fix(deps): prevent stale vcpkg

.github/dependabot.yml

@@ -31,6 +31,9 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+      # vcpkg updates are atomic baseline snapshots; do not delay them.
+      exclude:
+        - "*"
     open-pull-requests-limit: 10
     groups:
       dependencies:

Justfile

@@ -277,6 +277,7 @@ python-entrypoint-test: _sync-python-dev
     uv run --no-sync cdt-optimize-initialize --help >/dev/null
     uv run --no-sync cdt-mnist-experiment --help >/dev/null
     uv run --no-sync cdt-tag-release --help >/dev/null
+    uv run --no-sync python scripts/sync_vcpkg_tool_pins.py --help >/dev/null
 
 # Synchronize the lightweight Python development environment from the lockfile.
 [group('workflows')]
@@ -306,6 +307,11 @@ update-actions:
     just _action-lint
     just _zizmor
 
+# Synchronize the trusted vcpkg tool release and Windows hashes with the manifest baseline.
+[group('workflows')]
+sync-vcpkg-tool-pins: _sync-python-dev
+    uv run --no-sync python scripts/sync_vcpkg_tool_pins.py
+
 [default]
 [private]
 default:

README.md

@@ -298,6 +298,7 @@ just release-check         # Validate release metadata and citation fields
 just changelog-unreleased vX.Y.Z # Generate a pending release changelog
 just tag-check vX.Y.Z      # Preview and validate an annotated release tag
 just update-actions        # Update and repin Actions with pinact, then validate
+just sync-vcpkg-tool-pins  # Sync the vcpkg tool release and Windows hashes
 just python-sync           # Install the locked Python development environment
 just python-check          # Check Python formatting, lint, and types
 just python-fix            # Apply safe Ruff fixes and formatting
@@ -344,21 +345,28 @@ actionlint uses its pinned upstream version, and zizmor uses its pinned PyPI whe
 The native build entry points delegate checkout provenance, baseline, and executable-integrity validation directly
 to `scripts/bootstrap_vcpkg.py`, whose cross-platform fixtures run under `just check`.
 
-To update dependencies intentionally, bootstrap the current checkout, run the vcpkg baseline updater, review the
-manifest diff, and then rerun the complete build:
+To update dependencies intentionally, bootstrap the current checkout, run the vcpkg baseline updater, synchronize
+the independently reviewed tool pins, review both diffs, and then rerun the complete build:
 
 ```bash
 python3 scripts/bootstrap_vcpkg.py
 export VCPKG_ROOT="$PWD/.cache/vcpkg"
 "$VCPKG_ROOT/vcpkg" x-update-baseline
+just sync-vcpkg-tool-pins
 ./scripts/build.sh
 ```
 
-On Windows, invoke the same implementation with `python.exe scripts\bootstrap_vcpkg.py`; `scripts\build.bat` and
-`scripts\fast-build.bat` already do this directly.
+`just sync-vcpkg-tool-pins` reads the new manifest baseline, fetches that exact upstream commit's tool metadata,
+downloads the official Windows amd64 and arm64 release assets, and atomically updates the release and SHA-256 pins in
+`scripts/bootstrap_vcpkg.py`. It leaves the existing pins unchanged if any input cannot be fetched or validated, and
+only writes when the rendered release and hash assignments differ from the bootstrap source.
+
+On Windows, invoke the synchronizer with `python.exe scripts\sync_vcpkg_tool_pins.py`; `scripts\build.bat` and
+`scripts\fast-build.bat` already invoke the bootstrap implementation directly.
 
 CI uses `lukka/run-vcpkg`, which derives the vcpkg checkout commit from the same manifest baseline and supplies a
-binary cache. No separately maintained repository variable is required.
+binary cache. No separately maintained checkout SHA is required; the bootstrap script retains an independent tool
+release and Windows executable hashes as a supply-chain review gate.
 
 CodeQL keeps third-party implementation findings out of CDT++ results through a two-phase manual build.
 `just codeql-prepare` configures the project, installs manifest dependencies before CodeQL starts tracing, and uses a

docs/reproducibility.md

@@ -90,16 +90,18 @@ manifest. The manifest records:
 - a canonical placement fingerprint derived from sorted finite vertices and
   their timeslices;
 - a canonical topology fingerprint derived from sorted vertices, causal
-  metadata, and finite cells;
+  metadata, and finite-cell incidence;
 - the CDT++ version, compiler, build configuration, standard library,
   operating system, architecture, C++ standard, and CGAL version;
 - the payload byte count and FNV-1a corruption checksum.
 
 The triangulation remains a CGAL-readable payload; provenance is in the sidecar
 rather than prepended to the CGAL stream. Because CGAL's native triangulation
-stream omits `info()` fields, CDT++ appends a versioned, canonically ordered
+stream omits `info()` fields, CDT++ appends a versioned, payload-indexed
 causal-data trailer that preserves every finite vertex timeslice and cell type.
-Legacy streams without this trailer remain topology-readable. Before
+Payloads using the older `cdt-plusplus-causal-info-v1` trailer are rejected
+entirely by `read_causal_info` rather than loaded with their causal metadata
+discarded. Legacy streams without a trailer remain topology-readable. Before
 publication, CDT++ serializes with round-trip floating-point precision to a
 temporary file, flushes and closes it, parses the complete CGAL stream and
 causal trailer, rejects any other trailing data, validates its triangulation