docs: shorten the Lithos git dependency convention comments

Reduce the workspace Cargo.toml convention block to three lines: Lithos
libraries track `main`, Cargo.lock picks the commits (move one with
`cargo update -p <crate>`), and unmerged library work is tried with an
uncommitted `[patch]`. Drop the instruction to hand-review lockfile diffs
and trim the restatements in the pebble and petri comments, the
fabro-petri README and module doc, AGENTS.md, and the docker test doc.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -117,7 +117,7 @@ Fabro is an AI-powered workflow orchestration platform. Workflows are defined as
 - **fabro-workflow** — Fabro's platform half of a run: creates a run around Petri's admission (the run's display graph is read off the admitted graph), archives, forks and retries runs, and holds the run tools and the pull request pipeline. Compilation and execution are Petri's, through `fabro-petri`
 - **fabro-dot** — The workflow graph as written, read through Petri's DOT parser: its name, goal, node and edge counts, and the files it references (`import`, `stack.child_workflow`, `@file` prompts, the goal). The bundler and the workflow-version store walk references through it; `fabro-graphviz` re-emits Fabro DOT for Graphviz through it
 - **fabro-graphviz** — SVG rendering of workflow graphs through the vendored Graphviz (`graphviz-sys`)
-- **fabro-petri** — Fabro's adapters over Petri, the workflow engine: the one crate that imports the Petri packages (workspace dependencies tracking Petri `main`, with the commit chosen in `Cargo.lock`), holding the run store over SQLite and the platform adapters
+- **fabro-petri** — Fabro's adapters over Petri, the workflow engine: the one crate that imports the Petri packages (tracking Petri `main`; see the workspace `Cargo.toml`), holding the run store over SQLite and the platform adapters
 - **fabro-server** — Axum HTTP server. Routes for runs, sessions, models, completions, usage. SSE event streaming. Demo mode via header
 - **fabro-llm** — Unified LLM client with providers: Anthropic, OpenAI, Gemini, OpenAI-compatible, plus retry/middleware/streaming
 - **fabro-api** — Auto-generated Rust types and reqwest HTTP client from OpenAPI spec (build.rs + progenitor)
@@ -228,7 +228,7 @@ Fabro is an AI-powered workflow orchestration platform. Workflows are defined as
 - **fabro-workflow** — Fabro's platform half of a run: creates a run around Petri's admission (the run's display graph is read off the admitted graph), archives, forks and retries runs, and holds the run tools and the pull request pipeline. Compilation and execution are Petri's, through `fabro-petri`
 - **fabro-dot** — The workflow graph as written, read through Petri's DOT parser: its name, goal, node and edge counts, and the files it references (`import`, `stack.child_workflow`, `@file` prompts, the goal). The bundler and the workflow-version store walk references through it; `fabro-graphviz` re-emits Fabro DOT for Graphviz through it
 - **fabro-graphviz** — SVG rendering of workflow graphs through the vendored Graphviz (`graphviz-sys`)
-- **fabro-petri** — Fabro's adapters over Petri, the workflow engine: the one crate that imports the Petri packages (workspace dependencies tracking Petri `main`, with the commit chosen in `Cargo.lock`), holding the run store over SQLite and the platform adapters
+- **fabro-petri** — Fabro's adapters over Petri, the workflow engine: the one crate that imports the Petri packages (tracking Petri `main`; see the workspace `Cargo.toml`), holding the run store over SQLite and the platform adapters
 - **fabro-server** — Axum HTTP server. Routes for runs, sessions, models, completions, usage. SSE event streaming. Demo mode via header
 - **fabro-llm** — Unified LLM client with providers: Anthropic, OpenAI, Gemini, OpenAI-compatible, plus retry/middleware/streaming
 - **fabro-api** — Auto-generated Rust types and reqwest HTTP client from OpenAPI spec (build.rs + progenitor)

Cargo.toml

@@ -73,15 +73,10 @@ sha2 = "0.10"
 hex = "0.4"
 insta = "1"
 fabro-test = { path = "lib/foundation/fabro-test" }
-# Lithos git dependencies (lithos-llm, twins, sandbox-driver, pebble, petri)
-# all track `branch = "main"`, here and in every Lithos library that depends
-# on them, so the workspace resolves one source per repository and links one
-# copy of each shared crate. Fabro's `Cargo.lock` is the single place their
-# commits are chosen: move one with `cargo update -p <crate>` (for example
-# `cargo update -p sandbox-driver`), never a bare `cargo update`, and review
-# `git diff Cargo.lock` for unrelated moves. Don't point Fabro at an unmerged
-# library PR; to try unmerged work, add an uncommitted `[patch]` locally.
-#
+# Lithos libraries track `main`; this lockfile picks the commits — move one
+# with `cargo update -p <crate>`. Try unmerged library work with an
+# uncommitted `[patch]`, not a PR-head pin.
+
 # Provider-neutral LLM catalog and client, from git until 0.x is published to
 # crates.io.
 lithos-llm = { git = "https://github.com/lithoscomputer/lithos-llm", branch = "main", default-features = false }
@@ -107,16 +102,13 @@ sandbox-driver-testing = { git = "https://github.com/lithoscomputer/sandbox-driv
 # pebble: the coding agent loop fabro runs its agent stages, Ask Fabro
 # sessions, hook evaluators, and `fabro exec` on. The `Environment` over a
 # sandbox-driver handle is pebble's `sandbox_driver` module (the
-# `sandbox-driver` feature); pebble tracks sandbox-driver and lithos-llm
-# `main` as this file does, so the workspace links one copy of each.
+# `sandbox-driver` feature).
 pebble-agent = { git = "https://github.com/lithoscomputer/pebble", branch = "main" }
 pebble-coding-agent = { git = "https://github.com/lithoscomputer/pebble", branch = "main", features = ["mcp", "search-providers", "sandbox-driver"] }
 pebble-cli-core = { git = "https://github.com/lithoscomputer/pebble", branch = "main" }
-# petri: the workflow engine Fabro runs its workflows on. Petri tracks
-# pebble, lithos-llm and sandbox-driver `main` as this file does, so the
-# workspace links one copy of each. Only `fabro-petri` and `fabro-dot` (the
-# DOT parser alone) may depend on these packages; the keys carry the `petri_`
-# prefix so the crate names say where they come from.
+# petri: the workflow engine Fabro runs its workflows on. Only `fabro-petri`
+# and `fabro-dot` (the DOT parser alone) may depend on these packages; the
+# keys carry the `petri_` prefix so the crate names say where they come from.
 petri_runtime = { git = "https://github.com/lithoscomputer/petri.git", branch = "main", package = "petri-runtime" }
 petri_execution = { git = "https://github.com/lithoscomputer/petri.git", branch = "main", package = "petri-execution" }
 petri_store = { git = "https://github.com/lithoscomputer/petri.git", branch = "main", package = "petri-store" }

lib/apps/fabro-cli/tests/it/workflow/docker.rs

@@ -3,10 +3,9 @@
 //!
 //! Petri serves every provider through a sandbox-driver plugin executable it
 //! finds on `PATH` (`sandbox-driver-docker` here); CI installs the
-//! executables at the commit `Cargo.lock` resolves `sandbox-driver` to, and a
-//! developer installs them with
-//! `cargo install --locked --git https://github.com/lithoscomputer/sandbox-driver --rev <rev> sandbox-driver-host sandbox-driver-docker`,
-//! with `<rev>` read from that `Cargo.lock` entry.
+//! executables at the `sandbox-driver` commit in `Cargo.lock`, and a developer
+//! installs them with
+//! `cargo install --locked --git https://github.com/lithoscomputer/sandbox-driver --rev <rev> sandbox-driver-host sandbox-driver-docker`.
 //! A scenario configured here runs against its own server so the environment
 //! it creates never leaks into the shared session server.
 

lib/components/fabro-petri/README.md

@@ -5,11 +5,9 @@ Fabro's adapters over Petri, the workflow engine Fabro runs its workflows on.
 ## Layering rule
 
 Only this crate imports Petri. The workspace `Cargo.toml` lists the Petri
-packages under `petri_*` keys, tracking Petri's `main` branch, and
+packages under `petri_*` keys (see its comment for how they are tracked), and
 `fabro-petri` is the only member that lists them as dependencies. Every other
-Fabro crate reaches the engine through what this crate exports. The workspace
-`Cargo.lock` chooses the Petri commit, so moving it (`cargo update -p
-petri-runtime`) is a change to this crate and the lockfile, nothing else.
+Fabro crate reaches the engine through what this crate exports.
 
 ## What it holds
 

lib/components/fabro-petri/src/lib.rs

@@ -58,8 +58,8 @@
 //! - [`prune`]: a run's sandboxes deleted through Petri's lease ledger, as
 //!   `petri sandbox prune` deletes them, when Fabro deletes the run.
 //!
-//! The Petri packages are workspace dependencies under `petri_*` keys that
-//! track Petri's `main` branch; the workspace `Cargo.lock` chooses the commit.
+//! The Petri packages are workspace dependencies under `petri_*` keys; see the
+//! workspace `Cargo.toml` for how they are tracked.
 
 pub mod admission;
 pub mod blobs;