tamperward 1.14.5 → 1.14.6

package/README.md

@@ -173,9 +173,18 @@ Full assumptions and residual risks: [SPEC.md](./SPEC.md),
 npx tamperward init
 ```
 
-One idempotent command wires the policy, the agent hooks, the pre-commit hook, and
-a CI workflow that runs both the diff-time check and pristine verification. It
-never overwrites anything you wrote; `--dry-run` prints the plan.
+One idempotent command wires the policy, the agent hooks, the pre-commit hook, a
+CI workflow that runs both the diff-time check and pristine verification, and a
+`CODEOWNERS` requirement on the paths that decide whether the gate runs at all.
+It never overwrites anything you wrote; `--dry-run` prints the plan.
+
+**`init` is not sufficient on its own, and it will tell you so.** In your
+branch-protection or ruleset settings you must require the check *and* enable
+"Require review from Code Owners". A `pull_request` workflow runs from the pull
+request's own head and a required check is matched by job name, so without that
+a PR can keep the job name, replace the gate with `true`, and present a green
+required check over a change the gate would have blocked. That is reproduced on
+this project's own CI, not a theoretical concern.
 
 A real deployment needs a verify command configured — the generated CI verify step
 **fails closed (exit 2) without one** rather than passing quietly. In
@@ -272,6 +281,7 @@ and its totals.
 | v1.9.0 | `tamperward verify`: the round-1 pristine oracle productized — visible-green + pristine-red is a masked failure, and "could not verify" fails closed |
 | Round 2, 9–0 | On 22 fresh repositories, v1.9.0 produced b=9/c=0 false-green discordance (p = 0.0039); four gated false greens remained, through two documented residual mechanisms |
 | cssstyle lifecycle escape (round 2) | The `tamperward run` envelope: the gate denied 42 mutations and verify refused all 25 stop attempts, and the runtime completed the session anyway over a masked tree — hooks decide, runtimes terminate, so the adjudication boundary moved outside the runtime |
+| v1.14.6, external audit | A pull request can neuter the gate that judges it: `pull_request` workflows run from the PR's own head and required checks match by job name, so a job that keeps its name and runs `true` reports green over anything. Reproduced on this repo's own CI — `gate` succeeded in three seconds over a PR that lowered a mechanical rule to warn. No detector can close it, because the detector is defined by the candidate; `init` now writes a CODEOWNERS requirement on the gate-critical paths and states, every run, that branch protection is the half it cannot set for you |
 | v1.14.5, external audit | The pristine copy was a sibling of the visible copy and fully prepared before it ran, so the candidate's own code wrote `../pristine/<the failing test>` and both runs returned 0 — no race, no background process, no git. The pristine copy is now built only after the visible run exits, its restored files are digested either side of the pristine run, and the working and dependency trees are fingerprinted around both. Also: the overlay restored content but not MODE, so `chmod -x` alone hid a test from an exec-bit runner in both copies; a transient dependency substitution that restored itself on the way out left the entry-vs-exit fingerprint identical; and a committed `.npmrc` chose the registry the CI gate was downloaded from |
 | v1.14.4, external audit | The overlay restored the tests and then ran the agent's *runner*: `verify.command` was frozen, but `runner.js` — and anything `npm test` delegates to — was in no protected class. And `git replace` redirected what the base resolved to for `ls-tree`, `show` and `merge-base` alike, with no ref moved and no file touched. Verifier inputs are now restored from the base; every trusted read sets `GIT_NO_REPLACE_OBJECTS=1` and the envelope convicts a rewrite installed during the run. `init` also gained workflow migration and matcher repair, and the Claude hook now denies a payload it cannot parse instead of allowing it |
 | v1.14.3, external review | Standalone `verify` loaded its policy from the working tree, so the generated CI workflow let a pull request supply the `verify:` command for its own re-execution. `check --diff` flagged the edit as hook-tampering, so the workflow caught it as a pair — but only where both jobs are required, and `verify` alone had no protection. With a `--base`, policy now comes from that commit |

package/dist/cli/index.js

@@ -510,7 +510,14 @@ function defaultPolicy(version = 1) {
         "**/.tamperward.yml",
         ".claude/settings.json",
         ".claude/settings.local.json",
-        "**/.pre-commit-config.yaml"
+        "**/.pre-commit-config.yaml",
+        // CODEOWNERS is enforcement wiring, not documentation: it is the only
+        // thing that can require a human on a change to the workflow that
+        // decides whether the gate runs at all. GitHub reads it from any of
+        // these three locations. (H2.)
+        ".github/CODEOWNERS",
+        "CODEOWNERS",
+        "docs/CODEOWNERS"
       ]
     },
     rules: {
@@ -2709,6 +2716,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
@@ -2718,6 +2726,32 @@ var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
 var MARKER = "# tamperward: block agent shortcuts before they land";
+var CODEOWNERS_MARK = "# tamperward: the gate cannot guard the file that defines it";
+var CODEOWNERS_PATHS = ["/.github/workflows/", "/.tamperward.yml", "/.github/CODEOWNERS"];
+function coveredBy(existing, critical) {
+  for (const line of existing.split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const pattern = t.split(/\s+/)[0];
+    if (!t.slice(pattern.length).trim()) continue;
+    if (pattern === "*" || pattern === critical) return true;
+    if (pattern.endsWith("/") && critical.startsWith(pattern)) return true;
+  }
+  return false;
+}
+function inferOwner(cwd) {
+  try {
+    const url = execFileSync4("git", ["remote", "get-url", "origin"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const m = url.match(/github\.com[:/]+([^/]+)\//);
+    return m ? `@${m[1]}` : null;
+  } catch {
+    return null;
+  }
+}
 var POLICY_CONTENT = `# Tamperward policy. The BASELINE (all rules, standard protected globs) applies even
 # without this file \u2014 everything here is an override, so an empty file changes nothing.
 # Docs: https://github.com/hexrift/tamperward#readme
@@ -2930,6 +2964,35 @@ ${line}` : existing.replace(/\n?$/, "\n") + line;
     }
   };
 }
+function planCodeowners(cwd) {
+  const rel = ".github/CODEOWNERS";
+  const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
+    (r) => existsSync7(join8(cwd, r))
+  );
+  const path = join8(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync10(path, "utf8") : null;
+  const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
+  if (missing.length === 0) {
+    return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
+  }
+  const owner = inferOwner(cwd);
+  const block = `
+${CODEOWNERS_MARK}
+# A pull request that rewrites the workflow can keep the job name, replace the
+# gate with \`true\`, and still report a green required check. Only a human
+# requirement on these paths prevents that.
+` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
+  return {
+    item: "codeowners",
+    path: existingRel ?? rel,
+    status: existing === null ? "create" : "update",
+    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner})`),
+    apply: () => {
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block);
+    }
+  };
+}
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
   const path = join8(cwd, rel);
@@ -2983,7 +3046,7 @@ function planWorkflow(cwd, force) {
   };
 }
 function planInit(cwd, opts = {}) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false)];
+  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false), planCodeowners(cwd)];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -3010,18 +3073,21 @@ tamperward init: ${changed} change(s) planned. Re-run without --dry-run to apply
 tamperward init: ${changed} change(s) applied. Commit them so the gate travels with the repo.
 `
   );
+  w.write(
+    '\nONE STEP LEFT, AND IT IS NOT OPTIONAL. In your branch-protection or ruleset\nsettings for the default branch, require the tamperward check AND enable\n"Require review from Code Owners".\n\nUntil you do, the CI gate is advisory. A pull request runs the workflow from\nits OWN head, and a required check is matched by job name \u2014 so a pull request\ncan keep the job called `tamperward`, replace the gate with `true`, and present\na green required check over a change the gate would have blocked. That is\nreproduced, not theoretical. CODEOWNERS is what puts a human in front of it;\nbranch protection is what makes CODEOWNERS bind.\n'
+  );
   return 0;
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname4, join as join11, resolve } from "node:path";
 
 // src/git/trusted.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join9 } from "node:path";
@@ -3030,7 +3096,7 @@ function trustedGitEnv() {
 }
 function gitDirOf(cwd) {
   try {
-    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync5("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -3046,7 +3112,7 @@ function objectRewriteState(cwd) {
   const parts = [];
   try {
     parts.push(
-      "replace:" + execFileSync4("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+      "replace:" + execFileSync5("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -3073,12 +3139,12 @@ function objectRewriteState(cwd) {
 }
 
 // src/fingerprint.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
 import { join as join10 } from "node:path";
 function treeFingerprint(cwd) {
-  const files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 1 << 28,
@@ -3166,7 +3232,7 @@ var VERIFICATION_SURFACE = [
   "**/*.runsettings"
 ];
 function git2(args, cwd) {
-  return execFileSync6("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
@@ -3262,7 +3328,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     if (e.type === "commit") {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
-    const content = execFileSync6("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const content = execFileSync7("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out2 = join11(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
     rmSync2(out2, { force: true });
@@ -3449,13 +3515,13 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync7, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
-  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
@@ -3580,7 +3646,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   if (opts.settle && opts.settle > 0) {
     try {
-      execFileSync7("sleep", [String(opts.settle)]);
+      execFileSync8("sleep", [String(opts.settle)]);
     } catch {
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.14.5",
+  "version": "1.14.6",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",