bootstrap must prove the Depone runtime identity; docs must stop teaching removed commands (closes #134 #136)

[moonweave]

Closes #134 and #136, both filed against the installed release set by an operator.

#134 — readiness went green while the verifier's identity disagreed with itself

On the installed set the lock pinned Depone f067a05 (v0.2.10), the checkout sat at that commit, and the shared environment reported depone 0.2.9 through importlib.metadata, pip show, and depone.__version__. Bootstrap verified checkout and lock state and installed witnessd and the wrapper, but never installed or runtime-verified Depone — so an operator could get a green result without knowing which Depone the running Python actually was. That the component in question is the verifier is what makes it serious.

Bootstrap now makes the pinned checkout the runtime package and proves four facts agree: depone.__file__, the installed distribution version, the version the source declares, and the locked commit. Any disagreement fails closed with ERR_ORRO_BOOTSTRAP_DEPONE_RUNTIME_IDENTITY_MISMATCH, naming which fact disagreed and the repair command; --check-existing reports the same runtime identity rather than git state alone.

Because this repository has no unit-test suite and the --self-test flags are the regression mechanism, the bootstrap self-test now covers the identity logic offline: all four facts agreeing, an installed-versus-source version disagreement, a module path outside the locked checkout, and an unrunnable probe. Neutering the comparison makes the self-test fail, which was verified both ways.

#136 — the docs taught commands the wrapper had removed

The wrapper help says sketch/trace, next and report were removed in 2.27.0, while active documentation still used them as live examples — so a fresh operator following the repository got a deprecated-command error. This had also been raised in an internal review and not fixed; a real user hitting it is the reason it is fixed now.

Every active example was migrated to the supported form across the README, architecture, e2e-runner, e2e-smoke-contract and workflow-reference docs, all five files under examples/, and the e2e test README. A new check_orro_removed_command_docs.py fails when a removed command appears outside a migration note or fixture, derives its list from a single source, and runs in CI along with its own self-test.

Verified independently: injecting orro report into the README makes the drift checker exit 1 and removing it returns to 0; the identity check fails closed on a deliberate mismatch and passes when the four facts agree; neutering the comparison turns the self-test red.

🤖 Generated with Claude Code