[NetVar1337]

What changed

Commit 1: rebrand (d38c647): replaces PurpleAILAB/Vigilo with BitterSecurity/Vigilo in 20 files: README badges and links, install docs, issue templates, the repository/bugs/homepage fields in packages/opencode/package.json, packages/bench/package.json and the 7 packages/opencode/packages/*/package.json, plus the Claude plugin plugin.json/marketplace.json. npm package names are not changed (none of them reference the old org).

Commit 2: CI test gate (cdc260b): adds .github/workflows/ci.yml, which runs on pull_request and on push to main with bun pinned to 1.4.2, plus .github/scripts/check-bench-data.ts.

• opencode job: install, typecheck, bun test, build, CLI --version smoke check.
• bench job: bun install --frozen-lockfile, typecheck, offline unit tests, build, data-integrity check, report --all.

Bench in CI is a lightweight offline smoke subset

Full bench scoring needs a live OpenCode server and paid LLM calls (default anthropic/claude-opus-4-5, 3 voting rounds per ground-truth finding). No stored scores are committed, so CI only runs the deterministic parts: typecheck, src/utils.test.ts + src/__tests__/setup.test.ts, build, a data-integrity check (31 dataset entries ↔ 31 baselines, findings have title/severity), and report --all.

src/scorer/baseline-scorer.test.ts is excluded. It calls scoreBaseline() with real findings, which reaches the uninitialized OpenCode client and calls process.exit(1) (src/utils.ts error()), killing the whole test runner. Follow-up: mock the LLM call or make error() throw.

Intentionally left out (pending Markus's decision)

• LICENSE licensor line, "PurpleCHOIms (PurpleAILAB)"
• PurpleCHOIms author fields in packages/claude/.claude-plugin/plugin.json / marketplace.json
• publish.yml repository guard github.repository == 'PurpleAILAB/Vigilo' (lines 64, 176). This currently skips publish-main/publish-bench; changing it turns npm publishing back on.
• License mismatch: packages/opencode/package.json says MIT, while LICENSE and the platform packages say BSL-1.1 and bench says BUSL-1.1
• Model-ID inconsistency: model-requirements.ts uses 4.6, while hardcoded constants and docs still use claude-*-4-5
• Stray root package.json / package-lock.json (depends on vigilo-linux-x64)
• Two contests with empty pinned commits in packages/bench/data/dataset.json (code4rena_initia-move_2025_04, code4rena_starknet-perpetual_2025_06). The data check reports these as warnings only.

Local CI results (box, bun 1.4.2, clean clone at cdc260b)

• JSON parse of all 11 edited manifests: ok
• opencode: typecheck clean; 289 pass / 1 skip / 0 fail (290 tests, 19 files); build ok; CLI --version → 1.0.3
• bench: typecheck clean; 14 pass / 0 fail (2 files); build ok; data check OK (2 warnings above); report --all no-op
• All steps passed (exit 0)