Evolith Core 1.3.0 — the published CLI can do its job again

The published CLI can do its job again

@beyondnet/evolith-cli@1.2.2 shipped 87 Rego sources and zero policy.wasm, so validate --engine opa failed closed on every rule from a clean install. The bundle is gitignored, so a fresh CI checkout never had one — and nothing in the publish path compiled it. Locally it was invisible: any maintainer who had ever run build:policy had the artifact sitting in the ignored path, so their npm pack looked correct.

Two fixes, because compiling it is not the same as guaranteeing it. The release workflow now compiles and asserts the bundle, and the clean-room install guard fails the publish when a required runtime asset is missing or truncated.

Verified in a container with nothing but Node:

policy.wasm in the installed package .... 669,460 bytes
validate --engine opa .................. exit 2, status=failed
                                         133 checked / 26 skipped / 0 errored
accented characters in human output .... 0

errored=0 is the number that matters: the OPA engine evaluated, rather than failing closed.

Try it

npx -y @beyondnet/evolith-cli@1.3.0 rulesets

As a PR gate in your own repository:

- uses: beyondnetcode/evolith_arch32@v1
  with:
    fail-on-violation: true

As an MCP server:

{ "mcpServers": { "evolith": { "command": "npx", "args": ["-y", "@beyondnet/evolith-mcp"] } } }

Also in 1.3.0

• The CLI is entirely in English. validate, standards, adr, init and the rest — measured at zero accented characters across every user-facing surface.
• ADR-0126 narrows the bilingual mandate from 783 pairs to a 16-document entry surface, and both guards print what they no longer check on every run. A rule that was not evaluated is not a rule that passed.
• A DCO replaces no contribution provenance at all. The sign-off is added by a hook and verified by another, so it is a guarantee rather than an assumption.
• pre-push stops pushing a branch you did not ask for. It read an intent recorded at commit time and ignored the refs git hands it, so git push -u origin my-branch ran git push origin develop.
• drift no longer prints the source of a chalk function next to your score.
• Contributors are no longer rejected: committing without a TTY works, and the PR template stopped demanding three boxes nobody outside the project can honestly tick.

Packages

All three carry SLSA provenance attestations.

Package	Version
@beyondnet/evolith-cli	1.3.0
@beyondnet/evolith-mcp	1.3.0
@beyondnet/evolith-core-domain	1.3.0

Full changelog: v1.1.0...v1.3.0