Record strict current RustSec audit and reconcile verified GLib gates

docs/DEPENDENCY-REVIEW.md

@@ -5,7 +5,8 @@ by the desktop lockfile. Root independently verified all 121 original archive
 members and the exact two-line patch using `tools/glib-regression/verify_vendor.py`.
 The patched source retains original LF bytes; provenance records were updated
 after removing an unintended Windows newline conversion. Optimized Linux tests
-now pass; native desktop validation and the broad security gate stay open.
+now pass; native Linux release compilation and packaged startup also passed.
+Native graphical interaction and the broad security gate stay open.
 
 Recorded 2026-10-13 against commit `4e60038c2f3b0a7b1d2dd0f4361309a735ee140f`.
 This is an advisory inventory and dependency-path review, not a complete security
@@ -52,7 +53,7 @@ sent to the advisory service, and npm used the configured registry audit endpoin
 
 ## Findings and disposition
 
-### Linux desktop GLib unsoundness: unresolved
+### Initial Linux desktop GLib finding: subsequently locally remediated
 
 `glib 0.18.5` matches
 [RUSTSEC-2024-0429](https://rustsec.org/advisories/RUSTSEC-2024-0429.html).
@@ -108,11 +109,11 @@ performance; native appearance review/testing remains a separate open gate.
 
 ## Remaining review scope
 
-- Execute established `cargo audit` against both lockfiles before release,
-  including informational findings; do not treat this OSV fallback as an
-  equivalent full audit of the project's source or target resolution.
-- Resolve/review Linux GLib exposure with upstream-compatible evidence and
-  preserve reproducible findings; retain the maintenance notices until resolved.
+- Keep established `cargo audit` current before subsequent releases, including
+  informational findings. The completed scan below supersedes the earlier OSV
+  fallback for current lockfiles; it does not audit project source.
+- Maintain the reviewed GLib backport and preserve reproducible findings;
+  native graphical interaction and the maintenance notices remain open.
 - Audit native vendored ggml/llama runtime, FFmpeg/codec builds, Vulkan loader,
   copied CRT and OS webviews separately. Cargo/npm locks do not inventory their
   bundled native source versions or OS security patch state.
@@ -122,7 +123,8 @@ performance; native appearance review/testing remains a separate open gate.
 
 ## Compatible GLib remediation research
 
-Research recorded 2026-10-13; no patch has been applied or tested yet.
+The following records research on 2026-10-13 before applying the patch.
+The subsequent implementation and execution evidence follows below.
 The official [upstream fix](https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34)
 is exactly two changed lines in `glib/src/variant_iter.rs`: the local output
 pointer becomes mutable and the variadic C call receives `&mut p` instead of
@@ -227,5 +229,56 @@ Raw WSL evidence:
 `/home/karl/.cache/searchi-validation/glib-optimized-20261013.log`, SHA-256
 `98ce2a1580e6b73f58040d6efefdbdcc2dcb5e2cab6f64dc88d8a9424a0031dc`.
 This validates the focused iterator regression, not all GLib memory safety or
-the patched native desktop. Desktop interaction, broad security review and the
+the patched native desktop. Subsequent native 0.1.4 compilation and packaged
+startup passed with this selected local crate; see [Linux package evidence](LINUX-0.1.4.md).
+Desktop interaction, broad security review and the
 separate macro maintenance notice remain open.
+
+## Current established scanner execution
+
+On 2026-10-13 at 15:52:51 UTC, official `cargo-audit 0.22.2` inspected both
+current lockfiles using RustSec database revision
+`6aed84668c23d7f535077a9fe918bf1fa0f6a5bc`, containing 1310 advisories.
+The workspace scan fetched the database; the desktop scan reused that exact
+checkout with `--no-fetch`. Its JSON database commit fields are null in that
+mode; the independently read Git revision above identifies the shared checkout.
+No advisory ignore list, target filter or yanked-check bypass was used.
+
+The [official Windows artifact](https://github.com/rustsec/rustsec/releases/tag/cargo-audit%2Fv0.22.2)
+was verified against GitHub's published digest before extracting/executing:
+6192256 bytes, archive SHA-256
+`0a7316540862c13d954f648917ceacca593747baed6eec180fafa590be2710ab`.
+The tool is kept under ignored `.searchi/tools`; it is not an app dependency or
+a globally installed replacement. No inference or GPU operation was involved.
+
+Equivalent commands with that tool available on PATH:
+
+```sh
+cargo audit --file Cargo.lock --db .searchi/dependency-review/rustsec-current --json --deny warnings
+cargo audit --file apps/desktop/src-tauri/Cargo.lock --db .searchi/dependency-review/rustsec-current --json --deny warnings --no-fetch
+```
+
+Both reported zero vulnerability-class findings, but both exited **1** because
+warnings were denied. Workspace warning: `paste 1.0.15`, RUSTSEC-2024-0436;
+desktop warning: `proc-macro-error 1.0.4`, RUSTSEC-2024-0370. The paths/dispositions
+above remain applicable. This is not a fully green strict audit. No speculative
+macro/framework migration or silent warning suppression was introduced.
+
+The scanner does not list the local GLib override as the affected registry
+package. This omission is not proof of remediation: the independent 121-file
+archive comparison, exact upstream patch and optimized iterator tests remain
+the evidence for this local backport. Their stored log hash was rechecked and
+the original-archive verifier rerun successfully on the current vendor tree.
+
+| Current input/report | SHA-256 |
+| --- | --- |
+| Workspace lockfile | `f6f995c96bf8554175423edfaccbdf61b88a52a5742c660a4a6346395139eb6e` |
+| Desktop lockfile | `12b3522694a2a85c937b59b3d8128b10517b2393f6ceb6c105fb75c28e4d398e` |
+| Workspace audit JSON | `7fee9db9cf1dca04b82b915cfff76a3fee0023c7fb419d61b287b46d394ec461` |
+| Desktop audit JSON | `b4a039d05ad54be81cd0673af5fe9c281193449bb03cc882fe65843a6437d65c` |
+
+Ignored reports and stderr files live in
+`.searchi/dependency-review/cargo-audit-0.22.2-current/`.
+Advisory data changes; repeat this established scan before future releases.
+Registry scanning does not cover native runtime/codec source, platform webviews,
+unreported issues or project-level security, whose gates stay open.

docs/ROADMAP.md

@@ -156,8 +156,10 @@ release. Keep their evidence and unchecked production gates intact.
 - [ ] Formatting, lint, tests and security/dependency review.
   - [x] Inventory locked Rust/npm advisories; prepare byte-verified compatible
     upstream GLib iterator backport for the Linux desktop dependency graph.
-  - [ ] Execute optimized Linux backport regressions and native desktop checks;
-    complete native runtime and source security review. See DEPENDENCY-REVIEW.md.
+  - [x] Execute optimized Linux GLib backport regressions: three tests and the owner-lifetime compile-fail test passed; stored log hash and all 121 upstream source files reverified.
+  - [x] Native Linux 0.1.4 desktop build and packaged CPU startup use the selected local GLib backport; native graphical interaction remains unchecked.
+  - [x] Execute cargo-audit 0.22.2 against both current lockfiles with a fresh RustSec database and warnings denied; zero vulnerability-class findings, two tracked maintenance notices and exit 1. See DEPENDENCY-REVIEW.md.
+  - [ ] Complete native graphical interaction and broader native runtime/source security review. No broad security gate is closed by these narrow checks.
 - [ ] CPU benchmarks: filename p95 <50 ms/1M records; text <150 ms/100K documents; semantic <500 ms on declared hardware.
 - [ ] Measure cold start, indexing throughput, RAM, disk and idle CPU.
 - [ ] Record the very first foreground query and distinct unseen queries after