Read the full diff rather than trusting the "docs" framing — this session already had a PR
labelled docs(...) that shipped three breaking behavior guards. This one is genuinely
documentation: 7 files, +150/-13, no executable code.
What it changes:
- integration-preflight becomes a mandatory step 0, with a new non-skippable procedure step
6: one real authenticated request against every external dependency FROM THE RUNTIME
CONTEXT, with the status code pasted into the plan.
- onboard-host, integrate-service and finish-migration each gain an explicit entry gate, so
it is a checklist item rather than a judgment call. onboard-host previously said "run it
first IF any existing drift could interact" — that conditional is exactly how it got
skipped twice.
- Two new failure classes: F12 (external dependency never smoke-tested from the runtime
context) and F13 (preflight treated as a judgment call), written in the catalog's existing
style with real issue refs.
- Output becomes TWO tables (layers + dependencies); either left blank means the preflight
did not run.
- plugin.json 1.0.0 -> 1.0.1, required for the plugin cache to pick the change up.
The worked example is the right one: oleks/armer#171, where the token was byte-identical and
correctly injected, 127.0.0.1 returned 200 and the ZeroTier IP returned 401. Nothing about
the credential was wrong — the source address was. That distinction is the whole lesson.
NOT closing oleks/cluster#271 on this merge: the repo has no CI (verified two ways — find
returns nothing, and Woodpecker GET /repos/lookup 404s), and the remaining acceptance items
need a human. Docs efficacy cannot be proven by a lint gate; the real test is whether the
next rollout actually invokes it.
Refs oleks/cluster#271, oleks/armer#171, oleks/cluster#260
oleks