vigiles 2.5.0 → 3.0.0

package/dist/core/runtime.d.ts

@@ -0,0 +1,38 @@
+/**
+ * HarnessRuntime — the runtime/transport PORT (hexagonal transport axis). The
+ * facts the test tiers need to actually drive a harness: the agent binary to
+ * spawn, and the env a no-key mock model is reached through (the base-URL var,
+ * the API-key var, and a dummy key the mock ignores). These were hard-coded
+ * `"claude"` / `ANTHROPIC_*` literals in `harness-test.ts` and `eval.ts`; behind
+ * this interface a second harness (Codex) supplies its own `HarnessRuntime`
+ * (a different binary + its model's env) and the runners spawn it the same way.
+ *
+ * The Claude Code implementation is `claudeCodeRuntime` in
+ * `src/adapters/claude-code/runtime.ts`.
+ */
+export interface HarnessRuntime {
+    /** Stable identifier, e.g. "claude-code". */
+    readonly name: string;
+    /** The CLI binary that runs the agent, e.g. "claude". */
+    readonly agentBinary: string;
+    /** Env var pointing the client at the mock model, e.g. "ANTHROPIC_BASE_URL". */
+    readonly modelBaseUrlEnv: string;
+    /** Env var carrying the (dummy) API key, e.g. "ANTHROPIC_API_KEY". */
+    readonly modelApiKeyEnv: string;
+    /** A dummy key value the mock ignores — avoids needing real auth. */
+    readonly mockApiKey: string;
+    /**
+     * How to point the spawned binary at a mock model served at `baseUrl` — the
+     * args to add to the binary's argv and the env to spawn it with. For Claude
+     * Code this is env-only (`ANTHROPIC_BASE_URL` + a dummy key, no args); for
+     * Codex it is the keyless `-c model_providers.mock.*` flag recipe plus a
+     * dummy-key env. Behind one method so the runner wires either harness the
+     * same way, without knowing which transport axis (env var vs config flags) a
+     * given harness uses.
+     */
+    wireMock(baseUrl: string): {
+        readonly args: readonly string[];
+        readonly env: Record<string, string>;
+    };
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/core/runtime.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=runtime.js.map

package/dist/{types.d.ts → core/types.d.ts}

@@ -1,3 +1,4 @@
+import type { HarnessDialect } from "./dialect.js";
 /** A parsed rule from a markdown instruction file. */
 export interface ParsedRule {
     title: string;
@@ -68,6 +69,21 @@ export interface OrphansConfig {
      */
     exclude?: readonly string[];
 }
+/** Options for the untested-surface check. */
+export interface TestCoverageConfig {
+    /** Scan skills. Default true. */
+    skills?: boolean;
+    /** Scan subagents. Default true. */
+    agents?: boolean;
+    /** Scan hook scripts referenced from plugin.json / settings.json. Default true. */
+    hooks?: boolean;
+    /** Require a test for user-invoked (disable-model-invocation) skills. Default false. */
+    includeUserInvokedSkills?: boolean;
+    /** Globs of test files that count as coverage. */
+    testGlobs?: readonly string[];
+    /** Extra ignore globs. */
+    exclude?: readonly string[];
+}
 export interface RulesConfig {
     /** Require .spec.ts for CLAUDE.md / AGENTS.md. Default: "warn". */
     "require-spec"?: RuleSeverity;
@@ -77,6 +93,16 @@ export interface RulesConfig {
     integrity?: RuleSeverity;
     /** Enforce minimum spec coverage thresholds. Default: false. ESLint-style: ["warn", { scripts: 50 }]. */
     coverage?: RuleWithOptions<CoverageThresholds>;
+    /** Flag skills/agents/hooks with no test or eval. Default: "warn". */
+    "untested-surface"?: RuleWithOptions<TestCoverageConfig>;
+    /**
+     * Nudge (or block) when an instruction file has code-shaped references that
+     * aren't expressed as vigiles marks (so the audit can't verify them), or a
+     * `vigiles:symbol` mark that points at a missing symbol. Drives the
+     * PostToolUse refs-hook: "warn" (default) → a non-blocking nudge, "error" →
+     * block the edit, false → off.
+     */
+    "unmarked-refs"?: RuleSeverity;
 }
 /** Extract severity from a rule value (handles both simple and tuple forms). */
 export declare function ruleSeverity<T>(rule: RuleWithOptions<T> | undefined): RuleSeverity;
@@ -113,6 +139,9 @@ export interface ValidateOptions {
     ruleMarkers?: MarkerType[];
     rules?: RulesConfig;
     filePath?: string;
+    /** Injected harness dialect; its instructionTargets define recognized
+     *  instruction filenames. Omitted → the validator's built-in default set. */
+    dialect?: HarnessDialect;
 }
 /** Options for validatePaths(). */
 export interface ValidatePathsOptions {

package/dist/{validate.d.ts → core/validate.d.ts}

@@ -3,7 +3,7 @@ export type { ParsedRule, ValidationError, ValidationResult, ReadResult, FileRes
 export declare function findInstructionFiles(cwd?: string, configFiles?: string[]): string[];
 export declare function loadConfig(): VigilesConfig;
 export declare function parseRules(content: string, { ruleMarkers }?: ParseOptions): ParsedRule[];
-export declare function validate(content: string, { ruleMarkers, rules: rulesConfig, filePath }?: ValidateOptions): ValidationResult;
+export declare function validate(content: string, { ruleMarkers, rules: rulesConfig, filePath, dialect }?: ValidateOptions): ValidationResult;
 export declare function readInstructionFile(filePath: string, options?: ReadOptions): ReadResult;
 export declare function expandGlobs(patterns: string[]): string[];
 export declare function validatePaths(paths: string[], { followSymlinks, ruleMarkers, rules: rulesConfig, }?: ValidatePathsOptions): ValidatePathsResult;

package/dist/{validate.js → core/validate.js}

@@ -24,12 +24,19 @@ const VALID_MARKERS = ["headings", "checkboxes"];
 // ---------------------------------------------------------------------------
 // Default config
 // ---------------------------------------------------------------------------
-const DEFAULT_FILES = ["CLAUDE.md"];
+// The instruction filenames vigiles recognizes when no dialect is injected — a
+// validator-level default, not a harness dialect (the concrete dialects live in
+// the adapters; an injected ValidateOptions.dialect overrides this).
+const INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md"];
+// The default instruction file to validate when no config names one.
+const DEFAULT_FILES = [INSTRUCTION_FILES[0]];
 const DEFAULT_RULES = {
     "require-spec": "warn",
     "require-skill-spec": "warn",
     integrity: "warn",
     coverage: false,
+    "untested-surface": "warn",
+    "unmarked-refs": "warn",
 };
 const DEFAULT_CONFIG = {
     ruleMarkers: ["headings", "checkboxes"],
@@ -129,7 +136,7 @@ function parseRules(content, { ruleMarkers } = {}) {
 // ---------------------------------------------------------------------------
 // Core validation
 // ---------------------------------------------------------------------------
-function validate(content, { ruleMarkers, rules: rulesConfig, filePath } = {}) {
+function validate(content, { ruleMarkers, rules: rulesConfig, filePath, dialect } = {}) {
     const activeRules = rulesConfig ?? DEFAULT_RULES;
     const parsedRules = parseRules(content, { ruleMarkers });
     const enforced = parsedRules.filter((r) => r.enforcement === "enforced").length;
@@ -141,7 +148,8 @@ function validate(content, { ruleMarkers, rules: rulesConfig, filePath } = {}) {
     const disableComment = /<!--\s*vigiles-disable\s+require-spec\s*-->/;
     if (filePath) {
         const basename = (0, node_path_1.basename)(filePath);
-        const isInstruction = basename === "CLAUDE.md" || basename === "AGENTS.md";
+        const recognized = dialect?.instructionTargets ?? INSTRUCTION_FILES;
+        const isInstruction = recognized.includes(basename);
         const isSkill = basename === "SKILL.md";
         // --- require-spec (CLAUDE.md / AGENTS.md) ---
         const specSeverity = activeRules["require-spec"];
@@ -259,7 +267,30 @@ function expandGlobs(patterns) {
 function validatePaths(paths, { followSymlinks = false, ruleMarkers, rules: rulesConfig, } = {}) {
     const fileResults = [];
     let allValid = true;
+    // Maps a real (symlink-resolved) path → the first path validated for it, so a
+    // symlinked/synced CLAUDE.md⇄AGENTS.md mirror is validated ONCE on the real
+    // file instead of double-firing require-spec on the mirror's name (sync-tool-
+    // compatibility.md req 7). Recorded only on a successful validation, so a
+    // symlink seen first (and skipped) never shadows its real target.
+    const seenReal = new Map();
     for (const filePath of paths) {
+        let real;
+        try {
+            real = (0, node_fs_1.realpathSync)(filePath);
+        }
+        catch {
+            real = (0, node_path_1.resolve)(filePath);
+        }
+        const prior = seenReal.get(real);
+        if (prior !== undefined) {
+            fileResults.push({
+                path: filePath,
+                skipped: true,
+                reason: `mirror of ${prior} (same file via symlink/sync) — validated once`,
+                result: null,
+            });
+            continue;
+        }
         const { content, skipped, reason } = readInstructionFile(filePath, {
             followSymlinks,
         });
@@ -274,10 +305,16 @@ function validatePaths(paths, { followSymlinks = false, ruleMarkers, rules: rule
                 allValid = false;
             continue;
         }
+        // Attribute require-spec/integrity to the REAL file when this path is a
+        // symlink, so a symlinked AGENTS.md resolves to CLAUDE.md's spec rather than
+        // a nonexistent AGENTS.md.spec.ts. Non-symlinks keep the original path
+        // verbatim (behaviour-preserving).
+        const attributePath = real !== (0, node_path_1.resolve)(filePath) ? real : filePath;
+        seenReal.set(real, filePath);
         const result = validate(content, {
             ruleMarkers,
             rules: rulesConfig,
-            filePath,
+            filePath: attributePath,
         });
         fileResults.push({ path: filePath, skipped: false, reason: null, result });
         if (!result.valid)

package/dist/e2e.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `vigiles/e2e` — the **deterministic** end-to-end tier (real sandbox + real
+ * network, but a definite pass/fail).
+ *
+ * Re-exports everything in [`vigiles/integration`](./integration.ts) and adds the
+ * real-egress capability: `egressRoutes()` (probe whether allowlisted egress can
+ * actually route) and — by re-export — `runHook` used with `egress: { allow }`
+ * (allowlisted real outbound). Capability contract: needs a **routable rootless
+ * sandbox + real network**, and each test self-skips via `egressRoutes()` where
+ * that's unavailable. Still a **verification** tier — you assert pass/fail.
+ *
+ * NOT here: **evals** (`runEval` / `measureTriggerRate` / `judge`). Those are a
+ * different axis — **non-deterministic measurement** (real model, mean ± se), run
+ * via `vigiles eval` on `*.eval.mjs`. Import them from
+ * [`vigiles/eval`](./eval.ts) + [`vigiles/judge`](./judge.ts), not from here.
+ */
+export * from "./integration.js";
+export { egressRoutes } from "./adapters/claude-code/run-hook.js";
+//# sourceMappingURL=e2e.d.ts.map

package/dist/e2e.js

@@ -0,0 +1,39 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.egressRoutes = void 0;
+/**
+ * `vigiles/e2e` — the **deterministic** end-to-end tier (real sandbox + real
+ * network, but a definite pass/fail).
+ *
+ * Re-exports everything in [`vigiles/integration`](./integration.ts) and adds the
+ * real-egress capability: `egressRoutes()` (probe whether allowlisted egress can
+ * actually route) and — by re-export — `runHook` used with `egress: { allow }`
+ * (allowlisted real outbound). Capability contract: needs a **routable rootless
+ * sandbox + real network**, and each test self-skips via `egressRoutes()` where
+ * that's unavailable. Still a **verification** tier — you assert pass/fail.
+ *
+ * NOT here: **evals** (`runEval` / `measureTriggerRate` / `judge`). Those are a
+ * different axis — **non-deterministic measurement** (real model, mean ± se), run
+ * via `vigiles eval` on `*.eval.mjs`. Import them from
+ * [`vigiles/eval`](./eval.ts) + [`vigiles/judge`](./judge.ts), not from here.
+ */
+__exportStar(require("./integration.js"), exports);
+// The real-egress capability probe (the egress-using runHook is already re-exported
+// via the integration→unit chain).
+var run_hook_js_1 = require("./adapters/claude-code/run-hook.js");
+Object.defineProperty(exports, "egressRoutes", { enumerable: true, get: function () { return run_hook_js_1.egressRoutes; } });
+//# sourceMappingURL=e2e.js.map

package/dist/harness-assert.d.ts

@@ -13,19 +13,32 @@
  *     `expect(...).toHaveCreated(...)` sugar. The signature is identical for
  *     vitest and jest, so the same object supports both.
  */
-import { type HarnessTestSpec, type HarnessTestResult, type ToolCall, type Trace } from "./harness-test.js";
-import type { EvalReport, TriggerRateReport } from "./eval.js";
-import type { HookRunResult } from "./run-hook.js";
-import type { OutputContract } from "./spec.js";
-import { type ParsedAgentResult } from "./agent-result.js";
-export { compareArms } from "./stats.js";
-export type { Comparison } from "./stats.js";
+import { type HarnessTestSpec, type HarnessTestResult, type ToolCall, type Trace } from "./adapters/claude-code/harness-test.js";
+import type { EvalReport, TriggerRateReport } from "./adapters/claude-code/eval.js";
+import type { HookRunResult, EgressAttempt } from "./adapters/claude-code/run-hook.js";
+import type { OutputContract } from "./core/spec.js";
+import { type ParsedAgentResult } from "./adapters/claude-code/agent-result.js";
+import { type BaselineFile, type DiffOptions } from "./adapters/claude-code/eval-baseline.js";
+export { compareArms } from "./adapters/claude-code/stats.js";
+export type { Comparison } from "./adapters/claude-code/stats.js";
+export { diffReports, toBaselineFile, parseBaselineFile, readBaseline, writeBaseline, formatBaselineDiff, diffToJUnit, } from "./adapters/claude-code/eval-baseline.js";
+export type { BaselineFile, BaselineDiff, MetricDiff, DiffStatus, DiffOptions, } from "./adapters/claude-code/eval-baseline.js";
 /**
  * Run a harness test, hand the result to `fn`, and always clean up the sandbox.
  * Returns whatever `fn` returns. Use this instead of calling `cleanup()` by
  * hand — it survives assertion failures.
  */
 export declare function withHarness<T>(spec: HarnessTestSpec, fn: (r: HarnessTestResult) => T | Promise<T>): Promise<T>;
+/**
+ * Mark the current `*.harness.*` / `*.eval.*` SCRIPT as SKIPPED and exit, so
+ * `vigiles test` / `vigiles eval` report a loud `⊘ SKIPPED` instead of a silent
+ * `✓` — e.g. the deterministic tier when the `claude` CLI isn't installed. A skip
+ * never fails the run. Exit 77 is the runner's `SKIP_EXIT_CODE` (run-scripts.ts).
+ *
+ * For standalone CLI-fallback scripts only — inside a runner (vitest / jest /
+ * node:test) use that runner's own skip, not a process exit.
+ */
+export declare function skip(reason?: string): never;
 /** Assert the sandbox contains `path` (a hook/agent side-effect file). */
 export declare function assertCreated(r: HarnessTestResult, path: string): void;
 /** Assert the sandbox does NOT contain `path` (e.g. a blocked action's output). */
@@ -36,6 +49,28 @@ export declare function assertServedTurns(r: HarnessTestResult, n: number): void
 export declare function assertHookBlocked(r: HookRunResult): void;
 /** Assert a `runHook` result allowed (did not block). */
 export declare function assertHookAllowed(r: HookRunResult): void;
+/** Anything carrying recorded egress attempts (a runHook recordEgress result). */
+interface HasEgress {
+    readonly egress: readonly EgressAttempt[];
+}
+/** The `host:port` strings a run attempted, e.g. `["registry.npmjs.org:443"]`. */
+export declare function egressHosts(r: HasEgress): string[];
+/** Assert the confined run made NO network egress attempt at all. */
+export declare function assertNoEgress(r: HasEgress): void;
+/**
+ * Assert every egress attempt went to an allowed host. `allowed` matches a host
+ * (exact string or regex), or a specific `host:port`. Any attempt outside the
+ * allowlist fails, naming the offender — exfil / unexpected-registry detection.
+ */
+export declare function assertEgressOnly(r: HasEgress, allowed: ReadonlyArray<string | RegExp>): void;
+/** Anything carrying recorded file writes (a confined runHook result). */
+interface HasWrites {
+    readonly filesWritten: readonly string[];
+}
+/** Assert the run wrote NO file matching `pattern` (substring or regex). */
+export declare function assertNoWrite(r: HasWrites, pattern: string | RegExp): void;
+/** Assert every file the run wrote matches one of `allowed` (substring or regex). */
+export declare function assertWroteOnly(r: HasWrites, allowed: ReadonlyArray<string | RegExp>): void;
 /**
  * Assert the worker's output is a success result, and return its `value`. With a
  * `contract`, the value is validated against the success shape (a wrong/missing
@@ -208,12 +243,26 @@ export declare function assertImproves(report: EvalReport, opts: {
     alpha?: number;
 }): void;
 /**
- * Assert a skill/behaviour triggered on at least `min` (0..1) of its runs — the
- * reliability gate for a skill's *activation* (does its description fire on the
- * task), over a {@link TriggerRateReport} from `measureTriggerRate`.
+ * Assert the current run has not *regressed* against a committed baseline — the
+ * CI gate (Phase C). A regression is an arm×metric that moved **significantly in
+ * the bad direction** vs. `baseline` (Welch t-test, so sampling noise doesn't
+ * trip it; see `src/eval-baseline.ts`). Higher is better by default; list
+ * `lowerIsBetter` metrics (cost/latency) to flip them. Load the baseline with
+ * `readBaseline(path)` and record a fresh one with `writeBaseline(path, reports)`.
+ */
+export declare function assertNoRegression(current: EvalReport | readonly EvalReport[], baseline: BaselineFile, opts?: DiffOptions): void;
+/**
+ * Assert a skill/behaviour triggered reliably — the gate for a skill's
+ * *activation*, over a {@link TriggerRateReport} from `measureTriggerRate`.
+ * `min` gates recall (fires when it should). With irrelevant prompts measured,
+ * `maxFalsePositive` gates the precision side (does NOT fire when it shouldn't)
+ * and `minPrecision` gates `firedRight / firedTotal` — so a too-broad
+ * description that hijacks unrelated work fails, not just a too-narrow one.
  */
 export declare function assertTriggerRate(report: TriggerRateReport, opts: {
-    min: number;
+    min?: number;
+    maxFalsePositive?: number;
+    minPrecision?: number;
 }): void;
 interface MatcherOutput {
     pass: boolean;

package/dist/harness-assert.js

@@ -1,12 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.vigilesMatchers = exports.compareArms = void 0;
+exports.vigilesMatchers = exports.diffToJUnit = exports.formatBaselineDiff = exports.writeBaseline = exports.readBaseline = exports.parseBaselineFile = exports.toBaselineFile = exports.diffReports = exports.compareArms = void 0;
 exports.withHarness = withHarness;
+exports.skip = skip;
 exports.assertCreated = assertCreated;
 exports.assertNotCreated = assertNotCreated;
 exports.assertServedTurns = assertServedTurns;
 exports.assertHookBlocked = assertHookBlocked;
 exports.assertHookAllowed = assertHookAllowed;
+exports.egressHosts = egressHosts;
+exports.assertNoEgress = assertNoEgress;
+exports.assertEgressOnly = assertEgressOnly;
+exports.assertNoWrite = assertNoWrite;
+exports.assertWroteOnly = assertWroteOnly;
 exports.assertAgentOk = assertAgentOk;
 exports.assertAgentErr = assertAgentErr;
 exports.assertAgentResult = assertAgentResult;
@@ -34,6 +40,7 @@ exports.improvement = improvement;
 exports.significantlyBeats = significantlyBeats;
 exports.assertSignificant = assertSignificant;
 exports.assertImproves = assertImproves;
+exports.assertNoRegression = assertNoRegression;
 exports.assertTriggerRate = assertTriggerRate;
 /**
  * vigiles — runner-agnostic helpers for harness tests / evals.
@@ -50,13 +57,22 @@ exports.assertTriggerRate = assertTriggerRate;
  *     `expect(...).toHaveCreated(...)` sugar. The signature is identical for
  *     vitest and jest, so the same object supports both.
  */
-const harness_test_js_1 = require("./harness-test.js");
-const agent_result_js_1 = require("./agent-result.js");
-const stats_js_1 = require("./stats.js");
+const harness_test_js_1 = require("./adapters/claude-code/harness-test.js");
+const agent_result_js_1 = require("./adapters/claude-code/agent-result.js");
+const stats_js_1 = require("./adapters/claude-code/stats.js");
+const eval_baseline_js_1 = require("./adapters/claude-code/eval-baseline.js");
 // Re-export the significance primitives so the whole eval-analysis surface lives
 // behind `vigiles/harness-assert` (no separate entry point).
-var stats_js_2 = require("./stats.js");
+var stats_js_2 = require("./adapters/claude-code/stats.js");
 Object.defineProperty(exports, "compareArms", { enumerable: true, get: function () { return stats_js_2.compareArms; } });
+var eval_baseline_js_2 = require("./adapters/claude-code/eval-baseline.js");
+Object.defineProperty(exports, "diffReports", { enumerable: true, get: function () { return eval_baseline_js_2.diffReports; } });
+Object.defineProperty(exports, "toBaselineFile", { enumerable: true, get: function () { return eval_baseline_js_2.toBaselineFile; } });
+Object.defineProperty(exports, "parseBaselineFile", { enumerable: true, get: function () { return eval_baseline_js_2.parseBaselineFile; } });
+Object.defineProperty(exports, "readBaseline", { enumerable: true, get: function () { return eval_baseline_js_2.readBaseline; } });
+Object.defineProperty(exports, "writeBaseline", { enumerable: true, get: function () { return eval_baseline_js_2.writeBaseline; } });
+Object.defineProperty(exports, "formatBaselineDiff", { enumerable: true, get: function () { return eval_baseline_js_2.formatBaselineDiff; } });
+Object.defineProperty(exports, "diffToJUnit", { enumerable: true, get: function () { return eval_baseline_js_2.diffToJUnit; } });
 /**
  * Run a harness test, hand the result to `fn`, and always clean up the sandbox.
  * Returns whatever `fn` returns. Use this instead of calling `cleanup()` by
@@ -77,6 +93,21 @@ async function withHarness(spec, fn) {
 function fail(message) {
     throw new Error(message);
 }
+/**
+ * Mark the current `*.harness.*` / `*.eval.*` SCRIPT as SKIPPED and exit, so
+ * `vigiles test` / `vigiles eval` report a loud `⊘ SKIPPED` instead of a silent
+ * `✓` — e.g. the deterministic tier when the `claude` CLI isn't installed. A skip
+ * never fails the run. Exit 77 is the runner's `SKIP_EXIT_CODE` (run-scripts.ts).
+ *
+ * For standalone CLI-fallback scripts only — inside a runner (vitest / jest /
+ * node:test) use that runner's own skip, not a process exit.
+ */
+/* v8 ignore start -- process.exit can't be exercised in-process (tested via a child in cli.test.ts / run-scripts.test.ts) */
+function skip(reason) {
+    console.log(`SKIPPED${reason ? `: ${reason}` : ""}`);
+    process.exit(77);
+}
+/* v8 ignore stop */
 /** Assert the sandbox contains `path` (a hook/agent side-effect file). */
 function assertCreated(r, path) {
     if (r.file(path) === null)
@@ -105,6 +136,46 @@ function assertHookAllowed(r) {
         fail(`expected the hook to allow, but it blocked (exit ${String(r.exitCode)}, decision ${String(r.decision)})`);
     }
 }
+const hostPort = (e) => `${e.host}:${String(e.port)}`;
+/** The `host:port` strings a run attempted, e.g. `["registry.npmjs.org:443"]`. */
+function egressHosts(r) {
+    return r.egress.map(hostPort);
+}
+/** Assert the confined run made NO network egress attempt at all. */
+function assertNoEgress(r) {
+    if (r.egress.length > 0) {
+        fail(`expected no egress, but it tried to reach: ${egressHosts(r).join(", ")}`);
+    }
+}
+/**
+ * Assert every egress attempt went to an allowed host. `allowed` matches a host
+ * (exact string or regex), or a specific `host:port`. Any attempt outside the
+ * allowlist fails, naming the offender — exfil / unexpected-registry detection.
+ */
+function assertEgressOnly(r, allowed) {
+    const ok = (e) => allowed.some((a) => typeof a === "string"
+        ? a === e.host || a === hostPort(e)
+        : a.test(e.host) || a.test(hostPort(e)));
+    const bad = r.egress.filter((e) => !ok(e));
+    if (bad.length > 0) {
+        fail(`egress to non-allowlisted host(s): ${bad.map(hostPort).join(", ")}`);
+    }
+}
+const matches = (f, p) => typeof p === "string" ? f.includes(p) : p.test(f);
+/** Assert the run wrote NO file matching `pattern` (substring or regex). */
+function assertNoWrite(r, pattern) {
+    const bad = r.filesWritten.filter((f) => matches(f, pattern));
+    if (bad.length > 0) {
+        fail(`expected no write matching ${String(pattern)}, but wrote: ${bad.join(", ")}`);
+    }
+}
+/** Assert every file the run wrote matches one of `allowed` (substring or regex). */
+function assertWroteOnly(r, allowed) {
+    const bad = r.filesWritten.filter((f) => !allowed.some((a) => matches(f, a)));
+    if (bad.length > 0) {
+        fail(`run wrote file(s) outside the allowlist: ${bad.join(", ")}`);
+    }
+}
 // --- subagent railway outcome (parse the worker's result block) ------------
 //
 // A subagent with a result() contract ends its turn with a vigiles:ok/err block.
@@ -431,14 +502,45 @@ function assertImproves(report, opts) {
     }
 }
 /**
- * Assert a skill/behaviour triggered on at least `min` (0..1) of its runs — the
- * reliability gate for a skill's *activation* (does its description fire on the
- * task), over a {@link TriggerRateReport} from `measureTriggerRate`.
+ * Assert the current run has not *regressed* against a committed baseline — the
+ * CI gate (Phase C). A regression is an arm×metric that moved **significantly in
+ * the bad direction** vs. `baseline` (Welch t-test, so sampling noise doesn't
+ * trip it; see `src/eval-baseline.ts`). Higher is better by default; list
+ * `lowerIsBetter` metrics (cost/latency) to flip them. Load the baseline with
+ * `readBaseline(path)` and record a fresh one with `writeBaseline(path, reports)`.
+ */
+function assertNoRegression(current, baseline, opts) {
+    const reports = Array.isArray(current)
+        ? current
+        : [current];
+    const diff = (0, eval_baseline_js_1.diffReports)(baseline, reports, opts);
+    if (!diff.passed) {
+        const detail = diff.regressions
+            .map((r) => `${r.report}/${r.arm}/${r.metric} Δ=${r.comparison.delta.toFixed(3)} p=${r.comparison.pValue.toFixed(3)}`)
+            .join("; ");
+        fail(`regression vs baseline: ${detail}`);
+    }
+}
+/**
+ * Assert a skill/behaviour triggered reliably — the gate for a skill's
+ * *activation*, over a {@link TriggerRateReport} from `measureTriggerRate`.
+ * `min` gates recall (fires when it should). With irrelevant prompts measured,
+ * `maxFalsePositive` gates the precision side (does NOT fire when it shouldn't)
+ * and `minPrecision` gates `firedRight / firedTotal` — so a too-broad
+ * description that hijacks unrelated work fails, not just a too-narrow one.
  */
 function assertTriggerRate(report, opts) {
-    if (report.rate < opts.min) {
+    if (opts.min !== undefined && report.rate < opts.min) {
         fail(`expected a trigger rate ≥ ${String(opts.min)}, got ${report.rate.toFixed(2)} (${String(report.n)} runs)`);
     }
+    if (opts.maxFalsePositive !== undefined &&
+        (report.falsePositiveRate ?? 0) > opts.maxFalsePositive) {
+        fail(`expected a false-positive rate ≤ ${String(opts.maxFalsePositive)}, got ${(report.falsePositiveRate ?? 0).toFixed(2)}`);
+    }
+    if (opts.minPrecision !== undefined &&
+        (report.precision ?? 0) < opts.minPrecision) {
+        fail(`expected precision ≥ ${String(opts.minPrecision)}, got ${report.precision === undefined ? "n/a (nothing fired)" : report.precision.toFixed(2)}`);
+    }
 }
 /**
  * Custom matchers compatible with both vitest and jest. Register once:

package/dist/integration.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `vigiles/integration` — the **deterministic, assembled-machine** tier.
+ *
+ * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the runners that
+ * drive the real `claude` CLI against a **scripted mock model** plus structural
+ * assembly: `runHarnessTest` / `withHarness` (real hooks fire, outcome
+ * reproducible), `scriptModel` (the mock), and `loadPlugin` / `resolveHarness`
+ * (the plugin loader). Capability contract: needs the **`claude` binary and
+ * bubblewrap**, but **no API key and no network**. A `*.integration.test.ts`
+ * imports from here.
+ */
+export * from "./unit.js";
+export * from "./adapters/claude-code/harness-test.js";
+export * from "./adapters/claude-code/mock-model.js";
+export * from "./adapters/claude-code/plugin-loader.js";
+//# sourceMappingURL=integration.d.ts.map

package/dist/integration.js

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `vigiles/integration` — the **deterministic, assembled-machine** tier.
+ *
+ * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the runners that
+ * drive the real `claude` CLI against a **scripted mock model** plus structural
+ * assembly: `runHarnessTest` / `withHarness` (real hooks fire, outcome
+ * reproducible), `scriptModel` (the mock), and `loadPlugin` / `resolveHarness`
+ * (the plugin loader). Capability contract: needs the **`claude` binary and
+ * bubblewrap**, but **no API key and no network**. A `*.integration.test.ts`
+ * imports from here.
+ */
+__exportStar(require("./unit.js"), exports);
+__exportStar(require("./adapters/claude-code/harness-test.js"), exports);
+__exportStar(require("./adapters/claude-code/mock-model.js"), exports);
+__exportStar(require("./adapters/claude-code/plugin-loader.js"), exports);
+//# sourceMappingURL=integration.js.map

package/dist/leaderboard.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Plugin health leaderboard — rank many plugins by the deterministic structural
+ * signals `scan` already computes (research/divergent-bets.md #9, the engine).
+ *
+ * This is the no-model half: a defensible health score from concrete facts
+ * (missing hook scripts, skills that can't trigger, agents with no tool
+ * contract, untested surfaces). It deliberately does NOT score on the loader's
+ * free-text warnings — those include doc-mention false positives (see
+ * src/scan.ts), and a ranking that penalizes a prose mention would be unfair.
+ * The behavioural columns (real trigger-rate, observed egress, safety) need a
+ * model and stack on top later; this part runs anywhere in CI for free.
+ */
+import { type ScanReport } from "./scan.js";
+export interface PluginScore {
+    readonly dir: string;
+    readonly name: string;
+    /** 0–100 structural-health score (100 = no structural issues found). */
+    readonly score: number;
+    readonly grade: "A" | "B" | "C" | "D" | "F";
+    /** Human-readable deductions, worst first. */
+    readonly issues: readonly string[];
+    readonly report: ScanReport;
+}
+/** Deterministic structural-health score for one scanned plugin. */
+export declare function scoreReport(r: ScanReport): {
+    score: number;
+    issues: string[];
+};
+/** Scan + score each directory, ranked best-first (ties broken by name). */
+export declare function rankPlugins(dirs: readonly string[]): PluginScore[];
+/** Format a ranked leaderboard as human-readable text. */
+export declare function formatLeaderboard(scores: readonly PluginScore[]): string;
+//# sourceMappingURL=leaderboard.d.ts.map