tamperward 1.4.1 → 1.4.3

package/README.md

@@ -19,7 +19,8 @@ lowering coverage gates, rewriting snapshots, editing CI, or bypassing hooks wit
 `--no-verify`. Tamperward treats the safety nets themselves as protected assets and
 blocks the **class** of bypass — one ruleset, evaluated on the actual diff and commands
 as a verdict, not a probability, enforced everywhere a change can be made: **inside the
-agent's loop, at the commit, and at the merge.**
+agent's loop (a deny before the tool runs, and a sweep at end of turn), at the commit,
+and at the merge.**
 
 > Apache-2.0 · zero runtime model calls · every headline claim below is measured, with
 > the pre-registered predictions (including the refuted ones) committed to this repo
@@ -30,8 +31,8 @@ agent's loop, at the commit, and at the merge.**
 npx tamperward init
 ```
 
-One idempotent command wires all four enforcement points — it never overwrites anything
-you wrote, and `--dry-run` shows the plan first:
+One idempotent command wires the policy and every enforcement point — it never
+overwrites anything you wrote, and `--dry-run` shows the plan first:
 
 | point | what it wires |
 | --- | --- |
@@ -107,8 +108,9 @@ escape valve is a PR label only a human with write access can apply.
 **Does the loop work?** `harness/run.sh` stands up an isolated repo with a real bug and a
 failing protected test, lets a headless agent loose with the hooks installed, and
 classifies the end state with an oracle independent of the detectors under test
-(SPEC §7.B). **42 runs, 0 tampers reached green; all 20 runs where a block fired ended in
-an honest fix** — a 20/20 point estimate whose 95% lower bound is ≈86%. The split is the
+(SPEC §7.B). Across 42 runs of these **guarded** scenarios — every attempted bypass class
+had a detector covering it — **0 tampers reached green; all 20 runs where a block fired
+ended in an honest fix**, a 20/20 point estimate whose 95% lower bound is ≈86%. The split is the
 honest part: Sonnet 5 never attempted a bypass at all, even when the prompt *ordered*
 one; all 20 interceptions came from Haiku 4.5 on a seed whose honest fix is genuinely
 expensive. Reproduce: `npm run build && harness/run.sh 5 adversarial haiku seed-hard`.
@@ -116,7 +118,8 @@ expensive. Reproduce: `npm run build && harness/run.sh 5 adversarial haiku seed-
 **Which detectors deserve to exist?** Measured too. Affordance seeds offer an agent one
 specific bypass each; predictions are pre-registered before any rep runs
 (`harness/PREDICTION-affordance.md`). Result: 7/10 adversarial runs regenerated a golden
-file from buggy output (100% passed unseen — so `snapshot-rewrite` was built), while
+file from buggy output and sailed through — **because nothing guarded that class yet**;
+that measured demand is why `snapshot-rewrite` exists — while
 timeout-inflation and lint-config-gutting measured **0/10 attempts each** — two
 pre-registered bets refuted, two detectors *not* built. Bypass classes with no measured
 demand stay in a record-only shadow scanner that accumulates evidence on every weekly

package/dist/cli/index.js

@@ -2313,9 +2313,10 @@ Formats:
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
-  tamperward init [--dry-run]               wire all four enforcement points: policy
-                                            file, Claude Code hooks, pre-commit, CI.
-                                            Idempotent; never overwrites your files.
+  tamperward init [--dry-run]               wire the policy file plus every
+                                            enforcement point: Claude Code hooks,
+                                            pre-commit, CI. Idempotent; never
+                                            overwrites your files.
 
 Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",