feat(cli): prepare initial ZIPs in contributor workbench

.commitrail/INDEX.md

@@ -11,7 +11,7 @@ for current product capability.
 | [WS-AGENT-001](initiatives/WS-AGENT-001/OVERVIEW.md) | Planned | Neutral document tools plus OpenAI Agents SDK and OmniCoreAgent original-guide qualifications are delivered through the same public API, durable worker, parser and MinIO path. Retain the exact external provider/account and selected-image AWS evidence, then prove the broader hosted Flow contribution journey before deployment claims. |
 | [WS-DB-002](initiatives/WS-DB-002/OVERVIEW.md) | Complete | Shared UUIDv7 record generation, native-UUID relationships and fresh v0.1 baseline; natural-owner retry custody and aligned CI/local setup |
 | [WS-MCP-002](initiatives/WS-MCP-002/OVERVIEW.md) | Planned | 108 tools through WS-MCP-002-12 cover access, guide setup, contributor workspace, contribution policies, checker/artifact operations and task execution/submissions; task operations/imports and assembled release proof remain. |
-| [WS-CLI-001](initiatives/WS-CLI-001/OVERVIEW.md) | Planned | Public Go CLI setup, contributor/manager workflows, administrative and operational commands, Finance policies and contribution exports are detailed in the overview; -43 proves the connected local unpaid automated-acceptance journey. -44 prepares four native release archives and a gated manual publisher; -47 hardens its administrator-bypass guard. First publication and public-asset audit remain operational work. -46 adds the separate system-reader project catalogue; -48/-49 add contributor navigation, findings and verified guide downloads; -50 establishes the reading workbench. -51 bounds confirmed Claim/Start and direct collection navigation. TUI ZIP preparation/submission, automatic crash-safe recovery, contribution evidence, management, public human-review controls and hosted proof remain separate. Current revision context never substitutes for historical evidence. |
+| [WS-CLI-001](initiatives/WS-CLI-001/OVERVIEW.md) | Planned | Public Go CLI setup, contributor/manager workflows, administrative and operational commands, Finance policies and contribution exports are detailed in the overview; -43 proves the connected local unpaid automated-acceptance journey. -44 prepares four native release archives and a gated manual publisher; -47 hardens its administrator-bypass guard. First publication and public-asset audit remain operational work. -46 adds the separate system-reader project catalogue; -48/-49 add contributor navigation, findings and verified guide downloads; -50 establishes the reading workbench. -51 adds confirmed Claim/Start and direct navigation; -52 adds initial ZIP preparation/feedback with exact reviewed inputs. TUI immutable Submission/revision writes, automatic crash-safe recovery, contribution evidence, management, public human-review controls and hosted proof remain separate. Current revision context never substitutes for historical evidence. |
 | [WS-ARCH-001](initiatives/WS-ARCH-001/OVERVIEW.md) | Planned | Public admission-backed initial/remediation Submission entry and supported false-policy guide activation are implemented over selected production delivery. New false/pass effects require LIVE REV; a known pre-effect non-live refusal has bounded retry, with exhausted delivery dead-lettered. The [bounded local public/worker drill](initiatives/WS-ARCH-001/planning/PLAN.md#first-complete-contributor-milestone) starts from public guide inputs with recorded inference; hosted operation and live human review remain. |
 | [WS-ART-001](initiatives/WS-ART-001/OVERVIEW.md) | Planned | Verified input/output custody, exact-cause replacement and public admission-backed ZIP/Submission entry are delivered. The bounded local public/worker drill passed; hosted operation and setup-fault handling remain separate. |
 | [WS-AUTH-001](initiatives/WS-AUTH-001/OVERVIEW.md) | Planned | Exact fixed-router custody, checker remediation and checker retry are delivered. The ART Operator backend prerequisite adds exact system-Operator artifact reads and independently guarded verification retry; WS-CLI-001-43 consumes all nine public ART operations, while hosted S3 proof remains separate. Public entry and supported false-guide activation use current exact AUTH/SQL custody; human decision authority remains later work. |

.commitrail/initiatives/WS-CLI-001/OVERVIEW.md

@@ -67,7 +67,8 @@ ordered locked-guide selection with explicit verified single-document download.
 visible collections/sections, readable instructions and truthful page/evidence
 states; it changes no public operation or lifecycle authority.
 Contribution evidence remains an inert CLI handoff. Claim/start is bounded by
--51 below; other product mutations, management screens and their recovery remain
+-51 and initial ZIP preparation by -52 below; other product mutations,
+management screens and their recovery remain
 separate TUI boundaries; this
 interface does not depend on first binary publication or system-wide discovery.
 
@@ -80,16 +81,19 @@ the existing TUI and typed API client, not a second client or simulated demo.
 
 1. [WS-CLI-001-51](WS-CLI-001-51.md): direct collection navigation and deliberate
    claim/start using existing public writes, exact confirmation, caller-owned
-   replay keys and uncertain-outcome recovery. This is the current bounded work.
-2. ZIP preparation: explicit local package selection, summary/attestation,
+   replay keys and uncertain-outcome recovery.
+2. [WS-CLI-001-52](WS-CLI-001-52.md): explicit local ZIP selection, summary/attestation,
    actual intake feedback and exact replay. Preparation is not Submission.
 3. Submission and continuation: deliberate immutable creation, current outcome,
    checker remediation and only API-supported human revision responses. No
    automatic acceptance, hidden mutation route or invented reviewer workflow.
 4. Contribution evidence: inspect the contributor's returned records and awards
    inside the workbench, retaining the distinction from fulfillment.
 
-Only the first boundary is specified for implementation now. Each following
+The initial ZIP preparation boundary is specified by
+[WS-CLI-001-52](WS-CLI-001-52.md): fresh assigned context, exact packet/file hash,
+separate confirmation, intake feedback and explicit unchanged replay. Immutable
+Submission creation and revision uploads are not part of that slice. Each following
 boundary needs inspected API/replay contracts, its own bounded record and native
 public-API proof before starting. A durable automatic recovery design is needed
 before replacing caller-owned saved keys with generated keys; the current CLI
@@ -108,7 +112,7 @@ and separate guide-bound review/revision policy configuration. The commands
 the existing public writes with caller-owned replay keys and policy `If-Match`.
 The backend owns manager authorization for new writes, policy semantics, replay and activation;
 editing/configuring a guide does not approve or activate it. Other public API
-client gaps and the broader TUI beyond -51 remain separate work. Binary distribution's
+client gaps and the broader TUI beyond -52 remain separate work. Binary distribution's
 workflow is prepared by -44; a protected release run and public-asset audit
 remain operational work.
 
@@ -461,7 +465,8 @@ CLIs. Keep the package independent of backend and MCP runtime dependencies.
 26. **Optional TUI:** -48 supplies contributor navigation through existing typed
    reads; -49 adds findings pages and confirmed verified guide downloads; -50
    redraws this same contributor boundary for readable work and evidence states.
-   In-TUI Evidence, product writes and management remain
+   -51 adds deliberate claim/start; -52 adds initial ZIP preparation.
+   In-TUI Evidence, immutable Submission/revision writes and management remain
    separate boundaries; Evidence first needs a shared typed single-page client
    port without changing complete CLI exports. Never require a TUI for agents
    or scripts.

.commitrail/initiatives/WS-CLI-001/WS-CLI-001-52.md

@@ -0,0 +1,152 @@
+# WS-CLI-001-52 — Prepare an initial ZIP in the contributor workbench
+
+- Initiative: `WS-CLI-001`
+- Durable disposition: `Planned`
+- Intended merge outcome: Let contributors explicitly prepare an initial ZIP, inspect intake feedback and replay the exact preparation without creating a Submission.
+
+## Intent
+
+After the merged Claim/Start slice, the human asked to move forward. The next
+bounded step is packaging/intake, not a second submission implementation or a
+claim that the complete TUI journey is delivered.
+
+## Current behavior
+
+Main `517fe54c4` contains deliberate TUI claim/start. The existing typed
+`api.Client.PrepareSubmission` streams one regular file, validates the packet,
+returns intake feedback, checks source changes and supports explicit caller-key
+replay. `task prepare` is its current consumer. Mine rows retain assignment IDs;
+WorkContext confirms current-actor assignment but does not expose that ID.
+
+## Bounded change
+
+### Allowed
+
+- Existing `cli/internal/tui/` model, rendering, request port and focused tests.
+- Existing `cli/internal/api/submission.go` and its tests: an explicit optional
+  expected SHA-256 argument to the same preparation operation, checked against
+  its existing pre-send source hash. Update `command/submission.go` to pass no
+  expected hash, preserving explicit CLI behavior; affected command test fakes.
+- Focused native HTTP/public-API preparation tests and existing terminal fixtures
+  only as needed, with unchanged strict defaults. Current CLI/design/roadmap and
+  initiative/index documentation.
+
+### Not allowed
+
+Backend/API wire/auth/policy/storage changes; immutable Submission creation;
+revision uploads or inferred predecessor selection; management, Review or awards;
+polling, automatic POST retries, file execution, recursive file picker, automatic
+UUID generation, generic operation journal, compatibility paths, CI weakening,
+new dependencies or user-file writes.
+
+## Design and decisions
+
+- From fresh Mine Overview for an observed `in_progress` task, offer Prepare.
+  On deliberate entry, freshly read exact WorkContext and require matching
+  actor/project/task, assigned-to-current-actor and no revision context. Bind the
+  selected Mine assignment ID; UI observations never replace backend guards.
+- Use a compact staged form: regular ZIP path, exact optional summary and
+  attestation, caller-owned UUID saved outside the session. Blank optional text
+  means omitted; preserve printable ASCII text exactly and reject invalid input
+  rather than trimming or silently converting it. Explain current API limits.
+- Inspect/hash the selected regular file asynchronously, bounded at 512MiB, with
+  cancellation checks and safe errors. No disk work on resize or row movement.
+  Local paths support valid Unicode without control characters; the API's ASCII
+  restriction applies to packet headers, not filenames. Use narrowly scoped
+  platform-specific opening where required to reject nonregular sources without
+  blocking the supported Linux, macOS or Windows terminal process.
+  Confirmation shows exact actor/project/task/assignment, path, bytes, SHA-256,
+  packet text and key. Only explicit save acknowledgment and `y` send one POST.
+- Extend the existing shared preparation client with an expected SHA-256 input
+  so a file changed after confirmation is rejected before dispatch. Retain its
+  existing post-send source verification and unknown-outcome semantics.
+  Verify the exact count and digest of bytes consumed by the request stream
+  before confirming a successful receipt. Before/after file hashes alone miss
+  a transient write restored before the final check. Synchronize body reading,
+  closure and digest inspection; incomplete successful uploads remain unknown.
+  A known denial may legitimately occur before reading the body.
+  The expected hash is checked inside `PrepareSubmission` after its own first
+  hash and before request creation, with a context cancellation check, not only
+  in the TUI before a later independent hash. Open
+  source handles inside commands, close on every path; no background descriptor
+  stored in render state. No simulated upload percentage.
+- Freeze the complete packet and file fingerprint for send/replay. Unknown
+  outcomes prohibit replacement by a new packet/key; only explicit unchanged
+  replay is offered. A replaced/changed file is not a replay. A local pre-send
+  refusal must not erase an earlier uncertain server result. Pending work blocks
+  navigation/duplicate dispatch; quit cancels the client, not server effects.
+- Reuse existing bounded action outcomes/navigation/security clearing, extending
+  operation-specific state only where upload inputs differ. No parallel generic
+  mutation framework. Preserve the delayed-read401 dispatch guard from -51.
+- Display ready admission separately from all non-ready storage states; include
+  successful warnings and canonical blocking intake feedback. Every result says
+  no immutable Submission was requested. No success on malformed/transport
+  errors. Authorization denial clears protected text and disables replay while
+  retaining only minimal inert recovery identities; never render bearer/errors
+  unsanitized. Recover after restart through caller-saved exact inputs and CLI.
+  Clearing a previously confirmed ready receipt must not relabel it not ready;
+  report confirmed-but-cleared evidence without exposing the protected details.
+- A ready receipt exposes its admission and exact packet for an inert CLI
+  submission handoff, not an executable shell command or automatic submission.
+  Do not claim historical preparation browsing or persistent recovery.
+
+## Acceptance criteria
+
+- Initial in-progress Mine task can prepare a real ZIP and display ready,
+  non-ready and failed-intake results with findings; no Submission POST occurs.
+- Cancel/resize/paste/navigation never sends implicitly. Corrected failed intake
+  may start a new deliberately confirmed operation; unknown result cannot.
+- Exact task/assignment/packet/key/hash are retained for explicit replay. A file
+  modified after confirmation sends no POST; modifications during send cannot
+  produce a confirmed success. Stale responses and delayed auth failures cannot
+  reopen a write or restore protected content.
+- Existing Claim/Start, reads, downloads, pagination and noninteractive CLI
+  contracts pass unchanged. Text fields accept literal q and pasted content as
+  text, never shortcut execution; bounded/plain/minimum rendering remains usable.
+- Native built-binary HTTP tests assert ZIP bytes/headers, no automatic retry,
+  failure/non-ready/unknown/changed-file/revoked paths. A signed public API native
+  drill uses isolated PostgreSQL and existing artifact fixture to prove failed
+  intake, ready preparation, exact replay, revocation and zero Submission rows.
+  Storage fixture proof must not be labelled real S3; hosted MinIO proof remains
+  separately identified. Run relevant Go tests/vet/race and full hosted checks.
+
+## Risk and review routing
+
+- Risk class: L1 (file input, contributor mutation, uncertain outcomes).
+- Plan review before implementation; architecture/reuse, security, QA/test-delta,
+  product/docs and CI-integrity if shared native fixture/selection is affected.
+- Human focus: can a contributor identify the ZIP/packet, understand intake
+  findings and distinguish preparation from submission without hidden actions?
+- No new human decision is required by this bounded scope; no merge authorized.
+- Size exception: the cohesive file-input operation needs model/API tests,
+  native terminal wire proof and signed PostgreSQL owner proof together. This
+  exceeds the preferred L1 diff size; no backend, schema or workflow changes
+  are included. Review those proof layers separately against the same candidate
+  rather than splitting the safety guards from the operation they protect.
+
+## Evidence
+
+Existing API/client/CLI proof is discovery evidence, not TUI runtime proof. New
+focused tests must discriminate changed-file dispatch and implicit duplicate
+requests, and preserve the existing signed/native Claim/Start tests. Exact-head
+commands and reviewer results belong in the PR, not this durable record.
+
+The signed native drill must construct an app from production Flow verifier
+settings plus the fixture's exact ART namespace/local-store/scratch settings and
+isolated database. Install only the fixture JWKS transport; leave DB/AUTH/TASK
+owners unoverridden. If reused, name `LocalIntakeAdapter` explicitly as the
+in-process guest-rule fixture, not sandbox execution. First send a canonical
+failed-intake packet and assert feedback/zero Submission. Then use a fresh saved
+key and valid ZIP/packet: pending verification -> direct invocation of the real
+ART verifier -> exact native replay -> ready admission. Revoke through a
+distinct signed manager and replay to prove fresh denial/clearing. POST
+`put_attempt_id` is not GET preparation ID; the verifier consumes the former.
+Do not invent a detail lookup or infer replay identity from the latest list row.
+
+## Reconciliation
+
+Build on merged -51; no overlapping open TUI PR was found. Preserve main's hosted
+checker and unrelated work. Next usable boundary: deliberate immutable Submission
+creation from a ready preparation, then outcome/revision navigation and Evidence.
+Caller-owned saved inputs remain a documented recovery limitation, not crash-safe
+automatic recovery. Do not begin those next chunks automatically.