Qualify five portable tool releases and current adoption pins

[seathatflowsinourveins]

Scope

Five clean portable tool releases are qualified through supported vendor routes and selected in the current manifests/projections: Beads1.3.1, Promptfoo0.124.0, Syft1.54.1, jcodemunch-mcp1.108.333 and uv0.12.23. The complete live comparison records69/69stack components plus adoption's3independent pins; unqualified/stateful/runtime/major/channel candidates retain dated holds.

• Base commit: eb5fee4db9a494729deb29bdf38dbabac23ee643
• Lane: lane:foundation
• Owned scope: current stack/saturation/source snapshot, adoption uv/Linux/Mac source metadata, nativeCI/Syft workflow pin bindings, current recipes, the existing NewWSL owner/profile/install-plan/handbook projections, compact sanitized receipts and the final evidence registry.
• One commit includes current source changes and final registry registration. Frozen judge text, historical lifecycle receipts, SDK/Python/north-star acceptance locks and active client/service configurations retain their scope.

SOTA sources

Vendor	Clean release and immutable source	Supported route/oracle
gastownhall/beads	v1.3.1@c1c4b642ac1c08d8c828007a1c2f96e47e43ef7c	Publisher Linux archive/checksums and native gh attestation; native embedded-Dolt issue lifecycle
promptfoo/promptfoo	0.124.0@30949931ee90c963acd487e97828c9441db0bcd4	Native npm artifact; unchanged test/fixtures/package-artifact ESM/CJS fixtures, also invoked by the upstream package harness
anchore/syft	v1.54.1@b254e6d92f28c3868a755f62fb3ca8f26e9fee76	Publisher installer/checksum; unchanged Bun lock fixture and native CycloneDX conversion
jgravelle/jcodemunch-mcp	v1.108.333@bbe30fa299c4f82251233f25b8a0c5c56e2d407a	Native uv tool install and MCPorter indexing/outline/source retrieval on unchanged upstream Python fixture, AI summaries disabled
astral-sh/uv	0.12.23@46b84fd0bfec23b72f29e8e2185ba68a65052f48	Publisher unmanaged installer/checksum; documented offline generated project lock/run/check

Evidence-class table

Claim	Evidence class	Command / receipt
69component/3adoption-pin live vendor comparison	source_review	evidence/artifacts/vendor-currency-20261008/comparison.json; cached native vendor commands, source locators and original observation hashes
Beads issue state persists open→claimed→closed	native_proven, synthetic fixture	evidence/receipts/beads-131-qualification-20261008.json
Promptfoo ESM/CJS each verify pass1/fail1/provider-error1, zero model runs	focused unchanged upstream tests	evidence/receipts/promptfoo-01240-qualification-20261008.json
Syft yields exact10npm versions and preserves10purls in CycloneDX1.7	native CLI integration using unchanged upstream fixture	evidence/receipts/syft-1541-qualification-20261008.json
jCodeMunch indexes5symbols and returns exact source/hash	native MCP integration using unchanged upstream fixture	evidence/receipts/jcodemunch-1108333-qualification-20261008.json
uv locks/runs/checks an unchanged generated project offline	native CLI synthetic workflow	evidence/artifacts/vendor-currency-20261008/uv-01223-qualification.json
Canonical identity/owner/plan/handbook/nativeCI bindings	local_integration	evidence/artifacts/vendor-currency-20261008/integration.json
Mac archive/digest references	source_review	Publisher release digest/checksum sidecar; no Mac execution/retirement or platform status claim

All five inverses completed before publication: native scoped invalidation/uninstall/cleanup or owned-prefix retirement. Previous host prefixes/stores were preserved. Each receipt retains actual outputs, original hashes, warnings, failed attempts and explicit untested boundaries; public path locators are sanitized.

Local commands run

python3 -m unittest tests.test_stack_lifecycle tests.test_catalog_freshness_pins tests.test_native_token_ci tests.test_new_wsl_definitive_defaults.Manifest.test_owner_pins_are_the_repository_pins tests.test_new_wsl_handbook.NewWslHandbookTests.test_the_committed_outputs_are_current_and_the_handbook_receipt_names_them tests.test_upstream_surface_watch.DispositionCitationTests.test_every_cited_line_names_the_key -v
rc0; Ran68tests in2.015s; OK

python3 -B evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
rc0;84rows,193commands,113acceptanceentries agree with native scripts

python3 scripts/component_matrix.py --check
python3 scripts/new_host_grand_list.py --check
python3 scripts/build_new_wsl_handbook.py --check
all rc0

python3 scripts/validate.py
rc0 at2026-10-08T15:00:30.634378Z;69components,10838files,4profiles,232receipts
Integrity and scope checks only; no live provider or GPU execution.

git diff --cached --check
rc0 after removing the new decision's trailing blank line

The integration artifact retains initial stale-pin preflight failures and two corrected test-selector mistakes. Existing source/exception/interrupt gates remain unchanged. The source projection worker also passed the existing generators/checkers and four focused owner/profile assertions; destination install/accept scripts were syntax-checked, not run.

Decision record

docs/decisions/2026-10-08-qualified-tool-currency.md names sources, alternatives, evidence classes, inverses and overturn conditions. The separate runtime candidate question remains with the CC; this PR changes no accepted trading lock or SDK interpreter pin.

Host evidence

No evidence/hosts/ files or platform-status flips. Hosted Syft install/SBOM acceptance and final-head repository checks remain owed. Optional signatures, full tool harnesses, host migration, semantic/model/provider and Mac execution scopes are not promoted from these bounded results.

Existing live foundation pin correction

Co-op A56 (2026-10-08T14:29:41Z) also directed correction of the already active foundation vLLM0.31.0 pin. evidence/receipts/vllm-031-working-pin-binding-20261008.json binds the active unit/metadata and official wheel to retained native uv metadata/archive/hardlinks at vllm-project/vllm v0.31.0@db9527a46873454610df6dbedf79a36d6bf1a7f6. Current non-catalog stack/lifecycle/platform/recipe/release surfaces record that state without a new installation, restart or model run. Prior0.30/0.25 comparisons,0.29WSL failure and0.30 inverse stay dated. The later GPT complete operation gate remains FAIL/open; installation binding is not dual-clientS4 closure. Its catalog projection is handed to the G5 sole assembler. The refreshed68affected tests pass (2.253s), and final native validation at15:34:57Z returns0:69components,10839files,4profiles,233receipts. No trading runtime/north-star lock changes.

Checklist

• Existing workflow action SHAs and permissions retained; only the paired Syft release/checksum/report/freshness pins change.
• No credential values, authentication stores or private active client configurations read or published.
• No new paid hosting/subscription/billing surface or provider run.
• Peer-owned paths and dated evidence preserved; relevant NewWSL path owners cleared the bounded projection worker.
• Registry updated with supported registration in the final commit; native validator passed.
• Final-head hosted checks and CC landing cue through5f.