Release CodeTruss CLI v0.2.42 - #31

Blocked: 0.2.42 does not pass pnpm typecheck

6 of 9 legs are red. This is not a sync error and not the lockfile trap — the three Node 20.9 legs pass because ci.yml skips typecheck there (if: matrix.node != '20.9.0'). All six typechecking legs fail identically.

Reproduced locally against this branch, pnpm typecheck exit 1, three errors in two files:

test/sast-coverage-delta.test.ts(49,5):  TS2322  Type COMPLEXITY is not assignable to type 'FindingCategory'
test/suppression.test.ts(112,7):         TS2345  Property 'sastCoverageGap' is missing
test/suppression.test.ts(123,38):        TS2345  Property 'sastCoverageGap' is missing

Both defects arrive with 0.2.42 from the monorepo commit b40fce6, unchanged by the sync:

1. sast-coverage-delta.test.ts is new in 0.2.42 and sets category: 'COMPLEXITY', but FindingCategory has no such member (TECH_DEBT | BUG_RISK | DEAD_CODE | DUPLICATION | SECURITY_HYGIENE | DOCUMENTATION | ARCHITECTURE | TESTING | DEPENDENCY | PERFORMANCE | STRUCTURE).
2. 0.2.42 added a required sastCoverageGap to the analysis envelope (analysis.ts), but suppression.test.ts's local analysis() helper was not updated.

Why the monorepo did not catch it

The monorepo has no typecheck script — not in its root package.json, not in packages/cli/package.json. packages/cli/tsconfig.json (which includes test/**/*.ts) is only ever run by this repo's typecheck script. So nothing upstream typechecks packages/cli/test.

What is sound

• pnpm test — 405/405 pass, exit 0
• pnpm release:artifact rebuilds to the published digest exactly: 7d212774695235bad12055be5e27167d1904cfedc676f50be71e35dba010230b
• pnpm release:verify — exit 0
• The 31 synced paths are byte-identical to their b40fce6 blobs

Only the typecheck gate is red. The shipped tarball is fine.

Why the tag was not pushed

release.yml runs pnpm typecheck as the first command of its build step, so pushing v0.2.42 would fail the release job. The tag has deliberately not been created.

The fix belongs in the monorepo (b40fce6), then a re-sync — patching only the mirror would break the byte-fidelity invariant the attestation story depends on.

Superseded. 0.2.42 could not be released — it shipped three type errors in test files and this repo's release job runs pnpm typecheck first. That is fixed in CLI 0.2.43, which also adds the typecheck gate the monorepo never had, so the next sync goes straight to 0.2.43.