@codacy/verity-cli 0.30.1 → 0.31.0-experimental.6bc3b1b

package/data/skills/verity-insights/SKILL.md

@@ -85,3 +85,27 @@ curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
 3. **Review**: User sees suggestions with evidence (run counts, FP rates, citation counts)
 4. **Apply**: Approved suggestions become a new Standard version (immutable, rollback-safe)
 5. **No autonomous changes** in v1 — every suggestion requires human approval
+
+## Recording an accepted-risk disposition (unblocking a guard deadlock)
+
+When the pre-commit/pre-push guard blocks on a finding that humans have already
+adjudicated the other way (a reviewer finding, an ADR, phase exit criteria),
+record the disposition with:
+
+```bash
+verity waive <pattern-id> --file <path> --reason "per reviewer finding 5 — no code change needed"
+```
+
+What this does — and deliberately does not do:
+
+- Marks the open statement `waived` with your reason; the next guard/analyze run
+  on the **same file bytes** no longer blocks on it, and the disposition is
+  visible in the run report.
+- **It voids automatically when the file changes** — a waive is an assertion
+  about specific bytes, never a standing mute. Edit the file and the finding is
+  reconsidered fresh.
+- The reason is mandatory (≥ 20 chars) and should name the human decision it
+  traces to. At most 3 statements are waived per invocation.
+- `verity feedback finding <run-id> <pattern-id> false_positive` remains the
+  right tool for *pattern-level* feedback (it feeds suppression/evolution);
+  `verity waive` is the *per-site, accepted-risk* path that unblocks a push.

package/data/skills/verity-setup/SKILL.md

@@ -751,6 +751,48 @@ global store and removes it automatically on the next `verity` command.
 
 ---
 
+## Step 10b: Offer a `.verityignore` (optional)
+
+Only if the codebase analysis in Step 2 found committed generated output —
+`dist/`, `build/`, vendored bundles, generated API clients, large fixture
+corpora. Do NOT create the file speculatively; an empty or guessed ruleset is
+worse than none.
+
+Ask the user first, naming the specific directories you found. If they agree,
+write `.verityignore` at the repo root, gitignore syntax, and **commit it** — it
+is a shared team decision, not machine-local state, so it does NOT go in
+`.gitignore`.
+
+```
+# Generated — reviewing it grades a generator, not a person.
+src/generated/**
+dist/
+
+# …but keep this one in scope.
+!dist/entry.js
+```
+
+Rules, in the order they matter:
+
+- **Last match wins.** A later `!` line re-includes what an earlier line
+  excluded. Order is load-bearing.
+- A pattern with **no slash** matches at any depth (`*.min.js`). One **with** a
+  slash is anchored to the repo root (`src/generated/**`).
+- `**`, `*`, `/` and `**/*` on their own are **refused** — they exclude the whole
+  repository, which is turning the product off rather than scoping it.
+
+Two things to tell the user, because both surprise people:
+
+1. **It cannot hide a finding you just created.** Any turn that changes
+   `.verityignore` has its rules suspended entirely, and the edit is always
+   reviewed. A rule takes effect from the next turn onward.
+2. **A pattern that covers a secret is warned about, not refused** — `config/**`
+   also hides `config/.env`. Verity says so at push time and again on any run
+   where it actually excludes one. Add a `!` rule if that is not what was meant.
+
+Excluded files are still named in every run's coverage ledger, and the share of
+changed files they cover is reported — an ignore file is never silent.
+
 ## Step 11: Show summary
 
 Print a complete summary:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.30.1",
+  "version": "0.31.0-experimental.6bc3b1b",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",