fix(dso-7nos): add AcliClient class + migrate to Go ACLI v1.3+ syntax

Root cause: bridge-inbound.py expects an AcliClient class with
search_issues/get_server_info/get_comments/set_relationship methods,
but acli-integration.py only had standalone functions with legacy
Java ACLI --action syntax.

Changes:
- Add AcliClient class with credential injection via subprocess env
- search_issues: caches full --paginate results, slices by start_at/max_results
- get_server_info: connectivity check + UTC timezone (Jira Cloud invariant)
- set_relationship: raises on failure (no silent error swallowing)
- Migrate all standalone functions from --action syntax to Go subcommands
  (jira workitem create/edit/view/comment/search)
- Remove obsolete JAVA_TOOL_OPTIONS timezone injection from _build_env

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JoeOakhartNava

.tickets/.sync-state.json

@@ -449,8 +449,8 @@
     "last_synced": "2026-03-19T18:38:35Z",
     "local_hash": "14c516947a151a3db8bdec4010e2fd6e"
   },
-  "last_pull_timestamp": "2026-03-23T04:18:28Z",
-  "last_sync_commit": "56a55e69cc9402da5aa9c9b163da2c07aaf2022f",
+  "last_pull_timestamp": "2026-03-23T04:29:36Z",
+  "last_sync_commit": "bc822f030eb394ef13e5f0bd21e64707e0885fcf",
   "w21-5cqr": {
     "jira_hash": "bce29d76f01c58613ee99cb1dd03920d",
     "jira_key": "DIG-61",

plugins/dso/scripts/acli-integration.py

@@ -31,13 +31,8 @@
 
 
 def _build_env() -> dict[str, str]:
-    """Build subprocess environment with ACLI JVM timezone flag."""
-    env = os.environ.copy()
-    java_opts = env.get("JAVA_TOOL_OPTIONS", "")
-    tz_flag = "-Duser.timezone=UTC"
-    if tz_flag not in java_opts:
-        env["JAVA_TOOL_OPTIONS"] = f"{java_opts} {tz_flag}".strip()
-    return env
+    """Build subprocess environment for ACLI."""
+    return os.environ.copy()
 
 
 def _run_acli(
@@ -96,31 +91,18 @@ def create_issue(
     acli_cmd: list[str] | None = None,
     **kwargs: Any,
 ) -> dict[str, Any]:
-    """Create a Jira issue via ACLI and verify it exists.
-
-    Args:
-        project: Jira project key (e.g. "PROJ").
-        issue_type: Issue type (e.g. "Task", "Story").
-        summary: Issue summary text.
-        acli_cmd: Override the ACLI base command (for testing).
-        **kwargs: Additional fields (currently unused).
-
-    Returns:
-        dict with the created issue data (including 'key').
-
-    Raises:
-        subprocess.CalledProcessError: If ACLI fails after retries.
-        RuntimeError: If verify-after-create fails (issue not found).
-    """
+    """Create a Jira issue via ACLI and verify it exists."""
     cmd = [
-        "--action",
-        "createIssue",
+        "jira",
+        "workitem",
+        "create",
         "--project",
         project,
         "--type",
         issue_type,
         "--summary",
         summary,
+        "--json",
     ]
     result = _run_acli(cmd, acli_cmd=acli_cmd)
     created = json.loads(result.stdout)
@@ -130,7 +112,6 @@ def create_issue(
         msg = f"ACLI create returned no key: {created}"
         raise RuntimeError(msg)
 
-    # Verify-after-create: confirm the issue exists
     verified = get_issue(jira_key=jira_key, acli_cmd=acli_cmd)
     if not verified:
         msg = f"Verify-after-create failed: issue {jira_key} not found"
@@ -145,24 +126,14 @@ def update_issue(
     acli_cmd: list[str] | None = None,
     **kwargs: Any,
 ) -> dict[str, Any]:
-    """Update a Jira issue via ACLI.
-
-    Args:
-        jira_key: Jira issue key (e.g. "PROJ-99").
-        acli_cmd: Override the ACLI base command (for testing).
-        **kwargs: Fields to update (e.g. status="In Progress").
-
-    Returns:
-        dict with the updated issue data.
-
-    Raises:
-        subprocess.CalledProcessError: If ACLI fails after retries.
-    """
+    """Update a Jira issue via ACLI."""
     cmd = [
-        "--action",
-        "updateIssue",
-        "--issue",
+        "jira",
+        "workitem",
+        "edit",
+        "--key",
         jira_key,
+        "--json",
     ]
     for field, value in kwargs.items():
         cmd.extend([f"--{field}", str(value)])
@@ -176,23 +147,13 @@ def get_issue(
     *,
     acli_cmd: list[str] | None = None,
 ) -> dict[str, Any]:
-    """Get a Jira issue via ACLI.
-
-    Args:
-        jira_key: Jira issue key (e.g. "PROJ-7").
-        acli_cmd: Override the ACLI base command (for testing).
-
-    Returns:
-        dict with issue data (key, summary, status, etc.).
-
-    Raises:
-        subprocess.CalledProcessError: If ACLI fails after retries.
-    """
+    """Get a Jira issue via ACLI."""
     cmd = [
-        "--action",
-        "getIssue",
-        "--issue",
+        "jira",
+        "workitem",
+        "view",
         jira_key,
+        "--json",
     ]
     result = _run_acli(cmd, acli_cmd=acli_cmd)
     return json.loads(result.stdout)
@@ -204,26 +165,17 @@ def add_comment(
     *,
     acli_cmd: list[str] | None = None,
 ) -> dict[str, Any]:
-    """Add a comment to a Jira issue via ACLI.
-
-    Args:
-        jira_key: Jira issue key (e.g. "PROJ-42").
-        body: Comment body text (passed unchanged, may include markers).
-        acli_cmd: Override the ACLI base command (for testing).
-
-    Returns:
-        dict with comment data (id, body, etc.).
-
-    Raises:
-        subprocess.CalledProcessError: If ACLI fails after retries.
-    """
+    """Add a comment to a Jira issue via ACLI."""
     cmd = [
-        "--action",
-        "addComment",
-        "--issue",
+        "jira",
+        "workitem",
+        "comment",
+        "create",
+        "--key",
         jira_key,
-        "--comment",
+        "--body",
         body,
+        "--json",
     ]
     result = _run_acli(cmd, acli_cmd=acli_cmd)
     return json.loads(result.stdout)
@@ -234,26 +186,166 @@ def get_comments(
     *,
     acli_cmd: list[str] | None = None,
 ) -> list[dict[str, Any]]:
-    """Get all comments on a Jira issue via ACLI.
-
-    Args:
-        jira_key: Jira issue key (e.g. "PROJ-55").
-        acli_cmd: Override the ACLI base command (for testing).
-
-    Returns:
-        list of dicts, each with comment data (id, body, etc.).
-        Returns empty list if no comments exist.
-
-    Raises:
-        subprocess.CalledProcessError: If ACLI fails after retries.
-    """
+    """Get all comments on a Jira issue via ACLI."""
     cmd = [
-        "--action",
-        "getComments",
-        "--issue",
+        "jira",
+        "workitem",
+        "comment",
+        "list",
+        "--key",
         jira_key,
+        "--json",
     ]
     result = _run_acli(cmd, acli_cmd=acli_cmd)
-    # ACLI may output `null` for issues with no comments; `or []` ensures we always
-    # return a list as documented in the docstring.
     return json.loads(result.stdout) or []
+
+
+# ---------------------------------------------------------------------------
+# AcliClient class — used by bridge-inbound.py and bridge-outbound.py
+# ---------------------------------------------------------------------------
+
+
+class AcliClient:
+    """Client wrapping ACLI Go binary for Jira operations.
+
+    Provides the method interface expected by bridge-inbound.py:
+    search_issues, get_server_info, get_comments, set_relationship.
+
+    Credentials are injected into the subprocess environment on each call
+    so ACLI can authenticate without requiring prior ``acli auth`` setup.
+    """
+
+    def __init__(
+        self,
+        jira_url: str,
+        user: str,
+        api_token: str,
+        *,
+        acli_cmd: list[str] | None = None,
+    ) -> None:
+        self.jira_url = jira_url
+        self.user = user
+        self.api_token = api_token
+        self._acli_cmd = acli_cmd
+
+    def _run(self, cmd: list[str]) -> subprocess.CompletedProcess[str]:
+        """Run an ACLI command with credentials injected into env."""
+        base = self._acli_cmd if self._acli_cmd is not None else _DEFAULT_ACLI_CMD
+        full_cmd = base + cmd
+        env = _build_env()
+        env["JIRA_URL"] = self.jira_url
+        env["JIRA_USER"] = self.user
+        env["JIRA_API_TOKEN"] = self.api_token
+
+        last_error: subprocess.CalledProcessError | None = None
+        for attempt in range(_MAX_ATTEMPTS):
+            try:
+                return subprocess.run(
+                    full_cmd,
+                    capture_output=True,
+                    text=True,
+                    check=True,
+                    env=env,
+                )
+            except subprocess.CalledProcessError as exc:
+                last_error = exc
+                if exc.returncode == _AUTH_FAILURE_CODE:
+                    raise
+                if attempt < _MAX_ATTEMPTS - 1:
+                    delay = 2 ** (attempt + 1)
+                    time.sleep(delay)
+
+        assert last_error is not None
+        raise last_error
+
+    def search_issues(
+        self,
+        jql: str,
+        start_at: int = 0,
+        max_results: int = 50,
+    ) -> list[dict[str, Any]]:
+        """Search Jira issues via JQL, returning a page slice.
+
+        ACLI Go has no offset flag, so --paginate fetches all results in one
+        call. Results are cached per-JQL to avoid redundant fetches when the
+        caller paginates. Returns a slice of ``[start_at:start_at+max_results]``
+        to satisfy the bridge's pagination loop contract.
+        """
+        # Cache the full result set for this JQL to avoid re-fetching
+        if not hasattr(self, "_search_cache"):
+            self._search_cache: dict[str, list[dict[str, Any]]] = {}
+
+        if jql not in self._search_cache:
+            cmd = [
+                "jira",
+                "workitem",
+                "search",
+                "--jql",
+                jql,
+                "--paginate",
+                "--json",
+            ]
+            result = self._run(cmd)
+            parsed = json.loads(result.stdout)
+            if isinstance(parsed, list):
+                all_issues = parsed
+            elif isinstance(parsed, dict) and "issues" in parsed:
+                all_issues = parsed["issues"]
+            else:
+                all_issues = []
+            self._search_cache[jql] = all_issues
+
+        all_issues = self._search_cache[jql]
+        return all_issues[start_at : start_at + max_results]
+
+    def get_server_info(self) -> dict[str, Any]:
+        """Get Jira server info for timezone verification.
+
+        ACLI Go has no direct server-info command. Returns timeZone=UTC
+        because Jira Cloud always stores timestamps in UTC, and the ACLI Go
+        binary does not apply JVM timezone transformations like the legacy
+        Java ACLI did.
+        """
+        # Connectivity check — verify ACLI can reach Jira
+        cmd = ["jira", "project", "list", "--json"]
+        self._run(cmd)  # raises on auth/network failure
+        return {"timeZone": "UTC", "serverTitle": "Jira Cloud"}
+
+    def get_comments(self, jira_key: str) -> list[dict[str, Any]]:
+        """Get all comments on a Jira issue."""
+        cmd = [
+            "jira",
+            "workitem",
+            "comment",
+            "list",
+            "--key",
+            jira_key,
+            "--json",
+        ]
+        result = self._run(cmd)
+        return json.loads(result.stdout) or []
+
+    def set_relationship(
+        self,
+        from_key: str,
+        to_key: str,
+        link_type: str = "Blocks",
+    ) -> dict[str, Any]:
+        """Create a link between two Jira issues.
+
+        Raises subprocess.CalledProcessError on ACLI failure.
+        """
+        cmd = [
+            "jira",
+            "workitem",
+            "link",
+            "create",
+            "--out",
+            from_key,
+            "--in",
+            to_key,
+            "--type",
+            link_type,
+        ]
+        self._run(cmd)  # raises on failure — no silent swallowing
+        return {"status": "created", "from": from_key, "to": to_key}