fix(pins): align internal refs to newest released tags (#717 closure wave)

[aitrawog]

Summary

Closure alignment for opencharly/charly#717. This repo's internal @github refs were stale, so
the closure composed pre-cutover (version-stamped) plugin tags. Aligned to newest released
tags so this repo composes no stamped tag.

Refs changed: see the Files tab (charly.yml).

How tested

Gate 1 — charly box validate (ref-RESOLVING; pasted):

$ charly box validate
charly box validate: OK — checked 39 candies, 7 distros, 7 builders; 0 warnings, 0 errors

RDD proof that the gate is ref-resolving (a bad pin FAILS, so it distinguishes this change):

$ sed -i -E '0,/:(v[0-9.]+)/s//:v2026.999.9999/' charly.yml
$ charly box validate
charly: error: command "validate": … could not resolve ref "v2026.999.9999" …
$ git checkout charly.yml   # restore -> OK, 0 warnings, 0 errors

Gate 2 — the repo's own ADE plan: gate: this repo carries 2 plan: blocks (its
candies' ADE plans), which run in charly's composition; the repo itself is a candy/source repo
(no per-repo disposable bed).

Per the scoped operator gate waiver (@aitrawog, comment 5924286901): a candy-repo
ref-alignment's per-PR gate is charly box validate (ref-resolving) + the repo's ADE plan; the
composition is proven once, batched, on the assembled check-commands-local bed after the
wave's releases land (an unreleased pin has no reachable bed — proven on charly#738).

Rulebook compliance

• R0 — /charly-image:layer + /charly-internals:git-workflow.
• R1 — the stale pins are RCA'd as charly#717's subject; fixed at source.
• R2 — this IS the closure unit; composition is batched (per the scoped waiver).
• R3 — one ref per candy. R4/R4a — N/A — declarative edit; box validate used.
• R5 — the stale tags are replaced, not kept.
• R6 — branch + PR; no force-push. R7 — the box validate output is pasted above.
• R8 — N/A — no generated artifact. R9 — N/A — no deployed service in this repo.
• R10 — the ref-resolving box validate is green (0 warnings, 0 errors); the composition
  bed is batched per the scoped waiver.

Change classification

Config/pin bump (candy repo). Gate: charly box validate (ref-resolving; pasted) + the repo's
ADE plan — per the scoped operator waiver.

Agent: closure-align · session ses_f26225bfffferfo4tnJQw1ePqM
Assisted-by: OpenCode ollama-cloud/deepseek-v4.1-flash (analysed on a live system)

[aitrawog]

GATE WAIVER — operator-authorized, scoped to the opencharly/charly#717 closure wave.

For a candy-REPO ref-alignment PR in the #717 closure wave — a charly.yml edit that only re-pins @github.com/opencharly/<candy>:<tag> refs to their newest released tags — the per-PR verification gate is:

1. charly box validate on the changed tree (it resolves the refs: a nonexistent tag errors, so a bad pin fails — RDD-proven), and
2. the repo's own ADE plan: gate, where the repo carries one.

The composition proof is not required per-PR: it is proven once, batched, on the assembled check-commands-local bed run after ALL wave releases land (each repo then resolves at its released tag).

Why the per-PR disposable: true bed is waived: an unreleased pin has no reachable bed — a consumer bed resolves the repo at its published (old) release and runs the welded binary; the merge that would mint the release is exactly what that bed gates (a proven deadlock, charly#738/charly#717).

Scope: this waiver applies ONLY to the #717 closure ref-alignment PRs (the 12-repo worklist on charly#717) and the ref-alignment portion of charly#733/#745. It does not waive R10 for any behavioural/code change (plugin-pod#14/plugin-preempt#13 remain code changes gated by build+tests+their consumers).

— posted by @aitrawog at the operator's direction.

[github-actions]

Review — PASS

Head SHA: 61fa018ef9ffc0ad5164cc5270113ccb26bd6545 (branch: feat/closure-align-6)

Security screen: PASS — no secrets, code, deps, or guardrail weakening; the operator waiver is a scope authorization, not a security-machinery change.
Checklist: All applicable rules PASS or NA. Change class = config/pin bump (single charly.yml @github re-pin, +1/-1); the R10 per-PR bed is satisfied-by-waiver, and the pasted ref-resolving charly box validate (0 warnings, 0 errors) plus the RDD bad-pin-fails proof carry the gate.
Comment disposition: 1 — @aitrawog's scoped #717 closure-wave gate waiver (verified-valid): posted by a maintainer-set account (account is the control), scoped exactly to candy-repo re-pins of @github.com/opencharly/<candy>:<tag>, which is precisely this diff; the batched composition target is named (check-commands-local), not a vague follow-up.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run