Ttimmahlax · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml
@@ -0,0 +1,28 @@
+# Portfolio check - calls the shared harness in Remade-With-Rust/.github.
+#
+# Managed by remade-updater. Edit the shared workflow, not this file: this exists
+# only so the run attaches to the pull request, where a merge can wait on it.
+
+name: portfolio-check
+
+on:
+  pull_request:
+  # Also on the base branch, so a red pull request can be compared against a
+  # real run of THIS check on main. Without it the only baseline available is
+  # "are main's own checks green", which answers a different question: this
+  # harness is stricter than most repositories' own CI, so a pre-existing
+  # failure it alone catches looks exactly like a regression.
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main
+    with:
+      # FFAI's full test suite outruns the shared workflow's 60-minute limit;
+      # its own CI runs the tests. The portfolio gate is the cheap `check`.
+      command: check
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/ffai-argus-wasm/Cargo.toml b/crates/ffai-argus-wasm/Cargo.toml
@@ -36,7 +36,7 @@ wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two
 # feeding an autoregressive decoder with a growing KV cache — so
 # `--no-default-features` keeps the dlmalloc arm buildable for whoever takes
 # that measurement.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 
 # The gemm SIMD A/B, off by default. `gemm` is already in the tree beneath
 # candle; this makes its runtime switch reachable so a browser can measure

diff --git a/crates/ffai-argus/Cargo.toml b/crates/ffai-argus/Cargo.toml
@@ -63,7 +63,7 @@ getrandom = { version = "0.3", features = ["wasm_js"] }
 # places: a SigLIP/Llama forward allocates a 47 MB score tensor per layer, and
 # 47 MB is above the threshold where most allocators stop pooling and go
 # straight to the OS. See `examples/alloc_ab.rs`.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 
 # The step-3 oracle test reads the reference dump's summary.json.
 serde_json = { workspace = true }

diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml
@@ -37,13 +37,13 @@ serde-wasm-bindgen = "0.6"
 # rusty_alloc at parity with dlmalloc on Diana's workload. Carmenta's
 # allocation pattern is different (many small line crops rather than one big
 # tensor chain), so the answer here is its own open measurement.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 # The allocator CORE, for `arena::reserve_os_memory_ex`. `rusty_alloc-api` is
 # the mi_*-compatible surface and does not re-export the arena module, but on
 # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free`
 # is a no-op there because linear memory cannot shrink. Same version as the
 # api crate, so this adds no second copy of the allocator.
-rusty_alloc = { version = "=2.2.0", optional = true }
+rusty_alloc = { version = "=2.2.5", optional = true }
 
 [features]
 # **`rusty_alloc`, and the "open measurement" this comment used to ask for has

diff --git a/crates/ffai-carmenta/Cargo.toml b/crates/ffai-carmenta/Cargo.toml
@@ -84,7 +84,7 @@ tokenizers = { version = "0.23", default-features = false, features = ["unstable
 mimalloc = { version = "0.1", default-features = false }
 # Superseded as the default by the pure-Rust remake; see the allocator
 # doc comment in `ffai-cli/src/main.rs` for the measurement.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 ffai-media = { path = "../ffai-media" }
 ffai-bench = { path = "../ffai-bench" }
 

diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml
@@ -64,10 +64,10 @@ mimalloc = { version = "0.1", default-features = false, optional = true }
 # It reproduced in the CLI (which declares this allocator) and never in an
 # example (which declared none and got the system one), and that difference is
 # what finally identified it.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs.
 # Without it rusty_alloc's RSS does not bound on a rayon pool.
-rusty_alloc = "=2.2.0"
+rusty_alloc = "=2.2.5"
 clap = { workspace = true }
 
 [features]

diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml
@@ -66,10 +66,10 @@ libmimalloc-sys = { version = "0.1", default-features = false }
 # margin the largest single effect in the Diana latency campaign (1.64x), so
 # it is simultaneously the dependency we most want to drop and the one that
 # costs the most to drop wrongly.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives.
 # `rusty_alloc-api` deliberately exposes collect only per-`Heap`.
-rusty_alloc = "=2.2.0"
+rusty_alloc = "=2.2.5"
 ffai-media = { path = "../ffai-media" }
 ffai-bench = { path = "../ffai-bench" }
 

diff --git a/crates/ffai-mercury-wasm/Cargo.toml b/crates/ffai-mercury-wasm/Cargo.toml
@@ -38,7 +38,7 @@ wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two
 # Mercury's allocation pattern is its own question — one long encoder/decoder
 # chain rather than many small crops — so `--no-default-features` keeps the
 # dlmalloc arm buildable for whoever takes that measurement.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 
 [features]
 default = ["rusty-alloc"]

diff --git a/crates/ffai-wasm/Cargo.toml b/crates/ffai-wasm/Cargo.toml
@@ -27,7 +27,7 @@ wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two
 # pre-reservation is disabled there, because wasm `memory.grow` is never
 # returned to the host). Whether it beats dlmalloc on THIS workload is a
 # measurement we can now run, which is the point of having a cdylib at all.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 
 [features]
 # `rusty_alloc` is the default; `--no-default-features` leaves the target's own

diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
@@ -555,6 +555,13 @@ user-id = 1139 # Manish Goregaokar (Manishearth)
 start = "2020-04-20"
 end = "2027-08-18"
 
+[[trusted.portable-atomic]]
+criteria = "safe-to-deploy"
+trusted-publisher = "github:taiki-e/portable-atomic"
+start = "2026-07-17"
+end = "2027-10-08"
+notes = "Owner decision 2026-10-08 (Tim Almond): trust portable-atomic's GitHub trusted-publishing workflow; target-gated dependency of rusty_alloc 2.x."
+
 [[trusted.potential_utf]]
 criteria = "safe-to-deploy"
 user-id = 1139 # Manish Goregaokar (Manishearth)

diff --git a/supply-chain/config.toml b/supply-chain/config.toml
@@ -803,10 +803,6 @@ criteria = "safe-to-deploy"
 version = "0.3.33"
 criteria = "safe-to-deploy"
 
-[[exemptions.portable-atomic]]
-version = "1.14.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.portable-atomic-util]]
 version = "0.2.7"
 criteria = "safe-to-deploy"
@@ -984,11 +980,11 @@ version = "0.3.1"
 criteria = "safe-to-run"
 
 [[exemptions.rusty_alloc]]
-version = "2.2.0"
+version = "2.2.5"
 criteria = "safe-to-deploy"
 
 [[exemptions.rusty_alloc-api]]
-version = "2.2.0"
+version = "2.2.5"
 criteria = "safe-to-deploy"
 
 [[exemptions.rusty_expressions]]