varve: the pulseengine rolling root rotated and the registry moved — pin and realms file must move together

[avrabe]

Two things changed in the pulseengine realm, and this repository has both old values.

What you have now

# varve-realms.toml
registry   = "oci://ghcr.io/pulseengine/varve/layers"
trust-root = "4e771dc62a08be89e3450f8cd807da58ff70af4a4e124ebf2d2b71684cfd9973"

# varve.toml
layer   = "2026.08.2"

What it becomes

# varve-realms.toml
registry   = "oci://ghcr.io/pulseengine/layers"
trust-root = "7d3b892e6a33c70043becc708e08042e1cef0d54dd5ae6f23d7d4c68de1da1a0"

# varve.toml
layer   = "2026.09.2"

Take the realms file from the release rather than pasting it:

gh release download v0.33.0 --repo pulseengine/varve -p varve-realms.toml

2026.08.2 is the oldest pin of any consumer, so this is the largest jump — worth running varve inspect after installing to see what moved. Note that the layer carries synth 0.61.0, so if this repository's own release is newer than that, the layer is behind you and the next deposit should bump it.

Why the root changed

It existed only as a write-only GitHub Actions secret — unreadable by anyone, including the org owner — so it could never be backed up, moved, or given to a second repository. It was rotated rather than recovered, which varve-realms.toml always said was coming: the rolling root is provisional until the v1.0 ceremony. varve#110.

Every layer from 2026.08.0 to 2026.09.1 — including your 2026.08.2 — was signed by the retired root and does not verify against the new one.

Why the registry changed

The layers lived in a package owned by the varve repository while they are produced by pulseengine-layers, so publishing needed a cross-repo grant that no automation could obtain. Moving to ghcr.io/pulseengine/layers makes the permission stop existing rather than be granted.

Both files, one commit

varve-realms.toml and varve.toml must change together. Either alone leaves you broken:

• new realms file, old pin → your pinned layer was signed by the retired root, and you get No valid signatures
• new pin, old realms file → the old registry has no 2026.09.2, and the old root would not verify it anyway

Nothing is urgent

Your current setup keeps working untouched. The old realm — old root, old registry — is fully disjoint from the new one and still serves every layer it served yesterday. Nothing was deleted. The old realm is frozen, not broken.

Worth knowing if you upgrade varve too

varve v0.33.0 makes a retired root explain itself: if you do hit the rotation, it tells you which root signed your layer, when it was retired, and what to do — instead of No valid signatures, which is indistinguishable from a forgery.

Happy to open the PR if you would rather review than write it.

🤖 Generated with Claude Code

https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu