From df71fe13488ba1aa8c68561de3764ebbc9b5b02d Mon Sep 17 00:00:00 2001
From: Stella Test <ops@oxagen.sh>
Date: Sat, 1 Aug 2026 10:55:15 -0700
Subject: [PATCH] fix(deps): consume the Context Graph Protocol crates from
 crates.io (#819)

stella-context, stella-graph, and stella-cli took contextgraph-types, -host,
-trace, and -conformance as git dependencies pinned by commit rev, repeated
across six lines in three manifests.

The pin was worse than the issue described. The rev it named -- c5fb2fec --
lived on a history line the protocol repository had since re-rooted away from:
it was on no branch and no PR upstream, reachable only by raw SHA, and eligible
for garbage collection. A cold cargo cache away from breaking every build, and
invisible to cargo audit / cargo vet, which cannot see a git source.

Two of the four crates could not simply be re-pointed at the published 0.1.0:
-host and -conformance had diverged from it, and -trace had never been
published at all. Fixed upstream first (context-graph-protocol#74): 0.1.2 is
cut from that repo's main, -trace is published, and contextgraph-types once
again ships src/record.rs, which 0.1.0 silently omitted.

Here, the four crates are declared ONCE in [workspace.dependencies] at =0.1.2,
so the next bump is a one-line edit rather than six. Exact requirements because
contextgraph-trace is sketch stage -- a silent minor bump would change a wire
format stella arena writes to disk.

Also removes deny.toml's allow-git exemption, whose own comment scoped it to
'until they are published to crates.io'. The workspace now has no vetted git
sources; cargo deny check sources passes with an empty allow-list.
---
 CHANGELOG.md              |  9 +++++++++
 Cargo.lock                | 20 ++++++++++++--------
 Cargo.toml                | 21 +++++++++++++++++++++
 deny.toml                 | 15 +++++++++++----
 stella-cli/Cargo.toml     | 16 +++++++++-------
 stella-context/Cargo.toml |  2 +-
 stella-graph/Cargo.toml   |  2 +-
 7 files changed, 64 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fda28bf8f..9ec50abcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,15 @@ skip the roll) were re-inserted the same way.
 
 ## [Unreleased]
 
+- The four Context Graph Protocol crates (`contextgraph-types`,
+  `contextgraph-host`, `contextgraph-trace`, `contextgraph-conformance`) are now
+  ordinary crates.io dependencies at `=0.1.2`, declared once in the root
+  manifest, instead of git dependencies pinned by commit rev (#819). Building
+  stella from source no longer reaches out to the protocol repository, the
+  lockfile carries a checksum for each of them, and `cargo audit` / `cargo vet`
+  can see them — none of which was true of a git rev. `deny.toml`'s `allow-git`
+  exemption is removed, so the workspace now has no vetted git sources at all.
+
 ## [0.6.54] — 2026-08-01
 
 ## [0.6.53] — 2026-08-01
diff --git a/Cargo.lock b/Cargo.lock
index d9bffd5ae..4f278a615 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -395,8 +395,9 @@ checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
 name = "contextgraph-conformance"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b65478f263db1e54f2665b7653db5ee57130a108e78ec3785dc26036a263f7cd"
 dependencies = [
  "async-trait",
  "clap",
@@ -411,8 +412,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-host"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edaf2a69d0e22494dcf0f890bad63edc436035d0116100215f650b3ca1d3f343"
 dependencies = [
  "async-trait",
  "contextgraph-types",
@@ -428,8 +430,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-trace"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d26ec325f040549af3ba16f6343b0e5d022e174185161d5a3334aca602731ca"
 dependencies = [
  "contextgraph-types",
  "serde",
@@ -439,8 +442,9 @@ dependencies = [
 
 [[package]]
 name = "contextgraph-types"
-version = "0.1.0"
-source = "git+https://github.com/macanderson/context-graph-protocol?rev=c5fb2fec5820494ab6921dc088c03d7f43301fa7#c5fb2fec5820494ab6921dc088c03d7f43301fa7"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85b7acbbe63ff3a0a5eb104c5e9a4a81c9ec6de57d535b7e5216daac54ba6974"
 dependencies = [
  "serde",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 65065b60a..398c185e7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,6 +32,27 @@ homepage = "https://stella.oxagen.sh"
 publish = false
 
 [workspace.dependencies]
+# Context Graph Protocol — the wire types, host runtime, conformance suite, and
+# execution-trace vocabulary stella speaks (#819). Declared ONCE here so a
+# version bump is a one-line edit rather than six scattered across three member
+# manifests, which is how these drifted onto a git rev in the first place.
+#
+# These were `{ git = ..., rev = ... }` until #819. That pin named a commit
+# living on a history line this repository's upstream had since re-rooted away
+# from: it was on no branch and no PR, reachable only by raw SHA, and eligible
+# for garbage collection — a cold cargo cache away from breaking every build.
+# Registry versions get us a reviewable release, a checksum in Cargo.lock, and
+# an audit trail (`cargo audit`/`cargo vet` cannot see a git rev).
+#
+# `contextgraph-trace` is SKETCH STAGE and deliberately exempt from the
+# protocol's stability promise — its journal wire format may change in any 0.x
+# release. Gate behaviour on its `TRACE_FORMAT` constant, not on this version.
+# Hence exact `=` requirements: a silent minor bump here would change a wire
+# format `stella arena` writes to disk.
+contextgraph-types = "=0.1.2"
+contextgraph-host = "=0.1.2"
+contextgraph-trace = "=0.1.2"
+contextgraph-conformance = "=0.1.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # RFC 8785 JSON Canonicalization Scheme — pinned to the SAME version the Context
diff --git a/deny.toml b/deny.toml
index b9d15dfe3..9078c273c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -121,7 +121,14 @@ wildcards = "warn"
 # unknown registry or an unvetted git source fails the build.
 unknown-registry = "deny"
 unknown-git = "deny"
-# Vetted git sources. The Context Graph Protocol crates (contextgraph-types,
-# contextgraph-host) live in their own repo and are consumed directly at a
-# pinned rev until they are published to crates.io.
-allow-git = ["https://github.com/macanderson/context-graph-protocol"]
+# No vetted git sources. The Context Graph Protocol crates (contextgraph-types,
+# contextgraph-host, contextgraph-trace, contextgraph-conformance) were exempted
+# here while they were consumed at a pinned rev; they are published to crates.io
+# as of 0.1.2 and are now ordinary registry dependencies (#819).
+#
+# Deliberately left EMPTY rather than deleted: an empty allow-list is the
+# statement that no git source is vetted, so re-introducing one is a visible
+# edit to this file and not a silent addition to an existing exemption. That
+# matters because the exemption above is what let the pin drift onto a commit
+# reachable from no branch at all.
+allow-git = []
diff --git a/stella-cli/Cargo.toml b/stella-cli/Cargo.toml
index 5ec90fcb8..8ac9aface 100644
--- a/stella-cli/Cargo.toml
+++ b/stella-cli/Cargo.toml
@@ -23,11 +23,13 @@ formula = "stella"
 
 [dependencies]
 stella-protocol = { path = "../stella-protocol" }
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
-contextgraph-host = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
+contextgraph-host.workspace = true
 # The host execution-trace journal + replay oracles (sketch stage) — the
-# vocabulary `stella arena` records for the arena-bench runner to judge.
-contextgraph-trace = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+# vocabulary `stella arena` records for the arena-bench runner to judge. Sketch
+# stage means its wire format is exempt from the protocol's stability promise;
+# see the exact-version note in the root manifest.
+contextgraph-trace.workspace = true
 stella-core = { path = "../stella-core" }
 # The construction sequence (provider/registry/store/budget/calibration),
 # extracted so this bin-only crate is no longer its sole owner and
@@ -74,12 +76,12 @@ rpassword.workspace = true
 # dropped intact into freed heap. `stella-model` already zeroizes the `ApiKey`
 # these become; this closes the same hole one layer up, at the terminal.
 zeroize.workspace = true
-# The protocol's own conformance suite (SPEC.md 3.6), pinned to the same rev as
-# the types/host we consume. A RUNTIME dependency, not just a dev one: #453
+# The protocol's own conformance suite (SPEC.md 3.6), held at the same version
+# as the types/host we consume. A RUNTIME dependency, not just a dev one: #453
 # makes conformance an install/enable-time ADMISSION GATE for external
 # stdio/HTTP providers, so a non-conformant source is refused before it can
 # serve a turn. The same suite still audits the in-tree providers in tests.
-contextgraph-conformance = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-conformance.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util"] }
diff --git a/stella-context/Cargo.toml b/stella-context/Cargo.toml
index 340949e1d..320dfeba1 100644
--- a/stella-context/Cargo.toml
+++ b/stella-context/Cargo.toml
@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
diff --git a/stella-graph/Cargo.toml b/stella-graph/Cargo.toml
index a4e30024d..f45f39c86 100644
--- a/stella-graph/Cargo.toml
+++ b/stella-graph/Cargo.toml
@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 # For the workspace's single durable-write + schema-version contract
 # (`stella_store::durable`, #617) — one implementation of temp + fsync +
 # rename, not one per crate.