audit: cycle 0011 tidy — record the external-dependency firewall invariant

Architect drift review (f68258b..HEAD) found no code drift — the firewall is
real at the dependency-graph level (aura-core/std/engine/cli carry no external
dep; the chrono/regex/zip tree is confined to aura-ingest), and C3/C7/C1 are
faithfully realized. Four ledger-level items, all resolved here:

- [ledger-drift] The zero-external-dependency commitment — the load-bearing
  rationale for making aura-ingest a crate rather than a feature-gate — lived
  only in spec 0011. Recorded in the ledger: C16 now states the engine workspace
  is zero-external-dependency by commitment, names aura-ingest as the ingestion
  edge / external-dependency firewall, and forbids an external dep in any engine
  crate other than aura-ingest.
- [ledger-drift] C16's reuse taxonomy did not place aura-ingest. C16 now lists
  the non-node engine crates (aura-engine, aura-cli, aura-ingest).
- [ledger-debt] C12's eager-materialization-now / Arc<[T]>-sharing-later choice
  was only in the spec. C12 now carries a "Status (cycle 0011)" note recording
  the deliberate gap.
- [debt] aura-engine/Cargo.toml carried a stale comment ("data-server enters
  when the ingestion task starts") that contradicted the firewall it should
  protect. Replaced with the dependency-pure / firewall-in-aura-ingest note.

The External components data-server bullet is updated to reality (pulled in by
aura-ingest; workspace now resolves from a populated cargo cache, not fully
offline).

Regression gate: no-op (commands.regression empty); architect is the sole gate.
Cycle 0011 is drift-clean. (Drift-clean, not a milestone close — the
Walking-skeleton milestone close additionally needs its end-to-end milestone
fieldtest, a separate deliberate act.)

crates/aura-engine/Cargo.toml

@@ -7,8 +7,9 @@ publish.workspace = true
 
 [dependencies]
 aura-core = { path = "../aura-core" }
-# data-server (the first data source) enters when the ingestion task starts;
-# kept out of the bare skeleton so the workspace compiles without the network.
+# No external dependencies: aura-engine is an engine crate and stays
+# dependency-pure. The data-server ingestion edge lives in the aura-ingest crate
+# (the external-dependency firewall — cycle 0011, INDEX.md C16), never here.
 
 [dev-dependencies]
 aura-std = { path = "../aura-std" }

docs/design/INDEX.md

@@ -62,9 +62,14 @@ source of truth — not session memory.
   **AoS** (`M1Parsed`/`TickParsed`, `time_ms: i64` Unix-ms). The ingestion
   boundary (C3) therefore **transposes** these AoS records into aura's SoA
   columns (C7) and normalizes `time_ms` → canonical epoch-ns at that one
-  boundary. Pulled in as a cargo git dependency when the ingestion task starts;
-  deliberately absent from the bare skeleton so the workspace compiles without
-  the network.
+  boundary. Pulled in as a cargo git dependency by the **`aura-ingest`** crate
+  (cycle 0011) — the ingestion edge and the workspace's **external-dependency
+  firewall**: `aura-ingest` is the *only* crate that links `data-server` (hence
+  its transitive `chrono`/`regex`/`zip`), so the engine crates (`aura-core` /
+  `aura-std` / `aura-engine` / `aura-cli`) and the frozen deploy artifact (C13)
+  stay external-dependency-free. Consequence: `cargo build/test --workspace` now
+  resolves from a populated cargo cache (one Gitea fetch) rather than fully
+  offline.
 - **RustAst (`myc`)** — `~/dev/RustAst`, Gitea `Brummel/RustAst`
   (`http://192.168.178.103:3000/Brummel/RustAst.git`). The predecessor DSL attempt
   (Foundation): **a conceptual reference, never a dependency** — its DSL authoring
@@ -352,6 +357,12 @@ unit: (1) param-sweep (grid/random), (2) optimization (argmax metric),
 (3) walk-forward (rolling in-sample optimize + out-of-sample test),
 (4) Monte-Carlo (N seeded realizations perturbing input). **MC = sweep over
 seeds**; each realization is itself deterministic given its seed.
+*Status (cycle 0011).* The first ingestion (`aura-ingest`) **eagerly
+materializes** a data-server window into owned source streams rather than
+sharing `data-server`'s `Arc<[T]>` chunks zero-copy across sims — the cross-sim
+`Arc<[T]>` sharing has no consumer until the orchestration axes above are built.
+That sharing remains the target for the orchestration cycle that introduces
+them; the transpose logic is unchanged by it. A known, deliberate gap, not drift.
 **Forbids.** Baking a specific search strategy (Bayesian/genetic) into the
 primitive — those are pluggable policies atop the atomic unit; recompiling on a
 param change.
@@ -410,11 +421,21 @@ strategy / experiment blueprints — plus a static `Aura.toml` (project context:
 data paths, instrument/pip metadata, default broker & window, runs dir). During
 research the `aura` host loads and runs it (C13 hot-reload); for deploy the
 chosen strategy + broker freeze into a standalone binary. **A project is
-therefore always a Rust program built on the engine.**
+therefore always a Rust program built on the engine.** Beyond the node-reuse
+tiers, the engine workspace also carries non-node crates — `aura-engine` (the
+run loop), `aura-cli` (the `aura` binary), and **`aura-ingest`** (the
+data-source ingestion edge, cycle 0011). `aura-ingest` is the
+**external-dependency firewall**: it alone links external crates (via
+`data-server`), keeping the other engine crates and the frozen deploy artifact
+(C13) dependency-pure (see External components). The engine workspace is
+**zero-external-dependency** by commitment — the hand-rolled JSON of C14/C18 and
+the from-scratch `aura-core` substrate exist precisely to honour it; the one
+sanctioned external tree enters at the ingestion edge and is firewalled there.
 **Forbids.** Project-specific signals in the aura repo (it keeps at most
 example/fixture nodes under `examples/` for its own tests); a multi-project
 manager inside aura; a bespoke node registry/marketplace (cargo + Gitea *is* the
-package mechanism).
+package mechanism); an external (crates.io / git) dependency in any engine crate
+other than the ingestion-edge crate `aura-ingest`.
 **Why.** The engine/game split keeps the engine sharp and reusable while each
 project versions its own research with its own forward-queue. Promotion
 (local → shared → std) is the ordinary Rust reuse gradient, no new mechanism.