Your first vouch

By the end of this page you will have reviewed one unit and seen the coverage number move.

Numbers will not match. Every count here depends on how many files your repo has, and it changes as you edit, including when you edit documentation. Read 5356 as “some number”, and not a value to compare against.

Where you’re starting

vidi status is read-only. It scans the repo, splits every file into units, and reports how many carry a current review.

$ vidi status
NEUTRAL: 0/5356 reviewed · stale 0 · orphans 0 · requirement failures 0 · default shortfalls 0

Nothing is reviewed yet, so 0/5356.

NEUTRAL is one of three verdicts, and it means no policy file and nothing structurally broken:

Verdict	When
`FAILURE`	anything stale, orphaned, or failing a requirement — checked first, whether or not a policy exists
`PASS`	a policy is present and every requirement is met
`NEUTRAL`	no `.vidi/policy.toml`, and nothing broken. Counts as passing for branch protection

Staleness is not a policy rule, it is an integrity property. A review claiming to cover bytes that no longer exist is broken regardless of what your policy says, so it fails even in a repo with no policy at all. See Turn on the gate.

Set the repo up

vidi init is the visible opt-in. Until you run it, every command that would write to .vidi/ refuses.

$ vidi init
initialized: this repo can now track reviews in .vidi/
  created  .vidi/: commit these files so reviews travel with the repo
  updated  .gitattributes + .gitignore: combine review records across branches; keep the scan cache out of git
  stage    git add .vidi/ .gitattributes .gitignore

next: run vidi scan to address the repo, then vidi status to see current review coverage.
when ready: add .vidi/policy.toml to turn review coverage into a CI gate.

Three empty ledger files appear, and one line is added to .gitattributes:

$ ls .vidi/
authorship.jsonl  reviews.jsonl  revocations.jsonl

$ git diff .gitattributes
+.vidi/*.jsonl merge=union

That merge=union line is what stops review records from ever causing a merge conflict, git keeps every line from both sides. See Why review files never conflict.

Commit these. Review history is meant to travel with the code.

Log in

Writes have to be attributed to somebody, so they require a login. The offline form needs no account and no network:

$ vidi login --local
Logged in locally as [email protected] (self-asserted, offline)
  Writes (vouch / review / revoke) are now authorized on this machine.

The identity defaults to your git config user.email. Check that it is the address you want. It is written into every record you create, and the ledger is append-only. To choose explicitly:

$ vidi login --local [email protected]

Confirm at any time:

$ vidi whoami
[email protected] (local, self-asserted)

Find something to review

vidi queue ranks every unreviewed unit by significance and shows the top 20. Pass --top N to widen the cut, or --all for the full list.

$ vidi queue --top 8
re-review queue: top 8 of 5356 below the bar · gating first, then significance × severity
   1. advisory · sig 100 · unreviewed       crates/vidi-core/src/crypto/assurance.rs::enum:AssuranceScalar
   2. advisory · sig 100 · unreviewed       crates/vidi-core/src/crypto/entrypoint.rs::enum:SignRefusal
   3. advisory · sig 100 · unreviewed       crates/vidi-core/src/crypto/error.rs::enum:VerifyError
   4. advisory · sig 100 · unreviewed       crates/vidi-core/src/crypto/keyid.rs::struct:KeyId
   5. advisory · sig 100 · unreviewed       crates/vidi-core/src/digest.rs::struct:Blake3Digest
   6. advisory · sig 100 · unreviewed       crates/vidi-core/src/error.rs::enum:DecodeError
   7. advisory · sig 100 · unreviewed       crates/vidi-core/src/ledger/codec.rs::fn:check_no_dup_keys::struct:NoDupKeys
   8. advisory · sig 100 · unreviewed       crates/vidi-core/src/policy/diagnostics.rs::enum:PolicyError

Each line is a unit address, the file, then ::, then what’s inside it:

crates/vidi-core/src/digest.rs::struct:Blake3Digest
└─────────── file ───────────┘  └── what's inside ──┘

Read it

Open the file and find the declaration named in the address. There is currently no vidi command that prints a unit’s source, so use your editor.

The machine report knows the exact lines:

$ vidi json | python -c "import sys,json; [print(u['file'], u['lineStart'], u['lineEnd']) for u in json.load(sys.stdin)['units'] if u['address'].endswith('struct:Blake3Digest')]"
crates/vidi-core/src/digest.rs 55 55

vidi show does not do this. It accepts either a content_id (32 hex characters) or a unit address, but what it prints is a ledger record. A review someone already made, not source code.

Vouch for it

$ vidi vouch "crates/vidi-core/src/digest.rs::struct:Blake3Digest"
vouched crates/vidi-core/src/digest.rs::struct:Blake3Digest as [email protected]
  content_id 28d7043ed80ea10df8a78cd4b6f32f3f · appended to .vidi/ (bare line, diff-visible)
  note: this repo has no .vidi/policy.toml: this vouch is recorded without a standing and will never satisfy a rank requirement. To count toward one: add a policy with a [reviewers] entry, then vouch again.

The content_id is the record’s own identity. That is the value vidi show and vidi revoke accept.

The note means that without a policy file the vouch is recorded but cannot satisfy any requirement, because none exist yet. Expected at this stage.

The number moved

$ vidi status
NEUTRAL: 1/5356 reviewed · stale 0 · orphans 0 · requirement failures 0 · default shortfalls 0

0/5356 → 1/5356. One unit now carries a current review.

What actually got written

One line in .vidi/reviews.jsonl, an in-toto Statement:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [{
    "name": "crates/vidi-core/src/digest.rs::struct:Blake3Digest",
    "digest": { "blake3": "76b53b0c9cfd57d07d2a4802263e6856" },
    "repo": { "host": "github.com", "owner": "graze-ai", "name": "vidi" }
  }],
  "predicateType": "https://vidivouch.com/vidi/human-review/v1",
  "predicate": {
    "criteria": ["equivalent"],
    "rigor": "read-fully",
    "attesterIdentity": { "kind": "person", "id": "[email protected]" },
    "verdict": "approved",
    "claimTimestamp": "2026-07-30T20:52:58Z",
    "profileVersion": "rust-1",
    "scopeModelVersion": "vidi-scope-4"
  }
}

The blake3 value is the fingerprint of the unit as it was when you read it. That one field is what makes the next page work.

Watch a review go stale

Keyboard shortcuts

vidi