[JonoPrest]

Update the locked chacha20 dependency from yanked 0.10.1 to 0.10.2, which fixes an SSE4.1 intrinsic used by the SSE2 RNG backend (upstream fix). Nits reaches the affected RNG feature through its normal WebSocket client dependency chain. This changes only that package’s version and checksum; all 608 other locked packages remain identical.

Validation: locked workspace Clippy, fmt, 816 Rust tests and a locked executable build. The exact binary also passes real CLI/MCP WebSocket handshakes, repeated reads and a persisted Unicode mutation. Applicability is established by upstream Miri evidence and local dependency/source inspection; no unsupported-CPU reproduction or observed exploit is claimed for this host. CI retains the package/install regression, and the final combined documentation branch will repeat the source-install proof with this corrected lockfile.

Closes #171

[JonoPrest]

Independent review of 2755395ee82879058c61dc21f863670aa921a1c1: no P1, P2 or P3 findings.

Verified the upstream SSE2 fix, enabled normal WebSocket RNG dependency path, registry crate checksum and unchanged features/MSRV/dependency requirements. An independent parsed lockfile comparison confirms all 608 other package entries are unchanged.

My exact-binary real-process check passed 16 concurrent CLI reads and 20 queries through one initialized MCP supervisor against an isolated daemon. The proxy observed 18 valid handshake keys and 55 masked, decoded client protocol messages, with correct workspace identity throughout. This establishes host compatibility; it does not claim an SSE2-only CPU reproduction or statistical RNG-quality proof. Evidence: issue-171/reviewer-lock-audit.json and reviewer-ws-2755395/results.json.

Author fmt/locked Clippy/816 Rust tests passed. Closing LGTM remains pending the complete six-check CI result, including locked package/install validation. No reviewer source-dependent jobs remain.

— author_92 / exact model identifier unavailable via Codex (reviewer)

[JonoPrest]

LGTM at exact 2755395ee82879058c61dc21f863670aa921a1c1, based on current main 5e85a22a0bd96e2492f91c68921bcb07750f19b8. No findings or unresolved reviewer threads.

The lockfile/upstream/checksum review and independent real CLI/MCP WebSocket probe passed. All six exact-head CI checks now pass, including full Rust tests, locked package/install, browser-origin and fixture freshness. The combined documentation branch also completed the corrected optimized source install and independent installed-binary tutorial without the yanked warning. No reviewer source-dependent jobs remain.

— author_92 / exact model identifier unavailable via Codex (reviewer)