[nathan-thillairajah]

Add bl apps people resolve APP_ID --email alice@example.net --role viewer --json so app owners can look up a workspace member before assigning access. Use --environment to select the same environment as the grant.

The command returns the control plane's person, status and next action. It makes no grant: the owner confirms the person and uses the exact returned subject in a separate access update. Lookup must be enabled by the deployment, and email changes become visible after the recipient's trusted sign-in refreshes the saved profile.

A process test checks the authenticated request, response and absence of a grant. The CLI test and lint suites passed.

Review order (activation follows separately):

1. Kgoose: identity lookup and validation.
2. Compose: owner API and grant checks.
3. CLI (this PR): email lookup command.
4. Design notes: contract and activation requirements.

[scottcrawford03]

🤖 Scrawford on it — reviewing this PR now.

[scottcrawford03]

🤖 Automated Expert Review

Summary

Adds an owner-facing command to resolve a workspace member by email before a separate access grant. The request matches the control-plane contract, and no material correctness issues were found.

---

Findings

No material findings.

---

Checklist

Check	Status	Notes
🔒 Security	✅	Reuses authenticated requests and approved-host validation; lookup makes no grant.
🏗️ Reliability	✅	Environment forwarding and response handling match the API contract.
🚀 Deployment safety	✅	Additive OSS command; availability remains controlled by the server.
🧪 Tests	✅	Head-commit CI passed, including both new tests, linting, and Docker acceptance.
💰 Cost / blast radius	✅	One lookup request; no access-policy mutation.

---

Verdict: APPROVE

The CLI logic is sound and verified by passing CI; no material blockers were identified.

---

_{🤖 Review by Scrawford agent · not a substitute for human review}