ci(security): add a supply-chain gate, checksums and an SBOM

The project shipped signed Android builds and unsigned desktop binaries
with no vulnerability scanning of any kind. Nothing checked the ~500
crate Rust graph or the JS packages against an advisory feed, and nothing
checked that what we redistribute inside an MIT bundle permits it.

The first cargo-deny run found eight vulnerabilities and one
unsoundness -- bytes, four in rustls-webpki, time, two in quick-xml and
rand -- every one of them closed by a `cargo update` nobody had a reason
to run. That update is in this commit; 740 Rust tests and clippy
-D warnings pass on the new lockfile.

Two structural fixes matter as much as the gate itself:

  - deny.toml scopes the graph to the targets we actually ship. Without
    it the Apple targets pull in plist -> quick-xml and report two DoS
    advisories against a crate that is in no binary we release. Ignoring
    those by ID would silence them everywhere, including where they
    would matter; scoping makes them correctly absent.

  - libmpv is pinned by rev instead of branch = "master". A branch means
    the revision is whatever Cargo.lock happens to hold and any
    `cargo update` silently substitutes new upstream code -- in the one
    dependency that is not from crates.io and that links a C library
    into the player. The rev is the commit already locked, so this pins
    current behaviour rather than changing it.

Licence findings are recorded rather than waved through. libmpv and
libmpv-sys are LGPL-2.1, satisfied here by dynamic linking against the
system library; deny.toml carries the two obligations that follow (keep
the linkage dynamic, ship libmpv's licence text with any bundle carrying
the .so). MPL-2.0 crates are file-level copyleft and fine unmodified.

Releases now publish SHA256SUMS (verified in-job with `sha256sum -c`
before upload) and a CycloneDX SBOM for both halves, so "does this
release contain <vulnerable crate>?" has an answer that is not "rebuild
the tag and re-resolve it".

Workflows pin jellytau-builder:2026.08 instead of :latest. While every
job said :latest, rebuilding the image changed what every build compiled
against, including rebuilds of old release tags.

Also folded in, because both were the same class of problem:

  - publish-docs.yml downloaded mdBook from GitHub releases into
    /usr/local/bin at job time -- a toolchain install in CI, which
    CLAUDE.md explicitly forbids, and a hard dependency on GitHub's CDN
    at publish time. It is in the builder image now.

  - extract-traces.ts only ever read .ts/.svelte/.rs, so every
    requirement implemented by *configuration* was invisible to the
    matrix that measures it. DR-205, DR-206, DR-207 and DR-215 all carry
    TRACES comments nothing read, and each counted as uncovered while
    being covered. Coverage was really 90%, not 88%; MIN_THRESHOLD moves
    to 89 accordingly. CI workflows stay excluded and there is a test
    saying why: traceability-check.yml quotes "a TRACES: comment" beside
    deliberately-undefined example IDs, which the extractor would read
    as real traces and then fail its own dangling-ID check.

Supply-chain requirement is DR-216.

🔴 The builder image must be rebuilt and pushed
(scripts/build-builder-image.sh 2026.08) before this reaches master --
the workflows now name a tag and tools that do not exist in the registry
yet.

.gitea/workflows/build-and-test.yml

@@ -28,7 +28,7 @@ jobs:
     if: "!startsWith(github.event.head_commit.message, 'chore(release)')"
     runs-on: linux/amd64
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
 
     steps:
       - name: Checkout repository
@@ -156,7 +156,7 @@ jobs:
     runs-on: linux/amd64
     needs: test
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     env:
       ANDROID_HOME: /opt/android-sdk
       ANDROID_SDK_ROOT: /opt/android-sdk
@@ -208,3 +208,60 @@ jobs:
           export AR_aarch64_linux_android="$TC/llvm-ar"
           cd src-tauri
           cargo check --target aarch64-linux-android --lib
+
+  # Supply-chain gate. Until this job existed the project had no vulnerability
+  # scanning of any kind: nothing checked the ~500-crate Rust graph or the JS
+  # dependencies against a CVE feed, and nothing checked that everything we
+  # redistribute is licence-compatible with shipping JellyTau under MIT.
+  #
+  # The first run of this found eight vulnerabilities and one unsoundness
+  # (bytes, four in rustls-webpki, time, two in quick-xml, rand) — all fixed by
+  # `cargo update`, none of which anybody had reason to run.
+  #
+  # Runs in parallel with android-check rather than after `test`: a dependency
+  # advisory has nothing to do with whether the tests pass, and finding out
+  # sooner is the point.
+  security:
+    name: Supply Chain
+    runs-on: linux/amd64
+    container:
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-registry-
+
+      # cargo-deny is baked into the builder image. It fetches the RustSec
+      # advisory database at run time — that is *data*, like the crates
+      # `bun install` fetches, not a toolchain install, so the 🔴 rule in
+      # CLAUDE.md is not in play here.
+      #
+      # Config and every documented exception live in src-tauri/deny.toml.
+      # Vulnerabilities and unsoundness are hard failures with no override;
+      # unmaintained transitive crates that have no safe upgrade (Tauri's GTK3
+      # stack, the unic-* tables) are ignored there by ID, each with a reason.
+      - name: cargo-deny (advisories, licences, bans, sources)
+        run: |
+          cd src-tauri
+          cargo deny check
+
+      # Advisory for now, deliberately. The Rust graph was clean after one
+      # update pass, so gating it costs nothing; the JS graph has not been
+      # audited before and a first run that fails the build teaches everyone to
+      # ignore this job. Promote to a hard gate once the output is empty and
+      # stays empty — same approach that got clippy from advisory to -D warnings.
+      - name: bun audit (advisory)
+        run: |
+          bun install
+          bun audit || echo "::warning::bun audit reported findings — advisory for now, see CLAUDE.md"

.gitea/workflows/build-release.yml

@@ -21,7 +21,7 @@ jobs:
     name: Run Tests
     runs-on: linux/amd64
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -94,7 +94,7 @@ jobs:
     runs-on: linux/amd64
     needs: test
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -190,7 +190,7 @@ jobs:
     # baked into the builder image. No toolchain installs here — the image has
     # cargo-xwin, clang/clang-cl, lld, llvm, nsis and the msvc target.
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -260,7 +260,7 @@ jobs:
     runs-on: linux/amd64
     needs: test
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     env:
       ANDROID_HOME: /opt/android-sdk
       ANDROID_SDK_ROOT: /opt/android-sdk
@@ -359,7 +359,7 @@ jobs:
     needs: [build-linux, build-windows, build-android]
     if: startsWith(github.ref, 'refs/tags/v')
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -388,6 +388,42 @@ jobs:
           name: jellytau-android
           path: artifacts/android/
 
+      # Software Bill of Materials, one per half of the app. Without it there is
+      # no answer to "does this release contain <vulnerable crate>?" other than
+      # rebuilding the tag and re-resolving it. cargo-cyclonedx is in the builder
+      # image; the JS side is read straight from the lockfile bun install used.
+      - name: Generate SBOM
+        run: |
+          set -e
+          mkdir -p artifacts/sbom
+          cd src-tauri
+          cargo cyclonedx --format json
+          find . -maxdepth 2 -name "*.cdx.json" -exec cp -v {} ../artifacts/sbom/ \;
+          cd ..
+          bun install --frozen-lockfile
+          bun pm ls --all > artifacts/sbom/frontend-dependencies.txt
+          ls -lah artifacts/sbom/
+
+      # Checksums over everything being published. A release of unsigned Linux
+      # and Windows binaries with no checksum gives a user no way at all to tell
+      # a corrupted or substituted download from a good one — and the AppImage
+      # and NSIS installer are both fetched over plain HTTP redirects.
+      #
+      # Written with paths relative to the asset directory so `sha256sum -c
+      # SHA256SUMS` works in the directory a user downloaded into.
+      - name: Generate SHA256SUMS
+        run: |
+          set -e
+          mkdir -p artifacts/release
+          find artifacts/linux artifacts/windows artifacts/android -type f -exec cp -v {} artifacts/release/ \;
+          cd artifacts/release
+          sha256sum * > SHA256SUMS
+          echo "🔐 Published checksums:"
+          cat SHA256SUMS
+          # Verify what we just wrote, so a broken checksum file fails the
+          # release rather than shipping and failing for users.
+          sha256sum -c SHA256SUMS
+
       - name: Prepare release notes
         id: release_notes
         run: |
@@ -485,7 +521,10 @@ jobs:
           fi
           echo "Release id=$RELEASE_ID"
 
-          for f in artifacts/android/* artifacts/linux/* artifacts/windows/*; do
+          # artifacts/release/ holds a copy of every platform artifact plus the
+          # SHA256SUMS generated over exactly that set, so the checksums describe
+          # precisely what is uploaded. artifacts/sbom/ rides along.
+          for f in artifacts/release/* artifacts/sbom/*; do
             [ -f "$f" ] || continue
             echo "⬆️  Uploading $(basename "$f")"
             curl -fsS -X POST \

.gitea/workflows/publish-docs.yml

@@ -21,7 +21,7 @@ jobs:
     name: Build & publish docs to gitea-pages
     runs-on: linux/amd64
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
 
     steps:
       - name: Checkout code
@@ -34,14 +34,13 @@ jobs:
       - name: Install dependencies
         run: bun install
 
-      - name: Install mdBook
+      # mdBook is baked into jellytau-builder (Dockerfile.builder, MDBOOK_VERSION).
-        run: |
+      # It used to be curl'd from GitHub releases straight into /usr/local/bin
-          set -e
+      # right here, which was a toolchain install at job time — the exact thing
-          MDBOOK_VERSION=v0.4.40
+      # CLAUDE.md's 🔴 rule forbids — and made every docs publish depend on
-          URL="https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+      # GitHub's CDN answering. To move the version, bump it in the image.
-          echo "⬇️  Downloading mdBook ${MDBOOK_VERSION}"
+      - name: Confirm mdBook is present
-          curl -fsSL "$URL" | tar -xz -C /usr/local/bin
+        run: mdbook --version
-          mdbook --version
 
       - name: Regenerate traceability matrix (keep published copy current)
         run: bun run traces:markdown

.gitea/workflows/traceability-check.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: linux/amd64
     name: Check Requirement Traces
     container:
-      image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
+      image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
 
     steps:
       - name: Checkout repository
@@ -94,7 +94,7 @@ jobs:
           #
           # Keep in sync with MIN_COVERAGE_PERCENT in scripts/extract-traces.ts;
           # scripts/extract-traces.test.ts fails if the two drift apart.
-          MIN_THRESHOLD=88
+          MIN_THRESHOLD=89
           if [ "$COVERAGE" -lt "$MIN_THRESHOLD" ]; then
             echo "❌ ERROR: Coverage ($COVERAGE%) is below minimum threshold ($MIN_THRESHOLD%)"
             exit 1

CLAUDE.md

@@ -114,7 +114,7 @@ rename that missed a call site can no longer pass silently.
 
 **CI is Gitea Actions** (`.gitea/workflows/`, remote `gitea.tourolle.paris`), not
 GitHub. `traceability-check.yml` fails the build if coverage drops below
-**88%** (`MIN_THRESHOLD`, a *ratchet* — raise it as coverage climbs, never lower
+**89%** (`MIN_THRESHOLD`, a *ratchet* — raise it as coverage climbs, never lower
 it to make a build pass) or if any traced ID is undefined; `build-and-test.yml`
 runs frontend tests **with coverage thresholds**, `bun run check`, `format:check`,
 a `--max-warnings` eslint ratchet, Rust tests, `cargo fmt --check`, `cargo clippy

Dockerfile.builder

@@ -152,6 +152,29 @@ RUN . $HOME/.cargo/env && \
     rustup target add x86_64-pc-windows-msvc && \
     cargo install --locked cargo-xwin
 
+# ---------------------------------------------------------------------------
+# Supply-chain and docs tooling.
+#
+# cargo-deny     — advisories/licences/bans/sources gate (src-tauri/deny.toml),
+#                  run by the `security` job. It fetches the RustSec advisory
+#                  database at run time; that is *data*, not a toolchain, so it
+#                  does not breach the no-installs-in-CI rule.
+# cargo-cyclonedx — SBOM for the Rust half of a release.
+# mdbook         — builds the docs site. It used to be curl'd from GitHub
+#                  releases *inside* the job (publish-docs.yml), which was both a
+#                  breach of that rule and a hard dependency on GitHub's CDN
+#                  being up at publish time. Pinned to the version that job used.
+ENV MDBOOK_VERSION=v0.4.40
+RUN . $HOME/.cargo/env && \
+    cargo install --locked cargo-deny cargo-cyclonedx && \
+    wget -q "https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+        -O /tmp/mdbook.tar.gz && \
+    tar -xzf /tmp/mdbook.tar.gz -C /usr/local/bin && \
+    rm /tmp/mdbook.tar.gz && \
+    cargo deny --version && \
+    cargo cyclonedx --version && \
+    mdbook --version
+
 WORKDIR /app
 
 ENTRYPOINT ["/bin/bash"]

docs/requirements.md

@@ -405,6 +405,7 @@ Internal architecture, components, and application logic.
 | DR-213 | Containerised builds hand their artifacts back to the host user. The compose services bind-mount the repo and run as root — their caches live at `/root/.cargo` and `/root/.bun`, so a non-root container user cannot write them — which leaves root-owned files accumulating in the developer's working tree: 11,124 of them when this was found, enough that `cargo clean` and `scripts/clean.sh` failed with EACCES and a plain `cargo build` died part-way, since build scripts compile for the host and land in `target/debug` even during a cross-build. Ownership is restored at the end of each containerised build, reading the intended owner from the checkout so no uid needs plumbing through. Running the containers as the host uid is the tidier fix and remains open; it needs the cache volumes relocated off `/root` first | Tooling | - | Done |
 | DR-214 | The app identifies itself correctly everywhere a user or a package manager reads its name. `productName` was the scaffold's lowercase `jellytau`, which is what the Android release build showed under its icon and what the deb/rpm/NSIS bundles carried as their display name — invisible in development because `build.gradle.kts` overrides the label to "JellyTau Debug" for the debug build type, so the install a developer looks at daily was the only correctly-cased one. `mainBinaryName` pins the executable filename so nothing that resolves a path by name has to change. `strings.xml` moves into the canonical android tree, where `sync-android-sources.sh` already copies `res/values/*.xml`, so the fix survives regenerating `gen/`. Bundle metadata (publisher, copyright, category, descriptions, licence) was entirely absent, which is why the packages shipped with no maintainer or description — the hand-written Arch PKGBUILD and `.desktop` had all of it, so only the *generated* packaging was wrong | Packaging | - | Done |
 | DR-215 | Frontend test coverage is a ratcheted CI gate rather than a number nobody looks at. `test:coverage` had been configured since the suite was created and was silently broken: `@vitest/coverage-v8` resolved to 4.1.10, whose peer range pins `vitest` exactly, while `package.json` asked for `>=1.0.0 <5.0.0` and got 4.0.16 — so every invocation died on a missing `BaseCoverageProvider` export and no coverage figure had been produced in months. Fixing the range is half the requirement; the other half is that a measured figure that gates nothing decays the same way an unrun script does. Thresholds sit a few points under the measured result (statements 54.6, branches 48.7, functions 49.6, lines 55.1 when this landed) and only ever move up, matching `MIN_THRESHOLD` in the traceability gate and the eslint `--max-warnings` ratchet. The absolute numbers are held down by `.svelte` components, which this project deliberately does not test directly — the pattern is to extract the logic to a plain module and test that | Tooling | - | Done |
+| DR-216 | Dependencies are gated on known vulnerabilities and on licence compatibility, and the build graph is pinned to what is actually shipped. The project had no scanning of any kind: nothing checked the ~500-crate Rust graph or the JS packages against an advisory feed, and nothing checked that everything redistributed inside an MIT-licensed bundle permits it. The first run found eight vulnerabilities and one unsoundness — `bytes`, four in `rustls-webpki`, `time`, two in `quick-xml`, `rand` — every one closed by a `cargo update` nobody had reason to run. `cargo deny` (src-tauri/deny.toml) now runs in CI over advisories, licences, bans and sources. Two structural fixes matter as much as the gate: the graph is scoped to the targets actually shipped, so an advisory against an Apple-only path is correctly absent rather than ignored by ID; and the one git dependency (`libmpv`) is pinned by revision instead of by branch, since a branch means any `cargo update` silently substitutes new upstream code in the one dependency that is unsigned and links a C library into the player. Licence findings are recorded rather than waved through — `libmpv`/`libmpv-sys` are LGPL-2.1, which the app satisfies by dynamic linking, and that carries obligations (keep the linkage dynamic; ship libmpv's licence text with any bundle carrying the .so) | Tooling | - | Done |
 | DR-198 | The webview runs under a real Content-Security-Policy, and the asset protocol is scoped to the one directory it still serves. `csp` was `null`, which disables CSP entirely: any script that reached the web layer — through a future `{@html}`, a dependency, or a devtools paste — would have inherited the whole IPC surface, and with it the user's session. `script-src 'self'` (Tauri injects a nonce for SvelteKit's inline bootstrap script at build time, so no `'unsafe-inline'` is needed) plus `object-src`/`frame-src 'none'` and `base-uri 'self'` is the part that is genuinely restrictive. `img-src`/`media-src`/`connect-src` cannot be: the Jellyfin origin is typed in by the user at run time and is commonly plain `http` on a LAN, so they allow `http:`/`https:` — a wide grant for *data*, but one that still bars `file:`, `filesystem:` and scripting schemes, and leaves `script-src` untouched. `style-src` keeps `'unsafe-inline'` because Svelte compiles `style="…"` attributes (including `app.html`'s `display: contents` wrapper) into markup; this is safe only while no `<style>` element survives into `index.html`, since a nonce there would make Tauri's injection outrank — and therefore void — `'unsafe-inline'`. `worker-src blob:` and `media-src blob:` are hls.js: it demuxes in a worker built from a blob and attaches MSE through `URL.createObjectURL`. `asset:` and `http://asset.localhost` are the same protocol under the two naming schemes `convertFileSrc` emits (custom scheme on Linux/macOS, `http` host on Windows/Android); `ipc:`/`http://ipc.localhost` is the invoke transport, which would otherwise be blocked by `connect-src`. A run-time CSP naming the server origin exactly was rejected: Tauri computes the header from immutable config when it serves the HTML, so it would mean rebuilding config and reloading the webview on every server change, for a policy the user can already point anywhere. The asset-protocol scope narrows from `$APPDATA/**` to `$APPDATA/thumbnails/**` — since DR-137 moved downloaded media to the loopback server, `imageCache` is the only `convertFileSrc` caller left, so the database and the encrypted-token fallback file no longer sit inside the grant | Security | UR-012, UR-071 | Done |
 
 ---

scripts/build-builder-image.sh

@@ -49,12 +49,39 @@ else
 fi
 
 # Step 4: Push to registry
+#
+# Two tags, on purpose:
+#
+#   <date>   what the workflows pin (e.g. :2026.08). CI must name an immutable
+#            tag -- while every job said :latest, rebuilding the image silently
+#            changed what every build, including a rebuild of an old release
+#            tag, compiled against. That is the opposite of reproducible.
+#   latest   convenience for local `docker compose` runs and for anyone pulling
+#            the image by hand.
+#
+# Date tags rather than per-commit SHA tags: the Gitea runner shares a 74 GB
+# disk with two other projects, and SHA-tagged images accumulated there until it
+# filled. Keep at most a couple of dated tags live and prune the rest
+# (`docker image prune -a` on the runner).
+#
+# To bump: build+push a new dated tag, then update the `image:` lines in
+# .gitea/workflows/*.yml in the same commit as whatever needed the new tool.
 echo "📤 Pushing image to registry..."
 docker push ${FULL_IMAGE_NAME}
 
+if [ "$IMAGE_TAG" != "latest" ]; then
+    echo "🏷️  Also tagging as :latest for local use..."
+    LATEST_IMAGE_NAME="${REGISTRY_HOST}/${REGISTRY_USER}/${IMAGE_NAME}:latest"
+    docker tag ${IMAGE_NAME}:${IMAGE_TAG} ${LATEST_IMAGE_NAME}
+    docker push ${LATEST_IMAGE_NAME}
+fi
+
 echo ""
 echo "✅ Successfully built and pushed: ${FULL_IMAGE_NAME}"
 echo ""
-echo "Update your workflow to use:"
+echo "Workflows must pin the dated tag, not :latest --"
 echo "  container:"
 echo "    image: ${FULL_IMAGE_NAME}"
+echo ""
+echo "Currently pinned in .gitea/workflows/:"
+grep -ho "jellytau-builder:[A-Za-z0-9._-]*" "$(git rev-parse --show-toplevel)"/.gitea/workflows/*.yml 2>/dev/null | sort -u | sed "s/^/    /"

scripts/extract-traces.test.ts

@@ -23,6 +23,7 @@ import {
   findDanglingIds,
   formatMatrixFileLink,
   generateMarkdown,
+  isTracedSourceFile,
   MIN_COVERAGE_PERCENT,
   type TracesData,
 } from "./extract-traces";
@@ -30,6 +31,52 @@ import {
 // import.meta.dir is Bun-only; derive from import.meta.url under vitest.
 const HERE = path.dirname(new URL(import.meta.url).pathname);
 
+describe("isTracedSourceFile", () => {
+  // The extractor used to accept only .ts/.svelte/.rs under src/, src-tauri/src/
+  // and scripts/. Every requirement implemented by *configuration* was therefore
+  // invisible to the matrix that measures it: eslint.config.js (DR-205), the
+  // pre-commit hook (DR-207), rust-toolchain.toml (DR-206) and deny.toml
+  // (DR-216) all carry TRACES comments that were never read. Each one counted
+  // against coverage as an uncovered requirement while being, in fact, covered.
+  it("accepts the source extensions it always did", () => {
+    expect(isTracedSourceFile("src/lib/utils/logger.ts")).toBe(true);
+    expect(isTracedSourceFile("src/routes/settings/+page.svelte")).toBe(true);
+    expect(isTracedSourceFile("src-tauri/src/lib.rs")).toBe(true);
+  });
+
+  it("accepts tooling files that implement a requirement", () => {
+    expect(isTracedSourceFile("eslint.config.js")).toBe(true);
+    expect(isTracedSourceFile("src-tauri/deny.toml")).toBe(true);
+    expect(isTracedSourceFile("src-tauri/rust-toolchain.toml")).toBe(true);
+    expect(isTracedSourceFile("scripts/hooks/pre-commit")).toBe(true);
+  });
+
+  it("does not scan CI workflows, whose comments discuss TRACES in prose", () => {
+    // .gitea/workflows/traceability-check.yml explains the gate, so it contains
+    // lines like "a `TRACES:` comment ... (DR-189 and UT-188 lived in three
+    // source files, defined nowhere)". The extractor's pattern would read that
+    // as a trace and manufacture references to IDs that do not exist, failing
+    // traces:validate. A file that *describes* traceability is not a file that
+    // implements a requirement.
+    expect(isTracedSourceFile(".gitea/workflows/traceability-check.yml")).toBe(false);
+    expect(isTracedSourceFile(".gitea/workflows/build-and-test.yml")).toBe(false);
+  });
+
+  it("rejects files that merely mention a requirement in prose", () => {
+    // requirements.md defines IDs; traceability.md is generated *from* traces.
+    // Scanning either would make every requirement trace to itself.
+    expect(isTracedSourceFile("docs/requirements.md")).toBe(false);
+    expect(isTracedSourceFile("docs/traceability.md")).toBe(false);
+    expect(isTracedSourceFile("README.md")).toBe(false);
+  });
+
+  it("rejects generated and vendored trees", () => {
+    expect(isTracedSourceFile("node_modules/foo/index.ts")).toBe(false);
+    expect(isTracedSourceFile("src-tauri/target/debug/build/x.rs")).toBe(false);
+    expect(isTracedSourceFile("src-tauri/gen/android/app/build.gradle.kts")).toBe(false);
+  });
+});
+
 describe("countDefinedRequirements", () => {
   it("counts a well-formed table row as a defined requirement", () => {
     const md = `

scripts/extract-traces.ts

@@ -56,7 +56,7 @@ export interface TracesData {
  *
  * TRACES: | DR-093
  */
-export const MIN_COVERAGE_PERCENT = 88;
+export const MIN_COVERAGE_PERCENT = 89;
 
 // Repo root, derived from this script's location (scripts/ -> repo root).
 // Must NOT be hardcoded to a developer's machine, or CI checkouts see no files.
@@ -75,6 +75,71 @@ function extractRequirementIds(tracesString: string): string[] {
   return matches.map((m) => `${m[1]}-${m[2]}`);
 }
 
+/**
+ * Tooling files that implement a requirement.
+ *
+ * The walker below only visits `src/`, `src-tauri/src/` and `scripts/`, and only
+ * picks up `.ts`/`.svelte`/`.rs`. That made every requirement implemented by
+ * *configuration* invisible to the matrix that measures it — DR-205
+ * (eslint.config.js), DR-206 (rust-toolchain.toml), DR-207 (the pre-commit
+ * hook) and DR-216 (deny.toml) all carry TRACES comments that nothing read, so
+ * each was counted as uncovered while being covered.
+ *
+ * An explicit list rather than "also scan .toml/.js/.yml": most config files in
+ * this repo implement nothing, and one class of file is actively dangerous to
+ * scan — see `isTracedSourceFile`.
+ */
+const TOOLING_FILES = new Set([
+  "eslint.config.js",
+  "vitest.config.ts",
+  "scripts/hooks/pre-commit",
+  "src-tauri/deny.toml",
+  "src-tauri/rust-toolchain.toml",
+]);
+
+/** Directory names that never contain hand-written traced source. */
+const EXCLUDED_SEGMENTS = new Set([
+  "node_modules",
+  "target",
+  "build",
+  ".git",
+  ".svelte-kit",
+  "docs-site",
+  // Tauri regenerates src-tauri/gen/ on every android/desktop init; the
+  // canonical Android sources live in src-tauri/android/ and are synced into it.
+  "gen",
+]);
+
+/**
+ * Decide whether a repo-relative path should be scanned for TRACES comments.
+ *
+ * Exported for scripts/extract-traces.test.ts — the file-walking half needs a
+ * filesystem, this half is a pure decision and is where the mistakes live.
+ *
+ * Deliberately excluded:
+ *  - `docs/requirements.md` *defines* IDs and `docs/traceability.md` is
+ *    generated from traces; scanning either would make requirements trace to
+ *    themselves.
+ *  - `.gitea/workflows/*.yml` — traceability-check.yml explains the gate in
+ *    prose, quoting "a `TRACES:` comment" on the same line as example IDs that
+ *    are deliberately undefined. The extractor would read those as real traces
+ *    and then fail its own dangling-ID check.
+ */
+export function isTracedSourceFile(relativePath: string): boolean {
+  const p = relativePath.split(path.sep).join("/");
+  if (p.split("/").some((segment) => EXCLUDED_SEGMENTS.has(segment))) {
+    return false;
+  }
+  if (TOOLING_FILES.has(p)) {
+    return true;
+  }
+  const isSourceExtension = p.endsWith(".ts") || p.endsWith(".svelte") || p.endsWith(".rs");
+  if (!isSourceExtension) {
+    return false;
+  }
+  return p.startsWith("src/") || p.startsWith("src-tauri/src/") || p.startsWith("scripts/");
+}
+
 function getAllSourceFiles(): string[] {
   const baseDir = BASE_DIR;
   // `scripts` is scanned too: build tooling implements requirements (e.g.
@@ -90,23 +155,16 @@ function getAllSourceFiles(): string[] {
         const fullPath = path.join(dir, entry.name);
         const relativePath = path.relative(baseDir, fullPath);
 
-        // Skip node_modules, target, build
+        // Directory pruning still happens here so the walk does not descend
-        if (
+        // into node_modules/target at all; isTracedSourceFile repeats the rule
-          relativePath.includes("node_modules") ||
+        // for individual files (and is the version under test).
-          relativePath.includes("target") ||
+        if (entry.isDirectory() && !isTracedSourceFile(path.join(relativePath, "x.ts"))) {
-          relativePath.includes("build") ||
-          relativePath.includes(".git")
-        ) {
           continue;
         }
 
         if (entry.isDirectory()) {
           walkDir(fullPath);
-        } else if (
+        } else if (isTracedSourceFile(relativePath)) {
-          entry.name.endsWith(".ts") ||
-          entry.name.endsWith(".svelte") ||
-          entry.name.endsWith(".rs")
-        ) {
           files.push(fullPath);
         }
       }
@@ -122,6 +180,15 @@ function getAllSourceFiles(): string[] {
     }
   }
 
+  // eslint.config.js, deny.toml and rust-toolchain.toml sit at the repo root or
+  // in src-tauri/ rather than under a walked root, so they are added by name.
+  for (const toolingFile of TOOLING_FILES) {
+    const fullPath = path.join(baseDir, toolingFile);
+    if (fs.existsSync(fullPath) && !files.includes(fullPath)) {
+      files.push(fullPath);
+    }
+  }
+
   return files;
 }
 

src-tauri/Cargo.lock

@@ -421,9 +421,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
  "serde",
 ]
@@ -782,11 +782,10 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.5"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
- "powerfmt",
  "serde_core",
 ]
 
@@ -2035,7 +2034,7 @@ dependencies = [
  "libmpv",
  "log",
  "ndk-context",
- "rand 0.8.5",
+ "rand 0.8.7",
  "reqwest",
  "rusqlite",
  "serde",
@@ -2217,7 +2216,7 @@ dependencies = [
 [[package]]
 name = "libmpv"
 version = "2.0.1"
-source = "git+https://github.com/ParadoxSpiral/libmpv-rs.git?branch=master#3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7"
+source = "git+https://github.com/ParadoxSpiral/libmpv-rs.git?rev=3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7#3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7"
 dependencies = [
  "libmpv-sys",
 ]
@@ -2225,7 +2224,7 @@ dependencies = [
 [[package]]
 name = "libmpv-sys"
 version = "3.1.0"
-source = "git+https://github.com/ParadoxSpiral/libmpv-rs.git?branch=master#3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7"
+source = "git+https://github.com/ParadoxSpiral/libmpv-rs.git?rev=3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7#3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7"
 
 [[package]]
 name = "libredox"
@@ -2438,9 +2437,9 @@ checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-traits"
@@ -2915,7 +2914,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
  "phf_shared 0.10.0",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -2925,7 +2924,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared 0.11.3",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -3271,9 +3270,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -3574,9 +3573,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.8"
+version = "0.103.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4568,30 +4567,29 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.44"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
- "itoa",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.6"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.24"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
  "num-conv",
  "time-core",

src-tauri/Cargo.toml

@@ -71,8 +71,16 @@ tiny_http = { version = "0.12.0", default-features = false }
 [target.'cfg(target_os = "linux")'.dependencies]
 hostname = "0.4"
 libc = "0.2"
-# Use latest git version for better MPV version compatibility
+# The crates.io release of libmpv predates the MPV versions we support, so this
-libmpv = { git = "https://github.com/ParadoxSpiral/libmpv-rs.git", branch = "master" }
+# tracks the upstream git repo.
+#
+# Pinned by `rev`, not `branch = "master"`. With a branch, the revision is
+# whatever Cargo.lock happens to hold and any `cargo update` silently swaps in
+# new upstream code -- for the one dependency here that is not from crates.io,
+# is not signed, and links a C library into the player. The rev below is the
+# commit the lockfile already resolved to, so this pins current behaviour rather
+# than changing it. To take upstream fixes, bump this deliberately.
+libmpv = { git = "https://github.com/ParadoxSpiral/libmpv-rs.git", rev = "3e6c389b716f52a595cc5e8e3fa1f96cb76b3de7" }
 
 # JNI for Android ExoPlayer integration
 [target.'cfg(target_os = "android")'.dependencies]

src-tauri/deny.toml

@@ -0,0 +1,178 @@
+# cargo-deny configuration for the JellyTau backend.
+#
+# TRACES: | DR-216
+#
+# Run locally with:  cd src-tauri && cargo deny check
+# CI runs the same command in the `security` job of
+# .gitea/workflows/build-and-test.yml. cargo-deny is baked into the builder
+# image (Dockerfile.builder) -- the advisory database it fetches at run time is
+# *data*, not a toolchain, so it does not conflict with the "CI installs no
+# system tools" rule.
+#
+# Four checks run: advisories (known vulnerabilities), licenses (what we are
+# allowed to ship), bans (duplicate/undesired crates) and sources (where code
+# may come from).
+
+# ---------------------------------------------------------------------------
+# Graph scope
+#
+# Only the targets JellyTau actually ships. This is not a performance tweak --
+# it changes which advisories are *real*. Without it the graph includes Apple
+# targets, which drag in `plist` -> `quick-xml`, and two quick-xml DoS
+# advisories (RUSTSEC-2026-0194/0195) get reported against a crate that is not
+# compiled into anything we release. Ignoring them by ID would have been the
+# wrong fix: it silences the finding everywhere, including on a target where it
+# would matter. Scoping the graph makes the finding correctly absent instead.
+#
+# Add a target here the day we ship it, and expect new findings with it.
+[graph]
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "x86_64-pc-windows-msvc",
+    "aarch64-linux-android",
+    "armv7-linux-androideabi",
+    "x86_64-linux-android",
+]
+all-features = true
+
+[advisories]
+# Vulnerabilities and unsoundness are hard errors -- there is deliberately no
+# switch here turning them into warnings. Everything below is an explicit,
+# justified exception with a named ID; a new advisory fails the build until
+# somebody decides what to do about it.
+#
+# Yanked crates in the lockfile are an error too: a yank usually means the
+# author withdrew that exact version for a reason.
+yanked = "deny"
+
+ignore = [
+    # ---------------------------------------------------------------------
+    # GTK3 bindings: unmaintained, and not ours to replace.
+    #
+    # Tauri v2's Linux backend is WebKitGTK, which is GTK3. The gtk-rs project
+    # has stopped maintaining its GTK3 bindings in favour of GTK4, but Tauri
+    # cannot move until WebKitGTK does. These arrive through
+    # tauri -> tauri-runtime-wry -> wry -> gtk, with no version of any of them
+    # that avoids it ("No safe upgrade is available", per cargo-deny).
+    #
+    # Unmaintained != vulnerable: no advisory here describes an exploitable
+    # defect. Revisit when Tauri ships a GTK4/WebKitGTK-6 backend.
+    { id = "RUSTSEC-2024-0411", reason = "gdkwayland-sys: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0412", reason = "gdk: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0413", reason = "atk: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0414", reason = "gdkx11-sys: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0415", reason = "gtk: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0416", reason = "atk-sys: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0417", reason = "gdkx11: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0418", reason = "gdk-sys: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0419", reason = "gtk3-macros: GTK3 binding, pulled in by Tauri's Linux backend" },
+    { id = "RUSTSEC-2024-0420", reason = "gtk-sys: GTK3 binding, pulled in by Tauri's Linux backend" },
+
+    # ---------------------------------------------------------------------
+    # Unmaintained transitive build-time crates. All are proc-macro or
+    # lookup-table dependencies of Tauri's own toolchain; none has a safe
+    # upgrade and none is a vulnerability.
+    { id = "RUSTSEC-2024-0370", reason = "proc-macro-error: unmaintained proc-macro helper, transitive" },
+    { id = "RUSTSEC-2024-0436", reason = "paste: unmaintained macro helper, transitive" },
+    { id = "RUSTSEC-2025-0057", reason = "fxhash: unmaintained hasher, transitive" },
+
+    # unic-* reach us via urlpattern -> tauri-utils. Unicode table crates,
+    # superseded upstream but with no drop-in replacement at this depth.
+    { id = "RUSTSEC-2025-0075", reason = "unic-char-range: unmaintained, via urlpattern -> tauri-utils" },
+    { id = "RUSTSEC-2025-0080", reason = "unic-common: unmaintained, via urlpattern -> tauri-utils" },
+    { id = "RUSTSEC-2025-0081", reason = "unic-char-property: unmaintained, via urlpattern -> tauri-utils" },
+    { id = "RUSTSEC-2025-0098", reason = "unic-ucd-version: unmaintained, via urlpattern -> tauri-utils" },
+    { id = "RUSTSEC-2025-0100", reason = "unic-ucd-ident: unmaintained, via urlpattern -> tauri-utils" },
+]
+
+# ---------------------------------------------------------------------------
+# Licenses
+#
+# JellyTau ships as MIT (see ../LICENSE) in deb/rpm/AppImage/NSIS/APK bundles,
+# so every crate compiled into those has to be redistributable under terms
+# compatible with that. The list is an allow-list on purpose: a new crate with
+# an unlisted licence fails the build and gets a decision, rather than being
+# shipped because nobody looked.
+[licenses]
+# A crate offering a choice ("MIT OR Apache-2.0") is satisfied by any allowed
+# arm. 0.8 means we accept a licence-file match at >=80% textual confidence.
+confidence-threshold = 0.8
+
+allow = [
+    # Permissive, no redistribution conditions beyond attribution.
+    "MIT",
+    "MIT-0",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "0BSD",
+    "CC0-1.0",
+    "Unlicense",
+    "BSL-1.0",
+    # Unicode data tables (the icu_* family). Permissive, attribution only.
+    "Unicode-3.0",
+    # webpki-roots: the Mozilla CA bundle, published as data under CDLA.
+    "CDLA-Permissive-2.0",
+
+    # MPL-2.0 -- weak, *file-level* copyleft (cssparser, selectors, dtoa-short,
+    # option-ext). The obligation attaches to modified MPL files, not to the
+    # program that links them, so shipping them unmodified inside an MIT
+    # application is fine. If we ever patch one of these crates, that patch must
+    # be published.
+    "MPL-2.0",
+
+    # LGPL-2.1 -- `libmpv` and `libmpv-sys` only, and this one is deliberate.
+    #
+    # These are bindings to libmpv, which is itself LGPL-2.1+; the binding
+    # crates inherit the licence. LGPL permits use from a differently-licensed
+    # application provided the user can substitute their own build of the
+    # library, which dynamic linking satisfies -- libmpv-sys links the *system*
+    # shared object (the builder image installs libmpv-dev; the deb/rpm declare
+    # a runtime dependency) rather than statically embedding it.
+    #
+    # 🔴 Two obligations follow, and they are ours, not cargo-deny's:
+    #   - keep the linkage dynamic (do not switch libmpv-sys to a vendored
+    #     static build without revisiting this),
+    #   - ship libmpv's licence text with any bundle that carries the .so,
+    #     which currently means the AppImage.
+    "LGPL-2.1",
+]
+
+# Crates whose licence field is missing or unparseable get a per-crate
+# clarification here rather than a blanket relaxation. Empty today.
+exceptions = []
+
+[bans]
+# Duplicate versions are noise, not danger: a Tauri-sized graph legitimately
+# carries several `windows-sys` and `bitflags` majors because its dependencies
+# upgrade at different rates. Warn so the count stays visible; do not fail.
+multiple-versions = "warn"
+# The only wildcard in the graph is the `libmpv` git dependency: a git dep
+# carries no semver requirement, so cargo-deny counts it as `*` no matter how it
+# is pinned. It is pinned by `rev` in Cargo.toml and by hash in Cargo.lock, and
+# `[sources].allow-git` below is the check that actually constrains it -- so
+# "deny" here would fail the build forever over something already controlled
+# twice. Warn, so a *second* wildcard still shows up.
+wildcards = "warn"
+# `cargo build` order for equal-priority features; keeps the check deterministic.
+highlight = "all"
+
+deny = []
+skip = []
+
+[sources]
+# Anything not from crates.io needs to be named here. This is the check that
+# would notice a dependency being repointed at somebody's fork.
+unknown-registry = "deny"
+unknown-git = "deny"
+
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+
+# The one git dependency. Cargo.toml pins it by branch, not by revision, which
+# is worth knowing: the `master` it resolves to is whatever the lockfile has
+# recorded, and `cargo update` will move it. It exists because the crates.io
+# release of libmpv predates the MPV versions we support.
+allow-git = ["https://github.com/ParadoxSpiral/libmpv-rs.git"]