vigiles 2.6.0 → 3.0.0

package/dist/test-coverage.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Untested-surface detection: the third gap detector, alongside orphan-docs.
+ *
+ * Stale-ref detection catches specs pointing at files that vanished.
+ * Orphan-docs catches docs nothing references. This catches harness *surfaces*
+ * — skills, subagents, and hooks — that ship without a test or eval. A surface
+ * with no test is a probabilistic-compliance gap hiding in the deterministic
+ * layer: nothing measures whether it still does what it claims.
+ *
+ * Two detectors decide "tested", OR'd, so a test placed ANYWHERE counts:
+ *   1. colocation — a `*.{harness,eval}.mjs` next to the surface (the zero-config
+ *      convention the warning suggests): `skills/foo/*.eval.mjs`,
+ *      `agents/bar.harness.mjs`, `hooks/pre-edit.harness.mjs`.
+ *   2. content-reference — any discovered test (incl. `*.test.ts`) that names the
+ *      surface by PATH (`skills/foo`, `hooks/pre-edit.sh`) or NAMESPACE
+ *      (`vigiles:foo`). Not bare-name — too fuzzy.
+ *
+ * Warning-by-default (a nudge, not a gate). User-invoked skills
+ * (`disable-model-invocation: true`) can't auto-trigger, so they're exempt by
+ * default; flip `includeUserInvokedSkills` to demand an outcome test for them.
+ * Per-surface opt-out: a `vigiles:ignore-test` marker in the surface file.
+ */
+export type SurfaceKind = "skill" | "agent" | "hook";
+export interface Surface {
+    readonly kind: SurfaceKind;
+    /** Repo-relative path to the surface file (SKILL.md / agent .md / hook script). */
+    readonly path: string;
+    /** Stable name: skill dir, agent basename, or hook script basename. */
+    readonly name: string;
+    /** Substrings a test may reference to "cover" this surface (path / namespace). */
+    readonly tokens: readonly string[];
+    /** True for skills with `disable-model-invocation: true`. */
+    readonly userInvoked: boolean;
+}
+export interface UntestedReport {
+    /** Total surfaces considered (after exemptions). */
+    readonly total: number;
+    readonly covered: readonly Surface[];
+    readonly untested: readonly Surface[];
+    /** Surfaces skipped (user-invoked skills, `vigiles:ignore-test`). */
+    readonly exempt: number;
+}
+export interface TestCoverageOptions {
+    /** Repository root. Defaults to `process.cwd()`. */
+    readonly basePath?: string;
+    /** Scan skills under `skills/` and `.claude/skills/`. Default true. */
+    readonly skills?: boolean;
+    /** Scan subagents under `agents/` and `.claude/agents/`. Default true. */
+    readonly agents?: boolean;
+    /** Scan hook scripts referenced from plugin.json / settings.json. Default true. */
+    readonly hooks?: boolean;
+    /** Require a test for user-invoked (disable-model-invocation) skills. Default false. */
+    readonly includeUserInvokedSkills?: boolean;
+    /** Globs of test files that count as coverage. */
+    readonly testGlobs?: readonly string[];
+    /** Extra ignore globs (added to node_modules/dist/.git/.vigiles). */
+    readonly exclude?: readonly string[];
+}
+/**
+ * Find harness surfaces (skills / agents / hooks) that no test or eval covers.
+ * A surface is covered by a colocated `*.{harness,eval}.mjs` OR any discovered
+ * test that references its path/namespace. User-invoked skills are exempt unless
+ * `includeUserInvokedSkills` is set; any surface with a `vigiles:ignore-test`
+ * marker is exempt.
+ */
+export declare function findUntestedSurfaces(options?: TestCoverageOptions): UntestedReport;
+/** Suggested colocated test path for an untested surface (shown in the warning). */
+export declare function suggestedTestPath(surface: Surface): string;
+/** Format an untested-surface report as human-readable text. */
+export declare function formatUntestedReport(report: UntestedReport): string;
+//# sourceMappingURL=test-coverage.d.ts.map

package/dist/test-coverage.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Untested-surface detection: the third gap detector, alongside orphan-docs.
+ *
+ * Stale-ref detection catches specs pointing at files that vanished.
+ * Orphan-docs catches docs nothing references. This catches harness *surfaces*
+ * — skills, subagents, and hooks — that ship without a test or eval. A surface
+ * with no test is a probabilistic-compliance gap hiding in the deterministic
+ * layer: nothing measures whether it still does what it claims.
+ *
+ * Two detectors decide "tested", OR'd, so a test placed ANYWHERE counts:
+ *   1. colocation — a `*.{harness,eval}.mjs` next to the surface (the zero-config
+ *      convention the warning suggests): `skills/foo/*.eval.mjs`,
+ *      `agents/bar.harness.mjs`, `hooks/pre-edit.harness.mjs`.
+ *   2. content-reference — any discovered test (incl. `*.test.ts`) that names the
+ *      surface by PATH (`skills/foo`, `hooks/pre-edit.sh`) or NAMESPACE
+ *      (`vigiles:foo`). Not bare-name — too fuzzy.
+ *
+ * Warning-by-default (a nudge, not a gate). User-invoked skills
+ * (`disable-model-invocation: true`) can't auto-trigger, so they're exempt by
+ * default; flip `includeUserInvokedSkills` to demand an outcome test for them.
+ * Per-surface opt-out: a `vigiles:ignore-test` marker in the surface file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findUntestedSurfaces = findUntestedSurfaces;
+exports.suggestedTestPath = suggestedTestPath;
+exports.formatUntestedReport = formatUntestedReport;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const glob_1 = require("glob");
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+const DEFAULT_TEST_GLOBS = [
+    "**/*.harness.mjs",
+    "**/*.eval.mjs",
+    "**/*.test.ts",
+    "**/*.test.mts",
+    "**/*.test.cts",
+    "**/*.test.js",
+    "**/*.test.mjs",
+    "**/*.test.cjs",
+];
+const DEFAULT_IGNORE = [
+    "node_modules/**",
+    "dist/**",
+    ".vigiles/**",
+    ".git/**",
+];
+const IGNORE_MARKER = "vigiles:ignore-test";
+const SCRIPT_RE = /[\w./${}@-]+\.(?:sh|mjs|cjs|js|ts|py|rb)/g;
+function read(path) {
+    try {
+        return (0, node_fs_1.readFileSync)(path, "utf-8");
+    }
+    catch {
+        return "";
+    }
+}
+/** A SKILL.md is user-invoked when its frontmatter sets disable-model-invocation. */
+function isUserInvoked(content) {
+    return /^\s*disable-model-invocation:\s*true\s*$/m.test(content);
+}
+function discoverSkills(basePath, ignore) {
+    const out = [];
+    const found = (0, glob_1.globSync)(["skills/*/SKILL.md", ".claude/skills/*/SKILL.md"], {
+        cwd: basePath,
+        ignore,
+    });
+    for (const path of found.sort()) {
+        const name = (0, node_path_1.basename)((0, node_path_1.dirname)(path));
+        const content = read((0, node_path_1.join)(basePath, path));
+        if (content.includes(IGNORE_MARKER))
+            continue;
+        out.push({
+            kind: "skill",
+            path,
+            name,
+            tokens: [`skills/${name}`, `:${name}`],
+            userInvoked: isUserInvoked(content),
+        });
+    }
+    return out;
+}
+function discoverAgents(basePath, ignore) {
+    const out = [];
+    const found = (0, glob_1.globSync)(["agents/*.md", ".claude/agents/*.md"], {
+        cwd: basePath,
+        ignore,
+    });
+    for (const path of found.sort()) {
+        if (path.endsWith(".spec.ts"))
+            continue;
+        const content = read((0, node_path_1.join)(basePath, path));
+        if (content.includes(IGNORE_MARKER))
+            continue;
+        const name = (0, node_path_1.basename)(path, ".md");
+        const dir = (0, node_path_1.dirname)(path);
+        out.push({
+            kind: "agent",
+            path,
+            name,
+            tokens: [`${dir}/${name}`],
+            userInvoked: false,
+        });
+    }
+    return out;
+}
+/** Hook-script paths referenced from a manifest's `hooks` block (file hooks only). */
+function hookScripts(basePath, manifest) {
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(basePath, manifest)))
+        return [];
+    let hooks;
+    try {
+        hooks = JSON.parse(read((0, node_path_1.join)(basePath, manifest)))
+            .hooks;
+    }
+    catch {
+        return [];
+    }
+    if (hooks === undefined)
+        return [];
+    const text = JSON.stringify(hooks);
+    const scripts = new Set();
+    for (const m of text.matchAll(SCRIPT_RE)) {
+        const rel = m[0]
+            .replace("${CLAUDE_PLUGIN_ROOT}/", "")
+            .replace(/^\$\{CLAUDE_PLUGIN_ROOT\}/, "")
+            .replace(/^\.\//, "");
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(basePath, rel)))
+            scripts.add(rel);
+    }
+    return [...scripts];
+}
+function discoverHooks(basePath) {
+    const scripts = new Set();
+    for (const m of [
+        ".claude-plugin/plugin.json",
+        ".claude/settings.json",
+        ".claude/settings.local.json",
+    ]) {
+        for (const s of hookScripts(basePath, m))
+            scripts.add(s);
+    }
+    return [...scripts].sort().map((path) => ({
+        kind: "hook",
+        path,
+        name: (0, node_path_1.basename)(path).replace(/\.[^.]+$/, ""),
+        tokens: [path],
+        userInvoked: false,
+    }));
+}
+function discoverTests(basePath, globs, ignore) {
+    const found = (0, glob_1.globSync)([...globs], { cwd: basePath, ignore });
+    return found.map((path) => ({ path, content: read((0, node_path_1.join)(basePath, path)) }));
+}
+/** Colocated: a test inside a skill dir, or a name-prefixed sibling of an agent/hook. */
+function isColocated(surface, testPath) {
+    if (surface.kind === "skill") {
+        return testPath.startsWith(`${(0, node_path_1.dirname)(surface.path)}/`);
+    }
+    return ((0, node_path_1.dirname)(testPath) === (0, node_path_1.dirname)(surface.path) &&
+        (0, node_path_1.basename)(testPath).startsWith(`${surface.name}.`));
+}
+function isCovered(surface, tests) {
+    for (const t of tests) {
+        if (t.path === surface.path)
+            continue;
+        if (isColocated(surface, t.path))
+            return true;
+        if (surface.tokens.some((tok) => t.content.includes(tok)))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Find harness surfaces (skills / agents / hooks) that no test or eval covers.
+ * A surface is covered by a colocated `*.{harness,eval}.mjs` OR any discovered
+ * test that references its path/namespace. User-invoked skills are exempt unless
+ * `includeUserInvokedSkills` is set; any surface with a `vigiles:ignore-test`
+ * marker is exempt.
+ */
+function findUntestedSurfaces(options = {}) {
+    const basePath = options.basePath ?? process.cwd();
+    const ignore = [...DEFAULT_IGNORE, ...(options.exclude ?? [])];
+    const globs = options.testGlobs ?? DEFAULT_TEST_GLOBS;
+    const surfaces = [];
+    if (options.skills !== false)
+        surfaces.push(...discoverSkills(basePath, ignore));
+    if (options.agents !== false)
+        surfaces.push(...discoverAgents(basePath, ignore));
+    if (options.hooks !== false)
+        surfaces.push(...discoverHooks(basePath));
+    const considered = surfaces.filter((s) => !s.userInvoked || s.kind !== "skill" || options.includeUserInvokedSkills);
+    const exempt = surfaces.length - considered.length;
+    const tests = discoverTests(basePath, globs, ignore);
+    const covered = [];
+    const untested = [];
+    for (const s of considered) {
+        (isCovered(s, tests) ? covered : untested).push(s);
+    }
+    return { total: considered.length, covered, untested, exempt };
+}
+/** Suggested colocated test path for an untested surface (shown in the warning). */
+function suggestedTestPath(surface) {
+    if (surface.kind === "skill") {
+        return `${(0, node_path_1.dirname)(surface.path)}/${surface.name}.eval.mjs`;
+    }
+    return `${(0, node_path_1.dirname)(surface.path)}/${surface.name}.harness.mjs`;
+}
+/** Format an untested-surface report as human-readable text. */
+function formatUntestedReport(report) {
+    if (report.untested.length === 0) {
+        const tail = report.exempt > 0 ? ` (${String(report.exempt)} exempt)` : "";
+        return `✓ all ${String(report.total)} surface(s) have a test or eval${tail}`;
+    }
+    const lines = [
+        `⚠ ${String(report.untested.length)} surface(s) with no test or eval:`,
+    ];
+    for (const s of report.untested) {
+        lines.push(`    ${s.kind} ${s.path} — add e.g. ${suggestedTestPath(s)}`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=test-coverage.js.map

package/dist/testing.d.ts

@@ -5,8 +5,8 @@
  * separate from `vigiles/claude-code` so this surface can stay harness-agnostic as
  * more harnesses are added. Granular paths (`vigiles/run-hook`, etc.) still work.
  */
-export * from "./run-hook.js";
-export * from "./harness-test.js";
-export * from "./eval.js";
+export * from "./adapters/claude-code/run-hook.js";
+export * from "./adapters/claude-code/harness-test.js";
+export * from "./adapters/claude-code/eval.js";
 export * from "./harness-assert.js";
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.js

@@ -21,8 +21,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * separate from `vigiles/claude-code` so this surface can stay harness-agnostic as
  * more harnesses are added. Granular paths (`vigiles/run-hook`, etc.) still work.
  */
-__exportStar(require("./run-hook.js"), exports);
-__exportStar(require("./harness-test.js"), exports);
-__exportStar(require("./eval.js"), exports);
+__exportStar(require("./adapters/claude-code/run-hook.js"), exports);
+__exportStar(require("./adapters/claude-code/harness-test.js"), exports);
+__exportStar(require("./adapters/claude-code/eval.js"), exports);
 __exportStar(require("./harness-assert.js"), exports);
 //# sourceMappingURL=testing.js.map

package/dist/unit.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `vigiles/unit` — the **no-capability** harness-testing surface.
+ *
+ * Importing from here is a contract: this test needs **no `claude`, no model, no
+ * bubblewrap, no network** — only a process. It is the cheap base of the pyramid:
+ * `runHook` (pipe a synthesized event to a hook and read the block/allow
+ * decision), the bare `Trace` predicates, the `assert*` helpers, and the pure
+ * parsers. A `*.test.ts` should import **only** from here (enforced by lint).
+ *
+ * Higher tiers re-export this one — dependencies point downward only
+ * (e2e → integration → unit), never up. See `vigiles/integration` and
+ * `vigiles/e2e`.
+ */
+export * from "./harness-assert.js";
+export { runHook, parseHookOutput, decideHook, } from "./adapters/claude-code/run-hook.js";
+export type { HookInput, HookOutput, HookRunResult, RunHookOptions, } from "./adapters/claude-code/run-hook.js";
+//# sourceMappingURL=unit.d.ts.map

package/dist/unit.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideHook = exports.parseHookOutput = exports.runHook = void 0;
+/**
+ * `vigiles/unit` — the **no-capability** harness-testing surface.
+ *
+ * Importing from here is a contract: this test needs **no `claude`, no model, no
+ * bubblewrap, no network** — only a process. It is the cheap base of the pyramid:
+ * `runHook` (pipe a synthesized event to a hook and read the block/allow
+ * decision), the bare `Trace` predicates, the `assert*` helpers, and the pure
+ * parsers. A `*.test.ts` should import **only** from here (enforced by lint).
+ *
+ * Higher tiers re-export this one — dependencies point downward only
+ * (e2e → integration → unit), never up. See `vigiles/integration` and
+ * `vigiles/e2e`.
+ */
+__exportStar(require("./harness-assert.js"), exports);
+var run_hook_js_1 = require("./adapters/claude-code/run-hook.js");
+Object.defineProperty(exports, "runHook", { enumerable: true, get: function () { return run_hook_js_1.runHook; } });
+Object.defineProperty(exports, "parseHookOutput", { enumerable: true, get: function () { return run_hook_js_1.parseHookOutput; } });
+Object.defineProperty(exports, "decideHook", { enumerable: true, get: function () { return run_hook_js_1.decideHook; } });
+//# sourceMappingURL=unit.js.map

package/hooks/refs-nudge.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# PostToolUse hook — nudge the agent to express references in instruction files
+# (CLAUDE.md / AGENTS.md / SKILL.md) as vigiles marks, so `vigiles audit` can
+# actually verify them. Non-blocking by default; set the `unmarked-refs` rule to
+# "error" in .vigilesrc.json to turn the nudge into a hard block, or to false to
+# disable it. Runs as its OWN PostToolUse entry so its stdout stays clean JSON.
+
+set -uo pipefail
+
+INPUT=$(cat)
+
+# No npx / not a Node project → nothing to do, never disrupt the edit.
+command -v npx >/dev/null 2>&1 || exit 0
+[ -f package.json ] || exit 0
+
+printf '%s' "$INPUT" | npx vigiles refs-hook
+status=${PIPESTATUS[1]}
+
+# Propagate ONLY an explicit block (exit 2). Swallow tool/setup errors so a
+# missing dep or transient failure never blocks the agent's edit.
+if [ "$status" -eq 2 ]; then
+  exit 2
+fi
+exit 0

package/package.json

@@ -1,28 +1,33 @@
 {
   "name": "vigiles",
-  "version": "2.6.0",
+  "version": "3.0.0",
   "description": "Compile .spec.ts files to instruction files (CLAUDE.md, AGENTS.md) with linter cross-referencing",
   "bin": {
     "vigiles": "dist/cli.js"
   },
-  "main": "./dist/spec.js",
-  "types": "./dist/spec.d.ts",
+  "main": "./dist/core/spec.js",
+  "types": "./dist/core/spec.d.ts",
   "exports": {
-    ".": "./dist/spec.js",
+    ".": "./dist/core/spec.js",
+    "./unit": "./dist/unit.js",
+    "./integration": "./dist/integration.js",
+    "./e2e": "./dist/e2e.js",
     "./linting": "./dist/linting.js",
     "./testing": "./dist/testing.js",
     "./claude-code": "./dist/claude-code.js",
-    "./spec": "./dist/spec.js",
-    "./compile": "./dist/compile.js",
-    "./linters": "./dist/linters.js",
-    "./eval": "./dist/eval.js",
-    "./harness-test": "./dist/harness-test.js",
+    "./codex": "./dist/codex.js",
+    "./adapter": "./dist/adapter.js",
+    "./spec": "./dist/core/spec.js",
+    "./compile": "./dist/core/compile.js",
+    "./linters": "./dist/core/linters.js",
+    "./eval": "./dist/adapters/claude-code/eval.js",
+    "./harness-test": "./dist/adapters/claude-code/harness-test.js",
     "./harness-assert": "./dist/harness-assert.js",
-    "./run-hook": "./dist/run-hook.js",
-    "./plugin-loader": "./dist/plugin-loader.js",
-    "./mcp": "./dist/mcp.js",
-    "./judge": "./dist/judge.js",
-    "./mock-model": "./dist/mock-model.js",
+    "./run-hook": "./dist/adapters/claude-code/run-hook.js",
+    "./plugin-loader": "./dist/adapters/claude-code/plugin-loader.js",
+    "./mcp": "./dist/core/mcp.js",
+    "./judge": "./dist/adapters/claude-code/judge.js",
+    "./mock-model": "./dist/adapters/claude-code/mock-model.js",
     "./vitest": {
       "types": "./dist/vitest.d.mts",
       "default": "./dist/vitest.mjs"
@@ -38,6 +43,9 @@
     "!dist/**/*.test.d.ts",
     "action.yml",
     ".claude-plugin",
+    "hooks",
+    "skills",
+    "!skills/**/*.spec.ts",
     "README.md",
     "LICENSE"
   ],
@@ -49,7 +57,10 @@
     "fmt": "prettier --write .",
     "fmt:check": "prettier --check .",
     "demo": "npm run build && bash examples/demo/run.sh",
-    "test:e2e": "bash test/e2e/run.sh",
+    "test:unit": "npm run build && vitest run --project unit",
+    "test:integration": "npm run build && vitest run --project integration",
+    "test:e2e": "npm run build && vitest run --project e2e",
+    "test:cli-e2e": "bash test/e2e/run.sh",
     "test:harness": "npm run build && node dist/cli.js test",
     "test:eval": "npm run build && node dist/cli.js eval",
     "test:vitest": "npm run build && vitest run --project runners",
@@ -66,6 +77,8 @@
     "@typescript-eslint/parser": "^8.58.0",
     "@vitest/coverage-v8": "^4.1.8",
     "eslint": "^10.1.0",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-boundaries": "^6.0.2",
     "eslint-plugin-sonarjs": "^4.0.2",
     "globals": "^17.4.0",
     "jest": "^30.4.2",
@@ -91,11 +104,13 @@
     "@ast-grep/lang-ruby": "^0.0.7",
     "@ast-grep/lang-rust": "^0.0.7",
     "@ast-grep/napi": "^0.43.0",
+    "@iarna/toml": "^2.2.5",
     "@jackchuka/mdschema": "^0.12.8",
     "cosmiconfig": "^9.0.1",
     "glob": "^13.0.6",
     "js-yaml": "^4.1.0",
     "minimatch": "^10.0.1",
+    "ts-essentials": "^10.2.1",
     "typescript": "^5.9.3"
   }
 }

package/skills/audit-feedback-loop/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: audit-feedback-loop
+description: Scan the current repo and score its feedback loop maturity for AI-assisted development
+disable-model-invocation: true
+---
+
+Scan the current repository and score its feedback loop maturity for AI-assisted development.
+
+## Instructions
+
+Analyze this repository and score its **feedback loop maturity** using the levels below. Check for each signal, then output a summary report.
+
+### Maturity Levels
+
+**Level 0 — Vibes**
+No CI config, no linter rules, no CLAUDE.md. The AI agent is flying blind.
+
+**Level 1 — Guardrails**
+Has CI + standard linters, but no custom rules. The agent gets basic feedback but can't learn project-specific conventions.
+
+**Level 2 — Architecture as Code**
+Has custom lint rules, CLAUDE.md rules have enforcement annotations. The agent gets rich, project-specific feedback.
+
+**Level 3 — The Organism**
+Has CI + custom rules + screenshot/visual tests + observability + scheduled agent tasks. The entire development loop is instrumented.
+
+### Signals to Check
+
+Scan the repository for the following and note which exist:
+
+1. **CI Configuration**: Look for `.github/workflows/`, `.circleci/`, `Jenkinsfile`, `.gitlab-ci.yml`, `bitbucket-pipelines.yml`, `.travis.yml`, etc.
+2. **Linter Config** (language-aware):
+   - **JS/TS**: `eslint.config.*`, `.eslintrc*`, `biome.json`, `.prettierrc*`, `deno.json`
+   - **Python**: `pyproject.toml` (look for `[tool.ruff]`, `[tool.pylint]`, `[tool.flake8]`), `setup.cfg`, `.flake8`, `ruff.toml`
+   - **Rust**: `clippy.toml`, `.clippy.toml`, `rustfmt.toml`
+   - **Go**: `.golangci.yml`, `.golangci.yaml`
+   - **Ruby**: `.rubocop.yml`
+   - **Java/Kotlin**: `checkstyle.xml`, `pmd.xml`, `detekt.yml`
+3. **Custom Lint Rules**: Look for custom plugins, rule directories, or inline rule definitions in linter configs
+   - JS/TS: `eslint-plugin-*`, `eslint-rules/` directories
+   - Python: custom Ruff/Pylint plugins, AST-based checks
+   - Rust: custom Clippy lints
+   - Go: custom analyzers
+4. **CLAUDE.md**: Check if `CLAUDE.md` exists at the repo root
+5. **CLAUDE.md Enforcement**: Check if using vigiles v2 specs (`CLAUDE.md.spec.ts` exists) or v1 annotations (`**Enforced by:**` in CLAUDE.md). v2 specs = higher maturity.
+6. **Type-Safe Specs**: Check for `CLAUDE.md.spec.ts` or `*.spec.ts` files — indicates typed spec compilation via vigiles v2
+7. **Generated Types**: Check for `.vigiles/generated.d.ts` — indicates linter rules are type-checked at authoring time
+8. **Screenshot/Visual Tests**: Look for Playwright (`playwright.config.*`), Cypress (`cypress.config.*`), Chromatic, Percy, BackstopJS configs
+9. **Observability**: Search for imports/usage of `@sentry/`, `dd-trace`, `@datadog/`, `newrelic`, `@opentelemetry/`, `sentry_sdk`, `structlog`, `tracing` (Rust), `opentelemetry` in source files
+10. **Scheduled Agent Tasks**: Look for cron patterns in CI configs, `.github/workflows/` with `schedule:` triggers, or references to scheduled Claude Code tasks
+
+### Output Format
+
+```
+## Feedback Loop Audit
+
+**Repository:** <repo name>
+**Primary language(s):** <detected languages>
+**Score: Level X — <Name>**
+
+### Signals Found
+- [x] CI Configuration: <details>
+- [ ] Custom Lint Rules: not found
+- [x] CLAUDE.md: found, 5 enforced / 2 guidance / 1 missing
+...
+
+### Recommendations
+1. <Most impactful next step to level up>
+2. <Second recommendation>
+3. <Third recommendation>
+
+### How to Level Up
+<Specific, actionable advice for reaching the next maturity level>
+```
+
+Be specific about file paths and what you found. Give actionable recommendations tailored to the project's language and toolchain.