ci(supply-chain): wire cargo audit + cargo deny into a blocking CI gate (SUPPLY-01)

.cargo/audit.toml

@@ -0,0 +1,36 @@
+# cargo-audit configuration for Moon.
+# Run: cargo audit
+#
+# CI: wired into .github/workflows/supply-chain.yml (job `audit`), a
+# blocking check for SUPPLY-01. cargo-audit only fails the build on
+# `Warning::Vulnerability`-class advisories by default (unmaintained /
+# unsound / yanked print but do not fail) — deliberately NOT overridden
+# with `--deny warnings` here, matching the design that a real CVE hard
+# fails while informational advisories stay visible-but-non-blocking. The
+# entries below are additionally silenced via `ignore` (same three
+# unmaintained crates as deny.toml, plus one unsound-but-inapplicable
+# advisory not caught by cargo-deny's older rustsec matcher) purely to
+# keep CI logs clean; each has a reason and a re-check trigger.
+
+[advisories]
+ignore = [
+    # fxhash 0.2.1: unmaintained, no safe upgrade; pinned transitively by
+    # monoio 0.2.4 (vendor/monoio). Revisit when monoio drops it.
+    "RUSTSEC-2025-0057",
+    # paste 1.0.15: unmaintained (archived upstream), no safe upgrade;
+    # pinned transitively by tikv-jemalloc-ctl 0.6.1. Revisit on next
+    # jemalloc-ctl major bump.
+    "RUSTSEC-2024-0436",
+    # rustls-pemfile 2.2.0: unmaintained; migrating to
+    # rustls-pki-types::PemObject is a source-code change (src/tls*) out
+    # of scope for this CI-wiring change. Tracked as a follow-up.
+    "RUSTSEC-2025-0134",
+    # rand 0.9.2 (transitive via metrics-util 0.20.4 -> metrics -> moon):
+    # RUSTSEC-2026-0097 is a narrow unsoundness that only triggers when a
+    # *custom log::Log implementation* calls rand::rng() reentrantly from
+    # inside a log callback while ThreadRng reseeds — moon uses
+    # tracing-subscriber, not a custom `log` logger, so the trigger path
+    # is not reachable. No newer metrics-util is published yet that pulls
+    # rand >=0.9.3. Revisit on the next metrics-util bump.
+    "RUSTSEC-2026-0097",
+]

.github/workflows/supply-chain.yml

@@ -0,0 +1,69 @@
+name: Supply Chain
+
+# SUPPLY-01 (docs/PRODUCTION-CONTRACT.md, section A): `cargo audit` (RUSTSEC
+# advisories) + `cargo deny check` (advisories/licenses/bans/sources) as a
+# blocking CI gate. Runs on ubuntu-latest, NOT the self-hosted moon-dev
+# runner -- this job only inspects Cargo.lock/dependency metadata, no build
+# is required, so the hosted runner's queue time is a non-issue and it
+# keeps the self-hosted VM free for the Check job.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'deny.toml'
+      - '.cargo/audit.toml'
+      - '.github/workflows/supply-chain.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'deny.toml'
+      - '.cargo/audit.toml'
+      - '.github/workflows/supply-chain.yml'
+  schedule:
+    # Weekly, independent of code changes -- RUSTSEC advisories are
+    # published continuously, so even an untouched lockfile can go from
+    # green to red.
+    - cron: '0 6 * * 1'
+  workflow_dispatch: {}
+
+concurrency:
+  group: supply-chain-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # -- cargo audit: RUSTSEC vulnerability advisories --------------------
+  # Fails only on Vulnerability-class advisories by default (see
+  # .cargo/audit.toml for the rationale -- unmaintained/unsound/yanked are
+  # visible-but-non-blocking, matching cargo-audit's own default lint
+  # levels; nothing here overrides that with --deny warnings).
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.94.1
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-audit@0.22.2
+      - run: cargo audit
+
+  # -- cargo deny: advisories + license allowlist + ban rules + sources -
+  deny:
+    name: cargo deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.94.1
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-deny@0.19.6
+      - run: cargo deny check advisories licenses bans sources

CHANGELOG.md

@@ -34,6 +34,30 @@ task #44). New rows for shipped-but-untracked guarantees: `CRASH-02`
 (37-cell cross-plane kill-9 matrix), `MEM-10X-01` (10× RAM G2 acceptance),
 `REPL-PLANES-01` (all-plane replication); new `REPL-SOAK-01` row gates the
 v0.7.0 tag on the 24h replication soak. GA-blocking gap now 17 rows.
+### Added — supply-chain security CI gate: `cargo audit` + `cargo deny check` (task #63, SUPPLY-01)
+
+`deny.toml` existed in the tree but was never wired into CI (its own header
+comment said so). Added `.github/workflows/supply-chain.yml`: two
+`ubuntu-latest` jobs, `audit` (`cargo audit`, blocking on RUSTSEC
+vulnerability-class advisories) and `deny` (`cargo deny check advisories
+licenses bans sources`, blocking on any deny.toml violation), triggered on
+PRs touching `Cargo.toml`/`Cargo.lock`/`deny.toml`/`.cargo/audit.toml`,
+push to `main`, and a weekly schedule (advisories publish independent of
+code changes). Runs on the hosted runner, not the self-hosted `moon-dev`
+box — no build is required, just dependency-graph inspection.
+
+Fixed three real advisories to get to green: `memmap2` 0.9.10 → 0.9.11
+(RUSTSEC-2026-0186, unsound pointer-offset validation),
+`crossbeam-epoch` 0.9.18 → 0.9.20 (RUSTSEC-2026-0204, invalid pointer
+dereference in `Display`), `spin` 0.9.8 → 0.9.9 (yanked), and dropped the
+`core2`/`proc-macro-error2` unmaintained transitives by bumping
+`rust-embed` 8.11.0 → 8.12.0 (console feature). Three unmaintained
+transitive advisories with no available safe upgrade
+(`fxhash` via monoio, `paste` via tikv-jemalloc-ctl, `rustls-pemfile`
+pending a `rustls-pki-types::PemObject` migration) are explicitly
+ignore-listed with reasons in `deny.toml` / `.cargo/audit.toml` rather
+than left to silently pass — an always-red gate is worse than none, but a
+silently-permissive one is worse still.
 
 ### Fixed — legacy-mode (`--disk-offload disable`) graph WAL replay silently dropped the entire graph plane on kill-9 restart (task #60)