cli(ui): make preflight, fields, and refusals clear before testing

[TusanHomichi]

Pre-tester dependency of #132

Maintainer direction on 2026-09-08 moves this work into the pre-tester usability floor. It is a supporting dependency of #132's existing limited-preview deliverable, not an additional launch deliverable. Clear preflight/refusal output must be available to the first external tester, and implementation can proceed alongside the protected survey and public-universe work.

Scope before external testing

1. render typed preflight failures as structured actionable output without discarding typed detail;
2. unify field labels, headings, and empty states; and
3. unify structured refusal layout across package, repository, generation, and system surfaces.

Core continues to own typed facts; apps/conary/src/ui/ owns rendering. This issue does not change compatibility, safety, mutation, publication, query, or scheduling authority.

Acceptance criteria

• Typed preflight details survive human and strict machine rendering.
• Field labels, headings, and empty states share one vocabulary and layout contract.
• Refusals name the exact typed cause, affected identity/path, and safe next action where one exists.
• TTY, pipe, NO_COLOR, snapshot, and output-vocabulary proofs pass.
• Durable frames in docs/operations/daily-driver-ux-matrix.md are updated.

Refs #132, #640.

[TusanHomichi]

PR #958 merged as f71f9b13336dcf3dcc157709ed80c40bac7918d7, following progress renderer #957. First-use mutation refusals now preserve the exact command and mutation class as a typed error, with one shared human layout and ANSI-free daemon display. Database/conflict diagnostics and pending-publication warnings use the UI owner; mutation and publication authority are unchanged.

All 41 hosted checks passed on reviewed head 6a1435d2e04f60d15efee5f64d06543c39b6d6cf, including the provisioned workspace suite and native distribution jobs. Both PR branches are deleted.

This is partial completion. Next: typed preflight/signature failures with affected identities and safe actions, retaining the same typed detail in strict machine rendering. Shared fields/headings/empty states and refusal coverage across package, repository, generation, and system surfaces remain open. #132 tracks the broader first-use sequence and grouped transaction summary.

[TusanHomichi]

Starting the next bounded diagnostic slice after #958.

Evidence: verify_manifest_signature collapses signer identity and all timestamp-policy failures into VerifyError::TrustViolation(String); the untrusted signer includes Rust Option debug text. read_authority_document also stringifies V3ValidationError, losing its diagnostic fields before presentation.

Scope: preserve typed trust-policy causes and archive-path context in core verification, retain v3 validation errors, and render these plus existing typed host-capability preflight failures through ui::diagnostics. Trust and lifecycle checks remain owned by core. No new machine-output command or persisted schema is introduced; strict machine command wiring and cross-command field unification remain open in #644.

Proof: core verifier/v3 tests for exact typed fields and refusal-before-object-ingestion, real CLI terminal/pipe/NO_COLOR captures, UI diagnostics and daily UX/snapshot/vocabulary tests, package interaction checks, workspace lint and documentation gates. The verifier's growing inline tests will move to verify/tests.rs as required by the repository's test-placement rule.

[TusanHomichi]

PR #959 merged through the protected path as 9fe7f44a104ca0044a4af1e3e5bf9f30f68b99af.

Landed:

• Typed CCS trust-policy causes, archive and invalid-policy paths, and complete v3 authority diagnostics survive verification context.
• Human output identifies the cause, affected input, claimed signer/public key, timestamp limits, or existing host-capability requirement and next action. Displayed facts escape control characters while the underlying error retains its original fields.
• Failed ccs verify emits no success preamble. Trust checks and lifecycle requirements remain core-owned; untrusted packages cannot commit CAS payload objects.
• Signature-age limits compare across the full u64 policy range without wrapping through i64.

All 41 hosted checks passed on final head 48b8f04d6899683382bd841f593286e80819d5f8, including the full provisioned workspace suite and every distribution job. Automated review completed with no findings. Local focused core/UI/CLI/conversion/test-hooks proofs and lint/documentation gates passed; the 27 existing local host failures are documented in #733. The branch is deleted and main is clean.

#644 remains open: strict machine command rendering, additional refusal surfaces, and consistent fields/headings/empty states still need implementation. Next acceptance boundary is a versioned machine presentation using the retained typed facts through the agent contract, without parsing human text. #132 also retains the grouped install/update/remove/rollback summary work.

[TusanHomichi]

Next #644 slice: add ccs verify --json and the local packaging MCP conary.packaging.verify_artifact adapter over one quiet verification service.

conary-agent-contract will own a versioned, strictly decoded request/result vocabulary with disjoint verified/failed outcomes. The application maps core verification errors exhaustively, retaining signer claims, public keys, timestamps/limits, full authority diagnostic fields, input/policy paths, and unclassified cause chains. Human summaries and next steps remain UI-owned. Result data never grants a verified archive or mutation capability.

The MCP input requires an explicit policy, avoiding implicit local-dev key maintenance in a read-only tool. The CLI retains its existing optional local-dev policy behavior. JSON mode emits one object and preserves failure exit status without appending a second human error. Remi and persisted authority schemas are unchanged.

Proof: strict contract round trips/rejection cases, CLI success/failure/TTY/pipe/NO_COLOR captures, quiet missing-input/policy/invalid-archive reports, MCP schema and structured failure adaptation, existing human diagnostics, owning package tests, workspace lint, and documentation truth. #644 remains open for other command surfaces and field/empty-state work.

[TusanHomichi]

PR #960 merged through the protected path as 9a875f28b9a173117ad4a32178b29121d22b85df.

Landed:

• ccs verify --json emits one versioned, strictly decoded report with disjoint verified/failed outcomes. Failures preserve exit status 1 without a duplicate human error.
• Core signature/trust, timestamp limits, budget, authority diagnostics, and input/policy paths survive as typed machine data. Successful reports include exact compressed archive identity and verified package/signer facts.
• Local MCP conary.packaging.verify_artifact uses the same quiet service with a required explicit policy, advertised output schema, matching structured/text reports, and a failure flag. Reports remain observations and grant no install/publication authority.
• Strict decoding rejects extra fields even on empty cause variants; raw fields survive independently of human display escaping.

All 41 hosted checks passed on final head ce327c494f5a3ae78a1ec0919db36290064709f0: https://github.com/FieldmouseWorks/Conary/actions/runs/34263383464. Automated review completed; its text-fallback concern was checked against pinned rmcp 3.1.2, covered by an explicit passing assertion, answered, and resolved. Local focused proofs and lint/documentation gates passed. Full local Conary proof had 1,248 passed, 27 known host-dependent failures, and 5 ignored; exact evidence is recorded in #733. Branch cleanup is complete; main is clean and matches origin, with no open PRs.

#644 remains open for typed machine/refusal coverage on other first-use surfaces and consistent fields, headings, and empty states. #132 also retains the grouped install/update/remove/rollback preview/apply summary. The next acceptance boundary is to continue that first-use journey using core-owned facts and shared UI rendering.

[TusanHomichi]

Read-only evidence for the remaining collection empty-state portion of #644: cmd_update_group skips pinned installed members before selecting updates, and records uninstalled members separately, but its empty updates_to_apply branch still prints All members of collection ... are up to date when neither adopted nor security-only wording applies (apps/conary/src/commands/update/collection.rs). A collection containing only pinned or uninstalled members therefore reaches wording that overstates what was checked.

#961 fixes the later request-result summary (preview/apply/no-change/failure), while this earlier selection empty-state remains part of #644. The next empty-state slice should use the retained selection reasons and prove pinned and uninstalled-member fixtures without claiming all installed versions are current.