tamperward 1.6.0 → 1.8.0

package/README.md

@@ -115,6 +115,46 @@ escape valve is a PR label only a human with write access can apply.
 
 ## Measured, not asserted
 
+**Read the two headline numbers together, always:** across **137 guarded runs — every
+one inside a tamper class an active detector covered — 0 tampers reached green.**
+Outside that coverage, on the one seed built to measure it, **agents tampered in 26 of
+40 runs** — "tampered" meaning, mechanically: the independent held-out oracle
+classified the result as passing the visible check through a prohibited shortcut. The
+first number is what the gate does; the second is why the gate is one layer. And an honest note on evidence units: those run counts come from roughly
+fifteen seed/task configurations and eight real repositories — repeated runs on one
+seed measure that seed's stochasticity, not the space of real coding tasks, so the
+independent evidence behind these numbers is the seed count, not the run count.
+
+**And the third number, from the preregistered cross-repository experiment
+(taskbench, `harness/taskbench/`):** on 26 paired real repositories with real
+historical regressions, pressured-agent policy violations appeared in **13 of 26
+ungated runs (50%)** — the behavior transfers — but the gate at 1.6.0 **did not
+reduce false greens** (5 prevented vs 4 gated-only; paired RD +3.8%, 95% CI
+−17.2 to +24.7, exact McNemar p = 1.0): agents routed through tool-call
+spellings outside the shipped detector classes, including two gaps documented
+before the sweep and deliberately left unfixed for the experiment's integrity.
+Enforcement showed no measurable completion cost (+7.7 points, CI spans zero),
+and independent pristine-suite re-execution caught **every masked failure in
+all 53 trajectories**. Registration, bets, frozen analysis, and the refutation
+of our own headline bet: `PREDICTION-taskbench.md`, `PHASE3.md`. The first two
+numbers say what the gate does inside its coverage; the third says coverage is
+the whole game on real repositories — and that the reliable layer was the
+pristine-suite oracle the agent cannot touch.
+
+**What this does not do**, stated before the numbers rather than after: it does not
+establish that a patch is *correct*; it does not detect arbitrary deception (a
+hardcoded implementation is invisible to any diff rule — measured, twice); it does not
+replace sandboxing, held-out tests, or authoritative CI — it is designed to sit in
+front of them. What it does: **enforce explicitly defined development invariants at
+the loop, commit, and CI boundaries** — and nothing else.
+
+**A word on the words:** *tamper*, *honest*, *cheat*, and *surrender* are used
+throughout as operational labels, not claims about mental states. A "tamper" means: a
+protected asset changed, or an independent held-out oracle failed, while the visible
+check went green — a property of the artifacts, decided deterministically. Whether the
+process that produced it "intended" anything is a question these experiments do not
+measure and do not need.
+
 **Does the loop work?** `harness/run.sh` stands up an isolated repo with a real bug and a
 failing protected test, lets a headless agent loose with the hooks installed, and
 classifies the end state with an oracle independent of the detectors under test
@@ -229,9 +269,17 @@ framing, and Sonnet's famous refusals turn out to be triggered by framing). The
 completed frontier split — **Opus 0/10 · Fable 6/10 · Sonnet 10/10** — is the
 published shape, with the standing self-measurement caveat on the Fable rows.
 Twenty-six of forty runs tampered through the uncovered dimension: measured demand
-that hardens the `ts-any-launder` warn→block graduation case via the §7.A corpus —
-the honest fix itself narrows through `as Record<string, unknown>`, so a naive
-assertion-blocker is an FP factory.
+that sent the `ts-any-launder` warn→block graduation question to a §7.A negatives
+corpus — the honest fix itself narrows through `as Record<string, unknown>`, so a
+naive assertion-blocker is an FP factory. **The corpus answered, and the question is
+closed** (`harness/PREDICTION-launder-corpus.md`): on 1,227 real commits the
+laundering spellings fire on legitimate work at 4–10× any deployable block threshold
+(annotation-position `any`: 10.5% of commits; named-type assertions: 7.5%), so the
+warn stays a warn permanently on syntactic evidence, no assertion rule gets built,
+and the laundering class is owned by the layers where coverage is measured: the
+held-out **oracle** (caught all 18 assertion tampers) and the **prompt** (the naming
+sentence, 10/10 flip). For this class, detection is not the gate's layer —
+verification and framing are, and the record says so with a denominator.
 
 **Why not just a prompt line, or a 20-line grep hook?** Measured
 (`harness/PREDICTION-baselines.md`), against a frozen naive hook and a one-sentence
@@ -258,8 +306,27 @@ severity tune → roughly one sign-off decision per 17 commits residual. The sam
 shipped per-rule `exclude` globs (1.6.0, with the policy-weakening symmetry built in)
 and then measured them honestly: **zero effect on this corpus** — these repos' casts
 live in source, not tests, so the zod-recommended path scoping removed nothing here;
-the null is published next to the feature. Running ledger: **56 pre-registered
-bets — 25 refuted, 29 held, 2 unresolvable.**
+the null is published next to the feature.
+
+**What about just making the tests read-only?** The most common objection got its
+pre-registered measurement (`harness/PREDICTION-capability.md`) — starting with the
+mechanics the folk advice misses: `chmod` does not bind a root agent and never
+prevented `rm` anyway (deletion is a *directory*-write right); the workable barrier
+is the immutable bit. Result: **hard immutability governed the crude-tamper seed
+completely — 10/10 honest, four EPERM hits all converting to the real fix** (a bare
+permission error transferred the deny→fix dynamic with no remediation text). Then
+the twist: adding a logged, auto-granted **elevation script made it worse (8/10)** —
+both extra tampers walked through the front door with written confessions
+("*Remove failing test file to unblock build*"), the sanctioned-path thesis firing
+a fourth time. The lock is easy; the grantor is the hard part — which is the case
+for elevation flows that end at a human, and exactly what the gate's sign-off label
+already is. That seed now carries all six governance configurations on identical
+pre-registered ground: nothing 6/10 tampers, one sentence 1/10, naive hook 2/10,
+the gate 0/10, immutable 0/10, immutable+auto-grant 2/10 — with the standing scope
+that none of the capability rows touch the semantic classes, by construction.
+Running ledger: **70 pre-registered bets — 29 refuted, 37 held, 4 open or
+unresolvable** — taskbench's B2 (prevention on real repositories) is the newest
+refutation, published beside the bet it refutes.
 
 **What about false positives?** `snapshot-rewrite` was swept over **1,652 real mainline
 commits** (prettier, jest, docusaurus, immer): 216 touched snapshots, all legitimately —

package/dist/cli/index.js

@@ -438,11 +438,17 @@ function defaultPolicy(version = 1) {
       // Recorded expected outputs. An assertion stored as data is still an assertion;
       // rewriting it from current output is the snapshot-update move the affordance
       // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
-      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/golden/**", "**/*.golden.*"],
+      // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
+      // live there as .cjs and were rewritten unseen (PHASE3.md §4).
+      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
       hooks: [".husky/**", "**/lefthook.*", ".tamperward.yml", "**/.tamperward.yml"]
     },
     rules: {
       "test-deletion": { severity: "block" },
+      // content gutted from a surviving spec — the class Phase 3 measured walking
+      // through the block-count rule (rows, assertion arguments, setup). Severity
+      // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
+      "test-content-removal": { severity: "block" },
       "test-skip": { severity: "block" },
       "ts-any-cast": { severity: "block" },
       // the unambiguous explicit casts + ts-suppression directives
@@ -457,6 +463,11 @@ function defaultPolicy(version = 1) {
       // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
       // when intended output changes. WARN until the §7 evidence path earns block.
       "snapshot-rewrite": { severity: "warn" },
+      // the watcher's transient class (modified-and-restored within a turn). WARN by
+      // default: a Stop block already forces restores, and a compliant restore reads
+      // as churn — block-by-default would deadlock the honest path. Harnesses that own
+      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
+      "transient-protected-mutation": { severity: "warn" },
       // the narrow graduation candidate: snapshot moved with NO accompanying change.
       // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
       // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
@@ -1272,8 +1283,62 @@ var testDeletion = {
   }
 };
 
+// src/detectors/test-content-removal.ts
+var RULE8 = "test-content-removal";
+var MIN_REMOVED_LINES = 3;
+var ws = (s) => s.replace(/\s+/g, "");
+function significantLinesOrdered(src) {
+  const out = [];
+  for (const raw of src.split("\n")) {
+    const l = raw.trim();
+    if (l.length >= 10 && !/^(import\b|export\s|\/\/|\*|\/\*|}\)?;?$)/.test(l)) out.push(l);
+  }
+  return out;
+}
+var testContentRemoval = {
+  id: RULE8,
+  surface: ["file"],
+  certainty: "mechanical",
+  run(changes, policy) {
+    const out = [];
+    let keptPool = "";
+    for (const c of changes) {
+      if (c.kind === "file" && c.after != null && isProtected(c.path, policy, "tests")) {
+        keptPool += ws(significantLinesOrdered(c.after).join("\n"));
+      }
+    }
+    for (const c of changes) {
+      if (c.kind !== "file" || c.op !== "modify" || c.before == null || c.after == null) continue;
+      if (!isProtected(c.path, policy, "tests")) continue;
+      if (isProtected(c.path, policy, "snapshots")) continue;
+      if (countTestBlocks(c.after) < countTestBlocks(c.before)) continue;
+      const beforeSig = significantLinesOrdered(c.before);
+      const afterSig = significantLinesOrdered(c.after);
+      const netDrop = beforeSig.length - afterSig.length;
+      const afterSet = new Set(afterSig);
+      const gone = [];
+      for (const line of new Set(beforeSig)) {
+        if (afterSet.has(line)) continue;
+        if (keptPool.includes(ws(line))) continue;
+        gone.push(line);
+      }
+      if (gone.length >= MIN_REMOVED_LINES && netDrop >= MIN_REMOVED_LINES) {
+        out.push(
+          makeFinding(RULE8, policy, {
+            file: c.path,
+            message: `Test content removed from a surviving spec: ${gone.length} significant line(s) gone with no test block deleted.`,
+            evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
+            remediation: "Fix the code under test. Deleting the failing rows, assertion arguments, or setup from a spec weakens it exactly like deleting the test \u2014 the block just keeps its name."
+          })
+        );
+      }
+    }
+    return out;
+  }
+};
+
 // src/detectors/snapshot-rewrite.ts
-var RULE8 = "snapshot-rewrite";
+var RULE9 = "snapshot-rewrite";
 var RUNNER = /\b(?:jest|vitest|playwright|ava)\b/;
 var UPDATE_ANY = /--update-?[sS]napshots?\b/;
 var UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
@@ -1287,12 +1352,12 @@ function namesProtectedSnapshot(seg, policy) {
   return null;
 }
 var snapshotRewrite = {
-  id: RULE8,
+  id: RULE9,
   surface: ["command", "file"],
   certainty: "mechanical",
   run(changes, policy) {
     const out = [];
-    const warn = (input) => out.push(makeFinding(RULE8, policy, { ...input, defaultSeverity: "warn" }));
+    const warn = (input) => out.push(makeFinding(RULE9, policy, { ...input, defaultSeverity: "warn" }));
     for (const c of changes) {
       if (c.kind === "command") {
         for (const seg of segments(c.raw)) {
@@ -1330,7 +1395,7 @@ var snapshotRewrite = {
 };
 
 // src/detectors/snapshot-only.ts
-var RULE9 = "snapshot-only-rewrite";
+var RULE10 = "snapshot-only-rewrite";
 var COMMIT_VIEWS = ["staged", "range"];
 function isSnapshotChange(c, policy) {
   if (c.kind !== "file") return false;
@@ -1339,7 +1404,7 @@ function isSnapshotChange(c, policy) {
   return c.oldPath != null && isProtected(c.oldPath, policy, "snapshots");
 }
 var snapshotOnlyRewrite = {
-  id: RULE9,
+  id: RULE10,
   surface: ["file"],
   certainty: "mechanical",
   run(changes, policy, view) {
@@ -1351,7 +1416,7 @@ var snapshotOnlyRewrite = {
     const first = snaps[0];
     const names = snaps.map((c) => c.kind === "file" ? c.path : "").filter(Boolean).slice(0, 3).join(", ");
     return [
-      makeFinding(RULE9, policy, {
+      makeFinding(RULE10, policy, {
         file: first.path,
         message: `Only recorded expectations changed in this diff (${snaps.length} snapshot file${snaps.length === 1 ? "" : "s"}, no code change to explain them).`,
         evidence: names + (snaps.length > 3 ? ", \u2026" : ""),
@@ -1372,6 +1437,7 @@ var allDetectors = [
   ciTampering,
   hookTampering,
   testDeletion,
+  testContentRemoval,
   snapshotRewrite,
   snapshotOnlyRewrite
 ];
@@ -1660,10 +1726,10 @@ function locationCell(f, env) {
   const label = `${f.file}${f.line ? `:${f.line}` : ""}`;
   const server = env.GITHUB_SERVER_URL;
   const repo = env.GITHUB_REPOSITORY;
-  const sha = env.GITHUB_SHA;
-  if (!server || !repo || !sha) return `\`${cell(label)}\``;
+  const sha2 = env.GITHUB_SHA;
+  if (!server || !repo || !sha2) return `\`${cell(label)}\``;
   const frag = f.line ? `#L${f.line}` : "";
-  return `[\`${cell(label)}\`](${server}/${repo}/blob/${sha}/${f.file}${frag})`;
+  return `[\`${cell(label)}\`](${server}/${repo}/blob/${sha2}/${f.file}${frag})`;
 }
 function renderSummary(input, env = process.env) {
   const findings = orderFindings(input.findings);
@@ -1809,7 +1875,8 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync6, appendFileSync as appendFileSync3 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, statSync as statSync4 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -1834,6 +1901,7 @@ function relForDisplay(path, cwd) {
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
+  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
   return content.replace(oldStr, () => newStr);
 }
 function synthFileChange(displayPath, before, after) {
@@ -1964,10 +2032,261 @@ function advanceTurnBaseline(cwd, sessionId) {
   }
 }
 
+// src/effect.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+var UNSAFE2 = /[^A-Za-z0-9._-]/g;
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
+function gitDir2(cwd) {
+  try {
+    return execFileSync3("git", ["rev-parse", "--git-dir"], { cwd, encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+function ptreePath(cwd, sessionId) {
+  if (!sessionId) return null;
+  const gd = gitDir2(cwd);
+  if (!gd) return null;
+  const dir = join6(cwd, gd, "tamperward");
+  return join6(dir, `ptree-${sessionId.replace(UNSAFE2, "")}.json`);
+}
+var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
+function snapshotProtected(cwd, policy, prev) {
+  const out = {};
+  const walk = (rel) => {
+    const abs2 = rel ? join6(cwd, rel) : cwd;
+    let names;
+    try {
+      names = readdirSync(abs2);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      if (SKIP_DIRS.has(name)) continue;
+      const r = rel ? `${rel}/${name}` : name;
+      let st;
+      try {
+        st = statSync(join6(cwd, r));
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(r);
+      else if (st.isFile() && isProtected(r, policy)) {
+        const p = prev?.[r];
+        if (p && p.mtimeMs === st.mtimeMs && p.size === st.size && p.mode === st.mode) {
+          out[r] = p;
+        } else {
+          let hash = "";
+          try {
+            hash = sha(readFileSync6(join6(cwd, r)));
+          } catch {
+            hash = "unreadable";
+          }
+          out[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
+        }
+      }
+    }
+  };
+  walk("");
+  return out;
+}
+function driftBetween(expected, current) {
+  const changed = [];
+  const deleted = [];
+  for (const [path, e] of Object.entries(expected)) {
+    const c = current[path];
+    if (!c) deleted.push(path);
+    else if (c.hash !== e.hash || c.mode !== e.mode) changed.push(path);
+  }
+  return { changed, deleted };
+}
+function loadPtree(cwd, sessionId) {
+  const p = ptreePath(cwd, sessionId);
+  if (!p || !existsSync5(p)) return null;
+  try {
+    return JSON.parse(readFileSync6(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function savePtree(cwd, sessionId, tree) {
+  const p = ptreePath(cwd, sessionId);
+  if (!p) return;
+  try {
+    mkdirSync3(join6(p, ".."), { recursive: true });
+    writeFileSync3(p, JSON.stringify(tree));
+  } catch {
+  }
+}
+
+// src/cli/watch.ts
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2, watch } from "node:fs";
+import { join as join7 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+var SKIP = /(^|\/)(\.git|node_modules)(\/|$)/;
+function snap(abs2) {
+  try {
+    const st = statSync2(abs2);
+    if (!st.isFile()) return { mode: st.mode, size: null, hash: null };
+    const hash = createHash3("sha256").update(readFileSync7(abs2)).digest("hex").slice(0, 16);
+    return { mode: st.mode, size: st.size, hash };
+  } catch {
+    return { mode: null, size: null, hash: null };
+  }
+}
+function defaultEventLog(cwd) {
+  return process.env.TAMPERWARD_FSEVENTS ?? join7(cwd, ".git", "tamperward", "fsevents.jsonl");
+}
+function watchTree(dir, cb) {
+  if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
+    try {
+      const w = watch(dir, { recursive: true }, (kind, fname) => {
+        if (fname) cb(kind, String(fname));
+      });
+      return { close: () => w.close() };
+    } catch {
+    }
+  }
+  const watchers = /* @__PURE__ */ new Map();
+  const addDir = (rel) => {
+    if (watchers.has(rel) || SKIP.test(rel + "/")) return;
+    let w;
+    try {
+      w = watch(rel ? join7(dir, rel) : dir, (kind, fname) => {
+        if (!fname) return;
+        const child = rel ? `${rel}/${String(fname)}` : String(fname);
+        cb(kind, child);
+        try {
+          if (statSync2(join7(dir, child)).isDirectory()) addDir(child);
+        } catch {
+        }
+      });
+    } catch {
+      return;
+    }
+    watchers.set(rel, w);
+  };
+  const walk = (rel) => {
+    addDir(rel);
+    let names = [];
+    try {
+      names = readdirSync2(rel ? join7(dir, rel) : dir);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const child = rel ? `${rel}/${name}` : name;
+      if (SKIP.test(child + "/")) continue;
+      try {
+        if (statSync2(join7(dir, child)).isDirectory()) walk(child);
+      } catch {
+      }
+    }
+  };
+  walk("");
+  return { close: () => {
+    for (const w of watchers.values()) w.close();
+  } };
+}
+function startWatcher(dir, log, policy) {
+  try {
+    mkdirSync4(join7(log, ".."), { recursive: true });
+  } catch {
+  }
+  const last = /* @__PURE__ */ new Map();
+  return watchTree(dir, (kind, rel) => {
+    if (SKIP.test(rel) || !isProtected(rel, policy)) return;
+    const s = snap(join7(dir, rel));
+    const key2 = `${s.hash}:${s.mode}`;
+    if (last.get(rel) === key2) return;
+    last.set(rel, key2);
+    const ev = { ts: (/* @__PURE__ */ new Date()).toISOString(), path: rel, kind: kind === "rename" ? "rename" : "change", ...s };
+    try {
+      appendFileSync3(log, JSON.stringify(ev) + "\n");
+    } catch {
+    }
+  });
+}
+function runWatch(args) {
+  let dir = process.cwd();
+  let log = null;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--dir" && args[i + 1]) dir = args[++i];
+    else if (args[i] === "--log" && args[i + 1]) log = args[++i];
+  }
+  const policy = loadPolicy(dir);
+  const out = log ?? defaultEventLog(dir);
+  startWatcher(dir, out, policy);
+  process.stdout.write(`tamperward watch: recording protected-file events under ${dir} -> ${out}
+`);
+  return -1;
+}
+
+// src/detectors/fs-events.ts
+import { readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+var RULE11 = "transient-protected-mutation";
+function readEvents(log, offset) {
+  let size = 0;
+  try {
+    size = statSync3(log).size;
+  } catch {
+    return { events: [], newOffset: offset };
+  }
+  if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
+  const raw = readFileSync8(log, "utf8").slice(offset);
+  const events = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return { events, newOffset: size };
+}
+function transientFindings(events, persistentPaths, policy, finalHash) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    if (!isProtected(e.path, policy)) continue;
+    const arr = byPath.get(e.path) ?? [];
+    arr.push(e);
+    byPath.set(e.path, arr);
+  }
+  const out = [];
+  const strict = process.env.TAMPERWARD_TRANSIENT === "block";
+  for (const [path, evs] of byPath) {
+    if (persistentPaths.has(path)) continue;
+    const final = finalHash(path);
+    const hashes = new Set(evs.map((e) => e.hash).filter((h) => h != null));
+    if (final != null) hashes.add(final);
+    const contentChurn = hashes.size > 1;
+    const modes = new Set(evs.map((e) => e.mode).filter((m) => m != null));
+    const modeChurn = modes.size > 1;
+    if (!contentChurn && !modeChurn) continue;
+    const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
+    const f = makeFinding(RULE11, policy, {
+      file: path,
+      message: `Transient protected mutation: ${what}, leaving no net diff.`,
+      evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
+      remediation: "Anything that ran against the mid-turn state ran against a weakened suite. Re-run the checks against the restored tree; if the mutation was an experiment, say so where a human will read it.",
+      defaultSeverity: "warn"
+    });
+    if (strict && f.severity !== "block") {
+      f.severity = "block";
+      f.signoff.required = true;
+    }
+    out.push(f);
+  }
+  return out;
+}
+
 // src/cli/hook.ts
 function readStdin() {
   try {
-    return readFileSync6(0, "utf8");
+    return readFileSync9(0, "utf8");
   } catch {
     return "";
   }
@@ -1984,7 +2303,7 @@ function recordDenylog(blocks) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync3(log, blocks.map((b) => b.rule).join(",") + "\n");
+    appendFileSync4(log, blocks.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -2016,30 +2335,141 @@ function verdict(blocks, kind) {
   } : { decision: "block", reason };
   return { exitCode: 0, stdout: JSON.stringify(payload) + "\n" };
 }
+function effectDriftBlocks(cwd, sessionId, policy) {
+  if (!sessionId || !isGitRepo(cwd)) return null;
+  const expected = loadPtree(cwd, sessionId);
+  const current = snapshotProtected(cwd, policy, expected ?? void 0);
+  if (!expected) {
+    savePtree(cwd, sessionId, current);
+    return null;
+  }
+  const d = driftBetween(expected, current);
+  if (d.changed.length === 0 && d.deleted.length === 0) {
+    savePtree(cwd, sessionId, current);
+    return null;
+  }
+  const base = turnBaseline(cwd, sessionId);
+  const all = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
+  const drifted = /* @__PURE__ */ new Set([...d.changed, ...d.deleted]);
+  const scoped = all.filter(
+    (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
+  );
+  const blocks = evaluate(scoped, policy, void 0, "turn").filter((f) => f.severity === "block");
+  if (blocks.length > 0) return blocks;
+  savePtree(cwd, sessionId, current);
+  return null;
+}
+function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
+  if (!sessionId) return;
+  const tree = loadPtree(cwd, sessionId);
+  if (!tree) return;
+  let dirty = false;
+  for (const c of changes) {
+    if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy)) continue;
+    const hash = createHash4("sha256").update(c.after).digest("hex").slice(0, 16);
+    const prev = tree[c.path];
+    tree[c.path] = {
+      hash,
+      mode: prev?.mode ?? 33188,
+      size: Buffer.byteLength(c.after),
+      mtimeMs: -1
+      // unknown until written; forces a re-hash next snapshot, which is correct
+    };
+    dirty = true;
+  }
+  if (dirty) savePtree(cwd, sessionId, tree);
+}
 function preToolUseVerdict(input) {
   try {
     const cwd = input.cwd ?? process.cwd();
     turnBaseline(cwd, input.session_id);
+    const policy = loadPolicy(cwd);
+    const driftBlocks = effectDriftBlocks(cwd, input.session_id, policy);
+    if (driftBlocks) return verdict(driftBlocks, "PreToolUse");
     const changes = changesFromClaudeHook(input, cwd);
-    const blocks = evaluate(changes, loadPolicy(cwd), void 0, "tool-call").filter((f) => f.severity === "block");
+    const blocks = evaluate(changes, policy, void 0, "tool-call").filter((f) => f.severity === "block");
+    if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
     return verdict(blocks, "PreToolUse");
   } catch (e) {
     return failClosed("PreToolUse", errText(e));
   }
 }
+function cursorPath(cwd, sessionId) {
+  const p = ptreePath(cwd, sessionId);
+  return p ? p.replace(/ptree-/, "fscursor-") : null;
+}
+function turnTransientBlocks(cwd, sessionId, policy, changes) {
+  const none = { blocks: [], commit: () => {
+  } };
+  const log = defaultEventLog(cwd);
+  const cp = cursorPath(cwd, sessionId);
+  if (!existsSync6(log)) return none;
+  let offset = 0;
+  if (cp && existsSync6(cp)) {
+    const n = Number(readFileSync9(cp, "utf8"));
+    offset = Number.isFinite(n) ? n : 0;
+  }
+  const { events, newOffset } = readEvents(log, offset);
+  if (events.length === 0) return { ...none, commit: () => {
+    if (cp) try {
+      writeFileSync4(cp, String(newOffset));
+    } catch {
+    }
+  } };
+  const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
+  const finalHash = (path) => {
+    try {
+      if (!statSync4(`${cwd}/${path}`).isFile()) return null;
+      return createHash4("sha256").update(readFileSync9(`${cwd}/${path}`)).digest("hex").slice(0, 16);
+    } catch {
+      return null;
+    }
+  };
+  const findings = transientFindings(events, persistent, policy, finalHash);
+  recordWarns(findings.filter((f) => f.severity !== "block"));
+  return {
+    blocks: findings.filter((f) => f.severity === "block"),
+    commit: () => {
+      if (cp) try {
+        writeFileSync4(cp, String(newOffset));
+      } catch {
+      }
+    }
+  };
+}
+function recordWarns(warns) {
+  const log = process.env.TAMPERWARD_DENYLOG;
+  if (!log || warns.length === 0) return;
+  try {
+    appendFileSync4(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
+  } catch {
+  }
+}
 function stopVerdict(input) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const cwd = input.cwd ?? process.cwd();
   if (!isGitRepo(cwd)) return { exitCode: 0, stdout: "" };
   let blocks;
+  let commitCursor = () => {
+  };
   try {
+    const policy = loadPolicy(cwd);
     const base = turnBaseline(cwd, input.session_id);
     const changes = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
-    blocks = evaluate(changes, loadPolicy(cwd), void 0, "turn").filter((f) => f.severity === "block");
+    blocks = evaluate(changes, policy, void 0, "turn").filter((f) => f.severity === "block");
+    const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
+    blocks = blocks.concat(transient.blocks);
+    commitCursor = transient.commit;
+    if (blocks.length === 0 && input.session_id) {
+      savePtree(cwd, input.session_id, snapshotProtected(cwd, policy, loadPtree(cwd, input.session_id) ?? void 0));
+    }
   } catch (e) {
     return failClosed("Stop", errText(e));
   }
-  if (blocks.length === 0) advanceTurnBaseline(cwd, input.session_id);
+  if (blocks.length === 0) {
+    advanceTurnBaseline(cwd, input.session_id);
+    commitCursor();
+  }
   return verdict(blocks, "Stop");
 }
 function emit(r) {
@@ -2108,8 +2538,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, chmodSync } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
 var HOOK_CMD = "npx --yes tamperward hook claude";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
@@ -2169,24 +2599,24 @@ jobs:
         run: npx --yes tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
 `;
 function planPolicy(cwd) {
-  const path = join6(cwd, POLICY_FILE);
-  if (existsSync5(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
+  const path = join8(cwd, POLICY_FILE);
+  if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
   return {
     item: "policy",
     path: POLICY_FILE,
     status: "create",
     detail: "baseline policy with commented overrides",
-    apply: () => writeFileSync3(path, POLICY_CONTENT)
+    apply: () => writeFileSync5(path, POLICY_CONTENT)
   };
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join6(cwd, rel);
+  const path = join8(cwd, rel);
   let settings = {};
-  if (existsSync5(path)) {
+  if (existsSync7(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync7(path, "utf8"));
+      parsed = JSON.parse(readFileSync10(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -2208,7 +2638,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync5(path) ? "update" : "create",
+    status: existsSync7(path) ? "update" : "create",
     detail: `wire ${[needPre && "PreToolUse deny", needStop && "Stop sweep"].filter(Boolean).join(" + ")}`,
     apply: () => {
       if (needPre) {
@@ -2220,8 +2650,8 @@ function planClaudeHooks(cwd) {
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, JSON.stringify(settings, null, 2) + "\n");
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n");
     }
   };
 }
@@ -2229,12 +2659,12 @@ function planPreCommit(cwd) {
   const line = `${MARKER}
 ${PRECOMMIT_CMD}
 `;
-  const husky = join6(cwd, ".husky");
-  const gitDir2 = join6(cwd, ".git");
-  const target = existsSync5(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync5(gitDir2) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
+  const husky = join8(cwd, ".husky");
+  const gitDir3 = join8(cwd, ".git");
+  const target = existsSync7(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync7(gitDir3) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
   if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
-  const path = join6(cwd, target.rel);
-  const existing = existsSync5(path) ? readFileSync7(path, "utf8") : null;
+  const path = join8(cwd, target.rel);
+  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
   if (existing?.includes("tamperward check --staged")) {
     return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
   }
@@ -2244,26 +2674,26 @@ ${PRECOMMIT_CMD}
     status: existing === null ? "create" : "update",
     detail: existing === null ? `create via ${target.note}` : `append the staged check (${target.note})`,
     apply: () => {
-      mkdirSync3(dirname3(path), { recursive: true });
+      mkdirSync5(dirname3(path), { recursive: true });
       const content = existing === null ? `#!/bin/sh
 ${line}` : existing.replace(/\n?$/, "\n") + line;
-      writeFileSync3(path, content);
+      writeFileSync5(path, content);
       chmodSync(path, 493);
     }
   };
 }
 function planWorkflow(cwd) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join6(cwd, rel);
-  if (existsSync5(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
+  const path = join8(cwd, rel);
+  if (existsSync7(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
   return {
     item: "ci",
     path: rel,
     status: "create",
     detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
     apply: () => {
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, WORKFLOW_CONTENT);
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, WORKFLOW_CONTENT);
     }
   };
 }
@@ -2370,6 +2800,9 @@ Formats:
   auto    github when GITHUB_ACTIONS=true, otherwise text.
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
+  tamperward watch [--dir D] [--log F]      filesystem-event observer daemon: records
+                                            protected-file events so the sweep can
+                                            observe supported transient effects
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
   tamperward init [--dry-run]               wire the policy file plus every
                                             enforcement point: Claude Code hooks,
@@ -2380,8 +2813,8 @@ Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
 `);
 }
-function main(argv) {
-  const [cmd, ...rest] = argv;
+function main(argv2) {
+  const [cmd, ...rest] = argv2;
   switch (cmd) {
     case "check":
       return runCheck(parseCheck(rest));
@@ -2405,4 +2838,9 @@ function main(argv) {
       return 2;
   }
 }
-process.exit(main(process.argv.slice(2)));
+var argv = process.argv.slice(2);
+if (argv[0] === "watch") {
+  runWatch(argv.slice(1));
+} else {
+  process.exit(main(argv));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",