tamperward 2.10.4 → 2.10.6

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/git/build.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 
 // src/disk.ts
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readlinkSync, realpathSync } from "node:fs";
@@ -602,10 +602,62 @@ function addHunks(content) {
   ];
 }
 
+// src/git/trusted.ts
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join as join2 } from "node:path";
+function trustedGitEnv() {
+  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
+}
+function gitDirOf(cwd) {
+  try {
+    const d = execFileSync("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: trustedGitEnv()
+    }).trim();
+    if (!d) return null;
+    return isAbsolute(d) ? d : join2(cwd, d);
+  } catch {
+    return null;
+  }
+}
+function objectRewriteState(cwd) {
+  const parts = [];
+  try {
+    parts.push(
+      "replace:" + execFileSync("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: trustedGitEnv()
+      }).trim()
+    );
+  } catch {
+    parts.push("replace:<unreadable>");
+  }
+  const dir = gitDirOf(cwd);
+  for (const rel of ["info/grafts", "shallow"]) {
+    if (dir === null) {
+      parts.push(`${rel}:<no-git-dir>`);
+      continue;
+    }
+    const p = join2(dir, rel);
+    try {
+      parts.push(`${rel}:` + (existsSync(p) ? readFileSync(p, "utf8").trim() : ""));
+    } catch {
+      parts.push(`${rel}:<unreadable>`);
+    }
+  }
+  return createHash("sha256").update(parts.join("\n")).digest("hex");
+}
+
 // src/git/build.ts
 function git(args, cwd) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync2("git", args, {
       cwd,
       encoding: "utf8",
       // 256 MiB, matching the hook adapter. Every diff below runs with `--text`, so a
@@ -614,7 +666,12 @@ function git(args, cwd) {
       // the cap git() throws and the view fails CLOSED (a truncated patch would parse
       // as a smaller change than the one landing), which is the documented stance.
       maxBuffer: 256 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // Every object read in this shared adapter can feed a trust decision:
+      // policy-at-base, merge-base selection, range enrichment, and the HEAD
+      // side of worktree/staged comparisons. A pre-existing replace ref must
+      // never make those callers see an attacker-selected object.
+      env: trustedGitEnv()
     });
   } catch (e) {
     const err2 = e;
@@ -765,6 +822,104 @@ function hiddenTrackedPaths(opts = {}) {
   return out2;
 }
 
+// src/adapters/claude/changes.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute as isAbsolute2, join as join3, relative, resolve } from "node:path";
+function asStr(v) {
+  return typeof v === "string" ? v : "";
+}
+function readDisk(path) {
+  return textOf(inspectResolved(path));
+}
+function abs(path, cwd) {
+  return resolve(cwd, path);
+}
+function relForDisplay(path, cwd) {
+  const rel = relative(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : path;
+}
+function applyEdit(content, oldStr, newStr) {
+  if (content === null) return newStr;
+  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
+  return content.replace(oldStr, () => newStr);
+}
+function synthFileChange(displayPath, before, after) {
+  if (before === after) return [];
+  let op;
+  if (before === null) op = "add";
+  else if (after === null) op = "delete";
+  else op = "modify";
+  const dir = mkdtempSync(join3(tmpdir(), "hf-"));
+  let raw = "";
+  try {
+    const a = join3(dir, "a");
+    const b = join3(dir, "b");
+    writeFileSync(a, before ?? "");
+    writeFileSync(b, after ?? "");
+    try {
+      raw = execFileSync3("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024
+      });
+    } catch (e) {
+      const err2 = e;
+      if (err2.status !== 1) {
+        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
+      }
+      raw = err2.stdout ? String(err2.stdout) : "";
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  const first = parseDiff(raw)[0];
+  const hunks = first && first.kind === "file" ? first.hunks : [];
+  return [{ kind: "file", path: displayPath, oldPath: null, op, before, after, binary: false, hunks }];
+}
+function changesFromClaudeHook(input, cwd) {
+  const ti = input.tool_input ?? {};
+  switch (input.tool_name) {
+    case "Bash": {
+      const raw = asStr(ti.command);
+      return raw ? [{ kind: "command", raw, argv: raw.split(/\s+/) }] : [];
+    }
+    case "Write": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, asStr(ti.content));
+    }
+    case "Edit": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string));
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
+    }
+    case "MultiEdit": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      let after = before;
+      const edits = Array.isArray(ti.edits) ? ti.edits : [];
+      for (const raw of edits) {
+        const ed = raw;
+        after = applyEdit(after, ed.old_string ?? "", ed.new_string ?? "");
+      }
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
+    }
+    case "NotebookEdit": {
+      const fp = asStr(ti.notebook_path);
+      const src = asStr(ti.new_source);
+      if (!fp || !src) return [];
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), "", src);
+    }
+    default:
+      return [];
+  }
+}
+
 // src/detectors/finding.ts
 function severityOf(rule, policy, fallback = "block") {
   return policy.rules?.[rule]?.severity ?? fallback;
@@ -1360,9 +1515,9 @@ import picomatch2 from "picomatch";
 import ts2 from "typescript";
 
 // src/detectors/repo.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
 var cache = /* @__PURE__ */ new Map();
 function trackedFiles(ctx) {
   if (!ctx) return null;
@@ -1372,7 +1527,7 @@ function trackedFiles(ctx) {
   if (hit !== void 0) return hit;
   let files = null;
   try {
-    files = execFileSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    files = execFileSync4("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
@@ -1394,7 +1549,7 @@ function trackedContent(path, ctx) {
   if (hit !== void 0) return hit;
   let src = null;
   try {
-    src = readFileSync(join2(ctx.cwd, path), "utf8");
+    src = readFileSync2(join4(ctx.cwd, path), "utf8");
   } catch {
     src = null;
   }
@@ -1409,7 +1564,7 @@ function branchRefs(ctx) {
   if (hit !== void 0) return hit;
   let refs = null;
   try {
-    const out2 = execFileSync2("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
+    const out2 = execFileSync4("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -1432,7 +1587,7 @@ function revIsHead(rev, ctx) {
   if (!ctx?.cwd || rev.startsWith("-")) return null;
   const parse3 = (r) => {
     try {
-      return execFileSync2("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
+      return execFileSync4("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
         cwd: ctx.cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -1452,7 +1607,7 @@ function defaultBranch(ctx) {
   if (hit !== void 0) return hit;
   let name = null;
   try {
-    const ref = execFileSync2("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
+    const ref = execFileSync4("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -2706,20 +2861,20 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join4, relative } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join6, relative as relative2 } from "node:path";
 
 // src/wiring.ts
-import { readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join as join3, posix } from "node:path";
+import { basename, dirname, isAbsolute as isAbsolute3, join as join5, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync2(join3(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync3(join5(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -2732,10 +2887,12 @@ var TW_VERSION = shippedVersion();
 var PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
 var PRE_MATCHER = PRE_TOOLS.join("|");
 var MARKER = "# tamperward: block agent shortcuts before they land";
-var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
-var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
-var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
-var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
+var NPX_AUTHORITY = "npx --yes --global --userconfig=/dev/null --globalconfig=/dev/null/npmrc-global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online";
+var AUTHORITY_FAIL_CLOSED = " || (echo tamperward: authority failed to start >&2 && exit 2)";
+var HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook claude${AUTHORITY_FAIL_CLOSED}`;
+var SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep claude${AUTHORITY_FAIL_CLOSED}`;
+var PRECOMMIT_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} check --staged`;
+var OURS = /^\s*npx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (?:(hook claude|sweep claude) \|\| \(echo tamperward: authority failed to start >&2 && exit 2\)|(check --staged))\s*$/;
 var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
@@ -2749,7 +2906,7 @@ function pinNotBelow(now, floor) {
   const c = compareVersions(now, floor);
   return c !== null && c >= 0;
 }
-var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n*$/;
+var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? check --staged\n*$/;
 function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
@@ -2787,7 +2944,7 @@ function canonicalPath(path) {
 }
 function resolvesToClaudeSettings(path, env = process.env) {
   if (isClaudeSettings(path, env)) return true;
-  return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
+  return isAbsolute3(path) && isClaudeSettings(canonicalPath(path), env);
 }
 
 // src/detectors/policy-diff.ts
@@ -2915,8 +3072,8 @@ function policyAddWeakening(after) {
 }
 
 // src/detectors/hook-wiring.ts
-import { existsSync } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve } from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve2 } from "node:path";
 import { parse as parseYaml } from "yaml";
 function stripComment(line) {
   let single = false;
@@ -4030,16 +4187,16 @@ function expandShellPath(t, env = process.env) {
 }
 function hookTests(policy, ctx) {
   const cwd = ctx?.cwd;
-  const onDisk = cwd !== void 0 && existsSync(cwd);
+  const onDisk = cwd !== void 0 && existsSync2(cwd);
   const root = onDisk ? canonicalPath(cwd) : cwd;
   const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
     const hit = memo.get(t);
     if (hit !== void 0) return hit;
     let p = expandShellPath(t.replace(/^["']|["']$/g, ""));
-    const pathy = isAbsolute2(p) || p.includes("/") && !/^[-:]/.test(p);
-    if (pathy && (isAbsolute2(p) || onDisk)) {
-      p = canonicalPath(isAbsolute2(p) ? p : resolve(cwd, p));
+    const pathy = isAbsolute4(p) || p.includes("/") && !/^[-:]/.test(p);
+    if (pathy && (isAbsolute4(p) || onDisk)) {
+      p = canonicalPath(isAbsolute4(p) ? p : resolve2(cwd, p));
       if (root !== void 0) {
         if (p === root) p = ".";
         else if (p.startsWith(root + "/")) p = p.slice(root.length + 1);
@@ -4226,7 +4383,6 @@ var declares = (s, event) => eventEntries(s, event) !== null;
 var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout", "statusMessage"]);
 var HOOK_TYPES = /* @__PURE__ */ new Set(["command", "prompt", "agent", "http"]);
 var SIBLING_KEYS = GATE_KEYS;
-var CANONICAL_CMD = /^npx --yes tamperward@(\S+) (hook|sweep) claude$/;
 var MENTIONS_GATE = /\btamperward\b.*\b(?:hook|sweep)\b/;
 var FORGERY = /hookSpecificOutput|permissionDecision|updatedInput|"decision"|"continue"/;
 var ENV_MECHANISM = [
@@ -4244,10 +4400,11 @@ function analyseGateCommand(cmd, event) {
   const want = event === "PreToolUse" ? "hook" : "sweep";
   const problems = [];
   let runs = true;
-  const canonical2 = cmd.match(CANONICAL_CMD);
+  const canonical2 = cmd.match(OURS);
   if (canonical2) {
-    if (canonical2[2] !== want) {
-      problems.push(`runs \`${canonical2[2]} claude\` under ${event}`);
+    const kind = canonical2[2];
+    if (kind !== `${want} claude`) {
+      problems.push(`runs \`${kind}\` under ${event}`);
       runs = false;
     }
     if (!PLAIN_SEMVER.test(canonical2[1])) {
@@ -4597,8 +4754,8 @@ function lefthookBase(c, changes, ctx) {
   if (!ctx?.cwd) return null;
   for (const n of names) {
     try {
-      const p = join4(ctx.cwd, n);
-      if (existsSync2(p)) return parseDoc(readFileSync3(p, "utf8"));
+      const p = join6(ctx.cwd, n);
+      if (existsSync3(p)) return parseDoc(readFileSync4(p, "utf8"));
     } catch {
     }
   }
@@ -4668,9 +4825,9 @@ function updateIndexHiding(toks, policy) {
   return null;
 }
 function repoRelative(path, ctx) {
-  if (!ctx?.cwd || !isAbsolute3(path)) return path;
-  const rel = relative(ctx.cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
+  if (!ctx?.cwd || !isAbsolute5(path)) return path;
+  const rel = relative2(ctx.cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 var HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
 var HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
@@ -4719,7 +4876,7 @@ function huskyRuntimeWrite(path, content, ctx) {
   if (!ok) return false;
   if (!ctx?.cwd) return false;
   const root = path.slice(0, path.length - m[0].length + (m[0].startsWith("/") ? 1 : 0));
-  const entry = inspectRel(join4(ctx.cwd, root), ".husky/pre-commit");
+  const entry = inspectRel(join6(ctx.cwd, root), ".husky/pre-commit");
   if (entry.kind !== "file") return false;
   const gate = textOf(entry);
   if (gate == null) return false;
@@ -4972,7 +5129,7 @@ var hookTampering = {
           if (why) {
             const target = shellHookTarget(seg, toks, policy, ctx) ?? shellHookTarget("", fed, policy, ctx);
             const file = target ? repoRelative(target, ctx) : void 0;
-            const outside = file !== void 0 && (isAbsolute3(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
+            const outside = file !== void 0 && (isAbsolute5(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
             out2.push(
               makeFinding(RULE6, policy, {
                 ...file !== void 0 ? { file } : {},
@@ -6099,8 +6256,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join5, posix as posix2 } from "node:path";
+import { readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join7, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -6117,7 +6274,7 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute4(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  if (!ledger.trim() || isAbsolute6(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
   const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
@@ -6224,9 +6381,9 @@ function parseOrThrow(src, where) {
   return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
-  const path = join5(cwd, POLICY_FILE);
-  if (!existsSync3(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync4(path, "utf8"), POLICY_FILE);
+  const path = join7(cwd, POLICY_FILE);
+  if (!existsSync4(path)) return defaultPolicy();
+  return parseOrThrow(readFileSync5(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -6235,12 +6392,12 @@ function loadPolicyAt(rev, cwd) {
 }
 
 // src/signoff.ts
-import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync6, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname2, join as join8 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
-  return createHash("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
+  return createHash2("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
 }
 var fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
 function ledgerPath(cwd, policy) {
@@ -6248,13 +6405,13 @@ function ledgerPath(cwd, policy) {
   if (!ledgerInsideRepo(rel)) {
     throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
   }
-  return join6(cwd, rel);
+  return join8(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync4(p)) return [];
+  if (!existsSync5(p)) return [];
   const out2 = [];
-  for (const line of readFileSync5(p, "utf8").split("\n")) {
+  for (const line of readFileSync6(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -6294,7 +6451,9 @@ function oobToken(want, oob, head) {
     }
     const [rule, sha2] = [t.slice(0, at), t.slice(at + 1)];
     if (rule !== want) continue;
-    if (!head || sha2.length >= 7 && head.startsWith(sha2)) return t;
+    const normalizedHead = head?.trim().toLowerCase();
+    const normalizedSha = sha2.trim().toLowerCase();
+    if (!head || /^[0-9a-f]+$/.test(normalizedHead) && normalizedSha === normalizedHead) return t;
   }
   return null;
 }
@@ -6310,8 +6469,8 @@ function applyOobSignoffs(findings, oob, head) {
   return { findings: remaining, cleared };
 }
 function oobHeadFromEnv(env = process.env) {
-  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim();
-  return v.length >= 7 ? v : void 0;
+  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim().toLowerCase();
+  return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(v) ? v : void 0;
 }
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
@@ -6573,6 +6732,11 @@ function check(opts) {
   } else if (opts.worktree) {
     const p = policy;
     changes = opts.includeUntracked ? diffWorktreeWithUntracked({ cwd: opts.cwd }, (rel) => isProtected(rel, p)) : diffWorktree({ cwd: opts.cwd });
+    const seen = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
+    for (const rel of hiddenTrackedPaths({ cwd: opts.cwd })) {
+      if (seen.has(rel) || !isProtected(rel, p)) continue;
+      changes.push(...synthFileChange(rel, fileAt("HEAD", rel, { cwd: opts.cwd }), fileOnDisk(rel, { cwd: opts.cwd })));
+    }
     layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
@@ -6624,106 +6788,8 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
-
-// src/adapters/claude/changes.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, join as join7, relative as relative2, resolve as resolve2 } from "node:path";
-function asStr(v) {
-  return typeof v === "string" ? v : "";
-}
-function readDisk(path) {
-  return textOf(inspectResolved(path));
-}
-function abs(path, cwd) {
-  return resolve2(cwd, path);
-}
-function relForDisplay(path, cwd) {
-  const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
-}
-function applyEdit(content, oldStr, newStr) {
-  if (content === null) return newStr;
-  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
-  return content.replace(oldStr, () => newStr);
-}
-function synthFileChange(displayPath, before, after) {
-  if (before === after) return [];
-  let op;
-  if (before === null) op = "add";
-  else if (after === null) op = "delete";
-  else op = "modify";
-  const dir = mkdtempSync(join7(tmpdir(), "hf-"));
-  let raw = "";
-  try {
-    const a = join7(dir, "a");
-    const b = join7(dir, "b");
-    writeFileSync(a, before ?? "");
-    writeFileSync(b, after ?? "");
-    try {
-      raw = execFileSync3("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
-        encoding: "utf8",
-        maxBuffer: 256 * 1024 * 1024
-      });
-    } catch (e) {
-      const err2 = e;
-      if (err2.status !== 1) {
-        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
-      }
-      raw = err2.stdout ? String(err2.stdout) : "";
-    }
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-  const first = parseDiff(raw)[0];
-  const hunks = first && first.kind === "file" ? first.hunks : [];
-  return [{ kind: "file", path: displayPath, oldPath: null, op, before, after, binary: false, hunks }];
-}
-function changesFromClaudeHook(input, cwd) {
-  const ti = input.tool_input ?? {};
-  switch (input.tool_name) {
-    case "Bash": {
-      const raw = asStr(ti.command);
-      return raw ? [{ kind: "command", raw, argv: raw.split(/\s+/) }] : [];
-    }
-    case "Write": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, asStr(ti.content));
-    }
-    case "Edit": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string));
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
-    }
-    case "MultiEdit": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      let after = before;
-      const edits = Array.isArray(ti.edits) ? ti.edits : [];
-      for (const raw of edits) {
-        const ed = raw;
-        after = applyEdit(after, ed.old_string ?? "", ed.new_string ?? "");
-      }
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
-    }
-    case "NotebookEdit": {
-      const fp = asStr(ti.notebook_path);
-      const src = asStr(ti.new_source);
-      if (!fp || !src) return [];
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), "", src);
-    }
-    default:
-      return [];
-  }
-}
+import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync8 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
 function formatDenial(blocks) {
@@ -6745,22 +6811,22 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join9 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
-  return join8(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
+  return join9(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync5(p)) {
-      const v = readFileSync6(p, "utf8").trim();
+    if (existsSync6(p)) {
+      const v = readFileSync7(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -6785,21 +6851,21 @@ function advanceTurnBaseline(cwd, sessionId) {
 }
 
 // src/effect.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join9 } from "node:path";
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute7, join as join10 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
 function gitDir2(cwd) {
   try {
-    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync5("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join9(cwd, d);
+    return isAbsolute7(d) ? d : join10(cwd, d);
   } catch {
     return null;
   }
@@ -6808,8 +6874,8 @@ function statePath(cwd, sessionId, kind) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join9(gd, "tamperward");
-  return join9(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
+  const dir = join10(gd, "tamperward");
+  return join10(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 function ptreePath(cwd, sessionId) {
   return statePath(cwd, sessionId, "ptree");
@@ -6817,7 +6883,7 @@ function ptreePath(cwd, sessionId) {
 function turnTreePath(cwd, sessionId) {
   return statePath(cwd, sessionId, "turntree");
 }
-var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
+var sha = (buf) => createHash3("sha256").update(buf).digest("hex").slice(0, 16);
 function contentHash(content) {
   return sha(Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"));
 }
@@ -6838,7 +6904,7 @@ function snapshotProtected(cwd, policy, prev) {
   } catch {
   }
   const walk2 = (rel) => {
-    const abs2 = rel ? join9(cwd, rel) : cwd;
+    const abs2 = rel ? join10(cwd, rel) : cwd;
     let names;
     try {
       names = readdirSync(abs2);
@@ -6851,7 +6917,7 @@ function snapshotProtected(cwd, policy, prev) {
       if (pruned.has(r)) continue;
       let st;
       try {
-        st = lstatSync2(join9(cwd, r));
+        st = lstatSync2(join10(cwd, r));
       } catch {
         continue;
       }
@@ -6878,9 +6944,9 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync6(p)) return null;
+  if (!p || !existsSync7(p)) return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -6888,7 +6954,7 @@ function loadTree(p) {
 function saveTree(p, tree) {
   if (!p) return;
   try {
-    mkdirSync3(join9(p, ".."), { recursive: true });
+    mkdirSync3(join10(p, ".."), { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(tree));
     renameSync(tmp, p);
@@ -6920,19 +6986,19 @@ function dropTurnTree(cwd, sessionId) {
 
 // src/cli/watch.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
-import { join as join10 } from "node:path";
-import { createHash as createHash3 } from "node:crypto";
+import { join as join11 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
   const e = inspectPath(abs2);
   if (e.kind === "absent" || e.kind === "unreadable") return { mode: null, size: null, hash: null };
   if (e.kind !== "file" || e.content == null) return { mode: e.mode, size: null, hash: null };
-  const hash = createHash3("sha256").update(e.content).digest("hex").slice(0, 16);
+  const hash = createHash4("sha256").update(e.content).digest("hex").slice(0, 16);
   return { mode: e.mode, size: e.size, hash };
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
-  return join10(gitDir(cwd) ?? join10(cwd, ".git"), "tamperward", "fsevents.jsonl");
+  return join11(gitDir(cwd) ?? join11(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -6949,12 +7015,12 @@ function watchTree(dir, cb) {
     if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
-      w = watch(rel ? join10(dir, rel) : dir, (kind, fname) => {
+      w = watch(rel ? join11(dir, rel) : dir, (kind, fname) => {
         if (!fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync(join10(dir, child)).isDirectory()) addDir(child);
+          if (statSync(join11(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -6967,7 +7033,7 @@ function watchTree(dir, cb) {
     addDir(rel);
     let names = [];
     try {
-      names = readdirSync2(rel ? join10(dir, rel) : dir);
+      names = readdirSync2(rel ? join11(dir, rel) : dir);
     } catch {
       return;
     }
@@ -6975,7 +7041,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync(join10(dir, child)).isDirectory()) walk2(child);
+        if (statSync(join11(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -6987,13 +7053,13 @@ function watchTree(dir, cb) {
 }
 function startWatcher(dir, log, policy) {
   try {
-    mkdirSync4(join10(log, ".."), { recursive: true });
+    mkdirSync4(join11(log, ".."), { recursive: true });
   } catch {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
     if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
-    const s = snap(join10(dir, rel));
+    const s = snap(join11(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
     last.set(rel, key2);
@@ -7020,7 +7086,7 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync9, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync10, statSync as statSync2 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
@@ -7030,7 +7096,7 @@ function readEvents(log, offset) {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync9(log, "utf8").slice(offset);
+  const raw = readFileSync10(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -7083,7 +7149,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync10(0, "utf8");
+    return readFileSync11(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7299,7 +7365,7 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   let dirty = false;
   for (const c of changes) {
     if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy)) continue;
-    const hash = createHash4("sha256").update(c.after).digest("hex").slice(0, 16);
+    const hash = createHash5("sha256").update(c.after).digest("hex").slice(0, 16);
     const prev = tree[c.path];
     tree[c.path] = {
       hash,
@@ -7336,10 +7402,10 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync7(log)) return none;
+  if (!existsSync8(log)) return none;
   let offset = 0;
-  if (cp && existsSync7(cp)) {
-    const n = Number(readFileSync10(cp, "utf8"));
+  if (cp && existsSync8(cp)) {
+    const n = Number(readFileSync11(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -7490,15 +7556,15 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join11, relative as relative3, resolve as resolve3 } from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { createHash as createHash6 } from "node:crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
   try {
-    return execFileSync5("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+    return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
   } catch {
     return null;
   }
@@ -7506,6 +7572,8 @@ function gitConfig(cwd, key2) {
 var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
 var SWEEP_RE = /\btamperward(?:@\S+)?\s+sweep\s+claude\b/;
 var PRECOMMIT_RE = /\btamperward(?:@\S+)?\s+check\s+--staged\b/;
+var LEGACY_OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
+var PRE_GLOBAL_OURS = /^\s*npx --yes --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (hook claude|sweep claude|check --staged)\s*$/;
 var CODEOWNERS_MARK = "# tamperward: the gate cannot guard the file that defines it";
 var CODEOWNERS_PATHS = ["/.github/workflows/", "/.tamperward.yml", "/.github/CODEOWNERS"];
 function coveredBy(existing, critical) {
@@ -7550,12 +7618,16 @@ version: 1
 # ignore: []            # visible blind spots \u2014 the count is always reported
 `;
 function pinOf(command) {
-  const m = command.match(OURS);
+  const m = ours(command);
   return m ? m[1] ?? "" : null;
 }
+function ours(command) {
+  const previous = command.replace(" --global", "").replace(" || (echo tamperward: authority failed to start >&2 && exit 2)", "");
+  return command.match(OURS) ?? previous.match(PRE_GLOBAL_OURS) ?? command.match(LEGACY_OURS);
+}
 function stalePin(command) {
   const pin = pinOf(command);
-  return pin !== null && pin !== TW_VERSION;
+  return pin !== null && (pin !== TW_VERSION || !OURS.test(command));
 }
 var WORKFLOW_CONTENT = `name: tamperward
 
@@ -7579,22 +7651,20 @@ jobs:
   tamperward:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # The gate is fetched from the registry AT GATE TIME, from inside the
-    # checked-out pull request \u2014 and \`npm\` reads \`.npmrc\` from the working
-    # directory. A PR that commits one line, \`registry=https://\u2026\`, chooses where
-    # the authority judging it is downloaded from; the version pin below pins the
-    # STRING, not the SOURCE. An environment variable outranks a project
-    # \`.npmrc\` in npm's config precedence, so this is what makes the pin mean
-    # something.
-    env:
-      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
     steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0 # the range diff needs both endpoints
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+      # Install the authority before candidate files exist in the job workspace.
+      # npm therefore cannot discover a pull-request .npmrc, and every security-
+      # relevant npm setting is fixed on the command line. Later steps invoke the
+      # installed binary directly: npm/npx never starts from candidate-controlled cwd.
+      - name: Install Tamperward authority
+        working-directory: \${{ runner.temp }}
+        run: npm install --global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward@${TW_VERSION}
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # the range diff needs both endpoints
       - name: Resolve out-of-band sign-off from PR labels
         id: oob
         env:
@@ -7609,7 +7679,7 @@ jobs:
           # across pushes, so an unbound one would clear every later finding on
           # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
-        run: npx --yes tamperward@${TW_VERSION} check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
+        run: tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
       # Diff-time detection is spelling-dependent by nature; pristine
       # re-execution is not, and it was the layer nothing got past in the
       # taskbench sweeps. Shipping a CI template WITHOUT it meant every
@@ -7627,12 +7697,12 @@ jobs:
           # stays red whatever the labels say.
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
-        run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
+        run: tamperward verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
 var WORKFLOW_MARK = "# tamperward:generated";
 var WORKFLOW_MARK_RE = /^# tamperward:generated v(\S+) sha256:([0-9a-f]+)\n/m;
 function bodyHash(body) {
-  return createHash5("sha256").update(body).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(body).digest("hex").slice(0, 16);
 }
 function workflowFile(body) {
   return `${WORKFLOW_MARK} v${TW_VERSION} sha256:${bodyHash(body)}
@@ -7669,8 +7739,8 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join11(cwd, POLICY_FILE);
-  if (existsSync8(path)) {
+  const path = join12(cwd, POLICY_FILE);
+  if (existsSync9(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -7688,12 +7758,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join11(cwd, rel);
+  const path = join12(cwd, rel);
   let settings = {};
-  if (existsSync8(path)) {
+  if (existsSync9(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(path, "utf8"));
+      parsed = JSON.parse(readFileSync12(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -7728,7 +7798,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync8(path) ? "update" : "create",
+    status: existsSync9(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -7738,7 +7808,7 @@ function planClaudeHooks(cwd) {
     ].filter(Boolean).join(" + "),
     apply: () => {
       for (const h of repin) {
-        const kind = String(h.command ?? "").match(OURS)?.[2];
+        const kind = ours(String(h.command ?? ""))?.[2];
         h.command = kind === "hook claude" ? HOOK_CMD : kind === "sweep claude" ? SWEEP_CMD : h.command;
       }
       if (needPre) {
@@ -7785,15 +7855,15 @@ var MANAGED_HOOKS = [
 ];
 function hooksDir(cwd) {
   try {
-    const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const out2 = execFileSync6("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync8(join11(cwd, ".git")) ? join11(cwd, ".git", "hooks") : null;
+  return existsSync9(join12(cwd, ".git")) ? join12(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute8(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -7816,30 +7886,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync8(join11(cwd, ".husky"))) {
-    path = join11(cwd, ".husky", "pre-commit");
+  if (existsSync9(join12(cwd, ".husky"))) {
+    path = join12(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join11(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync9(join12(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
-      path = join11(dirname4(dir), "pre-commit");
+      path = join12(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join11(dir, "pre-commit");
+      path = join12(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join11(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join12(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
-  if (existsSync8(path) && !statSync3(path).isFile()) {
+  if (existsSync9(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync8(path) ? readFileSync11(path, "utf8") : null;
+  const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7883,8 +7953,8 @@ ${block.join("\n")}
     };
   }
   if (at !== -1) {
-    const ours = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
-    if (!ours) {
+    const ours2 = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
+    if (!ours2) {
       return {
         item: "pre-commit",
         path: rel,
@@ -7928,10 +7998,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync8(join11(cwd, r))
+    (r) => existsSync9(join12(cwd, r))
   );
-  const path = join11(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync11(path, "utf8") : null;
+  const path = join12(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync12(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -7964,12 +8034,12 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join11(cwd, rel);
+  const path = join12(cwd, rel);
   const write = () => {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync8(path)) {
+  if (!existsSync9(path)) {
     return {
       item: "ci",
       path: rel,
@@ -7980,7 +8050,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync11(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -8079,79 +8149,33 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join14, resolve as resolve4 } from "node:path";
-
-// src/git/trusted.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync12 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join12 } from "node:path";
-function trustedGitEnv() {
-  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
-}
-function gitDirOf(cwd) {
-  try {
-    const d = execFileSync6("git", ["rev-parse", "--git-dir"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      env: trustedGitEnv()
-    }).trim();
-    if (!d) return null;
-    return isAbsolute8(d) ? d : join12(cwd, d);
-  } catch {
-    return null;
-  }
-}
-function objectRewriteState(cwd) {
-  const parts = [];
-  try {
-    parts.push(
-      "replace:" + execFileSync6("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
-        cwd,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-        env: trustedGitEnv()
-      }).trim()
-    );
-  } catch {
-    parts.push("replace:<unreadable>");
-  }
-  const dir = gitDirOf(cwd);
-  for (const rel of ["info/grafts", "shallow"]) {
-    if (dir === null) {
-      parts.push(`${rel}:<no-git-dir>`);
-      continue;
-    }
-    const p = join12(dir, rel);
-    try {
-      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync12(p, "utf8").trim() : ""));
-    } catch {
-      parts.push(`${rel}:<unreadable>`);
-    }
-  }
-  return createHash6("sha256").update(parts.join("\n")).digest("hex");
-}
+import { dirname as dirname5, isAbsolute as isAbsolute9, join as join14, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
 import { join as join13 } from "node:path";
-function treeFingerprint(cwd) {
-  const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+function treeFingerprint(cwd, keepIgnored) {
+  const listed = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 1 << 28,
     env: trustedGitEnv()
-  }).split("\0").filter(Boolean).sort();
+  }).split("\0").filter(Boolean);
+  const files = [.../* @__PURE__ */ new Set([...listed, ...keepIgnored ? ignoredPaths({ cwd }, keepIgnored) : []])].sort();
   const h = createHash7("sha256");
   for (const rel of files) {
     h.update(rel);
     h.update("\0");
-    h.update(inspectRel(cwd, rel).content ?? "<unreadable>");
+    const entry = inspectRel(cwd, rel);
+    h.update(entry.kind);
+    h.update("\0");
+    h.update(String(entry.mode));
+    h.update("\0");
+    h.update(entry.content ?? `<${entry.kind}:${entry.detail}>`);
     h.update("\0");
   }
   return h.digest("hex");
@@ -8284,29 +8308,131 @@ function baseIsAncestorOfHead(base, cwd) {
   const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
+function inside(root, path) {
+  const rel = relative4(resolve4(root), resolve4(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute9(rel);
+}
+function linkParts(path) {
+  const parts = sep === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  return parts.filter((part) => part !== "" && part !== ".");
+}
+function linkEscape(label, target) {
+  return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
+}
+function driveRelativeLinkTarget(target) {
+  return sep === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+}
+function rootedLinkTarget(target) {
+  return isAbsolute9(target) || driveRelativeLinkTarget(target);
+}
+function safeSymlink(target, out2, root, label) {
+  if (rootedLinkTarget(target) || !inside(root, resolve4(dirname5(out2), target))) {
+    throw linkEscape(label, target);
+  }
+  rmSync3(out2, { force: true });
+  symlinkSync(target, out2);
+}
+function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
+  let domain = "tree";
+  let stack = linkParts(relative4(root, dirname5(out2)));
+  const pending = linkParts(target);
+  const seen = /* @__PURE__ */ new Set();
+  let hops = 0;
+  while (pending.length) {
+    const part = pending.shift();
+    if (part === "..") {
+      if (!stack.length) throw linkEscape(label, target);
+      stack.pop();
+      continue;
+    }
+    stack.push(part);
+    if (domain === "tree" && dependencyRoot && stack.length === 1 && stack[0] === "node_modules") {
+      domain = "deps";
+      stack = [];
+      continue;
+    }
+    const base = domain === "tree" ? root : dependencyRoot;
+    const current = join14(base, ...stack);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (!st.isSymbolicLink()) continue;
+    if (++hops > 128) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    const key2 = `${domain}:${current}:${pending.join(sep)}`;
+    if (seen.has(key2)) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    seen.add(key2);
+    const next = readlinkSync3(current);
+    stack.pop();
+    if (driveRelativeLinkTarget(next)) {
+      throw linkEscape(label, target);
+    }
+    if (isAbsolute9(next)) {
+      if (domain === "tree" || !dependencyRoot || !inside(dependencyRoot, next)) {
+        throw linkEscape(label, target);
+      }
+      stack = [];
+      pending.unshift(...linkParts(relative4(dependencyRoot, resolve4(next))));
+    } else {
+      pending.unshift(...linkParts(next));
+    }
+  }
+}
+function rejectLinkedParent(cwd, rel) {
+  const parts = rel.split("/").slice(0, -1);
+  let current = cwd;
+  for (const part of parts) {
+    current = join14(current, part);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) {
+      throw new Error(`${rel} has a symlinked parent directory (${relative4(cwd, current)})`);
+    }
+  }
+}
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  const links = [];
   for (const rel of listed) {
     const src = join14(cwd, rel);
+    rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = statSync5(src);
+      st = lstatSync3(src);
     } catch {
       continue;
     }
-    if (!st.isFile()) continue;
     const out2 = join14(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
-    if (lstatSync3(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync14(src));
-    } else {
+    if (st.isSymbolicLink()) {
+      const target = readlinkSync3(src);
+      safeSymlink(target, out2, dest, rel);
+      links.push({ rel, out: out2, target });
+    } else if (st.isFile()) {
       cpSync(src, out2, { dereference: true });
+      chmodSync2(out2, st.mode);
+    } else {
+      throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
-    chmodSync2(out2, st.mode);
   }
   const nm = resolve4(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  let dependencyRoot = null;
+  if (existsSync10(nm)) dependencyRoot = realpathSync3(nm);
+  for (const link of links) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
+  }
+  if (dependencyRoot) symlinkSync(nm, join14(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8358,6 +8484,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const verifierGlobs = policy.verify?.inputs ?? [];
   const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
   const restored = [];
+  const restoredLinks = [];
   const baseProtected = /* @__PURE__ */ new Set();
   for (const e of entries) {
     if (!isOverlay(e.path)) continue;
@@ -8370,7 +8497,9 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
-      symlinkSync(content.toString("utf8"), out2);
+      const target = content.toString("utf8");
+      safeSymlink(target, out2, dest, `the base's ${e.path}`);
+      restoredLinks.push({ path: e.path, out: out2, target });
     } else {
       writeFileSync6(out2, content);
       chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
@@ -8384,6 +8513,11 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     rmSync3(join14(dest, rel), { force: true });
     removed++;
   }
+  const nm = resolve4(cwd, "node_modules");
+  const dependencyRoot = existsSync10(nm) ? realpathSync3(nm) : null;
+  for (const link of restoredLinks) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, `the base's ${link.path}`);
+  }
   return { restored, removed };
 }
 var SUPERVISOR = `
@@ -8505,7 +8639,8 @@ function runVerify(opts) {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
   };
-  const treeBefore = treeFingerprint(cwd);
+  const protectedIgnored = (rel) => isProtected(rel, policy);
+  const treeBefore = treeFingerprint(cwd, protectedIgnored);
   const depsBefore = depsFingerprint(cwd);
   try {
     mkdirSync6(visDir);
@@ -8516,7 +8651,7 @@ function runVerify(opts) {
     return 2;
   }
   const visible = runSuite(visDir, cmd, budget);
-  if (treeFingerprint(cwd) !== treeBefore) {
+  if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
     out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
     out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
@@ -8544,7 +8679,7 @@ function runVerify(opts) {
   const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runSuite(priDir, cmd, budget);
   const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
-  const treeMoved = treeFingerprint(cwd) !== treeBefore;
+  const treeMoved = treeFingerprint(cwd, protectedIgnored) !== treeBefore;
   const depsMoved = depsFingerprint(cwd) !== depsBefore;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
@@ -8641,7 +8776,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync as realpathSync3 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync4 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -8659,7 +8794,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync3(cwd);
+    real = realpathSync4(cwd);
   } catch {
     return out2;
   }
@@ -8672,19 +8807,31 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   for (const pid of pids) {
     const n = Number(pid);
     if (n === process.pid) continue;
-    let held;
     try {
-      held = realpathSync3(`/proc/${pid}/cwd`);
+      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
+      const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
+      if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
       continue;
     }
-    if (held !== real && !held.startsWith(real + "/")) continue;
+    const procLinks = [`/proc/${pid}/cwd`, `/proc/${pid}/exe`];
     try {
-      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
-      const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
-      if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
+      for (const fd of readdirSync4(`/proc/${pid}/fd`)) procLinks.push(`/proc/${pid}/fd/${fd}`);
     } catch {
     }
+    let holds = false;
+    for (const link of procLinks) {
+      try {
+        const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
+        const held = raw.startsWith("/") ? resolve5(raw) : raw;
+        if (held === real || held.startsWith(real + "/")) {
+          holds = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (holds) out2.push(n);
   }
   return out2;
 }
@@ -8758,7 +8905,8 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
 tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMENT_FAILED`);
     return 1;
   }
-  const fpBefore = treeFingerprint(cwd);
+  const protectedIgnored = (rel) => isProtected(rel, frozenPolicy);
+  const fpBefore = treeFingerprint(cwd, protectedIgnored);
   let diffCode = 0;
   if (head !== base) {
     out(`
@@ -8775,7 +8923,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     } catch {
     }
   }
-  const mutatedDuringAdjudication = treeFingerprint(cwd) !== fpBefore;
+  const mutatedDuringAdjudication = treeFingerprint(cwd, protectedIgnored) !== fpBefore;
   if (mutatedDuringAdjudication) {
     err("tamperward run: the working tree changed while it was being adjudicated \u2014");
     err("the verdict below would describe a tree that no longer exists.");
@@ -8796,7 +8944,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err(`working tree (pid ${survivors.join(", ")}). A verdict cannot outlive the tree it describes.`);
   }
   const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted || rewrote;
-  const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
+  const cannot = !notQuiescent && (diffCode === 2 || workCode === 2 || verifyCode === 2);
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1 || notQuiescent;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;
   const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : rewrote ? "OBJECT_REWRITE \u2014 the base the checks read is not the base we anchored to" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";