Why:
The lifecycle pin verification step executes candidate Python and shell code even when its YAML run value is inline.
Evidence:
SELF regression observes three credential-order failures on the prior candidate, then passes after moving pin verification behind all privileged acquisition and recognizing inline run entries.
Impact:
Retain the pin verification gate while ending credential use before every candidate entry point.
Refs:
Dependency-workspace independent security and standards validation; R8 and CI phase boundary.
Why:
A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code.
Evidence:
SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint.
Impact:
Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain.
Refs:
Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Why:
Formal root tests cannot read ignored migration clones, so provider CI regressions failed despite the product and source gates passing.
Evidence:
SELF receipts record 18 missing-source errors, then all 29 credential cases passing from a real source archive without .migration and with exact host Git-source validation.
Impact:
Use committed test-only workflow snapshots with full source commits and SHA256 provenance. Real acquisition still executes trusted inline workflows and never reads these fixtures.
Refs:
Dependency-workspace U5/U7; archive receipt66f01970885b34bbb0f9a2dfb244e4a58618b725e600f85fe765099cf2f3bd36.
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
weichen