The dependency risk is where AI assistance becomes an infrastructure problem. A safe workflow should record the generated diff, resolved package versions, and the checks that ran before merge, not just rely on a human glance. How are you making those receipts durable across upgrades?