Reject outside artifact paths before sealing

[mrodgersjs-web]

Summary

• reject absolute --artifact paths outside the RIGForge project root before harness execution
• preserve accepted relative paths and absolute paths inside the project root
• return actionable text/JSON errors without running gates or writing proofs

Tests

• python3 -m pytest rigforge/tests/test_cli.py -q → 28 passed, 2 skipped
• python3 -m pytest -q → 264 passed, 21 skipped, 1 warning
• mutation check: replacing the new validator with return None made the three new regression tests fail; restoring it made them pass
• installed wheel/package smoke via python3 -m rigforge.cli: text and JSON outside-artifact errors exit 2 and write no proof

Known limits

• python3 -m ruff check . and focused python3 -m ruff check rigforge/cli.py rigforge/tests/test_cli.py both hung locally and were terminated inside the time bound.
• the prefix-installed console script failed before importing RIGForge (No module named 'encodings') in this Aside Python prefix environment; package-level installed CLI smoke passed via python3 -m rigforge.cli.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf288c1c-6774-43a9-8f1a-9d4dbf9705fc

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}