.github/workflows/conformance.yml

@@ -17,7 +17,7 @@ on:
 jobs:
   validate-json:
     name: Validate conformance JSON files
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -86,7 +86,7 @@ jobs:
 
   spec-vector-coupling:
     name: Spec changes require vector-pack updates
-    runs-on: ubuntu-latest
+    runs-on: linux
     if: github.event_name == 'pull_request'
     steps:
       - name: Checkout (with full history for diff)
@@ -132,7 +132,7 @@ jobs:
 
   versions-present:
     name: VERSIONS.md and README.md must exist
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/joule-code-conformance.yml

@@ -20,7 +20,7 @@ on:
 jobs:
   conformance:
     name: Build + round-trip C1-C4 vectors
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/jouleclaw-public-surface-documented.yml

@@ -28,7 +28,7 @@ on:
 jobs:
   scan:
     name: Public-surface audit (jouleclaw-rs)
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/no-vanity-metrics.yml

@@ -24,7 +24,7 @@ on:
 jobs:
   scan:
     name: Scan committed Markdown for vanity metrics
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/wai-byte-equality.yml

@@ -35,12 +35,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Self-hosted fleet labels, not GitHub-hosted images. macos-x86_64 is
+        # dropped: no Intel-Mac runner exists in the fleet, and by the same
+        # argument the cargo-classes matrix already makes, it adds no arch
+        # coverage — x86_64 is held by linux-x86_64 and windows-x86_64, arm64
+        # by linux-aarch64 and the macos-arm64 reference.
         include:
-          - { os: ubuntu-latest,    label: linux-x86_64 }
+          - { os: linux,       label: linux-x86_64 }
-          - { os: ubuntu-24.04-arm, label: linux-aarch64 }
+          - { os: linux-arm64, label: linux-aarch64 }
-          - { os: macos-latest,     label: macos-arm64 (reference) }
+          - { os: macos,       label: macos-arm64 (reference) }
-          - { os: macos-13,         label: macos-x86_64 }
+          - { os: windows,     label: windows-x86_64 }
-          - { os: windows-latest,   label: windows-x86_64 }
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/wai-conformance.yml

@@ -37,14 +37,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Both architectures across all three OS families. x86_64 is covered
+        # Self-hosted fleet labels. Both architectures across all three OS
-        # by ubuntu-latest + windows-latest, arm64 by ubuntu-24.04-arm +
+        # families: x86_64 by linux + windows, arm64 by linux-arm64 + macos —
-        # macos-latest — what matters for the Fx integer floor is the arch,
+        # what matters for the Fx integer floor is the arch, not the OS. No
-        # not the OS. The deprecated Intel-Mac runner (macos-13) is omitted:
+        # Intel-Mac runner exists in the fleet, and it would add no arch
-        # it adds no arch coverage and its hosted runners are scarce.
+        # coverage anyway.
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [linux, linux-arm64, macos, windows]
     steps:
       - uses: actions/checkout@v5
+      # The self-hosted macOS runner is a `host` executor started from launchd,
+      # whose PATH does not include ~/.cargo/bin — rustup is installed but not
+      # findable. Harmless everywhere else (a non-existent dir on PATH is a
+      # no-op), so it is applied unconditionally rather than branched on OS.
+      - name: Put cargo on PATH
+        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Rust 1.97.1
         run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
       - name: Build the cargo classes (pure Rust, no C codec chain)
@@ -81,14 +87,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Both architectures across all three OS families. x86_64 is covered
+        # Self-hosted fleet labels. Both architectures across all three OS
-        # by ubuntu-latest + windows-latest, arm64 by ubuntu-24.04-arm +
+        # families: x86_64 by linux + windows, arm64 by linux-arm64 + macos —
-        # macos-latest — what matters for the Fx integer floor is the arch,
+        # what matters for the Fx integer floor is the arch, not the OS. No
-        # not the OS. The deprecated Intel-Mac runner (macos-13) is omitted:
+        # Intel-Mac runner exists in the fleet, and it would add no arch
-        # it adds no arch coverage and its hosted runners are scarce.
+        # coverage anyway.
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [linux, linux-arm64, macos, windows]
     steps:
       - uses: actions/checkout@v5
+      # The self-hosted macOS runner is a `host` executor started from launchd,
+      # whose PATH does not include ~/.cargo/bin — rustup is installed but not
+      # findable. Harmless everywhere else (a non-existent dir on PATH is a
+      # no-op), so it is applied unconditionally rather than branched on OS.
+      - name: Put cargo on PATH
+        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Rust 1.97.1
         run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
       - name: Integer rANS + int_synth + JPEG-AI mANS goldens (one machine → every machine)

.github/workflows/wai-neural-e2e.yml

@@ -29,7 +29,7 @@ on:
 jobs:
   neural-e2e:
     name: synthetic fixtures → Rust decode → reference (±4)
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-python@v5

aac/aac-rs/Cargo.toml

@@ -12,7 +12,7 @@ version      = "0.1.0"
 edition      = "2024"
 license      = "Apache-2.0"
 repository   = "https://github.com/transaction-science/open-standards"
-rust-version = "1.96"
+rust-version = "1.97"
 authors      = ["Transaction Science <[email protected]>"]
 
 [workspace.dependencies]

arl/arl-rs/Cargo.toml

@@ -10,7 +10,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["ARL Contributors"]

eoc/eoc-bench/Cargo.toml

@@ -10,7 +10,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["EOC Benchmark Contributors"]

eoc/eoc-rs/Cargo.toml

@@ -33,7 +33,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["EOC Contributors"]

jcp/jcp-rs/Cargo.toml

@@ -29,7 +29,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 jcp-schema = { path = "crates/jcp-schema" }

jcp/jcp-rs/crates/jcp-efficiency/MAPPING.md

@@ -170,7 +170,7 @@ verifier-supplied parameter — is now **shipped** as `sandbox-tee::chain`
 (`derive_grounding` + `verify_attested_energy_rooted`): grounding is proven from
 evidence or it is software, and with a physical counter the ladder now *reaches*
 `PhysicallyRooted` (tested against a synthetic root). AMD's ARK→ASK→VCEK is one
-instance of exactly this chain, and the AMD-specific X.509 adapter is now also
+instance of exactly this chain, and the AMD-specific X.509 adapter is now also <!-- allow-vanity: X.509 is the ITU-T certificate standard's name, not a count of adapters -->
 **shipped** as `sandbox-tee::amd_kds` (the off-by-default `amd-kds` feature):
 `verify_kds_chain` parses the real ARK/ASK/VCEK X.509 certs, verifies the
 RSA-4096 **RSASSA-PSS/SHA-384** signatures ASK←ARK and VCEK←ASK against a
@@ -196,7 +196,7 @@ confidential compute (custom hardware).
 - End-to-end composition — **shipped** as `sandbox-tee/examples/attested_efficiency.rs`.
 - Evidence-derived grounding — **shipped** in `sandbox-tee::chain` (grounding from a
   signature chain to a trusted root, not asserted; `PhysicallyRooted` reachable + tested).
-- AMD KDS X.509 adapter — **shipped** in `sandbox-tee::amd_kds` (`amd-kds` feature):
+- AMD KDS X.509 adapter — **shipped** in `sandbox-tee::amd_kds` (`amd-kds` feature): <!-- allow-vanity: X.509 is the ITU-T certificate standard's name, not a count of adapters -->
   real ARK/ASK/VCEK parsing + RSA-4096 PSS-SHA384 chain verification to a pinned ARK.
 - Remaining (**not code**): pinning AMD's published ARK (a deploy artifact) and a
   signing physical shunt co-located with confidential compute (hardware).

joule-code/examples/l3-jouleclaw/Cargo.toml

@@ -7,7 +7,7 @@
 name = "l3-jouleclaw-binding"
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 description = "Example binding: JouleClaw's L3 model tier (jouleclaw-llm LlmBackend) as a Joule Code cascade FnStage. Verified model-free via EchoBackend; a real backend (vLLM, or jouleclaw-runtime GGUF) drops into the same slot."
 publish = false

joule-code/examples/transport-moqt/Cargo.toml

@@ -8,7 +8,7 @@
 name = "transport-moqt-binding"
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 publish = false
 

joule-code/joule-code-rs/Cargo.toml

@@ -25,7 +25,7 @@ version = "0.2.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 joule-code-schema = { path = "crates/joule-code-schema" }

joule-code/joule-code-rs/crates/joule-moq/Cargo.toml

@@ -3,7 +3,7 @@ name        = "joule-moq"
 version     = "0.1.0"
 description = "MoQT (Media over QUIC Transport) wire protocol + JWP receipt extension for CommunicationOS broadcast media. Trait surface lets the Realtime stack publish, subscribe, and relay tracks with object-level signed provenance and joule receipts."
 edition      = "2024"
-rust-version = "1.85"
+rust-version = "1.97"
 license      = "Apache-2.0"
 repository   = "https://github.com/transaction-science/open-standards"
 

joule-code/joule-code-rs/crates/jwp/Cargo.toml

@@ -3,7 +3,7 @@ name        = "jwp"
 version     = "0.1.0"
 description = "Joule Wire Protocol (JWP) — energy-aware binary framing protocol"
 edition      = "2024"
-rust-version = "1.85"
+rust-version = "1.97"
 license      = "Apache-2.0"
 repository   = "https://github.com/transaction-science/open-standards"
 

joule-ui/joule-ui-rs/Cargo.toml

@@ -13,7 +13,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["joule-ui Contributors"]

jouleclaw/jouleclaw-rs/Cargo.toml

@@ -1153,7 +1153,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["JouleClaw Contributors"]

joulecontract/joulecontract-rs/Cargo.toml

@@ -15,7 +15,7 @@ version = "0.6.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 joulecontract-schema = { path = "crates/joulecontract-schema" }

jouledesk/README.md

@@ -28,7 +28,7 @@ the [Transaction Science open standards](../README.md).
   workspace `jouledesk-rs/` ships the **teammate loop** (`Teammate` + `Skill` over
   `jcp-orchestrate` + `jcp-efficiency`): grant a skill → tag it → authorise outside the
   model → seal to a per-receipt-verifiable ledger, with **`efficiency/1` energy
-  accounting** (`energy_summary` → joules per completed unit, charging waste). 8 tests.
+  accounting** (`energy_summary` → joules per completed unit, charging waste).
 
 ## What Joule Desk adds over a closed teammate
 

jouledesk/jouledesk-rs/Cargo.toml

@@ -7,7 +7,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
-rust-version = "1.96.0"
+rust-version = "1.97"
 
 [patch.crates-io]
 # Work around the upstream livekit release skew: libwebrtc 0.3.38 omits the

joulehook/joulehook-rs/Cargo.toml

@@ -7,4 +7,4 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
-rust-version = "1.96.0"
+rust-version = "1.97"

map/map-rs/Cargo.toml

@@ -19,7 +19,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 map-schema = { path = "crates/map-schema" }

mesh/mesh-rs/Cargo.toml

@@ -17,7 +17,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 # Mesh crates

openpay/Cargo.toml

@@ -53,7 +53,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["OpenPay Contributors"]

proof/proof-rs/Cargo.toml

@@ -14,7 +14,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 proof-schema = { path = "crates/proof-schema" }

sandbox/sandbox-rs/Cargo.toml

@@ -23,7 +23,7 @@ version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.85"
+rust-version = "1.97"
 
 [workspace.dependencies]
 sandbox-schema = { path = "crates/sandbox-schema" }

sense/sense-rs/Cargo.toml

@@ -15,7 +15,7 @@ version = "0.1.0"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/transaction-science/open-standards"
-rust-version = "1.96"
+rust-version = "1.97"
 
 [workspace.dependencies]
 sense-schema = { path = "crates/sense-schema" }

smart-byte/smart-byte-rs/Cargo.toml

@@ -28,7 +28,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 repository = "https://github.com/Transaction-Science/open-standards"
 authors = ["Smart Byte Contributors"]

wai/byte-exact-conformance/Cargo.toml

@@ -9,7 +9,7 @@
 name = "wai-byte-exact-conformance"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 publish = false
 

wai/wai-relay/Cargo.toml

@@ -2,7 +2,7 @@
 name = "wai-world-relay"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 description = "Reference relay for wai.world.live sessions. Transport is OUT of the interactive-worlds extension's scope — this is one honest carrier: a per-room WebSocket fan-out that retains the signed op log for late joiners and verifies every op's Ed25519 signature before forwarding. It adjudicates nothing: sinks converge because the math does."
 

wai/wai-rs/Cargo.toml

@@ -2,7 +2,7 @@
 name = "wai"
 version = "0.3.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 description = "WAI — Web AI media transport + execution. Capability-as-requirement envelope + neural shared-prior regenerate-at-sink path + always-available zeroth-condition wrappers around SOTA standard codecs (AVIF / JPEG-XL / PNG / Opus / FLAC / AV1 / zstd / LZMA)."
 

wai/wai-spz-gen/Cargo.toml

@@ -2,7 +2,7 @@
 name = "wai-spz-gen"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.96"
+rust-version = "1.97"
 license = "Apache-2.0"
 description = "Produces a real Niantic-SPZ Gaussian-splat asset, wrapped as a content-addressed wai.splat.spz WAI object. Uses the field's SPZ library as the codec (sink-supplied, per WAI doctrine) and validates the file round-trips through it."