feat(docx-mcp): add verified CLI comparisons

[stevenobiajulu]

Summary

• add safe-docx compare --verify and --certificate <path>
• fail closed before publishing a redline when the Lean certificate does not pass
• use a 10-second default verifier timeout and exercise a public NVCA-derived document pair
• admit only inert ZIP directory placeholders while proving they cannot be selected as XML stories

Evidence

• full mandatory pre-submit sequence passes
• full Lean build passes (6,628 jobs)
• axiom audit matches the reviewed production boundary: Classical.choice, Quot.sound, propext
• no sorry in Lean sources
• strict OpenSpec validation passes
• public verified CLI performance gate: 6.65 seconds under full-suite load (10-second ceiling)

Notes

Ordinary CLI comparisons remain unverified unless explicitly requested. Certificate and redline files are published only after verification passes. No confidential corpus material or identifying metadata is included.

Fixes #775

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
site	Ready	Preview	Jul 30, 2026 4:47pm

[stevenobiajulu]

Automerge stalled — CI failed: allure-labels.

Local reproduction: packages/docx-mcp/src/cli/commands/compare.test.ts contains OpenSpec traceability tests but does not declare the required deterministic const TEST_FEATURE = .... Other checks were still running when this gate failed. Automerge remains armed while the focused metadata fix is prepared.

[usejunior-llm-gate]

Aggregate and post review

Overall: PASS (8 pass, 0 warn, 0 error, 9 skipped, 17 total)

Check	Verdict
read_file response metadata parity	SKIPPED paths not touched by this PR
Live DOM namespace-safe OOXML writes	SKIPPED paths not touched by this PR
Deleted field markup keeps w:fldChar outside w:del	PASS The PR does not touch field atomization, validateFieldStructure, hasFldCharInsideDel, w:instrText, w:delInstrText, or collapsed field comparison logic.
Field validation per story, not global	SKIPPED paths not touched by this PR
Revision IDs seeded from all revision-bearing side parts	SKIPPED paths not touched by this PR
Accept/reject sweep side parts and caches	PASS The PR does not touch DocxDocument.acceptChanges, DocxDocument.rejectChanges, REVISION_STORY_PART_PATHS, accept_changes, reject_changes, or side-part revision markup.
DocumentViewNode.heading stays canonical	SKIPPED paths not touched by this PR
AI-author parity across entry points	PASS The PR modifies packages/docx-mcp/src/cli/commands/compare.ts, which does not instantiate SessionManager. All existing production entry points in docx-mcp that construct SessionManager (server.ts:296, tool_runner.ts:27, edit.ts:132, and grep.ts:140) consistently resolve SAFE_DOCX_AI_AUTHOR with correct three-way parity.
Property-change wrapper discipline	SKIPPED paths not touched by this PR
SUPPORT.md Table A drift vs. implementation	SKIPPED paths not touched by this PR
Table A / Table B boundary on side-part revisions	SKIPPED paths not touched by this PR
Canonical-emission surface completeness	SKIPPED paths not touched by this PR
Lean predicate drift against engine semantics (asymmetric)	PASS The PR only modifies Lean verification files in verification/lean/Tier2/ to handle ZIP directory placeholders and does not change any TS engine or atomizer semantics.
Unit-test quality (avoid tautological / change-detector tests)	PASS The tests in leanXmlVerifier.test.ts and compare.test.ts are highly robust and independent of the SUT, utilizing first-principles input construction, verifying real-world integration performance on NVCA fixtures, and asserting concrete semantic claims rather than merely snapshotting or mock-implementing production code.
Re-derived facts vs canonical sources	PASS The PR does not add any logic that re-computes or re-derives a fact (such as fldChar walks or footnote references) already derived elsewhere, as its changes are limited to exposing verified comparisons through CLI argument parsing and updating Lean verifier ZIP directory policies.
.openspec tag ↔ test-assertion drift	PASS All added .openspec tags in packages/docx-compare/src/baselines/atomizer/leanXmlVerifier.test.ts:4150-4179 and packages/docx-mcp/src/cli/commands/compare.test.ts:130-237 have corresponding test bodies that precisely set up each scenario's precondition and assert its THEN observable without tag-stuffing.
Library stays general (no downstream-domain leakage)	PASS The PR adds CLI parameters and types for Lean verification (--verify and --certificate) to the document comparison command, which are general OOXML correctness mechanisms and contain no downstream-domain vocabulary.

[codecov]

Codecov Report

❌ Patch coverage is 84.00000% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/docx-mcp/src/cli/commands/compare.ts	81.81%	1 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!