chore(triage): digest — mkit

[christopherwxyz]

<!-- triage-state
{"last_run_utc": "2026-08-20T23:06:25Z", "open_issues": 4, "open_prs": 14}
-->

Triage digest — mkit — August 20, 2026 23:06 UTC

Needs a milestone call

• docs(drift): report — mkit #787 — "docs(drift): report — mkit" — recurring style-guide/dead-reference sweep. Touches release-adjacent docs but isn't one of the named v0.4.0 scope items and isn't a deferred theme either. Left unmilestoned rather than guessing.
• ci(actions): bump taiki-e/install-action from 2.85.10 to 2.85.13 in the actions-minor group #918–deps(rust): bump the cargo-minor group across 1 directory with 15 updates #924 (7 Dependabot bumps, updated 2026-08-18) — left unmilestoned. Sibling dep PRs (deps(signers): bump the cargo-minor group across 1 directory with 4 updates #889/deps(signers): bump p256 from 0.13.2 to 0.14.0 in /contrib/signers #890/deps(web): bump ox from 0.14.31 to 1.0.3 in /apps/web #893/deps(web): bump waku from 1.0.0-beta.6 to 1.0.0-beta.7 in /apps/web #894/deps(rust): bump p256 from 0.13.2 to 0.14.0 in /rust #896/deps(rust): bump k256 from 0.13.4 to 0.14.0 in /rust #897/deps(mcp): bump the npm-minor group across 1 directory with 5 updates #907) sit on "mkit public release (v0.4.0)", but routine dependency bumps aren't clearly release-scoped work; not confident enough to assign. A human may want to sweep the whole dependency backlog onto (or off) v0.4.0 consistently.

Possible duplicates

• None. deps(rust): bump the cargo-minor group across 1 directory with 15 updates #924 ("bump the cargo-minor group … 15 updates") does not overlap deps(rust): bump p256 from 0.13.2 to 0.14.0 in /rust #896 (p256 0.13.2→0.14.0) or deps(rust): bump k256 from 0.13.4 to 0.14.0 in /rust #897 (k256 0.13.4→0.14.0) — different package sets, not duplicates.

Stale (30+ days idle)

• deps(signers): bump p256 from 0.13.2 to 0.14.0 in /contrib/signers #890 — "deps(signers): bump p256 from 0.13.2 to 0.14.0 in /contrib/signers" — last activity 2026-07-20 (dependabot comment). Now 31+ days idle — labeled stale this run.
• deps(rust): bump p256 from 0.13.2 to 0.14.0 in /rust #896 — "deps(rust): bump p256 from 0.13.2 to 0.14.0 in /rust" — last activity 2026-07-20. Now 31+ days idle — labeled stale this run.
• deps(rust): bump k256 from 0.13.4 to 0.14.0 in /rust #897 — "deps(rust): bump k256 from 0.13.4 to 0.14.0 in /rust" — last activity 2026-07-20. Now 31+ days idle — labeled stale this run.
• Note: feat(keystore): Cloud KMS backend (BackendKind::Cloud, AWS KMS first) #204 and fix(keystore): YubiKey backend fails closed for any PIN- or touch-protected key (no PinProvider wired in) #777 still carry a stale label from a prior run but have since had label activity (updated 2026-08-12 / 2026-08-11), so they're no longer 30+ days idle by that measure. Left as-is — triage never removes labels — flagged here for a human glance.

Decorated this run

• deps(signers): bump p256 from 0.13.2 to 0.14.0 in /contrib/signers #890, deps(rust): bump p256 from 0.13.2 to 0.14.0 in /rust #896, deps(rust): bump k256 from 0.13.4 to 0.14.0 in /rust #897 — added stale label (crossed the 30-day-idle threshold since the last run; their real last activity is a 2026-07-20 Dependabot comment, not the later updated_at bump).
• Everything else re-verified, no changes needed: all 4 open issues and the other 11 open PRs already carry correct labels/milestones from prior runs. The 48h window (since 2026-08-18) held only ci(actions): bump taiki-e/install-action from 2.85.10 to 2.85.13 in the actions-minor group #918–deps(rust): bump the cargo-minor group across 1 directory with 15 updates #924 plus this digest; ci(actions): bump taiki-e/install-action from 2.85.10 to 2.85.13 in the actions-minor group #918–deps(rust): bump the cargo-minor group across 1 directory with 15 updates #924 are already correctly labeled by Dependabot (dependencies + web/scope) with no milestone, and no PR body references a fixes/closes/relates to #N issue link.
• Blocked — GitHub Project -Djemalloc build path is not exercised by CI or local testing #13 sync. This session's GitHub MCP server exposes no Projects v2 tools (no field-list/item-add equivalents), and gh is not installed. No item could be added to the board or have its Status set this run.
• Blocked — pinning. No issue pin/unpin tool is available this session either. This digest (chore(triage): digest — mkit #631) remains unpinned.