Small one, from an org-wide CLI survey across the verified varve layer 2026.08.2 — matrix and baseline in pulseengine.eu#167.
What is good here
wsc has the best operator surface of the nine:
--audit / --audit-file <FILE> — structured JSON audit logging to stderr or a file. No other tool in the layer offers a machine-readable audit trail of what it did, which is odd given that is what the whole toolchain is for. This should probably be the pattern others copy.bundle (air-gapped trust bundles), verify-matrix (batch verification against multiple keys), and the attest / show-chain / verify-chain trio give a complete transformation-provenance story rather than just sign/verify.docs — embedded documentation, same good instinct as rivet docs and witness quickstart.
split ("add cutting points to enable partial verification") is a nice touch — it makes partial verification a first-class artifact operation instead of a special case.
The problem
$ wsc --version
wsc-cli 0.10.0
The installed binary is wsc; wsc-cli is the crate. Same class as witness reporting witness-mcdc — cosmetic until something parses it, and we now require evidence to name the producing tool, so a check of "does the reported name match the binary I invoked" fails here and passes for seven of nine.
Ask
--version/-V print wsc <semver>; build metadata after the semver is welcome (rivet's form is the model). Usually a one-line display-name change rather than defaulting to CARGO_PKG_NAME.
Separately, and only worth a look: the release ships wsc-cli.wasm with no native darwin-arm64 asset, so the layer's native wsc and the published artifact have different names again. Fine if deliberate — flagging in case it is not.
🤖 Generated with Claude Code
Small one, from an org-wide CLI survey across the verified varve layer
2026.08.2— matrix and baseline in pulseengine.eu#167.What is good here
wschas the best operator surface of the nine:--audit/--audit-file <FILE>— structured JSON audit logging to stderr or a file. No other tool in the layer offers a machine-readable audit trail of what it did, which is odd given that is what the whole toolchain is for. This should probably be the pattern others copy.bundle(air-gapped trust bundles),verify-matrix(batch verification against multiple keys), and theattest/show-chain/verify-chaintrio give a complete transformation-provenance story rather than just sign/verify.docs— embedded documentation, same good instinct asrivet docsandwitness quickstart.split("add cutting points to enable partial verification") is a nice touch — it makes partial verification a first-class artifact operation instead of a special case.The problem
The installed binary is
wsc;wsc-cliis the crate. Same class as witness reportingwitness-mcdc— cosmetic until something parses it, and we now require evidence to name the producing tool, so a check of "does the reported name match the binary I invoked" fails here and passes for seven of nine.Ask
--version/-Vprintwsc <semver>; build metadata after the semver is welcome (rivet's form is the model). Usually a one-line display-name change rather than defaulting toCARGO_PKG_NAME.Separately, and only worth a look: the release ships
wsc-cli.wasmwith no native darwin-arm64 asset, so the layer's nativewscand the published artifact have different names again. Fine if deliberate — flagging in case it is not.🤖 Generated with Claude Code