Headless Mode

AI agent governance, security tooling, and mechanical enforcement.

rigscore v1.0.0

  • #rigscore
  • #security
  • #ai
  • #devtools
  • #open-source
  • #v1

Changes: v0.9.0 → v1.0.0

First tagged 1.x release — a packaging, quality, and distribution milestone. Stabilises the finding API, extends profiles, draws a clean line in the changelog.

Added

  • Scoring profiles (home, monorepo) — weights tuned for skill-library homes vs. polyrepos, via --profile or .rigscorerc.json
  • Baseline / diff mode — --baseline <path> reports only new findings; rigscore diff emits JSON for CI gating
  • Suppress semantics — glob + regex — skill-files:drive-resume/*, re:/.*sudo.*/ alongside the existing substring form
  • skillFiles.allowlist — per-skill, per-pattern allowlist so legitimate operator-skill sudo usage isn’t flagged
  • instructionEffectiveness.crossRepoRefs — config key for glob-allowlisting known-good cross-repo path references
  • Per-finding evidence field — every finding carries a ≤120-char snippet of the offending content
  • Fixture-dogfood suite — test/fixtures/scored-project/: intentional findings across 12+ checks, locked to a score range
  • rigscore init / rigscore explain <findingId> — new subcommands; init --example scaffolds a demo project
  • Docker image — ghcr.io/back-road-creative/rigscore:<tag> published on tag push
  • CHANGELOG.md — first entry

Changed

  • SARIF ruleIds — per-finding — <checkId>/<findingId> instead of check-level; better dedup and cross-run tracking in GitHub Advanced Security
  • Fix matcher — findingId-based — title-substring matching is now a deprecated fallback; plugin fixes no longer break on title rewrites
  • Coverage scaling — weight-0 advisories excluded — adding new advisories can no longer drag the score down
  • instruction-effectiveness false-positive cut — line-range suffixes stripped before path checks; cross-repo refs allowlist-aware; dead-ref count dropped 143 → 12

Distribution

  • npm publish remains off by design. Distribution is GitHub-only via npx github:Back-Road-Creative/rigscore. See the repo README “Distribution” section for the rationale.
  • Cross-platform CI matrix deferred pending --json truncation investigation on macOS runners. Ubuntu-only for v1.0.0.

github.com/Back-Road-Creative/rigscore

Try it → GitHub → All releases →
← Back to Releases