feat(simulation): add cargo audit to CI/review pipeline (#637)

Add `make audit` target running `cargo audit` with an advisory ignore for
RUSTSEC-2025-0141 (bincode, tracked by #636). Wire audit into `make pre-pr`
and `make pre-pr-server`. Add conditional cargo audit to the pre-commit hook
(triggers only when Cargo.toml/Cargo.lock are staged).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.config/hooks/pre-commit

@@ -23,6 +23,19 @@ run_check() {
 run_check "tooling/check-fact-ids" "fact_id validation"
 run_check "tooling/check-decision-ids" "decision ID duplication"
 
+# Run cargo audit only when Cargo.toml or Cargo.lock changed
+if git diff --cached --name-only | grep -qE '(Cargo\.toml|Cargo\.lock)$'; then
+    echo "pre-commit: Cargo dependency change detected — running cargo audit..."
+    if command -v cargo-audit >/dev/null 2>&1 || cargo audit --version >/dev/null 2>&1; then
+        if ! (cd "$REPO_ROOT/server" && cargo audit); then
+            ERRORS=$((ERRORS + 1))
+        fi
+    else
+        echo "pre-commit: WARNING — cargo-audit not installed, skipping advisory check"
+        echo "  Install with: cargo install cargo-audit"
+    fi
+fi
+
 if [ "$ERRORS" -gt 0 ]; then
     echo ""
     echo "pre-commit: $ERRORS check(s) failed. Commit aborted."

Makefile

@@ -3,6 +3,7 @@ GODOT := $(shell command -v godot4 2>/dev/null || command -v godot 2>/dev/null)
 .PHONY: help setup build check-protocol client server game stop test lint ci ci-client ci-server clean \
        decisions-sync decisions-coverage decisions-active decisions-orphan \
        db-backup db-install validate-content check-fact-ids setup-hooks \
+       audit \
        pre-pr pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures \
        pre-pr-server pre-pr-client pre-pr-content \
        fixtures-client fixtures-gauntlet golden-diff golden-update \
@@ -45,6 +46,7 @@ help:
 	@echo "  make decisions-coverage Decision-to-ticket coverage by domain"
 	@echo "  make decisions-active   List active decisions"
 	@echo "  make decisions-orphan   Decisions without implementing tickets"
+	@echo "  make audit              Run cargo audit (security advisory check)"
 	@echo "  make validate-content   Validate content YAML against schemas"
 	@echo "  make check-fact-ids    Check fact_id references against knowledge catalogs"
 	@echo "  make fixtures-client    Generate GDScript->Rust cross-encoder fixtures (#475)"
@@ -221,7 +223,7 @@ lint-client:
 
 # --- Pre-PR verification ---
 
-pre-pr: pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures
+pre-pr: pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures audit
 	@echo ""
 	@echo "=== PRE-PR: ALL CHECKS PASSED ==="
 	@echo "Safe to create PR."
@@ -274,7 +276,7 @@ pre-pr-fixtures:
 
 # Branch-specific variants (faster, scope-appropriate)
 
-pre-pr-server: lint-server build-server test-server pre-pr-fixtures
+pre-pr-server: lint-server build-server test-server pre-pr-fixtures audit
 	@echo "=== Server pre-PR: PASSED ==="
 
 pre-pr-client: lint-client build-client test-client
@@ -321,6 +323,9 @@ validate-content:
 check-fact-ids:
 	@tooling/check-fact-ids
 
+audit:
+	cd server && cargo audit
+
 checklist-validate:
 	@tooling/validate-checklist --check
 

server/audit.toml

@@ -0,0 +1,9 @@
+# cargo audit configuration for settled-reach-server.
+# Known advisories that are tracked but not yet resolved are listed here.
+# New advisories NOT in this list will fail CI.
+
+[advisories]
+# RUSTSEC-2025-0141: bincode v1.3.3 is unmaintained.
+# Migration to bincode v2 or an alternative is tracked in ticket #636.
+# This ignore can be removed once #636 is resolved.
+ignore = ["RUSTSEC-2025-0141"]