[jdwyah]

Why

verify-sdk-boot/boot_check_go and verify-dev-injection/inject_check_go required github.com/quonfig/sdk-go v0.0.0 with replace => ../../../sdk-go, which is outside the repo. That caused three problems:

• ssdlc / deps fails on every open ITD PR (chore(dev-deps): bump @types/node from 22.19.18 to 26.6.5 in /chaos/validator #29-deps: bump js-yaml from 4.3.2 to 5.5.0 in /generators #34). osv-scanner's govulncheck call analysis can't load the packages (replacement directory ../../../sdk-go does not exist), and since chore(dev-deps): bump the npm-minor-patch group across 2 directories with 1 update #28 osv-scanner exits 127 on that instead of continuing.
• GitHub's dependency graph never indexed either go.mod (qfg-ao5h4), so no Dependabot security alert could fire for a Go advisory there.
• sdk-go is now github.com/quonfig/sdk-go/v2, so the replace no longer matched the sibling checkout's module path either.

What

• go.mod / main.go: require and import github.com/quonfig/sdk-go/v2 v2.1.0, with no replace. x/sys is 0.44.0 in both.
• run.sh: the new run_go_check builds against the sibling ../../../sdk-go through a temporary go.work. It fails loudly if sdk-go/v2 resolves from anywhere else, such as a sibling on an old pre-v2 branch.
• dependabot.yml: drop the sdk-go ignore. Bumping the pin is harmless.
• READMEs updated. No YAML test definitions changed.

Verified

• go build and govulncheck ./... now load both modules (no called vulns; the only findings are uncalled stdlib advisories for the local toolchain).
• With a scratch root whose sdk-go is a worktree at origin/main, the sdk-go checks in both verify-dev-injection/run.sh and verify-sdk-boot/run.sh print OK sdk-go against the local checkout.
• With the real sibling on an old pre-v2 branch, run.sh now prints FAIL sdk-go: resolved sdk-go/v2 from …/pkg/mod/…@v2.1.0, not …/sdk-go instead of silently testing the published release.

🤖 Generated with Claude Code

[github-actions]

SSDLC sanity check: PASS

No issues found.

_{Model: claude-sonnet-5-5 (effort medium), commit 641f952, prompt default. Only BLOCK fails this check. To override a BLOCK after reading it, a human adds ssdlc-approved (sanity check only, this commit only) or, in an emergency, hotfix (all checks, needs a justification and follow-up bead).}