feat(supply-chain): execute the dependency policy with cargo-deny (Y43) - #7

Owner-arbitration: 2026-10-09

What

• The existing deny.toml was versioned and executed by nothing; it is aligned on the base policy and now executed by check:dependency-policy, called first in check:rust (part of bun run check, hence composition / validate).

• deny.toml is the constellation base policy, byte-identical to project-governance/deny.toml as aligned in the authority PR: licence allowlist of ADR-0042 §4 and §11 (MIT, MIT-0, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0, Unicode-3.0, Zlib; no linked GPL, no AGPL/SSPL), crates.io as the only registry, git trust bounded to libre-ai, yanked = "deny", wildcards = "deny" with allow-wildcard-paths = true (cargo-deny 0.19.5: path/git deps of private crates are not wildcards; a registry * stays refused, verified on a scratch workspace).

• tools/quality/check-dependency-policy.ts (+ tests) fetches cargo-deny 0.19.5, verifies the archive sha256 (linux-x64 digest identical to reusable-dependency-policy.yml), runs --locked check advisories bans licenses sources, fails on an unreadable deny.toml/Cargo.lock, and prints the number of locked packages inspected. The composition runner installs no cargo-deny, hence the fetch.

• Advisories are blocking (Y43), unlike the fleet template which only reports them; an accepted risk goes through a dated waiver per docs/security/ADVISORY-WAIVER-POLICY.md. No waiver is added.

Local result

 advisories ok: 0 errors, 0 warnings, 0 notes
       bans ok: 0 errors, 9 warnings, 0 notes
   licenses ok: 0 errors, 0 warnings, 98 notes
    sources ok: 0 errors, 1 warnings, 0 notes
Dependency policy verified: advisories, bans, licenses and sources hold for 1 manifest(s), 99 locked package(s) inspected

No workflow, Cargo.lock, rev or pin file is touched.

https://claude.ai/code/session_01Qw4AExV42cXJ67Sj9dqLVf