wit: pin nexum:host to crate-local wit-deps

nexum/crates/nexum-runtime/src/bindings.rs

@@ -11,7 +11,8 @@
 //!
 //! `nexum:host` is a leaf package: the host `event` variant carries a
 //! status transition as opaque bytes, so the core world resolves against
-//! `wit/nexum-host` alone. An extension's bindgen remaps onto the shared
+//! `wit/nexum-host` alone; the group `wit/deps.toml` and its lock stay
+//! empty. An extension's bindgen remaps onto the shared
 //! interfaces here with `with`, so the `Host` impls and the `fault` type
 //! its components see are the very ones the core host constructs.
 //! `PartialEq` is derived so extension services can compare event payloads.

nexum/scripts/check-venue-agnostic.sh

@@ -5,7 +5,8 @@
 # charter symbol
 # (nexum:intent|value-flow|VenueAdapter|synthesize_venue|nexum:adapter|PoolRouter)
 # and no privileged router field; and nexum:host names no foreign WIT
-# package and resolves as a leaf. The opaque-status envelope
+# package, resolves as a leaf, and its wit-deps manifest and lock stay
+# empty. The opaque-status envelope
 # (intent-status-update, its venue id string) is ratified host surface,
 # not a leak. Blocking in CI; run locally via `just check-venue-agnostic`.
 
@@ -84,4 +85,19 @@ else
     printf '\033[1;33m[l1 WARN]\033[0m wasm-tools not found; WIT resolve skipped\n' >&2
 fi
 
+# 5. wit-deps manifest: crate-local resolution with an empty, locked
+#    dependency set; a declared dependency would unmake the leaf.
+for f in wit/deps.toml wit/deps.lock; do
+    if [[ ! -f $f ]]; then
+        fail "$f missing"
+        continue
+    fi
+    rg -n --no-heading -e '^\s*[^#[:space:]]' "$f"
+    case $? in
+        0) fail "$f declares a WIT dependency; nexum:host is a leaf" ;;
+        1) pass "$f empty" ;;
+        *) fail "manifest scan errored for $f" ;;
+    esac
+done
+
 exit "$status"

nexum/wit/deps.toml

@@ -0,0 +1 @@
+# nexum:host is a leaf package; this manifest stays empty.