codetruss 0.2.55

[DeliriumPulse]

Points the formula at the v0.2.55 release archive.

url    https://github.com/CodeTruss/codetruss-cli/releases/download/v0.2.55/codetruss-cli-0.2.55.tgz
sha256 12010c43b6635c5e5384a753bd5467bfa7031f64403ccdf0acfa5f9baa150194

That digest was measured off the downloaded release asset, not copied from the release notes, and the URL written above was fetched independently with curl and cmpd against it. The asset is byte-identical to public/downloads/codetruss-cli-0.2.55.tgz in the monorepo, to the bytes codetruss.com serves, to the site's latest pointer, and to the archive rebuilt independently in the mirror from its own lockfile — five copies, all cmp clean.

gh attestation verify codetruss-cli-0.2.55.tgz --repo CodeTruss/codetruss-cli passes — the command was derived from attestationCommand() in packages/cli/scripts/release-metadata.mjs rather than retyped, and matches the attestationCommand field the live manifest publishes. It was run with --format json rather than trusting a bare exit code, so the subject it actually verified (codetruss-cli-0.2.55.tgz, digest 12010c43…) and the signer identity (https://github.com/CodeTruss/codetruss-cli/.github/workflows/release.yml@refs/tags/v0.2.55, issuer token.actions.githubusercontent.com) are on the record.

The release carries all three attestations:

predicate	subject	how confirmed
https://slsa.dev/provenance/v1	codetruss-cli-0.2.55.tgz @ 12010c43…	gh attestation verify --format json
https://cyclonedx.org/bom	codetruss-cli-0.2.55.tgz @ 12010c43…	gh attestation verify --predicate-type … --format json, CycloneDX 1.6, 5 components
https://in-toto.io/attestation/release/v0.2	pkg:github/CodeTruss/codetruss-cli@v0.2.55 @ 69a0e5c5… (the annotated tag object)	attestations API — gh 2.85 exits 1 on this predicate because it is signed by dotcom.releases.github.com, not an Actions OIDC identity

The exit 0 is not vacuous. The same cmp against 0.2.53 — the version this formula pointed at until now — exits 1. gh attestation verify was checked against a tampered copy of the archive (one appended NUL), against the pre-transfer DeliriumPulse/codetruss-cli slug, and against an unrelated repository; all three exit 1, and the attestations API returns HTTP 404 for the tampered digest.

Nothing else changes. .github/workflows/test.yml derives the expected version from brew info rather than a literal, so it needs no edit; the version assertion in CI is what proves the installed binary matches the formula.

What 0.2.55 carries

This release supersedes 0.2.54, which was merged but never released — no tag, no GitHub release, no formula bump. That has precedent (0.2.42 and 0.2.47 through 0.2.49 are all merged-but-unreleased). It is not retroactively released; its change ships inside these bytes.

0.2.54 — the README's profile id is derived instead of restated. The 0.2.53 archive contradicted itself: README.md said receipts identify the 15-pass local-registry-v4 profile while CHANGELOG.md, packed beside it in the same eight-file tarball, said local-registry-v5. That was recorded as a known wart in the 0.2.53 formula bump. A build step now reads LOCAL_ANALYSIS_PROFILE.id from packages/cli/src/types.ts and the analyzer count from ANALYZERS in the engine registry, and fails the release build when the README disagrees with either.

0.2.55 — the mirror's CI can now fail on a rule. The public source repository carries packages/cli/ and the engine's src, but no root tests/ and no engine test directory, so its nine required contexts verified packaging — reproducible archive, tamper-rejecting verifier, changelog chain — and a SAST behaviour regression could pass all nine. packages/cli/scripts/test-acceptance.mjs now runs the built dist/cli.cjs over committed fixtures and asserts the adjudicated verdicts from the cross-tool benchmark: a drizzle sql`…` tagged template that must not be reported, and client.query(param, …) on a database-shaped receiver that must be reported at HIGH.

No analyzer, rule, or receipt behaviour changes. git diff between the 0.2.53 and 0.2.55 source trees reports zero changes under packages/cli/src or packages/analyzer-engine/src. dist/cli.cjs moves 828,029 → 828,065 bytes (+36), 2 changed lines out of 296, and that delta is entirely the inlined package.json: the version string plus the 36 characters of && node scripts/test-acceptance.mjs. Receipts stay on local-registry-v5, and every frozen profile renderer (v1 through v5) pins an unchanged SHA-256.

Verified against the published archive, not a local build

Installed into a dedicated npm --prefix and invoked by absolute path — this machine also carries a stale global codetruss (0.2.28, from Homebrew) that must not be allowed to answer:

• codetruss --version → codetruss 0.2.55 (the stale global still answers codetruss 0.2.28, so the absolute path is doing real work)
• the installed dist/cli.cjs is byte-identical to the one inside the downloaded release archive
• README.md inside the installed package reads local-registry-v5 — the 0.2.54 correction is genuinely in these bytes
• a freshly signed receipt reads Profile: `local-registry-v5` and codetruss verify latest accepts its signature (PASS)

The new acceptance check is not decoration either: it was demonstrated red in both directions before being trusted. Reverting the tagged-template exemption reports CRITICAL sql-injection at src/db/rpc.ts:11 where none is allowed; switching the caller-supplied-argument gate off yields expected exactly 1 sql-injection finding …, got 0. It ran in the public repository's CI and printed reproduced 2 adjudicated verdicts over 2 fixtures in all six contexts that execute the test suite, and in the tag-triggered release job that produced this archive.

One known wart

The 0.2.55 changelog entry inside this archive says the acceptance script "runs in all nine compatibility contexts". It runs in six of nine: the upstream ci.yml gates its Test step on matrix.node != '20.9.0', so the three Node 20.9.0 contexts skip it — confirmed from the job step conclusions, not inferred. The check is real and the coverage gap it closes is closed on every context that runs the suite; only the count in the prose is wrong.

It is recorded rather than patched, because these bytes are already tagged, attested and served. A correction belongs in 0.2.56.

🤖 Generated with Claude Code