Harden M8 trust and guidance workflows

src/cmdforge/cli/registry_commands.py

@@ -410,6 +410,22 @@ def _print_preflight_sections(report: dict, prefix: str = "") -> None:
             )
 
 
+def _print_quality_summary(quality: dict | None) -> None:
+    if not quality:
+        return
+    print(
+        f"Quality {quality.get('score', 0)} — "
+        f"{quality.get('evidence_coverage', 0)}% evidence coverage"
+    )
+    for category in quality.get("categories", []):
+        state = category.get("state", "not_tested")
+        value = (
+            f"{category.get('earned', 0)}/{category.get('available', 0)}"
+            if state == "checked" else state.replace("_", " ")
+        )
+        print(f"  {category.get('name', 'Unknown'):24s} {value:>12s}")
+
+
 def _print_registry_suggestions(suggestions: dict) -> None:
     """Render registry-specific category, similarity, and scrutiny evidence."""
     category = suggestions.get("category") or {}
@@ -547,6 +563,7 @@ def _cmd_registry_publish(args):
 
         remote_report = result.get("preflight") or {}
         _print_preflight_sections(remote_report, prefix="Registry ")
+        _print_quality_summary(result.get("quality"))
         _print_registry_suggestions(result.get("suggestions") or {})
         if not remote_report.get("errors"):
             print("Registry preflight passed.")
@@ -691,6 +708,44 @@ def _cmd_registry_publish(args):
     except Exception:
         pass  # Continue with publish
 
+    # Stage 1 runs after dependency publication and any automatic version bump,
+    # so the evidence describes the exact version Stage 2 will mutate.
+    from ..preflight import analyze_tool
+    try:
+        preflight_tool = Tool.from_dict(data)
+        preflight_tool.path = config_path
+        local_report = analyze_tool(preflight_tool, include_contract_tests=True)
+    except (KeyError, TypeError, ValueError) as exc:
+        print(f"Local preflight error: {exc}", file=sys.stderr)
+        return 1
+    print("Preflight stage:")
+    _print_preflight_sections(local_report.to_dict(), prefix="Local ")
+    if not local_report.ok:
+        return 1
+
+    try:
+        preflight_client = get_client()
+        preflight_result = preflight_client.publish_tool(
+            config_yaml, readme=readme, defaults=defaults,
+            owner=getattr(args, "owner", ""), dry_run=True,
+        )
+    except RegistryError as exc:
+        print(f"Registry preflight failed: {exc}", file=sys.stderr)
+        return 1
+    remote_report = preflight_result.get("preflight") or {}
+    _print_preflight_sections(remote_report, prefix="Registry ")
+    _print_quality_summary(preflight_result.get("quality"))
+    if remote_report.get("errors"):
+        return 1
+    if sys.stdin.isatty() and not getattr(args, "force", False):
+        try:
+            if input("Publish this validated version? [y/N] ").strip().lower() != "y":
+                print("Cancelled.")
+                return 1
+        except (EOFError, KeyboardInterrupt):
+            print("\nCancelled.")
+            return 1
+
     print(f"Publishing {name}@{version}...")
 
     try: