chore(deps): bump wit-parser from 0.257.1 to 0.258.0 by dependabot[bot] · Pull Request #1106 · pulseengine/synth

dependabot · 2026-08-31T21:45:04Z

Bumps wit-parser from 0.257.1 to 0.258.0.

Commits

See full diff in compare view

github-actions · 2026-08-31T21:45:17Z

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

codecov · 2026-09-03T05:45:52Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

avrabe · 2026-09-05T11:02:53Z

[maintainer loop] Held-state audit — recording measured status so this hold is not silent.

wit-parser 0.257.1 -> 0.258.0 · classifier: class=zerox-minor

All 9 required contexts are GREEN on this PR. The only red is
Rivet Federated Graph (advisory), which was failing repo-wide from
2026-09-03 04:00–21:25 because GitHub rate-limits anonymous clones from
datacenter IPs — nothing to do with this bump. Diagnosed and fixed in #1143/#1144.

So this is held by policy, not by evidence of breakage. The policy
(SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965) treats a 0.x minor as a de-facto
major, because for a 0.x crate it is one — earned from ordeal 0.9 -> 0.12,
which auto-merged as "minor" and hung Test/Z3 for 4–6 hours per run for
days.

Why you are being told this rather than left to rot. A held PR currently has
no defined exit: it cannot auto-merge, and nothing prompts a human. Four of
these accumulated since 2026-08-31 — one (#1111, wasmparser) was genuinely
source-breaking and is closed with that evidence; the rest were reporting a CI
outage, not an incompatibility. A hold that is correct and silent is how they
became invisible, and I described their state wrongly in the org review as a
result. Raised for temper in #1132.

Staying held pending a deliberate decision, not forgotten. If you want it taken,
say so on this PR.

avrabe · 2026-09-07T06:05:25Z

@dependabot rebase

Why now (RQ-64-DEPS, #965): this PR's base is 32 commits behind main, so its CI verdict is uninterpretable — the single failure it currently shows could be the bump or any of those 32 commits. Attribution needs a baseline. Rebasing is the prerequisite for judging the bump at all, not an endorsement of merging it.

This remains held under SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965: under semver a 0.x-minor bump is BREAKING, and that rule exists because ordeal 0.9 → 0.12 auto-merged as "minor" and hung Test and Z3 for hours across several days (#849).

RQ-64-DEPS is scoped to give that hold an exit condition — it currently says hold and never says how a held bump gets evaluated and released, which is why four have accumulated since 2026-08-31.

dependabot · 2026-09-07T06:05:30Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

avrabe · 2026-09-07T06:13:37Z

@dependabot recreate

Why recreate and not rebase (RQ-64-DEPS, #965): this branch carries a
Merge branch 'main' into … commit authored by a human. Dependabot refuses to
rebase any branch with foreign commits — it said so on this PR at 06:05:
"Looks like this PR has been edited by someone other than Dependabot. That
means Dependabot can't rebase it." That is not a transient decline; it is a
one-way door. rebase will never work here again.

Measured, not assumed:


merge-base with `main`	`b552fb4c` (2026-09-03, pre-v0.63)
true tip-behind	32 commits
only red check	`Rivet Federated Graph (advisory)` — green on `main` HEAD

The single red is advisory and sits on a tree four days stale, so it cannot
be attributed to the bump: the same job passes on main at 8862ee2f. A
verdict from a stale base is not evidence about the dependency.

recreate discards the branch and rebuilds it on current main, which both
makes the CI verdict interpretable and restores dependabot's ability to manage
this PR. The merge commit being overwritten carried no content of its own.

avrabe · 2026-09-07T06:34:41Z

@dependabot recreate

github-actions · 2026-09-07T07:31:15Z

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

…ng about the tree the suite ran on The artifact's original premise ("the hold has no exit") was too strong. The workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never a block: merge a held bump BY HAND once the FULL suite is green ... the discriminator is CI, not a maintainer's read of the diff." That criterion is correct. The premise is corrected in the artifact rather than edited away, the third premise correction this release and the same discipline RQ-64-FLOORPROSE got. What the exit omitted is everything about the TREE THE SUITE RAN ON, which is what made it unusable in practice: 1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured on trees whose merge-base was four days and one release stale. Neither that red nor a green would have attributed anything to the bump. 2. The refresh mechanism can be permanently gone. Those three each carry a human `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to rebase a branch with foreign commits — it said so on all three at 06:05Z. Merging main into a dependabot branch to freshen it is the move that destroys the ability to freshen it. Now written down, because it is not obvious and it is not reversible. 3. A bump nobody evaluates needs a disposition. These accumulated for a week because nothing required an answer. "Still open" is not a disposition. None of this loosens the hold — 0.x-minor is breaking under semver and the ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which is what keeps a hold a delay rather than an accumulator. Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched — the added text deliberately avoids them), workflow parses, rivet validate at main's 40-error baseline with 0 broken cross-refs. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

…pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026-09-07: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

…ng about the tree the suite ran on The artifact's original premise ("the hold has no exit") was too strong. The workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never a block: merge a held bump BY HAND once the FULL suite is green ... the discriminator is CI, not a maintainer's read of the diff." That criterion is correct. The premise is corrected in the artifact rather than edited away, the third premise correction this release and the same discipline RQ-64-FLOORPROSE got. What the exit omitted is everything about the TREE THE SUITE RAN ON, which is what made it unusable in practice: 1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured on trees whose merge-base was four days and one release stale. Neither that red nor a green would have attributed anything to the bump. 2. The refresh mechanism can be permanently gone. Those three each carry a human `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to rebase a branch with foreign commits — it said so on all three at 06:05Z. Merging main into a dependabot branch to freshen it is the move that destroys the ability to freshen it. Now written down, because it is not obvious and it is not reversible. 3. A bump nobody evaluates needs a disposition. These accumulated for a week because nothing required an answer. "Still open" is not a disposition. None of this loosens the hold — 0.x-minor is breaking under semver and the ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which is what keeps a hold a delay rather than an accumulator. Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched — the added text deliberately avoids them), workflow parses, rivet validate at main's 40-error baseline with 0 broken cross-refs. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

…pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026-09-07: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

…the suite ran on (#1186) * fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothing about the tree the suite ran on The artifact's original premise ("the hold has no exit") was too strong. The workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never a block: merge a held bump BY HAND once the FULL suite is green ... the discriminator is CI, not a maintainer's read of the diff." That criterion is correct. The premise is corrected in the artifact rather than edited away, the third premise correction this release and the same discipline RQ-64-FLOORPROSE got. What the exit omitted is everything about the TREE THE SUITE RAN ON, which is what made it unusable in practice: 1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured on trees whose merge-base was four days and one release stale. Neither that red nor a green would have attributed anything to the bump. 2. The refresh mechanism can be permanently gone. Those three each carry a human `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to rebase a branch with foreign commits — it said so on all three at 06:05Z. Merging main into a dependabot branch to freshen it is the move that destroys the ability to freshen it. Now written down, because it is not obvious and it is not reversible. 3. A bump nobody evaluates needs a disposition. These accumulated for a week because nothing required an answer. "Still open" is not a disposition. None of this loosens the hold — 0.x-minor is breaking under semver and the ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which is what keeps a hold a delay rather than an accumulator. Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched — the added text deliberately avoids them), workflow parses, rivet validate at main's 40-error baseline with 0 broken cross-refs. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(rivet): correct the v0.64 plan's VG-009 claim — a grep for `1.6` matched `41.6 %` The plan comment asserted that VG-009 and VCR-REACH-002 both still state aarch64 accepts 1.6 %. Only the second is true. VG-009's only "1.6" is the tail of "41.6 %", a line-coverage figure for synth-backend-riscv/src/backend.rs, framed "measured at v0.54.0" — correctly dated history, and untouched since #918. Flagging it would have been a false red on a properly dated citation. Measured and reported by the RQ-64-SCOPEGAP lane, which was briefed with explicit permission to return a negative result and used it. The claim was mine: it came from a grep for `1.6`, which returns OCCURRENCES and cannot return FRAMING. Same failure that produced v0.62's devirtualization claim, and the correction is left visible beside the original rather than edited away — the scoping error is the same shape the artifact is about. The real population the artifact should have named is larger and of a different kind: eight artifacts restating the repo's own proof counts as undated present-tense fact ("188 Qed / 52 Admitted", six months stale against a number CLAUDE.md itself count-eq-pins). `chore` deliberately, not `fix`: naming RQ-64-SCOPEGAP in a delivery-shaped subject would oblige R4 to find that artifact's status flip in THIS PR, and it belongs to #1182. Verified: rivet validate at main's 40-error baseline, 0 broken cross-refs; status_evidence_check exit 0. Refs #1085 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for dependabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026-09-07: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(release): RQ-64-DEPS (#965) — record PR #1186 in landed:, status stays proposed (half the done-when) R4 is satisfied by fields.landed rather than a status flip, deliberately: the exit condition landed but the four held PRs have no disposition yet, and claiming `implemented` on half a criterion is the shape this release keeps finding in other people's gates. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

avrabe · 2026-09-07T13:36:47Z

@dependabot rebase

Bumps [wit-parser](https://github.com/bytecodealliance/wasm-tools) from 0.257.1 to 0.258.0. - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) --- updated-dependencies: - dependency-name: wit-parser dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-07T13:38:47Z

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

avrabe · 2026-09-07T14:00:24Z

Landed under the MINORHOLD exit condition (#1186 / RQ-64-DEPS #965). Reason,
as that condition requires — grounded in what the bump touches, not in "CI green":

Base freshness: rebased by dependabot itself to behind=0 before the
verdict was read. A green suite on a stale base attributes nothing; this one
ran on the tree it will merge into.
Scope: wit-parser is a workspace dep (Cargo.toml:46) consumed by
synth-frontend. It is a parsing-layer dependency — it cannot reach the
instruction selector or the encoder, so a regression cannot change emitted
bytes.
Discriminator: all 9/9 required contexts green by name, including
Test and the spec-suite jobs that exercise the parser. No non-advisory red.
PR-head vs merged: 0 lines.

The hold was correct to apply — 0.x-minor is breaking under semver — and this is
what its exit looks like when exercised rather than assumed.

…rred — a scope decision, surfaced rather than silent (#1192) Two artifact updates, no code. RQ-64-DEPS -> implemented. Both done-when clauses are discharged: the MINORHOLD exit condition landed in #1186, and all four held bumps now have a disposition recorded on the PR itself — #1106 and #1110 and #1107 merged for three different reasons, #1108 closed as genuinely breaking. Four bumps, four outcomes, each on its own evidence. The z3 decline is the FIRST time the enforced hold has stopped a breaking 0.x-minor before it landed; the rule was written after ordeal 0.9->0.12 hung CI for days (#849) and had never been falsified until now. RQ-64-ARCHMODEL stays `proposed` with its reason attached, following the v0.63 precedent (3540292). spar#445 is still OPEN with no activity since 2026-09-03, re-verified at cut time rather than carried forward. It is an EXTERNAL blocker, categorically different from a deferral for scope: nothing here went stale and nothing got harder — it cannot proceed because the tool it depends on silently ACCEPTS input it should refuse. Fourth consecutive release recording feature-loop steps 1-2 as N/A, tracked by #1136. Noted in the artifact: the conformance gate does not accept that prose as evidence — it derives NA-FILED only from a release-SCOPED artifact existing, so the obligation is discharged by filing, not by asserting "synth is a Rust compiler, not AADL-architected". That assertion is true and has never been examined, which is the point of #1136. Verified: rivet at main's 40-error cross-repo baseline with 0 broken cross-refs, status_evidence exit 0, claim_check 62/62. Refs #965, #1136 Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

dependabot Bot added the dependencies Dependency updates label Aug 31, 2026

temper-pulseengine Bot enabled auto-merge (squash) August 31, 2026 21:45

github-actions Bot disabled auto-merge August 31, 2026 21:45

github-actions Bot added the major-bump-hold Breaking-class dep bump (major / 0.x-minor / 0.0.x) held from auto-merge — #866/#965 label Aug 31, 2026

avrabe mentioned this pull request Sep 3, 2026

Feedback wanted: needs and wishes for synth #1132

Open

dependabot Bot force-pushed the dependabot/cargo/wit-parser-0.258.0 branch from 570cc34 to 39cad23 Compare September 7, 2026 06:59

This was referenced Sep 7, 2026

chore(deps): bump pulseengine/rivet from 0.34.0 to 0.35.0 #1107

Merged

chore(deps): bump wast from 257.0.1 to 258.0.0 #1110

Merged

avrabe mentioned this pull request Sep 7, 2026

fix(ci): RQ-64-DEPS — the MINORHOLD exit said nothing about the tree the suite ran on #1186

Merged

dependabot Bot force-pushed the dependabot/cargo/wit-parser-0.258.0 branch from 39cad23 to e1fc3b6 Compare September 7, 2026 13:38

avrabe merged commit 44987ba into main Sep 7, 2026
65 checks passed

avrabe deleted the dependabot/cargo/wit-parser-0.258.0 branch September 7, 2026 13:59

avrabe mentioned this pull request Sep 7, 2026

chore(deps): bump z3 from 0.20.2 to 0.21.0 #1108

Closed

avrabe mentioned this pull request Sep 7, 2026

chore(rivet): close RQ-64-DEPS and record WHY RQ-64-ARCHMODEL defers #1192

Merged

Navigation Menu

Uh oh!

chore(deps): bump wit-parser from 0.257.1 to 0.258.0 - #1106

chore(deps): bump wit-parser from 0.257.1 to 0.258.0#1106
avrabe merged 1 commit into
mainfrom
dependabot/cargo/wit-parser-0.258.0

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

codecov Bot commented Sep 3, 2026

Uh oh!

avrabe commented Sep 5, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

codecov Bot commented Sep 3, 2026

Codecov Report

Uh oh!

avrabe commented Sep 5, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Uh oh!

avrabe commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading