feat(cli): serve verified calculation reports on localhost

Merged
VI
25d ago
+1509-14

Summary

cso dev
  localhost HTTP boundary
    static Python definition and validated inputs
      verified calculation outputs
      retained report run
        captured HTML
        lazy PDF and hashed evidence

Adds an editable local report, an output-only calculation API and PDF downloads from the same retained execution. Uses the static definition manifest merged in #64. No deployment or generated demo project is added.

Evidence

  • Before: The installed CLI could generate files but could not serve an editable calculation application.
    After: Checks on latest main pass: 167 core, 50 React, 73 CLI, 110 Python and 290 integration cases, plus both added wide-float regression cases. Lint, typechecks, project isolation and library archive checks pass. The browser edit produces the two-panel width-1 result; curl returns only area, volume and mass.
  • Before: A later source edit could require another calculation to generate a PDF.
    After: Tests prove retained HTML/PDF remain unchanged after an edit, matching references are retained and hashed, and invalid requests preserve prior reports. Both manual two-panel PDF pages were inspected, with the PDF hash matched to its evidence.
  • Before: Cubic flagged routing and report lifecycle concentrated in one module.
    After: A private runtime owns captures, retention and PDFs. Cubic was rerun after integrating latest main. Its decimal-input finding is disproved by both added regression cases; Chromium launch already has a 30-second timeout. The earlier startup-cache suggestion would reject normal formula edits until restart, which the source-edit integration test covers.

Review follow-up

Calculations proceed during unrelated PDF work. PDF retention limits preserve HTTP 413 and pending state; renderer failures refresh the UI checks. The UI preserves negative zero and exposes evidence only after a successful PDF. Dev arguments validate normalized names, and integer inputs reject floating JSON spellings before execution.

One concentrated browser/HTTP workflow exercises concurrency, retention recovery, signed-zero display, failure checks and evidence visibility. Existing real-PDF workflows remain. On 35621ee, CI passes all 702 tests (592 TypeScript and 110 Python), lint, typecheck, project isolation, installed-package consumers and CodeQL. The refreshed review is green, with no open threads. Two lower-priority rendering/test-helper refactors were explicitly declined.

Merge Danger

Door: two-way

Existing offline CLI execution keeps its prior timeout behavior. Local execution has explicit deadlines and bounded temporary retention.

Blast Radius: runtime

Requires the installed Python wheel and Chromium. Runs expire or disappear on restart; this is a loopback application, not public hosting.