.carbonyl-fingerprint-version

# Pinned wreq version for the carbonyl-fingerprint TLS-egress layer.
# Mirrors the .carbonyl-runtime-version pattern from ADR-004.
#
# Format: one `key=value` line per setting. Comments and blank lines ignored.
#
#   wreq-version: crate semver (matches `wreq = "X.Y.Z"` in Cargo.toml)
#   wreq-sha:     git SHA of the upstream commit pulled (40-char hex)
#                 — verifies which exact source landed even if the
#                 crate registry mutates underneath us.
#   wreq-source:  upstream URL of record (for the cold mirror in #60).
#
# CI (`.gitea/workflows/check.yml`) compares the resolved Cargo.lock
# SHA against `wreq-sha` and fails on drift when `wreq-sha` is a
# 40-char hex commit. Phase 2.2 (#81) resolved wreq from the crates.io
# registry rather than a git pin, so `wreq-sha=registry` skips the
# drift check (Cargo.lock + crates.io are the integrity record). A
# future bump to a git pin restarts the drift check naturally.
#
# Pin-bump procedure: see `docs/wreq-pin-bumps.md`.
#
# Refs:
#   - ADR-005 § Bus-factor mitigation plan, item 1
#   - roctinam/carbonyl-agent#59 (this file)
#   - roctinam/carbonyl-agent#44 (consumer)

# Phase 2.2 (#81) landed wreq from the crates.io registry rather than
# a git pin. The CI drift check (`.gitea/workflows/check.yml`) skips
# silently when the lockfile has no git-source `#<sha>` — registry
# resolution is verified by Cargo.lock itself, not this pin file.
# Switching to a git pin (e.g. to anchor on a security-relevant SHA)
# is a follow-up bump documented in `docs/wreq-pin-bumps.md`.
wreq-version=5.3.0
wreq-sha=registry
wreq-source=https://crates.io/crates/wreq