From 531235e911f939c6856b242431fbe89a39089363 Mon Sep 17 00:00:00 2001 From: Zack Whitson Date: Fri, 7 Aug 2026 15:47:20 -0500 Subject: [PATCH] Document verify-receipt and grammars on the landing page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The command reference listed neither, so the two commands a reader is most likely to want first — check a receipt someone handed you, and install the grammar pack that turns on Python SAST — were invisible on the page people actually land on. Also corrects the profile id to local-registry-v4 and drops the pinned version from the frozen-renderer sentence, since naming one release there is what made it go stale in the first place. Co-Authored-By: Claude Opus 5 --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a5ebb41..1ddf535 100644 --- a/README.md +++ b/README.md @@ -124,10 +124,12 @@ codetruss setup [--allow GLOB] [--deny GLOB] [--hooks all|pre-commit|claude|code [--trust-verify] [--yes] codetruss init [--allow GLOB] [--deny GLOB] [--force] codetruss verify [id|latest] +codetruss verify-receipt [--public-key FILE] codetruss sync [id|latest] [--dry-run] codetruss auth login|status|logout codetruss verify-policy [status|trust|trust-key|revoke] codetruss hooks install|status|doctor|uninstall [pre-commit|claude|codex|all] +codetruss grammars list|status|install|uninstall [python] ``` `verify-policy status`, `trust`, and `revoke` govern whether the repository's @@ -184,7 +186,7 @@ be rechecked later with `codetruss verify latest`. Every receipt states the detection gaps in its own body, so a `PASS` is never mistaken for a security clearance. Abridged from a real 0.2.36 run, so it prints the `local-registry-v2` profile and its thirteen-analyzer wording. A run on this release prints -`local-registry-v3` and fifteen; 0.2.39 keeps the v2 renderer frozen so the +`local-registry-v4` and fifteen. Every superseded renderer stays frozen, so the receipt below still verifies byte-for-byte as signed: ```markdown