Cavil-CLI-0.02

Changes for version 0.02 - 2026-08-31

Removed --token, and --url is now accepted only by "config". A token passed as an argument is world-readable in ps output and stays in shell history, and once the token can only come from the saved config or CAVIL_API_KEY, --url elsewhere would have aimed that token at a different server. Server and token are now resolved together from one source, never mixed, for the same reason.
New "baseline" command: record a tree's current matches as accepted in a committed .cavil-baseline.json, so later checks report only what is not in it. Most projects carry some copies they have already decided about, and repeating them every run is how the report stops being read. Entries are pinned to the file's content and to what it matched (so an edit brings the finding back), never hide a risk higher than the one accepted, and are still counted in the tally and named in a footer. Use --no-baseline to report everything, or --baseline to point at another file.
The default risk gate is now 4 (strong copyleft) rather than 5. Risk 4 is where reciprocity applies to the derivative work, so code absorbed at that level obliges the codebase around it; at the old default a copied GPL function passed the gate as a mere note. Projects that already ship copyleft can restore the previous behaviour with "--fail-on-risk 5".