sverka-dev/sverka

v0.1.4MIT

Composable workflow SDK, local CI runtime, and multi-target compiler for software verification — define checks once, plan locally, run anywhere. Ships the /sverka:sverka skill for driving the sverka CLI.

GitHub Open Website

0.1.4 (2026-09-22)

🩹 Fixes

cli: use module.registerHooks when available (#207)

❤️ Thank You

Petr Plenkov @ThePlenkov

0.1.3 (2026-09-22)

🚀 Features

policy gate step + artifact import ordering fix (#200)

❤️ Thank You

Petr Plenkov @ThePlenkov
ThePlenkov

0.1.2 (2026-09-21)

🚀 Features

compiler: inject toolchain setup into generated GitHub workflows (#196)

🩹 Fixes

cli: report own package version for --version and MCP server (#198)
release: prefix publish dir with ./ to avoid git shorthand (#194)

❤️ Thank You

Petr Plenkov @ThePlenkov
ThePlenkov

0.1.1 (2026-09-21)

🚀 Features

Wave 0 — spec tree, monorepo scaffold, Gas City, website (5e03d63)
Wave 1 — core package (7827892)
Wave 2 — IR package (canonical plan schema and validation) (cdee22f)
Wave 1 — core package (ac44528)
Wave 2 — IR package (canonical plan schema and validation) (6394033)
Wave 3 — runtime package (executor interfaces and scheduler) (13a3d29)
Wave 4 — runtime-host package (host process executor) (7c7c9f9)
Wave 5 — runtime-docker package (Docker executor) (5038d7a)
Wave 6 — planner package (discovery and plan synthesis) (df244f8)
Wave 7 — findings package (normalization, fingerprints, baseline) (86ad86c)
Wave 8 — policy package (policy evaluation) (2f89767)
Wave 9 — sdk package (public TypeScript API) (5da05e5)
Wave 10 — cli package (command-line interface) (e6cf172)
Wave 11 — checks package (check resolution and findings extraction) (8b5da33)
Wave 12 — compiler-github package (Plan IR to GitHub Actions YAML) (2dc0c96)
Wave 13 — compiler-gitlab package (Plan IR to GitLab CI YAML) (54d7784)
Wave 14 — website (sverka.dev Astro site with sitemap, SEO, 404) (552f18f)
recover content from closed PRs #20 and #22 (#20, #22)
add pre-alpha disclaimers and Cloudflare Pages deploy workflow (77fb72f)
PR stack resolution harness — formula, order, script (ed5bf7d)
add mayor nudge logic to PR stack resolve script (39df5d7)
port F-01 to F-16 core features from v0-n-docs to main (#62)
port F-17 to F-25 runtime features from v0-n-docs to main (#63)
port F-29 to F-49 advanced features from v0-n-docs to main (#75)
gc-watchdog Devin plugin with self-healing (#78)
port shell proxy API ($, shell) from v0-n-docs to main (#77)
v1 Wave 1 — CacheStore, RetryPolicy, RunEvent, GHA SHA pinning (#122)
v1 Wave 2 — MCP & AI Integration (#123)
v1 Wave 2 — Sverka MCP server (#124)
v1 Wave 3 — RunSnapshot storage + suspend/resume types (#126)
v1 Wave 3 — Saga compensations (Spec 30, ADR-013) (#127)
v1 Wave 4 — Interoperability Engines (#128)
v1 Wave 5 — DX & Polish (#129)
@sverka/arena — generic benchmark framework with CRUD dashboard (#150)
@sverka/reporter — renderer core, text output, findings/policy gate (Phase 1) (#151)
@sverka/sarif-viewer-tui — standalone Ink TUI for SARIF files (Wave 1, PR1) (#152)
@sverka/sarif-viewer-web — standalone HTML report generator for SARIF (Wave 1, PR2) (#153)
SARIF pipeline — serializeSarif + --format sarif/web + sverka view (#155)
@sverka/ui — local web dashboard for SARIF findings + sverka ui command (#156)
@sverka/playground — browser sandbox for building and running check pipelines (#158)
run shell steps from project root + dogfood SARIF findings (#167)
warn on unknown config props in sverka validate/run (#168)
make repo installable as a Devin plugin (#185)
dogfood sverka pipeline + bun audit fixes (#188)
OIDC trusted publishing release pipeline (#190)
cli: add sverka compile command for github/gitlab targets (#35)
deploy: switch website deploy to GitHub Pages (c5b10b6)
nx: onboard @nx-devkit plugins — typescript preset, skill tooling, release (#187)
nx-cloud: setup nx cloud workspace (c61acaa)
nx-cloud: setup nx cloud workspace (#58)
website: migrate to Starlight docs site with engdocs and specs (3e5306f)

🩹 Fixes

address CodeRabbit review threads (b92ba98)
address code review findings in packages/ (76f1f83)
add legacy eslint engine name to .codacy.yml disable_rules (1fcb720)
add .eslintrc.json to disable es-x rules for Codacy ESLint 8 (0f7210f)
use exclude_paths instead of invalid disable_rules in .codacy.yml (0ac1b58)
runtime safety and condition handling in planner (e14bb06)
make outcomes required, add RuntimeFinalization type, widen OperandValue (5a1305c)
escape delimiters in matrix child IDs and reject duplicate values (ff14e45)
resolve SonarCloud and Codacy complexity findings (a09ab0a)
Add ESLint 9 flat config + fix per-package lint scripts (sv-ei2) (d0393a3)
Core ID assignment — SHA-256 content-addressed IDs per ADR-006 (b2570e4)
address Codacy review threads and typecheck after merge (3b8690a)
address Qodo review findings and thread issues (c233d24)
address CodeRabbit review threads (security, CI, planner, compilers) (1a119c4)
address Amazon Q and Codacy review findings on PR #28 (#28)
address CodeRabbit and Qodo iteration-2 findings on code files (e0e41ff)
address CodeRabbit and Qodo doc review findings on PR #28 (#28)
scope wisp/nudge filter to bead ID prefix in watchdog (7e165a2)
configure Codacy and SonarCloud to exclude scripts/ utility directory (48eca56)
address CodeRabbit iteration-3 findings on PR #28 (#28)
address Codacy post-merge findings on PR #28 (#28)
use urllib.parse for URI normalization, anchor Suspended grep (48186b5)
literal grep for harness.mayor, handle file:/ URI scheme (0995018)
address qodo post-merge findings on PR #28 (#28)
rebrand from 'AI-first' to 'code-first TypeScript pipeline engine' (eb477d7)
remove stale Nx Cloud org, ignore .worktrees from project graph (fdd46b6)
restore green typecheck baseline (81 pre-existing errors → 0) (#116)
MCP server typecheck errors (exactOptionalPropertyTypes + noUncheckedIndexedAccess) (#125)
bump Bun to 1.4.0 in CI and deploy-website workflows (#140)
audit fixes — stdout/stderr in JSON, findings pipeline, dead code removal (#166)
e2e verify graph/plan/compile — declare @sverka/workflow at root, lower exportStdout for CI targets (#177)
publish readiness — arena manifest, lockstep release (#189)
04-decorators: align decorators with spec, remove @output, add method-step support (8dec135)
cdk-split: address coderabbitai review threads (0ea77ff)
checks: sanitize output.path in extractFindings to prevent path traversal (9c3bc7c)
checks: wrap readFile in try/catch and skip only ENOENT (cad0d00)
checks: address v0-j-checks review threads (27853b9)
checks,sdk: resolve Codacy findings on PR #25\n\n- extractFindings: use async readFile and extract path validation into\n resolveSafeOutputPath helper.\n- sverka.ts: pass context directly instead of conditional spread. (#25)
checks,sdk: resolve wave-11 review threads (a75fe0e)
ci: contents: write for nx fix-ci auto-apply (8b87c26)
ci: pin all third-party actions to commit SHAs (fbea33c)
ci: resolve SonarCloud findings + add dependabot (1fdcaaf)
cli: propagate non-ENOENT unlink errors in baseline clear (#12)
cli: address PR review — path resolution, outcomes serialization, version extraction (cf4998f)
cli: address remaining review — TOCTOU init, test skip bug, type narrowing, function order (300bc50)
cli: resolve absolute baseline paths and close TOCTOU in clear (5dfb9c4)
cli: add 5s timeout to isBinaryAvailable spawnSync (c911d8f)
cli: resolve Codacy complexity and line-count findings (9faa9a1)
cli: add vitest aliases for runtime packages (bca9a41)
cli: init config conflict check, workspace-aware dependency, entry validation, package.json error handling (dffa6fc)
cli: prefer named project export over default in loadConfig (6c4f364)
cli: avoid file-existence race in ensureConstructsDependency and isLocalWorkspace (09a2e21)
cli: self-contained config loading and init --detect fixes (#179)
cli: unify check/init --detect detection paths (#180)
cli: actionable error when a @sverka/* dist is missing (#181)
cli, runtime, sdk: resolve CodeRabbit review threads for wave-10-cli (3fe5312)
cli,sdk: preserve all sdk re-exports by disabling tsdown tree-shaking (4d33da4)
cli,ui,sarif-viewer-tui: e2e fixes for report/view surfaces (#178)
codacy: replace broken disable_rules with engine exclude_paths (446def1)
compiler-github: address PR #14 review — toKebab, idToken, setup-bun, execute cmd, interface order (#14)
compiler-github: resolve CodeRabbit review threads for wave-12 (095dc11)
compiler-gitlab: address PR #16 review — default image, execute cmd, empty rules (#16)
compiler-gitlab: remove invalid regex flag in test (407ebbb)
compiler-gitlab: align contract/docs with implementation\n\n- Default image is oven/bun:latest; document Bun requirement.\n- Remove stale positional .sverka/plan.json from docs and JSDoc.\n- Add type exports usage in public-api test.\n- Use a Bun-capable image in custom-config test. (28414d8)
conformance: address review threads for v0-m-conformance (3ce3905)
conformance: use pipelineV0 instead of compat pipeline from SDK (07edbe5)
conformance: address coderabbitai review threads (e60fc3b)
constructs,core: address PR #38 review threads (#38)
core: remove JSON.stringify from canonical serialization and matrix/env encoding (bc9349d)
core: align canonicalStringify with tests (Date, undefined, lone surrogates) and update runtime-modes expectations (fe92e6b)
core: remove dead code in validateOutputCollisions, throw on missing artifact path (06ee98d)
core: restore old API as compat layer for downstream packages (9c54133)
core: condition dependency tests and docs lint; validate StepRef conditions (87a9b1c)
core: correct pipeline output mapping in synthesize after rebase (bff0a0b)
core,ir: align with main wave implementation to resolve SAST/review findings\n\nReplace the older core and ir source in the decouple branch with the\ncanonical versions from the main wave stack. This resolves SonarCloud/Codacy\ncomplexity and correctness findings and fixes the codeant/CodeRabbit\nthreads targeting the old core/ir code. (de87a63)
core,ir: address CodeRabbit review findings (a9b7190)
core,ir: address CodeRabbit review findings (000b6b8)
core,runtime-docker: reduce Codacy complexity/line-count findings (11e2bad)
decorators: allow number/boolean interpolation in planning methods (2cf7ca5)
decorators: address SonarCloud reliability and code smell issues (a5f4d80)
discover: resolve workspace globs to real dirs (#176)
docs,agents,config: address CodeRabbit review threads on PR #19 (#19)
engdocs: address review threads in v0 redesign foundation (b4e2825)
engine-native: address review threads for v0-f-engine (38589a6)
engine-native,runtimes: address PR #41 review threads (#41)
findings: resolve SonarCloud quality gate findings (7e4cafa)
findings: resolve Codacy quality gate findings (d858065)
foundation: address PR #37 review threads (#37)
github: reject unknown graph refs and preserve diagnostic messages (686f1c7)
github: address SonarCloud reliability and code smell issues (097613f)
github: revert replaceAll to replace with global flag for Codacy (4e79723)
gitlab: address review threads for PR #49 (#49)
gitlab: per-entry rules, import reachability, reserved keys, public API (96b7b9a)
ir: address SonarCloud + codeant-ai review findings (b0956d5)
ir: reduce cyclomatic complexity and mitigate ReDoS flag (de941e4)
ir: replace regex validation with manual string parsing (78ee1d7)
ir: reduce isValidMemoryString cyclomatic complexity below 10 (79176da)
ir: address CodeRabbit review threads for PR #2 (#2)
ir: reduce validateTopLevel cyclomatic complexity and pin typescript-eslint (e84641b)
ir: address CodeRabbit review threads — ADR wording, markdown lint, validation order, ISO 8601 (39e8ebe)
ir: complete dependsOn validation contract and align spec (cf29c59)
ir: allow empty sourceContextHash for SDK manual plans (66aac7a)
ir: add compat layer for old Plan API used by downstream packages (5e5a7d1)
ir: address SonarCloud reliability and code smell issues (f676007)
ir: fix ISO 8601 validation regression in compat/validate.ts (a0ba76d)
ir: address coderabbitai review threads (a4a24b5)
ir,core: address PR #39 review threads (#39)
ir,runtime: resolve all SonarCloud SAST findings (c0e94a8)
ir,runtime: resolve Codacy complexity and line-count findings (237731e)
lock: restore @sverka/ir workspace dependency in bun.lock (23be76f)
merge-stack: verify lower-branch content with trial 3-way merge (f2a4a90)
merge-stack: fail closed on fetch, validate merge-tree OID, keep unverified PRs open (c93871c)
merge-stack,watchdog: support SHA-256, source markers, grep -F (62d9481)
merge-stack,watchdog: source-markers, case-insensitive bead regex, robust gc parsing, fetch once (4cefcc1)
planner: resolve Codacy complexity and SonarCloud findings (c9b52b4)
planner: resolve remaining SonarCloud test-assertion and PATH-hotspot findings (4fc3874)
planner: revalidate resolved review threads (71fb3c0)
planner: address review threads for v0-g-planner (d3ae989)
planner: scope detection to root subtree for nested init --detect (#182)
planner,core,ir: address v0-g-planner review threads (5b6a62e)
plugin: clone nested CapabilityDetail, define connector diagnostic behavior (277bfea)
plugin: reject arrays as capability manifests, document operation.import (08e00d3)
policy: validate failOn rule shape before accessing severity (f80e05f)
policy: reduce createPolicy cyclomatic complexity for Codacy (aae5437)
policy,core,docs: resolve open CodeRabbit threads on #10 (#10)
pr-stack-resolve: fix shell lint issues in stack resolve script (eeb34b9)
pr-stack-resolve: fix shellcheck disable directive format (72dd255)
release: repair actions/setup-node pin — sha didn't resolve (dd04ce2)
release: drop --yes flag (#191)
release: commit in version step, tag in changelog step (#192)
release: pass version positionally to changelog (#193)
review: address Codacy/Qodo feedback on watchdog, runbook, and tests (497fbf0)
review: bind runbook head branch per PR and harden watchdog tests (15aeef3)
review: harden deploy workflow and pre-alpha banner accessibility (ddb6c12)
review: disable Bun cache and align banner text (5c8e31d)
review: base-path root handling and 404 home link (b9f8b85)
review: scope deployment permissions to the deploy job (37013d7)
review: split build/deploy jobs and simplify base normalization (a13c727)
runtime: address 6 codeant-ai review threads (720fb1e)
runtime: restore old runtime packages as compat layer (b3342e2)
runtime: export both old and new APIs from runtime-host and runtime-docker (b1bd02f)
runtime-docker: extract validateRequest/runContainer/finalizeResult to reduce complexity (818a725)
runtime-docker: address resolved review threads on socket policy, cache paths, and artifacts (f2e5bc8)
runtime-docker, core, ir: address CodeRabbit review threads for wave-5 (474c118)
runtime-host: extract validateRequest/finalizeResult to reduce complexity; pin devDeps (5908184)
runtime-host: treat spawn failure as runtime error (c0e424f)
sarif: normalize all URIs and reject boolean coordinates (af686af)
sdk: resolve Codacy complexity and line-count findings (bbc8e14)
sdk: extract resolveDefaults to reduce buildPlanOperation complexity (850e084)
sdk: type buildPlanOperation return as PlanOperation for exactOptionalPropertyTypes (4d31305)
sdk: address CodeRabbit review threads on PR #11 (#11)
sdk: revalidate resolved review threads (bfbd3a4)
sdk: reduce resolveDefaults cyclomatic complexity for Codacy (ac9c258)
sdk: forward PATH to host executor (c47f227)
sdk: address review findings for v0-c-sdk (cdbe6b8)
sdk: address review findings for v0-c-sdk (source changes) (c80f2cc)
sdk: remaining v0-c-sdk review threads (d3f2a05)
sdk: add compat layer for old SDK API used by CLI (a1426aa)
sdk: add runtime-host and runtime-docker to sdk deps (96ac85f)
sdk: address coderabbitai review threads (d303dd5)
sdk: make runtime imports lazy for waves that replace @sverka/runtime (31ff11a)
sdk: make runtime imports lazy in root sverka.ts (8e441f3)
sonar: scope workflow permissions to jobs (9dc60bd)
watchdog: match wisp/nudge exclusions to complete bead IDs (e853eb1)
watchdog: harden regex, use grep -m1, and add regression tests (826399f)
wave-11-checks: resolve Qodo review threads on SDK auto-discovery and check resolver (9ee33e2)
wave-9-sdk: provide explicit localeCompare compare function for sourceContextHash changedFiles sort (143e517)
website: add @sverka/sdk to quick start install instructions (4c50bb3)
website: address review feedback in sync-docs.ts (672262f)
website: use relative links in splash page so BASE_PATH is respected (9572605)
website: sync-docs refactor, per-page editUrl, runbooks, mermaid selector, deploy paths (dc70ff8)
website: add sync-docs tests, warn on unresolved links, exclude tests from astro check (b0e303a)
website: publish only user-facing docs, drop engineering/specs pages (c71781e)
website: remove dead singleFiles loop to satisfy SonarCloud reliability gate (f9b9a59)
website: run sync before asserting engineering/specs are absent in tests (844bccd)
website: consistent sidebar labels and deduplicate page titles (7d5cee5)
website: address SonarCloud reliability findings (ddbb2cf)
website: address review threads for sidebar and frontmatter (13a13a3)
website: harden sidebar generation and add order assertions (1d2a7b7)
website: migrate Starlight sidebar to v0.39+ format, fix broken policy link (#113)
website: switch deploy runner to ubuntu-latest (#114)
website: remove concurrency group to unblock stuck deploy (#115)

🔥 Performance

cli: lazy-import reporter and MCP SDK to cut startup ~60% (#183)

❤️ Thank You

Devin @devin-ai-integration[bot]
Devin AI @devin-ai-integration[bot]
Petr Plenkov @ThePlenkov
ThePlenkov @ThePlenkov