Expose portable Platform verification and worksets

.github/actions/setup-cli/action.yml

@@ -0,0 +1,27 @@
+name: Setup TreeSeed CLI
+description: Install one exact published TreeSeed CLI release.
+inputs:
+  version:
+    description: Exact published CLI semantic version.
+    required: true
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      with:
+        node-version: 24.12.0
+        registry-url: https://registry.npmjs.org
+    - name: Validate exact version
+      shell: bash
+      env:
+        TREESEED_CLI_VERSION: ${{ inputs.version }}
+      run: |
+        [[ "$TREESEED_CLI_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]
+    - name: Install exact CLI release
+      shell: bash
+      env:
+        TREESEED_CLI_VERSION: ${{ inputs.version }}
+      run: npm install --global --ignore-scripts --no-audit --no-fund "@treeseed/cli@${TREESEED_CLI_VERSION}"
+    - name: Verify command surface
+      shell: bash
+      run: trsd help platform

completions/trsd.bash

@@ -1,6 +1,6 @@
 # Generated from treeseed.command-tree/v1.
 _trsd_complete() {
-  local paths="inbox\nsend\ntopics list\ntopics show\ntopics subscribe\ntopics unsubscribe\ncapabilities list\ncapabilities show\nauth login\nauth logout\nauth status\nusers create\nteams list\nteams current\nteams use\nsecrets list\nsecrets status\nsecrets unlock\nsecrets lock\nsecrets rotate\ndev host activate\ndev host status\ndev host deactivate\ndev host guest image import\ndev session start\ndev session stop\ndev use\ndev rebuild\ndev restart\ndev status\ndev logs\ndev plan\ndev freeze\ndev verify\nhost status\nhost doctor\nhost plan\nhost apply\nhost reconcile\nhost events\nhost config show\nhost config plan\nhost config apply\nhost config adopt\nhost topology\nhost connections\nhost provider status\nhost provider credentials list\nhost provider credentials status\nhost provider credentials initialize\nhost storage status\nhost storage connect\nhost storage reconcile\nhost storage rotate\nhost storage reset\nhost security plan\nhost security initialize\nhost security status\nhost security verify\nhost security rotate\nhost security recovery verify\nhost sandbox status\nhost sandbox doctor\nhost fleet status\nhost update status\nhost update check\nhost update apply\nhost update channel\nhost update pause\nhost update resume\nhost component list\nhost component status\nhost component enable\nhost component disable\nhost aliases list\nhost recovery status\nhost recovery retry\nhost recovery restore\nhost bootstrap status\nhost bootstrap enroll\nhost reset\nagents list\nagents show\nagents validate\nagents diff\nagents diagnose\nagents classes list\nagents classes show\nagents bindings list\nagents bindings show\nagents bindings explain\nproviders list\nproviders show\nproviders status\nproviders diagnose\nproviders connect\nproviders disconnect\nproviders requests list\nproviders requests show\nproviders requests approve\nproviders requests reject\nproviders credentials status\nproviders credentials rotate\nproviders credentials revoke\nproviders offers show\nproviders offers validate\nproviders offers plan\nproviders offers apply\nseeds validate\nseeds plan\nseeds apply\nseeds show\nseeds verify\ncapacity status\ncapacity explain\ncapacity usage\ncapacity ledger\ncapacity audit\nplans list\nplans show\nplans explain\nplans diff\nworkdays profiles list\nworkdays profiles show\nworkdays profiles validate\nworkdays plan\nworkdays start\nworkdays list\nworkdays show\nworkdays watch\nworkdays pause\nworkdays resume\nworkdays stop\nworkdays cancel\nworkdays schedules list\nworkdays schedules show\nworkdays schedules plan\nworkdays schedules start\nworkdays schedules pause\nworkdays schedules resume\nworkdays schedules retire\nassignments list\nassignments show\nassignments explain\nassignments watch\nassignments retry\nassignments cancel\nassignments artifacts\nprojects treedx show\nprojects treedx bind\nprojects treedx status\nprojects treedx diagnose\nprojects treedx capabilities\nprojects treedx workspaces list\nprojects treedx workspaces show\nprojects treedx workspaces abandon\nai status\nai mode show\nai mode set\nai inference models\nai inference jobs\nai inference rollback\nai training libraries\nai training jobs\nai training runs\nai lab status\nai lab agents\nai lab libraries\nai qualify status\nai qualify run\nai qualify campaigns\nlibrary show\nlibrary status\nlibrary paths\nlibrary read\nlibrary search\nlibrary query\nlibrary context\nlibrary workspace create\nlibrary workspace show\nlibrary workspace read\nlibrary workspace diff\nlibrary workspace write\nlibrary workspace submit\nlibrary workspace abandon\nlibrary reviews list\nlibrary reviews decide\nlibrary reviews publish\nsave\nstage\nrelease\nstatus\ndiagnose"
+  local paths="inbox\nsend\ntopics list\ntopics show\ntopics subscribe\ntopics unsubscribe\ncapabilities list\ncapabilities show\nauth login\nauth logout\nauth status\nusers create\nteams list\nteams current\nteams use\nsecrets list\nsecrets status\nsecrets unlock\nsecrets lock\nsecrets rotate\nplatform verify\nplatform workset\nplatform project create\ndev host activate\ndev host status\ndev host deactivate\ndev host guest image import\ndev session start\ndev session stop\ndev use\ndev rebuild\ndev restart\ndev status\ndev logs\ndev plan\ndev freeze\ndev verify\nhost status\nhost doctor\nhost plan\nhost apply\nhost reconcile\nhost events\nhost config show\nhost config plan\nhost config apply\nhost config adopt\nhost topology\nhost connections\nhost provider status\nhost provider credentials list\nhost provider credentials status\nhost provider credentials initialize\nhost storage status\nhost storage connect\nhost storage reconcile\nhost storage rotate\nhost storage reset\nhost security plan\nhost security initialize\nhost security status\nhost security verify\nhost security rotate\nhost security recovery verify\nhost sandbox status\nhost sandbox doctor\nhost fleet status\nhost update status\nhost update check\nhost update apply\nhost update channel\nhost update pause\nhost update resume\nhost component list\nhost component status\nhost component enable\nhost component disable\nhost aliases list\nhost recovery status\nhost recovery retry\nhost recovery restore\nhost bootstrap status\nhost bootstrap enroll\nhost reset\nagents list\nagents show\nagents validate\nagents diff\nagents diagnose\nagents classes list\nagents classes show\nagents bindings list\nagents bindings show\nagents bindings explain\nproviders list\nproviders show\nproviders status\nproviders diagnose\nproviders connect\nproviders disconnect\nproviders requests list\nproviders requests show\nproviders requests approve\nproviders requests reject\nproviders credentials status\nproviders credentials rotate\nproviders credentials revoke\nproviders offers show\nproviders offers validate\nproviders offers plan\nproviders offers apply\nseeds validate\nseeds plan\nseeds apply\nseeds show\nseeds verify\ncapacity status\ncapacity explain\ncapacity usage\ncapacity ledger\ncapacity audit\nplans list\nplans show\nplans explain\nplans diff\nworkdays profiles list\nworkdays profiles show\nworkdays profiles validate\nworkdays plan\nworkdays start\nworkdays list\nworkdays show\nworkdays watch\nworkdays pause\nworkdays resume\nworkdays stop\nworkdays cancel\nworkdays schedules list\nworkdays schedules show\nworkdays schedules plan\nworkdays schedules start\nworkdays schedules pause\nworkdays schedules resume\nworkdays schedules retire\nassignments list\nassignments show\nassignments explain\nassignments watch\nassignments retry\nassignments cancel\nassignments artifacts\nprojects treedx show\nprojects treedx bind\nprojects treedx status\nprojects treedx diagnose\nprojects treedx capabilities\nprojects treedx workspaces list\nprojects treedx workspaces show\nprojects treedx workspaces abandon\nai status\nai mode show\nai mode set\nai inference models\nai inference jobs\nai inference rollback\nai training libraries\nai training jobs\nai training runs\nai lab status\nai lab agents\nai lab libraries\nai qualify status\nai qualify run\nai qualify campaigns\nlibrary show\nlibrary status\nlibrary paths\nlibrary read\nlibrary search\nlibrary query\nlibrary context\nlibrary workspace create\nlibrary workspace show\nlibrary workspace read\nlibrary workspace diff\nlibrary workspace write\nlibrary workspace submit\nlibrary workspace abandon\nlibrary reviews list\nlibrary reviews decide\nlibrary reviews publish\nsave\nstage\nrelease\nstatus\ndiagnose"
   COMPREPLY=( $(compgen -W "$paths" -- "${COMP_WORDS[*]:1}") )
 }
 complete -F _trsd_complete trsd

docs/command-reference.md

@@ -261,6 +261,52 @@ Execution: `local.secrets.rotate`.
 - `--json`: Emit the stable JSON envelope.
 - `--plan`: Return the exact proposed outcome without mutation.
 
+## trsd platform
+
+Platform operations.
+
+### trsd platform verify [root]
+
+Verify a declarative Platform repository without package checkouts or a control-plane API.
+
+Operation: read. Result schema: `treeseed.platform-verification/v1`.
+Execution: `local.platform.verify`.
+
+- `--json`: Emit the stable JSON envelope.
+- `--profile <value>`: Composable profile to verify.
+
+### trsd platform workset
+
+Plan or safely materialize exact primary source checkouts beneath packages/.
+
+Operation: mutation. Result schema: `treeseed.platform-workset-result/v1`.
+Execution: `local.platform.workset`.
+
+- `--json`: Emit the stable JSON envelope.
+- `--plan`: Return the exact proposed outcome without mutation.
+- `--apply`: Apply the frozen workset plan.
+- `--yes`: Confirm the planned checkout mutations.
+- `--profile <value>`: Composable source profile; repeat to union profiles.
+- `--project <value>`: Explicit project slug; repeat to select projects.
+- `--exclude <value>`: Project slug to exclude; repeat as needed.
+
+## trsd platform project
+
+Project operations.
+
+### trsd platform project create <slug>
+
+Plan or reconcile a project, repository, template, library binding, and live inventory without writing application source into Platform Git.
+
+Operation: mutation. Result schema: `treeseed.platform-project-create-result/v1`.
+Execution: `local.platform.project.create`.
+
+- `--yes`: Confirm authorized automation.
+- `--json`: Emit the stable JSON envelope.
+- `--plan`: Return the exact proposed outcome without mutation.
+- `--apply`: Apply the accepted creation plan.
+- `--template <value>`: Published template identity.
+
 ## trsd dev
 
 Dev operations.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/cli",
-  "version": "0.13.0-rc.38",
+  "version": "0.13.0-rc.39",
   "description": "Operator-facing Treeseed CLI package.",
   "license": "Apache-2.0",
   "repository": {
@@ -50,7 +50,7 @@
     "release:custody": "node --import tsx ./scripts/packages/release-custody.ts"
   },
   "dependencies": {
-    "@treeseed/sdk": "0.13.0-rc.60",
+    "@treeseed/sdk": "0.13.0-rc.61",
     "ink": "^7.1.1",
     "react": "^19.2.8",
     "string-width": "^8.2.2",

schemas/command-tree.json

@@ -792,6 +792,152 @@
         }
       ]
     },
+    {
+      "nodeType": "branch",
+      "segment": "platform",
+      "description": "Platform operations.",
+      "children": [
+        {
+          "nodeType": "leaf",
+          "segment": "verify",
+          "description": "Verify a declarative Platform repository without package checkouts or a control-plane API.",
+          "kind": "read",
+          "arguments": [
+            {
+              "name": "root",
+              "description": "Platform root; defaults to the current directory.",
+              "required": false
+            }
+          ],
+          "options": [
+            {
+              "name": "--profile",
+              "description": "Composable profile to verify.",
+              "type": "string[]"
+            },
+            {
+              "name": "--json",
+              "description": "Emit the stable command-result envelope.",
+              "type": "boolean"
+            }
+          ],
+          "resultSchemaId": "treeseed.platform-verification/v1",
+          "execution": {
+            "kind": "local",
+            "handlerId": "local.platform.verify"
+          }
+        },
+        {
+          "nodeType": "leaf",
+          "segment": "workset",
+          "description": "Plan or safely materialize exact primary source checkouts beneath packages/.",
+          "kind": "mutation",
+          "options": [
+            {
+              "name": "--plan",
+              "description": "Return the exact proposed outcome without mutation.",
+              "type": "boolean"
+            },
+            {
+              "name": "--apply",
+              "description": "Apply the frozen workset plan.",
+              "type": "boolean"
+            },
+            {
+              "name": "--yes",
+              "description": "Confirm the planned checkout mutations.",
+              "type": "boolean"
+            },
+            {
+              "name": "--profile",
+              "description": "Composable source profile; repeat to union profiles.",
+              "type": "string[]"
+            },
+            {
+              "name": "--project",
+              "description": "Explicit project slug; repeat to select projects.",
+              "type": "string[]"
+            },
+            {
+              "name": "--exclude",
+              "description": "Project slug to exclude; repeat as needed.",
+              "type": "string[]"
+            },
+            {
+              "name": "--json",
+              "description": "Emit the stable command-result envelope.",
+              "type": "boolean"
+            }
+          ],
+          "authorization": {
+            "capability": "development.workset",
+            "confirmation": "never"
+          },
+          "resultSchemaId": "treeseed.platform-workset-result/v1",
+          "execution": {
+            "kind": "local",
+            "handlerId": "local.platform.workset"
+          }
+        },
+        {
+          "nodeType": "branch",
+          "segment": "project",
+          "description": "Project operations.",
+          "children": [
+            {
+              "nodeType": "leaf",
+              "segment": "create",
+              "description": "Plan or reconcile a project, repository, template, library binding, and live inventory without writing application source into Platform Git.",
+              "kind": "mutation",
+              "arguments": [
+                {
+                  "name": "slug",
+                  "description": "Portable project slug.",
+                  "required": true
+                }
+              ],
+              "options": [
+                {
+                  "name": "--plan",
+                  "description": "Return the exact proposed outcome without mutation.",
+                  "type": "boolean"
+                },
+                {
+                  "name": "--apply",
+                  "description": "Apply the accepted creation plan.",
+                  "type": "boolean"
+                },
+                {
+                  "name": "--yes",
+                  "description": "Confirm authority-bearing project creation.",
+                  "type": "boolean"
+                },
+                {
+                  "name": "--template",
+                  "description": "Published template identity.",
+                  "type": "string",
+                  "required": true
+                },
+                {
+                  "name": "--json",
+                  "description": "Emit the stable command-result envelope.",
+                  "type": "boolean"
+                }
+              ],
+              "authorization": {
+                "capability": "projects.create",
+                "confirmation": "authority"
+              },
+              "resultSchemaId": "treeseed.platform-project-create-result/v1",
+              "execution": {
+                "kind": "local",
+                "handlerId": "local.platform.project.create"
+              }
+            }
+          ]
+        }
+      ]
+    },
     {
       "nodeType": "branch",
       "segment": "dev",