The verdict machinery that has always sat behind a git repo with a committed baseline is now callable on its own: one command in, one machine-readable verdict out, against any directory — no git, no init, no install into the tree being judged.
Highlights
vyuh-dxkit gate <dir>— one-shot tree gate: fresh prior (everything net-new by construction) or--baseline <original>tree diff. Untrusted by default (dxkit never executes code it is merely judging;--trustedis explicit consent). Exit 0 passed / 1 blocked / 2 cannot gate.verdict.v1— frozen machine-readable verdict + receipt (SDK 0.3.0), naming the policy it judged under: id, version, content hash.- Named, versioned, embeddable policies with declarative text rules — in-process pattern checks, safe on untrusted trees.
- The estate wave —
gate --workspace --flows <dir>: N member trees judged as one composition (unresolved cross-member calls, dead routes, declaredflow.v1end-to-end flows) on top of full per-member gates. - Offline advisory snapshots (
--advisory-db) for air-gapped dependency audits. - ABAP language pack (abaplint-adopted lint gate + syntax floor) — 11 ecosystems.
- Embed profile:
init --gate-only(policy scaffold only) andtools bom(scanner bill of materials with pins + checksums). - Two new learn guides (embedding the gate, wave gating) and the
dxkit-gateagent skill.
Upgrade notes
- No re-baseline needed — the finding-identity scheme is unchanged; existing baselines and allowlists remain valid as-is.
- One behavior change: a custom check declared
blocking: truenow blocks NET-NEW failures under every posture, includingsecurity-only, where it previously warned. Grandfathered backlog unaffected. Opt out per check (blocking: false) or viablockRules.newBlockingCustomCheckFailure: false. - Everything else is new opt-in surface, unreachable from an existing install until invoked.
Full changelog: https://github.com/vyuh-labs/dxkit/blob/main/CHANGELOG.md