From 6b8dfa9c772be84c21366fb73341be56d8d2ca2b Mon Sep 17 00:00:00 2001
From: mfw78 <mfw78@nxm.rs>
Date: Sat, 18 Jul 2026 04:55:25 +0000
Subject: [PATCH] packaging: pin nexum:host WIT resolution group-local with an
 empty wit-deps manifest

The runtime bindgen and every L1 fixture module already resolve
wit/nexum-host inside the nexum group; check in an empty wit/deps.toml
plus its lock to pin the leaf, and teach the zero-leak gate to fail if
either ever declares a dependency.
---
 nexum/crates/nexum-runtime/src/bindings.rs |  3 ++-
 nexum/scripts/check-venue-agnostic.sh      | 18 +++++++++++++++++-
 nexum/wit/deps.lock                        |  0
 nexum/wit/deps.toml                        |  1 +
 4 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 nexum/wit/deps.lock
 create mode 100644 nexum/wit/deps.toml

diff --git a/nexum/crates/nexum-runtime/src/bindings.rs b/nexum/crates/nexum-runtime/src/bindings.rs
index 46fb2424..b3debecb 100644
--- a/nexum/crates/nexum-runtime/src/bindings.rs
+++ b/nexum/crates/nexum-runtime/src/bindings.rs
@@ -11,7 +11,8 @@
 //!
 //! `nexum:host` is a leaf package: the host `event` variant carries a
 //! status transition as opaque bytes, so the core world resolves against
-//! `wit/nexum-host` alone. An extension's bindgen remaps onto the shared
+//! `wit/nexum-host` alone; the group `wit/deps.toml` and its lock stay
+//! empty. An extension's bindgen remaps onto the shared
 //! interfaces here with `with`, so the `Host` impls and the `fault` type
 //! its components see are the very ones the core host constructs.
 //! `PartialEq` is derived so extension services can compare event payloads.
diff --git a/nexum/scripts/check-venue-agnostic.sh b/nexum/scripts/check-venue-agnostic.sh
index 407006c9..d7658e44 100755
--- a/nexum/scripts/check-venue-agnostic.sh
+++ b/nexum/scripts/check-venue-agnostic.sh
@@ -5,7 +5,8 @@
 # charter symbol
 # (nexum:intent|value-flow|VenueAdapter|synthesize_venue|nexum:adapter|PoolRouter)
 # and no privileged router field; and nexum:host names no foreign WIT
-# package and resolves as a leaf. The opaque-status envelope
+# package, resolves as a leaf, and its wit-deps manifest and lock stay
+# empty. The opaque-status envelope
 # (intent-status-update, its venue id string) is ratified host surface,
 # not a leak. Blocking in CI; run locally via `just check-venue-agnostic`.
 
@@ -84,4 +85,19 @@ else
     printf '\033[1;33m[l1 WARN]\033[0m wasm-tools not found; WIT resolve skipped\n' >&2
 fi
 
+# 5. wit-deps manifest: crate-local resolution with an empty, locked
+#    dependency set; a declared dependency would unmake the leaf.
+for f in wit/deps.toml wit/deps.lock; do
+    if [[ ! -f $f ]]; then
+        fail "$f missing"
+        continue
+    fi
+    rg -n --no-heading -e '^\s*[^#[:space:]]' "$f"
+    case $? in
+        0) fail "$f declares a WIT dependency; nexum:host is a leaf" ;;
+        1) pass "$f empty" ;;
+        *) fail "manifest scan errored for $f" ;;
+    esac
+done
+
 exit "$status"
diff --git a/nexum/wit/deps.lock b/nexum/wit/deps.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/nexum/wit/deps.toml b/nexum/wit/deps.toml
new file mode 100644
index 00000000..e313c703
--- /dev/null
+++ b/nexum/wit/deps.toml
@@ -0,0 +1 @@
+# nexum:host is a leaf package; this manifest stays empty.