dependency-repair

Repairs a product's main gone red by itself — a dependency audit reading advisories published after the last green run — on a branch off main, and merges it once the suite is green. It runs the audit the product's NFDR names and answers every advisory by the rules development-security uses: an allowed fix (a bump to the fixed release, a renamed identifier, a major bump only with the suite green), an exception for an advisory the product does not reach (in the product's exception record, with a row in the instance upkeep register), and a question for the owner where the only fix is forbidden. It writes a committed report whose first line says merged, unmerged or stopped, or closes with nothing-to-repair when main is not red from its audit. Halts outside a senior-engineer session or the senior-engineer subagent.