tamperward 2.1.0 → 2.1.1

package/README.md

@@ -37,7 +37,8 @@ impossible.
 > and hardened. Use it as one layer of defence in depth alongside protected CI,
 > independent tests and human review. Findings, limitations and corrections are
 > published openly. The 2.0 major marks the Node 18 drop, not a declaration of
-> security maturity.
+> security maturity; the distance to that is tracked, milestone by milestone, in
+> [SPEC §9.1](./SPEC.md#91-maturity-milestones).
 
 ## What we have actually measured
 
@@ -63,7 +64,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > **Scope.** The rows above cover specific models, pressure prompts, treatment
 > versions, and finite JavaScript/TypeScript and Python repository samples —
 > evidence for those settings, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v2.0.0** adds post-study envelope hardening
+> the v1.9.0 stack; the current **2.x** line adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -352,7 +353,8 @@ and its totals.
 
 **[The research series](./docs/blog/index.md)** ·
 **[The harness](./harness/)** ·
-**[Errata](./docs/blog/errata.md)**
+**[Errata](./docs/blog/errata.md)** ·
+**[Maturity milestones](./SPEC.md#91-maturity-milestones)**
 
 ## The architecture was earned by failures
 
@@ -393,7 +395,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 520+ tests at 2.0.0 — parser, detectors, engine, policy, renderers
+npm test                        # 540+ tests — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -33,6 +33,11 @@ function unquotePath(p) {
   }
   return Buffer.from(bytes).toString("utf8");
 }
+function pathToken(raw) {
+  if (raw.startsWith('"')) return raw;
+  const tab = raw.indexOf("	");
+  return tab >= 0 ? raw.slice(0, tab) : raw;
+}
 function endOfQuoted(s) {
   for (let i = 1; i < s.length; i++) {
     if (s[i] === "\\") {
@@ -59,10 +64,17 @@ function headerPaths(line) {
       first = rest.slice(0, q);
       rest = rest.slice(q + 1);
     } else {
-      const m = rest.match(/^(.*) (b\/.*)$/);
-      if (!m) return [null, null];
-      first = m[1];
-      rest = m[2];
+      const mid = (rest.length - 1) / 2;
+      const sym = Number.isInteger(mid) && rest[mid] === " " && rest.startsWith("a/") && rest.slice(mid + 1).startsWith("b/") && rest.slice(2, mid) === rest.slice(mid + 3);
+      if (sym) {
+        first = rest.slice(0, mid);
+        rest = rest.slice(mid + 1);
+      } else {
+        const m = rest.match(/^(.*) (b\/.*)$/);
+        if (!m) return [null, null];
+        first = m[1];
+        rest = m[2];
+      }
     }
   }
   return [stripAB(first), stripAB(rest)];
@@ -126,8 +138,8 @@ function parseDiff(diff) {
         renameTo = unquotePath(l.slice(8));
         if (op === "modify") op = "rename";
       } else if (l.startsWith("Binary files ") || l.startsWith("GIT binary patch")) binary = true;
-      else if (l.startsWith("--- ")) minusPath = l.slice(4);
-      else if (l.startsWith("+++ ")) plusPath = l.slice(4);
+      else if (l.startsWith("--- ")) minusPath = pathToken(l.slice(4));
+      else if (l.startsWith("+++ ")) plusPath = pathToken(l.slice(4));
       i++;
     }
     let path;
@@ -196,7 +208,12 @@ function git(args, cwd) {
     return execFileSync("git", args, {
       cwd,
       encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
+      // 256 MiB, matching the hook adapter. Every diff below runs with `--text`, so a
+      // changed binary asset now costs its full size in patch output instead of one
+      // "Binary files differ" line; a legitimate golden-image update must fit. Past
+      // the cap git() throws and the view fails CLOSED (a truncated patch would parse
+      // as a smaller change than the one landing), which is the documented stance.
+      maxBuffer: 256 * 1024 * 1024,
       stdio: ["ignore", "pipe", "pipe"]
     });
   } catch (e) {
@@ -220,7 +237,7 @@ function fromDisk(path, cwd) {
   }
 }
 function enrich(c, beforeReader, afterReader) {
-  if (c.kind !== "file" || c.binary) return c;
+  if (c.kind !== "file") return c;
   const before = c.op !== "add" ? beforeReader(c.oldPath ?? c.path) : null;
   const after = c.op !== "delete" ? afterReader(c.path) : null;
   return { ...c, before, after };
@@ -261,8 +278,9 @@ function headSha(cwd) {
     return null;
   }
 }
+var DIFF_ARGS = ["diff", "--no-color", "--text", "-M"];
 function diffSince(rev, opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", rev], opts.cwd);
+  const raw = git([...DIFF_ARGS, rev], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(rev, p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -270,20 +288,20 @@ function diffSince(rev, opts = {}) {
 function diffRange(base, head, opts = {}) {
   assertRev(base);
   assertRev(head);
-  const raw = git(["diff", "--no-color", "-M", `${base}...${head}`], opts.cwd);
+  const raw = git([...DIFF_ARGS, `${base}...${head}`], opts.cwd);
   const mergeBase = mergeBaseOf(base, head, opts);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(mergeBase, p, opts.cwd), (p) => blobAt(head, p, opts.cwd))
   );
 }
 function diffStaged(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "--cached"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "--cached"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => blobAt("", p, opts.cwd))
   );
 }
 function diffWorktree(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "HEAD"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "HEAD"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -2302,7 +2320,7 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], {
+      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
         encoding: "utf8",
         maxBuffer: 256 * 1024 * 1024
       });
@@ -3033,7 +3051,7 @@ var WORKFLOW_CONTENT = `name: tamperward
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
 # the PR's commit range. A block fails the check and clears ONLY via the out-of-band
-# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with write access \u2014
+# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with triage access or higher \u2014
 # never a file the PR itself can commit. The verify step reads the same labels:
 # \`tamperward:allow:verify@<head-sha>\` accepts a masked failure a reviewer has judged.
 #
@@ -4101,7 +4119,7 @@ Formats:
                                             observe supported transient effects
   tamperward verify [--base R] [--cmd C]    pristine-suite re-execution: run the suite
              [--budget S] [--json] [--keep] as-is AND with protected files restored
-                                            from the trusted base; a visible-green /
+             [--require-ancestor] [--cwd D]  from the trusted base; a visible-green /
                                             pristine-red result is a MASKED FAILURE
                                             (exit 1, or 0 under an out-of-band
                                             verify@<head-sha> approval); cannot-verify
@@ -4109,14 +4127,16 @@ Formats:
   tamperward run [opts] -- <agent cmd...>   enforcement envelope: record the trusted
              [--base R] [--cmd C]           base, run the agent, treat its exit as
              [--budget S] [--allow-dirty]   untrusted, then re-adjudicate the tree it
-                                            left (policy over base...HEAD and the
+             [--settle S] [--allow-dep-drift] left (policy over base...HEAD and the
+             [--cwd D]
                                             worktree, plus verify). Exit: agent's code
                                             when clean; 1 on any blocking finding or
                                             masked failure; 2 when it cannot
                                             adjudicate (fails closed)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
+             [--file F] [--cwd D]
   tamperward init [--dry-run]               wire the policy file plus every
-             [--force-workflow]             enforcement point: Claude Code hooks,
+             [--force-workflow] [--cwd D]   enforcement point: Claude Code hooks,
                                             pre-commit, CI. Idempotent; never
                                             overwrites your files. Re-running it
                                             MIGRATES a CI workflow it generated and
@@ -4126,8 +4146,12 @@ Formats:
                                             --force-workflow replaces a workflow it
                                             did not write, or one you have edited.
 
-Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
-           emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
+Exit codes: 0 clean \xB7 1 a blocking finding (check), MASKED_FAILURE or SUITE_RED
+            (verify), any blocking finding or masked failure (run) \xB7 2 cannot
+            evaluate, failing closed: policy error, bad --diff range, no view,
+            unresolvable base, --require-ancestor refused, budget exceeded.
+            hook/sweep \u2192 0 with a deny emitted as JSON on stdout (exit 2 would make
+            Claude Code ignore the JSON); 2 only for an unsupported agent name.
 `);
 }
 function main(argv2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",