CodeTruss · DeliriumPulse · Aug 7, 2026 · Aug 7, 2026
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "codetruss",
   "version": "0.1.6",
-  "description": "Verify the acceptance contract for coding-agent changes locally.",
+  "description": "The deterministic first-pass verification gate for AI-written code.",
   "author": {
     "name": "CodeTruss",
     "email": "zack@codetruss.com",
@@ -14,7 +14,7 @@
   "skills": "./skills/",
   "interface": {
     "displayName": "CodeTruss",
-    "shortDescription": "Local acceptance gate for coding-agent changes",
+    "shortDescription": "First-pass verification gate for AI-written code",
     "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.",
     "developerName": "CodeTruss",
     "category": "Developer Tools",

diff --git a/README.md b/README.md
@@ -45,7 +45,7 @@ marketplace.
 
 - Git
 - Node.js 20.9 or newer
-- CodeTruss CLI v0.2.24 or newer from <https://codetruss.com/cli>
+- CodeTruss CLI v0.2.30 or newer from <https://codetruss.com/cli>
 
 Skill instructions in this repository are verified against the shipped CLI
 v0.2.30. The skill can explain the official installer when the CLI is missing,

diff --git a/plugins/codetruss-claude/README.md b/plugins/codetruss-claude/README.md
@@ -19,7 +19,7 @@ Prerequisites:
 
 - Git
 - Node.js 20.9 or newer
-- CodeTruss CLI v0.2.24 or newer from <https://codetruss.com/cli>
+- CodeTruss CLI v0.2.30 or newer from <https://codetruss.com/cli>
 
 Skill instructions are verified against the shipped CLI v0.2.30.
 
@@ -36,7 +36,7 @@ receipt sync require separate explicit developer actions.
 Troubleshooting:
 
 - Run `codetruss --version`; install or upgrade from the CLI page when it is
-  missing or older than v0.2.24.
+  missing or older than v0.2.30.
 - Run `codetruss setup` for the guided local policy, verification-fingerprint,
   and hook flow. Do not replace it with hand-edited setup steps.
 - Run `codetruss hooks status claude` and `codetruss hooks doctor claude`

diff --git a/plugins/codetruss-claude/skills/codetruss/SKILL.md b/plugins/codetruss-claude/skills/codetruss/SKILL.md
@@ -13,7 +13,7 @@ agent.
 
 - Work inside the developer's Git repository and inspect existing policy before
   proposing changes.
-- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the
+- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the
   CLI is missing or older, explain the prerequisite, then
   obtain explicit consent before downloading or installing software, including an upgrade.
 - Offer only the official install paths from `https://codetruss.com/cli`. Let
@@ -29,6 +29,10 @@ agent.
   as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or
   environment failure. Exits 1 and 2 still produce receipts; other commands
   may use nonzero exits differently, so read their output.
+- A receipt also names what did not run. SAST and the hosted symbol graph are
+  hosted-only, so a local run never performs injection or taint analysis.
+  Report a `PASS` as the deterministic passes finding nothing new, never as
+  evidence that the change is secure.
 - Describe a valid signature as post-generation integrity evidence. Do not call
   it trusted execution, proof of authorship, or automatic compliance evidence.
 

diff --git a/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml b/plugins/codetruss-claude/skills/codetruss/agents/openai.yaml
@@ -1,4 +1,4 @@
 interface:
   display_name: "CodeTruss"
-  short_description: "Local acceptance gate for coding-agent changes"
+  short_description: "First-pass verification gate for AI-written code"
   default_prompt: "Review my current agent changes with CodeTruss and explain the receipt."
diff --git a/plugins/codetruss/.codex-plugin/plugin.json b/plugins/codetruss/.codex-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "codetruss",
   "version": "0.1.6",
-  "description": "Verify the acceptance contract for coding-agent changes locally.",
+  "description": "The deterministic first-pass verification gate for AI-written code.",
   "author": {
     "name": "CodeTruss",
     "email": "zack@codetruss.com",
@@ -14,7 +14,7 @@
   "skills": "./skills/",
   "interface": {
     "displayName": "CodeTruss",
-    "shortDescription": "Local acceptance gate for coding-agent changes",
+    "shortDescription": "First-pass verification gate for AI-written code",
     "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.",
     "developerName": "CodeTruss",
     "category": "Developer Tools",

diff --git a/plugins/codetruss/README.md b/plugins/codetruss/README.md
@@ -7,7 +7,7 @@ Prerequisites:
 
 - Git
 - Node.js 20.9 or newer
-- CodeTruss CLI v0.2.24 or newer from <https://codetruss.com/cli>
+- CodeTruss CLI v0.2.30 or newer from <https://codetruss.com/cli>
 
 The plugin contains no analyzer, MCP server, background service, or upload path.
 Deterministic checks stay local. Provider-backed review, authentication, and
@@ -16,7 +16,7 @@ receipt sync require separate explicit developer actions.
 Troubleshooting:
 
 - Run `codetruss --version`; install or upgrade from the CLI page when it is
-  missing or older than v0.2.24.
+  missing or older than v0.2.30.
 - Run `codetruss setup` for the guided local policy, verification-fingerprint,
   and hook flow. Do not replace it with hand-edited setup steps.
 - Run `codetruss hooks status codex` and `codetruss hooks doctor codex` before

diff --git a/plugins/codetruss/skills/codetruss/SKILL.md b/plugins/codetruss/skills/codetruss/SKILL.md
@@ -13,7 +13,7 @@ agent.
 
 - Work inside the developer's Git repository and inspect existing policy before
   proposing changes.
-- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the
+- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the
   CLI is missing or older, explain the prerequisite, then
   obtain explicit consent before downloading or installing software, including an upgrade.
 - Offer only the official install paths from `https://codetruss.com/cli`. Let
@@ -29,6 +29,10 @@ agent.
   as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or
   environment failure. Exits 1 and 2 still produce receipts; other commands
   may use nonzero exits differently, so read their output.
+- A receipt also names what did not run. SAST and the hosted symbol graph are
+  hosted-only, so a local run never performs injection or taint analysis.
+  Report a `PASS` as the deterministic passes finding nothing new, never as
+  evidence that the change is secure.
 - Describe a valid signature as post-generation integrity evidence. Do not call
   it trusted execution, proof of authorship, or automatic compliance evidence.
 

diff --git a/plugins/codetruss/skills/codetruss/agents/openai.yaml b/plugins/codetruss/skills/codetruss/agents/openai.yaml
@@ -1,4 +1,4 @@
 interface:
   display_name: "CodeTruss"
-  short_description: "Local acceptance gate for coding-agent changes"
+  short_description: "First-pass verification gate for AI-written code"
   default_prompt: "Review my current agent changes with CodeTruss and explain the receipt."
diff --git a/scripts/validate.mjs b/scripts/validate.mjs
@@ -19,14 +19,16 @@ assert.match(canonicalSkill, /^---\nname: codetruss\ndescription: .{80,1024}\n--
 
 for (const required of [
   'obtain explicit consent before downloading or installing software',
-  'This skill targets v0.2.24 or newer.',
+  'This skill targets v0.2.30 or newer.',
   'use `codetruss setup` as the single guided setup path',
   '`codetruss verify-policy status` and require exit 0 with the same fingerprint',
   'An existing `.codetruss.yml` remains authoritative',
   'Do not run `--llm`, `codetruss auth login`, or `codetruss sync` unless',
   'Do not broaden `allow`, remove `deny`, add `--no-verify`',
   'For `codetruss run` and `codetruss review`, treat exit `0` as `PASS`',
   'post-generation integrity evidence',
+  'a local run never performs injection or taint analysis',
+  'never as\n  evidence that the change is secure',
 ]) {
   assert.ok(canonicalSkill.includes(required), `missing trust-boundary rule: ${required}`)
 }
@@ -74,7 +76,7 @@ for (const manifest of [codexManifest, rootManifest]) {
   assert.ok(!('hooks' in manifest), 'plugin must delegate hooks to the tested CLI installer')
   assert.equal(
     manifest.interface.shortDescription,
-    'Local acceptance gate for coding-agent changes',
+    'First-pass verification gate for AI-written code',
   )
 }
 for (const field of [
@@ -169,7 +171,7 @@ assert.deepEqual(codexMarketplace.plugins[0].policy, {
 })
 
 const readme = await read('README.md')
-assert.match(readme, /CodeTruss CLI v0\.2\.24 or newer/)
+assert.match(readme, /CodeTruss CLI v0\.2\.30 or newer/)
 assert.match(readme, /--skill codetruss --agent claude-code codex -y/)
 assert.match(readme, /codetruss-plugins\/tree\/v0\.1\.5/)
 assert.doesNotMatch(readme, /official listing remains pending review/)
@@ -191,7 +193,7 @@ for (const path of [
   'plugins/codetruss-claude/README.md',
 ]) {
   const pluginReadme = await read(path)
-  assert.match(pluginReadme, /CodeTruss CLI v0\.2\.24 or newer/)
+  assert.match(pluginReadme, /CodeTruss CLI v0\.2\.30 or newer/)
   assert.match(pluginReadme, /Run `codetruss setup` for the guided local policy/)
 }
 

diff --git a/skills/codetruss/SKILL.md b/skills/codetruss/SKILL.md
@@ -13,7 +13,7 @@ agent.
 
 - Work inside the developer's Git repository and inspect existing policy before
   proposing changes.
-- Run `codetruss --version` first. This skill targets v0.2.24 or newer. If the
+- Run `codetruss --version` first. This skill targets v0.2.30 or newer. If the
   CLI is missing or older, explain the prerequisite, then
   obtain explicit consent before downloading or installing software, including an upgrade.
 - Offer only the official install paths from `https://codetruss.com/cli`. Let
@@ -29,6 +29,10 @@ agent.
   as `REVIEW_REQUIRED`, exit `2` as `FAILED`, and exit `3` as a usage or
   environment failure. Exits 1 and 2 still produce receipts; other commands
   may use nonzero exits differently, so read their output.
+- A receipt also names what did not run. SAST and the hosted symbol graph are
+  hosted-only, so a local run never performs injection or taint analysis.
+  Report a `PASS` as the deterministic passes finding nothing new, never as
+  evidence that the change is secure.
 - Describe a valid signature as post-generation integrity evidence. Do not call
   it trusted execution, proof of authorship, or automatic compliance evidence.
 

diff --git a/skills/codetruss/agents/openai.yaml b/skills/codetruss/agents/openai.yaml
@@ -1,4 +1,4 @@
 interface:
   display_name: "CodeTruss"
-  short_description: "Local acceptance gate for coding-agent changes"
+  short_description: "First-pass verification gate for AI-written code"
   default_prompt: "Review my current agent changes with CodeTruss and explain the receipt."