Release CodeTruss CLI v0.2.61

[DeliriumPulse]

Syncs the 0.2.61 source from the private monorepo, byte for byte against the monorepo git objects (247 paths compared by blob hash, 0 mismatches, 0 missing).

codetruss-cli-0.2.61.tgz
sha256 b1d2f7c8f016cdade18ab67d9af68b82b1623546d1b221ed2727e5acf158aec6

That digest was not copied into release-reference.json: pnpm release:artifact was run against this tree, resolved from this repository's own lockfile, and the rebuilt archive cmp's clean against the monorepo's copy and against the bytes codetruss.com is serving right now. All three digests in release-reference.json were re-measured off the files — archive, SBOM, and the dist/cli.cjs extracted from inside the archive.

The blob-hash comparison was rerun against the 0.2.57 monorepo tree as a negative control: it reported 12 mismatched and 12 missing paths, so a sync that silently dropped or stale-copied a file would not have passed. The cmp chain's own negative control — a byte-identical copy with one NUL appended — correctly fails.

Local run of this repository's full suite before pushing: 442 tests, deterministic-package, release-verifier, changelog-policy, and acceptance (6 adjudicated verdicts over 4 fixtures) all pass against dist/cli.cjs 0.2.61.

Why this one is urgent

https://codetruss.com/downloads/codetruss-cli-latest.json already advertises 0.2.61 and its releaseUrl currently 404s; tagging this merge makes the advertised URL resolve. npm still serves 0.2.50 — eleven versions behind — and the founder has asked for npm to be brought current, so the Publish npm dispatch follows this release.

What users are actually waiting on

Four versions ride this sync (0.2.58–0.2.61), all false-positive and honesty fixes — the failure mode that costs a verification tool the most trust:

• 0.2.58 — prose that documents a credential pattern is no longer reported as a leak. The scanner had flagged the comment explaining its own rule, and 0.2.57 failed its own commit gate on it. Corpus-validated: byte-identical results across ~26,000 files in eleven outside repositories.
• 0.2.59 — the first line the CLI prints in an unconfigured repository no longer opens with "0 changed file(s) are within approved scope". Found by cold-installing the published tarball on a third-party repo.
• 0.2.60 — a finding dismissed with a reasoned codetruss-ignore marker is evidence, not a charge: it stops scoring while staying on every receipt with its reason. A reasonless marker still charges; the same finding without a marker still charges.
• 0.2.61 — fourteen hand-verified false positives in our own source carry their dismissal reasons in the code, the product's own workflow for a verified FP.

🤖 Generated with Claude Code