[aien-spark]

Evidence

• cargo audit before (main 13953d7): error: 6 vulnerabilities found!, warning: 3 allowed warnings found
• cargo audit after: 252 crates scanned, no findings, exit 0
• cargo test --workspace --verbose: every test result: ok; totals 95 passed, 0 failed, 1 ignored (unchanged ignore)
• cargo clippy --workspace --all-targets: no new warnings (3 pre-existing, in beacon-core/crypto.rs, beacon-core/cuckoo.rs, beacon-client/lib.rs, untouched files)
• scripts/demo-local.sh: exit 0, 10 of 10 rounds, 3 volunteers 4.7247 bits/byte vs single process 4.3919 (same as before)
• scripts/demo-teach.sh: skipped cleanly, local Qwen server at 127.0.0.1:18091 not answering

What changed, per advisory

All six vulnerabilities and the rustls-pemfile warning came from one place: reqwest 0.11 in crates/beacon-client/Cargo.toml (no .rs file calls reqwest today). Bumped to 0.12 with the same features (json, rustls-tls, no defaults).

Advisory	Crate	Fix
RUSTSEC-2026-0258 unbounded empty DATA frames	h2 0.3.27	gone from the tree (reqwest 0.12 without http2)
RUSTSEC-2026-0346 Debug leaks TLS secrets	rustls 0.21.12	now 0.23.46
RUSTSEC-2026-0349 ServerHello downgrade	rustls 0.21.12	now 0.23.46
RUSTSEC-2026-0098 / -0099 name constraints	rustls-webpki 0.101.7	now 0.103.15
RUSTSEC-2026-0104 CRL parsing panic	rustls-webpki 0.101.7	now 0.103.15
RUSTSEC-2025-0134 unmaintained	rustls-pemfile 1.0.4	gone from the tree
yanked	yoke-derive 0.8.3	cargo update -p yoke-derive to 0.8.4
RUSTSEC-2025-0141 unmaintained	bincode 1.3.3	documented ignore in .cargo/audit.toml

Left as is, with reason

• bincode 1.3 (unmaintained, no known vulnerability). Beacon packets and oh-core wire frames are bincode 1.3 bytes, so switching format changes the wire and belongs in a deliberate wire version bump. Network decodes already sit behind MAX_FRAME_BYTES (64 MiB) and the beacon magic/version checks. crumb-spec (git dependency) also uses bincode 1.3, so a later swap needs a matching bump in aien-dev/crumb-spec.
• No upstream bump is needed in crumb-spec or spark-crumbs for this PR.
• cargo fmt --check reports drift in beacon-core and beacon-client source files; it predates this PR and those files are untouched here.
• Follow-up idea: reqwest is declared but unused in beacon-client; removing it would shrink the dependency tree further.

🤖 Generated with Claude Code

[github-actions]

⚖️ Sovereign Code Review & Alignment Gate

Greetings @aien-spark. I am AIEN, the automated review gate for the AIENOS project.

Your pull request #19 ("fix(deps): clear cargo audit (6 vulnerabilities, 3 warnings)") has undergone automated auditing against the project standards.

✅ Doctrine Diff Audit: PASS

• Telemetry Check: Clean (zero tracking or surveillance hooks detected).
• Sovereign Voice & Formatting Check: Clean (zero em/en dashes, zero banned buzzwords).
• Secrets & Credentials Check: Clean (zero plaintext secrets, hardware vault only).
• Status: Project standards verified.

---

🌿 Sovereign Steward: Contributor Alignment Interview

Greetings @aien-spark. I am AIEN, the automated steward for the AIENOS project.

We welcome all contributors who share our commitment to open collaboration, global humanity, and disciplined systems craftsmanship. We build to expand computing capability, advance open-source intelligence, and share technology freely with the world.

Your pull request #19 ("fix(deps): clear cargo audit (6 vulnerabilities, 3 warnings)") is ready for stewardship alignment.

Please respond directly to these four alignment inquiries:

1. Long-Term Mission Alignment:
   This initiative is an enduring engineering commitment to open-source technology for humanity, not a vehicle for short-term hype, social media monetization, or get-rich-quick ventures. How does your contribution support global progress and the resilience of local communities?

2. Telemetry & Integrity:
   Do you certify that this change introduces zero telemetry, zero surveillance, and zero artificial paywalls?

   "I certify that my contribution is submitted in service of human sovereignty and open collaboration. I affirm that this work maintains zero telemetry, contains no surveillance backdoors, and introduces no artificial barriers, and that I offer it under AGPL-3.0-or-later, the license that governs this project. I build so that intelligence is owned by the person who runs it, not rented."

3. Downstream Heritage Preservation:
   Do you acknowledge and agree that any downstream branch, fork, or copy of this work remains under AGPL-3.0-or-later and retains the project's license and attribution notices, as the LICENSE file requires?

4. Craftsmanship & Native Discipline:
   What architectural trade-offs did you make, and how did you verify that this code introduces zero regressions, zero unneeded dependencies, and complies with our pure native compiled standards?

---

Reply to this comment with your affirmation. Once verified against the project standards, I will grant the sovereign-interview-passed clearance. For direct sovereign coordination: Drake Stapleton (drake@aienos.com) and AIEN (aien@aienos.com)