Verify content-addressed Issue lifecycle preflight evidence

[proerror77]

Parent

#455

What to build

Add the read-only verify operation for the bundle produced by #607. It validates the exact file set, canonical JSON, SHA-256 sidecars, schema and repository/controller scope, API and page inventory, object counts, and default-branch identity. Optional live verification independently re-reads GitHub and rejects any mutable or provenance drift.

Acceptance criteria

• Local verification rejects missing, extra, symlinked, non-canonical, tampered, or digest-mismatched bundle entries.
• Manifest schema, repository/controller/target/exclusions, API/media versions, page inventory, counts, and preflight identity are validated fail-closed.
• Live verification re-fetches the complete Capture content-addressed Issue lifecycle preflight evidence #607 graph and rejects default-branch, pagination/header, Issue/PR metadata, relationship, comment/event, check, or status drift.
• Focused tests prove valid independent readback, tamper rejection, scope/schema mismatch rejection, incomplete pagination rejection, and zero GitHub writes.

Blocked by

#607 must merge first.

Out of scope

• Capturing the bundle owned by Capture content-addressed Issue lifecycle preflight evidence #607.
• Producing a restoration plan owned by the dependent follow-up issue.
• Executing or authorizing metadata mutation, correcting the 54 legacy violations, or changing Enable the Issue Lifecycle required check after a green observation window #460/branch protection.

[proerror77]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Independently verify a captured Issue-lifecycle evidence bundle

Prerequisite readback: Native blocker #607 is CLOSED with completion evidence; #608 remains a direct child of #455. No existing lifecycle verify implementation or matching rejected request was found.

Current behavior:
The repository-native CLI can capture a canonical, content-addressed Issue/PR graph, but it cannot independently prove that a retained bundle is structurally complete, canonical, scope-bound, untampered, or still equal to live GitHub state.

Desired behavior:
Add verify to the existing preflight CLI. Local verification must be the default and perform zero GitHub calls. Optional --live verification must reuse the complete read-only capture path and fail closed on any graph, branch, page/header, count, or provenance drift. Both modes must perform zero writes.

Key interfaces:

• verify --bundle DIR --repo OWNER/REPO --controller NAME — exact local file/digest/canonical/schema/scope verification
• --live — opt-in independent GitHub readback; never a mutation authority
• Existing four-file bundle and Canonical representation — no new service, format, or dependency

TDD seams:

• Public CLI exit/result against a captured fixture bundle
• Fake gh boundary only for opt-in live verification and zero-write proof

Acceptance criteria:

• Reject missing, extra, symlinked, non-canonical, tampered, or digest-mismatched bundle entries.
• Validate manifest/preflight schema, exact repository/controller/target/exclusions, API/media versions, page inventory, counts, default-branch identity, and preflight digest.
• --live independently re-reads the complete graph and rejects any mutable or provenance drift.
• Focused tests prove valid local/live readback, tamper and scope/schema rejection, incomplete live pagination rejection, and zero GitHub writes.

Out of scope:
Capture changes, #609 restoration planning, a formal retained evidence bundle/PR, any GitHub metadata mutation, the 54 legacy violations, #459 execution, #460/branch protection, deployment/runtime resources, and Agent-led CEX PRD work.