[QuicksilverSlick]

Russell: tapping Ship it on this PR accepts one narrow security risk, described under "The risk this accepts".

Why this is a hotfix (lane:hotfix): at 4:03 AM CT on Mon 9 Nov 2026 the steward's cargo-deny check closed train #144 on new RustSec advisories, and only a hotfix can leave until main passes. A third advisory landed at 4:18 AM CT while this was being built. PR #142 and everything behind it wait on this.

What changes

Two files. Nothing under desktop/, so this needs no launch check.

• Cargo.lock: rmcp and rmcp-macros 3.4.1 to 3.9.0, and nothing else moved. That clears RUSTSEC-2026-0457, 0461 and 0462 for the root's 3.x copy.
• deny.toml: two new ignores, each with its reasoning and removal condition.

Each fix alone fails cargo-deny on the others, so they have to ship together.

The risk this accepts

RUSTSEC-2026-0459 (bundled SQLite before 3.54.0). A database file paired with a crafted -wal file of a different page size can make ordinary queries return stale bytes from the process's memory.

We can't take the fix yet. It needs libsqlite3-sys 0.39, every tagged mesh-llm through v0.78.1 requires rusqlite ^0.40, and Cargo allows only one copy of SQLite in a build.

The exposure is narrow but real, which is why the entry says accepted rather than unaffected:

• The desktop opens archive/archive.db inside the nest at every start, and the nest is the working directory of spawned agents. An agent running in an OS sandbox that can write there could plant the pair. Agents without a sandbox already have the user's full authority, so the bug adds nothing for them.
• The installed Windows app does contain the affected SQLite (3.53.2).
• Not proven either way: whether leaked bytes can get back to an agent. Nothing here was exercised with a crafted file.
• The other desktop databases are outside the nest. No import, restore, relay path or ATTACH reaches a SQLite open. The root workspace opens no SQLite file.

The alternative is moving archive.db out of the nest into the app data folder, with a one-time migration of a 2.4 GB file. That closes the agent path, but it is a desktop change with its own launch check, so it isn't in this hotfix.

RUSTSEC-2026-0462 on rmcp 1.8.0. Unbounded HTTP response bodies. There is no 1.x fix. buzz-agent is the only user and compiles only client and transport-child-process, so the HTTP client isn't built. The ignore is by id, so it would also hide a 3.x copy, and the comment says 3.x must stay at 3.9.0 or later.

Still open after this

• The desktop lockfile stays on rmcp 3.2.0 until the stacked follow-up PR lands. That copy compiles only with the mesh-llm feature, which Dreamforge release builds don't enable. Developer builds with just mesh=1 and CI's mesh-llm jobs still compile it until then, and 0462 is hidden on it in the meantime.
• Merging publishes a new desktop release about an hour later. The root lockfile builds the sidecars, so buzz-dev-mcp ships on rmcp 3.9.0. The kit's launch check only looks at desktop/ paths, so that sidecar change gets no launch check.

How it was checked

• cargo-deny, the steward's exact commands and CI's all-checks form, root and desktop: pass on this commit, against advisory database 899077d9 (RustSec's latest at 5:15 AM CT).
• --all-features: root passes; desktop fails only on 0457 and 0461 for rmcp 3.2.0, which the follow-up clears.
• With the two ignores removed, both ids fail, so both entries are doing real work.
• cargo check --locked for buzz-dev-mcp, buzz-agent and buzz-mesh-smoke --examples, which compile the mesh-llm crates against 3.9.0. Clippy with -D warnings on the first two.
• buzz-dev-mcp tests: 102 library and 2 stdio lifecycle tests pass.
• An independent agent review re-derived each statement in the two deny.toml comments from code, cargo tree, the rmcp source and the advisory text. The commit reviewed differs from this one only in the wording of the 0459 comment, which that review asked for.

Factory-Task: security/advisories-rustsec-2026-0459-0462
Built-by: claude-code/claude-opus-5-5
Claude-Account: russelledeming@gmail.com
Undo: revert this PR. Main then fails cargo-deny again and the lane stops until another hotfix. A desktop release already published can't be recalled, and an installed app never goes back a version.

🤖 Generated with Claude Code