Skip to content

PatchWitness v0.2.0 — From install to evidence in one command

Marketplace
Marketplace

Choose a tag to compare

View all tags
@pangxueyuan2-creator pangxueyuan2-creator released this 11 Aug 14:26
v0.2.0
f95f84d

PatchWitness v0.2.0 - From install to evidence in one command

PatchWitness v0.2.0 removes the largest first-use obstacle: a developer can now install the CLI,
enter an existing Git repository, and produce a real Change Passport with patchwitness scan.
There is no configuration file to write before seeing the tool work.

What changed

  • patchwitness scan selects the useful comparison automatically: HEAD for working-tree changes,
    or HEAD^ for the latest commit in a clean repository.
  • Deterministic, local detection recognizes conventional test commands for Python, Node.js, Go,
    Rust, .NET, Maven, Ruby, PHP, and Make projects.
  • Existing .patchwitness.toml policies are reused. Without one, the scan is clearly identified as
    an auto-detected-preview and the next step explains how to persist a trusted policy.
  • patchwitness init uses the same detector instead of assuming pytest, supports explicit
    --check ID=COMMAND overrides, and can generate a structural-only policy with --no-detect.
  • patchwitness doctor now shows the repository profile, exact detected commands, missing tools,
    contract state, and the recommended next command.
  • Check execution automatically prefers the repository's .venv, so a globally isolated CLI can
    still use local test dependencies.

Try it

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.2.0/patchwitness-0.2.0-py3-none-any.whl"
cd your-repository
patchwitness doctor
patchwitness scan

The output is a portable, offline-verifiable Change Passport under .patchwitness/evidence/.

Security boundary

Project detection is read-only: it does not run project code, contact a network service, or ask an
LLM to choose a command. The detected checks themselves do execute repository code with the current
user's permissions. Inspect an untrusted repository with patchwitness doctor, or use
patchwitness scan --no-checks for structural analysis only.

The auto-detected policy is intentionally a preview. A CI gate should still use a reviewed,
committed .patchwitness.toml loaded from the immutable base revision with --policy-ref.

Compatibility

  • Evidence schema remains patchwitness.dev/evidence/v1.
  • No runtime dependencies were added.
  • Existing contracts, CLI commands, SDK calls, MCP tools, reports, and Change Passports remain
    compatible.

Release validation

  • 51 tests passed on Windows with Python 3.14.5.
  • Measured test coverage was 82.15%, above the enforced 80% floor.
  • Ruff, strict mypy, CLI help, doctor, and a real self-scan passed.
  • The self-scan ran all three repository checks and wrote a verified Change Passport.
  • The wheel and source archive built successfully; the wheel installed without dependencies into a
    fresh virtual environment.
  • That clean installation detected a separate Python repository, used its local .venv, ran its real
    pytest suite, produced a passing Change Passport, and verified the passport offline.
  • Both archives had safe paths, no sensitive filenames, local maintainer paths, or private-key
    markers. One token-shaped string was reviewed and confirmed as an intentionally synthetic
    redaction-test fixture.

GitHub CI repeats the cross-platform matrix, and release assets receive GitHub build-provenance
attestations.

Assets 4
Loading