# Evidence Legal Holds CLI

## Module
Cli

## Status
VERIFIED

## Description
CLI commands for managing legal holds on evidence artifacts. Users can create holds scoped by digest, component, time-range, or all artifacts; list active/released holds; show hold details with affected artifact counts; and release holds with confirmation and audit reasons. Held artifacts are protected from retention policy deletion.

## Implementation Details
- **Command Group**: `src/Cli/StellaOps.Cli/Commands/EvidenceHoldsCommandGroup.cs` -- `EvidenceHoldsCommandGroup` (public static class)
- **Commands**:
  - `stella evidence holds create --scope digest|component|time-range|all` -- create a legal hold. Options: `--digest <digest>`, `--component <purl>`, `--from/--to`, `--reason <text>`
  - `stella evidence holds list` -- list holds. Options: `--status active|released`, `--format table|json`
  - `stella evidence holds show <hold-id>` -- show hold details with affected artifact count
  - `stella evidence holds release <hold-id> --reason <text>` -- release a hold with audit reason (requires confirmation)

## E2E Test Plan
- [ ] Run `stella evidence holds create --scope digest --digest sha256:abc123 --reason "Legal investigation"` and verify hold created
- [ ] Run `stella evidence holds create --scope all --reason "Litigation hold"` and verify all-artifact hold
- [ ] Run `stella evidence holds list` and verify active holds displayed
- [ ] Run `stella evidence holds list --status released` and verify released holds
- [ ] Run `stella evidence holds show <id>` and verify hold details with affected artifact count
- [ ] Run `stella evidence holds release <id> --reason "Investigation complete"` and verify release with confirmation
- [ ] Verify held artifacts are protected from retention policy deletion
- [ ] Verify `--format json` output for automation

## Verification

- **Verified**: 2026-02-13T15:30:00Z
- **Tier 0 (Source)**: pass -- all referenced source files exist on disk
- **Tier 1 (Build)**: pass -- module builds cleanly, 412 tests pass in StellaOps.Cli.Commands.Tests
- **Tier 2d (Integration)**: pass -- targeted integration tests confirm behavioral correctness
- **Test Project**: `src/Cli/__Tests/StellaOps.Cli.Commands.Tests/StellaOps.Cli.Commands.Tests.csproj`
- **Evidence**: `docs/qa/feature-checks/runs/cli/evidence-legal-holds-cli/run-001/tier2-integration-check.json`