Purpose

Prevent project builds and Rust deployments from resolving unreviewed dependency versions or compiling crates covered by current RustSec security advisories.

ADDED Requirements

Requirement: Mandatory Rust builds preserve the reviewed lock file

Every dependency-resolving Cargo command in the full project gate, parity CI and Rust artifact deployment paths SHALL require the existing root Cargo.lock without modifying it. A missing or stale lock file SHALL stop the command before project compilation begins.

Scenario: Reviewed lock file is current

• WHEN a mandatory Rust build runs with manifests consistent with the committed Cargo.lock
• THEN Cargo uses exactly the versions recorded in that lock file

Scenario: Manifest requires dependency resolution

• WHEN a manifest change would require Cargo to create or update Cargo.lock
• THEN the mandatory build fails before compiling project code and leaves Cargo.lock unchanged

Scenario: Lock file is missing

• WHEN a mandatory Rust build runs without the root Cargo.lock
• THEN the build fails instead of resolving a new dependency graph

Requirement: Current RustSec advisories gate project compilation

The full project gate, parity CI and every deployment mode that builds a Rust artifact SHALL audit the root Cargo.lock against RustSec before compiling the first project crate. The audit SHALL fetch the advisory database during that run, SHALL NOT accept an explicitly stale or fetch-skipped database, and SHALL fail on every vulnerability reported for a locked crate except the guarded RUSTSEC-2026-0235 case defined below. Informational maintenance warnings SHALL remain visible but SHALL NOT be reclassified as vulnerabilities.

The committed root dependency graph SHALL contain none of the five non-exempt vulnerabilities found by the 2026-08-21 baseline scan. The only permitted advisory ignore SHALL be RUSTSEC-2026-0235, and it SHALL be passed to the auditor only after Cargo proves that rkyv 0.7.46 is absent from the resolved workspace graph with all workspace features and all targets. A non-empty inverse tree or any inability to produce that proof SHALL fail before the audit and before project compilation.

Scenario: Locked graph has no non-exempt reported vulnerability

• WHEN the reachability proof and advisory database refresh succeed and the root lock file has no non-exempt RustSec vulnerability
• THEN the security gate succeeds and the requested build may begin

Scenario: Non-exempt baseline vulnerabilities are remediated

• WHEN the committed root Cargo.lock is audited after dependency remediation
• THEN RUSTSEC-2026-0258, RUSTSEC-2026-0220, RUSTSEC-2026-0233 and RUSTSEC-2026-0234 are absent without an advisory ignore

Scenario: Guarded advisory remains unreachable

• WHEN Cargo successfully resolves all workspace features and all targets and the inverse tree for rkyv@0.7.46 is empty
• THEN the gate invokes cargo audit with exactly the RUSTSEC-2026-0235 ignore

Scenario: Guarded advisory becomes reachable

• WHEN the inverse tree for rkyv@0.7.46 contains any dependency path
• THEN the gate fails before invoking cargo audit or compiling project code

Scenario: Reachability cannot be proved

• WHEN Cargo cannot resolve the all-features/all-targets inverse tree, including when the exact package is no longer present
• THEN the gate fails closed and requires the exception policy to be reviewed

Scenario: Locked graph contains a malicious crate

• WHEN the root lock file contains arrayref 0.3.10
• THEN the security gate fails with RUSTSEC-2026-0260 before any project compilation

Scenario: Advisory database cannot be refreshed

• WHEN the RustSec advisory database fetch fails
• THEN the security gate fails closed and no project compilation or deployment begins

Scenario: Auditor is unavailable or incompatible

• WHEN the required cargo-audit executable is missing or has a version other than the project-pinned version
• THEN the security gate fails with an installation instruction and no project compilation begins

Requirement: Every mandatory entry point applies the same security policy

The local full gate, parity CI and deployment script SHALL invoke one shared Cargo supply-chain policy. Deployment modes that do not build Rust artifacts SHALL remain usable without performing a dependency audit.

Scenario: Full local gate

• WHEN an operator runs scripts/gate.sh
• THEN the shared supply-chain gate succeeds before the first dependency-resolving Cargo command

Scenario: Parity CI

• WHEN the parity workflow runs
• THEN it installs the pinned auditor with its own lock file, verifies the shared policy and audits the project before building the workspace

Scenario: Rust deployment mode

• WHEN scripts/deploy-vps.sh enters a mode that builds one or more Rust binaries
• THEN one successful shared audit occurs before the first Rust build in that process

Scenario: Non-build deployment mode

• WHEN scripts/deploy-vps.sh performs a read-only health or verification mode
• THEN that mode does not require cargo-audit because it resolves and compiles no dependencies

Requirement: Supply-chain enforcement has executable regressions

The repository SHALL provide repeatable checks which prove that all mandatory Cargo build, test and lint commands carry the lock assertion, that reachability and audit failures stop their caller, that the only ignored advisory is guarded, and that the published arrayref 0.3.10 incident is rejected by the refreshed RustSec database.

Scenario: Command loses lock enforcement

• WHEN a mandatory Cargo build, test or lint command omits the lock assertion
• THEN the policy regression fails and names the offending command

Scenario: Help text quotes a Cargo command

• WHEN the body of a documentation here-document names a Cargo command in prose
• THEN the policy regression treats it as text and does not fail on it

Scenario: Executed snippet omits lock enforcement

• WHEN a here-document that is executed elsewhere carries a Cargo build, test or lint command without the lock assertion
• THEN the policy regression fails and names that command

Scenario: Audit command fails

• WHEN the shared auditor exits non-zero
• THEN its regression proves that the gate propagates the failure rather than continuing

Scenario: Guarded package is injected into the active tree

• WHEN the reachability regression returns a dependency path for rkyv@0.7.46
• THEN it proves the gate refuses before calling the auditor

Scenario: Additional advisory ignore is introduced

• WHEN the shared policy contains an advisory ignore other than RUSTSEC-2026-0235
• THEN the policy regression fails and identifies the unauthorized ignore

Scenario: Known malicious fixture is audited

• WHEN the regression audits a fixture lock containing arrayref 0.3.10 after the advisory database refresh
• THEN it observes a non-zero audit result that identifies RUSTSEC-2026-0260