diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c0d0aa43..85f84c261 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,15 @@ skip the roll) were re-inserted the same way.
 
 ## [Unreleased]
 
+- The four Context Graph Protocol crates (`contextgraph-types`,
+  `contextgraph-host`, `contextgraph-trace`, `contextgraph-conformance`) are now
+  ordinary crates.io dependencies at `=0.1.2`, declared once in the root
+  manifest, instead of git dependencies pinned by commit rev (#819). Building
+  stella from source no longer reaches out to the protocol repository, the
+  lockfile carries a checksum for each of them, and `cargo audit` / `cargo vet`
+  can see them — none of which was true of a git rev. `deny.toml`'s `allow-git`
+  exemption is removed, so the workspace now has no vetted git sources at all.
+
 ## [0.6.57] — 2026-08-01
 
 ## [0.6.56] — 2026-08-01
diff --git a/Cargo.lock b/Cargo.lock
index bc7a2d25b..72d72f115 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -395,8 +395,9 @@ checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
 name = "contextgraph-conformance"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b65478f263db1e54f2665b7653db5ee57130a108e78ec3785dc26036a263f7cd"
 dependencies = [
  "async-trait",
  "clap",
@@ -411,8 +412,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-host"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edaf2a69d0e22494dcf0f890bad63edc436035d0116100215f650b3ca1d3f343"
 dependencies = [
  "async-trait",
  "contextgraph-types",
@@ -428,8 +430,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-trace"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d26ec325f040549af3ba16f6343b0e5d022e174185161d5a3334aca602731ca"
 dependencies = [
  "contextgraph-types",
  "serde",
@@ -439,8 +442,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-types"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85b7acbbe63ff3a0a5eb104c5e9a4a81c9ec6de57d535b7e5216daac54ba6974"
 dependencies = [
  "serde",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 7493593fd..5ac0e9af0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,6 +32,27 @@ homepage = "https://stella.oxagen.sh"
 publish = false
 
 [workspace.dependencies]
+# Context Graph Protocol — the wire types, host runtime, conformance suite, and
+# execution-trace vocabulary stella speaks (#819). Declared ONCE here so a
+# version bump is a one-line edit rather than six scattered across three member
+# manifests, which is how these drifted onto a git rev in the first place.
+#
+# These were `{ git = ..., rev = ... }` until #819. That pin named a commit
+# living on a history line this repository's upstream had since re-rooted away
+# from: it was on no branch and no PR, reachable only by raw SHA, and eligible
+# for garbage collection — a cold cargo cache away from breaking every build.
+# Registry versions get us a reviewable release, a checksum in Cargo.lock, and
+# an audit trail (`cargo audit`/`cargo vet` cannot see a git rev).
+#
+# `contextgraph-trace` is SKETCH STAGE and deliberately exempt from the
+# protocol's stability promise — its journal wire format may change in any 0.x
+# release. Gate behaviour on its `TRACE_FORMAT` constant, not on this version.
+# Hence exact `=` requirements: a silent minor bump here would change a wire
+# format `stella arena` writes to disk.
+contextgraph-types = "=0.1.2"
+contextgraph-host = "=0.1.2"
+contextgraph-trace = "=0.1.2"
+contextgraph-conformance = "=0.1.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # RFC 8785 JSON Canonicalization Scheme — pinned to the SAME version the Context
diff --git a/deny.toml b/deny.toml
index b9d15dfe3..9078c273c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -121,7 +121,14 @@ wildcards = "warn"
 # unknown registry or an unvetted git source fails the build.
 unknown-registry = "deny"
 unknown-git = "deny"
-# Vetted git sources. The Context Graph Protocol crates (contextgraph-types,
-# contextgraph-host) live in their own repo and are consumed directly at a
-# pinned rev until they are published to crates.io.
-allow-git = ["https://github.com/macanderson/context-graph-protocol"]
+# No vetted git sources. The Context Graph Protocol crates (contextgraph-types,
+# contextgraph-host, contextgraph-trace, contextgraph-conformance) were exempted
+# here while they were consumed at a pinned rev; they are published to crates.io
+# as of 0.1.2 and are now ordinary registry dependencies (#819).
+#
+# Deliberately left EMPTY rather than deleted: an empty allow-list is the
+# statement that no git source is vetted, so re-introducing one is a visible
+# edit to this file and not a silent addition to an existing exemption. That
+# matters because the exemption above is what let the pin drift onto a commit
+# reachable from no branch at all.
+allow-git = []
diff --git a/stella-cli/Cargo.toml b/stella-cli/Cargo.toml
index 5ec90fcb8..8ac9aface 100644
--- a/stella-cli/Cargo.toml
+++ b/stella-cli/Cargo.toml
@@ -23,11 +23,13 @@ formula = "stella"
 
 [dependencies]
 stella-protocol = { path = "../stella-protocol" }
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
-contextgraph-host = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
+contextgraph-host.workspace = true
 # The host execution-trace journal + replay oracles (sketch stage) — the
-# vocabulary `stella arena` records for the arena-bench runner to judge.
-contextgraph-trace = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+# vocabulary `stella arena` records for the arena-bench runner to judge. Sketch
+# stage means its wire format is exempt from the protocol's stability promise;
+# see the exact-version note in the root manifest.
+contextgraph-trace.workspace = true
 stella-core = { path = "../stella-core" }
 # The construction sequence (provider/registry/store/budget/calibration),
 # extracted so this bin-only crate is no longer its sole owner and
@@ -74,12 +76,12 @@ rpassword.workspace = true
 # dropped intact into freed heap. `stella-model` already zeroizes the `ApiKey`
 # these become; this closes the same hole one layer up, at the terminal.
 zeroize.workspace = true
-# The protocol's own conformance suite (SPEC.md 3.6), pinned to the same rev as
-# the types/host we consume. A RUNTIME dependency, not just a dev one: #453
+# The protocol's own conformance suite (SPEC.md 3.6), held at the same version
+# as the types/host we consume. A RUNTIME dependency, not just a dev one: #453
 # makes conformance an install/enable-time ADMISSION GATE for external
 # stdio/HTTP providers, so a non-conformant source is refused before it can
 # serve a turn. The same suite still audits the in-tree providers in tests.
-contextgraph-conformance = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-conformance.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util"] }
diff --git a/stella-context/Cargo.toml b/stella-context/Cargo.toml
index 340949e1d..320dfeba1 100644
--- a/stella-context/Cargo.toml
+++ b/stella-context/Cargo.toml
@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
diff --git a/stella-graph/Cargo.toml b/stella-graph/Cargo.toml
index a4e30024d..f45f39c86 100644
--- a/stella-graph/Cargo.toml
+++ b/stella-graph/Cargo.toml
@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 # For the workspace's single durable-write + schema-version contract
 # (`stella_store::durable`, #617) — one implementation of temp + fsync +
 # rename, not one per crate.