[Abiorh001]

Change

WS-CLI-001-52 — Initial ZIP preparation in the contributor TUI

Goal and intent

Continue merged #695 with one usable contributor action: prepare an initial ZIP and inspect intake feedback. A ready admission is not an immutable Submission; this PR never creates one.

Intent, allowed owners, exclusions, design, acceptance criteria and risk routing: WS-CLI-001-52.

What changed

• Fresh Mine work context guards initial preparation; the staged form collects the exact path, optional packet text and externally saved caller UUID.
• Asynchronous local hashing, exact confirmation and explicit save acknowledgment precede one POST through the existing typed client.
• The shared operation checks the reviewed hash before dispatch, verifies the actual streamed digest/count before confirming success and preserves its post-upload source verification. Known early denials remain known denials.
• Explicit unchanged replay, unknown-outcome protection, protected-text clearing on authority loss, truthful storage status and intake feedback.
• Unicode local paths; bounded regular-file input with Unix FIFO and Windows device-path safeguards. No file execution, automatic retry, persistent journal or background polling.
• Current CLI/design/roadmap and initiative boundaries reconciled. Submission creation, revision uploads and contribution browsing remain separate TUI work.

Scope control

Only the existing TUI, preparation client/caller, focused tests and current docs changed. No backend route, schema, dependency or workflow changes. This cohesive L1 change exceeds the preferred size because it includes model/file-input tests, native terminal wire tests and signed PostgreSQL proof; the change record explains the exception.

Evidence — candidate 918549f

This PR remains draft: hosted full CI found a failing existing guide-compilation concurrency assertion in project_lifecycle_c. Diagnosis is in progress; no merge-readiness claim.

• Exact-candidate build, full Go tests, vet and TUI/API race checks passed.
• Native terminal, explicit submission and native-proof regression selection: 124 passed. This covers exact bytes/headers/replay, blocking feedback, delayed corrected-input context, unknown outcomes, changed-file refusal and revoked-access clearing.
• Signed Flow/public API/PostgreSQL: 3 passed, including corrected pending preparation, real verification, ready replay, manager revocation and zero Submission/contribution rows throughout. Temporary database/role cleanup verified. Development failures identified warning-only summary behavior and a generic form-label race; both fixture issues were corrected without changing backend behavior or weakening assertions.
• Ruff check/format, Markdown links, stale wording/authorization/artifact/review scans, Commitrail validation and clean-target inspection passed.
• Hosted native proof passed on Linux amd64, Windows amd64, macOS Intel and Apple Silicon; assembly passed (run40489788373). Artifacts bind the GitHub test merge b371c80, whose parents are the reviewed base and current head. Full Backend run40489788445 is still running; superseded prior-head run was cancelled, not counted as current proof.

The signed drill uses real Flow verification/JWKS fixture, public routes, PostgreSQL and local ART owners; guest rules use an explicitly named in-process fixture. It is not native checker sandbox, S3 or hosted deployment proof.

Test delta

Added file/packet/identity/state guards, platform input safety and native/public-API preparation cases. Existing read-only, Claim/Start, explicit submission and download proofs remain. No skipped tests, weakened gates or removed assertions.

Impact-routed reviewers

Plan review passed before implementation. Initial exact-head review at 3b6509631 found the following issues. All are repaired and replayed at 918549f1c:

• SEC-PREP-001: actual request-stream digest/count now prevents transient changed-and-restored file bytes being confirmed. Added same-size/restored-mtime, incomplete consumption and asynchronous body-close regressions; independent security overlay passes after repair.
• QA-698-001: fresh-form synchronization plus delayed-context corrected-intake regression.
• PROD-698-001: a confirmed receipt cleared after access loss now has neutral wording, not a false not-ready outcome; 401/403/404 regressions.
• DOC-698-001: initiative boundary wording reconciled.

Current clean-head architecture/reuse, security, QA/test delta, product/operations and documentation reviews all pass (security/QA after fixes). Their proof boundaries distinguish executed service/native behavior and stored-row PostgreSQL assertions from source/document consistency; none claims S3, sandbox execution or deployment. Independent stream-guard mutation fails the precise changed-stream/incomplete-body assertions while the complete-body control passes. CI-integrity review found no weakening and verified fail-closed selection/receipt probes; its hosted full-run custody remains pending. Reviews are advisory session evidence, not human approval. Earlier #695 or3b65 reviews are not relabelled to this head.

External review and CI integrity

External review: CodeRabbit skipped review, so it is not fresh review. Current CLI HTTP/API checks and four-platform native proof passed. Full Backend run40489788445 failed project_lifecycle_c: test_concurrent_live_deliveries_converge_on_one_finalization expected the duplicate's intermediate provider_result_accepted_not_persisted status but received policy_draft_ready. Its 479 tests all executed, 478 passed, no skips, cleanup verified. QA is diagnosing the concrete concurrency assumption; no unchanged-code exemption, assertion weakening, or blind retry is being treated as a pass.

• No workflow, lint/test gate, dependency or package-script weakening.
• No new action or checkout credential changes.
• Required hosted checks and exact-head independent human approval remain pending.

Risks and human focus

Caller-owned keys and exact packet/file inputs must be saved outside the session; automatic crash recovery is not implemented. Inspect that a contributor understands the file/packet, blocking versus nonblocking feedback, unknown outcome and the distinction between preparation and Submission. No merge is authorized by this PR.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}