200-the-dependency-policy-has-an-owner-and-records

The dependency policy has an owner, and its audit and vet records are committed

Lifecycle approvedImplementation completeVerification unknownQualification unknown

`deny.toml` is the dependency gate CI runs (spec 135), and no spec owns it: 135 names it only as a reference. This spec claims it, adds `.cargo/audit.toml` so `cargo audit` reads the same policy, and commits the `cargo vet` records under `supply-chain/` with six published audit sets imported. Each file enters the content hash and the governed scope, so an edit to the dependency policy stales the ledger and needs an owner.

Read the full pinned specification ↗

Relationships

depends on

135-the-toolchain-floor-and-dependencies-are-checked

Claimed units

establishes

{
  "kind": "file",
  "path": "deny.toml"
}

establishes

{
  "kind": "file",
  "path": ".cargo/audit.toml"
}

establishes

{
  "kind": "file",
  "path": "supply-chain/"
}

extends

{
  "nature": "additive",
  "spec": "061-shipped-is-not-the-same-as-working",
  "unit": {
    "kind": "file",
    "path": "spec-spine.toml"
  }
}

Source headings

200: The dependency policy has an owner, and its audit and vet records are committed
1. Purpose
2. Territory
3. Behavior
3.1 `deny.toml` stays the gate
3.2 `cargo audit` reads the same policy
3.3 `cargo vet` records
3.4 Each file is hashed and governed
4. Out of scope
5. Resolved decisions
Verification

Frozen anchors

No frozen anchors declared.