Track GPT runtime workers, SDKs, the gateway and pi in the daily catalog-freshness report

[seathatflowsinourveins]

Scope

• What this PR changes: the daily catalog-freshness job gains a report-only "GPT runtime workers, SDKs and agents" table. Twelve pins are read from their records at extraction time (the new-WSL install plan's rows by slot, the OpenHands recipe pins.json, adoption/sdk/accepted-constraints.txt), and seven watch-only upstreams (pi, oh-my-pi, OpenAI Agents SDK for Python and JS, crawl4ai, Deep Agents, codex-action) are reported against upstream releases with dormancy and archived signals. Upstreams without usable GitHub releases (Inspect AI, codex-action, Deep Agents' monorepo tags) are compared through a declared, anchored tag pattern read with GitHub's git/matching-refs and sorted by version; a failed tag list is recorded apart from the repository's partial errors, and a fetch failure on a repository that only runtime-pins.json names counts in separate runtime_only_* counters, so neither blanks another row nor holds the propose job. The manifest, the drift table, drift-status.txt, receipts and the propose job are unchanged.
• Base commit: e88d59e4 (main after Keep daily catalog reports and Monday proposals consistent #639; rebased from 56473e4b through dcae68bd, the evidence registration redone as the last commit each time)
• Lane: lane:foundation. The branch reads adoption/sdk/accepted-constraints.txt and the install plan and edits neither.
• Owned paths touched: tools/sota-convergence/{extract_layers,github_freshness,build_manifest}.py, tools/sota-convergence/README.md, scripts/freshness_propose.py, .github/workflows/catalog-freshness.yml (one flag, one counts line, one upload path), tests/test_catalog_freshness_runtime.py (new), docs/github-automation.md, docs/harness-defaults.md (one anti-pattern row, inserted at the top of the log so it does not meet Keep the root directory as one PATH component; refuse a host HOME of /; six anti-pattern log rows #619's rows at the end), docs/decisions/2026-10-02-gpt-runtime-tracking.md (new). manifests/evidence.json re-registrations are the last commit.

Relation to open #633 (Codex lane): #633's catalogs/foundation/runtime-jobs.json records the source pins its reviews read and has the runtime-worker workflow fetch their metadata; it compares no pin and renders no table. This table compares install and runtime records, so the two are complementary, and once #633 lands its catalog is a pin record on main from which watch:pi can be promoted.

#622 (merged 2026-10-03T05:37Z) carries the osv-scanner fix for GHSA-vfj7-8cjw-p6xm that had blocked every PR; this branch is rebased onto it.

SOTA sources

• Precedent in this repository at 56473e4b: tools/sota-convergence/extract_layers.py TRADING_PIN_SOURCES and resolve_trading_pins, build_manifest.py build_trading_freshness, scripts/freshness_propose.py render_trading_markdown.
• GitHub REST: get the latest release, the call github_freshness.py makes; PEP 503 normalized names for the constraints form; RFC 6901 for the pointer form.
• Alternatives trialed on copies of the records by the search-first sweep (wf_21fc37c5-123) and not adopted, with the overturn condition in the record: updatecli v0.122.0 (pipeline diff), Renovate 44.132.2 (--platform=local), nvchecker v2.22.
• Tracked upstreams: openai/codex, anthropics/claude-agent-sdk-python, diegosouzapw/OmniRoute, OpenHands/software-agent-sdk, assafelovic/gpt-researcher, bytedance/deer-flow, harbor-framework/harbor, UKGovernmentBEIS/inspect_ai, openai/openai-python, earendil-works/pi, can1357/oh-my-pi, openai/openai-agents-python, openai/openai-agents-js, unclecode/crawl4ai, langchain-ai/deepagents, openai/codex-action.

Evidence-class table

Claim	Evidence class	Command / receipt
Resolution, comparison, tag selection, failure isolation, report and leak-gate behaviour of the new code	synthetic	python3 -m unittest tests.test_catalog_freshness_runtime -v: 86 OK; mutation runs (rounds 2-4, 73 mutants) show each new test fails when its behaviour is removed
The pipeline on live GitHub metadata: 19 rows, 0 unresolved, 4 behind (Inspect AI 0.3.273 against tag 0.3.276, and the older host's three records), 7 not compared, drift-status.txt unchanged	local_integration	independent verifier runs on 2026-10-03 at the round-3 and round-4 code: extract_layers.py, github_freshness.py (488 repositories, 0 errors, 0 partial errors), build_manifest.py --runtime-freshness-out, build_drift_report; table in the decision record
A failed tag list keeps the repository's drift and trading rows reliable and the propose gate at 0 partial errors	local_integration	the same pipeline with a shim failing only Inspect AI's matching-refs call; the next run retried and recovered it
A runtime-only repository's fetch failure (503 on repos/openai/openai-python, or 502 on its releases/latest) leaves upstream-errors.txt/upstream-partial-errors.txt at 0 and the saturation input complete	local_integration	round-5 verifier, shimmed live fetches of all 488 repositories
Cross-family review	source_review (GPT family)	gpt-6-astra at max through native codex exec, read-only: BLOCK at 2d28e04e (four findings, see the PR comment), ACCEPT at f6a2f68e after round 5
Without the new flag the manifest and the trading sidecar are byte-identical	local_integration	same run, rebuilt without the flag, cmp exit 0
Installed versions on this distribution equal the plan's pins	local observation, not acceptance	read from the tool root's environments and checkouts
A hosted scheduled run produces the table	not yet observed	the first 06:17 UTC schedule on main after merge

Local commands run

All at f6a2f68e (rebased on e88d59e4) unless noted; exit codes as returned.

$ python3 -m unittest tests.test_catalog_freshness_runtime tests.test_catalog_freshness_trading tests.test_catalog_freshness_propose tests.test_catalog_freshness_pins tests.test_sota_convergence tests.test_practice_references tests.test_adoption_docs_consistency <the three builder registry tests>
Ran 668 tests ... OK (skipped=9)   # environment skips (jsonschema absent, docs data, macOS-only); the focused set adds the saturation ledger, workflow hardening and shell-parser suites
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 9413, "profiles": 4, "receipts": 187, "status": "passed"}
$ python3 scripts/validate_convergence.py --all-recorded --root . --json
valid: true, 26 records, none invalid
$ python3 scripts/validate_catalogs.py; python3 scripts/validate_foundation.py --root . --json; python3 scripts/landscape.py --root .
exit 0; exit 0 (errors []); exit 0
$ python3 scripts/verdict_review_gate.py --root . --base origin/main --json
status passed (trust path build_manifest.py changed; no verdict row, wave or sealed artifact)
$ actionlint .github/workflows/catalog-freshness.yml && zizmor .github/workflows/catalog-freshness.yml
exit 0; no findings (3 suppressed, as at the base)
$ python3 -m unittest    # full suite, at 6bc1199b
Ran 9846 tests: FAILED (failures=26, skipped=1182). Rerun at the base 56473e4b, the same failures recur
(bootstrap and macOS tests that need tools this distribution lacks, a cross-device git clone --local from the
worktree into tmpfs), except the publication hash check that the last commit's registration fixes.

Main may move before merge; the branch then rebases, re-registers in its last commit and reruns validate.py and validate_convergence.py --all-recorded.

Decision record

docs/decisions/2026-10-02-gpt-runtime-tracking.md: the gap by row kind, the pin records, ownership (the Codex maintenance task owns upstream detection; this table is a report), the search-first sweep and its overturn condition, the first run, limits and the anti-pattern correction.

The sweep's measured gap (Inspect AI not compared because of the name-ordered tag fallback) is closed in this PR. Remaining follow-ups: a registry identity per row through the PyPI simple JSON API (PEP 691, PEP 792 status); advisories through the adopted OSV-Scanner on a generated purl SBOM of the runtime pins; promotion of watch:pi when a pi pin record lands on main (#524 was closed on 2026-10-03; #633 lists pi v1.0.0 as a source pin).

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no action is added or changed).
• New/changed workflows declare top-level permissions: contents: read (unchanged).
• No secrets are printed, logged or committed; no new required secret.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T04:43:21.146994Z	80b5537	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Cross-family read at 2d28e04e: BLOCK, now being repaired in round 5

The reviewer was gpt-6-astra at max effort, run through native codex exec in a read-only sandbox. It was started by this session as coordinator, after four Claude build rounds, each verified and reviewed independently. It reviewed the head without rerunning tests. It confirmed the source pins, the row-kind inventory, the 86 test definitions, the seven re-registered hashes, and that the record labels its runs as local.

Findings:

1. Major. A repository that only the runtime table adds (for example openai/openai-python) joins the shared fetch. A failure fetching it counts in the document's top-level errors/partial_errors, which hold the propose job in catalog-freshness.yml, so a runtime-only failure could suppress a valid foundation or trading proposal. Matching-tag failures were already isolated; ordinary runtime-only failures were not.
2. Minor. A tag list truncated at the 5,000-name cap was ignored when picking the latest, which could give a false "not behind".
3. Minor. Pointer declarations with bad syntax ("tag", "owners") pass the declaration check and surface as moved records instead of raising.
4. Nit. The record says the propose PR never carries runtime rows, but the full drift.md is copied into the evidence branch.

Round 5 repairs all four:

• Runtime-only repositories get their own counters, runtime_only_errors and runtime_only_partial_errors. The gate counters keep their pre-runtime inventory and meaning.
• A truncated list makes the row not_compared.
• Pointer syntax is validated per RFC 6901 at declaration time.
• The record is corrected.

The same reviewer then rereads the repaired head before this PR is merged.

[seathatflowsinourveins]

Cross-family reread at f6a2f68e: ACCEPT. The reviewer was gpt-6-astra at max through native codex exec, read-only, the same reviewer that returned BLOCK at 2d28e04e.

1. Resolved (was major): runtime-only fetch failures are isolated. collect_runtime_only_slugs excludes every other working file's normalized slugs, the document keeps separate runtime_only_* counters, and every consumer of errors/partial_errors keeps its meaning: the proposal outputs, the workflow gate and saturation completeness. Keep daily catalog reports and Monday proposals consistent #639 adds no consumer.
2. Resolved: a truncated tag list now gives not_compared with reason tag_list_truncated, and the report explains it.
3. Resolved: malformed pointers raise at declaration time (RFC 6901 §3), before any record is read.
4. Resolved: the record now says the runtime rows appear in the committed drift.md but never trigger a proposal or name receipt component ids.

The reviewer found no regression. It noted that after the rebase, #639 makes scheduled proposals Monday-only, which does not disturb this PR's build, report or upload steps. It ran 30 read-only tests and checked the seven re-registered hashes.