docs(agents): record transitive platform-binding proof for dep-bump lanes

[seonghobae]

Follow-up know-how from merged PR #569 (CVE-2026-84373 Vitest remediation, merge be7df55). A minor Vitest bump pulled rolldown 1.2, which dropped @rolldown/binding-wasm32-wasi from optionalDependencies while still publishing it — breaking the WASI-only patch-validator materialize step. The lane reproduced the image materialize battery locally, pinned the binding explicitly with a lock-version-alignment regression test, and regenerated the lock plus the lockfile change policy in the same lane. This AGENTS.md bullet records that discipline so the next dependency-bump lane re-proves transitive platform bindings instead of rediscovering the trap.

Current exact is f527f2ce4b8148a71399f0b16e0e63be99c2163c on protected main@be7df559ca8c1d81b61f68f68c36d1526c94e7f2. Application CI, reviewer-ci, and Security Scan are SUCCESS. patch-validator-image 34321570783 / job 102369165009 is terminal FAILURE.

That image failure is outside this one-file docs lane. Exact checkout/base refusal and dependency materialization succeeded; authenticated GHA cache import succeeded; the patch-validator image built successfully; static self-contained-runtime inspection and no-network/read-only/non-root hostile smoke succeeded; SBOM and vulnerability scans completed. The terminal failure is the final critical-dependency provenance-receipt verifier on the inherited protected-main embedded-runtime/applicability state (including the old c-ares/runtime receipt set). #566 is the canonical image/runtime/provenance repair lane. Do not copy #566 scanner/applicability authority into this PR and do not weaken or suppress the verifier here.

#570 already prospectively contains this exact six-line platform-binding discipline plus its executable handoff contract, but that is not yet a valid close condition. Keep #572 open until #566 normally integrates, #570 ordinary/non-force reconverges onto the resulting protected main, reaches unchanged-exact four-GREEN with clean review, integrates normally, and protected-main comparison confirms complete inheritance of this delta/test/contract/evidence.

Do not rerun unchanged #572 merely to change queue/build time. No release authority is inferred.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Verified complete successor inheritance after normal #570 integration. Protected main is now f83d42817ac90aad4159e7b8649eed5b9a6f8740. #572 changes only AGENTS.md; its exact six-line transitive platform-binding discipline is present verbatim on protected main (dependency bumps re-prove platform bindings, reproduce the WASI materialize battery, explicit still-published binding pin with lock-version alignment, and lock + lockfile-policy regeneration). #570 reached unchanged-exact application CI/reviewer-ci/Security Scan/patch-validator-image GREEN at 902cb600d53966d8a1d18789ab65ac026d0fdf9f before normal merge and carries the executable handoff contract alongside the inherited guidance. Closing #572 is therefore verified successor consolidation, not loss of an unmerged valid delta.