Pin socraticode 1.15.0 and ccusage 20.0.26 with upstream-suite qualification receipts

[seathatflowsinourveins]

Scope

• What this PR changes: it pins socraticode 1.15.0 (Linux) and ccusage 20.0.26. Each gets a qualification receipt from upstream's own test suites, and the pins, bootstrap files, landscape, snapshot and saturation audit are updated to match. The workstation cut over at 2026-09-27 21:42:49Z (socraticode) and 22:01:01Z (ccusage).
• Base commit: ed3cd96c (origin/main)
• Lane: lane:shared. It changes what manifests/stack.json says (versions), so it needs the trading lane's acknowledgement before merge (docs/lanes.md:145-149).
• Owned paths touched: adoption pins and templates, blueprints/token-native-focus/saturation-audit.json, catalogs/landscape/upstream-snapshot.json, docs (stack, foundation-stack, memory-RAG, the two dated decisions), examples, recipes/README.md, scripts/native_token_ci.py, tests/test_adoption_bootstrap_macos.py, two new receipts, and the hot files manifests/stack.json, manifests/landscape.json and manifests/evidence.json (the last commit).

SOTA sources

• socraticode: https://github.com/giancarloerra/SocratiCode, tag v1.15.0, commit f6191f076a42405f0d5508139f3a8b505cfef93a. Upstream's npm test unit suite and its Qdrant regression tests at that commit.
• ccusage: https://github.com/ccusage/ccusage, tag v20.0.26, commit d9821088b98aa536c7a385aa1a4579d6fa02269b. Upstream's Node tests and cargo test --workspace at that commit; npm tarball integrity checked against the registry (sha256 prefix b8d59c19).

Evidence-class table

Claim	Evidence class	Command / receipt
socraticode 1.15.0 upstream unit suite passes	native_proven (unchanged upstream tests)	evidence/receipts/socraticode-1150-qualification-20260927.json: 2475/2475
socraticode Qdrant regressions pass on a disposable Qdrant 1.19.1	native_proven (unchanged upstream tests)	same receipt: 12/12
socraticode lint and typecheck clean	native_proven	same receipt: biome, tsc, check:release-versions
Host launchers repointed; the stored graph is built by v1.15.0	native_proven (host read-back)	same receipt: 7 launchers plus the symlink; graph_status "Built by: v1.15.0". Status partial: 2 processes were still on 1.14.0 at 02:03:14Z
ccusage 20.0.26 upstream Rust workspace passes	native_proven (unchanged upstream tests)	evidence/receipts/ccusage-20026-qualification-20260927.json: 944 passed, 0 failed, 3 ignored
ccusage Node tests pass	native_proven, non-discriminating	same receipt: 34/34; the test files are identical across tags
ccusage token totals equal 20.0.24 on host logs	local_integration	same receipt: daily, weekly and monthly totals identical
ccusage now prices claude-opus-5-5	local_integration	same receipt: pricing probe, 0.0 on 20.0.24 vs 4.0 on 20.0.26 at 1M input

Local commands run

$ python3 scripts/evidence_manifest.py --check        -> exit 0
$ python3 scripts/validate.py                         -> exit 0
$ python3 scripts/new_host_grand_list.py --check      -> exit 0
$ python3 scripts/component_matrix.py --check         -> exit 0
$ python3 scripts/build_ecosystem.py --check          -> exit 0
$ python3 scripts/host_receipts.py validate           -> exit 0
$ python3 scripts/validate_catalogs.py; python3 scripts/validate_foundation.py --json  -> exit 0, ok true
$ python3 -m unittest <13 affected modules>           -> 731 tests OK (skipped=33)
$ full `unittest discover -s tests` at base vs branch  -> the only branch-only failures were a fixed test_stack_lifecycle row and environment-dependent test_codex_broker_reaper cases (the /tmp worktree plus live claude/codex processes; the failing set varies from run to run)

Decision record

docs/decisions/2026-09-26-token-practice-f1-f9.md (dated update: the currency trigger fired, and the next trigger is anything newer than 20.0.26) and docs/decisions/2026-09-25-workstation-sota-refresh.md. The user waived the socraticode 7-day cooldown on 2026-09-27.

Residuals

• docs/token-efficiency-stack.json (owned by the cards session) still says socraticode 1.14.0 and ccusage 20.0.24.

• The landscape verdict pins stay at 1.14.0 and 20.0.24 until a verdict re-run.

• Host receipts (host_receipts.py record --allow-unbound-version) are not recorded.

• native_token_ci.py --install is left to PR CI.

• ccusage SLSA attestation not fetched, and the installed platform binary's integrity not compared with the registry: both recorded as limitations.

• On this host, native_token_ci.py (installed executables, no --install) exits 1 at 19e5f29. The only failure is serena-tools-list-byte-parity-with-the-pinned-install, and the same check also fails at origin/main ed3cd96. That main run has a second failure, "Installed ccusage differs from its manifest pin", which this branch fixes. The serena failure is a host-specific residual on main; this branch does not touch serena.

Review round 1 and repair (2026-09-28)

• Reviewers: a Claude evidence reviewer and GPT-6 (gpt-6-astra, effort max, runner exit 0). Verdict: repair.
• R1 (high): the Codex template hardcoded socraticode-1.15.0, but the macOS pin is 1.14.0. render_config.py now derives SOCRATICODE_VERSION from the selected platform's pins file, the way it already derives AI_MEMORY_BIN.
  • Four new tests; they fail against the old template.
  • Coordinator re-check: --platform linux-x86_64 renders socraticode-1.15.0 and --platform macos-arm64 renders socraticode-1.14.0, each matching its pins file.
• R1b-R7:
  • per-platform version notes in the examples and the recipes README;
  • the socraticode and ccusage rows in docs/token-efficiency-stack.json;
  • receipt wording: the stale-graph cause from recorded times, untested zero counts, the ccusage consumer scope;
  • docs/stack.md restored;
  • the provenance sentences in pins-macos-arm64.json and foundation-stack.md.
• Rebase: onto f508ffb (Token-lanes carrier: role-matched blocks name only the lanes each agent's allowlist grants #447). adoption/bootstrap.md auto-merged and keeps both texts. manifests/evidence.json was rebuilt last by the hot-file protocol.
• Checks at 19e5f29, all exit 0: validate.py, validate_foundation.py, evidence_manifest.py --check, component_matrix.py --check, new_host_grand_list.py --check, build_ecosystem.py --check, host_receipts.py validate, validate_catalogs.py, landscape.py, and gitleaks over origin/main..HEAD. unittest: 1028 run, OK (49 skipped).
• Still open: existing Codex homes rendered from the pre-merge template keep launching 1.14.0 until they are re-rendered.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Other-lane acknowledgement requested (lane:shared), head 19e5f29.

• Shared hot-file changes:
  • manifests/stack.json: socraticode 1.14.0 → 1.15.0 on Linux (macOS stays 1.14.0 through its own pins file); ccusage 20.0.24 → 20.0.26.
  • manifests/evidence.json: two new qualification receipts and re-registered file hashes, rebuilt last by the hot-file protocol in docs/lanes.md.
• Trading lane: no trading paths are touched.
• Status: the review round and its repairs are done (see the body). Validators exit 0, and unittest ran 1028 tests, OK. I asked native-agent-stack-a9 by message, because no trading-lane session is live. The coordinator will not merge before an acknowledgement comment naming this head.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Merge-time requirement: evidence manifest size bound.

This PR adds 14,248 bytes to manifests/evidence.json. On main fb14ded the file is 1,987,653 bytes, so merged it would reach about 2,001,901. That is past the 2,000,000-byte MAX_BYTES that observability/grand-dashboard/progress.py read() applies to every source, and eight tests/test_grand_dashboard.py tests would fail with "source exceeds size limit".

The fix is in 499a661 on claude/prompt-audit-instructions-20260927 (#444). Its two-file patch-id (git show 499a661e -- progress.py tests/test_grand_dashboard.py | git patch-id --stable) is 8f693abd4c601190, identical to the earlier 4ba16b49 and 7e5eddcd. It adds SOURCE_MAX_BYTES = {'manifests/evidence.json': 8_000_000}, keeps the same read() signature, and the call site at progress.py:188 passes that literal key. It also adds a test that fails before the fix.

• If Prompt audit rounds 2-3: AGENTS.md F1, F4, S1 and X5b; X9 applied to CLAUDE.md, 4 of 4 blind judgments; dashboard manifest bound #444 merges first, the rebase here picks the fix up from main.
• If this PR merges first, the rebase carries only the progress.py and tests/test_grand_dashboard.py hunks of 499a661, credited to that commit. Prompt audit rounds 2-3: AGENTS.md F1, F4, S1 and X5b; X9 applied to CLAUDE.md, 4 of 4 blind judgments; dashboard manifest bound #444's decision and control files stay with Prompt audit rounds 2-3: AGENTS.md F1, F4, S1 and X5b; X9 applied to CLAUDE.md, 4 of 4 blind judgments; dashboard manifest bound #444.
• In either case, manifests/evidence.json is re-registered last with register_file after the rebase, and python3 scripts/validate.py plus tests/test_grand_dashboard.py run before the push.

[seathatflowsinourveins]

Lane acknowledgement (docs/lanes.md): on 2026-09-28 at about 13:40Z the repository owner, who owns both lanes, answered "Yes, merge now" to merging this PR without a live trading-lane session. This comment records that as the acknowledgement.

Rebased head 184d1f2 (base main dd99677):

• The dashboard read bound is carried as 0be8004: only the progress.py and tests/test_grand_dashboard.py hunks of 499a661 (Prompt audit rounds 2-3: AGENTS.md F1, F4, S1 and X5b; X9 applied to CLAUDE.md, 4 of 4 blind judgments; dashboard manifest bound #444), with two-file patch-id 8f693abd4c601190. main's reader refuses the rebased manifest (2,002,449 bytes); the branch's reader accepts it and reads 163 receipts.
• validate.py rc 0 (163 receipts, 7,663 hashed files). tests.test_grand_dashboard: 17 OK. 50 affected test modules: 2,545 OK, 71 skipped for PyYAML, bash 3.2 or shellcheck, which CI covers.
• The PR's two receipt entries are carried unchanged from 19e5f29. Its 31 changed files are re-registered with register_file, and a second run is idempotent.

Merge follows green CI on this head.