Issues

• A composition whose included line ended gets no proposal, and the scan says 'read the warnings above' when there are none

  pulseengine/varve#343 · Filter by author avrabe opened on Nov 8, 2026

• An export's content check is self-referential: bind exported files to the signed manifest where an adapter copies bytes

  needs-decision
  pulseengine/varve#289 · Filter by author avrabe opened on Oct 28, 2026

• A composition's include went out of support and nothing said so for three days

  needs-decision
  pulseengine/varve#285 · Filter by author avrabe opened on Oct 27, 2026

• Dispatch trusts the store: a binary changed after install runs, for every pin

  needs-decision
  pulseengine/varve#277 · Filter by author avrabe opened on Oct 21, 2026

• shim overlay tools

  needs-decision
  pulseengine/varve#273 · Filter by author avrabe opened on Oct 17, 2026
  1

• Read varve's own TOML inputs (varve.toml, varve-realms.toml, layer.toml, deposit-spec.toml) via rivet-yaml

  needs-decision
  pulseengine/varve#272 · Filter by author avrabe opened on Oct 16, 2026
  1

• Layer: kiln's binary is renamed kilnd -> kiln in kiln v0.6.0 — carry both for one cycle, then drop kilnd

  needs-decision
  pulseengine/varve#258 · Filter by author avrabe opened on Oct 14, 2026
  1

• install fetches every tool in a layer, even ones the pin's tools= doesn't name

  needs-decision
  pulseengine/varve#257 · Filter by author avrabe opened on Oct 13, 2026

• Anti-rollback baseline is per-machine but pins are per-project: a supported, unyanked, digest-pinned layer is uninstallable on a shared runner

  needs-decision
  pulseengine/varve#256 · Filter by author avrabe opened on Oct 10, 2026
  3

• v0.42.0 — A moved pin arrives prepared, not reported

  needs-decision
  pulseengine/varve#253 · Filter by author avrabe opened on Oct 9, 2026

• A bump must arrive prepared, not reported: every "needs a person" case in this org is mechanically derivable

  needs-decision
  pulseengine/varve#251 · Filter by author avrabe opened on Oct 8, 2026

• Reclaiming disk: plan a read-only "varve doctor" before any "varve gc", and keep eviction out of the anti-rollback state

  needs-decision
  pulseengine/varve#248 · Filter by author avrabe opened on Oct 8, 2026

• rand/rand_chacha are pinned to 0.8 because pgp is — the exit is pgp moving, not a dependabot retry

  dependenciesneeds-decision
  pulseengine/varve#240 · Filter by author avrabe opened on Oct 7, 2026

• Rule 3: varve spells structured output two ways (--json vs --format), and list/which have none

  needs-decision
  pulseengine/varve#225 · Filter by author avrabe opened on Sep 30, 2026

• A signed advisory can only reach a consumer at install time, so the frozen consumer varve is built for never learns

  needs-decision
  pulseengine/varve#224 · Filter by author avrabe opened on Sep 30, 2026

• Spike: offering the wit payload kind, and keeping the air gap when we do

  needs-decision
  pulseengine/varve#220 · Filter by author avrabe opened on Sep 30, 2026
  2

• Spike: carrying Rust toolchains, and link as the alternative to copying them

  needs-decision
  pulseengine/varve#218 · Filter by author avrabe opened on Sep 30, 2026
  1

• Declining auto-deposit also turned off detection: wasm-layers has pinned a wasmtime with two advisories for five days and nothing would ever say so

  needs-decision
  pulseengine/varve#216 · Filter by author avrabe opened on Sep 30, 2026
  1

• No published layer ships a sound ordeal: 2026.09.16 carries 0.22.0, inside GHSA-xfxf-qxr3-435x's affected range

  needs-decision
  pulseengine/varve#214 · Filter by author avrabe opened on Sep 30, 2026
  2

• The anti-rollback high-water mark lives in per-worker local state, so the same pin gets four different verdicts on one CI fleet

  needs-decision
  pulseengine/varve#210 · Filter by author avrabe opened on Sep 30, 2026
  2

• v0.44.0 — Layers beyond our own tools, and stop copying to use them

  epicneeds-decision
  pulseengine/varve#206 · Filter by author avrabe opened on Sep 29, 2026
  3

• v0.43.0 — Keys, custody and roles before the v1.0 ceremony

  epicneeds-decision
  pulseengine/varve#205 · Filter by author avrabe opened on Sep 29, 2026
  1

• The first hour: the errors and docs a new consumer actually hits

  epicneeds-decision
  pulseengine/varve#204 · Filter by author avrabe opened on Sep 29, 2026
  2