# Dependency and security review

## Product graph

The generated architecture proof selects exact immutable versions of Spice,
the Spice toolchain, Spice Agent, the OpenAI provider, and the coding-tool
starter. The provider pins `openai-go/v3 v3.50.0`; the coding tools pin
`x/sys v0.47.0`. Transitive versions and checksums are committed in `go.sum`
and `vendor/modules.txt`.

The Spice projects are Apache-2.0. Their repository-local reviews cover their
transitive Apache-2.0, BSD, and MIT dependencies. The distribution adds no
independent third-party runtime dependency. `make verify` runs gosec and
govulncheck over the selected product graph and reproduces vendor contents.

The proof exercises cancellation-aware kernel/provider/tool APIs, bounded
provider and filesystem payloads, reverse cleanup, secret-redacted provider
configuration, Windows-safe paths, and a local TLS transport. Its fixed test
credential is not a real secret and is never retained in events or generated
metadata. Coding tools retain bare process privileges; the product must display
their exported capability warning before the release application enables them.

Future product dependencies must document maintenance, Apache-2.0 license
compatibility, checksum and vulnerability status, cancellation and bounded
resource behavior, observability and secret handling, Windows/Linux support,
and executable compatibility evidence.

## Verification tools

The isolated tools module pins golangci-lint 2.12.2, gofumpt 0.10.0,
goimports/x-tools 0.48.0, gosec 2.28.0, govulncheck 1.1.4, and NilAway at
`f4f8ac24c032`. They are build-time-only and run without inherited credential
variables. The gate permits module network access only during explicit
preparation and runs later checks with `GOPROXY=off`, `GOWORK=off`, and the
local Go 1.26.5 toolchain.