lib

commit e748a00296afafc0ea93c3e760b66ac2068a227b
parent 43ddd67fb7833ba2a9840e12c7243564387ed88f
Author: triesap <tyson@radroots.org>
Date:   Tue,  4 Aug 2026 00:05:50 +0000

release: qualify package supply chains

- pin patched Nostr and rustls dependency resolutions
- enforce scoped advisory license and source policy
- validate normalized CycloneDX package inventories
- bind exceptions provenance and relay URL mitigation

Diffstat:
M
Cargo.lock
 | 
8
++++----
M
Cargo.toml
 | 
2
+-
A
contracts/releases/supply_chain.toml
 | 
109
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
crates/event_store/contracts/source_maintenance_v1.manifest.json
 | 
10
+++++-----
M
crates/event_store/contracts/source_maintenance_v1.manifest.sha256
 | 
2
+-
M
crates/event_store/src/generated/source_maintenance_manifest.rs
 | 
4
++--
M
crates/transport_nostr/src/relay.rs
 | 
7
+++++++
A
deny.toml
 | 
67
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
tools/xtask/src/contract/nip09_reconciliation.rs
 | 
2
+-
M
tools/xtask/src/contract/source_maintenance.rs
 | 
2
+-
M
tools/xtask/src/main.rs
 | 
3
+++
A
tools/xtask/src/supply_chain_qualification.rs
 | 
708
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

12 files changed, 909 insertions(+), 15 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
@@ -3362,9 +3362,9 @@ dependencies = [
 
 [[package]]
 name = "nostr"
-version = "0.44.2"
+version = "0.44.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3aa5e3b6a278ed061835fe1ee293b71641e6bf8b401cfe4e1834bbf4ef0a34e1"
+checksum = "c7d3d987ea7078dc36947cde532637c472a229426702e4331dd7667325378bd9"
 dependencies = [
  "aes",
  "base64 0.22.1",
@@ -5811,9 +5811,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/Cargo.toml b/Cargo.toml
@@ -183,7 +183,7 @@ keyring = { version = "3.6.3", default-features = false, features = [
   "linux-native-sync-persistent",
   "vendored",
 ] }
-nostr = { version = "0.44.2", default-features = false }
+nostr = { version = "0.44.7", default-features = false }
 nostr-relay-pool = { version = "0.44.0" }
 nostr-sdk = { version = "0.44.1" }
 num_cpus = { version = "1.17.0" }
diff --git a/contracts/releases/supply_chain.toml b/contracts/releases/supply_chain.toml
@@ -0,0 +1,109 @@
+schema_version = 1
+spec_id = "radroots.crates.release.v1"
+package_version = "0.1.0-alpha"
+
+[tools]
+cargo_deny = "0.19.8"
+cargo_cyclonedx = "0.5.9"
+
+[sbom]
+format = "json"
+spec_version = "1.5"
+target = "all"
+all_features = true
+source_date_epoch = 0
+
+[[advisory_exception]]
+id = "RUSTSEC-2024-0384"
+package = "instant"
+affected_version = "0.1.13"
+introduced_by = "nostr 0.44.7"
+classification = "unmaintained"
+mitigation = "No Radroots public API exposes instant; replace the dependency when upstream Nostr removes it."
+remove_when = "nostr >=0.45.0 stable"
+
+[[advisory_exception]]
+id = "RUSTSEC-2024-0421"
+package = "idna"
+affected_version = "0.5.0"
+introduced_by = "nostr 0.44.7 via url-fork 3.0.1"
+classification = "vulnerability"
+mitigation = "radroots_transport_nostr canonicalizes every relay URL with url >=2.5.4 before upstream Nostr receives it."
+remove_when = "nostr >=0.45.0 stable"
+
+[[advisory_exception]]
+id = "CARGO-YANKED-SPIN-0.9.8"
+package = "spin"
+affected_version = "0.9.8"
+introduced_by = "sqlx 0.9.0 via flume 0.12.0"
+classification = "yanked"
+mitigation = "The package has no RustSec vulnerability; the gate rejects every yanked name/version except this exact transitive dependency."
+remove_when = "sqlx no longer resolves flume 0.12.0 with spin 0.9.8"
+
+[[package]]
+name = "radroots_core"
+manifest_path = "crates/core/Cargo.toml"
+
+[[package]]
+name = "radroots_identity"
+manifest_path = "crates/identity/Cargo.toml"
+
+[[package]]
+name = "radroots_blossom"
+manifest_path = "crates/blossom/Cargo.toml"
+
+[[package]]
+name = "radroots_protocol"
+manifest_path = "crates/protocol/Cargo.toml"
+
+[[package]]
+name = "radroots_event"
+manifest_path = "crates/event/Cargo.toml"
+
+[[package]]
+name = "radroots_event_codec"
+manifest_path = "crates/event_codec/Cargo.toml"
+
+[[package]]
+name = "radroots_trade"
+manifest_path = "crates/trade/Cargo.toml"
+
+[[package]]
+name = "radroots_signing"
+manifest_path = "crates/signing/Cargo.toml"
+
+[[package]]
+name = "radroots_transport"
+manifest_path = "crates/transport/Cargo.toml"
+
+[[package]]
+name = "radroots_nostr"
+manifest_path = "crates/nostr/Cargo.toml"
+
+[[package]]
+name = "radroots_nostr_connect"
+manifest_path = "crates/nostr_connect/Cargo.toml"
+
+[[package]]
+name = "radroots_secrets"
+manifest_path = "crates/secrets/Cargo.toml"
+
+[[package]]
+name = "radroots_storage"
+manifest_path = "crates/storage/Cargo.toml"
+
+[[package]]
+name = "radroots_storage_sqlite"
+manifest_path = "crates/storage_sqlite/Cargo.toml"
+
+[[package]]
+name = "radroots_transport_nostr"
+manifest_path = "crates/transport_nostr/Cargo.toml"
+
+[[package]]
+name = "radroots_sync"
+manifest_path = "crates/sync/Cargo.toml"
+
+[[package]]
+name = "radroots_geonames"
+manifest_path = "crates/geonames/Cargo.toml"
diff --git a/crates/event_store/contracts/source_maintenance_v1.manifest.json b/crates/event_store/contracts/source_maintenance_v1.manifest.json
@@ -153,7 +153,7 @@
       "role": "workspace_dependency_authority",
       "path": "Cargo.toml",
       "byte_length": 12664,
-      "sha256": "2498c6ce7f41a2543662f203f1043928c521c82ec6609761562e0d5e8d6754c0",
+      "sha256": "0070b6f53f8f2b8033869bf8418c92543bfc8a7e9ac27dc8db960d89f815e625",
       "hash_algorithm": "sha256_bytes_v1"
     },
     {
@@ -860,14 +860,14 @@
       "role": "transitive_predecessor_membership_governance",
       "path": "tools/xtask/src/contract/nip09_reconciliation.rs",
       "byte_length": 842433,
-      "sha256": "c5361d9da74ac6cbec1baa890818d5b00c935c5015c8e0cfaa9036a94fe2b69e",
+      "sha256": "6a8474d580d1165da4f89adca039811095f69a0601b4e74e652c22a42b9fc125",
       "hash_algorithm": "sha256_bytes_v1"
     },
     {
       "role": "source_maintenance_governance",
       "path": "tools/xtask/src/contract/source_maintenance.rs",
       "byte_length": 199270,
-      "sha256": "d2a1d4e14043fdff8908d5ce9062fca569a1ed4dd6ceacc9b5453d603e84b3b8",
+      "sha256": "a75fdd37990073a3f16e0ac771980a638641a2dc8ee317580aa100b41efc99de",
       "hash_algorithm": "sha256_bytes_v1"
     },
     {
@@ -887,8 +887,8 @@
     {
       "role": "xtask_dispatch_and_release_preflight",
       "path": "tools/xtask/src/main.rs",
-      "byte_length": 17242,
-      "sha256": "50524d502c0133dccf1f9d94f020b81ae6f588ca862509793a493dc978298683",
+      "byte_length": 17427,
+      "sha256": "c59c0ff0b3683756c309decd9e9a99ed3e037d186dd3590de56988be74d37289",
       "hash_algorithm": "sha256_bytes_v1"
     }
   ],
diff --git a/crates/event_store/contracts/source_maintenance_v1.manifest.sha256 b/crates/event_store/contracts/source_maintenance_v1.manifest.sha256
@@ -1 +1 @@
-ea015078a1f5e019d1fdd94e9537b8c6ab74e39746c2e719f134289408ed77c9
+ef03a4f87259e2d2d11b9b581d24f3109fbaac0789f02c7ded92bf6adbc5ec60
diff --git a/crates/event_store/src/generated/source_maintenance_manifest.rs b/crates/event_store/src/generated/source_maintenance_manifest.rs
@@ -1,8 +1,8 @@
 // @generated by `cargo xtask contract source-maintenance-manifest --write`; do not edit.
-pub(crate) const SOURCE_MAINTENANCE_MANIFEST_JSON: &str = "{\n  \"schema_version\": 1,\n  \"contract_id\": \"radroots_event_store.source_maintenance_v1\",\n  \"hook_id\": \"source_maintenance_v1\",\n  \"manifest_schema\": {\n    \"path\": \"crates/event_store/contracts/source_maintenance_v1.manifest.schema.json\",\n    \"byte_length\": 12315,\n    \"sha256\": \"96ea98a5abf3348b61565954cd34f2c622411d8dd34205ef04134bbe0e3d3f2b\",\n    \"hash_algorithm\": \"sha256_bytes_v1\"\n  },\n  \"predecessor\": {\n    \"hook_id\": \"food_availability_projection_v1\",\n    \"manifest\": {\n      \"path\": \"crates/event_store/contracts/food_availability_projection_v1.manifest.json\",\n      \"byte_length\": 17455,\n      \"sha256\": \"02dfe1b450fbdac16e718888215b4dd5c85d8975440fa21e8f439fb24c2b2990\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    }\n  },\n  \"migration\": {\n    \"version\": 4,\n    \"name\": \"source_maintenance\",\n    \"up\": {\n      \"path\": \"crates/event_store/migrations/0004_source_maintenance.up.sql\",\n      \"byte_length\": 19841,\n      \"sha256\": \"ab2724188f8d08c897eebea2533a635e7c74282a25e84e4c0c37e78b08837a43\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    \"down\": {\n      \"path\": \"crates/event_store/migrations/0004_source_maintenance.down.sql\",\n      \"byte_length\": 5172,\n      \"sha256\": \"fe44fd53c51545c08ea479b385e6781079dab70fc63da2a3c205d727a00ce860\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    \"schema_sha256\": \"074f85b663444ac150239ecd8441ea4a96ad83a798a55e22d2e5e2f7ee943a8c\",\n    \"catalog\": {\n      \"objects\": [\n        \"radroots_event_store_source_capacity_delete_guard\",\n        \"radroots_event_store_source_capacity_insert_guard\",\n        \"radroots_event_store_source_capacity_marker_close_guard\",\n        \"radroots_event_store_source_capacity_update_guard\",\n        \"radroots_event_store_source_capacity_v1\",\n        \"radroots_event_store_source_generation_capacity_advance\",\n        \"radroots_event_store_source_generation_capacity_guard\"\n      ],\n      \"replaced_objects\": [\n        \"radroots_event_store_food_availability_image_delete_guard\",\n        \"radroots_event_store_food_availability_projection_delete_guard\",\n        \"radroots_event_store_source_rebuild_marker_insert_guard\"\n      ],\n      \"tables\": [\n        \"radroots_event_store_source_capacity_v1\"\n      ],\n      \"fts5_tables\": []\n    }\n  },\n  \"source_maintenance\": {\n    \"version\": 1,\n    \"event_contract_registry_version\": 7,\n    \"capacity_authority_id\": \"radroots_event_store_source_capacity_v1\",\n    \"accounting\": {\n      \"algorithm\": \"sqlite_cast_blob_octet_sum_v1\",\n      \"raw_event_columns\": [\n        \"event_id\",\n        \"pubkey\",\n        \"tags_json\",\n        \"content\",\n        \"sig\",\n        \"raw_json\"\n      ],\n      \"raw_tag_columns\": [\n        \"event_id\",\n        \"tag_name\",\n        \"tag_value\",\n        \"tag_json\"\n      ],\n      \"nullable_raw_tag_columns\": [\n        \"tag_value\"\n      ]\n    },\n    \"limits\": {\n      \"raw_events\": 25000,\n      \"raw_tags\": 250000,\n      \"raw_event_text_bytes\": 67108864,\n      \"raw_tag_text_bytes\": 33554432,\n      \"retained_source_generations\": 8\n    },\n    \"reopen_validation\": {\n      \"mode\": \"bounded_full_raw_recount_v1\",\n      \"raw_event_rejection_scan_bound\": 25001,\n      \"raw_tag_rejection_scan_bound\": 250001,\n      \"generation_history_validation\": \"bounded_count_plus_active_ordinal_v1\",\n      \"retained_generation_rejection_scan_bound\": 9\n    },\n    \"rebuild_seal\": {\n      \"nip09_hook_id\": \"nip09_reconciliation_v1\",\n      \"nip09_manifest_sha256\": \"74af832420ffbaa9805e89df3c0b34f126a443e1598f757e3372f407f9003b77\",\n      \"food_hook_id\": \"food_availability_projection_v1\",\n      \"food_manifest_sha256\": \"02dfe1b450fbdac16e718888215b4dd5c85d8975440fa21e8f439fb24c2b2990\",\n      \"food_scope_fingerprint_sha256\": \"8b63c5ddc48a2cc7db69295238b96d5f814dba50427c80b4d0079f061e6d3de0\",\n      \"active_generation_authority\": \"radroots_event_store_source_state\",\n      \"marker_close_authority\": \"radroots_event_store_source_capacity_marker_close_guard\"\n    }\n  },\n  \"entry_points\": [\n    {\n      \"role\": \"migration_registry\",\n      \"rust_path\": \"radroots_event_store::migrations::EVENT_STORE_MIGRATIONS[3]\"\n    },\n    {\n      \"role\": \"migration_apply_hook\",\n      \"rust_path\": \"radroots_event_store::schema::apply_migration_hook\"\n    },\n    {\n      \"role\": \"migration_validation_hook\",\n      \"rust_path\": \"radroots_event_store::schema::validate_migration_hook_state\"\n    },\n    {\n      \"role\": \"capacity_query\",\n      \"rust_path\": \"radroots_event_store::RadrootsEventStore::source_capacity_v1\"\n    },\n    {\n      \"role\": \"raw_append_preflight\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::preflight_unique_raw_source_append_v1\"\n    },\n    {\n      \"role\": \"raw_append_advance\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::advance_source_capacity_after_insert_v1\"\n    },\n    {\n      \"role\": \"generation_append_preflight\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::preflight_source_generation_append_v1\"\n    },\n    {\n      \"role\": \"generation_rebuild_bind\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::bind_source_capacity_to_generation_v1\"\n    },\n    {\n      \"role\": \"sqlite_encoding_preflight\",\n      \"rust_path\": \"radroots_event_store::store::validate_main_database_encoding\"\n    },\n    {\n      \"role\": \"source_generation_history_rollback_guard\",\n      \"rust_path\": \"radroots_event_store::schema::validate_rollback_preserves_source_generation_history\"\n    },\n    {\n      \"role\": \"result_vector_executor\",\n      \"rust_path\": \"source_maintenance_v1_result_vector\"\n    }\n  ],\n  \"source_files\": [\n    {\n      \"role\": \"workspace_dependency_authority\",\n      \"path\": \"Cargo.toml\",\n      \"byte_length\": 12664,\n      \"sha256\": \"2498c6ce7f41a2543662f203f1043928c521c82ec6609761562e0d5e8d6754c0\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_currency_value_authority\",\n      \"path\": \"crates/core/src/currency.rs\",\n      \"byte_length\": 4142,\n      \"sha256\": \"42e6da2d8d2fdd6955dc2d83e98dd00266e02bc910b69923b117662c05089d14\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_decimal_value_authority\",\n      \"path\": \"crates/core/src/decimal.rs\",\n      \"byte_length\": 7839,\n      \"sha256\": \"4b1d681a92d7a9e074bee7e1f20eb1499bb05bfc6528a6c9ba69fa7d00416550\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_money_value_authority\",\n      \"path\": \"crates/core/src/money.rs\",\n      \"byte_length\": 8025,\n      \"sha256\": \"3f30bc21e21951a62fdc5d4033736ed42a883df590e8403940775bd2edfeebc5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_percent_value_authority\",\n      \"path\": \"crates/core/src/percent.rs\",\n      \"byte_length\": 2652,\n      \"sha256\": \"42ceab109881329f3539d06a0ee0381ab4359985fe185a18d58a9c9558c5eb7f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_quantity_value_authority\",\n      \"path\": \"crates/core/src/quantity.rs\",\n      \"byte_length\": 6785,\n      \"sha256\": \"d14e619da3829cdaf3ca7385fb892d330c286c1e21455c135c37518cbb588b5f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_quantity_price_value_authority\",\n      \"path\": \"crates/core/src/quantity_price.rs\",\n      \"byte_length\": 7061,\n      \"sha256\": \"d60f70377099470ed283f45868a5119d7bb46143cb250b5082a4c038ba7f6cdc\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_unit_value_authority\",\n      \"path\": \"crates/core/src/unit.rs\",\n      \"byte_length\": 10023,\n      \"sha256\": \"550e9582b6a5290aac3f637b83853b21fefcbab92c432d067c83448f4b2fe3e9\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_public_surface\",\n      \"path\": \"crates/blossom/src/lib.rs\",\n      \"byte_length\": 510,\n      \"sha256\": \"a4dfcbd193457c50c1b0fbfc91bb547981ecd3a6e23cfc6f1030edfb511dc58c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_authorization_authority\",\n      \"path\": \"crates/blossom/src/authorization.rs\",\n      \"byte_length\": 39360,\n      \"sha256\": \"461947b30516315a342b3b5697599f701d27050888f29f67f5d7a7ad4afa4c28\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_descriptor_authority\",\n      \"path\": \"crates/blossom/src/descriptor.rs\",\n      \"byte_length\": 13702,\n      \"sha256\": \"b2a4ffa760256e1316f70e012d200e2b5f4afd8ede771b85a5147f96b247f599\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_error_authority\",\n      \"path\": \"crates/blossom/src/error.rs\",\n      \"byte_length\": 17229,\n      \"sha256\": \"02af55beacf437040be17d1fc3271d6e2a62915f656ec2dbe06247deef83f95a\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_hash_authority\",\n      \"path\": \"crates/blossom/src/hash.rs\",\n      \"byte_length\": 11006,\n      \"sha256\": \"45eca0d81ac0f46c305a32f81aafcdd90b14679d0614f72862289a6e5d4cb08f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_media_type_authority\",\n      \"path\": \"crates/blossom/src/media_type.rs\",\n      \"byte_length\": 2368,\n      \"sha256\": \"69db5c0f9fcdd7dbe1f22daa499f65603ae4ce198083dab2c73a36813fa18a46\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_url_authority\",\n      \"path\": \"crates/blossom/src/url.rs\",\n      \"byte_length\": 14580,\n      \"sha256\": \"342c995fcf620e5fb32461a7d8276f5668ba2662890bd32d12780cc9121c6451\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_public_surface\",\n      \"path\": \"crates/event/src/lib.rs\",\n      \"byte_length\": 1892,\n      \"sha256\": \"5d609b963a9b8db18ef96a10f394617413734d2631774d3296e6d8fc029cb02c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_contract_facade\",\n      \"path\": \"crates/event/src/contract.rs\",\n      \"byte_length\": 208,\n      \"sha256\": \"27466bf36461071931f391c60646a13f7781d19584583166cc54c0eece76d010\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_contract_registry_v7_authority\",\n      \"path\": \"crates/event/src/contract/registry_v7.rs\",\n      \"byte_length\": 145805,\n      \"sha256\": \"0a62603f6fc05dc9f758561cf7da258c676ada810ceaeca7fb151364a5c83d62\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_envelope_authority\",\n      \"path\": \"crates/event/src/envelope.rs\",\n      \"byte_length\": 29310,\n      \"sha256\": \"29f8d8c4b17c01cb5a8c7f59e4ce52e134180e0e6f37d265063d278b8f2ff26e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_verification_typestate_authority\",\n      \"path\": \"crates/event/src/verification.rs\",\n      \"byte_length\": 9400,\n      \"sha256\": \"417acb2ce670d266b1fa4fcafd6b48a910218deab38f57fb8b942056db76f94d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_admission_typestate_authority\",\n      \"path\": \"crates/event/src/admission.rs\",\n      \"byte_length\": 7052,\n      \"sha256\": \"62bd2ceb0f434946fdfc2b81f4efb13738676a29a6936c23a427e43aadf2d9cb\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_head_facade\",\n      \"path\": \"crates/event/src/event_head.rs\",\n      \"byte_length\": 97,\n      \"sha256\": \"f761ff3e74c4f5e1e28381db00ce698c633ff048669b22984d14a587482e8e83\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_head_v1_authority\",\n      \"path\": \"crates/event/src/event_head/v1.rs\",\n      \"byte_length\": 6849,\n      \"sha256\": \"9f4144d8d240023cf493ce0b538ade4c16dc44204d6b5f2797152caf6f9e7dba\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_ids_authority\",\n      \"path\": \"crates/event/src/id.rs\",\n      \"byte_length\": 48381,\n      \"sha256\": \"a08fe3873815453a03318a706e2fa98a8a6728ec69d24368a87ec60025566fe0\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_trade_authority\",\n      \"path\": \"crates/event/src/trade.rs\",\n      \"byte_length\": 65549,\n      \"sha256\": \"f818a7287ed82de3fb9ef1d973f0fb18d84b30eb4827ddc576ee502dd980145f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_kinds_authority\",\n      \"path\": \"crates/event/src/kinds.rs\",\n      \"byte_length\": 34961,\n      \"sha256\": \"8b3ce6193cab1f7e1587d0c1b2880a81b0aa43c77d89671b602772db37edcebf\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_tags_authority\",\n      \"path\": \"crates/event/src/tags.rs\",\n      \"byte_length\": 4530,\n      \"sha256\": \"cb8f12a639fc72d9238e32495d9e67e928e6627fb8c94ec0a58c5d95e7373cd6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_draft_authority\",\n      \"path\": \"crates/event/src/draft.rs\",\n      \"byte_length\": 51150,\n      \"sha256\": \"ecc619aae28d688d13f35467398f17766b60f26c2bf3616d772ce65b7fa4fb53\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_calendar_authority\",\n      \"path\": \"crates/event/src/calendar.rs\",\n      \"byte_length\": 97992,\n      \"sha256\": \"73e79d61ee175cb46e6123e1d28239252ddf0ad094dc1113bdb1286b63b88d57\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_classified_listing_authority\",\n      \"path\": \"crates/event/src/classified_listing.rs\",\n      \"byte_length\": 7956,\n      \"sha256\": \"ac58484b87c7712c81f50f884d1c0dd60938571aa5f6f05d555191f529a4c2b0\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_profile_authority\",\n      \"path\": \"crates/event/src/profile.rs\",\n      \"byte_length\": 17011,\n      \"sha256\": \"572bfe3b6f1711d109db445077f0a8453cad3f021cc0638f79201b618e16b978\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_post_authority\",\n      \"path\": \"crates/event/src/post.rs\",\n      \"byte_length\": 19968,\n      \"sha256\": \"a822cd51eff9cbaa39db998cc5c90d117f7a983f0fe2d42d42118cb00e95982c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_comment_authority\",\n      \"path\": \"crates/event/src/comment.rs\",\n      \"byte_length\": 34896,\n      \"sha256\": \"a35b17418884c4c620e19b96d36a418db9d0065a5582f6b869a6bc6111f65bf6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_food_availability_authority\",\n      \"path\": \"crates/event/src/food_availability.rs\",\n      \"byte_length\": 42829,\n      \"sha256\": \"52472c07eb0855d884c60755dc3a3e1a963793451d707e51f769f2d78384f318\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_deletion_authority\",\n      \"path\": \"crates/event/src/deletion.rs\",\n      \"byte_length\": 30022,\n      \"sha256\": \"8c3f2e32407520a8e8242c1293af32613c648fb76218b8003a18929ac0b3811f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_dto_authority\",\n      \"path\": \"crates/event/src/dto.rs\",\n      \"byte_length\": 5038,\n      \"sha256\": \"9e228c95ff6ff33f99441d8682781fd0a1c4d3f1db24284a43985dcbac3ba136\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_farm_crdt_authority\",\n      \"path\": \"crates/event/src/farm_crdt.rs\",\n      \"byte_length\": 21118,\n      \"sha256\": \"cec265ac9c42b59a14be4eb96924d26a83477c27291f667f23e6e47a64b6b2c7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_knowledge_authority\",\n      \"path\": \"crates/event/src/knowledge.rs\",\n      \"byte_length\": 54624,\n      \"sha256\": \"3d55ff88a4e30d5d605f9ae4b2e96b9df6978d6c14e52f9aeb0b8039cfc200d7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_operational_listing_authority\",\n      \"path\": \"crates/event/src/operational_listing.rs\",\n      \"byte_length\": 10307,\n      \"sha256\": \"52e710db816c89c8d4b87c86541987f7447f2f7091c394c68d9cb98a27f90159\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_order_authority\",\n      \"path\": \"crates/event/src/order.rs\",\n      \"byte_length\": 60218,\n      \"sha256\": \"4203fcc469612cac5c705884564e140b9fb076cd57079e22ed85275a8b936e50\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_reply_authority\",\n      \"path\": \"crates/event/src/reply.rs\",\n      \"byte_length\": 15581,\n      \"sha256\": \"b0b83a1e96125c0892d932e9314519242a715fa8f46334aff765ffd248c91d9a\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_trade_validation_authority\",\n      \"path\": \"crates/event/src/trade_validation.rs\",\n      \"byte_length\": 4669,\n      \"sha256\": \"1486f79bd1d0eadea6cc1b7646ce1f7f57ccade18334a3ea37286426676b9b98\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_relay_hint_authority\",\n      \"path\": \"crates/event/src/relay_hint.rs\",\n      \"byte_length\": 13598,\n      \"sha256\": \"fb8b026eeccf51d78f20771c44223e7b48825aa0e3c760d6b3cb90148021a674\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_media_authority\",\n      \"path\": \"crates/event/src/media.rs\",\n      \"byte_length\": 3455,\n      \"sha256\": \"10678af3a202d5367dbcf3bcdc0bf9fdf8d8fb89b045d7d3fb96b3cc195ab6f9\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_social_authority\",\n      \"path\": \"crates/event/src/social.rs\",\n      \"byte_length\": 6076,\n      \"sha256\": \"a2dab19caad46eab14fac86e7c878a801a450d8ac374b0e728b71a5a224eef19\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_wire_facade\",\n      \"path\": \"crates/event/src/wire.rs\",\n      \"byte_length\": 68,\n      \"sha256\": \"cb52f6006f7ecd862707d6b048f9fc407e0cd5ebcd3091b3c54e195ffa5cba64\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_wire_v1_authority\",\n      \"path\": \"crates/event/src/wire/v1.rs\",\n      \"byte_length\": 22198,\n      \"sha256\": \"c818bc1f67e215948ba253c8c62b09ab788db9aeec9b6df8096014b55565cb8c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_public_surface\",\n      \"path\": \"crates/event_codec/src/lib.rs\",\n      \"byte_length\": 2448,\n      \"sha256\": \"7d4b0040ad3971f34395b17cb1aa40617e9c2c9e1b4222676c388c3adaa47e07\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_verification_facade\",\n      \"path\": \"crates/event_codec/src/verification.rs\",\n      \"byte_length\": 253,\n      \"sha256\": \"b49a32df605035c87f295c0a151140d43d2e588c5e11b05183e5fc92993dae0e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_verification_v1_authority\",\n      \"path\": \"crates/event_codec/src/verification/v1.rs\",\n      \"byte_length\": 6584,\n      \"sha256\": \"72f64615bd6b6dc3b051579e3069b2213f3781dcc28e12f0b533c7d81b81b9b1\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_registry_v7_admission_authority\",\n      \"path\": \"crates/event_codec/src/admission/registry_v7.rs\",\n      \"byte_length\": 5228,\n      \"sha256\": \"62da30cb6ef7d0ed2d43715a73bd529283e8ae8c12571bc5c68722cb400f17b8\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_admission_facade\",\n      \"path\": \"crates/event_codec/src/admission.rs\",\n      \"byte_length\": 21251,\n      \"sha256\": \"25928e734e7b3688f92af806a12a13458c48fb47e94249f60f0226300d5da2b4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_inbound_facade\",\n      \"path\": \"crates/event_codec/src/profile/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/profile/inbound/registry_v7.rs\",\n      \"byte_length\": 10347,\n      \"sha256\": \"32111c0e0592229c11a93a3a8054e7b124b039451aa696a9abcb56df2a6608d3\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_post_inbound_facade\",\n      \"path\": \"crates/event_codec/src/post/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_post_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/post/inbound/registry_v7.rs\",\n      \"byte_length\": 15985,\n      \"sha256\": \"e17083b0596e3a55994c399bc6272c0ebf04cabaa513260b3d45dd546f7f50ef\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_reply_inbound_facade\",\n      \"path\": \"crates/event_codec/src/reply/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_reply_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/reply/inbound/registry_v7.rs\",\n      \"byte_length\": 26662,\n      \"sha256\": \"d1d11116ca27801b7e2f17da60900e6a9ca0b6f27ea9ee0bf19e97dbf24c0c32\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_comment_inbound_facade\",\n      \"path\": \"crates/event_codec/src/comment/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_comment_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/comment/inbound/registry_v7.rs\",\n      \"byte_length\": 53311,\n      \"sha256\": \"c63fe853536b17bded6073f32b53434b60fc5123f911d01c642a6b3982f09c70\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_deletion_facade\",\n      \"path\": \"crates/event_codec/src/deletion/mod.rs\",\n      \"byte_length\": 115,\n      \"sha256\": \"17d56f82ddb0a86bc97abbcf3e037fe460ea31fff2548f527be4bf004dac3a95\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_deletion_reconciliation_v1_authority\",\n      \"path\": \"crates/event_codec/src/deletion/reconciliation_v1.rs\",\n      \"byte_length\": 38028,\n      \"sha256\": \"c6901f559e83700610595720c47a4d062078ae8411e1fc2fb952dd215b19dd90\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_error_authority\",\n      \"path\": \"crates/event_codec/src/error.rs\",\n      \"byte_length\": 3666,\n      \"sha256\": \"174ce982bca37fac28d016c3ab3236441c9b31b2169ec94db6c9288b36c72849\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_admission_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/admission.rs\",\n      \"byte_length\": 5681,\n      \"sha256\": \"99809859090f5295572688d06bbb30dbe50524ba2c996de7ec5b26f6dd390643\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_authored_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/authored.rs\",\n      \"byte_length\": 9724,\n      \"sha256\": \"8673ec62ed3fc47b691efd9ca828643719803971e72b756c5b4603d409d0fba5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_inbound_facade\",\n      \"path\": \"crates/event_codec/src/food_availability/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/inbound/registry_v7.rs\",\n      \"byte_length\": 26037,\n      \"sha256\": \"92a7e75da3293967cec17a514479144c3c948a64542577dd58c7f07992968e4f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_job_traits_authority\",\n      \"path\": \"crates/event_codec/src/job/traits.rs\",\n      \"byte_length\": 4946,\n      \"sha256\": \"1b3558a3196744005978dceddd33d3a72ad1ab8f50fb1cbfd997dcfe98bb9e39\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_job_encode_authority\",\n      \"path\": \"crates/event_codec/src/job/encode.rs\",\n      \"byte_length\": 1670,\n      \"sha256\": \"5d6cae6309fcdd02deb7c751b5c451d257cf1900986391cb39cbb2bfd1ddb577\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_knowledge_verification_authority\",\n      \"path\": \"crates/event_codec/src/knowledge/verification.rs\",\n      \"byte_length\": 6986,\n      \"sha256\": \"6f8a10ed262ce37f05acd9c89a1e37ca2fa99ce7da18407891e8abe228ee2349\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_operational_listing_tags_authority\",\n      \"path\": \"crates/event_codec/src/operational_listing/tags.rs\",\n      \"byte_length\": 50222,\n      \"sha256\": \"55b6860bc6f4699dd47a49f8336764e9db78aafb7c32849102dedeb96804b373\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_order_decode_authority\",\n      \"path\": \"crates/event_codec/src/order/decode.rs\",\n      \"byte_length\": 42667,\n      \"sha256\": \"033d9465bc041d205eab3f820572b719a35651340dcb50bdce7c60fabee5f6e1\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_facade\",\n      \"path\": \"crates/event_codec/src/profile/mod.rs\",\n      \"byte_length\": 1456,\n      \"sha256\": \"06b890da54580e2ec68f7e729281b7c3b650ac0a95a4fcb0db3c6cdaa591a7ef\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_tag_builders_authority\",\n      \"path\": \"crates/event_codec/src/tag_builders.rs\",\n      \"byte_length\": 9232,\n      \"sha256\": \"bd81ccf04fd72358331b48eddcde087a95e115c5bd90c05fd9332644979ad5e6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_trade_facade\",\n      \"path\": \"crates/event_codec/src/trade/mod.rs\",\n      \"byte_length\": 21472,\n      \"sha256\": \"10cee4b6cd6429ac9eb00327a521bcd0982fae4de98bda77e4728fda002965d3\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_dependency_authority\",\n      \"path\": \"crates/event_store/Cargo.toml\",\n      \"byte_length\": 1797,\n      \"sha256\": \"e79f4b69500553835e2cde28e7d9139788bebe6e2cd4e0b4ae72cc150491daf4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_error_and_limits\",\n      \"path\": \"crates/event_store/src/error.rs\",\n      \"byte_length\": 19458,\n      \"sha256\": \"3d87df984af6ae5decf7ca8c3a8d5422be6c647e6a05490225b6b2037bf3701b\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"generated_descriptor_registration\",\n      \"path\": \"crates/event_store/src/generated.rs\",\n      \"byte_length\": 144,\n      \"sha256\": \"6b0a8d6f249bd4fc3f878d37cb5e418680f0f1be2d9eec2518dedf03efc47121\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"public_surface\",\n      \"path\": \"crates/event_store/src/lib.rs\",\n      \"byte_length\": 3860,\n      \"sha256\": \"de1c5cc1ab36e1166d23e2b76aeae1d5f0f401cf07ce243590741c0126d02132\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"migration_registry\",\n      \"path\": \"crates/event_store/src/migrations.rs\",\n      \"byte_length\": 73585,\n      \"sha256\": \"a47477d04759ec6e71d14d3d05459864eae78fce0e3c2481a1b03147f04637f7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_model_public_surface\",\n      \"path\": \"crates/event_store/src/model.rs\",\n      \"byte_length\": 32070,\n      \"sha256\": \"2cdbf6d1a4e0fa6680f45f02758513509339a7cf3a2387e824fb73b0edf749a4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_reconciliation_v1_model\",\n      \"path\": \"crates/event_store/src/model/reconciliation_v1.rs\",\n      \"byte_length\": 10446,\n      \"sha256\": \"475b7b840bffdae7e3f7a31f5b940b9dfa579eaa1cac640729aaaeadabf83ba6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_reconciliation_v1_ingest_model\",\n      \"path\": \"crates/event_store/src/model/ingest_reconciliation_v1.rs\",\n      \"byte_length\": 1588,\n      \"sha256\": \"6117e797674c35bb1ccebffbc6a8c0108bfc38c7c9f82607066dfd802b8f0734\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"addressable_transition_feed_model\",\n      \"path\": \"crates/event_store/src/model/addressable_transition_feed_v1.rs\",\n      \"byte_length\": 22229,\n      \"sha256\": \"e651952d73ed0a29d2b137076f56f699beada205ac84ed8a96834e86e343fa78\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"current_visibility_model\",\n      \"path\": \"crates/event_store/src/model/current_visibility_v1.rs\",\n      \"byte_length\": 5634,\n      \"sha256\": \"d64429bc7985231e923c1c3e5295d94270a817dd5dc96693f35dfdf2dc398e4f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"food_projection_model\",\n      \"path\": \"crates/event_store/src/model/food_availability_projection_v1.rs\",\n      \"byte_length\": 17108,\n      \"sha256\": \"67861a966d674efbc40f0b0433db2ec006048ff923f6261df4161e2ddba717b5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_generation_rebuild_authority\",\n      \"path\": \"crates/event_store/src/nip09/reconciliation_v1.rs\",\n      \"byte_length\": 184833,\n      \"sha256\": \"3ca802cb7a8444c8512b2be1390a019281704316a430fb9b75a8ad2cad358a07\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"nip09_successor_result_vector_executor\",\n      \"path\": \"crates/event_store/tests/support/nip09_reconciliation_v1_result_vector_v2.rs\",\n      \"byte_length\": 18205,\n      \"sha256\": \"c632beee70dc777b8dd2a4f88cadb55296fee7aa5742e6e2c9f6d49f26ae2c78\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"schema_migration_and_reopen_authority\",\n      \"path\": \"crates/event_store/src/schema.rs\",\n      \"byte_length\": 146146,\n      \"sha256\": \"93b060e80d3edd73f86208e4bf698fa9d53eaf1eeb04526c9261fb8b5726fb0d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"public_store_and_transaction_authority\",\n      \"path\": \"crates/event_store/src/store.rs\",\n      \"byte_length\": 393218,\n      \"sha256\": \"64565c3bc043779e1c2f26d9761901b109b4acab0f48c2021102c0e4e1f1f726\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"addressable_transition_feed_store\",\n      \"path\": \"crates/event_store/src/store/addressable_transition_feed_v1.rs\",\n      \"byte_length\": 40209,\n      \"sha256\": \"2cebcca9602633652a79e7041d18d3a7d3feb1388a98f4f68137b9814efcedfa\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"current_visibility_store\",\n      \"path\": \"crates/event_store/src/store/current_visibility_v1.rs\",\n      \"byte_length\": 15737,\n      \"sha256\": \"aa5d1bff7a5368cbac2b37906bb40f54bfc8aa6906bab34369569fdd105bf899\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"food_projection_store\",\n      \"path\": \"crates/event_store/src/store/food_availability_projection_v1.rs\",\n      \"byte_length\": 48919,\n      \"sha256\": \"3a30da308ef863b806ed63d1cb65ac80f6a946a71821af84a0c595330491757e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_post_core_v1_extension\",\n      \"path\": \"crates/event_store/src/store/post_core_extensions_v1.rs\",\n      \"byte_length\": 6569,\n      \"sha256\": \"f5bd8ddb45e1b2144895bd8da737fc92db051be1844ce7e8047a32b47376ce37\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_post_core_v1_storage\",\n      \"path\": \"crates/event_store/src/store/post_core_storage_v1.rs\",\n      \"byte_length\": 16538,\n      \"sha256\": \"fcd6546c23a6cba12b70d92728d19b6ee5d43174b83495f820348b77efa33aab\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"raw_ingest_capacity_authority\",\n      \"path\": \"crates/event_store/src/store/protocol_reconciliation_v1.rs\",\n      \"byte_length\": 29950,\n      \"sha256\": \"c72aaff06e4f35d0b4523c6625e83345879f9e15b9fe9563dccf589e5d01e277\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_protocol_storage\",\n      \"path\": \"crates/event_store/src/store/protocol_storage_v1.rs\",\n      \"byte_length\": 10835,\n      \"sha256\": \"c82179b9f57968191f3e71dd008cc701787c62715ada74090eeecaa3b213076d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_maintenance_runtime\",\n      \"path\": \"crates/event_store/src/source_maintenance_v1.rs\",\n      \"byte_length\": 51849,\n      \"sha256\": \"db43df5849c811d767a87bfa7884ce499400d0b169734e18242542a4415b3a51\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_food_result_vector_executor\",\n      \"path\": \"crates/event_store/tests/food_availability_projection_v1_result_vector.rs\",\n      \"byte_length\": 34046,\n      \"sha256\": \"776903c6431ff07f26c6ad6b713db5628efce1a72f34d86de6e47d4404fa3a6d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"artifact_transaction_authority\",\n      \"path\": \"tools/xtask/src/contract/artifact_bundle.rs\",\n      \"byte_length\": 39149,\n      \"sha256\": \"3d1bba3980b80698d2a21e26caf7af6fe4d9dc4a7fbabc6e406b5d33928b457f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_successor_governance\",\n      \"path\": \"tools/xtask/src/contract/food_availability_projection.rs\",\n      \"byte_length\": 198991,\n      \"sha256\": \"36fd3d8b5dda3b0855a06a47dae14cae7f4cc84aaca9902c31477c218859fccc\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"transitive_predecessor_membership_governance\",\n      \"path\": \"tools/xtask/src/contract/nip09_reconciliation.rs\",\n      \"byte_length\": 842433,\n      \"sha256\": \"c5361d9da74ac6cbec1baa890818d5b00c935c5015c8e0cfaa9036a94fe2b69e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_maintenance_governance\",\n      \"path\": \"tools/xtask/src/contract/source_maintenance.rs\",\n      \"byte_length\": 199270,\n      \"sha256\": \"d2a1d4e14043fdff8908d5ce9062fca569a1ed4dd6ceacc9b5453d603e84b3b8\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"contract_command_authority\",\n      \"path\": \"tools/xtask/src/contract.rs\",\n      \"byte_length\": 515326,\n      \"sha256\": \"d6c0a6630ac30b88e571162c84e89509ebc72eda3f614b5cc3f456bedfe19f4b\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"dto_root_generation_authority\",\n      \"path\": \"tools/xtask/src/dto_roots.rs\",\n      \"byte_length\": 35940,\n      \"sha256\": \"a899a5695d7533c151d03477c4bd697a6e55c47a4980549724ac42046af694f5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"xtask_dispatch_and_release_preflight\",\n      \"path\": \"tools/xtask/src/main.rs\",\n      \"byte_length\": 17242,\n      \"sha256\": \"50524d502c0133dccf1f9d94f020b81ae6f588ca862509793a493dc978298683\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    }\n  ],\n  \"public_api\": {\n    \"inherited_predecessor_symbols\": [\n      \"RADROOTS_ADDRESSABLE_TRANSITION_CURSOR_JSON_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_D_TAG_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_FEED_VERSION_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_LIMIT_MAX_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_RAW_JSON_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_SCAN_MAX_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_SCOPE_KIND_MAX_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_PROJECTION_APPLY_PAGE_LIMIT_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_PROJECTION_VERSION_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_SEARCH_QUERY_MAX_BYTES_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_SEARCH_QUERY_MAX_TERMS_V1\",\n      \"RadrootsAddressableTransitionCauseV1\",\n      \"RadrootsAddressableTransitionCoordinateV1\",\n      \"RadrootsAddressableTransitionCursorV1\",\n      \"RadrootsAddressableTransitionEventReferenceV1\",\n      \"RadrootsAddressableTransitionOriginV1\",\n      \"RadrootsAddressableTransitionPageV1\",\n      \"RadrootsAddressableTransitionRawHeadDecisionV1\",\n      \"RadrootsAddressableTransitionScopeFingerprintV1\",\n      \"RadrootsAddressableTransitionScopeV1\",\n      \"RadrootsAddressableTransitionV1\",\n      \"RadrootsAddressableTransitionVisibilityV1\",\n      \"RadrootsCurrentEventVisibilityV1\",\n      \"RadrootsCurrentVisibilityDecisionV1\",\n      \"RadrootsFoodAvailabilitySearchQueryV1\",\n      \"RadrootsFoodAvailabilityStatusFilterV1\",\n      \"RadrootsNip09SuppressionEvidenceV1\",\n      \"RadrootsNip09SuppressionOutcome\",\n      \"RadrootsNip09SuppressionReason\",\n      \"RadrootsStoreProducedCanonicalEventV1\",\n      \"RadrootsStoredFoodAvailabilityImageV1\",\n      \"RadrootsStoredFoodAvailabilityV1\"\n    ],\n    \"added_symbols\": [\n      \"RADROOTS_EVENT_STORE_RAW_EVENT_COUNT_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_EVENT_TEXT_BYTES_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_TAG_COUNT_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_TAG_TEXT_BYTES_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RETAINED_SOURCE_GENERATION_LIMIT_V1\",\n      \"RadrootsEventStoreSourceCapacityResourceV1\",\n      \"RadrootsEventStoreSourceCapacityV1\"\n    ],\n    \"methods\": [\n      \"RadrootsEventStore::source_capacity_v1\",\n      \"RadrootsEventStoreSourceCapacityResourceV1::as_str\",\n      \"RadrootsEventStoreSourceCapacityV1::source_generation\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_event_count\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_tag_count\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_event_text_bytes\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_tag_text_bytes\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_high_water_seq\",\n      \"RadrootsEventStoreSourceCapacityV1::retained_generation_count\",\n      \"RadrootsEventStoreSourceCapacityV1::retained_generation_limit\"\n    ],\n    \"error_variants\": [\n      \"SourceCapacityExceeded\",\n      \"SourceGenerationHistoryLimitReached\",\n      \"PersistedEphemeralRawEvent\",\n      \"SourceCapacityStateDrift\",\n      \"SqliteMainDatabaseEncodingNotUtf8\",\n      \"RollbackWouldDiscardSourceGenerationHistory\"\n    ],\n    \"removed_symbols\": [\n      \"RadrootsEventStoreReconciliationResource\",\n      \"RadrootsEventStoreError::ReconciliationCapacityExceeded\"\n    ],\n    \"breaking_replacements\": [\n      {\n        \"removed\": \"RadrootsEventStoreReconciliationResource\",\n        \"replacement\": \"RadrootsEventStoreSourceCapacityResourceV1\"\n      },\n      {\n        \"removed\": \"RadrootsEventStoreError::ReconciliationCapacityExceeded\",\n        \"replacement\": \"RadrootsEventStoreError::SourceCapacityExceeded\"\n      }\n    ]\n  },\n  \"result_vector\": {\n    \"canonical_path\": \"contracts/conformance/vectors/event_store/source_maintenance.v1.json\",\n    \"mirror_path\": \"crates/event_store/tests/fixtures/source_maintenance.v1.json\",\n    \"byte_length\": 16253,\n    \"sha256\": \"997aba2604a2b9d199fb87dc9d07942ca50d91863aeadcf3eeacf16d191dd71f\",\n    \"hash_algorithm\": \"sha256_bytes_v1\",\n    \"executor_id\": \"radroots_event_store.source_maintenance_v1.result_vector_executor.v1\",\n    \"executor_path\": \"crates/event_store/tests/source_maintenance_v1_result_vector.rs\",\n    \"executor_test\": \"source_maintenance_v1_result_vector\",\n    \"executor_byte_length\": 23510,\n    \"executor_sha256\": \"a7487afdfe19fc5fc794811d0f0e6035203e1aabcf0a33a1d398f6b3555d38f3\",\n    \"executor_hash_algorithm\": \"sha256_bytes_v1\"\n  }\n}\n";
+pub(crate) const SOURCE_MAINTENANCE_MANIFEST_JSON: &str = "{\n  \"schema_version\": 1,\n  \"contract_id\": \"radroots_event_store.source_maintenance_v1\",\n  \"hook_id\": \"source_maintenance_v1\",\n  \"manifest_schema\": {\n    \"path\": \"crates/event_store/contracts/source_maintenance_v1.manifest.schema.json\",\n    \"byte_length\": 12315,\n    \"sha256\": \"96ea98a5abf3348b61565954cd34f2c622411d8dd34205ef04134bbe0e3d3f2b\",\n    \"hash_algorithm\": \"sha256_bytes_v1\"\n  },\n  \"predecessor\": {\n    \"hook_id\": \"food_availability_projection_v1\",\n    \"manifest\": {\n      \"path\": \"crates/event_store/contracts/food_availability_projection_v1.manifest.json\",\n      \"byte_length\": 17455,\n      \"sha256\": \"02dfe1b450fbdac16e718888215b4dd5c85d8975440fa21e8f439fb24c2b2990\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    }\n  },\n  \"migration\": {\n    \"version\": 4,\n    \"name\": \"source_maintenance\",\n    \"up\": {\n      \"path\": \"crates/event_store/migrations/0004_source_maintenance.up.sql\",\n      \"byte_length\": 19841,\n      \"sha256\": \"ab2724188f8d08c897eebea2533a635e7c74282a25e84e4c0c37e78b08837a43\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    \"down\": {\n      \"path\": \"crates/event_store/migrations/0004_source_maintenance.down.sql\",\n      \"byte_length\": 5172,\n      \"sha256\": \"fe44fd53c51545c08ea479b385e6781079dab70fc63da2a3c205d727a00ce860\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    \"schema_sha256\": \"074f85b663444ac150239ecd8441ea4a96ad83a798a55e22d2e5e2f7ee943a8c\",\n    \"catalog\": {\n      \"objects\": [\n        \"radroots_event_store_source_capacity_delete_guard\",\n        \"radroots_event_store_source_capacity_insert_guard\",\n        \"radroots_event_store_source_capacity_marker_close_guard\",\n        \"radroots_event_store_source_capacity_update_guard\",\n        \"radroots_event_store_source_capacity_v1\",\n        \"radroots_event_store_source_generation_capacity_advance\",\n        \"radroots_event_store_source_generation_capacity_guard\"\n      ],\n      \"replaced_objects\": [\n        \"radroots_event_store_food_availability_image_delete_guard\",\n        \"radroots_event_store_food_availability_projection_delete_guard\",\n        \"radroots_event_store_source_rebuild_marker_insert_guard\"\n      ],\n      \"tables\": [\n        \"radroots_event_store_source_capacity_v1\"\n      ],\n      \"fts5_tables\": []\n    }\n  },\n  \"source_maintenance\": {\n    \"version\": 1,\n    \"event_contract_registry_version\": 7,\n    \"capacity_authority_id\": \"radroots_event_store_source_capacity_v1\",\n    \"accounting\": {\n      \"algorithm\": \"sqlite_cast_blob_octet_sum_v1\",\n      \"raw_event_columns\": [\n        \"event_id\",\n        \"pubkey\",\n        \"tags_json\",\n        \"content\",\n        \"sig\",\n        \"raw_json\"\n      ],\n      \"raw_tag_columns\": [\n        \"event_id\",\n        \"tag_name\",\n        \"tag_value\",\n        \"tag_json\"\n      ],\n      \"nullable_raw_tag_columns\": [\n        \"tag_value\"\n      ]\n    },\n    \"limits\": {\n      \"raw_events\": 25000,\n      \"raw_tags\": 250000,\n      \"raw_event_text_bytes\": 67108864,\n      \"raw_tag_text_bytes\": 33554432,\n      \"retained_source_generations\": 8\n    },\n    \"reopen_validation\": {\n      \"mode\": \"bounded_full_raw_recount_v1\",\n      \"raw_event_rejection_scan_bound\": 25001,\n      \"raw_tag_rejection_scan_bound\": 250001,\n      \"generation_history_validation\": \"bounded_count_plus_active_ordinal_v1\",\n      \"retained_generation_rejection_scan_bound\": 9\n    },\n    \"rebuild_seal\": {\n      \"nip09_hook_id\": \"nip09_reconciliation_v1\",\n      \"nip09_manifest_sha256\": \"74af832420ffbaa9805e89df3c0b34f126a443e1598f757e3372f407f9003b77\",\n      \"food_hook_id\": \"food_availability_projection_v1\",\n      \"food_manifest_sha256\": \"02dfe1b450fbdac16e718888215b4dd5c85d8975440fa21e8f439fb24c2b2990\",\n      \"food_scope_fingerprint_sha256\": \"8b63c5ddc48a2cc7db69295238b96d5f814dba50427c80b4d0079f061e6d3de0\",\n      \"active_generation_authority\": \"radroots_event_store_source_state\",\n      \"marker_close_authority\": \"radroots_event_store_source_capacity_marker_close_guard\"\n    }\n  },\n  \"entry_points\": [\n    {\n      \"role\": \"migration_registry\",\n      \"rust_path\": \"radroots_event_store::migrations::EVENT_STORE_MIGRATIONS[3]\"\n    },\n    {\n      \"role\": \"migration_apply_hook\",\n      \"rust_path\": \"radroots_event_store::schema::apply_migration_hook\"\n    },\n    {\n      \"role\": \"migration_validation_hook\",\n      \"rust_path\": \"radroots_event_store::schema::validate_migration_hook_state\"\n    },\n    {\n      \"role\": \"capacity_query\",\n      \"rust_path\": \"radroots_event_store::RadrootsEventStore::source_capacity_v1\"\n    },\n    {\n      \"role\": \"raw_append_preflight\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::preflight_unique_raw_source_append_v1\"\n    },\n    {\n      \"role\": \"raw_append_advance\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::advance_source_capacity_after_insert_v1\"\n    },\n    {\n      \"role\": \"generation_append_preflight\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::preflight_source_generation_append_v1\"\n    },\n    {\n      \"role\": \"generation_rebuild_bind\",\n      \"rust_path\": \"radroots_event_store::source_maintenance_v1::bind_source_capacity_to_generation_v1\"\n    },\n    {\n      \"role\": \"sqlite_encoding_preflight\",\n      \"rust_path\": \"radroots_event_store::store::validate_main_database_encoding\"\n    },\n    {\n      \"role\": \"source_generation_history_rollback_guard\",\n      \"rust_path\": \"radroots_event_store::schema::validate_rollback_preserves_source_generation_history\"\n    },\n    {\n      \"role\": \"result_vector_executor\",\n      \"rust_path\": \"source_maintenance_v1_result_vector\"\n    }\n  ],\n  \"source_files\": [\n    {\n      \"role\": \"workspace_dependency_authority\",\n      \"path\": \"Cargo.toml\",\n      \"byte_length\": 12664,\n      \"sha256\": \"0070b6f53f8f2b8033869bf8418c92543bfc8a7e9ac27dc8db960d89f815e625\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_currency_value_authority\",\n      \"path\": \"crates/core/src/currency.rs\",\n      \"byte_length\": 4142,\n      \"sha256\": \"42e6da2d8d2fdd6955dc2d83e98dd00266e02bc910b69923b117662c05089d14\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_decimal_value_authority\",\n      \"path\": \"crates/core/src/decimal.rs\",\n      \"byte_length\": 7839,\n      \"sha256\": \"4b1d681a92d7a9e074bee7e1f20eb1499bb05bfc6528a6c9ba69fa7d00416550\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_money_value_authority\",\n      \"path\": \"crates/core/src/money.rs\",\n      \"byte_length\": 8025,\n      \"sha256\": \"3f30bc21e21951a62fdc5d4033736ed42a883df590e8403940775bd2edfeebc5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_percent_value_authority\",\n      \"path\": \"crates/core/src/percent.rs\",\n      \"byte_length\": 2652,\n      \"sha256\": \"42ceab109881329f3539d06a0ee0381ab4359985fe185a18d58a9c9558c5eb7f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_quantity_value_authority\",\n      \"path\": \"crates/core/src/quantity.rs\",\n      \"byte_length\": 6785,\n      \"sha256\": \"d14e619da3829cdaf3ca7385fb892d330c286c1e21455c135c37518cbb588b5f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_quantity_price_value_authority\",\n      \"path\": \"crates/core/src/quantity_price.rs\",\n      \"byte_length\": 7061,\n      \"sha256\": \"d60f70377099470ed283f45868a5119d7bb46143cb250b5082a4c038ba7f6cdc\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"core_unit_value_authority\",\n      \"path\": \"crates/core/src/unit.rs\",\n      \"byte_length\": 10023,\n      \"sha256\": \"550e9582b6a5290aac3f637b83853b21fefcbab92c432d067c83448f4b2fe3e9\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_public_surface\",\n      \"path\": \"crates/blossom/src/lib.rs\",\n      \"byte_length\": 510,\n      \"sha256\": \"a4dfcbd193457c50c1b0fbfc91bb547981ecd3a6e23cfc6f1030edfb511dc58c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_authorization_authority\",\n      \"path\": \"crates/blossom/src/authorization.rs\",\n      \"byte_length\": 39360,\n      \"sha256\": \"461947b30516315a342b3b5697599f701d27050888f29f67f5d7a7ad4afa4c28\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_descriptor_authority\",\n      \"path\": \"crates/blossom/src/descriptor.rs\",\n      \"byte_length\": 13702,\n      \"sha256\": \"b2a4ffa760256e1316f70e012d200e2b5f4afd8ede771b85a5147f96b247f599\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_error_authority\",\n      \"path\": \"crates/blossom/src/error.rs\",\n      \"byte_length\": 17229,\n      \"sha256\": \"02af55beacf437040be17d1fc3271d6e2a62915f656ec2dbe06247deef83f95a\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_hash_authority\",\n      \"path\": \"crates/blossom/src/hash.rs\",\n      \"byte_length\": 11006,\n      \"sha256\": \"45eca0d81ac0f46c305a32f81aafcdd90b14679d0614f72862289a6e5d4cb08f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_media_type_authority\",\n      \"path\": \"crates/blossom/src/media_type.rs\",\n      \"byte_length\": 2368,\n      \"sha256\": \"69db5c0f9fcdd7dbe1f22daa499f65603ae4ce198083dab2c73a36813fa18a46\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"blossom_url_authority\",\n      \"path\": \"crates/blossom/src/url.rs\",\n      \"byte_length\": 14580,\n      \"sha256\": \"342c995fcf620e5fb32461a7d8276f5668ba2662890bd32d12780cc9121c6451\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_public_surface\",\n      \"path\": \"crates/event/src/lib.rs\",\n      \"byte_length\": 1892,\n      \"sha256\": \"5d609b963a9b8db18ef96a10f394617413734d2631774d3296e6d8fc029cb02c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_contract_facade\",\n      \"path\": \"crates/event/src/contract.rs\",\n      \"byte_length\": 208,\n      \"sha256\": \"27466bf36461071931f391c60646a13f7781d19584583166cc54c0eece76d010\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_contract_registry_v7_authority\",\n      \"path\": \"crates/event/src/contract/registry_v7.rs\",\n      \"byte_length\": 145805,\n      \"sha256\": \"0a62603f6fc05dc9f758561cf7da258c676ada810ceaeca7fb151364a5c83d62\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_envelope_authority\",\n      \"path\": \"crates/event/src/envelope.rs\",\n      \"byte_length\": 29310,\n      \"sha256\": \"29f8d8c4b17c01cb5a8c7f59e4ce52e134180e0e6f37d265063d278b8f2ff26e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_verification_typestate_authority\",\n      \"path\": \"crates/event/src/verification.rs\",\n      \"byte_length\": 9400,\n      \"sha256\": \"417acb2ce670d266b1fa4fcafd6b48a910218deab38f57fb8b942056db76f94d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_admission_typestate_authority\",\n      \"path\": \"crates/event/src/admission.rs\",\n      \"byte_length\": 7052,\n      \"sha256\": \"62bd2ceb0f434946fdfc2b81f4efb13738676a29a6936c23a427e43aadf2d9cb\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_head_facade\",\n      \"path\": \"crates/event/src/event_head.rs\",\n      \"byte_length\": 97,\n      \"sha256\": \"f761ff3e74c4f5e1e28381db00ce698c633ff048669b22984d14a587482e8e83\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_head_v1_authority\",\n      \"path\": \"crates/event/src/event_head/v1.rs\",\n      \"byte_length\": 6849,\n      \"sha256\": \"9f4144d8d240023cf493ce0b538ade4c16dc44204d6b5f2797152caf6f9e7dba\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_ids_authority\",\n      \"path\": \"crates/event/src/id.rs\",\n      \"byte_length\": 48381,\n      \"sha256\": \"a08fe3873815453a03318a706e2fa98a8a6728ec69d24368a87ec60025566fe0\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_trade_authority\",\n      \"path\": \"crates/event/src/trade.rs\",\n      \"byte_length\": 65549,\n      \"sha256\": \"f818a7287ed82de3fb9ef1d973f0fb18d84b30eb4827ddc576ee502dd980145f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_kinds_authority\",\n      \"path\": \"crates/event/src/kinds.rs\",\n      \"byte_length\": 34961,\n      \"sha256\": \"8b3ce6193cab1f7e1587d0c1b2880a81b0aa43c77d89671b602772db37edcebf\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_tags_authority\",\n      \"path\": \"crates/event/src/tags.rs\",\n      \"byte_length\": 4530,\n      \"sha256\": \"cb8f12a639fc72d9238e32495d9e67e928e6627fb8c94ec0a58c5d95e7373cd6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_draft_authority\",\n      \"path\": \"crates/event/src/draft.rs\",\n      \"byte_length\": 51150,\n      \"sha256\": \"ecc619aae28d688d13f35467398f17766b60f26c2bf3616d772ce65b7fa4fb53\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_calendar_authority\",\n      \"path\": \"crates/event/src/calendar.rs\",\n      \"byte_length\": 97992,\n      \"sha256\": \"73e79d61ee175cb46e6123e1d28239252ddf0ad094dc1113bdb1286b63b88d57\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_classified_listing_authority\",\n      \"path\": \"crates/event/src/classified_listing.rs\",\n      \"byte_length\": 7956,\n      \"sha256\": \"ac58484b87c7712c81f50f884d1c0dd60938571aa5f6f05d555191f529a4c2b0\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_profile_authority\",\n      \"path\": \"crates/event/src/profile.rs\",\n      \"byte_length\": 17011,\n      \"sha256\": \"572bfe3b6f1711d109db445077f0a8453cad3f021cc0638f79201b618e16b978\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_post_authority\",\n      \"path\": \"crates/event/src/post.rs\",\n      \"byte_length\": 19968,\n      \"sha256\": \"a822cd51eff9cbaa39db998cc5c90d117f7a983f0fe2d42d42118cb00e95982c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_comment_authority\",\n      \"path\": \"crates/event/src/comment.rs\",\n      \"byte_length\": 34896,\n      \"sha256\": \"a35b17418884c4c620e19b96d36a418db9d0065a5582f6b869a6bc6111f65bf6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_food_availability_authority\",\n      \"path\": \"crates/event/src/food_availability.rs\",\n      \"byte_length\": 42829,\n      \"sha256\": \"52472c07eb0855d884c60755dc3a3e1a963793451d707e51f769f2d78384f318\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_deletion_authority\",\n      \"path\": \"crates/event/src/deletion.rs\",\n      \"byte_length\": 30022,\n      \"sha256\": \"8c3f2e32407520a8e8242c1293af32613c648fb76218b8003a18929ac0b3811f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_dto_authority\",\n      \"path\": \"crates/event/src/dto.rs\",\n      \"byte_length\": 5038,\n      \"sha256\": \"9e228c95ff6ff33f99441d8682781fd0a1c4d3f1db24284a43985dcbac3ba136\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_farm_crdt_authority\",\n      \"path\": \"crates/event/src/farm_crdt.rs\",\n      \"byte_length\": 21118,\n      \"sha256\": \"cec265ac9c42b59a14be4eb96924d26a83477c27291f667f23e6e47a64b6b2c7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_knowledge_authority\",\n      \"path\": \"crates/event/src/knowledge.rs\",\n      \"byte_length\": 54624,\n      \"sha256\": \"3d55ff88a4e30d5d605f9ae4b2e96b9df6978d6c14e52f9aeb0b8039cfc200d7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_operational_listing_authority\",\n      \"path\": \"crates/event/src/operational_listing.rs\",\n      \"byte_length\": 10307,\n      \"sha256\": \"52e710db816c89c8d4b87c86541987f7447f2f7091c394c68d9cb98a27f90159\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_order_authority\",\n      \"path\": \"crates/event/src/order.rs\",\n      \"byte_length\": 60218,\n      \"sha256\": \"4203fcc469612cac5c705884564e140b9fb076cd57079e22ed85275a8b936e50\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_reply_authority\",\n      \"path\": \"crates/event/src/reply.rs\",\n      \"byte_length\": 15581,\n      \"sha256\": \"b0b83a1e96125c0892d932e9314519242a715fa8f46334aff765ffd248c91d9a\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_trade_validation_authority\",\n      \"path\": \"crates/event/src/trade_validation.rs\",\n      \"byte_length\": 4669,\n      \"sha256\": \"1486f79bd1d0eadea6cc1b7646ce1f7f57ccade18334a3ea37286426676b9b98\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_relay_hint_authority\",\n      \"path\": \"crates/event/src/relay_hint.rs\",\n      \"byte_length\": 13598,\n      \"sha256\": \"fb8b026eeccf51d78f20771c44223e7b48825aa0e3c760d6b3cb90148021a674\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_media_authority\",\n      \"path\": \"crates/event/src/media.rs\",\n      \"byte_length\": 3455,\n      \"sha256\": \"10678af3a202d5367dbcf3bcdc0bf9fdf8d8fb89b045d7d3fb96b3cc195ab6f9\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_social_authority\",\n      \"path\": \"crates/event/src/social.rs\",\n      \"byte_length\": 6076,\n      \"sha256\": \"a2dab19caad46eab14fac86e7c878a801a450d8ac374b0e728b71a5a224eef19\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_wire_facade\",\n      \"path\": \"crates/event/src/wire.rs\",\n      \"byte_length\": 68,\n      \"sha256\": \"cb52f6006f7ecd862707d6b048f9fc407e0cd5ebcd3091b3c54e195ffa5cba64\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_wire_v1_authority\",\n      \"path\": \"crates/event/src/wire/v1.rs\",\n      \"byte_length\": 22198,\n      \"sha256\": \"c818bc1f67e215948ba253c8c62b09ab788db9aeec9b6df8096014b55565cb8c\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_public_surface\",\n      \"path\": \"crates/event_codec/src/lib.rs\",\n      \"byte_length\": 2448,\n      \"sha256\": \"7d4b0040ad3971f34395b17cb1aa40617e9c2c9e1b4222676c388c3adaa47e07\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_verification_facade\",\n      \"path\": \"crates/event_codec/src/verification.rs\",\n      \"byte_length\": 253,\n      \"sha256\": \"b49a32df605035c87f295c0a151140d43d2e588c5e11b05183e5fc92993dae0e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_verification_v1_authority\",\n      \"path\": \"crates/event_codec/src/verification/v1.rs\",\n      \"byte_length\": 6584,\n      \"sha256\": \"72f64615bd6b6dc3b051579e3069b2213f3781dcc28e12f0b533c7d81b81b9b1\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_registry_v7_admission_authority\",\n      \"path\": \"crates/event_codec/src/admission/registry_v7.rs\",\n      \"byte_length\": 5228,\n      \"sha256\": \"62da30cb6ef7d0ed2d43715a73bd529283e8ae8c12571bc5c68722cb400f17b8\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_admission_facade\",\n      \"path\": \"crates/event_codec/src/admission.rs\",\n      \"byte_length\": 21251,\n      \"sha256\": \"25928e734e7b3688f92af806a12a13458c48fb47e94249f60f0226300d5da2b4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_inbound_facade\",\n      \"path\": \"crates/event_codec/src/profile/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/profile/inbound/registry_v7.rs\",\n      \"byte_length\": 10347,\n      \"sha256\": \"32111c0e0592229c11a93a3a8054e7b124b039451aa696a9abcb56df2a6608d3\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_post_inbound_facade\",\n      \"path\": \"crates/event_codec/src/post/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_post_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/post/inbound/registry_v7.rs\",\n      \"byte_length\": 15985,\n      \"sha256\": \"e17083b0596e3a55994c399bc6272c0ebf04cabaa513260b3d45dd546f7f50ef\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_reply_inbound_facade\",\n      \"path\": \"crates/event_codec/src/reply/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_reply_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/reply/inbound/registry_v7.rs\",\n      \"byte_length\": 26662,\n      \"sha256\": \"d1d11116ca27801b7e2f17da60900e6a9ca0b6f27ea9ee0bf19e97dbf24c0c32\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_comment_inbound_facade\",\n      \"path\": \"crates/event_codec/src/comment/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_comment_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/comment/inbound/registry_v7.rs\",\n      \"byte_length\": 53311,\n      \"sha256\": \"c63fe853536b17bded6073f32b53434b60fc5123f911d01c642a6b3982f09c70\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_deletion_facade\",\n      \"path\": \"crates/event_codec/src/deletion/mod.rs\",\n      \"byte_length\": 115,\n      \"sha256\": \"17d56f82ddb0a86bc97abbcf3e037fe460ea31fff2548f527be4bf004dac3a95\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_deletion_reconciliation_v1_authority\",\n      \"path\": \"crates/event_codec/src/deletion/reconciliation_v1.rs\",\n      \"byte_length\": 38028,\n      \"sha256\": \"c6901f559e83700610595720c47a4d062078ae8411e1fc2fb952dd215b19dd90\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_error_authority\",\n      \"path\": \"crates/event_codec/src/error.rs\",\n      \"byte_length\": 3666,\n      \"sha256\": \"174ce982bca37fac28d016c3ab3236441c9b31b2169ec94db6c9288b36c72849\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_admission_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/admission.rs\",\n      \"byte_length\": 5681,\n      \"sha256\": \"99809859090f5295572688d06bbb30dbe50524ba2c996de7ec5b26f6dd390643\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_authored_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/authored.rs\",\n      \"byte_length\": 9724,\n      \"sha256\": \"8673ec62ed3fc47b691efd9ca828643719803971e72b756c5b4603d409d0fba5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_inbound_facade\",\n      \"path\": \"crates/event_codec/src/food_availability/inbound.rs\",\n      \"byte_length\": 86,\n      \"sha256\": \"9994cbca9dcc7450ad133b6b927e7c06bee08ef813652452cc1e56a284c1be10\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_food_registry_v7_authority\",\n      \"path\": \"crates/event_codec/src/food_availability/inbound/registry_v7.rs\",\n      \"byte_length\": 26037,\n      \"sha256\": \"92a7e75da3293967cec17a514479144c3c948a64542577dd58c7f07992968e4f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_job_traits_authority\",\n      \"path\": \"crates/event_codec/src/job/traits.rs\",\n      \"byte_length\": 4946,\n      \"sha256\": \"1b3558a3196744005978dceddd33d3a72ad1ab8f50fb1cbfd997dcfe98bb9e39\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_job_encode_authority\",\n      \"path\": \"crates/event_codec/src/job/encode.rs\",\n      \"byte_length\": 1670,\n      \"sha256\": \"5d6cae6309fcdd02deb7c751b5c451d257cf1900986391cb39cbb2bfd1ddb577\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_knowledge_verification_authority\",\n      \"path\": \"crates/event_codec/src/knowledge/verification.rs\",\n      \"byte_length\": 6986,\n      \"sha256\": \"6f8a10ed262ce37f05acd9c89a1e37ca2fa99ce7da18407891e8abe228ee2349\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_operational_listing_tags_authority\",\n      \"path\": \"crates/event_codec/src/operational_listing/tags.rs\",\n      \"byte_length\": 50222,\n      \"sha256\": \"55b6860bc6f4699dd47a49f8336764e9db78aafb7c32849102dedeb96804b373\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_order_decode_authority\",\n      \"path\": \"crates/event_codec/src/order/decode.rs\",\n      \"byte_length\": 42667,\n      \"sha256\": \"033d9465bc041d205eab3f820572b719a35651340dcb50bdce7c60fabee5f6e1\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_profile_facade\",\n      \"path\": \"crates/event_codec/src/profile/mod.rs\",\n      \"byte_length\": 1456,\n      \"sha256\": \"06b890da54580e2ec68f7e729281b7c3b650ac0a95a4fcb0db3c6cdaa591a7ef\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_tag_builders_authority\",\n      \"path\": \"crates/event_codec/src/tag_builders.rs\",\n      \"byte_length\": 9232,\n      \"sha256\": \"bd81ccf04fd72358331b48eddcde087a95e115c5bd90c05fd9332644979ad5e6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_codec_trade_facade\",\n      \"path\": \"crates/event_codec/src/trade/mod.rs\",\n      \"byte_length\": 21472,\n      \"sha256\": \"10cee4b6cd6429ac9eb00327a521bcd0982fae4de98bda77e4728fda002965d3\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_dependency_authority\",\n      \"path\": \"crates/event_store/Cargo.toml\",\n      \"byte_length\": 1797,\n      \"sha256\": \"e79f4b69500553835e2cde28e7d9139788bebe6e2cd4e0b4ae72cc150491daf4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_error_and_limits\",\n      \"path\": \"crates/event_store/src/error.rs\",\n      \"byte_length\": 19458,\n      \"sha256\": \"3d87df984af6ae5decf7ca8c3a8d5422be6c647e6a05490225b6b2037bf3701b\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"generated_descriptor_registration\",\n      \"path\": \"crates/event_store/src/generated.rs\",\n      \"byte_length\": 144,\n      \"sha256\": \"6b0a8d6f249bd4fc3f878d37cb5e418680f0f1be2d9eec2518dedf03efc47121\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"public_surface\",\n      \"path\": \"crates/event_store/src/lib.rs\",\n      \"byte_length\": 3860,\n      \"sha256\": \"de1c5cc1ab36e1166d23e2b76aeae1d5f0f401cf07ce243590741c0126d02132\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"migration_registry\",\n      \"path\": \"crates/event_store/src/migrations.rs\",\n      \"byte_length\": 73585,\n      \"sha256\": \"a47477d04759ec6e71d14d3d05459864eae78fce0e3c2481a1b03147f04637f7\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_model_public_surface\",\n      \"path\": \"crates/event_store/src/model.rs\",\n      \"byte_length\": 32070,\n      \"sha256\": \"2cdbf6d1a4e0fa6680f45f02758513509339a7cf3a2387e824fb73b0edf749a4\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_reconciliation_v1_model\",\n      \"path\": \"crates/event_store/src/model/reconciliation_v1.rs\",\n      \"byte_length\": 10446,\n      \"sha256\": \"475b7b840bffdae7e3f7a31f5b940b9dfa579eaa1cac640729aaaeadabf83ba6\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"event_store_reconciliation_v1_ingest_model\",\n      \"path\": \"crates/event_store/src/model/ingest_reconciliation_v1.rs\",\n      \"byte_length\": 1588,\n      \"sha256\": \"6117e797674c35bb1ccebffbc6a8c0108bfc38c7c9f82607066dfd802b8f0734\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"addressable_transition_feed_model\",\n      \"path\": \"crates/event_store/src/model/addressable_transition_feed_v1.rs\",\n      \"byte_length\": 22229,\n      \"sha256\": \"e651952d73ed0a29d2b137076f56f699beada205ac84ed8a96834e86e343fa78\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"current_visibility_model\",\n      \"path\": \"crates/event_store/src/model/current_visibility_v1.rs\",\n      \"byte_length\": 5634,\n      \"sha256\": \"d64429bc7985231e923c1c3e5295d94270a817dd5dc96693f35dfdf2dc398e4f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"food_projection_model\",\n      \"path\": \"crates/event_store/src/model/food_availability_projection_v1.rs\",\n      \"byte_length\": 17108,\n      \"sha256\": \"67861a966d674efbc40f0b0433db2ec006048ff923f6261df4161e2ddba717b5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_generation_rebuild_authority\",\n      \"path\": \"crates/event_store/src/nip09/reconciliation_v1.rs\",\n      \"byte_length\": 184833,\n      \"sha256\": \"3ca802cb7a8444c8512b2be1390a019281704316a430fb9b75a8ad2cad358a07\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"nip09_successor_result_vector_executor\",\n      \"path\": \"crates/event_store/tests/support/nip09_reconciliation_v1_result_vector_v2.rs\",\n      \"byte_length\": 18205,\n      \"sha256\": \"c632beee70dc777b8dd2a4f88cadb55296fee7aa5742e6e2c9f6d49f26ae2c78\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"schema_migration_and_reopen_authority\",\n      \"path\": \"crates/event_store/src/schema.rs\",\n      \"byte_length\": 146146,\n      \"sha256\": \"93b060e80d3edd73f86208e4bf698fa9d53eaf1eeb04526c9261fb8b5726fb0d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"public_store_and_transaction_authority\",\n      \"path\": \"crates/event_store/src/store.rs\",\n      \"byte_length\": 393218,\n      \"sha256\": \"64565c3bc043779e1c2f26d9761901b109b4acab0f48c2021102c0e4e1f1f726\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"addressable_transition_feed_store\",\n      \"path\": \"crates/event_store/src/store/addressable_transition_feed_v1.rs\",\n      \"byte_length\": 40209,\n      \"sha256\": \"2cebcca9602633652a79e7041d18d3a7d3feb1388a98f4f68137b9814efcedfa\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"current_visibility_store\",\n      \"path\": \"crates/event_store/src/store/current_visibility_v1.rs\",\n      \"byte_length\": 15737,\n      \"sha256\": \"aa5d1bff7a5368cbac2b37906bb40f54bfc8aa6906bab34369569fdd105bf899\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"food_projection_store\",\n      \"path\": \"crates/event_store/src/store/food_availability_projection_v1.rs\",\n      \"byte_length\": 48919,\n      \"sha256\": \"3a30da308ef863b806ed63d1cb65ac80f6a946a71821af84a0c595330491757e\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_post_core_v1_extension\",\n      \"path\": \"crates/event_store/src/store/post_core_extensions_v1.rs\",\n      \"byte_length\": 6569,\n      \"sha256\": \"f5bd8ddb45e1b2144895bd8da737fc92db051be1844ce7e8047a32b47376ce37\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_post_core_v1_storage\",\n      \"path\": \"crates/event_store/src/store/post_core_storage_v1.rs\",\n      \"byte_length\": 16538,\n      \"sha256\": \"fcd6546c23a6cba12b70d92728d19b6ee5d43174b83495f820348b77efa33aab\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"raw_ingest_capacity_authority\",\n      \"path\": \"crates/event_store/src/store/protocol_reconciliation_v1.rs\",\n      \"byte_length\": 29950,\n      \"sha256\": \"c72aaff06e4f35d0b4523c6625e83345879f9e15b9fe9563dccf589e5d01e277\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_protocol_storage\",\n      \"path\": \"crates/event_store/src/store/protocol_storage_v1.rs\",\n      \"byte_length\": 10835,\n      \"sha256\": \"c82179b9f57968191f3e71dd008cc701787c62715ada74090eeecaa3b213076d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_maintenance_runtime\",\n      \"path\": \"crates/event_store/src/source_maintenance_v1.rs\",\n      \"byte_length\": 51849,\n      \"sha256\": \"db43df5849c811d767a87bfa7884ce499400d0b169734e18242542a4415b3a51\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_food_result_vector_executor\",\n      \"path\": \"crates/event_store/tests/food_availability_projection_v1_result_vector.rs\",\n      \"byte_length\": 34046,\n      \"sha256\": \"776903c6431ff07f26c6ad6b713db5628efce1a72f34d86de6e47d4404fa3a6d\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"artifact_transaction_authority\",\n      \"path\": \"tools/xtask/src/contract/artifact_bundle.rs\",\n      \"byte_length\": 39149,\n      \"sha256\": \"3d1bba3980b80698d2a21e26caf7af6fe4d9dc4a7fbabc6e406b5d33928b457f\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"predecessor_successor_governance\",\n      \"path\": \"tools/xtask/src/contract/food_availability_projection.rs\",\n      \"byte_length\": 198991,\n      \"sha256\": \"36fd3d8b5dda3b0855a06a47dae14cae7f4cc84aaca9902c31477c218859fccc\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"transitive_predecessor_membership_governance\",\n      \"path\": \"tools/xtask/src/contract/nip09_reconciliation.rs\",\n      \"byte_length\": 842433,\n      \"sha256\": \"6a8474d580d1165da4f89adca039811095f69a0601b4e74e652c22a42b9fc125\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"source_maintenance_governance\",\n      \"path\": \"tools/xtask/src/contract/source_maintenance.rs\",\n      \"byte_length\": 199270,\n      \"sha256\": \"a75fdd37990073a3f16e0ac771980a638641a2dc8ee317580aa100b41efc99de\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"contract_command_authority\",\n      \"path\": \"tools/xtask/src/contract.rs\",\n      \"byte_length\": 515326,\n      \"sha256\": \"d6c0a6630ac30b88e571162c84e89509ebc72eda3f614b5cc3f456bedfe19f4b\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"dto_root_generation_authority\",\n      \"path\": \"tools/xtask/src/dto_roots.rs\",\n      \"byte_length\": 35940,\n      \"sha256\": \"a899a5695d7533c151d03477c4bd697a6e55c47a4980549724ac42046af694f5\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    },\n    {\n      \"role\": \"xtask_dispatch_and_release_preflight\",\n      \"path\": \"tools/xtask/src/main.rs\",\n      \"byte_length\": 17427,\n      \"sha256\": \"c59c0ff0b3683756c309decd9e9a99ed3e037d186dd3590de56988be74d37289\",\n      \"hash_algorithm\": \"sha256_bytes_v1\"\n    }\n  ],\n  \"public_api\": {\n    \"inherited_predecessor_symbols\": [\n      \"RADROOTS_ADDRESSABLE_TRANSITION_CURSOR_JSON_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_D_TAG_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_FEED_VERSION_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_LIMIT_MAX_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_RAW_JSON_MAX_BYTES_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_PAGE_SCAN_MAX_V1\",\n      \"RADROOTS_ADDRESSABLE_TRANSITION_SCOPE_KIND_MAX_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_PROJECTION_APPLY_PAGE_LIMIT_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_PROJECTION_VERSION_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_SEARCH_QUERY_MAX_BYTES_V1\",\n      \"RADROOTS_FOOD_AVAILABILITY_SEARCH_QUERY_MAX_TERMS_V1\",\n      \"RadrootsAddressableTransitionCauseV1\",\n      \"RadrootsAddressableTransitionCoordinateV1\",\n      \"RadrootsAddressableTransitionCursorV1\",\n      \"RadrootsAddressableTransitionEventReferenceV1\",\n      \"RadrootsAddressableTransitionOriginV1\",\n      \"RadrootsAddressableTransitionPageV1\",\n      \"RadrootsAddressableTransitionRawHeadDecisionV1\",\n      \"RadrootsAddressableTransitionScopeFingerprintV1\",\n      \"RadrootsAddressableTransitionScopeV1\",\n      \"RadrootsAddressableTransitionV1\",\n      \"RadrootsAddressableTransitionVisibilityV1\",\n      \"RadrootsCurrentEventVisibilityV1\",\n      \"RadrootsCurrentVisibilityDecisionV1\",\n      \"RadrootsFoodAvailabilitySearchQueryV1\",\n      \"RadrootsFoodAvailabilityStatusFilterV1\",\n      \"RadrootsNip09SuppressionEvidenceV1\",\n      \"RadrootsNip09SuppressionOutcome\",\n      \"RadrootsNip09SuppressionReason\",\n      \"RadrootsStoreProducedCanonicalEventV1\",\n      \"RadrootsStoredFoodAvailabilityImageV1\",\n      \"RadrootsStoredFoodAvailabilityV1\"\n    ],\n    \"added_symbols\": [\n      \"RADROOTS_EVENT_STORE_RAW_EVENT_COUNT_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_EVENT_TEXT_BYTES_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_TAG_COUNT_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RAW_TAG_TEXT_BYTES_LIMIT_V1\",\n      \"RADROOTS_EVENT_STORE_RETAINED_SOURCE_GENERATION_LIMIT_V1\",\n      \"RadrootsEventStoreSourceCapacityResourceV1\",\n      \"RadrootsEventStoreSourceCapacityV1\"\n    ],\n    \"methods\": [\n      \"RadrootsEventStore::source_capacity_v1\",\n      \"RadrootsEventStoreSourceCapacityResourceV1::as_str\",\n      \"RadrootsEventStoreSourceCapacityV1::source_generation\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_event_count\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_tag_count\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_event_text_bytes\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_tag_text_bytes\",\n      \"RadrootsEventStoreSourceCapacityV1::raw_high_water_seq\",\n      \"RadrootsEventStoreSourceCapacityV1::retained_generation_count\",\n      \"RadrootsEventStoreSourceCapacityV1::retained_generation_limit\"\n    ],\n    \"error_variants\": [\n      \"SourceCapacityExceeded\",\n      \"SourceGenerationHistoryLimitReached\",\n      \"PersistedEphemeralRawEvent\",\n      \"SourceCapacityStateDrift\",\n      \"SqliteMainDatabaseEncodingNotUtf8\",\n      \"RollbackWouldDiscardSourceGenerationHistory\"\n    ],\n    \"removed_symbols\": [\n      \"RadrootsEventStoreReconciliationResource\",\n      \"RadrootsEventStoreError::ReconciliationCapacityExceeded\"\n    ],\n    \"breaking_replacements\": [\n      {\n        \"removed\": \"RadrootsEventStoreReconciliationResource\",\n        \"replacement\": \"RadrootsEventStoreSourceCapacityResourceV1\"\n      },\n      {\n        \"removed\": \"RadrootsEventStoreError::ReconciliationCapacityExceeded\",\n        \"replacement\": \"RadrootsEventStoreError::SourceCapacityExceeded\"\n      }\n    ]\n  },\n  \"result_vector\": {\n    \"canonical_path\": \"contracts/conformance/vectors/event_store/source_maintenance.v1.json\",\n    \"mirror_path\": \"crates/event_store/tests/fixtures/source_maintenance.v1.json\",\n    \"byte_length\": 16253,\n    \"sha256\": \"997aba2604a2b9d199fb87dc9d07942ca50d91863aeadcf3eeacf16d191dd71f\",\n    \"hash_algorithm\": \"sha256_bytes_v1\",\n    \"executor_id\": \"radroots_event_store.source_maintenance_v1.result_vector_executor.v1\",\n    \"executor_path\": \"crates/event_store/tests/source_maintenance_v1_result_vector.rs\",\n    \"executor_test\": \"source_maintenance_v1_result_vector\",\n    \"executor_byte_length\": 23510,\n    \"executor_sha256\": \"a7487afdfe19fc5fc794811d0f0e6035203e1aabcf0a33a1d398f6b3555d38f3\",\n    \"executor_hash_algorithm\": \"sha256_bytes_v1\"\n  }\n}\n";
 pub(crate) const SOURCE_MAINTENANCE_MANIFEST_BYTE_LENGTH: usize = 38397;
 pub(crate) const SOURCE_MAINTENANCE_MANIFEST_SHA256: &str =
-    "ea015078a1f5e019d1fdd94e9537b8c6ab74e39746c2e719f134289408ed77c9";
+    "ef03a4f87259e2d2d11b9b581d24f3109fbaac0789f02c7ded92bf6adbc5ec60";
 pub(crate) const SOURCE_MAINTENANCE_MANIFEST_SCHEMA_VERSION: u32 = 1;
 pub(crate) const SOURCE_MAINTENANCE_CONTRACT_ID: &str =
     "radroots_event_store.source_maintenance_v1";
diff --git a/crates/transport_nostr/src/relay.rs b/crates/transport_nostr/src/relay.rs
@@ -368,6 +368,13 @@ mod tests {
     }
 
     #[test]
+    fn patched_url_parser_rejects_ascii_masking_punycode() {
+        for denied in ["wss://xn--example-.org", "wss://example.org.xn--"] {
+            assert!(RelayUrl::parse(denied, RelayUrlPolicy::Public).is_err());
+        }
+    }
+
+    #[test]
     fn resolved_addresses_are_revalidated() {
         let relay = RelayUrl::parse("wss://relay.example.com", RelayUrlPolicy::Public)
             .expect("public relay");
diff --git a/deny.toml b/deny.toml
@@ -0,0 +1,67 @@
+[graph]
+targets = [
+  "aarch64-apple-darwin",
+  "wasm32-unknown-unknown",
+  "x86_64-pc-windows-gnu",
+  "x86_64-unknown-linux-gnu",
+]
+all-features = true
+
+[advisories]
+# `nostr` 0.44.7 depends on `url-fork` 3.0.1 and therefore `idna` 0.5.0.
+# The only network-capable public adapter canonicalizes every relay URL with
+# patched `url` >=2.5.4 before the value reaches upstream Nostr code. This
+# exact exception is contract-bound and must be removed with the Nostr 0.45
+# stable upgrade.
+ignore = [
+  "RUSTSEC-2024-0384", # `instant` is an unmaintained, non-vulnerability Nostr 0.44 dependency.
+  "RUSTSEC-2024-0421",
+]
+
+[licenses]
+allow = [
+  "0BSD",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-1-Clause",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "CC0-1.0",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MIT-0",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Unlicense",
+  "Zlib",
+]
+confidence-threshold = 0.93
+
+[licenses.private]
+ignore = false
+registries = []
+
+[bans]
+multiple-versions = "allow"
+wildcards = "deny"
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+allow = []
+allow-workspace = true
+deny = []
+skip = []
+skip-tree = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
+
+[sources.allow-org]
+github = []
+gitlab = []
+bitbucket = []
diff --git a/tools/xtask/src/contract/nip09_reconciliation.rs b/tools/xtask/src/contract/nip09_reconciliation.rs
@@ -237,7 +237,7 @@ const GOVERNED_DEPENDENCY_TABLE_SHA256: [(&str, &str); 7] = [
     ),
     (
         "Cargo.toml#governed-workspace-dependencies",
-        "02e22f967966c6e67989554bfe643e057ac7ce6b1f3f40c897375432580d86b0",
+        "868e3c32af1495e3a262ce92f1fef7eba742cd0e34859f51ff39174b214905cb",
     ),
 ];
 
diff --git a/tools/xtask/src/contract/source_maintenance.rs b/tools/xtask/src/contract/source_maintenance.rs
@@ -79,7 +79,7 @@ const NIP09_SUCCESSOR_RESULT_VECTOR_EXECUTOR_ID: &str =
 const CONTRACT_COMMAND_SOURCE_RELATIVE: &str = "tools/xtask/src/contract.rs";
 const XTASK_MAIN_SOURCE_RELATIVE: &str = "tools/xtask/src/main.rs";
 const XTASK_MAIN_FULL_AST_SHA256: &str =
-    "26c07421588068c4ecc4dcad6067c9458f695a20479bee408374824e612bf67e";
+    "fe67e81610b2595b291530c5edb64909493e24ea78de1ecd4b8dadeca9ae97d5";
 
 const RAW_EVENT_COLUMNS: &[&str] = &[
     "event_id",
diff --git a/tools/xtask/src/main.rs b/tools/xtask/src/main.rs
@@ -17,6 +17,7 @@ mod generate;
 mod hygiene;
 mod portable_qualification;
 mod release_qualification;
+mod supply_chain_qualification;
 mod target_qualification;
 
 use std::env;
@@ -42,6 +43,7 @@ fn usage() {
     eprintln!("  cargo xtask release qualify-api");
     eprintln!("  cargo xtask release qualify-fuzz");
     eprintln!("  cargo xtask release qualify-portable");
+    eprintln!("  cargo xtask release qualify-supply-chain");
     eprintln!("  cargo xtask release qualify-targets");
     eprintln!("  cargo xtask coverage run-crate --crate <crate> [--out <dir>]");
     eprintln!("  cargo xtask coverage required-crates");
@@ -120,6 +122,7 @@ fn run_release(args: &[String]) -> Result<(), String> {
         Some("qualify-api") => api_qualification::run(&workspace_root()),
         Some("qualify-fuzz") => fuzz_qualification::run(&workspace_root()),
         Some("qualify-portable") => portable_qualification::run(&workspace_root()),
+        Some("qualify-supply-chain") => supply_chain_qualification::run(&workspace_root()),
         Some("qualify-targets") => target_qualification::run(&workspace_root()),
         _ => Err("unknown release subcommand".to_string()),
     }
diff --git a/tools/xtask/src/supply_chain_qualification.rs b/tools/xtask/src/supply_chain_qualification.rs
@@ -0,0 +1,708 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
+
+const CONTRACT_PATH: &str = "contracts/releases/supply_chain.toml";
+const DENY_PATH: &str = "deny.toml";
+const SBOM_FILENAME: &str = "radroots-release-v1-sbom.json";
+
+#[derive(Debug, Deserialize)]
+struct Contract {
+    schema_version: u16,
+    spec_id: String,
+    package_version: String,
+    tools: Tools,
+    sbom: Sbom,
+    advisory_exception: Vec<AdvisoryException>,
+    package: Vec<Package>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Tools {
+    cargo_deny: String,
+    cargo_cyclonedx: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct Sbom {
+    format: String,
+    spec_version: String,
+    target: String,
+    all_features: bool,
+    source_date_epoch: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+struct AdvisoryException {
+    id: String,
+    package: String,
+    affected_version: String,
+    introduced_by: String,
+    classification: String,
+    mitigation: String,
+    remove_when: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct Package {
+    name: String,
+    manifest_path: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct Metadata {
+    packages: Vec<MetadataPackage>,
+}
+
+#[derive(Debug, Deserialize)]
+struct MetadataPackage {
+    name: String,
+    version: String,
+    manifest_path: PathBuf,
+}
+
+struct GeneratedSboms(Vec<PathBuf>);
+
+impl Drop for GeneratedSboms {
+    fn drop(&mut self) {
+        for path in &self.0 {
+            let _ = fs::remove_file(path);
+        }
+    }
+}
+
+pub fn run(root: &Path) -> Result<(), String> {
+    let contract = load(root)?;
+    validate(root, &contract, 17)?;
+    verify_tools(&contract)?;
+    let metadata = load_metadata(root)?;
+    qualify_dependencies(root, &contract)?;
+    let sbom_hashes = qualify_sboms(root, &contract, &metadata)?;
+    let provenance = build_provenance(root, &contract, &sbom_hashes)?;
+    validate_provenance(&provenance, &contract)?;
+    eprintln!(
+        "qualified {} package supply chains; provenance sha256={}",
+        contract.package.len(),
+        sha256(&serde_json::to_vec(&provenance).map_err(|error| error.to_string())?)
+    );
+    Ok(())
+}
+
+fn load(root: &Path) -> Result<Contract, String> {
+    let path = root.join(CONTRACT_PATH);
+    let raw = fs::read_to_string(&path)
+        .map_err(|error| format!("failed to read {}: {error}", path.display()))?;
+    toml::from_str(&raw).map_err(|error| format!("failed to parse {}: {error}", path.display()))
+}
+
+fn validate(root: &Path, contract: &Contract, expected_packages: usize) -> Result<(), String> {
+    if contract.schema_version != 1
+        || contract.spec_id != "radroots.crates.release.v1"
+        || contract.package_version != "0.1.0-alpha"
+        || contract.tools.cargo_deny != "0.19.8"
+        || contract.tools.cargo_cyclonedx != "0.5.9"
+        || contract.sbom.format != "json"
+        || contract.sbom.spec_version != "1.5"
+        || contract.sbom.target != "all"
+        || !contract.sbom.all_features
+        || contract.sbom.source_date_epoch != 0
+    {
+        return Err("invalid supply-chain qualification contract".to_owned());
+    }
+
+    let names = contract
+        .package
+        .iter()
+        .map(|package| package.name.as_str())
+        .collect::<BTreeSet<_>>();
+    let manifests = contract
+        .package
+        .iter()
+        .map(|package| package.manifest_path.as_str())
+        .collect::<BTreeSet<_>>();
+    if names.len() != expected_packages
+        || names.len() != contract.package.len()
+        || manifests.len() != contract.package.len()
+    {
+        return Err(format!(
+            "supply-chain contract requires exactly {expected_packages} unique packages and manifests"
+        ));
+    }
+    for package in &contract.package {
+        let path = root.join(&package.manifest_path);
+        let raw = fs::read_to_string(&path)
+            .map_err(|error| format!("failed to read {}: {error}", path.display()))?;
+        let manifest: toml::Value = toml::from_str(&raw)
+            .map_err(|error| format!("failed to parse {}: {error}", path.display()))?;
+        let package_table = manifest
+            .get("package")
+            .and_then(toml::Value::as_table)
+            .ok_or_else(|| format!("{} has no package table", path.display()))?;
+        let name = package_table.get("name").and_then(toml::Value::as_str);
+        let version = package_table.get("version").and_then(toml::Value::as_str);
+        if name != Some(package.name.as_str()) || version != Some(contract.package_version.as_str())
+        {
+            return Err(format!(
+                "{} does not declare {} {}",
+                path.display(),
+                package.name,
+                contract.package_version
+            ));
+        }
+    }
+
+    validate_exceptions(root, contract)
+}
+
+fn validate_exceptions(root: &Path, contract: &Contract) -> Result<(), String> {
+    let expected = BTreeSet::from([
+        "CARGO-YANKED-SPIN-0.9.8".to_owned(),
+        "RUSTSEC-2024-0384".to_owned(),
+        "RUSTSEC-2024-0421".to_owned(),
+    ]);
+    let actual = contract
+        .advisory_exception
+        .iter()
+        .map(|exception| exception.id.clone())
+        .collect::<BTreeSet<_>>();
+    if actual != expected || actual.len() != contract.advisory_exception.len() {
+        return Err("supply-chain advisory exceptions are not the exact approved set".to_owned());
+    }
+    for exception in &contract.advisory_exception {
+        if exception.package.is_empty()
+            || exception.affected_version.is_empty()
+            || exception.introduced_by.is_empty()
+            || exception.classification.is_empty()
+            || exception.mitigation.is_empty()
+            || exception.remove_when.is_empty()
+        {
+            return Err(format!("advisory exception {} is incomplete", exception.id));
+        }
+        let exact = match exception.id.as_str() {
+            "RUSTSEC-2024-0384" => {
+                exception.package == "instant"
+                    && exception.affected_version == "0.1.13"
+                    && exception.classification == "unmaintained"
+                    && exception.remove_when == "nostr >=0.45.0 stable"
+            }
+            "RUSTSEC-2024-0421" => {
+                exception.package == "idna"
+                    && exception.affected_version == "0.5.0"
+                    && exception.classification == "vulnerability"
+                    && exception.remove_when == "nostr >=0.45.0 stable"
+            }
+            "CARGO-YANKED-SPIN-0.9.8" => {
+                exception.package == "spin"
+                    && exception.affected_version == "0.9.8"
+                    && exception.classification == "yanked"
+                    && exception.remove_when
+                        == "sqlx no longer resolves flume 0.12.0 with spin 0.9.8"
+            }
+            _ => false,
+        };
+        if !exact {
+            return Err(format!(
+                "advisory exception {} differs from its exact approved policy",
+                exception.id
+            ));
+        }
+    }
+
+    let lock_raw = fs::read_to_string(root.join("Cargo.lock"))
+        .map_err(|error| format!("failed to read Cargo.lock: {error}"))?;
+    let lock: toml::Value = toml::from_str(&lock_raw)
+        .map_err(|error| format!("failed to parse Cargo.lock: {error}"))?;
+    let locked_packages = lock
+        .get("package")
+        .and_then(toml::Value::as_array)
+        .ok_or_else(|| "Cargo.lock contains no packages".to_owned())?;
+    for exception in &contract.advisory_exception {
+        let present = locked_packages.iter().any(|package| {
+            package.get("name").and_then(toml::Value::as_str) == Some(exception.package.as_str())
+                && package.get("version").and_then(toml::Value::as_str)
+                    == Some(exception.affected_version.as_str())
+        });
+        if !present {
+            return Err(format!(
+                "advisory exception {} is stale because {} {} is absent from Cargo.lock",
+                exception.id, exception.package, exception.affected_version
+            ));
+        }
+    }
+    let patched_url_present = locked_packages.iter().any(|package| {
+        package.get("name").and_then(toml::Value::as_str) == Some("url")
+            && package
+                .get("version")
+                .and_then(toml::Value::as_str)
+                .and_then(|version| semver::Version::parse(version).ok())
+                .is_some_and(|version| version >= semver::Version::new(2, 5, 4))
+    });
+    if !patched_url_present {
+        return Err("the IDNA exception requires url 2.5.4 or newer in Cargo.lock".to_owned());
+    }
+
+    let deny_raw = fs::read_to_string(root.join(DENY_PATH))
+        .map_err(|error| format!("failed to read {DENY_PATH}: {error}"))?;
+    let deny: toml::Value = toml::from_str(&deny_raw)
+        .map_err(|error| format!("failed to parse {DENY_PATH}: {error}"))?;
+    let ignored = deny
+        .get("advisories")
+        .and_then(|value| value.get("ignore"))
+        .and_then(toml::Value::as_array)
+        .ok_or_else(|| "deny.toml advisories.ignore is missing".to_owned())?
+        .iter()
+        .filter_map(toml::Value::as_str)
+        .map(str::to_owned)
+        .collect::<BTreeSet<_>>();
+    let expected_ignored = expected
+        .iter()
+        .filter(|id| id.starts_with("RUSTSEC-"))
+        .cloned()
+        .collect::<BTreeSet<_>>();
+    if ignored != expected_ignored {
+        return Err("deny.toml advisory ignores differ from the governed exceptions".to_owned());
+    }
+
+    let relay_source = root.join("crates/transport_nostr/src/relay.rs");
+    if relay_source.exists() {
+        let source = fs::read_to_string(&relay_source)
+            .map_err(|error| format!("failed to read {}: {error}", relay_source.display()))?;
+        if !source.contains("Url::parse(canonical)") {
+            return Err(
+                "the IDNA exception requires patched relay URL canonicalization".to_owned(),
+            );
+        }
+    }
+    Ok(())
+}
+
+fn verify_tools(contract: &Contract) -> Result<(), String> {
+    verify_tool(
+        &["deny", "--version"],
+        "cargo-deny",
+        &contract.tools.cargo_deny,
+    )?;
+    verify_tool(
+        &["cyclonedx", "--version"],
+        "cargo-cyclonedx",
+        &contract.tools.cargo_cyclonedx,
+    )
+}
+
+fn verify_tool(args: &[&str], name: &str, expected: &str) -> Result<(), String> {
+    let output = Command::new("cargo")
+        .args(args)
+        .output()
+        .map_err(|error| format!("failed to start {name}: {error}"))?;
+    if !output.status.success() {
+        return Err(format!("{name} {expected} is required"));
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let installed = stdout
+        .split_whitespace()
+        .find_map(|value| semver::Version::parse(value).ok())
+        .ok_or_else(|| format!("could not parse {name} version: {stdout}"))?;
+    let expected = semver::Version::parse(expected)
+        .map_err(|error| format!("invalid governed {name} version: {error}"))?;
+    if installed != expected {
+        return Err(format!("{name} {expected} is required, found {installed}"));
+    }
+    Ok(())
+}
+
+fn load_metadata(root: &Path) -> Result<Metadata, String> {
+    let output = Command::new("cargo")
+        .args(["metadata", "--format-version", "1", "--locked", "--no-deps"])
+        .current_dir(root)
+        .output()
+        .map_err(|error| format!("failed to start cargo metadata: {error}"))?;
+    if !output.status.success() {
+        return Err("locked cargo metadata failed".to_owned());
+    }
+    serde_json::from_slice(&output.stdout)
+        .map_err(|error| format!("failed to parse cargo metadata: {error}"))
+}
+
+fn qualify_dependencies(root: &Path, contract: &Contract) -> Result<(), String> {
+    let mut saw_governed_yank = false;
+    for package in &contract.package {
+        let manifest = root.join(&package.manifest_path);
+        let common = [
+            "deny",
+            "-L",
+            "error",
+            "--manifest-path",
+            manifest
+                .to_str()
+                .ok_or_else(|| "non-UTF-8 package manifest path".to_owned())?,
+            "--all-features",
+            "--locked",
+            "check",
+        ];
+        saw_governed_yank |= qualify_advisories(root, &manifest, &package.name)?;
+        run_command(
+            root,
+            "cargo",
+            common
+                .iter()
+                .copied()
+                .chain(["bans", "licenses", "sources"])
+                .collect::<Vec<_>>(),
+            &format!("dependency policy failed for {}", package.name),
+        )?;
+    }
+    if !saw_governed_yank {
+        return Err("the governed spin 0.9.8 yank is stale and must be removed".to_owned());
+    }
+    Ok(())
+}
+
+fn qualify_advisories(root: &Path, manifest: &Path, package: &str) -> Result<bool, String> {
+    let output = Command::new("cargo")
+        .args([
+            "deny",
+            "--format",
+            "json",
+            "--log-level",
+            "warn",
+            "--manifest-path",
+            manifest
+                .to_str()
+                .ok_or_else(|| "non-UTF-8 package manifest path".to_owned())?,
+            "--all-features",
+            "--locked",
+            "check",
+            "--allow",
+            "advisory-not-detected",
+            "advisories",
+        ])
+        .current_dir(root)
+        .output()
+        .map_err(|error| format!("failed to start cargo-deny: {error}"))?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    if !output.status.success() {
+        return Err(format!(
+            "advisory qualification failed for {package}: {stdout}{stderr}"
+        ));
+    }
+
+    let mut saw_governed_yank = false;
+    for line in stdout.lines().chain(stderr.lines()) {
+        let Ok(message) = serde_json::from_str::<Value>(line) else {
+            continue;
+        };
+        if message.get("type").and_then(Value::as_str) != Some("diagnostic") {
+            continue;
+        }
+        let fields = message
+            .get("fields")
+            .and_then(Value::as_object)
+            .ok_or_else(|| "cargo-deny emitted a malformed diagnostic".to_owned())?;
+        let code = fields
+            .get("code")
+            .and_then(Value::as_str)
+            .unwrap_or_default();
+        let krate = fields
+            .get("graphs")
+            .and_then(Value::as_array)
+            .and_then(|graphs| graphs.first())
+            .and_then(|graph| graph.get("Krate"));
+        let exact_governed_yank = code == "yanked"
+            && krate
+                .and_then(|krate| krate.get("name"))
+                .and_then(Value::as_str)
+                == Some("spin")
+            && krate
+                .and_then(|krate| krate.get("version"))
+                .and_then(Value::as_str)
+                == Some("0.9.8");
+        if exact_governed_yank {
+            saw_governed_yank = true;
+        } else {
+            return Err(format!(
+                "unapproved cargo-deny diagnostic for {package}: {line}"
+            ));
+        }
+    }
+    Ok(saw_governed_yank)
+}
+
+fn qualify_sboms(
+    root: &Path,
+    contract: &Contract,
+    metadata: &Metadata,
+) -> Result<BTreeMap<String, String>, String> {
+    let mut paths = metadata
+        .packages
+        .iter()
+        .map(|package| {
+            package
+                .manifest_path
+                .parent()
+                .expect("manifest has parent")
+                .join(SBOM_FILENAME)
+        })
+        .collect::<Vec<_>>();
+    paths.sort();
+    paths.dedup();
+    if let Some(path) = paths.iter().find(|path| path.exists()) {
+        return Err(format!(
+            "refusing to overwrite pre-existing SBOM {}",
+            path.display()
+        ));
+    }
+    let _generated = GeneratedSboms(paths);
+
+    let status = Command::new("cargo")
+        .args([
+            "cyclonedx",
+            "--quiet",
+            "--manifest-path",
+            "Cargo.toml",
+            "--format",
+            &contract.sbom.format,
+            "--all-features",
+            "--target",
+            &contract.sbom.target,
+            "--spec-version",
+            &contract.sbom.spec_version,
+            "--license-strict",
+            "--license-accept-named",
+            "MIT/Apache-2.0",
+            "--license-accept-named",
+            "Apache-2.0/MIT",
+            "--license-accept-named",
+            "Apache-2.0 / MIT",
+            "--override-filename",
+            "radroots-release-v1-sbom",
+        ])
+        .env(
+            "SOURCE_DATE_EPOCH",
+            contract.sbom.source_date_epoch.to_string(),
+        )
+        .current_dir(root)
+        .status()
+        .map_err(|error| format!("failed to start cargo-cyclonedx: {error}"))?;
+    if !status.success() {
+        return Err("CycloneDX SBOM generation failed".to_owned());
+    }
+
+    let by_name = metadata
+        .packages
+        .iter()
+        .map(|package| (package.name.as_str(), package))
+        .collect::<BTreeMap<_, _>>();
+    let mut hashes = BTreeMap::new();
+    for package in &contract.package {
+        let metadata_package = by_name
+            .get(package.name.as_str())
+            .ok_or_else(|| format!("cargo metadata omitted {}", package.name))?;
+        if metadata_package.version != contract.package_version {
+            return Err(format!("{} metadata version drifted", package.name));
+        }
+        let path = metadata_package
+            .manifest_path
+            .parent()
+            .expect("manifest has parent")
+            .join(SBOM_FILENAME);
+        let raw = fs::read(&path)
+            .map_err(|error| format!("failed to read {}: {error}", path.display()))?;
+        let mut sbom: Value = serde_json::from_slice(&raw)
+            .map_err(|error| format!("invalid SBOM {}: {error}", path.display()))?;
+        validate_sbom(&sbom, &package.name, &contract.package_version)?;
+        normalize_sbom(&mut sbom, root);
+        hashes.insert(
+            package.name.clone(),
+            sha256(&serde_json::to_vec(&sbom).map_err(|error| error.to_string())?),
+        );
+    }
+    Ok(hashes)
+}
+
+fn validate_sbom(sbom: &Value, name: &str, version: &str) -> Result<(), String> {
+    let component = sbom
+        .pointer("/metadata/component")
+        .and_then(Value::as_object)
+        .ok_or_else(|| format!("{name} SBOM has no root component"))?;
+    if sbom.get("bomFormat").and_then(Value::as_str) != Some("CycloneDX")
+        || sbom.get("specVersion").and_then(Value::as_str) != Some("1.5")
+        || component.get("name").and_then(Value::as_str) != Some(name)
+        || component.get("version").and_then(Value::as_str) != Some(version)
+        || sbom
+            .get("components")
+            .and_then(Value::as_array)
+            .is_none_or(Vec::is_empty)
+        || sbom
+            .get("dependencies")
+            .and_then(Value::as_array)
+            .is_none_or(Vec::is_empty)
+    {
+        return Err(format!(
+            "{name} SBOM is incomplete or identifies the wrong package"
+        ));
+    }
+    Ok(())
+}
+
+fn normalize_sbom(value: &mut Value, root: &Path) {
+    normalize_sbom_value(value, root.to_string_lossy().as_ref());
+}
+
+fn normalize_sbom_value(value: &mut Value, root: &str) {
+    match value {
+        Value::Object(object) => {
+            object.remove("serialNumber");
+            for value in object.values_mut() {
+                normalize_sbom_value(value, root);
+            }
+        }
+        Value::Array(values) => {
+            for value in values {
+                normalize_sbom_value(value, root);
+            }
+        }
+        Value::String(string) if string.contains(root) => {
+            *string = string.replace(root, "$REPOSITORY");
+        }
+        _ => {}
+    }
+}
+
+fn build_provenance(
+    root: &Path,
+    contract: &Contract,
+    sbom_hashes: &BTreeMap<String, String>,
+) -> Result<Value, String> {
+    let revision = command_stdout(root, "git", &["rev-parse", "HEAD"])?;
+    if revision.len() != 40 || !revision.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err("Git provenance revision is not a full commit ID".to_owned());
+    }
+    let lock = fs::read(root.join("Cargo.lock"))
+        .map_err(|error| format!("failed to read Cargo.lock: {error}"))?;
+    let packages = contract
+        .package
+        .iter()
+        .map(|package| {
+            json!({
+                "name": package.name,
+                "version": contract.package_version,
+                "manifestPath": package.manifest_path,
+                "sbomSha256": sbom_hashes.get(&package.name),
+            })
+        })
+        .collect::<Vec<_>>();
+    Ok(json!({
+        "schemaVersion": 1,
+        "specId": contract.spec_id,
+        "source": {
+            "gitCommit": revision,
+            "cargoLockSha256": sha256(&lock),
+        },
+        "tools": {
+            "cargoDeny": contract.tools.cargo_deny,
+            "cargoCyclonedx": contract.tools.cargo_cyclonedx,
+        },
+        "packages": packages,
+        "advisoryExceptions": contract.advisory_exception,
+    }))
+}
+
+fn validate_provenance(provenance: &Value, contract: &Contract) -> Result<(), String> {
+    if provenance.get("schemaVersion").and_then(Value::as_u64) != Some(1)
+        || provenance.get("specId").and_then(Value::as_str) != Some(contract.spec_id.as_str())
+        || provenance
+            .get("packages")
+            .and_then(Value::as_array)
+            .is_none_or(|packages| packages.len() != contract.package.len())
+        || provenance
+            .pointer("/source/cargoLockSha256")
+            .and_then(Value::as_str)
+            .is_none_or(|hash| hash.len() != 64)
+    {
+        return Err("generated supply-chain provenance is incomplete".to_owned());
+    }
+    Ok(())
+}
+
+fn run_command(root: &Path, program: &str, args: Vec<&str>, failure: &str) -> Result<(), String> {
+    let status = Command::new(program)
+        .args(args)
+        .current_dir(root)
+        .status()
+        .map_err(|error| format!("failed to start {program}: {error}"))?;
+    if status.success() {
+        Ok(())
+    } else {
+        Err(failure.to_owned())
+    }
+}
+
+fn command_stdout(root: &Path, program: &str, args: &[&str]) -> Result<String, String> {
+    let output = Command::new(program)
+        .args(args)
+        .current_dir(root)
+        .output()
+        .map_err(|error| format!("failed to start {program}: {error}"))?;
+    if !output.status.success() {
+        return Err(format!("{program} {} failed", args.join(" ")));
+    }
+    String::from_utf8(output.stdout)
+        .map(|value| value.trim().to_owned())
+        .map_err(|error| format!("{program} emitted non-UTF-8 output: {error}"))
+}
+
+fn sha256(bytes: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(bytes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn root() -> PathBuf {
+        Path::new(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .and_then(Path::parent)
+            .expect("workspace root")
+            .to_path_buf()
+    }
+
+    #[test]
+    fn current_contract_is_exact_and_exception_bound() {
+        let root = root();
+        let contract = load(&root).expect("contract");
+        validate(&root, &contract, 17).expect("valid contract");
+    }
+
+    #[test]
+    fn sbom_validation_rejects_wrong_identity() {
+        let sbom = json!({
+            "bomFormat": "CycloneDX",
+            "specVersion": "1.5",
+            "metadata": {"component": {"name": "wrong", "version": "0.1.0-alpha"}},
+            "components": [{}],
+            "dependencies": [{}],
+        });
+        assert!(validate_sbom(&sbom, "radroots_core", "0.1.0-alpha").is_err());
+    }
+
+    #[test]
+    fn normalization_removes_random_and_absolute_identity() {
+        let mut sbom = json!({
+            "serialNumber": "urn:uuid:random",
+            "path": "/workspace/crate",
+        });
+        normalize_sbom(&mut sbom, Path::new("/workspace"));
+        assert!(sbom.get("serialNumber").is_none());
+        assert_eq!(
+            sbom.get("path").and_then(Value::as_str),
+            Some("$REPOSITORY/crate")
+        );
+    }
+}