varve v0.13.1

What's Changed

• fix: v0.13.1 — cold-start onboarding (varve#34) by @avrabe in #35

Full Changelog: v0.13.0...v0.13.1

varve v0.13.0

varve v0.13.0 — adversarial inputs

REQ-FUZZ-001 + REQ-PROP-001 + REQ-MATRIX-001 verified.

• Fuzzing (fuzz/, fuzz.yml — PR smoke + nightly): five cargo-fuzz targets on the untrusted-input parsers — layer-id grammar, layer-manifest JSON, DSSE envelope, varve.toml, varve-realms.toml. It found a real bug on the first run: the layer-id grammar accepted leading-zero patches, so 2026.07.052 and 2026.07.52 were two pin strings for one identity — a genuine hazard in a digest-is-identity system. Fixed, regression-seeded, re-fuzzed clean past 1.6M runs.
• Property tests (proptest): the core laws over the whole input space — layer-id parse/Display round-trip, rollback verdict monotonicity (accept iff counter ≥ mark), advance-never-lowers, platform-match totality + wasm universality.
• Matrix: CI now tests linux AND macos (was ubuntu-only while releasing four platforms), pins an MSRV (1.89) build, and publishes cargo-llvm-cov coverage as advisory evidence.
• Kani proofs of the same invariants are tracked honestly as REQ-KANI-001 (v1.0, advisory→required) — not claimed here.

Verify: varve self-verify --archive varve-v0.13.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json. This machine self-updated through the old-verifies-new chain.

varve v0.12.1

varve v0.12.1 — audit hardening

Independent ASPICE/ISO-26262 and cybersecurity audits (2026-08-08) — the actionable, no-decision findings, fixed and gated.

• F2 fail-open (security): a signed manifest with a malformed issued-at parsed fine and silently disabled the staleness warning, voiding SH-002. issued-at is now validated as a real RFC 3339 date at parse (impossible dates — Feb 31 — rejected), by the one epoch_days validator the staleness verdict uses.
• Potency: the cargo-mutants trust-critical gate + strict policy are now required merge checks (the audit found REQ-MUTATE-001 verified-but-bypassable). It proved itself immediately — the F2 fix's new guards had 9 uncaught mutants and the gate blocked the merge until they were killed.
• Honesty: README no longer claimed "nothing implemented" (against 14 releases); the claim-check now covers the status banner. SECURITY.md added — disclosure policy, the invariants a report should target, and the current provisional-trust limits.
• Hazards: SH-005 (root-key compromise) + SH-006 (deposit-pipeline compromise) + SC-005/006 — the two the STPA-Sec seed hadn't named.
• Supply chain: Cargo.lock tracked, releases build --locked; cargo-deny in CI (advisories/licenses/sources); cross tag-pinned; ci.yml + release.yml actions SHA-pinned; the rivet cosign identity regexp anchored (was matching rivet-evil).

Verify: varve self-verify --archive varve-v0.12.1-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json. This machine self-updated 0.12.0 → 0.12.1 through the old-verifies-new chain.

varve v0.12.0

What's Changed

• ci: layer 2026.08.2 roster — synth 0.55.0, ordeal 0.18.0 rejoins signed by @avrabe in #29
• feat: v0.12.0 — close the graph, make claims mechanical by @avrabe in #30

Full Changelog: v0.11.0...v0.12.0

varve v0.11.0

varve v0.11.0 — portable wasm entries + layer runners

REQ-RUNNER-001 verified: wasm-only tools join layers with zero per-platform gaps, executed by a runner from the same verified layer.

What's in

• Portable entries: a wasm32-* platform matches every host — the bytes ride everywhere a runner exists
• Signed runner contracts: [tool.runner] in the deposit spec (tool, prefix args, optional per-user-argument flag — kilnd's --wasi-arg shape) lands in the signed payload; varve run and the shims dispatch through the runner from the same verified layer, never from PATH; a runnered entry without its runner fails closed
• First real payload (scry via kilnd) awaits the meld↔kilnd entry-point contract: kiln#480 / scry#118 — a one-line roster addition once resolved

Falsification statement

This release claims: a runnered entry executes only through its layer's own runner, with exactly the signed invocation contract. To falsify: make a runnered entry execute via any binary outside the resolved layer, or with arguments deviating from the signed contract. The e2e demonstrates the exact invocation and is mutation-checked (skipping runner dispatch fails the test).

Verify this release

varve self-verify --archive varve-v0.11.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json

This machine took the release via varve self-update (0.10.0 → 0.11.0, old-verifies-new).

varve v0.10.0

varve v0.10.0 — realms: the pin names its trust universe

REQ-REALM-001 verified. Parallel toolchain universes — different organizations, different trust roots, different registries — coexist on one machine with isolation by construction.

What's in

• realm = "name" in varve.toml, defined by a committed varve-realms.toml (same walk-up discovery as the pin, so trust travels with the code): each realm maps to a registry and a trust root (inline hex key or a relative key file)
• A named realm is authoritative: its trust root applies — the ambient environment cannot substitute one — and varve install defaults to its registry, so a realm project needs no flags and no env vars
• Isolation by fingerprint: all per-realm state (core, anti-rollback marks, status cache) lives under $VARVE_ROOT/realms/<trust-root-fingerprint>/ — two realms with identical layer names and counters cannot cross-talk, and cross-acceptance is cryptographically impossible
• One shim directory serves every realm: resolution is per-invocation, so cd between projects of different realms switches tool universes

Falsification statement

This release claims: no byte from realm A can be accepted, resolved, or executed in a project pinned to realm B. To falsify: construct any layer signed by one realm's root that installs into, resolves for, or dispatches from a project naming another realm. The e2e test runs two realms with identical layer names and counters through one shim and demonstrates the refusal.

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt
varve self-verify --archive varve-v0.10.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json

This machine took the release via varve self-update — 0.9.0 verified and installed 0.10.0 through the old-verifies-new chain.

varve v0.9.0

varve v0.9.0 — signed source provenance + Bazel interop

REQ-BAZEL-001 verified: Bazel uses varve, never reimplements it.

What's in

• Deposit spec files (varve deposit --spec deposit.toml): CI-authored TOML carrying, per tool, its upstream source provenance — repo, release, asset name, and the sha256 of the asset as downloaded — recorded inside the signed payload, so downstream lockfiles inherit the signature anchor
• varve export-bazel --layer <id> --out <dir>: compiles rules_wasm_component-shaped checksum registries from a verified installed layer (trust root required and re-verified; platform keys in the rules vocabulary; tools without provenance skipped loudly). Every hash Bazel enforces becomes a transcription from a signed, counter-protected manifest instead of trust-on-first-use
• The primary integration ships in rules_wasm_component#606: a module extension where the project's varve.toml pin governs terminal and Bazel — live-tested against the real GHCR layer, with a corrupted-trust-root negative control refusing the build

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt
varve self-verify --archive varve-v0.9.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json

Cosign re-run against these published assets: Verified OK.

varve v0.8.0

What's Changed

• feat: v0.8.0 — self-update: explicit, verified, old-verifies-new by @avrabe in #19

Full Changelog: v0.7.0...v0.8.0

varve v0.7.0

varve v0.7.0 — environment integration

REQ-ENV-001 verified: varve sets up its own environment; users source it, never hand-edit PATH.

• varve env [--shell sh|fish] — idempotent shell code putting the shim directory on PATH: eval "$(varve env)". Double evaluation cannot stack duplicate entries (tested)
• varve shim install now writes a sourceable ~/.varve/env (rustup-style) and prints the one-liner
• varve completions <shell> — zsh/bash/fish completion scripts

Setup, in full:

echo '. "$HOME/.varve/env"' >> ~/.zshrc     # once

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt

Re-run against these published assets before these notes were written: Verified OK. The env flow itself was live-tested post-release: double-eval idempotency, sourced-env shim dispatch of the real 2026.08.0 layer, and completions output.

varve v0.6.1

varve v0.6.1 — registry pulls of real-sized binaries

Patch to v0.6.0, found by the first real dogfood: the transport read limit (ureq's 10 MiB default) rejected the 31 MB tool blobs of layer 2026.08.0 on the first GHCR pull. Raised to an 8 GiB sanity bound — the signed digests remain the acceptance criterion. Regression-tested with a 12 MB blob through the in-process registry double.

With this release the full loop is live: layer 2026.08.0 (rolling — rivet 0.32.0, synth 0.54.0, wsc 0.10.0 × 4 platforms, every upstream release cosign-verified at deposit) installs by pin from ghcr.io/pulseengine/varve/layers, verifies offline against the rolling trust root, and dispatches through PATH shims.

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt

Re-run against these published assets before these notes were written: Verified OK.