A smaller "Standing Trust Grant"

[zancas]

546 → 142 lockfile entries since this effort diverged from main: a 74% reduction. Here's the justification:

Why these changes

Every entry in Cargo.lock is a "Standing Trust Grant".

These entries imply a publisher who can ship code into this build, a crate that must be audited (or have its audit imported via cargo-vet), and a potential vector when any of them is compromised or abandoned.

These PRs (this and previous) attack that surface on three fronts.

Link binaries' protocols, not their code.

The largest win was architectural: the harness drives zebrad but no longer links it.

I replaced zebra-node-services with a hand-rolled JSON-RPC client and the zebra-rpc block-assembly code with an in-crate zebra_rpc module.

The "in house" zebra_rpc API is pinned by golden fixtures captured from a live differential run.

These two changes allowed me to remove the entire zebra/librustzcash tree — 361 lockfile entries in the final excision commit alone. Bear in mind that this is from the build of a crate whose actual job is launching subprocesses. A test harness that transitively compiles half the Zcash ecosystem to POST JSON at localhost was pure inherited risk.

Tolerated Security Advisories: >= 2 --> 0

The effort eliminates every advisory-flagged unmaintained crate the workspace carried:

• json (RUSTSEC-2022-0081, single call site → serde_json)
• getset's proc-macro stack including proc-macro-error2 (RUSTSEC-2026-0173) — whose cargo-deny ignore is deleted

Cargo deny now passes with no advisories waived at all. The policy surface went from "we know about this one and accept it" to empty.

Smaller cuts follow the same logic: bip0039 dragged ~18 crates (the stale rand 0.8/getrandom 0.2 stack, zerocopy, pbkdf2 machinery) into every consumer's graph to re-derive one hardcoded constant in one test.

Use A Feature Gate, to prepare for lwd/zcashd deprecation:

Zcashd is deprecated upstream; its patched fork and lightwalletd were the harness's last legacy obligations.
Gating them behind an explicitly unsupported legacy-stack feature (excision scheduled in 0.8.0, ADR-0001) means the default build — what CI verifies and consumers get — carries no code, no config machinery, and no CI binary provisioning for components with no future.

I considered removing reqwest but that would have significantly altered the public API, for relatively little kruft reduction. reqwest is widely used.

How these assertions were verified

• 546 → 142 / 74%: count in Cargo.lock at git merge-base main HEAD (546) vs. HEAD (142); 404/546 = 74.0%.
• 361-entry excision: same count at 477504b^ (559) vs. 477504b (198), measured per-commit across the whole excision sequence.
• Golden-fixture provenance: commit 477504b body; fixtures live in tests/zebra_rpc_golden.rs.
• Zero waived advisories: deny.toml grep shows no ignore entries; cargo deny check advisories run on the current tree → "advisories ok".
• bip0039/json cost: per-commit lockfile counts across 3d45603 (172 → 154), cross-checked against its commit body.
• Nothing unused: cargo shear reports no unused dependencies across all four crates and the workspace dependency table — no crate is compiled, and no workspace entry dangles, without a consuming use. The one class no syntax scanner flags — a declared [build-dependencies] section with no build.rs to consume it — was found by hand and removed.
• Nothing unused: cargo machete clean; the inert [build-dependencies] section it misses was found by checking for build.rs and removed.
• reqwest ~70: measured by temporary cargo remove + cargo tree set-difference (72 entries), then reverted; the prototype passed zebrad_http_response_framing_contract against the real zebrad binary before rejection.
• Legacy gate ships working: 19/19 smoke tests with --features legacy-stack against zcashd v6.20.0 and lightwalletd v0.4.19; default-build coverage via cargo check/clippy/nextest on both feature configurations.