Skip to content

New WSL distro recipe: Canonical Ubuntu 24.04.5 image, cloud-init passwordless user, first boot proofs (definitive SOTA WSL, unit W2) - #569

Merged
seathatflowsinourveins merged 12 commits into
mainfrom
claude/new-wsl-distro-recipe-20261001
Oct 1, 2026
Merged

New WSL distro recipe: Canonical Ubuntu 24.04.5 image, cloud-init passwordless user, first boot proofs (definitive SOTA WSL, unit W2)#569
seathatflowsinourveins merged 12 commits into
mainfrom
claude/new-wsl-distro-recipe-20261001

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Scope

  • What this PR changes, in one or two sentences: adds a source-cited, step-by-step recipe for a new WSL 2 distribution on the existing Windows host from Canonical's Ubuntu 24.04.5 .wsl image (cloud-init gives it a passwordless default user before the first launch; the first boot proves systemd, linger and the user bus before the repository bootstrap), with four templates, a decision record carrying a 79-row command table, and a consistency test that binds them. Documented, not run: nothing touched WSL on any host.
  • Base commit: the current origin/main (written on 3361b342, rebased with the hot-file protocol).
  • Lane: lane:foundation
  • Owned paths touched: adoption/platforms/linux-wsl2-new-distro.md (new), adoption/platforms/linux-wsl2.md (pointer section), adoption/templates/wsl/ (cloud-init user-data template, host file template, first-boot checklist, stage-1 receipt example), docs/decisions/2026-10-01-new-wsl-distro-recipe.md (new), tests/test_wsl_new_distro_recipe.py (new), manifests/evidence.json (last commit only).
  • grants: none
  • Program context: unit W2 of the definitive-SOTA-WSL program (the user's 2026-10-01 directive; Gate A re-aimed at the new distro). Stage 2 is the existing adoption/bootstrap-linux.sh --profile <id> --configure-full-profile --host <host> after native sign-in.

SOTA sources

Research unit and builder reads of 2026-10-01 (every claim in the record cites one of these):

Follow-up scope (2026-10-01). Step F11 records the per-project jCodeMunch registration after stage 2 (found by the cross-family review of PR #548: four of the six SubagentStart carrier blocks name its tools, the user-scope MCP template leaves it out by a dated decision, and no script registers or installs it; after stage 2 alone the expected outcome is not installed). F5 keeps 65,536 subordinate ids as the stage-1 value and says, with Docker's page, when an image set needs more. adoption/platforms/linux-wsl2.md quotes the current vLLM pin sentence of adoption/lifecycle.md. F11 is a source read; no host has run it on a new distribution.

Evidence-class table

Claim Evidence class Command / receipt
The image sha256 is published by Canonical and Microsoft and matched the streamed bytes (388,975,696) source_review + artifact check on the authoring host (streamed once, nothing written) step W2; record "Context"
WSL runs the first-run command only for a no-command launch; a failed first launch leaves setup pending source_review WSL 2.7.13 source
The image's wsl-setup/wait-for-cloud-init behaviour, packages and login.defs source_review (files read from the streamed image) record "Context"
The pinned Node x64 binary needs no libatomic.so.1 local check on the authoring host (readelf -d) record "Alternatives" 3
Recipe, templates, record, receipt example and checklist agree local_integration tests/test_wsl_new_distro_recipe.py (failing-first: 15 tests, 14 errors before the artifacts existed)
Stage 1 and the first boot work on a host not run; the first run records it stage-1 receipt (future, evidence/receipts/wsl-new-distro-stage1-<host>-<date>.json)

No unchanged upstream test suite was run.

Local commands run

$ python3 -m unittest tests.test_adoption_docs_consistency tests.test_wsl_new_distro_recipe
exit 0: Ran 52 tests; OK (skipped=1)
$ python3 scripts/validate.py
exit 0: "status": "passed"
$ python3 -m unittest <the three registry tests>
exit 0: Ran 3 tests; OK
$ python3 -m unittest tests.test_adoption_contract tests.test_render_config tests.test_ecosystem_manifest
exit 0: Ran 111 tests; OK
$ privacy scan of origin/main...HEAD (PRIVATE_CONTENT patterns + host checks)
exit 0: 1356 added lines, 0 hits

Decision record

docs/decisions/2026-10-01-new-wsl-distro-recipe.md: five decisions (image 24.04.5 with 26.04.1 as the queued comparison; creation path --install --from-file with cloud-init, --import plus a manual user as the fallback, an in-place repair recorded as the cheaper first fallback; first boot: systemd, linger, user bus, apt packages incl. uidmap, subordinate ids, the ~/.bash_profile hand-off, the host file with non-colliding ports; host-wide rules: no .wslconfig change, no wsl --update, never wsl --shutdown; open questions), each with alternatives and an overturn condition; the 94-row command table the test binds to the recipe; evidence classes.

Review round (2026-10-01, head 11a30be)

The Codex review bot left four threads; all are answered on the thread and resolved.

  • Receipt coverage (P2): the receipt example carries one entry per recipe command (94), and the check compares counts of (step, command) with the recipe's rows; a missing step, a missing command and an extra command each fail (c66dab9).
  • Convergence record (P1): blueprints/convergence-practice/wsl-new-distro-image-20261001/experiment.json, status planned, decision trial: selected by source review, not a completed adoption until a host run and the queued 26.04.1 comparison. It pins the recipe, templates, checklist, receipt example and test by SHA-256 and is registered in manifests/evidence.json; python3 scripts/validate_convergence.py --all-recorded exit 0, 26 records valid (cb998aa).
  • Completeness critic (P1): the unit had closed without one. An independent read-only researcher ran it; the decision record's new "Completeness critic (2026-10-01)" section lists its 11 items with dispositions. None overturns the selection. Four change what must happen before stage 1 (a rehearsal on a throwaway name, Windows apps writing to \\wsl.localhost create files owned by root (UID 0) instead of WSL default user microsoft/WSL#40941, #41482, #13416 with #9968) and two upstream verification steps are missing (sudo cloud-init schema --system, the signed SHA256SUMS.gpg). They are queued as a follow-up pull request; do not run stage 1 from this recipe before that follow-up lands (1ef6baf).
  • Export before unregister (P1): W6 terminates the distribution, exports it, and throws on a nonzero export exit before --unregister; the receipt records the export as failed_attempt_export (3930f56).

At this head: python3 -m unittest tests.test_wsl_new_distro_recipe exit 0 (31 tests), python3 scripts/validate.py exit 0 (8,726 hashed files), file rows 8,720 -> 8,726 against the previous head with none lost.

Host evidence

Not applicable.

Checklist

  • No GitHub Actions changed.
  • No workflows changed.
  • No secrets printed, logged or committed.
  • No paid hosting, subscription or billing surface.
  • Peer-owned untracked files and worktrees preserved.

🤖 Generated with Claude Code

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 1, 2026
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0d6b87bf5f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tests/test_wsl_new_distro_recipe.py Outdated
Comment thread docs/decisions/2026-10-01-new-wsl-distro-recipe.md
Comment thread docs/decisions/2026-10-01-new-wsl-distro-recipe.md
Comment thread adoption/platforms/linux-wsl2-new-distro.md
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 1, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-01T04:45:27.650649Z 0d6b87b PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@seathatflowsinourveins

seathatflowsinourveins commented Oct 1, 2026

Copy link
Copy Markdown
Collaborator Author

Cross-family review of the whole PR (GPT-6.1 Sol at max through the OmniRoute gateway, read-only codex exec, web search off, 2026-10-01 ~05:00Z): verdict needs_changes, three findings, all source-cited and accepted: (1) HIGH, linux-wsl2-new-distro.md:166: W5 expects cloud-init status --long to report status: done, but cloud-init 26.1 reports disabled once /etc/cloud/cloud-init.disabled exists (cloudinit/cmd/status.py#L284 at 26.1), so a successful provisioning would fail the checklist; fix: expect the marker-disabled state and verify completion and errors from the retained result separately. (2) MEDIUM, :67: the preflight misses %USERPROFILE%\.ubuntupro\.cloud-init\agent.yaml, whose top-level keys override user-data in cloud-init 26.1 (DataSourceWSL.py#L317); fix: add the preflight check and cite the merge order. (3) LOW, :363: type -P can print a non-executable file; fix: test -f and test -x per returned path. A repair round is running; the repaired head follows with the answers.

seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
WSL new-distro recipe: fix the three cross-family review findings (cl…
89bab8d 
…oud-init 26.1 status, agent.yaml, type -P)

GPT-6.1 Sol's read-only review of PR #569 (2026-10-01) found three defects; each fix cites cloud-init at tag 26.1
(8bf3567532b0).

1. W5 expected `cloud-init status --long` to print `status: done` after wsl-setup writes
   /etc/cloud/cloud-init.disabled. 26.1 reports `disabled` with boot code `disabled-by-marker-file` once the marker
   exists (cloudinit/cmd/status.py:284-286, 385-386), and `status` reads errors only from the boot's /run copy
   (:471-490). W5 now expects that state and reads completion and errors from /var/lib/cloud/data/result.json
   (written only when the final stage ends, with every stage's errors; main.py:1017-1030) and status.json (per-stage
   finished times and errors; main.py:915-1015). W6 records disabled-by-generator for an import without a
   datasource, and records the two files' absence when cloud-init did not run.
2. W1 checked only the Landscape instance file. It now also tests %USERPROFILE%\.ubuntupro\.cloud-init\agent.yaml
   and lists its top-level keys, stopping if `users` or `write_files` is among them: every agent.yaml top-level key
   replaces the user-data's key (DataSourceWSL.py:317-336, called at :490; Ubuntu Pro files loaded first at
   :241-270, :465-476).
3. F10 trusted `type -P claude codex`, which can print a stale or non-executable path and exit 0. A second line now
   tests each printed path with `test -f` and `test -x`, keeping linux-wsl2.md's limitation note.

The record's command table gains the five new rows and the changed proofs, its Context names the 26.1 semantics, and
its Sources and Evidence classes cite them. tests/test_wsl_new_distro_recipe.py CrossFamilyReviewTests checks each
fix and its mutants. On the pre-repair content (67d3055) the three new checks report 6, 3 and 1 errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@seathatflowsinourveins

seathatflowsinourveins commented Oct 1, 2026

Copy link
Copy Markdown
Collaborator Author

Repair for the GPT-6.1 Sol review (2026-10-01): all three findings fixed in 89bab8df; head eabe7654 (hot-file commit last, on 50bba7bb). Each fix is checked against cloud-init at tag 26.1 (8bf3567532b0), the image's version.

1 (HIGH), W5 expected status: done after the marker. Agreed, fixed. With systemd, /etc/cloud/cloud-init.disabled sets the boot code disabled-by-marker-file (cloudinit/cmd/status.py#L284-L286 at 26.1) and the status disabled whatever the run did (#L385-L386); status reads errors only from that boot's /run/cloud-init/status.json (#L471-L490); detail: is the datasource while that /run file exists and the marker reason only after a restart (#L407-L419). W5 now checks status: disabled and boot_status_code: disabled-by-marker-file, and takes completion and errors from the persistent files: /var/lib/cloud/data/result.json ("datasource": "DataSourceWSL", "errors": []; written only when the final stage ends, cloudinit/cmd/main.py#L1017-L1030) and /var/lib/cloud/data/status.json (init-local, init, modules-config, modules-final finished with empty errors; main.py#L915-L1015). Exit 2 (warnings, still disabled) is recorded, not a stop (status.py#L158-L163, #L254-L255); status: error or exit 1 stops. W6's first status --wait records done, error, or disabled by disabled-by-generator (#L298-L300), then repeats W5's checks after its root block writes the marker.

2 (MEDIUM), the preflight missed agent.yaml. Agreed, fixed. cloud-init 26.1 loads .ubuntupro\.cloud-init\<instance>.user-data and agent.yaml (DataSourceWSL.py#L241-L270, #L465-L476) and merge_agent_landscape_data replaces each user-data top-level key with agent.yaml's (#L317-L336, called at #L490). W1 now runs Test-Path on %USERPROFILE%\.ubuntupro\.cloud-init\agent.yaml and lists its top-level keys; the proof is False, or the keys recorded with neither users: nor write_files: among them (either key stops the run).

3 (LOW), F10 trusted type -P. Agreed, fixed. F10 keeps the launch-shape line and adds test -f and test -x per returned path, with an executable: line for both as the proof; the existing limitation note in adoption/platforms/linux-wsl2.md is cited.

Also updated: the record's command table (79 → 84 rows), Context, Decision, Sources and Evidence classes, and the checklist's W1, W5, W6 and F10 lines. tests/test_wsl_new_distro_recipe.py::CrossFamilyReviewTests checks each fix and fails on its mutants (pre-repair content: 6, 3 and 1 errors). At eabe7654: the two test modules (58 tests), validate.py, the registry tests, the 111 adoption tests and the privacy scan (1,548 added lines, 0 hits) all exit 0.

@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/new-wsl-distro-recipe-20261001 branch from 0d6b87b to eabe765 Compare October 1, 2026 05:11
This was referenced Oct 1, 2026
Merged
Merged
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
WSL new-distro recipe: fix the three cross-family review findings (cl…
2549099 
…oud-init 26.1 status, agent.yaml, type -P)

GPT-6.1 Sol's read-only review of PR #569 (2026-10-01) found three defects; each fix cites cloud-init at tag 26.1
(8bf3567532b0).

1. W5 expected `cloud-init status --long` to print `status: done` after wsl-setup writes
   /etc/cloud/cloud-init.disabled. 26.1 reports `disabled` with boot code `disabled-by-marker-file` once the marker
   exists (cloudinit/cmd/status.py:284-286, 385-386), and `status` reads errors only from the boot's /run copy
   (:471-490). W5 now expects that state and reads completion and errors from /var/lib/cloud/data/result.json
   (written only when the final stage ends, with every stage's errors; main.py:1017-1030) and status.json (per-stage
   finished times and errors; main.py:915-1015). W6 records disabled-by-generator for an import without a
   datasource, and records the two files' absence when cloud-init did not run.
2. W1 checked only the Landscape instance file. It now also tests %USERPROFILE%\.ubuntupro\.cloud-init\agent.yaml
   and lists its top-level keys, stopping if `users` or `write_files` is among them: every agent.yaml top-level key
   replaces the user-data's key (DataSourceWSL.py:317-336, called at :490; Ubuntu Pro files loaded first at
   :241-270, :465-476).
3. F10 trusted `type -P claude codex`, which can print a stale or non-executable path and exit 0. A second line now
   tests each printed path with `test -f` and `test -x`, keeping linux-wsl2.md's limitation note.

The record's command table gains the five new rows and the changed proofs, its Context names the 26.1 semantics, and
its Sources and Evidence classes cite them. tests/test_wsl_new_distro_recipe.py CrossFamilyReviewTests checks each
fix and its mutants. On the pre-repair content (67d3055) the three new checks report 6, 3 and 1 errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/new-wsl-distro-recipe-20261001 branch from eabe765 to 344a69f Compare October 1, 2026 08:28
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 1, 2026
Merged
5 tasks done
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
New-WSL architecture edition 2026-10-01: 37 rows, none closed, with i…
dbc62a0 
…ts decision record

catalogs/foundation/new-wsl-architecture-20261001.json is the install manifest for a new WSL
distribution: one row per catalog layer (20 foundation, 12 us-equities) plus five cross rows
(distribution, runtime workers, GPT-6 harnesses, credential practice, convergence practice).
Each row carries winners at their pin of record, a verdict under the research state's five
closure items, the evidence class every winner reaches, sourced reasons, alternatives,
per-winner upstream currency read on 2026-10-01, ordered new-host steps and gates.

Verdicts: 19 selection_of_record_open, 12 comparison_required, 4 no_selection, 1 provisional
(token-efficiency), 1 new_host_required (recovery-portability); closed: none. The trading rows
are the fallback form (assessment pending, provisional_wording). Sources not yet on main are
cited through PR #569, #570 and #358.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition: the coordinator's review edits (holds as gates,…
21d5173 
… subordinate ids, scheduling comparison, trading rows from the complete assessment)

- Pending sources follow their pull requests' heads (#569 344a69f, #570 87c74d5); the program record and the
  foundation assessment (#573) join the sources.
- quality-evaluation: 65,536 subordinate ids at stage 1, a wider range only on Docker's documented pull error, with
  the workstation observation cited from the Harbor receipt; the OAuth token lives in its 0600 provider file.
- durable-memory and cross:runtime-workers carry the holds the production program reports (Hindsight's stale and
  paused pages and held cold seed; AgentRelay's held automatic Codex PTY submission) as gates, and durable-memory the
  open operator decision on the 2026-09-23 live-store breach.
- code-navigation: the carrier names jCodeMunch while stage 2 neither installs nor registers it (gate); the recipe's
  step F11 joins the install order.
- scheduling-supervision: comparison_required after the failed preregistered SIGKILL case (the program record's
  decision 1), with the limit of the Temporal arm stated.
- hosting-services: Next.js 16.3.8 fixes a High-severity advisory above both recorded pins (release page read
  2026-10-01); a gate asks for the pin move before the layer hosts anything reachable.
- us-equities: the rows follow the last complete result per layer of the now complete 12-layer assessment
  (backtesting-engine item 1 met and item 4 unmet; portfolio-risk item 5 partial; security-supply-chain assessed).
- The decision record follows: 20 selection_of_record_open, 14 comparison_required; run-to-run variance stated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Scout and others added 12 commits October 1, 2026 05:32
Scout @claude
WSL new-distro recipe: consistency test, written before the recipe
93fda0f 
tests/test_wsl_new_distro_recipe.py binds the coming recipe page, its templates and its decision record:
the cloud-init user-data template renders (string.Template equals PowerShell's literal replace; #cloud-config
first, no BOM, uid 1000, NOPASSWD sudo, locked password, [user] default), the host value template has
adoption/hosts/example.json's keys on loopback ports outside the workstation's set and matches the recipe's ss
probe, every recipe command is a row of the record's command table under the same step and shell, one image
sha256 across recipe, record, receipt example and checklist, the receipt example carries the payload keys
scripts/validate.py compares, and no recipe command shuts down, updates or retargets WSL. Each check has
mutant cases. At this commit the 14 file-backed tests error with FileNotFoundError; the next commit adds the files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL new-distro recipe: stage 1 and first boot from Canonical's Ubuntu…
7969376 
… 24.04.5 image, cloud-init user

adoption/platforms/linux-wsl2-new-distro.md is a step-by-step procedure an LLM-native session can run. Steps W1-W6
run on the Windows host in PowerShell, as .ps1 files from a WSL session:
- preflight;
- download the image and verify its sha256 against SHA256SUMS and microsoft/WSL DistributionInfo.json at 8bc98bc;
- render %USERPROFILE%\.cloud-init\<Name>.user-data from the template;
- wsl --install --from-file ... --name --location Z:\WSL\<Name> --no-launch;
- a first launch with stdin at EOF, so the image's wsl-setup runs unattended or fails at once with a visible
  marker;
- path B (import, manual user) only after that marker.

Steps F1-F10 run inside the new distribution as the user: systemd running, linger, the user bus, the
bootstrap's packages plus libatomic1 and uidmap, subordinate ids, the .bash_profile hand-off, a clone of
origin/main, a host file on ports outside the workstation's, the stage-2 hand-off with --profile, and the
Windows Terminal PATH proof. Each step names its exact proof.

Host-wide rules: no .wslconfig change, no wsl --update, never wsl --shutdown, the default distribution unchanged.

Templates under adoption/templates/wsl/: cloud-init user-data, host values, the stage-1 receipt example and a
checklist. linux-wsl2.md gains a pointer section before its Windows Terminal section.
docs/decisions/2026-10-01-new-wsl-distro-recipe.md records the coordinator's five decisions with alternatives,
overturn conditions, the 79-row command table, the open questions and every source.

Documented, not run: nothing touched WSL on any host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL new-distro recipe: create the log folder in W1, before the transc…
6b70b2b 
…ript opens

The intro opens each PowerShell block's transcript in Z:\WSL\downloads, which W2 created, so W1 had no folder
to log into. W1 now starts with the New-Item line and says the transcript opens right after it. The
command-table test required the matching row to move from W2 to W1 in the decision record. The checklist's W1
names the folder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL new-distro recipe: list the research unit's own sources in the de…
6267786 
…cision record

Context and Alternatives cite facts only the research unit read: the host's wsl.exe --version and --help,
WSL 2.7.14 and 3.0.1 release notes, resolute SHA256SUMS with the 26.04.1 image contents, and the cloud-images WSL
notice. Sources now names each of them, apart from what unit W2 re-read itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL new-distro recipe: fix the three cross-family review findings (cl…
97f8dd7 
…oud-init 26.1 status, agent.yaml, type -P)

GPT-6.1 Sol's read-only review of PR #569 (2026-10-01) found three defects; each fix cites cloud-init at tag 26.1
(8bf3567532b0).

1. W5 expected `cloud-init status --long` to print `status: done` after wsl-setup writes
   /etc/cloud/cloud-init.disabled. 26.1 reports `disabled` with boot code `disabled-by-marker-file` once the marker
   exists (cloudinit/cmd/status.py:284-286, 385-386), and `status` reads errors only from the boot's /run copy
   (:471-490). W5 now expects that state and reads completion and errors from /var/lib/cloud/data/result.json
   (written only when the final stage ends, with every stage's errors; main.py:1017-1030) and status.json (per-stage
   finished times and errors; main.py:915-1015). W6 records disabled-by-generator for an import without a
   datasource, and records the two files' absence when cloud-init did not run.
2. W1 checked only the Landscape instance file. It now also tests %USERPROFILE%\.ubuntupro\.cloud-init\agent.yaml
   and lists its top-level keys, stopping if `users` or `write_files` is among them: every agent.yaml top-level key
   replaces the user-data's key (DataSourceWSL.py:317-336, called at :490; Ubuntu Pro files loaded first at
   :241-270, :465-476).
3. F10 trusted `type -P claude codex`, which can print a stale or non-executable path and exit 0. A second line now
   tests each printed path with `test -f` and `test -x`, keeping linux-wsl2.md's limitation note.

The record's command table gains the five new rows and the changed proofs, its Context names the 26.1 semantics, and
its Sources and Evidence classes cite them. tests/test_wsl_new_distro_recipe.py CrossFamilyReviewTests checks each
fix and its mutants. On the pre-repair content (67d3055) the three new checks report 6, 3 and 1 errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL new-distro recipe: F11 registers jCodeMunch for the clone after s…
af40ff5 
…tage 2; F5 says when more than 65,536 subordinate ids are needed

F11 runs adoption/bootstrap.md step 4a's own `claude mcp add --scope local
jcodemunch` line from the clone's root, after F9 and F10, in a block after
the `test -x` of the binary, and proves it with `claude mcp get jcodemunch`.
Four of the six SubagentStart carrier blocks name jCodeMunch tools, the
user-scope MCP template leaves the server out (2026-09-25 addendum of
docs/decisions/2026-09-23-claude-user-profile.md) and no script registers
it. No adoption profile pins jcodemunch-mcp, so after F9 alone the expected
outcome is `not installed`. The checklist and the receipt example's new
`jcodemunch_registration` field record registered, not installed, or
skipped with the reason.

F5 keeps 65,536 as the stage-1 value and quotes Docker's rootless
troubleshooting page on `lchown <FILE>: invalid argument`: a wider range is
an image-set need, added only when that error appears, by the unit that
pulls the images.

tests/test_wsl_new_distro_recipe.py holds F11 to the bootstrap block, the
step order, the separate binary-test block, the checklist, the receipt field
and the record's MCP source. It holds F5 to 65,536 ids and its source. Each
check has rejecting controls. The new text comes from source reads only:
Claude Code's MCP page and Docker's troubleshooting page, re-read
2026-10-01 08:02Z. Nothing ran on a host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
linux-wsl2.md: quote adoption/lifecycle.md's current vLLM pin sentenc…
2b7e92c 
…e (0.30.0), not the stale 0.25.0 one

The "vLLM pin: 0.30.0 (0.29.0 fails on WSL)" section said lifecycle.md
"records this exactly: The working WSL vLLM pin remains 0.25.0. ...". That
file now says "The working WSL vLLM pin is 0.30.0 since 2026-09-25,
qualified against 0.25.0 ..." (lines 157-162), and the section quotes that
text word for word. The caution keeps its rule: re-test any newer release's
startup on the new host's own GPU and driver before bumping the pin. It no
longer names 0.29.0, which is older than the 0.30.0 pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL recipe W6: export the failed attempt before --unregister (review …
3930f56 
…finding 3 of #569)

Path B now stops <Name> and exports it with Microsoft's documented wsl --export <Distribution Name> <FileName> into W1's log folder (Z:\WSL\downloads\<Name>-failed.tar) in the same block as --unregister and before it; a nonzero export exit throws before the deletion, and the file's SHA-256 and size go to the receipt's new failed_attempt_export field. The page says what to read in the tar (the cloud-init logs, /var/lib/cloud/instance, result.json and status.json). The record's command table, decision bullet and sources (Basic commands for WSL, ms.date 2025-12-01, and Canonical's cloud-init page, both read 2026-10-01 through Context Mode; neither documents an in-place repair), the checklist and the receipt example follow. The test rejects an --unregister without a preceding export in its block, a missing guard, stop, receipt field, checklist requirement or source, and any --export of a distribution other than <Name>. Source read only; no host ran it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL recipe receipt example: one entry per recipe command (review find…
c66dab9 
…ing 1 of #569)

The receipt-example check now compares the example's (step, cmd) entries with the recipe's command rows, the same recipe_rows() the command-table check reads, once per occurrence: a receipt that omits a step or a command, adds one, or names a step the recipe lacks fails, and every recipe step must have a command line. Failing first: on the previous example (W4, W5, F1-F3 only) tests.test_wsl_new_distro_recipe.ReceiptExampleTests ran 3 tests with failures=2, exit 1. The example now holds all 94 command lines with placeholders for what a run fills in (W6 marked path B only), keeping the five filled entries; new controls reject a missing step (W1), a missing command, an extra command under a real step and a duplicated command.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL distro selection: scoped convergence experiment record (review fi…
cb998aa 
…nding 2 of #569)

Adds blueprints/convergence-practice/wsl-new-distro-image-20261001/experiment.json in the form scripts/validate_convergence.py checks, after the one planned precedent (gpt6-family-tiering-20260926). It states what happened: a source-review selection of Canonical's Ubuntu 24.04.5 image with path A, status planned, decision trial, no observation, no comparison executed and no host run of stage 1 or first boot. The 26.04.1 comparison (queued, not run) and path B (documented, not run) are the named alternatives, and the research unit's usage stays unknown with no usage claim. It pins the recipe, the templates, the checklist, the receipt example and the test by SHA-256, at base b72c588 on main. python3 scripts/validate_convergence.py on it exits 0; mutated copies with an observation, adopt_within_scope or a drifted pin are rejected. The decision record now says: selected by source review; not a completed adoption until a host run and the queued comparison, and links the record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
WSL recipe record: the end-of-unit completeness critic and its dispos…
1ef6baf 
…itions

Research unit W2 closed without the critic the repository rule requires (a review thread on PR #569 pointed it out).
An independent read-only researcher asked what the unit did not look at and found 11 items; none overturns the
selection. Four change what happens before stage 1 (a rehearsal on a throwaway name; WSL#40941 file ownership after
first-run setup; WSL#41482 boot timeouts on this host's kernel; whether linger keeps the distribution running) and
two upstream verification steps are missing from the recipe (the cloud-init schema check, the signed SHA256SUMS).
They are queued as a follow-up to the recipe; the record says not to run stage 1 without those checks until then.
Debian, WSL containers and a golden-copy route feed the layer's next landscape sweep.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Scout @claude
Re-register this branch's changed files in manifests/evidence.json (h…
11a30be 
…ot-file protocol)

Last commit per docs/lanes.md "Hot-file protocol": main's manifests/evidence.json with this branch's changed,
hash-listed files re-registered (adoption/platforms/linux-wsl2.md) and the generated reports refreshed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/new-wsl-distro-recipe-20261001 branch from 344a69f to 11a30be Compare October 1, 2026 09:33
@seathatflowsinourveins
seathatflowsinourveins merged commit ad7d645 into main Oct 1, 2026
27 of 30 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the claude/new-wsl-distro-recipe-20261001 branch October 1, 2026 10:09
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 1, 2026
Closed
6 of 8 tasks
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
New-WSL architecture edition 2026-10-01: 37 rows, none closed, with i…
898d577 
…ts decision record

catalogs/foundation/new-wsl-architecture-20261001.json is the install manifest for a new WSL
distribution: one row per catalog layer (20 foundation, 12 us-equities) plus five cross rows
(distribution, runtime workers, GPT-6 harnesses, credential practice, convergence practice).
Each row carries winners at their pin of record, a verdict under the research state's five
closure items, the evidence class every winner reaches, sourced reasons, alternatives,
per-winner upstream currency read on 2026-10-01, ordered new-host steps and gates.

Verdicts: 19 selection_of_record_open, 12 comparison_required, 4 no_selection, 1 provisional
(token-efficiency), 1 new_host_required (recovery-portability); closed: none. The trading rows
are the fallback form (assessment pending, provisional_wording). Sources not yet on main are
cited through PR #569, #570 and #358.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition: the coordinator's review edits (holds as gates,…
ec7fa98 
… subordinate ids, scheduling comparison, trading rows from the complete assessment)

- Pending sources follow their pull requests' heads (#569 344a69f, #570 87c74d5); the program record and the
  foundation assessment (#573) join the sources.
- quality-evaluation: 65,536 subordinate ids at stage 1, a wider range only on Docker's documented pull error, with
  the workstation observation cited from the Harbor receipt; the OAuth token lives in its 0600 provider file.
- durable-memory and cross:runtime-workers carry the holds the production program reports (Hindsight's stale and
  paused pages and held cold seed; AgentRelay's held automatic Codex PTY submission) as gates, and durable-memory the
  open operator decision on the 2026-09-23 live-store breach.
- code-navigation: the carrier names jCodeMunch while stage 2 neither installs nor registers it (gate); the recipe's
  step F11 joins the install order.
- scheduling-supervision: comparison_required after the failed preregistered SIGKILL case (the program record's
  decision 1), with the limit of the Temporal arm stated.
- hosting-services: Next.js 16.3.8 fixes a High-severity advisory above both recorded pins (release page read
  2026-10-01); a gate asks for the pin move before the layer hosts anything reachable.
- us-equities: the rows follow the last complete result per layer of the now complete 12-layer assessment
  (backtesting-engine item 1 met and item 4 unmet; portfolio-risk item 5 partial; security-supply-chain assessed).
- The decision record follows: 20 selection_of_record_open, 14 comparison_required; run-to-run variance stated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition record and README: drift, landed sources, both d…
6fc0700 
…irections of the closed rule

- Record: the pending pull requests now name #569, #570, #358, #573, #575 and #535 (context and
  overturn condition 4); overturn condition 2 says a stack pin move passes, is noted on the page and
  listed by --check; the validation paragraph covers pin drift, roles, landed pending sources and
  (catalog, layer_id) identity; residual gaps add that pin_source content is unchecked and that two
  winners cite a file that cannot establish their pin.
- README: the validation paragraph states the closed rule in both directions and the new rules
  (missing segments, class floor, closure-text hash, drift, roles, landed sources).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
New-WSL architecture edition 2026-10-01: 37 rows, none closed, with i…
3571deb 
…ts decision record

catalogs/foundation/new-wsl-architecture-20261001.json is the install manifest for a new WSL
distribution: one row per catalog layer (20 foundation, 12 us-equities) plus five cross rows
(distribution, runtime workers, GPT-6 harnesses, credential practice, convergence practice).
Each row carries winners at their pin of record, a verdict under the research state's five
closure items, the evidence class every winner reaches, sourced reasons, alternatives,
per-winner upstream currency read on 2026-10-01, ordered new-host steps and gates.

Verdicts: 19 selection_of_record_open, 12 comparison_required, 4 no_selection, 1 provisional
(token-efficiency), 1 new_host_required (recovery-portability); closed: none. The trading rows
are the fallback form (assessment pending, provisional_wording). Sources not yet on main are
cited through PR #569, #570 and #358.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition: the coordinator's review edits (holds as gates,…
a29e558 
… subordinate ids, scheduling comparison, trading rows from the complete assessment)

- Pending sources follow their pull requests' heads (#569 344a69f, #570 87c74d5); the program record and the
  foundation assessment (#573) join the sources.
- quality-evaluation: 65,536 subordinate ids at stage 1, a wider range only on Docker's documented pull error, with
  the workstation observation cited from the Harbor receipt; the OAuth token lives in its 0600 provider file.
- durable-memory and cross:runtime-workers carry the holds the production program reports (Hindsight's stale and
  paused pages and held cold seed; AgentRelay's held automatic Codex PTY submission) as gates, and durable-memory the
  open operator decision on the 2026-09-23 live-store breach.
- code-navigation: the carrier names jCodeMunch while stage 2 neither installs nor registers it (gate); the recipe's
  step F11 joins the install order.
- scheduling-supervision: comparison_required after the failed preregistered SIGKILL case (the program record's
  decision 1), with the limit of the Temporal arm stated.
- hosting-services: Next.js 16.3.8 fixes a High-severity advisory above both recorded pins (release page read
  2026-10-01); a gate asks for the pin move before the layer hosts anything reachable.
- us-equities: the rows follow the last complete result per layer of the now complete 12-layer assessment
  (backtesting-engine item 1 met and item 4 unmet; portfolio-risk item 5 partial; security-supply-chain assessed).
- The decision record follows: 20 selection_of_record_open, 14 comparison_required; run-to-run variance stated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition record and README: drift, landed sources, both d…
96c4558 
…irections of the closed rule

- Record: the pending pull requests now name #569, #570, #358, #573, #575 and #535 (context and
  overturn condition 4); overturn condition 2 says a stack pin move passes, is noted on the page and
  listed by --check; the validation paragraph covers pin drift, roles, landed pending sources and
  (catalog, layer_id) identity; residual gaps add that pin_source content is unchecked and that two
  winners cite a file that cannot establish their pin.
- README: the validation paragraph states the closed rule in both directions and the new rules
  (missing segments, class floor, closure-text hash, drift, roles, landed sources).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 1, 2026
Scout @claude
Architecture edition: landed sources as plain citations; Qdrant cited…
cc37c83 
… to its host receipt

- The 27 citations of pull requests that have merged (#569, #570, #573, #358) and five in the edition's source list
  become plain source_path entries: the files are on main, and a pending_source names a pull-request head that is
  not (the Gate A owner's check of this pull request).
- Qdrant has a recorded run: the workstation's host receipt of 2026-09-25 (the running server answered with 1.19.1
  at the catalog pin). Its acceptance cites that receipt in both rows that list it; the health check stays a
  new-host step (the trading lane owner's correction). agents-models-workers therefore reads
  upstream_example_or_native_operation.
- skfolio in portfolio-risk cites the research-evaluation receipt instead of its prose summary.
- The record's counts follow: 125 winner entries, 14 none_recorded, 11 of them naming the check to run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 1, 2026
Merged
5 tasks done
seathatflowsinourveins added a commit that referenced this pull request Oct 1, 2026
@seathatflowsinourveins Scout @claude
Final architecture: the new-WSL install manifest (37 rows, none close…
9b80712 
…d) and its tab in the ecosystem guide (#574)

* New-WSL architecture edition 2026-10-01: 37 rows, none closed, with its decision record

catalogs/foundation/new-wsl-architecture-20261001.json is the install manifest for a new WSL
distribution: one row per catalog layer (20 foundation, 12 us-equities) plus five cross rows
(distribution, runtime workers, GPT-6 harnesses, credential practice, convergence practice).
Each row carries winners at their pin of record, a verdict under the research state's five
closure items, the evidence class every winner reaches, sourced reasons, alternatives,
per-winner upstream currency read on 2026-10-01, ordered new-host steps and gates.

Verdicts: 19 selection_of_record_open, 12 comparison_required, 4 no_selection, 1 provisional
(token-efficiency), 1 new_host_required (recovery-portability); closed: none. The trading rows
are the fallback form (assessment pending, provisional_wording). Sources not yet on main are
cited through PR #569, #570 and #358.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Ecosystem guide: "Final architecture" tab with its loader, validator and tests

scripts/build_ecosystem.py gains a second hard-wired topic beside the token topic:
ARCHITECTURE_TOPIC, build_architecture (run last, so its publication-ref links never move
another section's links) and architecture_row. It enforces known layer ids or cross: ids,
stack pins for component winners ("architecture row pin must match manifests/stack.json"),
public HTTPS links, repository-file citations hashed into the page inputs, structured
pending sources for files that land with a pull request, the verdict and evidence-class
enums, closed if and only if all five closure items are met, and a named gap for every open
row. Catalog layers without a row are listed, never a build failure.

docs/ecosystem/template.html adds tab 05 (Evidence becomes 06), hidden without the edition,
with the edition header, one table per catalog and expandable details; links go through
link()/safeHref, and the page keeps one data element and one inline script.

tests/test_ecosystem_manifest.py: fixture edition, one failing fixture per new validator
message, hidden tab without the file, digest change, inert hostile text, the page script
under Node, and the real edition's coverage and tracked citations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: us-equities rows from the trading closure assessment (provisional wording)

Eleven of the twelve us-equities rows now follow the 2026-10-01 trading closure assessment
(read at PR #358's head 4d11709): closure items and named gaps per layer, and winners limited
to pins of record from runtime-target.json (engine, brokers, adaptive paper engine) and the
adoption profiles. Verdict winners without such a pin (DVC, pandera, agent-retrieval-bench,
Inspect AI, MLflow, Grype) stay alternatives. security-supply-chain has no assessment and keeps
"assessment pending". The backtesting-engine dispute is read at #358's head b0eb7a1; paper
results are stated only as fills and passed trials. Every trading row stays marked
provisional_wording for the trading lane owner.

Edition totals: 37 rows, none closed; 21 selection_of_record_open, 13 comparison_required,
1 no_selection, 1 provisional, 1 new_host_required. The decision record follows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: the coordinator's review edits (holds as gates, subordinate ids, scheduling comparison, trading rows from the complete assessment)

- Pending sources follow their pull requests' heads (#569 344a69f, #570 87c74d5); the program record and the
  foundation assessment (#573) join the sources.
- quality-evaluation: 65,536 subordinate ids at stage 1, a wider range only on Docker's documented pull error, with
  the workstation observation cited from the Harbor receipt; the OAuth token lives in its 0600 provider file.
- durable-memory and cross:runtime-workers carry the holds the production program reports (Hindsight's stale and
  paused pages and held cold seed; AgentRelay's held automatic Codex PTY submission) as gates, and durable-memory the
  open operator decision on the 2026-09-23 live-store breach.
- code-navigation: the carrier names jCodeMunch while stage 2 neither installs nor registers it (gate); the recipe's
  step F11 joins the install order.
- scheduling-supervision: comparison_required after the failed preregistered SIGKILL case (the program record's
  decision 1), with the limit of the Temporal arm stated.
- hosting-services: Next.js 16.3.8 fixes a High-severity advisory above both recorded pins (release page read
  2026-10-01); a gate asks for the pin move before the layer hosts anything reachable.
- us-equities: the rows follow the last complete result per layer of the now complete 12-layer assessment
  (backtesting-engine item 1 met and item 4 unmet; portfolio-risk item 5 partial; security-supply-chain assessed).
- The decision record follows: 20 selection_of_record_open, 14 comparison_required; run-to-run variance stated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: the lane owners' answers (token-metric block, Gate A coverage, trading verdicts)

- token-efficiency: the layer protocol's own metric from the Harbor receipt's new block (headroom 0.867 [0.775,
  0.971], rtk 0.955 inconclusive, context-mode 1.181, jcodemunch 1.407, full stack 1.105; paired token ratios on
  tasks both arms solved, not independently reproduced); the gate says what the re-aimed Gate A E2E covers (the
  accepted profile in the multi-agent regime) and what stays open (the Repomix arm, the per-tool protocol in the
  multi-agent regime). Wording from the Gate A owner.
- us-equities: the trading lane owner's verdicts of 2026-10-01. research-factors-ml and security-supply-chain have
  no selection of record for the layer itself (no_selection; their current-choice components become alternatives).
  execution-broker: the #4983 entry is stated as under the owner's reconciliation; the 2026-09-29 paper series ran
  at engine revision b528bb5.
- Pending source for PR #570 follows its head ee06ded. Verdicts now: 19 selection_of_record_open, 13
  comparison_required, 3 no_selection, 1 provisional, 1 new_host_required.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: the lane owners' verbatim corrections (trading rows final for this edition; keys; Gate A)

- us-equities (the trading lane owner's acknowledgement in PR #574): twelve owner notes replace the provisional
  ones; the adaptive-paper winner is pinned to the #559 merge commit; the final #4983 gate text (a stale v1.227.0
  report for rc5 by source reading; the open rc5 obstacles are #5007, #5057 and #5060); two paid-data user gates
  and one lane gate; three evidence-class changes.
- cross:credential-practice (keys lane): the canary proof tool's review state and what item 3 waits for; K4's
  place in the train; the guard pin after #567.
- quality-evaluation: the OAuth token's store today and after K4 (keys lane); six matplotlib tasks logged the
  pull error and the four in the final task set ran after the widening (Gate A owner, receipt at cd7db15).

Adaptation, stated to the owner: the adaptive-paper winner keeps `name` and a file `pin_source`, because the
validator accepts `component_id` only for a manifests/stack.json component and a pin source only as a file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: each foundation row cites the Codex lane's second independent review (PR #575)

The cross-family review of the 20 foundation layers (gpt-6.1-sol, 2026-10-01) was performed and names remaining
gaps in every layer, so item 4 stays open; each row says so with its review file as a pending source. The item
cells keep the closure assessment's reading until the layer records are re-recorded. The crosswalk of the same
pull request is referenced in the sources, not duplicated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* AgentsView re-pin registry: classify the dated architecture edition

The edition names AgentsView 0.43.0 as an alternative of the observation layer, so the registry of files that name
the pinned version needs a classification for it (`tests.test_agentsview_qualification.RepinLocationRegistryTests`
failed in the hosted full suite on d15d584: "Lists differ: ['catalogs/foundation/new-wsl-architecture-20261001.json']
!= []"). It is a dated record: a re-pin does not rewrite a dated edition.

Tests: python3 -m unittest tests.test_agentsview_qualification -> 12 tests OK (2 failures before this change).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: evidence-class floor and closure-segment rules, with reverse-case tests

- A row with a none_recorded winner must be none_recorded; otherwise its class must be one that at
  least one winner's acceptance carries (rows without winners keep their owner's class). Ten rows
  change class to satisfy it: seven to none_recorded, three to the class all their winners carry.
- closure.missing must start with one "cN:" segment per item that is not met and name no met item;
  a trailing sentence without a prefix stays allowed.
- Tests: both rules (failing first), the reverse direction of the three if-and-only-if rules, a
  reversed line range, a cross: id with a non-cross catalog, a none_recorded install with a command,
  path escapes at the three architecture call sites, the hostile edition through the page harness;
  the real-edition test no longer requires a row for every layer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: bind the five closure-item texts by their sha256

The build reads saturation.close_only_when live; the edition now records close_only_when_sha256
(the five texts joined in order with newlines, no trailing newline) and the build fails when the
research state's texts hash differently, so a reworded or reordered state cannot show each row's
states beside other texts. Test written failing first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: pin drift passes, landed pending sources, layer identity pairs, winner roles

- A component_id winner whose pin differs from manifests/stack.json no longer fails the build (the
  token topic's precedent): the page notes "the stack now records <version>" on that winner and the
  --check JSON lists every drifted winner under architecture_pin_drift. A component_id outside the
  stack still fails.
- A pending_source whose path now exists as a repository file has landed: it is hashed into the page
  inputs and linked like a source_path, labelled "landed after this edition's base (pull request #N)";
  a later merge of that pull request never fails the build.
- Known and seen layers are keyed on (catalog, layer_id).
- An optional per-winner role (non-empty, at most 120 characters), rendered beside the winner's name in
  the table cell and in the row detail.
- Tests for each, and both states of a pending source in place of the trivially true assertion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition rows: winner roles, two corrected commands, the Harbor claim narrowed

- Roles on the three trading rows in the trading lane owner's words: backtesting-engine,
  execution-broker and portfolio-risk (NautilusTrader as destination or engine of record, LEAN as
  the comparison oracle, the Alpaca path and boundary, the Alpaca paper engine, skfolio's scope).
- instructions-skills: the separate renderer call install_skills.py --print-codex-config of
  adoption/update.md before the Codex configuration is applied.
- token-efficiency: the profile receipt step names adoption_status.py --client-wiring
  --pinned-versions --json (client wiring is reported only with the opt-in flag).
- token-efficiency: "no tool lowered whole-task cost" becomes the revised receipt's narrower claim
  (no cost reduction established for any tool); every figure kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition record and README: drift, landed sources, both directions of the closed rule

- Record: the pending pull requests now name #569, #570, #358, #573, #575 and #535 (context and
  overturn condition 4); overturn condition 2 says a stack pin move passes, is noted on the page and
  listed by --check; the validation paragraph covers pin drift, roles, landed pending sources and
  (catalog, layer_id) identity; residual gaps add that pin_source content is unchecked and that two
  winners cite a file that cannot establish their pin.
- README: the validation paragraph states the closed rule in both directions and the new rules
  (missing segments, class floor, closure-text hash, drift, roles, landed sources).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: winner acceptance classes describe recorded runs (review of 2026-10-01)

An independent review checked all 119 winner acceptance entries against their cited sources:
32 classes were not supported, 13 commands were version or status prints and 6 could not be
settled. This revision applies the coordinator's dispositions and the lane owners' answers:

- 55 of 119 entries change (32 classes, 48 commands, 31 cited sources); 20 entries are now
  none_recorded (a check only prescribed, planned, not run or failed) and 13 structural_validation
  (schema, pin, hash and contract-test checks).
- Trading owner (verbatim, items 1-7): alpaca-py, nautilus-trader, edgartools, adaptive-paper and
  systemd re-cited to the files that record their runs, with the owner's classes and notes.
- Gate A owner: Harbor's acceptance is the recorded 288-trial run, its forced-subagent pilot a
  NOT RUN reason; otelcol and loki structural; prometheus as its qualification receipt records;
  the headroom 0.39.1 versus pinned 0.37.0 fact in the token-efficiency reasons and closure text.
- Keys owner: the guard winner is K4 (merged as 2979742) with its verification receipt.
- dagu, jcodemunch-mcp and omniroute commands become what their receipts record; uv and gh are
  checksum checks; huggingface-hub-native, qdrant, openresearch and worktrunk are none_recorded.
- Row classes re-set by the round-2 rule, taking the class listed last in the policy table where
  winners carry several: 16 rows change. Reasons that contradicted their row are reworded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition record and README: the acceptance-class invariant and the dated review

- Record ("Evidence classes"): a winner's acceptance class describes a run that the cited source,
  or one file it links, shows was run on a host and what it returned; a check only prescribed,
  planned, not run or failed is none_recorded; schema, pin, hash and contract-test checks are
  structural_validation; a version print is metadata. The dated statement of the 2026-10-01 review
  and the counts this revision changed; the row tie-break (the class listed last in the policy
  table where winners carry several). Residual gap: the review read one hop from each cited file
  and rated part of its corrections below high confidence.
- README: the same invariant and tie-break, held by review rather than by a validator.
- Test: the repository record keeps the invariant and the dated review statement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Architecture edition: a none_recorded acceptance may name the check to run

Round 3 had to blank the command of every acceptance it set to none_recorded, because the build tied an empty
command to that class. For an install manifest that loses the check the new host must run. The build now requires a
command for every recorded class and allows one on none_recorded, where it names the check to run and no run of it
is recorded. One test, failing against the old rule.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: owners' selections, restored checks, all 32 layer reviews cited, current sources

- 13 none_recorded entries get their check to run back; restic is cited to its off-host receipt in four rows; the
  embedding model's command says what its receipt records; the convergence validators cite the recorded runs.
- The trading lane owner's decisions of 2026-10-01 for the two rows that had no selection: research-factors-ml
  (EdgarTools, skfolio; comparison_required) and security-supply-chain (Syft, Gitleaks, Grype;
  selection_of_record_open), each with the owner's sources and closure text; neither closes anything.
- cross:wsl-distro is re-rated to new_host_required now that the recipe is on main: one winner (the Ubuntu 24.04.5
  image by sha256), acceptance none_recorded, stage 1 waiting for the recipe's follow-up.
- Every foundation and us-equities row cites the Codex lane's second independent review at PR #575's head 51cb79b
  (12 us-equities reviews are new); the record names the difference between those reviews' selected sets and this
  edition's winners as a residual gap for the re-record pass.
- Pending sources carry the pull requests' current heads; the record lists which have merged.
- The trading owner's wording of the SPY parity blockers in the backtesting-engine row; two statements the day's
  merges overtook (the K4 inventory entry, the canary pull request).
- The program record names PR #578 for the trading closure records.

Row verdicts now: 20 selection_of_record_open, 14 comparison_required, 2 new_host_required, 1 provisional.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Architecture edition: landed sources as plain citations; Qdrant cited to its host receipt

- The 27 citations of pull requests that have merged (#569, #570, #573, #358) and five in the edition's source list
  become plain source_path entries: the files are on main, and a pending_source names a pull-request head that is
  not (the Gate A owner's check of this pull request).
- Qdrant has a recorded run: the workstation's host receipt of 2026-09-25 (the running server answered with 1.19.1
  at the catalog pin). Its acceptance cites that receipt in both rows that list it; the health check stays a
  new-host step (the trading lane owner's correction). agents-models-workers therefore reads
  upstream_example_or_native_operation.
- skfolio in portfolio-risk cites the research-evaluation receipt instead of its prose summary.
- The record's counts follow: 125 winner entries, 14 none_recorded, 11 of them naming the check to run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Hot files: evidence manifest hashes for the changed files and the regenerated reports

Filled by the hot-file protocol (docs/lanes.md): re-registers the changed files that
manifests/evidence.json lists and regenerates the component evidence matrix and the
new-host grand list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins added a commit that referenced this pull request Oct 1, 2026
@seathatflowsinourveins Scout @claude
New WSL distro recipe follow-up: rehearsal, signed sums, schema and s…
b8dd81d 
…torage pre-checks, ownership probe; three corrected facts (#582)

* New-WSL-distro recipe tests: bind the critic's pre-stage-1 checks (failing first)

Adds a check, a passing test and a mutant test for each rule of the follow-up to
PR #569:
- B: P1 verifies the signed SHA256SUMS with gpgv and the installed archive keyring,
  no key import, before stage 1;
- C1: P2 renders the user-data the way W3 does and runs cloud-init schema -c before
  any boot, and W3 prints the Windows file's SHA-256 to compare;
- C2: W5 runs cloud-init schema --system as root on path A, and W6 skips it;
- D: P3 counts the current boot's hv_storvsc kernel journal lines without the
  driver's registration line and stops on a nonzero count;
- E1 and E2: W7 terminates <Name> once after the first launch, relaunches it and
  reads the owner of a file created from Windows;
- F: W1 reads the two idle keys and F2 observes <Name> with no client attached; the
  host-wide check now passes a plain Select-String or grep read of .wslconfig and
  rejects writes, copies, editors, pipes and redirects;
- G: R1, the page's first step, rehearses on a throwaway name and removes only it,
  exporting a failed rehearsal first.
Step headings now include R and P steps.

At this commit the 17 new tests fail against the unchanged recipe, record,
checklist, receipt example and experiment record (Ran 48, failures=17); the next
commit makes them pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* New-WSL-distro recipe: rehearsal, signed sums, schema and storage pre-checks, ownership probe

Follow-up to PR #569 on the completeness critic's findings and the research packet
of 2026-10-01. No command of the page has run on a host.

Recipe, checklist and receipt example:
- R1 rehearses the page on a throwaway name through F3 and removes only that name,
  after W6's export rule when the rehearsal failed.
- P1 verifies SHA256SUMS with gpgv and the installed Ubuntu archive keyring (no key
  import); P2 runs cloud-init schema -c on the render, its SHA-256 compared with
  W3's; P3 counts the current boot's hv_storvsc kernel journal lines without the
  driver's registration line and stops on any count (microsoft/WSL#41482).
- W5 runs cloud-init schema --system on path A; W6 skips it on path B.
- W7 terminates <Name> once after the first launch, relaunches it and probes the
  owner of a file created from Windows (microsoft/WSL#40941; the fix, PR #40977,
  ships from 2.9.8 and 3.0.1, not in 2.7.13 or 2.7.14).
- W1 reads the two idle keys of the global WSL configuration; F2 lists the running
  distributions for two minutes with no client attached.
- Corrected facts: WSL 3.0.1 does change the first launch; the online
  wsl --install checks the catalog's hash while --from-file checks none; W5's
  console lines come from the image's wsl-setup (Launchpad 74bfc891, lines 117-118).

Decision record: the critic's outcomes per item, Learn pages pinned by
git_commit_id with their displayed dates, the cloud-init CLI page at 26.1, the
alternatives' exclusions, rewritten open question 2, open questions 6 and 7, and
the artifact checks of P1 to P3 in the workstation distribution. P3 counted 21
lines on this host, so by the page's rule stage 1 stops here until the user decides.

Experiment record: re-pinned, next test starts with the rehearsal, the two
research passes' usage as text (usage_assessment stays the planned-record value);
status stays planned.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* New-WSL-distro recipe tests: P3 as a baseline with a recency rule and a second reading (failing first)

The coordinator replaced P3's stop on any nonzero count: a count over the current
boot cannot tell an old burst from errors that are happening now. The D check now
requires:
- P3 to record the hv_storvsc count (without the registration line) as a baseline,
  print the newest error line with its kernel time and /proc/uptime, stop only when
  that line is less than one hour old, and call the threshold the recipe's choice;
- W5 to count again in the workstation distribution after the launch, on both
  paths, with a larger count recorded as exposure to microsoft/WSL#41482 and a hold
  before stage 2;
- the record to say why a bare count was rejected, the checklist and the receipt
  example's storage_errors block to carry the baseline, the newest line's time and
  the second count, and R1 to include both readings.
New mutants: the old stop rule, no newest line, no uptime, no recency rule, no second
reading, a second reading on one path, no exposure rule, and lost record, checklist
and receipt fields.

At this commit 4 tests fail against the unchanged recipe, record, checklist and
receipt example (Ran 48, failures=4); the next commit makes them pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* New-WSL-distro recipe: P3 as a baseline with a recency rule, a second reading after W5

The coordinator's decision of 2026-10-01: a count over the current boot cannot tell
an old burst from storage errors that are happening now, and on this host one burst
seven days earlier would have blocked stage 1 for good. So:
- P3 records the hv_storvsc count (without the registration line) as a baseline,
  prints the newest error line with its kernel time and /proc/uptime, and stops the
  run only when that line is less than one hour old. The threshold is this recipe's
  choice, not an upstream figure. The kernel time decides because journald restamps
  kernel lines it re-reads after a distribution restart (measured here: one kernel
  message with three reception stamps); the two clocks agree within 37 s over about
  8 days on this host.
- W5 counts again in the workstation distribution right after the launch, on both
  paths and before W6 or W7: equal passes; a larger count is recorded with the new
  lines, a failed W5 counts as exposure to microsoft/WSL#41482, and nothing
  continues to stage 2 until that is decided.
- R1 includes both readings, so the first real one comes from the rehearsal.
- Checklist, receipt example (storage_errors: baseline, newest_line_time, swap,
  second_count, new_lines; rehearsal.storage_readings) and command table follow.
- Record: this host's readings as artifact checks (baseline 21 at 12:19:29Z, newest
  error line about 7.4 days old, so P3 does not stop the run), why the bare count was
  rejected (Alternatives 4), open question 7 kept open.
- Experiment record re-pinned; validate_convergence passes; status stays planned.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* New-WSL-distro recipe tests: build the device-id mutant at run time

The mutant that searches for a device id instead of the driver's name carried a UUID-shaped literal, which the
publication validator rejects in any published file. The string is now built at run time; the check and its mutant
are unchanged. The experiment record is re-pinned to the test file's new hash.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Re-register this branch's changed files in manifests/evidence.json (hot-file protocol)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins