veriskit 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.5.0 — 2026-07-13
+
+### Added
+- Publish to GitHub. `veris verify --github` posts and updates one sticky PR comment with the verdict and report, and creates a Check Run (verified passes, failed fails, partial is neutral). Token read from `GITHUB_TOKEN`; publishing never changes the verdict or exit code. `veris badge` writes a shields.io endpoint JSON. GitHub API over built-in fetch, no new dependency.
+- Browser tests. A real Playwright runner, opt-in with `veris verify --browser` (or a `browser` entry in `.veris/config.json`). Detected Playwright now shows as an available capability.
+- `veris log` lists past runs from the stored evidence records, and `veris log --flaky` flags checks that both passed and failed across recent runs. Local per-machine history.
+
+## 0.4.1 — 2026-07-10
+
+### Added
+- Signed evidence. `veris evidence keygen` creates an Ed25519 keypair (via Node's built-in crypto, no new dependency); `veris evidence sign <evidence.json>` writes a detached signature; `veris evidence verify` checks a sibling signature automatically and can assert the signer with `--pubkey` or `--key-id`. Bundles carry the signature. Signing is opt-in; unsigned evidence still verifies for integrity. `VERISKIT_SIGNING_KEY` supplies the key in CI.
+
+### Changed
+- `veris init` now gitignores `keys/`.
+
 ## 0.4.0 — 2026-07-10
 
 ### Added

package/README.md

@@ -190,7 +190,7 @@ veris evidence verify .veris/runs/<run-id>/evidence.json
 This recomputes the digest and reports whether the record was edited or
 corrupted since it was written. An integrity digest is not forgery-proof on its
 own. To prove authorship, publish the digest separately (a CI log or PR) or sign
-it. Cryptographic signing is planned for a later release.
+the record with an Ed25519 key (see Signing below).
 
 Package a run as a single portable file (the record, its report, and its logs,
 each with a digest, plus a bundle digest over everything):
@@ -202,6 +202,28 @@ veris evidence verify <bundle> # checks the record, every log, and the report
 
 `veris evidence show` prints the latest record's key facts.
 
+### Signing (optional)
+
+An integrity digest proves a record was not edited. A signature proves a
+specific key vouched for it. VerisKit signs with Ed25519 from Node's built-in
+crypto, so signing adds no dependency and works offline.
+
+```bash
+veris evidence keygen                         # writes .veris/keys/veriskit-signing.key(.pub)
+veris evidence sign .veris/runs/<id>/evidence.json --key .veris/keys/veriskit-signing.key
+veris evidence verify .veris/runs/<id>/evidence.json --pubkey .veris/keys/veriskit-signing.key.pub
+```
+
+`sign` writes a detached `<evidence.json>.sig` next to the record. `verify`
+picks it up automatically and checks it. In CI, pass the key through the
+`VERISKIT_SIGNING_KEY` environment variable instead of a file.
+
+A signature proves that whoever holds the private key signed the record. It
+does not prove who that is. VerisKit prints the key fingerprint; to bind it to
+a person or system, compare that fingerprint to one you already trust, or
+assert it with `--pubkey` or `--key-id`. Keep the private key secret; `keygen`
+writes it into `.veris/keys/`, which `veris init` gitignores.
+
 Commit `.veris/config.json` and `.veris/.gitignore`. `veris init` keeps `runs/`,
 `reports/`, `cache/`, `graph.json`, and `evidence/` out of your history.
 
@@ -213,7 +235,65 @@ VerisKit says what it cannot do as plainly as what it can:
 - **No test generation.** `plan` tells you what to test. Writing the tests is a later release.
 - **One project root.** A monorepo with several `tsconfig.json` files is not modeled yet. Resolution runs against the root project.
 - **Scanner fallback on plain-JS or TS 7.x-native projects.** The accurate resolver needs the classic TypeScript compiler API. Without it you get the labeled, relative-imports-only graph described above, and no dependency is added to paper over the gap.
-- **No cryptographic signing.** Evidence carries an integrity digest, not a signature. Keyless signing is planned.
+- **No keyless or identity-bound signing.** Evidence can be signed with a local Ed25519 key (see Signing), but sigstore-style keyless signing that ties a signature to an identity is not built yet.
+
+## Publish to a pull request
+
+In CI, surface the verdict where reviewers look. Opt in with `--github`; VerisKit
+reads `GITHUB_TOKEN` from the environment and never stores it.
+
+```bash
+veris verify --github   # posts/updates a sticky PR comment + a Check Run
+```
+
+It edits one comment on re-runs (no spam) and creates a Check Run whose
+conclusion follows the verdict (verified passes, failed fails, partial is
+neutral). Publishing is a side channel: if there is no token or PR, VerisKit
+prints a notice and the exit code still reflects the verdict, and a GitHub API
+error is reported but never changes the result.
+
+The workflow needs permission to write them:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+```
+
+For a README badge, write a shields.io endpoint file:
+
+```bash
+veris badge   # writes .veris/badge.json
+```
+
+```markdown
+![VerisKit](https://img.shields.io/endpoint?url=<raw-url-to>/.veris/badge.json)
+```
+
+## Browser tests
+
+VerisKit can run your Playwright suite as part of the verdict. It is opt-in, so
+a normal `veris verify` stays fast:
+
+```bash
+veris verify --browser   # also runs `playwright test`, folded into the verdict
+```
+
+When Playwright is detected, `veris doctor` lists `browser` as available. You can
+also add `browser` to the `checks` array in `.veris/config.json` to run it every
+time.
+
+## History
+
+Every run leaves an evidence record, so VerisKit can show you a trend:
+
+```bash
+veris log            # past runs, newest first
+veris log --flaky    # checks that both passed and failed across recent runs
+```
+
+History is local to your machine (the `.veris/runs` directory is gitignored).
 
 ## Part of Baseframe Labs
 

package/dist/index.js

@@ -105,13 +105,9 @@ function detectLint(root, has) {
   return { id: "lint", available: false, reason: "no linter configured" };
 }
 function detectBrowser(root, has) {
-  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")))
-    return {
-      id: "browser",
-      available: false,
-      runner: "playwright",
-      reason: "detected; browser execution deferred to v0.5"
-    };
+  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")) || existsSync2(join(root, "playwright.config.js"))) {
+    return { id: "browser", available: true, runner: "playwright" };
+  }
   return {
     id: "browser",
     available: false,
@@ -548,6 +544,76 @@ var init_node_test = __esm({
   }
 });
 
+// src/runners/playwright.ts
+function parsePlaywrightStats(stdout) {
+  try {
+    const json = JSON.parse(stdout);
+    return json.stats ?? null;
+  } catch {
+    return null;
+  }
+}
+var TAIL_LINES2, playwrightRunner;
+var init_playwright = __esm({
+  "src/runners/playwright.ts"() {
+    "use strict";
+    init_store();
+    init_exec();
+    init_base();
+    TAIL_LINES2 = 20;
+    playwrightRunner = {
+      id: "playwright",
+      toCheck(project, _cap) {
+        return {
+          id: "browser",
+          title: "Browser tests",
+          runner: "playwright",
+          cmd: localBin(project.root, "playwright"),
+          args: ["test", "--reporter=json"]
+        };
+      },
+      async run(check, ctx) {
+        const r = await exec(check.cmd, check.args, {
+          cwd: ctx.root,
+          timeoutMs: 15 * 6e4
+        });
+        const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+        const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+        const stats = parsePlaywrightStats(r.stdout);
+        let status;
+        if (r.timedOut) {
+          status = "unknown";
+        } else if (stats) {
+          status = r.code === 0 && (stats.unexpected ?? 0) === 0 ? "passed" : "failed";
+        } else {
+          status = r.code === 0 ? "unknown" : "failed";
+        }
+        const result = {
+          checkId: "browser",
+          status,
+          durationMs: r.durationMs,
+          summary: status === "passed" ? "browser tests passed" : r.timedOut ? "timed out" : status === "unknown" ? "browser tests ran but the results could not be parsed" : "browser tests failed",
+          logRef
+        };
+        if (stats) {
+          const passed = stats.expected ?? 0;
+          const failed = stats.unexpected ?? 0;
+          result.counts = {
+            passed,
+            failed,
+            total: passed + failed + (stats.flaky ?? 0) + (stats.skipped ?? 0)
+          };
+        }
+        if (status !== "passed" && output) {
+          result.outputTail = output.split("\n").slice(-TAIL_LINES2).join("\n");
+        }
+        return result;
+      }
+    };
+  }
+});
+
 // src/runners/tsc.ts
 var tscRunner;
 var init_tsc = __esm({
@@ -614,6 +680,7 @@ var init_runners = __esm({
     init_eslint();
     init_jest();
     init_node_test();
+    init_playwright();
     init_tsc();
     init_vitest();
     init_base();
@@ -623,7 +690,8 @@ var init_runners = __esm({
       jest: jestRunner,
       "node-test": nodeTestRunner,
       eslint: eslintRunner,
-      biome: biomeRunner
+      biome: biomeRunner,
+      playwright: playwrightRunner
     };
   }
 });
@@ -849,6 +917,7 @@ var init_init = __esm({
       "cache/",
       "graph.json",
       "evidence/",
+      "keys/",
       ""
     ].join("\n");
   }
@@ -996,15 +1065,205 @@ var init_markdown = __esm({
   }
 });
 
+// src/publish/comment.ts
+function renderComment(run, record) {
+  const summary = run.results.filter((r) => r.status !== "skipped").map((r) => `${r.checkId} ${r.status}`).join(" \xB7 ");
+  return [
+    MARKER,
+    `**VerisKit: ${STATE_LABEL2[run.verdict.state]}**`,
+    "",
+    summary,
+    "",
+    "<details><summary>Report</summary>",
+    "",
+    renderMarkdown(run, record),
+    "",
+    "</details>",
+    ""
+  ].join("\n");
+}
+var MARKER, STATE_LABEL2;
+var init_comment = __esm({
+  "src/publish/comment.ts"() {
+    "use strict";
+    init_markdown();
+    MARKER = "<!-- veriskit-report -->";
+    STATE_LABEL2 = {
+      verified: "verified",
+      failed: "failed",
+      partial: "partial"
+    };
+  }
+});
+
+// src/publish/context.ts
+import { readFileSync as readFileSync2 } from "fs";
+function defaultReadEvent(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolvePublishContext(env = process.env, readEvent = defaultReadEvent) {
+  const repository = env.GITHUB_REPOSITORY;
+  const token = env.GITHUB_TOKEN;
+  if (!repository || !token) return null;
+  const [owner, repo] = repository.split("/");
+  if (!owner || !repo) return null;
+  let prNumber = null;
+  let headSha = env.GITHUB_SHA ?? "";
+  const refMatch = (env.GITHUB_REF ?? "").match(/^refs\/pull\/(\d+)\//);
+  if (refMatch) prNumber = Number(refMatch[1]);
+  const event = readEvent(env.GITHUB_EVENT_PATH ?? "");
+  const pr = event?.pull_request;
+  if (pr) {
+    if (prNumber === null && typeof pr.number === "number") {
+      prNumber = pr.number;
+    }
+    if (pr.head?.sha) headSha = pr.head.sha;
+  }
+  if (prNumber === null || !headSha) return null;
+  return { owner, repo, token, prNumber, headSha };
+}
+var init_context = __esm({
+  "src/publish/context.ts"() {
+    "use strict";
+  }
+});
+
+// src/publish/github.ts
+function headers(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "veriskit",
+    "Content-Type": "application/json"
+  };
+}
+async function gh(method, url, token, body) {
+  const res = await fetch(url, {
+    method,
+    headers: headers(token),
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const path = url.replace("https://api.github.com", "");
+    throw new GitHubApiError(
+      res.status,
+      `GitHub API ${method} ${path} -> ${res.status}`
+    );
+  }
+  return res.json();
+}
+function repoBase(ctx) {
+  return `https://api.github.com/repos/${ctx.owner}/${ctx.repo}`;
+}
+async function upsertComment(ctx, body) {
+  const base = repoBase(ctx);
+  const comments = await gh(
+    "GET",
+    `${base}/issues/${ctx.prNumber}/comments?per_page=100`,
+    ctx.token
+  );
+  const existing = comments.find((c) => (c.body ?? "").includes(MARKER));
+  if (existing) {
+    await gh("PATCH", `${base}/issues/comments/${existing.id}`, ctx.token, {
+      body
+    });
+  } else {
+    await gh("POST", `${base}/issues/${ctx.prNumber}/comments`, ctx.token, {
+      body
+    });
+  }
+}
+async function createCheckRun(ctx, opts) {
+  await gh("POST", `${repoBase(ctx)}/check-runs`, ctx.token, {
+    name: opts.name,
+    head_sha: ctx.headSha,
+    status: "completed",
+    conclusion: opts.conclusion,
+    output: { title: opts.title, summary: opts.summary }
+  });
+}
+var GitHubApiError;
+var init_github = __esm({
+  "src/publish/github.ts"() {
+    "use strict";
+    init_comment();
+    GitHubApiError = class extends Error {
+      status;
+      constructor(status, message) {
+        super(message);
+        this.name = "GitHubApiError";
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/publish/publish.ts
+async function publishToGitHub(run, record) {
+  const ctx = resolvePublishContext();
+  if (!ctx) {
+    process.stdout.write(
+      "veris: --github set but no GitHub PR context found (need GITHUB_TOKEN + a pull_request event); skipping publish.\n"
+    );
+    return;
+  }
+  try {
+    await upsertComment(ctx, renderComment(run, record));
+    await createCheckRun(ctx, {
+      name: "VerisKit",
+      conclusion: CONCLUSION[run.verdict.state],
+      title: `VerisKit: ${run.verdict.state}`,
+      summary: renderMarkdown(run, record)
+    });
+    process.stdout.write(
+      `veris: published the verdict to PR #${ctx.prNumber}
+`
+    );
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: GitHub publish failed: ${msg}
+`);
+  }
+}
+var CONCLUSION;
+var init_publish = __esm({
+  "src/publish/publish.ts"() {
+    "use strict";
+    init_markdown();
+    init_comment();
+    init_context();
+    init_github();
+    CONCLUSION = {
+      verified: "success",
+      failed: "failure",
+      partial: "neutral"
+    };
+  }
+});
+
 // src/cli/commands/verify.ts
 var verify_exports = {};
 __export(verify_exports, {
+  resolveChecks: () => resolveChecks,
   runVerify: () => runVerify
 });
+function resolveChecks(configChecks, project, opts) {
+  let checks = configChecks?.length ? configChecks : DEFAULT_CHECKS;
+  if (opts.browser && !checks.includes("browser")) {
+    const cap = project.capabilities.find((c) => c.id === "browser");
+    if (cap?.available) checks = [...checks, "browser"];
+  }
+  return checks;
+}
 async function runVerify(root, opts = {}) {
   const project = await detectProject(root);
   const config = await loadConfig(root);
-  const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
+  const checks = resolveChecks(config?.checks, project, opts);
   const run = await runChecks(project, checks, root);
   const git = await gitAnchor(root);
   const logDigests = await digestLogs(run);
@@ -1019,6 +1278,7 @@ async function runVerify(root, opts = {}) {
   await writeEvidence(runDir, record);
   process.stdout.write(`${renderRun(run, record)}
 `);
+  if (opts.github) await publishToGitHub(run, record);
   return verdictExitCode(run.verdict, opts);
 }
 var DEFAULT_CHECKS;
@@ -1032,6 +1292,7 @@ var init_verify = __esm({
     init_record();
     init_store();
     init_changes();
+    init_publish();
     init_markdown();
     init_terminal();
     init_version();
@@ -1044,7 +1305,7 @@ var report_exports = {};
 __export(report_exports, {
   runReport: () => runReport
 });
-import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join6 } from "path";
 async function runReport(root) {
   const dir = join6(root, ".veris", "reports");
@@ -1060,7 +1321,7 @@ async function runReport(root) {
     process.stdout.write("No reports yet. Run `veris verify` first.\n");
     return 0;
   }
-  process.stdout.write(`${readFileSync2(join6(dir, latest), "utf8")}
+  process.stdout.write(`${readFileSync3(join6(dir, latest), "utf8")}
 `);
   return 0;
 }
@@ -1175,7 +1436,7 @@ var init_discover = __esm({
 });
 
 // src/project-graph/scanner-resolver.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import { dirname, join as join8, relative as relative3, resolve } from "path";
 function extractSpecifiers(text) {
   const specs = [];
@@ -1214,7 +1475,7 @@ function resolveRelative(fromDir, spec) {
 function scannerImports(root, file) {
   let text;
   try {
-    text = readFileSync3(join8(root, file), "utf8");
+    text = readFileSync4(join8(root, file), "utf8");
   } catch {
     return [];
   }
@@ -1238,7 +1499,7 @@ var init_scanner_resolver = __esm({
 });
 
 // src/project-graph/ts-resolver.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 import { createRequire } from "module";
 import { join as join9, relative as relative4, sep as sep2 } from "path";
 function hasClassicApi(mod) {
@@ -1265,7 +1526,7 @@ function loadCompilerOptions(tsmod, root) {
 function tsImports(tsmod, root, options, file) {
   let text;
   try {
-    text = readFileSync4(join9(root, file), "utf8");
+    text = readFileSync5(join9(root, file), "utf8");
   } catch {
     return [];
   }
@@ -1517,6 +1778,7 @@ async function runAffected(root, opts = {}) {
 `);
   if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
+  if (opts.github) await publishToGitHub(run, record);
   return verdictExitCode(run.verdict, opts);
 }
 var init_affected = __esm({
@@ -1529,6 +1791,7 @@ var init_affected = __esm({
     init_record();
     init_store();
     init_changes();
+    init_publish();
     init_markdown();
     init_terminal();
     init_version();
@@ -1897,7 +2160,84 @@ var init_plan = __esm({
   }
 });
 
+// src/evidence/signing.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  generateKeyPairSync
+} from "crypto";
+function derOf(publicKey) {
+  return publicKey.export({ type: "spki", format: "der" });
+}
+function keyId(publicKey) {
+  const key = typeof publicKey === "string" ? createPublicKey(publicKey) : publicKey;
+  return createHash2("sha256").update(derOf(key)).digest("hex").slice(0, 8);
+}
+function signatureKeyId(sig) {
+  const key = createPublicKey({
+    key: Buffer.from(sig.publicKey, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  return keyId(key);
+}
+function generateKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+    privateKeyPem: privateKey.export({
+      type: "pkcs8",
+      format: "pem"
+    }),
+    keyId: keyId(publicKey)
+  };
+}
+function signDigest(digest, privateKeyPem) {
+  const privateKey = createPrivateKey(privateKeyPem);
+  const publicKey = createPublicKey(
+    privateKey
+  );
+  const sig = cryptoSign(null, Buffer.from(digest, "utf8"), privateKey);
+  return {
+    schema: SIGNATURE_SCHEMA,
+    alg: "ed25519",
+    keyId: keyId(publicKey),
+    publicKey: derOf(publicKey).toString("base64"),
+    digest,
+    signature: sig.toString("base64"),
+    signedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifySignature(sig) {
+  try {
+    const publicKey = createPublicKey({
+      key: Buffer.from(sig.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return cryptoVerify(
+      null,
+      Buffer.from(sig.digest, "utf8"),
+      publicKey,
+      Buffer.from(sig.signature, "base64")
+    );
+  } catch {
+    return false;
+  }
+}
+var SIGNATURE_SCHEMA;
+var init_signing = __esm({
+  "src/evidence/signing.ts"() {
+    "use strict";
+    SIGNATURE_SCHEMA = "veriskit/signature@1";
+  }
+});
+
 // src/evidence/verify-evidence.ts
+import { existsSync as existsSync5 } from "fs";
 import { readFile as readFile3 } from "fs/promises";
 function verifyRecord(record) {
   const recomputed = computeDigest(
@@ -1911,20 +2251,71 @@ function verifyRecord(record) {
       detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
     }
   ];
-  return { ok, kind: "record", record, checks };
+  return { ok, kind: "record", record, checks, signed: false };
+}
+function signatureChecks(recordDigest, sig, opts = {}) {
+  const checks = [];
+  const kid = signatureKeyId(sig);
+  const validSig = verifySignature(sig) && sig.digest === recordDigest;
+  checks.push({
+    name: "signature",
+    ok: validSig,
+    detail: validSig ? `valid ed25519 signature by key ${kid}` : "signature does not match this record"
+  });
+  if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    let matches = false;
+    if (opts.expectedPubKeyPem) {
+      try {
+        matches = keyId(opts.expectedPubKeyPem) === kid;
+      } catch {
+        matches = false;
+      }
+    } else if (opts.expectedKeyId) {
+      matches = opts.expectedKeyId.toLowerCase() === kid.toLowerCase();
+    }
+    checks.push({
+      name: "signer",
+      ok: matches,
+      detail: matches ? `signer matches the expected key ${kid}` : `signer ${kid} does not match the expected key`
+    });
+  }
+  return checks;
 }
-async function verifyEvidenceFile(path) {
+async function verifyEvidenceFile(path, opts = {}) {
   const parsed = JSON.parse(await readFile3(path, "utf8"));
   if (parsed?.schema === "veriskit/bundle@1") {
     const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
-    return verifyBundle2(parsed);
+    return verifyBundle2(parsed, opts);
   }
-  return verifyRecord(parsed);
+  const result = verifyRecord(parsed);
+  const assertedSigner = Boolean(
+    opts.expectedKeyId || opts.expectedPubKeyPem || opts.sigPath
+  );
+  const sigPath = opts.sigPath ?? `${path}.sig`;
+  if (existsSync5(sigPath)) {
+    const sig = JSON.parse(await readFile3(sigPath, "utf8"));
+    result.checks.push(
+      ...signatureChecks(result.record.digest, sig, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+    result.signed = true;
+  } else if (assertedSigner) {
+    result.checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id/--sig) but none was found"
+    });
+  }
+  result.ok = result.checks.every((c) => c.ok);
+  return result;
 }
 var init_verify_evidence = __esm({
   "src/evidence/verify-evidence.ts"() {
     "use strict";
     init_record();
+    init_signing();
   }
 });
 
@@ -1935,7 +2326,7 @@ __export(bundle_exports, {
   buildBundle: () => buildBundle,
   verifyBundle: () => verifyBundle
 });
-function buildBundle(record, report, logs) {
+function buildBundle(record, report, logs, signature) {
   const manifest = {
     record: record.digest,
     report: sha256(report),
@@ -1943,10 +2334,10 @@ function buildBundle(record, report, logs) {
       Object.entries(logs).map(([k, v]) => [k, sha256(v)])
     )
   };
-  const base = { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  const base = signature ? { schema: BUNDLE_SCHEMA, record, report, logs, manifest, signature } : { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
   return { ...base, bundleDigest: sha256(canonicalize(base)) };
 }
-function verifyBundle(bundle) {
+function verifyBundle(bundle, opts = {}) {
   const checks = [];
   const recordResult = verifyRecord(bundle.record);
   checks.push(...recordResult.checks);
@@ -1971,11 +2362,28 @@ function verifyBundle(bundle) {
     ok: recomputed === bundle.bundleDigest,
     detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
   });
+  let signed = false;
+  if (bundle.signature) {
+    signed = true;
+    checks.push(
+      ...signatureChecks(bundle.record.digest, bundle.signature, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+  } else if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id) but the bundle is unsigned"
+    });
+  }
   return {
     ok: checks.every((c) => c.ok),
     kind: "bundle",
     record: bundle.record,
-    checks
+    checks,
+    signed
   };
 }
 var BUNDLE_SCHEMA;
@@ -1992,17 +2400,33 @@ var init_bundle = __esm({
 var evidence_exports = {};
 __export(evidence_exports, {
   runEvidenceBundle: () => runEvidenceBundle,
+  runEvidenceKeygen: () => runEvidenceKeygen,
   runEvidenceShow: () => runEvidenceShow,
+  runEvidenceSign: () => runEvidenceSign,
   runEvidenceVerify: () => runEvidenceVerify
 });
-import { readFileSync as readFileSync5 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync } from "fs";
 import { writeFile as writeFile4 } from "fs/promises";
-import { basename as basename3, join as join12 } from "path";
+import { basename as basename3, dirname as dirname2, join as join12 } from "path";
 import pc5 from "picocolors";
-async function runEvidenceVerify(path) {
+async function runEvidenceVerify(path, opts = {}) {
+  let expectedPubKeyPem;
+  if (opts.pubkey) {
+    try {
+      expectedPubKeyPem = readFileSync6(opts.pubkey, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read public key at ${opts.pubkey}
+`);
+      return 1;
+    }
+  }
   let result;
   try {
-    result = await verifyEvidenceFile(path);
+    result = await verifyEvidenceFile(path, {
+      sigPath: opts.sig,
+      expectedKeyId: opts.keyId,
+      expectedPubKeyPem
+    });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
@@ -2027,8 +2451,93 @@ ${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.sta
   process.stdout.write(`
 ${HONESTY}
 `);
+  if (result.signed && !opts.pubkey && !opts.keyId) {
+    process.stdout.write(
+      "\nThis record is signed. Confirm you trust the signing key by comparing its\nkey id above to one you already trust, or re-run with --pubkey / --key-id.\n"
+    );
+  }
   return result.ok ? 0 : 1;
 }
+async function runEvidenceKeygen(root, opts = {}) {
+  const out = opts.out ?? join12(root, ".veris", "keys", "veriskit-signing.key");
+  const pub = `${out}.pub`;
+  if (existsSync6(out) || existsSync6(pub)) {
+    process.stderr.write(
+      `veris: a key already exists at ${out}. Refusing to overwrite it.
+`
+    );
+    return 1;
+  }
+  const { mkdir: mkdir3 } = await import("fs/promises");
+  await mkdir3(dirname2(out), { recursive: true });
+  const kp = generateKeyPair();
+  writeFileSync(out, kp.privateKeyPem, { mode: 384 });
+  chmodSync(out, 384);
+  writeFileSync(pub, kp.publicKeyPem, "utf8");
+  process.stdout.write(
+    [
+      `Wrote signing key ${out} (keep this secret; do not commit it)`,
+      `Wrote public key ${pub}`,
+      `Key id ${kp.keyId}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+async function runEvidenceSign(evidencePath, opts = {}) {
+  let privateKeyPem;
+  if (process.env.VERISKIT_SIGNING_KEY) {
+    privateKeyPem = process.env.VERISKIT_SIGNING_KEY;
+  } else if (opts.key) {
+    try {
+      privateKeyPem = readFileSync6(opts.key, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read signing key at ${opts.key}
+`);
+      return 1;
+    }
+  } else {
+    process.stderr.write(
+      "veris: no signing key. Pass --key <path> or set VERISKIT_SIGNING_KEY.\n"
+    );
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync6(evidencePath, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${evidencePath}
+`);
+    return 1;
+  }
+  const recomputed = computeDigest(
+    record
+  );
+  if (recomputed !== record.digest) {
+    process.stderr.write(
+      "veris: refusing to sign, the record digest does not match its contents.\n"
+    );
+    return 1;
+  }
+  let sig;
+  try {
+    sig = signDigest(record.digest, privateKeyPem);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: signing failed: ${msg}
+`);
+    return 1;
+  }
+  const out = opts.out ?? `${evidencePath}.sig`;
+  writeFileSync(out, `${JSON.stringify(sig, null, 2)}
+`, "utf8");
+  process.stdout.write(
+    `Signed ${evidencePath}
+Wrote ${out} (key ${sig.keyId})
+`
+  );
+  return 0;
+}
 async function runEvidenceBundle(root, opts = {}) {
   const runDir = latestRunDir(root);
   if (!runDir) {
@@ -2038,7 +2547,7 @@ async function runEvidenceBundle(root, opts = {}) {
   let record;
   try {
     record = JSON.parse(
-      readFileSync5(join12(runDir, "evidence.json"), "utf8")
+      readFileSync6(join12(runDir, "evidence.json"), "utf8")
     );
   } catch {
     process.stderr.write(`veris: no evidence.json in ${runDir}
@@ -2047,7 +2556,7 @@ async function runEvidenceBundle(root, opts = {}) {
   }
   let report = "";
   try {
-    report = readFileSync5(
+    report = readFileSync6(
       join12(root, ".veris", "reports", `verify-${record.id}.md`),
       "utf8"
     );
@@ -2055,7 +2564,15 @@ async function runEvidenceBundle(root, opts = {}) {
   }
   const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
   const logs = await readRunLogs(runDir, logIds);
-  const bundle = buildBundle(record, report, logs);
+  let signature;
+  const sigPath = join12(runDir, "evidence.json.sig");
+  if (existsSync6(sigPath)) {
+    try {
+      signature = JSON.parse(readFileSync6(sigPath, "utf8"));
+    } catch {
+    }
+  }
+  const bundle = buildBundle(record, report, logs, signature);
   const outDir = await ensureEvidenceDir(root);
   const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
   await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
@@ -2075,7 +2592,7 @@ async function runEvidenceShow(root, path) {
   }
   let record;
   try {
-    record = JSON.parse(readFileSync5(target, "utf8"));
+    record = JSON.parse(readFileSync6(target, "utf8"));
   } catch {
     process.stderr.write(`veris: cannot read evidence at ${target}
 `);
@@ -2101,10 +2618,187 @@ var init_evidence = __esm({
   "src/cli/commands/evidence.ts"() {
     "use strict";
     init_bundle();
+    init_record();
+    init_signing();
     init_store();
     init_verify_evidence();
     init_tty();
-    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (planned) to prove authorship.";
+    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (veris evidence sign) to prove authorship.";
+  }
+});
+
+// src/publish/badge.ts
+function buildBadge(verdict) {
+  const s = STYLE[verdict.state];
+  return {
+    schemaVersion: 1,
+    label: "veriskit",
+    message: s.message,
+    color: s.color
+  };
+}
+var STYLE;
+var init_badge = __esm({
+  "src/publish/badge.ts"() {
+    "use strict";
+    STYLE = {
+      verified: { message: "verified", color: "14b8a6" },
+      failed: { message: "failed", color: "e5484d" },
+      partial: { message: "partial", color: "f5a623" }
+    };
+  }
+});
+
+// src/cli/commands/badge.ts
+var badge_exports = {};
+__export(badge_exports, {
+  runBadge: () => runBadge
+});
+import { readFileSync as readFileSync7 } from "fs";
+import { mkdir as mkdir2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname3, join as join13 } from "path";
+async function runBadge(root, opts = {}) {
+  const dir = latestRunDir(root);
+  if (!dir) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync7(join13(dir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${dir}
+`);
+    return 1;
+  }
+  const out = opts.out ?? join13(root, ".veris", "badge.json");
+  await mkdir2(dirname3(out), { recursive: true });
+  await writeFile5(
+    out,
+    `${JSON.stringify(buildBadge(record.verdict), null, 2)}
+`,
+    "utf8"
+  );
+  process.stdout.write(`Wrote badge ${out}
+`);
+  return 0;
+}
+var init_badge2 = __esm({
+  "src/cli/commands/badge.ts"() {
+    "use strict";
+    init_store();
+    init_badge();
+  }
+});
+
+// src/history/flaky.ts
+function detectFlaky(records) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const rec of records) {
+    for (const c of rec.checks ?? []) {
+      const arr = byId.get(c.id) ?? [];
+      arr.push(c.status);
+      byId.set(c.id, arr);
+    }
+  }
+  const flaky = [];
+  for (const [id, statuses] of byId) {
+    if (statuses.includes("passed") && statuses.includes("failed")) {
+      flaky.push({ id, statuses });
+    }
+  }
+  return flaky;
+}
+var init_flaky = __esm({
+  "src/history/flaky.ts"() {
+    "use strict";
+  }
+});
+
+// src/history/read.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync8 } from "fs";
+import { join as join14 } from "path";
+function loadRuns(root, limit = 20) {
+  const runs = join14(root, ".veris", "runs");
+  let names;
+  try {
+    names = readdirSync5(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name);
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const name of names) {
+    try {
+      const rec = JSON.parse(
+        readFileSync8(join14(runs, name, "evidence.json"), "utf8")
+      );
+      if (rec?.schema === "veriskit/evidence@1") records.push(rec);
+    } catch {
+    }
+  }
+  records.sort(
+    (a, b) => a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0
+  );
+  return records.slice(0, limit);
+}
+var init_read = __esm({
+  "src/history/read.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/commands/log.ts
+var log_exports = {};
+__export(log_exports, {
+  runLog: () => runLog
+});
+async function runLog(root, opts = {}) {
+  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? opts.limit : 20;
+  const records = loadRuns(root, limit);
+  if (records.length === 0) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  if (opts.flaky) {
+    const flaky = detectFlaky(records);
+    if (flaky.length === 0) {
+      process.stdout.write(
+        `No flaky checks in the last ${records.length} run(s).
+`
+      );
+      return 0;
+    }
+    process.stdout.write(
+      `Flaky checks (both passed and failed in the last ${records.length} run(s), newest first):
+`
+    );
+    for (const f of flaky) {
+      process.stdout.write(`  ${f.id.padEnd(8)} ${f.statuses.join(" ")}
+`);
+    }
+    return 0;
+  }
+  for (const rec of records) {
+    const date = rec.startedAt.slice(0, 19).replace("T", " ");
+    const checks = (rec.checks ?? []).map((c) => `${c.id}:${c.status}`).join(" ");
+    const commit = rec.git ? rec.git.commit.slice(0, 7) : "-";
+    process.stdout.write(
+      `${date}  ${rec.verdict.state.padEnd(9)} ${checks}  ${commit}
+`
+    );
+  }
+  process.stdout.write(
+    "\nHistory is local to this machine (.veris/runs is gitignored).\n"
+  );
+  return 0;
+}
+var init_log = __esm({
+  "src/cli/commands/log.ts"() {
+    "use strict";
+    init_flaky();
+    init_read();
   }
 });
 
@@ -2130,23 +2824,36 @@ function buildCli() {
     const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
     process.exitCode = await runInit2(process.cwd());
   });
-  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
-    const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
-    process.exitCode = await runVerify2(process.cwd(), {
-      partialOk: opts.partialOk
-    });
-  });
+  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).option("--browser", "Also run browser tests (Playwright), when available").action(
+    async (opts) => {
+      const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
+      process.exitCode = await runVerify2(process.cwd(), {
+        partialOk: opts.partialOk,
+        github: opts.github,
+        browser: opts.browser
+      });
+    }
+  );
   cli.command("report", "Print the latest verification report").action(async () => {
     const { runReport: runReport2 } = await Promise.resolve().then(() => (init_report(), report_exports));
     process.exitCode = await runReport2(process.cwd());
   });
-  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
-    const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
-    process.exitCode = await runAffected2(process.cwd(), {
-      base: opts.base,
-      partialOk: opts.partialOk
-    });
-  });
+  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).action(
+    async (opts) => {
+      const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
+      process.exitCode = await runAffected2(process.cwd(), {
+        base: opts.base,
+        partialOk: opts.partialOk,
+        github: opts.github
+      });
+    }
+  );
   cli.command("watch", "Re-run affected checks as files change (Ctrl-C to stop)").option("--poll", "Use mtime polling instead of native fs.watch").action(async (opts) => {
     const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
     process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
@@ -2164,8 +2871,8 @@ function buildCli() {
   });
   cli.command(
     "evidence <action> [file]",
-    "Evidence tools: verify <file> | bundle | show [file]"
-  ).option("--out <file>", "For bundle: write to a specific path").action(
+    "Evidence: verify <file> | bundle | show [file] | keygen | sign <file>"
+  ).option("--out <file>", "For bundle/keygen/sign: output path").option("--key <file>", "For sign: the private signing key (PEM)").option("--pubkey <file>", "For verify: assert the signer's public key").option("--key-id <id>", "For verify: assert the signer's key id").option("--sig <file>", "For verify: signature path (default <file>.sig)").action(
     async (action, file, opts) => {
       const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
       if (action === "verify") {
@@ -2174,22 +2881,54 @@ function buildCli() {
           process.exitCode = 1;
           return;
         }
-        process.exitCode = await mod.runEvidenceVerify(file);
+        process.exitCode = await mod.runEvidenceVerify(file, {
+          pubkey: opts.pubkey,
+          keyId: opts.keyId,
+          sig: opts.sig
+        });
       } else if (action === "bundle") {
         process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
           out: opts.out
         });
       } else if (action === "show") {
         process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
+      } else if (action === "keygen") {
+        process.exitCode = await mod.runEvidenceKeygen(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "sign") {
+        if (!file) {
+          process.stderr.write("veris: evidence sign needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceSign(file, {
+          key: opts.key,
+          out: opts.out
+        });
       } else {
         process.stderr.write(
-          `veris: unknown evidence action '${action}' (use verify | bundle | show)
+          `veris: unknown evidence action '${action}' (use verify | bundle | show | keygen | sign)
 `
         );
         process.exitCode = 1;
       }
     }
   );
+  cli.command(
+    "badge",
+    "Write a shields.io endpoint JSON from the latest verdict"
+  ).option("--out <file>", "Output path (default .veris/badge.json)").action(async (opts) => {
+    const { runBadge: runBadge2 } = await Promise.resolve().then(() => (init_badge2(), badge_exports));
+    process.exitCode = await runBadge2(process.cwd(), { out: opts.out });
+  });
+  cli.command("log", "List past verification runs (local history)").option("--limit <n>", "How many runs to show (default 20)").option("--flaky", "Show only checks that flip-flop across runs").action(async (opts) => {
+    const { runLog: runLog2 } = await Promise.resolve().then(() => (init_log(), log_exports));
+    process.exitCode = await runLog2(process.cwd(), {
+      limit: opts.limit ? Number(opts.limit) : void 0,
+      flaky: opts.flaky
+    });
+  });
   return { raw: cli, version: VERSION };
 }
 async function main(argv2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veriskit",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The fastest way to prove your software works — a zero-config verification CLI.",
   "scripts": {
     "test": "vitest run",