[Phase 16] S7 — CLI and wizard boundary: policy declared must be policy enforced #893

Roadmap · Phase 16, step S7 · size XL · 8 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:481-516

Summary

All eight units are the CLI boundary declaring something it does not enforce or cannot deliver. --offline is applied in _dispatch.py after the subcommand is dispatched, so the global flag is inert for every subcommand — export, deploy, ingest, audit, safety-eval, cache-*, quickstart's parent process — while the CLI reference promises it disables all Hub network calls; doctor is the only exception, because it declares its own flag.

Units

Decisions this step executes

• C-11 — the [export] extra: the external converter becomes an explicit, validated prerequisite.

Plan

• Commit 1, the central seam: apply the offline policy before dispatch and thread offline into run_chat / load_model; add one canonical failure renderer for UnicodeDecodeError, OSError and the no-train modes.
• Commit 2, capability honesty: [export] stops proving capability with import llama_cpp and probes for a real converter (doctor uses the same false proxy and is corrected with it; the FileNotFoundError message names the actual install step); share quantization / temperature validation between the parser and the REPL; add the cache-models local-path branch.
• Commit 3, the wizard: three-state keep / replace / disable per collector, WizardOutcome.valid, and path resolution inside the try block.

Exit criteria

• Every no-train mode emits exactly one JSON object on stdout plus the documented exit code, with no log text on stdout.
• An invalid-UTF-8 config, a read-only cache and an unwritable export parent each produce one {"success": false, …} object, in separate subprocess tests.
• forgelm --offline chat HUB_ID reaches no network function under sentinels, and local_files_only=True reaches both from_pretrained calls.
• An invalid generated config leaves the file, preserves the state snapshot, prints no "start later" message and exits 1.
• Explicit-disable answers leave fields absent while bare Enter preserves them, asserted in both directions.

How to deliver

• One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
• A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
• Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
• A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
• Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}