NoWreck Deterministic AI Verifier — v0.13.0

NoWreck v0.13.0 — CI/CD Integration

Deterministic AI Verifier — v0.13.0

NoWreck is a deterministic structural verifier for AI-generated code-change claims. When an AI describes a code change, NoWreck compares the claims against structural evidence derived by its own scanners — the verifier never asks another AI for an opinion. Where the evidence comes from depends on the mode: in Pre/Post and Claims modes, from actual before/after repository snapshots; in Prompt Mode, from the model's own proposed diff.

$ nowreck fix "Add email validation to auth.py"

  Summary
  ────────────────────
  ● 3 claims total
  ● 2 confirmed
  ● 1 contradicted

  CONFIRMED
  ─────────
  ✓ ADD_FUNCTION validate_email → auth.py  (conf: 100%)
    Evidence: Function 'validate_email' was added in auth.py

  CONTRADICTED
  ────────────
  ✗ CALLS_FUNCTION validate_email → auth.py  (conf: 100%)
    Evidence: Function 'validate_email' was added in auth.py

Release date: August 2026

Previous release: v0.12.0 (Provider Consolidation + Scan Caching)

Focus: CI/CD integration with machine-readable output formats (SARIF, JUnit)

and automated git comparison for pull request verification.

SARIF output ✅

SARIF v2.1.0 output for GitHub Code Scanning, SonarQube, and CodeQL.

nowreck fix --compare HEAD~1 --format sarif > nowreck.sarif

15 rules defined:

NW001-NW013: One per CONTRADICTED claim type (error level)
NW014: UNVERIFIABLE claims (warning level)
NW015: UNEXPLAINED changes (note level)

Design decisions:

CONFIRMED results excluded by default (SARIF is for problems)
Uses ruleId (string) for GitHub UI readability
Each claim type gets its own rule for granular filtering

JUnit XML output ✅

Standard JUnit XML format for Jenkins, GitLab CI, and Azure Pipelines.

nowreck fix --compare HEAD~1 --format junit > nowreck-junit.xml

Verdict mapping:

CONFIRMED → pass (no element)
CONTRADICTED → <failure>
UNVERIFIABLE → <failure type="UNVERIFIABLE">
UNEXPLAINED → excluded (not a claim)

--format flag ✅

New --format flag for output format selection:

nowreck fix --compare HEAD~1 --format json # JSON

nowreck fix --compare HEAD~1 --format sarif # SARIF

nowreck fix --compare HEAD~1 --format junit # JUnit

Backward compatibility: --json deprecated with warning, still works.

--output flag ✅

Write output to file instead of stdout:

nowreck fix --compare HEAD~1 --format sarif --output nowreck.sarif

--compare flag ✅

Automated git comparison:

nowreck fix --compare HEAD~1 # Compare against previous commit

nowreck fix --compare main # Compare against main branch

nowreck fix --compare abc1234 # Compare against specific commit

Supported ref types: commit hash, branch name, tag, HEAD~N syntax.

Implementation: Uses git archive for clean extraction to temp directories.

Automatic cleanup via tempfile.TemporaryDirectory.