fix(work): import hashlib and wire heal subparser into main CLI

tests/test_box_dev_https.py

@@ -30,6 +30,7 @@ def _load(name, relpath):
 
 
 exec_constrained = _load("exec_constrained_dev", "bin/exec-constrained.py")
+box_ctl = _load("box_ctl_devtest", "bin/box-ctl.py")
 
 
 def _box_ctl(*args):
@@ -38,6 +39,35 @@ def _box_ctl(*args):
         capture_output=True, text=True, timeout=120)
 
 
+class _InProcResult:
+    """Minimal CompletedProcess stand-in (returncode/stdout/stderr)."""
+    def __init__(self, returncode, stdout, stderr=""):
+        self.returncode = returncode
+        self.stdout = stdout
+        self.stderr = stderr
+
+
+def _box_ctl_inproc(*args):
+    """In-process _box_ctl for pure dry-run verbs (quality-validate).
+
+    Calls the real main(argv) -- identical argv parsing, dispatch, audit,
+    and stdout JSON -- with stdio captured, amortizing the ~80ms
+    per-spawn interpreter + module-exec cost over one import. Only valid
+    for verbs that never read stdin (quality-validate is a dry-run that
+    never consumes stdin payloads).
+    """
+    import io
+    from contextlib import redirect_stderr, redirect_stdout
+    out, err = io.StringIO(), io.StringIO()
+    returncode = 0
+    with redirect_stdout(out), redirect_stderr(err):
+        try:
+            box_ctl.main(["box-ctl.py", *args])
+        except SystemExit as e:
+            returncode = e.code if isinstance(e.code, int) else 1
+    return _InProcResult(returncode, out.getvalue(), err.getvalue())
+
+
 class ExecGitOpsTests(unittest.TestCase):
     def test_ops_registered_and_read_only(self):
         for op in ("git.status", "git.diff", "git.log"):
@@ -223,12 +253,14 @@ class BoxCtlGitTests(unittest.TestCase):
         self.assertNotEqual(r.returncode, 0)
 
     def test_quality_validate_git_verbs(self):
+        # In-process dry-runs: same main(argv) path and stdout JSON as
+        # subprocess calls. Assertions below are unchanged.
         for args in (["git-status"], ["git-diff", "--stat"],
                      ["git-diff", "--path", "bin/dm.py"],
                      ["git-log", "--limit", "5"]):
-            r = _box_ctl("quality-validate", *args)
+            r = _box_ctl_inproc("quality-validate", *args)
             self.assertTrue(json.loads(r.stdout)["valid"], args)
-        r = _box_ctl("quality-validate", "git-diff", "--path", "../x")
+        r = _box_ctl_inproc("quality-validate", "git-diff", "--path", "../x")
         self.assertFalse(json.loads(r.stdout)["valid"])
 
 
@@ -274,15 +306,17 @@ class BoxCtlTestsRunTests(unittest.TestCase):
         self.assertEqual(json.loads(r.stdout)["code"], "NOT_FOUND")
 
     def test_quality_validate_tests_run(self):
-        r = _box_ctl("quality-validate", "tests-run")
+        # In-process dry-runs: same main(argv) path and stdout JSON as
+        # subprocess calls. Assertions below are unchanged.
+        r = _box_ctl_inproc("quality-validate", "tests-run")
         self.assertTrue(json.loads(r.stdout)["valid"], r.stdout)
-        r = _box_ctl("quality-validate", "tests-run", "tests.test_box_read_https")
+        r = _box_ctl_inproc("quality-validate", "tests-run", "tests.test_box_read_https")
         self.assertTrue(json.loads(r.stdout)["valid"], r.stdout)
-        r = _box_ctl("quality-validate", "tests-run", "--filter", "safepath")
+        r = _box_ctl_inproc("quality-validate", "tests-run", "--filter", "safepath")
         self.assertTrue(json.loads(r.stdout)["valid"], r.stdout)
-        r = _box_ctl("quality-validate", "tests-run", "os")
+        r = _box_ctl_inproc("quality-validate", "tests-run", "os")
         self.assertFalse(json.loads(r.stdout)["valid"], r.stdout)
-        r = _box_ctl("quality-validate", "tests-run", "--filter")
+        r = _box_ctl_inproc("quality-validate", "tests-run", "--filter")
         self.assertFalse(json.loads(r.stdout)["valid"], r.stdout)
 
 
@@ -303,10 +337,12 @@ class BoxCtlAckTests(unittest.TestCase):
         self.assertEqual(json.loads(r.stdout)["code"], "BAD_ARGS")
 
     def test_quality_validate_ack(self):
-        r = _box_ctl("quality-validate", "ack", "bdf7beb6",
+        # In-process dry-runs: same main(argv) path and stdout JSON as
+        # subprocess calls. Assertions below are unchanged.
+        r = _box_ctl_inproc("quality-validate", "ack", "bdf7beb6",
                      "--to", "pip", "--sender", "opm")
         self.assertTrue(json.loads(r.stdout)["valid"], r.stdout)
-        r = _box_ctl("quality-validate", "ack", "xyz!",
+        r = _box_ctl_inproc("quality-validate", "ack", "xyz!",
                      "--to", "pip", "--sender", "opm")
         self.assertFalse(json.loads(r.stdout)["valid"], r.stdout)