AINRA v0.3.1 — security: RUSTSEC-2025-0144 fixed, and the checks that hid it

Security release. Fixes one advisory end to end, and closes the class of CI failure that hid it.

Board evidence: docs/releases/v0.3.1-board.md — ALL GREEN 22/22 from a clean clone at the release commit.
Full workings: docs/PLAN-M26.md · post-mortem: SECURITY.md

The advisory

RUSTSEC-2025-0144 — timing side-channel in ml-dsa decompose(). Taken to 0.1.1, where Barrett reduction
replaces an operand-dependent hardware division on values derived from the secret components s2 and t0.

Blast radius, including the part that lets us off. This is a signing-side leak: verification consumes only
public inputs, so relying parties had no secret exposed. Registrar issuance, ceremony delegates and the CLI all
sign, so it was fixed in full regardless.

The pinning vector is NIST's, not ours. Our 745 conformance vectors were generated by the vulnerable crate
and could not adjudicate a change to it. FIPS 204 ML-DSA-65 known-answer tests were wired in first — keyGen,
byte-exact sigGen, and 15 sigVer cases of which 12 are negative. 0.0.4 passed them, so there was no second
finding. They run on every board now.

getrandom is also gone from the verify path — a default feature of ml-dsa 0.1 that our seed-first key
derivation never reaches, and which broke the WebAssembly build outright.

Checks that had never once run

Check	Appeared to be	Actually was
scorecard	a published OpenSSF score	referenced a tag that does not exist — never resolved
clusterfuzzlite	continuous parser fuzzing	failed at build every run — had never fuzzed one input
cargo-audit	advisories gated	short-circuited on an unmaintained notice, hiding this advisory

All three fixed, and every security gate now carries a proof it can go red on demand. cargo-audit reports
every finding before it gates. 56 GitHub Actions references pinned to commit SHAs, 0 floating.

Verifying these artifacts

ssh-keygen -Y verify -f allowed_signers -I release@ainra.org -n file -s SHA256SUMS.sig < SHA256SUMS
sha256sum -c SHA256SUMS

Then rebuild byte-for-byte from the tagged source: make repro. See RELEASE-VERIFY.md.

Artifacts were produced by make release at the tagged commit and signed with the offline release key
(D-042 — that key never enters CI). The tag-triggered workflow is fixed for the next release; its v0.3.1 run
failed on a missing Python runtime in the release container, and a tag is never moved to patch it.