Add source-first CLI with guarded writes and reviewed evidence

This commit is contained in:
2026-09-11 05:14:13 -07:00
parent 2ec72d4241
commit 01b76a1e89
16 changed files with 2179 additions and 2 deletions
@@ -0,0 +1,465 @@
{
"Reviewer": "Codex-9e8r6t /root/behavior_audit",
"RecordedUtc": "2026-09-11T11:59:00.5676616Z",
"BinarySHA256": "BAD169F8BE78DCFA74B32714569C886DD2132727080684FC2BA618D5822E3559",
"InitialPublishedFixtureSHA256": "E68D7162F6F7656AAD51853E5A38DECD2D84F4CC3B6A9120AF86AC7A64AA92A2",
"AliasInputSHA256": "53ACB827AB030203411D0E29907142AA83ECD65C133D5C975DDB9AB74920308B",
"AliasExpectedFinalSHA256": "1DCFFDEDEE6B2647F20442D1A8E74BF72AFBF30F1B067F3C947D52117B032C44",
"CheckCount": 183,
"Checks": [
"immutable CLI binary pin",
"project has one literal declaration header",
"element has one literal declaration header",
"element live-reference count",
"relation has one literal declaration header",
"relation live-reference count",
"diagram has one literal declaration header",
"diagram live-reference count",
"placement has one literal declaration header",
"artifact has one literal declaration header",
"trace has one literal declaration header",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"all-family baseline is admitted before mutation",
"all-family baseline has no missing identities",
"all-family baseline contains exactly 40 authored UUIDs",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"project preview succeeds without write",
"project preview preserves exact input bytes",
"project reports exactly one changed file",
"project preserves file ownership",
"project reports exact captured text",
"project changes only independently predicted header/live-reference tokens",
"project invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"project write succeeds",
"project stable separate write invocation has exact preview text",
"project persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"element preview succeeds without write",
"element preview preserves exact input bytes",
"element reports exactly one changed file",
"element preserves file ownership",
"element reports exact captured text",
"element changes only independently predicted header/live-reference tokens",
"element invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"element write succeeds",
"element stable separate write invocation has exact preview text",
"element persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"relation preview succeeds without write",
"relation preview preserves exact input bytes",
"relation reports exactly one changed file",
"relation preserves file ownership",
"relation reports exact captured text",
"relation changes only independently predicted header/live-reference tokens",
"relation invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"relation write succeeds",
"relation stable separate write invocation has exact preview text",
"relation persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"diagram preview succeeds without write",
"diagram preview preserves exact input bytes",
"diagram reports exactly one changed file",
"diagram preserves file ownership",
"diagram reports exact captured text",
"diagram changes only independently predicted header/live-reference tokens",
"diagram invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"diagram write succeeds",
"diagram stable separate write invocation has exact preview text",
"diagram persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"placement preview succeeds without write",
"placement preview preserves exact input bytes",
"placement reports exactly one changed file",
"placement preserves file ownership",
"placement reports exact captured text",
"placement changes only independently predicted header/live-reference tokens",
"placement invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"placement write succeeds",
"placement stable separate write invocation has exact preview text",
"placement persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"artifact preview succeeds without write",
"artifact preview preserves exact input bytes",
"artifact reports exactly one changed file",
"artifact preserves file ownership",
"artifact reports exact captured text",
"artifact changes only independently predicted header/live-reference tokens",
"artifact invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"artifact write succeeds",
"artifact stable separate write invocation has exact preview text",
"artifact persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"trace preview succeeds without write",
"trace preview preserves exact input bytes",
"trace reports exactly one changed file",
"trace preserves file ownership",
"trace reports exact captured text",
"trace changes only independently predicted header/live-reference tokens",
"trace invents no identity or migration",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"trace write succeeds",
"trace stable separate write invocation has exact preview text",
"trace persisted text equals independent expectation",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"all-family final source is freshly admitted",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"stable all-family source is a true no-op",
"no-op preserves source modification time",
"no-op preserves every source byte",
"writes leave no unexpected physical file",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"partial unallocated functions remain valid",
"exactly two raw unallocated-leaf diagnostics without stabilized duplicates",
"first warning starts at original UTF-8 declaration offset",
"first warning identifies raw include",
"first CRLF/Unicode line and scalar column",
"first warning ends inside raw input",
"first raw diagnostic slice identifies intended declaration",
"first diagnostic identity has correct authored/provisional status",
"second warning starts at original UTF-8 declaration offset",
"second warning identifies raw include",
"second CRLF/Unicode line and scalar column",
"second warning ends inside raw input",
"second raw diagnostic slice identifies intended declaration",
"second diagnostic identity has correct authored/provisional status",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"partial unallocated functions remain valid",
"exactly two raw unallocated-leaf diagnostics without stabilized duplicates",
"first warning starts at original UTF-8 declaration offset",
"first warning identifies raw include",
"first CRLF/Unicode line and scalar column",
"first warning ends inside raw input",
"first raw diagnostic slice identifies intended declaration",
"first diagnostic identity has correct authored/provisional status",
"second warning starts at original UTF-8 declaration offset",
"second warning identifies raw include",
"second CRLF/Unicode line and scalar column",
"second warning ends inside raw input",
"second raw diagnostic slice identifies intended declaration",
"second diagnostic identity has correct authored/provisional status",
"raw diagnostics and preview retain both exact source files",
"only missing-ID include is proposed for stabilization",
"fixture genuinely shifts second declaration in proposed candidate",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"partial unallocated functions remain valid",
"exactly two raw unallocated-leaf diagnostics without stabilized duplicates",
"first warning starts at original UTF-8 declaration offset",
"first warning identifies raw include",
"first CRLF/Unicode line and scalar column",
"first warning ends inside raw input",
"first raw diagnostic slice identifies intended declaration",
"first diagnostic identity has correct authored/provisional status",
"second warning starts at original UTF-8 declaration offset",
"second warning identifies raw include",
"second CRLF/Unicode line and scalar column",
"second warning ends inside raw input",
"second raw diagnostic slice identifies intended declaration",
"second diagnostic identity has correct authored/provisional status",
"authored-ID lint is read-only",
"process exit agrees with JSON",
"JSON invocation emits no mixed stderr",
"invalid raw Unicode source is refused before any candidate write",
"unresolved reference uses exact raw UTF-8 byte start",
"non-BMP prefix uses Unicode scalar column rather than UTF-16 units",
"invalid input exposes neither candidate coordinate nor ephemeral identity",
"invalid write retains complete input bundle bytes",
"CLI pin remains unchanged after probes"
],
"Operations": [
{
"Arguments": [
"check",
"<fixture>\\aliases\\project.arcadia"
],
"Exit": 0,
"Status": "checked",
"Changes": 0,
"Diagnostics": 0,
"StdoutSHA256": "251E0C7CAF9243AFBCDCCD371707B8BFFF63CCF47537DABE9C398B4F3BBDC165"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"alarm_response",
"alarm_suite"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "E577D97B27E93CF4395EA67C01177FB7427EC28AE7D83629BD3CAB82849AE712"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"alarm_response",
"alarm_suite",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "1134EA13A5674D0AF0237BFB08C720FF046C0D82C8AE916AA6F97C40A009471F"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"maintenance",
"maintenance_staff"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "05CFEFA2CDD8612628906E81BA994446FC2D408642CAD8C8EAE1B0B0BDBFE5D5"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"maintenance",
"maintenance_staff",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "54B496AFCC671910E5109FFF3B65CFE0DC1BEA8D85871BDBC976177F28962AEF"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"alarm_message",
"alarm_payload"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "61309AADFF80386FA73FA9E7005C4C45548C56BC015BAF11750DCB00CD379E92"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"alarm_message",
"alarm_payload",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "EB0317BF9C7A6C54644748D7F8BFD04E082469AE98EAAA1F39DCC2AED9EDFDE7"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"response_view",
"response_map"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "3D2325D62D6F7D7FB7D7B7E162800DBBB15A4328BC1C5C0BF98EFD794E4AA472"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"response_view",
"response_map",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "E77B284EAFFBB090B73035FD584CE1D184C601112BCC0D5266D42F1CD7D2D185"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"detector_card",
"detector_tile"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "8DBA5013A3404CB5719573CDE66C92768C764B363C937646B79D848EA356D275"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"detector_card",
"detector_tile",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "EB444F39F873C58A8192C0A5AFC2C48FCAF1CAB333231C66471F71D1C1D2486A"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"response_procedure",
"response_handbook"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "6613EDCABEF4D8AC81E9FC21000FDE7AF10726E882BAF106ECA7991E553C4F53"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"response_procedure",
"response_handbook",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "0B740F86D607AD194EBD93D63DA65210A39DD35B1B3757CE679EC1A84FB8D3B9"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"assessment_refinement",
"assessment_alignment"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "101A1D9E89F482E6607B8A4855A673F56897818969333F6ED0D5F5749BFA739D"
},
{
"Arguments": [
"rename-alias",
"<fixture>\\aliases\\project.arcadia",
"assessment_refinement",
"assessment_alignment",
"--write"
],
"Exit": 0,
"Status": "written",
"Changes": 1,
"Diagnostics": 0,
"StdoutSHA256": "DA48C339A3C387BE06F6C3DCD799B3F98E75F6F97F760195EFFB9AB1C86F6EE7"
},
{
"Arguments": [
"check",
"<fixture>\\aliases\\project.arcadia"
],
"Exit": 0,
"Status": "checked",
"Changes": 0,
"Diagnostics": 0,
"StdoutSHA256": "251E0C7CAF9243AFBCDCCD371707B8BFFF63CCF47537DABE9C398B4F3BBDC165"
},
{
"Arguments": [
"stabilize",
"<fixture>\\aliases\\project.arcadia",
"--write"
],
"Exit": 0,
"Status": "unchanged",
"Changes": 0,
"Diagnostics": 0,
"StdoutSHA256": "FD9DF6ECDEF4F60AFDB07C8B37848E65ABE2E995A8A9F21506A322BE173753BE"
},
{
"Arguments": [
"check",
"<fixture>\\raw\\project.arcadia"
],
"Exit": 0,
"Status": "checked",
"Changes": 0,
"Diagnostics": 5,
"StdoutSHA256": "76363050F8B22A12D5A587156C7C6846ABD9CB087378735068CE0AFC5FAA798D"
},
{
"Arguments": [
"stabilize",
"<fixture>\\raw\\project.arcadia"
],
"Exit": 0,
"Status": "preview",
"Changes": 1,
"Diagnostics": 5,
"StdoutSHA256": "4B832B7D683AEED0ABCCE29262561CF3C77DF0CB1E965990C28B860ED0002F7A"
},
{
"Arguments": [
"lint",
"<fixture>\\raw\\project.arcadia"
],
"Exit": 0,
"Status": "checked",
"Changes": 0,
"Diagnostics": 5,
"StdoutSHA256": "00DDDFC5A535317F6D4B5F8FFF46FACEDAF49E89D9D1ED319C4EC3D24B018BEC"
},
{
"Arguments": [
"stabilize",
"<fixture>\\raw\\project.arcadia",
"--write"
],
"Exit": 1,
"Status": "invalid",
"Changes": 0,
"Diagnostics": 1,
"StdoutSHA256": "0813BD7BEF5B4B20D500A3B547C07F52C10C3E074EC6B24B57021F42FC1AE5D1"
}
],
"Limits": "Independent CLI process/source-byte checks only; no production compile, full Project comparison, concurrency proof, Linux or native GUI claim."
}