01 · Workflow
Pin, change, compare
enola baseline pin
# make the change
enola checkbaseline pin creates the “before” snapshot. check builds the current snapshot, verifies that the two snapshots are comparable, and reports findings introduced by the change.
Snapshots are not comparable when the Enola version, repository, or ignore configuration differs.
If only the producer set differs, Enola grades facts from extractors and providers present in both snapshots. The result is marked PASS (partial verdict) or FAIL (partial verdict) and names every excluded producer and ungraded fact.
02 · Policy
Exit codes
| Code | Meaning | Action |
|---|---|---|
| 0 | No configured regression was introduced. | Continue. |
| 1 | The change introduced a finding covered by --fail-on. | Block the commit or job. |
| 2 | The check could not run, for example because no baseline exists or a --fail-on name was not recognised. | Fix the invocation or repository state. |
| 3 | The snapshots are not comparable: for example, the Enola version, repository identity, or ignore configuration differs. | Review the receipts, then re-pin with the intended configuration. |
enola check --fail-on=layers enola check --fail-on=layers,cycles,intent enola check --fail-on=god-class --min-confidence=0.8 enola check --fail-on=layers --warn-only enola check --json enola check --detail enola check --focus=internal/auth enola check --target=internal/auth --max-spillover=0
--fail-on accepts a comma-separated list of exact category names, including layers, cycles, intent, god-class, and hotspots. An unknown name returns exit code 2. Use enola check --json to inspect the applied policy.
Pattern matches and cluster-config overrides appear under Descriptive (never graded). They cannot fail a check.
--min-confidence sets the confidence floor before policy is evaluated. The default is 1.0; lower it to include inferred findings.
--warn-only prevents findings and spillover breaches from returning exit code 1. Invocation errors and incomparable snapshots still return codes 2 and 3.
--focus narrows the reported delta. --target defines the intended change area and reports touched packages outside its predicted dependency radius as spillover. Spillover fails only when it exceeds --max-spillover; set the limit to 0 to reject any spillover.
03 · Automation
Automate the loop
Run enola baseline pin and enola check from local scripts, hooks, or CI.
CI
Use CI setup for the maintained GitHub Actions workflow, merge queue trigger, confidence input, provider-native annotations, and SARIF output. Other CI systems can run enola check --fail-on=… directly and use its exit code.
04 · Findings
Deterministic and heuristic checks
Cycle detection uses Tarjan’s strongly connected components algorithm. Findings such as god classes, hotspots, dependency depth, and complexity outliers use documented thresholds.
The result is bounded by extractor coverage. Dynamic imports, generated code, runtime registration, and unsupported framework behavior can leave edges unresolved. Treat the receipt and coverage report as part of the result.