Float the RustCrypto fork pins that their default branch can carry

Cargo.toml

@@ -134,18 +134,21 @@ debug = 0
 
 # RustCrypto crates resolve to their AdaWorldAPI forks (fork-first policy).
 #
-# Each fork's default branch is a major version ahead of what this graph uses,
-# so every entry pins the fork commit whose Cargo.toml carries exactly the
-# version crates.io would have resolved; a patch whose version does not match
-# is silently unused. `docs/UPSTREAM-DEPS.md` lists the crates that have no
+# Internal pins are prohibited (2026-11-08): an entry floats on its fork's
+# default branch whenever that branch carries the version crates.io would
+# resolve (ecdsa, ed448-goldilocks). The rest still pin a commit, because their
+# fork's default branch is a semver-incompatible major ahead and a patch whose
+# version does not match is silently unused (the crate would then come from
+# crates.io). Each of those is unpinned by migrating its consumer to the new
+# major, not by editing this line. `docs/UPSTREAM-DEPS.md` lists the crates that have no
 # matching commit in their fork and therefore still come from crates.io.
 #
 # These patches apply to builds of THIS workspace only. A consumer (a2ui-rs,
 # report-rs, …) that depends on OGAR crates gets the registry versions unless it
 # repeats this block: cargo never applies a dependency's [patch] downstream.
 [patch.crates-io]
 # p256's ECDSA (ogar-oidc ES256).
-ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", rev = "5595c3b1bfa14022b46ec3cc662a87e49b954266" }
+ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", branch = "master" }
 # XChaCha20-Poly1305 (ndarray `encryption`, via ogar-encryption).
 chacha20poly1305 = { git = "https://github.com/AdaWorldAPI/AEADs", rev = "c5c199953aba561261bed1c55f62b9c19d0f49cf" }
 # The keystream comes from ndarray's own chacha20 0.9.1 fork, which adds an
@@ -155,7 +158,7 @@ chacha20 = { git = "https://github.com/AdaWorldAPI/ndarray", branch = "master" }
 poly1305 = { git = "https://github.com/AdaWorldAPI/universal-hashes", rev = "35de31af7396fe57fa28265e91532c816183c47f" }
 # Ed25519 (ndarray `encryption`) and X448's curve (elliptic-curves fork).
 curve25519-dalek = { git = "https://github.com/AdaWorldAPI/curve25519-dalek", rev = "5312a0311ec40df95be953eacfa8a11b9a34bc54" }
-ed448-goldilocks = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "f5cb30ebc9c2ccdbeb56965cf0c037e250b8f9c9" }
+ed448-goldilocks = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master" }
 # ogar-auth's legacy 3DES-EDE2 / PBKDF1-MD5 transition.
 md-5 = { git = "https://github.com/AdaWorldAPI/hashes", rev = "026b0e81e90ba476a5d343a8e4efbc63b814737b" }
 des = { git = "https://github.com/AdaWorldAPI/block-ciphers", rev = "7de364ede310f1ea7080c99ddf1138aeb47f9a69" }

crates/ogar-oidc/Cargo.toml

@@ -13,6 +13,6 @@ ogar-encryption = { path = "../ogar-encryption" }
 # ES256 (P-256 ECDSA). AdaWorldAPI fork of RustCrypto/elliptic-curves, the rev the
 # ndarray `encryption` crate already pins for x448. `ecdsa` itself is redirected to
 # the AdaWorldAPI/signatures fork by the workspace `[patch.crates-io]`.
-p256 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "739304e026fdf06cd1a31606e4db487d3f47c5ae", default-features = false, features = ["ecdsa", "alloc"] }
+p256 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master", default-features = false, features = ["ecdsa", "alloc"] }
 base64 = "0.22"
 serde_json = "1"

docs/UPSTREAM-DEPS.md

@@ -22,8 +22,8 @@
 | 6 (`lance-graph-ontology` cache) | manifest-watch event API for cache invalidation | LOCKED |
 | 7 (`lance-graph-callcenter`) | dataset transactional commit boundary; tag-based version retention | LOCKED |
 | `ogar-auth` (identity / federation) | `lance_graph_contract::auth::ActorContext` (canonical identity envelope) + `sla::TenantId`; git dep, branch `main`, unpinned. Measured: OGAR base `5b82ae0`; resolved lance-graph-contract at `f859d484c46dda9725ace2dc870c73e95203edde` | CURRENT-CONTRACT (unpinned `main`; re-measure the resolved rev when it matters) |
-| `ogar-oidc` (OIDC ID-token verifier) | `p256` from AdaWorldAPI/elliptic-curves rev `739304e026fdf06cd1a31606e4db487d3f47c5ae` (the rev ndarray `encryption` pins); `ecdsa` 0.17.0 redirected by workspace `[patch.crates-io]` to AdaWorldAPI/signatures rev `5595c3b1bfa14022b46ec3cc662a87e49b954266`; Ed25519 via `ogar-encryption`. RS256: no RSA fork wired | CURRENT-CONTRACT (rev-pinned) |
-| RustCrypto forks (workspace `[patch.crates-io]`) | Patched to the fork commit carrying the exact resolved version: `ecdsa` 0.17.0 (signatures `5595c3b`), `chacha20poly1305` 0.10.1 (AEADs `c5c1999`), `chacha20` 0.9.1 (ndarray `vendor/chacha20`, branch `master`), `poly1305` 0.8.0 (universal-hashes `35de31a`), `curve25519-dalek` 4.1.3 (curve25519-dalek `5312a03`), `ed448-goldilocks` 0.14.0-pre.15 (elliptic-curves `f5cb30e`), `md-5` 0.10.6 (hashes `026b0e8`), `des` 0.8.1 (block-ciphers `7de364e`). Still crates.io, no fork commit at the resolved version: `sha2` 0.10.9 and 0.11.1, `sha1` 0.10.7, `blake2` 0.11.0, `ed25519-dalek` 2.2.0; trait crates (`aead`, `cipher`, `digest`, `universal-hash`, `signature`) and `hmac` have no fork checked. `.cargo/config.toml` sets `curve25519_dalek_backend="serial"` and `poly1305_force_soft`. Patches and flags apply to this workspace only, never to consumers | MEASURED (fresh `cargo generate-lockfile`, no unused-patch warning; `cargo build -v` shows both cfgs on curve25519-dalek and poly1305) |
+| `ogar-oidc` (OIDC ID-token verifier) | `p256` 0.14.0 from AdaWorldAPI/elliptic-curves branch `master`; `ecdsa` 0.17.0 redirected by workspace `[patch.crates-io]` to AdaWorldAPI/signatures branch `master`; Ed25519 via `ogar-encryption`. RS256: no RSA fork wired | CURRENT-CONTRACT (floating on the fork's default branch; internal pins are prohibited) |
+| RustCrypto forks (workspace `[patch.crates-io]`) | Floating on the fork's default branch, which carries the resolved version: `ecdsa` 0.17.0 (signatures `master`), `ed448-goldilocks` 0.14.0-pre.15 (elliptic-curves `master`), `chacha20` 0.9.1 (ndarray `vendor/chacha20`, branch `master`). Still pinned to the fork commit carrying the resolved version, because the fork's default branch is a semver-incompatible major ahead (unpinning needs the consumer migrated to that major): `chacha20poly1305` 0.10.1 (AEADs `c5c1999`; `master` is 0.11.0), `poly1305` 0.8.0 (universal-hashes `35de31a`; `master` 0.9.1), `curve25519-dalek` 4.1.3 (curve25519-dalek `5312a03`; `main` 5.0.0), `md-5` 0.10.6 (hashes `026b0e8`; `master` 0.11.0), `des` 0.8.1 (block-ciphers `7de364e`; `master` 0.9.0). Still crates.io, no fork commit at the resolved version: `sha2` 0.10.9 and 0.11.1, `sha1` 0.10.7, `blake2` 0.11.0, `ed25519-dalek` 2.2.0; trait crates (`aead`, `cipher`, `digest`, `universal-hash`, `signature`) and `hmac` have no fork checked. `.cargo/config.toml` sets `curve25519_dalek_backend="serial"` and `poly1305_force_soft`. Patches and flags apply to this workspace only, never to consumers | MEASURED (fresh `cargo generate-lockfile`, no unused-patch warning; `cargo build -v` shows both cfgs on curve25519-dalek and poly1305) |
 
 **Coordination notes**:
 - OGAR's `Identity::class_identity_versioned(prefix, class, n)` MUST produce a string that `NiblePath` can split losslessly.