diff --git a/README.md b/README.md
index bb1e70807..d353fa0a4 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ explicit open gates, not a claim of universal completeness.
## What is here
-- **54 component records** across native clients, context, retrieval, memory, collaboration, browser work, verification, isolation, usage accounting, research hosting, backtesting, backup, dependency inventory and local observability; adoption scope remains receipt-specific.
+- **57 component records** across native clients, context, retrieval, memory, collaboration, browser work, verification, isolation, usage accounting, research hosting, backtesting, backup, dependency inventory and local observability; adoption scope remains receipt-specific. The original token study retains its 52-component scope.
- **19 researched alternatives** with adoption decisions, model requirements and prospective commands.
- A [six-candidate portability comparison](adoption/research.md), with 41 selected primary source files and a native uv adoption decision.
- **Four extended catalog layers** covering foundations/memory/RAG, agents/hosting/operations, data, and strategy/engine research; source review remains distinct from native execution.
diff --git a/adoption/manifest.json b/adoption/manifest.json
index 24df676e2..84708f43f 100644
--- a/adoption/manifest.json
+++ b/adoption/manifest.json
@@ -56,7 +56,10 @@
"current_job_recovery": "blueprints/convergence-practice/job-recovery/README.md",
"current_codex_session_recovery": "blueprints/convergence-practice/native-recovery/README.md",
"current_gpu_trial": "blueprints/convergence-practice/gpu-inference/README.md",
- "current_claude_session_recovery": "blueprints/convergence-practice/native-recovery/claude/README.md"
+ "current_claude_session_recovery": "blueprints/convergence-practice/native-recovery/claude/README.md",
+ "current_supplemental_native_tools": "evidence/receipts/upstream-native-tools-20260920.json",
+ "current_memory_maintenance": "evidence/receipts/native-ai-memory-maintenance-20260920.json",
+ "current_native_workflow_analyzer": "evidence/receipts/native-linux-zizmor-20260920.json"
},
"recipe_map": {
"affaan-m/ECC": "recipes/README.md",
@@ -112,7 +115,10 @@
"skfolio": "blueprints/us-equities/research-evaluation/README.md",
"edgartools": "blueprints/us-equities/catalyst-provenance/README.md",
"zizmor": "blueprints/convergence-practice/ci-security/README.md",
- "llama-cpp": "blueprints/convergence-practice/gpu-inference/README.md"
+ "llama-cpp": "blueprints/convergence-practice/gpu-inference/README.md",
+ "beads": "recipes/README.md",
+ "skills-ref": "recipes/README.md",
+ "otel-tui": "recipes/README.md"
},
"profiles": [
{
diff --git a/blueprints/convergence-practice/ci-security/README.md b/blueprints/convergence-practice/ci-security/README.md
index a448a0e5a..013ec4e35 100644
--- a/blueprints/convergence-practice/ci-security/README.md
+++ b/blueprints/convergence-practice/ci-security/README.md
@@ -16,6 +16,29 @@ unsafe fixture returns exit 14 with `template-injection`, `unpinned-uses` and
Replay with the selected native executable available:
+The later [native Linux receipt](../../../evidence/receipts/native-linux-zizmor-20260920.json)
+closes the executable gap on its recorded source Linux/WSL host with upstream
+`uv tool install zizmor==1.30.1` in an isolated tool environment. Importing that
+receipt does not qualify macOS, VelaNext or another host. The workflow-directory scan returned exit 0
+and no findings; the unchanged inert fixture returned exit 14 with all three
+diagnostics above. Both exact native acceptance tests passed with no skips.
+The installed binary was independently hashed; this follow-up did not repeat
+the CI wheel archive verification or execute any workflow.
+
+Run the direct upstream command from either client's native shell, choosing an
+owned cache directory:
+
+```sh
+uv tool install zizmor==1.30.1
+env -u GH_TOKEN -u GITHUB_TOKEN -u ZIZMOR_GITHUB_TOKEN \
+ zizmor --offline --no-config --no-ignores --no-progress \
+ --persona regular --strict-collection --format json \
+ --cache-dir "$OWNED_CACHE" "$PROJECT_ROOT/.github/workflows"
+```
+
+Install once; subsequent workflow edits need only the relevant scan. Acceptance
+can be replayed with the repository's native fixture tests:
+
```sh
python3 -m unittest -v tests.test_workflow_security
python3 scripts/validate_convergence.py blueprints/convergence-practice/ci-security/experiment.json --root . --json
diff --git a/catalogs/us-equities/README.md b/catalogs/us-equities/README.md
index 3108108f9..99f700aef 100644
--- a/catalogs/us-equities/README.md
+++ b/catalogs/us-equities/README.md
@@ -7,7 +7,7 @@ per-repository token-saving value.
**Dated decision catalog: September 20, 2026.** The north star is native, token-efficient research → reproducible backtesting → Alpaca paper automation. This is an examined selection across layers, not a universal final SOTA ranking or a claim that every listed framework runs together.
-The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **505 repository identities**, including all 342 public stars and 163 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,051 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material.
+The catalog has **152 baseline repository decision cards covering 147 unique GitHub repositories**, and **20 model entries**. The [combined repository index](repository-index.md) now contains **505 repository identities**, including all 342 public stars and 163 beyond that snapshot. Its [typed decision union](decision-index.json) validates baseline cards, component/candidate records and explicitly registered research supplements together; 1,054 source pointers preserve their different evidence depths. The historical 453-row index remains dated reference material.
The newest [security-identity review](security-identity-review.md) examines Alpaca,
Zipline, Qlib, NautilusTrader, LEAN and WRDS. It separates engine identity/lifetime
diff --git a/catalogs/us-equities/decision-index.json b/catalogs/us-equities/decision-index.json
index 9053bb16c..4124a9acd 100644
--- a/catalogs/us-equities/decision-index.json
+++ b/catalogs/us-equities/decision-index.json
@@ -164,10 +164,10 @@
"repositories": 505,
"public_star_repositories": 342,
"beyond_public_stars": 163,
- "references": 1052,
+ "references": 1055,
"repositories_by_record_type": {
"catalog_card": 147,
- "component_record": 54,
+ "component_record": 57,
"legacy_candidate": 19,
"public_star": 342,
"research_supplement": 103,
@@ -482,6 +482,7 @@
"aliases": [],
"public_star": true,
"record_types": [
+ "component_record",
"legacy_candidate",
"public_star",
"star_review"
@@ -505,7 +506,13 @@
"kind": "legacy_candidate",
"path": "manifests/candidates.json",
"pointer": "/candidates/14",
- "decision": "Demo-only portable-format linter; native client extensions differ. Existing official Codex quick_validate helper already passed for selected task-checkpoint skills."
+ "decision": "On-demand reference/demo portable-format linting, properties and prompt metadata; does not certify production native client extensions."
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/55",
+ "id": "skills-ref"
}
]
},
@@ -4462,6 +4469,7 @@
"aliases": [],
"public_star": true,
"record_types": [
+ "component_record",
"legacy_candidate",
"public_star",
"star_review"
@@ -4485,7 +4493,13 @@
"kind": "legacy_candidate",
"path": "manifests/candidates.json",
"pointer": "/candidates/12",
- "decision": "conditional backlog tool; defer installation until durable dependency/claimable-task queue is a real requirement"
+ "decision": "Use for selected-project persistent task dependencies and claims; ai-memory remains durable knowledge. Initialization skips agent instructions and hooks."
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/54",
+ "id": "beads"
}
]
},
@@ -12957,6 +12971,7 @@
"aliases": [],
"public_star": false,
"record_types": [
+ "component_record",
"legacy_candidate"
],
"references": [
@@ -12964,7 +12979,13 @@
"kind": "legacy_candidate",
"path": "manifests/candidates.json",
"pointer": "/candidates/18",
- "decision": "Conditional: use a deliberate local instrumented session or deterministic workflow when runtime latency/events are being diagnosed; no persistent exporter proposed."
+ "decision": "Use for explicit local telemetry diagnosis; no persistent exporter or provider-session claim."
+ },
+ {
+ "kind": "component_record",
+ "path": "manifests/stack.json",
+ "pointer": "/components/56",
+ "id": "otel-tui"
}
]
},
diff --git a/docs/ecosystem/README.md b/docs/ecosystem/README.md
index 2d246aca4..f9af3c4ac 100644
--- a/docs/ecosystem/README.md
+++ b/docs/ecosystem/README.md
@@ -64,11 +64,12 @@ The two retrieval replay highlights are separately identified as recorded
evaluations, with their own denominators and limits. Current acceptance on the
browser's host stays unknown: a static HTML file probes no accounts or services.
-The [current primary-source review](source-review.json) records native Claude Code
-features, existing retrieval and memory options, and local inference gates. It
-does not install anything or change accepted pins. In particular, ai-memory 2.3.2
-remains a candidate for an isolated migration/scope trial; native 2.3.1 state was
-not upgraded by this work.
+The [dated primary-source review](source-review.json) records native Claude Code
+features, existing retrieval and memory options, and local inference gates. That
+review installed nothing and left ai-memory 2.3.2 as a candidate. The later
+[maintenance receipt](../../evidence/receipts/native-ai-memory-maintenance-20260920.json)
+records its bounded update on the source Linux/WSL host after a private backup.
+Importing that receipt does not upgrade or qualify macOS, VelaNext or another host.
The [Tavily receipt](tavily-receipt.json) records CLI 0.1.8, eight official skills
at a full source commit, native authentication and one three-result search.
diff --git a/docs/ecosystem/index.html b/docs/ecosystem/index.html
index 13cef2120..af7ba8eff 100644
--- a/docs/ecosystem/index.html
+++ b/docs/ecosystem/index.html
@@ -60,7 +60,7 @@
-
+