CI: bump pinned pto-isa to 3eb8e99a

[chenshengxin2026]

Advance pto_isa.pin from c0d7148e95ef73bd12a73165fdce4b723a3b7e72 to 3eb8e99addabfc70eb5700985baf253470a24aae, which includes the upstream fix for TLOAD stride and vector length truncation.

Validation: confirmed the target commit exists in hw-native-sys/pto-isa, verified the diff contains exactly the one-line pin update, and passed git diff --check. Runtime validation is pending the CI run for this revision.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 21a805d5-0c60-4d30-9fec-7ae95ffc7123

📥 Commits

Reviewing files that changed from the base of the PR and between 9b283ab and 28dd33b.

📒 Files selected for processing (1)

• pto_isa.pin

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The stored PTO ISA revision identifier changes from c0d7148e95ef73bd12a73165fdce4b723a3b7e72 to 15a9e0a0845955f5d7a409a7f4d1609a263b5d25.

Changes

PTO ISA pin

Layer / File(s)	Summary
Update pinned revision pto_isa.pin	The pinned revision identifier changes to 15a9e0a0845955f5d7a409a7f4d1609a263b5d25.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 28dd3

The pin advances to a verified upstream revision, and supported runtime builds update their metadata accordingly. No actionable merge-blocking risk is evident.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 28dd3

The update retains existing revision checks and does not change setup permissions or acquisition mechanisms. No introduced security issue was established, but the intervening dependency changes were not fully reviewed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The supported exposure is the existing managed dependency checkout and runtimes that embed PTO-ISA headers. This repository change selects new dependency content without adding a setup caller or privilege mechanism. The security behavior of that upstream content remains outside the inspected source coverage.

Trust Boundaries and Controls

• observed — Normal cached-checkout reuse requires a clean tree at the pinned HEAD. After clone failure, however, the existing recovery branch accepts a checkout with the expected HEAD and include directory without rechecking cleanliness. Exact commit identity therefore does not universally establish working-tree integrity.

Resilience and Maintainability Implications

• observed — Checkout acquisition and metadata publication use separate locks. The acquisition lock ends before the resolved path is returned; these functions do not establish lifetime immutability of the checkout or a single atomic transaction spanning checkout, compiled binaries, and metadata.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the CI pin update, which matches the main change. The referenced SHA prefix, 3eb8e99a, differs from the 15a9e0a0 SHA in the changeset summary.
Description check	✅ Passed	The description directly explains the PTO-ISA pin update, the upstream fix, and the validation performed. Its referenced target SHA differs from the SHA in the changeset summary, but the description r…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the pinned line,
A newer hash is set in place.
No code paths change along the way,
The revision rests in its new space.
Then off I hop, with ears held high!}

_{Comment @coderabbitai help to get the list of available commands.}