fix: IMP-4/5/6 — parser allowlist, delete ID resolution, consistent errors

IMP-5: Replace strings.Contains(arg, ":") heuristic with an allowlist
of recognized attribute keys (ValidAttributeKeys). Colons in task
descriptions (URLs, "Meeting: topic") are no longer misinterpreted as
modifiers. Canonical key sets live in engine/keys.go and are shared
across parseAddArgs, ParseFilter, and ParseModifier. ParseModifier now
errors on unknown keys.

IMP-4: delete command now loads the working set and resolves display IDs
via GetTaskByDisplayID, matching the pattern used by done/modify.

IMP-6: All action commands (done, delete, modify, start, stop) now
return an error on no-match (stderr, exit 1). Previously done/delete
printed to stdout and exited 0; start/stop had no check at all.

Also adds requirements and design docs for the CLI UX improvements.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

opal-task/internal/engine/filter.go

@@ -42,17 +42,18 @@ func ParseFilter(args []string) (*Filter, error) {
 		} else if strings.HasPrefix(arg, "-") && !strings.Contains(arg, ":") {
 			// Exclude tag (but not negative modifiers like priority:-)
 			f.ExcludeTags = append(f.ExcludeTags, strings.TrimPrefix(arg, "-"))
-		} else if strings.Contains(arg, ":") {
-			// Attribute filter
-			parts := strings.SplitN(arg, ":", 2)
-			key := parts[0]
-			value := parts[1]
+		} else if idx := strings.Index(arg, ":"); idx > 0 {
+			key := arg[:idx]
+			value := arg[idx+1:]
 
-			if key == "uuid" {
+			if FilterOnlyKeys[key] {
+				// Filter-only keys (e.g., uuid)
 				f.UUIDs = append(f.UUIDs, value)
-			} else {
+			} else if ValidAttributeKeys[key] {
+				// Known attribute filter
 				f.Attributes[key] = value
 			}
+			// Unrecognized key:value tokens are silently ignored
 		} else {
 			// Try parsing as numeric ID
 			id, err := strconv.Atoi(arg)

opal-task/internal/engine/keys.go

@@ -0,0 +1,30 @@
+package engine
+
+// ValidAttributeKeys are the recognized key:value attribute names.
+// Used by parseAddArgs (cmd/add.go), ParseFilter, and ParseModifier
+// to distinguish modifiers from description text.
+var ValidAttributeKeys = map[string]bool{
+	"due":       true,
+	"priority":  true,
+	"project":   true,
+	"recur":     true,
+	"status":    true,
+	"wait":      true,
+	"scheduled": true,
+	"until":     true,
+}
+
+// DateKeys is the subset of ValidAttributeKeys that hold date values.
+// Used by Modifier.Apply and Modifier.ApplyToNew for date parsing.
+var DateKeys = map[string]bool{
+	"due":       true,
+	"scheduled": true,
+	"wait":      true,
+	"until":     true,
+}
+
+// FilterOnlyKeys are additional keys valid in filter context but not as
+// modifiers (e.g., uuid is a filter target, not something you set via modify).
+var FilterOnlyKeys = map[string]bool{
+	"uuid": true,
+}

opal-task/internal/engine/modifier.go

@@ -23,7 +23,9 @@ func NewModifier() *Modifier {
 	}
 }
 
-// ParseModifier parses command-line args into Modifier
+// ParseModifier parses command-line args into Modifier.
+// Only recognized attribute keys (ValidAttributeKeys) are accepted;
+// unrecognized key:value tokens produce an error.
 func ParseModifier(args []string) (*Modifier, error) {
 	m := NewModifier()
 
@@ -34,11 +36,13 @@ func ParseModifier(args []string) (*Modifier, error) {
 		} else if strings.HasPrefix(arg, "-") && !strings.Contains(arg, ":") {
 			// Remove tag
 			m.RemoveTags = append(m.RemoveTags, strings.TrimPrefix(arg, "-"))
-		} else if strings.Contains(arg, ":") {
-			// Attribute modification
-			parts := strings.SplitN(arg, ":", 2)
-			key := parts[0]
-			value := parts[1]
+		} else if idx := strings.Index(arg, ":"); idx > 0 {
+			key := arg[:idx]
+			value := arg[idx+1:]
+
+			if !ValidAttributeKeys[key] {
+				return nil, fmt.Errorf("unknown modifier: %q (known: due, priority, project, recur, status, wait, scheduled, until)", key)
+			}
 
 			if value == "" {
 				// Clear attribute (priority: with no value)
@@ -83,7 +87,7 @@ func (m *Modifier) Apply(task *Task) error {
 	resolvedDates["modified"] = task.Modified
 
 	// Apply attributes in the order they were specified (important for relative references)
-	dateKeys := map[string]bool{"due": true, "scheduled": true, "wait": true, "until": true}
+	dateKeys := DateKeys
 
 	for _, key := range m.AttributeOrder {
 		valuePtr := m.SetAttributes[key]
@@ -151,7 +155,7 @@ func (m *Modifier) ApplyToNew(task *Task) error {
 	}
 
 	// Apply attributes in the order they were specified (important for relative references)
-	dateKeys := map[string]bool{"due": true, "scheduled": true, "wait": true, "until": true}
+	dateKeys := DateKeys
 
 	for _, key := range m.AttributeOrder {
 		valuePtr := m.SetAttributes[key]