# Arcadia CLI Windows authoring preview — validation

Version0.2.0-preview.authoring.20260911; tag cli-v0.2.0-preview.authoring.20260911.

ZIP SHA256: `2b051f8ce1ea4f59ee7e233e1fbd516d423aadbfbca5d549755cbe78fcde1af6`.

Semantic build source01b76a1; packaging assemblya0a48e8; integrated/reviewed release checkpoint27df4a3. These have distinct recorded roles; the latter commits are not original compiler-input claims.


---

# Source-only CLI baseline — 2026-09-11

Codex-9e8r6t /root/palette_finish. Root authorized only new `crates/oa-cli`, its focused integration tests and this report. Root owns workspace membership, lockfile and public documentation. No grammar/schema/core/desktop change is part of this slice. The external source-language experiment remains a separate unratified design.

Read AGENTS, current issue1 through #143, existing local usability audit, external `release-textual-authoring-design-20260911.md`, and core source/session/file APIs. The independent reviewer supplied the loader's stabilized-warning/provisional-ID trap and verified journal/migration/no-op boundaries. Their review is `release-source-cli-review-20260911.md`.

## Proposed command contract implemented for validation

```
arcadia check ROOT [--json]
arcadia lint ROOT [--json]
arcadia stabilize ROOT [--write] [--json]
arcadia rename-alias ROOT OLD NEW [--write] [--json]
```

ROOT is the explicit entry file. No project discovery, editor, server or network is required. Check and lint are equivalent admission plus engineering-diagnostic commands. A valid model with warnings returns success. Mutation commands preview by default; `--write` explicitly saves the candidate captured and displayed/reported by that same invocation. Missing IDs in an earlier separate preview are provisional: another invocation may allocate different IDs until saved. There is no persisted apply-plan protocol in this baseline.

Exit0 means valid/success (warnings permitted),1 means invalid source or rejected semantic alias command,2 means usage,3 means disk/path/conflict/pending journal or output failure. Pending-save diagnosis is obtained from the production loader's `pending_save` code, not a copied journal-name calculation. Invalid raw source is never migrated, stabilized or renamed.

Human output places located diagnostics/status/notes on stderr and per-file unified diffs on stdout. With `--write`, the human candidate is flushed before the saver is invoked. JSON output is a single versioned envelope containing diagnostics, status, exit code, write result, exact changed before/after text, unified diffs, missing-identity count and a separate structured source-migration report. JSON after a failed save retains the proposed diff with `written:false`; a failed save can require explicit recovery and is not a blanket rollback guarantee. Diagnostic locations are half-open UTF-8 offsets into the named coordinate space; input line/column are one-based Unicode scalar coordinates. Related locations carry exact byte spans. Command/disk errors without a responsible source token explicitly have no source location.

The raw `lint_bundle` diagnostics are authoritative for source positions. Loader-only discovery/IO/path/pending errors are retained; successful-loader warnings from stabilized compilation are discarded. Unpersisted lint object IDs are omitted so they cannot be mistaken for the later candidate's freshly allocated IDs. Explicit authored object IDs remain available. Post-compilation/update errors identify their candidate coordinate space rather than claiming to point into original bytes.

## API and safety boundary

`load_project` captures original byte expectations and discoverable source, then `lint_bundle` validates raw reachable text. On success, `compile_bundle` stabilizes identities and performs supported core migrations. Alias rename resolves the existing global alias and uses `prepare_command(SetAlias)` plus `update_bundle_with_identity_map`; it does not replace text blindly. The initial migration report is retained before the updater recompiles current source. The complete raw-to-final diff shows identity insertion, supported source migration and rename together while their summary fields remain distinct. There is no canonical formatter fallback or new file writer.

`Prepared` privately owns the original DiskProject and final CompiledSourceProject. Its consuming `write` invokes `source_files::save_project`, including for an empty diff. The saver rechecks pending journal and every captured dependency before its existing no-op return, preserving conflict and journal guarantees. No CLI path calls `recover_project`. The inherited contract is recoverability with entry committed last; it is not cross-process compare-and-swap, simultaneous multi-file visibility, or a Windows power-loss durability claim. Detached files are never deleted by this wrapper. No directories/files are created by a preview.

Admission limits match desktop policy:256 files, include depth32/edges1024,64MiB aggregate UTF-8,100000 graph objects,250000 records and500000 ordered references. These are exposed in help; no performance acceptance is inferred. The per-file diff uses a linear common-prefix/suffix algorithm with one hunk and three context lines, avoiding quadratic LCS memory on large files. Far-apart changes can produce a large hunk; JSON also preserves exact full changed-file texts and newline bytes.

Dependencies are existing `oa-core`, workspace `serde` and `serde_json`; no new registry package. Root added workspace membership, then granted the serialized Cargo window. Cargo.lock gained only the local `oa-cli`0.2.0 package and those three existing dependencies. Source formatting was limited to this crate.

## Focused acceptance and executed validation

Twelve integration tests cover the complete externally authored 40-identity alarm model; preview nonmutation and one-time exact ID-only stabilization; a same-invocation captured write; CRLF/comments/omitted defaults and no-op mtime/inventory; three-file semantic alias rename with independent complete-model alias-only expectation; invalid Unicode raw diagnostics and no writes; raw missing-ID warning locality/provisional-ID suppression; external change before write and before a no-op write; pending journal at load and after preview with untouched sentinel; rejected and same-alias rename; supported source5 migration separately reported through rename; and explicit root/machine-readable usage errors. Additional cases cover invalid UTF-8, unavailable includes, unsupported/invalid old source, non-element alias rename, a changed dependency absent from the proposed diff, and exact retention of a detached invalid file. Some tests contain several linked assertions, but this is twelve test functions, not an invented larger native acceptance count.

The complete example fixture is the frozen external authoring experiment, not a new CLI-generated model. No new syntax or broad text-usability acceptance is ratified. Large-model timing, persistent review-plan application, reparent/navigation/LSP, migration to a future grammar and publication packaging remain outside this baseline.

The Windows GNU/LLVM toolchain selected by `.local/toolchain/env.ps1`, existing target and `CARGO_BUILD_JOBS=1` ran these gates:

| Gate | Result |
| --- | --- |
| `cargo test --offline -p oa-cli --all-targets -- --test-threads=1` | Initial compilation succeeded;11/12 tests passed, exit101,58.621s total. The remaining fixture used unsupported `/* block comment */` syntax. |
| `cargo test --locked --offline -p oa-cli --all-targets -- --test-threads=1` | After changing only that fixture to a supported line comment: **12/12 passed**, exit0,13.783s total /1.88s test execution. |
| `cargo clippy --locked --offline -p oa-cli --all-targets -- -D warnings` | Passed,136.447s initially (including core compilation). Independent review then corrected a note that incorrectly described changed-file output as a complete project candidate. Final strict pass:10.245s. |
| `cargo build --locked --offline -p oa-cli --bin arcadia` | Final wording-matched executable built successfully,9.734s. |
| `rustfmt --check --edition 2024` on the three crate Rust files | Passed. |
| Staged executable `--help` / `--version` | Successful; version `arcadia 0.2.0`. |

No production behavior was changed to accommodate the invalid block-comment fixture. The failed initial log remains preserved. The final note explicitly promises complete proposed **changed-file** text/diffs and disclaims a saved plan or digest of unchanged dependencies. Source-file expectations still capture every dependency, including those absent from the diff. No whole-project hash/apply protocol was added. The final wording-only change was compiled and strictly linted; the twelve semantic integration cases precede that wording change.

Immutable staging directory: `.local/source-cli-20260911/verified/`. Its `arcadia.exe` is **20312064 bytes**, SHA256 **`BAD169F8BE78DCFA74B32714569C886DD2132727080684FC2BA618D5822E3559`**. Sibling `libunwind.dll` is190976 bytes, SHA256 `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. `manifest.json` records source/workspace/lock/runtime/log identities; SHA256 `DD73FC2BB2190B23FFFE16D6C63D4ACDDF52338062FAC298379DDFD241D82EB8`. The matching test artifact is `.local/target-gnullvm/debug/deps/source_cli-343cec8034acf06e.exe`, SHA256 `F740CA81D0C60DEC4AA6A2BC36D3F7035844590FAB59E88F63A7F4ABE3F78AEF`.

Logs and separate exact command/exit/time JSON records remain under `.local/source-cli-20260911/`:

| Log | SHA256 |
| --- | --- |
| `tests-initial.log` | `00378D96D09A95265B09C9C7C12CB09A610E46055AC36FFD9ACEF3265965D56C` |
| `tests-final.log` | `A18B708B89FE715951201D9046C414080E0820BDC9C6DC9EDE9CF3AB84E37C04` |
| `clippy-initial.log` | `A3B5A7F051CF51B812BF5D4D0917E5CEFBD25CCCAD4033BAABD7EB36FCCFA72A` |
| `clippy-final.log` | `29C23E6372447D06EF68A5B161F323F80109024CEE3BB7AEC85F421530BD1564` |
| `build.log` | `B0968196245C5302F2576C087551E3F92071F85314E60512117BC632EED20742` |

Cargo lease was explicitly released to root/desktop owner after all gates terminated. Files remain uncommitted for root integration. The independent reviewer has the immutable executable for isolated no-compile falsifiers; that review is recorded separately and is not silently included in these author-run counts. No Linux CLI execution, native GUI or broad text-authoring release acceptance is claimed.

Independent review subsequently completed on the frozen BAD169F8 executable: **183 assertions across21 process invocations passed**, with no remaining implementation blocker. It covered all seven persistent identity families, exact header/live-reference changes with comment/quoted-alias retention and40 original UUIDs, saved/no-op source/mtime, raw CRLF/Unicode second-declaration warning offsets, explicit/provisional warning IDs and invalid non-BMP reference scalar columns. This is reviewer-owned evidence, not an addition to the author's12 tests: `harness/release-source-cli-review-20260911.md`, SHA256 `475645DB76CD193F2FC1CC1BDDAB57CCB0A724A62779A60C1E2AF0F756929344`; result `harness/experiments/source-cli-independent-20260911/result.json`, SHA256 `7F772FAB0E58C9901D9B87D7553C605C84E5DD2B234123C14EFD5B1BAF46DA9C`. The review discloses its corrected initial harness naming clash. Gitea issue1 comment176 records the handoff.


---

# Source CLI: independent contract review before implementation

Codex-9e8r6t `/root/behavior_audit`, 2026-09-11. Read-only review of the existing core and the proposed CLI contract; no production edits, Cargo, direct rustc, native input, or CLI test execution. `/root/palette_finish` owns `crates/oa-cli`. Root owns integration and release acceptance.

Reviewed AGENTS.md, issue #1 through #143, the empty open-PR list, Wiki `Authoring20260911`, and the imported `release-textual-authoring-design-20260911.md`. Inspected core is the working tree at HEAD `4bb4aaf3dc47b9738625b4d3f23ef8c74f286395`; this review did not inspect the author's evolving CLI implementation. References below are relative to the repository root. Existing tests are evidence of intended contracts, not newly executed results.

The proposed slice is coherent: explicit entry file; `check`/`lint` against original bytes; `stabilize` and semantic `rename-alias` preview by default; `--write` uses the same prepared candidate and the loader's original disk expectations. It does not select a new grammar, namespace scheme, identity policy, or source7 constructor defaults. The external design identifies this as useful immediate infrastructure, not completion of the text-only usability objective.

## Material traps

### 1. P1 — Loader diagnostics do not uniformly describe the raw files it returns

`source_files::discover_missing` retains original file text and bytes, then calls `compile_bundle` to populate `DiskProject.diagnostics` when discovery has no earlier diagnostic (`crates/oa-core/src/source_files.rs:528`). Compilation inserts missing UUIDs and reindexes the returned text (`source_project.rs:286`). Consequently, a successful load can return **raw files with warning spans from stabilized files**. Appending those warnings to raw lint output duplicates warnings and can point an editor beyond the intended declaration.

The existing counterexample is two missing-ID functions in one included file: a warning for the second function moves when the first UUID is inserted. `crates/oa-core/tests/source_project.rs:207` explicitly distinguishes these positions. Use `lint_bundle(snapshot.reachable_bundle(), limits)` as the semantic diagnostic authority for original bytes. Preserve loader-only discovery, encoding, path, and pending-save failures; replacing every loader diagnostic with lint would turn invalid UTF-8 into a less useful missing-file complaint or lose the journal refusal. Do not blindly reuse the loader's compiled semantic warnings.

There is a second identity dimension: `lint_bundle` calls `compile_once`, and `Parser::optional_id` allocates fresh UUIDs for omitted clauses (`language.rs:1226`). A raw lint warning's `object_id` can therefore differ from the later compiled candidate's UUID even though its raw position is correct. JSON must either omit such provisional identities, identify their provenance explicitly, or deliberately map them to the candidate. It must not imply that an independently allocated lint UUID identifies the record in the diff. Explicitly authored IDs remain stable.

The same separation applies to a failure during stabilization or migration after raw lint succeeds, such as the inserted IDs exceeding the source-byte budget. Its candidate-location diagnostic must not silently be presented as an original-buffer span. Spans are half-open UTF-8 byte offsets; line/column are one-based, with column counting Unicode scalar values (`language.rs:107`, `source_project.rs:640`).

Status: sent directly to the CLI author and root before implementation.

### 2. P1 — Keep the captured write baseline, including for no-op writes and failures

The correct write authority is the original `DiskProject.expectations`, which records bytes **before** stabilization (`source_files.rs:43`). Do not reload after preparation or replace those expectations with candidate bytes. Either would discard evidence of an intervening editor change. Check every captured dependency, including a file the proposed rename does not change.

An empty diff is not permission to skip `save_project`: the core checks the pending journal and all original expectations before its no-write return (`source_files.rs:880–902`). A prepared no-op followed by an external edit must refuse, rather than report an up-to-date successful write. A successful unchanged write should perform no file replacement and create no journal.

The core promises recoverability and checks for observed external changes, **not** a cross-process CAS, multi-file atomic visibility, or Windows power-loss durability (`source_files.rs:1–18`). A noncooperating writer can change a file between a check and its replacement. Different entry files can also have overlapping dependencies without sharing one journal. Neither this CLI nor its diff adds a stronger guarantee. No extra locking design is required for this bounded slice; describe the actual guarantee accurately.

Distinguish invalid-input refusal before saving from a disk failure during saving. `save_project` can have written files, attempted rollback, or left a pending journal when recovery cannot finish. Exit 3 must retain the specific conflict/recovery outcome and must not always claim that nothing was written. The saver may recover its own failed transaction internally; the CLI must not automatically recover a pre-existing transaction.

Status: author already proposed original expectations and no CAS claim; the empty-diff bypass and failed-write wording are explicit acceptance boundaries.

### 3. P2 — Preserve migration evidence before the rename updater removes it

`compile_bundle` can perform a targeted upgrade of accepted source3–6 in addition to UUID stabilization. The migration can add semantic defaults and generated interface allocations, not merely change a version token (`source_project/source_migration.rs:4–105`, `persistence.rs:15`). Capture this initial `decoded.migration` before applying `SetAlias`.

`update_bundle_with_identity_map` recompiles the already-upgraded bundle at `source_project.rs:1016`. The final schema7 result has no new migration report. Reading only `final_candidate.decoded.migration` would therefore hide the fact that a rename also upgraded the project. Preserve the initial report separately and show the complete original-to-final file diff, including generated declarations and defaults. The same-alias command may still change source through stabilization or migration; `changed` must compare original and final bytes, not only the semantic rename result.

The bundle parser explicitly admits source3–7 (`language.rs:1404`). Source1/2 migration belongs to the separate single-string legacy API; `tests/source_project.rs:605` explicitly proves those inputs are rejected by `compile_bundle`. Do not silently fall back to `language::parse` plus canonical export: that changes format, ownership, trivia, and the advertised command. State the supported input versions and retain unsupported/invalid raw files unchanged.

Source7 omitted defaults keep their existing meanings, including Scenario viewpoint `MixedLegacy`. CLI stabilization must not adopt a more helpful inferred viewpoint, allocation, parent, or occurrence order. Existing constructor-default probes and the external design are consistent on this boundary.

Status: sent directly to author/root; the author already intends explicit migration presentation.

### 4. P2 — A missing-ID preview is a proposal, not a persisted plan for a later process

Compiling the original missing-ID files twice allocates different UUIDs; the external design's executed probe already establishes this. Prepare the candidate once per invocation, and pass that exact model/bundle/index to saving. Do not regenerate a rename from raw files after displaying its diff or select the target by an ID allocated during the separate raw lint pass.

Resolve `OLD` by its exact stored alias in the compiled project's full identity namespace, then use `prepare_command(Command::SetAlias(...))` and its `identity_map` with the source updater. That namespace includes project, elements, relations, diagrams, placements, artifacts and traces; display names are not unique identity selectors (`model.rs:1727`, `session.rs:170,607,816`).

Separate preview and `--write` invocations may produce different *uncommitted* UUIDs. The author proposes disclosing this and deferring persisted plans, which is adequate for this slice. Do not describe `--write` as applying the previous invocation's exact patch. Once stabilized source has been written, repeated preparation must preserve all IDs. Never make name/path/content-derived IDs to conceal the preview difference.

For already stable source7, alias rename must change only the chosen stored alias and live reference tokens, preserving UUIDs, display names, comments, quoted prose, historical UUID literals, source membership and all other fields. Alias-like text inside a description is not a reference. The core updater already has the appropriate token behavior (`tests/source_project.rs:877`); do not implement a parallel text replacement algorithm.

Status: author explicitly accepted the per-invocation limitation and semantic updater path.

### 5. P2 — Journal and warning policy must survive the loader-to-CLI boundary

The existing loader appends a located `pending_save` diagnostic from the actual private journal path (`source_files.rs:534–547`). Use that diagnostic rather than recreating the journal naming convention. Loading itself is read-only but may compile internally before detecting the journal, so the accurate promise is refusal before the CLI prepares/adopts/writes a candidate, not detection before any load/compile work. The saver independently checks again. A pending journal remains a refusal even when source has no proposed change or contains a syntax error. Reserved stage/completed directories alone are not pending transactions.

The proposed policy—warnings exit 0, invalid source exit 1, usage exit 2, disk/conflict/journal refusal exit 3—matches core admission for structural errors versus engineering warnings (`session.rs:276`). Missing allocation, an empty scenario, or another allowed partial model must not become unsaveable merely because warnings exist. Conversely, raw invalid UTF-8/syntax, unresolved required references, unsupported versions, and path violations must never be replaced by a canonicalized or partially accepted bundle. Preserve their bytes and any pending journal. If an IO failure is represented as a discovery diagnostic, classify it consistently instead of assuming every diagnostic means exit 1.

`lint_bundle` may stop at the first syntax/conversion error, and structural-error admission returns errors rather than all engineering warnings (`source_project.rs:580–612`). A JSON result is not an exhaustive list of every defect; the CLI must not claim otherwise. Refactoring argument errors (absent source alias, invalid/reserved/colliding destination alias) likewise require a clear nonzero refusal with zero writes; distinguish command diagnostics from real source positions.

## Compact independent acceptance matrix

These are proposed CLI contract tests, not newly executed results. Compare complete `Project` and `SourceBundle` where a candidate exists, plus exact disk bytes for refusal/no-op cases.

| Case | Exact expected result |
| --- | --- |
| Raw diagnostics | Include a file with two missing-ID functions, CRLF and Unicode before a warning. Check/lint human and JSON locations select the original declaration; no stabilized warning duplicate or false candidate UUID. Explicit-ID version retains its real object identity. |
| Invalid discovery and pending save | Invalid UTF-8 include, missing include, syntax failure, and real captured `pending_save` separately retain disk bytes and useful loader diagnostics. Pending save also refuses an otherwise no-op write; unrelated stage/completed directories do not imply pending recovery. A journal appearing after preparation is refused by saving. |
| Missing-ID rename | Resolve an alias across includes, prepare once, and save that exact candidate. Readback is byte-for-byte candidate source and equal model with its exact IDs. A later fresh process can resolve the new alias. Two unwritten preparations may have different fresh IDs; the documented preview limitation is visible. |
| Stable alias rename and rejection | Existing UUIDs, duplicate display names, comment/prose containing the old alias, an `@` reference separated by a comment, and a non-element alias target. Only intended alias/live reference tokens change. Unknown `OLD`, invalid/reserved/colliding `NEW` refuse without writing. |
| Exact no-op and stale dependencies | Stable source7 stabilization and same-alias rename produce an empty diff and preserve exact bytes/line endings. Prepare the same no-op, edit or delete an unchanged dependency, then call the save boundary: exit 3 with no overwrite of the external bytes. |
| Migration and admission | A valid old bundle with all UUIDs explicit still shows its migration and full diff for a real or same-alias rename. The report survives the updater. Source1/2 and invalid old-source drafts stay untouched. A candidate exceeding its budget after insertion is refused without a false raw location or any write. |
| Warning-only acceptance | A permitted unallocated function or empty explicit-viewpoint scenario reports warnings and exits 0 for check/preview/write; acceptance does not invent allocations, change viewpoint, or populate steps. Structural errors exit 1 and preserve exact input. |
| Detached disk files | A no-longer-reachable `.arcadia` file from a prior Undo remains byte-identical. The explicit entry's reachable source alone defines the model; do not recursively add or delete unrelated files. Ordinary exact no-op compares the reachable bundle while separately proving the retained disk file unchanged. |

No implementation blocker requires a core redesign. The actionable work is to preserve the distinct raw-diagnostic, compiled-candidate, original-disk-expectation, and migration-report contracts in the adapter. Root should request an independent implementation review after the CLI source freezes; this report is not CLI or release acceptance.

## Frozen implementation review and independent process evidence

Codex-9e8r6t `/root/behavior_audit`, 2026-09-11. This section supersedes only the earlier **unreviewed implementation** status. Reviewed the final `crates/oa-cli/src/lib.rs`, `src/main.rs`, all 12 author tests and their terminal logs, the relevant unchanged core parser/updater/saver paths, issue #1 through #170, Wiki `Authoring20260911`, and the empty open-PR list. Read the user's updated remote `AGENTS.md` blob `d93cddacdd45341abb7bbea1d3e3fd4493484d9e`, including coordinated milestone prereleases; root retains release ownership. No production edits, Cargo, rustc compilation, native input, commit, or push was performed for this review.

**Result: no remaining blocker found in this bounded CLI slice.** One presentation claim was corrected during review. The actual write and diagnostic boundaries preserve the prepared contract; broader text authoring and release acceptance remain separate.

### Corrected finding: P3 — describe the changed files, not a whole-candidate identity

The first candidate note said that the invocation's candidate was shown in full, while `Report.changes` contains only changed files. Two projects with different unchanged include bytes can therefore yield identical changed-file output. This is expected for a diff report, but the note overstated what it identified. The author corrected `lib.rs:353` to describe complete proposed **changed-file** texts/diffs and explicitly disclaim a saved plan or unchanged-dependency digest. Root confirmed that no persisted-plan or digest protocol was selected; this review does not require one.

Unchanged dependencies are still protected when saving. `Prepared` keeps the original `DiskProject` and compiled candidate in private fields; `Prepared::write` always calls `source_files::save_project` (`lib.rs:179–205`). It has no empty-diff bypass and does not reload or substitute expectations. The core checks all captured expectations (`source_files.rs:799–816,884`) and the actual journal before its no-write return at 902. Thus an include absent from `changes` is not absent from the write precondition. The author separately exercised a changed unchanged include and a captured no-op changed after preparation; those are author test results, not independent runtime claims from this review. No cross-process CAS guarantee is added.

### Other contracts traced to their actual implementation

- **Raw diagnostics and identities:** loader-only discovery/encoding/path/journal diagnostics survive; raw `lint_bundle` supplies semantic spans; stabilized loader warnings are filtered (`lib.rs:224–270`). Successful raw warnings retain object IDs only when those IDs were authored in the input. Invalid raw text returns before declaration analysis/updating, and later candidate failures explicitly say `candidate`. Independent process probes below exercise the shifted-second-declaration and non-BMP-column counterexamples.
- **Semantic alias coverage and source preservation:** target resolution uses the compiled project's complete identity namespace, then `prepare_command(SetAlias)` and `update_bundle_with_identity_map` (`lib.rs:307–338`). It never uses an independently allocated lint UUID as its target. The core covers project, element, relation, diagram, placement, artifact and trace identities. Independent exact-source probes cover all seven, with comments and quoted old aliases deliberately retained.
- **Migration/default boundary:** the adapter captures the initial migration report before the semantic updater (`lib.rs:305`), compares original raw text with the final candidate, and has no canonical-export, legacy-parser, inferred-viewpoint or implicit-allocation fallback. Bundle admission remains source3–7; source1/2 are not silently converted. The author's source5 rename test verifies migration retention and original-to-final diff. This review inspected the other admitted-version branches but did not independently execute a full source3–7 constructor matrix.
- **Refusal and output:** `--write` consumes the same in-process candidate. Invalid source/commands use exit 1, usage 2, and path/conflict/journal/output failures 3; engineering warnings remain exit 0. A detected pending save is authoritative even when the source is invalid or the proposed write is unchanged. The CLI does not call `recover_project`. Human mode flushes its preview before saving; JSON returns the operation's final report. Failure wording correctly avoids equating `written=false` with guaranteed rollback. Separate missing-ID invocations remain distinct uncommitted proposals, explicitly disclosed.

### Independently executed frozen-binary probes

Ran the author's immutable Windows executable `.local/source-cli-20260911/verified/arcadia.exe`, 20,312,064 bytes, SHA-256 `BAD169F8BE78DCFA74B32714569C886DD2132727080684FC2BA618D5822E3559`, with its supplied `libunwind.dll`. The executable hash was checked before and after the run. No compiler was used.

Command:

```powershell
& harness/experiments/source-cli-independent-20260911/probe.ps1 -Repository 'C:\Users\User\Documents\Git\ARCADIA-Studio'
```

**183 assertions passed across 21 fresh CLI invocations.** The script computes every expected alias edit before the first mutation and writes only isolated `.local/source-cli-independent-20260911/verified/` fixture files. It refuses to overwrite a prior run directory; a new `-RunName` allows a separate repeat. Evidence lives in `harness/experiments/source-cli-independent-20260911/`: `probe.ps1`, `alias-input.arcadia`, `alias-expected-final.arcadia`, and `result.json` with individual assertions, commands, outcome counts and hashes.

| Independent case | Observed result |
| --- | --- |
| All seven identity families | Project `alarm_response`, element `maintenance`, relation `alarm_message`, diagram `response_view`, placement `detector_card`, artifact `response_procedure`, and trace `assessment_refinement` each previewed and wrote exactly the precomputed declaration/live-reference token changes. All 40 existing UUIDs, display names, other fields, comments, quoted aliases and source ownership remained byte-exact under the independent expectation. |
| Preview, repeat invocation and stable no-op | Every preview left its input unchanged; each separate write of already-stable input matched its predicted preview exactly. Fresh final check succeeded. Stabilization then returned `unchanged`, no diff and `written=false`, preserving bytes and modification time and leaving no unexpected physical file. |
| Raw warning position versus stabilized candidate | Two missing-ID SA functions in one CRLF include with Cyrillic, CJK and non-BMP text produced exactly two raw `unallocated_leaf` warnings, without loader-warning duplicates or provisional IDs. The second candidate declaration genuinely shifted after UUID insertion; its reported warning remained at the original input byte offset. Explicit-ID variants retained the exact authored warning IDs. |
| Invalid Unicode reference | A non-BMP symbol before an unresolved reference distinguished UTF-8 byte offsets, Unicode scalar columns and UTF-16 units. The write attempt reported the exact original reference position, exit 1, no changes, no ephemeral identity, and preserved the complete input bundle bytes. |

The first harness launch stopped before starting the CLI because PowerShell's built-in `cli` alias resolved to `Clear-Item` instead of the intended helper. With stop-on-error, the missing literal `check` path stopped that invocation before the isolated source argument was handled. The helper was renamed to `Invoke-ArcadiaProbe`; the final clean run above passed. This was a harness error, not a product failure. The initial isolated input directory is retained; no production or original example file was passed to that mistaken command.

The author's separate gate is **12/12 tests passed**, 1.88 seconds execution, plus strict all-target Clippy, formatting and matching build. I read their preserved initial 11/12 log: the failed fixture used unsupported block-comment syntax, then was corrected to supported line-comment syntax without a product change. These compiled gates remain attributed to `/root/palette_finish`.

This independent run proves exact source-byte predictions and process/report behavior for the stated cases. It does **not** claim an independent full-`Project` oracle, adversarial simultaneous-writer proof, exhaustive source-version/default coverage, Linux execution, native GUI usability, packaging or release acceptance. Those limits do not create an additional blocker for this bounded source CLI adapter.

Reviewed source fingerprints:

| File | SHA-256 |
| --- | --- |
| `crates/oa-cli/src/lib.rs` | `97BEBAB63B4A611A1D36AD0C20FE452CBE1985FE3A6FBD39C954603DA11410FC` |
| `crates/oa-cli/src/main.rs` | `DE964F9B6C59C0F31C080AFBD3B31D442B07B1B44F6A187A248D3409C45D35FB` |
| `crates/oa-cli/tests/source_cli.rs` | `A3A1B856C7A9FD3D80BC8074150A24FBB0EF0E9DDF736C7CEA036725FC3DC2B8` |
| `crates/oa-core/src/source_files.rs` | `669491DBDDB8E8E6556161426DFFA1A49AC1C826D31020BFF0956D81A4D84683` |
| `crates/oa-core/src/source_project.rs` | `1394370BCC5908873B830C2C11312E6E1611AF41F46C4F43CA0A6BCB713BB466` |


---

# Standalone CLI Windows packaging — 2026-09-11

Owner: Codex-9e8r6t /root/palette_finish. Root authorized implementation and isolated packaging; native acceptance, independent review, publication and credentials remain outside this worker's lease.

## Implementation and safety boundary

`scripts/package-cli-windows.ps1` creates a distinct `ArcadiaCLI-<version>-<target>.zip` from the prebuilt `arcadia.exe`. It requires an explicit build-evidence file and target, preserves the existing output-claim/no-overwrite behavior, checks the executable and runtime imports before staging, rechecks inspected hashes while copying, writes notices and checksums, and performs full deterministic ZIP membership/hash readback. Its returned acceptance status remains Pending.

The shared ordinary PE32+ reader, system-DLL allowlist, target/runtime selection and recursive ordinary-import check now live in `package-common.ps1`. The existing Studio packager has only the mechanical call-site replacement. Required files receive the existing ordinary-file/reparse check before inspection. Unknown imports, including unknown transitive runtime imports, still fail. Dynamic/delay imports remain a runtime-acceptance boundary. Common staging, notice, checksum and build-evidence helpers are reused; the new ZIP helper uses the existing reviewed Windows archive/readback algorithm.

`Get-ArcadiaNotices` adds only `oa-cli` to its allowed roots. Its default remains exactly `oa-desktop,oa-server`; the CLI entry point explicitly requests `oa-cli`. All locked/offline graph, local-source, crate archive, embedded-font, checksum-bound supplement, Rust and runtime requirements remain active. No registry dependencies or new license fallback were added.

The document helper accepts `--product cli`; omitted/default `studio` retains its original roots. CLI roots contain the CLI contract, language source/HTML, complete text-first example and complete linked release1 model/evidence. This avoids shipping the release1 walkthrough without the model it tells readers to copy. Relative document links are traversed and checked using the existing helper. The CLI README distinguishes packaged executable usage from source-checkout Cargo instructions and from Studio-specific example controls. No parser, core, CLI executable source, desktop behavior, common guide or grammar edits were made.

## Focused verification

Commands use the configured PowerShell and bundled Python, without Cargo or native application execution:

```powershell
& scripts/test-package-cli-windows.ps1
& scripts/test-windows-notices.ps1
& 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe' scripts/test-package-artifacts.py
```

- **15 inert Windows/CLI assertions passed:** system imports, CLI-only binary set, missing Studio/server inputs, gnullvm runtime requirement, unsupported target, unknown direct/transitive imports, wrong PE architecture, runtime/license closure, build-evidence hash/target mismatch, exact deterministic ZIP, overwrite refusal preserving bytes, and input mutation after inspection.
- **13 Python packaging tests passed**, including the original ELF/archive/document/notice invariants, explicit CLI transitive document closure and refusal, complete linked modular example selection, and exact default-versus-explicit Studio document roots. Initial run 0.954 seconds; after complete-example/readme refinement, final 1.252 seconds.
- **Expanded existing notice suite passed**, including explicit CLI graph selection, unchanged desktop/server defaults and unknown-root rejection, together with prior normal/build/dev selection, Linux-server notices, runtime/source/font/supplement safety cases.
- The extracted helper was also applied to the actual frozen D4D9 Studio, EFEE server and F456 runtime. Its complete import lists match the prior frozen Studio package metadata exactly.

Logs are under `.local/cli-packaging-20260911/`: `windows-initial.log`, `notices-initial.log`, `artifacts-initial.log`, `artifacts-final.log`. No failed compiler/package gate is hidden here; none has occurred at this checkpoint. The source diff's two whitespace-only helper lines were removed before staging.

## Exact source and artifact assembly

The semantic source basis is published commit `01b76a1e89e93b7992f39e63560aa8b2ca2f69e0`. An isolated checkout at `.local/cli-packaging-20260911/source` adds packaging-only auxiliary commits `8619708105c1851df58690c605001e22100a26ea` and `a0a48e82bd43be181caca1fe2c1514c21f2bc405`. The latter is the assembly basis, not an original compiler-input claim. Main-tree packaging edits remain for root integration; these private commits do not publish anything.

`prepare.py` independently verified six recorded CLI input hashes (root Cargo manifest/lock, CLI manifest, library, main and integration test), and 95 unchanged core/shared build input hashes. It copied and rehashed the frozen executable and runtime. `preparation.json` retains these input comparisons. Original evidence is `.local/source-cli-20260911/verified/manifest.json`; original build command was `cargo build --locked --offline -p oa-cli --bin arcadia`, successful at `2026-09-11T11:45:43.6035381Z`, duration 9.7336637 seconds. Prior author 12-test/strict-Clippy gates and independent 183 assertions/21 process invocations are recorded in their respective source-CLI reports, not rerun or reattributed by packaging.

| Input | Bytes | SHA256 |
| --- | ---: | --- |
| `.local/source-cli-20260911/verified/arcadia.exe` | 20312064 | `bad169f8be78dcfa74b32714569c886dd2132727080684fc2ba618d5822e3559` |
| `.local/source-cli-20260911/verified/libunwind.dll` | 190976 | `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4` |

Compiler evidence is Rust 1.98.1 commit `48a229ceaefd4985c50990b14116b6d856af0985`, Windows gnullvm, LLVM22.1.8; the frozen executable embeds that compiler path. Prior inventory compared the current toolchain and 58 target-library hashes. This is preserved development-profile output, not a release-profile or reproducible-build claim. `build-evidence.json` distinguishes the semantic source and later packaging assembly basis explicitly.

## Strict package and frozen handoff

After release_audit's final GUI/format gates terminated, it explicitly granted the metadata slot. The isolated invocation `.local/cli-packaging-20260911/package.ps1` passed on its first run, starting `2026-09-11T12:36:52.6900250Z`, finishing `12:37:33.7683084Z`, duration **41.084165 seconds**. No semantic binary build or native application execution occurred. The slot was explicitly released at terminal completion.

Frozen archive: `.local/cli-packaging-20260911/packages/ArcadiaCLI-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm.zip`.

| Result | Measured value |
| --- | --- |
| ZIP bytes | **5091267** |
| Package files | **114** |
| SHA256 | **`2b051f8ce1ea4f59ee7e233e1fbd516d423aadbfbca5d549755cbe78fcde1af6`** |
| Strict notice graph | **27 packages**, sole declared root `oa-cli` |
| Original CLI lock hash | `2b960242c33eb839ff008d01731f6d5cdb4e047ca8cd6e13151cbf9c09913510` |
| Checked local documentation links | **9** |
| Full ZIP membership/hash readback | **PASS** |
| Native acceptance returned by script | **Pending** |

`assembly.json` records final packaging-file hashes after the explicit-entry README correction and supersedes the initial packaging-file subset in `preparation.json`; both retain the original semantic input comparison. `package-initial.log`, `package-initial-result.json`, `build-evidence.json`, the package directory and sibling checksum retain the measured run. The ZIP and stage are frozen. Root and the independent reviewer received the exact identity and source boundary. Clean extracted CLI execution and independent review belong to that reviewer; publication belongs to root. Neither is claimed by this author result.


---

# Independent CLI packaging review — 2026-09-11

Codex-9e8r6t /root/behavior_audit. **PASS; no material finding in the bounded shared-script/default and packaged-CLI review.** Root owns integration and publication. No production edits, Cargo/rustc, GUI/native input or credentials were used.

## Source/default compatibility

Reviewed the nine packaging paths in auxiliary assembly `a0a48e82bd43be181caca1fe2c1514c21f2bc405` over semantic source `01b76a1e89e93b7992f39e63560aa8b2ca2f69e0`. The assembly diff contains exactly those nine script/readme/test paths; the reviewed main-tree files match their frozen assembly bytes. Individual hashes are in the private result.

- `Read-PackagePeImports` is byte-equivalent to its predecessor after function-name/line-ending normalization. The system DLL allowlist is unchanged. Required files now receive the shared ancestor-reparse check before inspection. Both the requested executable and packaged runtime are inspected, preserving refusal of unknown direct/transitive ordinary imports.
- Studio still passes exactly `arcadia-studio.exe` and `arcadia-server.exe`. Its complete pipeline after input inspection is unchanged, including evidence, documents, notices, copying and archive handling. Linux packaging and both Docker files are unchanged.
- Every original Python helper other than document product selection/argument dispatch is AST-equivalent, including ELF, tar, document-link and notice validation. Independently executed the old and new document selectors on the same frozen assembly: implicit Studio, explicit Studio and original behavior return exactly equal full file/source mappings for **Windows 65 files** and **Linux 64 files**. These counts describe that source snapshot, not the earlier Studio ZIP's document count.
- The notice collector's only source delta is adding `oa-cli` to the root allowlist. Its signature still defaults to `oa-desktop,oa-server`; the rest of its body is unchanged. The CLI entry point explicitly selects only `oa-cli` and requires explicit build evidence.
- The new Windows archive helper retains create-new/refusal behavior and full archive readback. CLI document roots include complete text-first and linked release1 examples. The CLI README correctly separates packaged executable usage, provisional preview identities, explicit writes and source-checkout Cargo instructions.

The author's separate 15 inert Windows assertions, 13 Python tests and expanded notice suite remain attributed to that worker's runs; they were not relabeled as independent executions here.

## Frozen archive and provenance

Freshly extracted `.local/cli-packaging-20260911/packages/ArcadiaCLI-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm.zip` into the reviewer's separate `.local/cli-packaging-review-20260911/extracted/` directory.

| Artifact | Bytes | SHA256 |
| --- | ---: | --- |
| CLI ZIP | 5,091,267 | `2b051f8ce1ea4f59ee7e233e1fbd516d423aadbfbca5d549755cbe78fcde1af6` |
| `arcadia.exe` | 20,312,064 | `bad169f8be78dcfa74b32714569c886dd2132727080684fc2ba618d5822e3559` |
| `libunwind.dll` | 190,976 | `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4` |

All **114 files**, ZIP CRCs, ordinary normalized members, fixed timestamps, extracted bytes and complete checksum inventory passed. All **108 package input hashes** match, with exactly six generated package records remaining. No Studio/server executable is included. Shipped docs/examples/public license and the CLI-specific README match the assembly bytes.

The **27 reported dependency package identities/checksums** agree with the historical CLI lock, whose SHA256 remains `2b960242c33eb839ff008d01731f6d5cdb4e047ca8cd6e13151cbf9c09913510`. Roots are exactly `oa-cli`. All **60 distinct notice-reference files** match their hashes; the runtime notice binds the shipped DLL. Complete local-crate and shared build inputs also match the inventory. The original CLI manifest's **six inputs** and **95 original core/shared build inputs** match the isolated source. These comparisons corroborate the declared preserved development build and later packaging-only assembly; they do not establish a reproducible build or independently rerun Cargo dependency resolution.

## Independent extracted CLI execution

The first gate passed **156 assertions across 10 subprocess invocations**, **12:42:56–12:43:12 UTC**. The absolute extracted executable ran with only package directory plus Windows/System32 on PATH, private TEMP/TMP, and SystemRoot/WINDIR. Tests used disposable example/source copies outside the package.

1. `--version` reported the underlying application version `arcadia 0.2.0`; `--help` listed the check, stabilization, semantic rename and preview/write contract.
2. `check --json` accepted both complete packaged text-first and release1 examples without changing any copied example byte.
3. A separately authored modular CRLF/Unicode fixture had three fixed IDs and one missing activity ID. Default stabilization preview left all physical files unchanged. Explicit stabilization wrote only the ID attached to the literal intended activity, preserving every other character, name, comment, reference and known detached file. Preview and write UUIDs were treated independently, as documented.
4. Renaming `crew` to `rescue_team` first previewed without mutation, then changed exactly the actor declaration alias and typed allocation source. Quoted `@crew`, comments and display names remained unchanged. Complete expected file contents were specified independently; all four final IDs remained exact and ordered.
5. Explicit no-op stabilization reported unchanged, preserved all bytes and retained every source file's modification timestamp. An explicit stabilization of invalid source exited 1 and preserved the original invalid bytes.
6. All **114 extracted package files** and the frozen ZIP were unchanged after execution.

No gate failed or required a retry. This is package/runtime acceptance of the already preserved BAD169F8 CLI, not a rerun of the earlier 183-assertion semantic review, every source migration, cross-process conflict behavior, or Linux runtime acceptance.

## Evidence

Private `.local/cli-packaging-review-20260911/` retains the independent checker, structured source/artifact/runtime results, complete expected fixture texts and every subprocess stdout/stderr. Both JSON report exit codes and actual process exits were checked.

| Evidence | SHA256 |
| --- | --- |
| `review.py` | `f85d1f34ab75b4067efe09886e447bf9fd54dc232020bcb1a46404ec57b2351e` |
| `result.json` | `3b92a816a62de386b5927b208c79c2a7c541e6e2e2e30bde31b4c11bbbc4509e` |

The generated activity identity is `9ba9e3cd-96f5-4f9a-865e-6b31ba94b4e6`; the result records its literal declaration binding and the three initially fixed IDs. Complete final physical source hashes are retained, including the unchanged detached file. No packaging staging directory, frozen artifact, common documentation, producer report or source was modified by this reviewer.