pulseengine-claude skills: integrate varve (the toolchain layer manager) — it's absent from the roster and every skill

[avrabe]

What varve is now

pulseengine/varve — the toolchain layer manager born from #157 — is no longer a design. As of today it is 14 shipped releases (v0.1.0 → v0.12.1), dogfooded: the PulseEngine toolchain ships as signed OCI layers on ghcr.io/pulseengine/varve/layers (layer 2026.08.2 carries rivet, synth, loom, meld, spar, witness, kilnd, wsc), pinned per-project via varve.toml, verified offline (DSSE against a trust root), anti-rollback-protected (SUIT/Uptane counters), dispatched through PATH shims (cd switches toolchains), self-updating (old-verifies-new), with parallel trust universes (realms), and consumed by Bazel via a module extension (pulseengine/rules_wasm_component#606). rivet graph: 20+ requirements verified, mutation gate + claim-check + verification-evidence gating CI.

The problem: varve is completely absent from pulseengine-toolchain.md (the single roster every skill references) and from all 16 skills — yet varve changes how the toolchain the skills orchestrate is delivered and identified. The skills currently assume tools are "just on PATH"; varve is what makes that PATH pinned, verified, and reproducible.

Proposed skill/memory improvements

1. pulseengine-toolchain.md (memory) — add varve to the roster

It's missing. Suggested entry:

varve — toolchain layer manager. Distributes the whole tool set as one signed, dated, digest-pinned OCI layer (YYYY.MM.P); per-project varve.toml pin, offline DSSE verification against the trust root, anti-rollback counters, content-addressed core, PATH shims (cd-switches), self-update (old-verifies-new), realms (parallel trust universes), deposit/export-bazel for CI. Sits outside the layer it installs (it must exist before any layer does). The answer to "which toolchain produced this artifact?" and to the stale-tool phantom-capability failure. Native Rust CLI — witness MC/DC and scry are N/A to varve itself (they target the wasm the layers carry).

2. release-artifact-pipeline — layers are a distribution track

Track B (distribution) lists crates.io + npm. Add varve layers as the canonical org-internal distribution: a tool's signed release becomes a layer entry via varve deposit; consumers pin a layer, not N independent tool versions. And varve export-bazel makes the checksum-registry hashes signature-anchored instead of TOFU (relevant to the Track E rivet-extraction story). The deposit workflow also became an org release-standard enforcer — it fail-closed-excludes tools whose releases lack cosign-signed sums (this is how ordeal's unsigned releases got caught and fixed same-day).

3. pulseengine-feature-loop — run the loop under a pinned layer

The compose loop (spar→WIT→rivet→code→witness→sigil→smithy) silently assumes whatever tools are on PATH. Add a step-0 note: resolve the loop's tools through varve so every build runs against a pinned, verified, single toolchain — this closes the mixed-toolchain hazard (a pipeline running half on one tool version and half on another) by construction, and stamps the layer identity into artifact provenance so the loop's outputs are traceable to the exact toolchain.

4. report-tool-friction — varve is on the roster now

Its step-2b version-currency check is exactly varve's domain (varve status surfaces staleness/known-problems); the friction-filing target list should include varve.

5. repo-hygiene / issue-hunt — varve is a repo to sweep

Add it to the standing rotation.

6. A note on independence (cross-cutting)

varve's own audit (2026-08-08) surfaced the one gap automation can't self-close: an autonomous author self-assigning verified status. varve is adopting adversarial clean-room review as a release gate (REQ-INDEP-001) — a fresh-context reviewer re-derives every verdict, recorded per artifact. Worth generalizing into clean-room-verification / release-execution as a standing expectation for solo-agent-authored repos, not just an on-demand check.

Offer

varve's repo has the concrete artifacts (rivet requirements, the deposit + export-bazel workflows, the Bazel extension) if useful as the reference when updating the skills. Happy to open the skill PRs against whichever repo hosts the plugin source.

🤖 Filed from a varve session, per the "how does this compose with the skills" question.

[avrabe]

Tested every claim by execution before touching a skill — PR #162.

Substantiated, and understated in two places: 15 releases (not 14 — v0.13.0 landed), and the layer carries 9 tools, not 8: the list omitted ordeal. cosign verify-blob on the release → Verified OK; varve verify → signature OK, 9 tool(s) match their signed digests; varve run rivet --version → rivet 0.32.0.

Two properties I could not have documented honestly without running them:

• Tamper detection bites. One byte appended to rivet inside the core → tool 'rivet' does not match its signed digest … the binary was altered. Green again after restore.
• Realms beat the ambient environment. A bogus VARVE_TRUST_ROOT makes varve verify exit 1 when the pin names no realm, and is ignored when it names one. The no-realm case is the control proving that isn't vacuous.

That second one changed the skill text: the realm path needs no environment variable at all (the realm supplies registry and trust root), and is the stronger mechanism, so step 0 documents realms and treats VARVE_TRUST_ROOT as the fallback.

All six proposals landed, with adjustments:

1. Roster — varve added, and ordeal too: report-tool-friction already named it while the roster defined it. Same defect.
2. release-artifact-pipeline — layers as a Track B channel, plus a new subsection on deposit as an org release-standard enforcer. I verified this in deposit-layer.yml, whose comments record ordeal is EXCLUDED until its releases carry cosign-signed sums and its rejoin at v0.18.0. The framing I took from it: an unsigned release no longer just fails an audit, it drops the tool out of the toolchain everyone installs.
3. feature-loop — step 0, with the exact copy-pasteable block that was run end-to-end.
4. report-tool-friction — report layer + digest, not just a version. But varve status does not work today: it needs an ingested line-status envelope and none is published (commented on Cold start dead-ends, and the error steers to the weaker trust mechanism varve#34). Documented as "not usable for this check today" rather than as a recommended step.
5. repo-hygiene / issue-hunt — no change needed: both take <R> as a parameter and never enumerate repos. The roster is the rotation, so item 1 covers it.
6. Independence — generalized into clean-room-verification and a new blocking step 4b in release-execution, citing REQ-INDEP-001 verbatim.

One gap worth naming: the cold start dead-ends (no trust root in the docs, the release assets, or the binary) and the canonical varve-realms.toml isn't published — I reconstructed it from the RawRealm struct plus a grep of the deposit workflow. Filed as pulseengine/varve#34; until it lands, the skill inlines the key with a pointer to that issue.