Why: Upstream Backend PR #185 changed account and audit behavior while the dependency branch was open. The fixed Dev app must select a source that includes those changes and the bounded test-gate corrections.
Evidence: SELF 343-Go-file upstream parity, full Go test/vet and controlled sandbox RED/GREEN in /tmp/dependency-backend-after-185-{parity,all-go,vet}-20261014-01a1345f.json and /tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json.
Impact: Advances only Backend application source lock. RDM and Go library versions remain independently selected; full Dev combination and current HEAD CI remain required before delivery.
Refs: Dev PR #537; Backend PR #196; upstream Backend PR #185; R15
Why: The fixed general-standard source must include the queue rule that protects language dependencies and source locks from component rollback, alongside the already approved workspace guidance.
Evidence: SELF R1-R15 documentation and focused queue/link checks passed in /tmp/dependency-guidelines-complete-doc-check-20261014-01a1345f.json and /tmp/dependency-guidelines-queue-consistency-20261014-01a1345f.json.
Impact: Advances only the fixed Guidelines source commit. Runtime code and product dependency selection are unchanged; the final Dev combination must be revalidated before remote delivery.
Refs: Dev PR #537; Guidelines PR #6; R13/R14
Why: Upstream Frontend PR #73 added export controls while the dependency migration branch was open; the fixed composition must include those user-visible changes.
Evidence: SELF disposable merge at 74511db passed offline npm install, 264 tests, package consumer and production build in /tmp/dependency-frontend-upstream-replay-{install,test,build}-20261014-01a1345f.json; exact provider platform CI remains to be checked.
Impact: Advances only the application Frontend source lock; Go and npm library versions remain under their language graphs. Full Dev combination validation follows before this branch is pushed.
Refs: Dev PR #537; Frontend PR #84; upstream Frontend PR #73; R15
Why:
The authority advanced its Documents gitlink and manual queue trial while this migration was under verification.
Evidence:
Read origin/main f00165e8d7 and the active Issue518 record; the Documents branch preserves its new main and approved dependency plan.
Impact:
Keep the new dependency layout, retain physical legacy Git data, adopt the merged Documents source lock and preserve manual-window progress without taking another task's window.
Refs:
R15; dependency-workspace U6/U7; Dev main f00165e; Documents 1de7d17
Why:
An immutable npm lock caches tarballs but packed consumers also require resolver metadata before candidate execution.
Evidence:
SELF host replay passed 57 composition and CI credential cases; real npm 10 and 11 cold-cache consumers passed without lock changes.
Impact:
Acquire only installed exact-version npmjs metadata with clean config, preserve cache paths for offline execution, adopt the repaired Frontend source and record immutable CI fixtures.
Refs:
R6-R8, R14; dependency-workspace U4/U5; UI 63d289e and Frontend 5467517
Why:
Preserve work merged by concurrent tasks while adopting versioned dependency workspaces.
Evidence:
SELF task receipts record conflict detection, all 96 task/recovery/cutover cases, all 33 evidence cases and 5 component identity cases. Documents links and requirements were replayed after preserving both planning entries.
Impact:
Keep upstream idempotent sync, local resume and source-external receipt rules; adapt fixed-guidelines readiness and ignored component identity validation. Remove only obsolete index links and retain their physical Git metadata.
Refs:
Authoritative main57bcb17ea212a531186b6e21617a7f3bea65a791; Documents4a26798000c39cc59ba0c2cc6328f5c8f10dcb32; dependency-workspace R15.
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
Why: Preserve a single Dev entry and independent repository ownership while allowing active feature branches to migrate without losing source or Git state.
Evidence: SELF 29 real Git/Go workspace tests and ordinary component evidence/lock tests passed; detailed RED/GREEN runs are recorded by make evidence in the task card.
Impact: Add fixed cloning, selected-version baselines, development overlays, npm source resolution, and independently preserved legacy snapshots. No other active worktree is modified.
Refs: Versioned dependencies U2/U5; R15; feature/dependency-workspace
Why: Prepare ordinary component workspaces and real module downloads without changing global Git configuration or other feature branches.
Evidence: SELF clean-cache module consumption and real temporary-Git transport tests are recorded by make evidence in the task card, including expected RED and passing GREEN runs.
Impact: Add component identities/source locks and non-secret transport configuration. Existing submodule layout remains supported during migration.
Refs: Versioned dependencies U1/U2; R15; feature/dependency-workspace
weichen