# Sigil

> Every AI agent capability, proven. The open proving ground for agent skills, rules, hooks,
> subagents and MCP servers: A/B runs on hidden tests, a canary sandbox, a sealed payload digest,
> and one install for every coding agent.

Every number is computed from recorded runs. Untested means nobody has measured it yet.

## Data

- [Registry (JSON)](https://sigil-lab.vercel.app/registry.json): manifests, digests, files and evidence
- [Method](https://sigil-lab.vercel.app/method): how uplift, intervals, canaries and seals work
- [Source](https://github.com/dgesteves/sigil)

## Capabilities

- [AI SDK 7 Tools and Structured Output](https://sigil-lab.vercel.app/c/ai-sdk/tools-and-structured-output.md): Correct Vercel AI SDK 7 tool calling, multi-step loops, agents and structured output, with the v4-v6 habits that silently break and mock-model tests. (submitted, uplift untested)
- [Angular 22 Signals, Zoneless and Resources](https://sigil-lab.vercel.app/c/angular/angular-22.md): Angular 21-22 as it runs now - zoneless and OnPush by default, signal component APIs, resource/httpResource, control flow and Vitest tests. (submitted, uplift untested)
- [ASP.NET Core Minimal APIs on .NET 10](https://sigil-lab.vercel.app/c/aspnet-core/minimal-apis.md): Validation, problem details, deny-by-default auth and cookie 401s for ASP.NET Core minimal APIs on .NET 10, measured on 10.0.14. (submitted, uplift untested)
- [axum 0.8 Services](https://sigil-lab.vercel.app/c/axum/axum-0-8.md): Rust HTTP services on axum 0.8 that keep body limits, JSON errors, cancellation and shutdown right, plus the 0.7 to 0.8 upgrade. (submitted, uplift untested)
- [Express 5](https://sigil-lab.vercel.app/c/express/express-5.md): Write, upgrade and harden Express 5.x APIs, including the route syntax and the silent 4-to-5 changes that still return 200. (submitted, uplift untested)
- [GitHub Actions Workflow Hardening](https://sigil-lab.vercel.app/c/github-actions/workflow-hardening.md): Secure GitHub Actions workflows as they work in late 2026, from script injection and pwn requests to SHA pins and tokenless npm publishing. (submitted, uplift untested)
- [Kubernetes Workload Hardening](https://sigil-lab.vercel.app/c/kubernetes/workload-hardening.md): Production Kubernetes 1.34-1.37 workloads that pass Pod Security restricted, really start, shut down cleanly and survive drains. (submitted, uplift untested)
- [MCP Servers in TypeScript (SDK v2)](https://sigil-lab.vercel.app/c/mcp/typescript-server.md): Build, test and port MCP servers on the v2 TypeScript SDK and the 2026-07-28 protocol, without the v1-era mistakes agents usually make. (submitted, uplift untested)
- [Next.js 16 App Router](https://sigil-lab.vercel.app/c/nextjs/next-16.md): Next.js 16 as it behaves today - Cache Components, the right invalidation call, proxy.ts, safe server actions and 15 to 16 upgrades. (submitted, uplift untested)
- [OAuth and OpenID Connect Clients and APIs in Node.js](https://sigil-lab.vercel.app/c/oauth/oidc-client.md): Secure OIDC sign-in, JWT access token validation and rotating refresh tokens in Node.js with openid-client 6, jose 6 and oauth4webapi 3. (submitted, uplift untested)
- [Zero-Downtime Postgres Migrations](https://sigil-lab.vercel.app/c/postgres/zero-downtime-migrations.md): Schema changes on large, busy PostgreSQL tables without blocking reads or writes, for PostgreSQL 18 with notes for 12-17. (submitted, uplift untested)
- [Accessible React Widgets](https://sigil-lab.vercel.app/c/react/accessible-widgets.md): WAI-ARIA APG keyboard, focus and ARIA contracts for React dialogs, menu buttons, comboboxes and tabs, plus how to test them in jsdom. (submitted, uplift untested)
- [Sigil Launch Set](https://sigil-lab.vercel.app/c/sigil/launch-set.md): The first seven Sigil skills, each with its own proof suite, for the APIs and safety rules coding agents most often get wrong in late 2026. (submitted, uplift untested)
- [Spring Boot 4 Web Services](https://sigil-lab.vercel.app/c/spring-boot/spring-boot-4.md): Spring Boot 4.1 REST services done right, and Boot 3.5 upgrades that keep the JSON contract, checked against Boot 4.1.2. (submitted, uplift untested)
- [Svelte 5 Runes and Migration](https://sigil-lab.vercel.app/c/svelte/svelte-5-runes.md): Correct Svelte 5 runes components, shared state modules and mount() code, and Svelte 4 ports that keep bindings, events and timing intact. (submitted, uplift untested)
- [Vue 3.5 Composition and Reactivity](https://sigil-lab.vercel.app/c/vue/vue-3-5.md): Current Vue 3.5 composition API, reactivity and component contracts, and the Vue 2 and early Vue 3 habits that silently break them. (submitted, uplift untested)
- [Zod 4 Validation and Migration](https://sigil-lab.vercel.app/c/zod/zod-4.md): Correct Zod 4 schemas at trust boundaries, and Zod 3 upgrades that keep messages, defaults and rules intact. (submitted, uplift untested)