Why:
An immutable npm lock caches tarballs but packed consumers also require resolver metadata before candidate execution.
Evidence:
SELF host replay passed 57 composition and CI credential cases; real npm 10 and 11 cold-cache consumers passed without lock changes.
Impact:
Acquire only installed exact-version npmjs metadata with clean config, preserve cache paths for offline execution, adopt the repaired Frontend source and record immutable CI fixtures.
Refs:
R6-R8, R14; dependency-workspace U4/U5; UI 63d289e and Frontend 5467517
Why:
Later authenticated source acquisition must never follow a frontend build or provider test.
Evidence:
SELF host replay passed all 23 real composition fixtures; both acquisition-order regressions failed before the repair.
Impact:
Prepare fixed sources and Go/npm caches before execution; retain committed tooling checks and RDM-selected Backend versions.
Refs:
R7, R8, R11, R14; dependency-workspace U5
Why:
A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code.
Evidence:
SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint.
Impact:
Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain.
Refs:
Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
weichen