Skip to content

New WSL builder: token layer wired by default on the owner's 2026-10-04 directive - #684

Merged
seathatflowsinourveins merged 33 commits into
mainfrom
c5/token-layer-2604
Oct 5, 2026
Merged

New WSL builder: token layer wired by default on the owner's 2026-10-04 directive#684
seathatflowsinourveins merged 33 commits into
mainfrom
c5/token-layer-2604

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Oct 4, 2026

Copy link
Copy Markdown
Owner

Scope

  • What this PR changes: it changes the client configuration that the builder (tools/adoption/new_wsl_client_config.py) writes for NativeStack2604. The token layer is now wired by default: rtk, the SubagentStart token-lane carrier, the Claude Code currency notice and agent teams. Each piece follows the owner's 2026-10-04 directive, recorded in a new dated decision record. Nothing is applied to the host.
  • Base commit: f77a35eb2bf30bc4bf6f3b4ee51bc9ce5397b4c5
  • Lane: lane:foundation
  • Owned paths touched:
    • adoption/new-wsl/client-config-map.json
    • adoption/new-wsl/templates/claude.settings.additions.json
    • adoption/new-wsl/{claude,codex}-user-instructions.md (regenerated by --write-blocks)
    • tools/adoption/new_wsl_client_config.py
    • tests/test_new_wsl_client_config.py
    • docs/decisions/2026-10-02-new-wsl-client-configuration.md (counts sentence and generated tables)
    • docs/decisions/2026-10-04-new-wsl-token-layer-default.md (new)

What gets wired:

Piece Before Now
RTK_TELEMETRY_DISABLED (Claude Code env, Codex shell_environment_policy.set), the PreToolUse Bash hook rtk hook claude, and six Bash(rtk git push … -f/--force …) deny rules slot context-supply installs context-mode, not rtk slot:context-supply with the new directive field
SubagentStart token-lanes-subagent-start.py and its six blocks not_wired (code-search ruling, change 7) practice, byte-pinned by adoption/hooks/claude/SHA256SUMS
Claude Code SessionStart currency-due-notice.py not_wired (no timer) practice; it prints once the stack-currency timer runs
CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 absent practice, in the 2604-only additions file
Codex instruction block RTK section filtered out RTK section restored (upstream text, verbatim)

How the directive field works:

  • A slot entry may name the dated record of an owner's directive. The entry's owner is then wired beside what the slot installs, but only while the slot installs anything, so it unwires with the slot.
  • --check fails when the record is not a file of the repository.
  • The definitive manifest is unchanged, so the handbook and the profile that c5/new-wsl-codex-0160 regenerates are not touched.

Left unchanged:

  • The copies of RTK_TELEMETRY_DISABLED inside Codex MCP server tables now follow their server's own entry. A server that is not wired therefore never gets a table holding only that variable.
  • The Codex hooks.json pieces stay unwired. ai-memory's own install-hooks writes that file, so this builder would be a second writer.
  • The Codex role carriers stay unwired. Their reason is restated: the filtered researcher copy now keeps the three rules but not its pinned hash.
  • context-mode's marketplace stays unpinned. A marketplace source has no sha, and tag v1.0.169 is 133 commits behind the interim pin 6f0cc684. The 2604 cache commit 9f3ecc8b differs from 6f0cc684 only in stats.json, which the interim pin allows.

SOTA sources

Evidence-class table

Claim Evidence class Command / receipt
The builder wires the token-layer pieces: 386 pieces, 315 wired, 59 not wired, 12 authorization local_integration python3 tools/adoption/new_wsl_client_config.py --check (exit 0)
The render carries the rtk hook, the deny rules, both env variables, the SubagentStart hook and the currency notice local_integration tests.test_new_wsl_client_config (160 tests, OK)
A directive unwires with its slot, needs its record, and is refused on a non-slot entry synthetic (scratch catalog) test_a_directive_adds_its_owner_while_the_slot_installs_and_needs_its_record
Agent teams are enabled by the env variable source_review code.claude.com/docs/en/agent-teams
A marketplace source cannot pin a commit source_review code.claude.com/docs/en/plugins/marketplace-reference
The 2604 context-mode cache is within the interim pin source_review gh api repos/mksglu/context-mode/compare/6f0cc684...9f3ecc8b0aaf (ahead 21, files stats.json)
Token saving not claimed Harbor 2026-09-30: no cost reduction for any tool; the subagent regime is unmeasured (catalogs/foundation/new-wsl-architecture-20261001.json L745-L749)

Local commands run

$ python3 tools/adoption/new_wsl_client_config.py --check
exit 0; pieces: 386; wired: 315; not wired: 59; authorization: 12
$ python3 -m unittest tests.test_new_wsl_client_config
exit 0; Ran 160 tests, OK
$ python3 -m unittest tests.test_install_claude_profile
exit 0; Ran 79 tests
$ python3 -m unittest tests.test_render_config
exit 0; Ran 36 tests, OK
$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9864, "profiles": 4, "receipts": 195, "status": "passed"}
$ python3 -m unittest tests.test_bootstrap_full_profile tests.test_codex_agents tests.test_currency_due_notice tests.test_new_wsl_definitive_defaults tests.test_catalog_freshness_runtime tests.test_landscape_sweep_harness tests.test_freeze_snapshot tests.test_task_model_routing tests.test_wsl_new_distro_recipe tests.test_token_lanes_subagent_start   (run one module at a time)
each exit 0

No file under evidence/ changed, so manifests/evidence.json needs no edit.

Decision record

docs/decisions/2026-10-04-new-wsl-token-layer-default.md. It quotes the owner's directive verbatim and supersedes the 2026-10-02 not-wired rulings for the named pieces only. It claims no saving. The decider is the preregistered multi-agent fresh-session comparison: its F-token arm, scored by docs/decisions/2026-10-01-new-wsl-definitive-defaults.md L171. The record also lists the apply steps, which were not run here.

Coordination: this PR and c5/new-wsl-codex-0160 both change the counts sentence of the 2026-10-02 record. Whichever lands second recounts with --check and regenerates the tables with --check --markdown. This PR edits no map key that the other branch edits (the Codex trust entry and the model).

Host evidence

Not applicable: no file under evidence/hosts/ changed.

Checklist

  • New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). (None changed.)
  • New/changed workflows declare top-level permissions: contents: read. (None changed.)
  • No secrets are printed, logged or committed; no new required secret was added without a documented owner.
  • No new paid hosting, subscription or billing surface was introduced.
  • Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 4, 2026
seathatflowsinourveins pushed a commit that referenced this pull request Oct 4, 2026
Scout @claude
New-WSL token layer: persist RTK and Context Hub configuration, regis…
0e01bec 
…ter jCodeMunch per project, restore the directive-branch test

The four findings of the independent read of #684 (0 P1, 3 P2, 1 P3), each from an upstream-documented field:

- F1 jCodeMunch is registered per project, never at user scope (docs/token-session-handbook.md, adoption/bootstrap.md
  "jCodeMunch, per project"): the user-scope Claude and Codex additions and their map entry are gone; the code-index
  row still installs the console script. Four project agents name its tools, which the record's gap table now lists.
- F2 RTK [hooks] exclude_commands (the recipe's five entries) is written by command-output() to
  ${XDG_CONFIG_HOME:-~/.config}/rtk/config.toml, an existing file kept; the acceptance is version-neutral ($e/bin/rtk
  hook check, no version string for the new lines).
- F3 Context Hub telemetry:false and feedback:false are written by api-docs() to ${CHUB_DIR:-~/.chub}/config.yaml, an
  existing file kept; the acceptance asks upstream's own isTelemetryEnabled()/isFeedbackEnabled() with CHUB_* unset.
- F4 the directive branch has a positive test again (a slot that installs a different owner keeps the entry's
  directive; without the directive the piece is not wired); three PlanConfigurationTests run the two writes and
  check_plan.py in scratch homes.

Counts: 390 pieces, 343 wired, 34 not wired, 13 authorization (with the carrier hold-out of the commit before).
Native demonstration on rtk 0.51.0 and Context Hub 0.1.4 (scratch config dirs): the four excluded commands rewrite
before the config (rc 0) and exit 1 "No rewrite for" after it, git status rewrites in both; Context Hub reports
telemetry=true feedback=true without config.yaml and false/false with it, acceptance exit 0.
The repair worker (Sol max) stopped at its deadline with the work unverified; the verification is the coordinator's.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the c5/token-layer-2604 branch 3 times, most recently from 316abe3 to 45a0c43 Compare October 4, 2026 18:22
seathatflowsinourveins pushed a commit that referenced this pull request Oct 4, 2026
Scout @claude
New-WSL token layer: persist RTK and Context Hub configuration, regis…
61d05cd 
…ter jCodeMunch per project, restore the directive-branch test

The four findings of the independent read of #684 (0 P1, 3 P2, 1 P3), each from an upstream-documented field:

- F1 jCodeMunch is registered per project, never at user scope (docs/token-session-handbook.md, adoption/bootstrap.md
  "jCodeMunch, per project"): the user-scope Claude and Codex additions and their map entry are gone; the code-index
  row still installs the console script. Four project agents name its tools, which the record's gap table now lists.
- F2 RTK [hooks] exclude_commands (the recipe's five entries) is written by command-output() to
  ${XDG_CONFIG_HOME:-~/.config}/rtk/config.toml, an existing file kept; the acceptance is version-neutral ($e/bin/rtk
  hook check, no version string for the new lines).
- F3 Context Hub telemetry:false and feedback:false are written by api-docs() to ${CHUB_DIR:-~/.chub}/config.yaml, an
  existing file kept; the acceptance asks upstream's own isTelemetryEnabled()/isFeedbackEnabled() with CHUB_* unset.
- F4 the directive branch has a positive test again (a slot that installs a different owner keeps the entry's
  directive; without the directive the piece is not wired); three PlanConfigurationTests run the two writes and
  check_plan.py in scratch homes.

Counts: 390 pieces, 343 wired, 34 not wired, 13 authorization (with the carrier hold-out of the commit before).
Native demonstration on rtk 0.51.0 and Context Hub 0.1.4 (scratch config dirs): the four excluded commands rewrite
before the config (rc 0) and exit 1 "No rewrite for" after it, git status rewrites in both; Context Hub reports
telemetry=true feedback=true without config.yaml and false/false with it, acceptance exit 0.
The repair worker (Sol max) stopped at its deadline with the work unverified; the verification is the coordinator's.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the c5/token-layer-2604 branch 3 times, most recently from 727b922 to 31b1b94 Compare October 4, 2026 19:22
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 4, 2026
Merged
4 tasks done
seathatflowsinourveins pushed a commit that referenced this pull request Oct 4, 2026
Scout @claude
New-WSL token layer: persist RTK and Context Hub configuration, regis…
26e3425 
…ter jCodeMunch per project, restore the directive-branch test

The four findings of the independent read of #684 (0 P1, 3 P2, 1 P3), each from an upstream-documented field:

- F1 jCodeMunch is registered per project, never at user scope (docs/token-session-handbook.md, adoption/bootstrap.md
  "jCodeMunch, per project"): the user-scope Claude and Codex additions and their map entry are gone; the code-index
  row still installs the console script. Four project agents name its tools, which the record's gap table now lists.
- F2 RTK [hooks] exclude_commands (the recipe's five entries) is written by command-output() to
  ${XDG_CONFIG_HOME:-~/.config}/rtk/config.toml, an existing file kept; the acceptance is version-neutral ($e/bin/rtk
  hook check, no version string for the new lines).
- F3 Context Hub telemetry:false and feedback:false are written by api-docs() to ${CHUB_DIR:-~/.chub}/config.yaml, an
  existing file kept; the acceptance asks upstream's own isTelemetryEnabled()/isFeedbackEnabled() with CHUB_* unset.
- F4 the directive branch has a positive test again (a slot that installs a different owner keeps the entry's
  directive; without the directive the piece is not wired); three PlanConfigurationTests run the two writes and
  check_plan.py in scratch homes.

Counts: 390 pieces, 343 wired, 34 not wired, 13 authorization (with the carrier hold-out of the commit before).
Native demonstration on rtk 0.51.0 and Context Hub 0.1.4 (scratch config dirs): the four excluded commands rewrite
before the config (rc 0) and exit 1 "No rewrite for" after it, git status rewrites in both; Context Hub reports
telemetry=true feedback=true without config.yaml and false/false with it, acceptance exit 0.
The repair worker (Sol max) stopped at its deadline with the work unverified; the verification is the coordinator's.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 4, 2026
Scout @claude
Refresh PR #684 token pins after PR #693
0e9f61f 
Align the new WSL RTK owner row, verified Linux asset, install/acceptance
scripts and profile with main's 0.51.0 pin. Retain the exact five-entry
hooks configuration required by bootstrap. Align the mcporter profile with
0.14.2 and verify that the claude-hud row already uses 0.10.0.

Regenerate the manifest, client instruction blocks and handbook; replace
receipt digests without reformatting it and recount the client record.
Repair citations into all 42 files changed by PR #693, preserving original
sources for the dated architecture pins. Record the failed attempt and its
corrections in the install-plan validation notes.

Validation: all 780 requested unittest cases pass, with five skips. Client
configuration, plan consistency, handbook and diff checks pass. All 30
convergence records pass native positional validation. The all-recorded
discovery check and publication validator await the coordinator's evidence
registry refresh; publication failures are registry drift only. Leave the
separate RTK grep exactness control untouched.

Sources:
https://github.com/rtk-ai/rtk/releases/tag/v0.51.0
https://github.com/rtk-ai/rtk/releases/download/v0.51.0/checksums.txt
https://github.com/openclaw/mcporter/releases/tag/v0.14.2
https://registry.npmjs.org/mcporter/0.14.2
https://github.com/jarrodwatts/claude-hud/releases/tag/v0.10.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout and others added 16 commits October 4, 2026 16:58
Scout @claude
New WSL builder: wire the token layer by default on the owner's 2026-…
f383c41 
…10-04 directive

NativeStack2604's client configuration now carries the token layer:
- rtk: RTK_TELEMETRY_DISABLED (Claude env, Codex shell set tables), the
  PreToolUse Bash hook `rtk hook claude`, the six rtk force-push deny rules,
  and the Codex instruction block's RTK section (rtk-ai/rtk v0.50.0
  hooks/rtk-awareness-full.md, verbatim).
- the SubagentStart token-lane carrier (hook and six blocks, byte-pinned).
- the Claude Code session-start currency notice.
- CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 (code.claude.com agent-teams).

The builder gains a `directive` field for slot entries: the dated record
of the owner's directive adds the entry's owner beside what the slot
installs, only while the slot installs anything; --check fails when the
record is not a file. rtk's MCP-server env copies follow their server.
docs/decisions/2026-10-04-new-wsl-token-layer-default.md quotes the
directive, supersedes the 2026-10-02 not-wired rulings for these pieces,
claims no saving, and names the F-token arm as what decides it. The
2026-10-02 record's counts sentence and tables are recounted
(386 pieces, 315 wired, 59 not wired, 12 authorization).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
2026-10-02 client-configuration record: addendum pointing to the 2026…
4705a30 
…-10-04 token-layer record

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Main-session token-lane carrier: SessionStart hook, block, template g…
7d78e69 
…roup and installer entries

The SubagentStart carrier reaches subagents only. This adds its main-session counterpart:

- adoption/hooks/claude/token-lanes-session-start.py, modeled line for line on
  token-lanes-subagent-start.py (stdlib, fail-open, unbuffered write, exit 0), returns its sibling
  token-lanes-block.main.md as SessionStart additionalContext; blind-* and the subagent carrier's
  silent roles get nothing.
- token-lanes-block.main.md (1,842 bytes, budget 2,600): choose the lane first, Read only to Edit or
  for small verbatim files, ctx_execute_file/ctx_execute with intent then ctx_search, qmd for
  catalog docs, ctx_batch_execute for large output, RTK scope, delegation, code and memory lanes if
  exposed, one lane per artifact, savings only from client counters. It adds the ToolSearch line that
  context-mode 1.0.169 gives only Agent-tool prompts (sessionstart.mjs L49, routing.mjs L892-907 at
  589d8214).
- claude.settings.template.json: one SessionStart group after the currency notice, matcher
  startup|resume|clear|compact|fork (every source code.claude.com/docs/en/hooks documents; fork is
  separate since v2.1.214 and re-runs SessionStart hooks), timeout 5.
- install_claude_profile.py HOOKS and SHA256SUMS list both files; tests cover the hook contract,
  the text, the registration and the installed command; handbook section and decision addendum.

Advisory only: context-mode's Read/Grep PreToolUse guidance stays advisory (routing.mjs L843-872)
and RTK's hook covers Bash only (README v0.50.0 L153, L368).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL builder map: wire the main-session carrier pieces, recompute …
342028c 
…the record's counts and tables

The SessionStart carrier of unit U1 added three pieces that the map did not know, so
`new_wsl_client_config.py --check` exited 1 with three unmapped pieces. They join the token-lane carrier entry
(same wiring and owner directive as the SubagentStart carrier): the SessionStart hook, its main-session block and
its script. The counts and tables of the 2026-10-02 record are recomputed from `--check` on this tree (389 pieces,
318 wired, 58 not wired, 13 authorization), adoption/bootstrap.md names the SessionStart carrier in both carrier
paragraphs, and two builder-test expectations follow the one additional wired hook command (5 to 6 commands, and
token-lanes-session-start.py in the set of hook files the repository copies with its checksum).

Checks at this commit: new_wsl_client_config.py --check exit 0; unittest tests.test_new_wsl_client_config
tests.test_install_claude_profile tests.test_render_config tests.test_token_lanes_session_start
tests.test_token_lanes_subagent_start tests.test_adoption_docs_consistency tests.test_wsl_new_distro_recipe
tests.test_new_wsl_definitive_defaults: 540 tests OK (5 skipped). Local integration checks, not upstream tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL wave 3: the owner's token-efficiency decision as amendment 4 …
e6c5963 
…of the manifest's rule

- docs/decisions/2026-10-04-token-full-stack-owner-default.md: the owner's order
  verbatim, its authority path, the rows it overturns by file:line, the
  alternatives and the comparison that would remove each component, and the
  measured limits of #627 kept as usage rules. Net provider savings stay
  unmeasured.
- consensus.json wave3: ten owner_decision rows in token-efficiency
  (command-output, output-compression, code-index, code-graph, repo-packing,
  structured-data, doc-conversion, api-docs, trace-viewer,
  token-lane-carriers), owner defaults on context-supply (context-mode
  1.0.169, its wave-2 interim dropped), ccusage 20.0.26 and
  session-analytics (agentsview 0.43.0, local archive only), and the
  code-search interim widened to semble 0.6.1 + SocratiCode 1.15.0. Pins are
  the ones manifests/stack.json and adoption/pins-linux-x86_64.json record
  at f77a35e.
- assemble_manifest.py folds every wave batch in numeric order and checks an
  owner batch (hashed relaying record that quotes the order and names every
  slot and repository; no acknowledgement owed; replaced fields kept under
  overturned).
- render_tables.py lists the owner decisions and what each replaced, and keeps
  the blind-round basis of an overturned row; definitive-manifest.json and the
  2026-10-01 record's tables are regenerated, with a dated pointer paragraph.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 93fec17155724f720ac06da9a267115bc21db252)
(cherry picked from commit f9da212cce86e105522bddcd071d79cd3e22b1fd)
Scout @claude
New-WSL install plan, wave 3: the token-efficiency owner rows, every-…
455616f 
…wave gate, tests

- install.sh / accept.sh / install-plan.json / owners.json: one install and one
  acceptance function per new owner row (command-output, output-compression,
  code-index, code-graph, repo-packing, structured-data, doc-conversion,
  api-docs, trace-viewer, token-lane-carriers), ccusage and session-analytics
  installed as owner defaults, code-search adds SocratiCode 1.15.0 beside
  semble; the --list rows, the --only lists and the slot loops follow. Every
  tool goes under ${ECO_ROOT:-$HOME/.local/share/codex-ecosystem}, the root
  the client templates run; archives and npm tarballs through fetch_verified
  against the recorded sha256 (no gh sign-in). Pins are the ones
  manifests/stack.json and adoption/pins-linux-x86_64.json record at f77a35e.
- interim_acknowledged reads every wave batch (refusing a misspelt wave key);
  context-supply, now an owner default, no longer calls it; check_plan.py
  refuses a gate call on a row without an interim.
- tests/test_new_wsl_definitive_defaults.py: invariants extended to the owner
  batch (rows, owner defaults, overturned fields, counts, rule text, tables),
  31 negative controls for the assembler's owner-batch checks, gate cases for
  later batches.
- README, SOURCES and VALIDATION: the Wave 3 sections. Nothing was installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 25b002046be9939b8506ee9778c588b4181dd627)
(cherry picked from commit 7440aeacacec7f570135a400bd2845601f7d27b7)
Scout @claude
New-WSL profile and handbook, wave 3: the token-efficiency owner defa…
256f111 
…ults

- adoption/new-wsl-profile.json: RTK picked with default_install true and the
  release-asset install (docs/token-efficiency-stack.json) instead of the
  UNRUN cargo build; Headroom picked with the [mcp] extra, not [all]; ccusage's
  install command and documented acceptance filled; SocratiCode's install
  command filled, and it stays a comparison arm of the split code-search slot
  (validate_default_installs refuses a default install for it); new rows for
  context-mode, jcodemunch-mcp, codebase-memory-mcp, Repomix, TOON,
  MarkItDown, Context Hub, otel-tui and agentsview. boundary.default_profile
  names the token rows; install_dispatch is unchanged. Validated by
  scripts/new_wsl_profile.py.
- scripts/build_new_wsl_handbook.py: reads every wave batch, the row kind
  owner_decision and owner defaults (overturned.fields), counts interims for
  any wave batch, renders a multi-repository interim without a broken link
  and lists what each owner decision replaced. Outputs regenerated; the
  handbook receipt's frozen hashes follow them.
- catalogs/foundation/new-wsl-architecture-20261001.json: a superseded-by
  pointer in the token-efficiency row's notes (the edition has no
  context-supply row and admits no new row field); the dated text stays.
- Tests: profile owner defaults and arms; handbook owner rows, owner
  amendments and six negative controls; counts 100/10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 85735c7163888c23c8a513e4cd26d738349589a7)
(cherry picked from commit 800ae92c8fb9f1a1337a0ad7929bf0a6e699c875)
Scout @claude
New-WSL builder map: wire the owner-default token tools through their…
20e91b0 
… wave-3 slots

Wave 3 (the previous three commits) makes the token-efficiency tools owner defaults of new slots, so the builder's map
moves their pieces to those slots and wires the two tools it had left out. Twenty-four pieces change: RTK's environment
variable, PreToolUse Bash hook and deny rules (9) go from slot context-supply to command-output; Headroom's MCP server and
its approval slot (8) go to output-compression, MCP only, never the proxy mode; codebase-memory (3) and Context Hub's two
telemetry switches (2) leave not_wired for code-graph and api-docs; jCodeMunch gets two new pieces (a Claude user-scope
server and a Codex [mcp_servers] table) on code-index, registered as the console script the plan installs into the
ecosystem bin directory, the same registration NativeStack runs, and never through `jcodemunch-mcp init`, which writes a
prompt policy and hooks and stays the user's decision. SocratiCode keeps its code-search wiring and points at the pinned
1.15.0 build the plan installs. The 23 pieces that stay unwired are the Codex hook-trust hashes, the Codex role carriers,
the rescue plugin and its marketplace, the cache-heal hook and four settings of other owners.

The generated instruction blocks keep the sentences that name tools which are now installed; 41 test expectations move by
exactly that consequence (162 tests before and after, none deleted, every negative control kept: Promptfoo replaces the
now-installed Headroom as the unwired tool in the name-injection fixtures, and the split-slot test still flips SocratiCode
off when the slot's owner is changed to semble). The record's counts, tables and dropped-units list are recomputed from
`--check` on this tree (391 pieces, 355 wired, 23 not wired, 13 authorization).

Checks at this commit: new_wsl_client_config.py --check exit 0; unittest tests.test_new_wsl_client_config
tests.test_install_claude_profile tests.test_render_config tests.test_token_lanes_session_start
tests.test_token_lanes_subagent_start tests.test_adoption_docs_consistency tests.test_wsl_new_distro_recipe
tests.test_new_wsl_definitive_defaults tests.test_new_wsl_handbook tests.test_new_wsl_profile: 638 tests OK (5 skipped);
check_plan.py OK; build_new_wsl_handbook.py --check OK. Local integration checks, not upstream tests. Map and test edits
were drafted by a GPT-6.1 Sol/max worker through the packaged OmniRoute SDK worker and reviewed edit by edit here.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL client-configuration record: recount on main 8c32a84 after #674…
1810047 
… (392 pieces, 356 wired, 23 not wired, 13 authorization)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL default: hold the token-lane carriers out of the clean install
3a7cff3 
The two carrier hook entries and the nine files install_claude_profile.py copies are this repository's own adaptation,
not a feature of an upstream tool. The owner's directive of 2026-10-04 (a clean install: upstream installers with
upstream default configuration), relayed by the command center, holds them out of the new distribution's default: the
map entry goes from practice to not_wired, so the rendered settings run no carrier file and --apply copies none.
Counts: 392 pieces, 345 wired, 34 not wired, 13 authorization (was 356 / 23). Shared template and carrier files are
unchanged, so other hosts keep what they render. New decision record, one new test, five expectations moved.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL token layer: persist RTK and Context Hub configuration, regis…
8d1faa7 
…ter jCodeMunch per project, restore the directive-branch test

The four findings of the independent read of #684 (0 P1, 3 P2, 1 P3), each from an upstream-documented field:

- F1 jCodeMunch is registered per project, never at user scope (docs/token-session-handbook.md, adoption/bootstrap.md
  "jCodeMunch, per project"): the user-scope Claude and Codex additions and their map entry are gone; the code-index
  row still installs the console script. Four project agents name its tools, which the record's gap table now lists.
- F2 RTK [hooks] exclude_commands (the recipe's five entries) is written by command-output() to
  ${XDG_CONFIG_HOME:-~/.config}/rtk/config.toml, an existing file kept; the acceptance is version-neutral ($e/bin/rtk
  hook check, no version string for the new lines).
- F3 Context Hub telemetry:false and feedback:false are written by api-docs() to ${CHUB_DIR:-~/.chub}/config.yaml, an
  existing file kept; the acceptance asks upstream's own isTelemetryEnabled()/isFeedbackEnabled() with CHUB_* unset.
- F4 the directive branch has a positive test again (a slot that installs a different owner keeps the entry's
  directive; without the directive the piece is not wired); three PlanConfigurationTests run the two writes and
  check_plan.py in scratch homes.

Counts: 390 pieces, 343 wired, 34 not wired, 13 authorization (with the carrier hold-out of the commit before).
Native demonstration on rtk 0.51.0 and Context Hub 0.1.4 (scratch config dirs): the four excluded commands rewrite
before the config (rc 0) and exit 1 "No rewrite for" after it, git status rewrites in both; Context Hub reports
telemetry=true feedback=true without config.yaml and false/false with it, acceptance exit 0.
The repair worker (Sol max) stopped at its deadline with the work unverified; the verification is the coordinator's.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL client-configuration record: recount on main df50444 after #687
0c98ecd 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Agentsview pin registry: classify the wave-3 profile and its generate…
13649a3 
…d handbook as dated records

The macOS gate of PR 684 failed two tests of tests/test_agentsview_qualification.py (the same two fail on Linux): the
new-WSL profile and its generated handbook (json and md) name agentsview 0.43.0 since the owner's decision of
2026-10-04 and neither registry list classified them. They are built from the definitive manifest and the install plan,
not from manifests/stack.json, so a stack re-pin does not edit them: dated_record entries with basis 2026-10-04, in
the registry's path order. 12 tests of the module pass. The registry file's hash is to be re-registered in
manifests/evidence.json by the series' registry commit.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL builder: turn on the You-should-know mod and the ConfigChange…
5e36e92 
… audit hook on NativeStack2604

The owner's order of 2026-10-04 asks for every latest changelog feature fully enabled in the native workflow of the new
WSL too. Two switches that NativeStack's own user settings already carry reach NativeStack2604 through the builder's
2604-only additions file, each with a `practice` map entry that cites its source. Neither is a token-layer adaptation:
the mod is a built-in Claude Code feature and the audit hook is zero-token host practice, so the clean-default
hold-out (the token-lane carriers only) does not touch them.

- enabledPlugins["cc-plugin-you-should-know@builtin"] = true: the built-in mod added in Claude Code 2.1.287 that runs a
  side agent and shows notes above the prompt (https://code.claude.com/docs/en/plugins/mods/overview, read 2026-10-04).
  It is disabled by default, and its side agent costs tokens that are counted apart from the token-efficiency measurements.
- hooks.ConfigChange: the logging-only audit hook of https://code.claude.com/docs/en/hooks-guide ("Audit configuration
  changes"), with the literal command NativeStack runs (it appends the change's source and file to
  ~/claude-config-audit.log and ends with `|| true`, so it cannot block anything).

Three test expectations move by exactly that consequence: the enabled-plugin set gains the mod, the hook-command allowance
gains the audit command (and ConfigChange must hold exactly that one command), and the expected event list gains
ConfigChange. The record's counts and tables are recomputed from `--check`: 393 pieces, 345 wired, 35 not wired,
13 authorization (head 316abe3 plus these two pieces). The commit was first withdrawn with the carriers and is
reinstated on the command center's correction of 2026-10-04.

Checks at this commit: new_wsl_client_config.py --check exit 0; unittest tests.test_new_wsl_client_config
tests.test_install_claude_profile tests.test_render_config tests.test_token_lanes_session_start
tests.test_token_lanes_subagent_start tests.test_adoption_docs_consistency tests.test_wsl_new_distro_recipe
tests.test_new_wsl_definitive_defaults tests.test_new_wsl_handbook tests.test_new_wsl_profile: 642 tests OK (5 skipped).
Local integration checks, not upstream tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL changelog parity: advisor opus, crossSessionInbound accept, C…
0773f25 
…odex fast tier and analytics_plan_history; Context Hub acceptance uses the PATH node

The user's directive of 2026-10-04 ("we need all the sota features, latest changlogs, fully enalbed seamlessly within our
naitve workflow for new wsl also"), relayed by the command center, carried to NativeStack2604 after a parity diff of
NativeStack's live Claude settings and Codex config against the builder's render of the PR 684 head. Everything else
NativeStack has enabled was already rendered; docs/decisions/2026-10-04-new-wsl-changelog-parity.md lists the rest and why.

- advisorModel = "opus": the map's own override entry, the user's decision of 2026-10-04 and NativeStack's value.
- crossSessionInbound = "accept": a fifth authorization setting (AUTHORIZATION_PIECES, the map entry, the additions file),
  written only with --with-authorization-settings; overturns the wave-2 messaging ruling on the user's directive.
- Codex service_tier = "fast" (2604 additions, the map's Codex practice entry): the user's 2026-10-03 choice, NativeStack's
  value; the 0.160.0 schema calls fast the legacy spelling of priority.
- Codex features.analytics_plan_history = true in the shared template, so both hosts: experimental, one ChatGPT-backend
  request, no model call.
- accept.sh and install-plan.json run the Context Hub acceptance with the node on the prepared PATH (the delta read of
  PR 684, P2: no plan command links Node into ${ECO_ROOT}/bin); check_plan.py agrees with the script.

Counts: 396 pieces, 347 wired, 35 not wired, 14 authorization. Tests: the authorization pins now name five standalone
settings (STANDALONE), the render test pins the advisor and the two Codex values, two authorization tests handle a
single-piece entry and a seeded value. Local integration checks, not upstream tests. Registry excluded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
New-WSL: register jCodeMunch once at user scope, for Claude Code and …
1959ca5 
…Codex, on the user's directive

The user, 2026-10-04, replying to the You-should-know note that new projects and worktrees start without jCodeMunch:
"we need to set up all the sota repos, mcp tools, harness rules, upstream cc native hooks and beyond, resolute them cleanly
for future session to make sure their seamless pick up and thier native workflow enhanced with the sota practice". The
command center read it as one registration for every project. This overturns, for NativeStack2604, the per-project rule of
2026-09-25 (docs/decisions/2026-09-23-claude-user-profile.md addendum, 2026-09-25-codex-mcp-scope.md decision 2, F6 of
2026-09-26-token-practice-f1-f9.md).

- Claude: user-scope `jcodemunch` (type stdio, the console script the code-index row installs) with the documented savings
  opt-out JCODEMUNCH_SHARE_SAVINGS=0 in its env block; Codex: [mcp_servers.jcodemunch] with the same env table.
  Source: jgravelle/jcodemunch-mcp 1.108.319 at 8f7b34ab, README.md L119-122 (`claude mcp add -s user jcodemunch
  jcodemunch-mcp`), CONFIGURATION.md L229-233 and SECURITY.md L311 (the opt-out). `jcodemunch-mcp init` is not run.
- Map: the code-index slot entry back (slot:code-index, owner jcodemunch); install plan note; profile line and the generated
  handbook with its receipt hashes; two lines of the session handbook; the tests restored to the user-scope shape.
- docs/decisions/2026-10-04-new-wsl-jcodemunch-user-scope.md keeps the measured cost visible: Harbor 2026-09-30, the
  jcodemunch arm (init + hooks) at 1.387 times the lean arm, 95% CI 1.230 to 1.553, Holm p = 0.0006, Sonnet 5.5 at medium;
  the bare registration of this commit was not measured. Overturn: the user's instruction to remove a tool or scope.
Counts: 399 pieces, 350 wired, 35 not wired, 14 authorization. Local integration checks, not upstream tests.
Registry excluded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout and others added 4 commits October 4, 2026 16:59
Scout @claude
New-WSL: complete the Codex jCodeMunch entry (approval mode, front-do…
95f139e 
…or verbs, start-up allowance, env)

The user-scope Codex entry of the previous commit carried only the command and the savings opt-out. Codex's tools of this server
carry no MCP annotations, so under approval_policy = "never" Codex refuses every unapproved call: the repository's own
per-project registration (adoption/templates/project.codex.config.template.toml) sets default_tools_approval_mode = "approve"
(codex-rs/codex-mcp/src/mcp/mod.rs L89-L98 at rust-v0.157.1), names the three verbs of the front door in enabled_tools
(jcodemunch-mcp 1.108.319, counter.py FRONT_DOOR), gives a 60 s start-up allowance and PATH and RTK_TELEMETRY_DISABLED. The user
entry is now that one, moved to user scope; CODE_INDEX_PATH stays unset (upstream's default is ~/.code-index).

- The approval mode is an authorization piece: a new map entry ahead of the code-index slot entry classes
  codex/*/mcp_servers.jcodemunch.default_tools_approval_mode `authorization:` with slot code-index and owner jcodemunch, so it is
  written only with --with-authorization-settings and only while the slot installs jcodemunch, like the other servers' modes.
- Tests: the approval constants gain jcodemunch (seven modes), the default render pins the entry without the approval mode, the
  option adds it. Counts: 404 pieces, 354 wired, 35 not wired, 15 authorization. The record and the user-scope record say so.
Local integration checks, not upstream tests. Registry excluded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Scout @claude
Refresh PR #684 token pins after PR #693
9e8dedb 
Align the new WSL RTK owner row, verified Linux asset, install/acceptance
scripts and profile with main's 0.51.0 pin. Retain the exact five-entry
hooks configuration required by bootstrap. Align the mcporter profile with
0.14.2 and verify that the claude-hud row already uses 0.10.0.

Regenerate the manifest, client instruction blocks and handbook; replace
receipt digests without reformatting it and recount the client record.
Repair citations into all 42 files changed by PR #693, preserving original
sources for the dated architecture pins. Record the failed attempt and its
corrections in the install-plan validation notes.

Validation: all 780 requested unittest cases pass, with five skips. Client
configuration, plan consistency, handbook and diff checks pass. All 30
convergence records pass native positional validation. The all-recorded
discovery check and publication validator await the coordinator's evidence
registry refresh; publication failures are registry drift only. Leave the
separate RTK grep exactness control untouched.

Sources:
https://github.com/rtk-ai/rtk/releases/tag/v0.51.0
https://github.com/rtk-ai/rtk/releases/download/v0.51.0/checksums.txt
https://github.com/openclaw/mcporter/releases/tag/v0.14.2
https://registry.npmjs.org/mcporter/0.14.2
https://github.com/jarrodwatts/claude-hud/releases/tag/v0.10.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Fix the refresh's stale locators and the profile pin table after the …
ee6d790 
…cross-family read

The Claude read of a3045d6 found three P2s and several P3s. adoption/new-wsl-profile.md rows now match profile.json
(RTK 0.51.0, mcporter 0.14.2). The 'never run rtk init --global --codex' locator is docs/token-session-handbook.md:397 in
the tree #684 lands (consensus, owner record; the definitive manifest and handbook regenerated). The client-configuration
record cites claude.settings.template.json L417 and bootstrap.md L366-385, the map note says RTK 0.51.0, the agentsview
locator is :1749-1751, the owner record points its RTK 0.50.0 line at the refresh section, and the install-plan README
says the plan follows #693's pins. The consensus pin of the owner record was re-issued.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Regenerate the new-WSL handbook on main d850a53 (after #694's PowerSh…
66759ed 
…ell 7 recipe) with the receipt's output digests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout and others added 2 commits October 4, 2026 17:07
Scout @claude
Re-freeze the new-WSL handbook receipt on main d850a53: generator, pr…
6bf88c1 
…ofile and inventory follow #684's profile (78 entries)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
registry: re-register the token-layer builder, carrier, wave-3 plan, …
6ce2584 
…profile, records, jCodeMunch registration, the rtk 0.51.0 refresh, its locator fixes and the handbook receipt on main d850a53 (registry last)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout and others added 9 commits October 4, 2026 17:17
Scout @claude
Merge main 38ac9ac for the custody merge (hot-file protocol: main's r…
00b7b44 
…egistry plus the owned rows)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Hot-file protocol: reset manifests/evidence.json to the merge base be…
f73872c 
…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Reapply this branch's manifests/evidence.json edits on the merge base…
1d116e1 
… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Hot-file protocol: reset manifests/evidence.json adoption/hooks/claud…
f3883f6 
…e/SHA256SUMS to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Reapply this branch's manifests/evidence.json adoption/hooks/claude/S…
46fe572 
…HA256SUMS edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Merge main 3b8f9c8 for the custody merge (hot-file protocol: main's r…
f7f96d3 
…egistry plus the owned rows)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Hot-file protocol: reset manifests/evidence.json to the merge base be…
940382b 
…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Reapply this branch's manifests/evidence.json edits on the merge base…
4810788 
… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Hot-file protocol: reset manifests/evidence.json adoption/hooks/claud…
664560b 
…e/SHA256SUMS to the merge base before the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins pushed a commit that referenced this pull request Oct 4, 2026
Scout @claude
Correct verified E2E publication provenance and artifact hashes
4431a60 
Retain the adjudication prompt, Opus run metadata and 14/8 split. Correct
the 25 plan / 8 host fix scope and four token holds for unmerged PR #684.
Restore harmless technical paths, retain the machine label consistently,
and preserve local-user redaction. Refresh all seven non-self artifact
hashes and add private fix-list and workflow-record hashes.

The coordinator synchronizes registry hashes and mirrored claim/limitations.

Validation: 277 tests passed, 0 skipped; eight publication scans and login
scans found zero hits; git diff --check passed. Full validation reports
only 16 expected registry-drift errors pending coordinator synchronization.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout and others added 2 commits October 4, 2026 18:52
Scout @claude
Upstream-surface dispositions: re-point two citations at the lines th…
c318f14 
…is branch moved (otel.metrics_exporter, tui.status_line)

Main's new test_every_cited_line_names_the_key reads the cited lines; this branch's template and
definitive-defaults table shift them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scout @claude
Reapply this branch's manifests/evidence.json adoption/hooks/claude/S…
ba3ee96 
…HA256SUMS edits on the merge base (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@seathatflowsinourveins
seathatflowsinourveins marked this pull request as ready for review October 5, 2026 00:29
@seathatflowsinourveins
seathatflowsinourveins merged commit ba1f687 into main Oct 5, 2026
25 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the c5/token-layer-2604 branch October 5, 2026 00:29
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 5, 2026
Merged
seathatflowsinourveins pushed a commit that referenced this pull request Oct 5, 2026
Scout @claude
NativeStack2604 E2E fix wave: 25 slot repairs from the verified E2E, …
1572f48 
…the wave-4 promptfoo owner default on the repository-quality rule

Integrates the eight GPT fix-wave builders (bounded job 050, GPT-6.1 Sol at max) on the verified-E2E fix
list, then two review rounds: a five-way Claude read (4 P1 authority wordings fixed by the coordinator,
19 P2 recipe defects fixed by GPT repair job 058) and a Claude delta read (its P2, the gateway canary
check's missing argument, and the leftover wording fixed by the coordinator). 21 slots are repaired in the
install plan, its acceptance and the client wiring; 4 still need a native sign-in or a destination
(alerting, grafana, promptfoo, ccusage). OpenHands stays at v1.50.1, the manifest baseline. Every revised
destination command is UNRUN here; the co-op session applies them on NativeStack2604.

wave4: an owner default on promptfoo resting on the owner's 2026-10-04 repository-quality rule; decide
round 2 and its Opus verification named promptfoo for paired skill verification in both clients
(docs/decisions/2026-10-04-repository-quality-rule.md; evidence/artifacts/new-wsl-fix-wave-20261004/).

Rebuilt on main after #684 and #702 (the wave-2 acknowledgements); generated outputs regenerated with
their own tools. The evidence registry follows in the last commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins added a commit that referenced this pull request Oct 5, 2026
@seathatflowsinourveins
Clean default for every host: carriers held out of the shared templat…
5df0e0e 
…e and retired on re-apply, removed Codex flags pruned, jCodeMunch at user scope (#699)

### Scope

- Based on main `287514581` (which holds the squash of #684 and #701). Restacked from the stack on `a3045d629`: the content commits cherry-pick without a conflict and the registry is redone last on each restack; main moves often, so the lander may find the hot file to redo once more. The command center decided that NativeStack follows NativeStack2604 on the user's clean-install directive (2026-10-04, quoted in the record). This PR does three things:
  1. holds the two token-lane carrier hooks out of the shared Claude settings template and the default install, and makes a settings re-apply retire the hook entries a host already has (the merge never dropped a base hook, so a template change alone would have left NativeStack's live SubagentStart carrier running);
  2. adds `tools/adoption/codex_config_prune.py`, which deletes the `[features]` keys that `codex features list` reports as `removed` (NativeStack's `plugin_hooks = true` today) through Codex's own config writer;
  3. registers jCodeMunch at user scope in both shared user templates (the user's directive of the same day; the Claude and Codex user-scope sets must mirror each other by this repository's own tests), with the measured cost kept visible in its record.
- Base commit: `287514581` (main after #701). Review history: five cross-family reads of the retirement matcher, closed by the command center's closing read (job-059) at `748cbe418`, whose content this head carries plus a docs-only commit that records the closing read's two residuals
- Lane: `lane:foundation`
- Owned paths touched: `adoption/templates/{claude.settings,codex.config,project.codex.config}.template.*`, `adoption/templates/codex.AGENTS.template.md`, `adoption/scaffold/AGENTS.md`, `adoption/mcp/claude-user.json`, `adoption/hooks/claude/{README.md,held-out-hook-entries.json}`, `tools/adoption/{install_claude_profile,apply_claude_settings,codex_config_prune}.py`, `adoption/new-wsl/**` (map, additions, generated Codex block), `adoption/bootstrap.md`, `docs/token-session-handbook.md`, `docs/decisions/2026-10-04-*`, the tests, and `manifests/evidence.json` (last commit, `registry:`).

### SOTA sources

- Claude Code hooks: https://code.claude.com/docs/en/hooks (command hooks, `SessionStart` and `SubagentStart`; read 2026-10-04). The carriers are our own adaptation, not an upstream feature.
- Codex removed features: `codex features list` of the installed binary, and openai/codex `rust-v0.160.0`, `codex-rs/features/src/lib.rs` L1474-L1479 (`plugin_hooks`: `Stage::Removed`, `default_enabled: false`). Writer: `config/batchWrite` of `codex app-server` with `expectedVersion`, as `tools/adoption/apply_codex_lane.py` already uses it (its rollback deletes keys with `value: null`).
- Codex MCP approval: openai/codex `rust-v0.157.1`, `codex-rs/codex-mcp/src/mcp/mod.rs` L89-L98 (an `approve` mode auto-approves even under `approval_policy = "never"`).
- jCodeMunch: jgravelle/jcodemunch-mcp 1.108.319 at `8f7b34abe16fb459e0bf1c04747d584216dfe32e`: `README.md` L119-L122 (`claude mcp add -s user jcodemunch jcodemunch-mcp`) and L225 (the anonymous savings counter and its default index path), `CONFIGURATION.md` L229-L233 and `SECURITY.md` L311 (`JCODEMUNCH_SHARE_SAVINGS=0`).
- Cost evidence: the frozen Harbor E2E of 2026-09-30 (Harbor 0.23.0, upstream installers verbatim, 36 SWE-bench Verified tasks, Sonnet 5.5 at medium effort): jcodemunch (init + hooks) 1.387 times the lean arm, 95% CI 1.230 to 1.553, Holm p = 0.0006. That arm ran `init`; the registration here does not, and was not measured.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Merging the new template into a copy of NativeStack's live `~/.claude/settings.json` removes exactly one hook, the SubagentStart carrier; a second merge changes nothing; `keep_held_out=True` keeps it | `local_integration` (real input, in-memory merge on this host, with the host's resolved home) | a one-off run at `176ee5a6c` (the same content as `7edb91e3e` here), not retained as a receipt; stated in `docs/decisions/2026-10-04-claude-template-holds-out-token-lane-carriers.md`, decision 3 |
| `codex_config_prune.py` on NativeStack's live config (dry run, real `codex features list`) names `features.plugin_hooks` and nothing else | `local_integration` (real input, no write) | `python3 tools/adoption/codex_config_prune.py` exit 0 |
| `--apply` against the real `codex app-server` (codex-cli 0.159.3) on a scratch copy of NativeStack's `config.toml`: exactly the `plugin_hooks = true` line was removed, read back through `config/read`, a 0600 backup was written, a second dry run found nothing, and the live file kept its hash | `local_integration` (real upstream binary, scratch copy, no write to the live host) | 2026-10-04 20:07Z; the process guard was pointed at an absent name (`--codex-process-name`) because five other codex processes were running, which the live apply must not do; recorded in the decision record, decision 5 |
| The dry run, the removed-name parsing and the `--apply` path with its refusals (backup then delete through the writer and read back; a running codex refuses before any write; a failed write is reported with the backup; a key the writer still reports is a failure; two backups in one second do not collide) | `synthetic` | 12 tests in `tests/test_codex_config_prune.py` with a fake codex and a fake app-server |
| Carrier retirement retires a hook only when its command equals, exactly (no trimming), a carrier command this repository shipped, as shipped or with the placeholder replaced by the text `render_config.py` writes there. The renderer substitutes `HOME` as written, so that text may be any spelling of the settings file's home (a trailing slash, a `.` or `..` segment, a doubled or leading double slash, a symlink alias): it counts when it is an absolute path with no control character, quote, `$`, backtick or backslash whose realpath is the home's, and the home is the resolved `<home>/.claude/settings.json` or nothing is retired. Every other hook is kept (five cross-family reads found a defect in each earlier matcher or in what it was given: any shell word naming the path; the first non-option word and shlex tokens; an anchored pattern, a recognised grammar; trimming, a fallback home and two sequential replaces; and, in the fifth, two ways a carrier was kept because the renderer writes the home as given) | `local_integration` | `SHIPPED_CARRIER_COMMANDS`, four fixed shapes with a hole where `HOME` is; `HeldOutHookTests` (53 tests; the fourth and fifth rounds' were written first: 78 failures and one error, then nine failures): the four shipped strings with their sources, every shipped string retired as shipped and as rendered, no whitespace around a command tolerated (nine paddings), a mutation test (6,908 single-character edits, none retired), the second read's 25 shapes and the third read's 30 all kept (the pattern matcher retired 26 of the 55), another host's home does not retire, the carriers rendered by the real `render_config.render_one` with seven spellings of one home retire, a carrier rendered for a symlink alias or for the real home retires through either path, spellings that name another directory or that the shell expands (`.../$X/..`, a substitution, a backtick, a backslash, a quote, a newline, a no-break space) are kept, a target that is not a home's `.claude/settings.json` retires nothing; the reviewer's own repro file for the fifth read's two families passes 6 of 6 against this head; the record counts the second to fifth repairs as extra rounds past the bounded loop, the fifth being the final one |
| On the rebased head, the 49 test modules that name a changed file ran 3,414 tests in 850 s: 3,137 passed, 266 skipped, 11 failed. Two failures were this PR's: the disposition for `codex:config_group:otel.metrics_exporter` cited `codex.config.template.toml:269`, which the jCodeMunch lines moved to 291 (fixed in `66ba4c45e`; `test_upstream_surface_watch` passes, 110 tests). The other nine (8 in `test_token_e2e_grader`, 1 in `test_windows_terminal_defaults`) are not caused by this PR | `local_integration` | locally authored tests, not upstream acceptance; run niced at `33b236ba1` (the head before the citation fix); the six related modules (apply_claude_settings, install_claude_profile, codex_config_prune, new_wsl_client_config, ecosystem_manifest, adoption_docs_consistency) ran 447 tests, all passing (5 skipped), at every round and on the rebased head |
| The full suite on macos-15 (10,900 tests) failed one test at the head before this one: `test_a_settings_file_names_its_own_home` compared the literal `/home/example` with the settings file's resolved home, and macOS resolves `/home` to `/System/Volumes/Data/home`; fixed in `b6a152785` by comparing with `resolve()` (the code is unchanged); the artifact held no other failure | `local_integration` | the `validate-macos` job's uploaded log `full-suite-macos.log` (1 failure, 1,412 skipped); the module passes (53 tests) after the fix |
| The nine failures are pre-existing | control | the same nine test names fail when `tests.test_token_e2e_grader`, `tests.test_windows_terminal_defaults` and `tests.test_upstream_surface_watch` run on clean main `43005a9f8` (a detached worktree): 776 tests, 9 failures, 6 skipped; the surface-watch module passes there |
| jCodeMunch's user-scope registration, its opt-out and the cost of the faithful-adoption arm | `source_review` | the pinned README and CONFIGURATION.md lines above; the frozen Harbor `RESULTS.md` |
| Applying any of this on NativeStack (settings re-apply, Codex prune `--apply` on the live file, `codex mcp add jcodemunch`) | not run | untested boundary: the host steps are in the record, the command center runs them after the merge, the prune in a window with no codex process |

### Local commands run

```
$ python3 tools/adoption/new_wsl_client_config.py --check
check passed (the record's counts: 393 pieces, 354 wired, 24 not wired, 15 authorization)
$ python3 -B -m unittest <49 modules that name a changed file>   # at 33b236b
Ran 3414 tests in 849.6s ... FAILED (failures=11, skipped=266)   # 2 fixed by be75911, the other nine are the control row's
$ python3 -B -m unittest tests.test_token_e2e_grader tests.test_windows_terminal_defaults tests.test_upstream_surface_watch   # clean main 43005a9
Ran 776 tests ... FAILED (failures=9, skipped=6)   # the same nine
$ python3 -m unittest tests.test_upstream_surface_watch   # at 2f85d97
Ran 110 tests ... OK (skipped=6)
$ python3 scripts/validate.py ; python3 scripts/validate_convergence.py --all-recorded
exit 0 ; exit 0
$ python3 scripts/build_new_wsl_handbook.py --check ; python3 evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
exit 0 ; OK: 80 rows: 56 installed (54 by the default run, 2 only when named), 3 measurement-only, 21 not installed
$ python3 tools/adoption/codex_config_prune.py --codex-home <scratch copy> --apply --codex-process-name <absent name>
pruned plugin_hooks ...; read back from config/read   # then a dry run: nothing to prune; live config.toml hash unchanged
$ gitleaks git --log-opts="origin/main..HEAD"
no leaks found
```

### Decision record

`docs/decisions/2026-10-04-claude-template-holds-out-token-lane-carriers.md` (decisions, the NativeStack host steps, alternatives, what would overturn each); addenda in `2026-10-04-new-wsl-clean-default-holdouts.md` and `2026-10-04-new-wsl-jcodemunch-user-scope.md`.

### Host evidence

No files under `evidence/hosts/` change. Applying the Codex AGENTS template's changed top-rule line (`jcodemunch` shares serena's lane) to `~/.codex/AGENTS.md` is an instruction-file edit that the command center applies after this PR's cross-family read; it reported the user's yes at 20:40Z.

### Checklist

- [x] No new or changed GitHub Actions or workflows.
- [x] No secrets printed, logged or committed (gitleaks above).
- [x] No new paid hosting, subscription or billing surface.
- [x] Peer-owned untracked files and worktrees preserved.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 7, 2026
Closed
5 of 6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins