feat: add versioned game identity contracts

scripts/audit_workspace.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Audit the dependency-free bootstrap, licensing, and source inventory."""
+"""Audit workspace dependencies, licensing, and source inventory."""
 
 from __future__ import annotations
 
@@ -43,12 +43,6 @@ def main() -> None:
     if license_hash != EXPECTED_LICENSE_SHA256:
         fail(f"root LICENSE is not the canonical AGPL-3.0 text: {license_hash}")
 
-    lock = load(ROOT / "Cargo.lock")
-    external = [package for package in lock["package"] if "source" in package]
-    if external:
-        names = [f"{item['name']}@{item['version']}" for item in external]
-        fail(f"unreviewed external Rust dependencies entered the bootstrap: {names}")
-
     inventory = load(ROOT / "docs" / "phase-0" / "source-inventory.toml")
     components = {item["name"]: item for item in inventory["components"]}
     toolchain = load(ROOT / "rust-toolchain.toml")["toolchain"]["channel"]
@@ -57,6 +51,31 @@ def main() -> None:
     if components.get("cargo-deny", {}).get("version") != "0.20.2":
         fail("cargo-deny is absent or not pinned to the reviewed version")
 
+    core_manifest = load(ROOT / "crates" / "kiln-core" / "Cargo.toml")
+    expected_dependencies = {
+        "serde": "=1.0.228",
+        "serde_json": "=1.0.150",
+        "uuid": "=1.24.0",
+    }
+    dependencies = core_manifest.get("dependencies", {})
+    for name, version in expected_dependencies.items():
+        configured = dependencies.get(name, {})
+        configured_version = configured if isinstance(configured, str) else configured.get("version")
+        if configured_version != version:
+            fail(f"{name} must remain pinned to reviewed version {version}")
+        if components.get(name, {}).get("version") != version.removeprefix("="):
+            fail(f"{name} source inventory does not match its manifest version")
+
+    lock = load(ROOT / "Cargo.lock")
+    external = [package for package in lock["package"] if "source" in package]
+    unexpected_sources = [
+        f"{item['name']}@{item['version']}"
+        for item in external
+        if item["source"] != "registry+https://github.com/rust-lang/crates.io-index"
+    ]
+    if unexpected_sources:
+        fail(f"unreviewed external Rust sources entered the workspace: {unexpected_sources}")
+
     load(ROOT / "deny.toml")
     print("PASS: workspace dependency, license, and source baseline")