V39 Gate 2: Depository Supply Indexing And Searchable Deposit Lifecycle

[geraldarthurdavis]

Summary

• Adds the package-owned DepositorySupplyIndex primitive for source-safe Depository supply records, search documents, vector/storage projections, rights boundaries, repair posture, and Finding Fits handoff.
• Generates the source-safe V39 Gate 2 proof artifact and protocol checker/test coverage.
• Updates V39 spec, delta, notes, parity matrix, README, roadmap, package docs, and gate/canon workflows for Gate 2 closure.

Validation

• pnpm run check:v39-gate2
• pnpm --filter @bitcode/pipeline-asset-pack typecheck
• pnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --runTestsByPath src/tests/depository-supply-index.test.ts src/tests/depository-search.test.ts --runInBand --forceExit
• pnpm --filter @bitcode/protocol test
• node scripts/check-bitcode-spec-family.mjs --version V39 --mode draft --current-target V38
• node scripts/check-bitcode-canon-posture-drift.mjs --active-canon V38 --draft-target V39
• node scripts/check-bitcode-spec-family.mjs --version V38 --mode promoted --current-target V38
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
engi-uapi	Ready	Preview, Comment	May 25, 2026 5:31am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1c121a4c41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor supply-index gating when no searchable records

When a depositorySupplyIndex is present but contains zero searchable records (for example, all records are blocked-readiness), this code falls through to raw depositoryAssets/depositCandidates and reintroduces candidates that the supply index explicitly gated out. In runDepositorySearchForPipelineInput, those raw collections are still passed alongside the index, so blocked supply can still be ranked and selected, bypassing the new lifecycle/rights boundary and potentially re-exposing non-source-safe content from raw units. If an index is supplied, asset selection should be derived strictly from depositorySupplyAssetsFromIndex (even if empty).

Useful? React with 👍 / 👎.