vigiles 14.13.4 → 15.0.0

package/README.md

@@ -130,13 +130,14 @@ It's free and open-source, runs entirely on your machine, and never bills per to
   <img src="vigiles-audit.png" width="760" alt="vigiles audit report for my-plugin: a verdict header reading 'Two one-line fixes away from a B.' next to a C (77/100) grade, a five-category strip (Truthfulness, Triggering, Structure, Safety, Tested), ranked fix cards with '+N pts' impact badges, broken-reference findings — and, lower down and badged experimental, a 'Your rules → enforced' preview mapping a prose rule the config silently turns off" />
 </p>
 
-**Like Google's Lighthouse, but for your agent harness.** One command grades it A–F across five categories, leads with a plain-English verdict — _"two one-line fixes away from a B"_ — and ranks every fix by the points it buys back:
+**Like Google's Lighthouse, but for your agent harness.** One command grades it A–F across six categories, leads with a plain-English verdict — _"two one-line fixes away from a B"_ — and ranks every fix by the points it buys back:
 
 - **Truthfulness** — do the references resolve?
 - **Triggering** — do skills fire, without colliding?
 - **Structure** — are tool contracts and configs valid?
 - **Safety** — any way for the agent to leak your data?
-- **Tested** — does the harness ship tests?
+- **Tested** — does the harness ship deterministic tests?
+- **Evaluated** — has anything measured whether your skills actually _fire_? (Distinct from `0`: if nothing asked, it says **not measured**.)
 
 And it closes the loop from prose to enforcement: **your rules → enforced** maps each rule you wrote to the lint rule that actually enforces it — already on, one config line away, or silently turned off (below).
 
@@ -208,8 +209,10 @@ Or run it yourself:
 
 ```bash
 npx vigiles init   # sets up the typed spec for structural rules (non-destructive — eject reverses), adds CI,
-                   # installs vigiles's skills + hooks as a Claude Code plugin (in
-                   # ~/.claude/, not your repo). On Codex, skills install globally too.
+                   # installs vigiles's skills + hooks as a Claude Code plugin. The plugin
+                   # CONTENT goes to ~/.claude/, never your repo; init also commits a two-key
+                   # reference to it in .claude/settings.json so teammates get prompted to
+                   # install it rather than silently missing it. Codex: skills install globally.
 ```
 
 **Already have a harness, or a non-JS repo?** `npx vigiles init --ci-only` sets up just the CI integrity gate — nothing installed, zero conflict. **[When to use gate vs full →](docs/agent-setup.md#non-interactive-setup-agents--ci)**
@@ -230,6 +233,7 @@ The **hooks** keep it honest in-loop — nudging the agent to tag a linter-rule
 - **Both lint and test** by default; scope with `--lint` / `--test`.
 - **Already have a CLAUDE.md / AGENTS.md, skills, or subagents? `audit` and `lint` read them as-is** — nothing is moved or rewritten. For the structural rules that want a typed spec, `init` sets one up **non-destructively** (`eject` undoes it).
 - Adds `vigiles` to `devDependencies`; installs the Claude Code plugin (skills + hooks) via the marketplace — globally, never vendored.
+- Declares that plugin in your repo's `.claude/settings.json` (`extraKnownMarketplaces` + `enabledPlugins`, merged into whatever is already there). This is a **reference, not content** — nothing is vendored, and it does **not** install the plugin for a teammate: an external-source plugin declared project-level [doesn't load until each person installs it](https://code.claude.com/docs/en/discover-plugins#configure-team-marketplaces). What it buys is that Claude Code **prompts** them with the install command, instead of a fresh clone silently having the npm package and none of its skills.
 - Wires CI as a `zernie/vigiles@v1` workflow (needs only read + PR-comment permissions) that posts a sticky PR comment + a `valid` output.
 
 Targets Claude Code and Codex out of the box, or [your own harness](docs/authoring-an-adapter.md). Prefer to write tests yourself? JS **or** TS (`*.harness.{mjs,ts}`) — run with `npx vigiles test`.

package/dist/audit-report.d.ts

@@ -11,7 +11,7 @@
  * timestamp is attached by the CLI at write time, never by this pure builder, so
  * the embedded-in-HTML form stays deterministic).
  */
-import { type AuditScore } from "./audit-score.js";
+import { type AuditScore, type AuditScoreOptions } from "./audit-score.js";
 import { type Recommendation } from "./optimize.js";
 import { type Verdict } from "./audit-verdict.js";
 import type { LedgerSummary } from "./observe.js";
@@ -20,6 +20,7 @@ import type { ScanReport, MarketplaceInfo } from "./scan.js";
 import type { PluginScore } from "./score-core.js";
 import type { RuleInventoryItem } from "./rule-inventory.js";
 import type { RuleRouting } from "./rule-routing.js";
+import type { EvidenceCounts } from "./coverage-evidence.js";
 /**
  * The current schema version. Bump only on a BREAKING change to the shape.
  * v2 (2026-07-15): the rule-map `mechanism` enum value for an unrouted rule
@@ -55,7 +56,26 @@ export interface AuditInventory {
     readonly hooks: number;
     readonly commands: number;
     readonly mcp: boolean;
+    /** Surfaces covered by NEITHER tier — the union count (unchanged). */
     readonly untested: number;
+    /**
+     * The two tiers, carried SEPARATELY so a consumer can tell "has deterministic
+     * coverage, no evals" from "has neither" — a distinction the single `untested`
+     * count erased. `untestedHarness` is free-and-every-push work; `unevaluated` is
+     * paid real-model work. Additive/optional — schema version unchanged.
+     */
+    readonly untestedHarness?: number;
+    readonly unevaluated?: number;
+    /**
+     * HOW the covered surfaces were decided to be covered — `declared` (an explicit
+     * `vigiles:covers` marker), `colocated` (a test placed at the surface), or
+     * `mention` (the surface's path/namespace appears in a test's code). Carried in
+     * the product boundary because a coverage count without its derivation is not
+     * auditable: a repo whose coverage is entirely `mention` looks, in a bare
+     * number, exactly like one with real tests. Additive/optional — schema version
+     * unchanged.
+     */
+    readonly coverageEvidence?: EvidenceCounts;
 }
 /**
  * A surface (skill / subagent / instruction file) that EXISTS but doesn't yet
@@ -86,7 +106,7 @@ export interface Adoptable {
  */
 export interface AuditReport {
     readonly meta: AuditReportMeta;
-    /** The five deterministic category rings + the weighted overall + grade. */
+    /** The six category rings + the weighted overall + grade. */
     readonly score: AuditScore;
     /**
      * The one-line verdict + per-recommendation `pointsIfFixed`, both derived by
@@ -147,7 +167,7 @@ export interface AuditReport {
      */
     readonly ruleRouting?: RuleRouting;
 }
-export interface BuildAuditReportOptions {
+export interface BuildAuditReportOptions extends AuditScoreOptions {
     readonly harness: string;
     readonly vigilesVersion: string;
     /** The flight-recorder summary from the local ledger (omit when empty). */

package/dist/audit-report.js

@@ -53,7 +53,7 @@ function buildAdoptable(surfaces) {
  */
 function buildAuditReport(report, opts) {
     const adoptable = buildAdoptable(opts.adoptableSurfaces);
-    const score = (0, audit_score_js_1.auditScore)(report);
+    const score = (0, audit_score_js_1.auditScore)(report, { firingMeasured: opts.firingMeasured });
     const recommendations = (0, optimize_js_1.optimize)(report).recommendations;
     const verdict = (0, audit_verdict_js_1.computeVerdict)({ report, score, recommendations });
     return {
@@ -78,6 +78,15 @@ function buildAuditReport(report, opts) {
             commands: report.commands,
             mcp: report.mcp,
             untested: report.untested,
+            ...(report.untestedHarness !== undefined
+                ? { untestedHarness: report.untestedHarness }
+                : {}),
+            ...(report.unevaluated !== undefined
+                ? { unevaluated: report.unevaluated }
+                : {}),
+            ...(report.coverageEvidence
+                ? { coverageEvidence: report.coverageEvidence }
+                : {}),
         },
         ...(report.danglingRefs.length
             ? { brokenReferences: report.danglingRefs }