From 86cc114db2e516b180b30b1a79d552e7f1995492 Mon Sep 17 00:00:00 2001
From: Albert Hui <i@hack9u.online>
Date: Sun, 2 Aug 2026 03:15:50 +0800
Subject: [PATCH] fix(supply-chain): trust our own crates instead of exempting
 them

ADR-0018 ranks the four cargo-vet mechanisms and states that reaching for a
weaker one is a defect. These crates are ours, consumed from crates.io, so
case 2 applies: a publisher-trust entry under h4x0r (user-id 347968), not an
exemption.

The distinction is semantic, not cosmetic. An exemption asserts "unreviewed,
accepted anyway"; a trust entry asserts "the publisher is ours". Recording our
own crates as unreviewed-but-tolerated misstated the supply-chain posture in
the direction of false comfort. A trust entry is also version-agnostic, so it
does not go stale on the next bump the way a pinned exemption does.

Exemption -> trust:
  - forensicnomicon
  - forensicnomicon-core
  - forensicnomicon-data

Dead exemption entries removed (no behaviour change) -- these name workspace
members already declared first-party via audit-as-crates-io = false, which is
ADR-0018 case 1, so the exemption had no effect:
  - exec-pe-analysis
  - exec-pe-core

Verified (config change, so the vet run is the test):

    Vetting Succeeded (25 fully audited, 1 partially audited, 41 exempted)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 supply-chain/audits.toml  | 18 ++++++++++++++++++
 supply-chain/config.toml  | 20 --------------------
 supply-chain/imports.lock | 21 +++++++++++++++++++++
 3 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index 2772ccb..1eabe91 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -2,3 +2,21 @@
 # cargo-vet audits file
 
 [audits]
+
+[[trusted.forensicnomicon]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-06-05"
+end = "2027-08-01"
+
+[[trusted.forensicnomicon-core]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-06-28"
+end = "2027-08-01"
+
+[[trusted.forensicnomicon-data]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-06-28"
+end = "2027-08-01"
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 300858b..2e81a64 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -50,30 +50,10 @@ criteria = "safe-to-deploy"
 version = "0.3.14"
 criteria = "safe-to-run"
 
-[[exemptions.exec-pe-analysis]]
-version = "0.2.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.exec-pe-core]]
-version = "0.3.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.fastrand]]
 version = "2.4.1"
 criteria = "safe-to-run"
 
-[[exemptions.forensicnomicon]]
-version = "1.0.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.forensicnomicon-core]]
-version = "1.0.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.forensicnomicon-data]]
-version = "1.0.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.generic-array]]
 version = "0.14.7"
 criteria = "safe-to-deploy"
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index bfe38d0..60ff1e8 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -1,6 +1,27 @@
 
 # cargo-vet imports lock
 
+[[publisher.forensicnomicon]]
+version = "1.0.0"
+when = "2026-06-28"
+user-id = 347968
+user-login = "h4x0r"
+user-name = "Albert Hui"
+
+[[publisher.forensicnomicon-core]]
+version = "1.0.0"
+when = "2026-06-28"
+user-id = 347968
+user-login = "h4x0r"
+user-name = "Albert Hui"
+
+[[publisher.forensicnomicon-data]]
+version = "1.0.0"
+when = "2026-06-28"
+user-id = 347968
+user-login = "h4x0r"
+user-name = "Albert Hui"
+
 [[publisher.unicode-xid]]
 version = "0.2.6"
 when = "2024-09-19"