Raise the CLI floor to v0.2.30 and state the receipt's detection gaps - #13
Merged
Conversation
📝 WalkthroughWalkthroughThe release updates CodeTruss metadata and documentation to describe deterministic first-pass verification. It raises the minimum CLI version to v0.2.30, documents hosted-analysis limits, updates the version to 0.1.6, and aligns validation checks. ChangesVerification gate update
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
README.md (1)
57-57: 📐 Maintainability & Code Quality | 🔵 TrivialCreate the
v0.1.6tag before publishing the immutable install command.The command at Line 57 resolves through the
/tree/v0.1.6reference. Create and push thev0.1.6tag after merge, then verify that the immutable install path resolves before announcing the release.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 57, Create and push the v0.1.6 Git tag before publishing the immutable install command, then verify that the /tree/v0.1.6 reference resolves successfully; keep the README URL unchanged once the tag is available.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/codetruss-claude/.claude-plugin/plugin.json`:
- Around line 3-4: Update the description field in the Claude plugin metadata to
describe CodeTruss as a “first-pass verification gate,” while preserving the
existing reference to local verification and the separately installed free
CodeTruss CLI.
In `@scripts/validate.mjs`:
- Around line 22-30: Update the receipt validation assertions in
scripts/validate.mjs to require generated documentation explicitly stating that
PASS is not security evidence. Keep the existing hosted-only SAST and
symbol-graph checks unchanged, and make validation fail when this
security-evidence wording is absent.
---
Nitpick comments:
In `@README.md`:
- Line 57: Create and push the v0.1.6 Git tag before publishing the immutable
install command, then verify that the /tree/v0.1.6 reference resolves
successfully; keep the README URL unchanged once the tag is available.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: de9f9c88-76ce-422f-aa08-127c8d7a0664
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (15)
.claude-plugin/marketplace.json.codex-plugin/plugin.jsonREADME.mdpackage.jsonplugins/codetruss-claude/.claude-plugin/plugin.jsonplugins/codetruss-claude/README.mdplugins/codetruss-claude/skills/codetruss/SKILL.mdplugins/codetruss-claude/skills/codetruss/agents/openai.yamlplugins/codetruss/.codex-plugin/plugin.jsonplugins/codetruss/README.mdplugins/codetruss/skills/codetruss/SKILL.mdplugins/codetruss/skills/codetruss/agents/openai.yamlscripts/validate.mjsskills/codetruss/SKILL.mdskills/codetruss/agents/openai.yaml
v0.1.6 moved the marketplace and Claude copy to the first-pass verification gate language and cited "the shipped CLI v0.2.30" in the README, but the prerequisite lines and the skill itself still told agents that v0.2.24 was enough, and the Codex manifests kept the retired "acceptance gate" wording. - Raise the CLI floor from v0.2.24 to v0.2.30 in the canonical skill, both platform copies, and all three READMEs. 0.2.28 fixed unattended `setup --yes`, which the skill's own setup flow depends on, so 0.2.24 is not a safe floor to advertise. - Tell the agent that a receipt names what did not run. SAST and the hosted symbol graph are hosted-only, so a local run never performs injection or taint analysis, and a PASS must never be reported as evidence the change is secure. Both sentences are pinned in the validator so they cannot silently drop out. - Finish the positioning pass in the Codex manifests and the Agent Skills interface metadata, which still read "acceptance contract" and "Local acceptance gate". No version bump: 0.1.6 is not tagged yet, and nothing here changes a capability. The wrappers still ship no analyzer, no MCP server, no bundled hook, and no upload path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
DeliriumPulse
force-pushed
the
release/v0.1.6
branch
from
August 7, 2026 03:33
d40061c to
9cc31d9
Compare
DeliriumPulse
changed the title
Collaborator
Author
|
Both review notes are handled after the rebase: Claude plugin description — moot. #14 already rewrote "PASS is not security evidence" assertion — added. 'a local run never performs injection or taint analysis',
'never as\n evidence that the change is secure',so validation fails if either sentence is dropped from the skill. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebased onto
mainafter #14 landed. That PR moved the marketplace and Claudecopy to the first-pass verification gate language and already cites "the shipped
CLI v0.2.30" in the README, so the version bump and those description changes are
dropped from this PR. What it left behind is what this fixes.
What was still stale on main
.codex-plugin/plugin.jsonat root and in the package) still read"Verify the acceptance contract for coding-agent changes locally."and"Local acceptance gate for coding-agent changes", along with the Agent Skillsopenai.yamlinterface metadata.Changes
setup --yes, which the skill's own setup flow depends on, so 0.2.24 is not a safe floor to advertise.PASSmust never be reported as evidence the change is secure. Both sentences are pinned invalidate.mjs, which also covers the earlier review note asking for the "not security evidence" wording to be enforced.No version bump: 0.1.6 is not tagged yet and nothing here changes a capability.
The wrappers still ship no analyzer, no MCP server, no bundled hook, and no
upload path, and
validate.mjsstill asserts all of that.Verification
npm testpasses, including the two new pinned trust-boundary rulesnpm run release:verifybuilds both archives twice from HEAD and confirms byte-for-byte reproducibility0.2.24or "acceptance gate/contract" strings remain outside the changelog history🤖 Generated with Claude Code