feat(api): consolidate interpretation-run retrieval GET and CLI

CHANGELOG.d/interpretation-run-retrieval-cli.md

@@ -0,0 +1 @@
+- `orchestrator_live` `tepp-interpretation-run-get get` mints a typed contextual-orchestrator `GET /v1/interpretation-runs/{idempotency_key}` onto spawned `tepp-orchestrator-loopback` TCP (ADR 0072). Metric-free hypothetical identities only (`claim_status=hypothetical`, `scientific_authority=false`). `tepp.scientific_acceptance.v1` never appears. Does not infer causality. Naruon and LineageWeave are refused. Not collection CLI, not GET-by-id HTTP-only, not persistence.

CHANGELOG.d/interpretation-run-retrieval-http.md

@@ -0,0 +1 @@
+- `orchestrator_live` loopback `GET /v1/interpretation-runs/{idempotency_key}` returns one accepted hypothetical interpretation-run identity on `tepp-orchestrator-loopback` without POST replay (ADR 0071). Metric-free identities only (`claim_status=hypothetical`, `scientific_authority=false`). `tepp.scientific_acceptance.v1` never appears. Does not infer causality. Naruon and LineageWeave are refused. Not collection GET, not collection CLI, not persistence.

DOCUMENTATION.md

@@ -15,6 +15,8 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Orchestrator live HTTP doctoring | [`docs/research/orchestrator-live-http.md`](docs/research/orchestrator-live-http.md) |
 | Interpretation-run CLI doctoring | [`docs/research/interpretation-run-cli.md`](docs/research/interpretation-run-cli.md) |
 | Interpretation-run collection GET doctoring | [`docs/research/interpretation-run-collection-http.md`](docs/research/interpretation-run-collection-http.md) |
+| Interpretation-run GET-by-id doctoring | [`docs/research/interpretation-run-retrieval-http.md`](docs/research/interpretation-run-retrieval-http.md) |
+| Interpretation-run retrieval CLI doctoring | [`docs/research/interpretation-run-retrieval-cli.md`](docs/research/interpretation-run-retrieval-cli.md) |
 | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) |
 | Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) |
 | Security policy | [`SECURITY.md`](SECURITY.md) |

crates/orchestrator_live/Cargo.toml

@@ -29,5 +29,11 @@ path = "src/bin/tepp_interpretation_runs.rs"
 test = false
 bench = false
 
+[[bin]]
+name = "tepp-interpretation-run-get"
+path = "src/bin/tepp_interpretation_run_get.rs"
+test = false
+bench = false
+
 [lints]
 workspace = true

crates/orchestrator_live/src/bin/tepp_interpretation_run_get.rs

@@ -0,0 +1,34 @@
+//! Operator CLI for loopback contextual-orchestrator interpretation-run GET-by-id.
+
+use std::io::{self, IsTerminal};
+use std::process::ExitCode;
+
+use orchestrator_live::{
+    execute_interpretation_run_retrieval_cli, read_interpretation_run_retrieval_cli_stdin,
+    render_interpretation_run_retrieval_cli_stdout, InterpretationRunRetrievalCliInvocation,
+    OrchestratorLiveError,
+};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => ExitCode::FAILURE,
+    }
+}
+
+fn run() -> Result<(), OrchestratorLiveError> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    match args.first().map(String::as_str) {
+        Some("get") => run_get(&args),
+        _ => Err(OrchestratorLiveError::InvalidWirePayload),
+    }
+}
+
+fn run_get(args: &[String]) -> Result<(), OrchestratorLiveError> {
+    let body = read_interpretation_run_retrieval_cli_stdin(io::stdin().is_terminal(), io::stdin())?;
+    let invocation = InterpretationRunRetrievalCliInvocation::from_args(args, body)?;
+    let response = execute_interpretation_run_retrieval_cli(&invocation)?;
+    let stdout = render_interpretation_run_retrieval_cli_stdout(&invocation, &response)?;
+    println!("{stdout}");
+    Ok(())
+}

crates/orchestrator_live/src/http.rs

@@ -5,7 +5,7 @@ use std::io::{Read, Write};
 
 use crate::error::OrchestratorLiveError;
 use crate::request::{
-    DEFAULT_INTERPRETATION_BYTE_LIMIT, host_implies_table_access, require_nonempty,
+    host_implies_table_access, require_nonempty, DEFAULT_INTERPRETATION_BYTE_LIMIT,
 };
 
 /// Maximum request-line plus header bytes accepted before the body.
@@ -211,6 +211,17 @@ pub(crate) fn refuse_collection_get_headers(
     Ok(())
 }
 
+/// GET-by-id admits empty bodies and refuses pagination plus `idempotency-key`.
+pub(crate) fn refuse_retrieval_get_headers(
+    headers: &HashMap<String, String>,
+) -> Result<(), OrchestratorLiveError> {
+    refuse_collection_get_headers(headers)?;
+    if headers.contains_key("tepp-page-limit") || headers.contains_key("tepp-page-cursor") {
+        return Err(OrchestratorLiveError::InvalidWirePayload);
+    }
+    Ok(())
+}
+
 fn refuse_common_live_headers(
     headers: &HashMap<String, String>,
 ) -> Result<(), OrchestratorLiveError> {
@@ -280,8 +291,8 @@ pub(crate) fn status_for(error: OrchestratorLiveError) -> (u16, &'static str) {
 mod tests {
     use super::{
         declared_content_length, header_is_credential, map_io_error, parse_headers,
-        parse_request_line, refuse_collection_get_headers, refuse_live_headers, split_header_line,
-        split_request, status_for,
+        parse_request_line, refuse_collection_get_headers, refuse_live_headers,
+        refuse_retrieval_get_headers, split_header_line, split_request, status_for,
     };
     use crate::error::OrchestratorLiveError;
     use std::collections::HashMap;
@@ -457,6 +468,13 @@ mod tests {
         );
         headers.remove("idempotency-key");
         refuse_collection_get_headers(&headers).expect("collection headers");
+        refuse_retrieval_get_headers(&headers).expect("retrieval headers");
+        headers.insert("tepp-page-limit".into(), "1".into());
+        assert_eq!(
+            refuse_retrieval_get_headers(&headers),
+            Err(OrchestratorLiveError::InvalidWirePayload)
+        );
+        headers.remove("tepp-page-limit");
         headers.insert("tepp-consumer".into(), "naruon".into());
         assert_eq!(
             refuse_collection_get_headers(&headers),