Retire historical WSL retrieval replay and isolate archive scan

[seathatflowsinourveins]

Scope

Retire the old WSL retrieval fixture's supported replay and npm installation entry points while retaining its historical records and exact lock bytes. Scan that one retired lock under a separate, expiring configuration; ordinary inputs and the existing macOS archive retain their own configurations.

• Base commit: 56473e4b840f0e6940c031801d866e7e9bf29baf
• Lane: lane:shared; other-lane exact-head acknowledgment is required before merge.
• Owned paths: retrieval blueprint/audit/tests, four scanner integration paths, scoped public artifacts/receipt, ecosystem row and evidence registry.
• No dependency relock/relocation. Active QMD's braces advisory remains unresolved.

SOTA sources

• npm/cli v11.19.0, commit bfacd33ccbcd908480610703b60455d2da5b57a9: devEngines, pre-execution enforcement, standalone lock loading. The dependency-free guard rejects supported install/ci routes; deleting the manifest alone is insufficient.
• google/osv-scanner v2.6.0: checksum-verified official executable ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108; configuration and Manager.Get. Explicit config affects every invocation input; caller/inventory guards enforce exact scope.
• GHSA-vfj7-8cjw-p6xm: the retained braces3.0.3 remains affected. This disposition is not a patch.
• Existing main564 frozen-macOS scanner pattern and acceptance policy; scoped architecture-owner handoff.

Evidence-class table

Claim	Evidence class	Command / receipt
Original17historical artifacts/lock,186receipt entries and26convergence records preserved; archived manifest/recording aid exact	local_integration	Hash-bound handoff, audit and independent reviews
Both old runner modes refuse before output creation; eight npm11.19 install/ci/prefix/ignore-scripts routes refuse1/EBADDEVENGINES without modules or input changes	native_proven	Original sanitized command/output captures in retirement artifact bundle
Exact workflow native scan covers50inputs as48/1/1; three primary and three SARIF invocations0, each SARIF zero results	native_proven	final-native-scan-record.json; official OSV2.6 binary; native script SHAf55f319bcfd2a1bf5fbbe19c1cd0b2155b75a8086b34586465b67c1db0d06625
Final config's expired counterpart reports advisory1; unchanged ordinary active-copy control1 reused	native_proven	Native expired output/config and prior original ordinary control
Unknown/duplicate/missing/wrong archive assignments fail before scan; all six statuses retained, including primary7 versus SARIF2 regression	synthetic	Recording-double workflow controls, explicitly authored integration evidence
46integrated OSV regressions0;33retrieval checks0; audit/convergence0	local_integration	Original retained command/output records; no unchanged upstream suite claim
Source/integration reviewed independently	source_review	Two scoped accepted verdict summaries; native Astra-requested integration review0

Local commands run

python3 -m unittest tests.test_osv_lockfile_coverage -v
# exit0:46tests
python3 scripts/validate.py
# exit0 required before commit; integrity/scope only
python3 scripts/build_ecosystem.py --write
python3 scripts/build_ecosystem.py --check
git diff --cached --check

The exact workflow scan step ran unchanged with cleared inherited environment, owned empty HOME/RUNNER_TEMP and the checksum-verified native scanner. Its20pre-scan guard tests passed. Public artifacts retain sanitized original stdout/stderr, native npm debug argv observations, exact script/configs and SARIF; every public digest binds published bytes only.

Decision record

blueprints/convergence-practice/wsl-retrieval/retirement-assessment.json and evidence/receipts/wsl-retrieval-retirement-20261003.json. Eligibility follows supported entry-point retirement and exact historical preservation, not fixed-literal glob safety or advisory dismissal. The dedicated exception expires2026-10-31; only the one hash-bound retired lock is eligible.

Limits: --force/other package managers/restored historical source are outside the guard. Historical missing argv/cwd/raw logs remain missing. Original config127 parse failures and failed source controls stay retained. Native client reviewer counters are not billed costs or token-efficiency comparisons. An existing correction note is retained unchanged with unverified authorship and is not original execution evidence.

Host evidence

No host receipt or platform status changes. Hosted current-head CI, shared acknowledgment, active QMD resolution and destination acceptance are separate gates.

Checklist

• Workflow actions retain full commit pins and existing permissions.
• No credential values or new required secrets.
• No new hosting/subscription/billing surface.
• Concurrent/uncommitted peer work and original historical artifacts preserved.

[seathatflowsinourveins]

Exact-head findings and retirement consolidation

Read #623 at bf750c9f52abfc09e9331aac0c5b642f62bedc1f against #622 at 3f862a489f1fd0c397169d684cb4657ad90d260f. HOLD on #623; use one integrated landing path. The original retirement source/audit/lock and historical archives are identical between these heads. Both PRs use the same base, 56473e4b840f0e6940c031801d866e7e9bf29baf.

Concrete findings:

1. Retire historical WSL retrieval replay and isolate archive scan #623 retains two zero-byte files named expired-archive.stdout.json and prospective-archive.stdout.json. The all-recorded discovery implementation parses registered JSON artifacts, so these cannot pass convergence discovery. Retire historical WSL retrieval replay and isolate its archive scan #622's original head failed this exact hosted command on Linux and macOS. Retire historical WSL retrieval replay and isolate its archive scan #622 now retains the same zero bytes as .stdout.txt, updates the bindings and passes all-recorded discovery (26 records) and publication validation (187 receipts, 9406 files). No validator rule changed; failed attempts remain preserved.
2. Retire historical WSL retrieval replay and isolate archive scan #623's workflow prints statuses:. The current repository action-pin text check matches the embedded uses: substring; Retire historical WSL retrieval replay and isolate its archive scan #622's scoped scanner repair uses exit codes: and passed the full focused three-module suite (161 tests, two skips), including workflow hardening. No scan semantics change.
3. Retire historical WSL retrieval replay and isolate its archive scan #622 adds seven mutation controls to the real scanner preflight: reject restored retirement status, wrong assessment path/digest, missing assessment, wrong receipt identity/binding and missing lock evidence. It binds the assessment and receipt content rather than relying only on config reason strings. OSV v2.6.0 Manager.Get applies explicit config to every invocation input, so caller-side controls matter. It also shortens this temporary archive expiry to 2026-10-17.

#622 has fresh native released-OSV evidence on that stronger workflow/config: 48/1/1 inputs; primary and SARIF 0/0/0; active-copy ordinary and expired-archive controls each 1 with the advisory; unchanged original lock. Its required hosted OSV check passes. Current-head remaining CI and exact-head independent read/other-lane acknowledgement are still required.

The additional #623 independent-integration-review.md remains preserved at its immutable GitHub head; it is a coordinator summary of its own earlier native review, not a verdict on #622's stronger candidate. Please consolidate on #622 or explicitly take its complete corrective delta into #623, then close the duplicate with a link. Do not land either older head in parallel. This goal is not editing the original owner's worktree or deleting its evidence. The original integration summary's claim that integrated-osv-tests.stdout.txt was corrected from a newline also has a provenance distinction: this goal observed it already empty with a stale registry row in its own captured tree; that correction is recorded in #622's publication note.

[seathatflowsinourveins]

Superseded by the stronger single landing candidate PR622, exact head 3f862a489f1fd0c397169d684cb4657ad90d260f.

Independent root checks on622 returned0:161integrationtests/2skips, all26recordedconvergence experiments,9406file/187receipt integrity and current native evidence bindings. Original historical artifacts/failures are preserved; the earlier nine retirement source postimages match this draft.

This draft's actual hosted validation failures and terminal watch1 remain evidence.622 fixes empty .stdout.json discovery and the workflow text check's statuses:/uses: collision, and strengthens actual-preflight mutation guards. Its current-head native Astra verdict is separate from this draft's historical scoped review. Current CI and shared-lane custody remain622's merge gates.

Closing the duplicate without deleting its branch, cancelling runs, changing peer worktrees or discarding source/native evidence. No whole-host, provider, active QMD or trading acceptance is implied.