tensor-grep-enterprise-review-bundle

name	tensor-grep-enterprise-review-bundle
description	Use when packaging tensor-grep outputs for enterprise change review — review-bundle create/verify requires a rewrite audit --manifest (not a capsule); optionally attach scan JSON and checkpoint IDs; pair with evidence emit and audit-history.

tensor-grep enterprise review bundle

Verified against tg 1.110.14 (2026-08-11).

tg review-bundle is the enterprise packaging surface for change review. It is not a substitute for tg agent / tg evidence emit.

Create

# Required: rewrite audit manifest from an applied rewrite / audit trail
tg review-bundle create \
  --manifest /path/to/audit-manifest.json \
  --scan /path/to/ruleset-scan.json \    # optional
  --checkpoint-id ckpt-… \              # optional
  --previous-manifest /path/to/prev.json \  # optional diff base
  --receipt /path/to/receipt.json \     # repeatable; embeds a signed EvidenceReceipt in the bundle
  --output /tmp/review-bundle.json \
  --json

tg review-bundle verify --help   # integrity / checksum verification
tg audit-history --json          # discover known manifests
tg audit-verify MANIFEST --json  # MANIFEST is positional, no --manifest flag

Dogfood / RED probe traps (2026-08-06)

• --sign with “no key” is only a real RED when the default key path is empty. Help text falls back to TG_EVIDENCE_SIGNING_KEY then ~/.tensor-grep/keys/evidence_ed25519.key. Clearing the env var on an operator machine that already has the default key still signs (exit 0, receipt written). Isolate HOME/USERPROFILE to an empty temp home, or temporarily move the default key, before claiming fail-closed. AGENTS.md A70; receipt docs/audits/2026-08-06-enterprise-w5-dogfood.md.
• Bare uvx --from tensor-grep==X has no dense/model2vec extras. Prefer prepare/search/evidence/review-bundle/ledger for enterprise CUJ dogfood, or install tensor-grep[semantic] / tg install-dense first (AGENTS.md A73).

CI gate chain (shipped #681)

--receipt (repeatable, create) embeds one or more signed EvidenceReceipts directly in the bundle; verify then re-checks them against the real PR state, not just internal consistency:

tg review-bundle verify /tmp/review-bundle.json \
  --against <PR-head-sha> \          # re-verify signature/trust/revision-freshness against the REAL PR head, never $GITHUB_SHA (resolves to a merge commit, not the head)
  --min-receipts 1 \                 # policy floor: reject an empty-to-[] receipts list (closes the all([])==True bypass)
  --expect-key KEY_ID \              # require a specific signer key id, distinct from --trusted-key
  --require-trusted \                # fail closed unless the embedded key matches --trusted-key
  --trusted-key BASE64_PUBKEY \
  --json

Source anchors (added 2026-07-27 — this skill previously cited NO source at all; re-derived 2026-08-01, all five had drifted uniformly by +618 lines in five days of main.py growth — proof these numbers are not worth re-stamping by hand). Every flag claim below was pinned only to docs/enterprise_review_bundle_ci.md prose, so a doc and a skill could agree with each other while both drifted from the binary. The option parsing lives in src/tensor_grep/cli/main.py; re-derive with grep -n '@review_bundle_app.command\|min_receipts: int = typer.Option\|expect_key: list' src/tensor_grep/cli/main.py — these are command-tail line numbers, which drift with every new tg command (see tensor-grep-diagnostics-and-tooling Provenance), so trust the grep over any number written here: @review_bundle_app.command("create") was :15896 now :16514 (review_bundle_create was :15897 now :16515), @review_bundle_app.command("verify") was :16040 now :16658, with min_receipts was :16071 now :16689 and expect_key was :16080 now :16698. Repo-wide, python .claude/skill_anchor_audit.py re-checks every citation in the skill library at once.

Both --min-receipts and --expect-key are default-OFF policy levers — a bundle with a stripped-empty receipts: [] list previously still verified valid:true (all([]) == True); --min-receipts N closes that gap. Full CI-gate wiring and the PR-head-sha rationale: docs/enterprise_review_bundle_ci.md.

Common mistakes

# WRONG — --capsule is not a create flag
tg review-bundle create tensor-grep --capsule capsule.json

# WRONG — treating review-bundle as the primary edit planner
tg review-bundle create   # missing --manifest → typer error

# WRONG — using $GITHUB_SHA for --against in a CI gate (resolves to a merge commit, not the PR head)
tg review-bundle verify bundle.json --against "$GITHUB_SHA"

Companion loop

1. tg prepare REPO/src "task" --out capsule.json --json → edit readiness in one call, capsule persisted directly (replaces the old tg agent + manual-redirect step)
2. tg scan --ruleset … --json → save scan artifact
3. tg checkpoint create REPO/src --json
4. Persist rewrite audit manifest (from rewrite/apply tooling)
5. tg evidence emit … --capsule capsule.json … --sign --out receipt.json
6. tg review-bundle create --manifest … [--scan …] [--checkpoint-id …] --receipt receipt.json --json

Related

• tensor-grep-enterprise-agent, tensor-grep-code-audit, tensor-grep-run-and-operate, tensor-grep-ledger (advisory claim/finding-reuse — a sibling coordination primitive; review-bundle's receipts are the audit trail, ledger is the live-coordination layer, and neither substitutes for the other)

Escrowed verification evidence (A92 — verify-edit, S1 spine, 2026-08-09)

This skill's trusted-key/verify surface is the SHIPPED family that the roadmap's S1 verify-edit contract extends. The existing mechanism (--expect-key --require-trusted --trusted-key) proves a receipt's signing key; A92 adds the load-bearing half for the edit loop: executed evidence must be escrowed to a key the verified principal does NOT hold (CI-held, pinned via TG_EVIDENCE_TRUSTED_KEYS — the editing agent can produce validation runs, but a PASS it self-attested is Oracle Form 8 self-report, never verification). A verify-edit PASS therefore requires: validation subprocess stdout-hash + exit code + duration, signed by the escrowed key; and the ticket's base_sha + working-tree fingerprint unchanged (fail closed on drift — a rebase or sibling edit cannot retroactively certify state nobody prepared). External precedent (Exa, 2026-08-11): Occasio's GitHub-Actions OIDC-signed agent attestations (Sigstore/Rekor, offline-verifiable) are the same CI-held-key escrow pattern at product scale; docs/plans/2026-08-09-worldclass-roadmap.md S1 is the repo's contract. See tensor-grep-worldclass-roadmap for the full S1 spine.