Verglos 2.0 alpha: scanner today, evidence direction next

Verglos is a local scanner for AI-assisted JavaScript and TypeScript projects. The public 2.0.0-alpha.1 release keeps that working surface and introduces the shape of a broader evidence workflow without pretending the workflow is complete.

What works now

The scanner analyzes a local project and produces findings and local report artifacts. Source analysis happens on the user's machine. The repository and npm package document the current command behavior and are the canonical references for installation and use.

npx verglos scan

Because this is an alpha, users should pin versions in repeatable workflows and inspect release notes before adopting it as a build gate.

What is scaffolded

verglos hunt names a proposed local verification workflow. verglos attest names a proposed signed evidence workflow. In 2.0.0-alpha.1, both commands are shells that exit as unavailable. They do not run sandbox proofs, sign artifacts, or publish verification URLs.

That scaffold is useful for discussing command boundaries, but it is not evidence of a delivered feature.

Why keep the names visible

The product direction is to move from detection toward reviewable evidence while retaining a local-first trust model. Naming the future surfaces helps test the information architecture: scan produces observations, hunt would attempt bounded verification, and attest would package a minimal integrity-protected summary.

Each step has unresolved work. Verification needs isolation and a strict authorization model. Attestation needs key management, schemas, privacy controls, and precise claims. Commercial tiers have not launched.

How to evaluate this release

Evaluate the alpha on the scanner it contains: installability, supported project shapes, finding quality, report usefulness, deterministic behavior, and documented limits. Treat hunt, attest, hosted verification, and paid-plan language as design intent until the public code and package demonstrate otherwise.

That boundary is less dramatic than calling the release an evidence agent. It is also the only boundary users can verify today.