chore(deps): bump KooshaPari/SessionLedger/.github/workflows/reusable-hermetic-build.yml from ec8916547e5678f72fe6894509249f9b23367b80 to 042c46e74751a378097086bcc89942dfa4bf4b04

[dependabot]

Bumps KooshaPari/SessionLedger/.github/workflows/reusable-hermetic-build.yml from ec89165 to 042c46e.

Changelog

Sourced from KooshaPari/SessionLedger/.github/workflows/reusable-hermetic-build.yml's changelog.

Changelog

Follows Keep a Changelog; versioning is SemVer.

[Unreleased]

Changed

• Wave-43 reaudit (Wave-43-D): audit/SCORECARD.md refresh at commit 41829e8 (machine-w43-reaudit); docs/ops/TRACEABILITY.json overall_audit wave=Wave-43 commit=41829e8 (conservative hold at 396/402); docs/ops/GAP_QA_MATRIX.md C00 + PLAN-W8-B rows reflect Wave-43 closure (#344/#348/#349/#361/#362).

• sl-viewer property-test surface extended (WBS-6.2 #426): crates/sl-viewer/tests/properties_viewer_theme_url.rs adds 6 proptest properties covering theme::Theme JSON round-trip + default invariant + ThemeColors::for_theme total-mapping, and daemon_url::daemon_api_url slash normalisation + daemon_host_display scheme stripping. ThemeColors gains PartialEq, Eq derives so the property test can compare palettes structurally.

• IntentState serde property surface (WBS-6.2 #426): tests/properties.rs adds intent_state_json_round_trip_preserves_variant (every variant serialises to its kebab-case Debug name and round-trips back) and intent_state_terminal_invariant_holds_across_serde (is_terminal agrees with the serde representation). Guards drift in the #[serde(rename_all = "kebab-case")] attribute.

• sl-viewer unfinished-tab property surface (WBS-6.2 #428): crates/sl-viewer/tests/properties_viewer_unfinished_tab.rs adds 6 proptest properties — reason_label is non-empty + injective; unfinished_items is deterministic, orders known last_activity_ms descending, ties break by session_id ascending, is length-monotonic w.r.t. input.

• CI drift cleanups (WBS-6.2 #428): scripts/fuzz-cadence-check.ps1 re-points the "PR smoke stays short" anchor from ci.yml (10 s budget) to fuzz-blocking.yml (30 s budget) since the PR smoke was consolidated there. scripts/rootless-nonet-check.ps1 + .github/workflows/ci.yml restore the documented rootless-nonet-policy cross-reference smoke job, with the script's regex tightened so continue-on-error detection can't bleed across jobs. tests/alloc_profile.rs + tests/replay_breadth.rs clear clippy::panic_in_if_then / clippy::unnecessary_trailing_comma under --all-targets --all-features.

• CI drift cleanups (WBS-6.2 #432 follow-up): scripts/rootless-matrix-check.ps1 ^ rootless-matrix-policy:.*?continue-on-error:\s*true regex was bleeding across jobs into the next security: job's continue-on-error: true; replaced with [regex]::Match + a proper terminator ((?=^ [A-Za-z][\w-]*:\s|\z)) so the check scopes to just the policy block. Same script now throws when the policy block is absent (was treating a failed match as success). .github/workflows/ci.yml pins actions/checkout to the immutable 3d3c42e5 SHA + persist-credentials: false for both policy jobs. .github/workflows/hermetic.yml aligns its reusable-workflow pin to the documented ec891654 SHA (was a8db485 — drift between pin doc + caller). crates/sl-viewer/src/web_exports.rs uses WebExportProvider::default_subdir to populate the defaults array in web_export_roots_with_env instead of repeating literal strings, fixing a dead_code warning that broke cargo test cli_help under -D warnings.

• sl-viewer timeline property surface (WBS-6.2 #433): crates/sl-viewer/tests/properties_viewer_timeline.rs adds 16 proptest properties — group_by_day partitions every entry into exactly one group with no losses, orders groups chronologically, and labels empty-day groups "(unknown date)". normalize_widths produces one width per input entry, all in [MIN_PX, MAX_PX], with all-zero inputs collapsing to MIN_PX and the max-tokened entry rendering at MAX_PX. model_hue is deterministic and in [0, 359]; model_color matches hsl(<hue>, 60%, 55%). TimelineEntry::from_bundle properties pin: day is the leading 10 chars of created_at (else empty), goal falls back to "(no goal)", model falls back to "unknown", source_id carries through, message_count / has_acceptance / has_contract match the input, and token_count falls back to 0 when no Intent slice carries a numeric user_turn_count.

• sl-viewer search/memory property surface (WBS-6.2 #435): crates/sl-viewer/tests/properties_viewer_search_memory.rs adds 12 proptest properties — search_view::build_query trims each field, emits a field iff its post-trim value is non-empty, encodes the documented break-character set ( , ,, #, &, =, +), and always emits limit= whose value is the parsed input or the documented "50" fallback. advanced_filter_active_count counts min_tokens/tags non-empty fields, treats "50" as the default for limit, and is trim-invariant. memory_tab::to_wiki_page carries session_id and title through unchanged and is deterministic across calls; all_wiki_pages_from_sessions produces exactly one page per input session, in input order.

• sl-viewer history_tab property surface (WBS-6.2 #444): crates/sl-viewer/tests/properties_viewer_history.rs adds 15 proptest properties — history_tab::to_timeline_entry carries summary.id / summary.title / summary.message_count / summary.intent_state (= Extracted), corpus, and cwd through unchanged; message_previews is capped at 3 (empty when input has no messages); total_messages matches input. unfinished is false for empty sessions, false when the last message content (case-insensitive) contains one of the six documented done-phrases ("looks good", "approved", "ship it", "all good", "thanks", "done"), and true otherwise. to_timeline_entry is deterministic. all_timeline_entries produces one entry per input session, sorts by total_messages descending (newest-first), every session id appears exactly once, and is deterministic.

• sl-viewer bundle_list + detail_pane property surface (WBS-6.2 #436): crates/sl-viewer/tests/properties_viewer_bundle_detail.rs adds 11 proptest properties — bundle_list::summarize carries source_id through unchanged, matches input bundle_count, reflects kind presence (has_acceptance/has_contract), falls back to "(no goal)" when no Intent slice carries a string goal, and is deterministic. detail_pane::extract_detail carries source_id through unchanged, always emits IntentState::Extracted, matches bundle.total_token_estimate() for the token total, mirrors Option<String> fields (intent_goal, context_cwd, context_title) exactly, and is deterministic.

• sl-viewer bundle-diff property surface (WBS-6.2 #434): crates/sl-viewer/tests/properties_viewer_bundle_diff.rs adds 10 proptest properties — diff_fields returns the documented field set in stable order, is reflexive on a == a, idempotent on a == a.clone(), value-flipped symmetric (diff_fields(b, a) swaps value_a/value_b while differs matches), differs matches value_a != value_b, and Option<String> fields render the em-dash fallback when both sides are None. OkfBundle::from_bundle properties pin the reduction: message_count matches slice count, has_acceptance/has_contract reflect kind presence, token_count falls back to 0 when no Intent slice carries numeric user_turn_count, source_id carries through unchanged.

• sl-viewer corpus_paths round-trip property surface (WBS-6.2 #446): crates/sl-viewer/tests/properties_viewer_corpus_paths.rs adds 10 proptest properties — CorpusPathConfig::empty() produces a config with zero custom paths; Default::default() equals empty(); is_empty() is true iff custom_paths is empty. JSON round-trip preserves custom_paths exactly (order-sensitive), is idempotent, and preserves length. save_config_to(c, p); load_config_from(p) round-trips equal configs; missing files yield Ok(empty()); junk JSON surfaces Err; save_config_to creates missing parent directories.

• Wave-44 plan landed: WAVE44_SCOPE.md + docs/ops/WAVE44_PERT.md enumerate 6 close-out lanes (3 machine, 3 human-gated) for the 6 unpaid residuals from Wave-43 (396/402 → 402/402 target). Theme: stack-stability closure + i18n migration + eval coverage + supply-chain signing.

• Wave-44 reaudit (Wave-44-D): audit/SCORECARD.md refresh at commit 13c974f7 (machine-w44-reaudit); docs/ops/TRACEABILITY.json overall_audit wave=Wave-44 commit=13c974f7 (conservative hold at 396/402); docs/ops/GAP_QA_MATRIX.md C00 + C08 + PLAN-W8-B rows reflect Wave-44 closure (#368 W44-B6 corpus / #372 W44-B1 loom / #373 PERT correction). 2 of 3 machine lanes shipped 2026-07-24; remaining 6 raw pts across C04 L36 / C08 L76 / C11 L110.

Fixed

• Viewer first-run corpus CTA (C09): wire “Open corpus…” to a web Forge DB file picker (corpus_cta.rs) or open the quick-start runbook on desktop; cargo test -p sl-viewer.

• sl-viewer web_exports property surface (WBS-6.2 #437): crates/sl-viewer/tests/properties_viewer_web_exports.rs adds 11 proptest properties — WebExportProvider::label is non-empty, distinct per variant, and free of tabs/newlines/double-spaces. WebExportProvider::corpus is total (every variant maps to a known Corpus web variant) and injective (distinct providers → distinct corpora). WebExportProvider::default_subdir is non-empty, distinct, and equals label (so ~/Downloads/<subdir> lines up with the user-facing provider name). web_export_roots_with_env(home, None) returns an empty set for a non-existent home, returns the existing-default subset in input order for an existing home, and is total over the documented 3-provider set when all defaults exist.

• sl-viewer mock_data fixture property surface (WBS-6.2 #451): crates/sl-viewer/tests/properties_viewer_mock_data.rs adds 18 proptest properties — sample_bundles() is non-empty and returns the documented 3-entry sample; every source_id is non-empty and unique; every ContinuationBundle has at least one Bundle slice, at least one Intent slice, and an Intent with a non-empty goal; every Acceptance slice carries ready: true; output is deterministic across calls. sample_sessions() is non-empty and returns the documented 3-entry sample; every session id is non-empty and unique; every session has at least one message whose content is non-empty; every session has non-empty cwd and title; every session contains at least one User and one Assistant message; output is deterministic across calls.

• sl-viewer cli_help + command_palette property surface (WBS-6.2 #452): crates/sl-viewer/tests/properties_viewer_cli_help.rs adds 17 proptest properties — cli_help::version_text is non-empty, contains the package version, the daemon: label, and the help doc link, and is deterministic across calls. cli_help::help_text is non-empty, documents SL_DAEMON_URL / FORGE_DB / SL_VIEWER_DEMO, links the documented SSOT and quick-start docs, mentions the keyboard shortcuts, and is deterministic across calls. command_palette::COMMANDS is non-empty; every command has a non-empty id / label / hint; every id is unique across the palette and is kebab-case ASCII; every documented PaletteAction variant is covered; label and hint are single-line; every action appears 1-7 times.

• sl-viewer corpus_cta constants property surface (WBS-6.2 #453): crates/sl-viewer/tests/properties_viewer_corpus_cta.rs adds 9 proptest properties — QUICKSTART_URL is non-empty, uses HTTPS, ends in QUICKSTART.md, and points at the canonical KooshaPari/SessionLedger repo. QUICKSTART_CORPUS_DOC is the documented docs/guides/quick-start/QUICKSTART.md repo path, and its basename matches the URL basename. CORPUS_PICKER_INPUT_ID and FORGE_DB_HINT_STORAGE_KEY are non-empty, kebab-case ASCII, and distinct.

• sl-viewer theme property surface (WBS-6.2 #454): crates/sl-viewer/tests/properties_viewer_theme.rs adds 28 proptest properties — Theme::default() is System, Theme JSON round-trips for every variant, and the serialised form uses lowercase. ThemeColors::dark / ThemeColors::light each expose 9 fields (bg / surface / text / accent / secondary / border / focus / danger / muted) that all match the documented lab_coat::* constants; every field is non-empty; focus == accent for both palettes. for_theme(Dark) == dark(), for_theme(Light) == light(), for_theme(System) == dark() (desktop fallback).

• sl-viewer settings property surface (WBS-6.2 #454): crates/sl-viewer/tests/properties_viewer_settings.rs adds 21 proptest properties — DefaultTab::default() is Bundles; DefaultTab::ALL covers every variant, has length 9, and every tab_id() / value_attr() is unique, kebab-case ASCII, and tab_id() is the tab- prefix of value_attr(). Settings::default() is {theme: System, default_tab: Bundles}; JSON round-trip preserves the struct; serialised theme is lowercase and default_tab is kebab-case; save_to_path / load_from_path round-trip equal configs; missing/corrupt files fall back to default(); missing parent directories are created. resolve_settings_dir honours non-empty overrides, falls through on empty overrides, picks the documented macOS / Windows / Linux paths conditionally.

... (truncated)

Commits

• 042c46e fix(gitleaks): remove tracked build artifacts and update gitignore
• 4d5f42a style: prettier format all files to fix Trunk Check lint failure
• 6efb90f chore(quality): add fuzz, mutation, benchmark scaffolds
• 9888ac3 chore(audit): regenerate scorecard (71/B)
• 9e937a9 chore(governance): add CODEOWNERS, labeler, WORKFLOW.md, scorecard, devcontai...
• 5e7d8fc chore(quality): add 1 missing quality pillar files
• bd86db9 Merge pull request #522 from KooshaPari/fix/release-blockers-20260802
• 69832f4 Merge remote-tracking branch 'origin/main' into fix/release-blockers-20260802
• 85b45c2 docs: add user-oriented scorecard (utility/usability/expandability 32 pillars)
• d9141c3 Fix SessionLedger gaps: Add CLAUDE.md, codecov.yml, gitleaks.toml, gitleaks w...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.