fix(verify): request command JSON for Cutter inspection

Use --json-output for the verifier's ij observation. Exercise the actual
verifier-selected arguments through the public CLI and authenticated fixture
bridge, asserting command JSON mode and retained Evidence. The old bare --json
selection fails this control. A live Cutter GUI was not qualified here.

Fixes #4912

scripts/verify-real-cutter.mjs

@@ -87,7 +87,7 @@ try {
     session.session_id,
     String(session.document_generation),
     "ij",
-    "--json",
+    "--json-output",
   );
   assert.equal(inspection.predicate_type, "rea.cutter.command-observation");
   assert.ok(

tests/boundary/cli/cutterCommands.test.ts

@@ -1,10 +1,11 @@
 import { createServer } from "node:net";
 import { createHmac, randomUUID } from "node:crypto";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { afterEach, describe, expect, it } from "vitest";
+import ts from "typescript6";
 
 import { serveCli } from "./cliServeHarness.js";
 import {
@@ -23,6 +24,64 @@ const listen = async (
   return address.port;
 };
 
+const assertRealVerifierJsonInspection = async (
+  directory: string,
+  commandJsonModes: readonly boolean[],
+): Promise<void> => {
+  // Exercise the actual real-verifier command selection against the public CLI.
+  const source = ts.createSourceFile(
+    "verify-real-cutter.mjs",
+    await readFile("scripts/verify-real-cutter.mjs", "utf8"),
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.JS,
+  );
+  const observations: string[][] = [];
+  const visit = (node: ts.Node): void => {
+    if (
+      ts.isCallExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === "runCli" &&
+      ts.isStringLiteral(node.arguments[0]!) &&
+      node.arguments[0].text === "cutter-command" &&
+      node.arguments[3] !== undefined &&
+      ts.isStringLiteral(node.arguments[3]) &&
+      node.arguments[3].text === "ij"
+    ) {
+      observations.push(
+        node.arguments.slice(4).map((argument) => {
+          if (!ts.isStringLiteral(argument))
+            throw new Error(
+              "Verifier inspection flags must be explicit arguments",
+            );
+          return argument.text;
+        }),
+      );
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  expect(observations).toHaveLength(1);
+  const verification = await serveCli(
+    [
+      "cutter-command",
+      SESSION_ID,
+      "0",
+      "ij",
+      ...observations[0]!,
+      "--format",
+      "json",
+    ],
+    { REA_CUTTER_BRIDGE_DIR: directory },
+  );
+  expect(verification.exitCode).toBe(0);
+  expect(commandJsonModes.at(-1)).toBe(true);
+  expect(JSON.parse(verification.stdout)).toMatchObject({
+    predicate_type: "rea.cutter.command-observation",
+    raw_result: { answer: 42 },
+  });
+};
+
 describe("Cutter CLI commands", () => {
   let directory: string | undefined;
   let server: ReturnType<typeof createServer> | undefined;
@@ -270,5 +329,7 @@ describe("Cutter CLI command output flags", () => {
       expect(compatible.exitCode).toBe(0);
       expect(commandJsonModes.at(-1)).toBe(expected);
     }
+
+    await assertRealVerifierJsonInspection(directory, commandJsonModes);
   });
 });