CLI Reference

Motivation

CLI reference supports automation and CI gates that cannot depend on a browser or HTTP server.

Theory

Evidence risk review treats an answer as a set of claims C={c1,c2,...,cn}C = \{c_1, c_2, ..., c_n\} and sources S={s1,s2,...,sm}S = \{s_1, s_2, ..., s_m\}. Each source receives a tier rank r(s)∈[0,100]r(s) \in [0,100]. A claim with assertiveness a(c)a(c) has a profile-specific minimum rank t(a,c)t(a,c). A deterministic gap is:

g(c)=max⁡(0,t(a,c)−max⁡s∈Scr(s)) g(c) = \max(0, t(a,c) - \max_{s \in S_c} r(s))

The package then combines evidence gaps, profile checks, and verdict precedence into a stable ReviewResult.

Design + Diagram

flowchart LR A[Artifact] --> B[Evidence tier labeling] B --> C[Risk sweep] C --> D[Verdict reduction] D --> E[ReviewResult] C --> F[(Review log)] G[Domain profile] --> C H[Budget meter] --> C

Data Model / Contract

Exit code 2 means the review completed but emitted findings.

Field Meaning
artifact_id Host-defined stable identifier.
claims Discrete claims extracted by the host.
sources Cited evidence with optional tier hints.
profile_key Risk profile used for thresholds and checks.
findings Structured review findings emitted by checks.

ADR

Problem: adapters tend to grow business logic

Decision: keep PHP facade, Artisan, HTTP, and MCP as thin adapters over ReviewEngine.

Consequences: there is one behavior to test, but adapters must validate input carefully.

Problem: external review can become expensive

Decision: run cheap deterministic checks first and spend LLM budget only when enabled and useful.

Consequences: default installs have zero token cost, but hosts must bind an LLM contract for semantic review.

Worked Example

php artisan evidence:review artifact.json --profile=medical --dry-run --json

Docs site

The docs tooling is self-contained in docs-site/: it has the only package.json in the repository, and all commands run from that folder.

cd docs-site
npm ci
npm run dev
npm run check
npm run build

npm run check fails on raw HTML or ::: button containers outside code samples. npm run build writes the static site to docs-site/_site.

Composer dist archive

.gitattributes marks docs-site/, docs/, tests/, skills/, .github/, .claude/, the README artwork and the dev config files as export-ignore. A Composer dist install (the default for tagged releases) contains only the runtime package (src/, config/, database/, routes/, resources/openapi.yaml, composer.json, README.md, LICENSE, SECURITY.md), so Node tooling and its lockfile do not reach vendor/. export-ignore only shapes the dist archive: a --prefer-source install is a full git clone and still contains every file. To inspect the archive locally:

git archive HEAD | tar -t

Gotcha / Limits

The package reviews evidence strength and risk boundaries; it does not retrieve sources, extract claims automatically, or replace human review for regulated decisions.

previous PHP Reference next HTTP Reference