studio2201 / product 01 v0.2.0 Apache-2.0

Vigil

Supply-chain dormancy scanner. Reads your project manifest, scores each dependency by how long it has been since the upstream moved, and emits SUPPLY-CHAIN.md and a badge.

View on GitHub → Framework Doctrine →

What it does

Auto-detect Manifests

Parses package.json, Cargo.lock, pyproject.toml, go.mod, pom.xml, composer.json, pubspec.yaml, and Package.swift.

Upstream Activity Heuristic

Cross-references dependencies against upstream commit velocity, release cadence, maintainer activity, and dormancy thresholds.

SUPPLY-CHAIN.md

Emits an actionable audit ranking packages from dormant risk to actively maintained, with remediation budgets in repo-weeks.

README Badge

Generates an SVG badge for your repository to display supply-chain health and attestation state in real-time.

Installation

# Install Vigil via the studio2201 installer:
curl -fsSL https://studio2201.com/install.sh | sh -s vigil

Terminal usage

# Scan current working directory manifest
vigil scan

# Emit structured JSON for CI ingestion
vigil scan --format json --output supply-chain.json

# Check policy against dormancy thresholds
vigil policy check --max-dormancy 180d

Architecture & Doctrine

Engineered under the studio2201 Framework v2 standards (§15–§18):

§15 Threat Model

Hardened against dormant package maintainer account takeovers, silent repo abandonment, and unannounced dependency transfer.

§16 Reproducible Builds

Host and rustc-keyed baseline reproduction. Zero pinned toolchains required.

§12 Zero Third-Party Crates

Built strictly with Rust standard library primitives (std-only). Zero external supply-chain attack surface.

§17 Security Disclosure

GHSA-tracked coordinated disclosure with a 14-day SLA on critical vulnerabilities.