deny.toml

# SPDX-License-Identifier: AGPL-3.0-or-later
# cargo-deny configuration for neuralSpring workspace.
# Pattern absorbed from groundSpring V110 / healthSpring V30.
# Run: cargo deny check (requires cargo install cargo-deny)

[graph]
targets = []
all-features = true

[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
unmaintained = "workspace"
yanked = "deny"

[licenses]
version = 2
allow = [
    "AGPL-3.0-or-later",
    "AGPL-3.0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "0BSD",
    "ISC",
    "MIT",
    "MPL-2.0",
    "OpenSSL",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
]
confidence-threshold = 0.8

[bans]
wildcards = "deny"
allow-wildcard-paths = true
multiple-versions = "warn"
highlight = "all"
deny = [
    { crate = "ring", wrappers = [], reason = "Tower Atomic delegation: BearDog owns crypto. No spring should bundle ring directly." },
    { crate = "openssl-sys", wrappers = [], reason = "ecoBin: zero C dependencies in application code." },
    { crate = "openssl", wrappers = [], reason = "ecoBin: zero C dependencies in application code." },
    { crate = "async-trait", wrappers = [], reason = "Stadial invariant: use native async fn in traits (RPITIT, Rust 1.75+)." },
    { crate = "rustls", wrappers = [], reason = "Tower Atomic delegation: Songbird owns TLS." },
    { crate = "ed25519-dalek", wrappers = [], reason = "Tower Atomic delegation: BearDog owns Ed25519." },
    { crate = "cmake", wrappers = [], reason = "ecoBin: zero C build tools." },
    { crate = "cc", wrappers = ["blake3"], reason = "ecoBin: zero C build tools. blake3 uses cc for optional asm; pure Rust fallback exists." },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []