Binary Prerequisites & Offline Layout

For developers and release engineers who add, pin, or refresh binary dependencies in the Stella Ops monorepo, and for anyone preparing an offline / air-gapped build. It defines where binaries may live, how that is checked, and how to keep restores deterministic and offline-friendly.

Layout (authoritative)

• ~/.nuget/packages/ — default system-wide NuGet package cache (the global packages folder; dotnet nuget locals global-packages --list prints it). Override it explicitly with NUGET_PACKAGES when preparing a bounded offline cache. No build, pack or tooling path uses a repo-local cache; /.nuget/ stays git-ignored so a stray one is never committed.
• devops/offline/ — air-gap inputs, including the stellaops-contracts NuGet folder feed (devops/offline/nuget/contract-packages/).
• Committed binaries live only under the reviewed roots listed in .gitea/scripts/validate/verify-binaries.sh (for example devops/plugins/, devops/offline/, test fixtures and benchmark corpora under src/, and doc samples). Each root carries its reason in the script.

Adding or updating NuGet packages

1. Run dotnet restore, which populates the active global packages folder (normally ~/.nuget/packages/) from the sources in NuGet.config.
2. Never add new feeds to NuGet.config without review; the configured sources are nuget.org, stellaops (internal feed) and stellaops-contracts (the committed contract-package folder feed).
3. For offline builds, pre-populate a bounded package cache from a network-connected machine and point NUGET_PACKAGES at that cache in the air-gapped environment.

Adding other binaries

1. Prefer building from source. A binary that must be committed goes under one of the reviewed roots; adding a root is a reviewed change to verify-binaries.sh that names what lives there and why it is committed.
2. A third-party binary passes the dependency and license gate first (docs/legal/LICENSE-COMPATIBILITY.md, docs/legal/THIRD-PARTY-DEPENDENCIES.md, NOTICE.md).

Automation & Integrity

• Run bash .gitea/scripts/validate/verify-binaries.sh locally; --self-test proves the detector still detects. CI runs both in .gitea/workflows/repo-hygiene-verify.yml on every pull request and every push to main.
• NuGet restore uses the system-wide cache unless NUGET_PACKAGES is set.

Housekeeping

• Record binary additions and removals in the current sprint’s Execution Log.