sources

• ai-memory:
  • https://github.com/akitaonrails/ai-memory/releases/tag/v2.4.0
  • akitaonrails/ai-memory@v2.3.2...v2.4.0
  • https://github.com/akitaonrails/ai-memory/releases/tag/v2.4.1 (tag commit 433a19f3; tarball sha256 15cafdc4…)
  • akitaonrails/ai-memory@v2.4.0...v2.4.1
  • FD leak: container esgota 1024 file descriptors em ~2-3 dias e o healthcheck quebra por EMFILE akitaonrails/ai-memory#792
  • feat(embedding): query/document prefixes for OpenAI-compatible embedders akitaonrails/ai-memory#859
  • GHSA-9pj6-vhgr-3mwh, GHSA-9g45-5xwm-f3wc and GHSA-33f5-2c5q-wgwj (https://github.com/advisories)
  • serve.rs at v2.4.0: https://github.com/akitaonrails/ai-memory/blob/v2.4.0/crates/ai-memory-cli/src/commands/serve.rs
  • m2026_09_okf_conformance.rs at v2.4.0: https://github.com/akitaonrails/ai-memory/blob/v2.4.0/crates/ai-memory-wiki/src/migrations/m2026_09_okf_conformance.rs
  • install_hooks.rs at v2.3.2: https://github.com/akitaonrails/ai-memory/blob/v2.3.2/crates/ai-memory-cli/src/commands/install_hooks.rs
  • https://developers.openai.com/codex/hooks
• mcporter:
  • https://github.com/openclaw/mcporter/releases/tag/v0.14.1
  • openclaw/mcporter@v0.13.13...v0.14.1
  • https://registry.npmjs.org/-/npm/v1/attestations/mcporter@0.14.1
  • fix(chrome): isolate and clean up compatibility preloads openclaw/mcporter#386
• headroom:
  • https://github.com/headroomlabs-ai/headroom/releases/tag/v0.39.0
  • [BUG] 0.38.0: ISO-8601 timestamped logs routed as search results, now folded lossily (5 of 2,000 lines, timestamps rewritten) headroomlabs-ai/headroom#3736
  • fix(transforms): stop routing timestamped log rows as grep matches headroomlabs-ai/headroom#3748
  • feat(compression): describe what CCR compression dropped, not just how much headroomlabs-ai/headroom#3635
  • https://github.com/headroomlabs-ai/headroom/blob/v0.39.0/headroom/transforms/log_compressor.py#L461-L487
  • https://github.com/headroomlabs-ai/headroom/blob/v0.39.0/crates/headroom-core/src/transforms/log_compressor.rs#L1396-L1433
  • https://pypi.org/project/headroom-ai/0.39.0/
• socraticode, dagu, llama.cpp:
  • https://github.com/giancarloerra/SocratiCode/releases/tag/v1.15.0
  • https://github.com/dagucloud/dagu/releases/tag/v2.17.2
  • GHSA-8wmf-6v46-5gfg
  • https://github.com/ggml-org/llama.cpp/releases/tag/b11146
• Models:
  • https://huggingface.co/Qwen/Qwen3.8-27B
  • https://huggingface.co/nvidia/Nemotron-3-Embed-1B-BF16
  • https://github.com/embeddings-benchmark/results
• This repository: [mac-coordinator] other: commit the memory-stack LongMemEval harness and preregistration for the NativeStack rerun #274, vLLM 0.30.0 for the production embeddings role on WSL (pin, receipt, docs) #260 (pin-move precedent), Pin rtk 0.50.0 and markitdown 0.1.8 on Linux with qualification receipts (workstation SOTA refresh) #291 (sibling rtk and markitdown pins).

Evidence

Receipts (all native_cli_e2e), with sanitized artifacts under evidence/artifacts/sota-refresh-20260925/:

• evidence/receipts/ai-memory-240-qualification-20260925.json
• evidence/receipts/ai-memory-241-qualification-20260925.json
• evidence/receipts/mcporter-0141-qualification-20260925.json
• evidence/receipts/headroom-039-qualification-20260925.json

The cutover.json files hold only coordinator-observed aggregates. No store contents, cold-copy data or private paths are included.

Deliberately unchanged

• Winner pins: the ledger winner pins in catalogs/landscape/foundation.json come from the sealed 2026-09-22 packets and do not move (see vLLM 0.30.0 host receipts on the workstation: install agree, use pending the winner pin #267). A dated limitation records the cutovers.
• macOS pins: untouched. The Mac lag is explicit in tests/test_adoption_bootstrap_macos.py, and adoption/platforms/macos-arm64.md has a standing section on Mac hook paths.
• R1/A17: keeps official 2.4.0 as its isolated control build, per the user's decision.

Review

An independent evidence-reviewer ran:

1. round 1: needs_changes, with 8 doc and evidence defects;
2. a repair round, all 8 fixed;
3. a re-check that found 2 small items, fixed along with the 2.4.1 and headroom additions;
4. a delta review of those additions, which is in progress.

Codex cross-family review was skipped because of the Codex usage limit until 2026-09-30.

Verification (uv Python 3.13 with jsonschema/PyYAML/numpy; head 929ca16 on main e833e3e)

• Pass:
  • validate.py (5993 files, 153 receipts), evidence_manifest --check, host_receipts validate (134);
  • component_matrix --check, new_host_grand_list --check, build_ecosystem --check;
  • catalog_decisions --check, landscape.py, validate_foundation.py;
  • build_verdicts --check, verdict_review_gate --base origin/main (0 rows);
  • gitleaks: clean.
• release_due: reports release_due, as expected, since this changes new-machine files after v2026.09.25.2; the markers are added.
• Full suite: Ran 5784 tests / OK (skipped=613).

Label: lane:foundation. This follows the #260 and #291 precedent; no trading-path file changes.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

A second Linux host that must not follow this ai-memory pin yet: the WSL authoring laptop (wsl-authoring-20260923).

Measured on the laptop, 2026-09-26 01:03Z (ai-memory status):

• The service runs a local build of 2.3.2 with the docs: refresh foundation layer pins and evidence dates #859 prefix change backported (2.3.2-prefix-a11c26f0).
• Its store's vectors are prefixed Nemotron: openai-compat/nvidia/Nemotron-3-Embed-1B-BF16+dp1-707ad539ebca7d87 at dim 2048, 301 of 303 rows.

This PR already records two relevant facts in docs/decisions/2026-09-25-workstation-sota-refresh.md:

• 2.4.1 does not contain docs: refresh foundation layer pins and evidence dates #859, and its config.rs has no prefix keys. Unknown keys are accepted silently, so prefix settings would produce unprefixed vectors.
• 2.4.1's migrations are forward-only (V64 → V67), so after it opens the store the older binary refuses it.

On this laptop, the new adoption/update.md step 1 (re-run the bootstrap, which "repoints each tool's bin/ link at once") would therefore do three things:

• replace the docs: refresh foundation layer pins and evidence dates #859 build with 2.4.1;
• switch every new embedding and query to unprefixed vectors under a different identity;
• make the switch reversible only by restoring the at-rest copy.

The at-rest copy you added protects the data, but not retrieval quality.

Suggested one-line caveat, in adoption/update.md step 1 or the ai-memory install_note: a host whose store uses #859 prefix keys (an embedding identity with +dp) keeps its prefix build until the first official release that contains #859 passes qualification. The laptop stays on its build until then. It is filing a workstation request for qualifying that release and for the prefixed-Nemotron against qwen3-embedding:4b arm.

Nothing else here blocks the Linux pin for new hosts or the workstation. The mcporter 0.14.1 and Headroom decisions match what the laptop sees.

[seathatflowsinourveins]

Review trail:

• An independent evidence-reviewer ran round 1 (needs_changes, 8 defects), a repair round and a re-check (2 small items), then a delta review of the 2.4.1 and headroom additions (3 small fixes).
• All fixes are at head b64f9b0.
• The coordinator spot-checked:
  • receipt 28/28 matches the 28 checks in results/step4-rehearsal.json;
  • no .pem files are tracked, and both keys are listed as not published (source: https://registry.npmjs.org/-/npm/v1/keys);
  • the release-review sentence is dated.
• The worker's full suite on b64f9b0: Ran 5784 tests / OK (skipped=613).

[seathatflowsinourveins]

Codex cross-family review, read-only, at 25c258d:

• Setup: codex exec -s read-only -m gpt-6-astra -c model_reasoning_effort=high via codex-cli 0.155.1, with stdin closed.
• Verdict: VERDICT: agree. It found no concrete defects.
  • Both release commits match, and freshly downloaded archive hashes match the pins; the ai-memory executable hash matches too.
  • All 60 receipt provenance hashes and all 198 artifact-file hashes verify.
  • The retained results support the scoped switch and retain decisions.
  • No private data is exposed.
• It could not check: the private production cold copies and capture records (only aggregates are published), native re-qualification, Codex hook trust, and macOS acceptance.
• Coordinator observation: during that Codex run, ai-memory recorded 0 observations with agent codex. So the 7 changed Codex ai-memory hooks are still skipped as untrusted, as expected, until the user trusts them in /hooks.