Part III · Supply Chain · SHIPPED (core) · DESIGNED (coverage) · p. 42–43
Lock files and licenses
Two quieter capabilities that answer two questions auditors ask early: when did this dependency arrive, and are we permitted to ship it.
When a dependency lock file changes, a receipt records the change: the file’s content hash before and after, and where format support exists, a count of dependencies added, removed, and version-bumped. Full parsing is shipped for the major lock formats. Every other lock format records that the file changed and hashes it, but reports zero counts — and says so. A record saying “changed, counts unavailable for this format” is materially different from “changed, zero dependencies affected.”
ShippedLicense detection runs at acquisition time. UNKNOWN is a valid recorded value. It never blocks the clone.
UNKNOWN is a valid value. “We looked and could not determine this” is a materially different fact from “we did not look.”
If license detection blocked acquisition, you could not obtain a repository in order to examine its license — which is the most common reason to obtain an unfamiliar repository in the first place. Enforcement belongs at a later gate, where you have information and intent.