diff --git a/README.md b/README.md index bb1e70807..d353fa0a4 100644 --- a/README.md +++ b/README.md @@ -117,7 +117,7 @@ explicit open gates, not a claim of universal completeness. ## What is here -- **54 component records** across native clients, context, retrieval, memory, collaboration, browser work, verification, isolation, usage accounting, research hosting, backtesting, backup, dependency inventory and local observability; adoption scope remains receipt-specific. +- **57 component records** across native clients, context, retrieval, memory, collaboration, browser work, verification, isolation, usage accounting, research hosting, backtesting, backup, dependency inventory and local observability; adoption scope remains receipt-specific. The original token study retains its 52-component scope. - **19 researched alternatives** with adoption decisions, model requirements and prospective commands. - A [six-candidate portability comparison](adoption/research.md), with 41 selected primary source files and a native uv adoption decision. - **Four extended catalog layers** covering foundations/memory/RAG, agents/hosting/operations, data, and strategy/engine research; source review remains distinct from native execution. diff --git a/adoption/manifest.json b/adoption/manifest.json index 24df676e2..84708f43f 100644 --- a/adoption/manifest.json +++ b/adoption/manifest.json @@ -56,7 +56,10 @@ "current_job_recovery": "blueprints/convergence-practice/job-recovery/README.md", "current_codex_session_recovery": "blueprints/convergence-practice/native-recovery/README.md", "current_gpu_trial": "blueprints/convergence-practice/gpu-inference/README.md", - "current_claude_session_recovery": "blueprints/convergence-practice/native-recovery/claude/README.md" + "current_claude_session_recovery": "blueprints/convergence-practice/native-recovery/claude/README.md", + "current_supplemental_native_tools": "evidence/receipts/upstream-native-tools-20260920.json", + "current_memory_maintenance": "evidence/receipts/native-ai-memory-maintenance-20260920.json", + "current_native_workflow_analyzer": "evidence/receipts/native-linux-zizmor-20260920.json" }, "recipe_map": { "affaan-m/ECC": "recipes/README.md", @@ -112,7 +115,10 @@ "skfolio": "blueprints/us-equities/research-evaluation/README.md", "edgartools": "blueprints/us-equities/catalyst-provenance/README.md", "zizmor": "blueprints/convergence-practice/ci-security/README.md", - "llama-cpp": "blueprints/convergence-practice/gpu-inference/README.md" + "llama-cpp": "blueprints/convergence-practice/gpu-inference/README.md", + "beads": "recipes/README.md", + "skills-ref": "recipes/README.md", + "otel-tui": "recipes/README.md" }, "profiles": [ { diff --git a/blueprints/convergence-practice/ci-security/README.md b/blueprints/convergence-practice/ci-security/README.md index a448a0e5a..013ec4e35 100644 --- a/blueprints/convergence-practice/ci-security/README.md +++ b/blueprints/convergence-practice/ci-security/README.md @@ -16,6 +16,29 @@ unsafe fixture returns exit 14 with `template-injection`, `unpinned-uses` and Replay with the selected native executable available: +The later [native Linux receipt](../../../evidence/receipts/native-linux-zizmor-20260920.json) +closes the executable gap on its recorded source Linux/WSL host with upstream +`uv tool install zizmor==1.30.1` in an isolated tool environment. Importing that +receipt does not qualify macOS, VelaNext or another host. The workflow-directory scan returned exit 0 +and no findings; the unchanged inert fixture returned exit 14 with all three +diagnostics above. Both exact native acceptance tests passed with no skips. +The installed binary was independently hashed; this follow-up did not repeat +the CI wheel archive verification or execute any workflow. + +Run the direct upstream command from either client's native shell, choosing an +owned cache directory: + +```sh +uv tool install zizmor==1.30.1 +env -u GH_TOKEN -u GITHUB_TOKEN -u ZIZMOR_GITHUB_TOKEN \ + zizmor --offline --no-config --no-ignores --no-progress \ + --persona regular --strict-collection --format json \ + --cache-dir "$OWNED_CACHE" "$PROJECT_ROOT/.github/workflows" +``` + +Install once; subsequent workflow edits need only the relevant scan. Acceptance +can be replayed with the repository's native fixture tests: + ```sh python3 -m unittest -v tests.test_workflow_security python3 scripts/validate_convergence.py blueprints/convergence-practice/ci-security/experiment.json --root . --json diff --git a/catalogs/us-equities/README.md b/catalogs/us-equities/README.md index 3108108f9..99f700aef 100644 --- a/catalogs/us-equities/README.md +++ b/catalogs/us-equities/README.md @@ -7,7 +7,7 @@ per-repository token-saving value. **Dated decision catalog: September 20, 2026.** The north star is native, token-efficient research → reproducible backtesting → Alpaca paper automation. This is an examined selection across layers, not a universal final SOTA ranking or a claim that every listed framework runs together. -The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **505 repository identities**, including all 342 public stars and 163 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,051 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material. +The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **505 repository identities**, including all 342 public stars and 163 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,054 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material. The newest [security-identity review](security-identity-review.md) examines Alpaca, Zipline, Qlib, NautilusTrader, LEAN and WRDS. It separates engine identity/lifetime diff --git a/catalogs/us-equities/decision-index.json b/catalogs/us-equities/decision-index.json index 9053bb16c..4124a9acd 100644 --- a/catalogs/us-equities/decision-index.json +++ b/catalogs/us-equities/decision-index.json @@ -164,10 +164,10 @@ "repositories": 505, "public_star_repositories": 342, "beyond_public_stars": 163, - "references": 1052, + "references": 1055, "repositories_by_record_type": { "catalog_card": 147, - "component_record": 54, + "component_record": 57, "legacy_candidate": 19, "public_star": 342, "research_supplement": 103, @@ -482,6 +482,7 @@ "aliases": [], "public_star": true, "record_types": [ + "component_record", "legacy_candidate", "public_star", "star_review" @@ -505,7 +506,13 @@ "kind": "legacy_candidate", "path": "manifests/candidates.json", "pointer": "/candidates/14", - "decision": "Demo-only portable-format linter; native client extensions differ. Existing official Codex quick_validate helper already passed for selected task-checkpoint skills." + "decision": "On-demand reference/demo portable-format linting, properties and prompt metadata; does not certify production native client extensions." + }, + { + "kind": "component_record", + "path": "manifests/stack.json", + "pointer": "/components/55", + "id": "skills-ref" } ] }, @@ -4462,6 +4469,7 @@ "aliases": [], "public_star": true, "record_types": [ + "component_record", "legacy_candidate", "public_star", "star_review" @@ -4485,7 +4493,13 @@ "kind": "legacy_candidate", "path": "manifests/candidates.json", "pointer": "/candidates/12", - "decision": "conditional backlog tool; defer installation until durable dependency/claimable-task queue is a real requirement" + "decision": "Use for selected-project persistent task dependencies and claims; ai-memory remains durable knowledge. Initialization skips agent instructions and hooks." + }, + { + "kind": "component_record", + "path": "manifests/stack.json", + "pointer": "/components/54", + "id": "beads" } ] }, @@ -12957,6 +12971,7 @@ "aliases": [], "public_star": false, "record_types": [ + "component_record", "legacy_candidate" ], "references": [ @@ -12964,7 +12979,13 @@ "kind": "legacy_candidate", "path": "manifests/candidates.json", "pointer": "/candidates/18", - "decision": "Conditional: use a deliberate local instrumented session or deterministic workflow when runtime latency/events are being diagnosed; no persistent exporter proposed." + "decision": "Use for explicit local telemetry diagnosis; no persistent exporter or provider-session claim." + }, + { + "kind": "component_record", + "path": "manifests/stack.json", + "pointer": "/components/56", + "id": "otel-tui" } ] }, diff --git a/docs/ecosystem/README.md b/docs/ecosystem/README.md index 2d246aca4..f9af3c4ac 100644 --- a/docs/ecosystem/README.md +++ b/docs/ecosystem/README.md @@ -64,11 +64,12 @@ The two retrieval replay highlights are separately identified as recorded evaluations, with their own denominators and limits. Current acceptance on the browser's host stays unknown: a static HTML file probes no accounts or services. -The [current primary-source review](source-review.json) records native Claude Code -features, existing retrieval and memory options, and local inference gates. It -does not install anything or change accepted pins. In particular, ai-memory 2.3.2 -remains a candidate for an isolated migration/scope trial; native 2.3.1 state was -not upgraded by this work. +The [dated primary-source review](source-review.json) records native Claude Code +features, existing retrieval and memory options, and local inference gates. That +review installed nothing and left ai-memory 2.3.2 as a candidate. The later +[maintenance receipt](../../evidence/receipts/native-ai-memory-maintenance-20260920.json) +records its bounded update on the source Linux/WSL host after a private backup. +Importing that receipt does not upgrade or qualify macOS, VelaNext or another host. The [Tavily receipt](tavily-receipt.json) records CLI 0.1.8, eight official skills at a full source commit, native authentication and one three-result search. diff --git a/docs/ecosystem/index.html b/docs/ecosystem/index.html index 13cef2120..af7ba8eff 100644 --- a/docs/ecosystem/index.html +++ b/docs/ecosystem/index.html @@ -60,7 +60,7 @@

- +