feat(cli): bounded JSON and SARIF review preview (signed DCO)

Merged
TH
8d ago
+689-10

Signed, DCO-compliant replacement for original PR #194

The bounded offline commandf review-preview CLI combines existing deterministic compatibility check and graph impact results as JSON or SARIF 2.1.0, preserving typed source-identity validation, failure-policy exits, verified package bytes and explicit false claims for complete consumer review, atomic snapshot and signed receipt. This is a preview, NOT the full CommandF decision product.

Original #194 is historically technically qualified but its GitHub API commits were unsigned. This candidate recreates its exact byte-identical Git tree in a single fresh commit signed with SSH key and DCO, using the authorized online Windows device. It does not rebase, amend, force-push or rewrite original commits and does not modify protected main or workflows.

  • Signed SHA: 714cec1cf631e3352aaa3c34b7f6d5bf41680769 — GitHub API verified=true, reason=valid.
  • DCO signoff: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Tree: 51e6a9c04d7f1d4951fb07df6d56138482461a36, exactly equal to original PR #194 head.
  • Parent: f82565cca917d119e1c774b2c470e2ac20e0d6dd.
  • Windows validation: ephemeral shallow main clone, fetched current original PR head, git apply --index --check, whitespace diff check, cargo fmt --all -- --check, exact pre/post-sign tree comparison, git commit -S -s and normal git push; prior GitHub CLI active account restored.

Qualification is not inherited. The original green CI is only evidence for identical file bytes, not this new commit identity. All GitHub technical checks must pass at 714cec1cf631e3352aaa3c34b7f6d5bf41680769 independently. Actual independent eligible human Code Owner APPROVED review after last push, all resolved threads, normal merge commit, fresh main CI, and any separate AF-02 FD-1/FD-2 governance gates remain mandatory. No self-review, bot comment as approval, ruleset bypass or false product completion is authorized. The original candidate should be closed without merge after this replacement is publicly documented.

CommandF remains incomplete: full consumer-specific decision and atomic signed receipts, release qualification and Studio are not claimed.

Summary by cubic

Adds the commandf review-preview CLI command, which bundles the existing deterministic compatibility check and package-graph impact reports into a single bounded JSON or SARIF 2.1.0 output.

The preview composes existing reports only — it introduces no new evaluation logic. The output envelope explicitly states that it is not a complete consumer-contract review, atomic cross-step snapshot, or signed receipt.

  • Composer validates that check and impact package identities (name, before/after versions, archive SHA-256, graph subject) agree before emitting output.
  • Requires lockfile schema 2 on both sides. On any failure (invalid CLI use, unsupported lock, tampered cache, failed impact), exits 1 without writing a partial preview.
  • The two subreports are read independently; the envelope does not claim they form a frozen cross-step snapshot.
  • Exit 0 on policy pass, 2 on policy failure, both only after both subreports complete; exits preserve existing atomic --output replacement.
  • Each report part is capped at 64 MiB; the SARIF projection embeds the impact report in run properties alongside explicit false capability flags and caps the combined output at 192 MiB.
  • Tests cover policy pass/fail, exit codes, output atomicity, lock schema rejection, cache tampering, identity mismatch, SARIF output, and byte-stable offline replays.