rigor-suite

Website: scottconverse.github.io/rigor-suite

One-command install for a three-layer toolset that keeps AI-agent coding work honest. The three tools install together but are never mixed — each is an independent project, independently useful, pinned to a known-good version:

Layer	Tool	What it covers	Lives at
1 — Discipline	dev-rigor-stack-lite	How the agent works: lanes, evidence, gates, receipts. Prompt-level, hook-free, portable.	~/.claude/skills/ (+ anchor block)
2 — Tamper alarm	tampercheck	The cheat instructions can't self-report: did this diff weaken the tests/checks themselves? Deterministic, offline, provider-agnostic.	PyPI (uv tool / pip)
3 — Enforcement	deterministic-detector	Puts the deterministic checks where the agent can't touch them: CI jobs, hooks, per-repo wiring via /install-detector.	~/.claude/skills/deterministic-detector

Each layer covers the failure mode the layer above can't: instructions can be rationalized past (layer 1), so a deterministic diff check catches tampering (layer 2), and CI on a machine no agent controls makes the check unskippable (layer 3).

Install

Windows (PowerShell):

git clone https://github.com/scottconverse/rigor-suite
.\rigor-suite\install.ps1

macOS / Linux:

git clone https://github.com/scottconverse/rigor-suite
./rigor-suite/install.sh

Add -Force / --force to replace already-installed skills. The installer reports each layer separately (PASS / SKIPPED / FAIL with the real reason) and never fakes green: a layer that could not install is reported, not implied.

What the installer does — and deliberately does not do

• Clones each repo at the pinned commit/version listed at the top of the install scripts (single source of truth; both scripts must agree — CI enforces that).
• Runs dev-rigor-stack-lite's own installer against ~/.claude/skills. All of that project's trust boundaries (owner-only opt-outs, collision preflight) remain its own — this wrapper adds nothing on top.
• Installs tampercheck from PyPI, pinned — never from a working tree — so what your CI later enforces cannot be swapped by editing a local clone.
• Does not wire any repository's CI or touch branch protection. Per-repo wiring stays where it belongs: run /install-detector inside a target repo; flipping a check to required is an owner-only manual action.
• Does not register the Codex marketplace entry for deterministic-detector (that flow is interactive by design): see that repo's README.

After install

1. Start a new agent session (skills load at session start).
2. In each target repo, run /install-detector to wire the CI lanes (randomized-suite, mutation-report, tampercheck).
3. Verification reports and merge gates will now cite tampercheck receipts automatically when the tool is on PATH.

Versions pinned by this release

• dev-rigor-stack-lite: v0.7.0 (release tag — includes the tampercheck receipt integration)
• deterministic-detector: 0fb0c4b (0.4.0 + tampercheck lane pinned to 0.1.1)
• tampercheck: 0.1.1 (PyPI)

License

Apache-2.0 — Scott Converse.