-
Notifications
You must be signed in to change notification settings - Fork 0
chore(deps): bump wit-parser from 0.257.1 to 0.258.0 - #1106
Conversation
🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
Codecov Report
✅ All modified and coverable lines are covered by tests.
📢 Thoughts on this report? Let us know!
avrabe
commented
Sep 5, 2026
[maintainer loop] Held-state audit — recording measured status so this hold is not silent.
wit-parser 0.257.1 -> 0.258.0 · classifier: class=zerox-minor
All 9 required contexts are GREEN on this PR. The only red is
Rivet Federated Graph (advisory), which was failing repo-wide from
2026年09月03日 04:00–21:25 because GitHub rate-limits anonymous clones from
datacenter IPs — nothing to do with this bump. Diagnosed and fixed in #1143/#1144.
So this is held by policy, not by evidence of breakage. The policy
(SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965) treats a 0.x minor as a de-facto
major, because for a 0.x crate it is one — earned from ordeal 0.9 -> 0.12,
which auto-merged as "minor" and hung Test/Z3 for 4–6 hours per run for
days.
Why you are being told this rather than left to rot. A held PR currently has
no defined exit: it cannot auto-merge, and nothing prompts a human. Four of
these accumulated since 2026年08月31日 — one (#1111, wasmparser) was genuinely
source-breaking and is closed with that evidence; the rest were reporting a CI
outage, not an incompatibility. A hold that is correct and silent is how they
became invisible, and I described their state wrongly in the org review as a
result. Raised for temper in #1132.
Staying held pending a deliberate decision, not forgotten. If you want it taken,
say so on this PR.
avrabe
commented
Sep 7, 2026
@dependabot rebase
Why now (RQ-64-DEPS, #965): this PR's base is 32 commits behind main, so its CI verdict is uninterpretable — the single failure it currently shows could be the bump or any of those 32 commits. Attribution needs a baseline. Rebasing is the prerequisite for judging the bump at all, not an endorsement of merging it.
This remains held under SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965: under semver a 0.x-minor bump is BREAKING, and that rule exists because ordeal 0.9 → 0.12 auto-merged as "minor" and hung Test and Z3 for hours across several days (#849).
RQ-64-DEPS is scoped to give that hold an exit condition — it currently says hold and never says how a held bump gets evaluated and released, which is why four have accumulated since 2026年08月31日.
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!
If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.
avrabe
commented
Sep 7, 2026
|
Why recreate and not rebase (RQ-64-DEPS, #965): this branch carries a Measured, not assumed:
The single red is advisory and sits on a tree four days stale, so it cannot
|
avrabe
commented
Sep 7, 2026
@dependabot recreate
570cc34 to
39cad23
Compare
🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
...ng about the tree the suite ran on
The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.
What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:
1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
on trees whose merge-base was four days and one release stale. Neither that
red nor a green would have attributed anything to the bump.
2. The refresh mechanism can be permanently gone. Those three each carry a human
`Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
rebase a branch with foreign commits — it said so on all three at 06:05Z.
Merging main into a dependabot branch to freshen it is the move that destroys
the ability to freshen it. Now written down, because it is not obvious and it
is not reversible.
3. A bump nobody evaluates needs a disposition. These accumulated for a week
because nothing required an answer. "Still open" is not a disposition.
None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.
Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.
Refs #965
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...ng about the tree the suite ran on
The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.
What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:
1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
on trees whose merge-base was four days and one release stale. Neither that
red nor a green would have attributed anything to the bump.
2. The refresh mechanism can be permanently gone. Those three each carry a human
`Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
rebase a branch with foreign commits — it said so on all three at 06:05Z.
Merging main into a dependabot branch to freshen it is the move that destroys
the ability to freshen it. Now written down, because it is not obvious and it
is not reversible.
3. A bump nobody evaluates needs a disposition. These accumulated for a week
because nothing required an answer. "Still open" is not a disposition.
None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.
Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.
Refs #965
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...the suite ran on (#1186) * fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothing about the tree the suite ran on The artifact's original premise ("the hold has no exit") was too strong. The workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never a block: merge a held bump BY HAND once the FULL suite is green ... the discriminator is CI, not a maintainer's read of the diff." That criterion is correct. The premise is corrected in the artifact rather than edited away, the third premise correction this release and the same discipline RQ-64-FLOORPROSE got. What the exit omitted is everything about the TREE THE SUITE RAN ON, which is what made it unusable in practice: 1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured on trees whose merge-base was four days and one release stale. Neither that red nor a green would have attributed anything to the bump. 2. The refresh mechanism can be permanently gone. Those three each carry a human `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to rebase a branch with foreign commits — it said so on all three at 06:05Z. Merging main into a dependabot branch to freshen it is the move that destroys the ability to freshen it. Now written down, because it is not obvious and it is not reversible. 3. A bump nobody evaluates needs a disposition. These accumulated for a week because nothing required an answer. "Still open" is not a disposition. None of this loosens the hold — 0.x-minor is breaking under semver and the ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which is what keeps a hold a delay rather than an accumulator. Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched — the added text deliberately avoids them), workflow parses, rivet validate at main's 40-error baseline with 0 broken cross-refs. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(rivet): correct the v0.64 plan's VG-009 claim — a grep for `1.6` matched `41.6 %` The plan comment asserted that VG-009 and VCR-REACH-002 both still state aarch64 accepts 1.6 %. Only the second is true. VG-009's only "1.6" is the tail of "41.6 %", a line-coverage figure for synth-backend-riscv/src/backend.rs, framed "measured at v0.54.0" — correctly dated history, and untouched since #918. Flagging it would have been a false red on a properly dated citation. Measured and reported by the RQ-64-SCOPEGAP lane, which was briefed with explicit permission to return a negative result and used it. The claim was mine: it came from a grep for `1.6`, which returns OCCURRENCES and cannot return FRAMING. Same failure that produced v0.62's devirtualization claim, and the correction is left visible beside the original rather than edited away — the scoping error is the same shape the artifact is about. The real population the artifact should have named is larger and of a different kind: eight artifacts restating the repo's own proof counts as undated present-tense fact ("188 Qed / 52 Admitted", six months stale against a number CLAUDE.md itself count-eq-pins). `chore` deliberately, not `fix`: naming RQ-64-SCOPEGAP in a delivery-shaped subject would oblige R4 to find that artifact's status flip in THIS PR, and it belongs to #1182. Verified: rivet validate at main's 40-error baseline, 0 broken cross-refs; status_evidence_check exit 0. Refs #1085 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for dependabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(release): RQ-64-DEPS (#965) — record PR #1186 in landed:, status stays proposed (half the done-when) R4 is satisfied by fields.landed rather than a status flip, deliberately: the exit condition landed but the four held PRs have no disposition yet, and claiming `implemented` on half a criterion is the shape this release keeps finding in other people's gates. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
commented
Sep 7, 2026
@dependabot rebase
Bumps [wit-parser](https://github.com/bytecodealliance/wasm-tools) from 0.257.1 to 0.258.0. - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) --- updated-dependencies: - dependency-name: wit-parser dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
39cad23 to
e1fc3b6
Compare
🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
avrabe
commented
Sep 7, 2026
Landed under the MINORHOLD exit condition (#1186 / RQ-64-DEPS #965). Reason,
as that condition requires — grounded in what the bump touches, not in "CI green":
- Base freshness: rebased by dependabot itself to
behind=0before the
verdict was read. A green suite on a stale base attributes nothing; this one
ran on the tree it will merge into. - Scope:
wit-parseris a workspace dep (Cargo.toml:46) consumed by
synth-frontend. It is a parsing-layer dependency — it cannot reach the
instruction selector or the encoder, so a regression cannot change emitted
bytes. - Discriminator: all 9/9 required contexts green by name, including
Testand the spec-suite jobs that exercise the parser. No non-advisory red. - PR-head vs merged: 0 lines.
The hold was correct to apply — 0.x-minor is breaking under semver — and this is
what its exit looks like when exercised rather than assumed.
...rred — a scope decision, surfaced rather than silent (#1192) Two artifact updates, no code. RQ-64-DEPS -> implemented. Both done-when clauses are discharged: the MINORHOLD exit condition landed in #1186, and all four held bumps now have a disposition recorded on the PR itself — #1106 and #1110 and #1107 merged for three different reasons, #1108 closed as genuinely breaking. Four bumps, four outcomes, each on its own evidence. The z3 decline is the FIRST time the enforced hold has stopped a breaking 0.x-minor before it landed; the rule was written after ordeal 0.9->0.12 hung CI for days (#849) and had never been falsified until now. RQ-64-ARCHMODEL stays `proposed` with its reason attached, following the v0.63 precedent (3540292). spar#445 is still OPEN with no activity since 2026年09月03日, re-verified at cut time rather than carried forward. It is an EXTERNAL blocker, categorically different from a deferral for scope: nothing here went stale and nothing got harder — it cannot proceed because the tool it depends on silently ACCEPTS input it should refuse. Fourth consecutive release recording feature-loop steps 1-2 as N/A, tracked by #1136. Noted in the artifact: the conformance gate does not accept that prose as evidence — it derives NA-FILED only from a release-SCOPED artifact existing, so the obligation is discharged by filing, not by asserting "synth is a Rust compiler, not AADL-architected". That assertion is true and has never been examined, which is the point of #1136. Verified: rivet at main's 40-error cross-repo baseline with 0 broken cross-refs, status_evidence exit 0, claim_check 62/62. Refs #965, #1136 Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
Bumps wit-parser from 0.257.1 to 0.258.0.
Commits