tamperward 2.10.2 → 2.10.4

package/README.md

@@ -73,7 +73,13 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > run had just restored — which was present from v1.9.0 onward, so rounds 2, 3
 > and 3.1 all ran on a verifier carrying it. No evidence any agent used it; the
 > layer's authority in those rounds was nonetheless weaker than described at the
-> time. Round 4 is the fresh pool.
+> time. **Round 4 is registered and frozen, not yet run:** a fresh pool of 110
+> paired repositories under `claude-sonnet-5`, treatment **2.10.3** pinned by
+> artefact hash, a confirmatory masked-failure endpoint (exact McNemar), and the
+> whole draw — task order, arm assignment, and a separate 22-pair instability
+> budget — derived from committed seeds before the first counted trajectory. The
+> methodology and preregistration are published, with no counted numbers:
+> [How round 4 is built to be hard to fool](./docs/blog/how-round-4-is-built-to-be-hard-to-fool.md).
 
 ## Architecture
 
@@ -395,7 +401,7 @@ via npm trusted publishing with SLSA provenance. Full rule:
 
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 540+ tests — parser, detectors, engine, policy, renderers
+npm test                        # 2,100+ tests — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
 

package/dist/cli/index.js

@@ -1230,12 +1230,16 @@ var lintSuppression = {
 
 // src/detectors/test-skip.ts
 var RULE3 = "test-skip";
+var acc = (names) => `(?:\\s*\\.\\s*(?:${names})(?![\\w$])|\\s*\\[\\s*['"\`](?:${names})['"\`]\\s*\\])`;
+var JS_RUNNER = "\\b(?:it|test|describe|suite)";
+var JS_MOD = "concurrent|sequential|shuffle";
 var PATTERNS2 = {
   js: [
-    // vitest chains a concurrency modifier before the marker: it.concurrent.skip.
-    { re: /\b(?:it|test|describe|suite)(?:\.(?:concurrent|sequential|shuffle))?\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-    { re: /\b(?:it|test|describe|suite)\.(?:skipIf|runIf)\s*\(/, why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
-    { re: /\b(?:it|test)\.(?:fails|failing)\s*\(/, why: "a .fails/.failing marker (the test now passes by failing)" },
+    // The skip/only/todo family on a runner, by dot-or-bracket access, with one optional
+    // vitest concurrency modifier hop: test.skip, test . skip, test['skip'], it.concurrent.skip.
+    { re: new RegExp(JS_RUNNER + acc(JS_MOD) + "?" + acc("skip|only|todo")), why: "a .skip/.only/.todo marker" },
+    { re: new RegExp(JS_RUNNER + acc("skipIf|runIf") + "\\s*\\("), why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
+    { re: new RegExp(JS_RUNNER + acc("fails|failing") + "\\s*\\("), why: "a .fails/.failing marker (the test now passes by failing)" },
     { re: /\b(?:it|test|describe)\.each\s*\(\s*\[\s*\]\s*\)/, why: "an empty .each table (no case ever runs)" },
     { re: /\b(?:xit|xtest|xdescribe)\s*\(/, why: "an x-prefixed disabled test" },
     { re: /\b(?:fit|ftest|fdescribe)\s*\(/, why: "an f-prefixed focused test (narrows the suite)" },
@@ -1249,7 +1253,7 @@ var PATTERNS2 = {
     { re: /\b(?:it|test|describe|suite)\s*\(\s*(['"`])(?:(?!\1).)*\1\s*,\s*\{[^}]*?\bskip:(?!\s*(?:false|0)\b)/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\bskip:\s*(?:true|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-    { re: /\b(?:t|ctx|context|this)\.skip\(/, why: "a runtime t.skip()/this.skip() call" }
+    { re: new RegExp("\\b(?:t|ctx|context|this)" + acc("skip") + "\\s*\\("), why: "a runtime t.skip()/this.skip() call" }
   ],
   py: [
     // `import pytest as pt` makes the decorator `@pt.mark.skip`; the module alias is free.
@@ -1306,6 +1310,17 @@ var PATTERNS2 = {
     { re: /\bAssert\.Inconclusive\(/, why: "an Assert.Inconclusive() call (the test ends without a verdict)" }
   ]
 };
+function matchesOutsideString(p, content, lang) {
+  if (p.comment) return p.re.test(content);
+  const re = p.re.global ? p.re : new RegExp(p.re.source, p.re.flags + "g");
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    if (!insideStringLiteral(content, m.index, lang)) return true;
+    if (m.index === re.lastIndex) re.lastIndex++;
+  }
+  return false;
+}
 var testSkip = {
   id: RULE3,
   surface: ["file"],
@@ -1321,7 +1336,7 @@ var testSkip = {
         const comment = isCommentLine(l.content.trim(), lang);
         for (const p of patterns) {
           if (comment && !p.comment) continue;
-          if (p.re.test(l.content)) {
+          if (matchesOutsideString(p, l.content, lang)) {
             out2.push(
               makeFinding(RULE3, policy, {
                 file: c.path,
@@ -5137,6 +5152,9 @@ function pytestSelection(src) {
         ignore.push({ pattern: `**/*${w}*`, key: "-k" });
     } else if (o === "-m" || o.startsWith("-m=")) {
       ignore.push({ pattern: "\0-m " + val(""), key: "-m" });
+    } else if (o === "-p" || o.startsWith("-p=") || o.length > 2 && o.startsWith("-p")) {
+      const v = o === "-p" ? opts[++j] ?? "" : o.startsWith("-p=") ? o.slice(3) : o.slice(2);
+      if (v.startsWith("no:")) ignore.push({ pattern: "\0-p " + v, key: "-p" });
     } else if (o === "--collect-only" || o === "--co") ignore.push({ pattern: "**", key: o });
   }
   sel.ignore = ignore;
@@ -5362,8 +5380,8 @@ function predicate(sel, runner) {
       if (!inRoots(r)) return `roots no longer covers it (${JSON.stringify(sel.roots)})`;
       const hit = ignoredBy(r);
       if (hit) {
-        const pat = hit.pattern.startsWith("\0") ? hit.pattern.slice(1) : hit.pattern;
-        return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(pat)})`;
+        if (hit.pattern.startsWith("\0")) return `${hit.key} narrows the whole run (${JSON.stringify(hit.pattern.slice(1))})`;
+        return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(hit.pattern)})`;
       }
       const key2 = runner === "jest" ? sel.include ? "testMatch" : sel.regex ? "testRegex" : "testMatch (default)" : sel.include ? "test.include" : "test.include (default)";
       return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? includeList ?? [])})`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.2",
+  "version": "2.10.4",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",