feat(lark): add experimental TypeScript personal follow-through CLI

[maxliux5]

Selected Lark text can now be turned into explicitly reviewed canonical User Todo changes through an opt-in TypeScript/Node CLI. The workflow prepares bounded model proposals, exposes a review digest, rechecks source and registry authority before applying, and reads persisted Todos back. Exact retries use canonical receipts; a changed deadline amends the same Todo. Multi-item reviews can refresh against the new canonical revision without another model request.

This is an experimental CLI prerequisite, partial RFC M1, following #5384. It does not ship the desktop personal-agent journey. Review files are private transient CLI handoffs; the existing desktop proposal lifecycle and installed UI still need typed integration. The draft remains held for maintainer review and live qualification.

Scope and authority:

• Reuse the existing work-item, canonical Todo/provider/writer, registry witness, and exact Goal identity owners. The Lark adapter remains in the bundled optional extension; no new capability or parallel Todo store.
• Admit only a private existing store with an explicit active, exact-instance, project-local object registry and no registered Agents. Unsupported registries/providers fail closed. Nothing auto-enables, sends a message, completes work, or starts a scheduler.
• CLI is the changed user entrypoint. Desktop and installed Lark surfaces have not adopted this workflow; full M1 remains open. Dates remain review/Todo-note metadata, without reminders.

Validation:

• 91 focused Node tests passed, including 9 new feature tests and related authority/provider/Todo/identity contracts.
• The process-level journey runs the real CLI, HTTP transport and disposable FileAuthorityStore with Python absent from PATH. Lark and model responses are scripted test doubles. Live Lark payload compatibility, model quality and installed desktop readback are untested.
• Full control-plane run: 3,530 passed, 21 failed, 31 skipped. The same 21 failures reproduced in the affected test files on unmodified f49b4a0 (missing checkout examples and existing runtime/test issues). Final fixes were revalidated with the focused set.
• Typecheck reports the same 53 diagnostics as f49b4a0, with no added/removed diagnostics after path normalization. This is not a green repository-wide typecheck.
• Whitespace and candidate public/private scans passed; no source-account data, credentials or raw logs are included.

Future-facing pass: reuse canonical receipts, source witness and typed Goal parsing; keep narrow registry admission local until the shared registry owner can support more profiles. Shared mutation and permission reducers are unchanged. Next owner: personal-workspace/work-items with the Lark extension for durable proposals, packaged desktop return and live qualification under the existing RFC. No self-merge.

[maxliux5]

Exact-head review: ad478f4 (base f49b4a0).

Verdict: APPROVE for the explicitly scoped experimental CLI slice. Full RFC M1 acceptance remains OPEN. Maintainer review/merge required; no self-merge.

Standards and Spec review both examined this head. Source reread is inside the service boundary; source edits retain stable Todo identity; registry admission proves empty registration instead of fabricating facts. Active state, exact instance, runtime binding, registry witness and canonical CAS/receipts bound mutations. The final pagination-revocation case rejects without a second read or provider revision change. No unresolved correctness blockers were identified within the documented CLI scope.

Changed surfaces: opt-in CLI/model orchestration, bundled read-only Lark adapter, private review handoffs and canonical Todo caller integration. Existing desktop, shared reducers and default runtime paths are unchanged. Disabled mode performs no provider/model effects. Source text cannot authorize sends, completion or execution; caller-supplied owner identity still needs live verification.

Validation: primary run 91 focused tests passed; Spec reviewer independently reran the nine feature tests on this head. Full-suite 21 failures reproduced on the unchanged baseline; typecheck has the identical 53 baseline diagnostics. Public/private and whitespace scans passed. Lark/model test doubles, missing live qualification, durable proposal lifecycle and packaged desktop readback are explicit manual holds. Focused coverage is sufficient for review of this experimental slice, not release qualification.

Future-facing pass reused canonical registry witness, typed exact Goal identity and existing mutation owners. No new permission reducer, scheduler or Todo database was introduced. Unsupported registry profiles fail closed until the shared registry owner is extended with parity evidence.