developer-experience: validate ledger append verdict/evaluated against ledger verify's own enum

[ruvnet]

Hypothesis

Given dream-machine ledger append, when it validates --verdict against ACCEPT|REJECT|INCONCLUSIVE and --evaluated against yes|no|blocked (the same enums ledger verify already enforces) and exits non-zero without writing on violation, then an out-of-schema ledger append invocation should be rejected before it reaches LEDGER.md, relative to the baseline (any string silently accepted and written) — subject to: existing valid invocations keep working unchanged, error/exit-code convention matches ledger verify, no other subcommand changes, full existing suite stays green.

Candidate

ledger append (packages/cli/src/index.ts) accepted any --verdict/--evaluated string with zero validation, even though ledger verify enforces a strict enum on those exact columns (packages/ledger/src/index.ts, verifyLedger). The two functions never shared validation. Fix: export VERDICTS/EVALS from @dream-machine/ledger (previously module-private) and check them in append before calling appendRow, rejecting with the same error format verify uses. 3 files, 32 lines, one conceptual change.

Evaluation Receipt

Real evaluator: npx vitest run (repo's bench entrypoint, npm test).

	Baseline (parent 7933c359, 2 new tests added, fix NOT applied)	Candidate
New tests	2 failing	2 passing
Full suite	98 passing + 2 failing = 100 total	100/100 passing
Lint	clean	clean
Build	clean	clean

Manual replay against a scratch copy of the real docs/dream-cycle/LEDGER.md: bad --verdict/--evaluated both exit 1 with the file's sha256 byte-for-byte unchanged; a valid append still writes correctly.

Baseline

Parent commit 7933c359. git stash confirmed the pre-existing typecheck script failure (tsconfig.json empty files list) is identical on parent and candidate — environmental, not caused by this diff; npm run build's per-package tsc is the real build/typecheck path and is clean both before and after.

Darwin Lineage

Not run. DARWIN=unavailable — npx --no-install @metaharness/darwin confirms the optional peer package isn't installed in this checkout.

Evidence

• ledger verify --path docs/dream-cycle/LEDGER.md → 9 real structural errors, rows 2-6, on main right now.
• git show df9ff40 -- docs/dream-cycle/LEDGER.md → all 5 malformed rows landed in one commit alongside an unrelated cron-floor fix — a direct file edit that bypassed ledger append entirely. This candidate's CLI validation does not retroactively fix those rows or prevent a future direct edit; it closes the CLI write path only. Recorded honestly, not overclaimed — see Issue [Dream Cycle 2026-08-29] developer-experience: ledger append accepts any --verdict/--evaluated value, corrupting ledger schema + cli,tui scan #48 for the full writeup.

Reward-Hack Check

Self-review (single session, no second agent spawned tonight — a real, disclosed limitation). No test weakened, no gold/threshold touched, no cherry-picked corpus, no evaluator exploit, no hidden cost. Verdict: clear.

Security Review

Additive input validation on a local CLI flag; reduces attack surface (malformed values can no longer reach a file other commands trust). No new filesystem/network scope, no credentials, no change to witness/verify-entrypoint. Not security-sensitive enough for its own ADR.

Regression Analysis

100/100 tests passing (98 pre-existing + 2 new), 0 removed, 0 modified. VERDICTS/EVALS export from @dream-machine/ledger is additive (no existing signature changed).

ADR

None — bug fix / input validation, not an architectural decision.

Gist

GIST=LOCAL (no gh CLI, no gist-creation MCP tool this session, matching repo precedent). Full report: docs/dream-cycle/2026-08-29-developer-experience-report.md.

Issue

#48

Witness

report_sha256 : cdcd1934830101f0c139a4a3f974ced0dc193e65c52db2c6774efed913fd59c2
session_commit: 7933c3599abe22df5290f4609d1f93f598feb3de
witness       : b1e4ed603fb970845d4c4b0eda8c6e2f624820a59531c24d2b26965bafdf059f

Reproduce: node packages/cli/dist/bin.js witness stamp docs/dream-cycle/2026-08-29-developer-experience-report.md 7933c3599abe22df5290f4609d1f93f598feb3de

Merge Policy

Human review required — no automerge label applied. Draft PR; the session never merges. Guarded auto-merge (.github/workflows/automerge.yml) is a separate CI job gated on the automerge-safe label, a fully green head, and no protected-path changes — not requested here, since this PR touches docs/dream-cycle/LEDGER.md (the durable ledger itself) and a library's public export surface, which warrant a human look even though the change is small.

---

Generated by Claude Code