Issues

• Read varve's own TOML inputs (varve.toml, varve-realms.toml, layer.toml, deposit-spec.toml) via rivet-yaml

  pulseengine/varve#272 · Filter by author avrabe opened on Oct 16, 2026

• systest: live-pin check accepts a malformed TARBALL_TOOLS line (two entries fused by a missing space)

  pulseengine/varve#267 · Filter by author avrabe opened on Oct 15, 2026

• Layer: kiln's binary is renamed kilnd -> kiln in kiln v0.6.0 — carry both for one cycle, then drop kilnd

  pulseengine/varve#258 · Filter by author avrabe opened on Oct 14, 2026
  1

• install fetches every tool in a layer, even ones the pin's tools= doesn't name

  pulseengine/varve#257 · Filter by author avrabe opened on Oct 13, 2026

• Anti-rollback baseline is per-machine but pins are per-project: a supported, unyanked, digest-pinned layer is uninstallable on a shared runner

  pulseengine/varve#256 · Filter by author avrabe opened on Oct 10, 2026
  1

• v0.42.0 — A moved pin arrives prepared, not reported

  pulseengine/varve#253 · Filter by author avrabe opened on Oct 9, 2026

• A bump must arrive prepared, not reported: every "needs a person" case in this org is mechanically derivable

  pulseengine/varve#251 · Filter by author avrabe opened on Oct 8, 2026

• Reclaiming disk: plan a read-only "varve doctor" before any "varve gc", and keep eviction out of the anti-rollback state

  pulseengine/varve#248 · Filter by author avrabe opened on Oct 8, 2026

• deposit tests wipe a fixed temp path, so two concurrent runs collide — and a mutation shard can record a kill it did not earn

  pulseengine/varve#246 · Filter by author avrabe opened on Oct 7, 2026

• rand/rand_chacha are pinned to 0.8 because pgp is — the exit is pgp moving, not a dependabot retry

  dependencies
  pulseengine/varve#240 · Filter by author avrabe opened on Oct 7, 2026

• An older varve refuses every operation when given varve's own current realms file — 'unknown field retired-roots', a field the file documents as diagnostic-only

  pulseengine/varve#234 · Filter by author avrabe opened on Oct 2, 2026

• Rule 3: varve spells structured output two ways (--json vs --format), and list/which have none

  pulseengine/varve#225 · Filter by author avrabe opened on Sep 30, 2026

• A signed advisory can only reach a consumer at install time, so the frozen consumer varve is built for never learns

  pulseengine/varve#224 · Filter by author avrabe opened on Sep 30, 2026

• Spike: offering the wit payload kind, and keeping the air gap when we do

  pulseengine/varve#220 · Filter by author avrabe opened on Sep 30, 2026
  2

• Spike: carrying Rust toolchains, and link as the alternative to copying them

  pulseengine/varve#218 · Filter by author avrabe opened on Sep 30, 2026
  1

• Declining auto-deposit also turned off detection: wasm-layers has pinned a wasmtime with two advisories for five days and nothing would ever say so

  pulseengine/varve#216 · Filter by author avrabe opened on Sep 30, 2026
  1

• No published layer ships a sound ordeal: 2026.09.16 carries 0.22.0, inside GHSA-xfxf-qxr3-435x's affected range

  pulseengine/varve#214 · Filter by author avrabe opened on Sep 30, 2026
  2

• The anti-rollback high-water mark lives in per-worker local state, so the same pin gets four different verdicts on one CI fleet

  pulseengine/varve#210 · Filter by author avrabe opened on Sep 30, 2026
  2

• v0.44.0 — Layers beyond our own tools, and stop copying to use them

  epic
  pulseengine/varve#206 · Filter by author avrabe opened on Sep 29, 2026
  3

• v0.43.0 — Keys, custody and roles before the v1.0 ceremony

  epic
  pulseengine/varve#205 · Filter by author avrabe opened on Sep 29, 2026

• The first hour: the errors and docs a new consumer actually hits

  epic
  pulseengine/varve#204 · Filter by author avrabe opened on Sep 29, 2026
  2