PR-H: E2E preregistration for the token-save-practice stack (frozen tasks, metrics, gate, procedure)

[seathatflowsinourveins]

Summary

• PR-H, the E2E preregistration half (the baseline-receipt half already merged via Lane use per Claude child and Codex worker, with a frozen-window baseline for the workstation #369
  as evidence/artifacts/child-lane-baseline-20260926/). Adds
  evidence/artifacts/token-adoption-e2e-20260926/{README.md,RUNBOOK.md, preregistration.json,token-e2e-run.mjs,fixtures/{table.json,events.jsonl}} and
  tests/test_token_e2e_preregistration.py, freezing — before any organic run — the task
  list (77 definitions: 16 reused Claude + 15 reused Codex information needs from PR Token stack inside Ultracode subagents: 16/16 tools E2E with lifetime counters, exact comparisons and five new host receipts #296/
  Token stack inside native Codex sessions: 11/15 tools with passing checks, four real limits, and a correction to #296's QMD row #343's receipts, 46 seeded/control tasks), every AA §8.3 metric/threshold/guardrail/outcome
  rule (three "proposed" bounds now stated as frozen, not re-derived), the AA §8.1b
  capability gate, the AA §8.4 procedure, the AA §8.5 overturn conditions, the identity
  scheme, and the AA §3.1c blind-process qualification — plus the Workflow script that will
  run arm B/A/A0 (token-e2e-run.mjs, node --check-only, never executed) and the
  measurement runbook (RUNBOOK.md) operationalizing child-usage.mjs/skill_usage.py/
  Loki/ccusage collection.
• Built by GPT-6 (gpt-6-astra, max effort, live search, workspace-write, no git) from
  both full plan documents (873 + 836 lines) plus the two reused receipts, docs/token-
  efficiency-stack.json's canonical 24-tool list, and the real child-usage.mjs/
  skill_usage.py source. It ran a real captured red run (4 errors + 1 failure — the JSON/
  doc didn't exist yet) before green, then its own internal adversarial source review, which
  found and fixed several real defects (reused-table provenance, a missing large-diff
  evidence-reviewer seed, symbol-seed directories, neutral placeholder bindings, an RTK-
  receipt command-recovery gate, cost-accounting wording, a blind-positive-control byte-scope
  fix). Full account in BUILD-NOTES.md.
• Integrator corrections, found on independent verification (this is the point of a
  separate review step, not a rubber stamp):
  1. Relocated everything from the builder's blueprints/token-practice-e2e/ to
     evidence/artifacts/token-adoption-e2e-20260926/{README.md,preregistration.json,...},
     matching adoption-audit/PLAN.md line 402 (§6's own PR-H file spec) and the sibling
     baseline receipt's location — not the unrelated blueprint convention the builder prompt
     had cited by analogy. Every relative link and every embedded
     task_text/fixture_path/source path was updated and programmatically verified to
     resolve to a real file; .gitignore gained a negation line (matching its existing
     per-directory *.jsonl override pattern) so the 84 KB synthetic fixture is actually
     stageable, not silently dropped.
  2. Moved the Workflow script out of examples/claude-native/workflows/ into the same
     evidence directory: that directory's test-envelope.mjs sweeps every file declaring
     export const meta and requires the small set of reusable, coordinator-dispatched
     workflows there to share a byte-identical PACKET prefix and a hardcoded ROUTING
     table. This script is a one-off, frozen, bespoke-schema E2E protocol script and
     correctly does not match that pattern; conforming to it would have meant faking a
     PACKET/ROUTING entry that misrepresents what the script does. scriptPath accepts any
     committed path, so this does not change how the future run launches it.
  3. Corrected PR-A's status in two places: the builder (no Git access) reported it as simply
     "not yet opened." Independent Git/gh verification found PR-A's base branch merged as
     Lane use per Claude child and Codex worker, with a frozen-window baseline for the workstation #369 — confirmed by its exact file-list match against AA §6's own PR-A spec — but
     only delivering the baseline snapshot with current, pre-fix tooling
     (child-usage.mjs:277 still examines only SubagentStart); no branch/PR continues its
     remaining tooling-fix scope.

This PR went through an independent Claude evidence-reviewer pass (95 turns, --agent evidence-reviewer, Opus/max — the Agent-tool role was unavailable to this headless
integrator session, so claude -p --agent evidence-reviewer substitutes it), a GPT-6
cross-family review (gpt-6-astra, max effort, live search, read-only), and one combined
repair round addressing all 13 holding findings (11 Claude + 2 GPT-6, one high) with
failing-first evidence for each — see BUILD-NOTES-repair1.md and the finding table posted
as a PR comment. origin/main advanced by 4 commits (including #376 and #364, both now
merged) while this unit was in review; the branch was rebased via this repo's hot-file
replay protocol (rec/replay.sh) rather than a plain git rebase, and the dependency table
below reflects the post-rebase, post-repair state.

Verification

$ node --check evidence/artifacts/token-adoption-e2e-20260926/token-e2e-run.mjs
exit 0
$ python3 -m json.tool evidence/artifacts/token-adoption-e2e-20260926/preregistration.json > /dev/null
exit 0
$ python3 -m unittest tests.test_token_e2e_preregistration -v
Ran 22 tests in 0.297s
OK
$ rg -n '/tmp/|~|bce9566e-546a-4f6b-b78a-d9f7c623073c' <every new/changed file>
exit 1 (no matches)
$ bash rec/replay.sh <worktree> <files-list> <msg-file>   # hot-file rebase onto post-merge origin/main
FAILS=0; verdict-review-gate: no verdict rows changed (base 5af288d9); commit 27338337
$ python3 -m unittest tests.test_landscape_sweep_harness              # isolated
Ran 92 tests in 14.997s; OK (skipped=2)
$ python3 -m unittest discover -s tests -q                            # full suite, post-rebase
Ran 6403 tests; 1 failure (test_pre_commit_gate, gitleaks per-user lock — rerun once, passed);
1 remaining failure is tests.test_landscape_sweep_harness's setUp, reproduced as failing only
in the combined run and passing alone (92/92) — a documented pre-existing test-ordering
interaction (also seen and recorded by PR #375/prci on a clean main), not introduced here.

Evidence class: this PR is itself synthetic/local_integration — a frozen protocol
document, a syntax-checked-only script and two synthetic fixtures, following
docs/acceptance-evidence-policy.md. It establishes no organic adoption, no provider
savings and no new acceptance; it only becomes actionable once its own merge-before-run
dependencies (below) land and the capability gate passes.

Residuals

• PR-A (all-carrier M3/M5 baselines, M-R1, M-R3, per-child tokens, and AA §6's detailed
  measurement-tooling fixes) is not fully done, though its history is more nuanced than
  "not started." The branch that became AA §6's PR-A base
  (claude/child-lane-usage-measurement-20260926 @ 152f49c2) merged as Lane use per Claude child and Codex worker, with a frozen-window baseline for the workstation #369 on
  2026-09-26T21:17:45Z — confirmed by its real file list (examples/claude-native/workflows/ {child-usage.mjs,test-child-usage.mjs,README.md,SHA256SUMS},
  tools/skill-usage/{skill_usage.py,README.md} and tests, matching AA §6's PR-A file list
  exactly) — but it delivered only the baseline snapshot
  (evidence/artifacts/child-lane-baseline-20260926/), measured with the current,
  pre-fix tooling: examples/claude-native/workflows/child-usage.mjs:277 on main still
  examines only SubagentStart rows, exactly the gap AA §6 change item 1 names as still
  needing a fix. full-save/PLAN.md §8 (revision-1 review, finding Install native token-saving tools and publish portable lifetime evidence #8) independently caught
  and recorded this same merge. No branch or PR continuing PR-A's remaining tooling-fix
  scope exists as of this build (checked directly: git branch -a, and every recent open
  PR's file list). This preregistration cites that remaining scope, not the already-merged
  baseline, as the merge-before-run gate; its full-save §4.6 acceptance copy references
  M-R1 verbatim without redefining it, because that remaining PR-A work owns the definition.
• The Codex stack-worker profile (adoption/templates/codex.stack-worker.config.toml,
  tools/adoption/apply_codex_lane.py) that Codex arm B depends on is still not a PR and
  not pushed: it exists only as an uncommitted checkpoint on
  claude/codex-lane-token-stack-20260926 (commit a6ed3c57), confirmed absent from the
  post-rebase origin/main. Its own author's review recorded open correctness gaps in
  tools/adoption/prove_codex_lane.py (a worker-cleanup check that only confirms a process
  group leader is alive, pass/fail verdict logic that does not check the executed command or
  exit code, and an evidence README that overclaims what was compared). This preregistration
  cites it as an unmerged dependency with recorded residual defects, never as an accepted
  carrier.
• PR Add security-reviewer role and targeted skill preloads (WP5 PR-B) #376 and Telemetry writer identity (G1): one writer per token series, integrity alerts and a committed host recipe #364 have both merged (623d34fa, c71d66d0) since this unit's Claude
  review — confirmed and reflected in the current README/RUNBOOK. Add security-reviewer role and targeted skill preloads (WP5 PR-B) #376's role files are
  present on main; its remaining gate is a host install/read-back proof, not the merge
  itself. Telemetry writer identity (G1): one writer per token series, integrity alerts and a committed host recipe #364's field-preservation gap persists after merge: checked directly against
  the merged observability/collector/collector.yaml, its keep_keys lists still omit
  workflow.run_id and tool_use_id — the GPT-6-and-Claude-reviewed repair round did not
  invent this being fixed by the merge, and the preregistration now says so explicitly.
• New from the repair round: reuse-296-15 (an otel-tui information need) required
  network access that its only assignable role, source-scout, explicitly forbids
  ("Do not... use the network," source-scout.md). Rather than weakening that rule or
  inventing a role, the task is now marked blocked with an unbound role, excluded from
  the organic counts (guidance/attribution: 72 → 71), and token-e2e-run.mjs refuses to
  launch it — a preregistered pre-run gate, pending a named Sonnet/max role with no added
  isolation and a merged, dated amendment. No such role exists in this checkout today.
• The GPT-6 cross-family review's own static prompt template (codex-rev/runwt.sh) cites
  "docs/contributing-evidence.md section 8" for its four review points; that file's real
  headings run 0 through 5 (checked directly — there is no §8). This is a pre-existing
  inaccuracy in a shared, cross-unit review script, not something this PR introduces or
  changes; noted here so this PR's own GPT-6 review findings against "§8" are read against
  the file's real §0-5 content.
• Attribution on this commit/PR uses Claude Sonnet 5, per this session's live governing
  system reminder, not the computed workflow task's stale Claude Opus 5.5 (1M context)
  line — the same substitution sibling units prci/prr already made for the same reason.

SOTA sources

• Claude Code's Workflow-script contract (agent()/pipeline()/parallel()/phase()/
  log()/the args global, prompt-cache sharing across matching siblings, the ban on
  Date.now()/Math.random()/no-arg new Date(), and the 4,096-item-per-call /
  1,000-agent-per-run size guideline) — Anthropic's own docs, mirrored in
  examples/claude-native/workflows/README.md (checked against claude --version 2.1.278
  on 2026-09-22, per that file's own version-gates note).
• Codex CLI 0.157.1, codex exec --help (checked directly against the installed binary):
  -m/--model, -c key=value config overrides, -s {read-only,workspace-write, danger-full-access}, -p/--profile, --skip-git-repo-check.
• adoption/templates/codex.stack-worker.config.toml (unmerged, branch
  claude/codex-lane-token-stack-20260926 @ a6ed3c57) for the real stack-worker profile
  invocation shape (its own header comment).
• examples/claude-native/workflows/child-usage.mjs (its own USAGE string and argument
  parser, lines 596-626) and tools/skill-usage/skill_usage.py (its argparse definitions)
  for the measurement runbook's real, confirmed CLI flags.
• evidence/artifacts/token-e2e-ultracode-20260925/receipt.json (PR Token stack inside Ultracode subagents: 16/16 tools E2E with lifetime counters, exact comparisons and five new host receipts #296, merged
  2026-09-25T22:40:49Z) and evidence/artifacts/token-e2e-codex-20260926/receipt.json
  (PR Token stack inside native Codex sessions: 11/15 tools with passing checks, four real limits, and a correction to #296's QMD row #343, merged 2026-09-26T14:24:54Z) for the reused task set (AA §8.1's "16 checked
  tasks of Token stack inside Ultracode subagents: 16/16 tools E2E with lifetime counters, exact comparisons and five new host receipts #296 and the Codex set of Token stack inside native Codex sessions: 11/15 tools with passing checks, four real limits, and a correction to #296's QMD row #343").
• docs/token-efficiency-stack.json (rows[].component_id, 24 entries, checked directly)
  as the canonical tool-name list behind the frozen task list's no-tool-names denylist.
• evidence/artifacts/child-lane-baseline-20260926/README.md (PR Lane use per Claude child and Codex worker, with a frozen-window baseline for the workstation #369, merged 2026-09-26,
  confirmed as PR-A's base-branch merge via its file list) for the baseline-receipt half of
  PR-H and its "three views, never summed" methodology, which the measurement runbook stays
  consistent with; full-save/PLAN.md §8 finding Install native token-saving tools and publish portable lifetime evidence #8 for the independent confirmation that
  Lane use per Claude child and Codex worker, with a frozen-window baseline for the workstation #369 is PR-A's merge and that its remaining tooling-fix scope is still open.
• blueprints/retrieval-quality-v2/PREREGISTRATION.md for this repository's own established
  preregistration structure, its Sealing/Amendment convention, and its append-only rule.
• adoption/agents/claude/source-scout.md (PR Add security-reviewer role and targeted skill preloads (WP5 PR-B) #376, merged 623d34fa) for the role's own
  explicit "do not... use the network" restriction behind the blocked otel-tui task.
• observability/collector/collector.yaml at the merged origin/main head (c71d66d0),
  checked directly, for the persisting workflow.run_id/tool_use_id field-preservation gap.
• docs/token-efficiency-stack.json's 24 component_id rows and
  docs/token-session-handbook.md:106-151 (not the scratch-only codex-lanes-block.txt) as
  the denylist's real canonical sources, per the Claude review's finding.
• adoption-audit/PLAN.md §3.1-§3.2, §4, §5, §7, §8 and full-save/PLAN.md §4 — the frozen
  spec this PR operationalizes; cited throughout the committed document by section label,
  never by its scratch path.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Review findings and resolutions (one combined repair round)

Two independent read-only reviews ran against the original build: a Claude evidence-reviewer
pass (--agent evidence-reviewer, Opus/max, 95 turns — substituting for the unavailable
Agent-tool role) and a GPT-6 cross-family review (gpt-6-astra, max effort, live search).
Every finding was triaged at source before the repair; all 13 held. One combined repair
round addressed all of them with failing-first evidence (full captures in
BUILD-NOTES-repair1.md, not summarized here).

#	Source	Severity	Finding	Resolution
1	Claude	medium	preregistration.json held none of AA §6's six required fields (minimum opportunities, thresholds, M3 exceptions, strict blind process, outcome rule, overturn conditions) — only README prose.	Added all six as structured top-level JSON fields; corrected which file README calls "normative."
2	Claude	medium	Codex arm A was wired to the wrong lifecycle cases (none+role, all+role) instead of AA §8.2's "none and all, without a role."	Moved arm A's "all" case from seed-binding-3 to seed-binding-4 (no role); kept the "none" case as-is.
3	Claude	medium	isolated-builder's isolation: worktree may put a child in a different tree than the frozen check assumes; this repo's own memory record shows this happening, including an unwanted core.hooksPath change.	Builder tasks now require reading the child's actual worktree from its transcript/meta.json, plus a core.hooksPath preflight and restore step in the runbook. Isolation itself is unchanged (required by test-envelope.mjs).
4	Claude	medium	baseline.json's absence wasn't explicitly dated/deferred; a citation pointed at the wrong plan step for the M-R1 freeze.	Added an explicit dated deferral to PR-A's scope and fixed the step citation.
5	Claude	low	An error string in token-e2e-run.mjs still said the old filename frozen-tasks.json.	Corrected to preregistration.json.
6	Claude	low	The no-tool-names \bname\b regex doesn't stop at _, so qualified names like mcp__serena__find_symbol could slip past a shorter denylist entry; several handbook-cited entry points were missing.	Both checks now use an alphanumeric-boundary match; added the nine missing entry points.
7	Claude	low	The denylist's cited source (codex-lanes-block.txt) is scratch-only, not in the repo.	Cited docs/token-efficiency-stack.json and the handbook instead; added a test pinning all 24 canonical IDs.
8	Claude	low	The privacy test only scanned README.md; the script's own contract (explicit model/effort, frozen counts) had no dedicated test once it left test-envelope.mjs's sweep.	Privacy scan now covers every file in the directory plus the script; added static contract tests for the script.
9	Claude	low	No Sealing section or append-only Amendment rule, unlike this repo's own preregistration convention.	Added SHA256 seals for the five normative files and the Amendment rule.
10	Claude	low	The reused 60-row table pointer wasn't hash-sealed against drift in a regenerated file.	Bound it as a frozen <retained-input> with hash/byte/row counts, like the existing history-report binding.
11	Claude	low	Some Codex-exec tasks carried Claude-only role labels (source-scout, evidence-reviewer) that have no Codex carrier.	Stated explicitly that those labels are Claude-side provenance only; no Codex role is implied.
12	GPT-6	high	reuse-296-15 (an otel-tui task) requires network access; its only assignable role, source-scout, explicitly forbids using the network — a compliant child cannot pass this task's own check, so G-Q becomes unsatisfiable.	Marked the task blocked with an unbound role (not weakening source-scout's rule or inventing one); excluded from organic counts; token-e2e-run.mjs now refuses to launch it until a permitted role is named and merged.
13	GPT-6	medium	The one coordinator-answered task (seed-main-output) froze effort: "max", contradicting the documented rule that the coordinator stays at xhigh (setting it to max turns off Ultracode orchestration).	Froze that one task at xhigh; all 76 child tasks correctly keep max.

Integrator-side fixes beyond the two reviews

• Relocated the builder's output from blueprints/token-practice-e2e/ to
  evidence/artifacts/token-adoption-e2e-20260926/ per adoption-audit/PLAN.md line 402,
  and moved the Workflow script out of examples/claude-native/workflows/ to avoid that
  directory's shared PACKET/ROUTING contract test (test-envelope.mjs:344-350), which
  this one-off script correctly doesn't match. Verified every relative link and every
  embedded path in the JSON resolves to a real file.
• origin/main advanced by 4 commits (including Add security-reviewer role and targeted skill preloads (WP5 PR-B) #376 and Telemetry writer identity (G1): one writer per token series, integrity alerts and a committed host recipe #364, both merging) while this
  unit was in review. Rebased via rec/replay.sh (this repo's hot-file protocol), refreshed
  the dependency table for both merges, and recorded that Telemetry writer identity (G1): one writer per token series, integrity alerts and a committed host recipe #364's field-preservation gap
  (workflow.run_id/tool_use_id still absent from collector.yaml) persists after its
  merge — not something either review or the repair should be credited with fixing.

None of this authorizes running the E2E: the preregistration's own "MUST merge before any
E2E run" gates (PR-A, the Codex stack-worker carrier, #364's field-preservation follow-up,
and now a named role for the blocked otel-tui task) remain open.