Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held)

.github/osv-scanner-lockfiles.json

@@ -33,6 +33,10 @@
       "path": ".github/requirements-calendar.txt",
       "parser": "requirements.txt"
     },
+    {
+      "path": ".github/requirements-validation.txt",
+      "parser": "requirements.txt"
+    },
     {
       "path": "blueprints/us-equities/sim-crosscheck-hftbacktest/requirements.lock",
       "parser": "requirements.txt"

.github/requirements-validation.txt

@@ -0,0 +1,8 @@
+# Native validation dependencies for the catalog workflows (catalog-freshness.yml freshness and propose jobs, Python
+# 3.13 through setup-python; publish-catalog.yml publish job, the ubuntu-24.04 runner's CPython 3.12.3).
+# PyYAML 6.0.3, the latest release: Linux x86_64 CPython 3.12-3.14 binary wheels only, no source distribution. The
+# hashes match https://pypi.org/pypi/PyYAML/6.0.3/json (uploaded 2025-09-25, not yanked; re-checked 2026-10-06).
+PyYAML==6.0.3 \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5

.github/workflows/catalog-freshness.yml

@@ -55,6 +55,11 @@ jobs:
       - name: Install the hash-locked session calendar
         run: |
           python3 -m pip install --require-hashes --only-binary=:all: -r .github/requirements-calendar.txt
+      - name: Install checksum-locked native validation dependencies
+        run: >-
+          python3 -m pip install --disable-pip-version-check --no-input
+          --only-binary=:all: --require-hashes --index-url https://pypi.org/simple
+          -r .github/requirements-validation.txt
       - name: Extract deterministic working files (no network)
         run: |
           mkdir -p "$RUNNER_TEMP/freshness"
@@ -132,7 +137,7 @@ jobs:
             for spec in \
               "actionlint|kjanat/actionlint|1.17.0" \
               "gitleaks|gitleaks/gitleaks|8.30.1" \
-              "syft|anchore/syft|1.52.0" \
+              "syft|anchore/syft|1.54.0" \
               "zizmor|zizmorcore/zizmor|1.30.1" \
               "grype|anchore/grype|0.119.0" \
               "nautilus_trader|nautechsystems/nautilus_trader|2.0.0rc5"; do
@@ -279,6 +284,11 @@ jobs:
         with:
           python-version: '3.13'
           check-latest: false
+      - name: Install checksum-locked native validation dependencies
+        run: >-
+          python3 -m pip install --disable-pip-version-check --no-input
+          --only-binary=:all: --require-hashes --index-url https://pypi.org/simple
+          -r .github/requirements-validation.txt
       - name: Download this run's freshness artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/publish-catalog.yml

@@ -49,6 +49,11 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Install checksum-locked native validation dependencies
+        run: >-
+          python3 -m pip install --disable-pip-version-check --no-input
+          --only-binary=:all: --require-hashes --index-url https://pypi.org/simple
+          -r .github/requirements-validation.txt
       - name: Validate the catalog and recorded evidence
         shell: bash
         run: |
@@ -103,19 +108,19 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          syft_dir="$RUNNER_TEMP/syft-1.52.0"
+          syft_dir="$RUNNER_TEMP/syft-1.54.0"
           mkdir -p "$syft_dir"
           curl --fail --location --show-error --silent --retry 3 --proto '=https' --tlsv1.2 \
-            'https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_checksums.txt' \
+            'https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_checksums.txt' \
             --output "$syft_dir/checksums.txt"
           curl --fail --location --show-error --silent --retry 3 --proto '=https' --tlsv1.2 \
-            'https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_linux_amd64.tar.gz' \
+            'https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_linux_amd64.tar.gz' \
             --output "$syft_dir/syft.tar.gz"
-          expected="$(grep '  syft_1.52.0_linux_amd64.tar.gz$' "$syft_dir/checksums.txt" | awk '{print $1}')"
+          expected="$(grep '  syft_1.54.0_linux_amd64.tar.gz$' "$syft_dir/checksums.txt" | awk '{print $1}')"
           test -n "$expected"
           printf '%s  %s\n' "$expected" "$syft_dir/syft.tar.gz" | sha256sum --check --status
-          # Pinned and independently re-verified 2026-09-22 against the upstream checksums file.
-          test "$expected" = 'caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d'
+          # Pinned and independently re-verified 2026-10-03 against the upstream checksums file.
+          test "$expected" = '54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860'
           tar -xzf "$syft_dir/syft.tar.gz" -C "$syft_dir" syft
           install -m 0755 "$syft_dir/syft" "$RUNNER_TEMP/syft"
           "$RUNNER_TEMP/syft" version

.github/workflows/supply-chain.yml

@@ -78,9 +78,9 @@ jobs:
           "$python" -m pip --isolated check >"$output/pip-check.stdout" 2>"$output/pip-check.stderr"
       - name: Install checksum-verified pinned syft
         env:
-          SYFT_VERSION: '1.52.0'
-          # https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_checksums.txt (fetched 2026-09-22)
-          SYFT_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d
+          SYFT_VERSION: '1.54.0'
+          # https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_checksums.txt (fetched and rehashed 2026-10-03)
+          SYFT_SHA256: 54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860
         run: |
           mkdir -p "$RUNNER_TEMP/syft"
           curl --fail --silent --show-error --location --retry 3 \
@@ -130,7 +130,7 @@ jobs:
               by_severity[severity] = by_severity.get(severity, 0) + 1
           spdx = json.loads((scan_root / "sbom/venv.spdx.json").read_text())
           summary = {
-              "syft_version": "1.52.0",
+              "syft_version": "1.54.0",
               "grype_version": "0.119.0",
               "grype_db_status": (scan_root / "sbom/grype-db-status.txt").read_text().strip(),
               "package_count": len(spdx.get("packages", [])),

adoption/bootstrap.md

@@ -173,6 +173,17 @@ GitHub-hosted macOS runner; see
    retain the host failures and limits. Darwin artifacts are
    artifact-checked only; the Mac host collects its own execution evidence.
 
+   On 2026-10-03, `pins-linux-x86_64.json` changed again after `v2026.09.26.2`:
+   `orx` 0.2.7 to 0.2.15 (URLs, hashes and install notes). The file is also
+   changed after `v2026.10.05.1`, which still pins 0.2.7, so a host at either
+   tag retains OpenResearch 0.2.7. W1 held the mcporter 0.14.2 candidate on
+   2026-10-03 because its resolved tree was inconsistent and its persistent
+   daemon/`serve` role was unqualified; the selected Linux pin then remained
+   0.14.1. Main's 2026-10-04 move in #693 selected Linux mcporter 0.14.2; see
+   [that receipt's limitations](../evidence/receipts/mcporter-0142-qualification-20261004.json).
+   The W1 scratch qualification and its functional limits remain dated history
+   in [the decision](../docs/decisions/2026-10-03-currency-wave-w1.md).
+
    `pins-linux-x86_64.json` and `adoption/bootstrap-linux.sh` changed after `v2026.09.25.2`.
    The Linux pins file gained `repomix`, `toon`,
    `headroom`, `ccusage`, `serena` and `socraticode`, taking the `token-efficiency` row's
@@ -406,9 +417,9 @@ GitHub-hosted macOS runner; see
    UV_TOOL_DIR="$eco/python-tools" UV_TOOL_BIN_DIR="$eco/bin" \
      uv tool install --python 3.13 git+https://github.com/oraios/serena@c6fbd1c5932df2494ffa0020af5a9fbe80b82143
    UV_TOOL_DIR="$eco/python-tools" UV_TOOL_BIN_DIR="$eco/bin" \
-     uv tool install --python 3.13 jcodemunch-mcp==1.108.319
+     uv tool install --python 3.13 jcodemunch-mcp==1.108.327
    "$eco/bin/serena" --version           # Serena 2.0.0.dev0
-   "$eco/bin/jcodemunch-mcp" --version   # jcodemunch-mcp 1.108.319
+   "$eco/bin/jcodemunch-mcp" --version   # jcodemunch-mcp 1.108.327
    ```
    Then run the installer:
    ```sh
@@ -607,6 +618,35 @@ GitHub-hosted macOS runner; see
    claude plugin marketplace add openai/codex-plugin-cc@v1.0.6 --scope user
    claude plugin install codex@openai-codex --scope user --json
    ```
+
+   **Upgrade an existing claude-hud 0.8.0 installation:** first apply the
+   template's `extraKnownMarketplaces.claude-hud.source.ref` value `v0.10.0`
+   in the host's user settings, retaining the other marketplace declarations.
+   [The loading reference](https://code.claude.com/docs/en/plugins/loading#plugins-and-marketplaces-that-arent-on-disk-at-session-start)
+   documents re-fetching a changed declared source at the next native session
+   start. Let that synchronization finish before updating. A marketplace
+   refresh follows its configured tag; it does not advance a source that still
+   names `v0.8.0` ([CLI reference](https://code.claude.com/docs/en/plugins/cli-reference#plugin-marketplace-update)).
+   Then refresh the retargeted marketplace and update the installed plugin:
+   ```sh
+   claude plugin marketplace update claude-hud
+   claude plugin update claude-hud@claude-hud --scope user
+   ```
+   These are separate steps: the shell marketplace command refreshes the
+   listing, and the plugin command updates the installed plugin
+   ([Update plugins now](https://code.claude.com/docs/en/plugins/install#update-plugins-now)).
+   Restart Claude Code or run `/reload-plugins`, then use the revision check
+   below to compare the installed `gitCommitSha` with `75683c6de1ac07f6bbef00d739001679dba0740c`.
+   Status: **documented, host verification pending**. R642b checked the native
+   2.1.288 command help with both `HOME` and `CLAUDE_CONFIG_DIR` in temporary
+   directories; it did not execute a marketplace or plugin update. A safe
+   offline reproduction of the GitHub-tag transition remains unverified.
+   Main's [2026-10-04 host receipt and limitations](../evidence/receipts/claude-hud-0100-qualification-20261004.json)
+   record the observed path after a tagged marketplace add failed on the old
+   source entry: the host ran `claude plugin marketplace remove claude-hud`,
+   repeated the tagged add and ran `claude plugin install claude-hud@claude-hud --scope user --json`
+   successfully; W1's marketplace-update/plugin-update path above remains unverified.
+
    Then compare the `gitCommitSha` that landed with the reviewed revisions in
    those rows (the check reads `$CLAUDE_CONFIG_DIR` when it is set, as Claude
    Code does). `context-mode`, installed from the default branch, also passes

adoption/manifest.json

@@ -158,7 +158,7 @@
     "nextjs": "blueprints/convergence-practice/application-delivery/README.md",
     "ntfy": "observability/backends/README.md",
     "omniroute": "docs/foundation-stack.md",
-    "openresearch": "recipes/native-upgrades-20260921.md",
+    "openresearch": "recipes/README.md",
     "opentelemetry-collector-contrib": "observability/README.md",
     "otel-tui": "recipes/README.md",
     "pandas": "blueprints/us-equities/nanosecond-replay/README.md",
@@ -181,12 +181,12 @@
     "skfolio": "blueprints/us-equities/research-evaluation/README.md",
     "skills-ref": "recipes/README.md",
     "socraticode": "recipes/README.md",
-    "syft": "blueprints/us-equities/supply-chain/README.md",
+    "syft": "recipes/README.md",
     "systemd": "blueprints/us-equities/worker-supervision/README.md",
     "tavily-cli": "recipes/tavily.md",
     "toon": "recipes/README.md",
     "vllm": "recipes/README.md",
-    "worktrunk": "recipes/native-upgrades-20260921.md",
+    "worktrunk": "recipes/README.md",
     "zizmor": "blueprints/convergence-practice/ci-security/README.md"
   },
   "profiles": [