[scbrown]

Why

Tambo's reviewed pins trailed every member's current release, so a fresh install delivered old tools, and a host already running current releases read them as drift.

member	pin	now
Bobbin	0.27.3	0.30.0
Yupana	0.12.7	0.16.2
Desire Path	v0.3.2 (1f457ec)	v0.10.0 (0681233)
Shuttle	0.5.0	0.6.1

Seeds stays at 0.3.0.

How each pin was checked

• Bobbin: tambo reads the archive digest from the release's SHA256SUMS.txt at install time. v0.30.0 publishes bobbin-v0.30.0-<target>.tar.gz for all four targets tambo maps, plus SHA256SUMS.txt.
• Yupana: the three pinned archive digests were recomputed from the downloaded archives. Each agrees with the release SHA256SUMS and with its .sha256.
• Desire Path: v0.10.0 is a lightweight tag on 06812336fda6a6fd3fe4cbcae2d50a303e95a024. That is the revision tambo builds and stamps.
• Shuttle: bumped with tambo bump-member members/shuttle.toml --tag v0.6.1. The wheel digest a25ecb13… matches a separate download and the release checksums.txt.
  • The manifest now names intigraph/shuttle. The GitHub API answers the old scbrown/shuttle with a 301, and bump-member's curl does not follow redirects, so the bump failed with missing field tag_name.
  • Follow-up, not in this PR: the seeds and chaski manifests, and the adapter's scbrown/… download URLs, should also move to their canonical names before their next bump.

Test fixtures move with the pins. Each fixture keeps its relation to the pin: equal, one patch ahead, or one minor ahead, the same as #122.

• One literal (0.30.0, the "ahead of stable channel" case) collided with the new pin value. It is now 0.33.0, above the new stable 0.32.0.

Gates

• cargo fmt --check;
• cargo clippy --all-targets --all-features -D warnings;
• cargo test --all-features: 288 / 0, each binary under a HOME-escape guard;
• scripts/test-stack-pendants.py, test-install-bootstrap.py, test-release-repository.py, test-crate-version.py, test-release-install.sh;
• pytest tests: 92 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BzgSY2LpdGhBhb7D1nHbiF

[scbrown]

Repair at head 3e0b55d8 (pr-risk tier 2, record 2e3fdcff…).

The red: Repository pendant source controls failed with source witness changed: src/adapter.rs. docs/knowledge/repository-knowledge.json pins that file by sha256, and the re-pin edits it.

• Fix: re-witnessed the hash only. The record describes the Adapter trait, which the version and digest constants leave unchanged.
• Locally, the job's four scripts with rdflib 7.6.0: test-repository-knowledge.py was rc 1 before the fix (the control reproduces CI) and rc 0 after. share-query, share-publication and pendant-admission are rc 0.
• Every other check was green on c7b38bd2. The code is unchanged since.