Grader

Grader 0.5.1 is a local submission-quality tool for C, Python, web, and container projects. It runs policy-defined checks from VS Code and keeps the result tied to machine evidence produced by the grading kernel.

Grader has five primary workflows:

• Quick Check verifies that the selected policy, signed packs, runtime, and required tools are ready. It returns diagnostics, not a Full Grade result.
• Full Grade runs the selected tier and returns one terminal outcome for the submission.
• Import Signed Pack validates and stores a local policy or capability pack.
• Select Policy chooses a validated policy by its canonical ID.
• Doctor inspects the current host and reports actionable setup problems.

Full Grade tiers

The tiers are cumulative. A higher tier includes the checks selected by each earlier tier.

• Baseline checks the required build, static, resource-safety, and basic behavior rules declared by the policy.
• Reviewer adds detailed boundary, error-handling, interface, and maintainability checks.
• Adversarial adds strict counterexamples, hostile inputs, and system-limit cases.

Bonus checks are separate and run only when explicitly enabled. The selected signed policy determines which criteria belong to each tier.

Result contract

A Full Grade run ends with one of these outcomes:

• PASS: every selected criterion completed successfully.
• FAIL: at least one selected criterion produced reproducible failing evidence.
• NO-GRADE: setup, integrity, cancellation, or execution reliability prevented a trustworthy result.

NO-GRADE is never converted into a submission failure. Quick Check does not issue any of these Full Grade outcomes.

The extension displays kernel results without inventing totals or filling gaps. Policy and capability packs are inputs to the process; their signatures, schemas, digests, and provenance are checked before use.

Get started

1. Open the submission in a trusted VS Code workspace.
2. Run Grader: Doctor.
3. If needed, run Grader: Import Signed Pack... and choose a pack from a source you trust.
4. Run Grader: Select Policy... and choose a validated policy.
5. Run Grader: Quick Check to inspect readiness.
6. Run Grader: Full Grade, choose Baseline, Reviewer, or Adversarial, and decide whether to include Bonus checks.

The Quick Settings view exposes the same tier and Bonus controls. Primary actions are also reachable from the Command Palette.

Signed local packs

Pack import is an explicit local action. The engine validates the signature, schema, content digest, and referenced identities before a pack can be selected. Imported content is stored by digest so changing a file does not silently change an earlier identity.

When no trust root exists yet, the first import performs validation without writing files and displays the signing fingerprint. Grader installs the pack only after you confirm that exact fingerprint in a modal prompt; the engine then reads and validates the source again.

The policy setting stores only a canonical policy ID. It does not accept a command, image override, executable path, or unsigned rule body.

Local execution and Workspace Trust

Grading runs on the local machine. The extension does not send submission contents to a remote grading service. A selected pack may require system tools already present on the host; Doctor reports missing requirements before a Full Grade run.

Workspace Trust is required before Grader reads submission files or starts grading work. In an untrusted workspace, the extension keeps execution and pack import disabled.

C compilation, style, and memory checks run through OS-specific local process isolation and do not require Docker. Policies for container projects may still require container tooling for their own runtime checks. Grader does not expose raw runner arguments as a user setting.

Reports and replay

Reports are read-only views of kernel data. Grader shows evidence or a replay action only when the kernel returned the corresponding data. It does not reconstruct missing evidence from console text.

Reports can be opened explicitly with Grader: Open Last Report. Automatic opening is controlled by a setting so a completed run does not have to move focus away from the current editor.

Commands

• Grader: Quick Check
• Grader: Full Grade
• Grader: Import Signed Pack...
• Grader: Select Policy...
• Grader: Select Tier...
• Grader: Toggle Bonus Checks
• Grader: Doctor
• Grader: Open Last Report
• Grader: Show Output

Settings

• Policy: canonical ID of the selected validated policy.
• Tier: Baseline, Reviewer, or Adversarial.
• Include Bonus: enables the policy's Bonus criteria for Full Grade.
• Auto-open report: opens the read-only report after a completed run. Settings cannot replace signed execution data.

Project types

Policies may define checks for C, Python, web, and container submissions. A policy describes its own required files, toolchains, runtime constraints, and criteria. Doctor and Quick Check are the source of truth for whether the selected policy can run on the current host.

Security and support

Read SECURITY.md before grading code from an unknown source. For a useful issue report, follow SUPPORT.md.