Sync from monorepo (v2026.917.1)

.github/workflows/helm.yml

@@ -118,6 +118,9 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v5
 
+      - name: Set up oras
+        uses: oras-project/setup-oras@v1
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

DOCS.md

@@ -465,6 +465,8 @@ vg review --local                    # deterministic scanners; no hosted model
 vg review --loop                     # review → deterministic patch → re-review
 vg review --base origin/main         # merge-base of HEAD and the base branch
 vg review explain arch-01            # the evidence behind one finding
+vg review findings-from-diff         # deterministic graph/policy findings only
+vg review propose blast:<node_id> --model forge --json
 ```
 
 | Flag                  | Default | Description                                                                |
@@ -531,13 +533,11 @@ to your repository; that is the only way to stop it gating.
 
 | Finding | What it means |
 |---|---|
-| `boundary_bypass` | A dependency breaks the declared layering, or skips a tier |
-| `peer_deviation` | This file does something its peers do differently |
 | `unguarded_entrypoint` | **Protected.** A mutating route has no authorization guard, where its peers do |
 | `guard_removed` | **Protected.** A guard was deleted and nothing equivalent remains |
 | `known_vulnerable_dependency` | **Protected.** A changed manifest declares a package with a known advisory |
-| `duplicate_implementation` | This re-implements something the repository already has |
-| `unverified_change` | Changed code with no test reaching it |
+| `correctness` (producer `blast_radius`) | Blast-radius fact: a changed symbol has cross-file callers or dependents — the same reverse-reachability `vg impact` reports. Severity stays at or below medium. Stable `id` (`blast:{node_id}` / `blast:{path}:{name}`) is the finding_key. |
+| `correctness` (producer `architecture`) | Architecture-policy on a changed file (layer skip / boundary, peer deviation, duplicate implementation, uncovered change). Stable `id` is `arch:{rule}:{path}` using the architecture pack's rule string when one exists. Severity is `low`, `medium`, or `high` — never `critical` from version lag. |
 
 Two of these deserve a note, because they are what a linter cannot do:
 
@@ -558,6 +558,34 @@ which by construction scores your best file worst.
 a file it could not parse, becomes an honest unknown — never "this route is
 open". Below four classified peer routes a finding is advisory and cannot gate.
 
+#### Findings from a change — `vg review findings-from-diff`
+
+The same deterministic scanners `vg review` runs, printed as the
+`vg.review.findings.v1` document — graph blast-radius facts for changed
+symbols, plus architecture and security-control findings on the change set.
+No hosted model. Use this when you want the findings (and their ids) without
+the signed receipt ceremony.
+
+```bash
+vg review findings-from-diff
+vg review findings-from-diff --base origin/main
+vg review findings-from-diff --diff pr.patch --format json
+vg review propose blast:<node_id> --model forge --json
+```
+
+`--diff` reads a unified diff (`-` is stdin). The patch names the files and
+hunks; the code map still has to be built (`vg` or `vg build`). `--format json`
+writes the findings document plus a `publishable` array of correctness rows
+(`kind: "correctness"`, stable `id` used as `finding_key`, producer metadata
+`blast_radius` or `architecture`) for App ingest. When capsule verification
+already emitted a fact for a finding's path, that evidence id is cited on the
+finding and on the publishable `receipts` array — no second receipt system.
+Suggested-fix on those rows is an honest skip — there is no computed PatchIR
+for blast-radius or architecture-policy rows. Propose is dry-run unless you pass
+`--apply --yes` on a topic branch — never the default branch. Local Code Mode
+ids are `spark`, `flow`, and `forge`; hosted Review uses `relay:<slug>`. This
+path does not post a comment or a check run.
+
 #### Before you write it — `assess_change`
 
 `vg review` asks "was that change sound?". The MCP tool `assess_change` asks
@@ -1686,7 +1714,7 @@ vg show arch --no-open --json    # print the URL and counts; keep serving
 | `--focus <name>` | — | Open the map on this symbol |
 | `--no-open` | — | Print the URL without opening a browser |
 
-The map opens on the **workspace** (one card per package), then drills into a **column slice** (UI / endpoint → application → store). Same-file functions collapse; tests stay hidden; at most 120 cards. Filters (**by job**, **by cluster**, **who calls whom**, **missing steps**, **problems**) apply inside that zoom. With the Architecture module off it is the raw graph’s kinds in the same columns — never a guess. The page is served inline from loopback with no external assets, and `q` / Ctrl-C stops it. `vg show chart` is the pre-rename spelling and still works as a silent alias for one release. See [docs/show-arch.md](./docs/show-arch.md).
+The map opens on the **workspace** (one card per package), then drills into a **column slice** (UI / endpoint → application → store). Same-file functions collapse; tests stay hidden; at most 120 cards. Filters (**by job**, **by cluster**, **who calls whom**, **missing steps**, **problems**) apply inside that zoom. Overlay toggles (vulns, drift, ownership, churn) paint on that same canvas — the Health tab opens them; it is not a blank page. Missing scan, CODEOWNERS, or git history is omitted, never a healthy zero, and the map does not invent an Architecture Health Score. With the Architecture module off it is the raw graph’s kinds in the same columns — never a guess. The page is served inline from loopback with no external assets, and `q` / Ctrl-C stops it. `vg show chart` is the pre-rename spelling and still works as a silent alias for one release. The VS Code architecture board hosts the same page and payload. See [docs/show-arch.md](./docs/show-arch.md).
 
 #### vg show savings
 

NOTICE

@@ -23,7 +23,7 @@ This product bundles or depends on the following open-source components:
     src/vendor/fastembed is adapted from fastembed-js v2.1.0
     (https://github.com/Anush008/fastembed-js); see that file's header for the
     changes made
-  - @anush008/tokenizers (MIT) — native HuggingFace tokenizers bindings
+  - tokenizers (Apache-2.0, © HuggingFace) — native HuggingFace tokenizers bindings
   - onnxruntime-node (MIT) — ONNX Runtime for local embedding inference
   - tar (ISC) — model archive extraction
   - web-tree-sitter (MIT) — WASM tree-sitter runtime

README.md

@@ -82,6 +82,13 @@ when files change — including edits the assistant itself just made — the nex
 tool call rebuilds it incrementally before answering, with no watcher or
 daemon involved.
 
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/node-turborepo/serve.gif" alt="Recorded node-turborepo/serve replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>node-turborepo/serve</code> — <code>vg serve --http</code> starts Vibgrate AI Context. <a href="https://vibgrate.com/cli">Live simulator</a>.</sub></p>
+
 Wire it up in one command:
 
 ```bash
@@ -180,7 +187,14 @@ Prefer the hosted server over your team's scan data? **[Vibgrate Cloud MCP](http
 
 ## Understand any codebase
 
-Build the graph once, query it continuously:
+Build the graph once, query it continuously. These are recorded replays of the real CLI on sample repos — [run them live](https://vibgrate.com/cli).
+
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/node-turborepo/build.gif" alt="Recorded node-turborepo/build replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>node-turborepo/build</code> — <code>vg build</code> maps a pnpm monorepo.</sub></p>
 
 ```bash
 vg build                        # index the repo (incremental; re-run after changes)
@@ -192,6 +206,20 @@ vg tree src/server.ts           # call tree rooted at a node
 vg insights                     # overview: hubs, hotspots, untested paths
 ```
 
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/node-turborepo/ask.gif" alt="Recorded node-turborepo/ask replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>node-turborepo/ask</code> — <code>vg ask</code> returns cited nodes, not a chat essay.</sub></p>
+
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/node-turborepo/impact.gif" alt="Recorded node-turborepo/impact replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>node-turborepo/impact</code> — blast radius of changing a hub before you edit.</sub></p>
+
 The graph is byte-deterministic and reproducible — the same repo always produces the same graph on every machine.
 
 ```bash
@@ -363,6 +391,13 @@ Full key reference — including `securityTier`, `capsule`, and `modelProfile` 
 
 ## Measure and manage upgrade drift
 
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/calcom/scan.gif" alt="Recorded calcom/scan replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>calcom/scan</code> — a bare <code>vg</code> drift scan on sample Cal.com data. <a href="https://vibgrate.com/cli">Live simulator</a>.</sub></p>
+
 ```bash
 vg scan                         # drift score + risk level + ranked priorities
 vg scan --push                  # same, and upload to Vibgrate Cloud for trend tracking
@@ -489,6 +524,13 @@ Upload is opt-in — nothing leaves your machine until you run `--push`. Store t
 
 ## CI integration
 
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/java-spring/budget.gif" alt="Recorded java-spring/budget replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>java-spring/budget</code> — <code>vg scan --drift-budget 60</code> as a CI gate (this recording exits 0). <a href="https://vibgrate.com/cli">Live simulator</a>.</sub></p>
+
 Drop `vg` into any pipeline to turn drift scoring into a quality gate:
 
 ```yaml
@@ -534,13 +576,35 @@ AI assistants connected via MCP use `vg lib` automatically when answering questi
 
 ## SBOM and OpenVEX
 
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/strapi/sbom.gif" alt="Recorded strapi/sbom replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>strapi/sbom</code> — <code>vg sbom export --format cyclonedx --out sbom.cdx.json</code>. An inventory, not a compliance determination. <a href="https://vibgrate.com/cli">Live simulator</a>.</sub></p>
+
 ```bash
 vg sbom export --format cyclonedx --out sbom.cdx.json
 vg sbom export --format spdx     --out sbom.spdx.json
 vg sbom delta  --from .vibgrate/baseline.json --to .vibgrate/scan_result.json --out delta.txt
 vg vex                          # generate an OpenVEX document for attestation
 ```
 
+## Review a change
+
+**Vibgrate Review** reads the current change against the declared architecture and security-control policy. It reports change integrity, not a proof of security.
+
+<p align="center">
+  <a href="https://vibgrate.com/cli">
+    <img src="https://vibgrate.com/img/cli-scenarios/dotnet-clean-arch/review.gif" alt="Recorded dotnet-clean-arch/review replay of the real Vibgrate CLI" width="620" />
+  </a>
+</p>
+<p align="center"><sub><code>dotnet-clean-arch/review</code> — <code>vg review</code> on a Clean Architecture fixture. <a href="https://vibgrate.com/cli">Live simulator</a>.</sub></p>
+
+```bash
+vg review
+```
+
 ---
 
 ## Privacy & offline-first
@@ -683,7 +747,7 @@ All HCS computation runs in an optional, separately-licensed engine module that
 | `vg fix` | Ranked, risk-tiered upgrade plans from the hosted planner — then apply the one you choose |
 | `vg init [path]` | Initialise config and `.vibgrate/` |
 | `vg report` | Generate a report from a scan artifact |
-| `vg review` | **Vibgrate Review** — architecture + security-control review of the current change, locally (`--in-place`, `--local`, `--loop`). One decision (`pass` / `needs_review` / `fail` / `undetermined`) in a signed receipt (Ed25519 over the receipt digest; `vg review verify <receipt.json>` checks it offline); protected findings cannot be blessed into a pass. Reports change integrity, not a proof of security. Builds or refreshes the code map itself when it is missing or stale (`--no-auto-build` opts out) |
+| `vg review` | **Vibgrate Review** — architecture + security-control review of the current change, locally (`--in-place`, `--local`, `--loop`). Deterministic blast-radius findings from the code graph via `vg review findings-from-diff`; `vg review propose <id>` attaches a PatchIR dry-run. One decision (`pass` / `needs_review` / `fail` / `undetermined`) in a signed receipt (Ed25519 over the receipt digest; `vg review verify <receipt.json>` checks it offline); protected findings cannot be blessed into a pass. Reports change integrity, not a proof of security. Builds or refreshes the code map itself when it is missing or stale (`--no-auto-build` opts out) |
 | `vg sbom export` / `delta` / `vex` | Export CycloneDX/SPDX SBOM, diff two artifacts, or emit an OpenVEX document |
 | `vg scan [path]` | Scan for upgrade drift |
 | `vg scan --full` | Comprehensive scan: drift + vulnerabilities + a banned-dependency report |

action.yml

@@ -46,7 +46,7 @@ inputs:
   image-tag:
     description: 'Scanner image tag to run (defaults to a pinned, tested release).'
     required: false
-    default: '2026.916.3' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
+    default: '2026.917.1' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
   verify:
     description: 'Verify the image cosign signature + provenance before running (requires cosign on the runner).'
     required: false

charts/vibgrate/Chart.yaml

@@ -7,7 +7,7 @@ type: application
 # stamped to the released @vibgrate/cli calendar version by
 # scripts/stamp-release-pins.mjs (via the marker on the appVersion line below).
 version: 0.1.2
-appVersion: "2026.916.3" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
+appVersion: "2026.917.1" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
 home: https://vibgrate.com
 icon: https://vibgrate.com/web-app-manifest-512x512.png
 sources:

docs/show-arch.md

@@ -32,6 +32,15 @@ Architecture off is the raw graph’s kinds in the same columns. Architecture on
 
 A rose mark is a finding with `line > 0`. A yellow mark is a missing step. They are not the same thing.
 
+**Overlays** sit on the same Overview and Architecture canvas (the Health tab opens that chrome — it is not a blank page). Vulns, drift, ownership, and churn are toggles. The engine joins existing scan / CODEOWNERS / git data onto cards; missing source is omitted, never painted as a healthy zero. This is not an Architecture Health Score and not the Cloud ≈100−drift KPI.
+
+- **Vulns** — reachable findings from a connected `vg scan` (DSN online). No reachability → honest empty.
+- **Drift** — dependency drift already on the scan artifact, joined by path (and import when the graph has it). `current` / `unknown` do not paint.
+- **Ownership** — CODEOWNERS teams only. A team is not an architecture layer.
+- **Churn** — relative git heat in a bounded commit window. No git → overlay disabled.
+
+The VS Code architecture board hosts the same page and payload as `vg show arch`.
+
 `/api/overview` is the workspace map. `/api/slice?package=` is the column view. `/api/graph` is deprecated (it returns the overview). `/api/node/:id` is `vg show --json` plus a `view` block of the English labels. `/api/path` uses the same shortest-path engine as `vg path`. `/api/reach/:id` walks callers (`dir=up`) or callees (`dir=down`).
 
 Deep links use `#zoom=workspace` or `#zoom=slice&package=<id>&n=<symbol>`. `vg show arch --focus scanDir` opens the owning package’s slice with that symbol selected.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "2026.916.3",
+  "version": "2026.917.1",
   "description": "vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)",
   "//mcpName": "Official MCP registry ownership proof: the registry fetches the published npm package and requires this field to match the com.vibgrate/ai-context server entry (see docs/marketing/mcp-registry/README.md). Must ship in the published @vibgrate/cli package.json.",
   "mcpName": "com.vibgrate/ai-context",
@@ -98,7 +98,7 @@
     "yaml": "^2.8.3"
   },
   "optionalDependencies": {
-    "@anush008/tokenizers": "^0.6.0",
+    "tokenizers": "^0.23.2",
     "onnxruntime-node": "^1.29.0",
     "tar": "^7.5.21"
   },

packaging/homebrew-tap/Formula/vg.rb

@@ -3,8 +3,8 @@
 class Vg < Formula
   desc "Deterministic, no-API-key code graph for AI assistants (vg)"
   homepage "https://vibgrate.com"
-  url "https://registry.npmjs.org/@vibgrate/cli/-/cli-2026.916.3.tgz"
-  sha256 "d79cb7c6b9c5a3332eb31f5af130260612175d696b10262c6dcbfb01e63ab567"
+  url "https://registry.npmjs.org/@vibgrate/cli/-/cli-2026.914.1.tgz"
+  sha256 "21c164080d1ba33dc53d604a8754ffa0079daa9c8b771a9053c224a2c43877bf"
   license "Apache-2.0"
   depends_on "node"
 

packaging/scoop-bucket/vg.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.916.3",
+  "version": "2026.914.1",
   "description": "Deterministic, no-API-key code graph for AI assistants (vg)",
   "homepage": "https://vibgrate.com",
   "license": "Apache-2.0",