Skip to content
GRACE
Registry

Step 3. Run a command

This step needs a local checkout of stratt-hq and Node 22. Two commands, and the second is the one that matters.

Validate

Section titled “Validate”
Terminal window
stratt validate packages/units/<domain>/<unit>.yaml

Validates the unit against the schema, resolves its imports, and checks its constraints. --strict treats warnings as errors. This is SPEC-01: it answers what shape the unit is and how it can fail, before anything executes.

Fingerprint

Section titled “Fingerprint”
Terminal window
stratt fingerprint packages/units/<domain>/<unit>.yaml --verify

Computes the Blake3 fingerprint over the canonical serialisation. With --verify, it compares the computed value against the one stored in the unit and tells you which of the four states you are in.

Change one character in the unit file and run it again. The fingerprint moves, the comparison fails, and you have seen drift rather than read about it. Restore the character and it returns to verified. That two-command loop is the whole of step 1’s identity guarantee, in the smallest form it takes.

A third command reaches further, comparing against the published copy in R2 rather than only the local record:

Terminal window
stratt verify packages/units/<domain>/<unit>.yaml

--local-only skips the remote check when you are offline.

What is being demonstrated

Section titled “What is being demonstrated”

Not that the tool works. That the artefact and the record of the artefact are separable, and something is watching the gap. Everything in step 4 follows from that.

Derivation. Command surfaces read from stratt-hq@a137d8a on 2026-08-13, at packages/cli/src/commands/{validate,fingerprint,verify}.ts. Per DW-GRACE-04 this page states where its claims come from and when, because a command list with no read date decays silently.

Step 4. Read what it wrote