docs(watch): move W3 unsafe-libyaml to Resolved (reapply #1320)

[hyperpolymath]

Why this exists

#1320 merged as an empty commit (6f96eab), so main still lists W3 under Local remediation.

How it happened: #1311 was squash-merged. Merging main back into #1320's branch then conflicted on docs/UPSTREAM-DEPENDENCY-WATCH.adoc. That merge commit, d952134, resolved the conflict by taking main's side, which left the branch identical to main. This PR reapplies the same edit, unchanged, on top of the latest main; main's copy of the file is otherwise identical to the one the edit was made against.

What

hyperpolymath/panic-attack#234 (merged 2026-10-20) replaced serde_yaml with serde-saphyr 2.0, so RUSTSEC-2024-0449 is clear in every known affected repository.

• W3 leaves Local remediation, which now reads "No entries."
• It becomes R2 (was W3) under Resolved. The entry records:
  • Minimum Rust version: no maintained safe-Rust serde YAML crate builds on 1.85, and the noyalib releases that do predate RUSTSEC-2026-0333.
  • Resource limits: scaling serde-saphyr's parse budget for large machine-written documents.
  • Checked clear: hyperpolymath/echidna.
  • Follow-up: a cargo tree -i unsafe-libyaml command for any other repository.

Checks

• The diff against main is this one file, +33 / −18, and nothing else.
• asciidoctor --failure-level=WARN renders it with no warnings.
• The commit message passes .githooks/commit-msg.

Merge note: if main moves before merge, please update this branch with a rebase, or a merge that keeps this side of the file. A plain "merge main" that takes main's side reproduces the empty merge.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 54 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2d00a9e2-8d21-4b0c-92db-d633d448105c

📥 Commits

Reviewing files that changed from the base of the PR and between 6f96eab and 47e9c5c.

📒 Files selected for processing: 1

• docs/UPSTREAM-DEPENDENCY-WATCH.adoc

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T13:46:52.568335Z	—	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🟢 conformant · commit 47e9c5c775f7 · run 39432134336

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	0	0	— no comparable baseline
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 positive/negative controls	🟢 conformant	27	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	12	0	0	2	— no comparable baseline

K9 live corpus (L0–L2): 2 finding(s) / scope notes

• 2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.