feat(storage): add mango-storage skeleton with redb + raft-engine fork (ROADMAP:815)

Cargo.toml

@@ -3,6 +3,7 @@ resolver = "2"
 members = [
     "crates/mango",
     "crates/mango-proto",
+    "crates/mango-storage",
     "crates/mango-loom-demo",
     "crates/mango-madsim-demo",
     "crates/xtask-vet-ttl",
@@ -92,6 +93,44 @@ subtle = { version = "2.6", default-features = false, features = [
     "const-generics",
 ] }
 
+# Phase 1 storage-backend deps (ROADMAP:815). See
+# .planning/adr/0002-storage-engine.md and
+# .planning/fork-raft-engine-lz4-verification.md.
+#
+# redb: pure-Rust embedded KV store. Pin shape `"4.1.0"` = `^4.1.0`
+# (>= 4.1.0, < 5.0.0) — ADR 0002 verified 4.1.0 specifically; the pin
+# is visible in the manifest for that reason. Minor/patch bumps inside
+# the 4.x range arrive via Dependabot.
+redb = "4.1.0"
+
+# raft-engine via the humancto/raft-engine fork.
+# Fork exists to feature-gate lz4-sys (C FFI) out of the default build
+# graph — see ADR 0002 §W5. `default-features = false` drops all three
+# upstream defaults (`internals`, `scripting`, `lz4-compression`); we
+# re-enable only `internals` because:
+#   - `lz4-compression` pulls lz4-sys (C FFI) — the entire reason the
+#     fork exists.
+#   - `scripting` pulls rhai → smartstring (MPL-2.0), an allow-list
+#     widening we do not want to take for a feature mango doesn't use.
+#     Scripting is raft-engine's TiKV-admin-CLI path; mango has no
+#     consumer of that surface.
+#   - `internals` exposes the Raft log reader/writer types mango-raft
+#     (Phase 1 impl PRs) actually needs.
+# Consumers MUST write `raft-engine.workspace = true` with NO local
+# `features = [...]` — local features ADD to the workspace set, which
+# would re-enable features we deliberately turned off.
+#
+# Mango configs MUST set batch-compression-threshold = 0 (enforced by
+# the fork's Config::sanitize when lz4-compression is off).
+#
+# Retirement: when tikv/raft-engine#397 merges, swap git URL to
+# tikv/raft-engine at the merged SHA per the procedure in
+# .planning/fork-raft-engine-lz4-verification.md §"Retirement plan".
+# Dependabot does NOT auto-bump git rev pins; retirement is manual.
+raft-engine = { version = "0.4.2", git = "https://github.com/humancto/raft-engine", rev = "e1d738d9ad1c1fc4f5b21c8c73bf605b5696f535", default-features = false, features = [
+    "internals",
+] }
+
 [workspace.package]
 version = "0.1.0"
 edition = "2021"

crates/mango-storage/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "mango-storage"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+authors.workspace = true
+description = "Mango storage backend (Phase 1 skeleton; Backend + RaftLogStore traits land per ROADMAP.md)."
+publish = false
+
+[dependencies]
+redb.workspace = true
+# Consumed via `.workspace = true` with NO feature override: the workspace
+# entry's `default-features = false, features = ["internals"]` inherits
+# verbatim. Adding a local `features = [...]` here would ADD to the
+# workspace set — re-enabling `lz4-compression` would re-introduce the
+# C FFI dep (ADR 0002 §W5), and re-enabling `scripting` would pull
+# MPL-2.0 (via rhai/smartstring).
+raft-engine.workspace = true
+
+[lints]
+workspace = true

crates/mango-storage/src/lib.rs

@@ -0,0 +1,43 @@
+//! mango-storage — the storage backend crate for mango.
+//!
+//! This crate is currently a placeholder skeleton. The `Backend` and
+//! `RaftLogStore` trait definitions land per `ROADMAP.md` (Phase 1);
+//! implementations follow in their own PRs.
+//!
+//! Dependencies declared here — `redb` and a git-pinned fork of
+//! `raft-engine` — are wired so subsequent trait and impl PRs can
+//! consume them via `.workspace = true`. The fork exists to keep
+//! `lz4-sys` (C FFI) out of the default build graph; see
+//! `.planning/adr/0002-storage-engine.md` §W5 and
+//! `.planning/fork-raft-engine-lz4-verification.md`.
+
+#![deny(missing_docs)]
+
+/// The package version string, captured at build time from
+/// `CARGO_PKG_VERSION`. Kept as a crate-level constant so downstream
+/// tests can assert on the shipped version without re-reading
+/// `Cargo.toml`.
+pub const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+#[cfg(test)]
+mod tests {
+    #![allow(
+        clippy::unwrap_used,
+        clippy::expect_used,
+        clippy::panic,
+        clippy::indexing_slicing,
+        clippy::unnecessary_literal_unwrap,
+        clippy::arithmetic_side_effects
+    )]
+
+    // Watchdog smoke lives in `crates/mango/src/lib.rs`; the single
+    // oracle for `scripts/test-watchdog.sh` is sufficient and not
+    // duplicated per crate.
+
+    use super::*;
+
+    #[test]
+    fn version_matches_cargo_manifest() {
+        assert_eq!(VERSION, "0.1.0");
+    }
+}

deny.toml

@@ -61,13 +61,27 @@ unsound = "all"
 # at every MSRV bump and crate major-version review.
 ignore = [
     { id = "RUSTSEC-2025-0141", reason = "bincode 1.3.3 formally unmaintained (the bincode team ceased development after a harassment incident; they consider 1.3.3 a complete version). Pulled in as a TRANSITIVE DEV-DEP of madsim 0.2.30 through mango-madsim-demo; not a runtime dep of any mango crate (sim scaffolding only). Blast radius: deterministic-simulator tests that serialize data the test itself controls — no untrusted input path. The advisory is informational (category `unmaintained`, no active CVE). Re-audit trigger: next madsim minor bump (0.3.x) — upstream may migrate to postcard/bitcode — or by 2026-10-23. See docs/madsim.md and .planning/0-5-3-madsim-dev-dep.plan.md." },
+    { id = "RUSTSEC-2024-0437", reason = "protobuf 2.28.0 uncontrolled recursion (stack overflow on crafted input). Pulled TRANSITIVELY through raft-engine 0.4.2 → prometheus 0.13.4 (metrics, internal use only — not a network-facing deserializer). Patch is protobuf >= 3.7.2, but the dep is behind two upstream crates we do not control in this PR. Mitigations in the mango skeleton: (a) mango-storage ships no code that invokes protobuf parsing; (b) when mango-raft (Phase 1 impl PRs) starts calling raft-engine APIs that deserialize, those call sites will be under the `parser fuzz in the phase that introduces the parser` rule from ROADMAP's Reviewer's contract, with crafted-input fuzz corpora as the direct mitigation for this advisory class. Re-audit triggers (any): (1) raft-engine upstream bumps prometheus past the fixed protobuf version, (2) tikv/raft-engine#397 merges and we re-pin against a fresher master that may have bumped prometheus, (3) review-by 2026-10-23. See ADR 0002 §W5 and .planning/fork-raft-engine-lz4-verification.md." },
 ]
 
 [bans]
 multiple-versions = "deny"
 # When a dupe is unavoidable during a major-version migration, add an
-# entry here with an issue link and a removal target. Empty today.
-skip = []
+# entry here with an issue link and a removal target.
+skip = [
+    # --- raft-engine 0.4.2 transitive-dep duplicates ---
+    # All four entries below are major-version gaps in raft-engine's
+    # transitive graph (via nix 0.26, rust-protobuf, prometheus, etc.)
+    # vs. the modern workspace tree. Fixing them requires upstream
+    # raft-engine bumps beyond what the humancto/raft-engine fork
+    # carries today. Retirement trigger: the upstream bump or
+    # tikv/raft-engine#397 (whichever first drags its dep graph forward).
+    # See ADR 0002 §W5 and .planning/fork-raft-engine-lz4-verification.md.
+    { crate = "bitflags@1.3.2", reason = "raft-engine 0.4.2 transitive via nix 0.26; modern tree uses bitflags 2.x. Retires on raft-engine upstream bumping nix." },
+    { crate = "getrandom@0.2.17", reason = "raft-engine 0.4.2 transitive; modern tree uses getrandom 0.3.x. Retires on raft-engine upstream refresh." },
+    { crate = "hashbrown@0.14.5", reason = "raft-engine 0.4.2 transitive; modern tree uses hashbrown 0.16.x. Retires on raft-engine upstream refresh." },
+    { crate = "syn@1.0.109", reason = "raft-engine 0.4.2 transitive via older proc-macro crates (serde_repr, strum_macros 0.26, etc.); modern tree uses syn 2.x. Retires on raft-engine upstream refresh." },
+]
 skip-tree = []
 wildcards = "deny"
 # Crate-level bans. Security axis mandates rustls — no OpenSSL path.
@@ -86,8 +100,15 @@ deny = [
 [sources]
 # Prod dep tree comes from crates.io. Any git-dep or alternate
 # registry requires an explicit allowlist entry below with a
-# justification — empty today.
+# justification.
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = []
+# humancto/raft-engine is a fork of tikv/raft-engine that feature-gates
+# the unconditional `lz4-sys` C FFI dep behind a Cargo feature (default-on
+# upstream to preserve BC; we consume with default-features = false).
+# See ADR 0002 §W5 and .planning/fork-raft-engine-lz4-verification.md.
+# Retirement trigger: upstream tikv/raft-engine#397 merging — when that
+# lands, swap the workspace `raft-engine` dep to point at tikv/raft-engine
+# at the merged SHA and DROP this allow-git entry in the same PR.
+allow-git = ["https://github.com/humancto/raft-engine"]