From 9cc31d9872152264830597b0966b8de6cdb2da69 Mon Sep 17 00:00:00 2001 From: Zack Whitson Date: Thu, 6 Aug 2026 22:33:07 -0500 Subject: [PATCH] Raise the CLI floor to v0.2.30 and state the receipt's detection gaps v0.1.6 moved the marketplace and Claude copy to the first-pass verification gate language and cited "the shipped CLI v0.2.30" in the README, but the prerequisite lines and the skill itself still told agents that v0.2.24 was enough, and the Codex manifests kept the retired "acceptance gate" wording. - Raise the CLI floor from v0.2.24 to v0.2.30 in the canonical skill, both platform copies, and all three READMEs. 0.2.28 fixed unattended `setup --yes`, which the skill's own setup flow depends on, so 0.2.24 is not a safe floor to advertise. - Tell the agent that a receipt names what did not run. SAST and the hosted symbol graph are hosted-only, so a local run never performs injection or taint analysis, and a PASS must never be reported as evidence the change is secure. Both sentences are pinned in the validator so they cannot silently drop out. - Finish the positioning pass in the Codex manifests and the Agent Skills interface metadata, which still read "acceptance contract" and "Local acceptance gate". No version bump: 0.1.6 is not tagged yet, and nothing here changes a capability. The wrappers still ship no analyzer, no MCP server, no bundled hook, and no upload path. Co-Authored-By: Claude Opus 5 --- .codex-plugin/plugin.json | 4 ++-- README.md | 2 +- plugins/codetruss-claude/README.md | 4 ++-- plugins/codetruss-claude/skills/codetruss/SKILL.md | 6 +++++- .../skills/codetruss/agents/openai.yaml | 2 +- plugins/codetruss/.codex-plugin/plugin.json | 4 ++-- plugins/codetruss/README.md | 4 ++-- plugins/codetruss/skills/codetruss/SKILL.md | 6 +++++- plugins/codetruss/skills/codetruss/agents/openai.yaml | 2 +- scripts/validate.mjs | 10 ++++++---- skills/codetruss/SKILL.md | 6 +++++- skills/codetruss/agents/openai.yaml | 2 +- 12 files changed, 33 insertions(+), 19 deletions(-) diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 89443ad..efff31c 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "codetruss", "version": "0.1.6", - "description": "Verify the acceptance contract for coding-agent changes locally.", + "description": "The deterministic first-pass verification gate for AI-written code.", "author": { "name": "CodeTruss", "email": "zack@codetruss.com", @@ -14,7 +14,7 @@ "skills": "./skills/", "interface": { "displayName": "CodeTruss", - "shortDescription": "Local acceptance gate for coding-agent changes", + "shortDescription": "First-pass verification gate for AI-written code", "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.", "developerName": "CodeTruss", "category": "Developer Tools", diff --git a/README.md b/README.md index 04eeacb..b522330 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ marketplace. - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from Skill instructions in this repository are verified against the shipped CLI v0.2.30. The skill can explain the official installer when the CLI is missing, diff --git a/plugins/codetruss-claude/README.md b/plugins/codetruss-claude/README.md index 78eb08d..14d373e 100644 --- a/plugins/codetruss-claude/README.md +++ b/plugins/codetruss-claude/README.md @@ -19,7 +19,7 @@ Prerequisites: - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from Skill instructions are verified against the shipped CLI v0.2.30. @@ -36,7 +36,7 @@ receipt sync require separate explicit developer actions. Troubleshooting: - Run `codetruss --version`; install or upgrade from the CLI page when it is - missing or older than v0.2.24. + missing or older than v0.2.30. - Run `codetruss setup` for the guided local policy, verification-fingerprint, and hook flow. Do not replace it with hand-edited setup steps. - Run `codetruss hooks status claude` and `codetruss hooks doctor claude` diff --git a/plugins/codetruss-claude/skills/codetruss/SKILL.md b/plugins/codetruss-claude/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/plugins/codetruss-claude/skills/codetruss/SKILL.md +++ b/plugins/codetruss-claude/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml b/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml +++ b/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt." diff --git a/plugins/codetruss/.codex-plugin/plugin.json b/plugins/codetruss/.codex-plugin/plugin.json index 382fc0b..f35179a 100644 --- a/plugins/codetruss/.codex-plugin/plugin.json +++ b/plugins/codetruss/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "codetruss", "version": "0.1.6", - "description": "Verify the acceptance contract for coding-agent changes locally.", + "description": "The deterministic first-pass verification gate for AI-written code.", "author": { "name": "CodeTruss", "email": "zack@codetruss.com", @@ -14,7 +14,7 @@ "skills": "./skills/", "interface": { "displayName": "CodeTruss", - "shortDescription": "Local acceptance gate for coding-agent changes", + "shortDescription": "First-pass verification gate for AI-written code", "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.", "developerName": "CodeTruss", "category": "Developer Tools", diff --git a/plugins/codetruss/README.md b/plugins/codetruss/README.md index a6a4969..b56cc30 100644 --- a/plugins/codetruss/README.md +++ b/plugins/codetruss/README.md @@ -7,7 +7,7 @@ Prerequisites: - Git - Node.js 20.9 or newer -- CodeTruss CLI v0.2.24 or newer from +- CodeTruss CLI v0.2.30 or newer from The plugin contains no analyzer, MCP server, background service, or upload path. Deterministic checks stay local. Provider-backed review, authentication, and @@ -16,7 +16,7 @@ receipt sync require separate explicit developer actions. Troubleshooting: - Run `codetruss --version`; install or upgrade from the CLI page when it is - missing or older than v0.2.24. + missing or older than v0.2.30. - Run `codetruss setup` for the guided local policy, verification-fingerprint, and hook flow. Do not replace it with hand-edited setup steps. - Run `codetruss hooks status codex` and `codetruss hooks doctor codex` before diff --git a/plugins/codetruss/skills/codetruss/SKILL.md b/plugins/codetruss/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/plugins/codetruss/skills/codetruss/SKILL.md +++ b/plugins/codetruss/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/plugins/codetruss/skills/codetruss/agents/openai.yaml b/plugins/codetruss/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/plugins/codetruss/skills/codetruss/agents/openai.yaml +++ b/plugins/codetruss/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt." diff --git a/scripts/validate.mjs b/scripts/validate.mjs index ae3100f..a1c15d0 100644 --- a/scripts/validate.mjs +++ b/scripts/validate.mjs @@ -19,7 +19,7 @@ assert.match(canonicalSkill, /^---\nname: codetruss\ndescription: .{80,1024}\n-- for (const required of [ 'obtain explicit consent before downloading or installing software', - 'This skill targets v0.2.24 or newer.', + 'This skill targets v0.2.30 or newer.', 'use `codetruss setup` as the single guided setup path', '`codetruss verify-policy status` and require exit 0 with the same fingerprint', 'An existing `.codetruss.yml` remains authoritative', @@ -27,6 +27,8 @@ for (const required of [ 'Do not broaden `allow`, remove `deny`, add `--no-verify`', 'For `codetruss run` and `codetruss review`, treat exit `0` as `PASS`', 'post-generation integrity evidence', + 'a local run never performs injection or taint analysis', + 'never as\n evidence that the change is secure', ]) { assert.ok(canonicalSkill.includes(required), `missing trust-boundary rule: ${required}`) } @@ -74,7 +76,7 @@ for (const manifest of [codexManifest, rootManifest]) { assert.ok(!('hooks' in manifest), 'plugin must delegate hooks to the tested CLI installer') assert.equal( manifest.interface.shortDescription, - 'Local acceptance gate for coding-agent changes', + 'First-pass verification gate for AI-written code', ) } for (const field of [ @@ -169,7 +171,7 @@ assert.deepEqual(codexMarketplace.plugins[0].policy, { }) const readme = await read('README.md') -assert.match(readme, /CodeTruss CLI v0\.2\.24 or newer/) +assert.match(readme, /CodeTruss CLI v0\.2\.30 or newer/) assert.match(readme, /--skill codetruss --agent claude-code codex -y/) assert.match(readme, /codetruss-plugins\/tree\/v0\.1\.5/) assert.doesNotMatch(readme, /official listing remains pending review/) @@ -191,7 +193,7 @@ for (const path of [ 'plugins/codetruss-claude/README.md', ]) { const pluginReadme = await read(path) - assert.match(pluginReadme, /CodeTruss CLI v0\.2\.24 or newer/) + assert.match(pluginReadme, /CodeTruss CLI v0\.2\.30 or newer/) assert.match(pluginReadme, /Run `codetruss setup` for the guided local policy/) } diff --git a/skills/codetruss/SKILL.md b/skills/codetruss/SKILL.md index cfea1ca..af922a0 100644 --- a/skills/codetruss/SKILL.md +++ b/skills/codetruss/SKILL.md @@ -13,7 +13,7 @@ agent. - Work inside the developer's Git repository and inspect existing policy before proposing changes. -- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the +- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade. - Offer only the official install paths from `https://codetruss.com/cli`. Let @@ -29,6 +29,10 @@ agent. as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output. +- A receipt also names what did not run. SAST and the hosted symbol graph are + hosted-only, so a local run never performs injection or taint analysis. + Report a `PASS` as the deterministic passes finding nothing new, never as + evidence that the change is secure. - Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence. diff --git a/skills/codetruss/agents/openai.yaml b/skills/codetruss/agents/openai.yaml index 42143c0..34fe70e 100644 --- a/skills/codetruss/agents/openai.yaml +++ b/skills/codetruss/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "CodeTruss" - short_description: "Local acceptance gate for coding-agent changes" + short_description: "First-pass verification gate for AI-written code" default_prompt: "Review my current agent changes with CodeTruss and explain the receipt."