`verification/cli-preflight-e2e-proof-7fb358c.json`

71 lines
{
  "schema_version": 1,
  "task_id": "cycle-20260908T1121Z.O0jFR4/vienna-cli-guard",
  "ticket": "TK-11299-zero-price-bin-zsh-orderable-regression",
  "intent": "Reject malformed invocations and safely show help before runtime initialization; preserve recognized parser modes",
  "risk_tier": "R1 isolated CLI guard with actual subprocess integration; live inventory R4 remains blocked",
  "environment": "/private/tmp/vienna-cli-guard-l81wngor/worktree",
  "timestamp_utc": "2026-09-08T11:48:04.917315+00:00",
  "baseline_commit": "55f8804fcd7c46032073893bf9724b1f99023739",
  "node_version": "v26.4.0",
  "code_sha256": {
    "apply-fix.mjs": "d806221f4dc7751bf0e7fe35d4d88975ca0a0df67653e012677fb3080c09ee8a",
    "cli-args.mjs": "cf52141b25bf74ff77cd1bd3b9e03bc7976b1df97aca4e2348c3bb1500c97888",
    "test/cli-preflight.test.mjs": "1cedcc7da5904f16c5d66e05120e0addddc4cb6288ad9c0337d4f66375c119df",
    "test/deny-side-effects.cjs": "a02860f2ae9043a3a12f64e394160a5bed24615dbfc5a352afcebb45a9b426fc"
  },
  "commands": [
    "CLI_BASELINE_ENTRY=/Users/macstudio3/Projects/tk-10965-zero-price-analysis/apply-fix.mjs node --test test/cli-preflight.test.mjs",
    "git diff --check"
  ],
  "checks": [
    {
      "name": "Original actual CLI with missing/help/typo arguments",
      "verdict": "PASS",
      "observed": "3 baseline invocations all attempt mkdirSync; preload throws before actual write or credentials"
    },
    {
      "name": "Patched actual CLI invalid arguments",
      "verdict": "PASS",
      "cases": 25,
      "observed": "Exit2, clear usage, zero intercepted filesystem mutation, sensitive-read, network or subprocess attempts"
    },
    {
      "name": "Patched actual CLI help",
      "verdict": "PASS",
      "observed": "Exit0, usage, zero intercepted attempts"
    },
    {
      "name": "Recognized modes parser and actual entry",
      "verdict": "PASS",
      "cases": 7,
      "observed": "Expected parse outputs; actual CLI stops at intercepted mkdirSync only; no real initialization"
    },
    {
      "name": "Deny-hook calibration",
      "verdict": "PASS",
      "cases": 6,
      "observed": "Sensitive read/write, promise read, fetch, HTTPS and subprocess probes each intercepted and denied"
    },
    {
      "name": "Whitespace diff check",
      "verdict": "PASS"
    },
    {
      "name": "Live inventory remediation and runtime integration",
      "verdict": "SKIP",
      "reason": "Outside scope and not approved; exact manifest, bounded executor, explicit write approval including canary still missing"
    }
  ],
  "tests": {
    "passed": 42,
    "failed": 0,
    "skipped": 0,
    "output": "verification/cli-preflight-test-output.txt"
  },
  "boundary_harness": "Preload installed before actual entry imports. Only entry/parser source reads allowed; read-only opens of those source files permitted. Builtin ESM exports synced after fs/network/child-process overrides. First denied call throws. Child environment contains only allowlist; no inherited tokens or NODE_OPTIONS.",
  "initial_harness_issue": "First test attempt blocked Node source-loader openSync too early; corrected by allowing read-only source opens only, then reran all tests. No real sensitive side effects occurred.",
  "cleanup": "Isolated worktree and all artifacts retained; original checkout unmodified; no cleanup deletion",
  "verdict": "PASS for bounded local CLI fix; operational ticket remains UNRESOLVED"
}