[prathikcannotcode]

Fixes from auditing Vigil as a new user would: fresh clones, the official export schemas, and hostile input to the hooks. The full list is under Unreleased in CHANGELOG.md.

What was wrong

• All 9 sample findings failed NIST's OSCAL 1.1.2 schema, and CI only checked the exit code.
• SARIF results with no file had no location, and rules lacked text GitHub lists as required, which put quick-start step 6 at risk.
• A second audit doubled everything: 18 findings instead of 9, and open criticals went from 1 to 2.
• From a subdirectory the hook crashed with exit 1, which does not block, so the write would go through.
• The agent could rewrite its own guard, because .claude/** was writable.
• The README called hand-written sample files real output.

What changes for users

• Claude can no longer edit .claude/scripts, .claude/schemas or .claude/settings.json. Those are hand-edit only, including for your own Claude sessions on this repo.
• SARIF leaves out findings with no file and closed findings. The exporter names them, and they stay in report.json, OSCAL and OCSF.
• Real company data is gitignored by default. Only the synthetic demo is tracked.
• Finding file paths must be relative. Absolute paths and ../ now fail validation.
• Exporters and kpis --company exit 1 for a company with no report, instead of reporting 0 findings.

Known limits

Both are documented in SECURITY.md, and both block writes rather than let them through.

• A session that moved into the repo from elsewhere and then changed into a subdirectory can't find the guard until it returns to the repo root. The hook command looks under ${CLAUDE_PROJECT_DIR}, then relative to the working directory.
• On Windows without Git Bash, Claude Code runs hooks in PowerShell, which can't parse the command. The write-guard then blocks every write, and post-write validation does not run.

Testing

• 23 of 23 tests pass on clean Linux (Node 22). On Windows (Node 24) 22 pass and the bash hook test is skipped
• npm run validate -- --strict passes
• OSCAL validates against NIST's 1.1.2 schema; SARIF validates against the published 2.1.0 schema
• All 20 skills parse under a strict YAML parser and show as auto-invocable on a Windows default Git clone
• Hooks ran in a live Claude Code desktop session (2.1.309), in a session that had moved into the repo. Blocked live: a path outside the layout, an edit to .claude/settings.json, an append-only log rewrite, an Aadhaar number in a report, and a key-shaped string. Allowed live: edits to README.md, SECURITY.md and CHANGELOG.md. The post-write hook reported a finding with no clause and an absolute path
• Before the fallback, onFailure: block stopped a write live when the guard could not start
• Live SARIF upload to GitHub code scanning
• A real /audit run on examples/acme-demo, scored against examples/acme-demo.expected.json

Not in this PR

• aranya/ stays in layout.json and .gitignore, because the local Aranya checkout sits inside this folder.
• There is no penalty script and no fixed control list for coverage. /penalty now reports totals per finding and per provision.
• Tags, releases and GitHub topics.

🤖 Generated with Claude Code