tamperward 1.10.0 → 1.10.1

package/dist/cli/index.js

@@ -2932,6 +2932,21 @@ function runEnvelope(opts) {
     err(`tamperward run: cannot resolve trusted base ${opts.base ?? "HEAD"} \u2014 failing closed.`);
     return 2;
   }
+  let frozenCmd;
+  let frozenBudget;
+  try {
+    const entryPolicy = loadPolicy(cwd);
+    frozenCmd = opts.cmd ?? entryPolicy.verify?.command;
+    frozenBudget = opts.budget ?? entryPolicy.verify?.budget;
+  } catch (e) {
+    err(`tamperward run: cannot load the entry-time policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed.`);
+    return 2;
+  }
+  if (!frozenCmd) {
+    err("tamperward run: no suite command at entry (policy `verify: { command: ... }` or --cmd) \u2014");
+    err("refusing to start: a verifier that appears after the agent runs would be agent-authored.");
+    return 2;
+  }
   if (!opts.allowDirty) {
     const dirty = git3(["status", "--porcelain"], cwd).trim();
     if (dirty) {
@@ -2944,6 +2959,14 @@ function runEnvelope(opts) {
   const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
+  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd });
+  if (isAncestor.status !== 0) {
+    err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
+    err("the agent rewrote history out from under the anchor. That is the finding.");
+    out(`
+tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMENT_FAILED`);
+    return 1;
+  }
   let diffCode = 0;
   if (head !== base) {
     out(`
@@ -2953,7 +2976,7 @@ function runEnvelope(opts) {
   out("\n[envelope] policy check over the working tree:");
   const workCode = runCheck({ worktree: true, cwd });
   out("\n[envelope] pristine verification against the trusted base:");
-  const verifyCode = runVerify({ cwd, base, cmd: opts.cmd, budget: opts.budget });
+  const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget });
   const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",