[object Object]

← back to Cli Printing Press

refactor(cli): table-drive dogfood verdict rules (#318)

faac0d39a9b7be88054b21ac4c01f3d621553db6 · 2026-04-26 17:36:08 -0700 · Trevin Chow

Make dogfood verdict priority explicit as ordered rules so future shipcheck gates can be added without extending a long branch ladder.

Add a dogfood verdict golden matrix to freeze PASS, hard FAIL, and WARN-before-FAIL priority behavior against the pre-refactor implementation.

Files touched

Diff

commit faac0d39a9b7be88054b21ac4c01f3d621553db6
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Sun Apr 26 17:36:08 2026 -0700

    refactor(cli): table-drive dogfood verdict rules (#318)
    
    Make dogfood verdict priority explicit as ordered rules so future shipcheck gates can be added without extending a long branch ladder.
    
    Add a dogfood verdict golden matrix to freeze PASS, hard FAIL, and WARN-before-FAIL priority behavior against the pre-refactor implementation.
---
 internal/pipeline/dogfood.go                       | 96 +++++++++-------------
 internal/pipeline/dogfood_test.go                  | 14 ++++
 .../cases/dogfood-verdict-matrix/artifacts.txt     |  3 +
 .../cases/dogfood-verdict-matrix/command.txt       |  5 ++
 .../expected/dogfood-verdict-matrix/exit.txt       |  1 +
 .../fail-path-auth-dead.json                       | 85 +++++++++++++++++++
 .../expected/dogfood-verdict-matrix/pass.json      | 72 ++++++++++++++++
 .../expected/dogfood-verdict-matrix/stderr.txt     |  1 +
 .../expected/dogfood-verdict-matrix/stdout.txt     |  0
 .../dogfood-verdict-matrix/warn-priority.json      | 81 ++++++++++++++++++
 .../cmd/matrix-fail-pp-cli/main.go                 | 19 +++++
 .../fail-path-auth-dead/go.mod                     |  3 +
 .../fail-path-auth-dead/internal/cli/live.go       |  6 ++
 .../fail-path-auth-dead/internal/cli/root.go       | 20 +++++
 .../fail-path-auth-dead/internal/cli/sync.go       |  5 ++
 .../fail-path-auth-dead/internal/client/client.go  |  3 +
 .../fail-path-auth-dead/spec.yaml                  | 19 +++++
 .../pass/cmd/matrix-pass-pp-cli/main.go            | 19 +++++
 .../fixtures/dogfood-verdict-matrix/pass/go.mod    |  3 +
 .../pass/internal/cli/root.go                      | 11 +++
 .../pass/internal/cli/sync.go                      |  5 ++
 .../warn-priority/cmd/matrix-warn-pp-cli/main.go   | 19 +++++
 .../dogfood-verdict-matrix/warn-priority/go.mod    |  3 +
 .../warn-priority/internal/cli/helpers.go          |  5 ++
 .../warn-priority/internal/cli/root.go             | 17 ++++
 .../warn-priority/internal/cli/sync.go             |  5 ++
 26 files changed, 463 insertions(+), 57 deletions(-)

diff --git a/internal/pipeline/dogfood.go b/internal/pipeline/dogfood.go
index 47cf4a55..3c410f26 100644
--- a/internal/pipeline/dogfood.go
+++ b/internal/pipeline/dogfood.go
@@ -1263,64 +1263,46 @@ func checkPipelineIntegrity(dir string) PipelineResult {
 	return result
 }
 
+type dogfoodVerdictRule struct {
+	verdict string
+	match   func(*DogfoodReport, bool) bool
+}
+
+var dogfoodVerdictRules = []dogfoodVerdictRule{
+	{"FAIL", func(r *DogfoodReport, hasSpec bool) bool {
+		return hasSpec && r.PathCheck.Tested > 0 && r.PathCheck.Pct < 70
+	}},
+	{"FAIL", func(r *DogfoodReport, hasSpec bool) bool { return hasSpec && !r.AuthCheck.Match }},
+	{"FAIL", func(r *DogfoodReport, hasSpec bool) bool {
+		return hasSpec && r.BrowserSessionCheck.Required && !r.BrowserSessionCheck.Pass
+	}},
+	{"FAIL", func(r *DogfoodReport, _ bool) bool { return r.DeadFlags.Dead >= 3 }},
+	{"FAIL", func(r *DogfoodReport, _ bool) bool {
+		return r.ExampleCheck.Tested > 0 && (r.ExampleCheck.WithExamples*100/r.ExampleCheck.Tested) < 50
+	}},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return r.DeadFlags.Dead >= 1 && r.DeadFlags.Dead <= 2 }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return r.DeadFuncs.Dead >= 1 }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return !r.PipelineCheck.SyncCallsDomain }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return len(r.ExampleCheck.InvalidFlags) > 0 }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return r.ExampleCheck.Skipped }},
+	{"FAIL", func(r *DogfoodReport, _ bool) bool { return len(r.WiringCheck.CommandTree.Unregistered) > 0 }},
+	{"FAIL", func(r *DogfoodReport, _ bool) bool {
+		return !r.WiringCheck.ConfigConsist.Consistent && len(r.WiringCheck.ConfigConsist.Mismatched) > 0
+	}},
+	// Pure-logic packages with zero tests fail shipcheck; prompts alone have not kept this invariant reliable.
+	{"FAIL", func(r *DogfoodReport, _ bool) bool { return len(r.TestPresence.MissingTests) > 0 }},
+	{"FAIL", func(r *DogfoodReport, _ bool) bool { return len(r.NamingCheck.Violations) > 0 }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return len(r.WiringCheck.WorkflowComplete.UnmappedSteps) > 0 }},
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return len(r.NovelFeaturesCheck.Missing) > 0 }},
+	// Surface hand-rolled responses without hard-blocking early iteration.
+	{"WARN", func(r *DogfoodReport, _ bool) bool { return len(r.ReimplementationCheck.Suspicious) > 0 }},
+}
+
 func deriveDogfoodVerdict(report *DogfoodReport, hasSpec bool) string {
-	if hasSpec && report.PathCheck.Tested > 0 && report.PathCheck.Pct < 70 {
-		return "FAIL"
-	}
-	if hasSpec && !report.AuthCheck.Match {
-		return "FAIL"
-	}
-	if hasSpec && report.BrowserSessionCheck.Required && !report.BrowserSessionCheck.Pass {
-		return "FAIL"
-	}
-	if report.DeadFlags.Dead >= 3 {
-		return "FAIL"
-	}
-	if report.ExampleCheck.Tested > 0 && (report.ExampleCheck.WithExamples*100/report.ExampleCheck.Tested) < 50 {
-		return "FAIL"
-	}
-	if report.DeadFlags.Dead >= 1 && report.DeadFlags.Dead <= 2 {
-		return "WARN"
-	}
-	if report.DeadFuncs.Dead >= 1 {
-		return "WARN"
-	}
-	if !report.PipelineCheck.SyncCallsDomain {
-		return "WARN"
-	}
-	if len(report.ExampleCheck.InvalidFlags) > 0 {
-		return "WARN"
-	}
-	if report.ExampleCheck.Skipped {
-		return "WARN"
-	}
-	if len(report.WiringCheck.CommandTree.Unregistered) > 0 {
-		return "FAIL"
-	}
-	if !report.WiringCheck.ConfigConsist.Consistent && len(report.WiringCheck.ConfigConsist.Mismatched) > 0 {
-		return "FAIL"
-	}
-	if len(report.TestPresence.MissingTests) > 0 {
-		// Pure-logic packages with zero tests fail shipcheck. This enforces the
-		// plan's R5 gate structurally — the skill prompt alone is insufficient
-		// (agents rationalize skipping tests). See docs/plans/2026-04-13-001.
-		return "FAIL"
-	}
-	if len(report.NamingCheck.Violations) > 0 {
-		return "FAIL"
-	}
-	if len(report.WiringCheck.WorkflowComplete.UnmappedSteps) > 0 {
-		return "WARN"
-	}
-	if len(report.NovelFeaturesCheck.Missing) > 0 {
-		return "WARN"
-	}
-	if len(report.ReimplementationCheck.Suspicious) > 0 {
-		// Hand-rolled responses and empty-stub commands surface as WARN so
-		// they're visible in the shipcheck block without hard-blocking a
-		// run that may legitimately be in an early iteration. Reviewers
-		// upgrade to FAIL when the pipeline integrity check also drops.
-		return "WARN"
+	for _, rule := range dogfoodVerdictRules {
+		if rule.match(report, hasSpec) {
+			return rule.verdict
+		}
 	}
 	return "PASS"
 }
diff --git a/internal/pipeline/dogfood_test.go b/internal/pipeline/dogfood_test.go
index b3d4e4b3..e5a61539 100644
--- a/internal/pipeline/dogfood_test.go
+++ b/internal/pipeline/dogfood_test.go
@@ -597,6 +597,20 @@ func TestDeriveDogfoodVerdict_WiringChecks(t *testing.T) {
 	assert.Equal(t, "PASS", deriveDogfoodVerdict(report, true))
 }
 
+func TestDeriveDogfoodVerdict_PreservesPriority(t *testing.T) {
+	report := passingDogfoodReport()
+	report.AuthCheck.Match = true
+	report.DeadFlags.Dead = 1
+	report.ExampleCheck = ExampleCheckResult{Tested: 10, WithExamples: 4}
+	assert.Equal(t, "FAIL", deriveDogfoodVerdict(report, true))
+
+	report = passingDogfoodReport()
+	report.AuthCheck.Match = true
+	report.DeadFuncs.Dead = 1
+	report.WiringCheck.CommandTree.Unregistered = []string{"orphaned"}
+	assert.Equal(t, "WARN", deriveDogfoodVerdict(report, true))
+}
+
 func TestCheckNovelFeatures(t *testing.T) {
 	t.Run("skipped when no research dir", func(t *testing.T) {
 		result := checkNovelFeatures(t.TempDir(), "")
diff --git a/testdata/golden/cases/dogfood-verdict-matrix/artifacts.txt b/testdata/golden/cases/dogfood-verdict-matrix/artifacts.txt
new file mode 100644
index 00000000..7c7e0dbd
--- /dev/null
+++ b/testdata/golden/cases/dogfood-verdict-matrix/artifacts.txt
@@ -0,0 +1,3 @@
+pass.json
+fail-path-auth-dead.json
+warn-priority.json
diff --git a/testdata/golden/cases/dogfood-verdict-matrix/command.txt b/testdata/golden/cases/dogfood-verdict-matrix/command.txt
new file mode 100644
index 00000000..0ea38e0e
--- /dev/null
+++ b/testdata/golden/cases/dogfood-verdict-matrix/command.txt
@@ -0,0 +1,5 @@
+set -euo pipefail
+cp -R testdata/golden/fixtures/dogfood-verdict-matrix "$CASE_ACTUAL_DIR/fixtures"
+"$BINARY" dogfood --dir "$CASE_ACTUAL_DIR/fixtures/pass" --json > "$CASE_ACTUAL_DIR/pass.json"
+"$BINARY" dogfood --dir "$CASE_ACTUAL_DIR/fixtures/fail-path-auth-dead" --spec "$CASE_ACTUAL_DIR/fixtures/fail-path-auth-dead/spec.yaml" --json > "$CASE_ACTUAL_DIR/fail-path-auth-dead.json"
+"$BINARY" dogfood --dir "$CASE_ACTUAL_DIR/fixtures/warn-priority" --json > "$CASE_ACTUAL_DIR/warn-priority.json"
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/exit.txt b/testdata/golden/expected/dogfood-verdict-matrix/exit.txt
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/testdata/golden/expected/dogfood-verdict-matrix/exit.txt
@@ -0,0 +1 @@
+0
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/fail-path-auth-dead.json b/testdata/golden/expected/dogfood-verdict-matrix/fail-path-auth-dead.json
new file mode 100644
index 00000000..f3916e01
--- /dev/null
+++ b/testdata/golden/expected/dogfood-verdict-matrix/fail-path-auth-dead.json
@@ -0,0 +1,85 @@
+{
+  "auth_check": {
+    "detail": "spec expects \"Bot\" but generated client uses \"Bearer\"",
+    "generated_format": "Bearer ",
+    "match": false,
+    "spec_scheme": "bot token format (expects \"Bot \" prefix)"
+  },
+  "browser_session_check": {
+    "detail": "browser-session auth not required",
+    "pass": true,
+    "required": false
+  },
+  "dead_flags": {
+    "dead": 3,
+    "items": [
+      "deadOne",
+      "deadThree",
+      "deadTwo"
+    ],
+    "total": 3
+  },
+  "dead_functions": {
+    "dead": 0,
+    "total": 0
+  },
+  "dir": "<ARTIFACT_DIR>/dogfood-verdict-matrix/fixtures/fail-path-auth-dead",
+  "example_check": {
+    "detail": "1/1 commands have examples",
+    "tested": 1,
+    "valid_examples": 1,
+    "with_examples": 1
+  },
+  "issues": [
+    "0% path validity against spec",
+    "auth protocol mismatch",
+    "3 dead flags found"
+  ],
+  "naming_check": {
+    "checked": 3
+  },
+  "novel_features_check": {
+    "found": 0,
+    "planned": 0,
+    "skipped": true
+  },
+  "path_check": {
+    "invalid": [
+      "/wrong"
+    ],
+    "tested": 1,
+    "valid": 0,
+    "valid_pct": 0
+  },
+  "pipeline_check": {
+    "detail": "sync uses domain-specific Upsert methods; search methods not found",
+    "domain_tables": 0,
+    "search_calls_domain": false,
+    "sync_calls_domain": true
+  },
+  "reimplementation_check": {
+    "checked": 0,
+    "exempted_via_store": 0,
+    "skipped": true
+  },
+  "spec_path": "<ARTIFACT_DIR>/dogfood-verdict-matrix/fixtures/fail-path-auth-dead/spec.yaml",
+  "test_presence": {
+    "checked": 0
+  },
+  "verdict": "FAIL",
+  "wiring_check": {
+    "command_tree": {
+      "defined": 1,
+      "registered": 1
+    },
+    "config_consistency": {
+      "consistent": true
+    },
+    "workflow_completeness": {
+      "detail": "no workflow_verify.yaml found",
+      "mapped_steps": 0,
+      "skipped": true,
+      "total_steps": 0
+    }
+  }
+}
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/pass.json b/testdata/golden/expected/dogfood-verdict-matrix/pass.json
new file mode 100644
index 00000000..73d5c9e2
--- /dev/null
+++ b/testdata/golden/expected/dogfood-verdict-matrix/pass.json
@@ -0,0 +1,72 @@
+{
+  "auth_check": {
+    "detail": "spec not provided; auth protocol check skipped",
+    "generated_format": "",
+    "match": true,
+    "spec_scheme": ""
+  },
+  "browser_session_check": {
+    "detail": "spec not provided; browser-session auth check skipped",
+    "pass": true,
+    "required": false
+  },
+  "dead_flags": {
+    "dead": 0,
+    "total": 0
+  },
+  "dead_functions": {
+    "dead": 0,
+    "total": 0
+  },
+  "dir": "<ARTIFACT_DIR>/dogfood-verdict-matrix/fixtures/pass",
+  "example_check": {
+    "detail": "1/1 commands have examples",
+    "tested": 1,
+    "valid_examples": 1,
+    "with_examples": 1
+  },
+  "issues": null,
+  "naming_check": {
+    "checked": 2
+  },
+  "novel_features_check": {
+    "found": 0,
+    "planned": 0,
+    "skipped": true
+  },
+  "path_check": {
+    "tested": 0,
+    "valid": 0,
+    "valid_pct": 0
+  },
+  "pipeline_check": {
+    "detail": "sync uses domain-specific Upsert methods; search methods not found",
+    "domain_tables": 0,
+    "search_calls_domain": false,
+    "sync_calls_domain": true
+  },
+  "reimplementation_check": {
+    "checked": 0,
+    "exempted_via_store": 0,
+    "skipped": true
+  },
+  "test_presence": {
+    "checked": 0
+  },
+  "verdict": "PASS",
+  "wiring_check": {
+    "command_tree": {
+      "defined": 1,
+      "registered": 1
+    },
+    "config_consistency": {
+      "consistent": true
+    },
+    "workflow_completeness": {
+      "detail": "no workflow_verify.yaml found",
+      "mapped_steps": 0,
+      "skipped": true,
+      "total_steps": 0
+    }
+  }
+}
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/stderr.txt b/testdata/golden/expected/dogfood-verdict-matrix/stderr.txt
new file mode 100644
index 00000000..a6f63c2a
--- /dev/null
+++ b/testdata/golden/expected/dogfood-verdict-matrix/stderr.txt
@@ -0,0 +1 @@
+warning: no servers defined in spec; generated CLI will require base_url in config
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/stdout.txt b/testdata/golden/expected/dogfood-verdict-matrix/stdout.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/testdata/golden/expected/dogfood-verdict-matrix/warn-priority.json b/testdata/golden/expected/dogfood-verdict-matrix/warn-priority.json
new file mode 100644
index 00000000..fdfb0d38
--- /dev/null
+++ b/testdata/golden/expected/dogfood-verdict-matrix/warn-priority.json
@@ -0,0 +1,81 @@
+{
+  "auth_check": {
+    "detail": "spec not provided; auth protocol check skipped",
+    "generated_format": "",
+    "match": true,
+    "spec_scheme": ""
+  },
+  "browser_session_check": {
+    "detail": "spec not provided; browser-session auth check skipped",
+    "pass": true,
+    "required": false
+  },
+  "dead_flags": {
+    "dead": 0,
+    "total": 0
+  },
+  "dead_functions": {
+    "dead": 1,
+    "items": [
+      "deadHelper"
+    ],
+    "total": 1
+  },
+  "dir": "<ARTIFACT_DIR>/dogfood-verdict-matrix/fixtures/warn-priority",
+  "example_check": {
+    "detail": "1/1 commands have examples",
+    "tested": 1,
+    "valid_examples": 1,
+    "with_examples": 1
+  },
+  "issues": [
+    "1 dead helper functions found",
+    "1 unregistered commands: orphan"
+  ],
+  "naming_check": {
+    "checked": 3
+  },
+  "novel_features_check": {
+    "found": 0,
+    "planned": 0,
+    "skipped": true
+  },
+  "path_check": {
+    "tested": 0,
+    "valid": 0,
+    "valid_pct": 0
+  },
+  "pipeline_check": {
+    "detail": "sync uses domain-specific Upsert methods; search methods not found",
+    "domain_tables": 0,
+    "search_calls_domain": false,
+    "sync_calls_domain": true
+  },
+  "reimplementation_check": {
+    "checked": 0,
+    "exempted_via_store": 0,
+    "skipped": true
+  },
+  "test_presence": {
+    "checked": 0
+  },
+  "verdict": "WARN",
+  "wiring_check": {
+    "command_tree": {
+      "defined": 2,
+      "registered": 1,
+      "unregistered": [
+        "orphan"
+      ]
+    },
+    "config_consistency": {
+      "consistent": true
+    },
+    "workflow_completeness": {
+      "detail": "no workflow_verify.yaml found",
+      "mapped_steps": 0,
+      "skipped": true,
+      "total_steps": 0
+    }
+  }
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/cmd/matrix-fail-pp-cli/main.go b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/cmd/matrix-fail-pp-cli/main.go
new file mode 100644
index 00000000..d0d2bb7d
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/cmd/matrix-fail-pp-cli/main.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	args := os.Args[1:]
+	if len(args) > 0 && args[0] == "agent-context" {
+		fmt.Println(`{"commands":[{"name":"live"}]}`)
+		return
+	}
+	if len(args) > 0 && args[0] == "live" {
+		fmt.Println("Live command\n\nUsage:\n  matrix-fail live [flags]\n\nExamples:\n  matrix-fail live --limit 10\n\nFlags:\n  --limit int   max results")
+		return
+	}
+	fmt.Println("Usage:\n  matrix-fail [command]\n\nAvailable Commands:\n  live\n\nFlags:\n  --help   help for matrix-fail")
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/go.mod b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/go.mod
new file mode 100644
index 00000000..10d26d35
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/go.mod
@@ -0,0 +1,3 @@
+module example.com/matrix-fail
+
+go 1.24
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/live.go b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/live.go
new file mode 100644
index 00000000..26feea87
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/live.go
@@ -0,0 +1,6 @@
+package cli
+
+func runLive() {
+	path := "/wrong"
+	_ = path
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/root.go b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/root.go
new file mode 100644
index 00000000..573f9b02
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/root.go
@@ -0,0 +1,20 @@
+package cli
+
+type rootFlags struct {
+	deadOne   string
+	deadTwo   string
+	deadThree string
+}
+
+func Execute() {
+	rootCmd.PersistentFlags().StringVar(&flags.deadOne, "dead-one", "", "")
+	rootCmd.PersistentFlags().StringVar(&flags.deadTwo, "dead-two", "", "")
+	rootCmd.PersistentFlags().StringVar(&flags.deadThree, "dead-three", "", "")
+	rootCmd.AddCommand(newLiveCmd())
+}
+
+func newLiveCmd() any {
+	return struct {
+		Use string
+	}{Use: "live"}
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/sync.go b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/sync.go
new file mode 100644
index 00000000..a03c556b
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/cli/sync.go
@@ -0,0 +1,5 @@
+package cli
+
+func syncLive(store any) {
+	store.UpsertLive()
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/client/client.go b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/client/client.go
new file mode 100644
index 00000000..65058852
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/internal/client/client.go
@@ -0,0 +1,3 @@
+package client
+
+const authorizationPrefix = "Bearer "
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/spec.yaml b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/spec.yaml
new file mode 100644
index 00000000..ed053b67
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/fail-path-auth-dead/spec.yaml
@@ -0,0 +1,19 @@
+openapi: 3.0.0
+info:
+  title: Dogfood Verdict Matrix
+  version: "1.0"
+paths:
+  /ok:
+    get:
+      operationId: getOk
+      responses:
+        "200":
+          description: ok
+components:
+  securitySchemes:
+    BotToken:
+      type: apiKey
+      in: header
+      name: Authorization
+security:
+  - BotToken: []
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/pass/cmd/matrix-pass-pp-cli/main.go b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/cmd/matrix-pass-pp-cli/main.go
new file mode 100644
index 00000000..c6c6fa6f
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/cmd/matrix-pass-pp-cli/main.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	args := os.Args[1:]
+	if len(args) > 0 && args[0] == "agent-context" {
+		fmt.Println(`{"commands":[{"name":"live"}]}`)
+		return
+	}
+	if len(args) > 0 && args[0] == "live" {
+		fmt.Println("Live command\n\nUsage:\n  matrix-pass live [flags]\n\nExamples:\n  matrix-pass live --limit 10\n\nFlags:\n  --limit int   max results")
+		return
+	}
+	fmt.Println("Usage:\n  matrix-pass [command]\n\nAvailable Commands:\n  live\n\nFlags:\n  --help   help for matrix-pass")
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/pass/go.mod b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/go.mod
new file mode 100644
index 00000000..088e7f8b
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/go.mod
@@ -0,0 +1,3 @@
+module example.com/matrix-pass
+
+go 1.24
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/root.go b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/root.go
new file mode 100644
index 00000000..feaf0b11
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/root.go
@@ -0,0 +1,11 @@
+package cli
+
+func Execute() {
+	rootCmd.AddCommand(newLiveCmd())
+}
+
+func newLiveCmd() any {
+	return struct {
+		Use string
+	}{Use: "live"}
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/sync.go b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/sync.go
new file mode 100644
index 00000000..a03c556b
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/pass/internal/cli/sync.go
@@ -0,0 +1,5 @@
+package cli
+
+func syncLive(store any) {
+	store.UpsertLive()
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/cmd/matrix-warn-pp-cli/main.go b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/cmd/matrix-warn-pp-cli/main.go
new file mode 100644
index 00000000..cb0254b1
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/cmd/matrix-warn-pp-cli/main.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	args := os.Args[1:]
+	if len(args) > 0 && args[0] == "agent-context" {
+		fmt.Println(`{"commands":[{"name":"live"}]}`)
+		return
+	}
+	if len(args) > 0 && args[0] == "live" {
+		fmt.Println("Live command\n\nUsage:\n  matrix-warn live [flags]\n\nExamples:\n  matrix-warn live --limit 10\n\nFlags:\n  --limit int   max results")
+		return
+	}
+	fmt.Println("Usage:\n  matrix-warn [command]\n\nAvailable Commands:\n  live\n\nFlags:\n  --help   help for matrix-warn")
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/go.mod b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/go.mod
new file mode 100644
index 00000000..02d48aa4
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/go.mod
@@ -0,0 +1,3 @@
+module example.com/matrix-warn
+
+go 1.24
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/helpers.go b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/helpers.go
new file mode 100644
index 00000000..b63b6d6f
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/helpers.go
@@ -0,0 +1,5 @@
+package cli
+
+func deadHelper() string {
+	return "unused"
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/root.go b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/root.go
new file mode 100644
index 00000000..82ed1e15
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/root.go
@@ -0,0 +1,17 @@
+package cli
+
+func Execute() {
+	rootCmd.AddCommand(newLiveCmd())
+}
+
+func newLiveCmd() any {
+	return struct {
+		Use string
+	}{Use: "live"}
+}
+
+func newOrphanCmd() any {
+	return struct {
+		Use string
+	}{Use: "orphan"}
+}
diff --git a/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/sync.go b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/sync.go
new file mode 100644
index 00000000..a03c556b
--- /dev/null
+++ b/testdata/golden/fixtures/dogfood-verdict-matrix/warn-priority/internal/cli/sync.go
@@ -0,0 +1,5 @@
+package cli
+
+func syncLive(store any) {
+	store.UpsertLive()
+}

← b54882aa fix(skills): inherit Codex model from ~/.codex/config.toml i  ·  back to Cli Printing Press  ·  refactor(cli): share verify report finalization (#319) ee923f84 →