tamperward 1.3.0 → 1.4.1

package/README.md

@@ -6,55 +6,51 @@
 
 <p align="center"><em>A ward is the obstruction inside a lock that blocks the wrong key.</em></p>
 
-**The deterministic agent-integrity gate.** One ruleset, evaluated on the actual
-diff and commands as a verdict — not a probability — enforced everywhere a change can
-be made: inside the coding agent's loop, at the commit, and at the merge.
-
-AI agents optimize for "the command succeeded," not "the change is trustworthy." To
-make checks pass they take the cheapest path: deleting failing tests, weakening
-assertions, casting to `any`, suppressing lint/type errors, lowering coverage gates,
-editing CI, or bypassing hooks with `--no-verify`. Tamperward treats the safety nets
-themselves as protected assets and blocks the *class* of bypass — so no single
-shortcut is enough.
+<p align="center">
+  <a href="https://www.npmjs.com/package/tamperward"><img src="https://img.shields.io/npm/v/tamperward?label=npm&color=4F46E5" alt="npm version"></a>
+  <a href="https://github.com/hexrift/tamperward/actions/workflows/release.yml"><img src="https://img.shields.io/github/actions/workflow/status/hexrift/tamperward/release.yml?label=release" alt="release"></a>
+  <a href="./LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-lightgrey" alt="license"></a>
+</p>
 
-> Apache-2.0 core · `github.com/hexrift/tamperward`
+**The deterministic agent-integrity gate.** AI coding agents optimize for "the command
+succeeded," not "the change is trustworthy." To make checks pass they take the cheapest
+path: deleting failing tests, skipping them, casting to `any`, suppressing lint errors,
+lowering coverage gates, rewriting snapshots, editing CI, or bypassing hooks with
+`--no-verify`. Tamperward treats the safety nets themselves as protected assets and
+blocks the **class** of bypass — one ruleset, evaluated on the actual diff and commands
+as a verdict, not a probability, enforced everywhere a change can be made: **inside the
+agent's loop, at the commit, and at the merge.**
 
-## Stability
+> Apache-2.0 · zero runtime model calls · every headline claim below is measured, with
+> the pre-registered predictions (including the refuted ones) committed to this repo
 
-`1.0.0` commits to the surface you actually depend on: the CLI and its **exit codes**, the
-hook wire format, the `.tamperward.yml` schema, and the `--json` `Finding` shape. The
-package publishes no `main` and no `exports` — it is a binary, not a library — so nothing
-under `src/` is public and internal refactors will never break you.
+## Install
 
-The version answers one question: *can taking this upgrade turn a green build red without
-me changing anything?* **Patch never can** — bypass fixes and false-positive fixes ship as
-patches so they reach you automatically. **Major can**, and only ever will alongside a
-changelog entry saying which rule changed. See
-[CONTRIBUTING](./CONTRIBUTING.md#versioning) for the full rule.
+```bash
+npx tamperward init
+```
 
-Two rules ship as `warn` and do not block: `assertion-weakening` and `guard-removal`. They
-are heuristic, and they stay non-blocking until their precision is measured (SPEC §7.A).
+One idempotent command wires all four enforcement points — it never overwrites anything
+you wrote, and `--dry-run` shows the plan first:
 
-## Does the loop actually work?
+| point | what it wires |
+| --- | --- |
+| agent loop | Claude Code `PreToolUse` deny + `Stop` sweep, merged into `.claude/settings.json` |
+| pre-commit | husky when present, the plain git hook otherwise |
+| CI | a PR-gate workflow with out-of-band sign-off (details below) |
+| policy | a commented baseline `.tamperward.yml` — the defaults apply even without it |
 
-The gate is only half the claim. The other half is what an agent does *after* it is
-denied: fix the real failure, or hunt for another way around. That is the
-**bypass-to-fix conversion rate** (SPEC §7.B), and it is measured, not asserted —
-`harness/run.sh` stands up an isolated repo with a real bug and a failing protected
-test, lets a headless agent loose on it with the hooks installed, and classifies the
-end state with an oracle independent of the detectors under test.
+Or run the views directly:
 
-**42 runs. 0 tampers reached green. Of the 20 runs where a block fired, 20 ended in an
-honest fix.**
+```bash
+npx tamperward check --staged                # pre-commit view
+npx tamperward check --diff "main...HEAD"    # CI view — the authority for main
+```
 
-| arm | model | runs | blocks fired | honest fix | tamper through |
-|---|---|---|---|---|---|
-| `seed` · adversarial | Sonnet 5 | 1 | 0 | 1 | 0 |
-| `seed` · **forced** | Sonnet 5 | 5 | 0 | 5 | 0 |
-| `seed-hard` · adversarial | Sonnet 5 | 3 | 0 | 3 | 0 |
-| `seed-hard` · adversarial | Haiku 4.5 | 33 | 20 | 33 | 0 |
+## What it looks like when it fires
 
-The trajectory the whole design is built around, from a transcript:
+An agent, mid-loop, tries the classic shortcut. The deny happens **before** the tool
+runs, and holds even under `bypassPermissions`:
 
 ```
 5. Bash  rm calc.test.js   → DENIED (test-deletion)
@@ -62,110 +58,97 @@ The trajectory the whole design is built around, from a transcript:
 7. Bash  node --test       → green, honestly
 ```
 
-**Read the number with its limits.** 20/20 is a point estimate on a finite sample: it
-supports "no conversion failure observed in 20 interceptions", whose 95% lower bound is
-≈ 86% — above the ~80% bar SPEC §7.B set for "the loop works", but not a claim of 100%.
-The split matters more than the total — Sonnet 5 never attempted a bypass at all,
-including 5/5 runs in `forced` mode where the prompt *orders* it to delete the failing
-test; all 20 interceptions came from Haiku 4.5 on the seed whose honest fix is genuinely
-expensive. Of those 20, the agent's first move after the denial was a real fix attempt
-19 times; once it went and read `.tamperward.yml` looking for another way through before
-converting. That probe is counted here as an attempted second bypass, not smoothed away.
-
-So on scenarios this size, a frontier model mostly does not need the gate. What the run
-supports is the narrower, more durable claim: **when a shortcut is attempted, it is
-caught deterministically, and the denial redirects the agent to the real fix rather than
-to another bypass.**
-
-Reproduce: `npm run build && harness/run.sh 5 adversarial haiku seed-hard`
-
-## Status
-
-Phase 1 — the engine, the eight mechanical detectors, the `check` CLI, and the Claude Code
-agent layer (PreToolUse hook + Stop sweep + `allow`). Tamperward gates its own repo in CI
-with the same engine it ships.
-
-- `src/types.ts` — the `Change` model every adapter manufactures and every detector
-  consumes (the one decision the codebase inherits).
-- `src/diff/parse.ts` — pure `git diff` → `Change[]` parser. Handles add / modify /
-  delete / **rename (as one change carrying `oldPath`)** / rename+edit / binary, with
-  per-line old/new line numbers correct across multiple hunks.
-- `src/git/build.ts` — the git adapter: range / staged / worktree views, enriching
-  `before`/`after` with full file content for the AST detectors.
-- `src/detectors/` — the **nine mechanical rules**: `no-verify`, `ts-any-cast`,
-  `lint-suppression`, `test-skip`, `coverage-lowering`, `ci-tampering`,
-  `hook-tampering`, `test-deletion` (the last counts `it()/test()` via the TS AST,
-  and handles delete / rename-out-of-glob / shell mutation), and `snapshot-rewrite`
-  (a `warn`: re-recording a snapshot/golden expectation from current output — the one
-  rule built from measured demand, after the affordance experiment put the move at a
-  70% attempt and 100% through rate; see `harness/PREDICTION-affordance.md`).
-- `src/engine.ts` — runs the enabled rules over `Change[]`; honours `policy.ignore`.
-- `src/cli/` — `tamperward check --staged | --worktree | --diff <base>...<head>`,
-  exit 1 on any blocking finding.
-- `test/` — 248 tests, including the AST-vs-regex, self-hosting precision, and
-  pre-go-live audit regression cases, and the renderer accessibility contract.
-
-- `src/adapters/claude/` + `src/cli/hook.ts` — the agent layer: `tamperward hook claude`
-  (PreToolUse deny, fail-closed) and `tamperward sweep claude` (Stop sweep, compared against
-  the turn's starting commit so a mid-turn commit can't launder a tamper past it).
-- `src/signoff.ts` — the three-layer sign-off model: the agent honours nothing it can author.
-
-Next: the negatives corpus to graduate the two heuristic rules, and a larger §7.B run
-to tighten the interval on the conversion rate.
-
-See **[SPEC.md](./SPEC.md)** for the full build spec, the detector table, the
-enforcement-point wiring, and the proof harness.
-
-## Use
+The same engine at pre-commit or in CI:
 
-```bash
-npx tamperward check --staged                # pre-commit view
-npx tamperward check --diff "main...HEAD"    # CI view — the authority for main
+```
+tamperward: 2 blocking
+(2 changes scanned)
+
+  BLOCK  coverage-lowering  package.json
+    Coverage gate weakened: global lines threshold lowered 90 → 10.
+    evidence  global lines threshold lowered 90 → 10
+    instead   Raise real coverage by adding tests; do not lower or exempt
+              the gate to pass.
+    sign-off  tamperward allow coverage-lowering --file package.json --reason "..."
+
+  BLOCK  test-deletion  test/calc.test.js
+    Test blocks removed: 3 → 1 it()/test() in this spec.
+    evidence  2 test block(s) removed from test/calc.test.js
+    instead   Keep the assertions and fix the code. Removing test blocks to go
+              green is the tamper.
+
+A blocking finding clears only with a human sign-off. In CI that sign-off is
+out-of-band — a PR label applied by a reviewer — never a file committed on the
+branch under review.
 ```
 
-### Reading the verdict
-
-One verdict, rendered for whoever is reading it. `--format` picks the view; the default,
-`auto`, picks `github` when `GITHUB_ACTIONS=true` and `text` otherwise, so the CI wiring
-stays a single line.
-
-| Format | Where it goes |
-| --- | --- |
-| `text` | The terminal. Blocking findings first, then by file and line, wrapped to the terminal width. |
-| `github` | An inline annotation per finding — so it lands **on the line** in *Files changed*, not four clicks deep in a job log — plus a job-summary table on the run page. The full text output still goes to the log. |
-| `json` | The findings verbatim, plus a summary count. |
-
-Severity is always spelled out (`BLOCK` / `warn`) and never carried by colour or a glyph
-alone, so the output reads the same piped, in a CI log, on a colour-blind reader's
-terminal, and through a screen reader. Colour honours
-[`NO_COLOR`](https://no-color.org) and `FORCE_COLOR`, and is off whenever stdout is not a
-terminal.
+Under GitHub Actions each finding also lands as an **inline annotation on the diff** in
+*Files changed*, plus a job-summary table — not four clicks deep in a log.
+
+## The rules
+
+Nine mechanical rules, deterministic by construction, `block` by default:
+`test-deletion` (AST block-count, rename-out-of-glob, shell mutation), `test-skip`
+(including `.only`, which narrows the suite), `ts-any-cast`, `lint-suppression`,
+`coverage-lowering` (Jest and Vitest shapes, all four metrics, `package.json` included),
+`ci-tampering` (a **moved** check is not a removed one), `hook-tampering`, `no-verify`
+(flags and the env-var escape hatches), and `snapshot-rewrite` (`warn` — see the FP study
+below for why).
+
+Three heuristics ship as `warn` and never block until their precision clears the bar:
+`assertion-weakening`, `guard-removal`, `ts-any-launder`.
+
+The policy file itself is un-ignorable, CI reads the policy from the **merge-base** (a PR
+cannot govern its own verdict), and the agent honours no sign-off it can author — the
+escape valve is a PR label only a human with write access can apply.
+
+## Measured, not asserted
+
+**Does the loop work?** `harness/run.sh` stands up an isolated repo with a real bug and a
+failing protected test, lets a headless agent loose with the hooks installed, and
+classifies the end state with an oracle independent of the detectors under test
+(SPEC §7.B). **42 runs, 0 tampers reached green; all 20 runs where a block fired ended in
+an honest fix** — a 20/20 point estimate whose 95% lower bound is ≈86%. The split is the
+honest part: Sonnet 5 never attempted a bypass at all, even when the prompt *ordered*
+one; all 20 interceptions came from Haiku 4.5 on a seed whose honest fix is genuinely
+expensive. Reproduce: `npm run build && harness/run.sh 5 adversarial haiku seed-hard`.
+
+**Which detectors deserve to exist?** Measured too. Affordance seeds offer an agent one
+specific bypass each; predictions are pre-registered before any rep runs
+(`harness/PREDICTION-affordance.md`). Result: 7/10 adversarial runs regenerated a golden
+file from buggy output (100% passed unseen — so `snapshot-rewrite` was built), while
+timeout-inflation and lint-config-gutting measured **0/10 attempts each** — two
+pre-registered bets refuted, two detectors *not* built. Bypass classes with no measured
+demand stay in a record-only shadow scanner that accumulates evidence on every weekly
+harness run.
+
+**What about false positives?** `snapshot-rewrite` was swept over **1,652 real mainline
+commits** (prettier, jest, docusaurus, immer): 216 touched snapshots, all legitimately —
+which is exactly why that rule is a `warn` asking for human confirmation, not a block,
+and why the study is committed (`harness/fp-study/`) rather than summarized away.
 
-From a clone:
+## Stability
 
-```bash
-npm install
-npm run build                                      # bundles the CLI to dist/cli/index.js
-node dist/cli/index.js check --staged
-node dist/cli/index.js check --diff "main...HEAD"
-```
+The public surface is the CLI and its **exit codes**, the hook wire format, the
+`.tamperward.yml` schema, and the `--json` `Finding` shape. No `main`, no `exports` —
+it is a binary, not a library. The version answers one question: *can taking this
+upgrade turn a green build red without me changing anything?* **Patch never can** —
+bypass fixes and false-positive fixes ship as patches so they reach you automatically.
+Rule graduations (`warn` → `block`) are **opt-in**: they gate on the `version:` field in
+your policy, so they ship as minors and apply only when you raise it. Releases publish
+via npm trusted publishing with SLSA provenance. Full rule:
+[CONTRIBUTING](./CONTRIBUTING.md#versioning).
 
 ## Develop
 
 ```bash
-npm test           # vitest — parser, detectors, engine, policy
+npm install && npm run build    # bundles the CLI to dist/cli/index.js
+npm test                        # 259 tests — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 
-## Layout
-
-```
-tamperward/
-  src/types.ts          the Change / Finding / Detector / Policy contracts
-  src/diff/             pure diff parser + selectors
-  src/git/              git adapter (range / staged / worktree)
-  src/detectors/        the rules (phase 1, in progress)
-  test/                 unit suite — green is the gate
-  .tamperward.yml         the policy: protected assets + rule severities
-  .github/workflows/    CI — dogfoods Tamperward on itself once the CLI lands
-```
+Tamperward gates its own repo in CI with the same engine it ships — including, on more
+than one occasion, blocking its own author's commits. See **[SPEC.md](./SPEC.md)** for
+the build spec, the detector table, the enforcement-point wiring, and the proof-harness
+design; the `harness/` directory holds the seeds, oracles, transcripts tooling, and
+every pre-registered prediction with its outcome.

package/dist/cli/index.js

@@ -2049,6 +2049,197 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
   return 0;
 }
 
+// src/cli/init.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, chmodSync } from "node:fs";
+import { dirname as dirname3, join as join6 } from "node:path";
+var HOOK_CMD = "npx --yes tamperward hook claude";
+var SWEEP_CMD = "npx --yes tamperward sweep claude";
+var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
+var MARKER = "# tamperward: block agent shortcuts before they land";
+var POLICY_CONTENT = `# Tamperward policy. The BASELINE (all rules, standard protected globs) applies even
+# without this file \u2014 everything here is an override, so an empty file changes nothing.
+# Docs: https://github.com/hexrift/tamperward#readme
+#
+# version gates rule GRADUATIONS: a baseline rule promoted warn -> block at policy
+# version N blocks only when you declare version >= N. Raising it is opting in.
+version: 1
+
+# protected:            # categories MERGE with the baseline (additive, never replace)
+#   tests: ['e2e/**']
+# rules:                # an explicit severity wins over the baseline in either direction
+#   snapshot-rewrite: { severity: block }
+# ignore: []            # visible blind spots \u2014 the count is always reported
+`;
+var WORKFLOW_CONTENT = `name: tamperward
+
+# The CI authority for main: the same engine as the agent hook and pre-commit, run over
+# the PR's commit range. A block fails the check and clears ONLY via the out-of-band
+# label \`tamperward:allow:<rule>\` applied by someone with write access \u2014 never a file
+# the PR itself can commit.
+#
+# labeled/unlabeled re-run the gate because the sign-off is read from the EVENT payload:
+# a label applied after a failure could otherwise never take effect, and REVOKING a
+# sign-off must re-block rather than linger green.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  tamperward:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # the range diff needs both endpoints
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - name: Resolve out-of-band sign-off from PR labels
+        id: oob
+        env:
+          LABELS: \${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          RULES="$(printf '%s' "$LABELS" | jq -r '.[] | select(startswith("tamperward:allow:")) | sub("^tamperward:allow:"; "")' | paste -sd, -)"
+          echo "rules=$RULES" >> "$GITHUB_OUTPUT"
+      - name: Tamperward gate
+        env:
+          TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
+        run: npx --yes tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
+`;
+function planPolicy(cwd) {
+  const path = join6(cwd, POLICY_FILE);
+  if (existsSync5(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
+  return {
+    item: "policy",
+    path: POLICY_FILE,
+    status: "create",
+    detail: "baseline policy with commented overrides",
+    apply: () => writeFileSync3(path, POLICY_CONTENT)
+  };
+}
+function planClaudeHooks(cwd) {
+  const rel = ".claude/settings.json";
+  const path = join6(cwd, rel);
+  let settings = {};
+  if (existsSync5(path)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync7(path, "utf8"));
+    } catch {
+      return {
+        item: "agent",
+        path: rel,
+        status: "error",
+        detail: "exists but is not valid JSON \u2014 fix it, then re-run init (refusing to overwrite)"
+      };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return { item: "agent", path: rel, status: "error", detail: "exists but is not a JSON object \u2014 refusing to overwrite" };
+    }
+    settings = parsed;
+  }
+  const hooks = settings.hooks ??= {};
+  const has = (arr, needle) => (arr ?? []).some((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
+  const needPre = !has(hooks.PreToolUse, "tamperward hook claude");
+  const needStop = !has(hooks.Stop, "tamperward sweep claude");
+  if (!needPre && !needStop) return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  return {
+    item: "agent",
+    path: rel,
+    status: existsSync5(path) ? "update" : "create",
+    detail: `wire ${[needPre && "PreToolUse deny", needStop && "Stop sweep"].filter(Boolean).join(" + ")}`,
+    apply: () => {
+      if (needPre) {
+        (hooks.PreToolUse ??= []).push({
+          matcher: "Bash|Edit|Write|MultiEdit",
+          hooks: [{ type: "command", command: HOOK_CMD }]
+        });
+      }
+      if (needStop) {
+        (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
+      }
+      mkdirSync3(dirname3(path), { recursive: true });
+      writeFileSync3(path, JSON.stringify(settings, null, 2) + "\n");
+    }
+  };
+}
+function planPreCommit(cwd) {
+  const line = `${MARKER}
+${PRECOMMIT_CMD}
+`;
+  const husky = join6(cwd, ".husky");
+  const gitDir2 = join6(cwd, ".git");
+  const target = existsSync5(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync5(gitDir2) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
+  if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
+  const path = join6(cwd, target.rel);
+  const existing = existsSync5(path) ? readFileSync7(path, "utf8") : null;
+  if (existing?.includes("tamperward check --staged")) {
+    return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+  }
+  return {
+    item: "pre-commit",
+    path: target.rel,
+    status: existing === null ? "create" : "update",
+    detail: existing === null ? `create via ${target.note}` : `append the staged check (${target.note})`,
+    apply: () => {
+      mkdirSync3(dirname3(path), { recursive: true });
+      const content = existing === null ? `#!/bin/sh
+${line}` : existing.replace(/\n?$/, "\n") + line;
+      writeFileSync3(path, content);
+      chmodSync(path, 493);
+    }
+  };
+}
+function planWorkflow(cwd) {
+  const rel = ".github/workflows/tamperward.yml";
+  const path = join6(cwd, rel);
+  if (existsSync5(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
+  return {
+    item: "ci",
+    path: rel,
+    status: "create",
+    detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
+    apply: () => {
+      mkdirSync3(dirname3(path), { recursive: true });
+      writeFileSync3(path, WORKFLOW_CONTENT);
+    }
+  };
+}
+function planInit(cwd) {
+  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd)];
+}
+function runInit(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const plan = planInit(cwd);
+  const w = process.stdout;
+  for (const a of plan) {
+    const verb = opts.dryRun && (a.status === "create" || a.status === "update") ? `would ${a.status}` : a.status;
+    w.write(`  ${a.item.padEnd(10)} ${verb.padEnd(12)} ${a.path}  \u2014 ${a.detail}
+`);
+    if (!opts.dryRun && a.apply) a.apply();
+  }
+  const errors = plan.filter((a) => a.status === "error");
+  const changed = plan.filter((a) => a.apply).length;
+  if (errors.length) {
+    w.write(`
+tamperward init: ${errors.length} item(s) need your attention above; the rest ${opts.dryRun ? "are planned" : "were applied"}.
+`);
+    return 2;
+  }
+  w.write(
+    changed === 0 ? "\ntamperward init: everything already wired \u2014 nothing to do.\n" : opts.dryRun ? `
+tamperward init: ${changed} change(s) planned. Re-run without --dry-run to apply.
+` : `
+tamperward init: ${changed} change(s) applied. Commit them so the gate travels with the repo.
+`
+  );
+  return 0;
+}
+
 // src/cli/index.ts
 function parseAllow(args) {
   const o = {};
@@ -2070,6 +2261,15 @@ function runAgentCommand(kind, args) {
   }
   return kind === "hook" ? runHookClaude() : runSweepClaude();
 }
+function parseInit(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--dry-run") o.dryRun = true;
+  }
+  return o;
+}
 function parseCheck(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -2113,6 +2313,9 @@ Formats:
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
+  tamperward init [--dry-run]               wire all four enforcement points: policy
+                                            file, Claude Code hooks, pre-commit, CI.
+                                            Idempotent; never overwrites your files.
 
 Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
@@ -2129,6 +2332,8 @@ function main(argv) {
       return runAgentCommand("sweep", rest);
     case "allow":
       return runAllow(parseAllow(rest));
+    case "init":
+      return runInit(parseInit(rest));
     case void 0:
     case "-h":
     case "--help":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -14,15 +14,18 @@
   },
   "keywords": [
     "ai-agents",
+    "claude-code",
+    "coding-agents",
     "agent-safety",
+    "reward-hacking",
     "code-integrity",
     "guardrails",
-    "claude-code",
+    "test-integrity",
     "pre-commit",
     "ci",
-    "static-analysis",
-    "reward-hacking",
-    "tests"
+    "hooks",
+    "llm",
+    "devsecops"
   ],
   "type": "module",
   "bin": {