70 — Forgeyard Dependency Update Automation, Version Maintenance, Vulnerability Remediation & Upgrade Campaign System Architecture

Document type: Core Dependency Update Automation, Version Maintenance, Lockfile Refresh, Vulnerability Remediation, Upgrade Campaign, Compatibility Validation & Automated Change Proposal System Architecture
Project: Forgeyard CI/CD
Subsystem: dependency discovery, version update policy, lockfile maintenance, automated upgrade proposals, grouped dependency updates, security remediation, toolchain/runtime upgrades, compatibility gates, staged update campaigns, stale dependency detection, update windows, rollout/rollback, ownership, notifications, and upgrade evidence
Architecture style: Proposal-first automation, exact dependency identities, lockfile-centered reproducibility, policy-bound version selection, immutable update plans, compatibility/test evidence, explicit security urgency, grouped risk-aware campaigns, no silent source mutation, and no bypass of normal change/release authority
Status: Target production architecture extending the Forgeyard series beyond the original 01–26 plan
Relationship to prior work: Builds on Dependency/Registry/Mirror Governance, Static Analysis/Security Findings, Compatibility Governance, Change Proposal, Merge Queue, Pipeline/Testing, Release Lifecycle, Progressive Delivery, Preflight, Artifact Registry, Supply Chain, Developer Experience, and Incident Management. This subsystem automates the maintenance workflow around dependencies while preserving Forgeyard’s existing source and release governance.

1. Purpose

Modern projects depend on continuously changing ecosystems:

Rust crates
npm packages
Python packages
Maven/Gradle artifacts
Go modules
Dart/Flutter packages
system packages
container base images
SDKs
toolchains
compiler versions
Git dependencies
internal packages

Without structured maintenance, dependency updates often happen as:

developer notices old package
  ↓
manually edits manifest
  ↓
updates lockfile
  ↓
hopes CI catches problems

At scale, this creates:

security exposure
large painful upgrade jumps
stale lockfiles
unsupported runtimes
dependency conflicts
manual toil
unreviewed emergency patches

The central rule is:

Forgeyard may discover, plan, propose, and validate dependency changes automatically, but protected source and lockfiles change only through the normal Change Proposal / merge workflow.

A second rule is:

Version selection is policy- and compatibility-aware. “Newest available” is not automatically “best allowed.”

A third rule is:

Security urgency may accelerate cadence, but it never eliminates source review, reproducible lock resolution, compatibility evidence, or normal release identity.

2. Architectural Position

                Registry / Mirror / Advisory Data
                            │
                            ▼
                     Update Discovery
                            │
                            ▼
                      Update Candidate
                            │
                            ▼
                       Update Plan
                            │
            ┌───────────────┼───────────────┐
            ▼               ▼               ▼
       Compatibility      Security        Policy
            │               │               │
            └───────────────┼───────────────┘
                            ▼
                  Generated Change Proposal
                            │
                            ▼
                        Normal CI
                            │
                            ▼
                     Merge / Release

3. Goals

The subsystem MUST:

define update-candidate identity;
define update-plan identity;
discover new dependency versions;
support semver-aware selection;
support exact lockfile regeneration;
support security-only updates;
support routine maintenance updates;
support major-version campaigns;
support grouped updates;
support internal package updates;
support compiler/toolchain updates;
support base-image updates;
support compatibility evaluation;
support automated Change Proposal creation;
support owner assignment;
support update windows;
support merge queue integration;
support vulnerability deadlines;
support rollback/revert;
support stale dependency reporting;
support dependency deprecation/EOL;
support multi-repo campaigns;
support monorepo campaigns;
support tenant/project policies;
support UI/API/CLI;
support audit;
support HA;
support air-gap/internal mirrors;
support evidence retention;
never silently mutate protected source.

4. Non-Goals

This subsystem does not replace:

package managers
dependency resolvers
registries
security scanners
Change Proposal
Merge Queue
Release

It orchestrates maintenance across them.

5. Workspace Structure

crates/dependency-update/
├── forgeyard-dependency-update/
├── forgeyard-dependency-update-model/
├── forgeyard-dependency-update-discovery/
├── forgeyard-dependency-update-policy/
├── forgeyard-dependency-update-resolver/
├── forgeyard-dependency-update-lockfile/
├── forgeyard-dependency-update-security/
├── forgeyard-dependency-update-campaign/
├── forgeyard-dependency-update-proposal/
├── forgeyard-dependency-update-reconcile/
├── forgeyard-dependency-update-health/
└── forgeyard-dependency-update-testkit/

Ecosystem adapters:

ecosystems/
├── rust/
├── javascript-typescript/
├── python/
├── java-kotlin/
├── go/
├── dart-flutter/
├── swift/
├── c-cpp/
└── ...

Each ecosystem adapter provides dependency metadata/resolution semantics while core remains ecosystem-neutral.

6. DependencyCoordinate

#![allow(unused)]
fn main() {
pub struct DependencyCoordinate {
    pub ecosystem: EcosystemId,
    pub namespace: Option<BoundedString>,
    pub name: BoundedString,
}
}

7. DependencyVersionId

#![allow(unused)]
fn main() {
pub struct DependencyVersionId(Digest);
}

Canonical resolved version identity.

8. UpdateCandidateId

#![allow(unused)]
fn main() {
pub struct UpdateCandidateId(Digest);
}

Immutable candidate:

current dependency
target dependency
project/source snapshot
update policy

9. UpdatePlanId

#![allow(unused)]
fn main() {
pub struct UpdatePlanId(Digest);
}

Immutable exact proposed update plan.

10. Dependency Update Subject

#![allow(unused)]
fn main() {
pub enum DependencyUpdateSubject {
    Project(ProjectId),
    Component(SoftwareComponentId),
    Workspace(WorkspaceId),
    Repository(RepositoryId),
    ReleaseLine(ReleaseLineId),
}
}

11. Update Kinds

#![allow(unused)]
fn main() {
pub enum DependencyUpdateKind {
    Patch,
    Minor,
    Major,
    Security,
    Toolchain,
    Runtime,
    BaseImage,
    GitRevision,
    InternalPackage,
}
}

#![allow(unused)]
fn main() {
pub struct DependencyVersionPolicyId(Digest);
}

15. VersionPolicy

#![allow(unused)]
fn main() {
pub struct DependencyVersionPolicy {
    pub allowed: VersionConstraint,
    pub denied: Vec<VersionConstraint>,
    pub prerelease: PrereleasePolicy,
    pub update_strategy: UpdateStrategy,
}
}

16. UpdateStrategy

#![allow(unused)]
fn main() {
pub enum UpdateStrategy {
    LatestAllowed,
    LowestCompatible,
    SecurityMinimum,
    PinExact,
    OrganizationApproved,
}
}

#![allow(unused)]
fn main() {
pub enum PrereleasePolicy {
    Deny,
    AllowExplicit,
    AllowChannel(ReleaseChannelRef),
}
}

#![allow(unused)]
fn main() {
pub struct RegistrySnapshotId(Digest);
}

#![allow(unused)]
fn main() {
pub struct VulnerabilityAdvisorySnapshotId(Digest);
}

31. Security Candidate

Contains:

affected version range
fixed versions
severity
exploitability if known
advisory evidence

#![allow(unused)]
fn main() {
pub enum SecurityUrgency {
    Routine,
    Elevated,
    Critical,
    Emergency,
}
}

36. Update Deadline

#![allow(unused)]
fn main() {
pub struct RemediationDeadline(Timestamp);
}

37. Deadline Policy

Based on:

severity
exploitability
internet exposure
runtime use
asset criticality

#![allow(unused)]
fn main() {
pub enum DependencyRelation {
    Direct,
    Transitive,
    Build,
    Dev,
    Runtime,
    Optional,
}
}

43. Transitive Update

May be achieved by parent package update or lock refresh.

44. Lockfile Identity

#![allow(unused)]
fn main() {
pub struct LockfileSnapshotId(Digest);
}

45. Lockfile Regeneration

Performed by exact package-manager/toolchain version.

46. ResolverEnvironmentId

#![allow(unused)]
fn main() {
pub struct ResolverEnvironmentId(Digest);
}

47. Resolver Environment

Includes:

package manager version
registry snapshot/mirror
configuration
platform/target where relevant

#![allow(unused)]
fn main() {
pub struct LockfileDiff {
    pub added: Vec<ResolvedDependency>,
    pub removed: Vec<ResolvedDependency>,
    pub changed: Vec<ResolvedDependencyChange>,
}
}

#![allow(unused)]
fn main() {
pub struct DependencyUpdatePlan {
    pub id: UpdatePlanId,
    pub source: SourceSnapshotId,
    pub candidates: Vec<UpdateCandidateId>,
    pub resolver: ResolverEnvironmentId,
    pub policy: DependencyVersionPolicyId,
}
}

55. Plan Output

manifest edits
lockfile edits
compatibility findings
security findings
expected CI impact

update plan
reason
current/target versions
security advisory
generated lockfile
risk facts

#![allow(unused)]
fn main() {
pub struct DependencyUpdateCampaignId(Ulid);
}

66. Campaign

Groups related update plans.

67. Campaign Types

#![allow(unused)]
fn main() {
pub enum DependencyUpdateCampaignKind {
    RoutineMaintenance,
    SecurityRemediation,
    MajorUpgrade,
    ToolchainUpgrade,
    RuntimeUpgrade,
    BaseImageUpgrade,
    EcosystemMigration,
}
}

#![allow(unused)]
fn main() {
pub enum DependencyUpdateCampaignState {
    Planned,
    Discovering,
    Proposing,
    Validating,
    RollingOut,
    Paused,
    Succeeded,
    Failed,
    Cancelled,
}
}

74. Grouped Updates

Can reduce noise.

Examples:

all Tokio crates
all AWS SDK crates
all internal platform packages

75. GroupPolicyId

#![allow(unused)]
fn main() {
pub struct DependencyGroupPolicyId(Digest);
}

76. Grouping Rules

ecosystem
publisher
package family
shared compatibility
security advisory

bisect group
split by package family
split one-by-one

#![allow(unused)]
fn main() {
pub struct UpdateProposalBudget {
    pub max_open_per_project: u32,
    pub max_new_per_day: u32,
}
}

83. Noise Control

Important.

84. Update Window

#![allow(unused)]
fn main() {
pub struct DependencyUpdateWindow {
    pub timezone: TimeZoneId,
    pub schedule: CalendarSchedule,
}
}

#![allow(unused)]
fn main() {
pub struct DependencyStaleness {
    pub current: DependencyVersionId,
    pub latest_allowed: Option<DependencyVersionId>,
    pub age: Duration,
}
}

90. Staleness Policy

Can flag:

months behind
unsupported version
EOL runtime

#![allow(unused)]
fn main() {
pub enum DependencySupportState {
    Supported,
    Maintenance,
    Deprecated,
    EndOfLife,
    Unknown,
}
}

Rust compiler
JDK
Node runtime
Python runtime
Android SDK/NDK
Swift toolchain

pilot projects
internal projects
all projects

#![allow(unused)]
fn main() {
pub struct DependencyUpdateWaveId(Ulid);
}

117. Wave Example

core libraries
  ↓
internal services
  ↓
edge clients

pause dependent repos
continue independent repos

build
unit tests
integration tests
compatibility
security scan
benchmark where required

137. Update-Specific Tests

Can include:

dependency API smoke
lockfile reproducibility
feature matrix
minimum supported version

#![allow(unused)]
fn main() {
pub enum UpdateCandidateFreshness {
    Current,
    NewerAvailable,
    TargetYanked,
    AdvisoryChanged,
    PolicyChanged,
    RegistryChanged,
    Expired,
    Unknown,
}
}

open new proposal
comment/rebase
ask human

incident
  ↓
rollback/revert
  ↓
alternative fixed version

163. Vulnerability May Remain

Incident/security policy determines urgency.

164. Update Exception

#![allow(unused)]
fn main() {
pub struct DependencyUpdateExceptionId(Ulid);
}

165. Exception

#![allow(unused)]
fn main() {
pub struct DependencyUpdateException {
    pub dependency: DependencyCoordinate,
    pub constraint: VersionConstraint,
    pub reason: BoundedString,
    pub expires_at: Timestamp,
}
}

166. Examples

upstream regression
license issue
platform incompatibility
temporary vendor block

dependency_update.read
dependency_update.plan
dependency_update.propose
dependency_update.campaign.manage
dependency_update.exception.manage
dependency_update.security.override

security exception
deadline override
campaign cancellation
major update approval
automated proposal actor
candidate suppression

187. Routine Discovery

Operational event.

188. Dioxus UI

Pages:

Dependency Updates
Security Remediation
Upgrade Campaigns
Stale Dependencies
Update Policies
Exceptions

189. Dependency Dashboard

Shows:

current version
latest allowed
latest available
support state
vulnerability state
open proposal

190. Campaign View

Shows:

scope
waves
repos/components
proposal states
failures
deadlines

191. Update Detail

Shows:

manifest diff
lockfile diff
transitive changes
compatibility
security
tests

192. CLI

forgeyard deps scan
forgeyard deps outdated
forgeyard deps plan <package>
forgeyard deps propose
forgeyard deps campaign create
forgeyard deps campaign status
forgeyard deps exception add
forgeyard deps doctor

193. API

Potential:

GET  /v1/dependencies/outdated
POST /v1/dependency-updates/plan
POST /v1/dependency-updates/proposals
POST /v1/dependency-update-campaigns
GET  /v1/dependency-update-campaigns/{id}

194. Notifications

Examples:

critical dependency deadline
proposal ready
major campaign blocked
EOL runtime
update exception expiring

open stale proposals
candidate freshness
campaign progress
deadline
exception expiry
registry/advisory changes

update plans
proposal links
security deadline decisions
exceptions
campaign history

affected components
CI cost
compatibility risks

critical dependency remediation within deadline

#![allow(unused)]
fn main() {
pub struct UpdateTestMatrix {
    pub required_platforms: Vec<PlatformId>,
    pub feature_sets: Vec<FeatureSetId>,
}
}

duplicate versions
unused entries
stale git revisions
unexpected registry

247. Registry Origin Drift

Security finding.

248. Doctor

forgeyard deps doctor

Checks:

stale advisory snapshot
mirror metadata lag
open critical remediation overdue
expired exceptions
bot proposals stuck
resolver environment unavailable
EOL toolchains

249. Health

#![allow(unused)]
fn main() {
pub enum DependencyUpdateSubsystemHealth {
    Healthy,
    DiscoveryDegraded,
    ResolverDegraded,
    ProposalDegraded,
    SecurityRemediationDegraded,
    Unhealthy,
}
}

250. Observability Metrics

dependency_updates_discovered_total
dependency_update_proposals_total
dependency_update_merge_total
dependency_update_failures_total
dependency_security_overdue_total
dependency_update_campaign_active

251. Labels

Low cardinality:

ecosystem
update_kind
result
urgency

252. No package-name high-cardinality labels baseline.

253. Tracing

deps.discover
deps.resolve
deps.plan
deps.propose
deps.validate
deps.campaign
deps.reconcile

254. Testkit

forgeyard-dependency-update-testkit/src/
├── lib.rs
├── discovery.rs
├── policy.rs
├── resolver.rs
├── lockfile.rs
├── campaign.rs
├── proposal.rs
└── assertions.rs

255. Core Tests

Discovery

same registry/advisory snapshot yields deterministic candidates;
prerelease denied unless policy allows.

Resolver

exact package-manager version used;
public fallback denied for private namespace;
yanked target invalidates candidate.

Lockfile

full transitive diff surfaced;
independent regeneration deterministic where ecosystem permits.

Proposal

protected branch never directly mutated;
bot service principal cannot bypass merge policy;
human edits are not silently overwritten.

Security

critical advisory creates deadline;
expired exception becomes visible/blocking per policy.

Campaign

compatibility order respected;
failed repo blocks dependents but not unrelated repos.

Toolchain

new descriptor created; old descriptor immutable.

Rollback

revert becomes new proposal; history not rewritten.

256. Chaos Tests

Inject:

registry outage
mirror lag
advisory feed outage
resolver crash
proposal provider timeout
SCM conflict

Expected:

no source corruption
candidate freshness explicit
proposal creation idempotent
campaign can resume

257. Scale Tests

Test:

large monorepo dependency graphs
thousands of repositories
large internal package ecosystem
mass security advisory
toolchain fleet-wide campaign

Update automation never silently modifies protected source.
Every proposed update binds exact source snapshot and target dependency identities.
Discovery is deterministic against exact registry/advisory snapshots.
Package ecosystem version semantics are adapter-specific.
Latest version is not automatically selected when policy forbids it.
Prerelease updates require explicit policy.
Lockfile regeneration uses exact resolver/toolchain environment.
Full transitive lockfile changes are surfaced.
Private namespaces never silently fall back to public registry.
Yanked/revoked versions invalidate candidates.
Security deadlines are explicit.
Security exceptions are scoped and expiring.
Critical security urgency does not create merge/policy bypass.
Bot-authored proposals use normal Change Proposal semantics.
Bot service principal has no special merge authority.
Human changes to bot proposals are preserved.
Auto-merge, if enabled, still uses normal Merge Queue/policy.
Grouped updates are policy-bounded.
Failed grouped updates can split deterministically.
Proposal spam is rate/budget controlled.
Major/toolchain campaigns use compatibility-aware ordering.
Toolchain upgrades create new immutable ToolchainDescriptorIds.
Base-image updates delegate to Part 58.
Deployment/production rollout delegates to Parts 62/67.
Rollback/revert creates new source history rather than rewriting.
EOL/support state remains distinct from vulnerability state.
Air-gap update discovery works from imported snapshots.
Federation preserves package/source authority boundaries.
Audit retains exceptions/deadline overrides/campaign decisions.
Forgeyard dogfoods dependency update automation on its own Rust workspace.

260. Production Readiness Gates

Do not call dependency update automation production-ready until:

inventory/discovery is deterministic
Rust lockfile updates are reproducible
private namespace fallback protection passes
bot proposals cannot bypass merge policy
security deadline/exception flow works
candidate freshness handles yank/advisory changes
grouped update split/recovery works
toolchain campaign compatibility gates work
air-gap/federation snapshot tests pass
chaos/scale tests pass

261. Architectural Invariants

updates are proposed, not silently applied;
protected source changes use Change Proposal;
dependency target identity is exact;
version semantics are ecosystem-aware;
policy controls allowed versions;
prereleases are explicit;
lockfile resolution is reproducible/traceable;
transitive changes are visible;
private registry namespaces never public-fallback;
candidate freshness matters;
yanked/revoked targets cannot merge normally;
security urgency does not bypass trust/authz;
exceptions expire;
bot actor has no special merge privilege;
human edits are preserved;
grouped updates are bounded;
campaigns are compatibility-ordered;
toolchain descriptors remain immutable;
base-image authority remains Part 58;
release/deployment authority remains Parts 15/62/67;
reverts create new history;
EOL and vulnerability are separate;
AI-generated fixes remain normal proposals;
air-gap snapshots are supported;
audit records privileged maintenance decisions;
cost cannot defer mandatory security remediation indefinitely;
no hidden DB/config migrations inside dependency update;
resolver workers lack production mutation credentials;
history/evidence is retained;
Forgeyard dogfoods its own dependency updater.

262. Final Target Architecture

                  Registry / Advisory Snapshot
                            │
                            ▼
                     Dependency Discovery
                            │
                            ▼
                       UpdateCandidate
                            │
                            ▼
                        UpdatePlan
                            │
             ┌──────────────┼──────────────┐
             ▼              ▼              ▼
       Compatibility     Security        Policy
             │              │              │
             └──────────────┼──────────────┘
                            ▼
                  Generated Source Patch
                            │
                            ▼
                     Change Proposal
                            │
                            ▼
                        Normal CI
                            │
                            ▼
                      Merge Queue
                            │
                            ▼
                   Normal Release Flow

Security campaign:

critical advisory
      ↓
affected dependency graph
      ↓
fixed-version candidates
      ↓
update proposals
      ↓
CI + compatibility
      ↓
merge
      ↓
security/hotfix release train
      ↓
progressive rollout

The key guarantee is:

Forgeyard can automate the repetitive work of dependency maintenance without turning maintenance bots into privileged source or release authorities. Discovery, resolution, lockfile generation, security remediation, and upgrade campaigns are automated aggressively, while every actual source change remains an exact, reviewable, testable Change Proposal that flows through the same merge and release controls as human-written code.

263. Extended Architecture Sequence

01 Core Domain & Foundation
02 Storage & Metadata
03 CAS & Artifact Data Plane
04 Pipeline IR / Parsing / Planning
05 Run / Job State Machine
06 Scheduler
07 Runner / Agent
08 Sandbox & Executor
09 Transport / QUIC / Protocol
10 Events / Reconciliation
11 Policy / Authorization / Identity
12 Secrets / Trust
13 Supply Chain / SBOM / Provenance / Signing
14 Packaging
15 Release
16 Deployment
17 Observability / Health / Doctor
18 API / Axum
19 Dioxus UI
20 Device Lab
21 SCM Provider Integrations
22 HA / Coordination / Raft
23 RBE Interop
24 Plugin / Extension Architecture
25 Operations / Backup / Upgrade / DR
26 Self-Hosting / Bootstrap / Release Forgeyard
27 Multi-Tenancy / Quotas / Resource Governance
28 Audit / Compliance / Security Governance
29 Notifications / Alerting / Human Workflow
30 Entitlements / Licensing / Subscription
31 Search / Indexing / Operational Analytics
32 Test Results / Quality / Coverage / Flaky Intelligence
33 Benchmark / Performance / Load / Capacity
34 Monorepo / Dependency Graph / Affected Work
35 Developer Experience / Local Dev
36 Dependency / Registry / Mirror Governance
37 Static Analysis / Security Findings
38 Cache / Remote Cache / Correctness
39 Configuration / Feature Flags / Runtime
40 Security / Threat Model / Incident Response
41 Release Distribution / Update Delivery
42 Workflow Templates / Golden Paths
43 Runner Fleet Autoscaling / Provisioning
44 Pipeline Triggers / Schedules / Dispatch
45 Cost Accounting / FinOps
46 Data Lifecycle / Retention / Privacy
47 CI/CD Migration / Compatibility
48 Failure Diagnosis / Reproduction / Bisect
49 Service Catalog / Ownership / Developer Portal
50 Reliability / SLO / Error Budget / Resilience
51 Multi-Region Federation / Edge / Disconnected
52 Artifact Registry / OCI / Package Distribution
53 Infrastructure-as-Code / Preview Environments / Drift
54 Merge Queue / Speculative Integration / Batch Validation
55 AI-Assisted CI Optimization / Engineering Copilot
56 Test Data / Fixtures / Ephemeral Databases / Service Virtualization
57 API / ABI / Schema / Protocol Compatibility / Contract Evolution
58 Runner Image Factory / Golden Images / Patch Management / Baseline Attestation
59 Network Connectivity / Private Resource Access / Egress / Tunneling / Zero-Trust Connectivity
60 Workflow Concurrency / Distributed Locks / Idempotency / Reservations / Exclusive Coordination
61 Incident Management / On-Call / Escalation / Response Coordination / Postmortem
62 Environment Promotion / Progressive Delivery / Feature Rollout / Canary Analysis / Automated Rollback
63 Database Schema Migration / Online Backfill / Data Transformation / Zero-Downtime Change Orchestration
64 Remote Development Environments / Cloud Workspaces / Developer Workspace Orchestration
65 Build Graph Replay / Historical Reproducibility / Time-Travel CI / Evidence Reconstruction
66 Change Risk Assessment / Preflight Simulation / Policy Preview / What-If Analysis
67 Artifact Promotion Policy / Release Train / Environment Channel / Lifecycle Governance
68 Configuration Drift Detection / Desired-State Convergence / Runtime Reconciliation / Environment Consistency
69 Job Checkpointing / Suspend-Resume / Preemption / Graceful Cancellation / Interruptible Runner Recovery
70 Dependency Update Automation / Version Maintenance / Vulnerability Remediation / Upgrade Campaigns

Keyboard shortcuts

Forgeyard System Architecture & Engineering Documentation