[tang-vu]

Why this matters

Extension dependencies determine activation order and the blast radius of disabling a shared service. Reviewers previously had to inspect dozens of manifests by hand, and the lifecycle path could discover a missing node or cycle only when an operator tried to apply it.

This PR provides deterministic human/JSON/DOT inspection and now runs the same complete graph contract through ods config validate / scripts/validate-manifests.sh. Invalid topology therefore fails in the installed operator command and existing CI manifest lane, not only when somebody remembers to invoke a standalone helper.

Overlap check

Searched open and closed upstream PRs for extension dependency graphs, Graphviz, depends_on validation, and every changed production/test file. No other PR changes the validator or graph script. #2853 adds a FalkorDB graph-memory extension and is unrelated. #2495 corrects one workflow dependency value; this tool validates that manifest contract but does not overlap its implementation. The existing #2909 branch was strengthened instead of opening a separate release-gate PR.

What changed

• scan bundled and library service manifests as one graph
• reject malformed dependency lists, duplicate IDs, missing nodes, and cycles with an actionable path
• traverse prerequisites or transitive dependents from a selected root
• emit deterministic table, JSON, and Graphviz DOT formats with dependency-first ordering
• invoke full-catalog graph validation from scripts/validate-manifests.sh, the path used by ods config validate and CI
• emit an explicit validation receipt; preserve the validator's existing documented skip when Python/PyYAML schema dependencies are unavailable
• document both ad-hoc inspection and automatic gate behavior

Regression coverage

The graph CLI tests exercise dependency ordering, reverse blast radius, missing nodes, exact cycle paths, and DOT edges. The manifest-validator boundary test now requires the production command to print Extension dependency graph validated; it failed before wiring because the standalone inspector was never called.

Validation

• python -m pytest -q tests/test_extension_dependency_graph.py — 4 passed.
• bash tests/test-validate-manifests.sh — 8 passed.
• bash tests/test-validate-manifest-schema.sh — full bundled/library schema source-of-truth suite passed.
• python scripts/extension-dependency-graph.py --format json against the real catalog — passed.
• bash -n scripts/validate-manifests.sh tests/test-validate-manifests.sh — passed.
• ShellCheck error-level validation — passed.
• git diff --check — passed.

Tradeoffs and rollback

Graph validation is strict only when the existing Python/PyYAML/jsonschema capability gate is available; dependency checks are skipped with an explicit warning in the same reduced environments where schema parsing is already skipped. This avoids making installed validation less portable while making CI/release validation authoritative. Rollback removes the inspector/gate without changing manifests or runtime state.

[tang-vu]

Batch compatibility receipt (2026-08-24)

Built the inspectable synthetic branch tang-vu:validation/batch-20260824-architecture from upstream main (6ff9b4fc) and merged exact candidate heads in this order:

1. fix(dashboard): keep extension progress polls single-flight #3065 bad25e7f
2. feat(extensions): preview and confirm lifecycle change plans #2903 829dd48f
3. feat(observability): stream scoped service health transitions #2911 d8aed4c6
4. feat(extensions): inspect and gate dependency graphs #2909 6e9bd227
5. feat(release): publish commit-bound deterministic runtime SBOM #2894 9115d147
6. refactor(cli): extract read-only formatting primitives #3071 bff5cbfc

No manual merge resolution was required, including the shared Extensions.jsx / Extensions.test.jsx surface in #3065 and #2903. Synthetic head: 2c82aaec.

Combined validation:

• Dashboard: 28 files / 262 tests passed; ESLint passed; production Vite build passed
• Dashboard API: 350 passed, 5 skipped across service events, main routing, extension plans, lifecycle, and dependency suites
• dependency graph + manifest gates: 4 pytest cases, 8 shell cases, full canonical/library schema contract passed
• runtime SBOM: 5 tests passed; shipped dependency-pin validation passed
• CLI: JSON public boundary, Phase C smoke, Bash syntax, ShellCheck, 4/4 BATS formatting contract, and enable/reconciliation fixture passed

The stale Browserslist notice and authentication-dependent Phase C skips are unchanged environmental disclosures. #2903 remains draft because synthetic compatibility does not replace its declared live host-agent lifecycle gate and independent human review.

[Lightheartdevs]

Thanks for this contribution. We're closing outside-contributor pull requests that have had no activity for 14 days or more, so the queue reflects work that can still land. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and reopen it or open a focused PR. See #7253 for details and the contribution policy.