cogitocv 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cogito (CogitoAgency)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,97 @@
+# CogitoCV — Continuous Verification for AI-agent-written code
+
+Your agents write. We verify.
+
+AI generates code faster than humans can review it. CogitoCV is the machine gate:
+it verifies every PR diff for **compliance** (your repo's declared rules), **quality**
+(does it actually do what it claims), and **security** (leaked secrets, vulnerable
+patterns) — and gates the merge with an evidence-backed verdict.
+
+CI tests that the code runs. CV verifies the agent was right.
+
+## Quick start
+
+```yaml
+# .github/workflows/verify.yml
+name: CogitoCV
+on: pull_request
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - uses: CogitoAgency/verify@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # only needed for `ask` (LLM judge) checks:
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+```
+
+Make the job a required check in branch protection and CogitoCV gates the merge.
+No `.cogito/verify.yaml` in your repo? A zero-config pipeline runs: secret scan +
+two generic reasoning checks over the diff.
+
+Also available as a CLI: `npx cogitocv` from any git branch. On a Mac with
+[Claude Code](https://claude.com/claude-code) installed, judge checks use your
+existing Claude login — no API key setup.
+
+## Rules — `.cogito/verify.yaml`
+
+```yaml
+version: 1
+
+compliance:
+  - name: repo-rules
+    ask: >
+      Does this diff follow the conventions in the context files?
+      Cite the violated rule if not.
+    context: [CLAUDE.md, "docs/**/*.md"]
+
+quality:
+  - name: tests
+    run: npm test             # any command; exit 0 = PASS
+    timeout: 240              # seconds (default 30 run / 120 ask, max 300)
+  - name: claim-matches-code
+    ask: >
+      Does the diff do what the PR claims? Flag stubs, swallowed errors,
+      hardcoded fake results presented as working.
+
+security:
+  - name: secrets
+    builtin: secret-scan      # gitleaks-derived scanner over added lines
+  - name: vulnerable-patterns
+    ask: >
+      Any string-built SQL, unsanitized shell of user input, committed
+      credentials, or disabled auth checks?
+    severity: warn            # block (default) fails the job; warn only reports
+```
+
+Three check kinds:
+
+| kind | what it is | provenance |
+|---|---|---|
+| `run` | a shell command — exit 0 = PASS (evidence-as-code) | deterministic |
+| `builtin` | shipped checks (`secret-scan`) | deterministic |
+| `ask` | an adversarial LLM judge over the diff + context — defaults to GAP on uncertainty | LLM-judged |
+
+Deterministic checks need no LLM and no key. `ask` checks run through the Claude
+Code CLI: set `CLAUDE_CODE_OAUTH_TOKEN` (from `claude setup-token`) or
+`ANTHROPIC_API_KEY` on CI; if neither is present they report SKIPPED — never a
+false PASS. Every claimed secret in the report is redacted before rendering.
+
+## Inputs & environment
+
+| input / var | purpose |
+|---|---|
+| `base` input / `COGITOCV_BASE` | base ref to diff against (default: PR base) |
+| `model` input / `COGITOCV_MODEL` | judge model, e.g. `haiku` for cheap/fast |
+| `COGITOCV_CONFIG` | alternate rules file (also `--config <path>`) |
+| `--no-diff` | probe mode: run checks without a diff (deploy health gates) |
+| `GITHUB_TOKEN` | enables the sticky PR comment |
+
+---
+Built by [Cogito](https://cogito.cv). CogitoCV — Continuous Verification.