The project file expresses intent, and may be loose: tracked branches, ‘latest’ tags. When ‘ergo’ resolves it, it writes the lock file, ‘<name>.erglock’, next to the project file: the complete dependency graph, with the exact commit of each dependency, direct or transitive.
Commit the lock file with your project. All the build, test, run, and load operations obey it exactly: everyone rebuilding the project gets the very same sources. The lock file changes only when you run ‘ergo update’ — review the diff, and commit it.