It seems like we will ultimately need to specify not just the dependent module in DEPENDENCIES, but also the version of the dependent module that is required, and then actually figure out a way to resolve these dependencies to make sure deployed modules (and test deploys) are pointing to the correct endpoints, and that these endpoints will all be compatible once we push new versions to production.  I know Gavin has been thinking lately about how to approach these issues too, so we may want to bring him into these discussions as well.