VerisKit

Features

What it does well.

New in 0.4.0

An evidence trail you can recompute.

0.4.0 adds the Evidence System. Every verify and affected run now writes a canonical, git-anchored evidence.json, and a new evidence command recomputes it, bundles it, or prints it. The verdict stays honest, and now it carries a digest.

Git-anchored evidence.json

Each run writes `.veris/runs/<id>/evidence.json` (schema veriskit/evidence@1) with a sha256 integrity digest over the whole record and a sha256 of each per-check log. It replaces the older metadata.json, and no new runtime dependency comes with it.

veris evidence verify, bundle, show

`evidence verify <file>` recomputes and checks a record or bundle, `evidence bundle` packages the latest run (record, report, and logs, each digested) into one portable proof file under `.veris/evidence/`, and `evidence show` prints the record's key facts.

What the digest proves, and what it does not

An integrity digest detects later edits and corruption. It is not forgery-proof on its own, so publish the digest separately or sign it. VerisKit states this plainly rather than overselling the proof. Cryptographic signing is planned.

Commit and tree state, on the record

The report and terminal now show the git commit and whether the working tree was clean, and the report carries the evidence digest, so a verdict is tied to an exact point in history.

The verdict

One honest verdict, three states.

A green wall of checkmarks does not tell you whether a change is safe. `veris verify` runs the configured checks in parallel, reads their real exit codes and output, and returns one verdict. There are three states, not two, and a partial is never a pass.

verified (exit 0)

Every configured check ran and passed. This is the only state that means the change cleared the bar you set.

failed (exit 1)

At least one check failed. VerisKit shows which one and preserves its output, so you fix the cause rather than hunt for it.

partial (exit 2, or 0 with --partial-ok)

No check failed, but one was skipped or its result is unknown. A partial verdict is not a pass. VerisKit never folds a skipped check into verified, and `--partial-ok` lets you accept a partial on purpose, in the open.

A report you can paste

`veris report` writes a Markdown summary, the verdict, each check with timing, and the git commit and tree state, so the evidence goes straight into the pull request.

Developer loop

Re-run only what your change reached.

A full suite on every keystroke is slow enough to skip. VerisKit narrows the run to the checks and test files your changes actually reach, built from an import graph, and keeps it honest with a conservative fallback.

veris affected

Runs only the checks, and only the test files, reached by your changes, using an import graph from the project's own TypeScript. Pass `--base <ref>` to scope it to a PR or CI diff.

veris watch

Re-runs the affected checks as files change, with native fs.watch and a `--poll` fallback for editors and filesystems that need it.

Never a false-fast run

Narrowing is conservative: when VerisKit cannot prove a smaller set is safe, it runs the full suite. An affected test is never skipped, and affected or watch never report a bare Verified.

Project intelligence

Find the untested code that matters.

Coverage percentages hide the risk. VerisKit maps how the code connects, then points at the high-impact files with no tests behind them. It reads and recommends; it never writes code.

veris scan

Maps the import graph from the project's own TypeScript, with a dependency-free scanner fallback, writes `.veris/graph.json`, and surfaces untested high-impact files.

veris plan

Turns the scan into prioritized recommendations: high-impact untested files, weak verification, and risky changes. Analysis only, no code generation.

Trust

Local, light, and honest.

VerisKit runs the checks you already run and writes local files. Nothing uploads, nothing phones home, and the dependency list is short enough to read.

Two dependencies

The whole tool ships with exactly cac and picocolors. Everything else is Node built-ins, so it installs light and stays auditable.

Nothing leaves the machine

No cloud, no telemetry, no source upload, no account, and no LLM calls. VerisKit reads your tools' output and writes under `.veris/`.

What it does not do yet

No framework route or endpoint detection, no test generation, one project root (monorepos are not modeled yet), a scanner fallback on plain-JS or TS 7.x-native projects, and no cryptographic signing. VerisKit names its edges rather than hiding them.