diff --git a/catalogs/foundation/new-wsl-architecture-20261001.json b/catalogs/foundation/new-wsl-architecture-20261001.json new file mode 100644 index 000000000..52e9c3fae --- /dev/null +++ b/catalogs/foundation/new-wsl-architecture-20261001.json @@ -0,0 +1,2668 @@ +{ + "schema_version": 1, + "kind": "new_wsl_architecture_edition", + "edition": { + "date_utc": "2026-10-01", + "base_commit": "5597f9fae2c6148037a74b4e73d2c55fc11c9ff6", + "close_only_when_sha256": "fe472bda74bd861d732a83948477386fd25605018d81560463c01b8ecd175d3c", + "scope": "The install manifest for a new WSL2 distribution: one row per layer of the two maintained catalogs (the 20 foundation layers of catalogs/foundation/manifest.json and the 12 us-equities layers of catalogs/landscape/research-state.json) plus cross-cutting rows for the distribution itself, the runtime workers, the GPT-6 harnesses, the credential practice and the convergence practice. Each row carries the selection of record at its pin of record, the verdict under the rules below, the row's evidence class (none_recorded when any winner's acceptance is none_recorded; otherwise a class that at least one winner's acceptance carries, and where the winners carry several, the one listed last in the policy table; stronger evidence for one winner stays in the reasons), the reasons with their sources, and the ordered steps a session runs on the new distribution. A winner's acceptance class describes a run that the cited source, or one file that source links, shows was run on a host and what it returned; a check that is only prescribed, planned, not run or failed is none_recorded. Every evidence class describes historical evidence from the source host: a new distribution collects its own evidence, and nothing in this edition is acceptance on it. Upstream currency was read on 2026-10-01 with one bounded read per pinned winner (the GitHub releases page, or the named registry page where the project publishes no GitHub release). Paths not yet on main are cited through their pull request and are not hashed.", + "verdict_rules": [ + "a layer is \"closed\" only when all five close_only_when items of research-state.json hold; otherwise \"selection_of_record_open\" with the missing items named", + "the winner cell carries the pin of record only (manifests/stack.json or adoption/pins-linux-x86_64.json for stack components; catalogs/us-equities/runtime-target.json for the engine and brokers; the adoption profile recipes for install commands)", + "evidence class stated per row", + "paper results count only as fills and passed trials", + "upstream and user-side gates are gates" + ], + "verdict_values": { + "closed": "All five close_only_when items of the research state hold for this row.", + "selection_of_record_open": "A selection of record exists at its pin of record, and at least one closure item does not hold; the row names what is missing.", + "provisional": "The selection of record stays the install default, but its owner marks it contested; a named comparison decides before any claim beyond installation.", + "comparison_required": "The research state or the row's owner requires a representative comparison that has not run; the selection stands only until it does.", + "new_host_required": "The remaining closure evidence can only be collected on a new host.", + "no_selection": "No selection of record exists for this row in this edition." + }, + "evidence_classes": { + "upstream_test": "Upstream test: an unchanged upstream test or suite at a recorded revision, with its returned result", + "upstream_example_or_native_operation": "Upstream example or native operation: a supported command or published example with its actual returned output", + "local_integration_check": "Local integration check: our integration of upstream behaviors with an explicit oracle, never an upstream test", + "synthetic_fixture": "Synthetic fixture: constructed frozen data with expected results, never production evidence", + "independent_observation": "Independent observation: direct inspection of artifacts or state by a separate method", + "structural_validation": "Structural validation: schema, references, hashes or contract tests; not execution", + "source_review": "Source review or release metadata only: no execution (below the policy table; AGENTS.md keeps metadata, pinned source review and native execution apart)", + "none_recorded": "No acceptance is recorded for this row or for at least one of its winners" + }, + "sources": [ + {"source_path": "docs/decisions/2026-10-01-new-wsl-architecture-edition.md"}, + {"source_path": "catalogs/landscape/research-state.json"}, + {"source_path": "catalogs/foundation/manifest.json"}, + {"source_path": "catalogs/landscape/foundation.json"}, + {"source_path": "catalogs/landscape/us-equities.json"}, + {"source_path": "docs/acceptance-evidence-policy.md"}, + {"source_path": "manifests/stack.json"}, + {"source_path": "adoption/pins-linux-x86_64.json"}, + {"source_path": "adoption/manifest.json"}, + {"source_path": "adoption/bootstrap.md"}, + {"source_path": "catalogs/us-equities/runtime-target.json"}, + {"source_path": "catalogs/saturation/ledger.json"}, + {"source_path": "adoption/platforms/linux-wsl2-new-distro.md"}, + {"source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"source_path": "docs/decisions/2026-10-01-definitive-sota-wsl-program.md"}, + {"source_path": "evidence/artifacts/layer-closure-assessment-20261001/foundation.json"}, + {"pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/README.md", "pull_request": 575, "commit": "51cb79ba"}}, + {"pending_source": {"path": "catalogs/foundation/new-wsl-layer-crosswalk-20261001.json", "pull_request": 575, "commit": "51cb79ba"}} + ] + }, + "rows": [ + { + "layer_id": "native-clients", + "catalog": "foundation", + "title": "Native clients", + "winners": [ + { + "component_id": "claude-code", + "repository": "https://github.com/anthropics/claude-code", + "pin": "2.1.284", + "pin_source": "manifests/stack.json:192", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "claude -p --output-format stream-json --verbose --max-turns 14 < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.1.286 (2026-09-30); 2.1.284 is a floor that native auto-update raises", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/claude-code/releases"} + }, + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the 2026-09-22 layer record does not fold in the 2026-09-23, 09-26 and 09-29 sweep proposals (opencode, gemini-cli, codex-acp, maka, prime-agent, jcode, goose, pi, hermes-agent, claude-agent-acp), and the contested proposals need a recorded adjudication; c3: neither frozen recovery fixture nor the same-prompt task has run at the installed pins on WSL (Codex same-thread resume on WSL and Claude resume with the full MCP set stay open); c4: no second independent review of a frozen set; c5: no dated closure record binding the current pins." + }, + "reasons": [ + {"text": "The layer verdict selects Claude Code and Codex with native-proven evidence and names five alternatives with their dispositions.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The pins of record moved past the verdict pins 2.1.278 and 0.155.1: the stack records claude-code 2.1.284 as a Linux floor and codex 0.159.2.", "source_path": "manifests/stack.json"}, + {"text": "Codex 0.159.2 was qualified on its CLI surface and npm provenance without a live model call; its upstream cargo tests were not run.", "source_path": "evidence/receipts/codex-01592-qualification-20260930.json"}, + {"text": "SDKs enter only for a demonstrated application need; interactive and worker sessions stay in the native clients.", "source_path": "catalogs/foundation/manifest.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/native-clients.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "Claude Agent SDK", "verdict": "conditional, source review in the layer record; refuted on fit in the 2026-09-26 and 2026-09-29 sweeps", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "OpenAI Agents SDK", "verdict": "unqualified: API-backed, not the native account", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Letta Code", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "opencode and gemini-cli", "verdict": "refuted in the 2026-09-23 sweep; opencode again on 2026-09-26 and 2026-09-29", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "goose, pi, jcode, maka, codex-acp, prime-agent, hermes-agent, claude-agent-acp", "verdict": "refuted in the 2026-09-26 or 2026-09-29 sweep; not yet folded into the layer record", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "From a clone of origin/main (the full-profile run refuses any other HEAD), run `bash adoption/bootstrap-linux.sh --profile token-efficiency`: it installs codex 0.159.2 from its sha256-verified npm tarball and claude-code 2.1.284 unless a launcher at 2.1.284 or newer already resolves.", + "Sign in natively: `claude`, then `codex login --device-auth`. Credentials never transfer from another machine.", + "Keep Codex's daemon_auto_start feature off before the first interactive launch (the rendered template sets it; otherwise `codex features disable daemon_auto_start`).", + "Run `bash adoption/bootstrap-linux.sh --profile token-efficiency --configure-full-profile --host ` for the Claude profile, settings, CLAUDE.md, skills, Codex lane, PATH block and login-shell check.", + "Run the recipe's native client acceptance in a fresh session of each client, then both frozen recovery fixtures under blueprints/convergence-practice/native-recovery/, and record a sanitized host receipt." + ], + "gates": [ + {"text": "Native sign-in to Claude Code and Codex on the new distribution is a user action; no credential is copied.", "kind": "user_side", "source_path": "docs/secret-storage.md"}, + {"text": "Codex 0.159.3, upstream's latest release, replaces the 0.159.2 pin only after its own qualification.", "kind": "lane", "url": "https://github.com/openai/codex/releases"} + ], + "owner_lane": "foundation", + "notes": "recipes/README.md still installs claude-code 2.1.278 in its component row while the pins file and the bootstrap use 2.1.284; the bootstrap is this edition's install path." + }, + { + "layer_id": "instructions-skills", + "catalog": "foundation", + "title": "Instructions and skills", + "winners": [ + { + "component_id": "affaan-m/ECC", + "repository": "https://github.com/affaan-m/ECC", + "pin": "dd6ee538aee0f548d4a6b520118f875431fd749e", + "pin_source": "manifests/stack.json:10", + "install": {"command": "python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --json", "kind": "repo_recipe", "source_path": "adoption/skills/lifecycle.md"}, + "acceptance": {"command": "python3 scripts/skills_status.py --skills-bin \"$SKILLS_BIN\" --json", "evidence_class": "structural_validation", "source_path": "adoption/skills/lifecycle.md"}, + "upstream_currency": {"latest_release": "v2.2.2 (2026-09-30); comparing the pinned commit with that tag returned not found", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "unknown", "url": "https://github.com/affaan-m/ECC/releases"} + }, + { + "component_id": "skills-ref", + "repository": "https://github.com/agentskills/agentskills", + "pin": "0.1.0", + "pin_source": "manifests/stack.json:1612", + "install": {"command": "git clone https://github.com/agentskills/agentskills.git \"$STACK_HOME/tools/agentskills\"; git -C \"$STACK_HOME/tools/agentskills\" checkout --detach 69ef37e9424c0a7ea9dd2293b559e43ec8176379; cd \"$STACK_HOME/tools/agentskills/skills-ref\" && uv sync --locked", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "uv run skills-ref validate \"$SKILL_DIRECTORY\"", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "no GitHub release; PyPI skills-ref 0.1.1 (2026-01-10)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://pypi.org/project/skills-ref/"} + }, + { + "name": "openai/skills (gh-fix-ci, security-best-practices)", + "repository": "https://github.com/openai/skills", + "pin": "49f948faa9258a0c61caceaf225e179651397431", + "pin_source": "adoption/skills/manifest.json:69", + "install": {"command": "python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --json", "kind": "repo_recipe", "source_path": "adoption/skills/lifecycle.md"}, + "acceptance": {"command": "python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --check-only --json", "evidence_class": "structural_validation", "source_path": "adoption/skills/lifecycle.md"}, + "upstream_currency": {"latest_release": "no GitHub release; the pinned commit is identical to the main branch head", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/openai/skills/commits/main"} + }, + { + "name": "typesafe-ai/skills (typesafe-ai)", + "repository": "https://github.com/typesafe-ai/skills", + "pin": "65a39f393687675ce170e6094757de20370365b9", + "pin_source": "adoption/skills/manifest.json:44", + "install": {"command": "python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --json", "kind": "repo_recipe", "source_path": "adoption/skills/lifecycle.md"}, + "acceptance": {"command": "python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --check-only --json", "evidence_class": "structural_validation", "source_path": "adoption/skills/lifecycle.md"}, + "upstream_currency": {"latest_release": "tag v0.5.7; the pinned commit is identical to it", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://github.com/typesafe-ai/skills/tags"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "partial", + "c5": "partial", + "missing": "c1: the verdict records ECC at dd6ee538 while the skills manifest binds search-first at c70874fa and iterative-retrieval at 2b6e8397, and skills-ref's classification is unsettled; c2: the candidate set is not re-frozen with the 2026-09-23 to 09-29 sweep survivors; c3: the challenger arm on a frozen labelled set and a new-host install, discovery and activation receipt with a failing control have not run; c4: no independent review of a re-frozen set; c5: no closure record replaces the 2026-09-22 verdict's stale pins." + }, + "reasons": [ + {"text": "Canonical project instructions (CLAUDE.md and AGENTS.md) carry the rules; selected skills load progressively, installed through the upstream skills CLI from a pinned manifest.", "source_path": "catalogs/foundation/manifest.json"}, + {"text": "The skills manifest pins every installed skill to a commit and installs it for both clients through tools/adoption/install_skills.py.", "source_path": "adoption/skills/manifest.json"}, + {"text": "The layer record gives local integration as the weakest evidence class across the winners; the edition labels each winner by what its cited source records, so the skills' pin and metadata checks are structural validation. No receipt is an unchanged upstream test.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/instructions-skills.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "Trail of Bits skills", "verdict": "conditional, source review only; several installed as trial skills", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Vercel agent-skills", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Claude Code Templates", "verdict": "unqualified in the verdict", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Anthropic skills (webapp-testing)", "verdict": "overlap; refuted on fit in the 2026-09-29 sweep", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "mattpocock/skills", "verdict": "listed as refuted on fit 2026-09-26, but that fit vote was missing rather than a refutation on merit", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Install the skills CLI 1.7.0 into its isolated prefix from the pinned tarball, checking its sha256 and npm integrity, and set SKILLS_BIN to its absolute path (the bare `skills` command is not on PATH).", + "Run `python3 tools/adoption/install_skills.py --skills-bin \"$SKILLS_BIN\" --dry-run --json`, then the same without --dry-run; the full-profile run's skills step does the same.", + "Before the Codex configuration is applied, run the separate renderer call of adoption/update.md, `python3 tools/adoption/install_skills.py --print-codex-config`, which prints the [[skills.config]] lines for the Codex config.toml.", + "Run `python3 scripts/skills_status.py --skills-bin \"$SKILLS_BIN\" --json` and read back each client's native discovery, including a Codex listing after its skills config write.", + "Record a sanitized install, discovery and activation receipt with one failing control (a deliberately absent skill)." + ], + "gates": [], + "owner_lane": "foundation", + "notes": "recipes/claude-native-profile.md says both ECC skills install at 2b6e8397, while adoption/skills/manifest.json pins search-first at c70874fa; the manifest is the installer's input." + }, + { + "layer_id": "workers", + "catalog": "foundation", + "title": "Workers and task ownership", + "winners": [ + { + "component_id": "claude-code", + "repository": "https://github.com/anthropics/claude-code", + "pin": "2.1.284", + "pin_source": "manifests/stack.json:192", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "", "evidence_class": "none_recorded", "source_path": "blueprints/convergence-practice/native-worker/README.md"}, + "upstream_currency": {"latest_release": "v2.1.286 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/claude-code/releases"} + }, + { + "component_id": "worktrunk", + "repository": "https://github.com/max-sixty/worktrunk", + "pin": "0.79.0", + "pin_source": "manifests/stack.json:1059", + "install": {"command": "gh release view v0.79.0 --repo max-sixty/worktrunk --json assets; gh release download v0.79.0 --repo max-sixty/worktrunk (worktrunk-x86_64-unknown-linux-musl.tar.xz and its checksum asset); sha256sum -c; extract into a versioned prefix", "kind": "repo_recipe", "source_path": "recipes/native-upgrades-20260921.md"}, + "acceptance": {"command": "wt list --format json", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.80.0 (2026-09-27)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/max-sixty/worktrunk/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the 2026-09-22 frozen set predates the 09-23, 09-26 and 09-29 sweeps and omits openai/codex (a 09-29 survivor) and the 09-26 bernstein proposal; c3: the preregistered arms have not run on the frozen fixtures, and no new-host lifecycle receipt exists at the current pins; c4: no second independent review of a re-frozen set (the record carries ten open gaps); c5: no closure record, only the keep_but_compare verdict." + }, + "reasons": [ + {"text": "The verdict keeps Claude native workers and Worktrunk owned-worktree lifecycle, with a preregistered comparison still required.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The research state marks the layer comparison_required.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "The worker fixture is author-written and has no runner; a rerun needs a fresh owned repository and a prompt built on its base commit.", "source_path": "blueprints/convergence-practice/native-worker/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 1 correction to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/workers.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Codex native workers", "verdict": "conditional, native-proven", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Codex for Claude companion 1.0.6", "verdict": "conditional, native-proven for review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Beads 1.3.0", "verdict": "conditional; refuted on fit in the 2026-09-29 sweep", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "DeerFlow", "verdict": "conditional; native-proven only at an older revision", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "OpenHands SDK", "verdict": "conditional, source review only; refuted on fit 2026-09-26 and 2026-09-29", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "After the native clients' install and sign-in (row native-clients), install Worktrunk 0.79.0 from its release archive with the checksum check; `gh release download` needs a signed-in gh.", + "Run `wt list --format json` in an owned clone, then one disposable `wt switch --create --base --no-cd --no-hooks --format json` and `wt remove --foreground --no-hooks --format json`, leaving only the original worktree.", + "Rerun the native worker fixture in a fresh owned repository with a prompt built on its actual base commit, and record the lifecycle receipt." + ], + "gates": [ + {"text": "The preregistered workers comparison decides the layer; the edition installs the selection of record until it runs.", "kind": "lane", "source_path": "catalogs/landscape/foundation.json"} + ], + "owner_lane": "foundation", + "notes": "Worktrunk is in no adoption profile and has no entry in adoption/pins-linux-x86_64.json, so no bootstrap run installs it." + }, + { + "layer_id": "isolation", + "catalog": "foundation", + "title": "Isolation", + "winners": [ + { + "component_id": "worktrunk", + "repository": "https://github.com/max-sixty/worktrunk", + "pin": "0.79.0", + "pin_source": "manifests/stack.json:1059", + "install": {"command": "gh release view v0.79.0 --repo max-sixty/worktrunk --json assets; gh release download v0.79.0 --repo max-sixty/worktrunk (worktrunk-x86_64-unknown-linux-musl.tar.xz and its checksum asset); sha256sum -c; extract into a versioned prefix", "kind": "repo_recipe", "source_path": "recipes/native-upgrades-20260921.md"}, + "acceptance": {"command": "wt list --format json", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.80.0 (2026-09-27)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/max-sixty/worktrunk/releases"} + }, + { + "component_id": "sandbox-runtime", + "repository": "https://github.com/anthropics/sandbox-runtime", + "pin": "0.0.77", + "pin_source": "manifests/stack.json:857", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/sandbox-runtime-0.0.77\" --ignore-scripts @anthropic-ai/sandbox-runtime@0.0.77", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "env -i HOME=\"$HOME\" PATH=\"$PATH\" srt --settings \"$SANDBOX_POLICY\" -- cat \"$FIXTURE_ROOT/blocked/marker.txt\" (must be denied)", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.0.78 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/sandbox-runtime/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "partial", + "c5": "partial", + "missing": "c2: the layer record (checked 2026-09-22) has no disposition for the 2026-09-29 survivors boxlite and microsandbox, nor for OpenSandbox and Lima; c3: no representative comparison has run, srt and Worktrunk persistence, restart and recovery are not established and crash cleanup is open; c4: the cross-family review agrees on the winners but leaves material gaps; c5: no closure record, only a dated verdict that predates the later sweeps and worktrunk v0.80.0." + }, + "reasons": [ + {"text": "Owned worktrees isolate edits; the sandbox runtime enforces a filesystem and network boundary only per task.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The on-demand isolation recipe prescribes the boundary check on an owned fixture (an allowed write succeeds, a blocked read and a protected write fail); its cited sources record no run of the file-denial check, and the linked network fixture verified only the HTTP proxy path.", "source_path": "recipes/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 1 correction to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/isolation.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Apple Container 1.4.1", "verdict": "conditional, optional; Mac storage persistence only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Podman / Quadlet", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Docker Engine / Moby", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "E2B", "verdict": "conditional, source review only; its commands were not executed", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "boxlite-ai/boxlite", "verdict": "survived the 2026-09-29 sweep; no layer disposition yet", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Install srt's Linux prerequisites (bubblewrap, socat and ripgrep are named by the recipe; no repository command installs them) and check kernel.apparmor_restrict_unprivileged_userns on the new kernel.", + "Install sandbox-runtime 0.0.77 with npm into its prefix; read the version from the installed package.json, because `srt --version` prints a fallback string.", + "Run the on-demand isolation fixture with an owned sandbox policy and record allowed, blocked and write-protected results.", + "Install Worktrunk as in row workers if that row has not." + ], + "gates": [], + "owner_lane": "foundation", + "notes": "Neither winner is in an adoption profile or the Linux pins file; both install from their recipes." + }, + { + "layer_id": "code-navigation", + "catalog": "foundation", + "title": "Code navigation", + "winners": [ + { + "component_id": "serena", + "repository": "https://github.com/oraios/serena", + "pin": "2.0.0.dev0 @ c6fbd1c5932df2494ffa0020af5a9fbe80b82143", + "pin_source": "manifests/stack.json:880", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "uvx --from git+https://github.com/oraios/serena@c6fbd1c5932df2494ffa0020af5a9fbe80b82143 serena start-mcp-server --context codex --project-from-cwd (then find_symbol and find_referencing_symbols through the client)", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.7.0 (2026-08-09); the pin is a 2.0.0.dev0 development commit 123 commits ahead of that release, so release currency does not apply", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "unknown", "url": "https://github.com/oraios/serena/releases"} + }, + { + "component_id": "ast-grep", + "repository": "https://github.com/ast-grep/ast-grep", + "pin": "0.45.3", + "pin_source": "manifests/stack.json:140", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/ast-grep-0.45.3\" @ast-grep/cli@0.45.3", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "ast-grep run --lang javascript --pattern 'function $NAME($$$ARGS) { $$$BODY }' --json=compact --stdin < evidence/artifacts/usage-report.source.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "0.45.3 (2026-08-31)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/ast-grep/ast-grep/releases"} + }, + { + "component_id": "codebase-memory-mcp", + "repository": "https://github.com/DeusData/codebase-memory-mcp", + "pin": "0.11.0", + "pin_source": "manifests/stack.json:275", + "install": {"command": "official v0.11.0 asset codebase-memory-mcp-linux-amd64.tar.gz, verified against the recorded SHA-256 032b33c1833919a2d1de67ff6367fa6ea46aee8689c86ef223c88fae3b6e4536", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.11.0 (2026-09-15)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/DeusData/codebase-memory-mcp/releases"} + }, + { + "component_id": "jcodemunch-mcp", + "repository": "https://github.com/jgravelle/jcodemunch-mcp", + "pin": "1.108.319", + "pin_source": "manifests/stack.json:1677", + "install": {"command": "eco=\"${ECO_INSTALL_ROOT:-$HOME/.local/share/codex-ecosystem}\"; UV_TOOL_DIR=\"$eco/python-tools\" UV_TOOL_BIN_DIR=\"$eco/bin\" uv tool install --python 3.13 jcodemunch-mcp==1.108.319", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "a deliberately scoped local code index, then search_symbols and get_symbol_source through jcodemunch-mcp's native MCP tools (called through mcporter): the exact requested function returned (2026-09-20)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/native-jcodemunch-20260920.json"}, + "upstream_currency": {"latest_release": "v1.108.320 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/jgravelle/jcodemunch-mcp/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: no public receipt for Serena find_referencing_symbols retains the argv, exit codes, returned span and reference set; c2: no committed frozen candidate list reconciles the 2026-09-22 set with the 2026-09-29 survivors and the native-LSP arm; c3: the preregistered comparison (rg and Read, Serena, codebase-memory, jCodeMunch, ast-grep, native LSP) with indexing and update cost has not run, nor update and delete checks on the new distribution; c4: no independent review after the comparison; c5: no closure record." + }, + "reasons": [ + {"text": "Serena is the layer winner for exact symbols and references; ast-grep, codebase-memory-mcp and jCodeMunch are conditional lanes, and a known-source read with rg comes first.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The token-efficiency profile carries Serena; jCodeMunch, codebase-memory-mcp and ast-grep stay outside it as optional, task-appended lanes until each has a reviewed pin on both platforms.", "source_path": "docs/decisions/2026-09-30-task-model-routing.md"}, + {"text": "On the Harbor E2E (36 SWE-bench Verified tasks, one trial per arm), jCodeMunch raised whole-task cost by a geometric-mean 1.387 [1.23, 1.553] and Serena's 1.063 [0.952, 1.159] is inconclusive.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "jcodemunch-mcp's acceptance is the native receipt of 2026-09-20, which ran version 1.108.319 (the stack pin).", "source_path": "evidence/receipts/native-jcodemunch-20260920.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict confirmed, 0 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/code-navigation.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "CodeGraph", "verdict": "unqualified, README and license review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "scip, zoekt and universal-ctags", "verdict": "refuted on the fit lens in the 2026-09-23 sweep", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "Glean", "verdict": "proposed only in the stopped 2026-09-23 attempt and never evaluated", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Serena installs with the token-efficiency profile as a uv tool from its pinned git commit into the ecosystem prefix (UV_TOOL_DIR and UV_TOOL_BIN_DIR), where the rendered MCP entries expect ${ECO_ROOT}/bin/serena.", + "Install ast-grep, codebase-memory-mcp and jCodeMunch only for a task that needs them, with the recipe commands; register jCodeMunch per project, never at user scope (step F11 of the new-distro recipe records the registration state).", + "For codebase-memory-mcp, write an MCPorter config with CBM_ALLOWED_ROOT and call index_repository explicitly; its database lives outside the repository.", + "Record a find_referencing_symbols receipt with argv, exit code, returned span and reference set." + ], + "gates": [ + {"text": "Four of the six SubagentStart carrier blocks name jCodeMunch tools, while no adoption profile installs jcodemunch-mcp, it has no Linux pin and no script registers it: after stage 2 alone the carrier names a server that is not there. Give it a Linux pin and an install step, or stop the carrier naming it.", "kind": "lane", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"} + ], + "owner_lane": "foundation", + "notes": "Serena's pin is a development commit (upstream declares 2.0.0.dev0); the commit is its identity." + }, + { + "layer_id": "document-retrieval", + "catalog": "foundation", + "title": "Documents and ingestion", + "winners": [ + { + "component_id": "qmd", + "repository": "https://github.com/tobi/qmd", + "pin": "2.8.3", + "pin_source": "manifests/stack.json:758", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "qmd --index \"$QMD_INDEX\" search 'local code' -c \"$QMD_COLLECTION\" -n 2 --json", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.8.3 (2026-08-16)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/tobi/qmd/releases"} + }, + { + "component_id": "markitdown", + "repository": "https://github.com/microsoft/markitdown", + "pin": "0.1.8", + "pin_source": "manifests/stack.json:575", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "markitdown fixtures/greeting.html -o \"$STACK_HOME/output/greeting.md\"", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.1.8 (2026-09-21)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/microsoft/markitdown/releases"} + }, + { + "component_id": "poppler", + "repository": "https://github.com/tsdgeos/poppler_mirror", + "pin": "26.09.0", + "pin_source": "manifests/stack.json:1809", + "install": {"command": "", "kind": "none_recorded", "source_path": "blueprints/convergence-practice/document-ingestion/README.md"}, + "acceptance": {"command": "pdftotext -bbox-layout -enc UTF-8 on the frozen source list only", "evidence_class": "local_integration_check", "source_path": "blueprints/convergence-practice/document-ingestion/README.md"}, + "upstream_currency": {"latest_release": "26.09.0 on the project's release page (the GitHub mirror lists no tags)", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://poppler.freedesktop.org/"} + }, + { + "component_id": "context-hub", + "repository": "https://github.com/andrewyng/context-hub", + "pin": "0.1.4", + "pin_source": "manifests/stack.json:381", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/context-hub-0.1.4\" @aisuite/chub@0.1.4", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "chub search 'python pytest' --json", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.1.4 (2026-04-27)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/andrewyng/context-hub/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the proposals refuted only by missing votes are not adjudicated and the sweep set is not in the layer's candidate list; c3: the preregistered comparison on a sealed representative corpus (warm and cold runs) and a frozen layout and OCR corpus with Docling and MinerU arms have not run, and no target-host lifecycle exists at markitdown 0.1.8; c4: no second independent review; c5: no closure record binds markitdown to 0.1.8 or settles Context Hub's standing." + }, + "reasons": [ + {"text": "QMD BM25 search followed by a get of the original body is the document lane; MarkItDown converts base HTML only and Poppler's pdftotext handles born-digital PDFs.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "BM25 search uses no model weights; query and embed are separate, model-enabled choices.", "source_path": "recipes/README.md"}, + {"text": "The layer declares local integration for its winners; no unchanged upstream test and no live-provider run is recorded.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict confirmed, 0 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/document-retrieval.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Docling", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "LlamaIndex", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "QMD vector, hybrid and full modes", "verdict": "not selected: one unsealed run gave equal or lower recall at far higher latency than BM25", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "MinerU", "verdict": "survived the 2026-09-23 and 2026-09-29 sweeps; not yet compared", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "arabold/docs-mcp-server", "verdict": "survived the 2026-09-29 sweep as keep_but_compare for Context Hub's role", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "QMD and MarkItDown install with the token-efficiency profile.", + "Install Context Hub 0.1.4 with the recipe's npm command only if the curated-docs lane is wanted; it is in no adoption profile.", + "Poppler has no Linux pin and no bootstrap path (its recipe is the macOS document-ingestion blueprint): install 26.09.0 only when born-digital PDF extraction is needed, and record the command used.", + "Run the document workflow on the fixtures (qmd collection add, update, search, then get an actual returned document ID) and markitdown on fixtures/greeting.html, then record a host receipt at markitdown 0.1.8." + ], + "gates": [], + "owner_lane": "foundation", + "notes": "The layer record's winner entry still names MarkItDown 0.1.7; the stack, the pins file and the recipe bind 0.1.8." + }, + { + "layer_id": "semantic-rag", + "catalog": "foundation", + "title": "Semantic code retrieval", + "winners": [ + { + "component_id": "socraticode", + "repository": "https://github.com/giancarloerra/SocratiCode", + "pin": "1.15.0", + "pin_source": "manifests/stack.json:962", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "mcporter --config \"$MCPORTER_CONFIG\" call socraticode.codebase_health --args '{}' --output text --no-oauth", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.16.0 (2026-09-28)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/giancarloerra/SocratiCode/releases"} + }, + { + "component_id": "qdrant", + "repository": "https://github.com/qdrant/qdrant", + "pin": "1.19.1", + "pin_source": "manifests/stack.json:727", + "install": {"command": "official v1.19.1 archive qdrant-x86_64-unknown-linux-musl.tar.gz, verified against SHA-256 70a40529e2ebe0a2787d574d3a2e28437cfe94f26f24fa419f6ac57b4ae817c9", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "GET / on the running Qdrant server: it answered with version 1.19.1 at commit 6ab21ca, the catalog pin (host receipt, stage use, result pass)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/hosts/nativestack-5975wx-20260925/nativestack-5975wx-20260925--qdrant--use--20260925.json"}, + "upstream_currency": {"latest_release": "v1.19.1 (2026-09-04)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/qdrant/qdrant/releases"} + }, + { + "component_id": "vllm", + "repository": "https://github.com/vllm-project/vllm", + "pin": "0.30.0", + "pin_source": "manifests/stack.json:1029", + "install": {"command": "uv venv --python 3.13 \"$STACK_HOME/tools/vllm-0.30.0\"; uv pip install --python \"$STACK_HOME/tools/vllm-0.30.0/bin/python\" vllm==0.30.0", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "curl --fail --silent --show-error http://127.0.0.1:8231/v1/embeddings with the recipe's request body (the new host file moves the port)", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.30.0 (2026-09-22)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/vllm-project/vllm/releases"} + }, + { + "component_id": "huggingface-hub-native", + "repository": "https://github.com/huggingface/huggingface_hub", + "pin": "1.32.0", + "pin_source": "manifests/stack.json:551", + "install": {"command": "uv tool install huggingface-hub==1.32.0", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.0.0 (2026-09-24)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/huggingface/huggingface_hub/releases"} + }, + { + "name": "nvidia/Nemotron-3-Embed-1B-BF16 (embedding model)", + "repository": "https://huggingface.co/nvidia/Nemotron-3-Embed-1B-BF16", + "pin": "c0c9fea93ea424587517f2c59e20db9f1d6bf615", + "pin_source": "manifests/stack.json:2072", + "install": {"command": "hf download nvidia/Nemotron-3-Embed-1B-BF16 --revision c0c9fea93ea424587517f2c59e20db9f1d6bf615 --local-dir \"${MODEL_DIRECTORY}\" --max-workers 2 --json", "kind": "repo_recipe", "source_path": "manifests/stack.json"}, + "acceptance": {"command": "an embeddings request to the vLLM service with the recipe's request body; the receipt records identical embeddings and identical top-10 code-index results after the switch to vLLM 0.30.0", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/vllm-030-switch-20260925.json"}, + "upstream_currency": {"latest_release": "model revision c0c9fea9 (last modified 2026-08-27) is the current head of the model repository", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://huggingface.co/nvidia/Nemotron-3-Embed-1B-BF16"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the verdict still records SocratiCode 1.14.0 and vLLM 0.25.0 with stale references; c2: the 2026-09-29 survivors semble, next-plaid and ollama and the 2026-09-26 proposals left open by missing votes have no disposition; c3: the preregistered blinded comparison (lexical baseline, current stack, code-memory and the survivors) with freshness, leakage, RAM and restore measures has not run, and SocratiCode index and watcher recovery is not established; c4: both review lanes record unresolved material gaps; c5: the only dated record is the 2026-09-22 verdict." + }, + "reasons": [ + {"text": "SocratiCode with Qdrant and a pinned local vLLM embedding service answers conceptual code questions; the Hugging Face CLI fetches the revision-pinned model.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "On the source host, one real query per native client, a finite 2048-dimension embedding and watcher add, update and delete of about 3 s each are recorded (historical, not repeated).", "source_path": "evidence/receipts/native-rag.json"}, + {"text": "vLLM 0.30.0 replaced 0.25.0 on 2026-09-25 under a resolver cutoff that the recipe does not repeat.", "source_path": "evidence/receipts/vllm-030-switch-20260925.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/semantic-rag.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "code-memory", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Haystack", "verdict": "out of scope here (rag-pipeline layer), README review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "pgvector", "verdict": "unqualified, README review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "LanceDB", "verdict": "unqualified, README and quickstart review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "ollama", "verdict": "survived the 2026-09-23 and 2026-09-29 sweeps; no layer disposition yet", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Run `python3 scripts/hardware_profile.py` and confirm the GPU driver supports the qualified torch 2.13.0+cu130 tree before installing vLLM.", + "SocratiCode installs with the token-efficiency profile; `bash adoption/bootstrap-linux.sh --profile semantic-rag` exits 3 because only socraticode has a Linux pin, so install the other three from their recipes (or rerun with --allow-unpinned huggingface-hub-native,vllm,qdrant).", + "Install vLLM 0.30.0 into its own uv venv with the qualified resolver cutoff (--exclude-newer 2026-09-25T23:59:59Z), Qdrant 1.19.1 from its verified archive and huggingface-hub 1.32.0 with uv tool install.", + "Download the embedding model at revision c0c9fea9 with `hf download`, start Qdrant and vLLM as user services on the new host file's ports, then check /healthz and one embeddings request.", + "Index one project through MCPorter (codebase_health, codebase_index, codebase_status), then record a host receipt with watcher add, update and delete." + ], + "gates": [ + {"text": "A local GPU with a driver for the qualified CUDA tree is a host prerequisite for the vLLM embedding service.", "kind": "user_side", "source_path": "adoption/README.md"} + ], + "owner_lane": "foundation", + "notes": "examples/native-stack-embeddings.service.example still names tools/vllm-0.25.0; the 0.30.0 service runs through a drop-in." + }, + { + "layer_id": "durable-memory", + "catalog": "foundation", + "title": "Durable memory", + "winners": [ + { + "component_id": "ai-memory", + "repository": "https://github.com/akitaonrails/ai-memory", + "pin": "2.4.1", + "pin_source": "manifests/stack.json:96", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "ai-memory init; ai-memory serve --transport http --enable-web --bind 127.0.0.1: --workspace local --project native-agent-stack; ai-memory install-hooks --agent claude-code --server-url http://127.0.0.1:", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.5.2 (2026-10-01)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/akitaonrails/ai-memory/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c2: no dated frozen candidate set folds in the 2026-09-26 and 09-29 survivors (agentmemory, MemPalace, deja-vu, agent-memory, Hindsight, langmem) and the proposals refuted only by missing votes; c3: the preregistered representative comparison has not run, nor target-host lifecycle checks at the installed pin; c4: every review on record names open material gaps; c5: no closure record." + }, + "reasons": [ + {"text": "ai-memory is the shared durable-memory lane for both clients; its hooks capture bounded observations, not complete transcripts.", "source_path": "recipes/README.md"}, + {"text": "The layer winner was recorded at 2.3.2; the stack and the Linux bootstrap install 2.4.1, which migrates an existing store forward only when serve first opens it.", "source_path": "manifests/stack.json"}, + {"text": "The research state requires a representative comparison for this layer.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort ultra; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/durable-memory.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "Hindsight 0.10.2 with its coding-agents integration v0.8.0 (upstream commit f9d9e2ab)", "verdict": "the memory lane's fit target, not a selection of record: the 2026-09-30 routing record keeps Hindsight 0.10.2 isolated, and no repository record pins the integration", "source_path": "docs/decisions/2026-09-30-bounded-native-decision-routing.md"}, + {"name": "Hindsight upstream release state", "verdict": "v0.10.2 is upstream's latest release (2026-09-29); commit f9d9e2ab is the coding-agents v0.8.0 release", "url": "https://github.com/vectorize-io/hindsight/commit/f9d9e2ab88bd"}, + {"name": "Mem0", "verdict": "conditional, source review", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Basic Memory", "verdict": "conditional, synthetic evidence only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Graphiti", "verdict": "conditional; deferred", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "ai-memory installs with the token-efficiency profile (the executable only, from the verified archive).", + "Choose a loopback port outside the workstation's exclusion set and record it in the host file: WSL distributions share one network namespace, so a copied port can write to another distribution's store.", + "Run `ai-memory init` and edit its config before starting hooks or the service, then run `ai-memory serve` on the chosen port as a user service (no unit is committed; adapt upstream's packaging/systemd/ai-memory-user.service).", + "Install the hooks for claude-code and codex against the new URL, then record a write and read-back receipt." + ], + "gates": [ + {"text": "Hindsight 0.10.2, the memory lane's fit target, enters only through this layer's comparison. The production program reports stale and paused pages and a held cold seed for it on the current host; its receipts are not published, and a new distribution fixes neither a provider-route timeout nor an adapter's semantics.", "kind": "lane", "source_path": "docs/decisions/2026-10-01-definitive-sota-wsl-program.md"}, + {"text": "The operator decision on the 2026-09-23 live-store isolation breach on the workstation (rewrite or collect the live wiki history, compact the database again) is open; the new distribution starts with a fresh store.", "kind": "user_side", "source_path": "evidence/artifacts/gap-wave2-20260923/foundation__durable-memory/README.md"} + ], + "owner_lane": "foundation", + "notes": "Upstream moved to v2.5.2 on 2026-10-01; a pin move needs its own qualification and a forward-only store migration plan." + }, + { + "layer_id": "web-research", + "catalog": "foundation", + "title": "Web research", + "winners": [ + { + "component_id": "tavily-cli", + "repository": "https://github.com/tavily-ai/tavily-cli", + "pin": "0.1.8", + "pin_source": "manifests/stack.json:1912", + "install": {"command": "uv tool install 'tavily-cli==0.1.8'", "kind": "repo_recipe", "source_path": "recipes/tavily.md"}, + "acceptance": {"command": "tvly search \"Codex CLI Claude Code native agent harness skills official documentation\" --depth basic --max-results 4 --include-domains developers.openai.com,code.claude.com --json", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/tavily.md"}, + "upstream_currency": {"latest_release": "no GitHub release; PyPI tavily-cli 0.1.8 (2026-09-02)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://pypi.org/project/tavily-cli/"} + }, + { + "component_id": "agent-browser", + "repository": "https://github.com/vercel-labs/agent-browser", + "pin": "0.38.1", + "pin_source": "manifests/stack.json:38", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/agent-browser-0.38.1\" agent-browser@0.38.1; agent-browser install", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "agent-browser --config examples/agent-browser.json --namespace native-stack --session selected-owned-session open \"file://${PROJECT_ROOT}/fixtures/greeting.html\"", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.38.1 (2026-09-16)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/vercel-labs/agent-browser/releases"} + }, + { + "component_id": "openresearch", + "repository": "https://github.com/alphaXiv/OpenResearch", + "pin": "0.2.7", + "pin_source": "manifests/stack.json:650", + "install": {"command": "gh release download v0.2.7 --repo alphaXiv/OpenResearch (openresearch-cli-x86_64-unknown-linux-musl.tar.xz and its checksum asset); sha256sum -c; extract into a versioned prefix", "kind": "repo_recipe", "source_path": "recipes/native-upgrades-20260921.md"}, + "acceptance": {"command": "orx --no-telemetry discover keyword 'agent memory' --published-after 2026-06-21 --published-before 2026-09-19 --limit 3", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.2.14 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/alphaXiv/OpenResearch/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the selection does not yet record the 2026-09-26 decision (free native lanes first; Tavily's standing as winner or fallback; agent-browser bound to its fixture run); c2: no frozen set includes the survivors exa-mcp-server and trafilatura, the contested defuddle and Playwright CLI; c3: the browser comparison (agent-browser against Playwright CLI) and the retrieval comparison (free native lanes against Tavily) have not run; c4: no independent review of executed comparisons; c5: no closure record replaces the 2026-09-22 verdict." + }, + "reasons": [ + {"text": "Web search, fetch and extraction use free native lanes first (Claude Code WebSearch and WebFetch, Context Mode fetch-and-index, Codex live web search); a paid keyed search API is not used for new work while a free lane does the job.", "source_path": "docs/harness-defaults.md"}, + {"text": "The pinned CLIs cover bounded search and extraction, owned browser fixtures and literature discovery; Tavily keeps its key in its store file, never in ~/.tavily/config.json.", "source_path": "recipes/tavily.md"}, + {"text": "The layer declares local integration for all three winners; the edition labels each winner by what its cited source records.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/web-research.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Playwright CLI 0.1.21", "verdict": "overlap: a conditional second browser lane", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Crawl4AI", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Firecrawl MCP", "verdict": "unqualified, source review only; never compared with Tavily", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Browser Use", "verdict": "unqualified in the alternatives, overlap in the candidates", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "exa-labs/exa-mcp-server", "verdict": "survived the 2026-09-23 sweep; not yet compared", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Use the free native lanes first; they need no install beyond the native clients.", + "None of the three CLIs is in an adoption profile: install tavily-cli with uv, agent-browser with npm and `agent-browser install` (`--with-deps` installs OS packages and needs consent), and OpenResearch from its release archive (its pin id is orx).", + "Keep the Tavily key in its provider file and use it through the credential runner; never run `tvly login` or `tvly init`.", + "Run `tvly auth --json`, the agent-browser fixture on fixtures/greeting.html and one `orx discover` query, then record a host receipt." + ], + "gates": [ + {"text": "Tavily calls need the user's own Tavily key in its 0600 provider file; the free native lanes need none.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "foundation", + "notes": "Tavily stays pinned for historical reproduction; new work prefers the free native lanes." + }, + { + "layer_id": "token-efficiency", + "catalog": "foundation", + "title": "Context and usage efficiency", + "winners": [ + { + "component_id": "rtk", + "repository": "https://github.com/rtk-ai/rtk", + "pin": "0.50.0", + "pin_source": "manifests/stack.json:822", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "rtk git log -6; rtk proxy git log -6", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.50.0 (2026-09-24)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/rtk-ai/rtk/releases"} + }, + { + "component_id": "context-mode", + "repository": "https://github.com/mksglu/context-mode", + "pin": "1.0.169", + "pin_source": "manifests/stack.json:403", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency (the npm CLI), then the Claude plugin from its SHA-pinned source 6f0cc6841c687e754059f36714a11233fda1a02b", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "compare the installed plugin's gitCommitSha with 6f0cc6841c687e754059f36714a11233fda1a02b, then read ctx_stats in a fresh session", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.0.169 (2026-06-29)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/mksglu/context-mode/releases"} + }, + { + "component_id": "headroom", + "repository": "https://github.com/headroomlabs-ai/headroom", + "pin": "0.37.0", + "pin_source": "manifests/stack.json:515", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "HEADROOM_OFFLINE=1 HF_HUB_OFFLINE=1 TRANSFORMERS_OFFLINE=1 DO_NOT_TRACK=1 headroom mcp serve --proxy-url http://127.0.0.1:1", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.39.1 (2026-09-26); 0.39.0 was qualified but not switched, and 0.39.1 changes only the proxy rate limiter", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/headroomlabs-ai/headroom/releases"} + }, + { + "component_id": "repomix", + "repository": "https://github.com/yamadashy/repomix", + "pin": "1.18.1", + "pin_source": "manifests/stack.json:793", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "repomix \"$PROJECT_ROOT\" --include 'fixtures/before.py,fixtures/after.py' --style xml --parsable-style --compress --token-count-encoding o200k_base --output \"$STACK_HOME/output/selected-code.xml\"", "evidence_class": "local_integration_check", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.18.1 (2026-09-21)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/yamadashy/repomix/releases"} + }, + { + "component_id": "toon", + "repository": "https://github.com/toon-format/toon", + "pin": "4.1.1", + "pin_source": "manifests/stack.json:999", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "toon fixtures/records.json --stats -o \"$STACK_HOME/output/records.toon\"; toon \"$STACK_HOME/output/records.toon\" --decode --strict -o \"$STACK_HOME/output/records.recovered.json\"", "evidence_class": "local_integration_check", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v4.1.1 (2026-08-05)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/toon-format/toon/releases"} + }, + { + "component_id": "ccusage", + "repository": "https://github.com/ccusage/ccusage", + "pin": "20.0.26", + "pin_source": "manifests/stack.json:164", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "CODEX_HOME=\"$SELECTED_CODEX_HOME\" ccusage codex daily --offline --no-cost --json --timezone UTC --config /dev/null", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v20.0.26 (2026-09-27)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/ccusage/ccusage/releases"} + } + ], + "verdict": "provisional", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the candidates list contradicts the winners and alternatives, and the winners' evidence is recorded at rtk 0.49.0 and ccusage 20.0.24 rather than the installed pins, and the Harbor run's headroom arm ran headroom-ai 0.39.1 rather than the pinned 0.37.0, so its headroom figures apply to the pin only by extrapolation; c2: the 2026-09-29 survivors (sqz, paritok-4b-v1, agent-console) and two proposals refuted only by missing votes are unresolved; c3: no repeated, counterbalanced matched comparison at equal correctness with complete provider usage, and no target-host receipt for the whole profile; the Harbor E2E measured the single-session regime only and no trial spawned a subagent; c4: the layer record lists eight open gaps; c5: no closure record (the research state says comparison_required)." + }, + "reasons": [ + {"text": "The token-efficiency adoption profile (14 pinned components) was accepted as the selection on 2026-09-30 in #540; jCodeMunch, codebase-memory-mcp and ast-grep stay outside it as optional, task-appended lanes.", "source_path": "docs/decisions/2026-09-30-task-model-routing.md"}, + {"text": "On Harbor v0.23.0 (288 trials, 36 SWE-bench Verified tasks, Claude Code 2.1.285, Sonnet 5.5 at medium effort, one trial per arm and task) the run established no cost reduction for any tool: context-mode, jcodemunch and the full stack raised whole-task cost by 30 to 39% (intervals above 1; context-mode a geometric-mean 1.34 [1.209, 1.456] and the five-tool stack 1.301 [1.176, 1.411], p at most 0.0006); headroom (0.983), rtk (1.027) and serena (1.063) are inconclusive, their intervals include 1 as the A/A control's does (1.045 [0.93, 1.20]).", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "Context-mode used its MCP tools in 0 of 36 trials and the full stack in 1 of 36, so those rows mostly price the tools' presence; mean wall time rose from 35.1 s to 107.2 s for context-mode and from 32.8 s to 108.9 s for the full stack.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "Resolve rates: the lean base 0.778 (28 of 36) against the full stack 0.667 (24 of 36); no Harbor trial spawned a subagent, so per-subagent attribution is untested there.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "On the layer protocol's own metric (complete provider tokens per accepted task; the paired ratio against the lean base on the tasks both arms solved, 95% percentile bootstrap): headroom 0.867 [0.775, 0.971] on 27 tasks, rtk 0.955 [0.847, 1.078] on 26, context-mode 1.181 [1.027, 1.341] on 25, serena 0.984 [0.819, 1.153] on 24, jcodemunch 1.407 [1.144, 1.72] on 24 and the full stack 1.105 [0.94, 1.303] on 23. Headroom saves tokens but not cost in short tasks, context-mode and jCodeMunch cost more tokens, and rtk is inconclusive. The figures were recomputed by script from the per-trial rows and are not independently reproduced. The Harbor run's headroom arm ran headroom-ai 0.39.1 with the all extra (receipt run.tools_under_test), while the profile pin and the recipes row are headroom 0.37.0, so the headroom measurements (0.867 tokens, 0.983 cost) are for 0.39.1 and apply to the pinned 0.37.0 only by extrapolation; rtk 0.50.0 and context-mode 1.0.169 match their pins.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "Agent-tool and workflow children carry 81.3% of the list-price-estimated dollars on the source host, so the regime that dominates spend is the one Harbor did not measure.", "source_path": "docs/decisions/2026-09-29-token-spend-attribution.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 1 correction to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/token-efficiency.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Context Mode as an always-on default", "verdict": "measured_tradeoff: its paired native results point both ways", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "TOON for every payload", "verdict": "measured_tradeoff: the exact o200k full-catalog count rose from 59,792 to 66,815 tokens", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Claude Token Efficient (drona23)", "verdict": "overlap, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "sqz, paritok-4b-v1, agent-console", "verdict": "survived the 2026-09-29 sweep; unresolved", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Run `bash adoption/bootstrap-linux.sh --profile token-efficiency`; every one of its 14 components has a Linux pin.", + "Install the Context Mode Claude plugin from its SHA-pinned source and start one session before the settings step: the plugin's start.mjs writes the SessionStart cache-heal hook under ~/.claude/hooks, which the settings template's SessionStart entry runs.", + "Then apply the settings template (the claude-settings step of --configure-full-profile) and check that ~/.claude/hooks/context-mode-cache-heal.mjs exists.", + "Run each winner's acceptance command, then record a profile receipt that covers all 13 required commands and the client wiring with `python3 scripts/adoption_status.py --client-wiring --pinned-versions --json` (client wiring is reported only with the opt-in --client-wiring flag).", + "Run the Gate A multi-agent adoption E2E on the new distribution before any savings claim." + ], + "gates": [ + {"text": "Savings stay 'not shown' until the multi-agent adoption E2E (the #381 Gate A plan) runs on the new distribution. That E2E tests the accepted profile against a lean base in the multi-agent regime; it does not cover the layer's per-tool protocol. The Harbor E2E covers four of that protocol's five arms in the short single-session regime, and the Repomix outline arm and the multi-agent regime are open.", "kind": "lane", "source_path": "examples/claude-native/workflows/README.md"} + ], + "owner_lane": "foundation: Gate A", + "notes": "PROVISIONAL AND CONTESTED: the 14-component profile stays the install default, savings are not shown, and Harbor measured context-mode as costlier on short single-session tasks. Harbor figures are cited from PR #570; its receipt path is evidence/receipts/harbor-e2e-token-tools-20260930.json." + }, + { + "layer_id": "quality-evaluation", + "catalog": "foundation", + "title": "Quality and evaluation", + "winners": [ + { + "component_id": "promptfoo", + "repository": "https://github.com/promptfoo/promptfoo", + "pin": "0.123.1", + "pin_source": "manifests/stack.json:701", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/promptfoo-0.123.1\" promptfoo@0.123.1", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "PROMPTFOO_DISABLE_TELEMETRY=1 promptfoo eval --config \"$EVAL_CONFIG\" --no-cache --no-table --no-progress-bar --no-share --no-write --output \"$EVAL_RESULT\"", "evidence_class": "local_integration_check", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "0.123.1 (2026-09-18)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/promptfoo/promptfoo/releases"} + }, + { + "component_id": "playwright-test", + "repository": "https://github.com/microsoft/playwright", + "pin": "1.63.0", + "pin_source": "manifests/stack.json:1857", + "install": {"command": "the wsl-application blueprint's pinned lock with the measured pnpm, plus the verified Chrome for Testing archive extracted into tools/chrome-linux64", "kind": "repo_recipe", "source_path": "blueprints/convergence-practice/wsl-application/README.md"}, + "acceptance": {"command": "taskset -c 0-3 pnpm exec playwright test", "evidence_class": "local_integration_check", "source_path": "blueprints/convergence-practice/wsl-application/README.md"}, + "upstream_currency": {"latest_release": "v1.63.0 (2026-09-04)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/microsoft/playwright/releases"} + }, + { + "name": "Harbor (containerized agent E2E runner)", + "repository": "https://github.com/harbor-framework/harbor", + "pin": "v0.23.0", + "pin_source": "blueprints/runtime-workers/openhands/pins.json:62", + "install": {"command": "uv tool install harbor==0.23.0", "kind": "upstream_documented", "url": "https://github.com/harbor-framework/harbor"}, + "acceptance": {"command": "the 288-trial Harbor v0.23.0 run (36 SWE-bench Verified tasks, 8 arms, graded by Harbor's verifier, preregistered; receipt blocks run, schedule, results and reproduction, where the preregistered analysis re-run reproduces the stored results byte for byte)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + "upstream_currency": {"latest_release": "v0.23.0 (2026-09-12)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/harbor-framework/harbor/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the layer record cites a superseded receipt, its candidate dispositions disagree with the verdict, and the Inspect AI and MLflow entries predate the gap-wave2 receipts; c2: seven of eight unclaimed manifest components carry no omission reason and the sweep candidates are not in the record; c3: no representative comparison of semantic advice on fresh, independently labelled cases, no lifecycle receipt from the new WSL host, and the Harbor pilot that forces subagent use has not run; c4: every layer-level review records open gaps; c5: no current closure record." + }, + "reasons": [ + {"text": "Harbor is the only upstream harness already run end to end on this stack: 288 trials over 36 SWE-bench Verified tasks with no infrastructure failure, its arm wrappers and analysis labelled as local integration code.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "The forced-subagent pilot is NOT RUN: the receipt's subagent_scan shows 0 delegation calls in 308 stream logs and 308 client transcripts and no subagents directory, so Harbor's per-subagent attribution is untested.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "Docker's rootless prerequisite is at least 65,536 subordinate ids, and a wider range is an image-set need: on the workstation the images of six matplotlib SWE-bench tasks logged `lchown : invalid argument` at 65,536 subordinate ids, and the four of them in the final task set ran after the ranges were widened to 262,144.", "source_path": "evidence/receipts/harbor-e2e-token-tools-20260930.json"}, + {"text": "E2E and A/B evaluations use an upstream harness, never a self-written runner.", "source_path": "docs/decisions/2026-09-30-rule-text-every-layer.md"}, + {"text": "Frozen deterministic checks stay verifier scripts: the 2026-09-29 grader decision compared promptfoo 0.123.1 and inspect-ai 0.3.272 and rejected their model graders for determinism, key redaction and the blind cross-family judge.", "source_path": "docs/decisions/2026-09-29-frozen-check-grader.md"}, + {"text": "Project and upstream tests come first; promptfoo stays the gateway and LLM A/B harness, and Playwright the browser acceptance.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 1 correction to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/quality-evaluation.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Inspect AI", "verdict": "the Harbor fallback runner; unqualified, source review in the layer record, which predates later executions", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "ShellCheck 0.11.0", "verdict": "conditional, native-proven", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Difftastic 0.71.0", "verdict": "overlap", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "TypeSafe semantic skill", "verdict": "conditional, one measured comparison", "source_path": "docs/native-skill-practice-20260921.md"} + ], + "new_host_steps": [ + "Install promptfoo 0.123.1 into its prefix with npm (it is in no adoption profile) and Playwright from the wsl-application blueprint's lock with its verified Chrome for Testing archive.", + "For the Harbor runner, install rootless Docker for the user with the 65,536 subordinate ids of the new-distro recipe's F5, set the egress allowlist and stage the Node v22.23.3 tarball pre-step that the arms use. Widen /etc/subuid and /etc/subgid only when a pull fails with `lchown : invalid argument`, and record the image, the error and the range chosen.", + "The Claude OAuth token for Harbor is held only in the kernel keyring today (status: present; memory only, gone at wsl --shutdown). K4 (#567, merged as 2979742f) added its claude-oauth-token inventory entry, so set_credential.py can write its 0600 provider file, which becomes the store of record once written, and the keyring stays the transport and per-boot spare. On the new distribution the user creates the token natively (claude setup-token) and stores it through set_credential.py.", + "Run `uv tool install harbor==0.23.0`, then the pilot first: force subagent use and check that each trial's saved sessions tree carries subagents/agent-*.jsonl.", + "Record install-and-control host receipts for promptfoo and Playwright, keeping every failed attempt." + ], + "gates": [ + {"text": "The native Claude OAuth token for Harbor runs is minted by the user with `claude setup-token`.", "kind": "user_side", "source_path": "docs/decisions/2026-09-29-key-management.md"}, + {"text": "The Gate A Harbor pilot (forced subagent use) runs before any Harbor result supports a multi-agent claim.", "kind": "lane", "source_path": "examples/claude-native/workflows/README.md"}, + {"text": "The new-distro recipe that allocates the subordinate ids lands with its pull request.", "kind": "lane", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"} + ], + "owner_lane": "foundation: Gate A", + "notes": "Harbor's prerequisites (rootless Docker, the egress allowlist, the Node v22.23.3 pre-step and the native OAuth token) come from the Gate A harness lane; the subordinate-id observation is in the Harbor receipt of PR #570, and the rest is not yet in the repository, so the pilot's record should land it. Inspect AI is the fallback runner." + }, + { + "layer_id": "ci-supply-chain", + "catalog": "foundation", + "title": "CI and supply chain", + "winners": [ + { + "component_id": "zizmor", + "repository": "https://github.com/zizmorcore/zizmor", + "pin": "1.30.1", + "pin_source": "manifests/stack.json:1565", + "install": {"command": "uv tool install zizmor==1.30.1", "kind": "repo_recipe", "source_path": "blueprints/convergence-practice/ci-security/README.md"}, + "acceptance": {"command": "env -u GH_TOKEN -u GITHUB_TOKEN -u ZIZMOR_GITHUB_TOKEN zizmor --offline --no-config --no-ignores --no-progress --persona regular --strict-collection --format json --cache-dir \"$OWNED_CACHE\" \"$PROJECT_ROOT/.github/workflows\"", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/convergence-practice/ci-security/README.md"}, + "upstream_currency": {"latest_release": "v1.30.1 (2026-09-09)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/zizmorcore/zizmor/releases"} + }, + { + "component_id": "syft", + "repository": "https://github.com/anchore/syft", + "pin": "1.52.0", + "pin_source": "manifests/stack.json:1396", + "install": {"command": "gh release download v1.52.0 --repo anchore/syft (the linux_amd64 archive and its checksums); verify, then tar --no-same-owner -xzf into a versioned prefix", "kind": "repo_recipe", "source_path": "blueprints/us-equities/supply-chain/README.md"}, + "acceptance": {"command": "syft scan dir:/sdk --base-path /sdk --source-name equity-worker-sdk (inside the recipe's read-only bubblewrap)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/supply-chain/README.md"}, + "upstream_currency": {"latest_release": "v1.52.0 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/anchore/syft/releases"} + }, + { + "name": "actions/attest", + "repository": "https://github.com/actions/attest", + "pin": "4.2.2 @ 1e69f48acb82d1966a394da916b4c1698aa569d6", + "pin_source": "catalogs/foundation/automation.json:147-149", + "install": {"command": "", "kind": "none_recorded", "source_path": ".github/workflows/publish-catalog.yml"}, + "acceptance": {"command": "gh attestation verify \"$archive\" --repo \"$repo\"", "evidence_class": "independent_observation", "source_path": "docs/catalog-provenance.md"}, + "upstream_currency": {"latest_release": "v4.2.2 (2026-08-04)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/actions/attest/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "partial", + "c5": "partial", + "missing": "c2: no committed re-record of the candidate set names the CI tools in use (actionlint, OSV-Scanner, CodeQL, dependency review, Scorecard as report-only) and the sweep survivors; c3: no fresh install of zizmor 1.30.1 and Syft 1.52.0 with the recorded commands on the target host followed by the preregistered metric; c4: no second independent review of the re-recorded set; c5: no layer closure record registered through the research state." + }, + "reasons": [ + {"text": "zizmor analyses the workflows offline and is a required CI gate; Syft inventories installed packages without a vulnerability verdict; actions/attest attests the published catalog archive and SBOM.", "source_path": "catalogs/foundation/automation.json"}, + {"text": "Hosted CI runs and consumer-side attestation verification are recorded as independent observations of the published artifacts.", "source_path": "docs/catalog-provenance.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/ci-supply-chain.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "independent_observation", + "alternatives": [ + {"name": "rhysd/actionlint", "verdict": "overlap, a complementary required validator (CI runs kjanat/actionlint)", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Trivy", "verdict": "unqualified, source review only; deferred until an SBOM and database freshness policy exists", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Grype", "verdict": "conditional; failing on high since 2026-09-22", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Dependabot", "verdict": "conditional; version updates for GitHub Actions references only", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "Sign in to gh first (`gh auth login`, `gh auth setup-git`): gh release download, gh api and gh attestation verify need it.", + "Install zizmor 1.30.1 with uv (or the hash-locked .github/requirements-ci.txt) and Syft 1.52.0 from its verified release archive; neither is in an adoption profile.", + "Run zizmor offline on .github/workflows and .github/dependabot.yml and expect no findings, then one Syft scan of a read-only directory.", + "Verify one published catalog archive with `gh attestation verify` and record the host receipt." + ], + "gates": [ + {"text": "gh sign-in on the new distribution is a user action.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "shared", + "notes": "actions/attest runs only in hosted CI; nothing installs it on a host." + }, + { + "layer_id": "scheduling-supervision", + "catalog": "foundation", + "title": "Scheduling and supervision", + "winners": [ + { + "component_id": "dagu", + "repository": "https://github.com/dagucloud/dagu", + "pin": "2.16.6", + "pin_source": "manifests/stack.json:1335", + "install": {"command": "gh release download v2.16.6 --repo dagucloud/dagu (the linux_amd64 archive and checksums.txt); check the checksum, extract and place the binary (the recipe omits this step)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/hosting/README.md"}, + "acceptance": {"command": "dagu start --context local --dagu-home \"$RESEARCH_HOME\" --run-id evidence-20260919-ready \"$WORKFLOW\": the three-step equity-research-evidence workflow through the upstream CLI (DuckDB summarized six LEAN simulated events into three orders, then both evidence validators passed; exit 0), and the native history kept its succeeded, failed and cancelled runs after a service restart (Dagu 2.16.6, 2026-09-19)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/hosting/receipt.json"}, + "upstream_currency": {"latest_release": "v2.18.1 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dagucloud/dagu/releases"} + }, + { + "component_id": "systemd", + "repository": "https://github.com/systemd/systemd", + "pin": "255.4-1ubuntu8.17", + "pin_source": "manifests/stack.json:1448", + "install": {"command": "", "kind": "none_recorded", "source_path": "blueprints/us-equities/worker-supervision/README.md"}, + "acceptance": {"command": "systemd 255 user units on the historical host: the timer started paper-ext-20260929.service at 16:00:05 ET on 2026-09-29, and journalctl --user -o json USER_UNIT=.service and systemctl --user show recorded its exit (status 3, Result=exit-code) and the run of its OnFailure alert unit", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/README.md"}, + "upstream_currency": {"latest_release": "255.4-1ubuntu8.17 is the published Ubuntu 24.04 (noble) updates and security version; upstream v255 source is cited for semantics only", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://launchpad.net/ubuntu/noble/+source/systemd"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the candidate set is not frozen (Conductor arrived on 2026-09-29 and the 2026-09-23 votes were not retained); c3: Dagu recovery after SIGKILL or a stale lock within the preregistered 150 s bound, the Restate and Dagster arms, physical reboot and power loss, and the target host's recovery lifecycle are open; c4: no independent review of the current set including the gap-wave2 SIGKILL failure; c5: no closure record (the decision is keep_but_compare)." + }, + "reasons": [ + {"text": "Dagu gives workflow run history, cancel and checkpointed step retry; the systemd user manager gives deadlines, control-group kill and descendant cleanup.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "systemd is the Ubuntu 24.04 distribution package; the stack pins the package version and cites upstream v255 source for semantics only.", "source_path": "manifests/stack.json"}, + {"text": "Dagu 2.16.6 failed its preregistered SIGKILL recovery case: without a scheduler, all retries within the 150 s bound were refused; it recovered (about 182 s) only in a post-hoc variant with a scheduler started after the kill, labelled a deviation.", "source_path": "evidence/artifacts/gap-wave2-20260923/foundation__scheduling-supervision/6-executed-challenger-comparison.json"}, + {"text": "The program record treats this layer as comparison required after that failure, while the research state still reads on_requirement_change and the layer record keep_but_compare; the re-record pass reconciles the label. The Temporal arm ran the native development server, which is developer evidence only, so the failure reopens the comparison and selects nothing.", "source_path": "docs/decisions/2026-10-01-definitive-sota-wsl-program.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/scheduling-supervision.json", "pull_request": 575, "commit": "51cb79ba"}}, + {"text": "systemd's acceptance is the historical host's user journal and manager record of the 2026-09-29 extended-hours paper series; the new-distro recipe's systemd checks are documented and not run, so they stay in the new-host steps (first boot F1 to F3), not in the acceptance.", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "Temporal", "verdict": "conditional; deferred as a new service, source review", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Restate", "verdict": "conditional; deferred as a new service, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Prefect", "verdict": "overlap", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Dagster", "verdict": "conditional, source review only, never executed", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "systemd comes with the Ubuntu 24.04.5 image: prove `systemctl is-system-running --wait` prints running, enable linger and prove the user bus (first boot F1 to F3 of the new-distro recipe).", + "Install Dagu 2.16.6 from its release archive after a gh sign-in; `bash adoption/bootstrap-linux.sh --profile research-runtime` exits 3 because nine of its eleven components lack a Linux pin.", + "Run `\"$DAGU\" version`, then one owned job with a stop, retry and checkpoint check, and record the host receipts." + ], + "gates": [ + {"text": "The reopened comparison (Dagu against Temporal and the Restate and Dagster arms on one fixture, within the preregistered bound) decides the layer; the edition installs the selection of record until it runs.", "kind": "lane", "source_path": "catalogs/landscape/foundation.json"} + ], + "owner_lane": "foundation", + "notes": "The Dagu recipe goes from the checksum check straight to `$DAGU version`; the extraction and placement step is not recorded. With its own preregistered SIGKILL case failed, this layer is a reopen candidate rather than nearly closed." + }, + { + "layer_id": "hosting-services", + "catalog": "foundation", + "title": "Application and service hosting", + "winners": [ + { + "component_id": "fastapi", + "repository": "https://github.com/fastapi/fastapi", + "pin": "0.141.1", + "pin_source": "manifests/stack.json:1760", + "install": {"command": "make setup; make postgres-install; make postgres-init; make postgres-start", "kind": "repo_recipe", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "acceptance": {"command": "make verify", "evidence_class": "local_integration_check", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "upstream_currency": {"latest_release": "0.142.2 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/fastapi/fastapi/releases"} + }, + { + "component_id": "nextjs", + "repository": "https://github.com/vercel/next.js", + "pin": "16.3.6", + "pin_source": "manifests/stack.json:1715", + "install": {"command": "make setup", "kind": "repo_recipe", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "acceptance": {"command": "make verify", "evidence_class": "local_integration_check", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "upstream_currency": {"latest_release": "v16.3.8 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/vercel/next.js/releases"} + }, + { + "component_id": "postgresql", + "repository": "https://github.com/postgres/postgres", + "pin": "18.6", + "pin_source": "manifests/stack.json:1782", + "install": {"command": "make postgres-install; make postgres-init; make postgres-start", "kind": "repo_recipe", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "acceptance": {"command": "make verify", "evidence_class": "local_integration_check", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + "upstream_currency": {"latest_release": "18.6 is the current 18.x release on the project's versioning page (the GitHub mirror publishes tags only)", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://www.postgresql.org/support/versioning/"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the winner entry records Next.js 16.3.5 while the stack and the committed lock pin 16.3.6, and the make verify acceptance has not been repeated at 16.3.6; c2: the candidate list and open gaps do not carry the sweep proposals and their refutations; c3: no matched native-against-container run under the frozen metric, no independent or off-host database restore, and no new-host lifecycle receipts; c4: no independent review after those checks; c5: no per-layer closure record." + }, + "reasons": [ + {"text": "FastAPI, Next.js and a source-built PostgreSQL are the layer winners; React is an overlap recorded with the UI server.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The application-delivery blueprint pins every tool and runs `make verify` on synthetic data only.", "source_path": "blueprints/convergence-practice/application-delivery/README.md"}, + {"text": "Next.js 16.3.8 (2026-09-30) fixes a High-severity advisory, server-side request forgery in image optimization (GHSA-cjq9-62q9-8jv4), and five Medium ones; the winner entry (16.3.5) and the lock (16.3.6) are both below it (release page read 2026-10-01).", "url": "https://github.com/vercel/next.js/releases/tag/v16.3.8"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/hosting-services.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "React 19.3.0", "verdict": "overlap; runs inside the Next.js UI server", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Docker Compose", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Podman / Quadlet", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Dev Containers CLI", "verdict": "conditional; deferred until container hosting is selected", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "Provide the blueprint's prerequisites first: a Python 3.13 interpreter, the self-pinned pnpm 12.4.2, gcc, make, perl, curl, tar and unzip (no install command is recorded for them), plus bison, flex and m4 for the PostgreSQL source build.", + "In a task-owned prefix with a clone of origin/main, run `make setup`, then the PostgreSQL install, init and start targets.", + "Run `make verify` at Next.js 16.3.6 and record the host receipt, then a database restore check." + ], + "gates": [ + {"text": "Move the Next.js pin to 16.3.8 or later and repeat `make verify` before this layer hosts anything reachable.", "kind": "lane", "url": "https://github.com/vercel/next.js/releases/tag/v16.3.8"} + ], + "owner_lane": "foundation", + "notes": "Only needed when the new distribution hosts an application; nothing else depends on this layer." + }, + { + "layer_id": "recovery-portability", + "catalog": "foundation", + "title": "Recovery and portability", + "winners": [ + { + "component_id": "restic", + "repository": "https://github.com/restic/restic", + "pin": "0.19.1", + "pin_source": "manifests/stack.json:1307", + "install": {"command": "the official restic_0.19.1_linux_amd64.bz2 release asset, its detached signature verified against the upstream primary fingerprint", "kind": "upstream_documented", "source_path": "blueprints/us-equities/hosting/backup/README.md"}, + "acceptance": {"command": "restic check and restore of two synthetic snapshots on a GitHub-hosted runner, after seven unchanged upstream restic tests passed there", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/native-offhost-restic-20260920.json"}, + "upstream_currency": {"latest_release": "v0.19.1 (2026-07-05)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/restic/restic/releases"} + }, + { + "name": "uv", + "repository": "https://github.com/astral-sh/uv", + "pin": "0.12.17", + "pin_source": "adoption/pins-linux-x86_64.json:24", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency (every profile run installs the node, uv and gh pins)", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "the pinned uv release archive's sha256 verified against the release's .sha256 sidecar (fetched 2026-09-22); `uv --version` is not shown run", "evidence_class": "structural_validation", "source_path": "adoption/pins-linux-x86_64.json"}, + "upstream_currency": {"latest_release": "0.12.21 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/astral-sh/uv/releases"} + } + ], + "verdict": "new_host_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the uv winner is recorded as unpinned (it should bind 0.12.17) and Devbox's disposition contradicts itself; c2: no three clean sweeps under an unchanged requirement hash; c3: the preregistered comparisons (Restic against Litestream; uv sync against a mise locked install) have not run, nor the full metric on a new host; c4: the two-lane review and later sweeps left material gaps open; c5: no closure record under docs/decisions." + }, + "reasons": [ + {"text": "Owned native install and rollback recipes plus application-native backups (ai-memory, Qdrant) carry recovery; Restic covers selected application state.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The research state marks this layer new_host_required: its remaining evidence is a recovery on another host.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "Restic's off-host recovery is recorded as native operation on synthetic fixtures, with unchanged upstream tests.", "source_path": "evidence/receipts/native-offhost-restic-20260920.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict confirmed, 0 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/recovery-portability.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "mise", "verdict": "conditional; a comparison arm", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "chezmoi", "verdict": "conditional; dotfile management deferred", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Litestream", "verdict": "conditional; a comparison arm", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Determinate Nix installer", "verdict": "out of scope: a privileged platform change", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "uv installs with any bootstrap profile run; provide CPython 3.13.15 for the SDK lane separately (no recipe provisions it).", + "Install Restic 0.19.1 from its signed release asset; `bash adoption/bootstrap-linux.sh --profile recovery` exits 3 because restic and qdrant lack Linux pins.", + "Restore one Restic snapshot and one ai-memory backup made on the source host into owned scratch paths on the new distribution, and compare them with the source; this is the evidence the layer waits for." + ], + "gates": [], + "owner_lane": "foundation", + "notes": "This is the layer the new distribution can close a closure item for: a recovery onto a separate host." + }, + { + "layer_id": "observation-inference", + "catalog": "foundation", + "title": "Observation and optional inference", + "winners": [ + { + "component_id": "opentelemetry-collector-contrib", + "repository": "https://github.com/open-telemetry/opentelemetry-collector-contrib", + "pin": "0.161.0", + "pin_source": "manifests/stack.json:1087", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"; python3 observability/backends/configure.py --tools-root \"$STACK_TOOLS_ROOT\" --config-root \"$STACK_CONFIG_ROOT\" --data-root \"$STACK_DATA_ROOT\" --unit-root \"$HOME/.config/systemd/user\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "otelcol-contrib validate --config=\"$OTEL_CONFIG\"", "evidence_class": "structural_validation", "source_path": "observability/README.md"}, + "upstream_currency": {"latest_release": "v0.162.0 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/releases"} + }, + { + "component_id": "prometheus", + "repository": "https://github.com/prometheus/prometheus", + "pin": "3.15.0", + "pin_source": "manifests/stack.json:1118", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "promtool check config and check rules (14 rules) on the live files, systemd-analyze --user verify of the rendered unit, then daemon-reload and restart of ecosystem-prometheus.service: /-/ready answered 0.86 s after the restart, buildinfo read 3.15.0, the seven targets were up and the 14 rules evaluated with health ok (2026-09-26)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/prometheus-3150-qualification-20260926.json"}, + "upstream_currency": {"latest_release": "v3.15.0 (2026-09-25)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/prometheus/prometheus/releases"} + }, + { + "component_id": "loki", + "repository": "https://github.com/grafana/loki", + "pin": "3.7.8", + "pin_source": "manifests/stack.json:1156", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "loki -config.file=\"$LOKI_CONFIG\" -verify-config=true (exit 0: the final native Loki OTLP structured-metadata configuration accepted)", "evidence_class": "structural_validation", "source_path": "observability/receipt.json"}, + "upstream_currency": {"latest_release": "v3.7.8 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/grafana/loki/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the candidate list (checked 2026-09-22) gives no disposition for the 2026-09-26 sweep survivors (Tempo, OpenLLMetry, Ollama, a GPU exporter); c3: no arm of the overturn protocol (OpenLIT, Phoenix) has run against the current path, the roadmap's confirming checks have not run, no new-host lifecycle receipt exists, and no record compares the two per-subagent tool-use routes; c4: no second independent review of the bounded set (eleven open gaps remain); c5: no closure record after the gap wave and the sweeps." + }, + "reasons": [ + {"text": "The catalog selects loopback native telemetry and scoped history; a local model and the gateway are optional trials.", "source_path": "catalogs/foundation/manifest.json"}, + {"text": "Per-subagent tool-use evidence has two routes and no record compares them: native OTel (Codex logs agent_name on its tool results and spawn edges; Claude carries agent_id on trace spans only) and transcript analysis over saved session directories.", "source_path": "docs/decisions/2026-09-26-tool-invoke-rates.md"}, + {"text": "The skill-usage tool rejects the OTel route on the assumption that OTEL_LOG_TOOL_DETAILS is off, which the 2026-09-26 decision turned on.", "source_path": "tools/skill-usage/README.md"}, + {"text": "The merged Gate A kernel (PR #528) is analysis code over saved session directories, including subagents/agent-*.jsonl; it is not the instrument of record until the routes are compared.", "source_path": "examples/claude-native/workflows/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/observation-inference.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "Grafana 13.2.2", "verdict": "overlap: the display layer, an accepted use stage", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Alertmanager 0.34.1", "verdict": "conditional; loopback fixture only, no external delivery", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "ntfy 2.28.0", "verdict": "conditional, native-proven", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "llama.cpp optional inference", "verdict": "conditional; one fixture and one trial", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "AgentsView 0.43.0", "verdict": "conditional; a snapshot, not continuous ingestion", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "Prove the systemd user manager first (first boot F1 to F3): the backends run as systemd user units.", + "Install the backends with the repository installer and configure them; `bash adoption/bootstrap-linux.sh --profile observability` exits 3 because none of its six components has a Linux pin.", + "Move the backends' fixed ports with --port-overrides: WSL distributions share one network namespace with the workstation's listeners.", + "Check readiness and buildinfo on loopback, then reconcile one fresh task's tokens with Prometheus.", + "On the Harbor pilot, run both per-subagent routes (native OTel with tool details and trace spans; the transcript kernel) and record which yields per-subagent tool calls with fewer gaps." + ], + "gates": [ + {"text": "The Gate A comparison of the two per-subagent routes runs on the Harbor pilot; until then neither route is the instrument of record.", "kind": "lane", "source_path": "examples/claude-native/workflows/README.md"} + ], + "owner_lane": "foundation: Gate A", + "notes": "Install the collector examples under observability/collector only if the OTel route is chosen for per-subagent evidence." + }, + { + "layer_id": "agent-sdks", + "catalog": "foundation", + "title": "Agent SDKs and runtime workers", + "winners": [ + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "name": "openai-codex Python SDK with openai-codex-cli-bin", + "repository": "https://github.com/openai/codex", + "pin": "openai-codex==0.154.0", + "pin_source": "adoption/sdk/accepted-constraints.txt:19-20", + "install": {"command": "uv venv --python \"$PYTHON_BIN\" --no-python-downloads \"$SDK_ENV\"; uv pip sync --python \"$SDK_ENV/bin/python\" --require-hashes --no-build --strict --default-index https://pypi.org/simple --no-sources adoption/sdk/requirements-linux-x86_64-py313.lock", "kind": "repo_recipe", "source_path": "adoption/sdk/README.md"}, + "acceptance": {"command": "uv pip check --python \"$SDK_ENV/bin/python\"; \"$SDK_ENV/bin/python\" -m unittest discover -s tests -v", "evidence_class": "local_integration_check", "source_path": "adoption/sdk/README.md"}, + "upstream_currency": {"latest_release": "PyPI openai-codex 0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://pypi.org/project/openai-codex/"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: no decision record cites the recoverable primary evidence (the SDK use receipt with hashed outputs, the worker receipt, the gap-wave2 raw output and the comparison); c2: the layer record does not absorb the sweep candidates with dispositions or record the access failures; c3: the sealed three-arm comparison has not been re-preregistered and rerun, and no target-host lifecycle checks exist at the current pins; c4: six of fourteen recorded gaps are unsettled; c5: no closure record." + }, + "reasons": [ + {"text": "The layer selects the Codex SDK and CLI; an SDK enters only for a demonstrated application need.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "The Python SDK and its bundled CLI binary are pinned at 0.154.0 while the native CLI is at 0.159.2.", "source_path": "adoption/sdk/accepted-constraints.txt"}, + {"text": "No unchanged upstream test is recorded for the SDK or the CLI.", "source_path": "evidence/receipts/codex-01592-qualification-20260930.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/agent-sdks.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Claude Agent SDK", "verdict": "conditional; arm C of the unresolved workers comparison", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "OpenHands SDK", "verdict": "conditional, source review in the layer record; qualified separately as a runtime worker", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "LangGraph", "verdict": "unqualified, source review in the layer record", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Temporal", "verdict": "out of scope in the alternatives", "source_path": "catalogs/landscape/foundation.json"} + ], + "new_host_steps": [ + "The native CLI half installs with the token-efficiency profile (row native-clients).", + "Provide an installed CPython 3.13.15 as PYTHON_BIN (no recipe provisions it) and a new private SDK_ENV path, then run the SDK lane's locked install.", + "Run `uv pip check` and the SDK lane's unit tests, then one sealed SDK task after a native `codex login`, and record the receipt." + ], + "gates": [ + {"text": "An interactive native `codex login` on the new host is a user action and does not transfer.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "foundation", + "notes": "Runtime workers are a separate cross-cutting row (cross:runtime-workers)." + }, + { + "layer_id": "mcp-surfaces", + "catalog": "foundation", + "title": "MCP servers and client surfaces", + "winners": [ + { + "component_id": "mcporter", + "repository": "https://github.com/openclaw/mcporter", + "pin": "0.14.1", + "pin_source": "manifests/stack.json:625", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "mcporter --config \"$MCPORTER_CONFIG\" list socraticode --brief --no-oauth", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.14.1 (2026-09-24)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/openclaw/mcporter/releases"} + }, + { + "component_id": "mcp-inspector", + "repository": "https://github.com/modelcontextprotocol/inspector", + "pin": "2.8.0", + "pin_source": "manifests/stack.json:600", + "install": {"command": "npm install --global --prefix \"$STACK_HOME/tools/mcp-inspector-2.8.0\" @modelcontextprotocol/inspector@2.8.0", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "mcp-inspector --cli --config \"$PROJECT_ROOT/.mcp.json\" --server socraticode --method tools/list --format json --stored-auth-only --cwd \"$PROJECT_ROOT\"", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "2.9.0 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/modelcontextprotocol/inspector/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c2: no consolidated frozen candidate set at the served pins folds in the 2026-09-23 manifest and ledger and the later sweeps; c3: the retained operations and the owned-daemon lifecycle fixture have not run at mcporter 0.14.1 and Inspector 2.8.0 on the target WSL host; c4: no independent cross-family review of a bounded set at the served pins (the 2.8.0 switch is unreviewed); c5: no closure record from a new verdict wave." + }, + "reasons": [ + {"text": "Native project MCP configuration is the policy; MCPorter and the Inspector inspect and bridge servers without replacing the clients' own MCP handling.", "source_path": "catalogs/foundation/decisions.json"}, + {"text": "@wong2/mcp-cli 2.0.0 lost the executed head-to-head against mcporter and the Inspector on every list and call operation.", "source_path": "evidence/artifacts/gap-wave2-20260923/foundation__mcp-surfaces/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 1 correction to the layer records). It names 3 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/mcp-surfaces.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "@wong2/mcp-cli 2.0.0", "verdict": "lost the executed head-to-head", "source_path": "evidence/artifacts/gap-wave2-20260923/foundation__mcp-surfaces/README.md"}, + {"name": "punkpeye/awesome-mcp-servers", "verdict": "out of scope: a discovery list", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "MCPJam/inspector", "verdict": "refuted in the 2026-09-23, 09-26 and 09-29 sweeps", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "microsoft/mcp-gateway, docker/mcp-registry, modelcontextprotocol/registry", "verdict": "refuted by lens 1 in the 2026-09-23 sweep", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Install procps before MCPorter's daemon is used: mcporter 0.14.x needs ps on the daemon launcher's PATH, and the bootstrap neither installs nor checks it.", + "MCPorter installs with the token-efficiency profile; install the Inspector 2.8.0 with npm (it is in no profile).", + "Render the project MCP configuration, then list one server through MCPorter and the Inspector and follow with one selected tool call; record the host receipt." + ], + "gates": [], + "owner_lane": "foundation", + "notes": "Both recorded checks need another layer's server (SocratiCode), so run them after row semantic-rag." + }, + { + "layer_id": "secrets-credentials", + "catalog": "foundation", + "title": "Secrets and credentials", + "winners": [ + { + "component_id": "gitleaks", + "repository": "https://github.com/gitleaks/gitleaks", + "pin": "8.30.1", + "pin_source": "manifests/stack.json:491", + "install": {"command": "curl -fsSLO \"$base/gitleaks_8.30.1_linux_x64.tar.gz\"; curl -fsSLO \"$base/gitleaks_8.30.1_checksums.txt\"; sha256sum --check --ignore-missing gitleaks_8.30.1_checksums.txt; tar -xzf gitleaks_8.30.1_linux_x64.tar.gz -C \"$ECO_INSTALL_ROOT/tools/gitleaks-8.30.1\" gitleaks", "kind": "repo_recipe", "source_path": "docs/secret-storage.md"}, + "acceptance": {"command": "the pre-commit hook passes a clean staged file (exit 0) and fails a planted, generated AWS-style key (exit 1)", "evidence_class": "none_recorded", "source_path": "docs/acceptance-evidence-policy.md"}, + "upstream_currency": {"latest_release": "v8.30.1 (2026-03-21)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/gitleaks/gitleaks/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the layer's alternatives do not name betterleaks or the 2026-09-29 credential-handling candidates, and the layer does not link the secret-storage and key-management records; c2: no frozen candidate set with explicit omitted or out-of-scope reasons; c3: no lifecycle receipt (verify, update, rollback) at a current revision on the target WSL host; c4: no review of the layer as a whole since the 2026-09-22 lanes recorded unresolved gaps; c5: no closure record supersedes the 2026-09-22 verdict." + }, + "reasons": [ + {"text": "Native sign-ins stay native; keys live in per-provider 0600 files under a 0700 directory outside every worktree, and nothing is read or printed by an agent.", "source_path": "docs/secret-storage.md"}, + {"text": "Authentication never transfers between hosts: the adoption policy is native login on the target only.", "source_path": "adoption/manifest.json"}, + {"text": "gitleaks is the pre-publication secret scan; its hook check is designed with a discriminating control (a planted generated key must fail), which the cited policy states as an example, with no recorded run.", "source_path": "docs/acceptance-evidence-policy.md"}, + {"text": "Upstream declares gitleaks feature complete: future releases are security patches only, and its maintainer's focus moved to Betterleaks (README read 2026-10-01).", "url": "https://github.com/gitleaks/gitleaks"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict confirmed, 0 corrections to the layer records). It names 1 remaining gap, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/secrets-credentials.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "OpenBao", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "betterleaks", "verdict": "survived the 2026-09-23, 09-26 and 09-29 sweeps; not named in the layer's alternatives", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "trufflehog", "verdict": "survived 2026-09-23; refuted on fit 2026-09-26", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "gitguardian/ggshield", "verdict": "refuted 2026-09-23; survived 2026-09-26 and 09-29", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "Follow the new-host steps of docs/secret-storage.md in order (cross-cutting row cross:credential-practice).", + "Install gitleaks 8.30.1 before enabling the hook (step 5a), compare the archive digest with the pin 551f6fc8, then set `git config core.hooksPath scripts/git-hooks`.", + "Run the hook check with a clean staged file and a planted generated key, and record both results." + ], + "gates": [ + {"text": "Each provider key is created by the user in its own 0600 file; values never pass through an agent, chat, gist, GitHub or shell history.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "shared", + "notes": "Enabling core.hooksPath before gitleaks resolves makes the pre-commit hook refuse every commit." + }, + { + "layer_id": "git-github-automation", + "catalog": "foundation", + "title": "Git practice and GitHub automation", + "winners": [ + { + "component_id": "worktrunk", + "repository": "https://github.com/max-sixty/worktrunk", + "pin": "0.79.0", + "pin_source": "manifests/stack.json:1059", + "install": {"command": "gh release view v0.79.0 --repo max-sixty/worktrunk --json assets; gh release download v0.79.0 --repo max-sixty/worktrunk (worktrunk-x86_64-unknown-linux-musl.tar.xz and its checksum asset); sha256sum -c; extract into a versioned prefix", "kind": "repo_recipe", "source_path": "recipes/native-upgrades-20260921.md"}, + "acceptance": {"command": "wt list --format json", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.80.0 (2026-09-27)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/max-sixty/worktrunk/releases"} + }, + { + "name": "GitHub CLI (gh)", + "repository": "https://github.com/cli/cli", + "pin": "2.101.0", + "pin_source": "adoption/pins-linux-x86_64.json:39", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency (every profile run installs the node, uv and gh pins)", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "the pinned gh 2.101.0 release archive's sha256 verified against the release's gh_2.101.0_checksums.txt (2026-09-22); `gh --version` and `gh auth status` are not shown run", "evidence_class": "structural_validation", "source_path": "adoption/pins-linux-x86_64.json"}, + "upstream_currency": {"latest_release": "v2.102.0 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/cli/cli/releases"} + }, + { + "component_id": "difftastic", + "repository": "https://github.com/Wilfred/difftastic", + "pin": "0.71.0", + "pin_source": "manifests/stack.json:468", + "install": {"command": "official 0.71.0 archive difft-0.71.0-x86_64-unknown-linux-gnu.tar.gz, verified against SHA-256 61aea5394a53c56f144637cf39b3a0c0dafa27769731745e5851ff276e6478da", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "difft --exit-code --color never fixtures/before.py fixtures/after.py (exit 1 means differences)", "evidence_class": "none_recorded", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "0.71.0 (2026-09-18)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/Wilfred/difftastic/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: gh's verdict pin reads unpinned while the adoption pin is 2.101.0, and gh has no stack.json row; c2: the survivors (claude-code-action, sem) and the executed challengers (native git worktree, git diff --no-index) are not frozen into the candidate set; c3: no syntax-aware structural-diff challenger has run on the fixtures; c4: no independent review after the re-record; c5: no closure record." + }, + "reasons": [ + {"text": "Owned worktrees for edits, gh for API, ruleset and pull-request operations, and difftastic for structural diffs.", "source_path": "catalogs/landscape/foundation.json"}, + {"text": "gh installs with every bootstrap run behind a fail-closed sha256 check against the release checksums.", "source_path": "adoption/pins-linux-x86_64.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict confirmed, 0 corrections to the layer records). It names 2 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/git-github-automation.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "openai/codex-plugin-cc 1.0.6", "verdict": "conditional; review bridge, not a default", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "native git worktree and git diff --no-index", "verdict": "run as challengers on 2026-09-23; not frozen into the candidate set", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "anthropics/claude-code-action", "verdict": "survived the 2026-09-23 sweep on source review only", "source_path": "catalogs/saturation/ledger.json"}, + {"name": "ataraxy-labs/sem", "verdict": "survived the 2026-09-26 and 2026-09-29 sweeps on source review only", "source_path": "catalogs/saturation/ledger.json"} + ], + "new_host_steps": [ + "gh installs with the bootstrap; sign in with `gh auth login` and `gh auth setup-git` before any `gh release download` step of other rows.", + "Install Worktrunk (row workers) and difftastic from its verified archive; neither is in an adoption profile.", + "Run `gh auth status`, `wt list --format json` and the difft fixture, and record the host receipt." + ], + "gates": [ + {"text": "gh sign-in is a user action on the new distribution.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "foundation", + "notes": "" + }, + { + "layer_id": "market-data-reference", + "catalog": "us-equities", + "title": "Market data and reference", + "winners": [ + { + "component_id": "alpaca-py", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the research-runtime profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "the September 20 run of installed alpaca-py 0.44.0: five authenticated GET requests, all returned HTTP 200", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/authenticated-data/README.md"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + }, + { + "component_id": "edgartools", + "repository": "https://github.com/dgunning/edgartools", + "pin": "5.58.0", + "pin_source": "manifests/stack.json:1516", + "install": {"command": "uv venv \"$CATALYST_RUNTIME/sdk\" --python 3.13; uv pip install --python \"$CATALYST_RUNTIME/sdk/bin/python\" -r blueprints/us-equities/catalyst-provenance/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/catalyst-provenance/README.md"}, + "acceptance": {"command": "native_edgar.py with the private SEC contact as EDGAR_IDENTITY: upstream edgar.get_filings and native bounded Filings.to_context completed the full quarterly-index request (EdgarTools 5.58.0; 371 8-K/8-K/A index rows for 2020-03-02; repeated on a second WSL2 host on 2026-09-24)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/catalyst-provenance/access-resolution.md"}, + "upstream_currency": {"latest_release": "v5.59.1 (2026-09-26)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dgunning/edgartools/releases"} + }, + { + "component_id": "exchange-calendars", + "repository": "https://github.com/gerrymanoim/exchange_calendars", + "pin": "4.13.2", + "pin_source": "manifests/stack.json:1544", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json --calendar XNYS", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "4.13.2 (2026-03-10)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/gerrymanoim/exchange_calendars/releases"} + }, + { + "component_id": "duckdb", + "repository": "https://github.com/duckdb/duckdb", + "pin": "1.5.5", + "pin_source": "manifests/stack.json:1275", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "v1.5.6 (2026-09-28)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/duckdb/duckdb/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c2: saturation is not established, and the 2026-09-22 layer entry does not disposition the 2026-09-26 sweep survivors (arcticdb, tiingo-python) or the GPT-6 omissions; c3: the Databento and Massive arms on the frozen AAPL plan with a generalized comparator, point-in-time and as-known availability, licensing, and a fresh-host acquisition receipt for alpaca-py have not run; c4: no review reports the bounded set free of material gaps, and the GPT-6 votes found errors in the 2026-09-26 proposal; c5: no closure record while the layer is comparison_required." + }, + "reasons": [ + {"text": "runtime-target.json selects alpaca-py 0.44.0 for ingestion; EdgarTools, exchange-calendars and DuckDB come from the layer's current choice.", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "The live provider evidence is five authenticated Alpaca market-data requests on 2026-09-20; the rest is native operation and local integration from 2026-09-19 to 2026-09-26.", "source_path": "blueprints/us-equities/authenticated-data/native-receipt.json"}, + {"text": "The 2026-09-26 convergence record keeps Databento and Sharadar as targeted candidates and pandas_market_calendars and sec-api-python as keep_but_compare.", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/market-data-reference.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Databento", "verdict": "conditional, source review; a targeted candidate on 2026-09-26", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Massive Python client", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Sharadar SEP/SF1", "verdict": "a targeted candidate on 2026-09-26", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"name": "pandas_market_calendars", "verdict": "keep_but_compare on 2026-09-26", "source_path": "catalogs/us-equities/convergence-20260926.json"} + ], + "new_host_steps": [ + "Provide CPython 3.13.15 for the research SDK lock (no step installs it; Ubuntu 24.04's python3 is 3.12) and a separate environment per recipe.", + "Install alpaca-py, EdgarTools, exchange-calendars and DuckDB from their recipes: the research-runtime profile exits 3 in the bootstrap because nine of its components lack Linux pins.", + "Keep the Alpaca data keys and the SEC contact identity in their 0600 provider files (row cross:credential-practice), then record a fresh-host acquisition receipt." + ], + "gates": [ + {"text": "Alpaca data access uses the user's own paper credentials and feed entitlements; entitlements stay separate from the code.", "kind": "user_side", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "Paid market data for the c3 comparison: the Databento arm (a paid entitlement) and Massive history beyond the free tier are the user's purchases.", "kind": "user_side", "source_path": "catalogs/us-equities/gates-20260922.json"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict (trading lane, 2026-10-01): selection of record, open, distance 4. Blocking item: c3, the provider comparison on the frozen AAPL plan with point-in-time and availability evidence. Closure items follow the trading closure assessment of 2026-10-01 (read at PR #358's head 4d11709c)." + }, + { + "layer_id": "identity-provenance", + "catalog": "us-equities", + "title": "Identity, provenance and lineage", + "winners": [ + { + "component_id": "alpaca-py", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the research-runtime profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "the September 20 run of installed alpaca-py 0.44.0: five authenticated GET requests, all returned HTTP 200", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/authenticated-data/README.md"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + }, + { + "component_id": "edgartools", + "repository": "https://github.com/dgunning/edgartools", + "pin": "5.58.0", + "pin_source": "manifests/stack.json:1516", + "install": {"command": "uv venv \"$CATALYST_RUNTIME/sdk\" --python 3.13; uv pip install --python \"$CATALYST_RUNTIME/sdk/bin/python\" -r blueprints/us-equities/catalyst-provenance/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/catalyst-provenance/README.md"}, + "acceptance": {"command": "native_edgar.py with the private SEC contact as EDGAR_IDENTITY: upstream edgar.get_filings and native bounded Filings.to_context completed the full quarterly-index request (EdgarTools 5.58.0; 371 8-K/8-K/A index rows for 2020-03-02; repeated on a second WSL2 host on 2026-09-24)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/catalyst-provenance/access-resolution.md"}, + "upstream_currency": {"latest_release": "v5.59.1 (2026-09-26)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dgunning/edgartools/releases"} + }, + { + "component_id": "duckdb", + "repository": "https://github.com/duckdb/duckdb", + "pin": "1.5.5", + "pin_source": "manifests/stack.json:1275", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "v1.5.6 (2026-09-28)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/duckdb/duckdb/releases"} + }, + { + "component_id": "exchange-calendars", + "repository": "https://github.com/gerrymanoim/exchange_calendars", + "pin": "4.13.2", + "pin_source": "manifests/stack.json:1544", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json --calendar XNYS", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "4.13.2 (2026-03-10)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/gerrymanoim/exchange_calendars/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: no selection covers the stated requirement (licensed acquisition, permanent identity, historical eligibility) or explicitly scopes it out, and DVC's status is unreconciled across the records; c2: no frozen candidate set reconciles the 2026-09-22 entry with the 2026-09-26 record (DuckLake, delta-rs and Pandera need dispositions); c3: the point-in-time fixture comparison with Iceberg add_files and ArcticDB staged-write arms, the two identity gates and a second-host rerun have not run; c4: no review of a reconciled closure set; c5: no closure record." + }, + "reasons": [ + {"text": "The selection of record is alpaca-py from runtime-target.json plus EdgarTools, DuckDB and exchange-calendars from the layer's current choice; the verdict's own winner, DVC 3.67.1, is source review only and has no pin of record.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The identity gates wait on user-owned identity sources.", "source_path": "catalogs/us-equities/gates-20260922.json"}, + {"text": "The research state asks first for a frozen universe, history and rights, with auditable delisting, ticker-reuse, action, currency and revision evidence.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 4 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/identity-provenance.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "DVC 3.67.1", "verdict": "the verdict's provisional winner on source review, without a pin of record", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Databento and Massive", "verdict": "conditional licensed or reference providers", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "ArcticDB", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with row market-data-reference.", + "Run the point-in-time fixture comparison before the identity gates; those gates need user-owned identity sources." + ], + "gates": [ + {"text": "The dated security-identity gate needs an entitled identity source that the user owns.", "kind": "user_side", "source_path": "catalogs/us-equities/gates-20260922.json"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5. Blocking item: c3, the verdict_overturn_when comparison on blueprints/us-equities/point-in-time/fixture.json with the validate_source invariants; no gate blocks it, and it needs a recorded DVC install first. The verdict's own winner, DVC 3.67.1, has no pin of record." + }, + { + "layer_id": "storage-compute", + "catalog": "us-equities", + "title": "Storage and compute", + "winners": [ + { + "component_id": "duckdb", + "repository": "https://github.com/duckdb/duckdb", + "pin": "1.5.5", + "pin_source": "manifests/stack.json:1275", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "v1.5.6 (2026-09-28)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/duckdb/duckdb/releases"} + }, + { + "component_id": "alpaca-py", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the research-runtime profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "the September 20 run of installed alpaca-py 0.44.0: five authenticated GET requests, all returned HTTP 200", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/authenticated-data/README.md"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + }, + { + "component_id": "edgartools", + "repository": "https://github.com/dgunning/edgartools", + "pin": "5.58.0", + "pin_source": "manifests/stack.json:1516", + "install": {"command": "uv venv \"$CATALYST_RUNTIME/sdk\" --python 3.13; uv pip install --python \"$CATALYST_RUNTIME/sdk/bin/python\" -r blueprints/us-equities/catalyst-provenance/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/catalyst-provenance/README.md"}, + "acceptance": {"command": "native_edgar.py with the private SEC contact as EDGAR_IDENTITY: upstream edgar.get_filings and native bounded Filings.to_context completed the full quarterly-index request (EdgarTools 5.58.0; 371 8-K/8-K/A index rows for 2020-03-02; repeated on a second WSL2 host on 2026-09-24)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/catalyst-provenance/access-resolution.md"}, + "upstream_currency": {"latest_release": "v5.59.1 (2026-09-26)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dgunning/edgartools/releases"} + }, + { + "component_id": "exchange-calendars", + "repository": "https://github.com/gerrymanoim/exchange_calendars", + "pin": "4.13.2", + "pin_source": "manifests/stack.json:1544", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" pandera==0.33.1 pandas exchange_calendars==4.13.2 pyarrow duckdb==1.5.5", "kind": "repo_recipe", "source_path": "blueprints/us-equities/data/README.md"}, + "acceptance": {"command": "\"$GATE_TOOL_DIR/.venv/bin/python3\" promotion_gate.py --input snapshot.parquet --out gate-result.json --calendar XNYS", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/data/README.md"}, + "upstream_currency": {"latest_release": "4.13.2 (2026-03-10)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/gerrymanoim/exchange_calendars/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: recoverable primary evidence is incomplete (one check's input is external and the broad-universe input is private); c2: the 2026-09-22 entry, the 2026-09-26 trading record and the companion sweep differ and are not reconciled; c3: the representative comparison (frozen universe, history, latency, rights, correction and availability semantics, and providers on securities with delistings, ticker reuse and corporate actions) is missing; c4: the cross-family reviews found gaps that remain unresolved; c5: no closure record while the layer is comparison_required." + }, + "reasons": [ + {"text": "DuckDB with Parquet is the layer's sole recorded verdict winner; alpaca-py comes from runtime-target.json and EdgarTools and exchange-calendars from the shared current choice of the data layers.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The research state asks first for a frozen universe, history and rights, with auditable delisting, ticker-reuse, action, currency and revision evidence.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/storage-compute.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Databento", "verdict": "conditional, source review", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Polars", "verdict": "conditional; no same-data comparison", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Apache Iceberg", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "QuestDB", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with row market-data-reference; the promotion gate needs its own environment from blueprints/us-equities/data/requirements.lock.", + "Decide whether to keep DuckDB 1.5.5 and EdgarTools 5.58.0 or re-pin to 1.5.6 and 5.59.1 before collecting receipts, then run the promotion gate on a retained snapshot." + ], + "gates": [ + {"text": "The comparison's licensed inputs need the same paid-data decision as market-data-reference.", "kind": "user_side", "source_path": "catalogs/us-equities/gates-20260922.json"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5. Blocking item: c3, a representative comparison (frozen universe, history, latency, rights, correction and availability semantics). A re-pin decision is pending: DuckDB 1.5.6 and EdgarTools 5.59.1 are published." + }, + { + "layer_id": "data-quality-orchestration", + "catalog": "us-equities", + "title": "Data quality and orchestration", + "winners": [ + { + "component_id": "dagu", + "repository": "https://github.com/dagucloud/dagu", + "pin": "2.16.6", + "pin_source": "manifests/stack.json:1335", + "install": {"command": "gh release download v2.16.6 --repo dagucloud/dagu (the linux_amd64 archive and checksums.txt); check the checksum, extract and place the binary", "kind": "repo_recipe", "source_path": "blueprints/us-equities/hosting/README.md"}, + "acceptance": {"command": "dagu start --context local --dagu-home \"$RESEARCH_HOME\" --run-id evidence-20260919-ready \"$WORKFLOW\": the three-step equity-research-evidence workflow through the upstream CLI (DuckDB summarized six LEAN simulated events into three orders, then both evidence validators passed; exit 0), and the native history kept its succeeded, failed and cancelled runs after a service restart (Dagu 2.16.6, 2026-09-19)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/hosting/receipt.json"}, + "upstream_currency": {"latest_release": "v2.18.1 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dagucloud/dagu/releases"} + }, + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "component_id": "claude-code", + "repository": "https://github.com/anthropics/claude-code", + "pin": "2.1.284", + "pin_source": "manifests/stack.json:192", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "claude -p --output-format stream-json --verbose --max-turns 14 < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.1.286 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/claude-code/releases"} + }, + { + "component_id": "systemd", + "repository": "https://github.com/systemd/systemd", + "pin": "255.4-1ubuntu8.17", + "pin_source": "manifests/stack.json:1448", + "install": {"command": "", "kind": "none_recorded", "source_path": "blueprints/us-equities/worker-supervision/README.md"}, + "acceptance": {"command": "systemd 255 user units on the historical host: the timer started paper-ext-20260929.service at 16:00:05 ET on 2026-09-29, and journalctl --user -o json USER_UNIT=.service and systemctl --user show recorded its exit (status 3, Result=exit-code) and the run of its OnFailure alert unit", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/README.md"}, + "upstream_currency": {"latest_release": "255.4-1ubuntu8.17 is the published Ubuntu 24.04 (noble) updates and security version", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://launchpad.net/ubuntu/noble/+source/systemd"} + }, + { + "component_id": "opentelemetry-collector-contrib", + "repository": "https://github.com/open-telemetry/opentelemetry-collector-contrib", + "pin": "0.161.0", + "pin_source": "manifests/stack.json:1087", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "otelcol-contrib validate --config=\"$OTEL_CONFIG\"", "evidence_class": "structural_validation", "source_path": "observability/README.md"}, + "upstream_currency": {"latest_release": "v0.162.0 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/releases"} + }, + { + "component_id": "prometheus", + "repository": "https://github.com/prometheus/prometheus", + "pin": "3.15.0", + "pin_source": "manifests/stack.json:1118", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "promtool check config and check rules (14 rules) on the live files, systemd-analyze --user verify of the rendered unit, then daemon-reload and restart of ecosystem-prometheus.service: /-/ready answered 0.86 s after the restart, buildinfo read 3.15.0, the seven targets were up and the 14 rules evaluated with health ok (2026-09-26)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/prometheus-3150-qualification-20260926.json"}, + "upstream_currency": {"latest_release": "v3.15.0 (2026-09-25)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/prometheus/prometheus/releases"} + }, + { + "component_id": "loki", + "repository": "https://github.com/grafana/loki", + "pin": "3.7.8", + "pin_source": "manifests/stack.json:1156", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "loki -config.file=\"$LOKI_CONFIG\" -verify-config=true (exit 0: the final native Loki OTLP structured-metadata configuration accepted)", "evidence_class": "structural_validation", "source_path": "observability/receipt.json"}, + "upstream_currency": {"latest_release": "v3.7.8 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/grafana/loki/releases"} + }, + { + "component_id": "grafana", + "repository": "https://github.com/grafana/grafana", + "pin": "13.2.2", + "pin_source": "manifests/stack.json:1193", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "systemd-analyze --user verify of the rendered ecosystem units, then systemctl --user enable --now ecosystem-{prometheus,loki,grafana,alertmanager,ntfy}.service", "evidence_class": "upstream_example_or_native_operation", "source_path": "observability/backends/README.md"}, + "upstream_currency": {"latest_release": "v13.2.3 (2026-09-29)", "checked_at": "2026-10-01T08:17Z", "pin_is_latest": "no", "url": "https://github.com/grafana/grafana/releases"} + }, + { + "component_id": "restic", + "repository": "https://github.com/restic/restic", + "pin": "0.19.1", + "pin_source": "manifests/stack.json:1307", + "install": {"command": "the official restic_0.19.1_linux_amd64.bz2 release asset, its detached signature verified against the upstream primary fingerprint", "kind": "upstream_documented", "source_path": "blueprints/us-equities/hosting/backup/README.md"}, + "acceptance": {"command": "restic check and restore of two synthetic snapshots on a GitHub-hosted runner, after seven unchanged upstream restic tests passed there", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/native-offhost-restic-20260920.json"}, + "upstream_currency": {"latest_release": "v0.19.1 (2026-07-05)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/restic/restic/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the current choice leaves out pandera, which the verdict and the domain card select, and keeps Dagu, which the 2026-09-29 manifest labels conditional; c2: DBOS, Pueue, Windmill, Great Expectations, Pointblank, Restate, Flyte and dataframely never entered the layer entry; c3: the Dagu-against-Temporal kill comparison does not meet the same-fixture clause of the overturn condition, and pandera has no matched comparison; c4: no review of the current layer state reports zero material gaps; c5: no closure record." + }, + "reasons": [ + {"text": "The current choice is native Codex and Claude for bounded research and review, Dagu and systemd for local command workflows, one OpenTelemetry Collector with Prometheus, Loki and Grafana, and Restic; pandera 0.33.1, the verdict's data-check winner, has no stack pin.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "Dagu's selection, recipe and failed preregistered SIGKILL case are shared with the foundation row scheduling-supervision.", "source_path": "evidence/artifacts/gap-wave2-20260923/foundation__scheduling-supervision/6-executed-challenger-comparison.json"}, + {"text": "The 2026-09-26 convergence record keeps Temporal, DBOS, Pueue, Dagster and Great Expectations as keep_but_compare.", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"text": "systemd's acceptance is the historical host's user journal and manager record of the 2026-09-29 extended-hours paper series; the new-distro recipe's systemd checks (documented, not run) stay in the new-host steps of row scheduling-supervision.", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 2 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/data-quality-orchestration.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "pandera 0.33.1", "verdict": "the verdict's data-check winner, installed only by the data recipe; no stack pin", "source_path": "blueprints/us-equities/data/README.md"}, + {"name": "Temporal", "verdict": "conditional, source review", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Modal", "verdict": "unqualified; the client needs a user login", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "DBOS, Pueue, Dagster and Great Expectations", "verdict": "keep_but_compare on 2026-09-26", "source_path": "catalogs/us-equities/convergence-20260926.json"} + ], + "new_host_steps": [ + "These install with the foundation rows native-clients, scheduling-supervision, observation-inference and recovery-portability; pandera installs only in the data recipe's promotion-gate environment.", + "Adjudicate the Dagu-against-Temporal kill comparison with a same-fixture rerun before extending scheduler scope.", + "Exercise one chosen real research worker job end to end, preserving its source packet, complete output, cancellation, process ownership and usage." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5 (queue: on_requirement_change). Blocking item: c3. The Dagu-vs-Temporal kill comparison (gap-wave2 #7) does not meet the same-fixture clause of verdict_overturn_when. pandera 0.33.1 is the verdict's data-check winner without a pin of record." + }, + { + "layer_id": "research-factors-ml", + "catalog": "us-equities", + "title": "Research, factors and ML", + "winners": [ + { + "component_id": "edgartools", + "role": "SEC filing acquisition and parsing", + "repository": "https://github.com/dgunning/edgartools", + "pin": "5.58.0", + "pin_source": "manifests/stack.json:1516", + "install": {"command": "uv venv \"$CATALYST_RUNTIME/sdk\" --python 3.13; uv pip install --python \"$CATALYST_RUNTIME/sdk/bin/python\" -r blueprints/us-equities/catalyst-provenance/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/catalyst-provenance/README.md"}, + "acceptance": {"command": "native_edgar.py with the private SEC contact as EDGAR_IDENTITY: upstream edgar.get_filings and native bounded Filings.to_context completed the full quarterly-index request (EdgarTools 5.58.0; 371 8-K/8-K/A index rows for 2020-03-02; repeated on a second WSL2 host on 2026-09-24)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/catalyst-provenance/access-resolution.md"}, + "upstream_currency": {"latest_release": "v5.59.1 (2026-09-26)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dgunning/edgartools/releases"} + }, + { + "component_id": "skfolio", + "role": "portfolio models and chronological evaluation", + "repository": "https://github.com/skfolio/skfolio", + "pin": "1.2.9", + "pin_source": "manifests/stack.json:1493", + "install": {"command": "uv venv --python \"$PYTHON\" \"$WAVE_DIR/venv\"; uv pip sync --python \"$WAVE_DIR/venv/bin/python\" --require-hashes blueprints/us-equities/research-evaluation/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/research-evaluation/README.md"}, + "acceptance": {"command": "\"$WAVE_DIR/venv/bin/python\" blueprints/us-equities/research-evaluation/evaluate.py --lean-source \"$LEAN_SOURCE\" --out \"$WAVE_DIR/run-1\" (the receipt: native skfolio 1.2.9 produced 20 chronological development folds and one reserved 2021Q1 evaluation)", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/research-evaluation/receipt.json"}, + "upstream_currency": {"latest_release": "v1.4.10 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/skfolio/skfolio/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c1: The selection of record is the owner's decision of 2026-10-01 (PR #578); the layer entry in catalogs/landscape/us-equities.json is not yet re-recorded with it.; c2: the candidate set is not refrozen with dispositions for the GPT-6 missed names and the sweep survivors; c3: the overturn-protocol arms have not run under one contract, the current upstream releases (skfolio 1.4.10, EdgarTools 5.59.1) are not qualified, and no fresh-host lifecycle run exists; c4: no review after these items; c5: no closure record." + }, + "reasons": [ + {"text": "The trading lane owner's decision of 2026-10-01 selects EdgarTools 5.58.0 for SEC filing acquisition and parsing and skfolio 1.2.9 for portfolio models and chronological evaluation; it closes nothing, and items 2 to 5 stay open.", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"text": "A cross-family adjudication (gpt-6-astra at effort max, in the Codex lane's selection-gap follow-up) recommended this narrower composition and named NautilusTrader as the engine, not the research selection; predictive ML and feature generation stay deferred until a prediction contract and an executable economic oracle exist.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/selection-gap-convergence-followup.json", "pull_request": 575, "commit": "51cb79ba"}}, + {"text": "Strategy qualification stays independent of the engine and broker checks.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 6 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/research-factors-ml.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "Alphalens Reloaded", "verdict": "conditional candidate, for when a factor-diagnostics requirement is activated", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"name": "Qlib and tsfresh", "verdict": "deferred until a prediction contract and an executable economic oracle exist", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"name": "skfolio 1.4.10 and EdgarTools 5.59.1", "verdict": "upgrade candidates, not qualified", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"name": "NautilusTrader 2.0.0rc5, LEAN and alpaca-py", "verdict": "the engine destination, the retained comparison engine and the Alpaca path, which rows backtesting-engine and execution-broker carry; none is a research, factor or ML component", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"name": "LEAN Alpaca brokerage", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "vectorbt", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Backtrader", "verdict": "overlap", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "Install the engine, LEAN and alpaca-py as in rows backtesting-engine and execution-broker; provide CPython 3.12 to 3.14 for the engine, since its recipe assumes /usr/bin/python3.12.", + "Install skfolio and EdgarTools from the research-evaluation and catalyst-provenance locks, then run evaluate.py once and record the receipt." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict (2026-10-01): comparison required, with a selection of record: EdgarTools 5.58.0 and skfolio 1.2.9. Alphalens Reloaded is a conditional candidate, Qlib and tsfresh are deferred, and skfolio 1.4.10 and EdgarTools 5.59.1 are upgrade candidates. The decision lands with PR #578 and closes nothing; the blocking item is the layer's re-record." + }, + { + "layer_id": "backtesting-engine", + "catalog": "us-equities", + "title": "Backtesting engine", + "winners": [ + { + "component_id": "nautilus-trader", + "role": "selected destination engine", + "repository": "https://github.com/nautechsystems/nautilus_trader", + "pin": "2.0.0rc5", + "pin_source": "catalogs/us-equities/runtime-target.json:26", + "install": {"command": "uv pip install --python \"$NAUTILUS_ENV/bin/python\" --index-url https://pypi.org/simple --pre nautilus_trader==2.0.0rc5 numpy==2.5.3 pandas==3.0.6", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine-nautilus/README.md"}, + "acceptance": {"command": "the one_zero SPY parity replay of NautilusTrader 2.0.0rc5 against the frozen LEAN oracle: verdict PASS, complete, 0 of 136 checks failed, the engine version check expecting and observing 2.0.0rc5", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/engine-nautilus/spy-parity/verdict-v2.json"}, + "upstream_currency": {"latest_release": "v2.0.0rc5 (pre-release, 2026-09-15) is the newest release; the latest stable is v1.231.0 (2026-08-02)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/nautechsystems/nautilus_trader/releases"} + }, + { + "component_id": "lean", + "role": "frozen comparison oracle, not the destination", + "repository": "https://github.com/QuantConnect/Lean", + "pin": "985ef30 with documented dependency remediation", + "pin_source": "manifests/stack.json:1368", + "install": {"command": "git clone https://github.com/QuantConnect/Lean.git \"$LEAN_SOURCE\" at the pinned commit, built with the verified .NET 10 SDK 10.0.401", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine/README.md"}, + "acceptance": {"command": "\"$DOTNET_ROOT/dotnet\" QuantConnect.Lean.Launcher.dll (from Launcher/bin/Debug, with Launcher/config.json unchanged)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/engine/README.md"}, + "upstream_currency": {"latest_release": "GitHub releases stop at v2.4.0.1 (2017-08-08); the default branch is 24 commits ahead of the pinned commit", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/QuantConnect/Lean/releases"} + }, + { + "component_id": "alpaca-py", + "role": "separate Alpaca path", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the trading-nautilus profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "the 2026-09-29 pre-market Alpaca paper series through the adaptive-paper engine (alpaca-py 0.44.0 LimitOrderRequest orders, engine b528bb55): 3 of 3 attempts passed, 9 entries and 9 exits filled, every fill matched to the broker, flat at the series end", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/adaptive-paper/trials/pre-20260929/receipt.json"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "partial", + "missing": "c2: no reconciled union exists across the 2026-09-22 layer entry, the four landscape manifests and the 2026-09-26 sweep, their labels conflict, and four omitted challengers and six manifest-only candidates are missing; c3: only one_zero of the six SPY cases passes, the other five wait on the undecided costs-and-rounding and margin-and-adaptive-state mappings, and no alternative has a same-input comparison or a new-host lifecycle receipt; c4: the 2026-09-26 findings stay open (the entry's stale BLOCKED parity text, a circular winner rationale without a challenger comparison, the omitted challengers, the LEAN payable-date caveat); c5: no closure record, and the 2026-09-22 residuals and triggers are stale. Item 1 is met with a caveat: the layer's direct evidence references still cite the v1 verdict, and its text contradicts the recorded pass." + }, + "reasons": [ + {"text": "NautilusTrader 2.0.0rc5 is the user-selected destination engine; LEAN stays the retained historical comparison engine; the Alpaca path is a separate boundary.", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "ml4t-backtest 0.1.12 passed the same-input SPY one_zero trial under the v1 contract on 2026-09-26; its consequence for the layer is not recorded.", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"text": "SPY/LEAN parity is established for the historical one_zero case only (136 checks, 0 failed); realistic liquidity and rc5 native broker adapter acceptance remain open.", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "The acceptance plan's status line for the frozen SPY comparison ('Planned, not executed', as of September 21, 2026) predates the rc5 one_zero replay that spy-parity/verdict-v2.json records and is stale; the superseding note is in the trading lane's pull request.", "source_path": "blueprints/us-equities/engine-nautilus/acceptance-plan.md"}, + {"text": "In the 2026-09-26 convergence record at PR #358's head, the NautilusTrader winner is cross_family_disputed: both GPT-6 votes refute its earns_it rationale as circular and accept only provisional retention, so comparative merit stays unproven.", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"text": "The research state marks the layer comparison_required.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "NautilusTrader 2.0.0rc5 also has a native-operation record: the unchanged EURUSD quickstart, run twice in isolation; this row labels the engine by the SPY parity verdict, which is the evidence for its role here.", "source_path": "evidence/receipts/native-nautilus-v2-20260920.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 4 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/backtesting-engine.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "ml4t-backtest 0.1.12", "verdict": "a same-input one_zero pass under the v1 contract; no recorded consequence", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"name": "Lumibot", "verdict": "conditional, with empty evidence references", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "LEAN Alpaca brokerage", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "vectorbt", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "Install bubblewrap first: the trading-nautilus profile requires python3, uv and bwrap, and no step installs bwrap.", + "Create a dedicated Python environment for NautilusTrader (supported CPython >=3.12,<3.15; the recipe assumes /usr/bin/python3.12) and install the pinned pre-release wheel with the recipe's numpy and pandas pins; the trading-nautilus profile has no Linux pins.", + "Install the .NET 10 SDK from Microsoft's release metadata with its hash check, clone LEAN at the pinned commit and build it.", + "Replay the retained SPY/LEAN parity case and compare with the frozen oracle; record the host receipt." + ], + "gates": [ + {"text": "The comparative merit of NautilusTrader stays disputed until the trading lane's comparison runs; retention is provisional.", "kind": "lane", "source_path": "catalogs/us-equities/convergence-20260926.json"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 4 (the other run graded c1 and c4 partial). Blocking item: c3. Five of six SPY parity cases have no mapping yet: costs_and_rounding_stress blocks one_stress, margin_and_adaptive_state blocks two_zero, adaptive_stress and over_limit, and both block two_stress (spy-parity/mapping-manifest-v2.json); one_zero passed on 2026-09-23. The layer entry's \"parity BLOCKED\" text is stale and gets a dated superseding note. Cross-family (PR #358 at b0eb7a11): GPT-6 accepts provisional retention and disputes comparative merit." + }, + { + "layer_id": "execution-broker", + "catalog": "us-equities", + "title": "Execution and broker adapters", + "winners": [ + { + "component_id": "nautilus-trader", + "role": "selected IBKR path; local broker acceptance not established", + "repository": "https://github.com/nautechsystems/nautilus_trader", + "pin": "2.0.0rc5", + "pin_source": "catalogs/us-equities/runtime-target.json:26", + "install": {"command": "uv pip install --python \"$NAUTILUS_ENV/bin/python\" --index-url https://pypi.org/simple --pre nautilus_trader==2.0.0rc5 numpy==2.5.3 pandas==3.0.6", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine-nautilus/README.md"}, + "acceptance": {"command": "IBKR acceptance plan section 5 step 1 (read-only, execution disabled) against a signed-in paper IB Gateway: the official ibapi client probe and the NautilusTrader 2.0.0rc5 native adapter probe both returned passed (2026-09-23); steps 2 to 4 are not run", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/ibkr-readonly-acceptance-20260923.json"}, + "upstream_currency": {"latest_release": "v2.0.0rc5 (pre-release, 2026-09-15) is the newest release; the latest stable is v1.231.0 (2026-08-02)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/nautechsystems/nautilus_trader/releases"} + }, + { + "component_id": "alpaca-py", + "role": "Alpaca broker boundary", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the trading-nautilus profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "bounded Alpaca paper roundtrips through the adaptive-paper engine in the 2026-09-29 pre-market series (engine b528bb55, alpaca-py 0.44.0): 3 of 3 attempts passed, every fill matched to the broker, flat at the series end", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/adaptive-paper/trials/pre-20260929/receipt.json"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + }, + { + "name": "adaptive-paper (the engine folder blueprints/us-equities/adaptive-paper on main at the #559 merge; the custom Alpaca adapter on NautilusTrader's LiveNode)", + "role": "Alpaca paper engine", + "repository": "https://github.com/seathatflowsinourveins/native-agent-stack", + "pin": "dca821cca85dce3647fa7b488d5a23fbe5b85d4a", + "pin_source": "blueprints/us-equities/adaptive-paper/README.md", + "install": {"command": "requirements.txt into an isolated Python 3.12 environment", "kind": "repo_recipe", "source_path": "blueprints/us-equities/adaptive-paper/README.md"}, + "acceptance": {"command": "the 2026-09-29 pre-market paper series of the engine's own runner at engine b528bb55 (scan, check, synthetic run, then paper, per attempt): 3 of 3 attempts passed, 46 fill events matched to the broker, 0 rejects, flat at the series end", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/adaptive-paper/trials/pre-20260929/receipt.json"}, + "upstream_currency": {"latest_release": "not applicable: an in-repo engine whose source hashes were last bound at the #559 merge (dca821cc)", "checked_at": "2026-10-01", "pin_is_latest": "unknown", "url": ""} + }, + { + "component_id": "lean", + "role": "frozen comparison oracle", + "repository": "https://github.com/QuantConnect/Lean", + "pin": "985ef30 with documented dependency remediation", + "pin_source": "manifests/stack.json:1368", + "install": {"command": "git clone https://github.com/QuantConnect/Lean.git \"$LEAN_SOURCE\" at the pinned commit, built with the verified .NET 10 SDK 10.0.401", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine/README.md"}, + "acceptance": {"command": "\"$DOTNET_ROOT/dotnet\" QuantConnect.Lean.Launcher.dll (from Launcher/bin/Debug, with Launcher/config.json unchanged)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/engine/README.md"}, + "upstream_currency": {"latest_release": "GitHub releases stop at v2.4.0.1 (2017-08-08); the default branch is 24 commits ahead of the pinned commit", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/QuantConnect/Lean/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: no layer verdict with winners and alternatives exists (the landscape record says pending_lanes), the selected IBKR boundary has no order and execution evidence, and the #4983 statement in the selection of record is unreconciled; c2: eight unverified and two omitted candidates lack dispositions, and the 2026-09-26 set is not merged into the layer entry; c3: no executed comparison on the same inputs, and IBKR acceptance-plan steps 2 to 4 have not run on any accepted version; c4: both existing reviews found material gaps; c5: no closure record." + }, + "reasons": [ + {"text": "On rc5 only the read-only step 1 of the IBKR acceptance plan passed (2026-09-23, execution disabled, against a signed-in paper IB Gateway); steps 2 to 4 have not run.", "source_path": "evidence/receipts/ibkr-readonly-acceptance-20260923.json"}, + {"text": "Each broker keeps its own boundary: IBKR through the Nautilus native IBKR adapter with a signed-in TWS or IB Gateway (local acceptance on rc5 not established), Alpaca through alpaca-py with a separately qualified deterministic paper lifecycle (one SPY roundtrip filled, flat, cash reconciled, recovery completed, no duplicate writes).", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "Paper results, counted only as fills and passed trials: the 2026-09-29 regular-session Alpaca series passed 5 of 6 trials (one failed on a ledger halt) with 23 entries and 23 exits filled; it is not a frozen gate run.", "source_path": "blueprints/us-equities/adaptive-paper/trials/rth-20260929/receipt.json"}, + {"text": "The 2026-09-29 pre-market series passed 3 of 3 trials (9 entries and 9 exits filled), and the extended-hours series passed 3 of 4 (one needs attention with a residual open; 9 entries and 7 exits filled).", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/receipt.json"}, + {"text": "The adaptive paper engine is NautilusTrader 2.0.0rc5's LiveNode with a custom Alpaca adapter and alpaca-py 0.44.0; its fee activities are booked in ledger cash since the #559 merge. The 2026-09-29 paper series ran at engine revision b528bb55; no series receipt exists yet at the merged revision.", "url": "https://github.com/seathatflowsinourveins/native-agent-stack/pull/559"}, + {"text": "The trading lane owner adds (2026-10-01): the committed paper receipts are at engine b528bb55; the first runs at the pin of record dca821cc happened on 2026-10-01 (the account-2 recovery went flat at 06:14 ET, and the pre-market series is running), and their receipts land in the owner's 10-01 receipts pull request.", "url": "https://github.com/seathatflowsinourveins/native-agent-stack/pull/574"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/execution-broker.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "NautilusTrader 1.231.0 Python IBKR adapter", "verdict": "bounded paper orders passed on 2026-09-23, but no record accepts 1.231.0 for this gate and reconnect, restart reconciliation and the kill switch were not run", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"name": "LEAN Alpaca brokerage", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Lumibot", "verdict": "conditional in the layer; not adopted in the 2026-09-26 set", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "Install the engine (row backtesting-engine), alpaca-py and the adaptive-paper requirements in their own environments; keep each broker's credentials in its 0600 provider file.", + "No IB Gateway or TWS install step or version pin exists; the recipes require an already signed-in paper Gateway.", + "Alpaca: run the order-contract tests, then one bounded paper roundtrip under the paper-lane policy, and count only fills and passed trials.", + "IBKR: start TWS or IB Gateway with a native paper sign-in (paper socket 7497 or 4002) only after the upstream gates below clear." + ], + "gates": [ + {"text": "nautilus_trader #4983 (open upstream, read 2026-10-01) is a stale v1.227.0 report for rc5. At tag v2.0.0rc5 (1b0a49d2) the execution engine denies an order only when `handles_order_venue` is false, and the IB execution client returns true. That is source reading, not an rc5 order observation; PR #280 moves the report to `rc5_reclassified_reports`. The open rc5 obstacles are on the recovery and risk paths that acceptance steps 3-4 exercise: #5007, #5057 and #5060 (open, read 2026-10-01); #4946 is closed. The rc5 IBKR stock-order path stays unqualified until native paper execution.", "kind": "upstream", "url": "https://github.com/nautechsystems/nautilus_trader/issues/4983"}, + {"text": "nautilus_trader PR #5041 (open, read 2026-10-01) ports the Interactive Brokers adapter onto ibapi 4.2.0.", "kind": "upstream", "url": "https://github.com/nautechsystems/nautilus_trader/pull/5041"}, + {"text": "The IB Gateway or TWS paper sign-in is the user's own native action, as are the paper account and market-data permissions.", "kind": "user_side", "source_path": "docs/secret-storage.md"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5. Blocking item: c3, IBKR acceptance-plan steps 2-4 on rc5 after the user's IB Gateway paper sign-in. Alpaca: paper execution at engine b528bb55 (2026-09-29: 11 of 13 trials passed; receipts via #564). dca821cc has no paper execution yet, and its native-fault binding is stale until its re-run." + }, + { + "layer_id": "portfolio-risk", + "catalog": "us-equities", + "title": "Portfolio and risk", + "winners": [ + { + "component_id": "nautilus-trader", + "role": "engine of record for risk limits", + "repository": "https://github.com/nautechsystems/nautilus_trader", + "pin": "2.0.0rc5", + "pin_source": "catalogs/us-equities/runtime-target.json:26", + "install": {"command": "uv pip install --python \"$NAUTILUS_ENV/bin/python\" --index-url https://pypi.org/simple --pre nautilus_trader==2.0.0rc5 numpy==2.5.3 pandas==3.0.6", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine-nautilus/README.md"}, + "acceptance": {"command": "a NautilusTrader 2.0.0rc5 backtest that fed the skfolio fold weights through RiskEngine limits (45,000 USD notional per order, 4 orders per second): the oversized and burst orders were denied with their reasons, the control arm filled them, and positions and cash reconciled in both arms (2026-09-23)", "evidence_class": "local_integration_check", "source_path": "evidence/artifacts/gap-wave2-20260923/us-equities__portfolio-risk/6-nautilus-riskengine-denial.json"}, + "upstream_currency": {"latest_release": "v2.0.0rc5 (pre-release, 2026-09-15) is the newest release; the latest stable is v1.231.0 (2026-08-02)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/nautechsystems/nautilus_trader/releases"} + }, + { + "component_id": "lean", + "role": "comparison oracle", + "repository": "https://github.com/QuantConnect/Lean", + "pin": "985ef30 with documented dependency remediation", + "pin_source": "manifests/stack.json:1368", + "install": {"command": "git clone https://github.com/QuantConnect/Lean.git \"$LEAN_SOURCE\" at the pinned commit, built with the verified .NET 10 SDK 10.0.401", "kind": "repo_recipe", "source_path": "blueprints/us-equities/engine/README.md"}, + "acceptance": {"command": "\"$DOTNET_ROOT/dotnet\" QuantConnect.Lean.Launcher.dll (from Launcher/bin/Debug, with Launcher/config.json unchanged)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/engine/README.md"}, + "upstream_currency": {"latest_release": "GitHub releases stop at v2.4.0.1 (2017-08-08); the default branch is 24 commits ahead of the pinned commit", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/QuantConnect/Lean/releases"} + }, + { + "component_id": "alpaca-py", + "role": "Alpaca boundary", + "repository": "https://github.com/alpacahq/alpaca-py", + "pin": "0.44.0", + "pin_source": "catalogs/us-equities/runtime-target.json:99", + "install": {"command": "uv pip install --python \"$GATE_TOOL_DIR/.venv/bin/python3\" with the recipe's pinned requirements (the trading-nautilus profile has no Linux pins)", "kind": "repo_recipe", "source_path": "blueprints/us-equities/order-contract/README.md"}, + "acceptance": {"command": "the 2026-09-29 pre-market Alpaca paper series through the adaptive-paper engine (alpaca-py 0.44.0 LimitOrderRequest orders, engine b528bb55): 3 of 3 attempts passed, 9 entries and 9 exits filled, every fill matched to the broker, flat at the series end", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/adaptive-paper/trials/pre-20260929/receipt.json"}, + "upstream_currency": {"latest_release": "v0.44.0 (2026-08-11)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/alpacahq/alpaca-py/releases"} + }, + { + "component_id": "skfolio", + "role": "walk-forward splitter only; winner in one place of the layer entry and conditional in another", + "repository": "https://github.com/skfolio/skfolio", + "pin": "1.2.9", + "pin_source": "manifests/stack.json:1493", + "install": {"command": "uv venv --python \"$PYTHON\" \"$WAVE_DIR/venv\"; uv pip sync --python \"$WAVE_DIR/venv/bin/python\" --require-hashes blueprints/us-equities/research-evaluation/requirements.lock", "kind": "repo_recipe", "source_path": "blueprints/us-equities/research-evaluation/README.md"}, + "acceptance": {"command": "\"$WAVE_DIR/venv/bin/python\" blueprints/us-equities/research-evaluation/evaluate.py --lean-source \"$LEAN_SOURCE\" --out \"$WAVE_DIR/run-1\"", "evidence_class": "local_integration_check", "source_path": "blueprints/us-equities/research-evaluation/receipt.json"}, + "upstream_currency": {"latest_release": "v1.4.10 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/skfolio/skfolio/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c1: the selection is inconsistent (skfolio is the verdict winner yet conditional in the same entry, absent from the current choice and from runtime-target.json, and its optimizers are unaccepted in the stack); c2: the layer entry was not re-recorded from the 2026-09-26 convergence record, and 11 of its 16 candidates and both omitted candidates have no disposition; c3: no fresh single-execution preregistered matched comparison, no Alpaca paper RiskEngine checks with fill reconciliation, no leverage-ladder receipts, no IBKR rc5 acceptance and no new-host lifecycle run; c4: no independent review after the GPT-6 corrections and the gap-wave2 results are absorbed; c5: no closure record, and the 2026-09-22 residuals and triggers are stale." + }, + "reasons": [ + {"text": "The engine destination, LEAN as the comparison oracle and the Alpaca boundary come from runtime-target.json; the 2026-09-22 verdict keeps skfolio for its walk-forward splitter only.", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "Risk and order state stay in deterministic code; the adaptive practice caps total requests at 200 per minute and submissions at 180 per minute.", "source_path": "catalogs/us-equities/runtime-target.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/portfolio-risk.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "cvxportfolio", "verdict": "unqualified in the verdict", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "empyrical-reloaded", "verdict": "unqualified in the verdict", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "quantstats", "verdict": "unqualified in the verdict", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "PyPortfolioOpt", "verdict": "a conditional card", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "The engine, LEAN and alpaca-py install as in rows backtesting-engine and execution-broker; skfolio installs with the research-evaluation lock.", + "Run the verdict's recorded overturn checks on the target host, starting with the research-evaluation tests, then collect leverage-ladder paper receipts that count only fills and passed trials." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open and inconsistent, distance 5 (the other run graded c5 unmet). Blocking item: c1, settle skfolio as winner or conditional (catalogs/landscape/us-equities.json:2840 against :2773). Then c3: a fresh, single-execution, preregistered matched comparison, and a separately frozen skfolio upgrade experiment (1.2.9 to 1.4.10)." + }, + { + "layer_id": "evaluation-experiments", + "catalog": "us-equities", + "title": "Evaluation and experiments", + "winners": [ + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "component_id": "claude-code", + "repository": "https://github.com/anthropics/claude-code", + "pin": "2.1.284", + "pin_source": "manifests/stack.json:192", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "claude -p --output-format stream-json --verbose --max-turns 14 < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.1.286 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/claude-code/releases"} + }, + { + "component_id": "dagu", + "repository": "https://github.com/dagucloud/dagu", + "pin": "2.16.6", + "pin_source": "manifests/stack.json:1335", + "install": {"command": "gh release download v2.16.6 --repo dagucloud/dagu (the linux_amd64 archive and checksums.txt); check the checksum, extract and place the binary", "kind": "repo_recipe", "source_path": "blueprints/us-equities/hosting/README.md"}, + "acceptance": {"command": "dagu start --context local --dagu-home \"$RESEARCH_HOME\" --run-id evidence-20260919-ready \"$WORKFLOW\": the three-step equity-research-evidence workflow through the upstream CLI (DuckDB summarized six LEAN simulated events into three orders, then both evidence validators passed; exit 0), and the native history kept its succeeded, failed and cancelled runs after a service restart (Dagu 2.16.6, 2026-09-19)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/hosting/receipt.json"}, + "upstream_currency": {"latest_release": "v2.18.1 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dagucloud/dagu/releases"} + }, + { + "component_id": "systemd", + "repository": "https://github.com/systemd/systemd", + "pin": "255.4-1ubuntu8.17", + "pin_source": "manifests/stack.json:1448", + "install": {"command": "", "kind": "none_recorded", "source_path": "blueprints/us-equities/worker-supervision/README.md"}, + "acceptance": {"command": "systemd 255 user units on the historical host: the timer started paper-ext-20260929.service at 16:00:05 ET on 2026-09-29, and journalctl --user -o json USER_UNIT=.service and systemctl --user show recorded its exit (status 3, Result=exit-code) and the run of its OnFailure alert unit", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/README.md"}, + "upstream_currency": {"latest_release": "255.4-1ubuntu8.17 is the published Ubuntu 24.04 (noble) updates and security version", "checked_at": "2026-10-01T07:43Z", "pin_is_latest": "yes", "url": "https://launchpad.net/ubuntu/noble/+source/systemd"} + }, + { + "component_id": "opentelemetry-collector-contrib", + "repository": "https://github.com/open-telemetry/opentelemetry-collector-contrib", + "pin": "0.161.0", + "pin_source": "manifests/stack.json:1087", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "otelcol-contrib validate --config=\"$OTEL_CONFIG\"", "evidence_class": "structural_validation", "source_path": "observability/README.md"}, + "upstream_currency": {"latest_release": "v0.162.0 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/releases"} + }, + { + "component_id": "prometheus", + "repository": "https://github.com/prometheus/prometheus", + "pin": "3.15.0", + "pin_source": "manifests/stack.json:1118", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "promtool check config and check rules (14 rules) on the live files, systemd-analyze --user verify of the rendered unit, then daemon-reload and restart of ecosystem-prometheus.service: /-/ready answered 0.86 s after the restart, buildinfo read 3.15.0, the seven targets were up and the 14 rules evaluated with health ok (2026-09-26)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/prometheus-3150-qualification-20260926.json"}, + "upstream_currency": {"latest_release": "v3.15.0 (2026-09-25)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/prometheus/prometheus/releases"} + }, + { + "component_id": "loki", + "repository": "https://github.com/grafana/loki", + "pin": "3.7.8", + "pin_source": "manifests/stack.json:1156", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "loki -config.file=\"$LOKI_CONFIG\" -verify-config=true (exit 0: the final native Loki OTLP structured-metadata configuration accepted)", "evidence_class": "structural_validation", "source_path": "observability/receipt.json"}, + "upstream_currency": {"latest_release": "v3.7.8 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/grafana/loki/releases"} + }, + { + "component_id": "grafana", + "repository": "https://github.com/grafana/grafana", + "pin": "13.2.2", + "pin_source": "manifests/stack.json:1193", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "systemd-analyze --user verify of the rendered ecosystem units, then systemctl --user enable --now ecosystem-{prometheus,loki,grafana,alertmanager,ntfy}.service", "evidence_class": "upstream_example_or_native_operation", "source_path": "observability/backends/README.md"}, + "upstream_currency": {"latest_release": "v13.2.3 (2026-09-29)", "checked_at": "2026-10-01T08:17Z", "pin_is_latest": "no", "url": "https://github.com/grafana/grafana/releases"} + }, + { + "component_id": "restic", + "repository": "https://github.com/restic/restic", + "pin": "0.19.1", + "pin_source": "manifests/stack.json:1307", + "install": {"command": "the official restic_0.19.1_linux_amd64.bz2 release asset, its detached signature verified against the upstream primary fingerprint", "kind": "upstream_documented", "source_path": "blueprints/us-equities/hosting/backup/README.md"}, + "acceptance": {"command": "restic check and restore of two synthetic snapshots on a GitHub-hosted runner, after seven unchanged upstream restic tests passed there", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/native-offhost-restic-20260920.json"}, + "upstream_currency": {"latest_release": "v0.19.1 (2026-07-05)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/restic/restic/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the current choice and the 2026-09-22 verdict winners (agent-retrieval-bench, Inspect AI and MLflow, none with a stack row) are not reconciled; c2: no single frozen candidate set (the limit-refused GPT-6 discovery needs a rerun, and FinMTEB, DeepEval and Ragas need dispositions); c3: no financial-document retrieval comparison, no mteb arm on the frozen fixture and no host acceptance; c4: no review after the 2026-09-26 corrections are applied; c5: no closure record." + }, + "reasons": [ + {"text": "The layer's current choice reuses the foundation's native clients, Dagu and systemd, the OpenTelemetry Collector with Prometheus, Loki and Grafana, and Restic.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The 2026-09-22 verdict winners agent-retrieval-bench 0.2.1, Inspect AI 0.3.266 and MLflow 3.16.1 are recorded but not adopted: none has a stack row.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The foundation's quality row runs containerized E2E evaluation on Harbor with Inspect AI as its fallback, never a self-written runner.", "source_path": "docs/decisions/2026-09-30-rule-text-every-layer.md"}, + {"text": "systemd's acceptance is the historical host's user journal and manager record of the 2026-09-29 extended-hours paper series; the new-distro recipe's systemd checks (documented, not run) stay in the new-host steps of row scheduling-supervision.", "source_path": "blueprints/us-equities/adaptive-paper/trials/ext-20260929/README.md"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 5 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/evaluation-experiments.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "agent-retrieval-bench, Inspect AI and MLflow", "verdict": "the 2026-09-22 verdict winners, recorded but not adopted", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "promptfoo", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Arize Phoenix", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with the foundation rows native-clients, scheduling-supervision, observation-inference and recovery-portability.", + "Build the financial-document retrieval comparison and the mteb arm on the frozen fixture before any evaluation claim." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5 (queue: on_requirement_change). Blocking item: c1, reconciling the current choice (foundation workers and observability) with the verdict winners inspect-ai, mlflow and agent-retrieval-bench." + }, + { + "layer_id": "agents-models-workers", + "catalog": "us-equities", + "title": "Agents, models and workers", + "winners": [ + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "component_id": "ai-memory", + "repository": "https://github.com/akitaonrails/ai-memory", + "pin": "2.4.1", + "pin_source": "manifests/stack.json:96", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "ai-memory init; ai-memory serve --transport http --enable-web --bind 127.0.0.1: --workspace local --project native-agent-stack", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.5.2 (2026-10-01)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/akitaonrails/ai-memory/releases"} + }, + { + "component_id": "socraticode", + "repository": "https://github.com/giancarloerra/SocratiCode", + "pin": "1.15.0", + "pin_source": "manifests/stack.json:962", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "mcporter --config \"$MCPORTER_CONFIG\" call socraticode.codebase_health --args '{}' --output text --no-oauth", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.16.0 (2026-09-28)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/giancarloerra/SocratiCode/releases"} + }, + { + "component_id": "qmd", + "repository": "https://github.com/tobi/qmd", + "pin": "2.8.3", + "pin_source": "manifests/stack.json:758", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "qmd --index \"$QMD_INDEX\" search 'local code' -c \"$QMD_COLLECTION\" -n 2 --json", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.8.3 (2026-08-16)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/tobi/qmd/releases"} + }, + { + "component_id": "serena", + "repository": "https://github.com/oraios/serena", + "pin": "2.0.0.dev0 @ c6fbd1c5932df2494ffa0020af5a9fbe80b82143", + "pin_source": "manifests/stack.json:880", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "uvx --from git+https://github.com/oraios/serena@c6fbd1c5932df2494ffa0020af5a9fbe80b82143 serena start-mcp-server --context codex --project-from-cwd (then find_symbol and find_referencing_symbols through the client)", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.7.0 (2026-08-09); the pin is a 2.0.0.dev0 development commit 123 commits ahead of that release, so release currency does not apply", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "unknown", "url": "https://github.com/oraios/serena/releases"} + }, + { + "component_id": "qdrant", + "repository": "https://github.com/qdrant/qdrant", + "pin": "1.19.1", + "pin_source": "manifests/stack.json:727", + "install": {"command": "official v1.19.1 archive qdrant-x86_64-unknown-linux-musl.tar.gz, verified against SHA-256 70a40529e2ebe0a2787d574d3a2e28437cfe94f26f24fa419f6ac57b4ae817c9", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "GET / on the running Qdrant server: it answered with version 1.19.1 at commit 6ab21ca, the catalog pin (host receipt, stage use, result pass)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/hosts/nativestack-5975wx-20260925/nativestack-5975wx-20260925--qdrant--use--20260925.json"}, + "upstream_currency": {"latest_release": "v1.19.1 (2026-09-04)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/qdrant/qdrant/releases"} + }, + { + "component_id": "context-mode", + "repository": "https://github.com/mksglu/context-mode", + "pin": "1.0.169", + "pin_source": "manifests/stack.json:403", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency (the npm CLI), then the Claude plugin from its SHA-pinned source 6f0cc6841c687e754059f36714a11233fda1a02b", "kind": "repo_recipe", "source_path": "recipes/README.md"}, + "acceptance": {"command": "compare the installed plugin's gitCommitSha with 6f0cc6841c687e754059f36714a11233fda1a02b, then read ctx_stats in a fresh session", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v1.0.169 (2026-06-29)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/mksglu/context-mode/releases"} + }, + { + "component_id": "rtk", + "repository": "https://github.com/rtk-ai/rtk", + "pin": "0.50.0", + "pin_source": "manifests/stack.json:822", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "rtk git log -6; rtk proxy git log -6", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v0.50.0 (2026-09-24)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "yes", "url": "https://github.com/rtk-ai/rtk/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the current choice, the winners, the alternatives, the 2026-09-29 sweep and the roadmap target do not agree on one selection, QMD BM25 against hybrid is undecided, and the recorded pins lag the installed ones; c2: eight names lack dispositions and the vote builder is not retained; c3: no preregistered held-out finance, document and code retrieval comparison at a matched context budget with abstention, across the retrieval challengers including QMD hybrid; c4: no review after the repairs; c5: no closure record." + }, + "reasons": [ + {"text": "The 2026-09-22 verdict keeps native Codex with its SDK, ai-memory and SocratiCode for research workers, and the current choice adds QMD BM25, Serena, Qdrant, Context Mode and RTK; the verdict's pins (CLI 0.155.1, ai-memory 2.3.1, SocratiCode 1.14.0) are older than the stack pins carried here.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The research state asks for held-out finance, document and code relevance judgments comparing fidelity, abstention and total task cost.", "source_path": "catalogs/landscape/research-state.json"}, + {"text": "In the 2026-09-26 convergence record at PR #358's head, the votes allow only provisional retention of ai-memory and SocratiCode: operational receipts do not establish comparative superiority.", "source_path": "catalogs/us-equities/convergence-20260926.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 4 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/agents-models-workers.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "Mem0", "verdict": "overlap", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Hindsight", "verdict": "conditional, source review", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Graphiti", "verdict": "conditional, and also listed as unqualified", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "LangGraph", "verdict": "unqualified", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with the foundation rows native-clients, durable-memory, code-navigation, document-retrieval, semantic-rag and token-efficiency; nothing extra for this layer.", + "Decide QMD BM25 against hybrid on the recorded retrieval-quality evidence, then build the held-out relevance judgments before any comparison run.", + "Check Qdrant's health endpoint on the new host file's port: `curl --fail --silent --show-error http://127.0.0.1:/healthz`." + ], + "gates": [ + {"text": "GPT-6 disputes the earns_it label of ai-memory and SocratiCode (PR #358); retention is provisional until the held-out comparison runs.", "kind": "lane", "source_path": "catalogs/us-equities/convergence-20260926.json"} + ], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5. This row follows the foundation memory and retrieval rows, whose closure governs. Blocking item: c3, a preregistered held-out financial, document and code retrieval comparison with abstention. The layer entry's pins (ai-memory 2.3.1, SocratiCode 1.14.0, CLI 0.155.1) lag the stack pins shown." + }, + { + "layer_id": "observability-hosting", + "catalog": "us-equities", + "title": "Observability and hosting", + "winners": [ + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "codex exec -C \"$PROJECT_ROOT\" --json - < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "component_id": "claude-code", + "repository": "https://github.com/anthropics/claude-code", + "pin": "2.1.284", + "pin_source": "manifests/stack.json:192", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "claude -p --output-format stream-json --verbose --max-turns 14 < fixtures/native-gap-prompt.txt", "evidence_class": "upstream_example_or_native_operation", "source_path": "recipes/README.md"}, + "upstream_currency": {"latest_release": "v2.1.286 (2026-09-30)", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/anthropics/claude-code/releases"} + }, + { + "component_id": "dagu", + "repository": "https://github.com/dagucloud/dagu", + "pin": "2.16.6", + "pin_source": "manifests/stack.json:1335", + "install": {"command": "gh release download v2.16.6 --repo dagucloud/dagu (the linux_amd64 archive and checksums.txt); check the checksum, extract and place the binary", "kind": "repo_recipe", "source_path": "blueprints/us-equities/hosting/README.md"}, + "acceptance": {"command": "dagu start --context local --dagu-home \"$RESEARCH_HOME\" --run-id evidence-20260919-ready \"$WORKFLOW\": the three-step equity-research-evidence workflow through the upstream CLI (DuckDB summarized six LEAN simulated events into three orders, then both evidence validators passed; exit 0), and the native history kept its succeeded, failed and cancelled runs after a service restart (Dagu 2.16.6, 2026-09-19)", "evidence_class": "upstream_example_or_native_operation", "source_path": "blueprints/us-equities/hosting/receipt.json"}, + "upstream_currency": {"latest_release": "v2.18.1 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/dagucloud/dagu/releases"} + }, + { + "component_id": "opentelemetry-collector-contrib", + "repository": "https://github.com/open-telemetry/opentelemetry-collector-contrib", + "pin": "0.161.0", + "pin_source": "manifests/stack.json:1087", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "otelcol-contrib validate --config=\"$OTEL_CONFIG\"", "evidence_class": "structural_validation", "source_path": "observability/README.md"}, + "upstream_currency": {"latest_release": "v0.162.0 (2026-09-29)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/releases"} + }, + { + "component_id": "prometheus", + "repository": "https://github.com/prometheus/prometheus", + "pin": "3.15.0", + "pin_source": "manifests/stack.json:1118", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "promtool check config and check rules (14 rules) on the live files, systemd-analyze --user verify of the rendered unit, then daemon-reload and restart of ecosystem-prometheus.service: /-/ready answered 0.86 s after the restart, buildinfo read 3.15.0, the seven targets were up and the 14 rules evaluated with health ok (2026-09-26)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/prometheus-3150-qualification-20260926.json"}, + "upstream_currency": {"latest_release": "v3.15.0 (2026-09-25)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/prometheus/prometheus/releases"} + }, + { + "component_id": "loki", + "repository": "https://github.com/grafana/loki", + "pin": "3.7.8", + "pin_source": "manifests/stack.json:1156", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "loki -config.file=\"$LOKI_CONFIG\" -verify-config=true (exit 0: the final native Loki OTLP structured-metadata configuration accepted)", "evidence_class": "structural_validation", "source_path": "observability/receipt.json"}, + "upstream_currency": {"latest_release": "v3.7.8 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/grafana/loki/releases"} + }, + { + "component_id": "grafana", + "repository": "https://github.com/grafana/grafana", + "pin": "13.2.2", + "pin_source": "manifests/stack.json:1193", + "install": {"command": "python3 observability/backends/install.py --tools-root \"$STACK_TOOLS_ROOT\" --evidence-dir \"$STACK_EVIDENCE_ROOT\"", "kind": "repo_recipe", "source_path": "observability/backends/README.md"}, + "acceptance": {"command": "systemd-analyze --user verify of the rendered ecosystem units, then systemctl --user enable --now ecosystem-{prometheus,loki,grafana,alertmanager,ntfy}.service", "evidence_class": "upstream_example_or_native_operation", "source_path": "observability/backends/README.md"}, + "upstream_currency": {"latest_release": "v13.2.3 (2026-09-29)", "checked_at": "2026-10-01T08:17Z", "pin_is_latest": "no", "url": "https://github.com/grafana/grafana/releases"} + }, + { + "component_id": "restic", + "repository": "https://github.com/restic/restic", + "pin": "0.19.1", + "pin_source": "manifests/stack.json:1307", + "install": {"command": "the official restic_0.19.1_linux_amd64.bz2 release asset, its detached signature verified against the upstream primary fingerprint", "kind": "upstream_documented", "source_path": "blueprints/us-equities/hosting/backup/README.md"}, + "acceptance": {"command": "restic check and restore of two synthetic snapshots on a GitHub-hosted runner, after seven unchanged upstream restic tests passed there", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/native-offhost-restic-20260920.json"}, + "upstream_currency": {"latest_release": "v0.19.1 (2026-07-05)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/restic/restic/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: no recorded layer verdict with winners and alternatives exists (the landscape record says pending_lanes); c2: no frozen candidate set reconciles the layer rows, the convergence record, the ledger, the decision index and the 2026-09-29 manifest (the Tempo conflict and the Jaeger and OpenObserve dispositions are open); c3: no preregistered target-host runs of the metric clauses at current pins, including broker-authority removal, and no Restic restore of live telemetry, state and the broker journal into an independent trust domain; c4: the recorded reviews name open material gaps; c5: no closure record." + }, + "reasons": [ + {"text": "The current choice reuses the foundation's native clients, Dagu with systemd, the OpenTelemetry Collector with Prometheus, Loki and Grafana, and Restic; the landscape record leaves the layer verdict pending its lanes.", "source_path": "catalogs/landscape/us-equities.json"}, + {"text": "The landscape winner pin for Prometheus is still 3.14.0 while the stack and the installer pin 3.15.0.", "source_path": "manifests/stack.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 4 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/observability-hosting.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "structural_validation", + "alternatives": [ + {"name": "Temporal", "verdict": "conditional, source review only", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Prefect", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "Dagster", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with the foundation rows native-clients, scheduling-supervision, observation-inference and recovery-portability; nothing extra for this layer.", + "After the paper lane runs on the new host, restore its telemetry, state and broker journal with Restic into an independent trust domain and record the check." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict: selection of record, open, distance 5 under the shared rule (queue: on_requirement_change). This row follows the foundation observability rows. Blocking item: c2, one frozen set (the Tempo conflict; Jaeger and OpenObserve dispositions), then c3 on the target host. Five pins are behind upstream; Grafana 13.2.3 is a security release, which is a foundation pin decision." + }, + { + "layer_id": "security-supply-chain", + "catalog": "us-equities", + "title": "Security and supply chain", + "winners": [ + { + "component_id": "syft", + "repository": "https://github.com/anchore/syft", + "pin": "1.52.0", + "pin_source": "manifests/stack.json:1396", + "install": {"command": "gh release download v1.52.0 --repo anchore/syft (the linux_amd64 archive and its checksums); verify, then tar --no-same-owner -xzf into a versioned prefix", "kind": "repo_recipe", "source_path": "blueprints/us-equities/supply-chain/README.md"}, + "acceptance": {"command": "syft scan of the NautilusTrader 2.0.0rc5 virtual environment with the binary catalogers selected by exact name (venv-syft exit 0; 21 packages), then grype over that SBOM (exit 0)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/artifacts/gap-wave2-20260923/us-equities__security-supply-chain/3-syft-binary-os-coverage.json"}, + "upstream_currency": {"latest_release": "v1.52.0 (2026-09-17)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/anchore/syft/releases"} + }, + { + "component_id": "gitleaks", + "repository": "https://github.com/gitleaks/gitleaks", + "pin": "8.30.1", + "pin_source": "manifests/stack.json:491", + "install": {"command": "curl -fsSLO \"$base/gitleaks_8.30.1_linux_x64.tar.gz\"; curl -fsSLO \"$base/gitleaks_8.30.1_checksums.txt\"; sha256sum --check --ignore-missing gitleaks_8.30.1_checksums.txt; tar -xzf gitleaks_8.30.1_linux_x64.tar.gz -C \"$ECO_INSTALL_ROOT/tools/gitleaks-8.30.1\" gitleaks", "kind": "repo_recipe", "source_path": "docs/secret-storage.md"}, + "acceptance": {"command": "gitleaks on a temporary control repository of 6 synthetic secret-shaped files: 6 findings and exit 1 under the default rules and again under the repository's configuration", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/artifacts/gap-wave2-20260923/us-equities__security-supply-chain/5-gitleaks-current-history.json"}, + "upstream_currency": {"latest_release": "v8.30.1 (2026-03-21)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "yes", "url": "https://github.com/gitleaks/gitleaks/releases"} + }, + { + "name": "Grype (vulnerability scanner)", + "repository": "https://github.com/anchore/grype", + "pin": "0.119.0 (archive sha256 3fa2dc4b924621ab65404cf08d0b8438d896d80ab949c9d5a4ca283c36004c9b)", + "pin_source": "catalogs/foundation/automation.json:173-176", + "install": {"command": "download the pinned v0.119.0 release archive from the official GitHub release, verify it against the publisher's checksum list and the release-asset digest, and extract it into a versioned directory in the tools layout Syft uses", "kind": "repo_recipe", "source_path": "blueprints/us-equities/supply-chain/README.md"}, + "acceptance": {"command": "grype over the SDK's Syft SBOM as JSON and as CycloneDX, plus two positive controls (the SBOM with requests changed to 2.19.0, and two vulnerable purls), with an isolated database cache and no auto-update: every run exit 0, 0 matches on the SDK and 5 on the mutated SBOM", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/artifacts/gap-wave2-20260923/us-equities__security-supply-chain/0-grype-sdk-sbom.json"}, + "upstream_currency": {"latest_release": "not checked for this edition; the Codex lane's review of 2026-10-01 reads v0.119.0 as matching the record", "checked_at": "2026-10-01", "pin_is_latest": "unknown", "url": ""} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: The selection of record is the owner's decision of 2026-10-01 (PR #578); the layer entry in catalogs/landscape/us-equities.json is not yet re-recorded with it, and the layer's own re-run trigger (cosign verify-blob and OpenBao secret-lifecycle receipts) is unresolved.; c2: no newcomer search ran for the 2026-09-22 set, and Trivy and four of the five GPT-6 omissions have no disposition in the layer entry; c3: Grype has no target-host receipt, the challenger arms that fired the trigger were not followed by a re-judged comparison, and no gitleaks comparison against Betterleaks exists for this layer; c4: the latest review returned needs_changes and its corrections are not applied; c5: no closure record." + }, + "reasons": [ + {"text": "The trading lane owner's decision of 2026-10-01 selects Syft 1.52.0, Gitleaks 8.30.1 and Grype 0.119.0, inheriting the foundation gates; it closes nothing, and items 2 to 5 stay open.", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"text": "Grype has no component entry in manifests/stack.json; its pin of record is the anchore/grype entry of the foundation automation catalog (version 0.119.0 with the archive sha256), and the sbom-vuln job of supply-chain.yml runs it.", "source_path": "catalogs/foundation/automation.json"}, + {"text": "The receipts cited for Syft and Gitleaks record the runs and their exit codes but not the tool versions.", "source_path": "evidence/artifacts/gap-wave2-20260923/us-equities__security-supply-chain/3-syft-binary-os-coverage.json"}, + {"text": "A cross-family adjudication (gpt-6-astra at effort max, in the Codex lane's selection-gap follow-up) recommended this composition, with OSV and provenance scoped separately and Betterleaks as a challenger whose compatibility oracle is open.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/selection-gap-convergence-followup.json", "pull_request": 575, "commit": "51cb79ba"}}, + {"text": "Syft and gitleaks are the same pins as the foundation rows ci-supply-chain and secrets-credentials.", "source_path": "manifests/stack.json"}, + {"text": "Second independent review (closure item 4): the Codex lane reviewed this layer on 2026-10-01 (gpt-6.1-sol at effort max; verdict corrected, 3 corrections to the layer records). It names 4 remaining gaps, so no review yet finds the bounded set free of material gaps, and the review also records each repository's upstream-documented install command, none of them run.", "pending_source": {"path": "evidence/artifacts/new-wsl-layer-reviews-20261001/security-supply-chain.json", "pull_request": 575, "commit": "51cb79ba"}} + ], + "evidence_class": "upstream_example_or_native_operation", + "alternatives": [ + {"name": "Betterleaks 1.9.0", "verdict": "the challenger for Gitleaks; its compatibility oracle is open", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"name": "OSV-Scanner and provenance attestation", "verdict": "scoped separately, with the foundation row ci-supply-chain", "pending_source": {"path": "docs/decisions/2026-10-01-trading-layer-verdicts.md", "pull_request": 578, "commit": "e1f15c97"}}, + {"name": "cosign", "verdict": "conditional", "source_path": "catalogs/landscape/us-equities.json"}, + {"name": "OpenBao", "verdict": "unqualified", "source_path": "catalogs/landscape/us-equities.json"} + ], + "new_host_steps": [ + "These install with the foundation rows ci-supply-chain and secrets-credentials; scan the trading worker SDK environment with Syft once it exists." + ], + "gates": [], + "owner_lane": "trading", + "notes": "Owner's verdict (2026-10-01): selection of record, open: Syft 1.52.0, Gitleaks 8.30.1 and Grype 0.119.0, inheriting the foundation gates. Betterleaks 1.9.0 is the challenger for Gitleaks, whose upstream ships security patches only; OSV and provenance are scoped separately. The layer's own re-run trigger (cosign verify-blob and OpenBao secret-lifecycle receipts) is unresolved. The decision lands with PR #578 and closes nothing." + }, + { + "layer_id": "cross:wsl-distro", + "catalog": "cross", + "title": "The new WSL distribution: image, first boot and install order", + "winners": [ + { + "name": "Ubuntu 24.04.5 LTS WSL image (Canonical)", + "repository": "https://releases.ubuntu.com/24.04.5/", + "pin": "sha256 bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e", + "pin_source": "adoption/platforms/linux-wsl2-new-distro.md:99", + "install": {"command": "Stage 1 of the recipe on the Windows host (W1 to W5): verify the image hash against both publications, render the cloud-init user data, `wsl.exe --install --from-file` with `--no-launch`, then the first launch with standard input at end of file", "kind": "repo_recipe", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"}, + "acceptance": {"command": "W5 and F1 to F3 of the recipe: the first launch exits 0 as the cloud-init user, `systemctl is-system-running --wait` prints running, linger is enabled and the user bus is a socket owned by the user", "evidence_class": "none_recorded", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"}, + "upstream_currency": {"latest_release": "Ubuntu 26.04.1 LTS is the newer LTS; it is queued as a bounded comparison before any switch", "checked_at": "2026-10-01", "pin_is_latest": "no", "url": "https://releases.ubuntu.com/"} + } + ], + "verdict": "new_host_required", + "closure": { + "c1": "partial", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the selection (Canonical's Ubuntu 24.04.5 .wsl image by sha256, creation path A with path B as the fallback) is on main since PR #569, made by source review with its convergence record at status planned; c2: Ubuntu 26.04.1 is queued as a comparison and path B is documented, while Debian, WSL containers and a golden-copy route were not weighed and feed the layer's next sweep; c3: no host has executed stage 1 or first boot, and the first run records the stage-1 receipt; c4: no review of a host run exists; c5: no closure record." + }, + "reasons": [ + {"text": "The recipe (PR #569, merged as ad7d645b) selects Canonical's Ubuntu 24.04.5 LTS image ubuntu-24.04.5-wsl-amd64.wsl, pinned by sha256 bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e and checked against both Canonical's SHA256SUMS and Microsoft's distribution catalog before install.", "source_path": "docs/decisions/2026-10-01-new-wsl-distro-recipe.md"}, + {"text": "Creation path: a cloud-init user-data file gives the distribution a passwordless default user (NOPASSWD sudo, locked password, uid 1000), then `wsl --install --from-file ... --no-launch` and a first launch with standard input at end of file; no .wslconfig change, no `wsl --update`, never `wsl --shutdown`.", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"}, + {"text": "26.04.1 LTS is queued as a bounded comparison before any switch (the bootstrap under python3 3.14, uutils coreutils and sudo-rs).", "source_path": "docs/decisions/2026-10-01-new-wsl-distro-recipe.md"}, + {"text": "On main, the linux-wsl2-x86_64 platform profile is accepted while second-machine acceptance is pending; the only fresh-userspace qualification ran in an Ubuntu Base 24.04.5 filesystem on the existing WSL kernel, which is not a booted new PC.", "source_path": "adoption/platforms/linux-wsl2.md"}, + {"text": "The bootstrap's release step 0 checks out tag v2026.09.26.2, which installs older pins (codex 0.155.1, claude-code 2.1.281); the full-profile run refuses any HEAD other than origin/main, so the new distribution starts from a clone of main.", "source_path": "adoption/bootstrap.md"}, + {"text": "The decision record's completeness critic lists what the unit did not look at, and says not to run stage 1 before a follow-up adds its pre-checks (a rehearsal on a throwaway name, the cloud-init schema check, the signed checksums, and the checks for three open WSL issues); that follow-up is in progress.", "source_path": "docs/decisions/2026-10-01-new-wsl-distro-recipe.md"}, + {"text": "The selection has a scoped convergence record at status planned with decision trial: it is not a completed adoption until a host run and the queued comparison.", "source_path": "blueprints/convergence-practice/wsl-new-distro-image-20261001/experiment.json"} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Ubuntu 26.04.1 LTS", "verdict": "queued as a bounded comparison unit before any switch", "source_path": "docs/decisions/2026-10-01-new-wsl-distro-recipe.md"}, + {"name": "Path B: `wsl --import` and a manual user", "verdict": "fallback only after the first launch shows that cloud-init did not provision", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"} + ], + "new_host_steps": [ + "Stage 1 on Windows (W1 to W6 of the recipe): preflight with no Ubuntu Pro cloud-init files; download ubuntu-24.04.5-wsl-amd64.wsl and verify its sha256 against both publications; render %USERPROFILE%\\.cloud-init\\.user-data from adoption/templates/wsl/cloud-init.user-data.template; `wsl.exe --install --from-file --name --location --no-launch`; first launch with standard input at end of file; confirm cloud-init reports disabled by its marker file.", + "First boot (F1 to F6): `systemctl is-system-running --wait` prints running; `sudo loginctl enable-linger \"$(id -un)\"`; the user bus is a socket owned by the user; install the bootstrap's apt list plus libatomic1 and uidmap; check subordinate ids; write the ~/.bash_profile hand-off line before anything else creates that file.", + "F7 and F8: clone origin/main into ~/code/native-agent-stack and render adoption/hosts/.json from the host template on ports outside the workstation's exclusion set (24318, 29374, 26333 and 28231, each probed with ss first).", + "Credentials next (row cross:credential-practice): native sign-ins and the 0700 store before any keyed tool.", + "Stage 2: `adoption/bootstrap-linux.sh --profile token-efficiency`, then native sign-in (`codex login`, then `claude`), with the Context Mode plugin started once before `adoption/bootstrap-linux.sh --profile token-efficiency --configure-full-profile --host ` applies the settings (row token-efficiency).", + "Then the layers outside the profile, each from its row: isolation, workers and git tools; documents and web research; semantic retrieval after the GPU check; quality, runtime workers and the Harbor harness after rootless Docker; observability last, after the host file's port map.", + "F10: install the Windows Terminal fragment with profile names that carry , then prove `type -P claude codex` and test each printed path with test -f and test -x.", + "F11: in a login shell, register jCodeMunch for the clone when its binary is installed (the `claude mcp add --scope local jcodemunch` command of adoption/bootstrap.md), and record registered, not installed or skipped in the stage-1 receipt." + ], + "gates": [ + {"text": "Stage 1 runs in the user's own PowerShell on the Windows host; WSL package updates stay the keys lane's decision.", "kind": "user_side", "source_path": "adoption/platforms/linux-wsl2-new-distro.md"}, + {"text": "The recipe, its decision record and its templates under adoption/templates/wsl/ landed with PR #569; the follow-up with the completeness critic's pre-checks is open, and stage 1 waits for it.", "kind": "lane", "source_path": "docs/decisions/2026-10-01-new-wsl-distro-recipe.md"} + ], + "owner_lane": "foundation", + "notes": "The selection is on main since PR #569 (2026-10-01): Canonical's Ubuntu 24.04.5 image by sha256, cloud-init path A with path B as the fallback, made by source review. Nothing has run on a host; the stage-1 receipt of the first run is the next evidence, after the recipe's follow-up lands." + }, + { + "layer_id": "cross:runtime-workers", + "catalog": "cross", + "title": "Runtime workers", + "winners": [ + { + "name": "OpenHands software-agent-sdk (runtime worker)", + "repository": "https://github.com/OpenHands/software-agent-sdk", + "pin": "v1.49.6 @ fcc102a697874d54a357e36004e02c95040dbdc0", + "pin_source": "blueprints/runtime-workers/openhands/pins.json:3-6", + "install": {"command": "bash blueprints/runtime-workers/openhands/install.sh (host.py install into a versioned prefix and a private state directory), then install-container.sh and install-grader.sh", "kind": "repo_recipe", "source_path": "blueprints/runtime-workers/openhands/README.md"}, + "acceptance": {"command": "blueprints/runtime-workers/openhands/run-e2e.sh on one official task, after the P0-P2 isolation probe passes on the live topology", "evidence_class": "none_recorded", "source_path": "blueprints/runtime-workers/openhands/README.md"}, + "upstream_currency": {"latest_release": "v1.50.1 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/OpenHands/software-agent-sdk/releases"} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "unknown", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: OpenHands is the worker with a committed recipe, but the roster that selects among runtime workers is unmerged (PR #535); c2: no closure assessment of a frozen runtime-worker candidate set exists; c3: the isolation probe and the live E2E have not run, and a resolved official task currently exits 2; c4: no review of a host run is possible before one exists; c5: no closure record." + }, + "reasons": [ + {"text": "OpenHands software-agent-sdk v1.49.6 has a committed recipe: a pinned agent-server image, a hash-locked container install and the official SWE-bench grader; Harbor v0.23.0 is the recorded runner-up.", "source_path": "blueprints/runtime-workers/openhands/pins.json"}, + {"text": "Host acceptance is open: the P0-P2 isolation probe has not run on the live topology, and a resolved official task currently exits 2, not 0.", "source_path": "blueprints/runtime-workers/openhands/README.md"}, + {"text": "Containers behind the rootless Docker network can reach host-loopback ports; a container running model-written code is an untrusted local process, which meets the overturn condition of the keyless loopback gateway.", "source_path": "docs/decisions/2026-09-29-key-management.md"} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Runtime-worker roster: OpenHands 1.50.0, GPT Researcher v3.7.0, DeerFlow v2.1.0, Crawl4AI v0.9.4, Codex Python SDK 0.159.2", "verdict": "every row pending and unaccepted", "pending_source": {"path": "blueprints/runtime-workers/README.md", "pull_request": 535, "commit": "1195e212"}}, + {"name": "AgentRelay v13.0.0 (upstream commit d8e1a188)", "verdict": "named for the production composition; no repository record pins it, so it is not a selection of record", "url": "https://github.com/AgentWorkforce/relay/releases"}, + {"name": "Relaycast v8.14.0 (upstream commit 4d0c22af)", "verdict": "named for the production composition; no repository record pins it, so it is not a selection of record", "url": "https://github.com/AgentWorkforce/relaycast/releases"}, + {"name": "Harbor v0.23.0 as the worker harness", "verdict": "runner-up: Terminal-Bench uses a different task contract", "source_path": "blueprints/runtime-workers/openhands/pins.json"} + ], + "new_host_steps": [ + "Rootless Docker for the user (with the subordinate ids of row quality-evaluation) and a signed-in gh.", + "Before a task container that runs model-written code can reach a keyless loopback gateway, settle its network isolation: no gateway port reachable from task containers.", + "Run `bash blueprints/runtime-workers/openhands/install.sh`, then install-container.sh (uv pip install --require-hashes) and install-grader.sh.", + "Run the offline tests (tests.test_runtime_worker_openhands, tests.test_openhands_lock_binding), the P0-P2 isolation probe, then run-e2e.sh on one official task, and record the host receipt." + ], + "gates": [ + {"text": "The runtime-worker roster qualification lands with PR #535; its candidates stay unaccepted until then.", "kind": "lane", "pending_source": {"path": "blueprints/runtime-workers/README.md", "pull_request": 535, "commit": "1195e212"}}, + {"text": "AgentRelay and Relaycast have no catalog layer: they enter only once a layer or a cross row with its own decision record names them. The production program reports that automatic Codex PTY submission through AgentRelay is held on the current host; its receipts are not published.", "kind": "lane", "source_path": "docs/decisions/2026-10-01-definitive-sota-wsl-program.md"} + ], + "owner_lane": "foundation", + "notes": "AgentRelay and Relaycast commits were confirmed upstream on 2026-10-01 (release commits for v13.0.0 and v8.14.0); a pin of record needs a repository record and its own qualification." + }, + { + "layer_id": "cross:gpt6-harnesses", + "catalog": "cross", + "title": "GPT-6 harnesses: the Codex lane and the gateway", + "winners": [ + { + "component_id": "codex", + "repository": "https://github.com/openai/codex", + "pin": "0.159.2", + "pin_source": "manifests/stack.json:297", + "install": {"command": "bash adoption/bootstrap-linux.sh --profile token-efficiency", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "python3 tools/adoption/prove_codex_lane.py (add --live only when worker runs are intended)", "evidence_class": "none_recorded", "source_path": "tools/adoption/prove_codex_lane.py"}, + "upstream_currency": {"latest_release": "rust-v0.159.3 (2026-09-30), the candidate for the new distribution", "checked_at": "2026-10-01T07:41Z", "pin_is_latest": "no", "url": "https://github.com/openai/codex/releases"} + }, + { + "component_id": "omniroute", + "repository": "https://github.com/diegosouzapw/OmniRoute", + "pin": "3.8.50", + "pin_source": "manifests/stack.json:1878", + "install": {"command": "npm install --global --prefix \"$OMNIROUTE_PREFIX\" omniroute@3.8.50 --include=optional --no-audit --no-fund, then the recipe's npm rebuild with its allow-scripts list", "kind": "repo_recipe", "source_path": "docs/foundation-stack.md"}, + "acceptance": {"command": "npm install --global --prefix \"$OMNIROUTE_PREFIX\" omniroute@3.8.50 into a clean prefix, then the scoped checks: 14 service checks passed on an isolated loopback port, a native restart and the native plaintext backup restore (2026-09-20)", "evidence_class": "upstream_example_or_native_operation", "source_path": "evidence/receipts/foundation-native-20260920.json"}, + "upstream_currency": {"latest_release": "v3.8.51 (2026-09-30)", "checked_at": "2026-10-01T07:42Z", "pin_is_latest": "no", "url": "https://github.com/diegosouzapw/OmniRoute/releases"} + } + ], + "verdict": "comparison_required", + "closure": { + "c1": "partial", + "c2": "unknown", + "c3": "unmet", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the lane's pins and templates are recorded, but OmniRoute is in no adoption profile and the workstation runs rebuilt source builds rather than the 3.8.50 pin; c2: no frozen candidate set for the harness lane exists; c3: the Codex 0.159.3 qualification and a new-host lane proof have not run; c4: no review of a host run; c5: no closure record." + }, + "reasons": [ + {"text": "The Codex lane is rendered by tools/adoption/apply_codex_lane.py (dry run by default, applied against reviewed sha256 values) and checked by prove_codex_lane.py, whose checks, --live included, are local integration rather than host acceptance; the cited script records no run of its own beyond a code comment about the 2026-09-26 rehearsal.", "source_path": "tools/adoption/prove_codex_lane.py"}, + {"text": "The stack-worker profile runs gpt-6.1-sol at max effort with live web search; gpt-6-astra stays for difficult judgment or escalation.", "source_path": "adoption/templates/codex.stack-worker.config.toml"}, + {"text": "Codex 0.159.2 is the pin of record; 0.159.3 was reported on the Mac host in the 2026-09-30 routing record and is upstream's latest, a candidate until its own qualification lands.", "source_path": "docs/decisions/2026-09-30-bounded-native-decision-routing.md"}, + {"text": "The workstation's gateway runs rebuilt release/v3.8.51 source builds with local carries, which the upstream npm command alone does not reproduce.", "source_path": "docs/decisions/2026-09-30-omniroute-rebuild.md"}, + {"text": "OmniRoute's acceptance is the 2026-09-20 receipt's clean pinned 3.8.50 install with its scoped service, persistence and plaintext-restore checks; its boundary stands: gateway inference is not accepted in this wave (Claude returned 429 and the connected Codex accounts reached their configured quota threshold).", "source_path": "evidence/receipts/foundation-native-20260920.json"} + ], + "evidence_class": "none_recorded", + "alternatives": [ + {"name": "Codex 0.159.3", "verdict": "candidate for the new distribution; comparison_required until its qualification lands", "url": "https://github.com/openai/codex/releases"}, + {"name": "Codex Python SDK routed through the gateway", "verdict": "qualification on an open pull request (#560), not merged", "url": "https://github.com/seathatflowsinourveins/native-agent-stack/pull/560"} + ], + "new_host_steps": [ + "Codex installs with the token-efficiency profile at 0.159.2; sign in with `codex login --device-auth`.", + "Render the Codex lane: `python3 tools/adoption/apply_codex_lane.py` (dry run), review, then `--apply --expect-config-sha256 --expect-agents-sha256 `; the codex-lane step of --configure-full-profile runs the same tool.", + "Prove it with `python3 tools/adoption/prove_codex_lane.py`; add --live only when worker runs are intended.", + "Only for gateway-routed lanes: install OmniRoute 3.8.50 into a fresh prefix with a private DATA_DIR, bound to 127.0.0.1 with REQUIRE_API_KEY=true on a port outside the workstation's 20128 and 20129, and create provider connections in its own store.", + "Qualify Codex 0.159.3 on the new distribution (npm tarball hash, provenance, CLI surface) before moving the pin." + ], + "gates": [ + {"text": "Provider accounts sign in natively on the new host; the gateway's provider connections are created in its own store, never copied.", "kind": "user_side", "source_path": "docs/decisions/2026-09-27-omniroute-account-pool.md"}, + {"text": "The Codex 0.159.3 qualification decides the pin on the new distribution.", "kind": "lane", "url": "https://github.com/openai/codex/releases"} + ], + "owner_lane": "foundation", + "notes": "Both pins are stated: 0.159.2 of record, 0.159.3 the candidate." + }, + { + "layer_id": "cross:credential-practice", + "catalog": "cross", + "title": "Credential practice: native sign-ins, the 0600 store and the guards", + "winners": [ + { + "name": "Command and secret-path guard (K4)", + "repository": "https://github.com/seathatflowsinourveins/native-agent-stack", + "pin": "33a11fc01ee35dc4b157b04eee4a8524460bb3fe74375ee32485bc3b2530782f", + "pin_source": "evidence/receipts/guard-k4-verification-20261001.json:27", + "install": {"command": "python3 tools/adoption/install_claude_profile.py --only guard", "kind": "repo_recipe", "source_path": "docs/secret-storage.md"}, + "acceptance": {"command": "the replay of 1,524 documented repository commands through K4 against K3 and against the installed guard (0 newly blocked, 0 loosened, 0 reason changed against each), the acceptance oracle (338 cases, 0 adjusted, 0 reason mismatches), the tracked-file scan against K3 (9,329 tracked files: 0 newly blocked, 0 loosened), the gitleaks branch-ancestry test and the targeted suites (409 tests, one failure by design), run on 2026-10-01", "evidence_class": "local_integration_check", "source_path": "evidence/receipts/guard-k4-verification-20261001.json"}, + "upstream_currency": {"latest_release": "not applicable: the guard is this repository's own code (sha256 of scripts/hooks/secret_path_guard.py as merged with #567 at 2979742f)", "checked_at": "2026-10-01", "pin_is_latest": "unknown", "url": ""} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "met", + "c2": "partial", + "c3": "unmet", + "c4": "unmet", + "c5": "partial", + "missing": "c2: the secrets layer's candidate set is not frozen (row secrets-credentials); c3: the canary proof, the user's acceptance for the key lane, has not run on any host; #567 (K4) merged as 2979742f and its tool's pull request is not open yet; c4: the canary proof tool (tools/credentials/canary_proof.py with a contained ripgrep worker) had one review round (a GPT-6 verification found seven false-clean paths; an Opus review), one repair round and an Opus re-check whose one remaining false-clean path a bounded fix round closed, each fix with a permanent test and a mutant; its synthetic acceptance passes on the workstation (143 tests, 0 skipped; 138 of 138 mutants killed; 12 of 12 real-scope containment cases), and no proof claim is made before its end-to-end run; c5: the key-management record is dated and lists residual risks, but it is not a closure record." + }, + "reasons": [ + {"text": "A new host inspects first (adoption_status.py, credential_status.py), signs in natively (claude, codex login --device-auth, gh auth login, gh auth setup-git), creates a 0700 store with one 0600 file per provider from its template, installs the scanner before the hook, installs the user-level guards and runs a fail-closed check with a synthetic file; values never pass through an agent.", "source_path": "docs/secret-storage.md"}, + {"text": "The tightened guard (sha256 a70a056f) merged with #511 at this edition's base; its verification is local integration on one host plus read-only cross-family reviews, not a proof.", "source_path": "evidence/receipts/guard-k3-verification-20260930.json"}, + {"text": "Guard K4 (#567: runner commands, bounded interpreter reading, OmniRoute management routes) merged as 2979742f and is this row's winner; its verification (evidence/receipts/guard-k4-verification-20261001.json) is local integration plus read-only cross-family reviews, not a proof.", "url": "https://github.com/seathatflowsinourveins/native-agent-stack/pull/567"}, + {"text": "The canary proof tool for exactly the user's acceptance (a per-consumer canary and a zero-hit search with positive controls over the named sinks) is built and reviewed but not merged, so it is not this row's acceptance; it makes no proof claim before its end-to-end run on the new distribution.", "source_path": "docs/decisions/2026-09-29-key-management.md"} + ], + "evidence_class": "local_integration_check", + "alternatives": [ + {"name": "OpenBao", "verdict": "unqualified, source review only", "source_path": "catalogs/landscape/foundation.json"}, + {"name": "Copying authentication stores between hosts", "verdict": "rejected: authentication transfer is native login on the target only", "source_path": "adoption/manifest.json"}, + {"name": "The kernel keyring as the store of record", "verdict": "transport and per-boot spare only", "source_path": "docs/secret-storage.md"} + ], + "new_host_steps": [ + "Run `python3 scripts/adoption_status.py` and `python3 scripts/credential_status.py`; both only inspect the host.", + "Sign in natively: `claude`, `codex login --device-auth`, `gh auth login`, then `gh auth setup-git`; `hf auth login` only where gated models are downloaded.", + "Create the 0700 store under ${XDG_CONFIG_HOME:-$HOME/.config}/native-agent-stack and one 0600 file per provider from its template with `install -m 600`; enter each value yourself.", + "Add the pointer lines to the shell startup file; install gitleaks before enabling the hook (row secrets-credentials), then `git config core.hooksPath scripts/git-hooks`.", + "Install the user-level guards with `python3 tools/adoption/install_claude_profile.py --only guard`, rerun credential_status.py until every required entry passes, then run the fail-closed check with a synthetic file.", + "Run the canary proof end to end on the new distribution once its tool merges; a later edition can take that run as this row's acceptance." + ], + "gates": [ + {"text": "Every sign-in and every key value is the user's own action; nothing is copied from another machine.", "kind": "user_side", "source_path": "docs/secret-storage.md"}, + {"text": "The canary proof tool is open; K4 merged with #567 (2979742f).", "kind": "lane", "url": "https://github.com/seathatflowsinourveins/native-agent-stack/pull/567"} + ], + "owner_lane": "shared: keys", + "notes": "The guard pin is the file hash recorded by the K4 verification receipt; the guard file as merged with #567 (2979742f) hashes to the same value." + }, + { + "layer_id": "cross:convergence-practice", + "catalog": "cross", + "title": "Convergence practice: evidence classes, validators and closure", + "winners": [ + { + "name": "Convergence practice and its validators (this repository)", + "repository": "https://github.com/seathatflowsinourveins/native-agent-stack", + "pin": "5597f9fae2c6148037a74b4e73d2c55fc11c9ff6", + "pin_source": "catalogs/foundation/new-wsl-architecture-20261001.json:6", + "install": {"command": "git clone https://github.com/seathatflowsinourveins/native-agent-stack.git (a clone of origin/main)", "kind": "repo_recipe", "source_path": "adoption/bootstrap.md"}, + "acceptance": {"command": "python3 scripts/validate.py; python3 scripts/validate_catalogs.py; python3 scripts/build_ecosystem.py --check", "evidence_class": "structural_validation", "source_path": "docs/catalog-provenance.md"}, + "upstream_currency": {"latest_release": "not applicable: this repository's own practice at this edition's base commit", "checked_at": "2026-10-01", "pin_is_latest": "unknown", "url": ""} + } + ], + "verdict": "selection_of_record_open", + "closure": { + "c1": "partial", + "c2": "unknown", + "c3": "partial", + "c4": "unmet", + "c5": "unmet", + "missing": "c1: the practice is written down, but the research state and the layer records disagree on which layers require a comparison (comparison_required against keep_but_compare); c2: no closure assessment of the practice itself exists; c3: the structural checks pass in CI, but no layer has completed the closure loop on a new host; c4: no independent review of the practice as a whole; c5: no closure record." + }, + "reasons": [ + {"text": "Eight practices: the task envelope as the entry point; review against the gap a component would close; instructions, retrieval and durable state kept distinct; one owner per worker on an actual base; native context and cache preserved; every attempt counted; deterministic checks separate from live qualification; a recoverable closing decision.", "source_path": "docs/convergence-architecture.md"}, + {"text": "Evidence classes stay separate (unchanged upstream tests, native operation, local integration, synthetic fixtures, independent observation, structural validation), and a new claim needs a discriminating control.", "source_path": "docs/acceptance-evidence-policy.md"}, + {"text": "A host receipt counts toward a status only at a version that matches a current winner pin: the recorder refuses other versions unless --allow-unbound-version, so verdict pins are re-recorded before new-distribution receipts are collected.", "source_path": "scripts/host_receipts.py"}, + {"text": "Closure records are registered through the research state's closure_refs, which the landscape build reads.", "source_path": "scripts/landscape.py"} + ], + "evidence_class": "structural_validation", + "alternatives": [], + "new_host_steps": [ + "Clone origin/main and run the three structural checks.", + "Before collecting new-distribution host receipts, re-record each layer's verdict pins with tools/sota-convergence/record_verdicts.py so that scripts/host_receipts.py binds the installed versions.", + "Collect each layer's host receipts with `python3 scripts/host_receipts.py record`, keeping every failed attempt and one negative control per new claim.", + "Write each layer's dated closure record and register it in catalogs/landscape/research-state.json closure_refs; a layer closes only when all five items hold." + ], + "gates": [ + {"text": "Each layer closes only after its comparison, an independent review and a closure record; this edition closes none.", "kind": "lane", "source_path": "catalogs/landscape/research-state.json"} + ], + "owner_lane": "foundation", + "notes": "The practice's pin is this edition's base commit, recorded on line 6 of this file." + } + ] +} diff --git a/docs/decisions/2026-10-01-definitive-sota-wsl-program.md b/docs/decisions/2026-10-01-definitive-sota-wsl-program.md index 7d7af3751..3eee8ab58 100644 --- a/docs/decisions/2026-10-01-definitive-sota-wsl-program.md +++ b/docs/decisions/2026-10-01-definitive-sota-wsl-program.md @@ -305,10 +305,10 @@ although four of the six SubagentStart carrier blocks name its tools (PR #548's The assessment reads `4d11709c`, an earlier head of PR #358, because that pull request carries the trading lane's current records. All 12 layers are assessed and refuted, and none is final for install: no layer meets item 4 or item 5 in any run. The trading lane owner's verdicts of 2026-10-01 call all 12 "selection of record, open", two of -them (research-factors-ml and security-supply-chain) with no selection of record for the layer itself, and the owner -acknowledged the 12 trading rows of the architecture edition in PR #574. The sanitized trading assessment and the -owner's records land in a lane:trading pull request after this one merges; the decisions, the verdict wording and the -closure records stay with that lane. +them (research-factors-ml and security-supply-chain) with no selection of record for the layer itself; later the same +day the owner recorded a selection for each, which closes nothing, and corrected and re-read the 12 trading rows of +the architecture edition in PR #574. The sanitized trading assessment and the owner's records are PR #578 +(lane:trading); the decisions, the verdict wording and the closure records stay with that lane. ## Gate A re-aim (decided by the user, 2026-10-01 03:33Z) diff --git a/docs/decisions/2026-10-01-new-wsl-architecture-edition.md b/docs/decisions/2026-10-01-new-wsl-architecture-edition.md new file mode 100644 index 000000000..d2d304e3b --- /dev/null +++ b/docs/decisions/2026-10-01-new-wsl-architecture-edition.md @@ -0,0 +1,242 @@ +# Decision: the new-WSL architecture edition of the ecosystem guide (2026-10-01) + +**Decided by:** units W1 and W3 of the 2026-10-01 new-distribution wave, on branch +`claude/new-wsl-architecture-topic-20261001`, written at `origin/main@5597f9fa` (the merge of #511). Every +`path:line` below is that revision's line unless the text names another revision. + +## Context + +The generated guide (`docs/ecosystem/index.html`, built by `scripts/build_ecosystem.py` from +`docs/ecosystem/template.html`) had one hard-wired topic edition, the token-efficiency stack +(`docs/token-efficiency-stack.json`, keyed on stack components). It had no single manifest that says, for +every catalog layer, what a session installs on a new WSL distribution, at which pin, under which verdict and +on what evidence. + +The inputs already existed in the repository, spread over several records: + +- the five `close_only_when` items of `catalogs/landscape/research-state.json` (`saturation.close_only_when`) + and its per-layer status (`comparison_required`, `new_host_required`, `on_requirement_change`); +- the 20 foundation layers of `catalogs/foundation/manifest.json` and the 12 us-equities layers of the + research state; +- the 2026-09-22 layer verdicts in `catalogs/landscape/foundation.json` and `catalogs/landscape/us-equities.json`, + and the sweep ledger `catalogs/saturation/ledger.json`; +- the pins of record in `manifests/stack.json` and `adoption/pins-linux-x86_64.json`, the engine and broker + boundaries in `catalogs/us-equities/runtime-target.json`, and the profiles and recipes of + `adoption/manifest.json`; +- the acceptance classes of `docs/acceptance-evidence-policy.md:26-33`. + +A closure assessment of the 20 foundation layers (2026-10-01, at `3361b342`, each assessment refuted and +corrected by a second reviewer), a closure assessment of the 12 us-equities layers (2026-10-01, at PR +#358's head `4d11709c`, same method) and the Gate A owner's draft for three layers fed this edition as working +input. The foundation assessment lands as `evidence/artifacts/layer-closure-assessment-20261001/` with PR #573; the +trading one stays with the trading lane owner. The edition therefore carries only the facts that a repository path +or a URL read on 2026-10-01 supports, each cited where it is used. Item statuses are one assessor and refuter +pair's judgment: where a layer ran twice, the border between met and partial or between partial and unmet moved in +some cells, and no run makes a layer final. The foundation rows use the first complete result per layer and the +us-equities rows the last, which is the basis of that assessment's synthesis. The core files those assessments cite +(`catalogs/landscape/foundation.json`, `catalogs/saturation/ledger.json`, `manifests/stack.json`, +`adoption/pins-linux-x86_64.json`, `catalogs/foundation/manifest.json`) are unchanged between `3361b342` and +this edition's base. Seven pull requests carried sources that were not on main at that base. Four have merged +since: the new-distribution recipe (PR #569, merged as `ad7d645b`), the Harbor E2E receipt (PR #570, `000aae77`), +the trading convergence record (PR #358, `326dc84b`) and the program record with the foundation assessment +(PR #573, `25098f8a`). Three are open: the Codex lane's layer reviews and crosswalk (PR #575, head `51cb79ba`), +the trading lane's verdict record (PR #578, head `e1f15c97`) and the runtime-workers blueprint README (PR #535, +head `1195e212`). + +## Alternatives + +1. **Extend the token topic.** Rejected: it keys on selected stack components and three groups, and its + validator forbids row-level pins; catalog layers, `cross:` rows and per-layer closure do not fit it. +2. **A separate static report page**, like `docs/ecosystem/claude-upstream-checks.html`. Rejected: it would + leave the single offline page, the input hashes the generator records and the publish workflow's + private-content scan, which all act on `index.html`. +3. **A Markdown table.** Rejected: nothing would check that a pin matches the stack, that a cited file exists + or that a "closed" row really meets the five items. +4. **Data-model choices inside the selected path.** `closure` is flat, as the unit brief specifies + (`c1`..`c5` plus one `missing` string naming each open item); a per-item object was considered and + dropped. `upstream_currency` sits on each winner rather than on the row, because most rows have several + winners with separate release pages. A source not yet on main is a structured `pending_source` + (path, pull request, optional commit), linked through the pull request and not hashed, rather than free + text in `notes`, so a later edition can move it to `source_path` mechanically. + +## Decision + +Add a second hard-wired topic to `scripts/build_ecosystem.py` (`ARCHITECTURE_TOPIC`, loader +`build_architecture`, row validator `architecture_row`, page key `data.architecture`) and a tab +"05 Final architecture" to the template, hidden when the edition file is absent. The edition file is +`catalogs/foundation/new-wsl-architecture-20261001.json`. + +**What the page shows.** The edition header (date 2026-10-01, base commit, scope, verdict rules verbatim, +the meaning of each verdict and evidence class, the five closure items read from the research state, the +sources) and a line that counts closed rows from the data. One table per catalog (foundation, us-equities, +cross) with columns Layer, Winners (pin), Verdict, Evidence class, Reasons and Install on the new distro; each +row expands into the closure items with what is missing, each winner's pin locator, install and acceptance +commands and upstream currency, the alternatives, the ordered new-host steps and the gates. + +**Verdict rules (recorded verbatim in the edition).** A layer is "closed" only when all five close_only_when +items of research-state.json hold; otherwise "selection_of_record_open" with the missing items named. The +winner cell carries the pin of record only (manifests/stack.json or adoption/pins-linux-x86_64.json for stack +components; catalogs/us-equities/runtime-target.json for the engine and brokers; the adoption profile recipes +for install commands). The evidence class is stated per row. Paper results count only as fills and passed +trials. Upstream and user-side gates are gates. + +**Verdict values.** `closed`, `selection_of_record_open`, `provisional` (the owner keeps the selection as the +install default but marks it contested), `comparison_required` (from the research state or the row's owner), +`new_host_required` (the remaining evidence needs another host) and `no_selection` (no pin of record exists). +The research-state status maps directly; `on_requirement_change` becomes `selection_of_record_open`. +Token efficiency is `provisional` on the Gate A owner's call. Scheduling and supervision is +`comparison_required` on the program record's call (PR #573, decision 1): its selected Dagu 2.16.6 failed the +preregistered SIGKILL case. + +**Evidence classes.** The six classes of `docs/acceptance-evidence-policy.md:26-33`, plus `source_review` and +`none_recorded`, two levels below the table: AGENTS.md keeps metadata, pinned source review and native +execution apart. A winner's acceptance class describes a run that the cited source, or one file that source +links, shows was run on a host and what it returned. A check that is only prescribed, planned, not run or failed +is `none_recorded`. Schema, pin, hash and contract-test checks are `structural_validation`. A version print is +metadata, not an acceptance. The `command` names the check the record is about; on a `none_recorded` entry it +names the check to run on the new host, of which no run is recorded. An independent review on 2026-10-01 found 32 +of the 119 winner acceptance classes overstated, 13 commands that were only version or status prints and 6 entries +it could not settle; this revision corrects them. 55 of the 119 entries changed (32 classes, 48 commands and 31 +cited sources); the lane owners re-cited their winners to the files that record the runs; 13 `none_recorded` +entries got their check to run back; restic is cited to its off-host receipt in four rows; and three rows that had +no winner gained six. The edition now has 125 winner entries: 72 `upstream_example_or_native_operation`, 24 +`local_integration_check`, 14 `structural_validation`, 1 `independent_observation` and 14 `none_recorded`, 11 of +which name the check to run. Row classes: 13 `local_integration_check`, 10 `none_recorded`, 7 +`structural_validation`, 6 `upstream_example_or_native_operation` and 1 `independent_observation`. The six policy +classes have no defined order, so the build enforces what can be enforced: +when any winner's acceptance is `none_recorded`, the row's class is `none_recorded`; otherwise the row's class is +one that at least one winner's acceptance carries, and where the winners carry several, the edition records the +one listed last in the policy table. A row without winners keeps its owner's class. Stronger evidence for one +winner stays in the reasons. Every class describes source-host history; a new distribution collects its own +evidence. + +**Validation the build enforces.** Known layer ids or `cross:`, a layer's identity being its +`(catalog, layer_id)` pair; the row catalog matches its layer; exactly one of `component_id` (a +`manifests/stack.json` component) or `name`; when a component's recorded version in the stack differs from the +winner's pin, the build passes, the page notes the drift on that winner ("the stack now records ") and +the `--check` JSON lists it under `architecture_pin_drift`, the token topic's precedent for a dated edition; an +optional `role` per winner (non-empty, at most 120 characters), rendered beside its name, because winners are the +components of the selection of record and some are not its destination; public HTTPS repositories and currency +links; a `pin_source` of one repository file with an optional line range inside it; every `source_path` a +repository file, hashed into the page inputs and linked at the publication ref; a `pending_source` whose path +exists as a repository file is treated as landed, hashed and linked like a `source_path` with the label "landed +after this edition's base (pull request #N)", so a later merge never fails the build; enums for verdicts, evidence +classes, closure states, install kinds and gate kinds; `closed` if and only if all five items are `met`; a +non-empty `missing` for every open row and an empty one for a closed row; a `missing` that starts with one +`cN: ...` segment for each item that is not `met` (segments separated by `; cN:`) and has none for a `met` item, +a trailing sentence without a `cN:` prefix staying allowed; the row's evidence class rule above; +`no_selection` if and only if there are no winners; and the sha256 of the five `close_only_when` texts (joined in +order with newlines, no trailing newline), recorded as the edition's `close_only_when_sha256`, so a reworded or +reordered research state fails the build instead of showing each row's states beside other texts. A catalog layer +without a row is listed on the page, not a build failure, so adding a layer elsewhere never breaks the page. + +**This edition's rows.** 37 rows: 20 foundation, 12 us-equities, 5 cross. Closed: none. 20 +`selection_of_record_open`, 14 `comparison_required`, 2 `new_host_required`, 1 `provisional` and no +`no_selection`. Every assessed row has at least one closure item unmet or partial, and no review item +(c4) is met. The twelve us-equities rows follow the trading closure assessment: their winners are the components +the layer's current choice names that have a pin of record (runtime-target.json for the engine, the brokers +and the adaptive paper engine; stack pins for profile components), while the 2026-09-22 verdict winners +without such a pin (DVC, pandera, agent-retrieval-bench, Inspect AI, MLflow) stay alternatives. +The trading lane owner's verdicts of 2026-10-01 call every trading layer "selection of record, open". Two +layers had no selection of record for the layer itself (research-factors-ml and security-supply-chain). After a +cross-family adjudication in the Codex lane's reviews, the owner recorded one for each the same day (PR #578): +EdgarTools and skfolio for the first, which reads `comparison_required`, and Syft, Gitleaks and Grype for the +second, which reads `selection_of_record_open`, with Grype pinned by the foundation automation catalog. Neither +decision closes anything. The other rows read `comparison_required` where the research state asks for a +comparison and `selection_of_record_open` otherwise. The owner corrected the trading winners' acceptance sources +in this change's pull request (#574) and re-read the twelve rows there, and each row's notes carry the owner's +verdict and blocking item verbatim. The keys lane corrected the credential-practice row, and the Gate A owner +decided the acceptance entries of its three rows the same way. The backtesting-engine row carries the dispute +recorded at PR #358's head `b0eb7a11`. +Paper results appear only as fills and passed trials (the 2026-09-29 Alpaca series: 11 of 13 trials passed, +41 entries and 39 exits filled). The cross row for the distribution is `new_host_required`: its image, hash +and creation path are on main since PR #569, selected by source review, and nothing has run on a host; the +recipe's follow-up with the completeness critic's pre-checks is open, and stage 1 waits for it. + +**Install order on the new distribution** (row `cross:wsl-distro`, each step citing the recipe of PR #569): +stage 1 on Windows; first boot (systemd, linger, user bus, packages, subordinate ids, the login hand-off); +a clone of origin/main and the host file on free ports; credentials before any keyed tool; stage 2 with the +token-efficiency profile, native sign-in, the Context Mode plugin started once before the settings step +(its start script writes the SessionStart cache-heal hook that the settings template runs), then +`--configure-full-profile`; then the layers outside the profile; observability last. + +**Residual gaps.** +- Upstream currency is one read per pinned winner on 2026-10-01 (GitHub releases, or the named registry + page); it was not repeated. Serena, ECC, the guard and the convergence practice carry `unknown`. +- `pin_source` content is not checked: validation checks the file and the line bounds, not the line's content; + the content was checked when the edition was written. Two winners cite a file that cannot establish their + pin: the adaptive-paper engine is pinned to a merge commit (`dca821cc`), which no file in that merge can + record, and the convergence practice is pinned to this edition's base commit, cited from this edition's own + `base_commit` line. +- The cross rows had no closure assessment; their closure items rest on this edition's reading, and items it + cannot establish are `unknown`. +- The acceptance review of 2026-10-01 read one hop from each cited file (a receipt or artifact the cited file + links directly) and no further, and it rated part of its corrections below high confidence: by entry, 10 of + the 32 medium, 9 medium-high and 3 low. +- Item 4 for the layer rows: the Codex lane's cross-family review of all 32 layers (PR #575 at `51cb79ba`, + gpt-6.1-sol) was performed on 2026-10-01 and names remaining gaps in every layer. Each foundation and + us-equities row cites its review; the item cells keep the closure assessment's reading until the layer records + are re-recorded. Those reviews select different component sets from this edition's winners in 20 of the 32 + layers (by a name match, 39 names only here and 41 only there, for example the scanners of ci-supply-chain and + the observability components of observation-inference). This edition keeps the catalogs' selections of record + and the owners' decisions; the re-record pass of the program record (unit U4) reconciles the two. The same + pull request carries the crosswalk from the guide's ten themes to the 32 layers, which this edition references + and does not duplicate, and each repository's upstream-documented install command, none of them run. +- Subordinate ids for the Harbor harness: the recipe allocates 65,536, Docker's documented minimum. A wider + range is an image-set need, added only when a pull fails with `lchown : invalid argument`; the + workstation's 262,144 for six matplotlib SWE-bench images is recorded in the Harbor receipt of PR #570. +- Hindsight's stale and paused pages and held cold seed, and the held automatic Codex PTY submission through + AgentRelay, are carried as gates on the word of the production program; its receipts are not published. +- The token topic's cards still record socraticode 1.14.0 and ccusage 20.0.24 against stack pins 1.15.0 and + 20.0.26; this change does not touch that topic. +- The research state (5 foundation layers `comparison_required`) and the layer records (9 `keep_but_compare`) + disagree on which layers need a comparison; this edition follows the research state, with the one exception + the program record makes for scheduling and supervision. +- Rows do not carry the themed explorer layer as `theme`; cross-linking the explorer is left out. + +## Overturn condition + +Write a new edition, or update this one in the change that causes it, when any of these happens: + +1. **A layer closure.** All five items hold for a row; the build then requires `closed`. +2. **A pin move.** A winner's version changes in `manifests/stack.json`: the build still passes, the page + notes the drift on that winner and `--check` lists it under `architecture_pin_drift`; re-read the row and + record the new pin in the next edition. A `component_id` that leaves the stack still fails the build. A move + in the Linux pins file or runtime-target.json is caught by the line-bounds check only when the line + disappears, so re-read those rows. +3. **A new upstream release** of a winner, or a qualification that moves a pin (Codex 0.159.3 first). +4. **A pending source lands.** PR #575, #578 or #535 merges: the build hashes the landed file and labels it as + landed after this edition's base. PR #569, #570, #358 and #573 have landed: their citations are plain + `source_path` entries now, and `cross:wsl-distro` was re-rated when #569 did. +5. **A lane owner changes a verdict or its wording** for one of its rows. +6. **The Gate A multi-agent E2E runs** on the new distribution: it decides the token-efficiency verdict. +7. **A new catalog layer** appears in the foundation manifest or the research state: the page lists it as a + gap until a row is added. + +## Sources + +- `catalogs/landscape/research-state.json` (`saturation.close_only_when`; per-layer status) +- `catalogs/foundation/manifest.json`, `catalogs/landscape/foundation.json`, `catalogs/landscape/us-equities.json`, + `catalogs/saturation/ledger.json` +- `manifests/stack.json`, `adoption/pins-linux-x86_64.json`, `adoption/manifest.json`, `adoption/bootstrap.md`, + `adoption/bootstrap-linux.sh` (fail-closed on unpinned profile components; node, uv and gh always installed) +- `catalogs/us-equities/runtime-target.json` +- `docs/acceptance-evidence-policy.md:26-33`; AGENTS.md (evidence levels) +- `docs/decisions/2026-09-30-task-model-routing.md:9-12` (the accepted token-efficiency profile, #540) +- `scripts/host_receipts.py` (a receipt binds only to a version that matches a winner pin) +- PR #569 (merged as `ad7d645b`): `adoption/platforms/linux-wsl2-new-distro.md`, + `docs/decisions/2026-10-01-new-wsl-distro-recipe.md`, `adoption/templates/wsl/` +- PR #570 (merged as `000aae77`): `evidence/receipts/harbor-e2e-token-tools-20260930.json` +- PR #573 (merged as `25098f8a`): `docs/decisions/2026-10-01-definitive-sota-wsl-program.md`, + `evidence/artifacts/layer-closure-assessment-20261001/` +- PR #575 at `51cb79ba`: `evidence/artifacts/new-wsl-layer-reviews-20261001/` (the 32 layer reviews and the + selection-gap follow-up), + `catalogs/foundation/new-wsl-layer-crosswalk-20261001.json` +- Docker Engine documentation, rootless mode, prerequisites and troubleshooting (read 2026-10-01); the Next.js + v16.3.8 release page (read 2026-10-01) +- PR #358 (merged as `326dc84b`): `catalogs/us-equities/convergence-20260926.json` +- PR #578 at `e1f15c97`: `docs/decisions/2026-10-01-trading-layer-verdicts.md` (the trading lane owner's verdicts + and the two selections of 2026-10-01) +- Upstream release pages read on 2026-10-01 (07:41Z to 08:06Z), each cited on its winner; the + nautilus_trader issue #4983 and pull request #5041 states; the gitleaks README; the Harbor README + (`uv tool install harbor`) diff --git a/docs/ecosystem/README.md b/docs/ecosystem/README.md index a5ab4b27f..54a865174 100644 --- a/docs/ecosystem/README.md +++ b/docs/ecosystem/README.md @@ -30,7 +30,8 @@ still works offline; the guide and manifest links require the checkout layout. The views connect a layered ecosystem map, foundation and trading capabilities, current choices and alternatives, the repository explorer, selected-stack setup, -token-efficiency evidence, and dated source provenance. Every +token-efficiency evidence, the new-WSL final architecture, and dated source +provenance. Every current public index identity and the existing 342-star snapshot are retained. The separate current-integrations lane makes newly observed Tavily setup searchable without silently enlarging the canonical index or accepted component manifest. Stars and @@ -125,6 +126,55 @@ arbitrary raw-log references. Publication review must establish that the declare public files are suitable for sharing; the hash check establishes byte identity. Receipts without public attachments say so explicitly. +**Final architecture** (tab 05) appears when the dated edition +[`catalogs/foundation/new-wsl-architecture-20261001.json`](../../catalogs/foundation/new-wsl-architecture-20261001.json) +is present; without it the tab stays hidden. It is the install manifest for a +new WSL distribution: one row per layer of both catalogs (the 20 foundation +layers and the 12 us-equities layers of the research state) plus `cross:` rows +for the distribution itself, runtime workers, the GPT-6 harnesses, the +credential practice and the convergence practice. The header shows the edition +date, its base commit, scope, the verdict rules verbatim, what each verdict and +evidence class means, the five closure items of +[the research state](../../catalogs/landscape/research-state.json) and the +edition's sources, and states how many rows are closed. One table per catalog +lists each row's winners at their pin of record, verdict, evidence class, +reasons and install command; expanding a row shows the closure items with what +is missing, the winners' pin locators, install and acceptance commands and +upstream currency, the alternatives, the ordered new-host steps and the gates. + +The build validates the edition before it renders: every `layer_id` is a known +catalog layer or a `cross:` id, a layer being identified by its catalog and id; a +winner's `component_id` must be a `manifests/stack.json` component, and when the +stack's recorded version differs from the edition's pin the build still passes, +the page notes the drift on that winner and the `--check` JSON lists it under +`architecture_pin_drift`; a winner may carry a short `role` (at most 120 +characters), shown beside its name; repositories and currency links pass the +public HTTPS gate; each cited `source_path` must be a repository file, which is +hashed into the page's inputs and linked at the publication ref; a source not yet +on main is cited as a `pending_source` with its pull request and is linked, not +hashed, until its file exists, when it is hashed and labelled as landed after the +edition's base; verdicts and evidence classes come from fixed enums; a row is +`closed` if and only if all five closure items are `met`, so a closed row names +nothing missing and an open row's `missing` names each item that is not met in +its own `cN:` segment and no met item; a row with a winner whose acceptance is +`none_recorded` is `none_recorded`, and otherwise its class is one that a +winner's acceptance carries (where the winners carry several, the edition +records the one listed last in the policy table); and the edition's +`close_only_when_sha256` must match the research state's five closure texts. A +catalog layer without a row is listed as a gap rather than failing the build. + +A winner's acceptance class describes a run that the cited source, or one file +that source links, shows was run on a host and what it returned. A check that is +only prescribed, planned, not run or failed is `none_recorded`. Schema, pin, +hash and contract-test checks are `structural_validation`. A version print is +metadata, not an acceptance. The `command` names the check the record is about; +on a `none_recorded` entry it names the check to run on the new host, of which +no run is recorded. +The build cannot read prose, so this rule is held by review, not by a validator: +an independent review on 2026-10-01 found 32 of the 119 winner classes +overstated, and the edition was corrected. The record of this edition is +[`docs/decisions/2026-10-01-new-wsl-architecture-edition.md`](../decisions/2026-10-01-new-wsl-architecture-edition.md). + ## Rebuild and check From the repository root, using Python 3.10 or newer and its standard library: diff --git a/docs/ecosystem/template.html b/docs/ecosystem/template.html index 4d00ca08a..8e9f34abc 100644 --- a/docs/ecosystem/template.html +++ b/docs/ecosystem/template.html @@ -19,6 +19,7 @@ #token-topic th:nth-child(1){width:15%}#token-topic th:nth-child(2){width:25%}#token-topic th:nth-child(3){width:32%}#token-topic th:nth-child(4){width:28%} #token-topic .topic-detail td{padding-top:0;padding-bottom:20px}#token-topic .topic-detail pre{max-width:100%} #token-topic-section{scroll-margin-top:160px} +#architecture .token-table{table-layout:fixed;min-width:1100px}#architecture td{overflow-wrap:anywhere}#architecture th:nth-child(1){width:14%}#architecture th:nth-child(2){width:17%}#architecture th:nth-child(3){width:10%}#architecture th:nth-child(4){width:11%}#architecture th:nth-child(5){width:28%}#architecture th:nth-child(6){width:20%}#architecture .topic-detail td{padding-top:0;padding-bottom:20px}#architecture .topic-detail pre{max-width:100%}#architecture h4{font-size:13px;margin:16px 0 6px}#architecture ol{font-size:12px;padding-left:20px}#architecture ol li{margin:6px 0}.architecture-verdict{font-weight:650}.architecture-verdict.closed{color:var(--green)}.architecture-verdict.open{color:var(--copper)} .navigation{flex-wrap:wrap;column-gap:22px;row-gap:0}.navigation button:last-child{margin-left:0} .catalog-entries,.catalog-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:18px;margin:0 0 36px}.catalog-entry,.catalog-layer,.catalog-card{min-width:0;border:1px solid var(--line);border-radius:var(--radius);padding:25px;background:var(--white);overflow-wrap:anywhere}.catalog-entry:first-child{background:#e8eddf}.catalog-entry h2{margin:12px 0;font-size:35px}.catalog-entry p,.catalog-layer p,.catalog-card p{font-size:13px;margin:12px 0;color:var(--muted)}.catalog-entry .button{margin-top:15px}.catalog-entry .catalog-count{color:var(--green);font-weight:600}.catalog-layer h3,.catalog-card h3{font-size:20px}.catalog-layer .eyebrow{color:var(--copper);margin-bottom:8px}.catalog-layer .accepted-scope{color:var(--green)}.catalog-gap{border-left:3px solid var(--copper);padding-left:12px;margin:16px 0;font-size:12px}.catalog-gap strong{display:block}.catalog-gap p{margin:5px 0}.catalog-detail{border-top:1px solid var(--line);padding:15px 0 0;margin-top:16px;min-width:0}.catalog-detail p,.catalog-detail li{font-size:12px}.catalog-detail summary,.catalog-detail a{overflow-wrap:anywhere}.catalog-capability{border-top:1px solid var(--line);padding:18px 0 4px}.catalog-capability h4{font-size:15px;margin:0 0 9px}.catalog-capability .badge{font-size:10px}.catalog-sources{display:flex;flex-direction:column;gap:8px;margin:14px 0;font-size:12px}.catalog-facts{display:grid;grid-template-columns:minmax(90px,1fr) minmax(0,2fr);gap:9px 16px;font-size:12px;margin:15px 0}.catalog-facts dt{color:var(--muted)}.catalog-facts dd{margin:0;overflow-wrap:anywhere}.catalog-layer .catalog-detail .catalog-detail{padding-left:12px}.catalog-summary{margin:0 0 22px}.catalog-summary p{font-size:13px;margin-top:10px}.catalog-controls{margin-bottom:20px}.catalog-scope{font-size:12px;color:var(--muted);margin:15px 0 25px}.catalog-empty{padding:30px;border:1px dashed var(--line);border-radius:12px;margin-bottom:30px}.catalog-grid>*{min-width:0}.catalog-card pre{max-width:100%}@media(max-width:800px){.catalog-entries,.catalog-grid{grid-template-columns:1fr}}@media(max-width:670px){.navigation{overflow:visible;column-gap:16px}.catalog-entry,.catalog-layer,.catalog-card{padding:20px}.catalog-facts{grid-template-columns:1fr}.catalog-facts dd{margin-bottom:7px}.catalog-entry h2{font-size:31px}} .foundation-repos{padding-left:18px;font-size:12px}.foundation-repos li{margin:9px 0}.foundation-repos code{display:block;font-size:10px;overflow-wrap:anywhere;color:var(--muted)}.foundation-surfaces{margin:20px 0}.foundation-surfaces h4{font-size:14px;margin:0 0 10px}.foundation-surface{border-left:2px solid var(--line);padding-left:12px;margin:16px 0}.foundation-surface h5{font-size:13px;margin:0 0 6px}.foundation-surface p{font-size:12px;margin:8px 0}.foundation-surface .catalog-sources{margin:9px 0}.foundation-surface .native-code{max-width:100%} @@ -45,7 +46,8 @@ - + +
@@ -118,6 +120,12 @@

Codex

Use native task context, compaction, cache, skills and collaboration. Select independent subagents and isolated writing worktrees; return source paths and concise verification.

Claude Code

Use native skills, subagents, scoped project instructions and isolated worktrees. Preserve native caching and compaction; keep account setup and active tool discovery specific to the host.

Research workers

Give each worker a bounded input packet, purpose and output contract. Preserve usage and failure evidence. Keep numerical state and permitted execution in deterministic code.

Codex input includes its cached-input subset. Claude ordinary input, cache creation and cache reads use different categories. Do not add those conventions blindly or double-count the same telemetry receipt.

+