#23 feat(context): ship deterministic context CLI

Stack

CF-11G implementation Stack C for tasks T030-T033.

Base PR: #22 (impl/cf11g-context-graph-library)
Foundation PR: #21
Planning PR: #20

Summary

Ship the user-visible offline commandf context vertical slice on top of the deterministic CF-11G graph library.

commandf context --lock commandf.lock --cache .commandf/cache --format json

Changes

• add commandf context with explicit lock/cache inputs and JSON-only V1 output;
• perform no package acquisition, registry lookup, or network canonical resolution;
• preserve the graph library's schema-v2 lock requirement and fail-closed semantics;
• add CLI boundary tests for:
  • stable schema-v1 migration refusal;
  • missing cache archive refusal;
  • corrupted cache digest refusal;
  • malformed supported reference shape refusal;
  • exact multi-version package-edge evidence;
  • StructureDefinition profile + Extension reference evidence;
  • ValueSet/CodeSystem reference evidence;
  • resolved, external, and ambiguous target states;
  • explicit unsupported-resource coverage;
• prove repeated CLI execution over identical pinned bytes is byte-identical;
• add a pinned cf11g-context-proof workflow that records CF11G_CONTEXT_SHA256=<sha256> in CI evidence;
• keep test fixtures dependency-neutral so Cargo.lock remains unchanged and --locked remains authoritative.

Authority boundary

This PR does not:

• start CF-12 commandf impact;
• convert Context Graph evidence into compatibility or safety claims;
• add a graph database, vector store, RAG, or model authority;
• perform network lookup during commandf context;
• change CF-03/04/05 compatibility semantics;
• change the CF-06 HL7 production pin or failure semantics;
• modify the frozen CF-10 corpus;
• depend on the skipped external HL7 maintainer path.

Required qualification

Keep Draft until the exact head passes:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-features

and the exact-head ci, cf06-oracle, cf11-multi-version-proof, and cf11g-context-proof workflows plus independent review are inspected.

CF-12 remains blocked until CF-11G T043 convergence closes canonically.

---

Summary by cubic

Ships a deterministic, offline commandf context CLI that emits the CF‑11G Context Graph as JSON from a schema‑v2 lock and local cache. It replaces no CLI with commandf context, proves byte‑identical output in CI (uploads CF11G_CONTEXT_SHA256 from a pinned container), and records Spec 012 convergence evidence with tasks marked “implementation proven; final gates pending.”

• New Features

  • Adds a context subcommand with --lock, --cache, and JSON‑only --format.
  • Requires schema v2 locks; prints a stable migration error for v1.
  • Resolves only from .commandf/cache; missing/corrupt archives and malformed packages fail closed.
  • Validates evidence for multi‑version edges and target states (resolved, external, ambiguous).
  • Adds a cf11g-context-proof workflow pinned to Rust 1.97.1 by digest; asserts a clean tree and uploads CF11G_CONTEXT_SHA256.
  • Adds Spec 012 convergence evidence and updates task status to “implementation proven; final convergence gates pending.”
  • Schema v1 lock serialization now refuses resolved_dependencies, with tests covering this boundary.

• Migration

  • Regenerate a schema‑v2 commandf.lock if you have schema v1.
  • Prepopulate .commandf/cache; the command fails if archives are missing or digests mismatch.

Summary by CodeRabbit

• New Features

  • Added a context command that builds and outputs dependency context data in JSON format.
  • Added options for selecting lockfiles, caches, and output formats.

• Bug Fixes

  • Added safeguards that reject unsupported or malformed package and lockfile data.

• Tests

  • Added coverage for deterministic output, dependency resolution evidence, help flags, offline operation, and failure scenarios.
  • Added automated verification that records and uploads a reproducible output checksum.