4.0.0

A UX overhaul of the CLI driven by two live incidents and a full help-text audit: context listing is now offline-first, discovery is built around one SSO profile at a time, synth deploy can no longer pick up stale batches, and the option surface (aliases, required args, types) is consistent CLI-wide.

Breaking Changes

• g3dt config contexts no longer contacts AWS by default — it lists the local marker instantly and offline; pass --verify for the per-context deployed check (now with botocore SSO tracebacks suppressed and an aws sso login hint on failures). --no-verify remains accepted as the default's name (d39ca72)
• Bare g3dt config discover no longer verifies configured contexts — it prints the discovery model and your ~/.aws/config profiles with no network calls; use g3dt config contexts --verify to check registered contexts. The repeatable --profile option is deprecated and hidden (fab58ad)
• g3dt synth deploy now requires --studies; the hardcoded ACDC demo default set (and its per-study record counts) is removed (b33ffbb)
• The synth commands' silent env="test" fallback is removed — synth resolves the current context like every other command group and errors with guidance when nothing is configured (f567e3f)
• Short-alias reassignments for a one-letter-one-meaning convention: k8s --sync and config diff --file are long-only (freeing -s for studies and -f for --follow), and indexd check-download --limit moves from -n to -l (f567e3f)

Features

• g3dt config current prints the bare current context name (script-friendly; exit 1 when none) (d39ca72)
• Single-profile-first discovery: g3dt config discover <profile> validates the SSO session, offers aws sso login inline, then scans that one account; --all-profiles remains as the best-effort sweep (fab58ad)
• Production gates on the widest-blast-radius commands: dict upload, dict deploy, and all k8s restart-* now require the typed context/env confirmation on production targets, matching the synth and delete commands; dict pull and the CodeBuild-driven release write stay ungated (7b9e0a5)
• Consistent short aliases CLI-wide: new -c --ctx, -v --version, -o --on, -l --limit, -r --region, -d --dry-run, -i --import-order, -k --key-path, and -s extended to every --studies (f567e3f)
• Stronger option validation: file options are Path with existence checks (a typo'd path is a usage error, not a traceback), fixed choice sets are enforced enums (synth --provider random|llm, --llm-provider anthropic|openai, pipeline --which per command), and synth deploy/generate reject mismatched study/count lists before anything runs (f567e3f)

Fixes

• synth deploy step [6] now scopes the upload to the run's --studies (--projects on the upload service script): stale study directories from earlier batches are skipped with a log line instead of being submitted — previously a leftover directory from another project's run could 404 and abort the whole deploy before any requested study uploaded (b33ffbb)
• One failing project no longer aborts the rest of a synth upload batch: healthy studies upload first, then the run exits 1 naming the failures (b33ffbb)
• Wrapped service scripts run Python via ${G3DT_PYTHON} (the interpreter owning the g3dt install) instead of bare python3, fixing a latent wrong-interpreter bug on AL2023 (b33ffbb)

Other

• Help-text overhaul: the root and config help now define what a context is; --env has one shared phrasing across ~20 commands; stale references to the deprecated config set now point at synth set-key; config diff examples show the required --file; deploy scripts echo "environment" where they previously (mis)said "profile"; synth deploy docs use the script's real [1]–[7] step numbers (b05b08d)
• Docs updated throughout: docs/design/contexts.md (normative command table, prod-gate set) and the README bootstrap, synth, and k8s sections (8d72df9)

Full Changelog: 3.8.1...4.0.0