AI-assisted upgrade: core-diagrams

core-diagrams is core-slim with a renderer wired in, and it upgrades the same way. Follow AI-assisted upgrade: core-slim — guardrails, classification against the checksum manifest, re-sync and reconciliation all carry over — with the four differences below.

What differs

The target template is keystone-template-core-diagrams. Read every mention of the core-slim repository on that page as this one; its tags and .keystone/sync.json work identically.

The compose file pins two images, the engine and the renderer. Step 5 says to keep the target template's image tag; keep the renderer's pinned digest with it. Both are the template's to pin — an author who edited the compose file was almost certainly adding a service or a mount, not choosing a version.

make verify checks two signatures rather than one — the engine's and the renderer's, against different signing identities.

A build that reports a hook which did not answer means the renderer is not running, rather than the upgrade being wrong. make down — asking first, per the guardrail — then build again. See A hook that fails.