fix(deps): consume the Context Graph Protocol crates from crates.io (#819)

CHANGELOG.md

@@ -35,6 +35,15 @@ skip the roll) were re-inserted the same way.
 
 ## [Unreleased]
 
+- The four Context Graph Protocol crates (`contextgraph-types`,
+  `contextgraph-host`, `contextgraph-trace`, `contextgraph-conformance`) are now
+  ordinary crates.io dependencies at `=0.1.2`, declared once in the root
+  manifest, instead of git dependencies pinned by commit rev (#819). Building
+  stella from source no longer reaches out to the protocol repository, the
+  lockfile carries a checksum for each of them, and `cargo audit` / `cargo vet`
+  can see them — none of which was true of a git rev. `deny.toml`'s `allow-git`
+  exemption is removed, so the workspace now has no vetted git sources at all.
+
 ## [0.6.57] — 2026-08-01
 
 ## [0.6.56] — 2026-08-01

Cargo.toml

@@ -32,6 +32,27 @@ homepage = "https://stella.oxagen.sh"
 publish = false
 
 [workspace.dependencies]
+# Context Graph Protocol — the wire types, host runtime, conformance suite, and
+# execution-trace vocabulary stella speaks (#819). Declared ONCE here so a
+# version bump is a one-line edit rather than six scattered across three member
+# manifests, which is how these drifted onto a git rev in the first place.
+#
+# These were `{ git = ..., rev = ... }` until #819. That pin named a commit
+# living on a history line this repository's upstream had since re-rooted away
+# from: it was on no branch and no PR, reachable only by raw SHA, and eligible
+# for garbage collection — a cold cargo cache away from breaking every build.
+# Registry versions get us a reviewable release, a checksum in Cargo.lock, and
+# an audit trail (`cargo audit`/`cargo vet` cannot see a git rev).
+#
+# `contextgraph-trace` is SKETCH STAGE and deliberately exempt from the
+# protocol's stability promise — its journal wire format may change in any 0.x
+# release. Gate behaviour on its `TRACE_FORMAT` constant, not on this version.
+# Hence exact `=` requirements: a silent minor bump here would change a wire
+# format `stella arena` writes to disk.
+contextgraph-types = "=0.1.2"
+contextgraph-host = "=0.1.2"
+contextgraph-trace = "=0.1.2"
+contextgraph-conformance = "=0.1.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # RFC 8785 JSON Canonicalization Scheme — pinned to the SAME version the Context

deny.toml

@@ -121,7 +121,14 @@ wildcards = "warn"
 # unknown registry or an unvetted git source fails the build.
 unknown-registry = "deny"
 unknown-git = "deny"
-# Vetted git sources. The Context Graph Protocol crates (contextgraph-types,
-# contextgraph-host) live in their own repo and are consumed directly at a
-# pinned rev until they are published to crates.io.
-allow-git = ["https://github.com/macanderson/context-graph-protocol"]
+# No vetted git sources. The Context Graph Protocol crates (contextgraph-types,
+# contextgraph-host, contextgraph-trace, contextgraph-conformance) were exempted
+# here while they were consumed at a pinned rev; they are published to crates.io
+# as of 0.1.2 and are now ordinary registry dependencies (#819).
+#
+# Deliberately left EMPTY rather than deleted: an empty allow-list is the
+# statement that no git source is vetted, so re-introducing one is a visible
+# edit to this file and not a silent addition to an existing exemption. That
+# matters because the exemption above is what let the pin drift onto a commit
+# reachable from no branch at all.
+allow-git = []

stella-cli/Cargo.toml

@@ -23,11 +23,13 @@ formula = "stella"
 
 [dependencies]
 stella-protocol = { path = "../stella-protocol" }
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
-contextgraph-host = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
+contextgraph-host.workspace = true
 # The host execution-trace journal + replay oracles (sketch stage) — the
-# vocabulary `stella arena` records for the arena-bench runner to judge.
-contextgraph-trace = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+# vocabulary `stella arena` records for the arena-bench runner to judge. Sketch
+# stage means its wire format is exempt from the protocol's stability promise;
+# see the exact-version note in the root manifest.
+contextgraph-trace.workspace = true
 stella-core = { path = "../stella-core" }
 # The construction sequence (provider/registry/store/budget/calibration),
 # extracted so this bin-only crate is no longer its sole owner and
@@ -74,12 +76,12 @@ rpassword.workspace = true
 # dropped intact into freed heap. `stella-model` already zeroizes the `ApiKey`
 # these become; this closes the same hole one layer up, at the terminal.
 zeroize.workspace = true
-# The protocol's own conformance suite (SPEC.md 3.6), pinned to the same rev as
-# the types/host we consume. A RUNTIME dependency, not just a dev one: #453
+# The protocol's own conformance suite (SPEC.md 3.6), held at the same version
+# as the types/host we consume. A RUNTIME dependency, not just a dev one: #453
 # makes conformance an install/enable-time ADMISSION GATE for external
 # stdio/HTTP providers, so a non-conformant source is refused before it can
 # serve a turn. The same suite still audits the in-tree providers in tests.
-contextgraph-conformance = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-conformance.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util"] }

stella-context/Cargo.toml

@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true

stella-graph/Cargo.toml

@@ -9,7 +9,7 @@ repository.workspace = true
 publish.workspace = true
 
 [dependencies]
-contextgraph-types = { git = "https://github.com/macanderson/context-graph-protocol", rev = "c5fb2fec5820494ab6921dc088c03d7f43301fa7" }
+contextgraph-types.workspace = true
 # For the workspace's single durable-write + schema-version contract
 # (`stella_store::durable`, #617) — one implementation of temp + fsync +
 # rename, not one per crate.