Skip to content

v0.43.0 — an advisory arrives as a prepared line-status, a composition is capped by what it composes - #279

Merged
avrabe merged 2 commits into
mainfrom
release/v0.43.0
Oct 22, 2026
Merged

avrabe merged 2 commits into
mainfrom
release/v0.43.0

Conversation

@avrabe

@avrabe avrabe commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

The v0.43.0 release PR: version, changelog, and the release scope you decided after two independent clean-room reviews.

Scope

Requirement Status Why
REQ-ENVQUOTE-001 verified Both reviews' injections fixed (#278); fish now runs in CI (this PR)
REQ-NOPINNOTOOL-001 verified Dispatch requires the layer's signature from the root in scope (#278)
REQ-SBOMFIELDS-001 verified Supplier and author amended and fixed (#278); byte-identical re-emission tested
REQ-ADVISORYWATCH-001 implemented Clause 3 needs a released varve in the layer repos; open clauses moved to REQ-ADVISORYWATCH-002 (v0.44.0)
REQ-COMPOSEWINDOW-001 implemented Direct includes only; transitivity, expiry, the signed reason and adoption moved to REQ-COMPOSEWINDOW-002 (v0.44.0)
REQ-MUTANTDEBT-001 implemented Gets a final commit marking it verified once a scheduled nightly run of the merged workflow completes on main

The reviews are recorded as VER-REVIEW-V0-43-0 (REQ-INDEP-001). review-check no longer warns for this release.

In this PR

  • Release bookkeeping: version 0.43.0, the CHANGELOG entry and the rivet status changes above. The changelog has an upgrading section, the falsification list, and what is not verified.
  • New CI job varve env round trip in fish:
    • installs fish on a hosted runner and evals varve env --shell fish output with a hostile root;
    • with VARVE_REQUIRE_FISH set the test fails, not skips, when fish is absent;
    • the step insists exactly one test ran.

Local gates

  • Tests: 1491 workspace tests, 0 failed.
  • Gates: fmt, clippy, rivet validate, verification-evidence, trace-gate, claim-check, tracepack-check, proof-check, review-check, the tool tests, cargo deny, no-key-on-disk, docs coverage.
  • Fish: not installed on this machine, so the fish behaviour itself is first shown by this PR's CI job. The required-flag failure was checked locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu

avrabe and others added 2 commits October 21, 2026 18:56
… is capped by what it composes

Version 0.43.0, the changelog, and the release scope per the
maintainer's decision after two clean-room reviews:
- verified: REQ-ENVQUOTE-001, REQ-NOPINNOTOOL-001, REQ-SBOMFIELDS-001,
  with the reviews recorded as VER-REVIEW-V0-43-0;
- implemented: REQ-ADVISORYWATCH-001 and REQ-COMPOSEWINDOW-001, their
  open clauses moved to REQ-ADVISORYWATCH-002 / REQ-COMPOSEWINDOW-002
  (v0.44.0); REQ-MUTANTDEBT-001 until a scheduled nightly run completes.

ENVQUOTE clause 2 asks for fish to be run, and nothing ran it: a CI job
now installs fish and evals the output; the test fails rather than
skips when VARVE_REQUIRE_FISH is set and fish is missing, and the step
insists exactly one test ran.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
…ides

ureq 3.5.0 (2026-10-21) changed TransportAdapter::new in its
semver-exempt `unversioned` module; wsc 0.11.0 calls the old arity.
The fuzz workspace has no lockfile and resolved 3.5.0, so all five
fuzz jobs on #279 failed compiling wsc; `cargo install varve` without
--locked would fail the same way. Reproduced locally, and with the cap
the fuzz graph resolves 3.4.3 and wsc builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
@avrabe
avrabe merged commit e7019ad into main Oct 22, 2026
37 checks passed
@avrabe
avrabe deleted the release/v0.43.0 branch October 22, 2026 04:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant