ditc edit-pass: verified → ditc@3.5.0 (stable-promotion unblock) #22

Merged
jsutter merged 6 commits from lockstep-repair-ditc-3.5.0 into main 2026-10-04 04:32:05 +00:00
Owner

The ditc manual edit-pass for the ditc 3.5.0 stable promotion. Every covering page is re-checked and its verified: advanced to ditc@3.5.0. Five pages had real drift, and those are fixed. The glossary registry definitions are synced to canon 6.0.0. Do not merge until the realm agent (deepnet) has reviewed this.

What the re-check measured each page against

  1. captures/ditc/**. Every capture body was diffed against the live release binary's --help (ditc 3.5.0-rc.1, /tmp/opencode/e2e/ditc-x86_64-unknown-linux-musl) on all 39 surfaces. There were 0 differences.
  2. The v3.3.0..v3.5.0-rc.1 delta in dit-client. Behavior changes are in fff3c56 (bare-domain sign-in), 8c64450 (dit.requires / dit.gated_paths capability negotiation, plus commented scaffold examples) and 7ddcc81 (feedback session-token selection). The rest are release, CI and canon re-vendor commits with no src/ change. The two pages still at 3.2.0 were also checked against v3.2.0..v3.3.0.
  3. dit-client source at v3.5.0-rc.1, for every printed string and behavior the pages quote: No session for tenant …, No session to clear., declaration refreshed, Active tenant: <slug>, the three-step first-run tour, the harness set (Claude Code / Codex / opencode), resolvable:, the --lines default of 100, the --ttl default of 24 and max of 168, the --purge / --force semantics, and the specify/clarify limits of 3 and 5.
  4. A script cross-checked every ditc … command and --flag on all pages against the captures. It found 0 unknown groups, subcommands or flags, and every Usage: line matches.

Per-page verdicts

page verified verdict
105-from-idea-to-running-app 3.3.0 → 3.5.0 clean re-check
110-what-hosting-does 3.2.0 → 3.5.0 clean re-check (conceptual; no delta touches it)
210-install-onboard 3.3.0 → 3.5.0 clean re-check
215-session-signin 3.3.0 → 3.5.0 drift fixed: 3.4.0 accepts the bare tenant domain. ditc tries the typed address, then the forge. form. One sentence added; the help example still prints forge.<tenant>.<zone>, so the existing guidance stands
220-pick-tenant 3.3.0 → 3.5.0 drift fixed: "re-onboard from a fresh bundle" named the retired onboarding bundle. It now reads: sign in again (session-signin)
230-assistant-learns 3.3.0 → 3.5.0 clean re-check
320-scaffold 3.3.0 → 3.5.0 clean re-check
330-first-deploy 3.3.0 → 3.5.0 clean re-check (a scaffolded app declares no requirements, so the first deploy never negotiates)
410-channels 3.3.0 → 3.5.0 clean re-check
420-promote-rollback 3.3.0 → 3.5.0 clean re-check
430-checks-approval 3.3.0 → 3.5.0 drift fixed: added the deploy refusal 3.4.0 introduced. A manifest that names a platform feature the tenant's platform lacks is refused before anything moves, and the fix is the operator's
510-previews 3.3.0 → 3.5.0 clean re-check
610-secrets 3.3.0 → 3.5.0 clean re-check (the key: url caution is still true at 3.5.0)
710-adopt 3.3.0 → 3.5.0 clean re-check
810-troubleshooting 3.3.0 → 3.5.0 clean re-check
820-reporting 3.3.0 → 3.5.0 clean re-check (the 3.4.1 token fix is internal; flags, exit codes and the envelope are unchanged)
830-retire 3.3.0 → 3.5.0 clean re-check
910-asking 3.2.0 → 3.5.0 drift fixed: "every command that changes something carries a dry run" was false. session login/logout, tenant use and feedback have none. Now scoped to commands that change an app or its secrets
920-structured-path 3.3.0 → 3.5.0 clean re-check
930-assistant-connection 3.3.0 → 3.5.0 clean re-check
310-app-parts (no verified:) — drift fixed: "the rest of the file stays blank" — 3.4.0 scaffolds commented example lines; now "the other lines need nothing from you for now"
glossary.yaml — stable / testing registry_definition synced verbatim to canon 6.0.0 (LIFECYCLE-016). This was the pre-existing check-prose REGISTRY failure

Commits: af206c7 glossary · be51f6e drift fixes · 778db4a verified advance.

Gate outputs (worktree, after the commits)

$ python3 tools/check-prose.py --manual ditc
prose: clean
$ python3 tools/check-coverage.py
coverage: OK — ditc 8, dito 12, scribe 7 groups covered, 71 covers entries verified
$ python3 tools/check-lockstep.py --manual ditc --synthesize
src/ditc/000-about.md:1 CONCEPT SKIP no requires: — FIRST-USE covers this page
src/ditc/120-your-tenant.md:98 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1
src/ditc/215-session-signin.md:94 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1
src/ditc/330-first-deploy.md:161 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1
src/ditc/820-reporting.md:136 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1
lockstep: ditc — 23 pages, glossary 51 terms, 0 fail, 0 warn, 5 skip, gate enforce
$ python3 tools/check-lockstep.py --manual ditc --synthesize --channel stable --emit-docs-manifest /tmp/…/ditc-docs-manifest.json
$ python3 tools/check-promotion-gate.py --tool ditc --version 3.5.0 --from-binary <ditc 3.5.0-rc.1> --docs-manifest /tmp/…/ditc-docs-manifest.json --site-yaml src/site.yaml --channel stable
promotion-gate: OK ditc@3.5.0 — 10 group(s), all covered at verified >= 3.5.0 (gate enforce, manual ditc)

Before this branch: check-prose had 2 REGISTRY findings, and lockstep showed 16 FRESHNESS warnings, which become failures under the promotion gate.

Gaps and items for the reviewer

  • Verified against the rc build. The pages say ditc@3.5.0, but the binary checked is 3.5.0-rc.1. Canon 6.0.0 has stable name its rc, so the stable bytes should be identical. If stable is re-cut from a later rc, re-diff the captures first.
  • No live side-effect probing. Per the contract, only --help / --version were run. Printed strings come from source at the tag, not from running the commands. The five MESSAGE SKIPs remain because there is no message catalog for ditc 3.5.0-rc.1.
  • Runner and platform behavior (auto-restore after a bad switch, the address probe on destroy) belongs to the platform, not the ditc binary. It is unchanged in this delta and carried forward from the 3.3.0 verification.
  • The canon stable definition reads "it moves only on the operator's word". In the ditc manual, "operator" means the DeepNet operator, but an app's stable channel moves when the user deploys a release tag. The glossary shows the registry definition next to the plain gloss, which carries the correct meaning. The REGISTRY gate forces the verbatim copy, so this is a canon-vs-app-channel wording question for the canon owner, not a page fix.
  • The dito and dev glossaries have the same two REGISTRY findings. They are out of this lane and left untouched.
  • foremerge: the ditdocs store exists. Intent int_621bfef0a99440c4913c3351ad990b21 was published after the edits, so it was not declared before editing. It found 0 conflicts. The in-flight intent int_2fdbb835… (deepnet-26-channel) adds src/ditc/250-release-channel.md. That file does not overlap with this branch, and its surface is not in the 3.5.0 binary.

Assisted-by: author:anthropic/claude-opus-5-5

The ditc manual edit-pass for the ditc 3.5.0 stable promotion. Every covering page is re-checked and its `verified:` advanced to `ditc@3.5.0`. Five pages had real drift, and those are fixed. The glossary registry definitions are synced to canon 6.0.0. Do not merge until the realm agent (deepnet) has reviewed this. ## What the re-check measured each page against 1. `captures/ditc/**`. Every capture body was diffed against the live release binary's `--help` (`ditc 3.5.0-rc.1`, `/tmp/opencode/e2e/ditc-x86_64-unknown-linux-musl`) on all 39 surfaces. There were **0 differences**. 2. The `v3.3.0..v3.5.0-rc.1` delta in dit-client. Behavior changes are in `fff3c56` (bare-domain sign-in), `8c64450` (`dit.requires` / `dit.gated_paths` capability negotiation, plus commented scaffold examples) and `7ddcc81` (feedback session-token selection). The rest are release, CI and canon re-vendor commits with no `src/` change. The two pages still at 3.2.0 were also checked against `v3.2.0..v3.3.0`. 3. dit-client source at `v3.5.0-rc.1`, for every printed string and behavior the pages quote: `No session for tenant …`, `No session to clear.`, `declaration refreshed`, `Active tenant: <slug>`, the three-step first-run tour, the harness set (Claude Code / Codex / opencode), `resolvable:`, the `--lines` default of 100, the `--ttl` default of 24 and max of 168, the `--purge` / `--force` semantics, and the specify/clarify limits of 3 and 5. 4. A script cross-checked every `ditc …` command and `--flag` on all pages against the captures. It found 0 unknown groups, subcommands or flags, and every `Usage:` line matches. ## Per-page verdicts | page | verified | verdict | |---|---|---| | 105-from-idea-to-running-app | 3.3.0 → 3.5.0 | clean re-check | | 110-what-hosting-does | 3.2.0 → 3.5.0 | clean re-check (conceptual; no delta touches it) | | 210-install-onboard | 3.3.0 → 3.5.0 | clean re-check | | 215-session-signin | 3.3.0 → 3.5.0 | **drift fixed**: 3.4.0 accepts the bare tenant domain. ditc tries the typed address, then the `forge.` form. One sentence added; the help example still prints `forge.<tenant>.<zone>`, so the existing guidance stands | | 220-pick-tenant | 3.3.0 → 3.5.0 | **drift fixed**: "re-onboard from a fresh bundle" named the retired onboarding bundle. It now reads: sign in again (session-signin) | | 230-assistant-learns | 3.3.0 → 3.5.0 | clean re-check | | 320-scaffold | 3.3.0 → 3.5.0 | clean re-check | | 330-first-deploy | 3.3.0 → 3.5.0 | clean re-check (a scaffolded app declares no requirements, so the first deploy never negotiates) | | 410-channels | 3.3.0 → 3.5.0 | clean re-check | | 420-promote-rollback | 3.3.0 → 3.5.0 | clean re-check | | 430-checks-approval | 3.3.0 → 3.5.0 | **drift fixed**: added the deploy refusal 3.4.0 introduced. A manifest that names a platform feature the tenant's platform lacks is refused before anything moves, and the fix is the operator's | | 510-previews | 3.3.0 → 3.5.0 | clean re-check | | 610-secrets | 3.3.0 → 3.5.0 | clean re-check (the `key: url` caution is still true at 3.5.0) | | 710-adopt | 3.3.0 → 3.5.0 | clean re-check | | 810-troubleshooting | 3.3.0 → 3.5.0 | clean re-check | | 820-reporting | 3.3.0 → 3.5.0 | clean re-check (the 3.4.1 token fix is internal; flags, exit codes and the envelope are unchanged) | | 830-retire | 3.3.0 → 3.5.0 | clean re-check | | 910-asking | 3.2.0 → 3.5.0 | **drift fixed**: "every command that changes something carries a dry run" was false. `session login/logout`, `tenant use` and `feedback` have none. Now scoped to commands that change an app or its secrets | | 920-structured-path | 3.3.0 → 3.5.0 | clean re-check | | 930-assistant-connection | 3.3.0 → 3.5.0 | clean re-check | | 310-app-parts (no `verified:`) | — | **drift fixed**: "the rest of the file stays blank" — 3.4.0 scaffolds commented example lines; now "the other lines need nothing from you for now" | | glossary.yaml | — | `stable` / `testing` `registry_definition` synced verbatim to canon 6.0.0 (LIFECYCLE-016). This was the pre-existing `check-prose` REGISTRY failure | Commits: `af206c7` glossary · `be51f6e` drift fixes · `778db4a` verified advance. ## Gate outputs (worktree, after the commits) ``` $ python3 tools/check-prose.py --manual ditc prose: clean $ python3 tools/check-coverage.py coverage: OK — ditc 8, dito 12, scribe 7 groups covered, 71 covers entries verified $ python3 tools/check-lockstep.py --manual ditc --synthesize src/ditc/000-about.md:1 CONCEPT SKIP no requires: — FIRST-USE covers this page src/ditc/120-your-tenant.md:98 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1 src/ditc/215-session-signin.md:94 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1 src/ditc/330-first-deploy.md:161 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1 src/ditc/820-reporting.md:136 MESSAGE SKIP message catalog absent for ditc@3.5.0-rc.1 lockstep: ditc — 23 pages, glossary 51 terms, 0 fail, 0 warn, 5 skip, gate enforce $ python3 tools/check-lockstep.py --manual ditc --synthesize --channel stable --emit-docs-manifest /tmp/…/ditc-docs-manifest.json $ python3 tools/check-promotion-gate.py --tool ditc --version 3.5.0 --from-binary <ditc 3.5.0-rc.1> --docs-manifest /tmp/…/ditc-docs-manifest.json --site-yaml src/site.yaml --channel stable promotion-gate: OK ditc@3.5.0 — 10 group(s), all covered at verified >= 3.5.0 (gate enforce, manual ditc) ``` Before this branch: check-prose had 2 REGISTRY findings, and lockstep showed 16 FRESHNESS warnings, which become failures under the promotion gate. ## Gaps and items for the reviewer - **Verified against the rc build.** The pages say `ditc@3.5.0`, but the binary checked is `3.5.0-rc.1`. Canon 6.0.0 has stable name its rc, so the stable bytes should be identical. If stable is re-cut from a later rc, re-diff the captures first. - **No live side-effect probing.** Per the contract, only `--help` / `--version` were run. Printed strings come from source at the tag, not from running the commands. The five MESSAGE SKIPs remain because there is no message catalog for ditc 3.5.0-rc.1. - **Runner and platform behavior** (auto-restore after a bad switch, the address probe on destroy) belongs to the platform, not the ditc binary. It is unchanged in this delta and carried forward from the 3.3.0 verification. - **The canon `stable` definition reads "it moves only on the operator's word".** In the ditc manual, "operator" means the DeepNet operator, but an app's stable channel moves when the user deploys a release tag. The glossary shows the registry definition next to the plain gloss, which carries the correct meaning. The REGISTRY gate forces the verbatim copy, so this is a canon-vs-app-channel wording question for the canon owner, not a page fix. - **The dito and dev glossaries have the same two REGISTRY findings.** They are out of this lane and left untouched. - **foremerge:** the ditdocs store exists. Intent `int_621bfef0a99440c4913c3351ad990b21` was published after the edits, so it was not declared before editing. It found 0 conflicts. The in-flight intent `int_2fdbb835…` (deepnet-26-channel) adds `src/ditc/250-release-channel.md`. That file does not overlap with this branch, and its surface is not in the 3.5.0 binary. Assisted-by: author:anthropic/claude-opus-5-5
Assisted-by: ditc:machine
capture-cli.py run per the tools README ('run after every release ships')
against the released binaries: ditc v3.5.0-rc.1 (the stable-to-be; host
from the publish at forge.deepnet.com/deepnet/dit-releases), dito v6.1.0
(tonight's stable, 0cb03c002170). Every capture body is byte-identical to
the 3.3.0/rc.26-era set — 3.4.x shipped no --help-visible surface change —
only the provenance headers move.

Assisted-by: deepnet:synthetic/hf:zai-org/GLM-5.3
The canon noun table (LIFECYCLE-016, three-tier channel model) extended
both definitions; check-prose REGISTRY requires them verbatim.

Assisted-by: author:anthropic/claude-opus-5-5
- session-signin: the bare tenant domain is accepted at sign-in (3.4.0);
  ditc tries the typed address, then the forge. form
- pick-tenant: the onboarding bundle is retired; recovery is a fresh sign-in
- checks-approval: the deploy refuses when the manifest names a platform
  feature (dit.requires / dit.gated_paths) the tenant's platform lacks (3.4.0)
- app-parts: the scaffolded manifest now carries commented example lines
- asking: the dry-run claim overstated — session, tenant use, and feedback
  carry none; scoped to commands that change an app or its secrets

Assisted-by: author:anthropic/claude-opus-5-5
Re-checked against captures/ditc (byte-identical to the live
ditc 3.5.0-rc.1 --help surface), the v3.3.0..v3.5.0-rc.1 delta
(bare-domain sign-in, capability negotiation, feedback token
selection), and dit-client source at v3.5.0-rc.1.

Assisted-by: author:anthropic/claude-opus-5-5
Author
Owner

Merge conflict note: the only conflicting file is provenance.json. Its branch-side change comes from the pre-existing capture-refresh commit 6cb7f68 (a local ditc deploy rewrote it: builder: jsutter, channel key dropped), not from this edit-pass. Main's 4de1682 (generated: stable publication) also rewrote it. This is a generated file outside the edit-pass lane, so it is left to the publishing step. Taking main's copy, or regenerating it at publish, resolves it. src/ditc/** merges cleanly.

Merge conflict note: the only conflicting file is `provenance.json`. Its branch-side change comes from the pre-existing capture-refresh commit 6cb7f68 (a local ditc deploy rewrote it: `builder: jsutter`, `channel` key dropped), not from this edit-pass. Main's 4de1682 (generated: stable publication) also rewrote it. This is a generated file outside the edit-pass lane, so it is left to the publishing step. Taking main's copy, or regenerating it at publish, resolves it. src/ditc/** merges cleanly.
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
deepnet/ditdocs!22
No description provided.