[purpshell]

Summary

Rebase the audience-profile commands and bounded CSV UTF-8 correction onto actual CLI main a9a19cd68eecf7f33eae495665c1f389b6906a5e, including merged Zod #91 (^4.6.6, locked 4.6.7).

Head: 06a29d8684c254f4b9bb30970e12c589ef52033e → a73af2b1febf139cb82380b4d724af9d0b10f5dd. Tree: 71a86004434788aa9dfcc79b8694ff7908b3f508. Merge topology is preserved: integration commit e9c1fc4fc49399dc7fbf13b654867c113cf879b9 has ordered parents 26e5cbd358b7b820865ba178df373dff1d0ce904 and current main; the UTF-8 correction follows it.

One atomic push used an explicit expected-old-head force lease. Old refs, the staged normal-merge tree, index/merge metadata and verified backup bundles remain preserved. All source, tests, README and workflow bytes equal old 06a29d8; only the two dependency files differ.

Keep draft. SDK pin 0.1.0-dev.20261004024706, its lock node, temporary raw adapter and both filter refusals are unchanged. SDK #350 remains contract-conflicted and has no accepted containing package for this consumer. No filter or package availability claim.

Previous comparison base: 58e91a18d1a4afc108eb3119db0830340bb2a926. New base: a9a19cd68eecf7f33eae495665c1f389b6906a5e.

Impact

Impact table

Area	Status and evidence
CLI	Updated history and Zod dependency. CSV-only fatal UTF-8 decoding retains valid BOM/Unicode/line-ending bytes; other input-reader callers keep their existing behavior.
SDK	Blocked for repin/adapter removal. Exact accepted SDK350 source, package and matching acceptance receipt remain required. No SDK source changed here.
Docs	Existing CLI README remains unchanged from the prior authored head. No shipped changelog or new customer availability claim.
Feature release	Current-head hosted verification passes. Independent review, accepted SDK, installed consumer and matching environment gates remain blocked.

No impact table

Area	Reason and evidence
API, databases, libraries, runners and Temporal	No handler, spec, SQL, protocol, authority or worker files change. API #567 containing source remains 561c9ebcefdf05784870e8ad5a88652f721da82a; no new spec hashes are invented.
Admin API/Console/MCP, Inspector and Console UI	No staff state, capability, action or graphical UI changes.
Billing, Usage, Logs/audit, Analytics, tracking, identity and consent	No charges, telemetry, auth or consent-policy changes. Existing scopes, revisions and opt-out behavior remain.
Catalog lifecycle and native shutdown	Canonical November 26 stays with #866. No date changes or whole-client/FinalClose acceptance. Native8c575 source-review evidence remains separate.

Verification

At a73af2b1, Node 24.15, standard serialized lease, unchanged assertions/deadlines:

• 111/111 focused tests pass in 13 files, including all 32 request/audience-profile cases: malformed CSV refusal before HTTP, strict stdin, BOM/split UTF-8/CRLF, unchanged default-reader behavior, import/replay mapping, revision/auth controls, mutation retry policy and current filter refusal.
• Full CLI TypeScript check and build pass. Source/author preservation, SDK pin/lock equality, exact current Zod and whitespace checks pass.
• Installed Vitest module resolution is verified; explicit OCLIF_TEST_ROOT points to the exact-source validation copy. No install, assertion change or version fallback. Prior wrong-root/incomplete-copy failures and the original UTF-8 red artifacts remain historical evidence.

Hosted Node 22.23.3 Verify job 122631399053 passed on this head: npm ci, format, lint, typecheck, 1,115/1,115 tests in 113 files, build, npm pack --dry-run --ignore-scripts, production audit (npm audit --omit=dev: 0 vulnerabilities) and 3/3 release-evidence tests. Tested merge d5235d0b0bbe371a73b3134681fcff7cf360056e has ordered parents current main and this head; its tree exactly equals 71a86004434788aa9dfcc79b8694ff7908b3f508. This is current-head proof, not substituted old CI.

The install's combined dependency summary still reports 5 findings (1 moderate, 2 high, 2 critical); package/advisory details were not emitted there, and this is not an all-dependency audit clearance. CodeRabbit is skipped for the draft; no submitted reviews or review threads were present. No physical CLI consumer, new SDK package acceptance, deployment, enrollment or provider acceptance is established.

Detailed six-part/source/command/failure packet: owned-pr-rebases-20261028/HANDOFF.md, SHA256 427c6c93f8ac61545352929dcafb790a0bccf15a257c2302c1336abb80ec4f09; receipt SHA256 6f173f05fadf7e45ed6ef0a9610c30e62dd0640db9c0440379dd032fffae158f. Evidence remains privately retained.

Session provenance and UI evidence

Existing ordinary owner thread 646a0c0a-e900-4d0f-9a25-0b8834d7d4e6, user-selected Codex gpt-6.1-sol/xhigh. No child or second writer. Existing registration is monorepo #518; current visible tool receipts are retained with capture limits. No complete or newly committed transcript is claimed. Synthetic HTTP/input fixtures only, no GUI changes.

Rollout and rollback

Leave draft. Release alone selects merges. Resolve SDK350's organization-boundary/contract conflict, bind actual accepted API/spec inputs, obtain the exact qualified package, then separately repin/remove the adapter and qualify the installed CLI. Keep filter gates through this step. Registry/tag/publication, new review requests, CI reruns and staging deployment are not included.

Old history is preserved in refs/bundles; any restoration remains a separate guarded action. No imported data, opt-outs or server replay semantics are changed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}