Agent task: scaffold read-only sourceosctl CLI

[mdheller]

Target repo

SourceOS-Linux/sourceos-devtools

Context

This repo is the SourceOS Developer and AI Operator Tools home. The first implementation slice should create a conservative read-only/dry-run CLI surface.

Scope

Implement the smallest bounded change that does the following:

1. Add a minimal sourceosctl CLI scaffold.
2. Add commands: doctor, profiles list, nlboot evidence inspect <path>, release inspect <path>, fingerprint collect --dry-run, ai labs list, and agents sandbox plan --dry-run.
3. Keep all commands read-only or dry-run.
4. Add fixtures and tests where practical.
5. Update README/docs with usage.

Acceptance criteria

• make validate passes.
• CLI help works.
• No mutating command is implemented.
• PR body includes validation evidence.

Validation commands

make validate

If additional repo-native commands are added, include them in the PR body.

Boundaries / non-goals

• Do not implement backend services.
• Do not implement real host mutation.
• Do not commit secrets, tokens, model weights, datasets, or training runs.
• Do not touch other repositories.

PR requirements

Open one PR against main. Include what changed, exact commands run, pass/fail summary, known gaps, and anything blocked.

[mdheller]

@codex Please take this in the SourceOS devtools Codex environment. One PR: scaffold the read-only/dry-run sourceosctl CLI. Inspect the repo first and include validation evidence.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[mdheller]

@copilot Assignment is active. Please open one bounded PR for this issue with validation evidence. Keep all commands read-only or dry-run.