Defect
mise.lock records whichever platforms someone happened to resolve; the release target list is declared separately; nothing joins them. edtf's v1.3.0 publish failed its x86_64-apple-darwin leg, build and repro, after the tag was minted:
mise ERROR Failed to install tools: aqua:rustwasm/wasm-pack@0.15.0, core:node@26.5.1
aqua:rustwasm/wasm-pack@0.15.0: No lockfile URL found for
aqua:rustwasm/wasm-pack@0.15.0 on platform macos-x64 (--locked mode)
The gate runs on linux and macos-arm64, so --locked is never asked to resolve macos-x64 before the release is the first thing that needs it. At the failing commit, wasm-pack and node carried linux-x64, linux-arm64 and macos-arm64 tables but not macos-x64 — partial coverage is why nothing looked wrong. Not repo-specific by construction. Re-verified 2026-08-24: no belt lint joins the two files.
Decided build
Decided in the original filing, unchanged:
A belt lint:* task that reads the repo's declared binary release targets (from the tracked publish stub's target declaration — read, never guessed; the one repo-specific input), maps each target triple to its mise platform key, and fails when the lockfile lacks a per-platform entry for that key on any tool that has per-platform tables at all. Tools with no platform tables (cargo:* backends, rust toolchains) are outside the check by construction — verified against release-lab, whose lock has none for those entries either. Deterministic and offline: two tracked files. Belongs in ci, not audit:*. Remedy in the message: the resolve command that populates the missing platform.
Applicability guard: skips clean where there is no publish stub declaring binary targets, or no mise.lock — a linter that cannot skip cannot be universal. Table tests per guard branch, planted both directions per #650.
Rejected, recorded: resolving the missing platform automatically in the lint (a lint that writes is a fixer, and the write is network-bound); running the gate on every release platform (buys the same answer at matrix cost).
Canon consequence
lint:* in the belt — every repo gets it at its pin bump with no repo change. A repo whose lock omits a declared release platform cannot reach a tag.
Done when
- the lint reds on edtf's pre-fix lock and greens on its current one — both measured against the real files, quoted
- green across canon, release-lab, stele and edtf at their current locks
- the guard branches are table-tested and planted both directions
- the remedy line names the exact resolve command
Sequencing
Independent of #813 and #811 (shared root — gate coverage narrower than the release path — different fixes; #811 changes WHICH asset a platform entry pins, this checks the entry EXISTS). No release-path change, no lab run. Shares mise/config.toml — own PR. Found by edtf v1.3.0, publish run 32521160714 (burned). Refs #650, #811, #813.
Defect
mise.lockrecords whichever platforms someone happened to resolve; the release target list is declared separately; nothing joins them. edtf's v1.3.0 publish failed itsx86_64-apple-darwinleg, build and repro, after the tag was minted:The gate runs on linux and macos-arm64, so
--lockedis never asked to resolvemacos-x64before the release is the first thing that needs it. At the failing commit,wasm-packandnodecarried linux-x64, linux-arm64 and macos-arm64 tables but not macos-x64 — partial coverage is why nothing looked wrong. Not repo-specific by construction. Re-verified 2026-08-24: no belt lint joins the two files.Decided build
Decided in the original filing, unchanged:
A belt
lint:*task that reads the repo's declared binary release targets (from the tracked publish stub's target declaration — read, never guessed; the one repo-specific input), maps each target triple to its mise platform key, and fails when the lockfile lacks a per-platform entry for that key on any tool that has per-platform tables at all. Tools with no platform tables (cargo:*backends,rusttoolchains) are outside the check by construction — verified against release-lab, whose lock has none for those entries either. Deterministic and offline: two tracked files. Belongs inci, notaudit:*. Remedy in the message: the resolve command that populates the missing platform.Applicability guard: skips clean where there is no publish stub declaring binary targets, or no
mise.lock— a linter that cannot skip cannot be universal. Table tests per guard branch, planted both directions per #650.Rejected, recorded: resolving the missing platform automatically in the lint (a lint that writes is a fixer, and the write is network-bound); running the gate on every release platform (buys the same answer at matrix cost).
Canon consequence
lint:*in the belt — every repo gets it at its pin bump with no repo change. A repo whose lock omits a declared release platform cannot reach a tag.Done when
Sequencing
Independent of #813 and #811 (shared root — gate coverage narrower than the release path — different fixes; #811 changes WHICH asset a platform entry pins, this checks the entry EXISTS). No release-path change, no lab run. Shares
mise/config.toml— own PR. Found by edtf v1.3.0, publish run 32521160714 (burned). Refs #650, #811, #813.