`README.md`

26 lines

# Historical digital Mylar rescope review

**HISTORICAL / PROVISIONAL / VENDOR UNVERIFIED / REVIEW ONLY**

TK-11785 local preparation only. This stdlib CLI reviews immutable copies of an earlier 91-product scope and broad rename plan. The snapshot lacks authoritative vendor and digital-manufacturing fields and an authenticated capture timestamp. It is not a fresh inventory or an operational dry run.

```sh
python3 review.py > verification/historical-review.json
python3 review.py --format markdown > verification/historical-review.md
python3 verify_cli.py
```

The retained snapshot yields **5 provisional candidates, 5 held rows, 81 excluded rows**. All five candidates were **ARCHIVED in the historical snapshot**. Current statuses are unverified. All 91 rows have `vendor_identity: UNVERIFIED`, `digital_method: UNVERIFIED`, and `apply_eligible: false`.

Candidate filtering requires whole-word `Bespoke` AND `Digital` or `Digitally` in the title, plus whole-word Mylar in title or body. A body mention cannot establish either title signal. One title signal without the other is held. No title signals means excluded from this historical proposal; this is not evidence of actual vendor or manufacturing identity. These semantics deliberately avoid guessing which products are digitally manufactured.

Candidate comparisons replace whole-word Mylar with Metallic, preserving initial capitalization and all other text. The old broad plan is used for strict matching of product IDs, statuses and before-values; its proposed after-values are never executed. The report is a human review comparison, not a Shopify mutation payload. Original vendor titles/bodies are retained verbatim as historical evidence, including legacy copy defects; this task does not correct those defects.

`--format markdown` produces readable before/after comparisons plus every hold and exclusion. JSON carries snapshot hashes, complete row dispositions and limitations. Completeness means all rows in these two supplied historical files only. Exit 0 means the input validated and the report rendered; it never means catalog or vendor approval. Invalid, malformed, duplicate, mismatched or tampered input exits 2 with no report on stdout.

The CLI defaults to `snapshots/` and a pinned manifest SHA256 in `review.py`. The manifest pins both file hashes. Snapshot files are retained read-only and committed. This protects accidental drift, not adversarial provenance: changing both bytes and the trust pin does not establish authority. Alternative bundles require a separately reviewed manifest pin with `--manifest-sha256`; the schema is the retained manifest. No credentials, API imports, network integrations or apply option exist. Output goes to stdout only.

The real CLI proof runs separate subprocesses over copied input files, JSON and Markdown modes, repeatability, positive title controls, body-only/substring negative controls, malformed JSON, duplicate keys/IDs, mismatched IDs/status/before-values, unexpected fields, invalid text, count mismatch and hash failures. An audit hook rejects socket creation and child execution in CLI processes; a positive control proves the socket tripwire fires. Evidence and input fixtures remain in `verification/`; no cleanup or source-project changes occur.

Remaining dependency: obtain a **current authoritative read-only export with vendor and digital-manufacturing classification** to validate exact scope. Reading that export is a technical dependency, not inherently an approval gate. Any later customer-facing rename requires exact mutation approval and its own current-state, rollback and live verification. This repository has no apply capability and cannot complete that operation. Parent independent acceptance and review are recorded on the ticket; source completion is not claimed.