@viberaven/cli 1.6.12 → 1.7.1

package/schemas/verification-report.schema.json

@@ -0,0 +1,550 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "VibeRaven local independent verification report v1",
+  "description": "Generated by the local trusted runner only, never accepted as input. checked means an observation ran; outcome separately records passed/failed. Conditions are the single public evidence mapping. Stored initial Task contract metadata remains backward compatible. Runtime additionally verifies frozen plan, snapshot, artifact and receipt hashes and checks current source freshness.",
+  "type": "object",
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "taskId": {
+      "type": "string",
+      "pattern": "^[a-f0-9-]{36}$"
+    },
+    "contractHash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "planHash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "baselineHash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "candidateHash": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "attemptId": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[a-f0-9-]{36}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "status": {
+      "enum": [
+        "checked",
+        "failed",
+        "not_checked"
+      ]
+    },
+    "stale": {
+      "type": "boolean"
+    },
+    "preparedAt": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 40
+    },
+    "approvedAt": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 40
+    },
+    "image": {
+      "type": "string",
+      "maxLength": 500
+    },
+    "adapterVersion": {
+      "const": "local-oracle-v1"
+    },
+    "baselineHeadSha": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[a-f0-9]{40,64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "candidateHeadSha": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[a-f0-9]{40,64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "conditions": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "conditionId": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+          },
+          "status": {
+            "enum": [
+              "checked",
+              "not_checked"
+            ]
+          },
+          "outcome": {
+            "enum": [
+              "passed",
+              "failed"
+            ]
+          },
+          "reason": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "checkIds": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+            },
+            "maxItems": 32
+          },
+          "receiptIds": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^[a-f0-9-]{36}$"
+            },
+            "maxItems": 64
+          },
+          "provenance": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "const": "independent_local_verification"
+              },
+              "planHash": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "baselineHash": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "candidateHash": {
+                "type": "string",
+                "pattern": "^(?:[a-f0-9]{64})?$"
+              },
+              "attemptId": {
+                "type": "string",
+                "pattern": "^(?:[a-f0-9-]{36})?$"
+              },
+              "adapterVersion": {
+                "const": "local-oracle-v1"
+              }
+            },
+            "required": [
+              "kind",
+              "planHash",
+              "baselineHash",
+              "candidateHash",
+              "attemptId",
+              "adapterVersion"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "required": [
+          "conditionId",
+          "status",
+          "reason",
+          "checkIds",
+          "receiptIds",
+          "provenance"
+        ],
+        "additionalProperties": false,
+        "oneOf": [
+          {
+            "properties": {
+              "status": {
+                "const": "checked"
+              },
+              "checkIds": {
+                "minItems": 1
+              },
+              "receiptIds": {
+                "minItems": 2
+              }
+            },
+            "required": [
+              "outcome"
+            ]
+          },
+          {
+            "properties": {
+              "status": {
+                "const": "not_checked"
+              }
+            },
+            "not": {
+              "required": [
+                "outcome"
+              ]
+            }
+          }
+        ]
+      },
+      "maxItems": 32
+    },
+    "scope": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "enum": [
+            "checked",
+            "failed",
+            "not_checked"
+          ]
+        },
+        "changedPaths": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "maxItems": 6000
+        },
+        "outsidePaths": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "maxItems": 6000
+        },
+        "protectedChanges": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "maxItems": 6000
+        }
+      },
+      "required": [
+        "status",
+        "changedPaths",
+        "outsidePaths",
+        "protectedChanges"
+      ],
+      "additionalProperties": false
+    },
+    "receipts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-f0-9-]{36}$"
+          },
+          "checkId": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+          },
+          "phase": {
+            "enum": [
+              "baseline",
+              "candidate"
+            ]
+          },
+          "attemptId": {
+            "type": "string",
+            "pattern": "^[a-f0-9-]{36}$"
+          },
+          "planHash": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "snapshotHash": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "image": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "retries": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 2
+          },
+          "state": {
+            "enum": [
+              "running",
+              "completed"
+            ]
+          },
+          "observation": {
+            "type": "object",
+            "properties": {
+              "outcome": {
+                "enum": [
+                  "pass",
+                  "fail",
+                  "not_checked"
+                ]
+              },
+              "reason": {
+                "type": "string",
+                "maxLength": 500
+              },
+              "startedAt": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 40
+              },
+              "durationMs": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "image": {
+                "type": "string",
+                "maxLength": 500
+              },
+              "adapterVersion": {
+                "enum": [
+                  "local-oracle-v1",
+                  "local-http-v1"
+                ]
+              },
+              "artifacts": {
+                "type": "object",
+                "properties": {
+                  "stdoutSha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "stderrSha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "capturedBytes": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "truncated": {
+                    "type": "boolean"
+                  },
+                  "stdoutRef": {
+                    "type": "string",
+                    "maxLength": 500
+                  },
+                  "stderrRef": {
+                    "type": "string",
+                    "maxLength": 500
+                  }
+                },
+                "required": [
+                  "stdoutSha256",
+                  "stderrSha256",
+                  "capturedBytes",
+                  "truncated"
+                ],
+                "additionalProperties": false
+              },
+              "cases": {
+                "type": "object",
+                "properties": {
+                  "passed": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "total": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "mismatched": {
+                    "type": "array",
+                    "items": {
+                      "type": "integer",
+                      "minimum": 0
+                    },
+                    "maxItems": 32
+                  }
+                },
+                "required": [
+                  "passed",
+                  "total",
+                  "mismatched"
+                ],
+                "additionalProperties": false
+              },
+              "tests": {
+                "type": "object",
+                "properties": {
+                  "passed": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "failed": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "skipped": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "total": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "fileFailures": {
+                    "type": "integer",
+                    "minimum": 0
+                  }
+                },
+                "required": [
+                  "passed",
+                  "failed",
+                  "skipped",
+                  "total"
+                ],
+                "additionalProperties": false
+              }
+            },
+            "required": [
+              "outcome",
+              "reason",
+              "startedAt",
+              "durationMs",
+              "image",
+              "adapterVersion",
+              "artifacts"
+            ],
+            "additionalProperties": false
+          },
+          "hash": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          }
+        },
+        "required": [
+          "id",
+          "checkId",
+          "phase",
+          "attemptId",
+          "planHash",
+          "snapshotHash",
+          "image",
+          "retries",
+          "state",
+          "hash"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 64
+    },
+    "limitations": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "maxLength": 500
+      },
+      "maxItems": 16
+    },
+    "excluded": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {
+            "type": "string",
+            "maxLength": 500
+          },
+          "reason": {
+            "enum": [
+              "secret",
+              "generated_or_private"
+            ]
+          }
+        },
+        "required": [
+          "path",
+          "reason"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 6000
+    },
+    "history": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "attemptId": {
+            "type": "string",
+            "pattern": "^[a-f0-9-]{36}$"
+          },
+          "candidateHash": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "createdAt": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 40
+          }
+        },
+        "required": [
+          "attemptId",
+          "candidateHash",
+          "createdAt"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 16
+    }
+  },
+  "required": [
+    "version",
+    "taskId",
+    "contractHash",
+    "planHash",
+    "baselineHash",
+    "candidateHash",
+    "attemptId",
+    "status",
+    "stale",
+    "preparedAt",
+    "image",
+    "adapterVersion",
+    "baselineHeadSha",
+    "candidateHeadSha",
+    "conditions",
+    "scope",
+    "receipts",
+    "limitations",
+    "excluded",
+    "history"
+  ],
+  "additionalProperties": false
+}

package/templates/AGENTS.snippet.md

@@ -1,56 +1,56 @@
-## VibeRaven Launch Readiness
-
-VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. It runs locally: no login, no API key, no telemetry.
-
-Use it when the user asks whether a Vercel + Supabase app built with an AI tool is ready to launch or hand off, or wants to find migrations that create tables without RLS. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test.
-
-### Humans
-
-```bash
-npx -y viberaven
-```
-
-This opens the local Studio. `npx -y viberaven check` prints a terminal verdict.
-
-### Agents
-
-```bash
-npx -y viberaven --agent-mode
-```
-
-1. Run `npx -y viberaven --agent-mode` from the project root.
-2. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict (`clear`, `warning` or `not_clear`), and `.viberaven/context-map.json` for compact agent context.
-3. Read `.viberaven/agent-summary.md` second for scan context.
-4. Read `.viberaven/launch-playbook.md` third for the full checklist.
-5. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
-6. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
-7. Do not claim provider dashboard checks are fixed by repo-code edits.
-8. After a batch of fixes, run tests/build, then `npx -y viberaven --verify`.
-
-For a CI verdict when the user wants one:
-
-```bash
-npx -y viberaven --strict
-```
-
-Also available:
-
-- `.viberaven/last-scan.json` - full mission map and gaps
-- `.viberaven/report.html` - visual map for the user
-- `npx -y viberaven init --dry-run` - preview local agent rules
-- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
-
-<!-- viberaven:agent-rules:start -->
-## VibeRaven Agent Rules
-
-VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test, and a clear result is not a security audit.
-
-- Suggest one pass with `npx -y viberaven --agent-mode` from the project root before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
-- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict, and `.viberaven/context-map.json` for compact agent context.
-- Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before editing code for a listed gap.
-- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
-- Run `npx -y viberaven --verify` once per batch of fixes, not after every edit.
-- For the Vercel + Supabase repo evidence, run `npx -y viberaven audit --vercel-supabase`.
-- `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.
-- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard.
-<!-- viberaven:agent-rules:end -->
+## VibeRaven Launch Readiness
+
+VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. It runs locally: no login, no API key, no telemetry.
+
+Use it when the user asks whether a Vercel + Supabase app built with an AI tool is ready to launch or hand off, or wants to find migrations that create tables without RLS. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test.
+
+### Humans
+
+```bash
+npx -y viberaven
+```
+
+This opens the local Studio. `npx -y viberaven check` prints a terminal verdict.
+
+### Agents
+
+```bash
+npx -y viberaven check
+```
+
+1. Run `npx -y viberaven check` from the project root.
+2. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict (`clear`, `warning` or `not_clear`), and `.viberaven/context-map.json` for compact agent context.
+3. Read `.viberaven/agent-summary.md` second for scan context.
+4. Read `.viberaven/launch-playbook.md` third for the full checklist.
+5. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
+6. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
+7. Do not claim provider dashboard checks are fixed by repo-code edits.
+8. After a batch of fixes, run tests/build, then `npx -y viberaven --verify`.
+
+For a CI verdict when the user wants one:
+
+```bash
+npx -y viberaven --strict
+```
+
+Also available:
+
+- `.viberaven/last-scan.json` - full mission map and gaps
+- `.viberaven/report.html` - visual map for the user
+- `npx -y viberaven init --dry-run` - preview local agent rules
+- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
+
+<!-- viberaven:agent-rules:start -->
+## VibeRaven Agent Rules
+
+VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test, and a clear result is not a security audit.
+
+- Suggest one pass with `npx -y viberaven check` from the project root before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
+- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict, and `.viberaven/context-map.json` for compact agent context.
+- Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before editing code for a listed gap.
+- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
+- Run `npx -y viberaven --verify` once per batch of fixes, not after every edit.
+- For the Vercel + Supabase repo evidence, run `npx -y viberaven audit --vercel-supabase`.
+- `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.
+- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard.
+<!-- viberaven:agent-rules:end -->

package/templates/CLAUDE.snippet.md

@@ -1,14 +1,14 @@
-<!-- viberaven:agent-rules:start -->
-## VibeRaven Agent Rules
-
-VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test, and a clear result is not a security audit.
-
-- Suggest one pass with `npx -y viberaven --agent-mode` from the project root before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
-- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict, and `.viberaven/context-map.json` for compact agent context.
-- Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before editing code for a listed gap.
-- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
-- Run `npx -y viberaven --verify` once per batch of fixes, not after every edit.
-- For the Vercel + Supabase repo evidence, run `npx -y viberaven audit --vercel-supabase`.
-- `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.
-- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard.
-<!-- viberaven:agent-rules:end -->
+<!-- viberaven:agent-rules:start -->
+## VibeRaven Agent Rules
+
+VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test, and a clear result is not a security audit.
+
+- Suggest one pass with `npx -y viberaven check` from the project root before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
+- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the verdict, and `.viberaven/context-map.json` for compact agent context.
+- Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before editing code for a listed gap.
+- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
+- Run `npx -y viberaven --verify` once per batch of fixes, not after every edit.
+- For the Vercel + Supabase repo evidence, run `npx -y viberaven audit --vercel-supabase`.
+- `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.
+- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard.
+<!-- viberaven:agent-rules:end -->