ARCADIA-Studio/harness/experiments/analysis-mixed-cli-20260925/ORACLE-GATE-PLAN.md

Mixed CLI independent oracle and gate plan

Design/source review only; parent owns every compiler/application run. Baseline bab6f96a5b05b37f2b5d67a430aed0f67d783e73; selected root contract committed locally at f810fb40, SHA256 69935281eadf9fa82bd8d4f606fed2df758cfe643ef88bd5168ee327453942e1. No public mixed CLI acceptance is inferred from the preceding public library checkpoint.

Independent observable oracles

• Success fixtures must bind real disk bytes to a complete independently constructed Project via load_mixed_source then check_mixed_bundle. The CLI report does not contain a model; do not pretend a status assertion establishes model equality. Prefer the same OA/SA literals for model and executable checks, with cross-file typed calls, scoped parameters, ordinary nested records, explicit identities, Unicode/CRLF and misleading include text in comments/strings.
• Compare the complete meaningful Report: operation/status/exit, ordered warning/error diagnostics and original spans/line/column/path, changes empty, written false, migration null, identity count zero. Compare stable human output too. The executable must use actual new dispatch, not only a direct helper call.
• Snapshot exact relative directory names and every file's raw bytes before/after success, warning, syntax/semantic/path/journal refusal and argument refusal. Diagnostic text should not grant missing-file or partial-bundle success. Explicitly distinguish schema/UUID rejection from ordinary check's existing migration/stabilization behavior.
• Internal discovery tests should use real parsed units with test-only tightened caps. Two individually valid files must exceed one shared aggregate cap; repeated targets inspect once while repeated authored edges count. Check retained conservative charges after unit drop, zero temporary balance, unchanged actual policy capture and shared ModelCounts. Cover first latched refusal with an unparsed queued sibling and exact first-file location. No reset/refund or partial-result escape is accepted by these tests.
• Exercise caller byte/file/depth/edge boundary and boundary-minus-one, including unlimited caller bytes clamped before read; missing/cyclic includes, invalid UTF-8, reserved/escaping paths, hard-link/case aliases, nonregular files and pending journals. Use positive controls. Windows and Unix-specific cases must be labelled by actual availability, not inferred from source-only test declarations.

Proportionate final gates

1. Normal core integration list/run for the new mixed disk boundary, plus the ten existing mixed_source8_read external tests. Test compilation alone does not establish the non-test API path.
2. Core full listing/run: preserve all 299 baseline named outcomes and enumerate exact additions. New focused discovery tests must be a declared subset of that list, with no ignored/filtered-away expected controls.
3. Existing seven ordinary integration selections (65 Windows outcomes at baseline), particularly all eight Windows source_files tests because the shared discovery loop changes. The other three source-file tests are cfg(unix), not missing Windows results. Retain the eleven exact core stack controls and the structural-writeback integration control named in the preceding public-read runtime plan; compare names/outcomes, not an approximate stack-name regex.
4. Existing oa-cli source_cli integration suite (12 authored baseline tests) plus exact newly listed mixed CLI names. Run real built executable mixed success/refusal/usage paths and ordinary check/rename-preview regression. Preserve full commands, output streams, exit codes and directory bytes.
5. Existing three public-read doctests, strict all-target core/CLI Clippy, and formatting disposition. Rustdoc's two exact CheckedMixed ... - compile fail runtime suffixes require the previously established narrow listing/runtime reconciliation if the recorder still compares literal names. Do not broadly strip arbitrary suffixes or conceal recorder failures. Compare inherited formatting bytes; any changed disposition needs inspection.

Bind each receipt to reviewed clean source, full declared Git/raw inputs, launcher/hash/argv/environment, raw log, actual artifact provenance and post-run clean state. Preserve initial compilation, test or recorder failures separately. Reuse already-valid evidence only for explicitly unchanged inputs/components; do not assume a new parser helper preserves stack reservations. Static frame observations, if collected, are supplemental to finite exercised worker tests.

The final source report will record settled file hashes and the actual commit after workers freeze their disjoint changes. Missing gates remain pending rather than inferred passes. No Linux, GUI/editor/save/history integration, atomic disk snapshot or universal stack/allocation guarantee is part of this milestone.

Frozen candidate readback: f2324822936374c5b9092518b986375233dc7882, clean. Exact authored additions are three core unit tests (expected full302), five mixed_source_files external tests and six mixed_cli integration tests. See SOURCE-REVIEW.md for complete file hashes and committed ancestry. No tests have been executed by this reviewer.