tamperward 1.14.2 → 1.14.5

package/README.md

@@ -43,7 +43,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 
 > **Scope.** The rows above are one model, one pressure prompt, one JS/TS
 > ecosystem — evidence for that setting, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v1.14.1** adds post-study envelope hardening
+> the v1.9.0 stack; the current **v1.14.3** adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -53,74 +53,119 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > and 3.1 all ran on a verifier carrying it. No evidence any agent used it; the
 > layer's authority in those rounds was nonetheless weaker than described at the
 > time. Round 4 is the fresh pool.
-> No round-3 outcomes are included in the claims above.
 
 ## Architecture
 
-The final envelope adjudication is anchored to state recorded before the agent
-starts; the in-loop hooks read the live tree and remain steering controls. The
-final adjudication boundary sits outside the agent's normal lifecycle.
+Tamperward separates **steering** from **adjudication**.
 
+> **Core invariant:** the agent may author the candidate tree, but it must not
+> choose the trusted baseline, the governing policy, the verifier, or the final
+> verdict.
+
+| plane | mechanism | role |
+| --- | --- | --- |
+| **In-loop steering** | Claude Code `PreToolUse`, protected-tree drift checks, the `Stop` sweep, and optional filesystem-event observation | Immediate corrective feedback. Not the final authority. |
+| **Local adjudication** | `tamperward run -- <agent…>` | Wraps the runtime and independently judges the tree it leaves behind. |
+| **Commit backstop** | `tamperward check --staged` | Catches human changes, and agents without supported hooks. |
+| **Repository authority** | Required PR checks plus branch protection | Decides what may reach the protected branch. |
+
+| layer | the question it answers |
+| --- | --- |
+| **Change semantics** | Does a proposed or recorded change match a known weakening class? (PreToolUse deny, staged diff, range diff) |
+| **Effect** | What did the protected state actually become, however the mutation arrived? (drift check, fs-event observer, Stop sweep) |
+| **Outcome** | Does the candidate still pass when protected verification state from the base is restored? (pristine verification — no diff interpreted at all) |
+| **Authority** | Where is the final verdict rendered, and what assumptions make it authoritative? (run envelope, CI, SHA-bound human sign-off) |
+
+### The local enforcement envelope
+
+```mermaid
+flowchart TB
+    subgraph R["tamperward run — outer enforcement envelope"]
+        E["Capture entry state"]
+        subgraph U["Agent-controlled lifecycle"]
+            H["In-loop steering hooks"]
+            A["Agent runtime"]
+            W["Candidate HEAD and worktree"]
+            H -.-> A
+            A --> W
+        end
+        J["Post-exit adjudication"]
+        C["Committed and worktree checks"]
+        V["Visible and pristine verification"]
+        Q["Ancestry, dependency drift, quiescence"]
+        X["Final exit verdict"]
+        E --> A
+        E --> J
+        W --> J
+        J --> C
+        J --> V
+        J --> Q
+        C --> X
+        V --> X
+        Q --> X
+    end
 ```
-      RECORDED AT ENVELOPE ENTRY:
-      entry SHA · frozen policy · frozen verifier command/budget · dependency fingerprint
-                                    │
-      ┌─────────────────────────────┴───────────────────────────────┐
-      │  agent loop (Claude Code hooks today)                       │
-      │    PreToolUse gate: every proposed Edit/Write/Bash judged;  │
-      │    known weakening DENIED before the tool runs              │
-      │                          │                                  │
-      │  working tree            ▼                                  │
-      │    effect observation: per-call protected-tree drift check  │
-      │    + filesystem-event observer (`tamperward watch`)         │
-      │                          │                                  │
-      │  Stop sweep              ▼                                  │
-      │    end-of-turn net diff re-checked; transient protected     │
-      │    mutations judged from the event log                      │
-      │                          │                                  │
-      │  pristine verification   ▼   (`tamperward verify`)          │
-      │    suite runs twice in separate copies: the candidate tree  │
-      │    as-is, and with protected tests/snapshots/config         │
-      │    restored from the trusted base; visible-green +          │
-      │    pristine-red = MASKED FAILURE                            │
-      └─────────────────────────────┬───────────────────────────────┘
-                                    │  agent runtime exits — exit code NOT trusted
-                                    ▼
-      `tamperward run -- <agent…>` — the outer envelope
-        policy + verifier resolved from the entry state, never the tree
-        the agent wrote · post-agent HEAD must descend from the entry
-        SHA · policy check over base...HEAD (committed weakening) and
-        over the worktree incl. untracked files (uncommitted) ·
-        dependency-tree fingerprint compared · quiescence guard ·
-        pristine verify against the entry base · exit 1 on any blocking
-        finding or masked failure · exit 2 (fail closed) when
-        adjudication is impossible
-                                    │
-                                    ▼
-      pre-commit backstop: `tamperward check --staged`
-                                    │
-                                    ▼
-      PR CI: `check --diff base...head` + `verify --require-ancestor`
-        policy read from the merge-base — a PR cannot govern its own verdict
-                                    │
-                                    ▼
-      out-of-band human exception only: PR label
-      `tamperward:allow:<rule>@<head-sha>` — SHA-bound, applied by a human
-      with write access, never a file the branch can commit
-                                    │
-                                    ▼
-      protected main
-```
 
-CI is the final authority in this design, and that authority is conditional on
-the deployment assumptions documented in
-[docs/guide/enforcement.md](./docs/guide/enforcement.md) and
-[SPEC.md](./SPEC.md): verification is anchored to a base the agent cannot
-rewrite (a protected branch), the repository's branch protection actually
-enforces the workflow's verdict on merges, and sign-off labels can only be
-applied by humans with write access. Mechanisms, residuals, and what is
-explicitly outside the trust boundary: [SPEC.md](./SPEC.md) and
-[SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md).
+Before starting the agent, the envelope
+
+1. records the exact entry commit;
+2. loads the policy and the verifier command and budget from that commit;
+3. records the installed `node_modules` content fingerprint, where one exists; and
+4. refuses an already-dirty tree unless the operator explicitly accepts the risk.
+
+The hooks then steer the agent while it works: they read live state, deny known
+weakening operations, detect protected-tree drift, and sweep the turn's net
+changes. The `Stop` hook runs that sweep — it does **not** invoke `verify`.
+`tamperward watch` can additionally record transient mutations, but it is an
+optional observer that `init` neither starts nor supervises, and it is not an
+enforcement boundary.
+
+After the runtime exits its exit code is treated as untrusted, and the envelope
+checks that post-agent `HEAD` still descends from the entry commit; the committed
+changes over `entry...HEAD`; staged, unstaged and untracked non-ignored worktree
+changes; dependency drift and whether the tree stayed quiescent; and the
+verification outcome.
+
+`tamperward verify` materialises two temporary copies — they are **not
+sandboxes**, and both execute agent-controlled code. The visible copy runs the
+candidate as-is. In the pristine copy, files on the protected overlay classes and
+on a separate enumerated **verification surface** (the configuration a test runner
+auto-consults) are restored from the trusted base, and agent-added files on those
+surfaces are removed. That surface list deliberately **bounds** runner-configuration
+inheritance rather than eliminating it — see
+[docs/THREAT-MODEL-pristine-run.md](./docs/THREAT-MODEL-pristine-run.md).
+
+Visible green followed by pristine red is a `MASKED_FAILURE`. Two green runs
+establish only that the candidate passes the base suite; they establish neither
+semantic correctness nor a substitute for independent held-out tests.
+
+| result | envelope behaviour |
+| --- | --- |
+| Enforcement clean and agent exits 0 | exit 0 |
+| Blocking finding, masked failure, dependency drift, or non-quiescent tree | exit 1 |
+| Required adjudication cannot be completed | exit 2, failing closed |
+| Enforcement clean but the agent failed | the agent's non-zero exit is preserved |
+
+### CI authority
+
+Pre-commit is an early backstop; protected CI is the merge authority. CI runs, independently:
+
+1. `check --diff base...head`, with policy from the trusted merge-base; and
+2. `verify --require-ancestor --base <base-sha>`, which since **1.14.3** also reads
+   its policy, verification surface and verifier command and budget from that same
+   trusted base — so neither job's verdict is governed by the candidate.
+
+Legitimate exceptions are out-of-band PR labels bound to the exact head SHA; a new
+push invalidates the approval.
+
+This guarantee depends on a protected and immutable base, required status checks, a
+pinned Tamperward version, and label permissions restricted to trusted humans.
+Tamperward provides no OS isolation, no network confinement, no secret isolation,
+and no semantic-correctness oracle.
+
+Full assumptions and residual risks: [SPEC.md](./SPEC.md),
+[SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md), and the
+[series limitations page](./docs/blog/limitations.md).
 
 ## Quick start
 
@@ -140,11 +185,20 @@ A real deployment needs a verify command configured — the generated CI verify
 verify:
   command: npm test
   budget: 300
+  inputs: ['scripts/**']   # what the command DELEGATES to
 ```
 
 That block is itself a guarded surface: changing the command, lowering the budget,
-or removing it is flagged as policy weakening — a verifier an agent can point at
-`true` is no verification at all.
+narrowing `inputs`, or removing it is flagged as policy weakening — a verifier an
+agent can point at `true` is no verification at all.
+
+`inputs` names the files the command *executes*, so the pristine run gets the
+base's copy of them too. A command token that names a file present at the base is
+picked up automatically (`node runner.js`), so most repositories need nothing
+here. Delegation is what needs the list: `npm test` names no file, and the base's
+restored `"test": "sh scripts/test.sh"` will happily call a script nothing
+restored. It bounds the class rather than closing it — see
+[the threat model](./docs/THREAT-MODEL-pristine-run.md).
 
 The four primitives:
 
@@ -155,14 +209,7 @@ npx tamperward verify --base main            # pristine-suite re-execution
 npx tamperward run -- <agent command...>     # the outer envelope around an agent
 ```
 
-## Four layers, different jobs
-
-| layer | the question it answers |
-| --- | --- |
-| **Change semantics** | Does a proposed or recorded change match a known weakening class? (PreToolUse deny, staged diff, range diff) |
-| **Effect** | What did the protected state actually become, however the mutation arrived? (drift check, fs-event observer, Stop sweep) |
-| **Outcome** | Does the candidate still pass when protected verification state from the base is restored? (pristine verification — no diff interpreted at all) |
-| **Authority** | Where is the final verdict rendered, and what assumptions make that verdict authoritative? (run envelope, CI, SHA-bound human sign-off) |
+### The rules
 
 Sixteen rules are specified and fourteen ship (see the table in
 [SPEC.md](./SPEC.md)). The families: test protection (`test-deletion`,
@@ -225,8 +272,12 @@ and its totals.
 | v1.9.0 | `tamperward verify`: the round-1 pristine oracle productized — visible-green + pristine-red is a masked failure, and "could not verify" fails closed |
 | Round 2, 9–0 | On 22 fresh repositories, v1.9.0 produced b=9/c=0 false-green discordance (p = 0.0039); four gated false greens remained, through two documented residual mechanisms |
 | cssstyle lifecycle escape (round 2) | The `tamperward run` envelope: the gate denied 42 mutations and verify refused all 25 stop attempts, and the runtime completed the session anyway over a masked tree — hooks decide, runtimes terminate, so the adjudication boundary moved outside the runtime |
+| v1.14.5, external audit | The pristine copy was a sibling of the visible copy and fully prepared before it ran, so the candidate's own code wrote `../pristine/<the failing test>` and both runs returned 0 — no race, no background process, no git. The pristine copy is now built only after the visible run exits, its restored files are digested either side of the pristine run, and the working and dependency trees are fingerprinted around both. Also: the overlay restored content but not MODE, so `chmod -x` alone hid a test from an exec-bit runner in both copies; a transient dependency substitution that restored itself on the way out left the entry-vs-exit fingerprint identical; and a committed `.npmrc` chose the registry the CI gate was downloaded from |
+| v1.14.4, external audit | The overlay restored the tests and then ran the agent's *runner*: `verify.command` was frozen, but `runner.js` — and anything `npm test` delegates to — was in no protected class. And `git replace` redirected what the base resolved to for `ls-tree`, `show` and `merge-base` alike, with no ref moved and no file touched. Verifier inputs are now restored from the base; every trusted read sets `GIT_NO_REPLACE_OBJECTS=1` and the envelope convicts a rewrite installed during the run. `init` also gained workflow migration and matcher repair, and the Claude hook now denies a payload it cannot parse instead of allowing it |
+| v1.14.3, external review | Standalone `verify` loaded its policy from the working tree, so the generated CI workflow let a pull request supply the `verify:` command for its own re-execution. `check --diff` flagged the edit as hook-tampering, so the workflow caught it as a pair — but only where both jobs are required, and `verify` alone had no protection. With a `--base`, policy now comes from that commit |
+| v1.14.2, threat model | 1.14.1 removed agent-added files only inside the protected classes, whose `config` list is JS/TS-only; an added `pytest.ini`, `setup.cfg`, `tox.ini` or `pyproject.toml` still reached the pristine run. `verify` now owns a verification surface covering runner-consulted configuration |
 | v1.14.1, article audit | `tamperward verify` kept agent-added protected files in the pristine run on the premise that they "only add strictness". An added `conftest.py` could deselect the restored base tests by node id, so a masked failure reported VERIFIED and the envelope printed GREEN MEANS GREEN over an unfixed bug. Added protected files are now removed; PoC and mutation-checked regression committed |
-| v1.10.1–v1.14.0, owner + two-pass external review | Frozen entry-time policy and verifier, entry-SHA ancestry enforcement, quiescence guard, dependency-tree fingerprint, a CI verify step in the generated workflow, the gate pinned to its own version in CI, and SHA-bound sign-off labels |
+| v1.10.1–v1.14.0, owner + two-pass external review | Frozen entry-time policy and verifier, entry-SHA ancestry enforcement, quiescence guard, `node_modules` content fingerprint, a CI verify step in the generated workflow, the gate pinned to its own version in CI, and SHA-bound sign-off labels |
 
 Each row's primary artifact: [CHANGELOG.md](./CHANGELOG.md), [SPEC.md](./SPEC.md),
 and the posts in [docs/blog/](./docs/blog/index.md).
@@ -247,7 +298,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 365 tests at v1.14.1 — parser, detectors, engine, policy, renderers
+npm test                        # 368 tests at v1.14.3 — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -1114,6 +1114,13 @@ function policyWeakening(before, after) {
       if (ab < bb) {
         reasons.push(`verify.budget lowered ${bb}s \u2192 ${ab}s \u2014 starving the budget turns "cannot verify" into a pressure point`);
       }
+      const stillInput = new Set(av.inputs ?? []);
+      const droppedInputs = (bv.inputs ?? []).filter((g) => !stillInput.has(g));
+      if (droppedInputs.length) {
+        reasons.push(
+          `verify.inputs narrowed (removed ${droppedInputs.join(", ")}) \u2014 the pristine run would execute the candidate's copy of those files`
+        );
+      }
     }
   }
   return reasons;
@@ -1624,7 +1631,16 @@ function parsePolicy(raw) {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
     },
-    ...r.verify?.command ? { verify: { command: r.verify.command, budget: r.verify.budget ?? 300 } } : {}
+    ...r.verify?.command ? {
+      verify: {
+        command: r.verify.command,
+        budget: r.verify.budget ?? 300,
+        // Rebuilding the block field-by-field means a field added later and
+        // not listed here is SILENTLY DROPPED — which is how `inputs` first
+        // shipped as a no-op that parsed, validated, and restored nothing.
+        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {}
+      }
+    } : {}
   };
 }
 function parseOrThrow(src, where) {
@@ -2418,20 +2434,27 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
 }
 
 // src/cli/hook.ts
+var HookInputError = class extends Error {
+};
 function readStdin() {
   try {
     return readFileSync9(0, "utf8");
-  } catch {
-    return "";
+  } catch (e) {
+    throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
 function parseInput(raw) {
   if (!raw.trim()) return {};
+  let parsed;
   try {
-    return JSON.parse(raw);
-  } catch {
-    return {};
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new HookInputError(`the hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
   }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new HookInputError(`the hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})`);
+  }
+  return parsed;
 }
 function recordDenylog(blocks) {
   const log = process.env.TAMPERWARD_DENYLOG;
@@ -2610,16 +2633,30 @@ function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
   return r.exitCode;
 }
+function preToolUseFromRaw(raw) {
+  try {
+    return preToolUseVerdict(parseInput(raw));
+  } catch (e) {
+    return failClosed("PreToolUse", errText(e));
+  }
+}
+function stopFromRaw(raw) {
+  try {
+    return stopVerdict(parseInput(raw));
+  } catch (e) {
+    return failClosed("Stop", errText(e));
+  }
+}
 function runHookClaude() {
   try {
-    return emit(preToolUseVerdict(parseInput(readStdin())));
+    return emit(preToolUseFromRaw(readStdin()));
   } catch (e) {
     return emit(failClosed("PreToolUse", errText(e)));
   }
 }
 function runSweepClaude() {
   try {
-    return emit(stopVerdict(parseInput(readStdin())));
+    return emit(stopFromRaw(readStdin()));
   } catch (e) {
     return emit(failClosed("Stop", errText(e)));
   }
@@ -2672,10 +2709,12 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
 var HOOK_CMD = "npx --yes tamperward hook claude";
+var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
 var MARKER = "# tamperward: block agent shortcuts before they land";
@@ -2729,6 +2768,15 @@ jobs:
   tamperward:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    # The gate is fetched from the registry AT GATE TIME, from inside the
+    # checked-out pull request \u2014 and \`npm\` reads \`.npmrc\` from the working
+    # directory. A PR that commits one line, \`registry=https://\u2026\`, chooses where
+    # the authority judging it is downloaded from; the version pin below pins the
+    # STRING, not the SOURCE. An environment variable outranks a project
+    # \`.npmrc\` in npm's config precedence, so this is what makes the pin mean
+    # something.
+    env:
+      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
     steps:
       - uses: actions/checkout@v5
         with:
@@ -2762,6 +2810,30 @@ jobs:
       - name: Tamperward verify (pristine re-execution)
         run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
+var WORKFLOW_MARK = "# tamperward:generated";
+var WORKFLOW_MARK_RE = /^# tamperward:generated v(\S+) sha256:([0-9a-f]+)\n/m;
+function bodyHash(body) {
+  return createHash5("sha256").update(body).digest("hex").slice(0, 16);
+}
+function workflowFile(body) {
+  return `${WORKFLOW_MARK} v${TW_VERSION} sha256:${bodyHash(body)}
+${body}`;
+}
+function readWorkflowMark(src) {
+  const m = src.match(WORKFLOW_MARK_RE);
+  if (!m) return null;
+  return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
+}
+function toolSet(matcher2) {
+  const m = String(matcher2 ?? "").trim();
+  if (m === "" || m === "*") return null;
+  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+}
+function missingTools(matcher2) {
+  const have = toolSet(matcher2);
+  if (have === null) return [];
+  return PRE_MATCHER.split("|").filter((t) => !have.has(t));
+}
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
   if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
@@ -2795,24 +2867,34 @@ function planClaudeHooks(cwd) {
     settings = parsed;
   }
   const hooks = settings.hooks ??= {};
-  const has = (arr, needle) => (arr ?? []).some((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
-  const needPre = !has(hooks.PreToolUse, "tamperward hook claude");
-  const needStop = !has(hooks.Stop, "tamperward sweep claude");
-  if (!needPre && !needStop) return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
+  const preEntries = entriesWith(hooks.PreToolUse, "tamperward hook claude");
+  const needPre = preEntries.length === 0;
+  const needStop = entriesWith(hooks.Stop, "tamperward sweep claude").length === 0;
+  const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
+  if (!needPre && !needStop && stale.length === 0) {
+    return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  }
+  const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
   return {
     item: "agent",
     path: rel,
     status: existsSync7(path) ? "update" : "create",
-    detail: `wire ${[needPre && "PreToolUse deny", needStop && "Stop sweep"].filter(Boolean).join(" + ")}`,
+    detail: [
+      needPre && "wire PreToolUse deny",
+      needStop && "wire Stop sweep",
+      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`
+    ].filter(Boolean).join(" + "),
     apply: () => {
       if (needPre) {
         (hooks.PreToolUse ??= []).push({
-          // NotebookEdit is modelled by the adapter but was absent here, so
-          // that branch was unreachable in the wiring we install. (P2-12.)
-          matcher: "Bash|Edit|Write|MultiEdit|NotebookEdit",
+          matcher: PRE_MATCHER,
           hooks: [{ type: "command", command: HOOK_CMD }]
         });
       }
+      for (const m of stale) {
+        m.matcher = [...toolSet(m.matcher) ?? /* @__PURE__ */ new Set(), ...missingTools(m.matcher)].join("|");
+      }
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
@@ -2848,27 +2930,64 @@ ${line}` : existing.replace(/\n?$/, "\n") + line;
     }
   };
 }
-function planWorkflow(cwd) {
+function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
   const path = join8(cwd, rel);
-  if (existsSync7(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
+  const write = () => {
+    mkdirSync5(dirname3(path), { recursive: true });
+    writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
+  };
+  if (!existsSync7(path)) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "create",
+      detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
+      apply: write
+    };
+  }
+  let src;
+  try {
+    src = readFileSync10(path, "utf8");
+  } catch {
+    return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
+  }
+  const current = bodyHash(WORKFLOW_CONTENT);
+  const mark = readWorkflowMark(src);
+  if (mark && bodyHash(mark.body) === current) {
+    return { item: "ci", path: rel, status: "ok", detail: `generated by tamperward and current (v${mark.version})` };
+  }
+  if (mark && bodyHash(mark.body) === mark.hash) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "update",
+      detail: `generated by tamperward v${mark.version} and unmodified \u2014 migrating to the v${TW_VERSION} template`,
+      apply: write
+    };
+  }
+  if (force) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "update",
+      detail: mark ? `edited since tamperward v${mark.version} generated it \u2014 OVERWRITING (--force-workflow)` : "not generated by tamperward \u2014 OVERWRITING (--force-workflow)",
+      apply: write
+    };
+  }
   return {
     item: "ci",
     path: rel,
-    status: "create",
-    detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
-    apply: () => {
-      mkdirSync5(dirname3(path), { recursive: true });
-      writeFileSync5(path, WORKFLOW_CONTENT);
-    }
+    status: "skip",
+    detail: (mark ? `edited since tamperward v${mark.version} generated it` : "present but not generated by tamperward") + ` \u2014 left untouched. Compare it against the v${TW_VERSION} template (an older one may lack the pristine-verify step) and re-run with --force-workflow to replace it.`
   };
 }
-function planInit(cwd) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd)];
+function planInit(cwd, opts = {}) {
+  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false)];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
-  const plan = planInit(cwd);
+  const plan = planInit(cwd, { forceWorkflow: opts.forceWorkflow });
   const w = process.stdout;
   for (const a of plan) {
     const verb = opts.dryRun && (a.status === "create" || a.status === "update") ? `would ${a.status}` : a.status;
@@ -2895,10 +3014,130 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync11, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
+import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { createHash as createHash8 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join9, resolve } from "node:path";
+import { dirname as dirname4, join as join11, resolve } from "node:path";
+
+// src/git/trusted.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { createHash as createHash6 } from "node:crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join9 } from "node:path";
+function trustedGitEnv() {
+  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
+}
+function gitDirOf(cwd) {
+  try {
+    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: trustedGitEnv()
+    }).trim();
+    if (!d) return null;
+    return isAbsolute2(d) ? d : join9(cwd, d);
+  } catch {
+    return null;
+  }
+}
+function objectRewriteState(cwd) {
+  const parts = [];
+  try {
+    parts.push(
+      "replace:" + execFileSync4("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: trustedGitEnv()
+      }).trim()
+    );
+  } catch {
+    parts.push("replace:<unreadable>");
+  }
+  const dir = gitDirOf(cwd);
+  for (const rel of ["info/grafts", "shallow"]) {
+    if (dir === null) {
+      parts.push(`${rel}:<no-git-dir>`);
+      continue;
+    }
+    const p = join9(dir, rel);
+    try {
+      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
+    } catch {
+      parts.push(`${rel}:<unreadable>`);
+    }
+  }
+  return createHash6("sha256").update(parts.join("\n")).digest("hex");
+}
+
+// src/fingerprint.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+function treeFingerprint(cwd) {
+  const files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 1 << 28,
+    env: trustedGitEnv()
+  }).split("\0").filter(Boolean).sort();
+  const h = createHash7("sha256");
+  for (const rel of files) {
+    h.update(rel);
+    h.update("\0");
+    try {
+      h.update(readFileSync12(join10(cwd, rel)));
+    } catch {
+      h.update("<unreadable>");
+    }
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+function depsFingerprint(cwd) {
+  const root = join10(cwd, "node_modules");
+  const h = createHash7("sha256");
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+      const p = join10(dir, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (e.isFile()) {
+        h.update(p);
+        try {
+          h.update(readFileSync12(p));
+          h.update(String(statSync5(p).mode));
+        } catch {
+          h.update("<unreadable>");
+        }
+      } else if (e.isSymbolicLink()) {
+        h.update(p);
+        try {
+          h.update(readlinkSync(p));
+        } catch {
+          h.update("<unreadable-link>");
+        }
+      }
+    }
+  };
+  try {
+    if (!statSync5(root).isDirectory()) return "none";
+  } catch {
+    return "none";
+  }
+  walk(root);
+  return h.digest("hex");
+}
+
+// src/cli/verify.ts
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
 var VERIFICATION_SURFACE = [
   // Python / pytest — read from the rootdir, and conftest at any depth
@@ -2927,7 +3166,7 @@ var VERIFICATION_SURFACE = [
   "**/*.runsettings"
 ];
 function git2(args, cwd) {
-  return execFileSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
+  return execFileSync6("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
@@ -2939,32 +3178,32 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd });
+  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join9(cwd, rel);
+    const src = join11(cwd, rel);
     let st;
     try {
-      st = statSync5(src);
+      st = statSync6(src);
     } catch {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join9(dest, rel);
+    const out2 = join11(dest, rel);
     mkdirSync6(dirname4(out2), { recursive: true });
     dropSymlink(out2);
     if (lstatSync(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync11(src));
+      writeFileSync6(out2, readFileSync13(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve(cwd, "node_modules");
-  if (existsSync8(nm)) symlinkSync(nm, join9(dest, "node_modules"), "dir");
+  if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -2972,29 +3211,77 @@ function dropSymlink(p) {
   } catch {
   }
 }
-function overlayPristine(cwd, base, dest, policy) {
-  const atBase = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd).split("\0").filter(Boolean);
-  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE);
-  let restored = 0;
+function verifierInputs(cmd, atBase, policy) {
+  const baseFiles = new Set(atBase);
+  const picked = /* @__PURE__ */ new Set();
+  for (const raw of cmd.split(/[\s;&|()<>]+/)) {
+    const tok = raw.replace(/^['"]|['"]$/g, "").replace(/^\.\//, "");
+    if (tok && baseFiles.has(tok)) picked.add(tok);
+  }
+  const globs = policy.verify?.inputs;
+  if (globs && globs.length) {
+    for (const rel of atBase) if (matchesAny(rel, globs)) picked.add(rel);
+  }
+  return picked;
+}
+function baseEntries(base, cwd) {
+  return git2(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
+    const tab = rec.indexOf("	");
+    const [mode, type] = rec.slice(0, tab).split(" ");
+    return { mode, type, path: rec.slice(tab + 1) };
+  });
+}
+function overlayDigest(dest, paths) {
+  const h = createHash8("sha256");
+  for (const rel of [...paths].sort()) {
+    h.update(rel);
+    h.update("\0");
+    const p = join11(dest, rel);
+    try {
+      const st = lstatSync(p);
+      h.update(String(st.mode));
+      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync13(p));
+    } catch {
+      h.update("<gone>");
+    }
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+function overlayPristine(cwd, base, dest, policy, cmd) {
+  const entries = baseEntries(base, cwd);
+  const atBase = entries.map((e) => e.path);
+  const verifierOwned = verifierInputs(cmd, atBase, policy);
+  const verifierGlobs = policy.verify?.inputs ?? [];
+  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
+  const restored = [];
   const baseProtected = /* @__PURE__ */ new Set();
-  for (const rel of atBase) {
-    if (!isOverlay(rel)) continue;
-    baseProtected.add(rel);
-    const content = execFileSync4("git", ["show", `${base}:${rel}`], { cwd, maxBuffer: 1 << 28 });
-    const out2 = join9(dest, rel);
+  for (const e of entries) {
+    if (!isOverlay(e.path)) continue;
+    baseProtected.add(e.path);
+    if (e.type === "commit") {
+      throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
+    }
+    const content = execFileSync6("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const out2 = join11(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
-    dropSymlink(out2);
-    writeFileSync6(out2, content);
-    restored++;
+    rmSync2(out2, { force: true });
+    if (e.mode === "120000") {
+      symlinkSync(content.toString("utf8"), out2);
+    } else {
+      writeFileSync6(out2, content);
+      chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
+    }
+    restored.push(e.path);
   }
   let removed = 0;
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync2(join9(dest, rel), { force: true });
+    rmSync2(join11(dest, rel), { force: true });
     removed++;
   }
-  return [restored, removed];
+  return { restored, removed };
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
@@ -3014,7 +3301,9 @@ function runVerify(opts) {
   const out2 = (s) => void process.stdout.write(s + "\n");
   let policy;
   try {
-    policy = opts.policyOverride ?? loadPolicy(cwd);
+    if (opts.policyOverride) policy = opts.policyOverride;
+    else if (opts.base) policy = loadPolicyAt(resolveBase(opts.base, cwd), cwd) ?? defaultPolicy();
+    else policy = loadPolicy(cwd);
   } catch (e) {
     out2(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
@@ -3030,7 +3319,9 @@ function runVerify(opts) {
   }
   const cmd = opts.cmd ?? policy.verify?.command;
   if (!cmd) {
-    out2("verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd");
+    out2(
+      opts.base ? "verify: no suite command in the policy at the trusted base \u2014 the base governs the verifier, so a `verify:` block added only on the candidate is not used. Add it at the base, or pass --cmd explicitly." : "verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd"
+    );
     return 2;
   }
   const budget = opts.budget ?? policy.verify?.budget ?? 300;
@@ -3041,25 +3332,63 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const work = mkdtempSync2(join9(tmpdir2(), "tw-verify-"));
-  const visDir = join9(work, "visible");
-  const priDir = join9(work, "pristine");
-  let restored = 0;
-  let removedAdded = 0;
+  const visRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join11(visRoot, "t");
+  const cleanup = (dirs) => {
+    if (opts.keep) return;
+    for (const d of dirs) rmSync2(d, { recursive: true, force: true });
+  };
+  const treeBefore = treeFingerprint(cwd);
+  const depsBefore = depsFingerprint(cwd);
   try {
     mkdirSync6(visDir);
-    mkdirSync6(priDir);
     materialize(cwd, visDir);
-    materialize(cwd, priDir);
-    [restored, removedAdded] = overlayPristine(cwd, base, priDir, policy);
   } catch (e) {
-    if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+    cleanup([visRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
   const visible = runSuite(visDir, cmd, budget);
+  if (treeFingerprint(cwd) !== treeBefore) {
+    cleanup([visRoot]);
+    out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
+    out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
+    return 2;
+  }
+  if (depsFingerprint(cwd) !== depsBefore) {
+    cleanup([visRoot]);
+    out2("verify: the installed dependency tree changed while the visible suite was running \u2014 the");
+    out2("pristine run executes through it too. Failing closed, not open.");
+    return 2;
+  }
+  const priRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join11(priRoot, "t");
+  let restored = [];
+  let removedAdded = 0;
+  try {
+    mkdirSync6(priDir);
+    materialize(cwd, priDir);
+    ({ restored, removed: removedAdded } = overlayPristine(cwd, base, priDir, policy, cmd));
+  } catch (e) {
+    cleanup([visRoot, priRoot]);
+    out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runSuite(priDir, cmd, budget);
-  if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+  const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
+  const treeMoved = treeFingerprint(cwd) !== treeBefore;
+  const depsMoved = depsFingerprint(cwd) !== depsBefore;
+  cleanup([visRoot, priRoot]);
+  if (overlayMoved || treeMoved || depsMoved) {
+    out2(
+      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the installed dependency tree changed while the pristine suite was running") + " \u2014"
+    );
+    out2("the verdict would describe something other than what ran. Failing closed, not open.");
+    out2("(A suite that rewrites its own snapshots or test files in place will trip this; run it in");
+    out2("whatever mode your runner calls CI, so verification observes rather than updates.)");
+    return 2;
+  }
   let verdict2;
   let code;
   if (visible.exit === null || pristine.exit === null) {
@@ -3084,15 +3413,15 @@ function runVerify(opts) {
         budget_secs: budget,
         visible: { exit: visible.exit, secs: visible.secs },
         pristine: { exit: pristine.exit, secs: pristine.secs },
-        protected_restored: restored,
+        protected_restored: restored.length,
         added_protected_removed: removedAdded,
-        ...opts.keep ? { workdir: work } : {}
+        ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
     );
   } else {
     const lines = {
-      VERIFIED: `verified: the suite passes, and still passes with all ${restored} protected files restored from ${base.slice(0, 10)}.`,
-      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
+      VERIFIED: `verified: the suite passes, and still passes with all ${restored.length} protected files restored from ${base.slice(0, 10)}.`,
+      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored.length} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
       SUITE_RED: `suite red: the visible suite fails (exit ${visible.exit}) \u2014 fix the code first (pristine exit ${pristine.exit}).`,
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
@@ -3120,72 +3449,17 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, realpathSync, statSync as statSync6 } from "node:fs";
-import { join as join10, resolve as resolve2 } from "node:path";
+import { execFileSync as execFileSync7, spawnSync as spawnSync2 } from "node:child_process";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
-  return execFileSync5("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
-}
-function treeFingerprint(cwd) {
-  const files = git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean).sort();
-  const h = createHash5("sha256");
-  for (const rel of files) {
-    h.update(rel);
-    h.update("\0");
-    try {
-      h.update(readFileSync12(join10(cwd, rel)));
-    } catch {
-      h.update("<unreadable>");
-    }
-    h.update("\0");
-  }
-  return h.digest("hex");
-}
-function depsFingerprint(cwd) {
-  const root = join10(cwd, "node_modules");
-  const h = createHash5("sha256");
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join10(dir, e.name);
-      if (e.isDirectory()) walk(p);
-      else if (e.isFile()) {
-        h.update(p);
-        try {
-          h.update(readFileSync12(p));
-          h.update(String(statSync6(p).mode));
-        } catch {
-          h.update("<unreadable>");
-        }
-      } else if (e.isSymbolicLink()) {
-        h.update(p);
-        try {
-          h.update(readlinkSync(p));
-        } catch {
-          h.update("<unreadable-link>");
-        }
-      }
-    }
-  };
-  try {
-    if (!statSync6(root).isDirectory()) return "none";
-  } catch {
-    return "none";
-  }
-  walk(root);
-  return h.digest("hex");
+  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync12("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -3200,7 +3474,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   }
   let pids;
   try {
-    pids = readdirSync3("/proc").filter((d) => /^\d+$/.test(d));
+    pids = readdirSync4("/proc").filter((d) => /^\d+$/.test(d));
   } catch {
     return out2;
   }
@@ -3215,7 +3489,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync12(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {
@@ -3262,11 +3536,30 @@ function runEnvelope(opts) {
   }
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
   const depsBefore = depsFingerprint(cwd);
+  const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
   const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
+  if (objectRewriteState(cwd) !== rewritesBefore) {
+    err("tamperward run: git object-replacement state changed during this run \u2014 a replace ref, graft");
+    err("or shallow boundary now redirects what the trusted base resolves to. Nothing below could be");
+    err("read against the anchor we started from. That is the finding.");
+    out(`
+tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
+    return 1;
+  }
+  if (depsFingerprint(cwd) !== depsBefore) {
+    err("tamperward run: the installed dependency tree changed before adjudication began \u2014 the program");
+    err("that runs the suite is not the one we started with, and both verification runs execute it.");
+    if (!opts.allowDepDrift) {
+      out(`
+tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEMENT_FAILED`);
+      return 1;
+    }
+    err("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
+  }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd });
+  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err("the agent rewrote history out from under the anchor. That is the finding.");
@@ -3287,7 +3580,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   if (opts.settle && opts.settle > 0) {
     try {
-      execFileSync5("sleep", [String(opts.settle)]);
+      execFileSync7("sleep", [String(opts.settle)]);
     } catch {
     }
   }
@@ -3301,16 +3594,21 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err("tamperward run: the installed dependency tree changed during this run \u2014 the program that");
     err("runs the suite is not the one we started with. Both verification runs execute it.");
   }
+  const rewrote = objectRewriteState(cwd) !== rewritesBefore;
+  if (rewrote) {
+    err("tamperward run: git object-replacement state changed WHILE the tree was being adjudicated \u2014");
+    err("the checks above read the trusted base through an object layer that has since moved.");
+  }
   const survivors = survivorsHoldingTree(cwd, spawnTicks);
   if (survivors.length) {
     err(`tamperward run: ${survivors.length} process(es) started during this run still hold the`);
     err(`working tree (pid ${survivors.join(", ")}). A verdict cannot outlive the tree it describes.`);
   }
-  const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted;
+  const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted || rewrote;
   const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1 || notQuiescent;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;
-  const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";
+  const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : rewrote ? "OBJECT_REWRITE \u2014 the base the checks read is not the base we anchored to" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";
   out(`
 tamperward run \u2014 agent exit ${agentExit}; checks diff=${diffCode} worktree=${workCode} verify=${verifyCode} \u2192 ${verdict2}`);
   return enforcement !== 0 ? enforcement : agentExit;
@@ -3364,6 +3662,7 @@ function parseInit(args) {
     const a = args[i];
     if (a === "--cwd") o.cwd = args[++i];
     else if (a === "--dry-run") o.dryRun = true;
+    else if (a === "--force-workflow") o.forceWorkflow = true;
   }
   return o;
 }
@@ -3427,9 +3726,15 @@ Formats:
                                             adjudicate (fails closed)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
   tamperward init [--dry-run]               wire the policy file plus every
-                                            enforcement point: Claude Code hooks,
+             [--force-workflow]             enforcement point: Claude Code hooks,
                                             pre-commit, CI. Idempotent; never
-                                            overwrites your files.
+                                            overwrites your files. Re-running it
+                                            MIGRATES a CI workflow it generated and
+                                            you have not edited, and widens a
+                                            PreToolUse matcher that no longer covers
+                                            every tool the gate must see.
+                                            --force-workflow replaces a workflow it
+                                            did not write, or one you have edited.
 
 Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.14.2",
+  "version": "1.14.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",