tamperward 1.12.0 → 1.13.0

package/dist/cli/index.js

@@ -1660,17 +1660,28 @@ function applyLocalSignoffs(findings, cwd, policy, now = Date.now()) {
   }
   return { findings: remaining, cleared };
 }
-function applyOobSignoffs(findings, oob) {
-  const set = new Set(oob.map((s) => s.trim()).filter(Boolean));
+function applyOobSignoffs(findings, oob, head) {
+  const tokens2 = oob.map((s) => s.trim()).filter(Boolean);
+  const matches = (want) => tokens2.some((t) => {
+    const at = t.lastIndexOf("@");
+    if (at === -1) return head ? false : t === want;
+    const [rule, sha2] = [t.slice(0, at), t.slice(at + 1)];
+    if (rule !== want) return false;
+    return head ? head.startsWith(sha2) && sha2.length >= 7 : true;
+  });
   const cleared = [];
   const remaining = [];
   for (const f of findings) {
-    const ok = f.severity === "block" && (set.has(f.rule) || (f.file ? set.has(`${f.rule}:${f.file}`) : false));
+    const ok = f.severity === "block" && (matches(f.rule) || (f.file ? matches(`${f.rule}:${f.file}`) : false));
     if (ok) cleared.push(f);
     else remaining.push(f);
   }
   return { findings: remaining, cleared };
 }
+function oobHeadFromEnv(env = process.env) {
+  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim();
+  return v.length >= 7 ? v : void 0;
+}
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 }
@@ -1938,7 +1949,7 @@ function check(opts) {
   }
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
   let findings = evaluate(changes, policy, void 0, view);
-  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv());
+  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
   findings = remaining;
   if (cleared.length) {
     const how = layer === "local" ? "local human sign-off (ledger)" : "out-of-band approval";
@@ -2694,6 +2705,10 @@ jobs:
       - name: Tamperward gate (diff-time)
         env:
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
+          # Binds each approval to the commit it was granted for: labels persist
+          # across pushes, so an unbound one would clear every later finding on
+          # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
+          TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
         run: npx --yes tamperward@${TW_VERSION} check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
       # Diff-time detection is spelling-dependent by nature; pristine
       # re-execution is not, and it was the layer nothing got past in the
@@ -2704,7 +2719,7 @@ jobs:
       # Requires a \`verify:\` block in .tamperward.yml naming the suite command;
       # without one this step fails closed (exit 2) rather than passing quietly.
       - name: Tamperward verify (pristine re-execution)
-        run: npx --yes tamperward@${TW_VERSION} verify --base "\${{ github.event.pull_request.base.sha }}"
+        run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
@@ -2853,6 +2868,10 @@ function resolveBase(base, cwd) {
     return rev;
   }
 }
+function baseIsAncestorOfHead(base, cwd) {
+  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd });
+  return r.status === 0;
+}
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
@@ -2926,6 +2945,15 @@ function runVerify(opts) {
     out2(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
+  if (opts.requireAncestor) {
+    const requested = git2(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
+    if (!baseIsAncestorOfHead(requested, cwd)) {
+      out2(
+        `verify: --require-ancestor: ${requested.slice(0, 10)} is not an ancestor of HEAD \u2014 the anchor would silently resolve to an older commit. Failing closed.`
+      );
+      return 2;
+    }
+  }
   const cmd = opts.cmd ?? policy.verify?.command;
   if (!cmd) {
     out2("verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd");
@@ -3008,6 +3036,7 @@ function parseVerify(args) {
     else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
     else if (a === "--json") o.json = true;
     else if (a === "--keep") o.keep = true;
+    else if (a === "--require-ancestor") o.requireAncestor = true;
     else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
   }
   return o;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",