There is also a larger problem here. Your thinking revolves around isolated, single responsitories. But the open source world has repositories referring to one another.
Example: https://github.com/simplex-chat/simplex-chat/blob/stable/cabal.project #L34
The whole chain of repositories must be decentralized and highly available. This is the problem I have to solve.
This is a good point. There is often a lock file referring to a particular state of each dependancy. However centralised package managers are almost always trusted by project maintainers to provide the authoritative latest state. There are usually only a small number of authoratitive package providers for each tech stack with have strategic lock due to network effect and language specific features.
Is this what you mean?
Relying on the centralized package manager's idea of what the authoritative state is is a serious bottleneck.
This is why lock files are being used for each project to define its own state.
This is @simplex lock file: https://github.com/simplex-chat/simplex-chat/blob/stable/flake.lock
Each time it says "github" that's a centralized bottleneck that must go away.
