[chubirka]

Plan 15, decision 10: the inventory-export reporting slice. Depends on contracts#127 and Core#397:

• feat(views): define inventory-export ViewModel contract traust-contracts#127
• feat(insight): publish native inventory export traust-core#397

Changes

• Route portfolio inventory-export through Core's registered inventory-export Insight view. Remove the client-side inventory join and copied column definition; Core owns rows, labels, ordering, cached contact resolution and rendering.
• Preserve default JSON-array stdout with the same eight raw human-label fields. Restore --format csv as Core-owned CSV stdout with safe one-line/formula-neutralized cells and semicolon-separated lists. No report files are created by the command.
• Retain --pd-cache-dir, including relative paths, as a per-invocation source override before Core services are wired. Do not place filesystem paths in ViewFilter or REST parameters.
• Expose the canonical {rows: [...]} wrapper and shared Markdown/HTML/CSV via the existing dashboard view inventory-export --out ... materializer. Reject unsupported global/historical inputs, including adapter-only --until, --sla-policy and --invoice, instead of silently dropping them.
• Preserve registered-repository selection, actual newest-first (created_at DESC, id DESC) ordering, current owners, deduplicated shipping products, recorded product-map precedence and optional product-definition contact semantics.
• Update CLI documentation/changelog and consistent version metadata to 0.44.0; 0.43.0 already has an existing tag, which was not overwritten. No release/tag was created.

Scope and compatibility

No inventory-declaration storage, owner policy, onboarding, scanner, PQC policy or ranking redesign. One existing leased cloud-audit test now records its synthetic repository's imported default line before submitting the order, as current Core requires. Production authorization/authentication is unchanged; both backends of that fixture passed after the setup correction.

The existing PQC representative-ref fixture also supplied IDs/timestamps that the database
correctly ignores on insert. It now persists its intended test timestamps explicitly and
checks the documented tie-break against actual database-generated UUIDs. This removes a
SQLite clock-resolution flake without changing production PQC selection or policy; both
backends of the corrected scenario passed.

Verification

• Frozen dependency installation targets the published immutable Core feature commit, not a local editable override or compatibility fork; full-suite results are recorded in the verification comment.
• Actual installed CLI scenarios on SQLite and PostgreSQL matched the old producer's entire JSON array exactly, including raw hostile text and ordering; CSV, contacts/products/current-owner joins, canonical exports, schema validation and scope refusal passed.
• Full SQL snapshots across 33 SQLite / 42 PostgreSQL tables and all object bytes remained unchanged after reporting.
• Actual localhost authenticated Core APIs on both databases returned the same canonical wrapper (200) and refused historical scope (422 problem+json), with no SQL/object writes.
• Real Chromium inspection of both HTML outputs retained hostile text as visible data with no injected images/scripts/event handlers/JavaScript links or executed injection.
• Lint/format, documentation/content-license guards and the CI-pinned consumer ratchet passed. Repository suite and immutable-pin rerun results are recorded separately.

Merge gate — keep draft

Current review pin is Core 81e27c598e602594ae517aa2e0fc39e49637f962, whose only new contracts dependency is the directly based schema feature in contracts#127. Merge contracts#127, re-pin/verify/merge Core#397 against canonical merged contracts, then re-pin and verify this consumer against merged Core before making it ready. No automatic merges.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chubirka]

Final verification for 51078be:

• Frozen installation resolves the published Git Core commit 81e27c598e602594ae517aa2e0fc39e49637f962 and schema commit 1a0c02c9b139975b5ce94e94b44933e854117d50. A runtime direct_url check verified the Core VCS commit and absence of an editable override.
• Complete consumer suite with isolated PostgreSQL enabled: 3,042 passed, 17 existing skips, zero failures/errors. Lint/format, documentation/content-license guards, CI-pinned consumer ratchet, and commit/push guards passed without bypasses.
• Final installed-pin CLI reruns on SQLite/PostgreSQL preserve the entire legacy JSON array and canonical wrapper, safe CSV, all four dashboard formats, and unchanged SQL/object snapshots.
• Native earlier SQL snapshots covered 33 SQLite / 42 PostgreSQL tables; live authenticated APIs on both backends returned the matching wrapper (200), refused history (422 problem+json), and changed no SQL/object state. Real Chromium retained hostile text as visible data with no active injected nodes/handlers/JavaScript links.
• The leased cloud-audit fixture now imports its known default line; the PQC ref-selection fixture now uses persisted test timestamps and actual database UUID tie-breaking instead of ignored constructor values. No production authorization or PQC policy was changed.

Merge gate remains contracts#127 → Core#397 canonical re-pin/verification/merge → this consumer canonical Core re-pin/verification. Core#397 documents two unrelated reproduced baseline performance failures and a full-rerun deadline; its current inventory-only volume suite has 9 passing cases. No full-performance-green claim or automatic merge.

[chubirka]

/agentic_review

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-for-traust-sci]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.