veriskit 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.4.0 — 2026-07-10
+
+### Added
+- Evidence System. Every `veris verify` and `veris affected` run writes a canonical, git-anchored `.veris/runs/<id>/evidence.json` (schema `veriskit/evidence@1`) with a sha256 integrity digest over the whole record and a sha256 of each per-check log. No new runtime dependencies.
+- `veris evidence verify <file>` recomputes and checks a record or a bundle, and states plainly what an integrity digest does and does not prove.
+- `veris evidence bundle` packages the latest run (record, report, and logs, each digested) into one portable proof file under `.veris/evidence/`.
+- `veris evidence show` prints the latest record's key facts.
+
+### Changed
+- The report and terminal output now show the git commit and whether the tree was clean, plus the evidence digest in the report.
+- `evidence.json` replaces the older `metadata.json`. `veris init` now also gitignores `evidence/`.
+
 ## 0.3.0 — 2026-07-10
 
 ### Added

package/README.md

@@ -1,11 +1,28 @@
-# veris
+<p align="center">
+  <img src="assets/veriskit-icon.svg" alt="VerisKit" width="96" height="96">
+</p>
 
-The fastest way to prove your software works.
+<h1 align="center">VerisKit</h1>
 
-Veris is a zero-config verification CLI. It detects the tools already in your
-project — TypeScript, Vitest, Jest, `node:test`, ESLint, Biome — runs them,
-and turns the results into one honest verdict with a reviewable Markdown
-report. No config to write, no new test framework to learn.
+<p align="center"><strong>The fastest way to prove your software works.</strong></p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/veriskit"><img src="https://img.shields.io/npm/v/veriskit?color=14b8a6&label=npm" alt="npm version"></a>
+  <img src="https://img.shields.io/badge/deps-cac%20%2B%20picocolors-14b8a6" alt="two runtime dependencies">
+  <img src="https://img.shields.io/badge/license-MIT-14b8a6" alt="MIT license">
+</p>
+
+<p align="center">
+  <img src="assets/veriskit-affected.gif" alt="veris affected narrowing the unit run to only the tests that reach a change" width="760">
+</p>
+
+<p align="center"><em>Change a file. VerisKit runs only the tests that reach it (2 of 28 here), then gives an honest verdict.</em></p>
+
+---
+
+VerisKit runs the test and quality tools your project already has (TypeScript, Vitest, Jest, `node:test`, ESLint, Biome), then turns their results into one honest verdict with a Markdown report you can paste into a pull request. There is no config to write and no new test framework to learn.
+
+It answers the question a wall of green checkmarks leaves open: **is this change safe enough to trust?**
 
 ## Install
 
@@ -19,8 +36,7 @@ Or add it to a project:
 npm install --save-dev veriskit
 ```
 
-> Published on npm as **`veriskit`** (the bare name `veris` was too similar to an
-> existing package). The installed command is still **`veris`**.
+You install the package `veriskit`. The command it gives you is `veris`. (The bare name `veris` was already too close to another npm package.)
 
 ## Quickstart
 
@@ -30,17 +46,16 @@ veris verify    # run the configured checks, print a verdict, write a report
 veris report    # print the latest report
 ```
 
-`veris doctor` and `veris test` are also available: `doctor` is a read-only
-capability report (what will run, what will be skipped, and why); `test` runs
-just the detected unit test runner with the same summarized output as
-`verify`.
+Two more commands round out the basics. `veris doctor` prints a read-only capability report: what will run, what will be skipped, and why. `veris test` runs just the detected unit test runner with the same summarized output as `verify`.
 
-## Sample output
+## The verdict
+
+`veris verify` runs your checks and prints one result. Here is a passing run:
 
 ```text
-Veris
+VerisKit
 
-Project     veris
+Project     veriskit
 Risk        —
 
 Checks
@@ -51,56 +66,78 @@ Checks
 Result
   ✓ Verified
 
+Commit      4fa33a9 · tree clean
+
 Report
-  .veris/reports/verify-2026-07-08T22-41-03-000Z-1.md
+  .veris/reports/verify-2026-07-10T09-04-52-076Z-1.md
+```
+
+The verdict has three states, not two:
+
+| Verdict | Exit code | Meaning |
+|---|---|---|
+| `verified` | `0` | every configured check ran and passed |
+| `failed` | `1` | at least one check failed |
+| `partial` | `2` (`0` with `--partial-ok`) | no failures, but a check was skipped or its result is unknown |
+
+A partial verdict is not a pass. A check can end up skipped when its runner is not installed, or when nothing in your change reaches it. VerisKit lists that check as skipped and lowers the verdict rather than folding it into "verified", because a folded skip hands CI confidence it did not earn. If your team wants partial runs to pass CI, opt in with `veris verify --partial-ok`.
+
+VerisKit orchestrates the tools you already run. It shells out to `tsc`, Vitest, Jest, `node:test`, ESLint, and Biome, reads their exit codes and output, and reports one result. It does not run browser tests, and it does not ship its own test engine. Detection stays read-only, and `init` never overwrites an existing `.veris/config.json`.
+
+## Developer loop
+
+While you work, scope the checks to what you touched instead of running everything.
+
+### `veris affected`
+
+```bash
+veris affected              # checks affected by working-tree changes vs HEAD
+veris affected --base main  # checks affected by the diff against another ref (PR/CI)
 ```
 
-`Risk` is shown as `—` in v0.1 — risk scoring is not built yet; the column
-exists so the layout is stable across future versions and never fakes a
-number.
-
-## What v0.1 does — and does not do
-
-Veris v0.1 is an **orchestrator**, not a test engine. It shells out to
-tools you already have installed and turns their exit codes and output into
-one verdict:
-
-- **Orchestrates:** `tsc` (types), Vitest, Jest, and `node:test` (unit
-  tests), and ESLint or Biome (lint) — whichever your project already has
-  configured. Playwright is *detected* and reported as available; it is not
-  run.
-- **Does not** run browser tests, and does not build or ship a native test
-  execution engine. Those are explicit non-goals for v0.1 (see the design
-  spec linked below).
-- **Does not** impose a linter, a test runner, or any new config format —
-  detection is read-only and `init` never overwrites an existing
-  `.veris/config.json`.
-
-### The verdict is three states, not two
-
-- **`verified`** — every configured capability ran and passed.
-- **`failed`** — at least one check failed. Exit code `1`.
-- **`partial`** — no failures, but at least one configured capability was
-  skipped or its result is unknown (e.g. a runner wasn't installed). Exit
-  code `2` by default.
-
-**`partial` is not a pass.** Veris never folds a skipped check into
-"verified" — that would manufacture confidence CI shouldn't have. Teams that
-want partial results to pass CI can opt in explicitly with
-`veris verify --partial-ok` (exits `0` on partial).
-
-| Verdict  | Exit code | Meaning                                   |
-|----------|-----------|--------------------------------------------|
-| verified | `0`       | every configured check passed              |
-| failed   | `1`       | at least one check failed                  |
-| partial  | `2` (`0` with `--partial-ok`) | no failures, but something was skipped |
+`affected` reads which files changed (your working tree plus untracked files against `HEAD`, or against `--base <ref>` for a PR/CI diff) and maps each one to the check categories it can touch:
+
+| Changed file | Checks run |
+|---|---|
+| test file | unit, lint |
+| TypeScript file | types, lint, unit |
+| JavaScript file | lint, unit |
+| config (`tsconfig`, biome/eslint config, `package.json`, `veris.config.*`) | every available check |
+| docs and assets (`.md`, images, `LICENSE`) | nothing |
+| anything else unrecognized | every available check (a safe default) |
+
+That table picks the check categories. Inside the `unit` category, `affected` goes further: it builds the same import graph that [`veris scan` and `veris plan`](#project-intelligence) use, then runs only the test files that transitively import your changed files.
+
+The narrowing stays conservative. It runs the full unit suite whenever it cannot prove a smaller set is safe:
+
+- a changed file matches a config or global pattern (`tsconfig*.json`, `package.json`, a `*.config.*` or `*.setup.*` file, biome/eslint config)
+- a changed file is not a node in the import graph (it sits under an ignored directory like `node_modules` or `.veris`, or it is not a recognized code extension)
+- no test file reaches any changed file, so the change has no tests to run
+- the graph came from the relative-imports scanner rather than TypeScript, which can miss aliased imports
+
+The output says when a run was narrowed, and when it ran in full and why:
+
+```text
+unit narrowed to 3 of 41 test file(s) via typescript graph
+unit ran in full — global/config change (package.json)
+```
+
+An `affected` run never prints a bare "Verified". The terminal and report say "Affected checks passed" (or "failed", or "Affected: partial"), and every available-but-unaffected capability is listed as skipped with the reason `not affected by changes`. Touch only a doc and VerisKit prints "Nothing affected" and exits `0`, which is a no-op and not a verified result: no checks ran.
+
+### `veris watch`
+
+```bash
+veris watch          # re-run affected checks as files change
+veris watch --poll   # use mtime polling instead of native fs.watch
+```
+
+`watch` runs a full baseline over every available check once, then re-runs only the checks affected by whatever changed since the last tick. It uses Node's built-in recursive `fs.watch`, so it adds no dependency. On a platform where recursive `fs.watch` is unavailable, or a filesystem where native events are unreliable (some containers and network mounts), pass `--poll` to diff file mtimes on an interval instead.
+
+Each tick reprints the full board and rebuilds the graph fresh, so narrowing reflects the file you just saved. A capability the latest change did not touch keeps its last real result, marked `⟳ cached`. A cached failure stays a failure (`✗`); VerisKit never hides it just because it did not rerun this tick. Press Ctrl-C to stop, and the watcher (or poll loop) closes cleanly with exit `0`.
 
 ## Project intelligence
 
-`veris scan` and `veris plan` map your codebase's import graph and turn it
-into recommendations — what to test, where verification is weak, and (with
-`--base`) which of your changes are risky. Both are **read-only analysis**;
-neither generates or writes any code.
+`veris scan` and `veris plan` map your codebase's import graph and turn it into recommendations: what to test, where verification is thin, and which of your changes carry risk. Both are read-only analysis. Neither writes or generates any code.
 
 ### `veris scan`
 
@@ -108,31 +145,12 @@ neither generates or writes any code.
 veris scan
 ```
 
-`scan` discovers every source and test file in the project, builds an import
-graph between them, and reports the source files with the most dependents
-that no test transitively reaches ("untested, by impact"). It writes the
-graph to `.veris/graph.json` — a derived cache, rebuilt on every run and not
-meant to be committed.
-
-**`scan` always states which resolver built the graph**, because the two
-have very different accuracy:
-
-- **`typescript`** — used when the project has a `tsconfig.json` and its own
-  `typescript` package exposes the classic compiler API
-  (`preProcessFile`/`resolveModuleName`/`readConfigFile`/…). Veris loads
-  *your project's own* TypeScript at run time — **no new dependency is added
-  for this** — and resolves imports the way `tsc` would: `tsconfig` path
-  aliases, extension-mapped specifiers, index resolution, and so on.
-- **`scanner`** — the fallback when there's no TypeScript, no
-  `tsconfig.json`, or the installed `typescript` package is a 7.x
-  native/Go-ported build that doesn't expose the classic compiler API veris
-  needs. The scanner is a dependency-free, **relative-imports-only** reader:
-  it follows `./foo` and `../bar/baz` but does not understand `tsconfig`
-  path aliases or computed (non-string-literal) dynamic imports. On a
-  project that relies on aliases, this can miss real edges and undercount a
-  file's blast radius.
-  `scan` says plainly when this fallback is active — it is never presented
-  as equivalent to the TypeScript-accurate graph.
+`scan` finds every source and test file, builds the import graph between them, and lists the source files with the most dependents that no test reaches. It writes the graph to `.veris/graph.json`, a derived cache rebuilt on every run.
+
+`scan` always names the resolver that built the graph, because the two differ in accuracy:
+
+- **`typescript`** runs when your project has a `tsconfig.json` and a `typescript` package that exposes the classic compiler API. VerisKit loads your project's own TypeScript at run time, so it adds no dependency, and it resolves imports the way `tsc` does: `tsconfig` path aliases, extension-mapped specifiers, index resolution.
+- **`scanner`** is the fallback for a project with no TypeScript, no `tsconfig.json`, or a TypeScript 7.x native build that drops the classic compiler API. The scanner reads relative imports only. It follows `./foo` and `../bar/baz` but does not resolve `tsconfig` path aliases or computed dynamic imports, so on an alias-heavy project it can miss edges. `scan` labels the resolver it used, and VerisKit never treats a scanner graph as equal to the TypeScript one. This is also why graph-based narrowing in `affected` and `watch` runs the full suite in scanner mode.
 
 ### `veris plan`
 
@@ -141,141 +159,76 @@ veris plan               # recommendations from the current graph
 veris plan --base main   # also factor in changes vs another ref
 ```
 
-`plan` reads the same graph and turns it into prioritized recommendations:
+`plan` reads the graph and prioritizes:
 
-- the highest-impact untested files to test first (most dependents, no test
-  reaches them);
-- gaps in your verification setup (e.g. no lint or type-check configured);
-- with `--base <ref>`, which files that changed since that ref are "risky" —
-  high blast radius and either untested or actually changed.
+- the highest-impact untested files to cover first (the most dependents, reached by no test)
+- gaps in your setup, such as a missing linter or type-check
+- with `--base <ref>`, the changed files that carry risk: high blast radius, and either untested or freshly changed
 
-**`plan` only recommends — it never generates or writes any code.** Test
-generation is a separate, later goal (v0.8), not something v0.3 does.
+`plan` recommends. It never writes or generates test code. Generation is a later goal, not something VerisKit does today.
 
-### What's still deferred
+## Evidence
 
-- **No framework route/endpoint detection.** The graph understands imports
-  only; it doesn't know a file is an Express route, a Next.js page, or an
-  API handler, so it can't flag "this endpoint has no test" the way it flags
-  "this module has no test." Planned as a v0.3.x follow-up, not v0.3.0.
-- **No test generation.** `plan` recommends what to test; it does not write
-  test files. That's v0.8.
-- **Single tsconfig, single root.** Monorepos with multiple `tsconfig.json`
-  files aren't modeled yet — resolution runs against the root project only.
-- **Plain JS / TS 7.x-native projects degrade to the scanner.** There's no
-  new dependency added to compensate — the classic TypeScript compiler API
-  is what makes the accurate resolver possible, and projects without it get
-  the honestly-labeled, relative-imports-only fallback described above.
+Every `veris verify` and `veris affected` run leaves a canonical, git-anchored
+evidence record you can check later or hand to someone else as proof.
 
-## Developer loop
+- `.veris/runs/<run-id>/evidence.json` is the machine-readable record: schema
+  `veriskit/evidence@1`, the verdict, per-check results, the environment, the
+  git commit and whether the tree was clean, and a sha256 integrity digest over
+  the whole record.
+- `.veris/reports/verify-<run-id>.md` is the human-readable report, now showing
+  the commit and the digest. Paste it into a PR.
+- Raw per-check logs live under `.veris/runs/<run-id>/`, and the record carries
+  a sha256 of each one.
 
-For fast local iteration, veris can scope checks to what you changed instead
-of always running the full set.
-
-### `veris affected`
+Check a record:
 
 ```bash
-veris affected              # checks affected by working-tree changes vs HEAD
-veris affected --base main  # checks affected by the diff against another ref (PR/CI)
+veris evidence verify .veris/runs/<run-id>/evidence.json
 ```
 
-`affected` looks at which files changed — working tree + untracked files
-against `HEAD`, or against `--base <ref>` for PR/CI diffs — and maps each
-changed file to the check categories it plausibly touches:
-
-| Changed file        | Checks run                    |
-|----------------------|-------------------------------|
-| test file             | unit, lint                    |
-| TypeScript file        | types, lint, unit             |
-| JavaScript file        | lint, unit                    |
-| config (tsconfig, biome/eslint config, `package.json`, `veris.config.*`) | every available check |
-| docs/assets (`.md`, images, `LICENSE`) | nothing |
-| anything else unrecognized | every available check (safe default) |
-
-The table above decides *which check categories* run — that part is still a
-coarse, file-extension-based mapping. **What changed in v0.3 is what happens
-inside the `unit` category.** Instead of running every unit test in the
-project, `affected` builds the same import graph that
-[`veris scan`/`veris plan`](#project-intelligence) use and narrows the unit
-run to only the test files that **transitively import** your changed files.
-
-That narrowing is deliberately conservative — it **falls back to running the
-full test suite** rather than ever risk hiding an affected test:
-
-- any changed file matches a config/global pattern (`tsconfig*.json`,
-  `package.json`, a `*.config.*` or `*.setup.*` file, biome/eslint config, …);
-- a changed file isn't a node in the import graph at all (e.g. it's under an
-  ignored directory like `node_modules` or `.veris`, or it's not a
-  recognized code extension);
-- no test file transitively reaches any of the changed files (an untested
-  change).
-
-The output says when a run was narrowed and why it wasn't:
+This recomputes the digest and reports whether the record was edited or
+corrupted since it was written. An integrity digest is not forgery-proof on its
+own. To prove authorship, publish the digest separately (a CI log or PR) or sign
+it. Cryptographic signing is planned for a later release.
 
-```text
-unit narrowed to 3 of 41 test file(s) via typescript graph
-unit ran in full — global/config change (package.json)
+Package a run as a single portable file (the record, its report, and its logs,
+each with a digest, plus a bundle digest over everything):
+
+```bash
+veris evidence bundle          # writes .veris/evidence/<run-id>.bundle.json
+veris evidence verify <bundle> # checks the record, every log, and the report
 ```
 
-Today it will still sometimes run more than the minimal ideal set (a config
-change reruns everything, an unresolved file falls back to full), but it
-never silently skips work it can't prove is safe to skip.
+`veris evidence show` prints the latest record's key facts.
 
-**The verdict is honestly scoped.** An `affected` run never prints a bare
-"Verified" — the terminal output and report say "Affected checks passed" (or
-"Affected checks failed" / "Affected: partial") instead, and any
-available-but-unaffected capability is listed as `skipped — not affected by
-changes` rather than being folded into the pass. If nothing is affected (for
-example you only touched a doc file), veris prints "Nothing affected" and
-exits `0` — but that is explicitly **not** a verified result: no checks ran
-at all.
+Commit `.veris/config.json` and `.veris/.gitignore`. `veris init` keeps `runs/`,
+`reports/`, `cache/`, `graph.json`, and `evidence/` out of your history.
 
-### `veris watch`
+## What VerisKit does not do yet
 
-```bash
-veris watch          # re-run affected checks as files change
-veris watch --poll    # use mtime polling instead of native fs.watch
-```
+VerisKit says what it cannot do as plainly as what it can:
 
-`watch` runs a full baseline over every available check once, then watches
-the working tree and re-runs only the checks affected by whatever changed
-since the last tick — using Node's built-in `fs.watch` (recursive). **No new
-dependency was added for this.** On platforms where recursive `fs.watch`
-isn't supported, or on filesystems (containers, some network mounts) where
-native change events are unreliable, pass `--poll` to fall back to an
-interval-based scan that diffs file mtimes instead.
-
-Every tick after the baseline uses the same graph-based `unit` narrowing (and
-conservative full-suite fallback) described above for `affected` — the graph
-is rebuilt fresh each tick, so it always reflects the file you just saved,
-not a stale snapshot.
-
-Each tick reprints the full check board. A capability that wasn't affected by
-the latest change keeps showing its last real result, marked `⟳ cached` — a
-cached **failure stays a failure** (✗); it is never hidden or silently
-dropped just because it didn't rerun this tick. Press Ctrl-C to stop; veris
-closes the watcher (or poll loop) cleanly and exits `0`.
+- **No framework route or endpoint detection.** The graph understands imports, not that a file is an Express route or a Next.js page, so it flags an untested module but not an untested endpoint. Planned next.
+- **No test generation.** `plan` tells you what to test. Writing the tests is a later release.
+- **One project root.** A monorepo with several `tsconfig.json` files is not modeled yet. Resolution runs against the root project.
+- **Scanner fallback on plain-JS or TS 7.x-native projects.** The accurate resolver needs the classic TypeScript compiler API. Without it you get the labeled, relative-imports-only graph described above, and no dependency is added to paper over the gap.
+- **No cryptographic signing.** Evidence carries an integrity digest, not a signature. Keyless signing is planned.
 
-## Evidence
+## Part of Baseframe Labs
 
-Every `veris verify` run writes:
+VerisKit is one of four developer tools from [Baseframe Labs](https://www.baseframelabs.com), each answering a different question about your work:
 
-- A Markdown report under `.veris/reports/verify-<run-id>.md` — project and
-  environment metadata, per-check status/timing/summary, the verdict with
-  its skipped list and reasons, and log references. Paste it straight into a
-  PR.
-- Raw per-check logs and run metadata under `.veris/runs/<run-id>/`.
+- **[ProjScan](https://www.baseframelabs.com/apps/projscan)** asks: is the repository healthy?
+- **[AgentLoopKit](https://www.baseframelabs.com/apps/agentloopkit)** asks: what should the agent do next?
+- **[AgentFlight](https://www.baseframelabs.com/apps/agentflight)** asks: what did the agent actually do?
+- **VerisKit** asks: can we trust the result?
 
-`.veris/config.json` and `.veris/.gitignore` are meant to be committed;
-`.veris/runs/`, `.veris/reports/`, and `.veris/cache/` are gitignored by
-`veris init`. `.veris/graph.json` (written by [`veris scan`](#project-intelligence))
-is a separate derived cache, rebuilt on every scan — treat it the same way
-and don't commit it.
+Each works on its own. VerisKit needs none of the others to verify a change.
 
 ## Design
 
-Full rationale, locked decisions, and the v0.2+ roadmap live in the design
-spec: [`docs/superpowers/specs/2026-07-08-veris-v0.1-design.md`](docs/superpowers/specs/2026-07-08-veris-v0.1-design.md).
+The design specs, locked decisions, and roadmap live in [`docs/superpowers/specs`](docs/superpowers/specs).
 
 ## License
 

package/dist/index.js

@@ -8,6 +8,20 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl, VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    pkgUrl = new URL("../package.json", import.meta.url);
+    VERSION = JSON.parse(
+      readFileSync(fileURLToPath(pkgUrl), "utf8")
+    ).version;
+  }
+});
+
 // src/util/fs-safe.ts
 import { existsSync } from "fs";
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -57,6 +71,7 @@ async function detectProject(root) {
   ];
   return {
     root,
+    name: pkg.name ?? void 0,
     packageManager: detectPackageManager(root),
     frameworks,
     languages,
@@ -153,7 +168,7 @@ function renderDoctor(project, env) {
   const ok = (s) => plain ? s : pc.green(s);
   const dim = (s) => plain ? s : pc.dim(s);
   const lines = [];
-  lines.push("Veris doctor");
+  lines.push("VerisKit doctor");
   lines.push("");
   lines.push(`Package manager  ${project.packageManager}`);
   lines.push(`Node             ${env.node}`);
@@ -189,8 +204,80 @@ var init_doctor = __esm({
   }
 });
 
+// src/evidence/record.ts
+import { createHash } from "crypto";
+import { basename } from "path";
+function canonicalize(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const src = value;
+    const out = {};
+    for (const key of Object.keys(src).sort()) {
+      if (src[key] !== void 0) out[key] = sortValue(src[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function computeDigest(record) {
+  const { digest: _omit, ...rest } = record;
+  return sha256(canonicalize(rest));
+}
+function buildRecord(run, git, logDigests, toolVersion) {
+  const runnerOf = new Map(
+    run.project.capabilities.map((c) => [c.id, c.runner])
+  );
+  const checks = run.results.map((r) => {
+    const check = {
+      id: r.checkId,
+      status: r.status,
+      durationMs: r.durationMs,
+      summary: r.summary
+    };
+    const runner = runnerOf.get(r.checkId);
+    if (runner) check.runner = runner;
+    if (r.counts) check.counts = r.counts;
+    const digest = logDigests[r.checkId];
+    if (digest) check.logDigest = digest;
+    return check;
+  });
+  const scope = run.scope ? { kind: run.scope.kind, changedCount: run.scope.changedCount } : { kind: "full", changedCount: 0 };
+  const base = {
+    schema: EVIDENCE_SCHEMA,
+    id: run.id,
+    startedAt: run.startedAt,
+    tool: { name: "veriskit", version: toolVersion },
+    git,
+    env: run.env,
+    project: {
+      name: run.project.name ?? basename(run.project.root),
+      packageManager: run.project.packageManager,
+      frameworks: run.project.frameworks,
+      languages: run.project.languages
+    },
+    scope,
+    checks,
+    verdict: run.verdict
+  };
+  return { ...base, digest: computeDigest(base) };
+}
+var EVIDENCE_SCHEMA;
+var init_record = __esm({
+  "src/evidence/record.ts"() {
+    "use strict";
+    EVIDENCE_SCHEMA = "veriskit/evidence@1";
+  }
+});
+
 // src/evidence/store.ts
-import { writeFile as writeFile2 } from "fs/promises";
+import { readdirSync } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
 function newRunId() {
   counter += 1;
@@ -207,11 +294,6 @@ async function writeLog(runDir, checkId, content) {
   await writeFile2(ref, content, "utf8");
   return ref;
 }
-async function writeMetadata(runDir, run) {
-  const ref = join2(runDir, "metadata.json");
-  await writeFile2(ref, JSON.stringify(run, null, 2), "utf8");
-  return ref;
-}
 async function writeReport(root, id, markdown) {
   const dir = join2(root, ".veris", "reports");
   await ensureDir(dir);
@@ -219,11 +301,54 @@ async function writeReport(root, id, markdown) {
   await writeFile2(ref, markdown, "utf8");
   return ref;
 }
+async function writeEvidence(runDir, record) {
+  const ref = join2(runDir, "evidence.json");
+  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return ref;
+}
+async function digestLogs(run) {
+  const out = {};
+  for (const r of run.results) {
+    if (!r.logRef) continue;
+    try {
+      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function readRunLogs(runDir, checkIds) {
+  const out = {};
+  for (const id of checkIds) {
+    try {
+      out[id] = await readFile2(join2(runDir, `${id}.log`), "utf8");
+    } catch {
+    }
+  }
+  return out;
+}
+function latestRunDir(root) {
+  const runs = join2(root, ".veris", "runs");
+  try {
+    const dirs = readdirSync(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name).sort();
+    const latest = dirs.at(-1);
+    return latest ? join2(runs, latest) : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureEvidenceDir(root) {
+  const dir = join2(root, ".veris", "evidence");
+  await ensureDir(dir);
+  return dir;
+}
 var counter;
 var init_store = __esm({
   "src/evidence/store.ts"() {
     "use strict";
     init_fs_safe();
+    init_record();
     counter = 0;
   }
 });
@@ -611,18 +736,18 @@ function glyph(status, plain) {
 function secs(ms) {
   return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
 }
-function renderRun(run) {
+function renderRun(run, record) {
   const plain = isPlain();
   const bold = (s) => plain ? s : pc2.bold(s);
   const dim = (s) => plain ? s : pc2.dim(s);
   const lines = [];
   const scoped = run.scope?.kind;
   if (scoped) {
-    lines.push(bold(`Veris \u2014 ${scoped}`));
+    lines.push(bold(`VerisKit \u2014 ${scoped}`));
     lines.push("");
     lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
   } else {
-    lines.push(bold("Veris"));
+    lines.push(bold("VerisKit"));
     lines.push("");
     lines.push(
       `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
@@ -646,6 +771,13 @@ function renderRun(run) {
   const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
   const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
   lines.push(`  ${plain ? label : color(label)}`);
+  if (record?.git) {
+    const g = record.git;
+    lines.push("");
+    lines.push(
+      `Commit      ${g.commit.slice(0, 7)} ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}`
+    );
+  }
   if (run.reportRef) {
     lines.push("");
     lines.push("Report");
@@ -701,7 +833,7 @@ async function runInit(root) {
   await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
   process.stdout.write(
     wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
-` : "Veris already initialized (.veris/config.json exists). Nothing overwritten.\n"
+` : "VerisKit already initialized (.veris/config.json exists). Nothing overwritten.\n"
   );
   return 0;
 }
@@ -711,7 +843,14 @@ var init_init = __esm({
     "use strict";
     init_detect();
     init_fs_safe();
-    GITIGNORE = ["runs/", "reports/", "cache/", "graph.json", ""].join("\n");
+    GITIGNORE = [
+      "runs/",
+      "reports/",
+      "cache/",
+      "graph.json",
+      "evidence/",
+      ""
+    ].join("\n");
   }
 });
 
@@ -727,15 +866,60 @@ var init_load = __esm({
   }
 });
 
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
+  }
+}
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+async function gitAnchor(root) {
+  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
+  if (head.code !== 0) return null;
+  const commit = head.stdout.trim();
+  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root
+  });
+  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
+  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
+  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+  return {
+    commit,
+    branch,
+    dirty: lines.length > 0,
+    changedFiles: lines.length
+  };
+}
+var init_changes = __esm({
+  "src/git/changes.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
 // src/reporters/markdown.ts
 import { relative } from "path";
 function cell(value) {
   return value.replace(/\|/g, "\\|");
 }
-function renderMarkdown(run) {
+function renderMarkdown(run, record) {
   const root = run.project.root;
   const lines = [];
-  lines.push("# Veris Verification Report");
+  lines.push("# VerisKit Verification Report");
   if (run.scope?.kind) {
     lines.push("");
     lines.push(
@@ -748,6 +932,13 @@ function renderMarkdown(run) {
   lines.push(
     `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
   );
+  if (record?.git) {
+    const g = record.git;
+    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
+    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
+  } else if (record) {
+    lines.push("**Commit:** no git anchor available");
+  }
   lines.push("");
   lines.push("## Checks");
   lines.push("");
@@ -779,9 +970,16 @@ function renderMarkdown(run) {
       lines.push("```");
     }
   }
+  if (record) {
+    lines.push("");
+    lines.push(`**Evidence digest:** \`${record.digest}\``);
+    lines.push(
+      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
+    );
+  }
   lines.push("");
   lines.push(
-    "_Generated by Veris. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
   );
   lines.push("");
   return lines.join("\n");
@@ -808,11 +1006,18 @@ async function runVerify(root, opts = {}) {
   const config = await loadConfig(root);
   const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
   const run = await runChecks(project, checks, root);
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
 `);
   return verdictExitCode(run.verdict, opts);
 }
@@ -824,9 +1029,12 @@ var init_verify = __esm({
     init_load();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
+    init_changes();
     init_markdown();
     init_terminal();
+    init_version();
     DEFAULT_CHECKS = ["types", "lint", "unit"];
   }
 });
@@ -836,13 +1044,13 @@ var report_exports = {};
 __export(report_exports, {
   runReport: () => runReport
 });
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join6 } from "path";
 async function runReport(root) {
   const dir = join6(root, ".veris", "reports");
   let files;
   try {
-    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    files = readdirSync2(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     process.stdout.write("No reports yet. Run `veris verify` first.\n");
     return 0;
@@ -915,36 +1123,8 @@ var init_gate = __esm({
   }
 });
 
-// src/git/changes.ts
-function collect(set, out) {
-  for (const line of out.split("\n")) {
-    const f = line.trim();
-    if (f) set.add(f);
-  }
-}
-async function changedFiles(root, opts = {}) {
-  const base = opts.base ?? null;
-  const files = /* @__PURE__ */ new Set();
-  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
-  const diff = await exec("git", diffArgs, { cwd: root });
-  if (diff.code === 0) collect(files, diff.stdout);
-  const untracked = await exec(
-    "git",
-    ["ls-files", "--others", "--exclude-standard"],
-    { cwd: root }
-  );
-  if (untracked.code === 0) collect(files, untracked.stdout);
-  return { files: [...files].sort(), base };
-}
-var init_changes = __esm({
-  "src/git/changes.ts"() {
-    "use strict";
-    init_exec();
-  }
-});
-
 // src/project-graph/discover.ts
-import { readdirSync as readdirSync2, statSync } from "fs";
+import { readdirSync as readdirSync3, statSync } from "fs";
 import { join as join7, relative as relative2, sep } from "path";
 function toPosix(p) {
   return sep === "/" ? p : p.split(sep).join("/");
@@ -959,7 +1139,7 @@ function discoverFiles(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync2(dir);
+      entries = readdirSync3(dir);
     } catch {
       return;
     }
@@ -1322,11 +1502,18 @@ async function runAffected(root, opts = {}) {
       });
     }
   }
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
 `);
   if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
@@ -1339,23 +1526,25 @@ var init_affected = __esm({
     init_detect();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
     init_changes();
     init_markdown();
     init_terminal();
+    init_version();
   }
 });
 
 // src/watch/watcher.ts
 import {
   watch as fsWatch,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync4,
   statSync as statSync3
 } from "fs";
-import { basename, join as join10, relative as relative5 } from "path";
+import { basename as basename2, join as join10, relative as relative5 } from "path";
 function watch(root, opts, onBatch) {
   const debounceMs = opts.debounceMs ?? 150;
-  const rootBase = basename(root);
+  const rootBase = basename2(root);
   let pending = /* @__PURE__ */ new Set();
   let timer = null;
   const flush = () => {
@@ -1406,7 +1595,7 @@ function scanMtimes(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync3(dir);
+      entries = readdirSync4(dir);
     } catch {
       return;
     }
@@ -1582,7 +1771,7 @@ function renderScan(graph, analysis) {
   const dim = (s) => plain ? s : pc3.dim(s);
   const warn = (s) => plain ? s : pc3.yellow(s);
   const lines = [];
-  lines.push(bold("Veris \u2014 scan"));
+  lines.push(bold("VerisKit \u2014 scan"));
   lines.push("");
   lines.push(
     `Resolver    ${graph.resolver}${graph.resolver === "scanner" ? dim("  (no TypeScript found \u2014 relative imports only)") : ""}`
@@ -1644,7 +1833,7 @@ function renderPlan(project, graph, analysis, changed) {
   const dim = (s) => plain ? s : pc4.dim(s);
   const warn = (s) => plain ? s : pc4.yellow(s);
   const lines = [];
-  lines.push(bold("Veris \u2014 plan"));
+  lines.push(bold("VerisKit \u2014 plan"));
   lines.push(dim(`(graph via ${graph.resolver})`));
   lines.push("");
   lines.push("Test these first (high impact, untested)");
@@ -1708,21 +1897,223 @@ var init_plan = __esm({
   }
 });
 
+// src/evidence/verify-evidence.ts
+import { readFile as readFile3 } from "fs/promises";
+function verifyRecord(record) {
+  const recomputed = computeDigest(
+    record
+  );
+  const ok = recomputed === record.digest;
+  const checks = [
+    {
+      name: "record digest",
+      ok,
+      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
+    }
+  ];
+  return { ok, kind: "record", record, checks };
+}
+async function verifyEvidenceFile(path) {
+  const parsed = JSON.parse(await readFile3(path, "utf8"));
+  if (parsed?.schema === "veriskit/bundle@1") {
+    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
+    return verifyBundle2(parsed);
+  }
+  return verifyRecord(parsed);
+}
+var init_verify_evidence = __esm({
+  "src/evidence/verify-evidence.ts"() {
+    "use strict";
+    init_record();
+  }
+});
+
+// src/evidence/bundle.ts
+var bundle_exports = {};
+__export(bundle_exports, {
+  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
+  buildBundle: () => buildBundle,
+  verifyBundle: () => verifyBundle
+});
+function buildBundle(record, report, logs) {
+  const manifest = {
+    record: record.digest,
+    report: sha256(report),
+    logs: Object.fromEntries(
+      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
+    )
+  };
+  const base = { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  return { ...base, bundleDigest: sha256(canonicalize(base)) };
+}
+function verifyBundle(bundle) {
+  const checks = [];
+  const recordResult = verifyRecord(bundle.record);
+  checks.push(...recordResult.checks);
+  const reportDigest = sha256(bundle.report);
+  checks.push({
+    name: "report",
+    ok: reportDigest === bundle.manifest.report,
+    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
+  });
+  for (const [id, body] of Object.entries(bundle.logs)) {
+    const d = sha256(body);
+    checks.push({
+      name: `log:${id}`,
+      ok: d === bundle.manifest.logs[id],
+      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+    });
+  }
+  const { bundleDigest: _omit, ...rest } = bundle;
+  const recomputed = sha256(canonicalize(rest));
+  checks.push({
+    name: "bundle digest",
+    ok: recomputed === bundle.bundleDigest,
+    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
+  });
+  return {
+    ok: checks.every((c) => c.ok),
+    kind: "bundle",
+    record: bundle.record,
+    checks
+  };
+}
+var BUNDLE_SCHEMA;
+var init_bundle = __esm({
+  "src/evidence/bundle.ts"() {
+    "use strict";
+    init_record();
+    init_verify_evidence();
+    BUNDLE_SCHEMA = "veriskit/bundle@1";
+  }
+});
+
+// src/cli/commands/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  runEvidenceBundle: () => runEvidenceBundle,
+  runEvidenceShow: () => runEvidenceShow,
+  runEvidenceVerify: () => runEvidenceVerify
+});
+import { readFileSync as readFileSync5 } from "fs";
+import { writeFile as writeFile4 } from "fs/promises";
+import { basename as basename3, join as join12 } from "path";
+import pc5 from "picocolors";
+async function runEvidenceVerify(path) {
+  let result;
+  try {
+    result = await verifyEvidenceFile(path);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
+`);
+    return 1;
+  }
+  const plain = isPlain();
+  const mark = (ok) => plain ? ok ? "ok" : "FAIL" : ok ? pc5.green("\u2713") : pc5.red("\u2717");
+  for (const check of result.checks) {
+    process.stdout.write(
+      `  ${mark(check.ok)} ${check.name}: ${check.detail}
+`
+    );
+  }
+  const g = result.record.git;
+  const anchor = g ? `commit ${g.commit.slice(0, 7)} \xB7 ${g.dirty ? "tree dirty" : "tree clean"}` : "no git anchor";
+  process.stdout.write(
+    `
+${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.state} \xB7 ${anchor}
+`
+  );
+  process.stdout.write(`
+${HONESTY}
+`);
+  return result.ok ? 0 : 1;
+}
+async function runEvidenceBundle(root, opts = {}) {
+  const runDir = latestRunDir(root);
+  if (!runDir) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync5(join12(runDir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${runDir}
+`);
+    return 1;
+  }
+  let report = "";
+  try {
+    report = readFileSync5(
+      join12(root, ".veris", "reports", `verify-${record.id}.md`),
+      "utf8"
+    );
+  } catch {
+  }
+  const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
+  const logs = await readRunLogs(runDir, logIds);
+  const bundle = buildBundle(record, report, logs);
+  const outDir = await ensureEvidenceDir(root);
+  const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
+  await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
+`, "utf8");
+  process.stdout.write(`Wrote portable evidence bundle: ${out}
+`);
+  return 0;
+}
+async function runEvidenceShow(root, path) {
+  const target = path ?? (() => {
+    const dir = latestRunDir(root);
+    return dir ? join12(dir, "evidence.json") : null;
+  })();
+  if (!target) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync5(target, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${target}
+`);
+    return 1;
+  }
+  const g = record.git;
+  process.stdout.write(
+    [
+      `Evidence   ${basename3(target)}`,
+      `Verdict    ${record.verdict.state}`,
+      `Project    ${record.project.name}`,
+      `Scope      ${record.scope.kind} (${record.scope.changedCount} changed)`,
+      `Commit     ${g ? `${g.commit.slice(0, 7)} (${g.branch}) ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}` : "no git anchor"}`,
+      `Checks     ${record.checks.map((c) => `${c.id}:${c.status}`).join(", ")}`,
+      `Digest     ${record.digest}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+var HONESTY;
+var init_evidence = __esm({
+  "src/cli/commands/evidence.ts"() {
+    "use strict";
+    init_bundle();
+    init_store();
+    init_verify_evidence();
+    init_tty();
+    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (planned) to prove authorship.";
+  }
+});
+
 // src/cli/index.ts
+init_version();
 import { realpathSync } from "fs";
 import { argv } from "process";
 import { pathToFileURL } from "url";
 import cac from "cac";
-
-// src/version.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-var pkgUrl = new URL("../package.json", import.meta.url);
-var VERSION = JSON.parse(
-  readFileSync(fileURLToPath(pkgUrl), "utf8")
-).version;
-
-// src/cli/index.ts
 function buildCli() {
   const cli = cac("veris");
   cli.version(VERSION);
@@ -1771,6 +2162,34 @@ function buildCli() {
     const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
     process.exitCode = await runPlan2(process.cwd(), { base: opts.base });
   });
+  cli.command(
+    "evidence <action> [file]",
+    "Evidence tools: verify <file> | bundle | show [file]"
+  ).option("--out <file>", "For bundle: write to a specific path").action(
+    async (action, file, opts) => {
+      const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+      if (action === "verify") {
+        if (!file) {
+          process.stderr.write("veris: evidence verify needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceVerify(file);
+      } else if (action === "bundle") {
+        process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "show") {
+        process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
+      } else {
+        process.stderr.write(
+          `veris: unknown evidence action '${action}' (use verify | bundle | show)
+`
+        );
+        process.exitCode = 1;
+      }
+    }
+  );
   return { raw: cli, version: VERSION };
 }
 async function main(argv2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veriskit",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The fastest way to prove your software works — a zero-config verification CLI.",
   "scripts": {
     "test": "vitest run",