feat(varve): replace loom/meld/spar/synth/witness toolchains with varve

MODULE.bazel

@@ -11,7 +11,6 @@ module(
 # filegroup fix (#3727) that fix Windows LNK1181 errors — these previously
 # required a git_override pinned to commit 6281d27 (now an ancestor of 0.70.0).
 bazel_dep(name = "rules_rust", version = "0.70.0")
-
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "rules_cc", version = "0.2.17")
@@ -99,11 +98,11 @@ use_repo(
     wasi_wit_ext,
     # WASI 0.2.3 (default)
     "wasi_cli",
-    "wasi_p3",
     "wasi_clocks",
     "wasi_filesystem",
     "wasi_http",
     "wasi_io",
+    "wasi_p3",
     "wasi_random",
     "wasi_sockets",
     # WASI 0.2.0
@@ -251,57 +250,38 @@ use_repo(binaryen, "binaryen_toolchain")
 
 register_toolchains("@binaryen_toolchain//:binaryen_toolchain")
 
-# Meld toolchain for static WebAssembly component fusion
-meld = use_extension("//wasm:extensions.bzl", "meld")
-meld.register(
-    name = "meld",
-    version = "0.10.0",
-)
-use_repo(meld, "meld_toolchain")
-
-register_toolchains("@meld_toolchain//:meld_toolchain")
-
-# Loom toolchain for WebAssembly component optimization (native binary, v1.x).
-# wasm_optimize consumes this (loom_toolchain_type); the old @loom_wasm 0.3.0
-# component path was removed (#512).
-loom = use_extension("//wasm:extensions.bzl", "loom")
-loom.register(
-    name = "loom",
-    version = "1.1.14",
-)
-use_repo(loom, "loom_toolchain")
-
-register_toolchains("@loom_toolchain//:loom_toolchain")
-
-# spar toolchain: AADL architecture model -> WIT generation
-spar = use_extension("//wasm:extensions.bzl", "spar")
-spar.register(
-    name = "spar",
-    version = "0.10.0",
-)
-use_repo(spar, "spar_toolchain")
-
-register_toolchains("@spar_toolchain//:spar_toolchain")
-
-# witness toolchain: MC/DC branch coverage for WASM core modules
-witness = use_extension("//wasm:extensions.bzl", "witness")
-witness.register(
-    name = "witness",
-    version = "0.22.0",
+# loom/meld/spar/synth/witness toolchains, sourced from varve (the
+# PulseEngine toolchain layer manager) instead of this repo's own per-tool
+# GitHub-release download + checksums/tools/*.json trust-on-first-use pin.
+# One signed, counter-protected, dated layer (//:varve.toml) replaces five
+# separately hand-maintained registry entries. See //varve/README.md for the
+# trust model and //varve/toolchains:BUILD.bazel for the toolchain wiring.
+#
+# wsc (signing toolchain) stays on its existing path deliberately — a
+# signing-path trust-source change needs its own explicit review, not a
+# bundled one. rivet has no existing rules_wasm_component toolchain to
+# migrate.
+varve = use_extension("//varve:varve.bzl", "varve")
+varve.configure(
+    pin = "//:varve.toml",
+    tools = [
+        "loom",
+        "meld",
+        "spar",
+        "synth",
+        "witness",
+    ],
+    trust_root = "//:rolling.pub",
 )
-use_repo(witness, "witness_toolchain")
-
-register_toolchains("@witness_toolchain//:witness_toolchain")
+use_repo(varve, "varve_tools")
 
-# synth toolchain: WebAssembly-to-ARM ahead-of-time compiler
-synth = use_extension("//wasm:extensions.bzl", "synth")
-synth.register(
-    name = "synth",
-    version = "0.6.0",
+register_toolchains(
+    "//varve/toolchains:loom_toolchain",
+    "//varve/toolchains:meld_toolchain",
+    "//varve/toolchains:spar_toolchain",
+    "//varve/toolchains:synth_toolchain",
+    "//varve/toolchains:witness_toolchain",
 )
-use_repo(synth, "synth_toolchain")
-
-register_toolchains("@synth_toolchain//:synth_toolchain")
 
 # MoonBit hermetic toolchain for WebAssembly component builds (dev only)
 # NOTE: Not eagerly loaded - MoonBit uses rolling /latest/ URLs that cause
@@ -343,7 +323,7 @@ wasm_component_download(
     version = "0.7.0",
 )
 
-# LOOM: consumed via the native loom toolchain (@loom_toolchain, above).
+# LOOM: consumed via the native loom toolchain, sourced from varve (above).
 # The old @loom_wasm 0.3.0 component download was removed — loom v1.x is
 # native-only and wasm_optimize now runs the native binary directly (#512).
 

examples/varve_extension/varve.toml

@@ -2,4 +2,4 @@ manifest-version = 1
 
 [toolchain]
 channel = "rolling"
-layer   = "2026.09.0"
+layer   = "2026.09.1"

rolling.pub

@@ -0,0 +1 @@
+4e771dc62a08be89e3450f8cd807da58ff70af4a4e124ebf2d2b71684cfd9973

varve.toml

@@ -0,0 +1,15 @@
+# This is THE pin: what the loom/meld/spar/synth/witness toolchains resolve
+# to (see //varve/toolchains:BUILD.bazel), and — for a developer using varve's
+# own shims outside Bazel — what their terminal resolves to too. One file,
+# both worlds.
+#
+# To move to a newer layer: check what's actually published first
+# (`crane ls ghcr.io/pulseengine/varve/layers` or the GHCR package page),
+# bump `layer` below, and send it through review like any other change —
+# varve deliberately has no auto-update. Bumping this alone is the override;
+# nothing else needs to change.
+manifest-version = 1
+
+[toolchain]
+channel = "rolling"
+layer   = "2026.09.1"

varve/toolchains/BUILD.bazel

@@ -0,0 +1,92 @@
+# Copyright 2026 Ralf Anton Beier. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Registers loom/meld/spar/synth/witness toolchains sourced from
+@varve_tools (the varve module extension) instead of this repo's own
+per-tool GitHub-release download (toolchains/{loom,meld,spar,synth,
+witness}_toolchain.bzl's repository rules, backed by checksums/tools/*.json).
+
+Each `<tool>_toolchain` rule (loaded from its existing definition — this file
+adds no new rule types) is generic: it takes a `<tool>` file-label attr and
+wraps it in the existing ToolchainInfo. The only thing that changes is where
+that file comes from: `@varve_tools//:<tool>`, resolved and
+signature-verified by varve against the trust root in //:rolling.pub, rather
+than a checksum_updater-tracked, trust-on-first-use GitHub release asset.
+
+`wsc` (the signing toolchain) and `rivet` are deliberately NOT here: wsc sits
+on the signing path and needs its own explicit review before its trust source
+changes; rivet has no existing rules_wasm_component toolchain to replace.
+"""
+
+load("@rules_wasm_component//toolchains:loom_toolchain.bzl", "loom_toolchain")
+load("@rules_wasm_component//toolchains:meld_toolchain.bzl", "meld_toolchain")
+load("@rules_wasm_component//toolchains:spar_toolchain.bzl", "spar_toolchain")
+load("@rules_wasm_component//toolchains:synth_toolchain.bzl", "synth_toolchain")
+load("@rules_wasm_component//toolchains:witness_toolchain.bzl", "witness_toolchain")
+
+package(default_visibility = ["//visibility:public"])
+
+loom_toolchain(
+    name = "loom_toolchain_impl",
+    loom = "@varve_tools//:loom",
+)
+
+toolchain(
+    name = "loom_toolchain",
+    exec_compatible_with = [],
+    target_compatible_with = [],
+    toolchain = ":loom_toolchain_impl",
+    toolchain_type = "@rules_wasm_component//toolchains:loom_toolchain_type",
+)
+
+meld_toolchain(
+    name = "meld_toolchain_impl",
+    meld = "@varve_tools//:meld",
+)
+
+toolchain(
+    name = "meld_toolchain",
+    exec_compatible_with = [],
+    target_compatible_with = [],
+    toolchain = ":meld_toolchain_impl",
+    toolchain_type = "@rules_wasm_component//toolchains:meld_toolchain_type",
+)
+
+spar_toolchain(
+    name = "spar_toolchain_impl",
+    spar = "@varve_tools//:spar",
+)
+
+toolchain(
+    name = "spar_toolchain",
+    exec_compatible_with = [],
+    target_compatible_with = [],
+    toolchain = ":spar_toolchain_impl",
+    toolchain_type = "@rules_wasm_component//toolchains:spar_toolchain_type",
+)
+
+synth_toolchain(
+    name = "synth_toolchain_impl",
+    synth = "@varve_tools//:synth",
+)
+
+toolchain(
+    name = "synth_toolchain",
+    exec_compatible_with = [],
+    target_compatible_with = [],
+    toolchain = ":synth_toolchain_impl",
+    toolchain_type = "@rules_wasm_component//toolchains:synth_toolchain_type",
+)
+
+witness_toolchain(
+    name = "witness_toolchain_impl",
+    witness = "@varve_tools//:witness",
+)
+
+toolchain(
+    name = "witness_toolchain",
+    exec_compatible_with = [],
+    target_compatible_with = [],
+    toolchain = ":witness_toolchain_impl",
+    toolchain_type = "@rules_wasm_component//toolchains:witness_toolchain_type",
+)