Use the same workspace and released CLI from configuration through verification. Generated files are evidence-bearing outputs; the StackSpec remains the editable input.
1. Validate and generate
Generation writes the resolved plan, generation manifest, receipt, and governed artifacts below the configured output root.
2. Inspect the plan
Before applying, confirm:
- the plan and spec hashes are present
readiness.generation.status is readyreadiness.apply.status is ready- the selected workloads, sites, nodes, and adapter match your intent
- every generated artifact has an owner and expected path
plan inspects the native v2 closure without invoking an executor. A ready plan is necessary, but it is not proof that a host has already changed.
3. Apply explicitly
Review the local approval prompt. apply is the step that changes the host; neither the website nor the one-line installers perform it.
4. Verify the result
Keep the JSON output with the workspace. It binds the observed result to the local lifecycle rather than to a screenshot or an edited Compose file.
Stop when the resolved plan reports an apply blocker. Do not bypass it with direct Docker, Compose, or generated-file edits; correct the StackSpec or the target host and generate again.
