# Dependency review

## Decision

The coding-tools product remains standard-library-first. Spice core is pinned
at `v0.1.0-preview.1.0.20260806200749-524424a04df0`, and the toolchain is pinned
at `v0.1.0-preview.1.0.20260806203056-d0b9ac086bd6`. Spice Agent is pinned at
`v0.0.0-20260806225954-af79fc7fe4ad` for its public immutable tool contract,
including explicit effect, replay-safety, fingerprint, and execution-failure
semantics.

`golang.org/x/sys/windows` v0.47.0 is the sole non-framework
runtime package and is compiled only on Windows for Job Object ownership and
typed status classification around root-contained atomic replacement.

## Maintenance and license

Filesystem, process, context, hashing, and atomic-file behavior use Go's
supported standard library under its BSD-style license. `x/sys` is maintained
by the Go project, uses a BSD-3-Clause license, follows the Go vulnerability and
release process, and exposes the Windows Job Object APIs missing from the
standard library. Version 0.47.0 is checksum-pinned and reviewed as a direct
Windows dependency.

## Security and ownership

- A Suite is instance-owned and rooted at one validated absolute path.
- Construction performs no filesystem or process operation.
- Read pages, writes, and total captured output default to 256 KiB and may not
  exceed 512 KiB; commands default to two minutes and may not exceed 30 minutes.
  JSON construction is additionally checked by Spice Agent's 1 MiB public
  payload bound.
- Capability metadata discloses read, write, and process risk but is not
  represented as a sandbox or permission boundary.
- Effect and replay metadata is explicit and fingerprinted. Read is
  read-only/safe; replace is mutating/idempotent because repeated create and
  stale-protected replace calls cannot duplicate a committed file mutation;
  shell is mutating/unsafe.
- `os.Root` rejects traversal and link escape for read/replace operations.
  Shell rejects and revalidates link components before its path-based process
  start. Same-user concurrent mutation remains explicitly trusted.
- Replace performs expected-digest checks before and immediately before atomic
  commit. This is stale detection, not an external-writer filesystem CAS.
- Windows existing-target replacement remains inside `os.Root`. Retries are
  bounded and cancellation-aware for access-denied, sharing, and lock statuses;
  every attempt repeats the digest and regular non-symbolic-link checks. A real
  ACL denial exhausts to `replace_failed`; retryability does not assert that an
  error was transient.
- Windows Job Objects and Unix process groups provide bounded cleanup for the
  managed launcher and ordinary descendants. Deliberately detached Unix
  processes and Windows children created before Job Object attachment may
  escape; these primitives are not a sandbox. Incomplete launcher cleanup is
  returned explicitly as an uncertain, never-replayable failure.

## Observability

Results contain byte counts, exit classification, truncation, timeout, managed-
cleanup completion, and replace commit/durability state. Validation and
operating-system failures remain model-visible results. Cancellation and host
delivery failures use bounded, correlated execution errors that preserve
`context.Canceled` or `context.DeadlineExceeded`. File contents, command output,
environment values, arguments, and raw operating-system diagnostics are
excluded from general diagnostics.

## Build-only dependencies

The Spice toolchain is authorized through the standard Go `tool` directive and
normal module selection. Committed vendor data makes compiler and product
verification available offline. No custom plugin or dependency registry exists.