feat(cli): add detection disposition command

[kkkhs]

What

Closes #100. Adds shell access for closing audit detections through the existing disposition API.

Fix

Adds agentmetry disposition <correlation_id> <rule_id> with closing status choices, optional API-key forwarding, AGENTMETRY_URL support, and client-side note validation for false positives and accepted risks.

Test

Adds CLI parser/client tests for payloads, configured URL/API key, note validation, down-orchestrator handling, and server error rendering.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[blitzcrieg1]

Thank you for this. It is more than the issue asked for, in the right places.

Requiring --note for false_positive and risk_accepted is the detail I want to single out. Accepting a risk without recording why is exactly what turns a disposition into a checkbox, and this project's argument is that the decision has to be evidence. You added that without being asked, which tells me you read what the feature is for rather than only what it does.

Supporting AGENTMETRY_API_KEY and AGENTMETRY_URL is also a step past the brief, and welcome. I had told another contributor not to solve auth in their command, so having it solved properly here is better than either of us doing it halfway.

Updating both README spots, including the CLI table, is the part people skip.

The blocker is the CLA, not the code

All eight CI checks pass. CLAAssistant is red because your signature is not recorded yet.

Comment on this PR with exactly:

I have read the CLA Document and I hereby sign the CLA

The bot picks it up and turns the check green. That is the only thing standing between this and review.

One heads-up

#139 touches the same two files, cli/__init__.py and tests/test_cli_commands.py. Whichever lands second will need a rebase, and it will be a small one. Nothing for you to do now, just so it is not a surprise.

If you want more after this

The area you have just walked into is the one that matters most in the next few weeks. Detections have to be triaged or a dogfood week goes red, and until your command exists that is only possible through the dashboard. So this is not a starter task that happens to be open, it is load-bearing.

If you want another, #130 is unclaimed: one secret currently produces up to four critical findings because DLP rules overlap and the scanner returns every match. It needs a judgment call about which of four approaches is right, and an argument for one of them would be welcome even without code.

And if you know people who enjoy pulling a detection tool apart, please send them this way. The most useful thing anyone sends this project is a report that a rule fired on something legitimate, and there is a standing offer here: a case that makes a rule misfire is worth more than a case that confirms it works.

[blitzcrieg1]

Gentle nudge, and no pressure attached to it.

This is ready apart from one line. All eight CI checks pass. The only red is CLAAssistant, and it clears the moment you post this as a comment on this PR:

I have read the CLA Document and I hereby sign the CLA

Nothing else is outstanding. I am not asking for code changes.

Worth saying why I am nudging at all rather than waiting quietly. The four-week evaluation clock this project gates its beta on restarted on 2026-08-30, and a week goes red if any detection is left untriaged at the end of it. Closing a detection today needs the dashboard or a raw API call, which is precisely why untriaged findings piled up from one to seven inside a single day last week. Your command is the thing that fixes that, so it is load-bearing rather than a nice addition.

If you are busy, that is completely fine and I will triage through the dashboard this week rather than have a deadline of mine become a deadline of yours. The PR keeps its place either way, and I would rather it land with your name on it than rush it.

Thanks again for the --note requirement on false_positive and risk_accepted. That was not in the issue and it is the detail that makes a disposition evidence rather than a checkbox.