[avrabe]

Org rule: actions pinned by SHA with the version as a comment (uses: owner/action@<sha> # vN). Rewrites every tag-pinned uses: in .github/workflows. Workflow-only change.

[github-actions]

📐 rivet artifact delta

PR: #232 Base SHA: 7ca4e05e

Validation

head — `rivet validate` result

  SR-11 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-12 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-13 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-2 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-3 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-4 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-5 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-6 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-7 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-8 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-9 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SYS-1 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-2 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-3 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-4 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-5 (system-req, status: accepted) — missing: sys-integration-verification
  → run `rivet validate --explain SR-1` to see which link type and source types satisfy a gap

Result: PASS (193 warnings)
Schemas: common@0.4.0 (embedded), dev@0.6.0 (embedded), research@0.1.0 (embedded), research-ext@0.1.0 (on-disk), dev-ext@0.1.0 (on-disk), safety-case@0.1.0 (embedded), aspice@0.3.0 (embedded)

base — `rivet validate` result (for comparison)

  SR-11 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-12 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-13 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-2 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-3 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-4 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-5 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-6 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-7 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-8 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SR-9 (sw-req, status: accepted) — missing: sw-integration-verification, unit-verification
  SYS-1 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-2 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-3 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-4 (system-req, status: accepted) — missing: sys-integration-verification
  SYS-5 (system-req, status: accepted) — missing: sys-integration-verification
  → run `rivet validate --explain SR-1` to see which link type and source types satisfy a gap

Result: PASS (193 warnings)
Schemas: common@0.4.0 (embedded), dev@0.6.0 (embedded), research@0.1.0 (embedded), research-ext@0.1.0 (on-disk), dev-ext@0.1.0 (on-disk), safety-case@0.1.0 (embedded), aspice@0.3.0 (embedded)

Artifact stats

	base	head
Total artifacts	270	270

full stats — head

Artifact summary:
  academic-reference               24
  competitive-analysis             11
  design-decision                  23
  feature                          99
  market-finding                    7
  requirement                      21
  safety-context                    3
  safety-goal                       5
  safety-justification              4
  safety-solution                   6
  safety-strategy                   1
  stakeholder-req                   3
  sw-req                           13
  sw-verification                  13
  sys-verification                  5
  system-req                        5
  technology-evaluation            12
  verification                     15
  TOTAL                           270

Orphan artifacts (no links): 12
  CA-001
  CA-002
  CA-003
  CA-004
  CA-005
  CA-006
  CA-007
  CA-008
  CA-009
  CA-010
  CA-011
  FEAT-078

Diagnostics: 0 error(s), 193 warning(s), 11 info(s)

Diff (base → head)

0 added, 0 removed, 0 modified, 270 unchanged

AADL model — head

spar/scry.aadl: OK

---

Posted by the rivet-delta workflow. Informational only — does not gate the PR.

[avrabe]

Diagnosis: this is staleness, not a defect in the PR. It needs a base update, nothing more.

cargo-deny is failing on four wasmtime advisories that are already fixed on main:

ID	Subject	Patched
RUSTSEC-2026-0420	wasip3 UDP send can deliver a datagram to a receive-only address	>= 48.0.8
RUSTSEC-2026-0422	typed functions with i31/nullref args may panic on insufficient type-check	>= 48.0.8
RUSTSEC-2026-0423	cross-engine type confusion with host-created struct-types-with-supertypes	>= 48.0.8
RUSTSEC-2026-0424	unchecked memory usage transferring borrowed resources between components	>= 48.0.8

This branch forked at 66e75ab, one commit before #231, which bumped the lock to 48.0.8 while dropping the cache feature. So main clears all four and this branch is pinned at 48.0.7.

Confirmed rather than assumed: main's Cargo.lock has wasmtime = 48.0.8 and wasmtime-wasi = 48.0.8, main's CI is green at 7ca4e05 (run 41346015535), and a pull of the advisory DB shows nothing newer than 0424 for wasmtime* — so there is no fifth wave waiting behind this.

I initially guessed the red was #231's zstd advisories and that was wrong; it is wave-3 wasmtime. Same commit fixes both, for different reasons.

Updating the branch from main (merge, not a rebase — not rewriting your history). The other 14 contexts are already green, so that should be the whole of it.

Worth noting for the actions-pinning work itself: this is the third advisory wave in six weeks against a dependency that enters the graph only through scry-host-tests (publish = false). #230 has the measurements and the options — pinning actions to SHAs and the dependency-churn problem are the same supply-chain surface seen from two ends.