All issues

Search results

Publish a CycloneDX VEX with each release, and re-issue it when advisories land

Status: Open.

#433 In pulseengine/meld;

· avrabe opened on Sep 23, 2026

Update wit-bindgen Fixtures has failed every week since at least 24 August (runner $HOME missing)

Status: Open.

#429 In pulseengine/meld;

· avrabe opened on Sep 22, 2026

fuse: fusion domains — fuse within a domain, keep the Canonical ABI between domains (the MCU privilege boundary)

Status: Open.

#427 In pulseengine/meld;

· avrabe opened on Sep 18, 2026

--reproducible numbers provenance ids by flattened component, the attestation by caller input: component-2 joins to the wrong input

Status: Open.

#420 In pulseengine/meld;

· avrabe opened on Sep 17, 2026

STPA XH-2/XH-3 name synth's synth-abi crate as the synth side of element-size agreement — the synth compiler does not link synth-abi (0 symbols)

Status: Open.

#417 In pulseengine/meld;

· avrabe opened on Sep 17, 2026

Documentation drift sweep: ADRs, README and AGENTS.md describe a system several releases old

Status: Open.

#415 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

SWV-44 says 'rivet validate mechanically enforces' the traceability backlinks — no workflow runs it, and it warns rather than fails

Status: Open.

#412 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

Several SRs are 'verified' on evidence weaker than the requirement — placeholder proofs and existence-only tests

Status: Open.

#410 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

concept-attestation.md claims unconditional byte-for-byte determinism; the attestation-feature path is non-reproducible and its guard test is cfg'd out

Status: Open.

#408 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

AGENTS.md calls Bazel the "Production/CI" build path; no CI runs it and it cannot compile the current tree

Status: Open.

#407 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

Bazel build stamps a false meld version into --version and into every fused artifact's attestation

Status: Open.

#406 In pulseengine/meld;

· avrabe opened on Sep 16, 2026

Fused core modules drop WIT type info (component-type* sections) — runtimes can't invoke typed exports

Status: Open.

#400 In pulseengine/meld;

· avrabe opened on Sep 7, 2026