feat: refresh measured pins and ci-workflows 0.1.17

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     name: rust
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       toolchain: '1.98.0'
       # The three-OS matrix is the evidence ADR-0113 asks for, and standard
@@ -46,7 +46,7 @@ jobs:
     name: supply-chain
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       enable_deny: true
       enable_audit: true
@@ -56,7 +56,7 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
 
   pr-hygiene:
     name: pr-hygiene
@@ -68,7 +68,7 @@ jobs:
       # that would use them is off.
       issues: write # the stale bot closes threads
       pull-requests: write # the labeler applies labels
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
 
 
   boundary:

.github/workflows/security.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # CodeQL reads the workflow definitions it analyses
       contents: read
       security-events: write # CodeQL publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       languages: '["rust", "actions"]'
       queries: security-and-quality
@@ -37,7 +37,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write # writes the review it produces
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       fail_on_severity: moderate
 
@@ -52,24 +52,24 @@ jobs:
       contents: read
       id-token: write # mints the OIDC token Scorecard's publication is signed with
       security-events: write # Scorecard publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
 
   osv:
     name: osv
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
 
   zizmor:
     name: zizmor
     permissions:
       actions: read # the SARIF upload reads this run to attach its results
       contents: read
       security-events: write # zizmor publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
 
   secret-scan:
     name: secret-scan
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17

CHANGELOG.md

@@ -15,6 +15,16 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.72] - 2026-09-16
+
+nddev-builder guidance is refreshed against each harness's current native
+extension model. Software artifacts are refreshed from verified vendor bytes:
+Claude Code 2.1.273, Grok Build 1.0.34, OpenCode 1.18.31 and Antigravity CLI
+1.2.4. Codex remains 0.154.0, Cursor 2026.09.10-fd3934a and Pi 0.85.1.
+Public reusable workflows pin ci-workflows 0.1.17
+(b4421b8660a7b6462095a9f492ea012b2a609abe). Previous artifact pins remain
+available for rollback.
+
 ## [0.0.71] - 2026-09-13
 
 nddev-builder guidance is refreshed against each harness's current native

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.71"
+version = "0.0.72"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.71" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.71" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.71" }
+setup-core = { path = "crates/setup-core", version = "0.0.72" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.72" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.72" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"

README.md

@@ -179,7 +179,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.71 \
+  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.72 \
   status --target /config/<dir> --json
 ```
 

crates/opencode-setup-system/src/software.rs

@@ -20,116 +20,116 @@ use harness_runtime::{Artifact, Delivery, Previous, Shape, Software};
 pub(crate) const ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.30.tgz",
-        bytes: 59_985_069,
-        sha256: "sha256:1e20b66e76afbb7c1e5cd9be7515d2744cb4ea3476ff57add1f7e9ad6fb3a32d",
+        url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.31.tgz",
+        bytes: 60_022_468,
+        sha256: "sha256:9f30fc9882c2782b7ce5714db5263993f6bcb310c8c590192baa7cfd9b7465d0",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.30.tgz",
-        bytes: 60_202_013,
-        sha256: "sha256:aa31a7e68ce5c73cba302c6a4f31c2e308398db125e49d3dbea32f61862fe6de",
+        url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.31.tgz",
+        bytes: 60_232_635,
+        sha256: "sha256:6d89da252a8b030d923e728396dc34465cf6095101b78222b0ee337b68140dea",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.30.tgz",
-        bytes: 45_975_576,
-        sha256: "sha256:25b722fcdc8c46aebcb6501e1156dc1dc5a392492cc278c65b7775311674e7f8",
+        url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.31.tgz",
+        bytes: 46_009_615,
+        sha256: "sha256:e1fa9a06765f0b3419b65f05ddfd457977c4ea07ab9c143192a4392fab57d671",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.30.tgz",
-        bytes: 48_153_052,
-        sha256: "sha256:d7119bd0adbacf86c1176f07b35d429909d1d702ca0c90dcd31415e66220f590",
+        url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.31.tgz",
+        bytes: 48_184_570,
+        sha256: "sha256:dfcf4aa1207f1f47a6ff6620fe19a07ac6b204e8c27786f337ac8b38344494ea",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.30.tgz",
-        bytes: 58_430_892,
-        sha256: "sha256:d26f3759e7c17754e1d6c72020853ffb153c7bb0f6b7d75efdc48466f482c4d4",
+        url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.31.tgz",
+        bytes: 58_462_934,
+        sha256: "sha256:bae1dec9b774176e4364da7abbbe96007c3ae5f09766217c9064bdb811848ec1",
         shape: Shape::GzipTar,
         member: "package/bin/opencode.exe",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.30.tgz",
-        bytes: 60_117_264,
-        sha256: "sha256:1a5cc50f529cf359fbb6d1a1750c6ae521799f463d00a0215e6eff579a08b036",
+        url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.31.tgz",
+        bytes: 60_152_538,
+        sha256: "sha256:8a300ee2b3210ccc6894ff27d21bdb0a60ee44107389c49b743b4caed10aa5cf",
         shape: Shape::GzipTar,
         member: "package/bin/opencode.exe",
     },
 ];
 
-/// The artifacts 1.18.29 was published as, kept so
+/// The artifacts 1.18.30 was published as, kept so
 /// `software_update` has a version to move from and `rollback` a tree to
 /// return to. Measured from bytes when it was the current pin.
 pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.29.tgz",
-        bytes: 59_952_206,
-        sha256: "sha256:bbc655accf8263d44e5c668ef865520239e58bef515057bf8ecc27d006a6f28a",
+        url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.30.tgz",
+        bytes: 59_985_069,
+        sha256: "sha256:1e20b66e76afbb7c1e5cd9be7515d2744cb4ea3476ff57add1f7e9ad6fb3a32d",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.29.tgz",
-        bytes: 60_170_392,
-        sha256: "sha256:a2df564ba242759e3ee27cbd356da786243a3d3fd911cf5aa2c417521aef3042",
+        url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.30.tgz",
+        bytes: 60_202_013,
+        sha256: "sha256:aa31a7e68ce5c73cba302c6a4f31c2e308398db125e49d3dbea32f61862fe6de",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.29.tgz",
-        bytes: 45_944_097,
-        sha256: "sha256:1fc08fee8b4984c1306c826b8c0e2c367fd9eeb4d4c3707469194e3fea047e72",
+        url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.30.tgz",
+        bytes: 45_975_576,
+        sha256: "sha256:25b722fcdc8c46aebcb6501e1156dc1dc5a392492cc278c65b7775311674e7f8",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.29.tgz",
-        bytes: 48_120_807,
-        sha256: "sha256:d9e2270b9040d7ce140df629773c68f15222c7a6c882f16921d36aa4c9200ae2",
+        url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.30.tgz",
+        bytes: 48_153_052,
+        sha256: "sha256:d7119bd0adbacf86c1176f07b35d429909d1d702ca0c90dcd31415e66220f590",
         shape: Shape::GzipTar,
         member: "package/bin/opencode",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.29.tgz",
-        bytes: 58_399_395,
-        sha256: "sha256:ad2f4a063a6d82578edc0b37078eff76fcb2a58f6439a33c34a50e1c795512b8",
+        url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.30.tgz",
+        bytes: 58_430_892,
+        sha256: "sha256:d26f3759e7c17754e1d6c72020853ffb153c7bb0f6b7d75efdc48466f482c4d4",
         shape: Shape::GzipTar,
         member: "package/bin/opencode.exe",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.29.tgz",
-        bytes: 60_086_309,
-        sha256: "sha256:19eca6cdead9c67cce26fdc2db165980318edb7318c8c964dfc2ebffe03bb472",
+        url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.30.tgz",
+        bytes: 60_117_264,
+        sha256: "sha256:1a5cc50f529cf359fbb6d1a1750c6ae521799f463d00a0215e6eff579a08b036",
         shape: Shape::GzipTar,
         member: "package/bin/opencode.exe",
     },
 ];
 
 /// Opencode's program, and where its bytes come from.
 pub(crate) const SOFTWARE: Software = Software {
-    version: "1.18.30",
+    version: "1.18.31",
     command: "opencode",
     delivery: Delivery::Artifacts(ARTIFACTS),
     unsupported: &[],
     previous: Some(Previous {
-        version: "1.18.29",
+        version: "1.18.30",
         artifacts: PREVIOUS_ARTIFACTS,
     }),
 };

install.ps1

@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.71",
+  [string]$Version = "0.0.72",
   [string]$InstallDir = "$env:LOCALAPPDATA\Programs\opencode-setup-system"
 )
 $ErrorActionPreference = "Stop"

install.sh

@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/opencode-setup-system"
 BINARY="opencode-setup-system"
-VERSION="${1:-0.0.71}"
+VERSION="${1:-0.0.72}"
 PREFIX="${OPENCODE_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in