feat(app-builder): add deterministic replay

[kattsushi]

Closes #123

Tracker: #92

Chain Context

• Strategy: feature-branch-chain
• Current slice: PR 06 / Deterministic Replay
• Base: feat/app-builder-golden-cli-protocol at fb2313382fb02d6753b7b55d6003800ebbd8a06d
• Head: feat/app-builder-golden-replay at b7348d7eae289a6990c9d3142f293bad4217dafe
• Out of scope: nested E2E, showcase, Effect AI, MCP, marketplace, arbitrary execution, and unrelated refactors.

tracker (#92) -> PR 01 -> PR 02 -> PR 03 -> PR 04 -> PR 05 -> 📍 PR 06 -> PR 07 -> PR 08

Summary

• Adds canonical JSON/digest provenance and semantic dependency identity for frozen replay inputs.
• Validates candidate and workspace output identities without crossing the Tree mutation boundary.
• Binds the closed replay CLI command to trusted evidence while retaining JSON/JSONL framing and terminal semantics.

Changes

File	Change
packages/app-builder/generation/src/{cjson,provenance,replay}.ts	Adds canonical SHA-256 evidence, pin validation, semantic dependency comparison, and no-write replay validation.
packages/app-builder/generation/tests/replay.test.ts	Covers R12/R13 and S21-S24 with a real Nx Tree replay harness.
packages/app-builder/cli/src/commands.ts	Routes replay to the trusted validation authority.
openspec/changes/app-builder-golden-monorepo/tasks.md	Marks only 6.1 and 6.2 complete.

Test Plan

• pnpm nx run @effectify/repo:format:check passed.
• pnpm nx run-many --target=lint|typecheck|test|build --projects=@effectify/app-builder-generation,@effectify/app-builder-cli passed.
• Exact-parent pnpm nx affected --target=lint|typecheck|test|build --base=fb2313382fb02d6753b7b55d6003800ebbd8a06d --head=HEAD passed; existing warnings were outside this slice.
• Built Node runtime replay returned exit 0, empty stderr, one Success terminal envelope, and { "diffPaths": [], "zeroDiff": true }.
• No shell scripts changed; shellcheck is not applicable.

Contributor Checklist

• Linked approved issue Deliver App Builder Golden deterministic replay slice #123.
• Added exactly one type:feature label.
• Conventional commit with no Co-Authored-By trailer.
• Scope remains one autonomous chained work unit with a replay-evidence-only rollback boundary.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e96aaa8c-7427-4136-94eb-d9c204e60f52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}