tamperward 2.10.8 → 2.11.0

package/dist/cli/index.js

@@ -1651,8 +1651,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve6) {
-  const obj = resolve6(expr);
+function metricsOf(expr, resolve8) {
+  const obj = resolve8(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1666,7 +1666,7 @@ function metricsOf(expr, resolve6) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve6(p.initializer));
+    const n = numericOf(resolve8(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1712,17 +1712,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve6 = resolverFor(sf);
+    const resolve8 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve6(node.initializer);
+          const init = resolve8(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve6);
+            const flat = metricsOf(init, resolve8);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1736,7 +1736,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve6);
+              const m = metricsOf(p.initializer, resolve8);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1769,18 +1769,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve6 = resolverFor(sf);
+    const resolve8 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve6(node.initializer));
+          const { items, opaque } = literals(resolve8(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve6(node.initializer));
+          const { items, opaque } = literals(resolve8(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -3064,6 +3064,18 @@ function policyWeakening(before, after) {
           `verify.inputs narrowed (removed ${droppedInputs.join(", ")}) \u2014 the pristine run would execute the candidate's copy of those files`
         );
       }
+      const beforeBackend = bv.backend ?? "local";
+      const afterBackend = av.backend ?? "local";
+      if (beforeBackend === "container" && afterBackend !== "container") {
+        reasons.push(
+          `verify.backend lowered container \u2192 ${afterBackend} \u2014 final verification would leave the isolated trust domain`
+        );
+      }
+      if (beforeBackend === "container" && afterBackend === "container" && av.image !== bv.image) {
+        reasons.push(
+          `verify.image changed (${bv.image ?? "<missing>"} \u2192 ${av.image ?? "<missing>"}) \u2014 the trusted verifier image identity changed`
+        );
+      }
     }
   }
   return reasons;
@@ -6342,6 +6354,21 @@ function validate(r, where) {
       bad(`verify.budget must be a positive number of seconds, got ${show(v.budget)}`);
     }
     if (v.inputs !== void 0 && !isStringList(v.inputs)) bad(`verify.inputs must be a list of globs, got ${show(v.inputs)}`);
+    if (v.backend !== void 0 && v.backend !== "local" && v.backend !== "container") {
+      bad(`verify.backend must be "local" or "container", got ${show(v.backend)}`);
+    }
+    if (v.image !== void 0 && typeof v.image !== "string") {
+      bad(`verify.image must be an immutable container image reference, got ${show(v.image)}`);
+    }
+    const backend = v.backend ?? "local";
+    if (backend === "container") {
+      if (typeof v.image !== "string") bad('verify.image is required when verify.backend is "container"');
+      if (!/^(?!-)[^\s@]+@sha256:[0-9a-f]{64}$/i.test(v.image)) {
+        bad(`verify.image must be pinned by sha256 digest (name@sha256:<64 hex>), got ${show(v.image)}`);
+      }
+    } else if (v.image !== void 0) {
+      bad('verify.image is only valid when verify.backend is "container"');
+    }
   }
 }
 function parsePolicy(raw, where = POLICY_FILE) {
@@ -6374,7 +6401,9 @@ function parsePolicy(raw, where = POLICY_FILE) {
         // Rebuilding the block field-by-field means a field added later and
         // not listed here is SILENTLY DROPPED — which is how `inputs` first
         // shipped as a no-op that parsed, validated, and restored nothing.
-        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {}
+        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {},
+        ...r.verify.backend ? { backend: r.verify.backend } : {},
+        ...r.verify.image ? { image: r.verify.image } : {}
       }
     } : {}
   };
@@ -8162,17 +8191,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
-import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash10 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, isAbsolute as isAbsolute9, join as join14, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join15, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
-import { join as join13 } from "node:path";
 function treeFingerprint(cwd, keepIgnored) {
   const listed = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -8195,44 +8222,772 @@ function treeFingerprint(cwd, keepIgnored) {
   }
   return h.digest("hex");
 }
-function depsFingerprint(cwd) {
-  const root = join13(cwd, "node_modules");
-  const h = createHash7("sha256");
-  const walk2 = (dir) => {
+
+// src/dependency-env.ts
+import { createHash as createHash8 } from "node:crypto";
+import {
+  existsSync as existsSync10,
+  lstatSync as lstatSync3,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync13,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync3,
+  statSync as statSync4
+} from "node:fs";
+import {
+  basename as basename3,
+  delimiter,
+  dirname as dirname5,
+  isAbsolute as isAbsolute9,
+  join as join13,
+  relative as relative4,
+  resolve as resolve4,
+  sep
+} from "node:path";
+var Unattestable = class extends Error {
+};
+function inside(root, candidate) {
+  const rel = relative4(resolve4(root), resolve4(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute9(rel);
+}
+function modeKind(path) {
+  const st = lstatSync3(path);
+  if (st.isFile()) return { kind: "file", mode: st.mode };
+  if (st.isDirectory()) return { kind: "dir", mode: st.mode };
+  if (st.isSymbolicLink()) return { kind: "symlink", mode: st.mode };
+  return { kind: "special", mode: st.mode };
+}
+function fingerprintRoot(root, cwd, h) {
+  let rootStat;
+  let currentReal;
+  try {
+    rootStat = lstatSync3(root.path);
+    currentReal = realpathSync3(root.path);
+  } catch (e) {
+    throw new Unattestable(
+      root.kind + " root " + JSON.stringify(root.path) + " can no longer be resolved (" + (e instanceof Error ? e.message : String(e)) + ")"
+    );
+  }
+  if (currentReal !== root.realPath) {
+    throw new Unattestable(
+      root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
+    );
+  }
+  if (!statSync4(root.path).isDirectory()) {
+    throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
+  }
+  h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
+  if (rootStat.isSymbolicLink()) h.update(readlinkSync2(root.path) + "\0");
+  const cwdReal = realpathSync3(cwd);
+  const visited = /* @__PURE__ */ new Set();
+  const hashFile = (path, label) => {
+    let st;
+    try {
+      st = statSync4(path);
+      if (!st.isFile()) throw new Error("not a regular file");
+      h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
+      h.update(readFileSync13(path));
+      h.update("\0");
+    } catch (e) {
+      throw new Unattestable(
+        "dependency link target " + JSON.stringify(path) + " is not attestable (" + (e instanceof Error ? e.message : String(e)) + ")"
+      );
+    }
+  };
+  const walk2 = (dir, namespace) => {
+    const realDir = realpathSync3(dir);
+    if (visited.has(realDir)) return;
+    visited.add(realDir);
     let entries;
     try {
       entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
+    } catch (e) {
+      throw new Unattestable(
+        "dependency directory " + JSON.stringify(dir) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+      );
     }
-    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join13(dir, e.name);
-      if (e.isDirectory()) walk2(p);
-      else if (e.isFile()) {
-        h.update(p);
+    for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join13(dir, entry.name);
+      const rel = namespace ? namespace + "/" + entry.name : entry.name;
+      let ident;
+      try {
+        ident = modeKind(path);
+      } catch (e) {
+        throw new Unattestable(
+          "dependency entry " + JSON.stringify(path) + " disappeared while attesting (" + (e instanceof Error ? e.message : String(e)) + ")"
+        );
+      }
+      h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
+      if (ident.kind === "file") {
         try {
-          h.update(readFileSync13(p));
-          h.update(String(statSync4(p).mode));
-        } catch {
-          h.update("<unreadable>");
+          h.update(readFileSync13(path));
+          h.update("\0");
+        } catch (e) {
+          throw new Unattestable(
+            "dependency file " + JSON.stringify(path) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+          );
+        }
+        continue;
+      }
+      if (ident.kind === "dir") {
+        walk2(path, rel);
+        continue;
+      }
+      if (ident.kind === "symlink") {
+        let target;
+        try {
+          target = readlinkSync2(path);
+        } catch (e) {
+          throw new Unattestable(
+            "dependency symlink " + JSON.stringify(path) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+          );
         }
-      } else if (e.isSymbolicLink()) {
-        h.update(p);
+        h.update(target + "\0");
+        let resolved;
         try {
-          h.update(readlinkSync2(p));
+          resolved = realpathSync3(path);
         } catch {
-          h.update("<unreadable-link>");
+          continue;
         }
+        const followed = statSync4(path);
+        if (followed.isFile()) {
+          hashFile(resolved, "@target:" + rel);
+          continue;
+        }
+        if (followed.isDirectory()) {
+          if (inside(root.realPath, resolved)) {
+            walk2(resolved, "@target:" + rel);
+            continue;
+          }
+          if (inside(cwdReal, resolved)) {
+            throw new Unattestable(
+              "dependency workspace symlink " + JSON.stringify(path) + " points into the candidate worktree at " + JSON.stringify(resolved) + "; faithful per-copy remapping is not available"
+            );
+          }
+          throw new Unattestable(
+            "dependency directory symlink " + JSON.stringify(path) + " escapes the bounded root to " + JSON.stringify(resolved)
+          );
+        }
+        throw new Unattestable("dependency symlink " + JSON.stringify(path) + " resolves to a special file");
       }
+      throw new Unattestable("dependency entry " + JSON.stringify(path) + " is a special file");
     }
   };
+  walk2(root.realPath, "");
+}
+function snapshot(roots, probes, cwd) {
+  const h = createHash8("sha256");
+  for (const probe of probes) {
+    h.update(
+      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync10(probe.path) ? "present" : "absent") + "\0"
+    );
+  }
+  for (const root of roots) fingerprintRoot(root, cwd, h);
+  return h.digest("hex");
+}
+function freezeRoot(kind, path) {
   try {
-    if (!statSync4(root).isDirectory()) return "none";
+    if (!statSync4(path).isDirectory()) {
+      throw new Error("not a directory");
+    }
+    return { kind, path: resolve4(path), realPath: realpathSync3(path) };
+  } catch (e) {
+    throw new Unattestable(
+      kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
+    );
+  }
+}
+function shellTokens(command) {
+  const matches = command.match(/(?:[^\s"'\\]+|"(?:\\.|[^"])*"|'[^']*')+/g) ?? [];
+  return matches.map((token) => {
+    if (token.startsWith("'") && token.endsWith("'") || token.startsWith('"') && token.endsWith('"')) return token.slice(1, -1);
+    return token;
+  });
+}
+function firstExecutable(command) {
+  const tokens2 = shellTokens(command);
+  let i = 0;
+  while (i < tokens2.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[i])) i++;
+  if (tokens2[i] === "env") {
+    i++;
+    while (i < tokens2.length && (tokens2[i].startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[i]))) i++;
+  }
+  if (tokens2[i] === "command") {
+    i++;
+    while (i < tokens2.length && tokens2[i].startsWith("-")) i++;
+  }
+  if (tokens2[i] === "timeout") {
+    i++;
+    while (i < tokens2.length && tokens2[i].startsWith("-")) i++;
+    if (i < tokens2.length) i++;
+  }
+  return tokens2[i] ?? null;
+}
+function resolveExecutable(token, cwd, env) {
+  if (!token) return null;
+  if (token.includes("/") || token.includes("\\")) {
+    const path = isAbsolute9(token) ? token : resolve4(cwd, token);
+    try {
+      return existsSync10(path) ? realpathSync3(path) : null;
+    } catch {
+      return null;
+    }
+  }
+  for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    const candidate = resolve4(entry, token);
+    try {
+      if (existsSync10(candidate) && statSync4(candidate).isFile()) return realpathSync3(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function pythonName(name) {
+  return /^(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)$/.test(name.toLowerCase());
+}
+function looksPython(command, executable, token) {
+  const exe = executable ? basename3(executable) : "";
+  const raw = token ? basename3(token) : "";
+  if (pythonName(exe) || pythonName(raw)) return true;
+  return /(?:^|[\s;&|()])(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)(?=$|[\s;&|()])/.test(command);
+}
+function inferredVenvFromToken(token, cwd) {
+  if (!token || !token.includes("/") && !token.includes("\\")) return null;
+  const path = isAbsolute9(token) ? token : resolve4(cwd, token);
+  if (!pythonName(basename3(path))) return null;
+  const parent = dirname5(path);
+  const parentName = basename3(parent).toLowerCase();
+  if (parentName !== "bin" && parentName !== "scripts") return null;
+  const root = dirname5(parent);
+  return existsSync10(join13(root, "pyvenv.cfg")) ? root : null;
+}
+function unsupportedEcosystem(command, token) {
+  const name = token ? basename3(token).toLowerCase() : "";
+  const raw = command.toLowerCase();
+  if (["ruby", "bundle", "bundler", "rspec", "rake"].includes(name) || /(?:^|[\s;&|()])(?:bundle\s+exec|ruby|rspec|rake)(?=$|[\s;&|()])/.test(raw)) return "Ruby dependency environment discovery is not yet attestable";
+  if (["mvn", "mvnw", "gradle", "gradlew", "java"].includes(name) || /(?:^|[\s;&|()])(?:mvn|mvnw|gradle|gradlew|java)(?=$|[\s;&|()])/.test(raw)) return "JVM dependency environment discovery is not yet attestable";
+  if (name === "dotnet" || /(?:^|[\s;&|()])dotnet(?=$|[\s;&|()])/.test(raw)) return ".NET dependency environment discovery is not yet attestable";
+  return null;
+}
+function inferredVenv(executable) {
+  if (!executable) return null;
+  const parent = dirname5(executable);
+  const parentName = basename3(parent).toLowerCase();
+  if (parentName !== "bin" && parentName !== "scripts") return null;
+  const root = dirname5(parent);
+  return existsSync10(join13(root, "pyvenv.cfg")) ? root : null;
+}
+function venvProblem(root) {
+  const cfg = join13(root, "pyvenv.cfg");
+  if (!existsSync10(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
+  try {
+    const body = readFileSync13(cfg, "utf8");
+    if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
+      return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
+    }
+  } catch (e) {
+    return "cannot read " + JSON.stringify(cfg) + " (" + (e instanceof Error ? e.message : String(e)) + ")";
+  }
+  return null;
+}
+function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
+  const cwd = resolve4(cwdInput);
+  const roots = [];
+  const probes = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addRoot = (kind, path) => {
+    const root = freezeRoot(kind, path);
+    const key2 = kind + ":" + root.path;
+    if (!seen.has(key2)) {
+      roots.push(root);
+      seen.add(key2);
+    }
+  };
+  try {
+    const nodeModules = join13(cwd, "node_modules");
+    if (existsSync10(nodeModules)) addRoot("node_modules", nodeModules);
+    else probes.push({ kind: "node_modules", path: nodeModules });
+    const token = firstExecutable(command);
+    const executable = resolveExecutable(token, cwd, env);
+    let venv = null;
+    if (env.VIRTUAL_ENV?.trim()) {
+      if (!isAbsolute9(env.VIRTUAL_ENV)) {
+        throw new Unattestable("VIRTUAL_ENV is relative (" + JSON.stringify(env.VIRTUAL_ENV) + ")");
+      }
+      venv = resolve4(env.VIRTUAL_ENV);
+    } else {
+      venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
+      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync10(join13(cwd, ".venv", "pyvenv.cfg"))) {
+        venv = join13(cwd, ".venv");
+      }
+    }
+    if (venv) {
+      const problem = venvProblem(venv);
+      if (problem) throw new Unattestable(problem);
+      addRoot("python-venv", venv);
+    } else if (looksPython(command, executable, token)) {
+      throw new Unattestable(
+        "Python verifier selected without an identifiable virtual environment; global/user site-packages are not bounded"
+      );
+    }
+    const unsupported = unsupportedEcosystem(command, token);
+    if (unsupported) throw new Unattestable(unsupported);
+    const status = roots.length ? "attested" : "none";
+    const fingerprint2 = snapshot(roots, probes, cwd);
+    return { status, command, roots, probes, fingerprint: fingerprint2 };
+  } catch (e) {
+    return {
+      status: "unattestable",
+      command,
+      roots,
+      probes,
+      reason: e instanceof Error ? e.message : String(e)
+    };
+  }
+}
+function checkDependencyEnvironment(cwdInput, descriptor) {
+  if (descriptor.status === "unattestable") {
+    return { ok: false, reason: descriptor.reason ?? "dependency environment is not attestable" };
+  }
+  try {
+    const fingerprint2 = snapshot(descriptor.roots, descriptor.probes, resolve4(cwdInput));
+    if (fingerprint2 !== descriptor.fingerprint) {
+      return { ok: false, fingerprint: fingerprint2, reason: "dependency environment fingerprint changed" };
+    }
+    return { ok: true, fingerprint: fingerprint2 };
+  } catch (e) {
+    return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+function dependencyEnvironmentReport(descriptor) {
+  return {
+    status: descriptor.status,
+    roots: descriptor.roots.map((root) => ({ kind: root.kind, path: root.path })),
+    ...descriptor.fingerprint ? { fingerprint: descriptor.fingerprint } : {},
+    ...descriptor.reason ? { reason: descriptor.reason } : {}
+  };
+}
+function dependencyEnvironmentSummary(descriptor) {
+  if (descriptor.status === "unattestable") {
+    return "unattestable - " + (descriptor.reason ?? "unknown dependency environment");
+  }
+  if (descriptor.status === "none") return "none detected (candidate node_modules remains absent)";
+  const kinds = [...new Set(descriptor.roots.map((root) => root.kind))].join(", ");
+  return "attested " + kinds + " (sha256 " + (descriptor.fingerprint?.slice(0, 12) ?? "unknown") + "...)";
+}
+
+// src/verifier-backend.ts
+import { createHash as createHash9, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync5 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname6, join as join14, resolve as resolve5 } from "node:path";
+var DIGEST_IMAGE = /^(?!-)[^\s@]+@sha256:[0-9a-f]{64}$/i;
+var DEFAULT_DOCKER_HOST = "unix:///var/run/docker.sock";
+function identity() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const groups = typeof process.getgroups === "function" ? process.getgroups() : [];
+  return { uid, groups };
+}
+function writableByCaller(path) {
+  try {
+    const st = statSync5(path);
+    const { uid, groups } = identity();
+    if (uid === 0) return true;
+    if ((st.mode & 2) !== 0) return true;
+    if (uid !== null && st.uid === uid && (st.mode & 128) !== 0) return true;
+    if (groups.includes(st.gid) && (st.mode & 16) !== 0) return true;
+    return false;
   } catch {
-    return "none";
+    return true;
+  }
+}
+function replaceableByCaller(path) {
+  let current = resolve5(path);
+  if (writableByCaller(current)) return true;
+  current = dirname6(current);
+  while (true) {
+    if (writableByCaller(current)) return true;
+    const parent = dirname6(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return false;
+}
+function findExecutable(name) {
+  for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
+    if (!raw) continue;
+    const candidate = join14(raw, name);
+    try {
+      accessSync(candidate, constants2.X_OK);
+      return realpathSync4(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function fileSha256(path) {
+  return createHash9("sha256").update(readFileSync14(path)).digest("hex");
+}
+function engineClientEnv() {
+  return {
+    PATH: "/usr/bin:/bin",
+    HOME: "/nonexistent",
+    LANG: "C",
+    LC_ALL: "C"
+  };
+}
+function dockerArgs(host, args) {
+  return ["--host", host, ...args];
+}
+function dockerAvailable(enginePath, host) {
+  try {
+    const r = spawnSync(enginePath, dockerArgs(host, ["version"]), {
+      stdio: "ignore",
+      timeout: 5e3,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+function declaredImageVolumePaths(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    throw new Error("image metadata must be a Docker image-inspect object");
+  }
+  const config = metadata.Config;
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("image metadata Config must be an object");
+  }
+  const volumes = config.Volumes;
+  if (volumes === void 0 || volumes === null) return [];
+  if (typeof volumes !== "object" || Array.isArray(volumes)) {
+    throw new Error("image metadata Config.Volumes must be a mapping or null");
+  }
+  return Object.keys(volumes).sort();
+}
+function inspectImageMetadata(enginePath, host, image) {
+  try {
+    const r = spawnSync(enginePath, dockerArgs(host, ["image", "inspect", image]), {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e4,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+    if (r.error || r.status !== 0) {
+      return {
+        metadata: null,
+        reason: "the digest-pinned verifier image is not present locally; TamperWard refuses to pull during adjudication"
+      };
+    }
+    const parsed = JSON.parse(r.stdout ?? "");
+    if (!Array.isArray(parsed) || parsed.length !== 1) {
+      return { metadata: null, reason: "Docker returned malformed verifier image metadata" };
+    }
+    return { metadata: parsed[0] };
+  } catch {
+    return { metadata: null, reason: "Docker returned unreadable verifier image metadata" };
+  }
+}
+function engineStable(backend) {
+  if (!backend.enginePath || !backend.engineSha256) return false;
+  try {
+    if (realpathSync4(backend.enginePath) !== backend.enginePath) return false;
+    if (replaceableByCaller(backend.enginePath)) return false;
+    return fileSha256(backend.enginePath) === backend.engineSha256;
+  } catch {
+    return false;
+  }
+}
+function prepareVerifierBackend(verify) {
+  const kind = verify?.backend ?? "local";
+  if (kind === "local") {
+    return { kind: "local", trust: "checkpointed-local", available: true };
+  }
+  const image = verify?.image;
+  if (!image || !DIGEST_IMAGE.test(image)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      ...image ? { image } : {},
+      reason: "container verifier requires an immutable runtime-safe image reference name@sha256:<64 hex>"
+    };
+  }
+  const forced = process.env.TAMPERWARD_CONTAINER_ENGINE;
+  if (forced && forced !== "docker") {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      reason: `unsupported isolated verifier engine ${JSON.stringify(forced)}; Docker is the tested backend`
+    };
+  }
+  const enginePath = findExecutable("docker");
+  if (!enginePath) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      reason: "Docker executable was not found on the operator PATH"
+    };
+  }
+  if (replaceableByCaller(enginePath)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      reason: "Docker engine executable is writable/replaceable by the caller identity; it cannot be verifier authority"
+    };
+  }
+  const daemonHost = DEFAULT_DOCKER_HOST;
+  if (!dockerAvailable(enginePath, daemonHost)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `Docker is unavailable at the fixed verifier endpoint ${daemonHost}`
+    };
+  }
+  const inspectedImage = inspectImageMetadata(enginePath, daemonHost, image);
+  if (!inspectedImage.metadata) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: inspectedImage.reason ?? "Docker could not attest the verifier image metadata"
+    };
+  }
+  let declaredVolumes;
+  try {
+    declaredVolumes = declaredImageVolumePaths(inspectedImage.metadata);
+  } catch (e) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `Docker verifier image metadata is invalid: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (declaredVolumes.length > 0) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `the verifier image declares writable Docker VOLUME path(s): ${declaredVolumes.join(", ")}; --read-only does not make image-declared volumes immutable`
+    };
+  }
+  return {
+    kind: "container",
+    trust: "isolated-container",
+    available: true,
+    image,
+    engine: "docker",
+    enginePath,
+    engineSha256: fileSha256(enginePath),
+    daemonHost
+  };
+}
+function verifierBackendReport(backend) {
+  return {
+    kind: backend.kind,
+    trust: backend.trust,
+    available: backend.available,
+    ...backend.image ? { image: backend.image } : {},
+    ...backend.engine ? { engine: backend.engine } : {},
+    ...backend.reason ? { reason: backend.reason } : {}
+  };
+}
+function verifierBackendSummary(backend) {
+  if (backend.kind === "local") {
+    return "local (checkpointed same-host; weaker trust boundary)";
+  }
+  const identity2 = backend.image ?? "<missing image>";
+  if (!backend.available) {
+    return `container (isolated; unavailable: ${backend.reason ?? "unknown reason"}; image ${identity2})`;
+  }
+  return `container (isolated via Docker; image ${identity2})`;
+}
+function cleanupContainer(backend, name) {
+  if (!backend.enginePath || !backend.daemonHost || !engineStable(backend)) return;
+  try {
+    spawnSync(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
+      stdio: "ignore",
+      timeout: 1e4,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+  } catch {
+  }
+}
+function containerRunArgs(input) {
+  return [
+    "run",
+    "--name",
+    input.name,
+    // Keep the stopped container until the trusted host has inspected .State.
+    // Docker CLI exit codes overlap candidate exit codes; container metadata is
+    // the authority that tells us whether the suite actually ran.
+    "--pull",
+    "never",
+    "--network",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--pids-limit",
+    "256",
+    "--user",
+    `${input.uid}:${input.gid}`,
+    // Frozen candidate/pristine input is immutable in the verifier. A suite
+    // needing outputs writes to /workspace-out, HOME or /tmp instead.
+    "--mount",
+    `type=bind,src=${input.workspace},dst=/workspace,ro`,
+    "--tmpfs",
+    "/tmp:rw,nosuid,nodev,mode=1777",
+    "--tmpfs",
+    `/home/tamperward:rw,nosuid,nodev,mode=700,uid=${input.uid},gid=${input.gid}`,
+    "--tmpfs",
+    `/workspace-out:rw,nosuid,nodev,mode=700,uid=${input.uid},gid=${input.gid}`,
+    "--workdir",
+    "/workspace",
+    "--env",
+    "HOME=/home/tamperward",
+    "--env",
+    "TMPDIR=/tmp",
+    "--env",
+    "CI=1",
+    "--env",
+    "TAMPERWARD_OUTPUT_DIR=/workspace-out",
+    "--env",
+    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    // The image supplies immutable runtime/dependencies, not command policy.
+    // Docker otherwise appends our command to an image ENTRYPOINT.
+    "--entrypoint",
+    "/bin/sh",
+    input.image,
+    "-c",
+    input.command
+  ];
+}
+function runContainerStage(backend, dir, command, budgetSecs) {
+  const t0 = Date.now();
+  if (backend.kind !== "container" || !backend.available || !backend.image || !backend.enginePath || !backend.engineSha256 || !backend.daemonHost || !engineStable(backend)) {
+    return {
+      exit: null,
+      secs: 0,
+      failure: "backend",
+      reason: "isolated verifier authority is incomplete or changed before stage execution"
+    };
+  }
+  const name = `tamperward-verify-${process.pid}-${randomUUID().slice(0, 12)}`;
+  const uid = typeof process.getuid === "function" ? process.getuid() : 65534;
+  const gid = typeof process.getgid === "function" ? process.getgid() : 65534;
+  const args = containerRunArgs({
+    image: backend.image,
+    name,
+    workspace: resolve5(dir),
+    command,
+    uid,
+    gid
+  });
+  try {
+    const r = spawnSync(
+      backend.enginePath,
+      dockerArgs(backend.daemonHost, args),
+      {
+        stdio: "ignore",
+        timeout: budgetSecs * 1e3,
+        killSignal: "SIGKILL",
+        env: engineClientEnv()
+      }
+    );
+    const secs = Math.round((Date.now() - t0) / 1e3);
+    if (r.error) {
+      cleanupContainer(backend, name);
+      const code = r.error.code;
+      return code === "ETIMEDOUT" ? { exit: null, secs, failure: "budget", reason: "verifier stage exceeded its budget" } : { exit: null, secs, failure: "backend", reason: `Docker client failed: ${r.error.message}` };
+    }
+    if (r.status === null) {
+      cleanupContainer(backend, name);
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`
+      };
+    }
+    if (!engineStable(backend)) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: "Docker engine identity changed before verifier result inspection"
+      };
+    }
+    const inspected = spawnSync(
+      backend.enginePath,
+      dockerArgs(backend.daemonHost, ["inspect", "--format", "{{json .State}}", name]),
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 1e4,
+        killSignal: "SIGKILL",
+        env: engineClientEnv()
+      }
+    );
+    let state = null;
+    if (!inspected.error && inspected.status === 0) {
+      try {
+        state = JSON.parse((inspected.stdout ?? "").trim());
+      } catch {
+        state = null;
+      }
+    }
+    cleanupContainer(backend, name);
+    if (!state || state.Status !== "exited" || typeof state.ExitCode !== "number" || state.OOMKilled || (state.Error ?? "") !== "") {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: state?.OOMKilled ? "verifier container was OOM-killed" : state?.Error ? `verifier container runtime error: ${state.Error}` : "Docker did not provide a trustworthy exited-container state"
+      };
+    }
+    return { exit: state.ExitCode, secs };
+  } catch (e) {
+    cleanupContainer(backend, name);
+    return {
+      exit: null,
+      secs: Math.round((Date.now() - t0) / 1e3),
+      failure: "backend",
+      reason: `Docker verifier execution failed: ${e instanceof Error ? e.message : String(e)}`
+    };
   }
-  walk2(root);
-  return h.digest("hex");
 }
 
 // src/cli/verify.ts
@@ -8320,28 +9075,28 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
+  const r = spawnSync2("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
-function inside(root, path) {
-  const rel = relative4(resolve4(root), resolve4(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute9(rel);
+function inside2(root, path) {
+  const rel = relative5(resolve6(root), resolve6(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute10(rel);
 }
 function linkParts(path) {
-  const parts = sep === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  const parts = sep2 === "\\" ? path.split(/[\\/]+/) : path.split("/");
   return parts.filter((part) => part !== "" && part !== ".");
 }
 function linkEscape(label, target) {
   return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
 }
 function driveRelativeLinkTarget(target) {
-  return sep === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+  return sep2 === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
 }
 function rootedLinkTarget(target) {
-  return isAbsolute9(target) || driveRelativeLinkTarget(target);
+  return isAbsolute10(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out2, root, label) {
-  if (rootedLinkTarget(target) || !inside(root, resolve4(dirname5(out2), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve6(dirname7(out2), target))) {
     throw linkEscape(label, target);
   }
   rmSync3(out2, { force: true });
@@ -8349,7 +9104,7 @@ function safeSymlink(target, out2, root, label) {
 }
 function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative4(root, dirname5(out2)));
+  let stack = linkParts(relative5(root, dirname7(out2)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -8367,10 +9122,10 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "tree" ? root : dependencyRoot;
-    const current = join14(base, ...stack);
+    const current = join15(base, ...stack);
     let st;
     try {
-      st = lstatSync3(current);
+      st = lstatSync4(current);
     } catch {
       continue;
     }
@@ -8378,7 +9133,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     if (++hops > 128) {
       throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
     }
-    const key2 = `${domain}:${current}:${pending.join(sep)}`;
+    const key2 = `${domain}:${current}:${pending.join(sep2)}`;
     if (seen.has(key2)) {
       throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
     }
@@ -8388,12 +9143,12 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     if (driveRelativeLinkTarget(next)) {
       throw linkEscape(label, target);
     }
-    if (isAbsolute9(next)) {
-      if (domain === "tree" || !dependencyRoot || !inside(dependencyRoot, next)) {
+    if (isAbsolute10(next)) {
+      if (domain === "tree" || !dependencyRoot || !inside2(dependencyRoot, next)) {
         throw linkEscape(label, target);
       }
       stack = [];
-      pending.unshift(...linkParts(relative4(dependencyRoot, resolve4(next))));
+      pending.unshift(...linkParts(relative5(dependencyRoot, resolve6(next))));
     } else {
       pending.unshift(...linkParts(next));
     }
@@ -8403,32 +9158,32 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join14(current, part);
+    current = join15(current, part);
     let st;
     try {
-      st = lstatSync3(current);
+      st = lstatSync4(current);
     } catch {
       continue;
     }
     if (st.isSymbolicLink()) {
-      throw new Error(`${rel} has a symlinked parent directory (${relative4(cwd, current)})`);
+      throw new Error(`${rel} has a symlinked parent directory (${relative5(cwd, current)})`);
     }
   }
 }
-function materialize(cwd, dest) {
+function materialize(cwd, dest, dependencyRoot) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   const links = [];
   for (const rel of listed) {
-    const src = join14(cwd, rel);
+    const src = join15(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = lstatSync3(src);
+      st = lstatSync4(src);
     } catch {
       continue;
     }
-    const out2 = join14(dest, rel);
-    mkdirSync6(dirname5(out2), { recursive: true });
+    const out2 = join15(dest, rel);
+    mkdirSync6(dirname7(out2), { recursive: true });
     dropSymlink(out2);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -8441,17 +9196,14 @@ function materialize(cwd, dest) {
       throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
   }
-  const nm = resolve4(cwd, "node_modules");
-  let dependencyRoot = null;
-  if (existsSync10(nm)) dependencyRoot = realpathSync3(nm);
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join15(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync3(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync4(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -8476,15 +9228,15 @@ function baseEntries(base, cwd) {
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash8("sha256");
+  const h = createHash10("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join14(dest, rel);
+    const p = join15(dest, rel);
     try {
-      const st = lstatSync3(p);
+      const st = lstatSync4(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync14(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
     } catch {
       h.update("<gone>");
     }
@@ -8492,7 +9244,7 @@ function overlayDigest(dest, paths) {
   }
   return h.digest("hex");
 }
-function overlayPristine(cwd, base, dest, policy, cmd) {
+function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const entries = baseEntries(base, cwd);
   const atBase = entries.map((e) => e.path);
   const verifierOwned = verifierInputs(cmd, atBase, policy);
@@ -8508,8 +9260,8 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join14(dest, e.path);
-    mkdirSync6(dirname5(out2), { recursive: true });
+    const out2 = join15(dest, e.path);
+    mkdirSync6(dirname7(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
@@ -8525,11 +9277,9 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join14(dest, rel), { force: true });
+    rmSync3(join15(dest, rel), { force: true });
     removed++;
   }
-  const nm = resolve4(cwd, "node_modules");
-  const dependencyRoot = existsSync10(nm) ? realpathSync3(nm) : null;
   for (const link of restoredLinks) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, `the base's ${link.path}`);
   }
@@ -8572,8 +9322,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join14(scratch, "npmrc-user");
-  const globalRc = join14(scratch, "npmrc-global");
+  const userRc = join15(scratch, "npmrc-user");
+  const globalRc = join15(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -8581,12 +9331,12 @@ function suiteEnv(scratch) {
   env.YARN_IGNORE_PATH = "1";
   return env;
 }
-function runSuite(dir, cmd, budgetSecs) {
+function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join14(tmpdir2(), "tw-verify-run-"));
-  const outFile = join14(outDir, "result.json");
+  const outDir = mkdtempSync2(join15(tmpdir2(), "tw-verify-run-"));
+  const outFile = join15(outDir, "result.json");
   try {
-    spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+    spawnSync2(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
       env: suiteEnv(outDir),
       stdio: "ignore",
@@ -8597,7 +9347,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync14(outFile, "utf8"));
+      r = JSON.parse(readFileSync15(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -8641,6 +9391,45 @@ function runVerify(opts) {
     return 2;
   }
   const budget = opts.budget ?? policy.verify?.budget ?? 300;
+  const verifierBackend = opts.verifierBackend ?? prepareVerifierBackend(policy.verify);
+  const backendReport = () => verifierBackendReport(verifierBackend);
+  if (!verifierBackend.available) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_UNAVAILABLE",
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend is unavailable \u2014 failing closed");
+      out2("verify: " + (verifierBackend.reason ?? "unknown backend failure"));
+    }
+    return 2;
+  }
+  const isolated = verifierBackend.kind === "container";
+  const dependencyEnvironment = isolated ? null : opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
+  const dependencyReport = () => dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : {
+    status: "verifier-owned",
+    roots: [],
+    image: verifierBackend.image
+  };
+  if (dependencyEnvironment?.status === "unattestable" && !opts.allowDepDrift) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
+        verifier_backend: backendReport(),
+        dependency_environment: dependencyReport()
+      }));
+    } else {
+      out2("verify: dependency environment is not attestable \u2014 failing closed");
+      out2("verify: " + (dependencyEnvironment.reason ?? "unknown dependency environment"));
+    }
+    return 2;
+  }
+  const frozenNodeModules = dependencyEnvironment ? dependencyEnvironment.roots.find((root) => root.kind === "node_modules")?.realPath ?? null : null;
+  const checkDeps = () => dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
+  const runStage = (dir) => isolated ? runContainerStage(verifierBackend, dir, cmd, budget) : runLocalSuite(dir, cmd, budget);
   let base;
   try {
     base = resolveBase(opts.base ?? "HEAD", cwd);
@@ -8648,58 +9437,105 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join14(visRoot, "t");
+  const visRoot = mkdtempSync2(join15(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join15(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
   };
   const protectedIgnored = (rel) => isProtected(rel, policy);
   const treeBefore = treeFingerprint(cwd, protectedIgnored);
-  const depsBefore = depsFingerprint(cwd);
+  const dependencyAtEntry = checkDeps();
+  if (!dependencyAtEntry.ok && !opts.allowDepDrift) {
+    cleanup([visRoot]);
+    out2("verify: the frozen dependency environment changed before the visible suite ran \u2014");
+    out2((dependencyAtEntry.reason ?? "dependency identity changed") + ". Failing closed, not open.");
+    return 2;
+  }
   try {
     mkdirSync6(visDir);
-    materialize(cwd, visDir);
+    materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
-  const visible = runSuite(visDir, cmd, budget);
+  const visible = runStage(visDir);
+  if (visible.failure === "backend") {
+    cleanup([visRoot]);
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        stage: "visible",
+        detail: visible.reason,
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend failed while running the visible stage \u2014 failing closed");
+      if (visible.reason) out2("verify: " + visible.reason);
+    }
+    return 2;
+  }
   if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
     out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
     out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
     return 2;
   }
-  if (depsFingerprint(cwd) !== depsBefore) {
+  const dependencyAfterVisible = checkDeps();
+  if (!dependencyAfterVisible.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
-    out2("verify: the installed dependency tree changed while the visible suite was running \u2014 the");
-    out2("pristine run executes through it too. Failing closed, not open.");
+    out2("verify: the frozen dependency environment changed while the visible suite was running \u2014");
+    out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join14(priRoot, "t");
+  const priRoot = mkdtempSync2(join15(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join15(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
     mkdirSync6(priDir);
-    materialize(cwd, priDir);
-    ({ restored, removed: removedAdded } = overlayPristine(cwd, base, priDir, policy, cmd));
+    materialize(cwd, priDir, frozenNodeModules);
+    ({ restored, removed: removedAdded } = overlayPristine(
+      cwd,
+      base,
+      priDir,
+      policy,
+      cmd,
+      frozenNodeModules
+    ));
   } catch (e) {
     cleanup([visRoot, priRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
   const overlayBefore = overlayDigest(priDir, restored);
-  const pristine = runSuite(priDir, cmd, budget);
+  const pristine = runStage(priDir);
+  if (pristine.failure === "backend") {
+    cleanup([visRoot, priRoot]);
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        stage: "pristine",
+        detail: pristine.reason,
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed");
+      if (pristine.reason) out2("verify: " + pristine.reason);
+    }
+    return 2;
+  }
   const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
   const treeMoved = treeFingerprint(cwd, protectedIgnored) !== treeBefore;
-  const depsMoved = depsFingerprint(cwd) !== depsBefore;
+  const dependencyAfterPristine = checkDeps();
+  const depsMoved = !dependencyAfterPristine.ok && !opts.allowDepDrift;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
     out2(
-      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the installed dependency tree changed while the pristine suite was running") + " \u2014"
+      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the frozen dependency environment changed while the pristine suite was running") + " \u2014"
     );
     out2("the verdict would describe something other than what ran. Failing closed, not open.");
     out2("(A suite that rewrites its own snapshots or test files in place will trip this; run it in");
@@ -8734,6 +9570,8 @@ function runVerify(opts) {
         pristine: { exit: pristine.exit, secs: pristine.secs },
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
+        verifier_backend: backendReport(),
+        dependency_environment: dependencyReport(),
         ...signedOff ? { oob_signoff: signedOff } : {},
         ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
@@ -8746,6 +9584,10 @@ function runVerify(opts) {
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
     out2(`tamperward verify \u2014 ${lines[verdict2]}`);
+    out2(`verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+    out2(
+      dependencyEnvironment ? `dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : "") : `dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`
+    );
     if (signedOff)
       out2(
         `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
@@ -8790,9 +9632,9 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync4 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
+import { readdirSync as readdirSync4, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync6 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -8800,7 +9642,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync15("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -8809,7 +9651,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync4(cwd);
+    real = realpathSync6(cwd);
   } catch {
     return out2;
   }
@@ -8823,7 +9665,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -8838,7 +9680,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     for (const link of procLinks) {
       try {
         const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
-        const held = raw.startsWith("/") ? resolve5(raw) : raw;
+        const held = raw.startsWith("/") ? resolve7(raw) : raw;
         if (held === real || held.startsWith(real + "/")) {
           holds = true;
           break;
@@ -8851,7 +9693,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve5(opts.cwd ?? process.cwd());
+  const cwd = resolve7(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -8887,11 +9729,37 @@ function runEnvelope(opts) {
       return 2;
     }
   }
+  const verifierBackend = prepareVerifierBackend(frozenPolicy.verify);
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
-  const depsBefore = depsFingerprint(cwd);
+  out(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+  if (!verifierBackend.available) {
+    err("tamperward run: the requested verifier backend cannot be established \u2014");
+    err(`${verifierBackend.reason ?? "unknown backend failure"}. Failing closed before the agent starts.`);
+    return 2;
+  }
+  if (verifierBackend.kind === "container") {
+    err("tamperward run: container verification requires a frozen candidate handoff from an");
+    err("agent domain that cannot control the verifier engine. `run` executes the agent under");
+    err("this host identity, so it cannot honestly provide that separation. Failing closed");
+    err("before the agent starts; use standalone `tamperward verify` in trusted CI or after");
+    err("an externally isolated agent produces the frozen candidate artifact.");
+    return 2;
+  }
+  const dependencyEnvironment = verifierBackend.kind === "local" ? discoverDependencyEnvironment(cwd, frozenCmd) : null;
+  if (dependencyEnvironment) {
+    out(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
+    if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
+      err("tamperward run: the verifier dependency environment cannot be attested \u2014");
+      err(`${dependencyEnvironment.reason ?? "unknown dependency environment"}. Failing closed before the agent starts.`);
+      err("(Pass --allow-dep-drift only if you explicitly own this dependency-integrity risk.)");
+      return 2;
+    }
+  } else {
+    out(`tamperward run \u2014 dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`);
+  }
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
-  const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
+  const agent = spawnSync3(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
   if (objectRewriteState(cwd) !== rewritesBefore) {
     err("tamperward run: git object-replacement state changed during this run \u2014 a replace ref, graft");
@@ -8901,9 +9769,10 @@ function runEnvelope(opts) {
 tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
     return 1;
   }
-  if (depsFingerprint(cwd) !== depsBefore) {
-    err("tamperward run: the installed dependency tree changed before adjudication began \u2014 the program");
-    err("that runs the suite is not the one we started with, and both verification runs execute it.");
+  const dependencyBeforeAdjudication = dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
+  if (!dependencyBeforeAdjudication.ok) {
+    err("tamperward run: the frozen dependency environment changed before adjudication began \u2014");
+    err(`${dependencyBeforeAdjudication.reason ?? "dependency identity changed"}.`);
     if (!opts.allowDepDrift) {
       out(`
 tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEMENT_FAILED`);
@@ -8912,7 +9781,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     err("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
   }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
+  const isAncestor = spawnSync3("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err("the agent rewrote history out from under the anchor. That is the finding.");
@@ -8931,7 +9800,16 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   out("\n[envelope] policy check over the working tree (frozen policy, untracked included, no local ledger):");
   const workCode = runCheck({ worktree: true, cwd, policyOverride: frozenPolicy, includeUntracked: true, ciLayer: true });
   out("\n[envelope] pristine verification against the trusted base:");
-  const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
+  const verifyCode = runVerify({
+    cwd,
+    base,
+    cmd: frozenCmd,
+    budget: frozenBudget,
+    policyOverride: frozenPolicy,
+    ...dependencyEnvironment ? { dependencyEnvironment } : {},
+    allowDepDrift: opts.allowDepDrift,
+    verifierBackend
+  });
   if (opts.settle && opts.settle > 0) {
     try {
       execFileSync9("sleep", [String(opts.settle)]);
@@ -8943,10 +9821,11 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err("tamperward run: the working tree changed while it was being adjudicated \u2014");
     err("the verdict below would describe a tree that no longer exists.");
   }
-  const depsDrifted = !opts.allowDepDrift && depsFingerprint(cwd) !== depsBefore;
+  const dependencyAfter = dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
+  const depsDrifted = Boolean(dependencyEnvironment) && !opts.allowDepDrift && !dependencyAfter.ok;
   if (depsDrifted) {
-    err("tamperward run: the installed dependency tree changed during this run \u2014 the program that");
-    err("runs the suite is not the one we started with. Both verification runs execute it.");
+    err("tamperward run: the frozen dependency environment changed during this run \u2014");
+    err(`${dependencyAfter.reason ?? "dependency identity changed"}. Both verification runs depend on it.`);
   }
   const rewrote = objectRewriteState(cwd) !== rewritesBefore;
   if (rewrote) {