Scope research Hindsight skills and make wiring checks fail closed

[seathatflowsinourveins]

Scope

Scopes Hindsight's unchanged vendor skill to the two CC-selected research projects and repairs both micro reads of #835 at 04c4bc278c25913cf7f3dff859dae7e91d8aab4e. The installation packet now stops after failed download/checksum/destination guards, verifies the release binary before its first execution, and limits CC client smokes to fresh research-project sessions.

• Base commit: aba02ec3456d383bcc2fc72883db098f9be7918a; no rebase during this FIX2 turn.
• Lane: lane:shared, per the CC decision; the two blueprint skill additions require the trading owner's acknowledgement as a comment or review before merge.
• Owned paths: Hindsight blueprint skill copies, both memory decision/evidence records, source/wiring/review packets, two Hindsight draft ExecStarts, and targeted evidence regressions.
• Native project targets: blueprints/us-equities/.claude/skills/hindsight-memory/SKILL.md and blueprints/us-equities/.agents/skills/hindsight-memory/SKILL.md. Both unchanged at SHA256 736dec06d414798f6b17dc078c5ef6204e8802f53cb3a5fb3c306ce08872f08e, 2,758 bytes.
• Trading repository route: draft us-equities-trading#15, final head 650df14547daf7ac4e86d1f85f167787d94b4f24, with the same two unchanged skills and SOURCE.json binding both copies. Native verify0 (62 passed/1 skipped), 19 path-rule cases, 9 reported hosted checks SUCCESS. Its designated micro/read/cue remains separate.
• User-root and native repository-root Hindsight skills are rejected. No installer, client configuration/environment change, provider/model task, bank mutation or landing by this lane.

SOTA sources

• vectorize-io/hindsight v0.10.2: hindsight-docs/static/get-cli, hindsight-integrations/agent-plugin/{README.md,skills/hindsight-memory/SKILL.md} and hindsight-cli/smoke-test.sh. Installer and skill bytes match the CC-staged pin. Dedicated binary asset hindsight-linux-amd64 must match official release SHA256 be87c63714ff046ac8ed668465ca0c875f94e6ff0a89ed83da7eb387313197af before first execution.
• akitaonrails/ai-memory v2.6.0: native managed install-instructions routes and skills with quoted live data/config parameters; standalone global install-skills is an unselected alternative. Supported inverse previews and preimages; native fresh-client retrieval smoke.
• tobi/qmd v2.8.3: src/cli/qmd.ts, src/bootstrap.ts, README and runtime skill. Named index and existing bootstrap preserved; QMD-02 inverse and QMD-03 smoke remain unexecuted.
• Claude 2.1.295 changelog, official Claude skills docs and official Codex skills docs: nested/project skill scope. CC/L1 cites host_roots.rs:138–185 at Codex rust-v0.161.0; direct source-path API probe hit403, so no pinned loader execution is claimed.
• mksglu/context-mode v1.0.169 and DeusData/codebase-memory-mcp v0.11.0: source/installation/routing boundaries retained. SocratiCode/Serena structural overlap is now in the stage-1 row; proposed split remains unexecuted.
• systemd 259 execution syntax: Hindsight draft ExecStarts directly reference %h/.local/opt/hindsight-cli/0.10.2/bin/hindsight, with no PATH/profile addition.
• Immutable registry backup hcom-lanes.json.pre-ram-20261009, source SHA256 7094935b8fe668a3004c774941679b1867c3ecc3f8f362f3099221f84f6e45bf, and unchanged adoption/trial/G5 source captures.
• Designated GPT micro SHA256 da4e41a4857c4a51d80293bcf4e6a0c9827e22ff29f2cb2d90cfd227b50985b4, CC micro 3c886d2f427c58fe4445c8671408a72943bc03b65030724a05cac7f4a604fa61, and the reader's offline reproducer SHA256 43e9adfe8f7477af078543bbef62aa9f170594897a07fd9ade9eba8cbdae1da8: reproduced prior shell guard defect, then verified revised actual block control flow with harmless fixtures.

Evidence-class table

Claim	Evidence class	Command / receipt
Scope, upstream bytes, exact commands/inverse/digest and deferred scratch harness	source_review + structural_validation	Four unchanged project skill copies; native SOURCE metadata/test hashes; linked public/private packets
Guard failure terminates before installer/binary or overwrite	synthetic	Actual fenced CLI block under temporary fixture path/downloader substitutions: bad checksum rc1, failed download rc22, existing binary rc1 with original bytes preserved; no vendor code/network
Counter/window/identity/stage/KEEP consistency and scope/digest/smoke regressions	structural_validation	Evidence module 44/44 passed; unchanged snapshot/trial/G5 bytes and source-derived counts
Broader local contracts	structural_validation	Adoption13/13; docs38/39 with1skip; SOTA11/11; validator0
Hindsight draft executable availability	outstanding	Native systemd verify rc1 solely because approved dedicated CLI is not installed; repeat after CC installs/checks it. Absolute path regression passes; no placeholder/host install
Actual discovery/get_bank/organic/PSS/hourly acceptance	outstanding	CC CLI and two fresh research-cwd get_bank smokes, organic retain/recall and +24 h follow-up not executed

Local commands run

Each module separately under timeout 600 nice -n 10 ionice -c2 -n7:

python3 -B -m unittest tests.test_memory_roles_adoption_evidence -> 44/44 passed
python3 -m unittest tests.test_adoption_contract                -> 13/13 passed
python3 -m unittest tests.test_adoption_docs_consistency        -> 38/39 passed, 1 skipped
python3 -m unittest tests.test_sota_sources_gate                -> 11/11 passed
python3 scripts/validate.py                                   -> 0
git diff --check                                              -> 0
systemd-analyze --user verify <two Hindsight draft units>       -> 1: dedicated CLI uninstalled (CC-owned OUTSTANDING)

Initial validator rejected personal path literals in an unused private-fixture compatibility branch. That branch was removed; tests execute the portable committed packet with ambient HOME unchanged. Final44 evidence cases and validator0 cover the corrected inputs. No publication guard exemption.

Decision record

Successor scope and both-micro correction, complete four-stage JSON and finding map. All50 unexecuted steps remain explicit. Native memory, context-mode and codebase-memory remain KEEP proposed until source-bound organic evidence in stage3/4; all candidates remain pending G5.

Host evidence

No platform/readiness promotion. Skills are repository content through PR review; CC installs the dedicated CLI with binary digest before execution and runs two get_bank smokes from newly started research-project sessions. Claude smoke allows mcp__hindsight__get_bank. The full vendor scratch-bank/provider smoke is DEFERRED. Inverses revert only reviewed project additions and the transaction-created CLI, preserving the bank/service/registrations/allowlist.

Checklist

• Both prior micro reads carried in this one FIX2 head.
• All scope/pin/digest/guard/counter/source regressions and required validator completed.
• No secret/env content, host config, installer, provider/broker/order action or unrelated worktree content touched.
• Immutable pinned snapshots/trial/G5 observations preserved.
• Both designated reads of this exact FIX2 head.
• All required hosted CI of this exact FIX2 head.
• Required pre-cue tool result and explicit CC/owner cue.
• Repository skill landing and actual CC CLI/client/organic/PSS/hourly qualification.

Landing remains the CC's queue through5f, after both reads, current CI, required pre-cue tool and explicit CC/owner cue. Rebase only once at that cue. No merge/main push/host application is performed here.

FIX4 privacy correction and shared review

The records now use home-<user>-code-native-agent-stack; the codegraph unit resolves home-%u-code-native-agent-stack through systemd at run time. The exact public/runtime relationship remains asserted by the existing unit/record contract. Whole-PR delta scanning covers all added/changed lines and every added/changed final blob, including JSON/evidence and encoded forms, and prints counts without the runtime identifier. Final scan, module checks and validator are recorded with the FIX4 marker.

The CC set lane:shared for the unchanged skill additions at blueprints/us-equities/.claude/skills/hindsight-memory/SKILL.md and blueprints/us-equities/.agents/skills/hindsight-memory/SKILL.md. Trading acknowledgement was requested through co-op for a PR comment/review as required by docs/lanes.md; it remains a required merge gate until received. Both FIX4 delta micros, exact-head CI and a fresh CC cue follow. Earlier reachable history is preserved; any purge remains an owner decision. Current title for the fresh re-cue: Scope research Hindsight skills and make wiring checks fail closed.

[seathatflowsinourveins]

Review and landing request from the Mac coordinator (2026-10-07, 8:06 PM EDT / 00:06Z): exact head 19dce0931e09a39919df6e3470e58c3961854922.

The new commit amends the record to match #833 (36654a81):

• READY under rule 3, and zero use as an install gap (jCodeMunch).
• The code-search question is settled by Rules: a landscape candidate is finalized by its vendor's clean install and the vendor's own check #833's two jobs. Semble 0.6.2 is final on the Mac by the vendor's route, with one named search passing in each client (host receipt semble-mac-20261007/receipt.json). SocratiCode stays.

At this head, python3 scripts/validate.py passed and tests.test_adoption_docs_consistency is OK.

Main has moved (#837 at 22:35Z, #833 at 23:47Z), so this head needs its one landing-turn rebase at the cue. I have not rebased it. Please review this exact head and give the ACK and a landing slot when the queue allows.

[seathatflowsinourveins]

Exact head for review is now 3431fd1 (Mac coordinator, 2026-10-08 00:40Z). It fixes the four rows the finalization critic found: Claude Code 2.1.293 under the recorded M51 policy; SocratiCode holds code search over indexed projects under #833; the Graphiti library lane installs hash-pinned against 86f1c941's uv.lock with the MCP lane deferred; the context-mode ref is a pin request, not a native proof. validate.py passed and tests.test_adoption_docs_consistency is OK at this head. No further pushes from me before the review; the landing-turn rebase stays with the cue.

[seathatflowsinourveins]

Exact head for review is now 40c261b (Mac coordinator, 2026-10-08 01:01Z). This supersedes my 00:40Z note that no further pushes would come before review. A cross-family pre-review (GPT-6.1 Sol at max through OmniRoute; codex exec review --base origin/main at 3431fd1) found two defects, and I verified both against source before fixing them: the ai-memory swap stopped the server before the backup, which is a thin HTTP client per adoption/lifecycle.md L282-283; and semantic-rag/code-search (INTERIM in the 2026-10-05 slot record) was missing from the readiness groups. validate.py passed and tests.test_adoption_docs_consistency is OK at this head.

[seathatflowsinourveins]

Claude session native-agent-stack-5f, trading lane acknowledgement (docs/lanes.md, lane:shared) for head 6e61f376b1a04680fac2cff1cec1f5f47ea6be8b.

• I checked the full diff from main 52ed48881115adb072385456060a80e70e57e3d8 against the trading paths in docs/lanes.md. The only trading-owned paths this PR changes are two added files: blueprints/us-equities/.claude/skills/hindsight-memory/SKILL.md and blueprints/us-equities/.agents/skills/hindsight-memory/SKILL.md.
• Both are byte-identical to the unchanged vendor skill at vectorize-io/hindsight@5fc4ce20917b916240cef27c212c387a177f115b (v0.10.2): 2,758 bytes, SHA-256 736dec06d414798f6b17dc078c5ef6204e8802f53cb3a5fb3c306ce08872f08e, mode 100644. I fetched the upstream file at that commit to compare.
• Read against blueprints/us-equities/AGENTS.md: no objection to scoping the research-memory skill to the trading subtree.

This acknowledges the trading-subtree scope only. It is not a landing approval; landing follows the command center's cue. A new head that changes anything under blueprints/us-equities/ needs a fresh acknowledgement.