tamperward 2.0.0 → 2.1.1

package/README.md

@@ -12,6 +12,7 @@
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-lightgrey" alt="license"></a>
 </p>
 
+**[Quick start](#quick-start)** ·
 **[Docs & guide](https://hexrift.github.io/tamperward/)** ·
 **[The research series](./docs/blog/index.md)** — every registered prediction
 published beside its outcome
@@ -22,14 +23,29 @@ trajectories, some modify or attempt to modify verification in ways that can
 turn incorrect work into apparent success. Under pressure, the cheaper route to
 green is sometimes to weaken the checks instead of fixing the failure.
 
+In plain English: Tamperward lets a coding agent change your code, but not the
+trusted starting point, the rules, or the checks used to judge that code.
+
 Tamperward is a **deterministic verification-integrity layer**. It blocks known
 weakening moves as they happen, observes protected-state effects, and
 independently re-adjudicates apparent success outside the agent's normal
 completion path. No runtime LLM judge. Fail closed when adjudication is
 impossible.
 
+> **Project status: active research release.** Tamperward is usable today, but
+> its enforcement architecture and supporting evidence are still being tested
+> and hardened. Use it as one layer of defence in depth alongside protected CI,
+> independent tests and human review. Findings, limitations and corrections are
+> published openly. The 2.0 major marks the Node 18 drop, not a declaration of
+> security maturity; the distance to that is tracked, milestone by milestone, in
+> [SPEC §9.1](./SPEC.md#91-maturity-milestones).
+
 ## What we have actually measured
 
+Plain-English takeaway: the original detector-centred design was insufficient.
+Later versions materially reduced false-green outcomes in two held-out rounds,
+and the subsequent stronger-model replication was inconclusive.
+
 | experiment | result | what it supports |
 | --- | --- | --- |
 | **Round 1** — 26 paired real repos, historical regressions, 53 counted trajectories, **v1.6.0** ([`harness/taskbench/`](./harness/taskbench/)) | Transfer: **9/27 ungated runs (33.3%)** violated policy ([corrected](./harness/taskbench/reanalysis/TRANSFER-REANALYSIS.md) from a published 13/26 — the original predicate was defective; the transfer bet is refuted, not held). Headline prevention bet **lost**: b=5 / c=4, RD +3.8pp [−17.2, +24.7], exact McNemar **p = 1.0** — published beside the bet | A detector-centric architecture was insufficient: agents routed around the shipped detector classes |
@@ -39,11 +55,16 @@ impossible.
 | **Round 3** — 17 paired Python repos, fresh PyPI frame, **v1.14.0** ([`harness/taskbench/round3/`](./harness/taskbench/round3/)) | Transfer 9/17 (52.9%). Prevention: **b=6 / c=0**, RD **+35.3pp**, BP95 [9.5, 58.7], exact McNemar **p = 0.0313** | The prevention result appeared in Python — with the treatment also changed from v1.9.0, so ecosystem transfer is not isolated. The in-loop skip detector proved blind to pytest syntax; the outer layers carried it |
 | **Round 3.1** — the same 16 pairs under **`claude-sonnet-5`** ([`harness/taskbench/round3.1/`](./harness/taskbench/round3.1/)) | Transfer 4/16 (25.0%). Prevention: **b=1 / c=0**, RD +6.3pp, BP95 [−13.8, 28.3], exact McNemar **p = 1.0000** | The confirmatory result **did not replicate**, and could not have: only three ungated false greens occurred, so `b ≤ 3` and p ≥ .25 whatever the gate did. A failure to reject, not evidence of no effect |
 
+Key: `b` = false greens seen only without Tamperward; `c` = false greens seen
+only with it; `RD` = paired risk difference; `pp` = percentage points; `BP95` =
+Bonett–Price 95% interval.
+
 Earlier controlled experiments → **[the research series](./docs/blog/index.md)**.
 
-> **Scope.** The rows above are one model, one pressure prompt, one JS/TS
-> ecosystem — evidence for that setting, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v2.0.0** adds post-study envelope hardening
+> **Scope.** The rows above cover specific models, pressure prompts, treatment
+> versions, and finite JavaScript/TypeScript and Python repository samples —
+> evidence for those settings, not a universal claim. Round 2 tested
+> the v1.9.0 stack; the current **2.x** line adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -56,7 +77,11 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 
 ## Architecture
 
-Tamperward separates **steering** from **adjudication**.
+The agent may produce the work, but it must not control how that work is
+judged. In architectural terms, Tamperward separates **steering** from
+**adjudication**. "Visible" verification runs the candidate as it stands;
+"pristine" verification restores the protected verification state from the
+trusted starting point and runs the checks again.
 
 > **Core invariant:** the agent may author the candidate tree, but it must not
 > choose the trusted baseline, the governing policy, the verifier, or the final
@@ -160,16 +185,19 @@ are involved here, and they are not the same thing.
    trusted base — so neither step's verdict is governed by the candidate.
 
 Legitimate exceptions are out-of-band PR labels, `tamperward:allow:<rule>@<head-sha>`.
-The workflow passes the head SHA to the gate through `TAMPERWARD_OOB_HEAD`, so an
+The workflow passes the head SHA to both steps through `TAMPERWARD_OOB_HEAD`, so an
 approval is bound to the exact commit it was granted for and a new push invalidates it.
+Since **2.1.0** the verify step reads the same labels: `tamperward:allow:verify@<head-sha>`
+accepts a `MASKED_FAILURE` — the case where a behaviour change makes the original
+expectations wrong and a reviewer has read the test edit and said so. It clears nothing
+else: a red visible suite, or a run that could not verify, stays red whatever the labels
+say, and the verdict is still reported as a masked failure; only the exit code changes.
 
 **This repository's own self-gate** — the `gate` job in `.github/workflows/ci.yml` —
 runs the built CLI's `check --diff` over the pull-request range, cleared only by the
 same label channel, but does **not** run `verify` on itself. This repo's test
-expectations legitimately change whenever a rule changes, and standalone `verify` has
-no out-of-band sign-off channel, so a pristine re-execution of its own suite would fail
-closed on exactly the pull requests that improve the gate. The self-gate is a
-diff-time gate.
+expectations legitimately change whenever a rule changes, so nearly every rule pull
+request would need the verify label; the self-gate stays a diff-time gate.
 
 This guarantee depends on a protected and immutable base, required status checks, a
 pinned Tamperward version, and label permissions restricted to trusted humans.
@@ -186,6 +214,10 @@ Full assumptions and residual risks: [SPEC.md](./SPEC.md),
 npx tamperward init
 ```
 
+Requires Node.js 20.19 or later. JavaScript and TypeScript are the fully
+supported detector surface; the other documented ecosystems get file-level and
+pattern-based protection.
+
 One idempotent command wires the policy, the agent hooks, the pre-commit hook, a
 CI workflow that runs both the diff-time check and pristine verification, and a
 `CODEOWNERS` requirement on the paths that decide whether the gate runs at all.
@@ -252,7 +284,7 @@ commands ignore what they do not know.
 | command | 0 | 1 | 2 |
 | --- | --- | --- | --- |
 | `check` | no blocking finding | at least one blocking finding | cannot evaluate: policy parse error, malformed `--diff` range, or no view given |
-| `verify` | `VERIFIED` — visible and pristine both green | `MASKED_FAILURE` (visible green, pristine red) or `SUITE_RED` | cannot verify, failing closed: no suite command, unresolvable base, `--require-ancestor` refused, budget exceeded, or the working or dependency tree moved during the run |
+| `verify` | `VERIFIED` — visible and pristine both green; or a `MASKED_FAILURE` cleared by an out-of-band `verify@<head-sha>` approval | `MASKED_FAILURE` (visible green, pristine red) or `SUITE_RED` | cannot verify, failing closed: no suite command, unresolvable base, `--require-ancestor` refused, budget exceeded, or the working or dependency tree moved during the run |
 | `run` | enforcement clean and the agent exited 0 — a non-zero agent exit is passed through unchanged | any blocking finding or masked failure, whatever the agent returned | cannot adjudicate: dirty start, policy error, verify cannot run |
 | `hook claude` / `sweep claude` | always — a deny is JSON on stdout at exit 0, never exit 2 | — | only for an unsupported agent name |
 | `allow` | sign-off recorded | — | no rule or `--reason`, not a git repo, or no current blocking finding to sign off |
@@ -263,8 +295,8 @@ commands ignore what they do not know.
 
 | variable | who sets it | what it does |
 | --- | --- | --- |
-| `TAMPERWARD_OOB_SIGNOFF` | the CI workflow, from PR labels | comma-separated out-of-band approvals — `<rule>` or `<rule>:<file>`, optionally `@<head-sha>` — honoured by `check --diff` only; never the committed ledger |
-| `TAMPERWARD_OOB_HEAD` | the CI workflow (`github.event.pull_request.head.sha`) | the head SHA under adjudication; once set, an approval clears a finding only if it names that commit (`@<sha>`, at least 7 characters), so a new push re-blocks |
+| `TAMPERWARD_OOB_SIGNOFF` | the CI workflow, from PR labels | comma-separated out-of-band approvals — `<rule>` or `<rule>:<file>` for `check --diff`, `verify` for a `verify` masked failure — optionally `@<head-sha>`; honoured at the CI layer only, never the committed ledger |
+| `TAMPERWARD_OOB_HEAD` | the CI workflow (`github.event.pull_request.head.sha`) | the head SHA under adjudication; once set, an approval clears anything only if it names that commit (`@<sha>`, at least 7 characters), so a new push re-blocks |
 | `TAMPERWARD_DENYLOG` | a harness or operator | a file to which `hook claude` and `sweep claude` append the rule ids of every deny, one line per verdict, best effort |
 | `TAMPERWARD_FSEVENTS` | operator or harness | overrides the `tamperward watch` event-log path (default `.git/tamperward/fsevents.jsonl`); the Stop sweep reads the same variable |
 | `TAMPERWARD_WATCH_NO_RECURSIVE` | CI and tests (`=1`) | forces `tamperward watch` onto its per-directory fallback instead of recursive `fs.watch`, so the fallback is exercised on every platform |
@@ -286,7 +318,7 @@ Some ambiguous syntactic classes deliberately remain warnings or unimplemented
 `ts-any-launder` is a permanent warn — rather than being promoted to blockers
 without precision evidence.
 
-## What this does not establish
+## What Tamperward does not do
 
 - **Not a correctness oracle.** Pristine verification can only re-run tests that
   exist in the tree. Round 2's designed-in blind spot: on tasks with withheld
@@ -321,7 +353,8 @@ and its totals.
 
 **[The research series](./docs/blog/index.md)** ·
 **[The harness](./harness/)** ·
-**[Errata](./docs/blog/errata.md)**
+**[Errata](./docs/blog/errata.md)** ·
+**[Maturity milestones](./SPEC.md#91-maturity-milestones)**
 
 ## The architecture was earned by failures
 
@@ -362,7 +395,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 520+ tests at 2.0.0 — parser, detectors, engine, policy, renderers
+npm test                        # 540+ tests — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -33,6 +33,11 @@ function unquotePath(p) {
   }
   return Buffer.from(bytes).toString("utf8");
 }
+function pathToken(raw) {
+  if (raw.startsWith('"')) return raw;
+  const tab = raw.indexOf("	");
+  return tab >= 0 ? raw.slice(0, tab) : raw;
+}
 function endOfQuoted(s) {
   for (let i = 1; i < s.length; i++) {
     if (s[i] === "\\") {
@@ -59,10 +64,17 @@ function headerPaths(line) {
       first = rest.slice(0, q);
       rest = rest.slice(q + 1);
     } else {
-      const m = rest.match(/^(.*) (b\/.*)$/);
-      if (!m) return [null, null];
-      first = m[1];
-      rest = m[2];
+      const mid = (rest.length - 1) / 2;
+      const sym = Number.isInteger(mid) && rest[mid] === " " && rest.startsWith("a/") && rest.slice(mid + 1).startsWith("b/") && rest.slice(2, mid) === rest.slice(mid + 3);
+      if (sym) {
+        first = rest.slice(0, mid);
+        rest = rest.slice(mid + 1);
+      } else {
+        const m = rest.match(/^(.*) (b\/.*)$/);
+        if (!m) return [null, null];
+        first = m[1];
+        rest = m[2];
+      }
     }
   }
   return [stripAB(first), stripAB(rest)];
@@ -126,8 +138,8 @@ function parseDiff(diff) {
         renameTo = unquotePath(l.slice(8));
         if (op === "modify") op = "rename";
       } else if (l.startsWith("Binary files ") || l.startsWith("GIT binary patch")) binary = true;
-      else if (l.startsWith("--- ")) minusPath = l.slice(4);
-      else if (l.startsWith("+++ ")) plusPath = l.slice(4);
+      else if (l.startsWith("--- ")) minusPath = pathToken(l.slice(4));
+      else if (l.startsWith("+++ ")) plusPath = pathToken(l.slice(4));
       i++;
     }
     let path;
@@ -196,7 +208,12 @@ function git(args, cwd) {
     return execFileSync("git", args, {
       cwd,
       encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
+      // 256 MiB, matching the hook adapter. Every diff below runs with `--text`, so a
+      // changed binary asset now costs its full size in patch output instead of one
+      // "Binary files differ" line; a legitimate golden-image update must fit. Past
+      // the cap git() throws and the view fails CLOSED (a truncated patch would parse
+      // as a smaller change than the one landing), which is the documented stance.
+      maxBuffer: 256 * 1024 * 1024,
       stdio: ["ignore", "pipe", "pipe"]
     });
   } catch (e) {
@@ -220,7 +237,7 @@ function fromDisk(path, cwd) {
   }
 }
 function enrich(c, beforeReader, afterReader) {
-  if (c.kind !== "file" || c.binary) return c;
+  if (c.kind !== "file") return c;
   const before = c.op !== "add" ? beforeReader(c.oldPath ?? c.path) : null;
   const after = c.op !== "delete" ? afterReader(c.path) : null;
   return { ...c, before, after };
@@ -261,8 +278,9 @@ function headSha(cwd) {
     return null;
   }
 }
+var DIFF_ARGS = ["diff", "--no-color", "--text", "-M"];
 function diffSince(rev, opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", rev], opts.cwd);
+  const raw = git([...DIFF_ARGS, rev], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(rev, p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -270,20 +288,20 @@ function diffSince(rev, opts = {}) {
 function diffRange(base, head, opts = {}) {
   assertRev(base);
   assertRev(head);
-  const raw = git(["diff", "--no-color", "-M", `${base}...${head}`], opts.cwd);
+  const raw = git([...DIFF_ARGS, `${base}...${head}`], opts.cwd);
   const mergeBase = mergeBaseOf(base, head, opts);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(mergeBase, p, opts.cwd), (p) => blobAt(head, p, opts.cwd))
   );
 }
 function diffStaged(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "--cached"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "--cached"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => blobAt("", p, opts.cwd))
   );
 }
 function diffWorktree(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "HEAD"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "HEAD"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -1931,15 +1949,23 @@ function applyLocalSignoffs(findings, cwd, policy, now = Date.now()) {
   }
   return { findings: remaining, cleared };
 }
-function applyOobSignoffs(findings, oob, head) {
-  const tokens2 = oob.map((s) => s.trim()).filter(Boolean);
-  const matches = (want) => tokens2.some((t) => {
+function oobToken(want, oob, head) {
+  for (const raw of oob) {
+    const t = raw.trim();
+    if (!t) continue;
     const at = t.lastIndexOf("@");
-    if (at === -1) return head ? false : t === want;
+    if (at === -1) {
+      if (!head && t === want) return t;
+      continue;
+    }
     const [rule, sha2] = [t.slice(0, at), t.slice(at + 1)];
-    if (rule !== want) return false;
-    return head ? head.startsWith(sha2) && sha2.length >= 7 : true;
-  });
+    if (rule !== want) continue;
+    if (!head || sha2.length >= 7 && head.startsWith(sha2)) return t;
+  }
+  return null;
+}
+function applyOobSignoffs(findings, oob, head) {
+  const matches = (want) => oobToken(want, oob, head) !== null;
   const cleared = [];
   const remaining = [];
   for (const f of findings) {
@@ -2294,7 +2320,7 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], {
+      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
         encoding: "utf8",
         maxBuffer: 256 * 1024 * 1024
       });
@@ -3025,8 +3051,9 @@ var WORKFLOW_CONTENT = `name: tamperward
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
 # the PR's commit range. A block fails the check and clears ONLY via the out-of-band
-# label \`tamperward:allow:<rule>\` applied by someone with write access \u2014 never a file
-# the PR itself can commit.
+# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with triage access or higher \u2014
+# never a file the PR itself can commit. The verify step reads the same labels:
+# \`tamperward:allow:verify@<head-sha>\` accepts a masked failure a reviewer has judged.
 #
 # labeled/unlabeled re-run the gate because the sign-off is read from the EVENT payload:
 # a label applied after a failure could otherwise never take effect, and REVOKING a
@@ -3082,6 +3109,14 @@ jobs:
       # Requires a \`verify:\` block in .tamperward.yml naming the suite command;
       # without one this step fails closed (exit 2) rather than passing quietly.
       - name: Tamperward verify (pristine re-execution)
+        env:
+          # The same channel as the gate. \`tamperward:allow:verify@<head-sha>\`
+          # accepts a MASKED_FAILURE \u2014 a reviewer has read the intentional test
+          # change and agrees the original suite no longer applies. It clears
+          # nothing else: a red visible suite, or a run that could not verify,
+          # stays red whatever the labels say.
+          TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
+          TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
         run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
 var WORKFLOW_MARK = "# tamperward:generated";
@@ -3768,6 +3803,8 @@ function runVerify(opts) {
     verdict2 = "SUITE_RED";
     code = 1;
   }
+  const signedOff = verdict2 === "MASKED_FAILURE" ? oobToken("verify", oobFromEnv(), oobHeadFromEnv()) : null;
+  if (signedOff) code = 0;
   if (opts.json) {
     out2(
       JSON.stringify({
@@ -3779,6 +3816,7 @@ function runVerify(opts) {
         pristine: { exit: pristine.exit, secs: pristine.secs },
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
+        ...signedOff ? { oob_signoff: signedOff } : {},
         ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
     );
@@ -3790,6 +3828,10 @@ function runVerify(opts) {
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
     out2(`tamperward verify \u2014 ${lines[verdict2]}`);
+    if (signedOff)
+      out2(
+        `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
+      );
     if (removedAdded > 0)
       out2(
         `(${removedAdded} protected file(s) added since ${base.slice(0, 10)} were removed from the pristine run: the pristine tree carries exactly the base's protected surface.)`
@@ -4077,20 +4119,24 @@ Formats:
                                             observe supported transient effects
   tamperward verify [--base R] [--cmd C]    pristine-suite re-execution: run the suite
              [--budget S] [--json] [--keep] as-is AND with protected files restored
-                                            from the trusted base; a visible-green /
+             [--require-ancestor] [--cwd D]  from the trusted base; a visible-green /
                                             pristine-red result is a MASKED FAILURE
-                                            (exit 1); cannot-verify fails closed (2)
+                                            (exit 1, or 0 under an out-of-band
+                                            verify@<head-sha> approval); cannot-verify
+                                            fails closed (2)
   tamperward run [opts] -- <agent cmd...>   enforcement envelope: record the trusted
              [--base R] [--cmd C]           base, run the agent, treat its exit as
              [--budget S] [--allow-dirty]   untrusted, then re-adjudicate the tree it
-                                            left (policy over base...HEAD and the
+             [--settle S] [--allow-dep-drift] left (policy over base...HEAD and the
+             [--cwd D]
                                             worktree, plus verify). Exit: agent's code
                                             when clean; 1 on any blocking finding or
                                             masked failure; 2 when it cannot
                                             adjudicate (fails closed)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
+             [--file F] [--cwd D]
   tamperward init [--dry-run]               wire the policy file plus every
-             [--force-workflow]             enforcement point: Claude Code hooks,
+             [--force-workflow] [--cwd D]   enforcement point: Claude Code hooks,
                                             pre-commit, CI. Idempotent; never
                                             overwrites your files. Re-running it
                                             MIGRATES a CI workflow it generated and
@@ -4100,8 +4146,12 @@ Formats:
                                             --force-workflow replaces a workflow it
                                             did not write, or one you have edited.
 
-Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
-           emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
+Exit codes: 0 clean \xB7 1 a blocking finding (check), MASKED_FAILURE or SUITE_RED
+            (verify), any blocking finding or masked failure (run) \xB7 2 cannot
+            evaluate, failing closed: policy error, bad --diff range, no view,
+            unresolvable base, --require-ancestor refused, budget exceeded.
+            hook/sweep \u2192 0 with a deny emitted as JSON on stdout (exit 2 would make
+            Claude Code ignore the JSON); 2 only for an unsupported agent name.
 `);
 }
 function main(argv2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",