Is there a procedure in place at Xoxoday which mandates when and how software packages can be changed or modified?

All the software package changes are controlled through the manifest files that are committed into the source code repositories.

Did this answer your question?
...