Summary

• synchronize the independently locked ffproof guest workspaces after encrypted-spaces-changelog-core gained log
• add a cached, fail-closed pull-request preflight that discovers every first-party guest workspace and validates locked fetch plus frozen metadata before Clippy
• keep the bridge runtime, guest source, release artifact layout, and trust-root contract unchanged

Root cause

Main release run 29261973781 reached the RISC Zero build after about 40 minutes, then Cargo rejected ffproof/methods/guest/Cargo.lock because RISC0_BUILD_LOCKED=1 forbids updating the stale nested lock. ffproof/methods_bench/guest/Cargo.lock had the same dependency drift. The client-method and tracer guest locks were already synchronized.

Regression proof

With the lock fixes reverted:

$ cargo metadata --format-version 1 --manifest-path ffproof/methods/guest/Cargo.toml --locked
error: cannot update the lock file ... because --locked was passed

$ cargo metadata --format-version 1 --manifest-path ffproof/methods_bench/guest/Cargo.toml --locked
error: cannot update the lock file ... because --locked was passed

With the fixes restored:

PASS: 4 nested guest lockfiles are synchronized

The zero-manifest path also exits 1 with No nested guest Cargo manifests found.

Verification

• RISC0_SKIP_BUILD=1 cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo fmt --all -- --check
• actionlint -ignore 'actions-rs/toolchain@v1' .github/workflows/lint-prototype.yml (excludes the pre-existing format-job action warning)
• changelog core: 240 passed
• SDK: 324 passed, 1 intentional measurement helper ignored
• numeric round trips: 6 passed
• adversarial review: SHIP-IT; no Critical or Important findings

Runtime launch transcript

Build:

$ cargo build --locked -p encrypted-spaces-backend-server -p encrypted-spaces-bridge
Finished dev profile

Launch:

$ RISC0_SKIP_BUILD=1 ENCRYPTED_SPACES_BRIDGE_TEST_BINARY=<bridge> ENCRYPTED_SPACES_BACKEND_TEST_BINARY=<backend> cargo test -p encrypted-spaces-bridge --locked --test runtime runtime_member_invite_join_remove_enforces_revocation -- --exact --test-threads=1
test runtime_member_invite_join_remove_enforces_revocation ... ok
test result: ok. 1 passed; 0 failed

$ RISC0_SKIP_BUILD=1 ENCRYPTED_SPACES_BRIDGE_TEST_BINARY=<bridge> ENCRYPTED_SPACES_BACKEND_TEST_BINARY=<backend> cargo test -p encrypted-spaces-bridge --locked --test runtime runtime_space_lifecycle_survives_restart_and_membership_changes -- --exact --test-threads=1
test runtime_space_lifecycle_survives_restart_and_membership_changes ... ok
test result: ok. 1 passed; 0 failed

The revocation case emitted its expected removed-member decryption warning on stderr. Failure-signature scrape: clean.

Verdict: PASS

Scope

Continues Task 4 of the locked Signal/Encrypted Spaces group-channel plan by repairing its reproducible official-runtime release gate.

Doc-reconciliation: clean