Release notes: Vibgrate CLI 2026.1007.1 — risk budgets and a CI-ready DriftScore summary

[vibgrate-team]

What's new in 2026.1007.1 (and 2026.1006.2)

Shipped 7 Oct 2026. Full release: https://github.com/vibgrate/cli/releases/tag/v2026.1007.1 · Changelog: https://vibgrate.com/changelog/cli/2026.1007.1

2026.1006.2 went out earlier the same day with the same feature set; 2026.1007.1 is the one to install. Its release is here: https://github.com/vibgrate/cli/releases/tag/v2026.1006.2

Headline: budget for risk, not just drift, and hand CI a clean summary

Last release added a DriftScore budget. This one lets driftBudget cap risk too: maxRiskScore and maxRiskWorseningPercent let you fail a change that makes exposure meaningfully worse, even when drift barely moves. A local vg scan reports those limits as not evaluated rather than guessing, so you know the gate only bites where it has the data.

For CI authors, vg scan --summary-out <file> now writes a small JSON summary of the DriftScore, and the Action exposes drift-score, risk-level and score-delta outputs, so later steps (PR comments, badges, Slack) can read the result without parsing the full report.

Also in this cut

New / Changed

• driftBudget accepts maxRiskScore and maxRiskWorseningPercent
• vg scan --summary-out writes a compact DriftScore JSON for CI; new drift-score, risk-level, score-delta outputs
• The npm page now links to the CLI product page and explains that a scan scores drift and exposure separately

Improved (docs)

• vg build --attest / vg build --verify are documented, including the signing flow and the error messages you can hit
• vg build docs explain how a GitHub Actions uses: pin is recorded in the code map
• vg sbom export and vg scan --format json docs cover package digest fields and clarify project vs solution identifiers

Fixed

• vg evidence and vg build --attest exit with a clear error when the output file can't be serialized or written, instead of failing vaguely
• vg sbom export keeps one component when several projects resolve the same package, and warns about any dropped dependency edges

Try it

npm install -g @vibgrate/cli
vg --version                          # expect 2026.1007.1
vg scan --summary-out drift.json      # compact DriftScore summary for CI
cat drift.json
vg sbom export                        # multi-project repos: one component per package

No-install try: npx @vibgrate/cli scan

Benchmarks (honest)

Two-arm benchmark vs 2026.1006.2 on the pinned corpus (236 metrics compared). Extraction held steady (19 languages, 26,626 definitions, 19,057 call edges, locate accuracy 0.94, dependency detection 0.96). Startup median ~829 → ~827 ms. The two regressions we've been reporting are still there and still published: agent tokens with vg on comparable tasks 578,766 → 636,808 (+10.0%) and median tool calls per task 6 → 7 (+16.7%). Details: https://vibgrate.com/cli/benchmarks

Discuss

• Gating on risk? Tell us which of maxRiskScore or maxRiskWorseningPercent fits your team, and what thresholds you landed on.
• Using --summary-out in a pipeline? Reply with what you feed it into; it helps us decide which fields to add next.
• Docs gaps? Grab a good first issue or reply here.
• Roadmap thread: Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144

— maintainers (vibgrate-team)