Why: Keep the migration task's current main baseline, preserved conflicts, fixed sources, and formal verification state reviewable before candidate CI.
Evidence: SELF task-sync, fixed Frontend refresh, full test failures, Core SSH probe, and successful build receipts are recorded in the task card; current-head GATE remains pending.
Impact: Record the fixed-port contention and transport stall without claiming a passing full local test or stage 7 acceptance.
Refs: #537, #538, mq-dev-20261014-537-01
Why: Include the latest Dev task-card closure and governance fix while preserving the versioned dependency migration.
Evidence: SELF merge conflict inspection, clean staged diff, bash syntax check, and prior isolated E2E replay; full final-head verification pending.
Impact: Keep existing Backend and Frontend source directories outside the Git index and retain their on-disk Git data. Preserve password setup, audit grants, scoped browser coverage, and owned process cleanup.
Refs: #537, #538, mq-dev-20261014-537-01
Why: Upstream Backend PR #185 changed account and audit behavior while the dependency branch was open. The fixed Dev app must select a source that includes those changes and the bounded test-gate corrections.
Evidence: SELF 343-Go-file upstream parity, full Go test/vet and controlled sandbox RED/GREEN in /tmp/dependency-backend-after-185-{parity,all-go,vet}-20261014-01a1345f.json and /tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json.
Impact: Advances only Backend application source lock. RDM and Go library versions remain independently selected; full Dev combination and current HEAD CI remain required before delivery.
Refs: Dev PR #537; Backend PR #196; upstream Backend PR #185; R15
Why: The fixed general-standard source must include the queue rule that protects language dependencies and source locks from component rollback, alongside the already approved workspace guidance.
Evidence: SELF R1-R15 documentation and focused queue/link checks passed in /tmp/dependency-guidelines-complete-doc-check-20261014-01a1345f.json and /tmp/dependency-guidelines-queue-consistency-20261014-01a1345f.json.
Impact: Advances only the fixed Guidelines source commit. Runtime code and product dependency selection are unchanged; the final Dev combination must be revalidated before remote delivery.
Refs: Dev PR #537; Guidelines PR #6; R13/R14
Why: Upstream Frontend PR #73 added export controls while the dependency migration branch was open; the fixed composition must include those user-visible changes.
Evidence: SELF disposable merge at 74511db passed offline npm install, 264 tests, package consumer and production build in /tmp/dependency-frontend-upstream-replay-{install,test,build}-20261014-01a1345f.json; exact provider platform CI remains to be checked.
Impact: Advances only the application Frontend source lock; Go and npm library versions remain under their language graphs. Full Dev combination validation follows before this branch is pushed.
Refs: Dev PR #537; Frontend PR #84; upstream Frontend PR #73; R15
Why: The unrelated main merge restored a gitlink-only test instruction in the queue policy, which omits the new language dependencies and application source lock.
Evidence: SELF document and link check in /tmp/dependency-queue-terminology-check-20261014-01a1345f.json; git diff --check exits 0.
Impact: Documentation wording only; existing manual queue and CI behavior are unchanged.
Refs: Dev PR #537; Documents PR #100; R14
Why:
The authority advanced its Documents gitlink and manual queue trial while this migration was under verification.
Evidence:
Read origin/main f00165e8d7 and the active Issue518 record; the Documents branch preserves its new main and approved dependency plan.
Impact:
Keep the new dependency layout, retain physical legacy Git data, adopt the merged Documents source lock and preserve manual-window progress without taking another task's window.
Refs:
R15; dependency-workspace U6/U7; Dev main f00165e; Documents 1de7d17
Why:
Retain actual platform failures and discriminating regression evidence while keeping human acceptance separate.
Evidence:
Reference complete SELF RED and GREEN receipts, actual private-dependency CI success and the preserved strict source gates.
Impact:
Freeze the new task record before current-head CI and independent supplemental review, without implying merge or deployment.
Refs:
R8-R10, R14-R15; dependency-workspace U5/U7
Why:
Go-to-Python tests leave ignored bytecode in fixed sources, lifecycle clones need a fixed main reference, and boundary gates require ripgrep.
Evidence:
SELF real byproduct and clone regressions failed before repair; host passed 11 component cases, 4 hook cases and 33 CI credential cases.
Impact:
Execute versioned Go checks in disposable clones while preserving editable overlays and strict dirty guards; install the boundary prerequisite and seed only isolated pinned lifecycle refs.
Refs:
R8-R10, R14-R15; dependency-workspace U5; Dev PR 537 run 3036
Why:
Final validation needs to distinguish fixed local results, actual platform failures and the user's additional credential authorization.
Evidence:
Reference sanitized run logs, independent cold-cache closures, the HTTP mirror regression and metadata-only credential receipts.
Impact:
Keep stage-7 acceptance pending and preserve failed runs rather than treating prior SELF results as current GATE approval.
Refs:
R7-R8, R14-R15; dependency-workspace U5/U7; user approval 2026-10-14
Why:
Gitea Docker runners inject an HTTP server URL, while ordinary transport rules intentionally reject HTTP sources.
Evidence:
SELF observed the fixed-runner failure, added a real local Git clone regression with RED then GREEN, and passed 31 transport/composition cases.
Impact:
Accept only inherited mirror aliases matching the injected server, owner and repository; keep configured HTTP sources, credentials and foreign aliases rejected without global Git changes.
Refs:
R7-R8, R14; dependency-workspace U5; Dev PR 537 runs 3029/3030
Why:
Preserve approval, active-branch integration and the cold-cache repair without conflating local evidence with final acceptance.
Evidence:
Link complete SELF and independent REPLAY records, and fixed-head component platform runs; leave pending gates explicit.
Impact:
Prepare the final candidate record and WIP component PR links before freezing source-external stage-7 evidence.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why:
An immutable npm lock caches tarballs but packed consumers also require resolver metadata before candidate execution.
Evidence:
SELF host replay passed 57 composition and CI credential cases; real npm 10 and 11 cold-cache consumers passed without lock changes.
Impact:
Acquire only installed exact-version npmjs metadata with clean config, preserve cache paths for offline execution, adopt the repaired Frontend source and record immutable CI fixtures.
Refs:
R6-R8, R14; dependency-workspace U4/U5; UI 63d289e and Frontend 5467517
Why:
The user approved the fixed implementation and self-check handoff.
Evidence:
Import the complete startup receipt through task-resume; preserve the fixed 0676 candidate's original receipts and independent review scope.
Impact:
Advance stage 6 to approved and prepare stage 7 verification without claiming formal acceptance, trusted CI, integration or deployment.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=add097d06137c4912a4ed9279e98ca353e4e4cf1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why:
Keep implementation, independent review, formal acceptance and main integration distinct.
Evidence:
Reference immutable early-review scope and actual SELF receipts without upgrading their provenance.
Impact:
Prepare a source-external final evidence entry while preserving current branches and pending acceptance gates.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why:
Later authenticated source acquisition must never follow a frontend build or provider test.
Evidence:
SELF host replay passed all 23 real composition fixtures; both acquisition-order regressions failed before the repair.
Impact:
Prepare fixed sources and Go/npm caches before execution; retain committed tooling checks and RDM-selected Backend versions.
Refs:
R7, R8, R11, R14; dependency-workspace U5
Why:
An interrupted multi-component transition must retain original staged, ignored and external-worktree data after some independent copies have completed.
Evidence:
SELF scratch fixture interrupts a real nested copy after App is saved and Logging is partially copied; originals and external Git metadata remain identical, recorded partial data persists and retry refuses to discard it.
Impact:
Add failure-path coverage and clarify reachability checks before component branch cleanup; no transition implementation change.
Refs:
Dependency-workspace R9/R15 and independent reliability coverage followup.
Why:
The lifecycle pin verification step executes candidate Python and shell code even when its YAML run value is inline.
Evidence:
SELF regression observes three credential-order failures on the prior candidate, then passes after moving pin verification behind all privileged acquisition and recognizing inline run entries.
Impact:
Retain the pin verification gate while ending credential use before every candidate entry point.
Refs:
Dependency-workspace independent security and standards validation; R8 and CI phase boundary.
Why:
A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code.
Evidence:
SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint.
Impact:
Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain.
Refs:
Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Why:
Formal root tests cannot read ignored migration clones, so provider CI regressions failed despite the product and source gates passing.
Evidence:
SELF receipts record 18 missing-source errors, then all 29 credential cases passing from a real source archive without .migration and with exact host Git-source validation.
Impact:
Use committed test-only workflow snapshots with full source commits and SHA256 provenance. Real acquisition still executes trusted inline workflows and never reads these fixtures.
Refs:
Dependency-workspace U5/U7; archive receipt66f01970885b34bbb0f9a2dfb244e4a58618b725e600f85fe765099cf2f3bd36.
Why:
Preserve work merged by concurrent tasks while adopting versioned dependency workspaces.
Evidence:
SELF task receipts record conflict detection, all 96 task/recovery/cutover cases, all 33 evidence cases and 5 component identity cases. Documents links and requirements were replayed after preserving both planning entries.
Impact:
Keep upstream idempotent sync, local resume and source-external receipt rules; adapt fixed-guidelines readiness and ignored component identity validation. Remove only obsolete index links and retain their physical Git metadata.
Refs:
Authoritative main57bcb17ea212a531186b6e21617a7f3bea65a791; Documents4a26798000c39cc59ba0c2cc6328f5c8f10dcb32; dependency-workspace R15.
Why:
An attempted shared digest import introduced a workspace package requirement in standalone fixed-root product fixtures.
Evidence:
SELF task receipts record the actual ModuleNotFoundError followed by all 20 real Git/Go/npm composition cases passing after restoring the local helper.
Impact:
Preserve standalone operation and retain the behavior-preserving unused parameter/import cleanup.
Refs:
Agent-System-Dev dependency-workspace U5; SELF composition receipt 5b7c224d67ab248b685da436ebee56638c1945a1dca3666f40e763621c1b8003.
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
Why: Preserve a single Dev entry and independent repository ownership while allowing active feature branches to migrate without losing source or Git state.
Evidence: SELF 29 real Git/Go workspace tests and ordinary component evidence/lock tests passed; detailed RED/GREEN runs are recorded by make evidence in the task card.
Impact: Add fixed cloning, selected-version baselines, development overlays, npm source resolution, and independently preserved legacy snapshots. No other active worktree is modified.
Refs: Versioned dependencies U2/U5; R15; feature/dependency-workspace
Why: Prepare ordinary component workspaces and real module downloads without changing global Git configuration or other feature branches.
Evidence: SELF clean-cache module consumption and real temporary-Git transport tests are recorded by make evidence in the task card, including expected RED and passing GREEN runs.
Impact: Add component identities/source locks and non-secret transport configuration. Existing submodule layout remains supported during migration.
Refs: Versioned dependencies U1/U2; R15; feature/dependency-workspace
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=ee9b437b22b49f96e1bc65f79417b22e8e82a37c.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Keep the approved direction and concrete pending decisions discoverable across sessions.
Evidence: The task card contains tool-written SELF precheck, task-sync, source inventory, and documentation validation receipts.
Impact: Add a project entry and task state for a locally saved Documents candidate without changing the pinned composition or active dependency policy.
Refs: Documents feature/dependency-workspace-plan; versioned-dependencies-and-workspaces r1
Why: Keep the approved direction and concrete pending decisions discoverable across sessions.
Evidence: The task card contains tool-written SELF precheck, task-sync, source inventory, and documentation validation receipts.
Impact: Add a project entry and task state for a locally saved Documents candidate without changing the pinned composition or active dependency policy.
Refs: Documents feature/dependency-workspace-plan; versioned-dependencies-and-workspaces r1
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-dependency-workspace.md; R0=ff3fb4a7ebe432ab21c6b9668abc9823aca2fdd1.
Impact: task metadata only; the feature workspace starts at ff3fb4a7eb.
Refs: .task/feature-dependency-workspace.md
weichen