diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 89443ad..efff31c 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "codetruss", "version": "0.1.6", - "description": "Verify the acceptance contract for coding-agent changes locally.", + "description": "The deterministic first-pass verification gate for AI-written code.", "author": { "name": "CodeTruss", "email": "zack@codetruss.com", @@ -14,7 +14,7 @@ "skills": "./skills/", "interface": { "displayName": "CodeTruss", - "shortDescription": "Local acceptance gate for coding-agent changes", + "shortDescription": "First-pass verification gate for AI-written code", "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.", "developerName": "CodeTruss", "category": "Developer Tools", diff --git a/README.md b/README.md index 04eeacb..b522330 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ marketplace. - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from Skill instructions in this repository are verified against the shipped CLI v0.2.30. The skill can explain the official installer when the CLI is missing, diff --git a/plugins/codetruss-claude/README.md b/plugins/codetruss-claude/README.md index 78eb08d..14d373e 100644 --- a/plugins/codetruss-claude/README.md +++ b/plugins/codetruss-claude/README.md @@ -19,7 +19,7 @@ Prerequisites: - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from Skill instructions are verified against the shipped CLI v0.2.30. @@ -36,7 +36,7 @@ receipt sync require separate explicit developer actions. Troubleshooting: - Run `codetruss --version`; install or upgrade from the CLI page when it is - missing or older than v0.2.24. + missing or older than v0.2.30. - Run `codetruss setup` for the guided local policy, verification-fingerprint, and hook flow. Do not replace it with hand-edited setup steps. - Run `codetruss hooks status claude` and `codetruss hooks doctor claude` diff --git a/plugins/codetruss-claude/skills/codetruss/SKILL.md b/plugins/codetruss-claude/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/plugins/codetruss-claude/skills/codetruss/SKILL.md +++ b/plugins/codetruss-claude/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml b/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml +++ b/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt." diff --git a/plugins/codetruss/.codex-plugin/plugin.json b/plugins/codetruss/.codex-plugin/plugin.json index 382fc0b..f35179a 100644 --- a/plugins/codetruss/.codex-plugin/plugin.json +++ b/plugins/codetruss/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "codetruss", "version": "0.1.6", - "description": "Verify the acceptance contract for coding-agent changes locally.", + "description": "The deterministic first-pass verification gate for AI-written code.", "author": { "name": "CodeTruss", "email": "zack@codetruss.com", @@ -14,7 +14,7 @@ "skills": "./skills/", "interface": { "displayName": "CodeTruss", - "shortDescription": "Local acceptance gate for coding-agent changes", + "shortDescription": "First-pass verification gate for AI-written code", "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.", "developerName": "CodeTruss", "category": "Developer Tools", diff --git a/plugins/codetruss/README.md b/plugins/codetruss/README.md index a6a4969..b56cc30 100644 --- a/plugins/codetruss/README.md +++ b/plugins/codetruss/README.md @@ -7,7 +7,7 @@ Prerequisites: - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from The plugin contains no analyzer, MCP server, background service, or upload path. Deterministic checks stay local. Provider-backed review, authentication, and @@ -16,7 +16,7 @@ receipt sync require separate explicit developer actions. Troubleshooting: - Run `codetruss --version`; install or upgrade from the CLI page when it is - missing or older than v0.2.24. + missing or older than v0.2.30. - Run `codetruss setup` for the guided local policy, verification-fingerprint, and hook flow. Do not replace it with hand-edited setup steps. - Run `codetruss hooks status codex` and `codetruss hooks doctor codex` before diff --git a/plugins/codetruss/skills/codetruss/SKILL.md b/plugins/codetruss/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/plugins/codetruss/skills/codetruss/SKILL.md +++ b/plugins/codetruss/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/plugins/codetruss/skills/codetruss/agents/openai.yaml b/plugins/codetruss/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/plugins/codetruss/skills/codetruss/agents/openai.yaml +++ b/plugins/codetruss/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt." diff --git a/scripts/validate.mjs b/scripts/validate.mjs index ae3100f..a1c15d0 100644 --- a/scripts/validate.mjs +++ b/scripts/validate.mjs @@ -19,7 +19,7 @@ assert.match(canonicalSkill, /^---\nname: codetruss\ndescription: .{80,1024}\n-- for (const required of [ 'obtain explicit consent before downloading or installing software', - 'This skill targets v0.2.24 or newer.', + 'This skill targets v0.2.30 or newer.', 'use `codetruss setup` as the single guided setup path', '`codetruss verify-policy status` and require exit 0 with the same fingerprint', 'An existing `.codetruss.yml` remains authoritative', @@ -27,6 +27,8 @@ for (const required of [ 'Do not broaden `allow`, remove `deny`, add `--no-verify`', 'For `codetruss run` and `codetruss review`, treat exit `0` as `PASS`', 'post-generation integrity evidence', + 'a local run never performs injection or taint analysis', + 'never as\n evidence that the change is secure', ]) { assert.ok(canonicalSkill.includes(required), `missing trust-boundary rule: ${required}`) } @@ -74,7 +76,7 @@ for (const manifest of [codexManifest, rootManifest]) { assert.ok(!('hooks' in manifest), 'plugin must delegate hooks to the tested CLI installer') assert.equal( manifest.interface.shortDescription, - 'Local acceptance gate for coding-agent changes', + 'First-pass verification gate for AI-written code', ) } for (const field of [ @@ -169,7 +171,7 @@ assert.deepEqual(codexMarketplace.plugins[0].policy, { }) const readme = await read('README.md') -assert.match(readme, /CodeTruss CLI v0\.2\.24 or newer/) +assert.match(readme, /CodeTruss CLI v0\.2\.30 or newer/) assert.match(readme, /--skill codetruss --agent claude-code codex -y/) assert.match(readme, /codetruss-plugins\/tree\/v0\.1\.5/) assert.doesNotMatch(readme, /official listing remains pending review/) @@ -191,7 +193,7 @@ for (const path of [ 'plugins/codetruss-claude/README.md', ]) { const pluginReadme = await read(path) - assert.match(pluginReadme, /CodeTruss CLI v0\.2\.24 or newer/) + assert.match(pluginReadme, /CodeTruss CLI v0\.2\.30 or newer/) assert.match(pluginReadme, /Run `codetruss setup` for the guided local policy/) } diff --git a/skills/codetruss/SKILL.md b/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/skills/codetruss/SKILL.md +++ b/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/skills/codetruss/agents/openai.yaml b/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/skills/codetruss/agents/openai.yaml +++ b/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt."