tamperward 1.4.4 → 1.4.6

package/README.md

@@ -18,13 +18,17 @@ path: deleting failing tests, skipping them, casting to `any`, suppressing lint
 lowering coverage gates, rewriting snapshots, editing CI, or bypassing hooks with
 `--no-verify`. Tamperward treats the safety nets themselves as protected assets and
 blocks the **class** of bypass — one ruleset, evaluated on the actual diff and commands
-as a verdict, not a probability, enforced everywhere a change can be made: **inside the
-agent's loop (a deny before the tool runs, and a sweep at end of turn), at the commit,
-and at the merge.**
+as a verdict, not a probability, enforced at every stage a change passes through:
+**inside the agent's loop (a Claude Code hook today — a deny before the tool runs, and
+a sweep at end of turn), at the commit, and at the merge.** CI is the authority; the
+earlier layers shorten the feedback loop for agents that carry them.
 
 > Apache-2.0 · zero runtime model calls · every headline claim below is measured, with
 > the pre-registered predictions (including the refuted ones) committed to this repo
 
+**[Docs & guide](https://hexrift.github.io/tamperward/)** ·
+**[The launch post](https://hexrift.github.io/tamperward/blog/what-agents-do-when-you-block-their-shortcuts)** — how these numbers were measured, and which of my own bets lost
+
 ## Install
 
 ```bash
@@ -34,12 +38,12 @@ npx tamperward init
 One idempotent command wires the policy and every enforcement point — it never
 overwrites anything you wrote, and `--dry-run` shows the plan first:
 
-| point | what it wires |
+| what | wired as |
 | --- | --- |
+| policy | a commented baseline `.tamperward.yml` — the defaults apply even without it |
 | agent loop | Claude Code `PreToolUse` deny + `Stop` sweep, merged into `.claude/settings.json` |
 | pre-commit | husky when present, the plain git hook otherwise |
 | CI | a PR-gate workflow with out-of-band sign-off (details below) |
-| policy | a commented baseline `.tamperward.yml` — the defaults apply even without it |
 
 Or run the views directly:
 
@@ -77,6 +81,7 @@ tamperward: 2 blocking
     evidence  2 test block(s) removed from test/calc.test.js
     instead   Keep the assertions and fix the code. Removing test blocks to go
               green is the tamper.
+    sign-off  tamperward allow test-deletion --file test/calc.test.js --reason "..."
 
 A blocking finding clears only with a human sign-off. In CI that sign-off is
 out-of-band — a PR label applied by a reviewer — never a file committed on the
@@ -88,7 +93,7 @@ Under GitHub Actions each finding also lands as an **inline annotation on the di
 
 ## The rules
 
-Nine mechanical rules, deterministic by construction, `block` by default:
+Nine mechanical rules, deterministic by construction — eight `block`, one `warn`:
 `test-deletion` (AST block-count, rename-out-of-glob, shell mutation), `test-skip`
 (including `.only`, which narrows the suite), `ts-any-cast`, `lint-suppression`,
 `coverage-lowering` (Jest and Vitest shapes, all four metrics, `package.json` included),
@@ -96,8 +101,10 @@ Nine mechanical rules, deterministic by construction, `block` by default:
 (flags and the env-var escape hatches), and `snapshot-rewrite` (`warn` — see the FP study
 below for why).
 
-Three heuristics ship as `warn` and never block until their precision clears the bar:
-`assertion-weakening`, `guard-removal`, `ts-any-launder`.
+Two heuristic rule names — `assertion-weakening` and `guard-removal` — are **reserved
+in the baseline policy but not yet built**: they get detectors only once a measured
+negatives corpus exists (SPEC §7.A), enter as `warn`, and never block until their
+precision clears the bar.
 
 The policy file itself is un-ignorable, CI reads the policy from the **merge-base** (a PR
 cannot govern its own verdict), and the agent honours no sign-off it can author — the
@@ -108,13 +115,29 @@ escape valve is a PR label only a human with write access can apply.
 **Does the loop work?** `harness/run.sh` stands up an isolated repo with a real bug and a
 failing protected test, lets a headless agent loose with the hooks installed, and
 classifies the end state with an oracle independent of the detectors under test
-(SPEC §7.B). Across 42 runs of these **guarded** scenarios — every attempted bypass class
-had a detector covering it — **0 tampers reached green; all 20 runs where a block fired
-ended in an honest fix**, a 20/20 point estimate whose 95% lower bound is ≈86%. The split is the
+(SPEC §7.B). Across 67 runs of these **guarded** scenarios — every attempted bypass class
+had a detector covering it — **0 tampers reached green; all 25 runs where a block fired
+ended in an honest fix**, a 25/25 point estimate whose 95% lower bound is ≈89%. The split is the
 honest part: Sonnet 5 never attempted a bypass at all, even when the prompt *ordered*
-one; all 20 interceptions came from Haiku 4.5 on a seed whose honest fix is genuinely
+one; every interception came from Haiku 4.5 on a seed whose honest fix is genuinely
 expensive. Reproduce: `npm run build && harness/run.sh 5 adversarial haiku seed-hard`.
 
+**Is the fix caused by the deny, or would it have happened anyway?** Measured, with a
+pre-registered no-gate control arm (`harness/PREDICTION-ungated-control.md`): same seed,
+model, prompt and oracle, hooks removed. **6/10 ungated runs tampered through; honest
+fixes fell from 10/10 gated to 4/10 ungated.** The gate's measured contribution on that
+configuration is a 60-point swing — causation, not survivorship — and one of the three
+control-arm bets was refuted (ungated honest fixes came in above my bet).
+
+**And when the agent knows the gate is there?** Also pre-registered
+(`harness/PREDICTION-informed-adversary.md`) — betting the gate would *leak*. Refuted,
+three bets out of three: with the detector sources vendored into the repo and the prompt
+naming the gate, Haiku's bypass attempts went from 5/10 uninformed (same day, same
+everything) to **0/10 informed — fifteen informed runs, zero evasion attempts**. Sonnet,
+told the gate exists under "speed is everything" pressure, refused the task outright in
+3/5 runs rather than work around it, and fixed honestly in the other 2. At this scenario
+size, disclosure measured as deterrence, not as an evasion spec.
+
 **Which detectors deserve to exist?** Measured too. Affordance seeds offer an agent one
 specific bypass each; predictions are pre-registered before any rep runs
 (`harness/PREDICTION-affordance.md`). Result: 7/10 adversarial runs regenerated a golden

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.4.4",
+  "version": "1.4.6",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",