feat(catalog): Next.js 16, Svelte 5, Vue 3.5 and Angular 22 by dgesteves · Pull Request #19 · dgesteves/sigil

dgesteves · 2026-11-02T09:08:00Z

Four frontend skills about how each framework behaves now, where model knowledge is most likely stale:

Capability	What it covers	Suite (3 tasks each)
`nextjs/next-16`	Cache Components, the right invalidation call, `proxy.ts`, safe server actions, 15 to 16 upgrades	`product-page-caching`, `project-settings-actions`, `upgrade-from-15`
`svelte/svelte-5-runes`	Runes components, shared state modules, `mount()`, Svelte 4 ports that keep bindings, events and timing	`cart-state-module`, `embed-widget-mount`, `tag-input-runes`
`vue/vue-3-5`	Composition API, reactivity and component contracts, and the Vue 2 and early Vue 3 habits that break them	`form-field-ids`, `stock-level-polling`, `tag-input-v-model`
`angular/angular-22`	Angular 21-22 defaults: zoneless, OnPush, signal component APIs, `resource`/`httpResource`, control flow, Vitest	`dispatch-board-zoneless`, `product-search-resource`, `ticket-list-signals`

All suites run on node:24-bookworm. With sigil mcp (#15), a Next.js project now gets nextjs/next-16 from recommend.

Each suite passed node tasks/_tools/check-task.mjs tasks/<suite> --runs 3 in Docker today: the hidden verifier fails on the untouched repo and passes on repo + reference solution three times in a row, with the verifier run under --network none. sigil validate catalog and sigil scan catalog --fail-on high pass on the branch (no new findings).

Not done yet, on purpose: the calibration probe (a short baseline run in the lab) that checks whether today's models already pass these tasks without the skill. The first lab runs hit ceiling effects on zod-4 and express-5, so every suite gets probed before its first published proof. Until then these capabilities show as submitted and untested, which is what they are.

vercel · 2026-11-02T09:08:06Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sigil-lab	Ignored	Preview	Nov 2, 2026 9:50am UTC

+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+export function byTestId(html: string, id: string): string[] {
+  const re = new RegExp(`<([a-z0-9]+)\\b[^>]*\\bdata-testid="${id}"[^>]*>([\\s\\S]*?)</\\1>`, 'g')
+  return [...html.matchAll(re)].map((m) =>
+    decode(m[2]!.replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '')).trim(),


+  const catalog = await load()
+  const product = catalog[id]
+  if (!product) throw new Error(`Unknown product ${id}`)
+  product.priceCents = priceCents


+export async function updateProjectName(id: string, name: string): Promise<void> {
+  const projects = await read<Record<string, Project>>(file.projects)
+  if (!projects[id]) throw new Error(`Unknown project ${id}`)
+  projects[id].name = name


…e it stands (#22) The README was a 12-line "under construction" stub. This replaces it with the front door: the problem, what Sigil does, a quick start, how a proof works, trust levels, an honest status and the repo layout. How it was written: - **Every number checked against its source today.** SkillsBench's abstract has been revised since we first read it: +16.6 points on average (33.9% to 50.5%), ranging from +4.1 to +25.7 across 18 model-harness setups. SWE-Skills-Bench: 92 of 98 skills had no statistically significant effect (76.6% to 76.9%). Scan numbers come from `packages/sigil/src/scan/BENCHMARK.md` (47 benign skills with zero high or critical findings, all 14 malicious samples flagged). Agent counts come from `core/ids.ts` (22 agents plus `generic`). - **Only commands that exist,** with their real flags. Sigil isn't on npm yet, so the quick start runs from a clone and says so. - **Honest status:** all capabilities are `submitted` and `untested`, the first local lab runs hit ceiling effects, and no number is published until a run produced it. The header image is the site's OG image, rendered from the live registry, so it can't drift. - **No named-competitor comparison table.** The claims about other tools can't be re-verified today, so they stay out. Also corrects `spec/METHODOLOGY.md`, which said evidence "are published with GitHub artifact attestations" in the present tense. The CI proving workflow isn't live yet, so it now says CI-produced evidence is attested and local runs are labelled local until then. The catalog line lists what is on main at this commit. When #17 and #19 land, it gains Next.js, Svelte, Vue, Angular and OAuth.

…es (#21) CodeQL default setup cannot ignore paths. Every proof suite adds deliberately imperfect starting repos, test harnesses and reference solutions that only ever run inside the lab sandbox, and CodeQL flags them. #17 (OAuth) and #19 (web) brought 25 such alerts, all under `tasks/`: HTML-stripping helpers in Next.js test harnesses, prototype-pollution warnings on the toy database of a starting repo, and rate-limit and CSRF heuristics on a demo OIDC login app. This moves CodeQL to an advanced workflow with the same default query suite and the same languages (`actions`, `javascript-typescript`). It runs on PRs, on main and weekly, is SHA-pinned like the rest of CI, and has least-privilege permissions. `.github/codeql/codeql-config.yml` ignores `tasks/`, `site/fixtures/` and `packages/sigil/test/fixtures/`. Capability content keeps its own scanner job ("Scan the catalog"). **Before merging:** default setup has to be switched off, or GitHub rejects the advanced upload. Settings → Code security → CodeQL analysis → Switch to advanced, or: ```sh gh api -X PATCH repos/dgesteves/sigil/code-scanning/default-setup -f state=not-configured ``` Then re-run this PR's checks, merge it, and re-run CodeQL on #17 and #19.

Updates the Status line after #17 and #19: adds Next.js 16, Vue 3.5, Svelte 5, Angular 22 and OAuth/OIDC. Counts come from `catalog/skills/**/sigil.yaml` (16) and `tasks/*/*/task.yaml` (48) on main.

dgesteves added 6 commits November 1, 2026 15:32

feat(catalog): add nextjs/next-16 with its proof suite

93cab87

feat(catalog): add svelte/svelte-5-runes with its proof suite

8de4be0

feat(catalog): add vue/vue-3-5 with its proof suite

8d242c0

feat(catalog): add angular/angular-22 with its proof suite

7b95356

Merge remote-tracking branch 'origin/main' into feat/catalog-web

1581787

Merge remote-tracking branch 'origin/main' into feat/catalog-web

6f49a8b

github-advanced-security Bot found potential problems Nov 2, 2026

View reviewed changes

This was referenced Nov 2, 2026

ci(codeql): advanced setup that skips proving-ground tasks and fixtures #21

Merged

docs: a README that says what Sigil does, how a proof works, and where it stands #22

Merged

Merge origin/main into feat/catalog-web

8c7caa4

dgesteves merged commit 5cb851d into main Nov 2, 2026
8 checks passed

dgesteves deleted the feat/catalog-web branch November 2, 2026 09:56

dgesteves mentioned this pull request Nov 2, 2026

docs(readme): the catalog now has 16 skills and 48 tasks #25

Merged

Navigation Menu

Repository navigation

feat(catalog): Next.js 16, Svelte 5, Vue 3.5 and Angular 22 - #19

feat(catalog): Next.js 16, Svelte 5, Vue 3.5 and Angular 22#19
dgesteves merged 7 commits into
mainfrom
feat/catalog-web

dgesteves commented Nov 2, 2026

Uh oh!

vercel Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dgesteves commented Nov 2, 2026

Uh oh!

vercel Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Nov 2, 2026 •

edited

Loading