[maxtcodes]

Scope — Issue #47

Remove redundant, hardcoded wit-parser/tree-sitter version gates without weakening supply-chain, license, native build, or protected release controls.

• Resolve normal/build native and adapter closures from locked cargo metadata; report actual parser/runtime versions.
• Derive and compare grammar revision pins from both manifests and enforce the exact resolved grammar Git source.
• Keep license policy, supported target allowlist, license notice collection, and protected CD unchanged.

Corrections after independent audit at d270ae08df8b3c25b0022e62c616766c57f6c671

The independent audit identified three findings (F1 and F2 Medium; F3 Low). This branch now includes focused fixes:

• F1 — Unreviewed local dependencies: for source: null require a recognized Cargo workspace member and a canonical Cargo.toml under the canonical repository root; reject unapproved paths, outside paths, and symlink escapes.
• F2 — Resolved package identity: require one matching resolved package entry/ID, rather than deduplicating by version. Keep independent native and adapter parser closures.
• F3 — Exact crates.io source: compare against the pinned toolchain's exact approved registry source string, rejecting prefix lookalikes and unrelated registries.
• Add focused positive/negative fixtures for workspace boundaries, symlink escapes, same-version distinct package IDs, and registry lookalikes; retain existing grammar/license tests. Update docs/xtask.md.

Qualification and review evidence — SHA-specific

Historical owner-run local validation, d270ae08d (before audit corrections):

• cargo fmt --all -- --check, unfiltered and macOS ARM64 cargo xtask check-dependencies, cargo test -p xtask --locked (116 passing), cargo xtask verify (188 workspace Nextest passes, Clippy, check, docs, Wasm), cargo xtask test-publish (7 lifecycle tests + asset integrity), macOS ARM64 native release build/package, and redistribution license collection (116 packages) passed.
• Clean owner working tree was reported.

Historical hosted GitHub Actions, d270ae08d: all applicable PR quality/portability/test/registry checks passed. PR native artifact jobs were skipped.

Exact corrected HEAD — 3374eb3452906244069bcd8e012268bcc574d1b0: hosted GitHub Actions run 39441872071 passed all applicable PR checks: quality (including 123 passing xtask tests, check-dependencies, publish lifecycle and asset-integrity checks, rustfmt, Clippy with warnings denied, locked workspace checks, doctests, Wasm adapter build, and clean working tree), Windows/Linux/macOS native tests, Intel macOS and ARM64 Linux portability, and Zed registry compatibility. The main-only native artifact and five-target release sidecar verification jobs are skipped on PRs. Fresh owner-executed local qualification at this exact corrected HEAD and exact-HEAD native release/license sidecar checks have not yet been reported; historical local ARM64 notice collection at d270ae08d does not qualify this SHA.

Independent review: historical external audit at d270ae08d produced F1–F3; corrections require a fresh independent re-audit at the new exact HEAD. The audit findings are not described as independently resolved until that re-audit.

Do not merge without exact-HEAD qualification and independent review. Do not merge/rebase Dependabot PR #46 as part of this PR.

Refs #47; context: #46.