dependency-sweeplisted

# Dependency sweep You are in control. `dep-sweep.py` is an instrument you point at things — it gathers evidence and computes eligibility, it never edits a file and never decides. Run it in stages, read each result, then choose the next move. **Never re-derive by hand what the script already computed.** Registry dates, cooldown arithmetic, pin verification and provenance are exactly the work it exists to remove. ### Stage 1 — cheap, offline, no excuses (< 1s) ```bash python3 tools/vela-dev/scripts/dep-sweep.py --offline --only coverage,parity ``` Is a manifest unwatched? Have the two root lockfiles drifted? Both are structural problems that make everything downstream untrustworthy. Fix these before looking at versions. ### Stage 2 — what is actually available (~10s, network) ```bash python3 tools/vela-dev/scripts/dep-sweep.py --only npm,go,audit ``` Cooldown-eligible npm targets, an end-of-life Go toolchain, and live advisories per tree. **Install the trees first** (`npm ci`, `pnpm install --frozen-lockfile` in `tools/vela-dev/channel`) or the audit half reports nothing — an uninstalled tree is silence, not a clean bill of health. ### Stage 3 — Actions and supply-chain vetting (~15s more) ```bash python3 tools/vela-dev/scripts/dep-sweep.py --upgrades --vet ``` `--upgrades` is not optional when Actions are in scope. Without it the report confirms each pin matches the tag it claims and says nothing about whether that tag is still current — an action can be correctly