Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held)

.github/workflows/catalog-freshness.yml

@@ -116,7 +116,7 @@ jobs:
             for spec in \
               "actionlint|kjanat/actionlint|1.17.0" \
               "gitleaks|gitleaks/gitleaks|8.30.1" \
-              "syft|anchore/syft|1.52.0" \
+              "syft|anchore/syft|1.54.0" \
               "zizmor|zizmorcore/zizmor|1.30.1" \
               "grype|anchore/grype|0.119.0" \
               "nautilus_trader|nautechsystems/nautilus_trader|2.0.0rc5"; do

.github/workflows/publish-catalog.yml

@@ -96,19 +96,19 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          syft_dir="$RUNNER_TEMP/syft-1.52.0"
+          syft_dir="$RUNNER_TEMP/syft-1.54.0"
           mkdir -p "$syft_dir"
           curl --fail --location --show-error --silent --retry 3 --proto '=https' --tlsv1.2 \
-            'https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_checksums.txt' \
+            'https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_checksums.txt' \
             --output "$syft_dir/checksums.txt"
           curl --fail --location --show-error --silent --retry 3 --proto '=https' --tlsv1.2 \
-            'https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_linux_amd64.tar.gz' \
+            'https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_linux_amd64.tar.gz' \
             --output "$syft_dir/syft.tar.gz"
-          expected="$(grep '  syft_1.52.0_linux_amd64.tar.gz$' "$syft_dir/checksums.txt" | awk '{print $1}')"
+          expected="$(grep '  syft_1.54.0_linux_amd64.tar.gz$' "$syft_dir/checksums.txt" | awk '{print $1}')"
           test -n "$expected"
           printf '%s  %s\n' "$expected" "$syft_dir/syft.tar.gz" | sha256sum --check --status
-          # Pinned and independently re-verified 2026-09-22 against the upstream checksums file.
-          test "$expected" = 'caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d'
+          # Pinned and independently re-verified 2026-10-03 against the upstream checksums file.
+          test "$expected" = '54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860'
           tar -xzf "$syft_dir/syft.tar.gz" -C "$syft_dir" syft
           install -m 0755 "$syft_dir/syft" "$RUNNER_TEMP/syft"
           "$RUNNER_TEMP/syft" version

.github/workflows/supply-chain.yml

@@ -75,9 +75,9 @@ jobs:
           "$python" -m pip --isolated check >"$output/pip-check.stdout" 2>"$output/pip-check.stderr"
       - name: Install checksum-verified pinned syft
         env:
-          SYFT_VERSION: '1.52.0'
-          # https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_checksums.txt (fetched 2026-09-22)
-          SYFT_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d
+          SYFT_VERSION: '1.54.0'
+          # https://github.com/anchore/syft/releases/download/v1.54.0/syft_1.54.0_checksums.txt (fetched and rehashed 2026-10-03)
+          SYFT_SHA256: 54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860
         run: |
           mkdir -p "$RUNNER_TEMP/syft"
           curl --fail --silent --show-error --location --retry 3 \
@@ -127,7 +127,7 @@ jobs:
               by_severity[severity] = by_severity.get(severity, 0) + 1
           spdx = json.loads((scan_root / "sbom/venv.spdx.json").read_text())
           summary = {
-              "syft_version": "1.52.0",
+              "syft_version": "1.54.0",
               "grype_version": "0.119.0",
               "grype_db_status": (scan_root / "sbom/grype-db-status.txt").read_text().strip(),
               "package_count": len(spdx.get("packages", [])),

adoption/bootstrap.md

@@ -165,6 +165,8 @@ GitHub-hosted macOS runner; see
    `pins-linux-x86_64.json` (the rtk and headroom `install_note` text and its `claude-code` entry, 2.1.281 at that tag and 2.1.284 on main) and `adoption/bootstrap-linux.sh` changed after `v2026.09.26`: its rtk config reminder now also asks the installed `rtk hook check`; `install_npm` now adds `--ignore-scripts` for a pin with `ignore_scripts: true` (socraticode), a field the tag's script ignores, so there npm runs every install script in socraticode's dependency tree; and `install_uv_tool` now downloads a uv-tool pin's wheel `url` (headroom), verifies its `sha256` before uv runs and installs that file as `'headroom-ai[mcp] @ file://<percent-encoded path>'`, where the tag's script resolves `headroom-ai[mcp]==0.37.0` from the index and never reads the wheel or its hash (the markitdown and tavily-cli sdist hashes stay cross-checks).
    `pins-linux-x86_64.json` changed after `v2026.09.26.2` in its `codex` entry: 0.155.1 moves to 0.159.2 (URL, hashes and note; 0.157.1 from 2026-09-26, 0.159.2 from 2026-09-30), so a host at that tag installs 0.155.1, and in its `claude-code` entry: 2.1.281 moves to 2.1.284 (URL, hashes and note), so a host at that tag installs 2.1.281. `adoption/templates/codex.config.template.toml` changed after the same tag to set `daemon_auto_start = false`: 0.157.1's first interactive launch otherwise installs a self-updating app-server daemon (see `evidence/receipts/codex-01571-qualification-20260926.json`; 0.159.2 still lists the feature as stable and on, `evidence/receipts/codex-01592-qualification-20260930.json`). It changed again on 2026-09-30 to default to `gpt-6.1-sol`, which Codex's bundled model catalog carries from `rust-v0.159.1` on (0.157.1's has no such entry). The macOS pin stays at 0.155.1: macOS needs its own 0.159.x qualification before the template default applies there.
 
+   On 2026-10-03, `pins-linux-x86_64.json` changed again after `v2026.09.26.2`: `mcporter` 0.14.1 to 0.14.2 and `orx` 0.2.7 to 0.2.15 (URLs, hashes and install notes). A host at that tag retains 0.14.1 and 0.2.7. The W1 scratch qualification and its functional limits are in [the dated decision](../docs/decisions/2026-10-03-currency-wave-w1.md). The Claude HUD marketplace recipe and template now select v0.10.0 at `75683c6de1ac07f6bbef00d739001679dba0740c`; hosts at the tag keep v0.8.0.
+
    `pins-linux-x86_64.json` and `adoption/bootstrap-linux.sh` changed after `v2026.09.25.2`.
    The Linux pins file gained `repomix`, `toon`,
    `headroom`, `ccusage`, `serena` and `socraticode`, taking the `token-efficiency` row's
@@ -394,9 +396,9 @@ GitHub-hosted macOS runner; see
    UV_TOOL_DIR="$eco/python-tools" UV_TOOL_BIN_DIR="$eco/bin" \
      uv tool install --python 3.13 git+https://github.com/oraios/serena@c6fbd1c5932df2494ffa0020af5a9fbe80b82143
    UV_TOOL_DIR="$eco/python-tools" UV_TOOL_BIN_DIR="$eco/bin" \
-     uv tool install --python 3.13 jcodemunch-mcp==1.108.319
+     uv tool install --python 3.13 jcodemunch-mcp==1.108.327
    "$eco/bin/serena" --version           # Serena 2.0.0.dev0
-   "$eco/bin/jcodemunch-mcp" --version   # jcodemunch-mcp 1.108.319
+   "$eco/bin/jcodemunch-mcp" --version   # jcodemunch-mcp 1.108.327
    ```
    Then run the installer:
    ```sh
@@ -578,7 +580,7 @@ GitHub-hosted macOS runner; see
    ```sh
    claude plugin marketplace add mksglu/context-mode --scope user
    claude plugin install context-mode@context-mode --scope user --json
-   claude plugin marketplace add jarrodwatts/claude-hud@v0.8.0 --scope user
+   claude plugin marketplace add jarrodwatts/claude-hud@v0.10.0 --scope user
    claude plugin install claude-hud@claude-hud --scope user --json
    claude plugin marketplace add openai/codex-plugin-cc@v1.0.6 --scope user
    claude plugin install codex@openai-codex --scope user --json
@@ -593,9 +595,9 @@ GitHub-hosted macOS runner; see
    ```sh
    python3 - <<'EOF'
    import json, os, pathlib, re, subprocess
-   reviewed = {  # recipes/README.md rows: context-mode, claude-hud (tag v0.8.0), codex-for-claude
+   reviewed = {  # recipes/README.md rows: context-mode, claude-hud (tag v0.10.0), codex-for-claude
        "context-mode@context-mode": "6f0cc6841c687e754059f36714a11233fda1a02b",
-       "claude-hud@claude-hud": "ef5f1c8b167572ad1443c70629763ea8780af96b",
+       "claude-hud@claude-hud": "75683c6de1ac07f6bbef00d739001679dba0740c",
        "codex@openai-codex": "db52e28f4d9ded852ab3942cea316258ae4ef346",
    }
    by_content = {"context-mode@context-mode": "mksglu/context-mode"}  # default-branch install, no ref

adoption/pins-linux-x86_64.json

@@ -129,11 +129,11 @@
     },
     {
       "id": "mcporter",
-      "version": "0.14.1",
+      "version": "0.14.2",
       "kind": "npm",
-      "url": "https://registry.npmjs.org/mcporter/-/mcporter-0.14.1.tgz",
-      "sha256": "8e489864d7118863f516d0d22ca1d43b862b9d93228489c39617c2c130d810f2",
-      "install_note": "npm dist.integrity sha512-/6pvMjFPlCtFU3NhzWEV8vj2EwvbY2nisc8XYDwtPiyApj8v6A+B0Va5ul018oqSEkw7BiKCLoazBc4l+8QsdQ== matched, and the sha256 above equals the GitHub release v0.14.1 asset digest and its checksums.txt (checked 2026-09-25); `npm audit signatures` verified the registry signatures and mcporter's SLSA provenance (release.yml at refs/tags/v0.14.1, commit 93e0916cafe2d624b94271e31b75ca681a016514). `npm install --global --prefix tools/mcporter-0.14.1 mcporter@0.14.1`, matching recipes/README.md. Requires Node >=24, and `ps` on the PATH of whatever launches the mcporter daemon: 0.14.x runs `ps` from PATH (0.13.13 ran /bin/ps), and without it the daemon cannot connect keep-alive servers and `mcporter daemon stop` refuses. Qualified against 0.13.13 and switched on nativestack-5975wx-20260925 (evidence/receipts/mcporter-0141-qualification-20260925.json); that is one host's state, not evidence about any other Linux host.",
+      "url": "https://registry.npmjs.org/mcporter/-/mcporter-0.14.2.tgz",
+      "sha256": "f5baa5a02be64d5d75722c5739975eee79d393eb2761496f70a53474688f8f6b",
+      "install_note": "2026-10-03 W1 scratch qualification. Checked against four published sources, all matched. (1) npm registry dist.integrity sha512-3ajjKzPLe/39hN582XqMuOw3S9vHQfLpSBq72zVakT03xso3GDXHcht/eVLu/l2MDqulIOtLevnTKreUxymHJQ== equals `openssl dgst -sha512 -binary | base64` of the downloaded tarball, and dist.shasum ee7d91e7362e7dc5b44b5fcc5cfdea7cfaedb1fd equals sha1sum. (2) GitHub release v0.14.2 asset digest sha256:f5baa5a02be64d5d75722c5739975eee79d393eb2761496f70a53474688f8f6b for mcporter-0.14.2.tgz equals the local sha256sum; the release checksums.txt line matches (sha256sum -c: OK, exit 0); the release asset is byte-identical to the npm tarball (cmp exit 0); size 3585823 bytes. (3) npm SLSA provenance attestation (https://registry.npmjs.org/-/npm/v1/attestations/mcporter@0.14.2): subject sha512 dda8e32b...8725 equals the tarball sha512 hex, workflow .github/workflows/release.yml at refs/tags/v0.14.2, gitCommit aa0f55f9bffcde9d2070c86145f37d4dd3525f6c; the release provenance.json asset also names commit aa0f55f9 and the tgz sha256. (4) `npm audit signatures` exit 0: audited 40 packages, 40 verified registry signatures, 12 verified attestations. Receipt: evidence/receipts/mcporter-0142-qualification-20261003.json. This is isolated qualification evidence, not a host installation switch. Supported installation: npm install --global --prefix tools/mcporter-0.14.2 mcporter@0.14.2. Requires Node >=24 and ps on the daemon launcher PATH. Bundled client 2.2.0 is covered by the archive hash; other dependency ranges resolve at install time. The ad-hoc stdio canary passed; daemon and serve behavior remain unqualified.",
       "version_probe": {
         "method": "exec",
         "command": "mcporter",
@@ -201,11 +201,11 @@
     },
     {
       "id": "orx",
-      "version": "0.2.7",
+      "version": "0.2.15",
       "kind": "tarball",
-      "url": "https://github.com/alphaXiv/OpenResearch/releases/download/v0.2.7/openresearch-cli-x86_64-unknown-linux-musl.tar.xz",
-      "sha256": "c0f8c7488cc3ff028e6757ee54957911f754ea3cd80e239e12f7a47a88884d63",
-      "install_note": "2026-09-23 catalog-winner-but-unpinned gap: the host that recorded PR #139 (docs/decisions/2026-09-23-claude-user-profile.md) had OpenResearch's `orx` CLI 0.2.7 installed on 2026-09-23 (confirmed there with `orx --version`; alphaXiv/OpenResearch, the local-first research-agent workspace). That is one host's state, not evidence about any other Linux host. Archive re-downloaded and sha256-hashed independently; matches the release's own `openresearch-cli-x86_64-unknown-linux-musl.tar.xz.sha256` sidecar (`gh api repos/alphaXiv/OpenResearch/releases/tags/v0.2.7`, read 2026-09-23) exactly. `tar -tJf` lists exactly one top-level directory containing `orx`, `README.md` and `LICENSE`, matching `install_single_binary_tarball`'s convention of finding a single file literally named `orx` in the extracted tree.",
+      "url": "https://github.com/alphaXiv/OpenResearch/releases/download/v0.2.15/openresearch-cli-x86_64-unknown-linux-musl.tar.xz",
+      "sha256": "f36ed4095f4839767a162a555d9e7eafc04f70f0664ce3767178f81fc0b45c86",
+      "install_note": "2026-10-03 W1 scratch qualification. https://github.com/alphaXiv/OpenResearch/releases/download/v0.2.15/openresearch-cli-x86_64-unknown-linux-musl.tar.xz.sha256 (release-published sidecar; `sha256sum -c` printed OK, exit 0). Same hash also in the release's sha256.sum line 5 (`sha256sum -c --ignore-missing` OK, exit 0) and in the GitHub API asset digest sha256:f36ed409... (gh api repos/alphaXiv/OpenResearch/releases/tags/v0.2.15); size 11890208 bytes matches the API size. Receipt: evidence/receipts/openresearch-0215-qualification-20261003.json. This is isolated qualification evidence, not a host installation switch.",
       "version_probe": {
         "method": "exec",
         "command": "orx",