Harden dependency and supply-chain policy (#100)

RUSTREWRITE.md

@@ -417,7 +417,7 @@ MSRV, features, and licenses at adoption time.
 | SkiaSharp 4.150.1 | [`skia-safe` 0.99.0](https://crates.io/crates/skia-safe/0.99.0) | Adopted behind the opt-in `skia` feature. Target-specific official binary-cache feature sets provide BMP/GIF/ICO/JPEG/PNG/WBMP/WebP decoding on macOS, Linux, and Windows; checked owned buffers keep Skia types out of the core image API. |
 | Pfim 0.11.4 | [`image` 0.25.10](https://crates.io/crates/image/0.25.10), [`ddsfile` 0.6.0](https://crates.io/crates/ddsfile/0.6.0) | `image` covers TGA and common DDS decoding; `ddsfile` exposes DDS container details. Golden files decide whether both are needed. |
 | OggVorbisEncoder 1.2.2 | [`vorbis_rs` 0.5.6](https://crates.io/crates/vorbis_rs/0.5.6) | BSD-3-Clause, MSRV 1.82, backed by C libraries. Feature-gate native audio encoding. |
-| SIPSorcery 8.0.23 | [`webrtc` 0.20.0](https://crates.io/crates/webrtc/0.20.0), [`cpal` 0.18.1](https://crates.io/crates/cpal/0.18.1), [`opus` 0.3.1](https://crates.io/crates/opus/0.3.1) | Validate SDP, ICE, data-channel framing, audio formats, device hotplug, and native libopus deployment separately. Do not claim parity from successful compilation. |
+| SIPSorcery 8.0.23 | [`str0m` 0.22.0](https://crates.io/crates/str0m/0.22.0), [`cpal` 0.18.1](https://crates.io/crates/cpal/0.18.1), system libopus 1.3+ through `libremetaverse-opus` | The private safe adapter avoids the unmaintained `audiopus_sys` binding. Validate SDP, ICE, data-channel framing, audio formats, device hotplug, and native libopus deployment separately. Do not claim parity from successful compilation. |
 | LSL generated parser | [`lalrpop` 0.23.1](https://crates.io/crates/lalrpop/0.23.1) | Candidate only. Preserve grammar conflicts, recovery, token positions, and diagnostics before replacing the generated parser. |
 | NUnit/Moq | built-in test harness, [`mockall` 0.15.0](https://crates.io/crates/mockall/0.15.0), [`proptest` 1.11.0](https://crates.io/crates/proptest/1.11.0) | Prefer fakes and deterministic protocol fixtures; use mocks only for interaction contracts. Add properties after direct parity cases exist. |
 | NUnit benchmarks | [`criterion` 0.8.2](https://crates.io/crates/criterion/0.8.2) | Port benchmark-category methods to `benches/`; never make timing thresholds correctness tests. |
@@ -429,6 +429,29 @@ not select a crate merely because NuGet used one. In particular, begin with
 `Mutex<HashMap<...>>` rather than a concurrent-map dependency and add a pool
 only after allocations appear in a profile.
 
+### 4.1 Adopted direct dependency inventory
+
+The candidates above are not the release inventory. The machine-checked
+inventory is [`ci/dependency-policy.json`](ci/dependency-policy.json); each
+locked direct version must appear there with its implemented purpose,
+maintenance state, transitive-cost classification, and native-code status.
+The current adopted set is:
+
+| Responsibility | Adopted direct crates |
+|---|---|
+| Async and HTTP | `tokio`, `futures-channel`, `futures-util`, `reqwest` |
+| Wire data and parsing | `base64`, `serde`, `serde_json`, `roxmltree`, `regex`, `unicode-general-category` |
+| Identity, hashing, and platform facts | `uuid`, `getrandom`, `md-5`, `sha1`, `sha2`, `mac_address2`, `os_info` |
+| Archives, images, and audio | `flate2`, `tar`, `bcdec_rs`, `skia-safe`, `hound`, `vorbis_rs`, `str0m`, `cpal` |
+| Code generation and program CLI | `syn`, `prettyplease`, `clap` |
+| Build and compatibility-test support | `pkg-config`, `vcpkg`, `stats_alloc` |
+
+System libopus is accessed only through the private `libremetaverse-opus`
+safe adapter; it replaces the unmaintained `audiopus`/`audiopus_sys` stack.
+The adapter uses `pkg-config` on Linux, macOS, and Windows GNU, and `vcpkg` on
+Windows MSVC. The dependency audit fails closed for any new direct crate,
+resolved version, duplicate-version set, wildcard, Git source, or registry.
+
 ## 5. Module-by-module implementation guidance
 
 ### 5.1 `libremetaverse-types`