# CLI-only integration review — 2026-09-11

Reviewer: Codex-ytr83r / server_audit. Bounded read-only review of commit
`01b76a1e89e93b7992f39e63560aa8b2ca2f69e0` over
`2ec72d4241fa8971fa6fe9f626937de9dfd7c7eb`, against local HEAD
`b853a1eca3df93ec9434e301e2b5521210f2579d` and the current B4/guide working changes.
Coordination: Gitea issue #1, ownership comment #197; upstream handoff #185.

## Verdict and import recipe

No new material correctness finding in this bounded review. Importing ONLY 01b is
self-contained against the local core. Do not import its parent 2ec or the other
host's branch history. A plain patch is not entirely conflict-free: coordination
files need the preservation decisions below. Actual three-way cherry-pick and
execution were not performed by this reviewer.

1. After the root's current serialized gate ends, apply only the 01b change.
2. Retain current `AGENTS.md` unchanged: its blob already equals the 01b target,
   `d93cddacdd45341abb7bbea1d3e3fd4493484d9e`.
3. Retain every current `.gitattributes` rule and add only
   `harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol`.
   In particular preserve `PROJECT_GOAL.md`, both history/archive directories,
   and existing constructor/native/textual-analysis/fixture rules. Do not replace
   this file with the remote whole-file version.
4. The remaining 14 paths can take the exact commit diff. Preserve all unrelated
   B4, guide, language-documentation and ledger working changes. Verify incoming
   archived evidence bytes with its attributes in force before staging.
5. Root owns fresh locked CLI tests/build/lint and any executable probes against
   the integrated source. Existing evidence is attributed below. Release asset
   packaging and Linux verification remain separate claims.

Read-only `git diff 01b76a1^ 01b76a1 --binary | git apply --check -` rejected
only `.gitattributes` and `AGENTS.md` (and emitted fixture CRLF whitespace warnings).
The same check excluding these two files, with `--whitespace=nowarn`, exited 0.
All eleven added paths were absent locally, and the five integration input paths
had no worktree edits. These are patch checks, not a promise that Git's three-way
operation will require exactly the same conflict resolution.

## Exact changed paths

Modified:

- `.gitattributes`
- `AGENTS.md`
- `Cargo.lock`
- `Cargo.toml`
- `README.md`

Added:

- `crates/oa-cli/Cargo.toml`
- `crates/oa-cli/src/lib.rs`
- `crates/oa-cli/src/main.rs`
- `crates/oa-cli/tests/source_cli.rs`
- `docs/source-cli.md`
- `harness/experiments/source-cli-independent-20260911/alias-expected-final.arcadia`
- `harness/experiments/source-cli-independent-20260911/alias-input.arcadia`
- `harness/experiments/source-cli-independent-20260911/probe.ps1`
- `harness/experiments/source-cli-independent-20260911/result.json`
- `harness/release-source-cli-20260911.md`
- `harness/release-source-cli-review-20260911.md`

No desktop, `docs/language.rst`, `PROJECT_GOAL.md`, or shared ledger path is in
this commit. Keep both incoming reports as their authors' historical evidence;
do not rewrite them as local B4 or integrated-release verification. README's new
CLI usage section and `docs/source-cli.md` complement the existing guide rather
than replacing it. README's desktop/server package statement is not a CLI asset
publication claim.

## Verified dependency and write-path facts

The entire `crates/oa-core` tree is identical at local b853, remote parent 2ec,
and 01b: `a9c71e2c3fc9260d06f191c0d65b1e63e41edbec`. The referenced
`harness/experiments/textual-authoring-20260911/alarm-response.arcadia` fixture is
also identical (`f401ca5459d3b678a1c701d49c6ae122b2f0bb87`), as are the checked
text-first examples and source7 fixtures. Cargo/README input bases match.
Cargo.lock adds only the local oa-cli package using existing dependencies.

Source references below refer to 01b for CLI files and the identical local core:

- `crates/oa-cli/src/lib.rs:191` consumes the prepared operation and calls
  `source_files::save_project` at line 197 with its original disk snapshot, even
  when the proposed changed-file list is empty. It does not reload and silently
  accept a changed dependency before writing.
- `crates/oa-core/src/source_files.rs:799` checks every snapshot expectation,
  including unchanged reachable includes. The saver begins at line 819; pending
  journal refusal and conflict checks precede its no-op return. A removed or
  edited unchanged include therefore remains a meaningful refusal case even
  though it is absent from the preview's changed-file list.
- `crates/oa-cli/src/lib.rs:220` loads the source snapshot; line 243 obtains raw
  lint diagnostics, and line 254 gates invalid input before mutation. Loader
  discovery/path/encoding/recovery diagnostics are retained. Lines 271–281 omit
  unauthored provisional object IDs from those diagnostics. Migration notes are
  captured at line 305 before alias updating.
- Alias rename prepares the core SetAlias command at line 321, then calls the
  identity-aware source updater at line 325. This is not a textual replacement;
  source bytes and detached files are governed by the existing source saver.
- `crates/oa-cli/src/main.rs:75` prints and flushes the human preview before the
  write at line 78; JSON emits the resulting report at line 86. Proposed changes
  remain reviewable in a failed write report. A later output failure must not be
  interpreted as proof that no disk write occurred.

Concrete falsifiers retained for the root's gate are an unchanged included file
edited after prepare, a pending journal introduced before a no-op write, an alias
occurring in comments/prose and references, and malformed UTF-8 or a missing
include. Existing CLI tests target these behaviors. This review found no source
counterexample requiring a production fix.

## Evidence boundary

This reviewer ran source comparisons and read-only patch checks only: no Cargo,
CLI execution, native validation, production edit, or Git mutation. The only new
file from this assignment is this report.

The incoming author report attributes 12 passing CLI tests and final lint/build
to Codex-9e8r6t / palette_finish. The incoming independent report attributes 183
assertions over 21 processes to Codex-9e8r6t / behavior_audit against frozen CLI
SHA-256 `BAD169F8BE78DCFA74B32714569C886DD2132727080684FC2BA618D5822E3559`.
Those are prior executable results, not fresh passes against b853 plus B4.
Their earlier pre-implementation findings are recorded as closed in that work.

The preview describes changed files, not a persisted approved plan or full
project digest. Provisional IDs can differ across separate invocations until
stabilized. Core persistence documents recoverability rather than multi-file
atomic visibility, cross-process compare-and-swap, or guaranteed power-loss
durability. These existing boundaries are not newly discovered regressions.