Changelog

v0.2.1 — 2026-08-15

A false-positive fix. No configuration change is required, and nothing that passed 0.2.0 fails here — verikt check reports strictly less.

Fixed

global_mutable_state no longer reports lookup tables. An unexported package-level variable that nothing writes to is not global mutable state. Go has no const map or const slice, so var x = map[K]V{...} is the only way to express a table — reporting it named a construct the language requires, and prescribed dependency injection, which makes a static table worse.

On verikt’s own codebase the check fired 22 times and 21 were tables nothing ever wrote to. A detector wrong 21 times in 22 teaches you to skim the section it appears in.

Still reported: exported variables, whatever a single file shows, because another package can write to them; and anything mutated — assignment, index assignment, delete, or append assigned back.

The trade is deliberate. A table mutated from a sibling file in the same package is now missed. Occasional misses do less harm than routine false positives.

Added

A restraint fixture — code written the way a careful engineer writes it, where every detector must stay silent. Any finding fails the build. Detection was already guarded, and restraint was not, so a detector could grow louder indefinitely with no test objecting.

Effect

On verikt’s own repository: 23 anti-pattern findings to 1, and the survivor is real. If you ratchet a finding count, re-measure — it will drop.

v0.2.0 — 2026-08-15

Fixes an external audit of 0.1.0 and the parity gaps found while fixing it — cases where two implementations of the same check disagreed and nothing detected it. Read the breaking changes before upgrading: a pipeline can newly pass or newly fail without any change to your code.

Breaking

verikt check requires the embedded engine for Go projects. The Go duplicates of the engine’s analysis are deleted. Released binaries embed the engine, so this affects builds from source that skipped the engine build.

Only error severity fails the check. Warnings no longer do. Gate on .result in the JSON output rather than selecting on severity across violations[] and anti_patterns[] — those two arrays hold detector findings only, so a gate built from them misses proxy-rule violations, stale rules and decision gates:

verikt check --output json > verikt.json
jq -e '.result == "pass"' verikt.json

Error-severity anti-patterns fail again, including sql_concatenation and swallowed_error. They were silently downgraded to warnings whenever the embedded engine resolved. Fix them, or waive them with a required reason — severity_overrides now covers anti-patterns, and waived findings stay visible in a WAIVED section without affecting the exit code.

A path verikt cannot read fails the check, reported as unreadable_path. The tool cannot vouch for what it did not read.

anti_patterns[] uses lowercase JSON keys, and the document carries schema_version: 2. violations[], anti_patterns[] and waived[] are always present and always arrays.

Fixed

--diff <ref> reported nothing at all — the ref was read as a pathspec, so every finding was filtered away and the check passed unconditionally. --staged now filters detector findings, not just proxy rules.

Proxy rules ran against nothing under the default --path .. A rule that swept its scope and found nothing is no longer reported as stale. check.exclude matches whole path segments instead of substrings, so excluding gen/** no longer silences findings in internal/agent/. Glob patterns with ** anywhere in them work, and rule scopes and verikt.yaml share one matcher.

Test files no longer produce dependency violations in TypeScript, symlinks are skipped everywhere, testdata/ is excluded, and the engine no longer reports findings against its own fixtures.

The platform capability’s config layer reads the environment: defaults, then the YAML file, then environment variables. Credentials have no YAML key at all, so a secret written into the committed config file is refused rather than quietly accepted.

Full detail, including every finding and the reasoning behind each fix, is in CHANGELOG.md.

v0.1.0 — 2026-03-23

First public release of verikt. Previously developed as “archway” — renamed to verikt as part of the dikta platform.

Go Language Provider

63 capabilities across 10 categories. 4 architecture patterns (hexagonal, layered, clean, flat).

Core commands: verikt new (scaffold), verikt add (add capabilities), verikt check (11 AST-based detectors), verikt guide (generate AI agent context for Claude Code, Cursor, Copilot, Windsurf).

Smart suggestions, capability warnings, feature-flag template engine, proxy rules, decision gates.

verikt new my-api --language go --arch hexagonal \
  --cap platform,bootstrap,http-api,postgres,docker --no-wizard

TypeScript/Node.js Provider

39 capabilities across data, resilience, security, patterns, and infrastructure. Two architectures: hexagonal and flat. HTTP framework choice: Express, Fastify, or Hono.

verikt new my-ts-api --language typescript --arch hexagonal \
  --cap platform,bootstrap,http-api,postgres,docker --no-wizard

ORM choice. Data capabilities default to Prisma. Drizzle is available as a query-builder alternative:

verikt new my-api --language typescript --arch hexagonal \
  --cap platform,bootstrap,http-api,postgres --set OrmLibrary=drizzle --no-wizard

Go Query Builders

Two capabilities for structured query building on top of pgx/database-sql:

• squirrel — fluent SQL construction with QB() factory for PostgreSQL-aware placeholders
• sqlc — compile .sql files to type-safe Go functions

Rust Analysis Engine

Embedded Rust engine using tree-sitter for import graph analysis. Supports both Go and TypeScript via language-specific extractors. Communication via protobuf over stdin/stdout. Cross-compiled for darwin-arm64, darwin-amd64, linux-arm64, linux-amd64.

Governance Checkpoint

verikt guide includes a governance checkpoint — an instruction block that tells agents to verify architecture rules before modifying files and re-check compliance after tool results.

Validated by EXP-10: variance eliminated (0.89 → 0.00), violations reduced 25% on greenfield builds.

Onboarding

verikt init is the single entry point. Detects your project state:

• Empty directory → greenfield scaffold wizard (same quality as verikt new)
• Existing code → analyzes codebase, then offers: map existing or bubble context (strangler fig)

/verikt:init skill for Claude Code mirrors the CLI flow. verikt setup installs the skill globally, locally, or both.

Node.js Version Support

Default Node version: 22 (Active LTS). Node 24 support adds version-gated features via features.yaml:

• native_ts — drops tsx dependency, uses node --watch for dev server
• es2024 — tsconfig target set to ES2024

Website

• About page, 3 agent-specific guide pages (Claude Code, Cursor, Copilot)
• Capability pages, architecture comparisons, glossary
• 10 experiments documenting architecture context effectiveness
• robots.txt, per-page OG meta, structured data

brew install diktahq/tap/verikt