defining a lock file, for the repository root only, that `go get` can read and transparently use, if it’s available.
So you want to write a package manager
sam boyer
18128

I am eliding a real risk here — we don’t really want a competing ecosystem of tools. But I’m suggesting this because I suspect that if we can converge on a lock file, we’ll converge on a manifest shortly thereafter.