fix(supply-chain): correct Demucs release evidence on current develop

docs/security/dependency-policy.md

@@ -106,10 +106,10 @@ Current controlled exceptions:
 - `RUSTSEC-2024-0429` / `GHSA-wrw7-89jp-8q8g` for `glib 0.18.5` is allowed only for the `VariantStrIter` advisory inherited through the Tauri/wry/webkit2gtk/gtk GTK3 stack. A compatible lockfile refresh can move the desktop stack to `tauri 2.11.4`, `wry 0.55.1`, `tao 0.35.3`, `muda 0.19.3`, and related transitive patches, but it still does not move this stack to patched `glib >=0.20.0`; as of 2026-07-11, crates.io metadata for `tauri 2.11.5`, `tauri-runtime-wry 2.11.4`, `wry 0.55.1`, `webkit2gtk 2.0.2`, and `gtk 0.18.2` still keeps Linux on `gtk ^0.18` / `glib ^0.18`. Cargo target-tree evidence shows this Linux GTK stack is absent from the Windows and macOS artifacts BandScope ships. The exception must remain encoded in repo-controlled cargo-audit, OSV, and Trivy configuration, must carry a Trivy expiry/revisit date, is guarded by `scripts/checks/verify_supply_chain.py`, and must be removed when upstream drops or patches the chain.
 - `RUSTSEC-2026-0194` and `RUSTSEC-2026-0195` for `quick-xml 0.39.4` are allowed only while the current compatible upstream owner chains still require vulnerable `quick-xml`: `plist 1.9.0` through Tauri, and `wayland-scanner 0.31.10` through Linux `rfd`/Wayland dependencies. `quick-xml >=0.41.0` is patched, but `plist 1.9.0` requires `quick-xml ^0.39.2` and the current `wayland-scanner` release also has no compatible patched path. BandScope does not expose either owner chain as a user-controlled XML ingestion surface; the exception must stay encoded in repo-controlled cargo-audit and OSV configuration, and must be removed once compatible upstream crates publish a patched dependency path.
 
-Retired third-party deprecation and advisory signal:
+Retired or unresolved third-party deprecation and advisory signal:
 
 - `proc-macro-hack v0.5.20+deprecated`, `RUSTSEC-2025-0057` for `fxhash`, and `RUSTSEC-2026-0097` for legacy `rand 0.7.3` were removed by a compatible Tauri lockfile refresh that moved `tauri` to `2.11.0` and `tauri-utils` to `2.9.0`, dropping the `kuchikiki`/`selectors`/`phf 0.8` owner chain. Do not reintroduce this chain or restore the `RUSTSEC-2026-0097` Cargo audit exception; `scripts/checks/verify_supply_chain.py` rejects any future `rand 0.7.x` lockfile entry.
-- `GHSA-53q9-r3pm-6pq6` (`torch.load` RCE, fixed in torch 2.6) is allowed only for `torch 2.2.2` in `services/analysis-engine`: torch 2.2.2 is the last release publishing macOS Intel (x86_64) wheels, and the cross-platform build policy mandates macOS Intel + arm64. The vulnerable API only ever loads demucs's pinned model weights (bundled/checksum-tracked per this policy); user-supplied audio never reaches `torch.load`. The exception is encoded in `.github/workflows/dependency-review.yml` (`allow-ghsas`) and `services/analysis-engine/osv-scanner.toml`, and must be removed when the engine migrates off torch (e.g. ONNX runtime) or the Intel-mac mandate changes.
+- `GHSA-53q9-r3pm-6pq6` (`torch.load` RCE, fixed in torch 2.6) remains an unresolved `torch 2.2.2` compatibility risk because torch 2.2.2 is the last release publishing macOS Intel (x86_64) wheels and the cross-platform build policy still mandates macOS Intel + arm64. It is **not an active Python vulnerability exception**: the repository-local dependency-review workflow was removed during workflow consolidation, there is no `services/analysis-engine/osv-scanner.toml`, and the retained `security-backstop` runs `pip-audit --local --strict` without a targeted ignore. A future audit that reports this advisory must therefore fail closed rather than rely on stale exception prose. Protected `develop` currently resolves `htdemucs` through upstream `get_model`, whose first load can acquire weights, and the Demucs checkpoint path reaches the code-bearing `torch.load` serialization boundary. Draft #970 narrows compatibility loading to an already-present, bounded, checksum-prefix-validated local checkpoint snapshot with remote resolution disabled, but Draft behavior is not protected or released truth. #1180 owns the immutable full-digest/signature/provenance and safer serialization contract, while #1181 independently blocks upstream pretrained-weight commercial use/redistribution absent an explicit grant. Remove the vulnerable dependency path by moving to a patched or materially narrower loader/runtime, or retire the Intel-mac requirement; until then, release readiness remains fail closed on the model-artifact, security, and rights prerequisites.
 - Yanked `fastrand 2.4.0` was transiently inherited through target-specific `wry`/`dom_query` HTML parsing dependencies and must stay updated to `2.4.1` or newer in `apps/desktop/src-tauri/Cargo.lock`; `scripts/checks/verify_supply_chain.py` guards against reintroducing the yanked version.
 
 ## Required checks intent

services/analysis-engine/tests/test_supply_chain_policy.py

@@ -1275,9 +1275,7 @@ def test_workflow_concurrency_cancels_only_superseded_pr_heads() -> None:
         workflow = (workflows_dir / workflow_name).read_text(encoding="utf-8")
         assert "concurrency:" in workflow, workflow_name
         assert "cancel-in-progress: false" in workflow, workflow_name
-        assert "contents: read" in workflow or "permissions: read-all" in workflow, (
-            workflow_name
-        )
+        assert "contents: read" in workflow or "permissions: read-all" in workflow, workflow_name
 
     assert "pull_request:" not in (workflows_dir / "release.yml").read_text(encoding="utf-8")
 

supply-chain/supplemental-component-inventory.json

@@ -19,8 +19,8 @@
       "license": "Proprietary",
       "checksum": "sha256:ced4ae5c9077aace1694b6fafee1877e46e836e293545dcb6ea06cb579984254",
       "storagePath": "services/analysis-engine/src/bandscope_analysis/separation/model_weights/bandsplit-v1.json",
-      "releaseUsage": "Local-first lightweight profile used by analysis-engine stem separation.",
-      "verification": "SHA256 verified in bandscope_analysis.separation.audio_separator.AudioStemSeparator._load_model_profile"
+      "releaseUsage": "Tracked repository profile; the current runtime separation path does not consume it.",
+      "verification": "SHA256 is recorded here; runtime checksum verification is not currently implemented."
     }
   ],
   "notes": [