chore(deps): bump scry-sai-core from 3.2.4 to 3.2.7

[dependabot]

Bumps scry-sai-core from 3.2.4 to 3.2.7.

Release notes

Sourced from scry-sai-core's releases.

v3.2.7

Two fixes. Both were found by looking at what the project actually did rather than at what it claimed, and one was found by running the artifact shipped minutes earlier.

Fixed — the shipped artifact now tells the truth about itself

• The shipped component announced scry 0.0.0 (#152, FEAT-083). Found by running the SHIPPED v3.2.6 artifact minutes after cutting it — not 3.2.6, and not the 3.2.4 that #133 had been about.

  The mechanism is worth recording because the previous fix caused it. FEAT-076 replaced a hand-maintained literal with env!("CARGO_PKG_VERSION"), which is correct under cargo. The shipped component is built by Bazel, and rules_rust populates CARGO_PKG_VERSION from the target's version attribute — which was absent, so it defaulted to 0.0.0. A fix that is right for one build system and silently wrong for the one that ships.

  Fixed in three layers, because the source-level assertion had become tautological (SCRY_VERSION == env!("CARGO_PKG_VERSION") where the constant IS that env): the Bazel target now carries version, claims.yaml pins the literal, and CI byte-checks the built artifact with grep -qaF — the -a matters, since without it the check passed on both the fixed and the broken wasm.

Fixed — CI

• Clippy ran on 4 of 12 crates (#157, FEAT-086), the same defect as #141's Test job one gate over. Two live clippy errors existed on main that the job could not see. Both gates are now widened, and the coverage guard checks both rather than one.

  The guard's first version scraped the workflow with awk ranges that chained across the whole file, so its two lists came out identical — it could not detect the drift it existed for, and printed FIRES under mutation with the wrong attribution. Replaced with a YAML-parsing checker shipping a --self-test that CI runs BEFORE the real check.

  Recorded plainly: the implementation merged as PR #159 titled "FEAT-086 (#157)" while no such artifact existed. It was filed after the fact (#160). rivet validate cannot catch that — it validates artifacts that exist, not references to ones that do not. That gap is what #161's commit traceability now closes.

v3.2.6

Five fixes, three of which were things quietly WRONG rather than missing. All five were found by inspecting what the project actually did — running the released artifact, reading CI logs, re-measuring a claim — not by the fixture

... (truncated)

Changelog

Sourced from scry-sai-core's changelog.

[3.2.7] — 2026-08-27

Two fixes. Both were found by looking at what the project actually did rather than at what it claimed, and one was found by running the artifact shipped minutes earlier.

Fixed — the shipped artifact now tells the truth about itself

• The shipped component announced scry 0.0.0 (#152, FEAT-083). Found by running the SHIPPED v3.2.6 artifact minutes after cutting it — not 3.2.6, and not the 3.2.4 that #133 had been about.

  The mechanism is worth recording because the previous fix caused it. FEAT-076 replaced a hand-maintained literal with env!("CARGO_PKG_VERSION"), which is correct under cargo. The shipped component is built by Bazel, and rules_rust populates CARGO_PKG_VERSION from the target's version attribute — which was absent, so it defaulted to 0.0.0. A fix that is right for one build system and silently wrong for the one that ships.

  Fixed in three layers, because the source-level assertion had become tautological (SCRY_VERSION == env!("CARGO_PKG_VERSION") where the constant IS that env): the Bazel target now carries version, claims.yaml pins the literal, and CI byte-checks the built artifact with grep -qaF — the -a matters, since without it the check passed on both the fixed and the broken wasm.

Fixed — CI

• Clippy ran on 4 of 12 crates (#157, FEAT-086), the same defect as #141's Test job one gate over. Two live clippy errors existed on main that the job could not see. Both gates are now widened, and the coverage guard checks both rather than one.

  The guard's first version scraped the workflow with awk ranges that chained across the whole file, so its two lists came out identical — it could not detect the drift it existed for, and printed FIRES under mutation with the wrong attribution. Replaced with a YAML-parsing checker shipping a --self-test that CI runs BEFORE the real check.

  Recorded plainly: the implementation merged as PR #159 titled "FEAT-086 (#157)" while no such artifact existed. It was filed after the fact (#160). rivet validate cannot catch that — it validates artifacts that exist, not references to ones that do not. That gap is what #161's commit traceability now closes.

[3.2.6] — 2026-08-26

Five fixes, three of which were things quietly WRONG rather than missing. All five were found by inspecting what the project actually did — running the

... (truncated)

Commits

• 61206b9 release: v3.2.7 — bump workspace + inter-crate pins, CHANGELOG, README (#178)
• 4a9510b FEAT-065: correct a falsified AC and redesign the verdict set before coding (...
• 1676d9c Promote FEAT-071 / 091 / 092 / 093 to accepted — v3.3.0 6→5, v3.4.0 7→4 (#176)
• 02f6c99 FEAT-093 refinement: close the window where main goes red (scry#130) (#175)
• 09b2c11 FEAT-071 (REQ-021): scry's scope as DATA, from one source (#174)
• ccbb144 Promote FEAT-087 / FEAT-088 / FEAT-090 to accepted — v3.4.0 not-ready 7 -> 4 ...
• 0749953 FEAT-092 (scry#126): one operator, one name (#172)
• 8b53ec2 Sync required-checks.txt to the ruleset: 10 → 12 (scry#130) (#170)
• b877f45 Release machinery: commit traceability (FEAT-091, #161) + required-check drif...
• 9ea0166 FEAT-090: the delta view carries the identity bit, so a vanish that isn't evi...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)