contextgraph-* crates are git deps pinned only by rev (supply-chain / reproducibility risk)

[macanderson]

Where: stella-cli/Cargo.toml:26

Problem: stella-context, stella-graph, and stella-cli all take contextgraph-types (plus contextgraph-host, -trace, -conformance in stella-cli) as a git dependency from github.com/macanderson/context-graph-protocol, pinned only by commit rev, not a published crates.io version. This is core protocol/domain-type infrastructure for three crates sourced from a single personal, unreviewed, unversioned repository outside the workspace's own governance.

Suggested fix: Vendor the crate into the workspace or publish it to crates.io with normal semver; if it must stay external, mirror it and reference the mirror, and centralize the rev in one place (see next finding).

Audit confirmation: single-verifier-real (verifiers: opus).

---

Filed from round-3 /ultraudit (cross-model confirmed). Fixes already applied to safe-fix categories are in draft PR #815; this issue is a finding that needs a change beyond that scope.

[macanderson]

Reopening the question this issue closed, in stella#6504 — flagging it here so the reversal is findable from the decision it reverses.

#6504 moves the four contextgraph-* crates back to { git, rev } and re-opens allow-git with a single entry. The forcing reason is that CGP cut a new major version (ContextQueryResult gained frame_attestations and result_attestation) and has not published it, because that repository has no crates.io token and no crates-io environment. Until it does, stella cannot compile against CGP's HEAD, and CGP's Downstream Canary is red on main for that reason alone.

The reproducibility risk this issue was filed about does not carry over. The pin here is CGP's main at its exact HEAD, not a commit on a re-rooted line reachable from no branch — that was the specific failure mode here, and it was the right thing to fix.

The audit-coverage half does carry over: cargo audit and cargo vet cannot see a git revision, so those four crates leave that coverage while the pin stands. Context-graph-protocol being first-party makes that a smaller loss than it would be for a third-party crate, but it is not nothing.

Both Cargo.toml and deny.toml now carry an explicit instruction to move back to a registry version and restore allow-git = [] in the same change, once CGP publishes. That publish is tracked at macanderson/context-graph-protocol#102.