[kunwarshivam]

Story

This fixes main, which is red at 9f4a259 for two separate reasons. Both fixes are in this PR so main goes green in one landing. Decisions: DEC-2334 and DEC-2338.

1. api-release runs in no CI job. #2289 (DEC-2338 item 5) added it to cargo xtask ci full after #2195 had split full's parts into full-checks and full-checks-2 (DEC-2334). So the_full_jobs_run_exactly_the_full_group fails on main and in every PR that selects xtask's tests (for example #2319).

• A new full-checks-3 job runs cargo xtask ci api-release alone. It has the same select gate and timeout-minutes: 10 as the other two, does checkout, toolchain and rust-cache only, and starts no services.
• The full aggregate needs it and judges its result like the other two: success where full_checks is selected, skipped where it is not.
• Why its own job. Locally, after exchange-release had warmed the release cache, api-release took 4m53s on 4 cores. CI's step timings on E10-13 connect finish split: the finish runs in its own process as the connection manager (DEC-2348 item 3) #2319's run show full-checks-2 spends about 4m28s in reference alone, before its two release builds. On a full selection, either existing job would have ended near or past ten minutes (DEC-464).

2. cargo deny --locked check fails on an advisory. ctutils 0.4.2 is affected by RUSTSEC-2026-0385 (RustCrypto/utils#1569): its constant-time Choice mask lacked an optimization barrier. 0.4.4 and later fix it.

• ctutils is a transitive RustCrypto crate, reached through aes-gcm, crypto-bigint, digest, sec1 and universal-hash (webpush, p256, sqlx-postgres).
• cargo update -p ctutils makes a patch-level bump to 0.4.5. It is a 2-line Cargo.lock change: nothing else moves, and no manifest, dependency or docs/dependencies.md row changes.

Spec clause → test

Spec clause or invariant	Test name
The full jobs together run exactly cargo xtask ci full's parts, each once, each gated and capped, and full needs every one	the_full_jobs_run_exactly_the_full_group
full fails on a failed, cancelled or skipped full-checks-3 when selected, and on one that ran when not selected	full_accepts_a_skipped_matrix_only_beside_a_plan_of_zero
full-checks-3 is skipped on drafts and gated by full_checks; the checkout count and the env-var list include it	the workflow guard, SELECT_GATES, checkout and env tests
No dependency carries a known advisory	cargo xtask ci supply-chain (cargo-deny)

Each fix was checked against its failure:

• With full-checks-3's line removed from the full script, full_accepts_… failed.
• Before the bump, cargo deny check advisories named RUSTSEC-2026-0385 on ctutils 0.4.2; after it, advisories, bans, licenses and sources all pass.

Dependencies

No new dependency. ctutils, already a transitive dependency, moves from 0.4.2 to 0.4.5, a patch-level security fix.

Journal events added

None.

Not done

Nothing else changes.

Decisions needed

None. The third job extends DEC-2334's split under DEC-464, an engineering choice.

Safety checklist (safety-critical changes)

Not safety-critical. The new job holds no credentials (contents: read).

Checks

• cargo nextest run -p xtask: 543 of 543 passed.
• actionlint on ci.yml.
• cargo xtask ci supply-chain: green (cargo-deny, the dependency registry, gitleaks).
• cargo build --workspace --locked.
• cargo xtask ci api-release locally: 4m53s.
• Review agent report attached

🤖 Generated with Claude Code

https://claude.ai/code/session_01UoxcMViCbnGUTPSaduuGYU