Problem. wit/deps.toml carries all-zero sha256/sha512 placeholders on all four entries, and builds resolve against the checked-in wit/deps/ copies, so a mispinned or drifted upstream tree is silently unverifiable. No CI job checks that the vendored tree matches deps.toml.
Scope. Record the real digests for every entry in wit/deps.toml. Add a CI job that re-resolves wit-deps and fails on any diff against the vendored wit/deps/ tree. Same fix as nullislabs/videre-nexum-module#45; the videre value-flow freeze treats both as preconditions.
Dependencies. None: do now.
AI Assistance: Claude Fable filed this from a four-agent audit (2026-08-06).
Problem.
wit/deps.tomlcarries all-zero sha256/sha512 placeholders on all four entries, and builds resolve against the checked-inwit/deps/copies, so a mispinned or drifted upstream tree is silently unverifiable. No CI job checks that the vendored tree matchesdeps.toml.Scope. Record the real digests for every entry in
wit/deps.toml. Add a CI job that re-resolves wit-deps and fails on any diff against the vendoredwit/deps/tree. Same fix as nullislabs/videre-nexum-module#45; the videre value-flow freeze treats both as preconditions.Dependencies. None: do now.
AI Assistance: Claude Fable filed this from a four-agent audit (2026-08-06).