Source Truth And Verification

Use this page before treating a command, route, package, or workflow as current. The documentation checkout is a guide; the sibling sweet-potato checkout, its generated manifest, package metadata, tests, and a running service are the authorities.

Verified Snapshot

Item	Value	Evidence
Sweet Potato source	`5b09d3df1194577c5313c865fef1db98f694cdea`	`git -C ../sweet-potato rev-parse HEAD`
Manifest update	`2026-09-01`, schema `1.4`	`../sweet-potato/docs/manifest.json`
Manifest endpoint inventory	448 total; 333 documented; 346 tested	Manifest `metadata` block
npm CLI source	`spaps` `0.10.1`; Node.js 22+	`packages/spaps/package.json`
TypeScript SDK source	`spaps-sdk` `1.14.1`; Node.js 14+	`packages/sdk/package.json`
Python client source	`spaps` `0.7.1`; Python 3.9+	`packages/python-client/pyproject.toml`
FastAPI package source	`spaps-server-quickstart` `0.7.1`; Python 3.12+	`packages/python-server-quickstart/pyproject.toml`

Those are source-checkout versions, not a claim about a remote registry or deployed production. An unpinned npm install or pip install can resolve an older published artifact. Confirm the installed version before using a newly documented API.


npx spaps --version
node -p "require('spaps-sdk/package.json').version"
python -c "from importlib.metadata import version; print(version('spaps'))"
python -c "from importlib.metadata import version; print(version('spaps-server-quickstart'))"

What Each Gate Proves

Gate	Strong evidence	Does not prove
`npm run docs-contract:upstream`	Documented endpoint method/path exists in the current manifest; package names exist; every documented CLI command returns valid `--help`; every documented SPAPS environment variable occurs in active package source	Endpoint behavior, deployed production, credentials, or mutating workflow success
`npm run link-check`	Internal page and heading targets resolve	External product facts or runtime behavior
`npm run first-run:dry-run`	Scenario schema, command lines, expected artifacts, and documentation anchors are well formed	Commands were executed or artifacts were created
`npm run first-run:live -- --strict-live`	`executed_passed` applies only to declared health URLs that returned 2xx; command/artifact rows are labeled `declared_valid`	Scaffold, fixture, authentication, billing, or entitlement completion
`node scripts/verify-upstream-first-run.mjs --include-writes --upstream ../sweet-potato`	Current source CLI completes quickstart, verification, tool export, React scaffold, fixture initialization, and fixture application; all writes occur in a disposable temporary directory	Hosted authentication, real billing, or production deployment
`node scripts/verify-first-service-snippet.mjs --upstream ../sweet-potato`	Python fences in the first-service tutorial execute against the sibling package environment and `/health` returns the documented JSON	Published package availability or production configuration
`npx spaps verify --json`	The selected runtime and auth mode pass the CLI’s current checks	Every domain workflow or production readiness
`npx spaps tools --json`	The selected runtime can emit its current agent-facing tool contract	That a caller is authorized to invoke every emitted tool
`npm run build`	Every docs route compiles and the search index can be generated	Browser rendering on every target device

A green docs gate is scoped evidence, not a release receipt. Production claims require the release and deployment evidence described in Deployment validation.

At this verification snapshot, no accepted .release/pages/<sha>/release.json exists in this worktree. Docs-site deployment state is therefore INDETERMINATE; local build and pages:verify results must not be reported as a deployment.

Freshness Procedure

Run this from the docs checkout after the sibling source changes:


git -C ../sweet-potato rev-parse HEAD
npm run docs-contract:upstream
npm run docs-metadata:lint
npm run link-check
npm run first-run:live -- --strict-live
node scripts/verify-upstream-first-run.mjs --include-writes --upstream ../sweet-potato
node scripts/verify-first-service-snippet.mjs --upstream ../sweet-potato
npx spaps verify --json

If the SHA differs from the snapshot above, treat version tables and broad architectural prose as potentially stale until the upstream contract gate and focused source review pass. Never refresh a lastVerified date merely because a link checker passed.

Where To Go Next

Endpoint reference for the compact operational surface and exact OpenAPI command.
Domain catalog for the current manifest-backed ownership map.
SPAPS CLI quickstart for safe first proof and mutating-command boundaries.
Deployment validation for production evidence.

Ownership And Help

The Sweet Potato product repository is owned by @build000r in .github/CODEOWNERS. For usage or implementation problems, follow SUPPORT.md and include reproduction steps plus exact code paths. Report vulnerabilities privately through SECURITY.md; never open a public issue containing exploit details. The docs repository follows the same escalation boundary.