---

name: codetruss description: Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.

CodeTruss

Use the installed codetruss CLI as the source of truth. Do not reimplement scope classification, analyzers, verdict rules, signing, or hook behavior in the agent.

Preserve the trust boundary

• Work inside the developer's Git repository and inspect existing policy before proposing changes.
• Run codetruss --version first. This skill targets v0.2.35 or newer. If the CLI is missing or older, explain the prerequisite, then obtain explicit consent before downloading or installing software, including an upgrade.
• Offer only the official install paths from https://codetruss.com/cli. Let the developer inspect a downloaded installer instead of piping it when they prefer an inspect-first flow.
• Do not run --llm, codetruss auth login, or codetruss sync unless the developer explicitly requests that networked action. Never search for or print provider keys.
• Do not broaden allow, remove deny, add --no-verify, or edit a receipt to manufacture a green verdict. Fix the change or ask the developer to approve a genuine policy change.
• For codetruss run and codetruss review, treat exit 0 as PASS, exit 1 as REVIEW_REQUIRED, exit 2 as FAILED, and exit 3 as a usage or environment failure. Exits 1 and 2 still produce receipts; other commands may use nonzero exits differently, so read their output.
• A receipt also names what did not run, and that boundary moved in v0.2.35. A local run now executes the shared SAST engine over the JavaScript, TypeScript and TSX in the repository, covering SQL injection, mass assignment, un-awaited database writes, swallowed errors, coercion-prone ==, and N+1 queries in loops. The rest of the rule pack (command injection, code injection, path traversal, SSRF, open redirect, XSS, insecure deserialization), every non-JavaScript language, and the hosted symbol graph stay hosted-only. Read the receipt's own "What did not run" section instead of asserting either way from memory. Report a PASS as the deterministic passes finding nothing new, never as evidence that the change is secure.
• Local security findings are REVIEW_REQUIRED at most. They never fail a verdict on their own, so do not report one as a blocking failure.
• Describe a valid signature as post-generation integrity evidence. Do not call it trusted execution, proof of authorship, or automatic compliance evidence.

Set up a repository

1. Confirm the repository root and require a reasonably clean baseline when attribution matters.
2. Inspect tracked paths, task context, existing .codetruss.yml, package scripts, and the repository's normal lint, typecheck, test, or build commands.
3. Propose the smallest useful allow globs, appropriate deny globs, the exact verification commands CodeTruss is expected to detect, and one hook target. Keep secrets, generated output, production infrastructure, and unrelated migrations denied when appropriate. Show which tracked paths each glob matches, and flag empty or overly broad matches. Do not default to **/*.
4. Ask the developer to confirm the exact boundary, hook target, verification command list, and whether to trust that list for automatic execution.
5. After confirmation, use codetruss setup as the single guided setup path, with the approved repeated --allow and --deny values and one --hooks claude|codex|pre-commit|all value. Prefer its interactive trust prompt so the commands it actually prints can be compared with the approved list before answering trust. Use --yes only after every choice is explicit and the inspected repository state is unchanged. Include --trust-verify only after the developer approves the exact detected list, so fingerprint trust is completed. Do not replace guided initial setup with ad hoc config editing or separate hook installation.
6. Read the setup output and verify the expected policy, hook health, and local-only privacy reminder. When commands were detected, require their full verification fingerprint and trusted result, then run codetruss verify-policy status and require exit 0 with the same fingerprint and command list. Otherwise confirm that setup reports no detected commands. If setup pauses before trust, show the exact commands and fingerprint, obtain approval, then rerun the same setup path with --trust-verify.
7. Remind Codex users to open /hooks and approve the exact repository hook definition when setup reports that one-time host trust step.

The CLI's hook installer is idempotent and preserves supported existing hook configuration. An existing .codetruss.yml remains authoritative: if setup reports a policy mismatch, stop instead of overwriting or weakening it, and treat any policy change as a separate developer decision. If the developer approves the exact policy diff, make only that reviewed edit and rerun setup without conflicting policy flags. A setup hook target installs or checks that target; it does not remove other existing hooks. Never uninstall another hook without an explicit removal request. Do not replace the installer with plugin-bundled hook logic.

Review changes

1. Use the developer's actual task statement. Ask for it if the intended change is unclear; do not invent a permissive task after seeing the diff.
2. Use codetruss review --task "..." for current tracked and untracked changes. Add --staged only when the developer requests the index or a pre-commit review.
3. Use repository policy by default. Pass task-specific --allow, --deny, or --verify values only when the developer explicitly sets or approves them.
4. Read the receipt ID and explicit reasons. Use codetruss report latest --json when structured evidence is useful, then run codetruss verify latest before describing the receipt as valid.
5. Report the verdict, scope exceptions, sensitive surfaces, analyzer findings, verification results, evidence limitations, and receipt path. Distinguish a policy dispute from a product or shell failure.

Since v0.2.32, a run with no allow policy infers the scope of the turn and marks those files allowed (inferred) on the receipt: treat an inferred allow as weaker evidence than a declared boundary and still propose a real .codetruss.yml.

Since v0.2.34, a finding may carry a Suggested fixes entry with a diff and a required safety note: present it, never apply it automatically, and keep the note's rotation-first ordering for a credential, whose diff is deliberately masked and cannot apply cleanly.

For a wrapped agent run, preserve the exact task and policy:

codetruss run --task "<task>" --allow "<glob>" --verify "<command>" -- <agent-command>

Do not stage, commit, reset, clean, or sync as a side effect of review.

Repair and recheck

• Repair the finding at its source while keeping the approved policy stable.
• Re-run the same review mode and verification commands after the change.
• If the developer intentionally changed a sensitive or denied surface, record that decision explicitly; do not silently reclassify it.
• Use codetruss hooks status <surface> and codetruss hooks doctor <surface> for diagnosis. Use codetruss hooks uninstall <surface> only on an explicit removal request.

Keep the final response compact: verdict first, then actionable reasons, receipt ID/path, integrity result, and any decision still required from the developer.