feat(dependencies): build provider dependency foundations

[skevetter]

Summary

Adds Provider Dependencies foundations and the first functional passive command: devsy dependency inspect <tool> --for-provider <installed-name> --json for trusted built-in Docker, Podman, Apple and Kubernetes providers.

• Reads saved configuration and the installed manifest through the supplied read-only home/manager, preserves explicit path intent, and performs filesystem metadata lookup. It does not resolve dynamic options, execute candidates, probe endpoints, download, authenticate, elevate or start runtimes. Modified, missing, ambiguous and external manifests remain blocked.
• Emits the frozen v1 report with snapshot fingerprints and separate availability/platform policy. Executable metadata remains compatibility-unknown and unexecuted; request-local file identity is not serialized or treated as selection/ownership authority. Actions and managed recipes remain empty.
• Retains the earlier guards, disabled catalog, path roots, strict metadata codecs/private atomic writer, passive Survey, built-in adapter, read-only loaders/deletion fence, root policy and static saved/preview inputs.
• Removes ambient cache creation from platform-client package initialization. Explicit Save of the exact captured default config restores missing private category parents with 0700; custom paths and existing modes retain their prior behavior. Mechanical upstream identifier fixes preserve legacy disk/environment literals.

Why

Provider inspection needs a useful CLI entry point whose startup and error paths preserve passive behavior. Shared observations, wire output and durable metadata establish the foundation for later explicit dependency actions and Desktop integration; installation and managed support are not enabled here.

Validation

Full serial validation on VPS1 passed on unchanged tree 878d11464aaf677852dafbbc5b5f0e51dd49c74b:

• mise exec -- prek run --all-files: passed, including format, secrets and Go lint hooks.
• go test -p 1 -race -count=1 -v ./cmd ./cmd/dependency ./cmd/flags: passed, including all 36 actual-main PTY inspection cases, strict fresh-root preservation and ordinary proxy/process positive controls.
• Uncached race tests for dependencytest, config, provider, options/resolver, dependencies, status, clierr, devcontainer/config and platform/client: passed. Fresh actual-main reports for all four tools were supplied to the unchanged frozen-validator bridge. Focused workspace preparation/adapter race tests also passed.
• mise run cli:lint:ci: passed, 0 issues. Native/Linux complete-feature patch lint passed; separate unfiltered scoped lint retains 42 findings in unchanged lines.
• Private-parent regression observed red then green under Unix child umasks 0022/0002, with 20 default/custom/existing/fallback/failure controls. Coordinator and independent source reviews found no remaining material blockers in the reviewed slices.
• Original lint/hook config bytes/index restored; source hashes, final tree and all four report hashes reverified. Go soft limits and systemd 4608 MiB memory/512 MiB swap/45 min per stage caps used.
• Linux/Windows affected-package compilation passed with normal vet; compilation only. Local CodeRabbit attempts returned service/rate-limit errors, so no completed local review is claimed.

Signed coherent formatter/cache/command commits preserve the validated tree. Current head: 0609cee23bc5a0a7afb1ecf7925c3e0885ad6629. Fresh GitHub CI and final reviewers remain pending.

Spec refs/task/test IDs

Tracks #1575. T00a/T00b, T02, T03 paths/codecs/private writer/read-only resolution, T04 lookup/internal Survey/built-in translation/loaders/static saved-preview preparation; T10 root lifecycle/report/functional inspect. SPEC sections 6.3-6.5/7/8.5/11, C18/C20 and REVIEW_ADDENDUM sections 2/3/5/6/7. Guard-map evidence distinguishes implemented tests from future unwired seams.

Gates affected

G01-G09 NOT RUN; managed recipes/ranges disabled. No installer, selection, removal, adapter release or Desktop flow is enabled. Native Windows and managed runtime/hardware qualification remain absent; Windows metadata writes are unsupported. Fault injection is not power-loss evidence. Metadata writers provide no CAS/multi-file transaction or ownership/removal authority. Snapshot digests are neither file identity nor atomic snapshots/CAS. Constructor BindEnv fatal errors, profile-tag initialization, completion and synchronous filesystem/driver limits remain outside the passive guarantee. Sentinel/proxy fixtures provide bounded evidence, not OS-wide interception.

Next

Fresh exact-head CI, completed Greptile >= 4/5, then completed CodeRabbit and all actionable threads resolved before readiness. External-provider trust, saved selection/store reconciliation, bounded probes, secure installation/ownership, remaining CLI and Desktop work accumulate here. User approval is required before merge; qualification gates remain separate.

[netlify]

✅ Deploy Preview for devsydev ready!

Name	Link
🔨 Latest commit	0609cee
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad6f00bcbc7740c939a247c
😎 Deploy Preview	https://deploy-preview-1588--devsydev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	0609cee
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad6f00b3f46c4a763fbe43b

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[skevetter]

@greptileai review

Please review the current head 92ceb40d7452d38faec2a7a6f2d9fb8dfc685549. Implementation CI is complete and passing on this SHA. This PR contains T00a test/fixture/source-ledger scaffolding; executable T00b guards and managed-runtime qualification remain separate.

[greptile-apps]

Confidence Score: 4/5

[Low impact] Test fixtures for provider dependency contracts.

The PR appears safe to merge, with two non-blocking improvements to the test-owned validators.

Findings

1.  Unchecked candidates appear compatible ▶
2.  Schema constraints are silently ignored ▶

Summary

Adds test-owned provider dependency reports, a JSON schema, contract validators, and a source ledger.

• Dependency reports now follow a checked version-one contract.
• Provider reports now show distinct dependency states.
• The baseline map records where the next dependency guards belong.

Acknowledged scope from skevetter: executable T00b guards and managed-runtime qualification are intentionally separate. Their absence is not reported as a defect.

_{Reviews (1) · Last reviewed commit: "test(dependencies): add provider depende..." · Reviewed by Greptile}