Shared runtime dependencies

NMRNet consumes provider-core from the shared owner's GitHub releases. The installation lock pins its wheel and complete runtime dependency closure. The release record identifies source revision, consumed dependency bytes and artifact hashes.

The shared owner maintains dependency selection, advisory review and package builds. NMRNet acquires the private wheel directly from the pinned GitHub URLs. Only third-party requirements go through PyPI. The wheelhouse is one operator-selected flat cache, shared with the scientific images.

make packages/provider-core/wheelhouse WHEELHOUSE=/path/to/shared-wheelhouse NETWORK_INTERFACE=YOUR_SETUP_INTERFACE SHARED_RUNTIME_IMAGE=sha256:YOUR_SHARED_IMAGE
make packages/provider-core/wheelhouse/check WHEELHOUSE=/path/to/shared-wheelhouse

The installed consumer tests also use the released source archive. Acquire it when needed with make packages/provider-core/test-support WHEELHOUSE=/path/to/shared-wheelhouse NETWORK_INTERFACE=YOUR_SETUP_INTERFACE SHARED_RUNTIME_IMAGE=sha256:YOUR_SHARED_IMAGE.

Build or load the shared runtime image through nmr-provider-tools before acquisition. Setup traffic uses the selected interface; deployment routes are separate explicit inputs.

Controller, geometry and inference images install the released closure offline, without rebuilding core or resolving replacement scientific dependencies. An existing scientific package with a different version blocks that installation. The image records the lock and actual consumed wheel hashes. See installed consumer checks and the inference dependency record.