Command surface

A stable, digest-bound CLI. The 1.0.0 compatibility contract freezes command spellings, option and positional forms, and inventoried schema versions.

Scan the tracked inventory
# Read-only scan of the exact Git-tracked tree
rigor scan
rigor scan --root ./repo
rigor scan --changed-since HEAD~1
Gate and promote
# Enforce a policy; ratchet mode blocks regressions only
rigor gate
rigor gate --mode ratchet

# Promote only fresh, verified decisions into a gate / TODO / SARIF
rigor promote
rigor review-template
Offline verification
# Verify signed audit reports with no network
rigor verify report.json

# Create a trackable, descriptor-bound project scaffold
rigor bootstrap

rigor verify checks caller-supplied signed evidence, explicit key lifecycle, expiry, unavailable records, and model-alias collapse entirely offline.

Interfaces
CLI
Digest-bound command surface with a 1.0.0 compatibility contract.
Python API
Package-level API with a machine-readable top-level inventory (API-stability schema 1.1).
GitHub Action
Runs the read-only scan and gate in CI via action.yml.
VS Code extension
Workspace-scoped display of structurally checked audit candidates.
GHCR image
Container images published through the repository.
SARIF 2.1.0
Deterministic export of every candidate with exact anchors.