tamperward 2.1.0 → 2.2.0

package/README.md

@@ -37,7 +37,8 @@ impossible.
 > and hardened. Use it as one layer of defence in depth alongside protected CI,
 > independent tests and human review. Findings, limitations and corrections are
 > published openly. The 2.0 major marks the Node 18 drop, not a declaration of
-> security maturity.
+> security maturity; the distance to that is tracked, milestone by milestone, in
+> [SPEC §9.1](./SPEC.md#91-maturity-milestones).
 
 ## What we have actually measured
 
@@ -63,7 +64,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > **Scope.** The rows above cover specific models, pressure prompts, treatment
 > versions, and finite JavaScript/TypeScript and Python repository samples —
 > evidence for those settings, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v2.0.0** adds post-study envelope hardening
+> the v1.9.0 stack; the current **2.x** line adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -282,7 +283,7 @@ commands ignore what they do not know.
 
 | command | 0 | 1 | 2 |
 | --- | --- | --- | --- |
-| `check` | no blocking finding | at least one blocking finding | cannot evaluate: policy parse error, malformed `--diff` range, or no view given |
+| `check` | no blocking finding | at least one blocking finding | cannot evaluate: policy parse error, malformed `--diff` range, no view given, not a git repository, or an unresolvable revision — any failure the gate cannot recover from is one clean `tamperward: …` line on stderr at exit 2, never a stack trace at exit 1 |
 | `verify` | `VERIFIED` — visible and pristine both green; or a `MASKED_FAILURE` cleared by an out-of-band `verify@<head-sha>` approval | `MASKED_FAILURE` (visible green, pristine red) or `SUITE_RED` | cannot verify, failing closed: no suite command, unresolvable base, `--require-ancestor` refused, budget exceeded, or the working or dependency tree moved during the run |
 | `run` | enforcement clean and the agent exited 0 — a non-zero agent exit is passed through unchanged | any blocking finding or masked failure, whatever the agent returned | cannot adjudicate: dirty start, policy error, verify cannot run |
 | `hook claude` / `sweep claude` | always — a deny is JSON on stdout at exit 0, never exit 2 | — | only for an unsupported agent name |
@@ -352,7 +353,8 @@ and its totals.
 
 **[The research series](./docs/blog/index.md)** ·
 **[The harness](./harness/)** ·
-**[Errata](./docs/blog/errata.md)**
+**[Errata](./docs/blog/errata.md)** ·
+**[Maturity milestones](./SPEC.md#91-maturity-milestones)**
 
 ## The architecture was earned by failures
 
@@ -393,7 +395,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 520+ tests at 2.0.0 — parser, detectors, engine, policy, renderers
+npm test                        # 540+ tests — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -33,6 +33,11 @@ function unquotePath(p) {
   }
   return Buffer.from(bytes).toString("utf8");
 }
+function pathToken(raw) {
+  if (raw.startsWith('"')) return raw;
+  const tab = raw.indexOf("	");
+  return tab >= 0 ? raw.slice(0, tab) : raw;
+}
 function endOfQuoted(s) {
   for (let i = 1; i < s.length; i++) {
     if (s[i] === "\\") {
@@ -59,10 +64,17 @@ function headerPaths(line) {
       first = rest.slice(0, q);
       rest = rest.slice(q + 1);
     } else {
-      const m = rest.match(/^(.*) (b\/.*)$/);
-      if (!m) return [null, null];
-      first = m[1];
-      rest = m[2];
+      const mid = (rest.length - 1) / 2;
+      const sym = Number.isInteger(mid) && rest[mid] === " " && rest.startsWith("a/") && rest.slice(mid + 1).startsWith("b/") && rest.slice(2, mid) === rest.slice(mid + 3);
+      if (sym) {
+        first = rest.slice(0, mid);
+        rest = rest.slice(mid + 1);
+      } else {
+        const m = rest.match(/^(.*) (b\/.*)$/);
+        if (!m) return [null, null];
+        first = m[1];
+        rest = m[2];
+      }
     }
   }
   return [stripAB(first), stripAB(rest)];
@@ -126,8 +138,8 @@ function parseDiff(diff) {
         renameTo = unquotePath(l.slice(8));
         if (op === "modify") op = "rename";
       } else if (l.startsWith("Binary files ") || l.startsWith("GIT binary patch")) binary = true;
-      else if (l.startsWith("--- ")) minusPath = l.slice(4);
-      else if (l.startsWith("+++ ")) plusPath = l.slice(4);
+      else if (l.startsWith("--- ")) minusPath = pathToken(l.slice(4));
+      else if (l.startsWith("+++ ")) plusPath = pathToken(l.slice(4));
       i++;
     }
     let path;
@@ -196,7 +208,12 @@ function git(args, cwd) {
     return execFileSync("git", args, {
       cwd,
       encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
+      // 256 MiB, matching the hook adapter. Every diff below runs with `--text`, so a
+      // changed binary asset now costs its full size in patch output instead of one
+      // "Binary files differ" line; a legitimate golden-image update must fit. Past
+      // the cap git() throws and the view fails CLOSED (a truncated patch would parse
+      // as a smaller change than the one landing), which is the documented stance.
+      maxBuffer: 256 * 1024 * 1024,
       stdio: ["ignore", "pipe", "pipe"]
     });
   } catch (e) {
@@ -220,7 +237,7 @@ function fromDisk(path, cwd) {
   }
 }
 function enrich(c, beforeReader, afterReader) {
-  if (c.kind !== "file" || c.binary) return c;
+  if (c.kind !== "file") return c;
   const before = c.op !== "add" ? beforeReader(c.oldPath ?? c.path) : null;
   const after = c.op !== "delete" ? afterReader(c.path) : null;
   return { ...c, before, after };
@@ -261,8 +278,9 @@ function headSha(cwd) {
     return null;
   }
 }
+var DIFF_ARGS = ["diff", "--no-color", "--text", "-M"];
 function diffSince(rev, opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", rev], opts.cwd);
+  const raw = git([...DIFF_ARGS, rev], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(rev, p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -270,20 +288,20 @@ function diffSince(rev, opts = {}) {
 function diffRange(base, head, opts = {}) {
   assertRev(base);
   assertRev(head);
-  const raw = git(["diff", "--no-color", "-M", `${base}...${head}`], opts.cwd);
+  const raw = git([...DIFF_ARGS, `${base}...${head}`], opts.cwd);
   const mergeBase = mergeBaseOf(base, head, opts);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt(mergeBase, p, opts.cwd), (p) => blobAt(head, p, opts.cwd))
   );
 }
 function diffStaged(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "--cached"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "--cached"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => blobAt("", p, opts.cwd))
   );
 }
 function diffWorktree(opts = {}) {
-  const raw = git(["diff", "--no-color", "-M", "HEAD"], opts.cwd);
+  const raw = git([...DIFF_ARGS, "HEAD"], opts.cwd);
   return parseDiff(raw).map(
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
@@ -425,6 +443,16 @@ function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
   }
   return out2;
 }
+function normalizeGlob(glob) {
+  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
+}
+function mergeRules(base, user) {
+  const out2 = { ...base };
+  for (const [name, cfg] of Object.entries(user ?? {})) {
+    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
+  }
+  return out2;
+}
 var cache = /* @__PURE__ */ new Map();
 function matcher(glob) {
   let m = cache.get(glob);
@@ -434,12 +462,12 @@ function matcher(glob) {
   }
   return m;
 }
-function matchesAny(path, globs) {
-  return !!globs && globs.some((g) => matcher(g)(path));
+function matchesAny(path, globs2) {
+  return !!globs2 && globs2.some((g) => matcher(g)(path));
 }
 function protectedCategory(path, policy) {
-  for (const [cat, globs] of Object.entries(policy.protected ?? {})) {
-    if (matchesAny(path, globs)) return cat;
+  for (const [cat, globs2] of Object.entries(policy.protected ?? {})) {
+    if (matchesAny(path, globs2)) return cat;
   }
   return null;
 }
@@ -455,9 +483,9 @@ function isIgnored(path, policy) {
 }
 function mergeProtected(base, user) {
   const out2 = { ...base };
-  for (const [cat, globs] of Object.entries(user ?? {})) {
+  for (const [cat, globs2] of Object.entries(user ?? {})) {
     const have = new Set(out2[cat] ?? []);
-    out2[cat] = [...out2[cat] ?? [], ...(globs ?? []).filter((g) => !have.has(g))];
+    out2[cat] = [...out2[cat] ?? [], ...(globs2 ?? []).filter((g) => !have.has(g))];
   }
   return out2;
 }
@@ -1146,6 +1174,7 @@ var ciTampering = {
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
+var globs = (list) => Array.isArray(list) ? list.filter((g) => typeof g === "string").map(normalizeGlob) : [];
 function safeParse(src) {
   try {
     const v = parse(src);
@@ -1159,12 +1188,19 @@ function effective(raw) {
   const v = raw.version;
   const version = typeof v === "number" && Number.isInteger(v) && v >= 1 ? v : 1;
   const base = defaultPolicy(version);
+  const rules = { ...base.rules };
+  for (const [name, cfg] of Object.entries(raw.rules ?? {})) {
+    const over = cfg && typeof cfg === "object" && !Array.isArray(cfg) ? cfg : {};
+    rules[name] = { ...rules[name] ?? {}, ...over, ...over.exclude ? { exclude: globs(over.exclude) } : {} };
+  }
+  const userProtected = raw.protected && typeof raw.protected === "object" ? Object.fromEntries(Object.entries(raw.protected).map(([cat, list]) => [cat, globs(list)])) : void 0;
   return {
     version,
-    rules: { ...base.rules, ...raw.rules ?? {} },
-    ignore: raw.ignore ?? base.ignore ?? [],
-    protected: mergeProtected(base.protected, raw.protected),
-    requiredFor: raw.signoff?.required_for ?? raw.signoff?.requiredFor ?? base.signoff.requiredFor
+    rules,
+    ignore: raw.ignore ? globs(raw.ignore) : base.ignore ?? [],
+    protected: mergeProtected(base.protected, userProtected),
+    requiredFor: raw.signoff?.required_for ?? raw.signoff?.requiredFor ?? base.signoff.requiredFor,
+    ledger: typeof raw.signoff?.ledger === "string" ? raw.signoff.ledger : base.signoff.ledger
   };
 }
 function policyWeakening(before, after) {
@@ -1216,6 +1252,9 @@ function policyWeakening(before, after) {
   if (be.requiredFor.includes("block") && !new Set(ae.requiredFor).has("block")) {
     reasons.push("sign-off no longer required for blocking findings");
   }
+  if (ae.ledger !== be.ledger) {
+    reasons.push(`sign-off ledger moved (${be.ledger} \u2192 ${ae.ledger}) \u2014 the local layer would trust a different file`);
+  }
   const bv = b.verify;
   const av = a.verify;
   if (bv?.command) {
@@ -1771,7 +1810,7 @@ function hasBlocking(findings) {
 
 // src/policy-load.ts
 import { readFileSync as readFileSync2, existsSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2, posix } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -1786,11 +1825,21 @@ var SEVERITIES = ["block", "warn"];
 var isSeverity = (v) => SEVERITIES.includes(v);
 var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
+function ledgerInsideRepo(ledger) {
+  if (!ledger.trim() || isAbsolute(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
+  return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
+}
 function validate(r, where) {
   function bad(msg) {
     throw new PolicyError(`${where}: ${msg}`);
   }
   const show = (v) => JSON.stringify(v) ?? String(v);
+  const unknown = Object.keys(r).filter((k) => !TOP_LEVEL_KEYS.has(k));
+  if (unknown.length) {
+    bad(`unknown top-level key${unknown.length === 1 ? "" : "s"} ${unknown.map((k) => JSON.stringify(k)).join(", ")} (expected one of ${[...TOP_LEVEL_KEYS].join(", ")})`);
+  }
   if (r.rules !== void 0) {
     if (!isMapping(r.rules)) bad(`rules must be a mapping of rule name to { severity, enabled, exclude }, got ${show(r.rules)}`);
     for (const [name, cfg] of Object.entries(r.rules)) {
@@ -1809,8 +1858,8 @@ function validate(r, where) {
   if (r.ignore !== void 0 && !isStringList(r.ignore)) bad(`ignore must be a list of globs, got ${show(r.ignore)}`);
   if (r.protected !== void 0) {
     if (!isMapping(r.protected)) bad(`protected must be a mapping of category to a list of globs, got ${show(r.protected)}`);
-    for (const [cat, globs] of Object.entries(r.protected)) {
-      if (!isStringList(globs)) bad(`protected.${cat} must be a list of globs, got ${show(globs)}`);
+    for (const [cat, globs2] of Object.entries(r.protected)) {
+      if (!isStringList(globs2)) bad(`protected.${cat} must be a list of globs, got ${show(globs2)}`);
     }
   }
   if (r.signoff !== void 0) {
@@ -1823,6 +1872,9 @@ function validate(r, where) {
     }
     const ledger = r.signoff.ledger;
     if (ledger !== void 0 && typeof ledger !== "string") bad(`signoff.ledger must be a path, got ${show(ledger)}`);
+    if (typeof ledger === "string" && !ledgerInsideRepo(ledger)) {
+      bad(`signoff.ledger must be a relative path inside the repository, got ${show(ledger)}`);
+    }
   }
   if (r.verify !== void 0) {
     if (!isMapping(r.verify)) bad(`verify must be a mapping like { command: "npm test" }, got ${show(r.verify)}`);
@@ -1839,14 +1891,20 @@ function parsePolicy(raw, where = POLICY_FILE) {
   const version = normalizeVersion(r.version, where);
   validate(r, where);
   const base = defaultPolicy(version);
+  const globs2 = (list) => list?.map(normalizeGlob);
+  const userProtected = r.protected ? Object.fromEntries(Object.entries(r.protected).map(([cat, list]) => [cat, globs2(list) ?? []])) : void 0;
+  const userRules = r.rules ? Object.fromEntries(
+    Object.entries(r.rules).map(([name, cfg]) => [name, cfg?.exclude ? { ...cfg, exclude: globs2(cfg.exclude) } : cfg])
+  ) : void 0;
   return {
     version,
     // Merge with the baseline, never replace. For an integrity tool, a config that sets
     // one rule's severity must NOT silently drop the other nine — nor may naming one
-    // protected glob wipe out the rest of its category (see mergeProtected).
-    protected: mergeProtected(base.protected, r.protected),
-    rules: { ...base.rules, ...r.rules ?? {} },
-    ignore: r.ignore ?? base.ignore,
+    // protected glob wipe out the rest of its category (see mergeProtected), nor may
+    // an `exclude`-only override drop the rule's baseline severity (see mergeRules).
+    protected: mergeProtected(base.protected, userProtected),
+    rules: mergeRules(base.rules, userRules),
+    ignore: globs2(r.ignore) ?? base.ignore,
     signoff: {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
@@ -1896,7 +1954,11 @@ function fingerprint(rule, file, evidence) {
 }
 var fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
 function ledgerPath(cwd, policy) {
-  return join3(cwd, policy.signoff?.ledger ?? ".tamperward/ledger.jsonl");
+  const rel = policy.signoff?.ledger ?? ".tamperward/ledger.jsonl";
+  if (!ledgerInsideRepo(rel)) {
+    throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
+  }
+  return join3(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
@@ -1990,7 +2052,7 @@ function paint(s, code, on) {
 function wrap(text, width) {
   const out2 = [];
   let cur = "";
-  for (const w of text.split(/\s+/).filter(Boolean)) {
+  for (const w of stripControl(text).split(/\s+/).filter(Boolean)) {
     if (cur === "") cur = w;
     else if (cur.length + 1 + w.length <= width) cur += " " + w;
     else {
@@ -2055,15 +2117,15 @@ function renderText(input, opts) {
   for (const f of findings) {
     const isBlock = f.severity === "block";
     const mark = paint(isBlock ? "BLOCK" : "warn ", isBlock ? BOLD + RED : YELLOW, c);
-    const loc = f.file ? `${f.file}${f.line ? `:${f.line}` : ""}` : "(command)";
-    out2.push(`  ${mark}  ${paint(f.rule, BOLD, c)}  ${paint(loc, DIM, c)}`);
+    const loc = f.file ? `${stripControl(f.file)}${f.line ? `:${f.line}` : ""}` : "(command)";
+    out2.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, DIM, c)}`);
     for (const l of wrap(f.message, opts.width - 4)) out2.push(`    ${l}`);
     const row = (key2, lines) => {
       lines.forEach((l, i) => out2.push(`    ${paint(pad(i === 0 ? key2 : ""), DIM, c)}  ${l}`));
     };
     row("evidence", [paint(clip(f.evidence, body), DIM, c)]);
     row("instead", wrap(f.remediation, body));
-    if (f.signoff.required) row("sign-off", [f.signoff.command]);
+    if (f.signoff.required) row("sign-off", [stripControl(f.signoff.command)]);
     out2.push("");
   }
   if (blocks.length > 0) {
@@ -2077,7 +2139,7 @@ function renderText(input, opts) {
 // src/cli/render/github.ts
 import { appendFileSync as appendFileSync2 } from "node:fs";
 function escData(s) {
-  return s.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+  return stripControl(s).replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
 }
 function escProp(s) {
   return escData(s).replace(/:/g, "%3A").replace(/,/g, "%2C");
@@ -2096,7 +2158,7 @@ function annotations(findings) {
   });
 }
 function cell(s) {
-  return s.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
+  return stripControl(s).replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
 }
 function mdCode(s) {
   return s.replace(/`/g, "'").replace(/[\r\n]/g, " ");
@@ -2204,8 +2266,13 @@ function report(input) {
 
 // src/cli/check.ts
 function check(opts) {
-  let policy = opts.policyOverride ?? loadPolicy(opts.cwd);
   const cwd = opts.cwd ?? process.cwd();
+  if (!isGitRepo(cwd)) {
+    process.stderr.write(`tamperward: ${cwd} is not inside a git repository \u2014 nothing to check
+`);
+    return 2;
+  }
+  let policy = opts.policyOverride ?? loadPolicy(opts.cwd);
   let changes;
   let layer;
   let view;
@@ -2218,13 +2285,20 @@ function check(opts) {
     layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
-    const [base, head] = opts.diff.split(/\.{2,3}/);
-    if (!base || !head) {
+    const m = opts.diff.match(/^(.+?)\.{2,3}(.+)$/);
+    const [base, head] = m ? [m[1], m[2]] : ["", ""];
+    if (!base || !head || base.endsWith(".") || head.startsWith(".")) {
       process.stderr.write(`tamperward: invalid --diff range "${opts.diff}" (expected <base>...<head>)
 `);
       return 2;
     }
     changes = diffRange(base, head, { cwd: opts.cwd });
+    if (changes.length === 0) {
+      process.stderr.write(
+        `tamperward: note: the range ${base}...${head} contains no changes \u2014 if this is not an empty pull request, check that the range resolves to the intended commits
+`
+      );
+    }
     layer = "ci";
     view = "range";
     policy = opts.policyOverride ?? loadPolicyAt(mergeBaseOf(base, head, { cwd: opts.cwd }), opts.cwd) ?? defaultPolicy();
@@ -2265,7 +2339,7 @@ import { createHash as createHash4 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync4, existsSync as existsSync3, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute, join as join4, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, relative, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -2281,7 +2355,7 @@ function abs(path, cwd) {
 }
 function relForDisplay(path, cwd) {
   const rel = relative(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -2302,7 +2376,7 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], {
+      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
         encoding: "utf8",
         maxBuffer: 256 * 1024 * 1024
       });
@@ -2425,7 +2499,7 @@ function advanceTurnBaseline(cwd, sessionId) {
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join6 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -2437,7 +2511,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute2(d) ? d : join6(cwd, d);
+    return isAbsolute3(d) ? d : join6(cwd, d);
   } catch {
     return null;
   }
@@ -2954,9 +3028,18 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute4, join as join8, relative as relative2, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
+var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function gitConfig(cwd, key2) {
+  try {
+    return execFileSync4("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+  } catch {
+    return null;
+  }
+}
 var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
 var MARKER = "# tamperward: block agent shortcuts before they land";
 var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
@@ -2969,25 +3052,28 @@ function coveredBy(existing, critical) {
   for (const line of existing.split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
-    const pattern = t.split(/\s+/)[0];
-    if (!t.slice(pattern.length).trim()) continue;
-    if (pattern === "*" || pattern === critical) return true;
-    if (pattern.endsWith("/") && critical.startsWith(pattern)) return true;
+    const raw = t.split(/\s+/)[0];
+    if (!t.slice(raw.length).trim()) continue;
+    if (raw === "*" || raw === "**") return true;
+    const pattern = raw.replace(/\/\*{1,2}$/, "/");
+    if (pattern.includes("*")) continue;
+    const anchored = pattern.startsWith("/") ? pattern : "/" + pattern;
+    if (anchored === critical) return true;
+    if (anchored.endsWith("/") && critical.startsWith(anchored)) return true;
+    if (!pattern.startsWith("/")) {
+      if (critical.endsWith("/" + pattern)) return true;
+      if (pattern.endsWith("/") && critical.includes("/" + pattern)) return true;
+    }
   }
   return false;
 }
 function inferOwner(cwd) {
-  try {
-    const url = execFileSync4("git", ["remote", "get-url", "origin"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    const m = url.match(/github\.com[:/]+([^/]+)\//);
-    return m ? `@${m[1]}` : null;
-  } catch {
-    return null;
-  }
+  const url = gitConfig(cwd, "remote.origin.url");
+  const m = url?.match(/github\.com[:/]+([^/]+)\//);
+  if (!m) return null;
+  const segment = m[1];
+  const self = [gitConfig(cwd, "github.user"), gitConfig(cwd, "user.name")].filter((v) => v !== null);
+  return { owner: `@${segment}`, confirmed: self.some((v) => v.toLowerCase() === segment.toLowerCase()) };
 }
 var POLICY_CONTENT = `# Tamperward policy. The BASELINE (all rules, standard protected globs) applies even
 # without this file \u2014 everything here is an override, so an empty file changes nothing.
@@ -3033,7 +3119,7 @@ var WORKFLOW_CONTENT = `name: tamperward
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
 # the PR's commit range. A block fails the check and clears ONLY via the out-of-band
-# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with write access \u2014
+# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with triage access or higher \u2014
 # never a file the PR itself can commit. The verify step reads the same labels:
 # \`tamperward:allow:verify@<head-sha>\` accepts a masked failure a reviewer has judged.
 #
@@ -3125,9 +3211,31 @@ function missingTools(matcher2) {
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
+function hooksShapeError(hooks) {
+  if (hooks === void 0 || hooks === null) return null;
+  if (!isPlainObject(hooks)) return "hooks is not an object";
+  for (const [event, arr] of Object.entries(hooks)) {
+    if (arr === void 0 || arr === null) continue;
+    if (!Array.isArray(arr)) return `hooks.${event} is not a list`;
+    for (const m of arr) {
+      if (!isPlainObject(m)) return `hooks.${event} contains an entry that is not an object`;
+      if (m.hooks !== void 0 && m.hooks !== null && !(Array.isArray(m.hooks) && m.hooks.every(isPlainObject))) {
+        return `hooks.${event} has a "hooks" value that is not a list of { type, command }`;
+      }
+    }
+  }
+  return null;
+}
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
-  if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
+  if (existsSync7(path)) {
+    try {
+      loadPolicy(cwd);
+    } catch (e) {
+      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText2(e)}; fix it, then re-run init (left untouched)` };
+    }
+    return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present and loads \u2014 left untouched" };
+  }
   return {
     item: "policy",
     path: POLICY_FILE,
@@ -3157,6 +3265,10 @@ function planClaudeHooks(cwd) {
     }
     settings = parsed;
   }
+  const shapeError = hooksShapeError(settings.hooks);
+  if (shapeError) {
+    return { item: "agent", path: rel, status: "error", detail: `${shapeError} \u2014 fix it, then re-run init (refusing to overwrite)` };
+  }
   const hooks = settings.hooks ??= {};
   const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => needle.test(String(h.command ?? ""))));
   const preEntries = entriesWith(hooks.PreToolUse, HOOK_RE);
@@ -3202,47 +3314,170 @@ function planClaudeHooks(cwd) {
     }
   };
 }
+var MANAGED_HOOKS = [
+  {
+    name: "lefthook",
+    configs: ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml", "lefthook-local.yml", "lefthook-local.yaml"],
+    hookRe: /\blefthook\b/i,
+    hint: `add this under \`pre-commit:\` \u2192 \`commands:\` in lefthook.yml:
+        tamperward:
+          run: ${PRECOMMIT_CMD}`
+  },
+  {
+    name: "pre-commit",
+    configs: [".pre-commit-config.yaml", ".pre-commit-config.yml"],
+    hookRe: /pre-commit\.com|File generated by pre-commit/i,
+    hint: `add this under \`repos:\` in .pre-commit-config.yaml:
+        - repo: local
+          hooks:
+            - id: tamperward
+              name: tamperward
+              entry: ${PRECOMMIT_CMD}
+              language: system
+              pass_filenames: false
+              always_run: true`
+  }
+];
+function hooksDir(cwd) {
+  try {
+    const out2 = execFileSync4("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (out2) return resolve2(cwd, out2);
+  } catch {
+  }
+  return existsSync7(join8(cwd, ".git")) ? join8(cwd, ".git", "hooks") : null;
+}
+function display(cwd, path) {
+  const rel = relative2(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : path;
+}
+function unconditionalExitAt(lines) {
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith("#")) continue;
+    if (depth === 0) {
+      if (/^exit(\s|$|;)/.test(t)) return i;
+      const exec = t.match(/^exec(?:\s+(.*))?$/);
+      if (exec && exec[1] && !/^(\d*[<>]|&>)/.test(exec[1])) return i;
+    }
+    const opens = (t.match(/(?:^|[;(]\s*|&&\s*|\|\|\s*)(?:if|case|for|while|until)\s/g) ?? []).length + (/(?:^|\s)\{\s*$/.test(t) ? 1 : 0);
+    const closes = (t.match(/(?:^|[;]\s*)(?:fi|esac|done)(?:\s|;|$)/g) ?? []).length + (/^\}/.test(t) ? 1 : 0);
+    depth = Math.max(0, depth + opens - closes);
+  }
+  return -1;
+}
 function planPreCommit(cwd) {
-  const line = `${MARKER}
-${PRECOMMIT_CMD}
-`;
-  const husky = join8(cwd, ".husky");
-  const gitDir3 = join8(cwd, ".git");
-  const target = existsSync7(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync7(gitDir3) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
-  if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
-  const path = join8(cwd, target.rel);
+  const block = [MARKER, PRECOMMIT_CMD];
+  const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
+  let path;
+  let note;
+  if (existsSync7(join8(cwd, ".husky"))) {
+    path = join8(cwd, ".husky", "pre-commit");
+    note = "husky";
+  } else {
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join8(cwd, c))));
+    if (managed) {
+      return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
+    }
+    const dir = hooksDir(cwd);
+    if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
+    if (basename(dir) === "_" && basename(dirname3(dir)) === ".husky") {
+      path = join8(dirname3(dir), "pre-commit");
+      note = "husky";
+    } else {
+      path = join8(dir, "pre-commit");
+      const rel2 = display(cwd, dir);
+      note = rel2 === join8(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+    }
+  }
+  const rel = display(cwd, path);
+  if (existsSync7(path) && !statSync5(path).isFile()) {
+    return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
+  }
   const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
-  if (existing !== null && PRECOMMIT_RE.test(existing)) {
-    const lines = existing.split("\n");
-    const staleAt = lines.findIndex((l) => PRECOMMIT_RE.test(l) && stalePin(l));
-    if (staleAt === -1) {
-      return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+  if (existing === null) {
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "create",
+      detail: `create via ${note}`,
+      apply: () => {
+        mkdirSync5(dirname3(path), { recursive: true });
+        writeFileSync5(path, `#!/bin/sh
+${block.join("\n")}
+`);
+        chmodSync(path, 493);
+      }
+    };
+  }
+  const owner = MANAGED_HOOKS.find((m) => m.hookRe.test(existing));
+  if (owner) {
+    return { item: "pre-commit", path: rel, status: "skip", detail: `generated by ${owner.name}, which overwrites it on install \u2014 ${owner.hint}` };
+  }
+  const lines = existing.split("\n");
+  const dead = unconditionalExitAt(lines);
+  const at = lines.findIndex((l) => PRECOMMIT_RE.test(l));
+  const write = (out2) => {
+    writeFileSync5(path, out2.join("\n"));
+    chmodSync(path, 493);
+  };
+  if (at !== -1 && (dead === -1 || at < dead)) {
+    if (!stalePin(lines[at])) {
+      return { item: "pre-commit", path: rel, status: "ok", detail: "already runs the staged check" };
     }
-    const was = pinOf(lines[staleAt]) || "unpinned";
+    const was = pinOf(lines[at]) || "unpinned";
     return {
       item: "pre-commit",
-      path: target.rel,
+      path: rel,
       status: "update",
       detail: `re-pin the staged check to tamperward@${TW_VERSION} (was ${was})`,
       apply: () => {
-        lines[staleAt] = PRECOMMIT_CMD;
-        writeFileSync5(path, lines.join("\n"));
-        chmodSync(path, 493);
+        lines[at] = PRECOMMIT_CMD;
+        write(lines);
+      }
+    };
+  }
+  if (at !== -1) {
+    const ours = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
+    if (!ours) {
+      return {
+        item: "pre-commit",
+        path: rel,
+        status: "error",
+        detail: `the staged check on line ${at + 1} never runs: line ${dead + 1} (\`${lines[dead].trim()}\`) ends the script first \u2014 move the tamperward line above it`
+      };
+    }
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "update",
+      detail: `move the staged check above line ${dead + 1} (\`${lines[dead].trim()}\`), which ended the script before it ran`,
+      apply: () => {
+        const out2 = lines.filter((_, i) => i !== at && i !== at - 1);
+        out2.splice(dead, 0, ...block);
+        write(out2);
+      }
+    };
+  }
+  if (dead !== -1) {
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "update",
+      detail: `insert the staged check above line ${dead + 1} (\`${lines[dead].trim()}\`), which ends the script \u2014 ${note}`,
+      apply: () => {
+        const out2 = [...lines];
+        out2.splice(dead, 0, ...block);
+        write(out2);
       }
     };
   }
   return {
     item: "pre-commit",
-    path: target.rel,
-    status: existing === null ? "create" : "update",
-    detail: existing === null ? `create via ${target.note}` : `append the staged check (${target.note})`,
-    apply: () => {
-      mkdirSync5(dirname3(path), { recursive: true });
-      const content = existing === null ? `#!/bin/sh
-${line}` : existing.replace(/\n?$/, "\n") + line;
-      writeFileSync5(path, content);
-      chmodSync(path, 493);
-    }
+    path: rel,
+    status: "update",
+    detail: `append the staged check (${note})`,
+    apply: () => write([...existing.replace(/\n?$/, "\n").split("\n").slice(0, -1), ...block, ""])
   };
 }
 function planCodeowners(cwd) {
@@ -3256,18 +3491,26 @@ function planCodeowners(cwd) {
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
   }
-  const owner = inferOwner(cwd);
+  const inferred = inferOwner(cwd);
+  const owner = inferred?.owner ?? null;
+  const unconfirmed = inferred !== null && !inferred.confirmed;
   const block = `
 ${CODEOWNERS_MARK}
 # A pull request that rewrites the workflow can keep the job name, replace the
 # gate with \`true\`, and still report a green required check. Only a human
 # requirement on these paths prevents that.
-` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
+` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : unconfirmed ? `# TODO: replace ${owner} with ${owner}/<team> if "${owner.slice(1)}" is an organisation. GitHub
+# rejects a bare organisation as an owner, and a rule with an invalid owner protects
+# nothing. A user login is fine as written.
+` : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
   return {
     item: "codeowners",
     path: existingRel ?? rel,
     status: existing === null ? "create" : "update",
-    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner})`),
+    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner}${unconfirmed ? ", unconfirmed \u2014 see warning below" : ""})`),
+    ...inferred && unconfirmed ? {
+      warning: `${inferred.owner} was inferred from the origin remote and is not confirmed to be a user. If "${inferred.owner.slice(1)}" is an organisation, replace it with ${inferred.owner}/<team> in CODEOWNERS: GitHub rejects a bare organisation as an owner, and a rule with an invalid owner protects nothing.`
+    } : {},
     apply: () => {
       mkdirSync5(dirname3(path), { recursive: true });
       writeFileSync5(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block);
@@ -3326,21 +3569,49 @@ function planWorkflow(cwd, force) {
     detail: (mark ? `edited since tamperward v${mark.version} generated it` : "present but not generated by tamperward") + ` \u2014 left untouched. Compare it against the v${TW_VERSION} template (an older one may lack the pristine-verify step) and re-run with --force-workflow to replace it.`
   };
 }
+function planned(item, path, plan) {
+  try {
+    return plan();
+  } catch (e) {
+    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText2(e)}` };
+  }
+}
 function planInit(cwd, opts = {}) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false), planCodeowners(cwd)];
+  return [
+    planned("policy", POLICY_FILE, () => planPolicy(cwd)),
+    planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
+    planned("pre-commit", "(hooks)", () => planPreCommit(cwd)),
+    planned("ci", ".github/workflows/tamperward.yml", () => planWorkflow(cwd, opts.forceWorkflow ?? false)),
+    planned("codeowners", ".github/CODEOWNERS", () => planCodeowners(cwd))
+  ];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const plan = planInit(cwd, { forceWorkflow: opts.forceWorkflow });
   const w = process.stdout;
+  let applied = 0;
   for (const a of plan) {
+    if (!opts.dryRun && a.apply) {
+      try {
+        a.apply();
+        applied++;
+      } catch (e) {
+        a.status = "error";
+        a.detail = `could not be written \u2014 ${errText2(e)}`;
+        a.apply = void 0;
+      }
+    }
     const verb = opts.dryRun && (a.status === "create" || a.status === "update") ? `would ${a.status}` : a.status;
     w.write(`  ${a.item.padEnd(10)} ${verb.padEnd(12)} ${a.path}  \u2014 ${a.detail}
 `);
-    if (!opts.dryRun && a.apply) a.apply();
+  }
+  for (const a of plan) {
+    if (a.warning) w.write(`
+WARNING (${a.item}): ${a.warning}
+`);
   }
   const errors = plan.filter((a) => a.status === "error");
-  const changed = plan.filter((a) => a.apply).length;
+  const changed = opts.dryRun ? plan.filter((a) => a.apply).length : applied;
   if (errors.length) {
     w.write(`
 tamperward init: ${errors.length} item(s) need your attention above; the rest ${opts.dryRun ? "are planned" : "were applied"}.
@@ -3363,15 +3634,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join11, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, join as join11, resolve as resolve3 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join9 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join9 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -3384,7 +3655,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute3(d) ? d : join9(cwd, d);
+    return isAbsolute5(d) ? d : join9(cwd, d);
   } catch {
     return null;
   }
@@ -3422,7 +3693,7 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync6 } from "node:fs";
 import { join as join10 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
@@ -3461,7 +3732,7 @@ function depsFingerprint(cwd) {
         h.update(p);
         try {
           h.update(readFileSync12(p));
-          h.update(String(statSync5(p).mode));
+          h.update(String(statSync6(p).mode));
         } catch {
           h.update("<unreadable>");
         }
@@ -3476,7 +3747,7 @@ function depsFingerprint(cwd) {
     }
   };
   try {
-    if (!statSync5(root).isDirectory()) return "none";
+    if (!statSync6(root).isDirectory()) return "none";
   } catch {
     return "none";
   }
@@ -3534,7 +3805,7 @@ function materialize(cwd, dest) {
     const src = join11(cwd, rel);
     let st;
     try {
-      st = statSync6(src);
+      st = statSync7(src);
     } catch {
       continue;
     }
@@ -3549,7 +3820,7 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve2(cwd, "node_modules");
+  const nm = resolve3(cwd, "node_modules");
   if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
@@ -3565,9 +3836,9 @@ function verifierInputs(cmd, atBase, policy) {
     const tok = raw.replace(/^['"]|['"]$/g, "").replace(/^\.\//, "");
     if (tok && baseFiles.has(tok)) picked.add(tok);
   }
-  const globs = policy.verify?.inputs;
-  if (globs && globs.length) {
-    for (const rel of atBase) if (matchesAny(rel, globs)) picked.add(rel);
+  const globs2 = policy.verify?.inputs;
+  if (globs2 && globs2.length) {
+    for (const rel of atBase) if (matchesAny(rel, globs2)) picked.add(rel);
   }
   return picked;
 }
@@ -3839,7 +4110,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -3886,7 +4157,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const cwd = resolve4(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -4023,7 +4294,7 @@ function parseRun(args) {
   return o;
 }
 
-// src/cli/index.ts
+// src/cli/main.ts
 function parseAllow(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -4101,7 +4372,7 @@ Formats:
                                             observe supported transient effects
   tamperward verify [--base R] [--cmd C]    pristine-suite re-execution: run the suite
              [--budget S] [--json] [--keep] as-is AND with protected files restored
-                                            from the trusted base; a visible-green /
+             [--require-ancestor] [--cwd D]  from the trusted base; a visible-green /
                                             pristine-red result is a MASKED FAILURE
                                             (exit 1, or 0 under an out-of-band
                                             verify@<head-sha> approval); cannot-verify
@@ -4109,14 +4380,16 @@ Formats:
   tamperward run [opts] -- <agent cmd...>   enforcement envelope: record the trusted
              [--base R] [--cmd C]           base, run the agent, treat its exit as
              [--budget S] [--allow-dirty]   untrusted, then re-adjudicate the tree it
-                                            left (policy over base...HEAD and the
+             [--settle S] [--allow-dep-drift] left (policy over base...HEAD and the
+             [--cwd D]
                                             worktree, plus verify). Exit: agent's code
                                             when clean; 1 on any blocking finding or
                                             masked failure; 2 when it cannot
                                             adjudicate (fails closed)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
+             [--file F] [--cwd D]
   tamperward init [--dry-run]               wire the policy file plus every
-             [--force-workflow]             enforcement point: Claude Code hooks,
+             [--force-workflow] [--cwd D]   enforcement point: Claude Code hooks,
                                             pre-commit, CI. Idempotent; never
                                             overwrites your files. Re-running it
                                             MIGRATES a CI workflow it generated and
@@ -4126,8 +4399,14 @@ Formats:
                                             --force-workflow replaces a workflow it
                                             did not write, or one you have edited.
 
-Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a deny is
-           emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
+Exit codes: 0 clean \xB7 1 a blocking finding (check), MASKED_FAILURE or SUITE_RED
+            (verify), any blocking finding or masked failure (run) \xB7 2 cannot
+            evaluate, failing closed: policy error, bad --diff range, no view,
+            not a git repository, unresolvable base or revision, --require-ancestor
+            refused, budget exceeded \u2014 always one line on stderr, never a stack
+            trace. hook/sweep \u2192 0 with a deny emitted as JSON on stdout (exit 2
+            would make Claude Code ignore the JSON); 2 only for an unsupported
+            agent name.
 `);
 }
 function main(argv2) {
@@ -4159,9 +4438,21 @@ function main(argv2) {
       return 2;
   }
 }
+function guardedMain(argv2, stderr = process.stderr) {
+  try {
+    return main(argv2);
+  } catch (e) {
+    const first = (e instanceof Error ? e.message : String(e)).split("\n").map((l) => l.trim()).find(Boolean) ?? "";
+    stderr.write(`tamperward: ${first || "unexpected failure"}
+`);
+    return 2;
+  }
+}
+
+// src/cli/index.ts
 var argv = process.argv.slice(2);
 if (argv[0] === "watch") {
   runWatch(argv.slice(1));
 } else {
-  process.exit(main(argv));
+  process.exit(guardedMain(argv));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",