tools(landing): move the CC's landing scripts into the repository, with offline tests

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: moves the CC's three landing files, uet_land.sh, nas_land.sh and codex_gate.py, into tools/landing/ so the repository holds the one copy, with the user's home directory replaced by variables whose defaults reproduce today's paths (three lines per shell script, codex_gate.py byte for byte), and adds an offline test module for them. It is the CC's request: "ONE PR to native-agent-stack, lane:shared: move nas_land.sh, uet_land.sh and codex_gate.py into tools/landing/; paths come from ${XDG_STATE_HOME:-$HOME/.local/state}-style variables so there is no username or home literal; add the offline harness subset as CI tests there". The CC will run them from a clone of this repository after it lands. Synced on 2026-10-11 (210bc7e4) to the live copies the CC installed at 00:02Z, which add the head-following of uet#58 and the no-reply squash author of CC correction Point new machines at the attested release v2026.09.23.1 #148; see "The sync of 2026-10-11" below. Review rounds 1-3 (0d5a59f, 6c17af2, af9d190, 761810d) then changed the repository copies, so they no longer equal the live ones line for line. After landing, the CC replaces the live copies whole from the repository; see "Review rounds" below.
• Base commit: 9d4c00cd05d79b3fd5074df2e46bacab87ee67ff
• Lane: lane:shared. tools/ is foundation-owned (docs/lanes.md:24) and the scripts land pull requests of the trading repository as well as this one, so the change serves both lanes (docs/lanes.md:29). The trading lane's acknowledgement, as a comment or review on this PR, is required before the merge cue (docs/lanes.md:149).
• Owned paths touched: tools/landing/ (new: the three files and a README) and tests/test_landing_scripts.py (new), both foundation-owned; manifests/evidence.json (shared hot file; eight new rows only: the three files, their README, the test module and three fixtures, registered through the hot-file protocol).

SOTA sources

The code moved here is the CC's own, corrected over today's session (#118, #121, #122, #123 and #136, recorded in the scripts' comments and in tools/landing/README.md). The upstream mechanisms it relies on, and that the tests exercise, are:

• git v2.39.0 (c48035d29b4e) and the installed v2.53.0 (67ad42147a7a), Documentation/git-patch-id.txt (blob 1d15fa45d5, 2,430 bytes, --verbatim at L33; absent from v2.38.0, whose blob is 442caff8a9): the change identity is git patch-id --verbatim of the -U0 --binary --no-renames diff between a commit and its merge base. The README therefore requires git 2.39.0 or later.
• GitHub CLI v2.102.0 (fc4b137cdef0), pkg/cmd/api/api.go (blob cb2b86dcc0; --slurp at L58 and L138) and pkg/cmd/pr/merge/merge.go (blob 1de7ccffad; --match-head-commit at L184); --slurp first appears in v2.48.0 (fd4f2c9c1f76, api.go blob dc80298b2f; v2.47.0 has none), so the README requires gh 2.48.0 or later.
• GitHub CLI v2.102.0 (fc4b137cdef0), pkg/cmd/pr/merge/merge.go (the same blob 1de7ccffad): -A, --author-email ("Email text for merge commit author") at L185, passed to the merge as authorEmail at L295. Whether GitHub applies it to a squash merge is not tested here: the first landing is the test, and lg_author_check exits 12 if the merge commit's author is not the no-reply address.
• GitHub GraphQL schema, github/docs at be38ec5d78e24172587e61b3c6ff40ace1865c71: src/graphql/data/fpt/schema-commits.json (blob c517be6cb3, 94,329 bytes): the union StatusCheckRollupContext is CheckRun or StatusContext (L2306) and StatusState is ERROR, EXPECTED, FAILURE, PENDING, SUCCESS (L2274); schema-checks.json (blob 4abec62bfe, 67,694 bytes): CheckStatusState (L1325) and CheckConclusionState (L1195). These are the types the CI line's --jq program reads; correction Book same-account paper fills made outside the durable ledger #136 fixed it counting a StatusContext (which has .state, not .status) as never complete.
• The review rounds' mechanisms are cited in tools/landing/README.md, "Upstream sources for the tools(landing): move the CC's landing scripts into the repository, with offline tests #975 corrections". Each source was fetched on 2026-10-11 at its pin, and its sha256 and the lines read are recorded there. Round 3:
  • cli/cli@v2.102.0:pkg/cmd/pr/merge/merge.go L184, L294, with the gh_pr_merge manual page. --match-head-commit pins the head only.
  • The GitHub GraphQL schema: MergePullRequestInput (only expectedHeadOid is a pin), IssueComment.userContentEdits and UserContentEdit.diff/editedAt. These give a review's start from the connector's summary-comment revisions.
  • github/rest-api-description@58b1e0c00b39 L55724: statuses come newest first.
  • git/git@v2.53.0:Documentation/git-ls-remote.adoc L6, L93-L97, plus revisions.adoc L14-L18 and usage.c L40-L43, L82.
• Round 4 (the README's second sources table):
  • util-linux/util-linux@v2.41.3:sys-utils/flock.1.adoc L59-L60, L68-L69, L78, L124-L125 and sys-utils/flock.c L189, L351-L363, L392-L399: exec <fd><>file; flock -n <fd>, exclusive by default, a held lock exits 1 silently.
  • git/git@v2.53.0:builtin/fetch.c L2725, run-command.c L1829-L1837, builtin/gc.c L1823-L1827, setup.c L2083-L2105 and Documentation/config/maintenance.adoc L6-L15: a fetch starts detached auto maintenance, which keeps every descriptor but 0-2, so the scripts run children with the lock descriptor closed.
  • The GitHub GraphQL schema (sha256 3ed09565…): IssueComment author, body, createdAt, fullDatabaseId: BigInt, userContentEdits; UserContentEdit.editor; ReactionContent.EYES. github/rest-api-description@58b1e0c00b39 L146097-L146102 (check-run.started_at is nullable) and L148544-L148557 (reaction eyes); jqlang/jq@jq-1.8.1 L1544-L1552 (null sorts first).
  • The connector's own summary comment on nas#975, read with the gate's query and kept masked as tests/fixtures/landing/codex-summary-comment.json (sha256 3918a253…), whose footer says "Codex reacts with 👀 while any review is running".
  • python/cpython@v3.13.16:Modules/main.c L403-L410, L437-L441, plus Doc/library/sys.rst L394-L399 and Doc/library/re.rst L769-L773.
  • github/docs@be38ec5d variables.md L32, L36 (CI, GITHUB_ACTIONS).
• A1, pagination and the combined status (f206d6de; the README's last three source rows, read from the local upstream mirrors at these pins):
  • cli/cli@v2.102.0:pkg/cmd/api/api.go L260-L273 (--slurp needs --paginate and refuses --jq), L358-L360 (a per_page in the path is kept), L362-L371 (every page into one JSON array), L431-L470 (the page loop), L546 and L553-L565 (a failed page's body is still written, and gh exits non-zero); pkg/cmd/api/pagination.go L17-L24 (the next page is the Link header's rel="next") and L94-L110; go.mod L21, L141 (gh's own --jq is go-gh's, on gojq).
  • github/rest-api-description@58b1e0c00b39 L55518, L55521 (checks/list-for-ref takes per_page and page), L344577-L344585 (per_page, "max 100"), L55563-L55564 (a Link header).
  • github/docs@be38ec5d using-pagination-in-the-rest-api.md L22, L28, L49 (request the next page from the link header's rel="next").
  • jqlang/jq@jq-1.8.1 L1544-L1552 and L2425-L2433 (null orders before every string, and > uses that order, so a run without a time supersedes nothing).
  • github/rest-api-description@58b1e0c00b39 L55664-L55667 (the combined status, "a combined view of commit statuses for a given ref", whose state is success "if the latest status for all contexts is success"), L55687, L55690 (per_page and page), L148666-L148707 (combined-commit-status); github/docs@be38ec5d src/rest/data/fpt-2022-11-28/commits.json L9530 (the same operation). Neither states one entry per context; that, and paging by context with Link rel="next", were measured read-only on 2026-10-11.
• The correction Book same-account paper fills made outside the durable ledger #136 harness (trading-cc/land-patches-20261010/harness/run.py, outside this repository): this PR's tests are its offline subset, with the same decision-site extraction and the same synthetic inputs. Its parity result on the moved files is below.

Evidence-class table

Claim	Evidence class	Command / receipt
Only host literals changed: three lines per shell script, the same line counts (232 and 243), codex_gate.py byte for byte	local_integration	diff of each file against the CC's live copy (below); the three expressions expanded to the CC host's paths reproduce the live sha256 values 301fb5b07274… and 96144670bc30… (the CC's installed copies of 00:02Z) byte for byte (sync_975_scripts.py checks it, scratch)
The correction #136 harness gives the same result on the moved files as on the live ones	local_integration (captured host inputs: 594 real Astra verdict files and their wrong-head variants, the real CC and co-op layout files, 65 real records, 18 scratch-repository changes, captured rollups)	an adapted copy of the harness (its home-literal substitution replaced by COORD=<dir> in the prelude; not committed) against tools/landing: 2,047 cases, 0 differ; the original harness against the CC's patched copies at the same moment: 2,047 cases, 0 differ, with identical per-site counts (the real-file set grows as verdicts land: 2,008 when the correction was measured)
The decision sites decide as specified	synthetic	tests/test_landing_scripts.py: 107 test methods at 80bcd77e (45, and 417 sub-cases, before the 2026-10-11 sync), offline: 34 verdict files through both loops and the GPT block, 17 records, the description forms, the status states, the GATES_DONE rule, 17 scratch-repository change cases and a hostile diff configuration, 24 CI rollups, codex_gate.py precedence on canned API data, and each script end to end with a fake gh, python3 and sleep (variables and defaults, the gate path through a symlink and a wrapper, the order in which the gates stop a landing, a pure rebase landing pinned to the new head; since the sync also lg_follow_head as a decision site, a head followed during CI, a head that keeps moving, and the author address: the merge argv, exits 11 and 12)
Those tests catch the edits they exist for	synthetic	323 single-line mutants of the shared block, the CI lines, the trading-cc-read gate, the verdict loops and GPT block, the Codex wait and merge steps of both scripts, the variable defaults and codex_gate.py: 302 caught, 21 survive, each equivalent or covered first by another check, for the reason listed below the table; the two source-binding tests are deselected for the census
The repository validates with the five new rows	local_integration	below

The 2026-10-11 census covers only the code the sync adds, in both scripts: 30 single-line mutants of the head-following (limit, change test, counter, adoption, stop) and of the author address (the -A argument, the lookup and its exit 11, the post-merge check and its exit 12, the gh api user path, the numeric-id test, the comparison, the printed text, the owner login, the retry count): 30 caught, 0 survive. One (the new head's fetch fallback removed in uet_land.sh) is caught only by the block-identity test; no behavioural test fetches a head the clone lacks.

The 21 survivors (of 323; 128 of 139 caught in uet_land.sh, 124 of 133 in nas_land.sh, 50 of 51 in codex_gate.py), in both shell scripts unless noted, and why none is observable:

• a trailing CR kept on line 1 (tr -d '\r' removed): the Astra regex ends in a non-word-character test and a carriage return is not a word character;
• the hexadecimal tail after the head prefix removed from the Astra regex: [^:]* consumes those characters anyway;
• CHANGES_REQUESTED added to that regex's words: line 1 is rejected for it before the regex is tried;
• the r3 branch without its records test: in files mode $line comes from the r12 grep only, so the branch is never reached;
• the names: hash truncated to two characters: with one excluded path the fallback can only ever hash that one name;
• the -- . pathspec dropped: git adds the implicit match-all to an exclude-only list and lists everything with none;
• -c diff.mnemonicPrefix=false dropped: the option does not change the prefixes of a commit-to-commit diff (git-diff documentation);
• || return 1 dropped from the first identity: an empty first identity can only equal a second that also failed, and that one still returns 1;
• [ -f "$GATES_DONE" ] dropped: grep on a missing file fails, so the chain still ends in the exit-2 branch;
• LG_EXCLUDE dropped (uet_land.sh only): uet_land.sh never sets it (the same mutant is caught in nas_land.sh);
• [ -n "${GPT_VERDICT:-}" ] dropped (uet_land.sh only): lg_verdict_file_ok on an empty path says "file missing" and the same branch exits 9;
• .replace("Z", "+00:00") dropped (codex_gate.py only): fromisoformat reads a trailing Z from Python 3.11; the replace is for older Pythons.

The sync of 2026-10-11 (210bc7e4, one commit)

• Why. The CC changed the live scripts after this PR was opened: the head-following of uet#58 (16:55Z) and, at 00:02Z, CC correction Point new machines at the attested release v2026.09.23.1 #148 (every squash merge had been authored with the owner's primary email; GitHub does that unless the merge names one). This commit makes the repository copies those scripts again, with the same three host literals per file as variables. Installed live digests: uet_land.sh 301fb5b07274b28fde0f2061356bf9682883eca352c8bcb7a3119e8934920c7d, nas_land.sh 96144670bc301036604fc39e57e3ab4e4a2e43a6b9d6b8b645ef7b02482f4017, codex_gate.py unchanged. The patch itself, with its test and proof, is trading-cc/land-patches-20261010/author-email-148/ (outside this repository); here its end-to-end form is part of tests/test_landing_scripts.py.
• Author address. lg_author_email forms <id>+<login>@users.noreply.github.com from the repository owner's login and the id of the public gh api users/<login> --jq .id (never gh api user; a non-numeric id fails closed), the merge passes it with -A, and lg_author_check compares the merge commit's author with it inside jq and prints text only, never an address. The tests use a fake gh, the placeholder id 4242424 and an .invalid address; no real address appears in the repository.
• Why validate was red. test_no_home_literal_or_user_name_in_tools_landing read every entry of tools/landing, including the __pycache__ directory other tests create by importing codex_gate.py, and failed with IsADirectoryError in the shard that ran both. It now reads files only.
• Verification. The module: 51 tests, OK. The grouped run, validate.py and the manifest check: below. The five evidence rows follow the changed files (tests/test_landing_scripts.py, tools/landing/README.md, nas_land.sh, uet_land.sh; codex_gate.py unchanged).

Review rounds (2026-10-11)

1. 0d5a59f2 (the tools(landing): move the CC's landing scripts into the repository, with offline tests #975 P2s). Non-pass check conclusions fail closed. A failed merge is never echoed. The scan covers the host name.
2. 6c17af27 (review). A failing Codex gate prints one fixed line and exits 4. Commit statuses fail closed. The README records are corrected.
3. af9d1901 (the GPT micro). The scan covers every prohibited identity. Status descriptions and gh stderr are withheld. Each mechanism is cited.
4. 761810d7 (the Codex review of af9d190: 3 P1 + 3 P2; the GPT micro: 5 P2 + P3; the Claude micro's P3s).
   • Codex completion is bound to a review that started after the latest trigger. The start comes from the summary comment's revisions, read through one GraphQL userContentEdits query. A +1 counts only after an attributable start.
   • A gate that turns unavailable (5) at either gate call needs the GPT substitute verdict (uet).
   • The trading-cc-read gate is read again immediately before the merge, in both scripts.
   • nas_land.sh and main: it records the base it validated and re-reads main with git ls-remote as the last step. It revalidates up to three times, then stops with the new exit 13.
   • The gate receipt is bound to the resolved eight-character head.
   • gh values: every one is type-checked before use. Local failures print no path and no diagnostic.
   • The identity scan covers percent-encoded joiners and home paths in any case. The generic-account exemption applies in CI only.
   • Each correction has a test that fails on af9d190.
   • Declared gaps (README "Known gaps"):
     • the seconds between git ls-remote and the merge call stay open, because GitHub's merge pins only the head;
     • the connector's summary rows carry no review id;
     • in nas_land.sh, the author lookup now runs before validation, so exit 11 can precede exit 10;
     • a failed GraphQL call is gate exit 4, so the script stops with 9.
5. 5b8ba3b2 (round 4: the CC's Claude micro at 761810d, P2-1 to P2-4 and P3-1 to P3-8; the co-op's GPT micro, CHANGES_REQUESTED, two P1 and four P2; Codex's four P1 threads). A restructure instead of one more re-read:
   • A landing lock per repository (flock -n on descriptor 9; exit 14 before any call). Children run with the descriptor closed.
   • One final_gate after every slow step, fast reads only, then the pinned merge: the head and its change, the verdict files and GATES_DONE, trading-cc-read (a failed gh call now stops with 2), the Codex gate (a 5 needs GPT_VERDICT in uet), CI at the head, and in nas origin/main against the validated base.
   • Verdict files, records and receipts are read once; a read that fails is a refusal that prints no path.
   • nas check runs: a name is incomplete while any of its runs is, and judged on its latest completed run. An unreadable main is its own stop.
   • codex_gate.py: one GraphQL snapshot (a summary whose newest revision is not its body gives 3), trigger <= start <= completion, the row's commit must prefix the read head or the current head, only the connector's revisions count (another editor gives 4), 👀 gives 3, and summary edits count as activity.
   • Tests: the final gate's reads are the last calls before the merge; each gate flipped between its first read and the final gate stops with its code and no merge (12 of the 17 flips merged at 761810d; the other five already stopped). Every new regression fails at 761810d.
   • Declared, not closed (README "What the final gate narrows but cannot close"): the local-only gates (verdict files, GATES_DONE, trading-cc-read, Codex, GPT_VERDICT, nas's base) are narrowed to the seconds before the merge call. GitHub's merge pins only the head, so the GPT micro's A5 for nas's base remains. Attribution by trigger kind (C2) waits for a measured security-review row. The closure path is the review App and required checks (an owner item). The lock covers our own landings, not merges made out of band.
6. 3e6e7e46 (the final round: the CC's adjudication of 5b8ba3b2, the Claude micro's B1, P3-a and P3-d; Astra's follow-up 1, ruled fix-now; Codex F1 and F2).
   • B1: tcc_read_gate took sort_by(.updated_at)|last, and jq's stable sort kept the older of two statuses posted in the same second, a success over a newer failure. REST lists a ref's statuses newest first (github/rest-api-description@58b1e0c0 L55724), so both scripts take the first status of the context. The regressions (one updated_at, the failure listed first) at the first read and as a final-gate flip at the author lookup stop with 2 and merge nothing; both merged at 5b8ba3b2.
   • Astra's follow-up 1: nas_checks ranked completed runs by max_by([.started_at // "", .id // 0]), so a completed failing re-run with a null start lost to an older success. The check runs are now read with filter=latest, which "Filters check runs by their completed_at timestamp" (L55504-L55514), and each name is judged on its completed run with the greatest completed_at. Both timestamps are nullable (L146097-L146107), so a completed run without completed_at, or a tie with two conclusions, counts as incomplete. Astra's replay (exit 5), a final-gate flip (exit 5, no merge) and the null completed_at case (exit 6) each merged at 5b8ba3b2.
   • P3-a and P3-d: the lock is held after a signal until an in-flight $(…) call returns (exit 14, fails closed; measured), and the trigger window is worded as the snapshot sees it.
   • Codex F1 (the change identity at -U0 ignores where an edit is, git/git@v2.53.0:Documentation/git-patch-id.adoc L17-L18) is a declared gap in the README and a research-queue item, with no code change. Codex F2 is a follow-up (below).
   • Tests: the flip suite has 20 flips; 15 merged at 761810d7, 3 at 5b8ba3b2 (the two B1 flips and the re-run), and none now.
7. f206d6de (A1, pagination, the passing tie and the combined status: the CC's Claude micro at 3e6e7e46, CHANGES_REQUESTED, its A1 and P3-1/P3-2; Codex's P2 at nas:289 and, by the CC's scope amendment, Codex's P1 at nas:234). One correction to nas_checks and to both scripts' tcc_read_gate:
   • A1 (a gate fail-open). A name was judged on its completed run with the greatest completed_at, so a failure that started later and finished first passed beside an overlapping success that finished last (input F: exit 0 and one merge at 3e6e7e46); start order passed the mirror, input G, at 5b8ba3b2. A name now fails when one of its completed runs ended other than success, neutral or skipped and no run of that name both started and completed after it. A run without started_at or completed_at supersedes nothing, since jq orders null first, and a failing run without them is superseded by nothing (fail closed; 0 of the 2,072 live runs below lack either time). filter=latest and the any-incomplete refusal stay; Ground G6c-B practice records in upstream sources while preserving frozen replay #886's superseded cancellation, a failure re-run to success and the live success-and-skipped overlap still land.
   • The passing tie (P3-2) and the failing tie (P3-1). The tie rule is gone: runs that share a completed_at pass when each passes (success and neutral exited 6 after the timeout) and fail at once when one fails (exit 5, not 6 after about 50 minutes). validate counts when it is complete, not failing, and a run with its greatest completed_at succeeded, so its own success-and-neutral tie validates whichever is listed first.
   • Pagination (Codex P2 at nas:289). The read is gh api <path> --paginate --slurp; gh's exit code is checked before jq reads (a failed page's body lands in the array too), and jq judges the runs of every page together, its stderr dropped (its error quotes the start of the value it failed on). Measured on 2026-10-11 at 26f551b1 (43 runs): per_page=10 gave 5 pages, total_count 43 on each, the same 43 ids and the same counts as one page of 100, and the next link kept filter=latest.
   • The combined status (Codex P1 at nas:234, both scripts). tcc_read_gate read page 1 of the newest-first statuses list (L55724), the 100 newest statuses of every context, so a trading-cc-read failure behind 100 newer statuses of other contexts was not on it and passed as "no status". It now reads the combined status, GET .../commits/{ref}/status (L55664-L55667), on every page (--paginate --slurp; per_page and page, L55687, L55690), and takes the trading-cc-read entry. The docs do not say the entries are one per context; measured read-only on 2026-10-11, on 8 public kubernetes/kubernetes heads (2 to 35 statuses in 2 to 15 contexts) and on the 12 of our 80 heads with statuses, every context appeared once, as the list's newest status of it, total_count was the number of contexts, and at per_page=5 the 5 heads with 13 to 15 contexts gave a Link rel="next" and the same entries over 3 pages as one page of 100. So B1's same-second choice is GitHub's now. gh's exit code still stops (exit 2); a reply that is not an array of pages with statuses, an empty one included, stops too (jq -n fails at input); only a combined status without the context is "no status".
   • Tests (107, OK): ci_reference_nas follows the rule; F, G, the ties, runs with no start, validate's own tie and overlap, and two pages (a failing or a running check on page 2, a page-2 failure superseded on page 1) as CI lines with written-out counts and as whole landings; F and G also as final-gate flips; a reply jq cannot judge prints neither jq's error nor the value. In both scripts, a trading-cc-read failure or pending status behind 100 newer statuses of 100 other contexts, or of one, stops with 2, a success behind them has its record checked, unreadable combined replies stop, and the B1 same-second cases still pass. The fake gh serves page 1 of the list as its first per_page statuses and builds the combined status as measured. The call-order test requires --paginate --slurp on both reads. The new test file gives 51 failures on the 3e6e7e46 tree, all new assertions (there F, the page-2 failure and the page-2 running check each merge, and behind 100 newer statuses the gate gives "no status" and both scripts merge), and 51 on the 5b8ba3b2 tree (G merges there). The flip suite has 22 flips: none merges now, 1 (F) merged at 3e6e7e46, 4 at 5b8ba3b2 (the two B1 flips, the re-run and G).
   • Live replay (read only). The 70 heads the micro replayed, re-read with the new check-run request: one page each, 2,072 runs, and the same four counts under the 3e6e7e46 program and this one on every head. On 80 heads of ours (40 per repository; 12 with a trading-cc-read status, one combined page each), the combined read and the 3e6e7e46 read give the same trading-cc-read state and description.

Follow-ups

• Codex F2 (pre-existing since 2026-10-10): nas_land.sh's merge_validate runs the PR's own scripts/validate.py with the CC's gh credentials. Run it in a credential-free sandbox (bwrap, a read-only merged worktree, no gh token, network off). A CC follow-up PR.

• Codex F1: research queue, layer "landing gate change identity": -U3 against the -U0 status quo, measured over the last 30 landings' rebases.

• Astra's follow-up 3 (A5, declared): the base is not leased across the server merge; the lock and the final git ls-remote are interim defenses. Close it through the selected review App and required checks (docs/decisions/2026-10-09-review-verdict-app-identity.md), measured on a non-production PR.

• Astra's P3 (the base field): this body's Scope gives base 9d4c00cd…, the original base; the comparison and merge base of the reviews is 8bffa2c4…. Label the first as historical and give the second.

• Astra's P3 (sources): cite the Bash and tr semantics behind the single-read helper (lg_text) at an exact pin, and retain the cited captures the reader lacked (the jq manual, the uutils and tempfile sources, the gh manual page, the connector and ruleset captures, and the historical parity and census receipts).

• The live sync: after the landing, replace all three cc-tools files together (the scripts pass the read head as the gate's third argument).

• Codex P1 at nas:234: FIXED in f206d6de. tcc_read_gate, in both scripts, reads the combined status on every page instead of page 1 of the statuses list (item 7).

• Codex P2 at nas:289: FIXED in f206d6de. nas_checks reads every page of check runs (item 7). Both threads were answered and resolved at 19:17Z; all 15 review threads on this PR are resolved.

• Pages that change between requests (untested boundary, f206d6de): gh asks for page after page, and neither the check-run endpoint's description, the combined status's nor GitHub's pagination guide states an order or a snapshot across pages, so an entry that moves between pages while they are read could be missed or read twice. It needs more than 100 runs, or more than 100 contexts, at a head (the most measured was 43 runs on the 70 heads and 1 context on our 80). A candidate hardening: count what was read against total_count, which every page carries (43 on each of the 5 measured check-run pages; the number of contexts on each combined page).

• Mirrors (rule 9). jqlang/jq is mirrored only at jq-1.8.1, and actions/runner-images is not mirrored. Add jq-1.7.1 and the runner-images release tag, so CI's tool versions can be cited at the pin.

• Local CI parity. Run tests.test_landing_scripts under CI's jq (1.7.1) locally as well as the host's 1.8.1, so jq-version regressions show up before CI.

• A measured alternative, not taken. The one-page combined-status read with a total_count guard is kept as a local branch in the CC's checkout (cc/975-alt-onepage-5e8118eb, not pushed), and its patch file is retained with the CC's records. It passed the same receipts, but the every-page read was kept, because it closes nas:234 at least as strongly without a new wave.

• Codex P2 at uet:216 (4243421514), CC-ruled a follow-up under the terminal rule: uet_land.sh reads the rollup's first 100 contexts (cli/cli v2.102.0 builds contexts(first: 100)); uet heads carry 13 today. Read every page as nas_checks does, with a fixture of more than 100 contexts whose unique failing entry sits past page 1.

• Codex P2 at uet:216 (4243421519), CC-ruled a follow-up (fails closed): a stale failed or cancelled run beside a newer success keeps exit 5. Apply nas's per-name dominance rule to uet_land.sh, with the rerun fixture (CANCELLED or FAILURE, then SUCCESS on one head).

Local commands run

At f206d6de, with TMPDIR under /var/tmp and the prohibited-names environment sourced from its file:

$ python3 -E -s -B -m unittest tests.test_landing_scripts -v
Ran 107 tests ... OK
$ python3 -E -s -B -m unittest tests.test_evidence_manifest
Ran 5 tests ... OK
$ python3 -E -s -B scripts/evidence_manifest.py --check
{"files": 11478, "status": "passed"}
$ python3 -E -s -B scripts/validate.py
exit 0   {"components": 70, "hashed_files": 11478, "profiles": 4, "receipts": 239, "status": "passed"}
$ bash -n tools/landing/uet_land.sh && bash -n tools/landing/nas_land.sh
$ gitleaks git . --log-opts="--no-merges 3e6e7e46..HEAD"                          # v8.30.1
no leaks found

At f206d6de, the merge with main 99e72aef (git merge-tree --write-tree, exit 0, tree 96a5f1ad) gave the same: 107 tests OK, 5 OK, --check passed (11,640 files) and validate.py exit 0 (11,640 hashed files). At 80bcd77e, git merge-tree --write-tree exits 0 against main 0f00a1aa (tree b0529331) and against main 569bbc59 after #1008 (the CC's delta micro also ran validate.py and the module on both merge trees).

At the sync commit 210bc7e4 (kept for the record):

$ python3 -B -m unittest tests.test_landing_scripts                  # 51 tests at 210bc7e4, about 20 s
Ran 51 tests ... OK
$ python3 -B -m unittest tests.test_validate tests.test_evidence_manifest tests.test_foundation_catalog tests.test_stack_lifecycle \
    tests.test_component_matrix tests.test_adoption_docs_consistency tests.test_claude_repository_evidence tests.test_landing_scripts
Ran 278 tests ... OK (skipped=1)
$ python3 -B scripts/validate.py
exit 0   {"components": 70, "hashed_files": 11426, "profiles": 4, "receipts": 239, "status": "passed"}
$ python3 -B scripts/evidence_manifest.py --check
{"files": 11426, "status": "passed"}
$ bash -n tools/landing/uet_land.sh && bash -n tools/landing/nas_land.sh        # also a test
$ gitleaks git . --log-opts="--no-merges <base>..HEAD" --redact=100              # v8.30.1
no leaks found

The adapted harness run and the parity check are scratch files, not part of this PR. python3 scripts/host_receipts.py validate exits 1 in the shallow clone these were run in (a catalog_revision of an unrelated host receipt is not in the checkout); the workflow clones with full history.

Decision record

None: this moves existing files and tests them. What changed in each shell script, and why the default paths are what they are, is in tools/landing/README.md:

uet_land.sh   17: U=${LANDING_UET_REPO:-$HOME/code/us-equities-trading}; COORD=${LANDING_COORD:-${XDG_STATE_HOME:-$HOME/.local/state}/native-agent-stack/coordination}
              141: rec=$COORD/${BASH_REMATCH[2]}
              181: GATE=${LANDING_GATE:-$(dirname "$(readlink -f -- "$0")")/codex_gate.py}
nas_land.sh   20: G="git -C ${LANDING_NAS_REPO:-$HOME/code/native-agent-stack}"; COORD=${LANDING_COORD:-...the same}
              153: rec=$COORD/${BASH_REMATCH[2]}
              175: GATE=${LANDING_GATE:-$(dirname "$(readlink -f -- "$0")")/codex_gate.py}

Findings of the census that are not changed here (the files stay as they were; each is in the README's "Known gaps" or "Exit codes"): nas_land.sh's validation merge needs a git committer identity and otherwise reports exit 10, "does not merge cleanly"; both expand the clone path unquoted. (Two findings of the census were fixed later: the CI lines fail every conclusion but success, neutral and skipped since 0d5a59f2, and nas_land.sh's header lists exit 4 since round 4.)

Host evidence

No files under evidence/hosts/ change.

• python3 scripts/host_receipts.py validate passes for every new/changed receipt. (not applicable)
• Independent review is recorded (scripts/host_receipts.py review) or explicitly requested in this PR. (not applicable)
• No platform_status change is made from a host receipt alone; a platform status flip still needs the matrix rule in docs/component-evidence-matrix.md. (not applicable)

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job only what it needs. (none changed)
• No secrets are printed, logged or committed; no new required secret was added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

Ready for review. The reads at f206d6de:

• Astra (GPT): ACK.
• The CC's Claude micro: CHANGES_REQUESTED on one mechanical blocker. The required validate check was red, because the test fixture's reduce … as $c needs jq 1.8 and CI's ubuntu-24.04 image ships jq 1.7.1.

80bcd77e fixes that one line in the test file, plus the file's binding in manifests/evidence.json. It fails first with the official jq-1.7.1 binary: 231 failures at f206d6de, against 107 OK at 80bcd77e.

Before the merge cue: one delta micro per family over f206d6de..80bcd77e. Codex: no @codex review was requested on this PR after 16:40:54Z, so it has not reviewed f206d6de or 80bcd77e. A request was posted at the CC's review cue, and codex_gate.py decides at landing (it measures this PR's own Codex activity since the trigger). (Corrected: an earlier revision said Codex had posted no review on any PR since 18:37Z. That was false, because Codex reports clean results as comments; see CC correction #171.)

🤖 Generated with Claude Code

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T22:03:47.270880Z	80bcd77	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af9d190113

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 761810d703

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b8ba3b20e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e6e7e4666

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 80bcd77e41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".