statecraft.
Catalog/spec-spine

027-cargo-workflow-dependency-waiver

Cargo and workflow dependabot bumps self-clear: freshness projection + auto-waiver

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Amends 004 §3.5 and 005 §3.5, extending the paired 2026-06-11 npm dependency-only mechanism to the cargo and GitHub Actions ecosystems so a dependabot-class bump self-clears without a human waiver. Freshness half: Cargo.toml folds into the index content hash as a governance projection (its dependency tables stripped), mirroring npm, so a version bump leaves the committed shards fresh. Coupling half: the mechanical auto-waiver recognizes a Cargo.toml whose only change is dependency version specifiers, and a `.github/workflows/*.yml` whose only change is the `@ref` of `uses:` action references. Every non-version edit (a new or removed dependency, a feature / git / path change, a `run:` / `with:` edit, an added step or table, an unpinned action, a spec-metadata edit) still refuses the waiver, fail-closed. A claimed workflow file (007/008/019's release.yml) and a crate whose direct dependencies dependabot bumps are the live acceptance tests.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/manifest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/index.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "005-coupling-gate",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/dep_only.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "005-coupling-gate",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-cli/src/cmd_couple.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "005-coupling-gate",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-cli/tests/couple.rs"
  }
}

Source headings

  1. 027: Cargo and workflow dependabot bumps self-clear
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 Cargo freshness projection (amends 004 §3.5)
  6. 3.2 Cargo dependency-only auto-waiver (amends 005 §3.5)
  7. 3.3 Workflow dependency-only auto-waiver (amends 005 §3.5)
  8. 3.4 The whole-diff rule is unchanged
  9. 3.5 Config, determinism, and report shape
  10. 3.6 Tests (minimum)
  11. 4. Out of scope

Frozen anchors

No frozen anchors declared.