[captjt]

Part of GRD-270.

Guardian's Source Scan fails on CVE-2026-115905 (zip < 9.0.5). Guardian's Integrity Service gets zip 0.6.6 only as a build dependency of utoipa-swagger-ui 3. Only utoipa-swagger-ui 10 uses a fixed zip, and it needs utoipa 6. The Integrity Service embeds about 25 of these models in its OpenAPI document, so the models have to move first: utoipa 6 can't use utoipa 3 derives.

• integrity-lineage-models: utoipa goes from 3.5.0 to 6.0.0, with the same features. It's the only crate here that uses utoipa. The lockfile adds utoipa-gen 6.0.1 and its syn 3.
• Hash fields: UrnCidWithSha256.sha256 and UrnCidWithSha384.sha384 are [u8; N] written as hex strings. utoipa 6 would describe them as arrays of integers, so #[schema(value_type = String, format = Binary)] keeps the schema they had.
• CHANGELOG: an Unreleased entry, marked Breaking: because the ToSchema impls are now utoipa 6's. Serialization and the Rust API are unchanged.

Schema comparison

I dumped every ToSchema type's schema under utoipa 3 (main) and utoipa 6 (this branch). Then I compared them after mapping OpenAPI 3.0's nullable: true onto 3.1's "null" type member. What's left:

• Documentation only: doc comments now appear next to $refs, and maps declare propertyNames: {type: string}.
• anchor::Location loses its discriminator: {propertyName: type}: utoipa 6 only derives discriminators for untagged enums. Each oneOf arm still requires its type value, so the JSON it accepts is the same. The Integrity Service's published spec never carried this discriminator, because a service type named Location replaces it there.
• ValueOrArray<String>: it pointed at a non-existent T schema and now points at String. Nothing references it, because ComputationStatement.input and output override it with value_type = String.

Checks

These pass on Rust 1.94.1 in nix develop:

• just ci: fmt-check, readme-check, build, build-wasm, lint, lint-docs, test (90 passed), test-wasm
• cargo check --locked -p integrity-ffi --features blob-all,signer-all

After merging: Guardian needs a v0.0.21 release to pick this up. The Guardian side is the axum 0.8 / utoipa 6 move in the Integrity Service.

🤖 Generated with Claude Code