fix: close review safety gaps and isolate standalone builds

.github/actions/setup-deps/action.yml

@@ -1,52 +1,23 @@
 name: Setup Dependencies
-description: Clone ecosystem sibling repos with retry, setup Go, sync workspace
+description: Set up Go and download the independently published module graph
 
 inputs:
   go-version:
     description: Go version to install
-    default: '1.27.2'
+    default: '1.27.3'
   token:
-    description: GitHub token for authenticated clones
-    required: true
+    description: Retained for compatibility; public modules need no clone token
+    required: false
 
 runs:
   using: composite
   steps:
-    - name: Checkout sibling dependencies
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-      run: |
-        clone_with_retry() {
-          local repo=$1 dest=$2 branch=${3:-main}
-          for i in 1 2 3; do
-            git clone --depth=1 --branch "$branch" "https://x-access-token:${GH_TOKEN}@github.com/GrayCodeAI/${repo}.git" "$dest" && return 0
-            echo "Retry $i for $repo..." && sleep $((i * 5))
-          done
-          echo "Failed to clone $repo after 3 attempts" && return 1
-        }
-        ws_parent="$(cd "${GITHUB_WORKSPACE}/.." && pwd)"
-        mkdir -p "$ws_parent"
-        while IFS= read -r repo; do
-          [ "$repo" = reflect ] && continue
-          dest="$ws_parent/$repo"
-          if [ -d "$dest/.git" ]; then
-            echo "$repo already present at $dest"
-            continue
-          fi
-          if ! git ls-remote "https://x-access-token:${GH_TOKEN}@github.com/GrayCodeAI/${repo}.git" HEAD >/dev/null 2>&1; then
-            echo "WARNING: GrayCodeAI/${repo} is not reachable; skipping checkout"
-            continue
-          fi
-          clone_with_retry "$repo" "$dest" main
-        done < <(./scripts/ecosystem-manifest.sh list workspace)
-
     - name: Set up Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ inputs.go-version }}
-
-    - name: Sync workspace
+    - name: Download published dependencies
       shell: bash
-      run: |
-        make workspace
+      env:
+        GOWORK: 'off'
+      run: go mod download

.github/workflows/ci.yml

@@ -24,16 +24,8 @@ env:
   # published on the public proxy. Direct-VCS fallback is retained for anything
   # else.
   GOPROXY: "https://proxy.golang.org,direct"
-  # CI must resolve the dependency versions pinned in go.mod/go.sum, not whatever
-  # happens to sit in the sibling checkouts that the committed go.work points at.
-  # Go's reference is explicit that a committed go.work "may cause a continuous
-  # integration (CI) system to select and thus test the wrong versions of a
-  # module's dependencies" and that "CI systems should generally not be allowed to
-  # use the go.work file". Because ./.github/actions/checkout-relay clones the
-  # siblings at branch HEAD into the workspace parent, workspace mode would silently
-  # hide version skew (e.g. a shared pin that no longer matches).
-  # The `module` job opts back in (GOWORK: "auto") since `go work sync` and the
-  # go.work content checks genuinely require the workspace.
+  # Build and test the independently published dependency graph. Optional
+  # local Relay development uses go.local.mod, never a parent workspace.
   GOWORK: "off"
 
 jobs:
@@ -100,55 +92,25 @@ jobs:
         run: bash ./scripts/check-relay-engine-boundary.sh
 
   # -------------------------------------------------------------------------
-  # 2. Module hygiene — tidy, verify Reflect plus the sibling Go modules via go.work.
+  # 2. Module hygiene — validate the published Reflect dependency graph.
   # -------------------------------------------------------------------------
   module:
     name: module hygiene
     runs-on: ubuntu-latest
-    # Workspace hygiene is this job's entire purpose (`go work sync`, the go.work
-    # content checks), so it deliberately re-enables the workspace that the
-    # workflow-level GOWORK: "off" disables. The steps here that must see the
-    # pinned versions already set GOWORK=off inline.
-    env:
-      GOWORK: "auto"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
-      - name: Generate ecosystem workspace
-        run: bash ./scripts/generate-workspace.sh
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
-      - name: go work sync + module consistency
+      - name: Published module consistency
         run: |
-          # Sibling repos are independent checkouts in the workspace parent.
-          # go mod tidy can mis-resolve workspace modules here; go work sync is
-          # the supported workspace hygiene step.
-          go work sync
+          go mod tidy -diff
+          go mod verify
           go build -mod=readonly -o /dev/null ./cmd/reflect
-          if ! git diff --quiet -- go.mod go.sum go.work go.work.sum; then
-            echo "::error::go.mod / go.sum / go.work files out of date — run 'go work sync' locally and commit"
-            git diff -- go.mod go.sum go.work go.work.sum
-            exit 1
-          fi
-      - name: go mod verify
-        run: go mod verify
-      - name: workspace references sibling checkouts
-        run: |
-          workspace_file="${GITHUB_WORKSPACE}/../go.work"
-          while IFS= read -r module; do
-            [ "$module" = reflect ] && continue
-            if ! grep -q "./${module}" "$workspace_file"; then
-              echo "::error::go.work must include ./${module}."
-              cat "$workspace_file"
-              exit 1
-            fi
-          done < <(./scripts/ecosystem-manifest.sh list workspace)
+          git diff --exit-code -- go.mod go.sum
       - name: Validate every Go module independently
         run: |
           while IFS= read -r modfile; do
@@ -166,9 +128,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -183,15 +142,13 @@ jobs:
           go test ./... -count=1 -timeout=300s
 
   release-parity:
+    # Retain the required status-check name configured on main.
     name: workspace and module parity
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -208,9 +165,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -233,9 +187,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -262,9 +213,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -349,9 +297,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -438,9 +383,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -493,9 +435,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -523,9 +462,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -556,9 +492,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/compatibility-matrix.yml

@@ -17,15 +17,15 @@ on:
 permissions:
   contents: read
 
+env:
+  GOWORK: "off"
+
 jobs:
   validate:
     name: validate compatibility matrix
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/checkout-relay
-        with:
-          ref: ${{ github.head_ref || github.ref_name }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "1.27.2"

.gitignore

@@ -40,7 +40,7 @@ coverage.html
 CODE_REVIEW_REPORT.md
 review_report.md
 
-# Workspace checksum file — regenerated by `make setup` / `go work sync`.
+# Personal workspace checksums are never part of the published build.
 go.work.sum
 
 # Local direnv file (may hold personal keys for `make test-live`).

CONTRIBUTING.md

@@ -39,11 +39,22 @@ Repo-specific dev targets:
 
 | Target             | What it does                                                        |
 | ------------------ | ------------------------------------------------------------------- |
-| `make setup`       | Set up local development environment (go.work + external repos).     |
+| `make setup`       | Install local development tools; use published dependencies.     |
 | `make boundaries`  | Alias for all boundary guards (matches `make boundaries` in engine repos). |
 | `make test-10x`    | Run tests 10 times to surface flakes.                               |
 | `make smoke`       | Quick build + doctor + ecosystem verification.                      |
 
+Reflect builds independently with the published Relay dependency in `go.mod`.
+For coordinated Relay changes, create an optional local overlay:
+
+```bash
+make workspace RELAY_DIR=/path/to/relay
+GOWORK=off go test -modfile=go.local.mod ./...
+```
+
+The overlay stays gitignored. Run `make ci` against the published dependency
+before release. Setup and CI never generate a parent `go.work`.
+
 ## Commit message convention
 
 We use [Conventional Commits](https://www.conventionalcommits.org/). Pull