chore: May 2026 toolchain baseline + wasi-sdk-32 checksum fix

MODULE.bazel

@@ -146,7 +146,7 @@ wasm_toolchain = use_extension("//wasm:extensions.bzl", "wasm_toolchain")
 wasm_toolchain.register(
     name = "wasm_tools",
     strategy = "download",  # Download prebuilt binaries from GitHub releases
-    version = "1.244.0",
+    version = "1.246.2",
 )
 use_repo(wasm_toolchain, "wasm_tools_toolchains")
 
@@ -168,7 +168,7 @@ wasi_sdk = use_extension("//wasm:extensions.bzl", "wasi_sdk")
 wasi_sdk.register(
     name = "wasi",
     strategy = "download",
-    version = "29",
+    version = "32",
 )
 use_repo(wasi_sdk, "wasi_sdk")
 
@@ -208,7 +208,7 @@ cpp_component = use_extension("//wasm:extensions.bzl", "cpp_component")
 cpp_component.register(
     name = "cpp",
     strategy = "download",
-    wasi_sdk_version = "29",
+    wasi_sdk_version = "32",
 )
 use_repo(cpp_component, "cpp_toolchain")
 
@@ -219,7 +219,7 @@ bazel_dep(name = "rules_nodejs", version = "6.5.0")
 
 # Configure Node.js version and tools
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
-node.toolchain(node_version = "24.14.0")
+node.toolchain(node_version = "24.14.1")
 use_repo(node, "nodejs_toolchains")
 
 # JavaScript/TypeScript WebAssembly components with JCO
@@ -295,7 +295,7 @@ wasm_component_download(
     name = "file_ops_component_external",
     filename = "file_ops_component.wasm",
     tool_name = "file-ops-component",
-    version = "0.1.0-rc.3",
+    version = "0.2.0",
 )
 
 # WSC (WebAssembly Signature Component) for signing (version in //checksums/tools/wsc.json)

artifacts/decisions.yaml

@@ -0,0 +1,125 @@
+# Design decisions and their driving requirements.
+# Managed by rivet (see rivet.yaml).
+artifacts:
+  - id: REQ-002
+    type: requirement
+    title: End-to-end certifiable WebAssembly pipeline
+    status: accepted
+    description: >
+      The project shall provide a build-and-verification pipeline that takes a
+      system from an AADL architecture model through to coverage-verified,
+      target-compiled WebAssembly artifacts, with each transformation
+      independently attestable.
+    tags: [pipeline, certification]
+
+  - id: REQ-003
+    type: requirement
+    title: Version-pinned, checksum-verified toolchains
+    status: accepted
+    description: >
+      All build toolchains shall be pinned to explicit upstream versions with
+      SHA256 checksums verified against the JSON registry, so an upstream
+      re-release of an existing version fails the build loudly rather than
+      silently changing build inputs.
+    tags: [toolchain, security]
+
+  - id: REQ-004
+    type: requirement
+    title: First-class integration of PulseEngine pipeline tools
+    status: accepted
+    description: >
+      PulseEngine pipeline tools (spar, loom, meld, sigil, witness, synth)
+      shall be integrated as first-class hermetic Bazel rules rather than
+      invoked as manual out-of-band steps.
+    tags: [toolchain, integration]
+
+  - id: DD-001
+    type: design-decision
+    title: Adopt the AADL-to-ELF certifiable WebAssembly pipeline
+    status: approved
+    description: >
+      Standardize the toolchain on a fixed staged pipeline: spar (AADL to WIT)
+      then build, then loom + wasm-opt optimization, then wac composition,
+      then sigil/wsc sign and attest, then meld fusion to a core module, then
+      witness MC/DC coverage and synth ELF compilation.
+    tags: [pipeline, certification]
+    fields:
+      rationale: >
+        A fixed, attestable stage order is what makes the output certifiable
+        (DO-178C / ISO 26262 lineage). meld's component-to-core-module fusion
+        is the bridge that lets witness and synth (both core-module-only)
+        operate on what started as a component; both consume the same
+        MeldFusedInfo provider. sigil/wsc attests every transform edge so the
+        chain is independently verifiable.
+      alternatives: >
+        Ad-hoc per-project tool invocation; checking generated WIT and ELF
+        into source; using only hand-authored WIT interfaces.
+      source-ref: docs/certification-pipeline.md
+      diagram: |
+        flowchart TD
+          AADL["AADL architecture model"] -->|"spar codegen --format wit"| WIT["WIT interfaces"]
+          WIT -->|"wit_library / wit_bindgen"| BIND["Language bindings"]
+          SRC["Component source"] --> BUILD["Build component"]
+          BIND --> BUILD
+          BUILD --> COMP["WASM component"]
+          COMP -->|"loom + wasm-opt"| OPT["Optimized component"]
+          OPT -->|"wac compose"| COMPOSE["Composed component"]
+          COMPOSE -->|"wsc / sigil sign+attest"| ATTEST["Attested component"]
+          ATTEST -->|"meld fusion"| MOD["WASM core module"]
+          MOD -->|"witness"| COV["MC/DC coverage evidence"]
+          MOD -->|"synth compile"| ELF["ARM Cortex-M ELF"]
+    links:
+      - type: satisfies
+        target: REQ-002
+
+  - id: DD-002
+    type: design-decision
+    title: May 2026 toolchain version baseline
+    status: approved
+    description: >
+      Bump wasm-tools 1.244.0 to 1.246.2, wasi-sdk 29 to 32, binaryen 123 to
+      129, nodejs 24.14.0 to 24.14.1, and file-ops-component 0.1.0-rc.3 to
+      0.2.0; re-verify and correct all five wasi-sdk-32 SHA256 checksums.
+    tags: [toolchain, security]
+    fields:
+      rationale: >
+        MODULE.bazel version pins had drifted behind the checksum registry's
+        verified versions; realigning them keeps the JSON registry as the
+        single source of truth. The wasi-sdk-32 checksum mismatch on all five
+        platforms was an upstream re-release of an existing version, caught
+        only because checksums are pinned - a live confirmation of REQ-003's
+        loud-failure property.
+      alternatives: >
+        Remain on the older versions; bump versions without re-verifying the
+        upstream checksums.
+      baseline: "2026-05"
+      source-ref: "commit 40a4d02"
+    links:
+      - type: satisfies
+        target: REQ-003
+
+  - id: DD-003
+    type: design-decision
+    title: Integrate spar and witness now; defer synth pending a release
+    status: approved
+    description: >
+      Add JSON-registry entries, toolchains, and Bazel rules for spar
+      (aadl_wit_library) and witness (wasm_module_coverage); keep loom, meld,
+      and sigil integrated with a consistency pass; defer synth until it
+      publishes a versioned release.
+    tags: [toolchain, integration]
+    fields:
+      rationale: >
+        spar (v0.9.3) and witness (v0.22.0) publish versioned per-platform
+        release binaries with SHA256SUMS, fitting JSON-registry download
+        Pattern 1. synth has no published releases, so integrating it now
+        would require rolling-URL sourcing - the exact anti-pattern that
+        disables MoonBit and componentize-py. witness operates on core
+        modules, which meld already produces.
+      alternatives: >
+        Integrate all four tools now (blocked by the absence of synth
+        releases); build every tool from source via git_repository.
+      source-ref: docs/certification-pipeline.md
+    links:
+      - type: satisfies
+        target: REQ-004

checksums/tools/wasi-sdk.json

@@ -2,29 +2,29 @@
   "tool_name": "wasi-sdk",
   "github_repo": "WebAssembly/wasi-sdk",
   "latest_version": "32",
-  "last_checked": "2026-03-15T00:00:00Z",
+  "last_checked": "2026-05-20T00:00:00Z",
   "versions": {
     "32": {
       "release_date": "2026-03-12",
       "platforms": {
         "darwin_amd64": {
-          "sha256": "fa34cbdd4828537a877ced0b3b1a0a36fb3a27645d2518e480844af27cbc93b4",
+          "sha256": "a36c9ab106a40abe8a051279c233c6bab719a5788ecc0788e8d141796eb55b1b",
           "url_suffix": "x86_64-macos.tar.gz"
         },
         "darwin_arm64": {
-          "sha256": "f46ad0b7382c1faf3787171790eb4e5e61e0021908f5b6c53bcdb07df346e299",
+          "sha256": "383be7fe00ae04691e1859164fd99970a528c55d624b886ed59f7933898b933d",
           "url_suffix": "arm64-macos.tar.gz"
         },
         "linux_amd64": {
-          "sha256": "854117f853dcdeef19b08a3d9d06fa4ac3c1cda1a05d0b65abbbe5df1868a82e",
+          "sha256": "55fc523ebfbc98f69d1034fcfcb83d1ff5610cd9ab7eceef6cd097a30ba4ef93",
           "url_suffix": "x86_64-linux.tar.gz"
         },
         "linux_arm64": {
-          "sha256": "3d348da5943c21f9745286c6c0f429f07dd98b2222f7c5fb38cab7070a2678b6",
+          "sha256": "b2070865e6cb0c1e97a38e6ac8d9c37a9dfcd0752764ebabc6bacd3e60cedb96",
           "url_suffix": "arm64-linux.tar.gz"
         },
         "windows_amd64": {
-          "sha256": "18d93534ea6ac58b79f5a55fe35a4d7329ad8b2647b4d6d9be58a8735ecd49e6",
+          "sha256": "3188807b9708d05e854b1b2f8db1f2bffcc337292449a4673fbab7175416bd41",
           "url_suffix": "x86_64-windows.tar.gz"
         }
       }

docs/certification-pipeline.md

@@ -0,0 +1,68 @@
+# Certifiable WebAssembly Pipeline
+
+This document describes the end-to-end build-and-verification pipeline that
+`rules_wasm_component` targets, integrating the PulseEngine toolchain
+(`spar`, `loom`, `meld`, `sigil`/`wsc`, `witness`, `synth`). It is the
+reference flow for producing **certifiable** WebAssembly artifacts — the tool
+ordering has a DO-178C / ISO 26262 lineage.
+
+## Flow
+
+```mermaid
+flowchart TD
+    AADL["AADL architecture model"] -->|"spar codegen --format wit"| WIT["WIT interfaces"]
+    WIT -->|"wit_library / wit_bindgen"| BIND["Language bindings"]
+    SRC["Component source<br/>(Rust / C++ / Go / JS)"] --> BUILD
+    BIND --> BUILD["Build component"]
+    BUILD --> COMP["WASM component"]
+    COMP -->|"loom + wasm-opt (binaryen)"| OPT["Optimized component"]
+    OPT -->|"wac compose"| COMPOSE["Composed component"]
+    COMPOSE -->|"wsc / sigil: sign + attest"| ATTEST["Signed + attested component"]
+    ATTEST -->|"meld: component fusion"| MOD["WASM core module"]
+    MOD -->|"witness: instrument + run"| COV["MC/DC coverage evidence"]
+    MOD -->|"synth compile"| ELF["ARM Cortex-M ELF"]
+
+    SIGIL["sigil / wsc attestation"] -.->|"attests each transform edge"| OPT
+    SIGIL -.-> COMPOSE
+    SIGIL -.-> MOD
+```
+
+## Stages
+
+| Stage | Tool | Consumes | Produces |
+|-------|------|----------|----------|
+| Interface generation | **spar** | AADL v2.3 architecture model | `wit/*.wit` (one per `process`) |
+| Binding generation | `wit_library` / `wit_bindgen` | WIT interfaces | Language bindings |
+| Build | existing language rules | source + bindings | WASM component |
+| Optimization | **loom** + **wasm-opt** (binaryen) | WASM component | Optimized component |
+| Composition | `wac` | components | Composed component |
+| Sign & attest | **sigil** (`wsc` CLI) | composed component | Signed + attested component |
+| Fusion | **meld** | composed component | WASM **core module** (`MeldFusedInfo`) |
+| Coverage | **witness** | core module | MC/DC branch-coverage evidence |
+| Target compile | **synth** | core module | ARM Cortex-M ELF |
+
+## Key architectural points
+
+- **`meld` is the component → core-module bridge.** `witness` and `synth`
+  both operate on *core modules*, not components — `meld`'s component fusion
+  is what makes them applicable. Both consume the same `MeldFusedInfo`
+  provider (`synth_compile.bzl` already does); the `witness` rule should too.
+- **`spar` extends the pipeline's origin point** from hand-authored WIT to
+  WIT derived from a formal AADL architecture model.
+- **`sigil`/`wsc` attestation wraps each transform edge** so the entire chain
+  is independently verifiable — this is what the existing `wasm_attest` /
+  `wasm_verify_chain` / `wasm_show_chain` rules provide.
+
+## Tool integration status
+
+| Tool | Repo | Latest | Status |
+|------|------|--------|--------|
+| loom | `pulseengine/loom` | 0.3.0 | ✅ Integrated (`wasm_optimize`) |
+| meld | `pulseengine/meld` | 0.1.0 | ✅ Integrated (`meld_fuse`, native toolchain) |
+| sigil (`wsc`) | `pulseengine/sigil` | 0.7.0 | ✅ Integrated (`wasm_attest` etc.) |
+| spar | `pulseengine/spar` | 0.9.3 | 🔜 Planned — `aadl_wit_library` rule |
+| witness | `pulseengine/witness` | 0.22.0 | 🔜 Planned — `wasm_module_coverage` rule |
+| synth | `pulseengine/synth` | — | ⏸️ Deferred — awaiting an upstream release |
+
+See rivet design-decision artifacts in `artifacts/decisions.yaml` for the
+recorded rationale behind this pipeline and the integration plan.

toolchains/binaryen_toolchain.bzl

@@ -99,7 +99,7 @@ binaryen_repository = repository_rule(
     implementation = _binaryen_repository_impl,
     attrs = {
         "version": attr.string(
-            default = "123",
+            default = "129",
             doc = "Binaryen version to download",
         ),
         "bundle": attr.string(

toolchains/tinygo_toolchain.bzl

@@ -26,7 +26,7 @@ All tools (Go SDK, Binaryen, TinyGo) are downloaded via tool_registry.download()
 
 # Version constants - centralized for easy updates
 _GO_VERSION = "1.25.3"
-_BINARYEN_VERSION = "123"
+_BINARYEN_VERSION = "129"
 
 def _setup_go_wit_bindgen(repository_ctx, go_binary):
     """Install wit-bindgen-go Go tool for WIT binding generation