fix(cli): register the trust command on the root (dropped in #162)

[IanFrelinger]

Production-readiness audit, H1. Full ledger: Nexo Readiness Ledger (shared separately).

What / why

Program.CommandRegistration.cs built the trust command tree (var trustCmd = BuildTrustCommand(jsonOpt);) but the AddCommand block at the bottom never added it to the root, so nexo trust ... failed with 'trust' was not matched (TreatUnmatchedTokensAsErrors). The registration line was lost in ae6c6bf (#162) when the file was split.

Consequences of the gap:

• README.md (trust dashboard, trust pack apply --id strict-enterprise, trust pause / trust resume) and docs/GettingStarted.md ("help should list trust") advertised a command that did not exist.
• scripts/security-gate-tier-c.sh runs trust boundary --format-json and trust dashboard --format-json under set -euo pipefail, so make security-gate-tier-c and the Security Gate workflow's Tier C were guaranteed to fail.

Changes

• application/src/Nexo.CLI/Program.CommandRegistration.cs
  • root.AddCommand(trustCmd); added beside the other AddCommand calls.
  • BuildRootCommand is now internal (with a doc comment; Nexo.CLI.csproj already has InternalsVisibleTo Nexo.Tests.CLI) so the test project can assert the registered root commands without spawning the host.
• application/src/Nexo.Tests.CLI/Tests/Commands/RootCommandRegistrationTests.cs (new, xunit, Category=CLI)
  • RootCommand_RegistersTrustCommand — root subcommands contain trust.
  • TrustCommand_HasDocumentedSubcommands — trust exposes dashboard, boundary, pause, resume, pack, and pack exposes apply (the surface named by README, GettingStarted and Tier C).
• .github/workflows/security-gate.yml
  • pull_request.paths now includes application/src/Nexo.CLI/Program.TrustCommands.cs and application/src/Nexo.CLI/Program.CommandRegistration.cs.

No documented subcommand had to be invented: Program.TrustCommands.cs already defines audit, pause, resume, allow, deny, boundary, dashboard, pack {list,describe,apply --id}.

Verification

• dotnet build application/src/Nexo.Tests.CLI/Nexo.Tests.CLI.csproj — 0 warnings, 0 errors.
• dotnet Nexo.CLI.dll --help — lists trust Trust & Information Architecture: audit log and access boundary.
• dotnet Nexo.CLI.dll trust --help — shows audit, pause, resume, allow, deny, boundary, dashboard, pack.
• NEXO_ALLOW_MOCK=1 dotnet Nexo.CLI.dll trust boundary --format-json and trust dashboard --format-json — both exit 0 (the exact Tier C invocations).
• dotnet test ... --filter FullyQualifiedName~RootCommandRegistrationTests — 2/2 passed (net8.0 with DOTNET_ROLL_FORWARD=Major; the test project single-targets net8.0, so -f net9.0 does not apply).

Not done / notes

• Nothing skipped. Line endings preserved (working tree CRLF, index LF via autocrlf, unchanged from master).

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.