ARCADIA-Studio/harness/release-cli-integration-ytr83r-20260911.md

CLI-only integration review — 2026-09-11

Reviewer: Codex-ytr83r / server_audit. Bounded read-only review of commit 01b76a1e89e93b7992f39e63560aa8b2ca2f69e0 over 2ec72d4241fa8971fa6fe9f626937de9dfd7c7eb, against local HEAD b853a1eca3df93ec9434e301e2b5521210f2579d and the current B4/guide working changes. Coordination: Gitea issue #1, ownership comment #197; upstream handoff #185.

Verdict and import recipe

No new material correctness finding in this bounded review. Importing ONLY 01b is self-contained against the local core. Do not import its parent 2ec or the other host's branch history. A plain patch is not entirely conflict-free: coordination files need the preservation decisions below. Actual three-way cherry-pick and execution were not performed by this reviewer.

1. After the root's current serialized gate ends, apply only the 01b change.
2. Retain current AGENTS.md unchanged: its blob already equals the 01b target, d93cddacdd45341abb7bbea1d3e3fd4493484d9e.
3. Retain every current .gitattributes rule and add only harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol. In particular preserve PROJECT_GOAL.md, both history/archive directories, and existing constructor/native/textual-analysis/fixture rules. Do not replace this file with the remote whole-file version.
4. The remaining 14 paths can take the exact commit diff. Preserve all unrelated B4, guide, language-documentation and ledger working changes. Verify incoming archived evidence bytes with its attributes in force before staging.
5. Root owns fresh locked CLI tests/build/lint and any executable probes against the integrated source. Existing evidence is attributed below. Release asset packaging and Linux verification remain separate claims.

Read-only git diff 01b76a1^ 01b76a1 --binary | git apply --check - rejected only .gitattributes and AGENTS.md (and emitted fixture CRLF whitespace warnings). The same check excluding these two files, with --whitespace=nowarn, exited 0. All eleven added paths were absent locally, and the five integration input paths had no worktree edits. These are patch checks, not a promise that Git's three-way operation will require exactly the same conflict resolution.

Exact changed paths

Modified:

• .gitattributes
• AGENTS.md
• Cargo.lock
• Cargo.toml
• README.md

Added:

• crates/oa-cli/Cargo.toml
• crates/oa-cli/src/lib.rs
• crates/oa-cli/src/main.rs
• crates/oa-cli/tests/source_cli.rs
• docs/source-cli.md
• harness/experiments/source-cli-independent-20260911/alias-expected-final.arcadia
• harness/experiments/source-cli-independent-20260911/alias-input.arcadia
• harness/experiments/source-cli-independent-20260911/probe.ps1
• harness/experiments/source-cli-independent-20260911/result.json
• harness/release-source-cli-20260911.md
• harness/release-source-cli-review-20260911.md

No desktop, docs/language.rst, PROJECT_GOAL.md, or shared ledger path is in this commit. Keep both incoming reports as their authors' historical evidence; do not rewrite them as local B4 or integrated-release verification. README's new CLI usage section and docs/source-cli.md complement the existing guide rather than replacing it. README's desktop/server package statement is not a CLI asset publication claim.

Verified dependency and write-path facts

The entire crates/oa-core tree is identical at local b853, remote parent 2ec, and 01b: a9c71e2c3fc9260d06f191c0d65b1e63e41edbec. The referenced harness/experiments/textual-authoring-20260911/alarm-response.arcadia fixture is also identical (f401ca5459d3b678a1c701d49c6ae122b2f0bb87), as are the checked text-first examples and source7 fixtures. Cargo/README input bases match. Cargo.lock adds only the local oa-cli package using existing dependencies.

Source references below refer to 01b for CLI files and the identical local core:

• crates/oa-cli/src/lib.rs:191 consumes the prepared operation and calls source_files::save_project at line 197 with its original disk snapshot, even when the proposed changed-file list is empty. It does not reload and silently accept a changed dependency before writing.
• crates/oa-core/src/source_files.rs:799 checks every snapshot expectation, including unchanged reachable includes. The saver begins at line 819; pending journal refusal and conflict checks precede its no-op return. A removed or edited unchanged include therefore remains a meaningful refusal case even though it is absent from the preview's changed-file list.
• crates/oa-cli/src/lib.rs:220 loads the source snapshot; line 243 obtains raw lint diagnostics, and line 254 gates invalid input before mutation. Loader discovery/path/encoding/recovery diagnostics are retained. Lines 271–281 omit unauthored provisional object IDs from those diagnostics. Migration notes are captured at line 305 before alias updating.
• Alias rename prepares the core SetAlias command at line 321, then calls the identity-aware source updater at line 325. This is not a textual replacement; source bytes and detached files are governed by the existing source saver.
• crates/oa-cli/src/main.rs:75 prints and flushes the human preview before the write at line 78; JSON emits the resulting report at line 86. Proposed changes remain reviewable in a failed write report. A later output failure must not be interpreted as proof that no disk write occurred.

Concrete falsifiers retained for the root's gate are an unchanged included file edited after prepare, a pending journal introduced before a no-op write, an alias occurring in comments/prose and references, and malformed UTF-8 or a missing include. Existing CLI tests target these behaviors. This review found no source counterexample requiring a production fix.

Evidence boundary

This reviewer ran source comparisons and read-only patch checks only: no Cargo, CLI execution, native validation, production edit, or Git mutation. The only new file from this assignment is this report.

The incoming author report attributes 12 passing CLI tests and final lint/build to Codex-9e8r6t / palette_finish. The incoming independent report attributes 183 assertions over 21 processes to Codex-9e8r6t / behavior_audit against frozen CLI SHA-256 BAD169F8BE78DCFA74B32714569C886DD2132727080684FC2BA618D5822E3559. Those are prior executable results, not fresh passes against b853 plus B4. Their earlier pre-implementation findings are recorded as closed in that work.

The preview describes changed files, not a persisted approved plan or full project digest. Provisional IDs can differ across separate invocations until stabilized. Core persistence documents recoverability rather than multi-file atomic visibility, cross-process compare-and-swap, or guaranteed power-loss durability. These existing boundaries are not newly discovered regressions.