All issues

linestatus.rs carries two security-relevant signed fields and is not in the mutation gate (18 survivors)

#126

· avrabe opened

on Sep 4, 2026

Layer index entries declare image.manifest but their digest is the raw tool binary

#125

· avrabe opened

on Sep 2, 2026

REQ-CARRYFORWARD-001 clause 6 is not reachable: a deposit spec cannot name a blob the registry already holds

#124

· avrabe opened

on Sep 2, 2026

·

Feedback wanted: needs and wishes for varve

#121

· avrabe opened

on Sep 2, 2026

Rust toolchain layers: consumers pinning PulseEngine tools still float the compiler underneath them

#120

· avrabe opened

on Sep 2, 2026

rolling republished layer 2026.08.4 under a second manifest digest, making every name-only pin on it unresolvable

#115

· avrabe opened

on Aug 28, 2026

·

Root custody design for REQ-CEREMONY-001: hardware, succession, and how many backups

#112

· avrabe opened

on Aug 27, 2026

The pulseengine rolling root exists only as a write-only CI secret: no backup, no way to move it, and no rotation if it is lost

#110

· avrabe opened

on Aug 27, 2026

cargo test --workspace fails when CARGO_TARGET_DIR is set — and the failure looks like a product bug

#107

· avrabe opened

on Aug 26, 2026

varve does not pin its own toolchain, and its four sources of rivet disagree — the exact hazard it exists to close

#106

· avrabe opened

on Aug 26, 2026

No second source for a layer: one registry per realm, and nothing to fall back to when it is unreachable

#105

· avrabe opened

on Aug 26, 2026

·

A rolling layer should declare its own staleness: support-until exists, is signed, and is never populated

#104

· avrabe opened

on Aug 26, 2026

·