Skip to content

Evidrift v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 09:17
v0.3.0
602ac92

Code compiles. APIs drift.

Evidrift is the evidence lockfile for AI coding agents. v0.3 records the exact TypeScript overload selected at a real call site, or an exact value inside a repository-local JSON contract, then recomputes that evidence in CI.

No account. No cloud. No LLM judge. No package code execution.

Try it

npx --yes evidrift demo

The demo records an optional TypeScript parameter, verifies it, changes the dependency signature on purpose, and reports the deterministic mismatch with the claim, expected and current signatures, affected code location, Receipt ID, and next action.

What landed in v0.3

  • Call-site overload resolution — point --code at the real call and TypeScript selects the overload that code actually uses. --overload remains an explicit fallback for incomplete call sites.
  • JSON Pointer evidence — lock a value from repository-local OpenAPI JSON or JSON Schema with RFC 6901 pointers, including ~1 and ~0 escapes.
  • One verification core — CLI and STDIO MCP tools create and revalidate the same content-addressed Receipts.
  • Fail closed on deterministic mismatch — changed or missing selected contracts fail CI; unrelated source changes remain warnings.

The failure is reviewable

FAIL contract_mismatch sha256:...
Claim: parseConfig accepts an optional options parameter used by the demo.
Expected signature: parseConfig(input:string,options?:ParseOptions):ParseResult
Current signature: parseConfig(input:string,options:ParseOptions):ParseResult
Affected code location: app/src/index.ts:3
Action: Review the dependency change and affected code, then intentionally record a new receipt.

Trust boundary

Evidrift recomputes evidence from installed TypeScript declarations or repository-local JSON. Receipt files are treated as untrusted input. It does not fetch URLs, run shell commands, execute dependency JavaScript, or ask an LLM to decide whether CI should pass.

It does not prove runtime correctness or eliminate AI hallucinations. It proves evidence integrity and reports deterministic contract drift.

Assets 2
Loading