build: re-land the 7-day soak + pinned tooling, MSRV-ceiling guarded

.buildkite/linux-agent.Dockerfile

@@ -24,10 +24,43 @@ RUN set -eux; \
   sh /tmp/mise-install.sh; \
   rm /tmp/mise-install.sh; \
   /root/.local/bin/mise --version
+# Minimal-profile toolchains only (the default profile ships rust-docs,
+# ~600 MB per toolchain): stable as the default, plus the MSRV floors the
+# CI legs verify against (1.91 workspace rust-version; 1.93 leg). NO dated
+# nightly is baked — the repo deliberately ships no rust-toolchain.toml
+# (#1039), and the one nightly consumer (`cargo +nightly update` in
+# scripts/soak/update-deps.mts) runs on dev machines, not this agent.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
     | sh -s -- -y --profile minimal --default-toolchain stable \
-  && /root/.cargo/bin/rustup toolchain install 1.93.0 --profile minimal \
+  && /root/.cargo/bin/rustup toolchain install 1.91.0 1.93.0 --profile minimal \
   && /root/.cargo/bin/rustup component add rustfmt clippy --toolchain stable \
   && rm -rf /root/.rustup/downloads /root/.rustup/tmp
 
-ENV PATH="/root/.cargo/bin:/root/.local/bin:/root/.local/share/mise/shims:${PATH}"
+# Pre-bake Socket Firewall (free tier — keyless; jobs holding a Socket key
+# select enterprise at job time) plus its package-manager shims, pinned +
+# integrity-checked against external-tools.json (sfw-free 1.14.0, sha512
+# hex below = that file's SRI decoded). scripts/soak/external-tools.mts
+# --check asserts these embedded copies never drift from the manifest.
+COPY sfw-shim-template.sh /tmp/sfw-shim-template.sh
+RUN set -eux; \
+  arch="$(uname -m)"; \
+  case "$arch" in \
+    x86_64)  asset=sfw-free-linux-x86_64; sha=85b108842381b948c50e93580d8149d63fc8c080226b1287b06690e1448e8b004ad72d69a2ea46948462aad0e4563e0ff71fbd2341a48b7c6856ae82da7c816f ;; \
+    aarch64) asset=sfw-free-linux-arm64;  sha=098a790b829eca08576b4494b53e96afe5fce75857217d377234c52b7a80c94ff1f874245bb65a9c07ef5a13becc29aff0306b5c7556a38365bfa5673fabd75d ;; \
+    *) echo "unsupported arch $arch" >&2; exit 1 ;; \
+  esac; \
+  mkdir -p /root/.local/share/aube/dev-tools/rack/sfw-free/1.14.0 /root/.local/share/aube/dev-tools/bin; \
+  curl -fsSL -o /root/.local/share/aube/dev-tools/rack/sfw-free/1.14.0/sfw \
+    "https://github.com/SocketDev/sfw-free/releases/download/v1.14.0/$asset"; \
+  echo "$sha  /root/.local/share/aube/dev-tools/rack/sfw-free/1.14.0/sfw" | sha512sum -c -; \
+  chmod 0755 /root/.local/share/aube/dev-tools/rack/sfw-free/1.14.0/sfw; \
+  ln -sf /root/.local/share/aube/dev-tools/rack/sfw-free/1.14.0/sfw /root/.local/share/aube/dev-tools/bin/sfw; \
+  for cmd in npm yarn pnpm pip pip3 uv cargo; do \
+    sentinel="SFW_SHIM_ACTIVE_$(printf '%s' "$cmd" | tr '[:lower:]' '[:upper:]' | tr -c 'A-Z0-9' '_')"; \
+    sed -e "s/__CMD__/$cmd/g" -e "s/__SENTINEL__/$sentinel/g" \
+      /tmp/sfw-shim-template.sh > "/root/.local/share/aube/dev-tools/bin/$cmd"; \
+    chmod 0755 "/root/.local/share/aube/dev-tools/bin/$cmd"; \
+  done; \
+  rm /tmp/sfw-shim-template.sh
+
+ENV PATH="/root/.local/share/aube/dev-tools/bin:/root/.cargo/bin:/root/.local/bin:/root/.local/share/mise/shims:${PATH}"

.buildkite/sfw-shim-template.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# sfw shim for __CMD__ — pre-baked into the agent image; mirrors what
+# scripts/soak/external-tools.mts --shims writes on dev machines. Routes the
+# real package-manager invocation through Socket Firewall; the sentinel env
+# var breaks recursion when sfw re-invokes the tool, and the real binary is
+# found by stripping the tool-rack bin dir out of PATH.
+set -euo pipefail
+CLEAN_PATH=$(printf '%s' "$PATH" | tr ':' '\n' | grep -vFx '/root/.local/share/aube/dev-tools/bin' | paste -sd ':' -)
+REAL=$(PATH="$CLEAN_PATH" command -v '__CMD__' || true)
+if [ -n "${__SENTINEL__:-}" ] || [ -z "$REAL" ] || ! command -v sfw >/dev/null 2>&1; then
+	# Fail-open must not be SILENT-open: say so once on stderr when the
+	# firewall is missing (never on the sentinel re-entry path, where sfw
+	# itself is the caller).
+	if [ -z "${__SENTINEL__:-}" ] && [ -n "$REAL" ]; then
+		echo "[sfw-shim] sfw not on PATH — running __CMD__ unfirewalled" >&2
+	fi
+	[ -n "$REAL" ] && exec "$REAL" "$@"
+	echo "__CMD__: not found" >&2
+	exit 127
+fi
+export __SENTINEL__=1
+# Enterprise sfw defaults to BLOCK for non-registry hosts, which breaks
+# ordinary dev flows the day a Socket key lands; free tier hardcodes
+# ignore and disregards the var, so setting it is always safe.
+export SFW_UNKNOWN_HOST_ACTION=ignore
+exec sfw '__CMD__' "$@"

.cargo/config.toml

@@ -15,3 +15,15 @@
 # (7.07 s → 9.57 s) — acceptable given the safety guarantee.
 [env]
 RUST_TEST_THREADS = "1"
+
+# Supply-chain soak for cargo's own dependency resolution — the same
+# soak-window rule aube offers npm users via minimumReleaseAge: crate
+# versions younger than the window are pubtime-incompatible and the
+# resolver skips them unless already in Cargo.lock
+# (resolver.incompatible-publish-age defaults to "deny"). The unstable
+# feature is active because rust-toolchain.toml pins a nightly.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "7 days"

.claude/skills/soak/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: soak
+description: Manages the repo's supply-chain soak window (SOAK_DAYS) — checks and fixes the derived surfaces, bumps or disables the window, adds dated per-package exclusions, bumps pinned external tools, and enforces the Ubuntu-PPA MSRV ceiling. Use when a task touches minimumReleaseAge, min-release-age, min-publish-age, rust-version / MSRV, external-tools.json, sfw shims, renovate.json, or taze cooldowns, or when investigating why a freshly published version won't install.
+---
+
+# The soak window
+
+One rule: a release must be at least `SOAK_DAYS` old before this repo
+adopts it. The delay gives the ecosystem time to catch a malicious or
+yanked release before we ever install it. The window is defined exactly
+once — read the current value from `scripts/soak/constants.mts` and never
+hardcode it elsewhere. Every surface derives from or is parity-checked
+against it:
+
+| Surface | Key | Units |
+|---|---|---|
+| `.cargo/config.toml` | `global-min-publish-age` | `"N days"` |
+| `docs/pnpm-workspace.yaml` | `minimumReleaseAge` | minutes |
+| `docs/.npmrc` | `min-release-age` | days |
+| `docs/taze.config.mts` | `maturityPeriod` | imports `SOAK_DAYS` |
+| `external-tools.json` | `soakBypass` annotations | days |
+| `.github/renovate.json` | `minimumReleaseAge` (explicit — an `extends:` preset doesn't count) | `"N days"` |
+| `Cargo.toml` | `rust-version` ≤ the PPA rustc ceiling (not window-derived — see below) | version |
+
+## Commands (mise tasks — the code lives in `scripts/soak/`)
+
+- `mise run soak` — parity-check every surface (CI-gated, always-run)
+- `mise run soak:fix` — rewrite drifted windows, prune expired exclusions
+- `mise run deps:update` — bump npm (taze) + cargo deps through the window
+- `mise run tools:check` / `tools:fix` / `tools:install` — validate /
+  prune-expired-bypasses / install the SRI-pinned external tools
+  (`external-tools.json`); `tools:install` also writes the sfw firewall
+  shims into the dev-tools bin dir
+- `mise run test:scripts` — the scripts' own unit tests
+
+A soak change is done when `mise run soak` and `mise run test:scripts`
+both exit 0 — the same gates CI runs. Re-run them after every fix.
+
+The gates fail closed on invalid states (missing/malformed/wrong-math
+annotations) and WARN on expired ones — stale is not unsafe, and nobody
+has to watch for it: the scheduled `soak-autofix` workflow runs
+`soak:fix` + `tools:fix` daily and commits the pruning as a bot PR.
+
+## The MSRV ceiling (the #1039 guard)
+
+The Ubuntu PPA builds aube's source package on Launchpad with the DISTRO
+rustc. The first soak landing (#1020) bumped the workspace MSRV past it
+(1.95 > 1.93) and the whole port was reverted (#1039) to unbreak the
+release. `mise run soak` now fails any `Cargo.toml` `rust-version` above
+`PPA_RUST_CEILING` (`scripts/soak/paths.mts`, with a dated `checked:`
+note). Raise the ceiling ONLY after confirming Launchpad's rustc moved:
+https://launchpad.net/ubuntu/+source/rustc.
+
+## The cargo soak needs nightly — the repo still must not pin one
+
+`min-publish-age` is an `[unstable]` cargo feature: a stable cargo ignores
+it silently. The repo deliberately ships **no** `rust-toolchain.toml`,
+because a repo-root toolchain file outranks `rustup default` and would
+silently redirect the version-pinned CI legs and the PPA/release builds.
+The nightly is instead requested per-invocation, at the only step that
+picks versions: `scripts/soak/update-deps.mts` runs `cargo +nightly
+update`. Everything else — every CI job, every shipped binary — builds on
+stable. If you need the cargo soak somewhere new, call `cargo +nightly`
+there; do not add a toolchain file.
+
+## Change the window (one place)
+
+1. Edit `SOAK_DAYS` in `scripts/soak/constants.mts`.
+2. `mise run soak:fix` (rewrites cargo/npmrc/yaml/renovate; taze follows
+   by import).
+3. `mise run soak` + `mise run test:scripts` — existing exclusion
+   annotations encode the old window and will be flagged; re-date or
+   remove them, then re-run until both pass.
+
+**Opt out entirely**: set `SOAK_DAYS = 0` and run the same two steps —
+cargo, pnpm/aube (`minimumReleaseAge: 0`), npm, and taze all treat zero
+as disabled. There is deliberately no env-var bypass: opting out is a
+committed, reviewable change, never a silent one.
+
+## Skip the soak for ONE package (dated, temporary)
+
+Add to `minimumReleaseAgeExclude` in `docs/pnpm-workspace.yaml` with the
+annotation on the line above (block list only — flow `[..]` is rejected
+because a comment line can't attach to an inline entry):
+
+```yaml
+# published: YYYY-MM-DD | removable: YYYY-MM-DD
+- 'name@1.2.3'
+```
+
+`removable` = `published + SOAK_DAYS`; `published` must be the real
+registry publish date (the placeholders above are schematic — copying
+them verbatim is rejected). Once `removable` passes, `mise run soak`
+warns until the pin is pruned (`soak:fix` or the soak-autofix workflow
+does it). Bare names / `@scope/*` globs are standing trust and need no
+annotation. External tools use the same shape via a `soakBypass` object
+in `external-tools.json`.
+
+## Maintaining this skill
+
+`scripts/soak/` is the law; this file only documents it — when they
+disagree, fix this file. When editing, follow Anthropic's guidance:
+
+- [Prompting best practices](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices)
+- [Prompting Claude Fable 5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-fable-5)
+- [Skill authoring best practices](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices)
+- [Write an effective AGENTS.md](https://code.claude.com/docs/en/best-practices#write-an-effective-claude-md)
+
+Keep it concise (goal + constraints, not step enumeration), keep the
+description in third person with explicit "use when" triggers, and keep
+the window value in `constants.mts` rather than restating it here.

.github/renovate.json

@@ -1,19 +1,33 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["local>jdx/renovate-config"],
-  "ignorePaths": ["fixtures/**"],
+  "extends": [
+    "local>jdx/renovate-config"
+  ],
+  "ignorePaths": [
+    "fixtures/**"
+  ],
   "packageRules": [
     {
       "description": "Group Sigstore Rust crates so their shared pre-1.0 APIs stay aligned.",
-      "matchManagers": ["cargo"],
-      "matchPackageNames": ["/^sigstore-/"],
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchPackageNames": [
+        "/^sigstore-/"
+      ],
       "groupName": "sigstore crates"
     },
     {
       "description": "decmpfs 0.1.2 fails to compile for musl targets (FICLONE ioctl request typed c_ulong, which is c_int on musl). Hold at 0.1.0 until upstream fixes it.",
-      "matchManagers": ["cargo"],
-      "matchPackageNames": ["decmpfs"],
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchPackageNames": [
+        "decmpfs"
+      ],
       "allowedVersions": "<=0.1.0"
     }
-  ]
+  ],
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict"
 }

.github/workflows/ci.yml

@@ -82,6 +82,25 @@ jobs:
       - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           cache: false
+      - name: pinned package managers + socket firewall
+        env:
+          # Until the SOCKET_SECURITY_KEY repo secret lands this is empty
+          # and sfw runs its keyless free tier — the firewall is active
+          # either way and upgrades itself to enterprise when the secret
+          # appears. No cargo escape hatch is needed: sfw >= 1.14.0 exempts
+          # loopback in the child NO_PROXY, so tests talking to local
+          # registry mocks are never proxied.
+          SOCKET_SECURITY_KEY: ${{ secrets.SOCKET_SECURITY_KEY }}
+          # download() attaches this to github.com fetches only (release
+          # assets) — avoids unauthenticated rate limits.
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          node scripts/soak/external-tools.mts --install pnpm --install npm --install sfw --shims
+          node scripts/soak/external-tools.mts --print-bin >> "$GITHUB_PATH"
+      - name: assert pinned pms resolve through the shims
+        run: |
+          pnpm --version
+          npm --version
       - run: node benchmarks/validate-results.mts
       - run: mise run test
       - run: mise run lint
@@ -340,6 +359,33 @@ jobs:
   # blocked. Lets the branch-protection rule depend on one name instead of ten.
   # Exception: jobs in SKIP_OK below (api-stability, a PR-only gate) are allowed
   # to skip on push/tag/dispatch runs without failing the aggregate.
+  # Supply-chain soak parity + external-tool pin gates + the #1039 MSRV
+  # ceiling. Always-run (deliberately NOT path-filtered — a gate that only
+  # runs when tooling files change misses the drift it exists to catch)
+  # and required via `final`.
+  soak-gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          # v7 caches by default; this workflow also runs on tag pushes
+          # (release artifacts), so no cache — the soak scripts are
+          # dep-free and never npm-install anyway.
+          package-manager-cache: false
+      - name: soak window parity (mise run soak)
+        run: node scripts/soak/soak.mts --check
+      - name: external-tool pins valid (mise run tools:check)
+        run: node scripts/soak/external-tools.mts --check
+      - name: soak script unit tests (mise run test:scripts)
+        run: node --test scripts/soak/*.test.mts
+
   final:
     needs:
       - build
@@ -348,6 +394,7 @@ jobs:
       - bats-serial
       - windows
       - api-stability
+      - soak-gate
     runs-on: namespace-profile-endev-linux-amd64
     timeout-minutes: 2
     permissions: {}