tamperward 1.14.5 → 1.15.0

package/README.md

@@ -43,7 +43,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 
 > **Scope.** The rows above are one model, one pressure prompt, one JS/TS
 > ecosystem — evidence for that setting, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v1.14.3** adds post-study envelope hardening
+> the v1.9.0 stack; the current **v1.15.0** adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -148,15 +148,28 @@ semantic correctness nor a substitute for independent held-out tests.
 
 ### CI authority
 
-Pre-commit is an early backstop; protected CI is the merge authority. CI runs, independently:
+Pre-commit is an early backstop; protected CI is the merge authority. Two workflows
+are involved here, and they are not the same thing.
 
-1. `check --diff base...head`, with policy from the trusted merge-base; and
+**The shipped workflow** — the one `tamperward init` writes into your repository as
+`.github/workflows/tamperward.yml` — runs, independently:
+
+1. `check --diff base.sha...head.sha`, with policy from the trusted merge-base; and
 2. `verify --require-ancestor --base <base-sha>`, which since **1.14.3** also reads
    its policy, verification surface and verifier command and budget from that same
-   trusted base — so neither job's verdict is governed by the candidate.
+   trusted base — so neither step's verdict is governed by the candidate.
+
+Legitimate exceptions are out-of-band PR labels, `tamperward:allow:<rule>@<head-sha>`.
+The workflow passes the head SHA to the gate through `TAMPERWARD_OOB_HEAD`, so an
+approval is bound to the exact commit it was granted for and a new push invalidates it.
 
-Legitimate exceptions are out-of-band PR labels bound to the exact head SHA; a new
-push invalidates the approval.
+**This repository's own self-gate** — the `gate` job in `.github/workflows/ci.yml` —
+runs the built CLI's `check --diff` over the pull-request range, cleared only by the
+same label channel, but does **not** run `verify` on itself. This repo's test
+expectations legitimately change whenever a rule changes, and standalone `verify` has
+no out-of-band sign-off channel, so a pristine re-execution of its own suite would fail
+closed on exactly the pull requests that improve the gate. The self-gate is a
+diff-time gate.
 
 This guarantee depends on a protected and immutable base, required status checks, a
 pinned Tamperward version, and label permissions restricted to trusted humans.
@@ -173,9 +186,18 @@ Full assumptions and residual risks: [SPEC.md](./SPEC.md),
 npx tamperward init
 ```
 
-One idempotent command wires the policy, the agent hooks, the pre-commit hook, and
-a CI workflow that runs both the diff-time check and pristine verification. It
-never overwrites anything you wrote; `--dry-run` prints the plan.
+One idempotent command wires the policy, the agent hooks, the pre-commit hook, a
+CI workflow that runs both the diff-time check and pristine verification, and a
+`CODEOWNERS` requirement on the paths that decide whether the gate runs at all.
+It never overwrites anything you wrote; `--dry-run` prints the plan.
+
+**`init` is not sufficient on its own, and it will tell you so.** In your
+branch-protection or ruleset settings you must require the check *and* enable
+"Require review from Code Owners". A `pull_request` workflow runs from the pull
+request's own head and a required check is matched by job name, so without that
+a PR can keep the job name, replace the gate with `true`, and present a green
+required check over a change the gate would have blocked. That is reproduced on
+this project's own CI, not a theoretical concern.
 
 A real deployment needs a verify command configured — the generated CI verify step
 **fails closed (exit 2) without one** rather than passing quietly. In
@@ -209,9 +231,50 @@ npx tamperward verify --base main            # pristine-suite re-execution
 npx tamperward run -- <agent command...>     # the outer envelope around an agent
 ```
 
+### CLI reference
+
+Every flag below is what the command's parser actually reads (`src/cli/index.ts`,
+`parseVerify`, `parseRun`). `check` reports an unknown flag on stderr; the other
+commands ignore what they do not know.
+
+| command | flags |
+| --- | --- |
+| `check` | one view — `--staged` · `--worktree` · `--diff <base>...<head>` — plus `--format text\|json\|github\|auto` (default `auto`) · `--json` (alias for `--format json`) · `--cwd <dir>` |
+| `verify` | `--base <rev>` (default `HEAD`) · `--cmd <suite command>` · `--budget <seconds>` · `--json` · `--keep` (keep the two materialised copies and report their paths) · `--require-ancestor` (refuse a base that is not an ancestor of `HEAD`) · `--cwd <dir>` |
+| `run` | `--base <rev>` · `--cmd <suite command>` · `--budget <seconds>` · `--allow-dirty` · `--settle <seconds>` (wait before the final quiescence check) · `--allow-dep-drift` · `--cwd <dir>` · then `-- <agent command...>` |
+| `allow` | `<rule>` · `--file <path>` · `--reason "<why>"` (required) · `--cwd <dir>` |
+| `init` | `--cwd <dir>` · `--dry-run` · `--force-workflow` |
+| `watch` | `--dir <dir>` · `--log <file>` — a daemon; it runs until signalled |
+| `hook claude` / `sweep claude` | none — the Claude Code payload arrives on stdin |
+
+**Exit codes** — part of the public surface:
+
+| command | 0 | 1 | 2 |
+| --- | --- | --- | --- |
+| `check` | no blocking finding | at least one blocking finding | cannot evaluate: policy parse error, malformed `--diff` range, or no view given |
+| `verify` | `VERIFIED` — visible and pristine both green | `MASKED_FAILURE` (visible green, pristine red) or `SUITE_RED` | cannot verify, failing closed: no suite command, unresolvable base, `--require-ancestor` refused, budget exceeded, or the working or dependency tree moved during the run |
+| `run` | enforcement clean and the agent exited 0 — a non-zero agent exit is passed through unchanged | any blocking finding or masked failure, whatever the agent returned | cannot adjudicate: dirty start, policy error, verify cannot run |
+| `hook claude` / `sweep claude` | always — a deny is JSON on stdout at exit 0, never exit 2 | — | only for an unsupported agent name |
+| `allow` | sign-off recorded | — | no rule or `--reason`, not a git repo, or no current blocking finding to sign off |
+| `init` | wired, or already wired | — | an item needs attention |
+| no or unknown command | help printed (no command) | — | unknown command, help printed |
+
+### Environment variables
+
+| variable | who sets it | what it does |
+| --- | --- | --- |
+| `TAMPERWARD_OOB_SIGNOFF` | the CI workflow, from PR labels | comma-separated out-of-band approvals — `<rule>` or `<rule>:<file>`, optionally `@<head-sha>` — honoured by `check --diff` only; never the committed ledger |
+| `TAMPERWARD_OOB_HEAD` | the CI workflow (`github.event.pull_request.head.sha`) | the head SHA under adjudication; once set, an approval clears a finding only if it names that commit (`@<sha>`, at least 7 characters), so a new push re-blocks |
+| `TAMPERWARD_DENYLOG` | a harness or operator | a file to which `hook claude` and `sweep claude` append the rule ids of every deny, one line per verdict, best effort |
+| `TAMPERWARD_FSEVENTS` | operator or harness | overrides the `tamperward watch` event-log path (default `.git/tamperward/fsevents.jsonl`); the Stop sweep reads the same variable |
+| `TAMPERWARD_WATCH_NO_RECURSIVE` | CI and tests (`=1`) | forces `tamperward watch` onto its per-directory fallback instead of recursive `fs.watch`, so the fallback is exercised on every platform |
+| `TAMPERWARD_TRANSIENT` | a harness that owns restore semantics (`=block`) | raises `transient-protected-mutation` from warn to block; it can never lower a severity |
+| `NO_COLOR` / `FORCE_COLOR` | the user's shell | any non-empty `NO_COLOR` disables colour in the text renderer; a non-empty, non-`0` `FORCE_COLOR` enables it |
+| `GITHUB_ACTIONS` | GitHub Actions (`=true`) | `--format auto` selects the `github` renderer — an inline annotation per finding plus a job summary |
+
 ### The rules
 
-Sixteen rules are specified and fourteen ship (see the table in
+Seventeen rules are specified and fifteen ship (see the table in
 [SPEC.md](./SPEC.md)). The families: test protection (`test-deletion`,
 `test-skip`, `test-content-removal`), verification-signal protection
 (`coverage-lowering`, `snapshot-rewrite`, `snapshot-only-rewrite`), suppression
@@ -272,6 +335,7 @@ and its totals.
 | v1.9.0 | `tamperward verify`: the round-1 pristine oracle productized — visible-green + pristine-red is a masked failure, and "could not verify" fails closed |
 | Round 2, 9–0 | On 22 fresh repositories, v1.9.0 produced b=9/c=0 false-green discordance (p = 0.0039); four gated false greens remained, through two documented residual mechanisms |
 | cssstyle lifecycle escape (round 2) | The `tamperward run` envelope: the gate denied 42 mutations and verify refused all 25 stop attempts, and the runtime completed the session anyway over a masked tree — hooks decide, runtimes terminate, so the adjudication boundary moved outside the runtime |
+| v1.14.6, external audit | A pull request can neuter the gate that judges it: `pull_request` workflows run from the PR's own head and required checks match by job name, so a job that keeps its name and runs `true` reports green over anything. Reproduced on this repo's own CI — `gate` succeeded in three seconds over a PR that lowered a mechanical rule to warn. No detector can close it, because the detector is defined by the candidate; `init` now writes a CODEOWNERS requirement on the gate-critical paths and states, every run, that branch protection is the half it cannot set for you |
 | v1.14.5, external audit | The pristine copy was a sibling of the visible copy and fully prepared before it ran, so the candidate's own code wrote `../pristine/<the failing test>` and both runs returned 0 — no race, no background process, no git. The pristine copy is now built only after the visible run exits, its restored files are digested either side of the pristine run, and the working and dependency trees are fingerprinted around both. Also: the overlay restored content but not MODE, so `chmod -x` alone hid a test from an exec-bit runner in both copies; a transient dependency substitution that restored itself on the way out left the entry-vs-exit fingerprint identical; and a committed `.npmrc` chose the registry the CI gate was downloaded from |
 | v1.14.4, external audit | The overlay restored the tests and then ran the agent's *runner*: `verify.command` was frozen, but `runner.js` — and anything `npm test` delegates to — was in no protected class. And `git replace` redirected what the base resolved to for `ls-tree`, `show` and `merge-base` alike, with no ref moved and no file touched. Verifier inputs are now restored from the base; every trusted read sets `GIT_NO_REPLACE_OBJECTS=1` and the envelope convicts a rewrite installed during the run. `init` also gained workflow migration and matcher repair, and the Claude hook now denies a payload it cannot parse instead of allowing it |
 | v1.14.3, external review | Standalone `verify` loaded its policy from the working tree, so the generated CI workflow let a pull request supply the `verify:` command for its own re-execution. `check --diff` flagged the edit as hook-tampering, so the workflow caught it as a pair — but only where both jobs are required, and `verify` alone had no protection. With a `--base`, policy now comes from that commit |
@@ -298,12 +362,14 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 368 tests at v1.14.3 — parser, detectors, engine, policy, renderers
+npm test                        # 520+ tests at 1.15.0 — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 
-Tamperward gates its own repo in CI with the same engine it ships — including, on more
-than one occasion, blocking its own author's commits. See **[SPEC.md](./SPEC.md)** for
+Tamperward's own CI runs the engine it ships over every pull request — `check --diff`
+over the PR range, cleared only by an out-of-band label; see [CI authority](#ci-authority)
+for why the self-gate runs no `verify` on itself — and has, on more than one occasion,
+blocked its own author's commits. See **[SPEC.md](./SPEC.md)** for
 the build spec, the detector table, the enforcement-point wiring, and the proof-harness
 design; the `harness/` directory holds the seeds, oracles, transcripts tooling, and
 every pre-registered prediction with its outcome.

package/dist/cli/index.js

@@ -90,6 +90,8 @@ function parseDiff(diff) {
     let renameTo = null;
     let minusPath = null;
     let plusPath = null;
+    let oldMode;
+    let newMode;
     const hunks = [];
     while (i < lines.length && !lines[i].startsWith("diff --git ")) {
       const l = lines[i];
@@ -103,8 +105,14 @@ function parseDiff(diff) {
         i++;
         continue;
       }
-      if (l.startsWith("new file mode")) op = "add";
-      else if (l.startsWith("deleted file mode")) op = "delete";
+      if (l.startsWith("new file mode ")) {
+        op = "add";
+        newMode = l.slice(14).trim();
+      } else if (l.startsWith("deleted file mode ")) {
+        op = "delete";
+        oldMode = l.slice(18).trim();
+      } else if (l.startsWith("old mode ")) oldMode = l.slice(9).trim();
+      else if (l.startsWith("new mode ")) newMode = l.slice(9).trim();
       else if (l.startsWith("rename from ")) {
         renameFrom = unquotePath(l.slice(12));
         op = "rename";
@@ -140,7 +148,9 @@ function parseDiff(diff) {
       before: null,
       after: null,
       binary,
-      hunks
+      hunks,
+      ...oldMode !== void 0 ? { oldMode } : {},
+      ...newMode !== void 0 ? { newMode } : {}
     };
     changes.push(change);
   }
@@ -344,7 +354,13 @@ var LITERAL = [
   { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" },
   { re: /(?:^|[\s;&|=])LEFTHOOK=0(?:\s|$)/, why: "LEFTHOOK=0 disables Lefthook hooks" },
   { re: /\bSKIP_SIMPLE_GIT_HOOKS=1\b/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
-  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" }
+  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
+  // The pre-commit framework's own escape hatch: SKIP=<hook-id>[,…] skips those
+  // hooks for that one invocation. `.pre-commit-config.yaml` is a protected hook,
+  // so its documented bypass has to be one too. `SKIP=` is a plausible variable
+  // name elsewhere, so it counts only in a segment that runs git or pre-commit.
+  { re: /(?:^|[\s;&|])SKIP=\S+/, why: "SKIP=<hook-id> tells the pre-commit framework to skip that hook", when: /\b(?:git|pre-commit)\b/ },
+  { re: /(?:^|[\s;&|])LEFTHOOK_EXCLUDE=\S+/, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
 ];
 var SHORT_N = /^-[a-z]*n[a-z]*$/i;
 var noVerify = {
@@ -358,7 +374,7 @@ var noVerify = {
       for (const seg of segments(c.raw)) {
         let why = null;
         for (const p of LITERAL) {
-          if (p.re.test(seg)) {
+          if (p.re.test(seg) && (!p.when || p.when.test(seg))) {
             why = p.why;
             break;
           }
@@ -510,7 +526,14 @@ function defaultPolicy(version = 1) {
         "**/.tamperward.yml",
         ".claude/settings.json",
         ".claude/settings.local.json",
-        "**/.pre-commit-config.yaml"
+        "**/.pre-commit-config.yaml",
+        // CODEOWNERS is enforcement wiring, not documentation: it is the only
+        // thing that can require a human on a change to the workflow that
+        // decides whether the gate runs at all. GitHub reads it from any of
+        // these three locations. (H2.)
+        ".github/CODEOWNERS",
+        "CODEOWNERS",
+        "docs/CODEOWNERS"
       ]
     },
     rules: {
@@ -558,6 +581,42 @@ var CODE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
 function isCodeFile(path) {
   return CODE.test(path);
 }
+var EXT = [
+  [CODE, "js"],
+  [/\.pyw?$/, "py"],
+  [/\.go$/, "go"],
+  [/\.rs$/, "rs"],
+  [/\.rb$/, "rb"],
+  [/\.java$/, "java"],
+  [/\.kts?$/, "kt"],
+  [/\.php$/, "php"],
+  [/\.cs$/, "cs"]
+];
+function langOf(path) {
+  for (const [re, lang] of EXT) if (re.test(path)) return lang;
+  return null;
+}
+var COMMON = /^(export\s|\/\/|\*|\/\*|}\)?;?$)/;
+var IMPORTS = {
+  js: /^import\b/,
+  py: /^(?:import\b|from\s+\S+\s+import\b)/,
+  go: /^(?:import\b|package\b)/,
+  rs: /^(?:use\b|extern\s+crate\b|mod\b)/,
+  rb: /^(?:require(?:_relative)?\b|include\b)/,
+  java: /^(?:import\b|package\b)/,
+  kt: /^(?:import\b|package\b)/,
+  php: /^(?:use\b|namespace\b|require(?:_once)?\b|include(?:_once)?\b)/,
+  cs: /^(?:using\b|namespace\b)/
+};
+var HASH_COMMENT = /* @__PURE__ */ new Set(["py", "rb"]);
+function isSignificantLine(trimmed, lang) {
+  if (trimmed.length < 10) return false;
+  if (COMMON.test(trimmed)) return false;
+  const l = lang ?? "js";
+  if (IMPORTS[l].test(trimmed)) return false;
+  if (HASH_COMMENT.has(l) && trimmed.startsWith("#")) return false;
+  return true;
+}
 
 // src/detectors/ts-any-cast.ts
 var BLOCK_RULE = "ts-any-cast";
@@ -664,11 +723,35 @@ var tsAnyCast = {
 
 // src/detectors/lint-suppression.ts
 var RULE2 = "lint-suppression";
-var PATTERNS = [
-  { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
-  { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
-  { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
-];
+var PATTERNS = {
+  js: [
+    { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
+    { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
+    { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
+  ],
+  py: [
+    { re: /#\s*noqa\b/, why: "# noqa suppresses flake8/ruff findings" },
+    { re: /#\s*type:\s*ignore\b/, why: "# type: ignore suppresses the type checker" },
+    { re: /#\s*pyright:\s*ignore\b/, why: "# pyright: ignore suppresses the type checker" },
+    { re: /#\s*pylint:\s*disable\b/, why: "# pylint: disable suppresses lint rules" },
+    { re: /#\s*nosec\b/, why: "# nosec suppresses bandit security findings" },
+    { re: /#\s*fmt:\s*(?:off|skip)\b/, why: "# fmt: off/skip suppresses formatting checks" }
+  ],
+  go: [{ re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" }],
+  rs: [],
+  rb: [{ re: /#\s*rubocop:\s*(?:disable|todo)\b/, why: "# rubocop:disable suppresses lint rules" }],
+  java: [{ re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" }],
+  kt: [{ re: /@Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" }],
+  php: [
+    { re: /\bphpcs:(?:ignore|disable)\b/, why: "phpcs:ignore/disable suppresses coding-standard checks" },
+    { re: /@phpstan-ignore\b/, why: "@phpstan-ignore suppresses static-analysis findings" },
+    { re: /@psalm-suppress\b/, why: "@psalm-suppress suppresses static-analysis findings" }
+  ],
+  cs: [
+    { re: /#pragma\s+warning\s+disable\b/, why: "#pragma warning disable suppresses compiler warnings" },
+    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" }
+  ]
+};
 var lintSuppression = {
   id: RULE2,
   surface: ["file"],
@@ -676,9 +759,13 @@ var lintSuppression = {
   run(changes, policy) {
     const out2 = [];
     for (const c of changes) {
-      if (c.kind !== "file" || !isCodeFile(c.path)) continue;
+      if (c.kind !== "file") continue;
+      const lang = langOf(c.path);
+      if (!lang) continue;
+      const patterns = PATTERNS[lang];
+      if (patterns.length === 0) continue;
       for (const l of addedLines(c)) {
-        for (const p of PATTERNS) {
+        for (const p of patterns) {
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE2, policy, {
@@ -700,18 +787,44 @@ var lintSuppression = {
 
 // src/detectors/test-skip.ts
 var RULE3 = "test-skip";
-var PATTERNS2 = [
-  { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-  { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
-  { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
-  { re: /\bpending\(\s*\)/, why: "a pending() marker" },
-  // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
-  // a runtime call. A live evasion used the options form the day this gap was measured
-  // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
-  { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
-  { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-  { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
-];
+var PATTERNS2 = {
+  js: [
+    { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
+    { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
+    { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
+    { re: /\bpending\(\s*\)/, why: "a pending() marker" },
+    // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
+    // a runtime call. A live evasion used the options form the day this gap was measured
+    // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
+    { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
+    { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
+  ],
+  py: [
+    { re: /@pytest\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail() call" },
+    { re: /@unittest\.(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
+    { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
+    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" }
+  ],
+  go: [
+    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" }
+  ],
+  rs: [{ re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" }],
+  rb: [
+    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*$)/, why: "a skip/pending call" },
+    { re: /\bx(?:it|describe|context|specify|example)\b/, why: "an x-prefixed disabled example" },
+    { re: /\b(?:fit|fdescribe|fcontext)\b/, why: "an f-prefixed focused example (narrows the suite)" },
+    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip:/pending: metadata flag" }
+  ],
+  java: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
+  kt: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
+  php: [{ re: /\bmarkTest(?:Skipped|Incomplete)\(/, why: "a markTestSkipped()/markTestIncomplete() call" }],
+  cs: [
+    { re: /\[Ignore\b/, why: "an [Ignore] attribute" },
+    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' }
+  ]
+};
 var testSkip = {
   id: RULE3,
   surface: ["file"],
@@ -721,8 +834,9 @@ var testSkip = {
     for (const c of changes) {
       if (c.kind !== "file") continue;
       if (!isProtected(c.path, policy, "tests")) continue;
+      const patterns = PATTERNS2[langOf(c.path) ?? "js"];
       for (const l of addedLines(c)) {
-        for (const p of PATTERNS2) {
+        for (const p of patterns) {
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE3, policy, {
@@ -1011,6 +1125,7 @@ var ciTampering = {
         (c.after != null ? c.after.split("\n") : addedLines(c).map((l) => l.content)).map(commandCore)
       );
       for (const l of removedLines(c)) {
+        if (/^\s*#/.test(l.content)) continue;
         const isUsesLine = USES.test(l.content) && CHECK.test(l.content);
         const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
         if (!isUsesLine && !isCheckCommand) continue;
@@ -1073,8 +1188,11 @@ function policyWeakening(before, after) {
       reasons.push(`rule "${name}" removed from policy`);
       continue;
     }
-    if (br.severity === "block" && ar.severity === "warn") {
-      reasons.push(`rule "${name}" lowered block \u2192 warn`);
+    if (br.severity === "block" && ar.severity !== "block") {
+      const to = typeof ar.severity === "string" ? ar.severity : JSON.stringify(ar.severity);
+      reasons.push(
+        ar.severity === "warn" ? `rule "${name}" lowered block \u2192 warn` : `rule "${name}" lowered block \u2192 ${to} (not a valid severity; the rule would no longer block)`
+      );
     }
     if (ar.enabled === false && br.enabled !== false) {
       reasons.push(`rule "${name}" disabled (enabled: false)`);
@@ -1130,6 +1248,27 @@ function policyWeakening(before, after) {
 var RULE6 = "hook-tampering";
 var HOOK_INVOCATION = /\b(tamperward|npx|npm|pnpm|yarn|bun|jest|vitest|eslint|tsc|lefthook|husky|lint-staged|make|cargo|pytest)\b/;
 var isShellComment = (s) => /^\s*#/.test(s);
+var ownerExec = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
+var SYMBOLIC = /^[ugoa]*([-+=])([rwxXst]*)$/;
+function chmodTouchesExec(seg) {
+  const toks = tokens(seg).map(unquote);
+  const at = toks.findIndex((t) => /^chmod$/.test(t));
+  if (at === -1) return false;
+  for (const tok of toks.slice(at + 1)) {
+    if (/^[0-7]{3,4}$/.test(tok)) {
+      if (!ownerExec(tok)) return true;
+      continue;
+    }
+    for (const clause of tok.split(",")) {
+      const m = clause.match(SYMBOLIC);
+      if (!m) continue;
+      const [, op, perms] = m;
+      const namesExec = /[xX]/.test(perms);
+      if (op === "=" ? !namesExec : namesExec) return true;
+    }
+  }
+  return false;
+}
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
@@ -1140,6 +1279,16 @@ var hookTampering = {
       if (c.kind === "file") {
         const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false);
         if (!targetsHook) continue;
+        if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec(c.oldMode) && !ownerExec(c.newMode)) {
+          out2.push(
+            makeFinding(RULE6, policy, {
+              file: c.path,
+              message: `Execute permission was removed from a protected hook (${c.oldMode} \u2192 ${c.newMode}) \u2014 git will skip it.`,
+              evidence: `${c.path}: mode ${c.oldMode} \u2192 ${c.newMode}`,
+              remediation: "Restore the execute bit (chmod +x). A hook git cannot run is a disabled hook."
+            })
+          );
+        }
         if (c.op === "delete") {
           out2.push(
             makeFinding(RULE6, policy, {
@@ -1236,10 +1385,8 @@ var hookTampering = {
         for (const seg of segments(c.raw)) {
           const hitsHook = tokens(seg).map(unquote).some((t) => isProtected(t, policy, "hooks"));
           if (!hitsHook) continue;
-          const octal = seg.match(/\bchmod\b[^|;&]*?(?:^|\s)([0-7]{3,4})(?:\s|$)/);
-          const octalDropsExec = octal ? (Number(octal[1].slice(-3)[0]) & 1) === 0 : false;
           let why = null;
-          if (/\bchmod\b/.test(seg) && (/(?:^|\s)[-+=]?[a-z]*x/i.test(seg) || octalDropsExec)) {
+          if (chmodTouchesExec(seg)) {
             why = "chmod alters execute permission on a hook, which can disable it";
           } else if (/\brm\b/.test(seg)) {
             why = "rm deletes a protected hook";
@@ -1267,6 +1414,16 @@ var hookTampering = {
 // src/detectors/test-deletion.ts
 import ts3 from "typescript";
 var RULE7 = "test-deletion";
+var TEST_DEFS = {
+  py: /^\s*(?:async\s+)?def\s+test\w*\s*\(/,
+  go: /^func\s+(?:Test|Example|Fuzz)\w*\s*\(/,
+  rs: /^\s*#\[[\w:]*test[\w:]*(?:\(|\])/,
+  rb: /^\s*(?:(?:it|specify|test|scenario|example)\s*(?:\(\s*)?['"]|def\s+test_\w+)/,
+  java: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
+  kt: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
+  php: /^\s*(?:(?:public\s+)?function\s+test\w*\s*\(|#\[Test\]|\*\s*@test\b)/,
+  cs: /^\s*\[(?:Fact|Theory|Test|TestMethod|TestCase|DataTestMethod)\b/
+};
 function calleeName(expr) {
   if (ts3.isIdentifier(expr)) return expr.text;
   if (ts3.isPropertyAccessExpression(expr) && ts3.isIdentifier(expr.expression)) {
@@ -1274,7 +1431,14 @@ function calleeName(expr) {
   }
   return null;
 }
-function countTestBlocks(src) {
+function countTestBlocks(src, path = "spec.ts") {
+  const lang = langOf(path);
+  if (lang && lang !== "js") {
+    const re = TEST_DEFS[lang];
+    let n2 = 0;
+    for (const line of src.split("\n")) if (re.test(line)) n2++;
+    return n2;
+  }
   const sf = ts3.createSourceFile("spec.ts", src, ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TS);
   let n = 0;
   const visit = (node) => {
@@ -1287,11 +1451,12 @@ function countTestBlocks(src) {
   visit(sf);
   return n;
 }
-function significantLines(src) {
+function significantLines(src, path) {
   const out2 = /* @__PURE__ */ new Set();
+  const lang = langOf(path);
   for (const raw of src.split("\n")) {
     const l = raw.trim();
-    if (l.length >= 10 && !/^(import\b|export\s|\/\/|\*|\/\*|}\)?;?$)/.test(l)) out2.add(l);
+    if (isSignificantLine(l, lang)) out2.add(l);
   }
   return out2;
 }
@@ -1305,22 +1470,22 @@ var testDeletion = {
     let addedTestBlocks = 0;
     for (const c of changes) {
       if (c.kind === "file" && c.op === "add" && c.after != null && isProtected(c.path, policy, "tests")) {
-        for (const l of significantLines(c.after)) addedTestLines.add(l);
-        addedTestBlocks += countTestBlocks(c.after);
+        for (const l of significantLines(c.after, c.path)) addedTestLines.add(l);
+        addedTestBlocks += countTestBlocks(c.after, c.path);
       }
     }
-    const isRelocation = (before) => {
-      const sig = significantLines(before);
+    const isRelocation = (before, path) => {
+      const sig = significantLines(before, path);
       if (sig.size === 0 || addedTestLines.size === 0) return false;
       let hit = 0;
       for (const l of sig) if (addedTestLines.has(l)) hit++;
-      return hit / sig.size >= 0.6 && addedTestBlocks >= countTestBlocks(before);
+      return hit / sig.size >= 0.6 && addedTestBlocks >= countTestBlocks(before, path);
     };
     for (const c of changes) {
       if (c.kind === "file") {
         const isTest = isProtected(c.path, policy, "tests");
         if (c.op === "delete" && isTest) {
-          if (c.before != null && isRelocation(c.before)) continue;
+          if (c.before != null && isRelocation(c.before, c.path)) continue;
           out2.push(
             makeFinding(RULE7, policy, {
               file: c.path,
@@ -1339,8 +1504,8 @@ var testDeletion = {
             })
           );
         } else if ((c.op === "modify" || c.op === "rename") && isTest && c.before != null && c.after != null) {
-          const before = countTestBlocks(c.before);
-          const after = countTestBlocks(c.after);
+          const before = countTestBlocks(c.before, c.path);
+          const after = countTestBlocks(c.after, c.path);
           if (after < before) {
             out2.push(
               makeFinding(RULE7, policy, {
@@ -1396,11 +1561,12 @@ var testDeletion = {
 var RULE8 = "test-content-removal";
 var MIN_REMOVED_LINES = 3;
 var ws = (s) => s.replace(/\s+/g, "");
-function significantLinesOrdered(src) {
+function significantLinesOrdered(src, path) {
   const out2 = [];
+  const lang = langOf(path);
   for (const raw of src.split("\n")) {
     const l = raw.trim();
-    if (l.length >= 10 && !/^(import\b|export\s|\/\/|\*|\/\*|}\)?;?$)/.test(l)) out2.push(l);
+    if (isSignificantLine(l, lang)) out2.push(l);
   }
   return out2;
 }
@@ -1413,16 +1579,16 @@ var testContentRemoval = {
     let keptPool = "";
     for (const c of changes) {
       if (c.kind === "file" && c.after != null && isProtected(c.path, policy, "tests")) {
-        keptPool += ws(significantLinesOrdered(c.after).join("\n"));
+        keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
       }
     }
     for (const c of changes) {
       if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
       if (!isProtected(c.path, policy, "tests")) continue;
       if (isProtected(c.path, policy, "snapshots")) continue;
-      if (countTestBlocks(c.after) < countTestBlocks(c.before)) continue;
-      const beforeSig = significantLinesOrdered(c.before);
-      const afterSig = significantLinesOrdered(c.after);
+      if (countTestBlocks(c.after, c.path) < countTestBlocks(c.before, c.path)) continue;
+      const beforeSig = significantLinesOrdered(c.before, c.path);
+      const afterSig = significantLinesOrdered(c.after, c.path);
       const netDrop = beforeSig.length - afterSig.length;
       const afterSet = new Set(afterSig);
       const gone = [];
@@ -1593,6 +1759,7 @@ function evaluate(changes, policy, detectors = allDetectors, view) {
     return true;
   });
   return deduped.filter((f) => {
+    if (f.rule !== "detector-error" && !isEnabled(f.rule, policy)) return false;
     const ex = policy.rules[f.rule]?.exclude;
     if (!ex?.length || !f.file || isPolicyFile(f.file)) return true;
     return !matchesAny(f.file, ex);
@@ -1615,9 +1782,62 @@ function normalizeVersion(v, where = POLICY_FILE) {
   }
   return v;
 }
-function parsePolicy(raw) {
+var SEVERITIES = ["block", "warn"];
+var isSeverity = (v) => SEVERITIES.includes(v);
+var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
+var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validate(r, where) {
+  function bad(msg) {
+    throw new PolicyError(`${where}: ${msg}`);
+  }
+  const show = (v) => JSON.stringify(v) ?? String(v);
+  if (r.rules !== void 0) {
+    if (!isMapping(r.rules)) bad(`rules must be a mapping of rule name to { severity, enabled, exclude }, got ${show(r.rules)}`);
+    for (const [name, cfg] of Object.entries(r.rules)) {
+      if (!isMapping(cfg)) bad(`rules.${name} must be a mapping like { severity: block }, got ${show(cfg)}`);
+      if (cfg.severity !== void 0 && !isSeverity(cfg.severity)) {
+        bad(`rules.${name}.severity must be "block" or "warn", got ${show(cfg.severity)}`);
+      }
+      if (cfg.enabled !== void 0 && typeof cfg.enabled !== "boolean") {
+        bad(`rules.${name}.enabled must be true or false, got ${show(cfg.enabled)}`);
+      }
+      if (cfg.exclude !== void 0 && !isStringList(cfg.exclude)) {
+        bad(`rules.${name}.exclude must be a list of globs, got ${show(cfg.exclude)}`);
+      }
+    }
+  }
+  if (r.ignore !== void 0 && !isStringList(r.ignore)) bad(`ignore must be a list of globs, got ${show(r.ignore)}`);
+  if (r.protected !== void 0) {
+    if (!isMapping(r.protected)) bad(`protected must be a mapping of category to a list of globs, got ${show(r.protected)}`);
+    for (const [cat, globs] of Object.entries(r.protected)) {
+      if (!isStringList(globs)) bad(`protected.${cat} must be a list of globs, got ${show(globs)}`);
+    }
+  }
+  if (r.signoff !== void 0) {
+    if (!isMapping(r.signoff)) bad(`signoff must be a mapping, got ${show(r.signoff)}`);
+    for (const key2 of ["required_for", "requiredFor"]) {
+      const v = r.signoff[key2];
+      if (v !== void 0 && !(Array.isArray(v) && v.every(isSeverity))) {
+        bad(`signoff.${key2} must be a list of "block" / "warn", got ${show(v)}`);
+      }
+    }
+    const ledger = r.signoff.ledger;
+    if (ledger !== void 0 && typeof ledger !== "string") bad(`signoff.ledger must be a path, got ${show(ledger)}`);
+  }
+  if (r.verify !== void 0) {
+    if (!isMapping(r.verify)) bad(`verify must be a mapping like { command: "npm test" }, got ${show(r.verify)}`);
+    const v = r.verify;
+    if (v.command !== void 0 && typeof v.command !== "string") bad(`verify.command must be a string, got ${show(v.command)}`);
+    if (v.budget !== void 0 && !(typeof v.budget === "number" && Number.isFinite(v.budget) && v.budget > 0)) {
+      bad(`verify.budget must be a positive number of seconds, got ${show(v.budget)}`);
+    }
+    if (v.inputs !== void 0 && !isStringList(v.inputs)) bad(`verify.inputs must be a list of globs, got ${show(v.inputs)}`);
+  }
+}
+function parsePolicy(raw, where = POLICY_FILE) {
   const r = raw ?? {};
-  const version = normalizeVersion(r.version);
+  const version = normalizeVersion(r.version, where);
+  validate(r, where);
   const base = defaultPolicy(version);
   return {
     version,
@@ -1653,7 +1873,7 @@ function parseOrThrow(src, where) {
   if (raw !== null && raw !== void 0 && (typeof raw !== "object" || Array.isArray(raw))) {
     throw new PolicyError(`${where} is not a policy mapping`);
   }
-  return parsePolicy(raw);
+  return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
   const path = join2(cwd, POLICY_FILE);
@@ -2037,7 +2257,7 @@ import { createHash as createHash4 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync4, existsSync as existsSync3, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join4, isAbsolute } from "node:path";
+import { isAbsolute, join as join4, relative, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -2049,10 +2269,11 @@ function readDisk(path) {
   }
 }
 function abs(path, cwd) {
-  return isAbsolute(path) ? path : join4(cwd, path);
+  return resolve(cwd, path);
 }
 function relForDisplay(path, cwd) {
-  return path.startsWith(cwd + "/") ? path.slice(cwd.length + 1) : path;
+  const rel = relative(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -2073,9 +2294,15 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], { encoding: "utf8" });
+      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024
+      });
     } catch (e) {
       const err2 = e;
+      if (err2.status !== 1) {
+        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
+      }
       raw = err2.stdout ? String(err2.stdout) : "";
     }
   } finally {
@@ -2190,13 +2417,19 @@ function advanceTurnBaseline(cwd, sessionId) {
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join6 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join6 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
 function gitDir2(cwd) {
   try {
-    return execFileSync3("git", ["rev-parse", "--git-dir"], { cwd, encoding: "utf8" }).trim();
+    const d = execFileSync3("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (!d) return null;
+    return isAbsolute2(d) ? d : join6(cwd, d);
   } catch {
     return null;
   }
@@ -2205,7 +2438,7 @@ function ptreePath(cwd, sessionId) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join6(cwd, gd, "tamperward");
+  const dir = join6(gd, "tamperward");
   return join6(dir, `ptree-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
@@ -2288,7 +2521,8 @@ function snap(abs2) {
   }
 }
 function defaultEventLog(cwd) {
-  return process.env.TAMPERWARD_FSEVENTS ?? join7(cwd, ".git", "tamperward", "fsevents.jsonl");
+  if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
+  return join7(gitDir(cwd) ?? join7(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -2398,6 +2632,7 @@ function readEvents(log, offset) {
   return { events, newOffset: size };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
+  if (!isEnabled(RULE11, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -2709,15 +2944,43 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
-var HOOK_CMD = "npx --yes tamperward hook claude";
 var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
-var SWEEP_CMD = "npx --yes tamperward sweep claude";
-var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
 var MARKER = "# tamperward: block agent shortcuts before they land";
+var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
+var SWEEP_RE = /\btamperward(?:@\S+)?\s+sweep\s+claude\b/;
+var PRECOMMIT_RE = /\btamperward(?:@\S+)?\s+check\s+--staged\b/;
+var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
+var CODEOWNERS_MARK = "# tamperward: the gate cannot guard the file that defines it";
+var CODEOWNERS_PATHS = ["/.github/workflows/", "/.tamperward.yml", "/.github/CODEOWNERS"];
+function coveredBy(existing, critical) {
+  for (const line of existing.split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const pattern = t.split(/\s+/)[0];
+    if (!t.slice(pattern.length).trim()) continue;
+    if (pattern === "*" || pattern === critical) return true;
+    if (pattern.endsWith("/") && critical.startsWith(pattern)) return true;
+  }
+  return false;
+}
+function inferOwner(cwd) {
+  try {
+    const url = execFileSync4("git", ["remote", "get-url", "origin"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const m = url.match(/github\.com[:/]+([^/]+)\//);
+    return m ? `@${m[1]}` : null;
+  } catch {
+    return null;
+  }
+}
 var POLICY_CONTENT = `# Tamperward policy. The BASELINE (all rules, standard protected globs) applies even
 # without this file \u2014 everything here is an override, so an empty file changes nothing.
 # Docs: https://github.com/hexrift/tamperward#readme
@@ -2747,6 +3010,17 @@ function shippedVersion() {
   return "latest";
 }
 var TW_VERSION = shippedVersion();
+var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
+var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
+var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
+function pinOf(command) {
+  const m = command.match(OURS);
+  return m ? m[1] ?? "" : null;
+}
+function stalePin(command) {
+  const pin = pinOf(command);
+  return pin !== null && pin !== TW_VERSION;
+}
 var WORKFLOW_CONTENT = `name: tamperward
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
@@ -2867,15 +3141,18 @@ function planClaudeHooks(cwd) {
     settings = parsed;
   }
   const hooks = settings.hooks ??= {};
-  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
-  const preEntries = entriesWith(hooks.PreToolUse, "tamperward hook claude");
+  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => needle.test(String(h.command ?? ""))));
+  const preEntries = entriesWith(hooks.PreToolUse, HOOK_RE);
   const needPre = preEntries.length === 0;
-  const needStop = entriesWith(hooks.Stop, "tamperward sweep claude").length === 0;
+  const stopEntries = entriesWith(hooks.Stop, SWEEP_RE);
+  const needStop = stopEntries.length === 0;
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
-  if (!needPre && !needStop && stale.length === 0) {
+  const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
+  const pins = [...new Set(repin.map((h) => pinOf(String(h.command ?? "")) || "unpinned"))];
   return {
     item: "agent",
     path: rel,
@@ -2883,9 +3160,14 @@ function planClaudeHooks(cwd) {
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
-      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`
+      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
+      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`
     ].filter(Boolean).join(" + "),
     apply: () => {
+      for (const h of repin) {
+        const kind = String(h.command ?? "").match(OURS)?.[2];
+        h.command = kind === "hook claude" ? HOOK_CMD : kind === "sweep claude" ? SWEEP_CMD : h.command;
+      }
       if (needPre) {
         (hooks.PreToolUse ??= []).push({
           matcher: PRE_MATCHER,
@@ -2913,8 +3195,24 @@ ${PRECOMMIT_CMD}
   if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
   const path = join8(cwd, target.rel);
   const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
-  if (existing?.includes("tamperward check --staged")) {
-    return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+  if (existing !== null && PRECOMMIT_RE.test(existing)) {
+    const lines = existing.split("\n");
+    const staleAt = lines.findIndex((l) => PRECOMMIT_RE.test(l) && stalePin(l));
+    if (staleAt === -1) {
+      return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+    }
+    const was = pinOf(lines[staleAt]) || "unpinned";
+    return {
+      item: "pre-commit",
+      path: target.rel,
+      status: "update",
+      detail: `re-pin the staged check to tamperward@${TW_VERSION} (was ${was})`,
+      apply: () => {
+        lines[staleAt] = PRECOMMIT_CMD;
+        writeFileSync5(path, lines.join("\n"));
+        chmodSync(path, 493);
+      }
+    };
   }
   return {
     item: "pre-commit",
@@ -2930,6 +3228,35 @@ ${line}` : existing.replace(/\n?$/, "\n") + line;
     }
   };
 }
+function planCodeowners(cwd) {
+  const rel = ".github/CODEOWNERS";
+  const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
+    (r) => existsSync7(join8(cwd, r))
+  );
+  const path = join8(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync10(path, "utf8") : null;
+  const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
+  if (missing.length === 0) {
+    return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
+  }
+  const owner = inferOwner(cwd);
+  const block = `
+${CODEOWNERS_MARK}
+# A pull request that rewrites the workflow can keep the job name, replace the
+# gate with \`true\`, and still report a green required check. Only a human
+# requirement on these paths prevents that.
+` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
+  return {
+    item: "codeowners",
+    path: existingRel ?? rel,
+    status: existing === null ? "create" : "update",
+    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner})`),
+    apply: () => {
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block);
+    }
+  };
+}
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
   const path = join8(cwd, rel);
@@ -2983,7 +3310,7 @@ function planWorkflow(cwd, force) {
   };
 }
 function planInit(cwd, opts = {}) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false)];
+  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false), planCodeowners(cwd)];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -3010,34 +3337,37 @@ tamperward init: ${changed} change(s) planned. Re-run without --dry-run to apply
 tamperward init: ${changed} change(s) applied. Commit them so the gate travels with the repo.
 `
   );
+  w.write(
+    '\nONE STEP LEFT, AND IT IS NOT OPTIONAL. In your branch-protection or ruleset\nsettings for the default branch, require the tamperward check AND enable\n"Require review from Code Owners".\n\nUntil you do, the CI gate is advisory. A pull request runs the workflow from\nits OWN head, and a required check is matched by job name \u2014 so a pull request\ncan keep the job called `tamperward`, replace the gate with `true`, and present\na green required check over a change the gate would have blocked. That is\nreproduced, not theoretical. CODEOWNERS is what puts a human in front of it;\nbranch protection is what makes CODEOWNERS bind.\n'
+  );
   return 0;
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join11, resolve } from "node:path";
+import { dirname as dirname4, join as join11, resolve as resolve2 } from "node:path";
 
 // src/git/trusted.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join9 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join9 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
 function gitDirOf(cwd) {
   try {
-    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync5("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute2(d) ? d : join9(cwd, d);
+    return isAbsolute3(d) ? d : join9(cwd, d);
   } catch {
     return null;
   }
@@ -3046,7 +3376,7 @@ function objectRewriteState(cwd) {
   const parts = [];
   try {
     parts.push(
-      "replace:" + execFileSync4("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+      "replace:" + execFileSync5("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -3073,12 +3403,12 @@ function objectRewriteState(cwd) {
 }
 
 // src/fingerprint.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
 import { join as join10 } from "node:path";
 function treeFingerprint(cwd) {
-  const files = execFileSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 1 << 28,
@@ -3166,7 +3496,7 @@ var VERIFICATION_SURFACE = [
   "**/*.runsettings"
 ];
 function git2(args, cwd) {
-  return execFileSync6("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
@@ -3202,7 +3532,7 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve(cwd, "node_modules");
+  const nm = resolve2(cwd, "node_modules");
   if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
@@ -3262,7 +3592,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     if (e.type === "commit") {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
-    const content = execFileSync6("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const content = execFileSync7("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out2 = join11(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
     rmSync2(out2, { force: true });
@@ -3283,18 +3613,52 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   }
   return { restored, removed };
 }
+var SUPERVISOR = `
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const [cmd, budgetMs, outFile] = process.argv.slice(1);
+const child = cp.spawn('sh', ['-c', cmd], { stdio: 'ignore', detached: process.platform !== 'win32' });
+const killGroup = () => {
+  try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+  try { child.kill('SIGKILL'); } catch {}
+};
+let done = false;
+const finish = (r) => {
+  if (done) return;
+  done = true;
+  killGroup();
+  fs.writeFileSync(outFile, JSON.stringify(r));
+  process.exit(0);
+};
+const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
+child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
+child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
+`;
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const r = spawnSync("sh", ["-c", cmd], {
-    cwd: dir,
-    stdio: "ignore",
-    timeout: budgetSecs * 1e3,
-    killSignal: "SIGKILL"
-  });
-  const secs = Math.round((Date.now() - t0) / 1e3);
-  if (r.error && r.error.code === "ETIMEDOUT") return { exit: null, secs };
-  if (r.status === null && r.signal) return { exit: null, secs };
-  return { exit: r.status ?? 2, secs };
+  const outDir = mkdtempSync2(join11(tmpdir2(), "tw-verify-run-"));
+  const outFile = join11(outDir, "result.json");
+  try {
+    spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+      cwd: dir,
+      stdio: "ignore",
+      timeout: budgetSecs * 1e3 + 3e4,
+      // backstop only; the supervisor enforces the budget
+      killSignal: "SIGKILL"
+    });
+    const secs = Math.round((Date.now() - t0) / 1e3);
+    let r;
+    try {
+      r = JSON.parse(readFileSync13(outFile, "utf8"));
+    } catch {
+      return { exit: null, secs };
+    }
+    if (r.timedOut || r.error) return { exit: null, secs };
+    if (r.exit === null || r.exit === void 0) return { exit: null, secs };
+    return { exit: r.exit, secs };
+  } finally {
+    rmSync2(outDir, { recursive: true, force: true });
+  }
 }
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -3449,13 +3813,13 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync7, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
-  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
@@ -3498,7 +3862,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve2(opts.cwd ?? process.cwd());
+  const cwd = resolve3(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -3580,7 +3944,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   if (opts.settle && opts.settle > 0) {
     try {
-      execFileSync7("sleep", [String(opts.settle)]);
+      execFileSync8("sleep", [String(opts.settle)]);
     } catch {
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.14.5",
+  "version": "1.15.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -55,8 +55,8 @@
   "devDependencies": {
     "@types/node": "^20.14.0",
     "@types/picomatch": "^3.0.1",
-    "esbuild": "^0.24.0",
+    "esbuild": "^0.25.12",
     "vitepress": "^1.6.4",
-    "vitest": "^2.1.8"
+    "vitest": "^2.1.9"
   }
 }