phoenix-deps

phoenix-deps — a dependency change is a supply-chain decision, and it needs a gate

Encodes the practice from jongio/skills → deps-doctor (MIT). That skill states the two hard rules as craft. Phoenix's contribution is to make them gates, because a rule an agent can talk its way past is not a rule.

Overview

Everywhere else, Phoenix refuses to let an agent grade its own work. Dependencies are the one surface where "I updated the packages" has historically been accepted on assertion. It shouldn't be — a dependency bump is not a version edit, it is a decision to run someone else's new code inside your build.

So the gate is not "the manifest changed". The gate is that the regenerated lockfile installs clean in a fresh environment the way CI will, and the test suite is still green after it.

The gate

{"check":{"kind":"command_exit","target":["npm","ci"],"expect":0}}

Per-ecosystem equivalents — always the clean-room form, never the incremental one, because an incremental install passes on a lockfile CI will reject:

ecosystem	gate command
npm / pnpm / yarn	npm ci · pnpm install --frozen-lockfile · yarn install --immutable
Python	uv sync --locked · pip install -r requirements.txt in a fresh venv
Rust	cargo build --locked
Go	go mod verify && go build ./...
.NET / Java	dotnet restore --locked-mode · mvn -B verify

Run the install gate and the test gate. A lockfile that resolves but breaks the suite is red.

The loop

  inventory every manager ──► audit ──► is there a real change? ──no──► STOP. Report. No branch, no PR.
                                │                                        (the no-op boundary)
                               yes
                                ▼
                 resolve with lifecycle scripts DISABLED
                                │
                                ▼
                 review every package whose version or source changed
                                │
                                ▼
                 install for real ──► clean-room install gate (phoenix_sense)
                                │                    │
                              green                 red
                                │                    ▼
                                │       fix FORWARD — never --force, never downgrade
                                │                    │
                                ▼                    ▼
                        test gate ──────────────► re-sense
                                │
                                ▼
              report, naming every manager that came back BLOCKED