[antoinetoussaint-byte]

The five host services still require Core v0.19.3, whose pruned dependency graph can select kube-openapi incompatible with stable client-go. The root agent, tools and module-authority qualification also retain Core v0.18.0. This moves those eight direct requirements to released Core v0.19.4 and its required module selections. No production Go, generated contract, authority decision, transport, service-agent pin or package version changes.

This is an owner dependency fix: it reuses Core’s existing graph correction and issuer Authority.ReadBack. It adds no replacement, vendor patch, copied verifier or alternate endpoint/identity mechanism. Root AGENTS.md and module/AGENTS.md now describe the actual independent modules, both graph guard conditions and the already-selected SDK v0.4.0.

Of nine tracked Go modules, eight select Core v0.19.4. The unchanged source-read SDK selects v0.2.33 transitively through its existing SDK but compiles no Core package in its build/test graph. This is deliberately not an all-module or completed-release claim.

Validation on the frozen 18-file patch (SHA256 b650a391925e94647c5ab63623aac4fdf6fe8486e11f55f208698d2d6863c7e1):

• All nine module graphs and selected inventories, build, vet, module verification and tidy-diff passed. Both Core guard conditions passed; a temporary host-root consumer compiled client-go/kubernetes and apimachinery/managedfields v0.37.1 with readonly modules.
• Native module suites passed; accounts uses its documented pure tag. Naming and boundary gates passed. Initial root/accounts tests hit exhausted disk; the complete accounts repeat passed. A root retry overlapped a documentation edit, and the first tracked-source test needed Git metadata for its existing check-ignore test. Exact tracked-source root build/vet/tests then passed with local Git metadata. All failed attempts remain in local evidence.
• Fresh independent review checked all 18 file hashes, all nine graphs, representative client-go compilation, accounts issuer read-back tests and the root suite. No introduced blocker was found for local compatibility. Report: REVIEW-FINDING-3-host.md in the coordinator’s local artifacts; it is not a published evidence URL.

Every local verifier used Go 1.27.2, OS-enforced nonlocal network denial, denied Docker/Nix broker sockets, offline package settings and readonly verification. Dependency acquisition was separate. This does not establish DB-backed accounts acceptance, full Codefly release gates, Linux service images, a new vulnerability audit, live Kubernetes behavior, deployment or published-artifact adoption.

Overlap inspected before draft creation: #1124 requires a newer Core API for accounts; #1120 requires a newer Core API in accounts/gateway. Their owners were notified; integration must preserve those API requirements and recheck the resulting graph, never downgrade them to this floor. Older #1076 also changes dependency files from its historical base; #1027 removes telemetry and touches the guide. None is folded into this snapshot. #1123’s independently reviewed refusal-audit repair is disjoint and not included here. If main changes, re-evaluate the integrated scope before delivery.

Refs #1082. Draft only; no merge, tag, release or deployment requested by this publication.

[antoinetoussaint-byte]

Obsolete — main's host modules already moved past core v0.19.4 (core v0.19.6+ / sdk-go 0.4.x).