fix: restore sqlparser dependency and security policy compliance

- Add missing sqlparser = "0.50" dependency to Cargo.toml (accidentally
  removed in commit b30ea01 when adding tracing dependencies)
- Fill in security.txt template placeholders with actual values:
  - Contact: j.d.a.jewell@open.ac.uk
  - Encryption: PGP key URL from keys.openpgp.org
  - Hiring: hyperpolymath.dev/careers
- Add SECURITY.md with RFC 9116 compliant security policy
- Apply cargo fmt fixes to source files

This fixes the root cause of PR #135 failing checks (cargo check,
governance/Well-Known RFC 9116 + RSR).

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.well-known/security.txt

@@ -2,10 +2,10 @@
 # RFC 9116 - security.txt
 # https://securitytxt.org/
 
-Contact: mailto:{{SECURITY_EMAIL}}
+Contact: mailto:j.d.a.jewell@open.ac.uk
 Expires: 2026-12-31T23:59:59.000Z
-Encryption: {{PGP_KEY_URL}}
+Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/A0482E114994E946284637D320731542C19A770E
 Preferred-Languages: en
 Canonical: https://github.com/hyperpolymath/verisimiser/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/verisimiser/blob/main/SECURITY.md
-Hiring: https://{{WEBSITE}}/careers
+Hiring: https://hyperpolymath.dev/careers

Cargo.toml

@@ -22,6 +22,7 @@ thiserror = "2"
 chrono = { version = "0.4", features = ["serde"] }
 sha2 = "0.10"
 rusqlite = { version = "0.32", features = ["bundled", "hooks"] }
+sqlparser = "0.50"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 

SECURITY.md

@@ -0,0 +1,13 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Email:** j.d.a.jewell@open.ac.uk
+
+**Response timeline:**
+- Acknowledgement within 48 hours
+- Initial assessment within 7 days
+- Fix or mitigation within 90 days
+
+**Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure.

src/codegen/overlay.rs

@@ -802,8 +802,7 @@ mod tests {
     fn test_sqlite_dialect_seed_and_portable_timestamp() {
         let schema = test_schema();
         let octad = OctadConfig::default();
-        let ddl = generate_sidecar_schema(&schema, &octad, SqlDialect::Sqlite)
-            .expect("sqlite ddl");
+        let ddl = generate_sidecar_schema(&schema, &octad, SqlDialect::Sqlite).expect("sqlite ddl");
         assert!(ddl.contains("INSERT OR IGNORE INTO verisimdb_metadata"));
         assert!(
             ddl.contains("CURRENT_TIMESTAMP"),
@@ -820,8 +819,8 @@ mod tests {
     fn test_postgres_dialect_uses_on_conflict_not_or_ignore() {
         let schema = test_schema();
         let octad = OctadConfig::default();
-        let ddl = generate_sidecar_schema(&schema, &octad, SqlDialect::Postgres)
-            .expect("postgres ddl");
+        let ddl =
+            generate_sidecar_schema(&schema, &octad, SqlDialect::Postgres).expect("postgres ddl");
         assert!(
             ddl.contains("ON CONFLICT (table_name) DO NOTHING"),
             "postgres metadata upsert must use ON CONFLICT"

src/tier1/provenance.rs

@@ -282,9 +282,8 @@ pub fn fork_points(conn: &Connection, entity_id: &str) -> rusqlite::Result<Vec<F
 
 /// The current set of branch-tip hashes for `entity_id`.
 fn head_set(conn: &Connection, entity_id: &str) -> rusqlite::Result<Vec<String>> {
-    let mut stmt = conn.prepare(
-        "SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id = ?1",
-    )?;
+    let mut stmt = conn
+        .prepare("SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id = ?1")?;
     let rows = stmt.query_map([entity_id], |r| r.get::<_, String>(0))?;
     rows.collect()
 }
@@ -489,7 +488,9 @@ mod tests {
 
         let heads: Vec<String> = {
             let mut s = conn
-                .prepare("SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id='e1'")
+                .prepare(
+                    "SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id='e1'",
+                )
                 .unwrap();
             let r = s.query_map([], |x| x.get::<_, String>(0)).unwrap();
             r.collect::<Result<_, _>>().unwrap()
@@ -518,7 +519,9 @@ mod tests {
 
         let heads: Vec<String> = {
             let mut s = conn
-                .prepare("SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id='e1'")
+                .prepare(
+                    "SELECT head_hash FROM verisimdb_provenance_chain_heads WHERE entity_id='e1'",
+                )
                 .unwrap();
             let r = s.query_map([], |x| x.get::<_, String>(0)).unwrap();
             r.collect::<Result<_, _>>().unwrap()

tests/integration_test.rs

@@ -78,7 +78,9 @@ fn test_full_pipeline_blog_schema() {
         enable_constraints: true,
         enable_simulation: false,
     };
-    let overlay_ddl = overlay::generate_sidecar_schema(&schema, &octad, overlay::SqlDialect::Sqlite).expect("schema is valid");
+    let overlay_ddl =
+        overlay::generate_sidecar_schema(&schema, &octad, overlay::SqlDialect::Sqlite)
+            .expect("schema is valid");
 
     // Verify all expected sidecar tables are present.
     assert!(
@@ -487,7 +489,8 @@ path = ".verisim/test.db"
 
     // Generate overlay.
     let overlay_ddl =
-        overlay::generate_sidecar_schema(&schema, &manifest.octad, overlay::SqlDialect::Sqlite).expect("schema is valid");
+        overlay::generate_sidecar_schema(&schema, &manifest.octad, overlay::SqlDialect::Sqlite)
+            .expect("schema is valid");
     assert!(overlay_ddl.contains("verisimdb_provenance_log"));
     assert!(overlay_ddl.contains("verisimdb_temporal_versions"));
     assert!(

tests/provenance_fork_test.rs

@@ -60,12 +60,10 @@ fn fork_can_be_written_and_both_branches_persist() {
     let entity = "account:42";
 
     // Genesis, then a normal linear child (branch A) off it.
-    let genesis =
-        append_provenance(&mut conn, entity, "accounts", "insert", "alice", None, None)
-            .expect("genesis append");
-    let _branch_a =
-        append_provenance(&mut conn, entity, "accounts", "update", "alice", None, None)
-            .expect("branch A append (linear, off genesis)");
+    let genesis = append_provenance(&mut conn, entity, "accounts", "insert", "alice", None, None)
+        .expect("genesis append");
+    let _branch_a = append_provenance(&mut conn, entity, "accounts", "update", "alice", None, None)
+        .expect("branch A append (linear, off genesis)");
 
     // A second, partitioned-but-honest writer extends the chain from
     // the SAME genesis tip — a legitimate fork via the explicit API.
@@ -123,8 +121,17 @@ fn each_branch_verifies_independently() {
 
     let genesis = append_provenance(&mut conn, entity, "t", "insert", "a", None, None).unwrap();
     append_provenance(&mut conn, entity, "t", "update", "a", None, None).unwrap();
-    append_provenance_fork(&mut conn, entity, "t", "transform", "b", None, None, &genesis)
-        .unwrap();
+    append_provenance_fork(
+        &mut conn,
+        entity,
+        "t",
+        "transform",
+        "b",
+        None,
+        None,
+        &genesis,
+    )
+    .unwrap();
 
     // Divergence is not tampering: every branch is hash-consistent, so
     // the forked entity must still verify true.