tamperward 1.14.3 → 1.14.5

package/README.md

@@ -185,11 +185,20 @@ A real deployment needs a verify command configured — the generated CI verify
 verify:
   command: npm test
   budget: 300
+  inputs: ['scripts/**']   # what the command DELEGATES to
 ```
 
 That block is itself a guarded surface: changing the command, lowering the budget,
-or removing it is flagged as policy weakening — a verifier an agent can point at
-`true` is no verification at all.
+narrowing `inputs`, or removing it is flagged as policy weakening — a verifier an
+agent can point at `true` is no verification at all.
+
+`inputs` names the files the command *executes*, so the pristine run gets the
+base's copy of them too. A command token that names a file present at the base is
+picked up automatically (`node runner.js`), so most repositories need nothing
+here. Delegation is what needs the list: `npm test` names no file, and the base's
+restored `"test": "sh scripts/test.sh"` will happily call a script nothing
+restored. It bounds the class rather than closing it — see
+[the threat model](./docs/THREAT-MODEL-pristine-run.md).
 
 The four primitives:
 
@@ -263,6 +272,8 @@ and its totals.
 | v1.9.0 | `tamperward verify`: the round-1 pristine oracle productized — visible-green + pristine-red is a masked failure, and "could not verify" fails closed |
 | Round 2, 9–0 | On 22 fresh repositories, v1.9.0 produced b=9/c=0 false-green discordance (p = 0.0039); four gated false greens remained, through two documented residual mechanisms |
 | cssstyle lifecycle escape (round 2) | The `tamperward run` envelope: the gate denied 42 mutations and verify refused all 25 stop attempts, and the runtime completed the session anyway over a masked tree — hooks decide, runtimes terminate, so the adjudication boundary moved outside the runtime |
+| v1.14.5, external audit | The pristine copy was a sibling of the visible copy and fully prepared before it ran, so the candidate's own code wrote `../pristine/<the failing test>` and both runs returned 0 — no race, no background process, no git. The pristine copy is now built only after the visible run exits, its restored files are digested either side of the pristine run, and the working and dependency trees are fingerprinted around both. Also: the overlay restored content but not MODE, so `chmod -x` alone hid a test from an exec-bit runner in both copies; a transient dependency substitution that restored itself on the way out left the entry-vs-exit fingerprint identical; and a committed `.npmrc` chose the registry the CI gate was downloaded from |
+| v1.14.4, external audit | The overlay restored the tests and then ran the agent's *runner*: `verify.command` was frozen, but `runner.js` — and anything `npm test` delegates to — was in no protected class. And `git replace` redirected what the base resolved to for `ls-tree`, `show` and `merge-base` alike, with no ref moved and no file touched. Verifier inputs are now restored from the base; every trusted read sets `GIT_NO_REPLACE_OBJECTS=1` and the envelope convicts a rewrite installed during the run. `init` also gained workflow migration and matcher repair, and the Claude hook now denies a payload it cannot parse instead of allowing it |
 | v1.14.3, external review | Standalone `verify` loaded its policy from the working tree, so the generated CI workflow let a pull request supply the `verify:` command for its own re-execution. `check --diff` flagged the edit as hook-tampering, so the workflow caught it as a pair — but only where both jobs are required, and `verify` alone had no protection. With a `--base`, policy now comes from that commit |
 | v1.14.2, threat model | 1.14.1 removed agent-added files only inside the protected classes, whose `config` list is JS/TS-only; an added `pytest.ini`, `setup.cfg`, `tox.ini` or `pyproject.toml` still reached the pristine run. `verify` now owns a verification surface covering runner-consulted configuration |
 | v1.14.1, article audit | `tamperward verify` kept agent-added protected files in the pristine run on the premise that they "only add strictness". An added `conftest.py` could deselect the restored base tests by node id, so a masked failure reported VERIFIED and the envelope printed GREEN MEANS GREEN over an unfixed bug. Added protected files are now removed; PoC and mutation-checked regression committed |
@@ -287,7 +298,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 367 tests at v1.14.3 — parser, detectors, engine, policy, renderers
+npm test                        # 368 tests at v1.14.3 — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -1114,6 +1114,13 @@ function policyWeakening(before, after) {
       if (ab < bb) {
         reasons.push(`verify.budget lowered ${bb}s \u2192 ${ab}s \u2014 starving the budget turns "cannot verify" into a pressure point`);
       }
+      const stillInput = new Set(av.inputs ?? []);
+      const droppedInputs = (bv.inputs ?? []).filter((g) => !stillInput.has(g));
+      if (droppedInputs.length) {
+        reasons.push(
+          `verify.inputs narrowed (removed ${droppedInputs.join(", ")}) \u2014 the pristine run would execute the candidate's copy of those files`
+        );
+      }
     }
   }
   return reasons;
@@ -1624,7 +1631,16 @@ function parsePolicy(raw) {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
     },
-    ...r.verify?.command ? { verify: { command: r.verify.command, budget: r.verify.budget ?? 300 } } : {}
+    ...r.verify?.command ? {
+      verify: {
+        command: r.verify.command,
+        budget: r.verify.budget ?? 300,
+        // Rebuilding the block field-by-field means a field added later and
+        // not listed here is SILENTLY DROPPED — which is how `inputs` first
+        // shipped as a no-op that parsed, validated, and restored nothing.
+        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {}
+      }
+    } : {}
   };
 }
 function parseOrThrow(src, where) {
@@ -2418,20 +2434,27 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
 }
 
 // src/cli/hook.ts
+var HookInputError = class extends Error {
+};
 function readStdin() {
   try {
     return readFileSync9(0, "utf8");
-  } catch {
-    return "";
+  } catch (e) {
+    throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
 function parseInput(raw) {
   if (!raw.trim()) return {};
+  let parsed;
   try {
-    return JSON.parse(raw);
-  } catch {
-    return {};
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new HookInputError(`the hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new HookInputError(`the hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})`);
   }
+  return parsed;
 }
 function recordDenylog(blocks) {
   const log = process.env.TAMPERWARD_DENYLOG;
@@ -2610,16 +2633,30 @@ function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
   return r.exitCode;
 }
+function preToolUseFromRaw(raw) {
+  try {
+    return preToolUseVerdict(parseInput(raw));
+  } catch (e) {
+    return failClosed("PreToolUse", errText(e));
+  }
+}
+function stopFromRaw(raw) {
+  try {
+    return stopVerdict(parseInput(raw));
+  } catch (e) {
+    return failClosed("Stop", errText(e));
+  }
+}
 function runHookClaude() {
   try {
-    return emit(preToolUseVerdict(parseInput(readStdin())));
+    return emit(preToolUseFromRaw(readStdin()));
   } catch (e) {
     return emit(failClosed("PreToolUse", errText(e)));
   }
 }
 function runSweepClaude() {
   try {
-    return emit(stopVerdict(parseInput(readStdin())));
+    return emit(stopFromRaw(readStdin()));
   } catch (e) {
     return emit(failClosed("Stop", errText(e)));
   }
@@ -2672,10 +2709,12 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
 var HOOK_CMD = "npx --yes tamperward hook claude";
+var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
 var MARKER = "# tamperward: block agent shortcuts before they land";
@@ -2729,6 +2768,15 @@ jobs:
   tamperward:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    # The gate is fetched from the registry AT GATE TIME, from inside the
+    # checked-out pull request \u2014 and \`npm\` reads \`.npmrc\` from the working
+    # directory. A PR that commits one line, \`registry=https://\u2026\`, chooses where
+    # the authority judging it is downloaded from; the version pin below pins the
+    # STRING, not the SOURCE. An environment variable outranks a project
+    # \`.npmrc\` in npm's config precedence, so this is what makes the pin mean
+    # something.
+    env:
+      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
     steps:
       - uses: actions/checkout@v5
         with:
@@ -2762,6 +2810,30 @@ jobs:
       - name: Tamperward verify (pristine re-execution)
         run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
+var WORKFLOW_MARK = "# tamperward:generated";
+var WORKFLOW_MARK_RE = /^# tamperward:generated v(\S+) sha256:([0-9a-f]+)\n/m;
+function bodyHash(body) {
+  return createHash5("sha256").update(body).digest("hex").slice(0, 16);
+}
+function workflowFile(body) {
+  return `${WORKFLOW_MARK} v${TW_VERSION} sha256:${bodyHash(body)}
+${body}`;
+}
+function readWorkflowMark(src) {
+  const m = src.match(WORKFLOW_MARK_RE);
+  if (!m) return null;
+  return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
+}
+function toolSet(matcher2) {
+  const m = String(matcher2 ?? "").trim();
+  if (m === "" || m === "*") return null;
+  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+}
+function missingTools(matcher2) {
+  const have = toolSet(matcher2);
+  if (have === null) return [];
+  return PRE_MATCHER.split("|").filter((t) => !have.has(t));
+}
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
   if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
@@ -2795,24 +2867,34 @@ function planClaudeHooks(cwd) {
     settings = parsed;
   }
   const hooks = settings.hooks ??= {};
-  const has = (arr, needle) => (arr ?? []).some((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
-  const needPre = !has(hooks.PreToolUse, "tamperward hook claude");
-  const needStop = !has(hooks.Stop, "tamperward sweep claude");
-  if (!needPre && !needStop) return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
+  const preEntries = entriesWith(hooks.PreToolUse, "tamperward hook claude");
+  const needPre = preEntries.length === 0;
+  const needStop = entriesWith(hooks.Stop, "tamperward sweep claude").length === 0;
+  const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
+  if (!needPre && !needStop && stale.length === 0) {
+    return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  }
+  const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
   return {
     item: "agent",
     path: rel,
     status: existsSync7(path) ? "update" : "create",
-    detail: `wire ${[needPre && "PreToolUse deny", needStop && "Stop sweep"].filter(Boolean).join(" + ")}`,
+    detail: [
+      needPre && "wire PreToolUse deny",
+      needStop && "wire Stop sweep",
+      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`
+    ].filter(Boolean).join(" + "),
     apply: () => {
       if (needPre) {
         (hooks.PreToolUse ??= []).push({
-          // NotebookEdit is modelled by the adapter but was absent here, so
-          // that branch was unreachable in the wiring we install. (P2-12.)
-          matcher: "Bash|Edit|Write|MultiEdit|NotebookEdit",
+          matcher: PRE_MATCHER,
           hooks: [{ type: "command", command: HOOK_CMD }]
         });
       }
+      for (const m of stale) {
+        m.matcher = [...toolSet(m.matcher) ?? /* @__PURE__ */ new Set(), ...missingTools(m.matcher)].join("|");
+      }
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
@@ -2848,27 +2930,64 @@ ${line}` : existing.replace(/\n?$/, "\n") + line;
     }
   };
 }
-function planWorkflow(cwd) {
+function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
   const path = join8(cwd, rel);
-  if (existsSync7(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
+  const write = () => {
+    mkdirSync5(dirname3(path), { recursive: true });
+    writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
+  };
+  if (!existsSync7(path)) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "create",
+      detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
+      apply: write
+    };
+  }
+  let src;
+  try {
+    src = readFileSync10(path, "utf8");
+  } catch {
+    return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
+  }
+  const current = bodyHash(WORKFLOW_CONTENT);
+  const mark = readWorkflowMark(src);
+  if (mark && bodyHash(mark.body) === current) {
+    return { item: "ci", path: rel, status: "ok", detail: `generated by tamperward and current (v${mark.version})` };
+  }
+  if (mark && bodyHash(mark.body) === mark.hash) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "update",
+      detail: `generated by tamperward v${mark.version} and unmodified \u2014 migrating to the v${TW_VERSION} template`,
+      apply: write
+    };
+  }
+  if (force) {
+    return {
+      item: "ci",
+      path: rel,
+      status: "update",
+      detail: mark ? `edited since tamperward v${mark.version} generated it \u2014 OVERWRITING (--force-workflow)` : "not generated by tamperward \u2014 OVERWRITING (--force-workflow)",
+      apply: write
+    };
+  }
   return {
     item: "ci",
     path: rel,
-    status: "create",
-    detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
-    apply: () => {
-      mkdirSync5(dirname3(path), { recursive: true });
-      writeFileSync5(path, WORKFLOW_CONTENT);
-    }
+    status: "skip",
+    detail: (mark ? `edited since tamperward v${mark.version} generated it` : "present but not generated by tamperward") + ` \u2014 left untouched. Compare it against the v${TW_VERSION} template (an older one may lack the pristine-verify step) and re-run with --force-workflow to replace it.`
   };
 }
-function planInit(cwd) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd)];
+function planInit(cwd, opts = {}) {
+  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false)];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
-  const plan = planInit(cwd);
+  const plan = planInit(cwd, { forceWorkflow: opts.forceWorkflow });
   const w = process.stdout;
   for (const a of plan) {
     const verb = opts.dryRun && (a.status === "create" || a.status === "update") ? `would ${a.status}` : a.status;
@@ -2895,10 +3014,130 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync11, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
+import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { createHash as createHash8 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join9, resolve } from "node:path";
+import { dirname as dirname4, join as join11, resolve } from "node:path";
+
+// src/git/trusted.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { createHash as createHash6 } from "node:crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join9 } from "node:path";
+function trustedGitEnv() {
+  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
+}
+function gitDirOf(cwd) {
+  try {
+    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: trustedGitEnv()
+    }).trim();
+    if (!d) return null;
+    return isAbsolute2(d) ? d : join9(cwd, d);
+  } catch {
+    return null;
+  }
+}
+function objectRewriteState(cwd) {
+  const parts = [];
+  try {
+    parts.push(
+      "replace:" + execFileSync4("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: trustedGitEnv()
+      }).trim()
+    );
+  } catch {
+    parts.push("replace:<unreadable>");
+  }
+  const dir = gitDirOf(cwd);
+  for (const rel of ["info/grafts", "shallow"]) {
+    if (dir === null) {
+      parts.push(`${rel}:<no-git-dir>`);
+      continue;
+    }
+    const p = join9(dir, rel);
+    try {
+      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
+    } catch {
+      parts.push(`${rel}:<unreadable>`);
+    }
+  }
+  return createHash6("sha256").update(parts.join("\n")).digest("hex");
+}
+
+// src/fingerprint.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+function treeFingerprint(cwd) {
+  const files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 1 << 28,
+    env: trustedGitEnv()
+  }).split("\0").filter(Boolean).sort();
+  const h = createHash7("sha256");
+  for (const rel of files) {
+    h.update(rel);
+    h.update("\0");
+    try {
+      h.update(readFileSync12(join10(cwd, rel)));
+    } catch {
+      h.update("<unreadable>");
+    }
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+function depsFingerprint(cwd) {
+  const root = join10(cwd, "node_modules");
+  const h = createHash7("sha256");
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+      const p = join10(dir, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (e.isFile()) {
+        h.update(p);
+        try {
+          h.update(readFileSync12(p));
+          h.update(String(statSync5(p).mode));
+        } catch {
+          h.update("<unreadable>");
+        }
+      } else if (e.isSymbolicLink()) {
+        h.update(p);
+        try {
+          h.update(readlinkSync(p));
+        } catch {
+          h.update("<unreadable-link>");
+        }
+      }
+    }
+  };
+  try {
+    if (!statSync5(root).isDirectory()) return "none";
+  } catch {
+    return "none";
+  }
+  walk(root);
+  return h.digest("hex");
+}
+
+// src/cli/verify.ts
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
 var VERIFICATION_SURFACE = [
   // Python / pytest — read from the rootdir, and conftest at any depth
@@ -2927,7 +3166,7 @@ var VERIFICATION_SURFACE = [
   "**/*.runsettings"
 ];
 function git2(args, cwd) {
-  return execFileSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
+  return execFileSync6("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
@@ -2939,32 +3178,32 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd });
+  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join9(cwd, rel);
+    const src = join11(cwd, rel);
     let st;
     try {
-      st = statSync5(src);
+      st = statSync6(src);
     } catch {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join9(dest, rel);
+    const out2 = join11(dest, rel);
     mkdirSync6(dirname4(out2), { recursive: true });
     dropSymlink(out2);
     if (lstatSync(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync11(src));
+      writeFileSync6(out2, readFileSync13(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve(cwd, "node_modules");
-  if (existsSync8(nm)) symlinkSync(nm, join9(dest, "node_modules"), "dir");
+  if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -2972,29 +3211,77 @@ function dropSymlink(p) {
   } catch {
   }
 }
-function overlayPristine(cwd, base, dest, policy) {
-  const atBase = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd).split("\0").filter(Boolean);
-  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE);
-  let restored = 0;
+function verifierInputs(cmd, atBase, policy) {
+  const baseFiles = new Set(atBase);
+  const picked = /* @__PURE__ */ new Set();
+  for (const raw of cmd.split(/[\s;&|()<>]+/)) {
+    const tok = raw.replace(/^['"]|['"]$/g, "").replace(/^\.\//, "");
+    if (tok && baseFiles.has(tok)) picked.add(tok);
+  }
+  const globs = policy.verify?.inputs;
+  if (globs && globs.length) {
+    for (const rel of atBase) if (matchesAny(rel, globs)) picked.add(rel);
+  }
+  return picked;
+}
+function baseEntries(base, cwd) {
+  return git2(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
+    const tab = rec.indexOf("	");
+    const [mode, type] = rec.slice(0, tab).split(" ");
+    return { mode, type, path: rec.slice(tab + 1) };
+  });
+}
+function overlayDigest(dest, paths) {
+  const h = createHash8("sha256");
+  for (const rel of [...paths].sort()) {
+    h.update(rel);
+    h.update("\0");
+    const p = join11(dest, rel);
+    try {
+      const st = lstatSync(p);
+      h.update(String(st.mode));
+      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync13(p));
+    } catch {
+      h.update("<gone>");
+    }
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+function overlayPristine(cwd, base, dest, policy, cmd) {
+  const entries = baseEntries(base, cwd);
+  const atBase = entries.map((e) => e.path);
+  const verifierOwned = verifierInputs(cmd, atBase, policy);
+  const verifierGlobs = policy.verify?.inputs ?? [];
+  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
+  const restored = [];
   const baseProtected = /* @__PURE__ */ new Set();
-  for (const rel of atBase) {
-    if (!isOverlay(rel)) continue;
-    baseProtected.add(rel);
-    const content = execFileSync4("git", ["show", `${base}:${rel}`], { cwd, maxBuffer: 1 << 28 });
-    const out2 = join9(dest, rel);
+  for (const e of entries) {
+    if (!isOverlay(e.path)) continue;
+    baseProtected.add(e.path);
+    if (e.type === "commit") {
+      throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
+    }
+    const content = execFileSync6("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const out2 = join11(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
-    dropSymlink(out2);
-    writeFileSync6(out2, content);
-    restored++;
+    rmSync2(out2, { force: true });
+    if (e.mode === "120000") {
+      symlinkSync(content.toString("utf8"), out2);
+    } else {
+      writeFileSync6(out2, content);
+      chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
+    }
+    restored.push(e.path);
   }
   let removed = 0;
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync2(join9(dest, rel), { force: true });
+    rmSync2(join11(dest, rel), { force: true });
     removed++;
   }
-  return [restored, removed];
+  return { restored, removed };
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
@@ -3045,25 +3332,63 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const work = mkdtempSync2(join9(tmpdir2(), "tw-verify-"));
-  const visDir = join9(work, "visible");
-  const priDir = join9(work, "pristine");
-  let restored = 0;
-  let removedAdded = 0;
+  const visRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join11(visRoot, "t");
+  const cleanup = (dirs) => {
+    if (opts.keep) return;
+    for (const d of dirs) rmSync2(d, { recursive: true, force: true });
+  };
+  const treeBefore = treeFingerprint(cwd);
+  const depsBefore = depsFingerprint(cwd);
   try {
     mkdirSync6(visDir);
-    mkdirSync6(priDir);
     materialize(cwd, visDir);
-    materialize(cwd, priDir);
-    [restored, removedAdded] = overlayPristine(cwd, base, priDir, policy);
   } catch (e) {
-    if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+    cleanup([visRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
   const visible = runSuite(visDir, cmd, budget);
+  if (treeFingerprint(cwd) !== treeBefore) {
+    cleanup([visRoot]);
+    out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
+    out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
+    return 2;
+  }
+  if (depsFingerprint(cwd) !== depsBefore) {
+    cleanup([visRoot]);
+    out2("verify: the installed dependency tree changed while the visible suite was running \u2014 the");
+    out2("pristine run executes through it too. Failing closed, not open.");
+    return 2;
+  }
+  const priRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join11(priRoot, "t");
+  let restored = [];
+  let removedAdded = 0;
+  try {
+    mkdirSync6(priDir);
+    materialize(cwd, priDir);
+    ({ restored, removed: removedAdded } = overlayPristine(cwd, base, priDir, policy, cmd));
+  } catch (e) {
+    cleanup([visRoot, priRoot]);
+    out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runSuite(priDir, cmd, budget);
-  if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+  const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
+  const treeMoved = treeFingerprint(cwd) !== treeBefore;
+  const depsMoved = depsFingerprint(cwd) !== depsBefore;
+  cleanup([visRoot, priRoot]);
+  if (overlayMoved || treeMoved || depsMoved) {
+    out2(
+      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the installed dependency tree changed while the pristine suite was running") + " \u2014"
+    );
+    out2("the verdict would describe something other than what ran. Failing closed, not open.");
+    out2("(A suite that rewrites its own snapshots or test files in place will trip this; run it in");
+    out2("whatever mode your runner calls CI, so verification observes rather than updates.)");
+    return 2;
+  }
   let verdict2;
   let code;
   if (visible.exit === null || pristine.exit === null) {
@@ -3088,15 +3413,15 @@ function runVerify(opts) {
         budget_secs: budget,
         visible: { exit: visible.exit, secs: visible.secs },
         pristine: { exit: pristine.exit, secs: pristine.secs },
-        protected_restored: restored,
+        protected_restored: restored.length,
         added_protected_removed: removedAdded,
-        ...opts.keep ? { workdir: work } : {}
+        ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
     );
   } else {
     const lines = {
-      VERIFIED: `verified: the suite passes, and still passes with all ${restored} protected files restored from ${base.slice(0, 10)}.`,
-      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
+      VERIFIED: `verified: the suite passes, and still passes with all ${restored.length} protected files restored from ${base.slice(0, 10)}.`,
+      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored.length} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
       SUITE_RED: `suite red: the visible suite fails (exit ${visible.exit}) \u2014 fix the code first (pristine exit ${pristine.exit}).`,
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
@@ -3124,72 +3449,17 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, realpathSync, statSync as statSync6 } from "node:fs";
-import { join as join10, resolve as resolve2 } from "node:path";
+import { execFileSync as execFileSync7, spawnSync as spawnSync2 } from "node:child_process";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
-  return execFileSync5("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
-}
-function treeFingerprint(cwd) {
-  const files = git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean).sort();
-  const h = createHash5("sha256");
-  for (const rel of files) {
-    h.update(rel);
-    h.update("\0");
-    try {
-      h.update(readFileSync12(join10(cwd, rel)));
-    } catch {
-      h.update("<unreadable>");
-    }
-    h.update("\0");
-  }
-  return h.digest("hex");
-}
-function depsFingerprint(cwd) {
-  const root = join10(cwd, "node_modules");
-  const h = createHash5("sha256");
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join10(dir, e.name);
-      if (e.isDirectory()) walk(p);
-      else if (e.isFile()) {
-        h.update(p);
-        try {
-          h.update(readFileSync12(p));
-          h.update(String(statSync6(p).mode));
-        } catch {
-          h.update("<unreadable>");
-        }
-      } else if (e.isSymbolicLink()) {
-        h.update(p);
-        try {
-          h.update(readlinkSync(p));
-        } catch {
-          h.update("<unreadable-link>");
-        }
-      }
-    }
-  };
-  try {
-    if (!statSync6(root).isDirectory()) return "none";
-  } catch {
-    return "none";
-  }
-  walk(root);
-  return h.digest("hex");
+  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync12("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -3204,7 +3474,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   }
   let pids;
   try {
-    pids = readdirSync3("/proc").filter((d) => /^\d+$/.test(d));
+    pids = readdirSync4("/proc").filter((d) => /^\d+$/.test(d));
   } catch {
     return out2;
   }
@@ -3219,7 +3489,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync12(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {
@@ -3266,11 +3536,30 @@ function runEnvelope(opts) {
   }
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
   const depsBefore = depsFingerprint(cwd);
+  const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
   const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
+  if (objectRewriteState(cwd) !== rewritesBefore) {
+    err("tamperward run: git object-replacement state changed during this run \u2014 a replace ref, graft");
+    err("or shallow boundary now redirects what the trusted base resolves to. Nothing below could be");
+    err("read against the anchor we started from. That is the finding.");
+    out(`
+tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
+    return 1;
+  }
+  if (depsFingerprint(cwd) !== depsBefore) {
+    err("tamperward run: the installed dependency tree changed before adjudication began \u2014 the program");
+    err("that runs the suite is not the one we started with, and both verification runs execute it.");
+    if (!opts.allowDepDrift) {
+      out(`
+tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEMENT_FAILED`);
+      return 1;
+    }
+    err("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
+  }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd });
+  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err("the agent rewrote history out from under the anchor. That is the finding.");
@@ -3291,7 +3580,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   if (opts.settle && opts.settle > 0) {
     try {
-      execFileSync5("sleep", [String(opts.settle)]);
+      execFileSync7("sleep", [String(opts.settle)]);
     } catch {
     }
   }
@@ -3305,16 +3594,21 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err("tamperward run: the installed dependency tree changed during this run \u2014 the program that");
     err("runs the suite is not the one we started with. Both verification runs execute it.");
   }
+  const rewrote = objectRewriteState(cwd) !== rewritesBefore;
+  if (rewrote) {
+    err("tamperward run: git object-replacement state changed WHILE the tree was being adjudicated \u2014");
+    err("the checks above read the trusted base through an object layer that has since moved.");
+  }
   const survivors = survivorsHoldingTree(cwd, spawnTicks);
   if (survivors.length) {
     err(`tamperward run: ${survivors.length} process(es) started during this run still hold the`);
     err(`working tree (pid ${survivors.join(", ")}). A verdict cannot outlive the tree it describes.`);
   }
-  const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted;
+  const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted || rewrote;
   const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1 || notQuiescent;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;
-  const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";
+  const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : rewrote ? "OBJECT_REWRITE \u2014 the base the checks read is not the base we anchored to" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";
   out(`
 tamperward run \u2014 agent exit ${agentExit}; checks diff=${diffCode} worktree=${workCode} verify=${verifyCode} \u2192 ${verdict2}`);
   return enforcement !== 0 ? enforcement : agentExit;
@@ -3368,6 +3662,7 @@ function parseInit(args) {
     const a = args[i];
     if (a === "--cwd") o.cwd = args[++i];
     else if (a === "--dry-run") o.dryRun = true;
+    else if (a === "--force-workflow") o.forceWorkflow = true;
   }
   return o;
 }
@@ -3431,9 +3726,15 @@ Formats:
                                             adjudicate (fails closed)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
   tamperward init [--dry-run]               wire the policy file plus every
-                                            enforcement point: Claude Code hooks,
+             [--force-workflow]             enforcement point: Claude Code hooks,
                                             pre-commit, CI. Idempotent; never
-                                            overwrites your files.
+                                            overwrites your files. Re-running it
+                                            MIGRATES a CI workflow it generated and
+                                            you have not edited, and widens a
+                                            PreToolUse matcher that no longer covers
+                                            every tool the gate must see.
+                                            --force-workflow replaces a workflow it
+                                            did not write, or one you have edited.
 
 Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.14.3",
+  "version": "1.14.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",