feat(cli): reach upstream's list, status and validate surfaces

[replygirl]

Summary

cospec list, cospec status and cospec validate had drifted from what the
wrapped OpenSpec 1.13.1 binary answers for the same invocation. This PR closes
that gap:

• a native nested-change detector: namespace folders under openspec/changes/
  are reported for what they are, and are not treated as empty changes. Schema
  outputs are matched with the binary's own glob semantics (core/glob.ts over
  fast-glob, pinned to the version the pinned openspec resolves).
• a next step on every status entry.
• upstream's own JSON keys merged additively into the list, status and
  validate documents, checked by a contract key oracle.
• delegated status for schemas cospec doesn't type: a fork, spec-driven, or
  one that resolves nowhere.
• validate's item resolution: --type, the ambiguity and unknown-name
  refusals, bulk-flag precedence, --report full|findings and --concurrency.
• the schemas and archived-changes completion sources.
• one JSON document on every apply early exit and every --json read
  failure.
• a linear-time fix for the archive/target-invalid dedupe, which had
  regressed to double-reporting a quoted requirement header.

Breaking

• cospec list now orders by most recent change first. Pass --sort name for
  the old order.
• cospec list outside an OpenSpec root answers OpenSpec's own
  no_openspec_root refusal, exit 1, where it printed No active changes.
• cospec validate <name> --all|--changes|--specs validates the bulk scope,
  not the one item.
• An ambiguous validate name is refused, and an unknown one prints the
  binary's message.
• A namespace folder makes status --change and status --all exit 1 and
  validate fail. validate, apply and archive (which share
  validateChange) now report it as meta/nested-change, not
  meta/openspec-yaml — a script grepping the old rule id for this case needs
  the new one.
• status --json on a schema cospec doesn't type exits 1 when the binary
  does.
• status types a change directory without .openspec.yaml by config.yaml.
  validate, apply and archive still refuse it.
• The root key of the status --all and no-active-changes documents is an
  object, not a path string.
• A cospec-typed change whose schema OpenSpec can't load, or whose
  .openspec.yaml OpenSpec refuses, makes status exit 1, in text and
  --json (rounds 4; text mode used to render cospec's own table at exit 0 in
  both cases).

Judgment calls

• Commit scopes: tasks.md named subjects with the scopes status, list
  and completion. commitlint's scope-enum doesn't allow them, so those
  commits use the allowed cli scope.
• status --schema overrides the schema; it doesn't filter. This was probed
  against the pinned binary: every change is reported as that schema.
• Unknown validate names get the binary's nearestMatches (the five
  nearest by edit distance), not cospec's own closest().
• resolveNext's order follows the verification spec's table. Design's
  prose disagreed with it. The order:
  1. the first ready required artifact;
  2. else cospec apply <id>, once every required one is done (a skipped
     specs counts as done);
  3. else the first ready artifact of any kind;
  4. else nothing.
• Rule-id change: validate, apply and archive share
  validateChange, so all three now report a namespace folder as
  meta/nested-change instead of meta/openspec-yaml. Rule ids are documented
  as stable public API, so this is in the Breaking list above.
• items[].type collision (ruled by the roadmap): items[].type keeps
  cospec's meaning, the change's schema. OpenSpec's value is carried as
  kind. This is the oracle's one named collision besides version, and it is
  documented on the validate page's JSON section.
• Verification row 8.4 (unknown --store) stays [~] defer. cospec's
  message text is root-resolution-parity's documented wording, accepted at the
  round-1 review. The row compares code, target, fix, payload and exit, and
  they all match.
• Round 2:
  • fast-glob is an exact-pinned devDependency, like yaml. It is not loaded
    from the wrapped package at run time, because the standalone binary's
    embedded openspec bundle has no copy to load. glob.test.ts fails if an
    OpenSpec pin bump moves it.
  • On an unreadable tasks.md, the binary refuses under Bun on macOS but
    lists the change on Linux. cospec relays whichever answer the binary gives
    on that OS.

Round-2 review fixes (tasks 11.1–11.13)

• 11.1: the round-2 rows were written first, as failing tests.
• 11.2: validate <id> --type spec on a spec that discovery skips (a
  dot-directory, a linked capability) validates that file, where it used to
  print an empty passing report.
• 11.3: the namespace-folder detector matches generates with the binary's
  glob semantics (braces, ranges, extglobs, negation) through core/glob.ts.
• 11.4: bench parseSchemaConformanceJson returns null for a refused or
  incomplete validate document.
• 11.5: status takes a custom schema's status from its own artifacts.
• 11.6: validate --archived relays the binary's failure document. It no longer
  says "needs >=1.9.0".
• 11.7: an unreadable openspec/changes/archive/ leaves validate and apply
  answering, with an archive_unreadable warning.
• 11.8: validate --json outside a root prints the one no_openspec_root
  document.
• 11.9: a failed list --specs relays the binary's document, or its message and
  fix in text.
• 11.10: an unreadable living spec.md is one meta/unreadable-artifact ERROR,
  and every other spec is reported as it is alone.
• 11.11: evidence is recorded on every group-15 row, and the docs pages that own
  each fact are updated.
• 11.12: an unreadable tasks.md is answered as the binary answers it on each OS
  (CI was red on Linux before this fix).
• 11.13: CodeQL js/redos alert fix(cli): report the embedded openspec pin from cospec doctor #15 is closed. The test no longer compiles an
  exponential reference regex; a star-height guard flags it instead.

Round-3 review fixes (tasks 12.1–12.13)

• 12.1: the round-3 rows were written first, as failing tests.
• 12.2: every delegated validation names its kind (--type change/--type spec); a refusal the binary answers with a status[] document is the
  item's openspec/validate ERROR, never an empty passing report; --strict
  fails a warning-only spec.
• 12.3: the living spec a delta targets is read through the change's reader, so
  an unreadable one is meta/unreadable-artifact naming the file.
• 12.4: an errno failure that escapes validate, status or apply (an
  unreadable openspec/changes/, openspec/specs/ or capability directory) is
  one --json document with the binary's per-command code and payload.
• 12.5: validate <name> with no openspec/ directory resolves the name as
  unknown_item, as the binary does.
• 12.6: a change is looked up as the binary's validateChangeExists looks it
  up.
• 12.7: every diagnostic status relays from the binary is spelled through the
  remedy allowlist, in text and under --json.
• 12.8: an in-progress cospec-typed entry keeps artifacts: [] under --json,
  singly and in the sweep.
• 12.9: status refuses a change the binary refuses, including in text mode
  for a change cospec cannot read.
• 12.10: apply relays the binary's failure document when instructions apply
  refuses after the gate clears.
• 12.11: an unreadable directory no artifact lives in leaves the change's
  answer unchanged.
• 12.12: rows 15.4, 15.6 and 15.7 are held to what their ledger promises.
• 12.13: evidence recorded on every group-16 row; docs updated.

Round-4 review fixes (tasks 13.1–13.3)

• 13.1: text-mode status asks the binary for a cospec-typed change whose
  schema it cannot load (missing, unreadable, unparsable or invalid), singly
  and in the --all sweep, and relays its refusal as --json already did.
  Before, text mode rendered cospec's own table at exit 0 where --json and
  the binary both refused at exit 1.
• 13.2: text-mode status asks the binary for a cospec-typed change whose
  .openspec.yaml the binary's readChangeMetadata refuses (unreadable, not
  YAML, an unlisted schema, or failing ChangeMetadataSchema), the same way.
• 13.3: changeMetadataRefused's own listSchemas call (13.2's mechanism) can
  itself fail with an errno — the project openspec/schemas unreadable or not
  a directory, distinct from the per-schema listing 13.1 already guards. That
  escaped binaryDecides uncaught in both the --all sweep's upstream-fetch
  decision and the --change lookup's own decision, neither inside a
  per-change try/catch, crashing the whole command with a bare top-level
  cospec: ENOTDIR … line instead of the per-change refusal --json already
  answered correctly. changeMetadataRefused now catches it like every other
  read failure in that function. Found and fixed in post-round-4 re-review.

Merge stage

• Rebased onto main (67f20c5d, through #61), 64 commits, zero conflicts;
  bun install --frozen-lockfile unchanged.
• mise run check green on the rebased tree: unit 1858, contract 2521,
  integration 176, bench 343, release-test 14 — 0 fail. mise run docs:build
  green separately. mise run cospec -- validate cli-surface-parity --strict
  clean.
• mise run cospec -- archive cli-surface-parity, no --force* flag of any
  kind. The archive left two of its own newly-created capabilities
  (json-document-parity, nested-change-detection) with its generic
  "TBD - created by archiving" ## Purpose placeholder, which fails
  validate --all --strict; both got a real Purpose paragraph in the same
  archive commit.
• git show --stat on the archive commit (f53fdab3): 20 files, all under
  openspec/ — the 11-file rename into
  openspec/changes/archive/2026-10-05-cli-surface-parity/ and 9 merged/created
  spec files under openspec/specs/.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.