#178 cli: add deterministic JSON output to doberman scan

[Anonymous]

Originally created by: fu351

Context

doberman scan currently renders a human-readable local capability risk map. An opt-in JSON mode would make the same results usable by scripts and editor integrations without changing the default experience.

Suggested starting points

• src/doberman/cli/main.py — the scan command
• src/doberman/discovery/scan.py — capability enumeration, rating, and human rendering
• tests/unit/test_discovery_scan.py
• tests/unit/test_risk_map.py
• Existing CLI tests that use Typer's CliRunner

Acceptance criteria

• [ ] Add a --json option to doberman scan.
• [ ] Emit exactly one valid JSON document on stdout when the option is used.
• [ ] Define and document a small stable schema containing the information already available from the rated capability results.
• [ ] Make output deterministic for identical scan results (including object keys and capability ordering).
• [ ] Do not mix Rich tables, headings, or progress text into JSON stdout.
• [ ] Preserve the current human-readable output when --json is absent.
• [ ] Preserve existing success/failure exit semantics.
• [ ] Add tests for JSON parsing, schema fields, deterministic ordering, default-output compatibility, empty results, and redaction/sensitive-content safety.

Suggested validation

Use CliRunner with injected or monkeypatched capability results so tests do not inspect the developer's machine. Parse stdout with Python's standard json module and compare repeated runs.

Out of scope

• Changing capability discovery or risk-rating logic.
• Adding network calls or remote inventory.
• Replacing the existing human-readable risk map.
• Introducing enterprise dashboard concepts.

Security and compatibility

JSON output must not add raw file contents, environment values, credentials, or unredacted payloads. Core must remain standalone with no enterprise package installed, and machine-readable errors should not be interleaved with JSON stdout.

See CONTRIBUTING.md (github.com) before opening a pull request.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed