dashcaddy-api/VERSION is the deploy-time build stamp written by start.sh
(the deployed commit SHA), NOT a semver source of truth. Batch 7's r1
edit set it to 1.17.0, which broke SelfUpdater.getLocalVersion() commit
resolution (2 test failures: commit must end with a git SHA). Reverted
to the pre-existing stamp 70e252c; version alignment claims corrected to
package.json + openapi.yaml + README badge (all 1.17.0 — that half of
the drift finding stands). VERIFY-OUTPUT.txt updated with the accurate
transcript; audit finding 36 correction recorded in AUDIT-2026-10-27.md.
Self-updater suites 13/13.
Customer-facing professionalism tier (AUDIT-2026-10-27.md findings 34-39):
- CHANGELOG.md rebuilt to Keep-a-Changelog: ONE Unreleased section, the
2026-08-12 hardening sprint folded into 1.17.0 (no v1.16.0 tag exists,
verified via git tag -l), ALL 7 judge-grade/URN lines moved out of
customer copy into RELEASE-EVIDENCE-internal.md, missing DC-166/169
entries added, full DC-170 sweep entry written, DC-171 DNS-parity
ticket recorded, date order strictly descending across all 22
sections (1.1.5 restored with its true content after the re-sort ate
the heading), compare-link chain filled (Unreleased from v1.17.0,
1.17.0 from v1.14.6-patched, 18 missing version links added)
- VERSION 1.15.0 -> 1.17.0 + openapi.yaml 1.15.0 -> 1.17.0 (three-way
drift closed: VERSION=package.json=openapi; start.sh build stamps
single-sourced)
- README: quickstart endpoints rewritten against the live router (the
fictional /api/caddy/{config,reload} section replaced with the real
/api/v1/caddy/* routes from routes/sites.js), 50+ -> 78 templates
(proven in VERIFY-OUTPUT.txt via require of src/docker/app-templates),
version badge 1.17.0, yourusername links -> sami7777, roadmap
reconciled with shipped features (multi-user DC-048, DNS UI DC-166,
backup automation marked shipped), verification note scoped to the
MCP drift gate's actual coverage
- API-SURFACE.md regenerated: 443 handler rows / 368 unique paths / 441
unique operations / 88 public rows, Known Limitations section (static
extraction, line-oriented, may omit multiline/computed/chained
registrations), exact duplicate registrations with file:line
- VERIFY-OUTPUT.txt: verbatim command/output transcript proving all
version + count claims (sha256 of the generated doc recorded and
matching)
- state-manager test mock extended for the atomic tmp+rename contract
Judge rounds: r1 D -> r2 D -> r3 D -> r4 D -> r5 C -> r6 C -> r7 C ->
r8 C -> r9 C -> r10 A (each round fixed blockers in-lane; no bypasses).
r10 independently reproduced all counts and the generated doc hash
against the live repository.
Hermes