feat(campaign): read-only campaign-cli ledger reporter (v5.7 Fase 2 Block 3b)

Read-only reporter over the durable campaign-ledger core (Block 3a). Mirrors
knowledge-refresh-cli: the deterministic, READ-ONLY half of the campaign motor.

- scanners/campaign-cli.mjs (-cli → not an orchestrated scanner): loadLedger +
  validateLedger + rollUp, emits {status, initialized, ledgerPath, schemaVersion,
  createdDate, updatedDate, repos, rollUp} JSON. NEVER writes — a missing ledger
  is reported gracefully (initialized:false), never created. init + status
  transitions belong to the Block 3c command layer (human-approved writes).
- --ledger-file overrides default path (deterministic testing); --output-file
  mirrors the sibling. Exit: 0 = initialized & valid, 1 = not initialized
  (advisory), 3 = error (parse/corrupt/invalid).
- 8 tests (tests/scanners/campaign-cli.test.mjs). Suite 1119→1127 green hermetic;
  scanner count stays 15 (-cli), SC-5 byte-stable.
- CLAUDE.md: §campaign-cli added; Testing badge corrected 1091/62 → 1127/64
  (fixes pre-existing Block 3a drift).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/scanners/campaign-cli.test.mjs

@@ -0,0 +1,140 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { readFileSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import {
+  createLedger,
+  addRepo,
+  setRepoStatus,
+  rollUp,
+  saveLedger,
+} from '../../scanners/lib/campaign-ledger.mjs';
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const CLI = resolve(__dirname, '../../scanners/campaign-cli.mjs');
+
+const NOW = '2026-06-22';
+
+// Every test passes an explicit --ledger-file in a temp dir, so the CLI never touches
+// the real default path under HOME — the suite is hermetic by construction.
+function runCli(extraArgs) {
+  try {
+    const stdout = execFileSync('node', [CLI, ...extraArgs], { encoding: 'utf-8', timeout: 15000 });
+    return { status: 0, stdout };
+  } catch (err) {
+    return { status: err.status, stdout: err.stdout || '', stderr: err.stderr || '' };
+  }
+}
+
+// Round-trip a populated ledger through the real lib + saveLedger so the CLI reads
+// exactly what the command layer would persist.
+async function seedLedger(dir) {
+  let l = createLedger({ now: NOW });
+  l = addRepo(l, { path: '/r/a', name: 'a' }, { now: NOW });
+  l = addRepo(l, { path: '/r/b', name: 'b' }, { now: NOW });
+  l = addRepo(l, { path: '/r/c', name: 'c' }, { now: NOW });
+  l = setRepoStatus(l, '/r/a', 'audited', {
+    now: NOW,
+    findingsBySeverity: { critical: 1, high: 2, medium: 0, low: 4 },
+    sessionId: '20260622_120000',
+  });
+  l = setRepoStatus(l, '/r/b', 'implemented', {
+    now: NOW,
+    findingsBySeverity: { critical: 0, high: 1, medium: 3, low: 0 },
+  });
+  // c stays pending, no findings
+  const file = join(dir, 'campaign-ledger.json');
+  await saveLedger(file, l);
+  return { file, ledger: l };
+}
+
+const EMPTY_ROLLUP = {
+  totalRepos: 0,
+  byStatus: { pending: 0, audited: 0, planned: 0, implemented: 0 },
+  bySeverity: { critical: 0, high: 0, medium: 0, low: 0 },
+  reposWithFindings: 0,
+};
+
+describe('campaign-cli — exit codes', () => {
+  it('exits 0 when the ledger exists and is valid', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const { file } = await seedLedger(dir);
+    const { status, stdout } = runCli(['--ledger-file', file]);
+    assert.equal(status, 0);
+    assert.equal(JSON.parse(stdout).initialized, true);
+  });
+
+  it('exits 1 (advisory) when no ledger file exists yet', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const { status, stdout } = runCli(['--ledger-file', join(dir, 'nope.json')]);
+    assert.equal(status, 1);
+    const out = JSON.parse(stdout);
+    assert.equal(out.initialized, false);
+    assert.deepEqual(out.repos, []);
+  });
+
+  it('exits 3 on a malformed (non-JSON) ledger file', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const file = join(dir, 'campaign-ledger.json');
+    writeFileSync(file, '{ not valid json');
+    assert.equal(runCli(['--ledger-file', file]).status, 3);
+  });
+
+  it('exits 3 on a schema-invalid ledger', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const file = join(dir, 'campaign-ledger.json');
+    writeFileSync(file, JSON.stringify({ schemaVersion: 99, repos: 'nope' }));
+    assert.equal(runCli(['--ledger-file', file]).status, 3);
+  });
+});
+
+describe('campaign-cli — payload shape', () => {
+  it('emits the expected keys and a roll-up matching the lib', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const { file, ledger } = await seedLedger(dir);
+    const out = JSON.parse(runCli(['--ledger-file', file]).stdout);
+    assert.equal(out.status, 'ok');
+    assert.equal(out.initialized, true);
+    assert.equal(out.ledgerPath, resolve(file));
+    assert.equal(out.schemaVersion, 1);
+    assert.equal(out.createdDate, NOW);
+    assert.equal(out.updatedDate, NOW);
+    assert.equal(out.repos.length, 3);
+    assert.deepEqual(out.rollUp, rollUp(ledger));
+  });
+
+  it('repos carry per-repo provenance (status, findingsBySeverity, sessionId)', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const { file } = await seedLedger(dir);
+    const out = JSON.parse(runCli(['--ledger-file', file]).stdout);
+    const a = out.repos.find((r) => r.name === 'a');
+    assert.equal(a.status, 'audited');
+    assert.deepEqual(a.findingsBySeverity, { critical: 1, high: 2, medium: 0, low: 4 });
+    assert.equal(a.sessionId, '20260622_120000');
+  });
+
+  it('uninitialized payload has empty repos and an all-zero roll-up', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const out = JSON.parse(runCli(['--ledger-file', join(dir, 'nope.json')]).stdout);
+    assert.equal(out.initialized, false);
+    assert.equal(out.schemaVersion, null);
+    assert.deepEqual(out.repos, []);
+    assert.deepEqual(out.rollUp, EMPTY_ROLLUP);
+  });
+});
+
+describe('campaign-cli — --output-file', () => {
+  it('writes JSON to the file and stays silent on stdout', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'camp-cli-'));
+    const { file } = await seedLedger(dir);
+    const out = join(dir, 'report.json');
+    const { stdout } = runCli(['--ledger-file', file, '--output-file', out]);
+    assert.equal(stdout.trim(), '', 'stdout is silent when --output-file is given');
+    const written = JSON.parse(readFileSync(out, 'utf-8'));
+    assert.equal(written.status, 'ok');
+    assert.equal(written.repos.length, 3);
+  });
+});