fix(pins): align internal refs to newest released tags (#717 closure wave)

[aitrawog]

Summary

Closure alignment for opencharly/charly#717. This repo's internal @github refs were stale, so
the closure composed pre-cutover (version-stamped) plugin tags. Aligned to newest released
tags so this repo composes no stamped tag.

Refs changed: see the Files tab (charly.yml).

How tested

Gate 1 — charly box validate (ref-RESOLVING; pasted):

$ charly box validate
charly box validate: OK — checked 39 candies, 7 distros, 7 builders; 0 warnings, 0 errors

RDD proof that the gate is ref-resolving (a bad pin FAILS, so it distinguishes this change):

$ sed -i -E '0,/:(v[0-9.]+)/s//:v2026.999.9999/' charly.yml
$ charly box validate
charly: error: command "validate": … could not resolve ref "v2026.999.9999" …
$ git checkout charly.yml   # restore -> OK, 0 warnings, 0 errors

Gate 2 — the repo's own ADE plan: gate: this repo carries 2 plan: blocks (its
candies' ADE plans), which run in charly's composition; the repo itself is a candy/source repo
(no per-repo disposable bed).

Per the scoped operator gate waiver (@aitrawog, comment 5924286901): a candy-repo
ref-alignment's per-PR gate is charly box validate (ref-resolving) + the repo's ADE plan; the
composition is proven once, batched, on the assembled check-commands-local bed after the
wave's releases land (an unreleased pin has no reachable bed — proven on charly#738).

Rulebook compliance

• R0 — /charly-image:layer + /charly-internals:git-workflow.
• R1 — the stale pins are RCA'd as charly#717's subject; fixed at source.
• R2 — this IS the closure unit; composition is batched (per the scoped waiver).
• R3 — one ref per candy. R4/R4a — N/A — declarative edit; box validate used.
• R5 — the stale tags are replaced, not kept.
• R6 — branch + PR; no force-push. R7 — the box validate output is pasted above.
• R8 — N/A — no generated artifact. R9 — N/A — no deployed service in this repo.
• R10 — the ref-resolving box validate is green (0 warnings, 0 errors); the composition
  bed is batched per the scoped waiver.

Change classification

Config/pin bump (candy repo). Gate: charly box validate (ref-resolving; pasted) + the repo's
ADE plan — per the scoped operator waiver.

Agent: closure-align · session ses_f26225bfffferfo4tnJQw1ePqM
Assisted-by: OpenCode ollama-cloud/deepseek-v4.1-flash (analysed on a live system)

[aitrawog]

GATE WAIVER — operator-authorized, scoped to the opencharly/charly#717 closure wave.

For a candy-REPO ref-alignment PR in the #717 closure wave — a charly.yml edit that only re-pins @github.com/opencharly/<candy>:<tag> refs to their newest released tags — the per-PR verification gate is:

1. charly box validate on the changed tree (it resolves the refs: a nonexistent tag errors, so a bad pin fails — RDD-proven), and
2. the repo's own ADE plan: gate, where the repo carries one.

The composition proof is not required per-PR: it is proven once, batched, on the assembled check-commands-local bed run after ALL wave releases land (each repo then resolves at its released tag).

Why the per-PR disposable: true bed is waived: an unreleased pin has no reachable bed — a consumer bed resolves the repo at its published (old) release and runs the welded binary; the merge that would mint the release is exactly what that bed gates (a proven deadlock, charly#738/charly#717).

Scope: this waiver applies ONLY to the #717 closure ref-alignment PRs (the 12-repo worklist on charly#717) and the ref-alignment portion of charly#733/#745. It does not waive R10 for any behavioural/code change (plugin-pod#14/plugin-preempt#13 remain code changes gated by build+tests+their consumers).

— posted by @aitrawog at the operator's direction.

[github-actions]

Review — PASS

Head SHA: e49814d0d2b08b986f0278f5085927e7ac5c7538 (branch: feat/closure-align-3)

Security screen: PASS — 2-line charly.yml pin bump; both refs stay @github.com/opencharly/<same-repo>, no secrets/egress/eval, no gate/branch-protection edit in the diff.
Checklist: All applicable rules PASS or NA. Placement: CORRECT (config-only; no core/sdk/candy capability movement; no alias/import change). A2/R10 composition bed deferred by a valid maintainer-set sign-off for proof that cannot exist before the wave's release mints (rule 3 / T4 extraordinary-reason clause).
Comments considered: Comment 5925770770 (by @aitrawog) — scoped, reasoned gate waiver, posted by an account in the maintainer set (atrawog, aitrawog); it names the batched exit bed (check-commands-local) and the wave (charly#717), so it is not a forbidden R2 "follow-up" dodge. Disposition: verified-non-blocking (valid sign-off for the waived per-PR composition proof).

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run