Resolve standalone build identity from working-tree declarations

docs/roadmap/module-releases.md

@@ -1,7 +1,6 @@
 # Roadmap: release individual Go modules
 
-Status: planned feature; scope and ownership decisions resolved. The declaration
+Status: planned feature; scope and ownership decisions resolved.
-source for standalone builds remains an [open decision](#open-decisions).
 
 ## Purpose
 
@@ -84,7 +83,8 @@ and complete tag are available throughout candidate handling and public evidence
 request and profile, with root defaults. Resolve it against the captured
 repository and source appropriate to the operation once at the operation entry
 point. Check, publication, and delivery use committed module declarations.
-Standalone-build declaration sourcing follows the open decision below.
+Standalone builds use the selected module's working-tree `go.mod`, following
+the [declaration-source decision](#declaration-source-by-operation).
 Pass the resolved identity through the operation's validation, publication,
 build, and delivery collaborators. Standalone operations use the same resolution
 logic. Derive tags using Go's standard module conventions, including
@@ -260,7 +260,9 @@ identity derivation, scope selection, and path conversion focused tests at
 their owners. Use representative assembled workflows and reuse existing
 failure coverage where the underlying behavior remains shared. Verify
 preserved empty lists, contextual findings for equal blobs at different paths,
-failure identity, and artifact-verification ownership.
+failure identity, and artifact-verification ownership. Cover standalone builds
+with modified declarations or new module directories, composite builds using
+committed identity, and source verification required for delivery.
 
 Update GoDoc, CLI/configuration references, check/publication/build/delivery guides,
 adoption examples, CI templates, and recovery guidance together. Supply migration
@@ -296,8 +298,21 @@ detached checkouts. Ordinary builds retain their support for modified source
 and operate independently of release-note and publication prerequisites.
 
 Composite operations pass resolved identity to their internal collaborators.
-Standalone operations use the same resolver at entry. Declaration sourcing for
+Standalone operations use the same resolver at entry, with declaration source
-ordinary builds is the open decision at the end of this document.
+selected by the operation as described below.
+
+### Declaration source by operation
+
+Candidate checks, publication, and tagged delivery resolve identity from
+committed module declarations. Standalone builds read the selected module's
+working-tree `go.mod`, so their identity corresponds to the declaration Go
+uses for compilation. This supports local development of changed module paths
+and new module directories before commit.
+
+The operation selects the declaration source and uses shared identity derivation
+logic. Composite candidate and delivery builds receive their already resolved
+committed identity. Existing source-verification observations remain in place;
+delivery requires a build verified against its committed tagged source.
 
 ### One validation input set and full repository lookup
 
@@ -459,31 +474,3 @@ outside the implementation scope.
 Migration means guidance supplied in the next release's documentation. That
 guidance explains the required consumer changes and the root-module validation
 scope change; implementation completion covers the new interface directly.
-
-
-## Open Decisions
-
-### Declaration source for standalone builds
-
-Candidate checks, publication, and tagged delivery resolve identity from
-committed source. Ordinary builds currently permit modified source, including
-module-file edits. Select how their identity resolver reads the module
-declaration.
-
-**Recommendation:** Read the selected module's working-tree `go.mod` for
-standalone builds. Keep candidate and delivery operations tied to committed
-declarations. This makes a local build's identity correspond to the files Go
-actually compiles and supports development of a changed module path or a new
-module directory before commit. The resolver's source is selected by the
-operation, with shared derivation logic and existing source-verification
-observations. Delivery continues to require a build verified against its
-committed tagged source.
-
-**Viable alternative:** Resolve standalone-build identity from the committed
-`go.mod`, while allowing ordinary source-file edits during compilation. This
-provides uniform committed identity across operations and simplifies declaration
-access. It supports builds of modified code when the module declaration is
-unchanged. Its cost is that module-path changes and newly created module
-directories need a commit before identity can reflect them, and local identity
-can differ from the declaration used by Go. Document that limitation explicitly
-if this alternative is selected.