chore(cfl): enforce final presenter boundary for #271

[rianjs]

Summary

• Add package-wide AST enforcement for cfl presenter-boundary violations with narrow allowlists for init/root/prompt exceptions.
• Update durable presenter-boundary docs and artifact-contract wording now that cfl default text output is presenter-backed.
• Add final feat(cfl): establish the same presenter-boundary architecture as jtk #271 proof with grep output, live smoke excerpts, mutation cleanup evidence, and child proof index.

Closes #437

Verification

• rtk go test ./tools/cfl/internal/cmd/root ./tools/cfl/internal/present ./shared/present
• rtk go test ./tools/cfl/... ./shared/...
• rtk golangci-lint run ./tools/cfl/... ./shared/...
• rtk proxy git diff --check
• Issue-required grep gates documented in docs/proofs/271-437-final-enforcement.md
• Live smoke documented in docs/proofs/271-437-final-enforcement.md

[rianjs]

Findings

• Blocker: presenter_boundary_test.go is still only a source-pattern gate. It checks a small set of selector names and fmt sinks, but it does not resolve import aliases or catch other direct output paths (os.Stdout.Write, io.WriteString, helper wrappers, log.*, etc.). That means a command can still violate the presenter boundary and keep this test green. For a ticket whose main deliverable is final executable enforcement, I don’t think this is enough proof by itself.

[monit-reviewer]

PR review failed and the daemon has stopped retrying for this commit. I am removing my pending review request to stop the automated review cycle. Re-request @monit-reviewer to retry, or push a new commit and re-request.

[monit-reviewer]

Automated PR Review

Reviewed commit: 9e95f59

Summary

Reviewer	Findings
documentation:docs-reviewer	2
harness-engineering:harness-enforcement-reviewer	1
harness-engineering:harness-self-documenting-code-reviewer	2

documentation:docs-reviewer (2 findings)

⚠️ Should Fix - docs/proofs/271-437-final-enforcement.md:43

The proof document claims the enforcement test catches 'import-alias variants of fmt, io, log, and os', 'io.WriteString or direct .Write calls', and 'log.Print*, log.Fatal*, or log.Panic*' — but the PR author's own PR comment explicitly states the test 'does not resolve import aliases or catch other direct output paths (os.Stdout.Write, io.WriteString, helper wrappers, log.*, etc.)'. The proof document overstates the test's verified coverage, which could mislead auditors of the #271 completion claim.

⚠️ Should Fix - tools/cfl/internal/present/README.md:173

The README describes presenter_boundary_test.go as the 'authoritative package-wide enforcement gate' that 'allowlists only documented exceptions'. The PR author's own PR comment acknowledges the test does not catch import aliases, io.WriteString, or log.* writes. Describing the test as the authoritative gate overstates its completeness and will lead contributors to trust it as a comprehensive guard when it is not.

harness-engineering:harness-enforcement-reviewer (1 findings)

💡 Suggestion - tools/cfl/internal/cmd/root/presenter_boundary_test.go:107

Violation messages report what is wrong but omit remediation guidance. For example, 'legacy shared/view helper v.Table outside init exception' does not tell the author what to use instead. Adding a short pointer such as 'use present.Emit; see tools/cfl/internal/present/README.md' would make enforcement messages actionable for both developers and agents.

harness-engineering:harness-self-documenting-code-reviewer (2 findings)

💡 Suggestion - tools/cfl/internal/cmd/root/presenter_boundary_test.go:81

The variable name (assigned from sel.Sel.Name) represents the method name of a call expression (e.g., 'Fprint', 'WriteString', 'Write') but its generic identifier makes the seven downstream uses — "v." + name, "fmt." + name, "log." + name — harder to read without tracing back to the AST field. Renaming to methodName would make intent immediately clear.

💡 Suggestion - tools/cfl/internal/cmd/root/presenter_boundary_test.go:133

The condition rel == "../space/delete.go" || rel == "../page/delete.go" || rel == "../attachment/delete.go" encodes a domain concept as a string-equality chain. Extracting it as a named predicate (e.g., isDeleteCommandFile(rel)) would make allowedPromptWrite read as policy rather than path enumeration, and make it easier to extend without scanning raw strings to understand why these three files are special.

1 info-level observations excluded. Run with --verbose to include.

2 PR discussion threads considered.

---

Completed in 3m 23s | $1.88 | sonnet | daemon 0.2.132 | Glorfindel

Field	Value
Model	sonnet
Reviewers	hybrid-synthesis, documentation:docs-reviewer, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer, harness-engineering:harness-self-documenting-code-reviewer, security:security-code-auditor
Engine	claude · sonnet
Reviewed by	pr-review-daemon · monit-pr-reviewer
Duration	3m 23s wall · 3m 20s compute (Reviewers: 2m 35s · Synthesis: 45s)
Cost	$1.88 (estimated)
Tokens	335.1k in / 26.3k out
Turns	14

Per-workstream usage

Workstream	Model	In	Out	Cache read	Cache create	Cost
hybrid-synthesis	sonnet	37.7k	2.4k	13.1k	24.6k (1h)	$0.19
documentation:docs-reviewer	sonnet	46.7k	3.6k	13.1k	33.5k (1h)	$0.26
harness-engineering:harness-architecture-reviewer	sonnet	53.7k	3.0k	13.1k	40.6k (1h)	$0.29
harness-engineering:harness-enforcement-reviewer	sonnet	55.8k	4.7k	13.1k	42.6k (1h)	$0.33
harness-engineering:harness-knowledge-reviewer	sonnet	53.2k	2.2k	13.1k	40.0k (1h)	$0.28
harness-engineering:harness-self-documenting-code-reviewer	sonnet	49.0k	9.7k	13.1k	35.9k (1h)	$0.37
security:security-code-auditor	sonnet	39.0k	659	13.1k	25.9k (1h)	$0.17

_{Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.}

Superseded by updated review

[monit-reviewer]

Automated PR Review

Reviewed commit: d45760a | Previous: 9e95f59 (incremental)

Summary

No issues found.

7 PR discussion threads considered.

---

Completed in 1m 03s | $4.75 | sonnet | daemon 0.2.132 | Glorfindel

Field	Value
Model	sonnet
Mode	Re-review · Cycle 2 · Session resumed
Reviewers	hybrid-synthesis, documentation:docs-reviewer, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer, harness-engineering:harness-self-documenting-code-reviewer, security:security-code-auditor
Engine	claude · sonnet
Reviewed by	pr-review-daemon · monit-pr-reviewer
Duration	1m 03s wall · 39s compute (Reviewers: 17s · Synthesis: 22s)
Cost	$4.75 (estimated)
Tokens	868.7k in / 29.2k out
Turns	28

Per-workstream usage

Workstream	Model	In	Out	Cache read	Cache create	Cost
hybrid-synthesis	sonnet	85.4k	3.4k	26.3k	59.1k (1h)	$0.41
documentation:docs-reviewer	sonnet	113.0k	3.8k	26.3k	86.7k (1h)	$0.58
harness-engineering:harness-architecture-reviewer	sonnet	134.8k	3.2k	26.3k	108.5k (1h)	$0.71
harness-engineering:harness-enforcement-reviewer	sonnet	140.9k	4.8k	26.3k	114.6k (1h)	$0.77
harness-engineering:harness-knowledge-reviewer	sonnet	133.2k	2.4k	26.3k	106.9k (1h)	$0.69
harness-engineering:harness-self-documenting-code-reviewer	sonnet	120.5k	10.0k	26.3k	94.2k (1h)	$0.72
security:security-code-auditor	sonnet	97.2k	839	33.1k	64.1k (1h)	$0.41
discussion-summarizer	—	43.8k	760	0	43.8k (1h)	$0.46

_{Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.}

[rianjs]

No findings.

The post-daemon diff is empty, so there is no architectural drift to review. The approved PR state still matches #437/#271: package-wide enforcement, narrow documented exceptions, durable boundary docs, and final proof evidence remain intact.

[rianjs]

No findings.

The daemon-driven edits did not introduce architectural drift. The enforcement gate is now appropriately broad for #437 without expanding exceptions: it resolves aliases, covers common direct-output APIs, keeps prompt writes pinned to opts.Stderr, and leaves only root/init/prompt as documented exceptions. The docs and final proof remain aligned with #271 closure.