[mfw78]

Why

nexum-runtime moved to Rust 1.96.0 and wasmtime 49.0.2 in nxm-rs/nexum-runtime#385 to clear nine wasmtime advisories and one rustls advisory, and videre followed in nxm-rs/videre#89. Shepherd pins both by rev and carries its own wasmtime lines, so it is the last of the three to move, and the shepherd binary is what actually ships.

What changed

• The ten nexum-runtime pins move from 2ed882f to 2085cd2, and the eight videre pins from 9ab1515 to 9a54866. Both are merge commits on the dependency's main. The lockfile holds one copy of each.
• The toolchain moves to 1.96: flake.nix pins 1.96.0, and the CI rust setup, the Dockerfile base image (rust:1.96-slim-bookworm) and AGENTS.md follow.
• wasmtime, wasmtime-wasi and wasmtime-wasi-http move to "49", written the way the runtime writes them, with default features. The lockfile resolves all three to 49.0.2.

WIT pins. wit/deps.toml named older revs than the crates did (fd16db7 and 66c8c3b) and carried all-zero digest placeholders, and wit/deps.lock still held monorepo-era path entries. Both now name the same revs as the crate manifests, with real tarball digests and a per-package prefix, and the lock is regenerated. The vendored wit/deps tree is byte-identical.

A wit-sync CI job, textually the same as videre's, re-resolves the pins with the pinned, digest-verified wit-deps 0.6.0 binary and fails if wit/ drifts.

The lockfile also takes rustls 0.23.45, chacha20 0.10.2 in place of the yanked 0.10.1, the fixed h2, ruint and crossbeam-epoch releases, and toml 1.1.8, which is the version the runtime and videre are tested on. The [patch.crates-io] cowprotocol entries are untouched.

What did not change

No source file. Shepherd has no WallClock use, no wasi:http hook or view implementation, and no direct wasmtime import, so the runtime's gate rewrite needs nothing here. The engine configs, the compose files and the module manifests are untouched.

Breaking

The minimum Rust version is 1.96.

Advisories

Under cargo-deny's defaults this clears the wasmtime, rustls, h2, ruint and crossbeam-epoch advisories, and no yanked crate remains. Three "unmaintained" notices are left, each with no compatible upgrade and the same three as in videre: instant through wstd, paste through alloy-primitives, and proc-macro-error2 through alloy-sol-macro 1.6.0. Clearing the third means moving the alloy-core family to 1.7 across all three repos. Shepherd still has no cargo-deny job of its own.

Verification

Run on Rust 1.96.0 with --locked: fmt, clippy at -D warnings, the cow-orderbook-only check, both guest wasms and cargo doc -D warnings pass. nextest with CI set after building the wasms: 243 run, 243 passed, no test skipped for a missing artefact. The one nextest skip is the #[ignore] fixture writer in the cow-venue conformance suite.

The anvil-fork end-to-end test returns early without SHEPHERD_FORK_RPC, so it did not run here and does not run in CI. No local docker build was run; the Docker job on this pull request is the first build on the new base image, whose tag was confirmed to exist.

wit-deps update is idempotent against the new pins and leaves wit/ with no diff.

Follow-ups

• just ci and AGENTS.md say the recipe mirrors ci.yml one to one. With wit-sync added that is no longer true; videre has a just wit-sync recipe to copy.
• The CI setup and the Dockerfile pin the floating 1.96; only the flake pins 1.96.0 exactly, as before with 1.94.

Closes #670.

AI Assistance: Claude Code used for the re-pin, the WIT pins, the CI job, the lockfile updates and this description.