tamperward 2.10.9 → 2.11.0

package/README.md

@@ -207,8 +207,11 @@ request would need the verify label; the self-gate stays a diff-time gate.
 
 This guarantee depends on a protected and immutable base, required status checks, a
 pinned Tamperward version, and label permissions restricted to trusted humans.
-Tamperward provides no OS isolation, no network confinement, no secret isolation,
-and no semantic-correctness oracle.
+The default local verifier is checkpointed same-host execution, not OS isolation.
+An optional digest-pinned container backend isolates final verification with no network,
+host dependency tree, HOME, temp, credential or socket sharing. Tamperward still is not a
+semantic-correctness oracle, and `tamperward run` does not pretend that a same-identity
+host agent is isolated from the Docker daemon.
 
 Full assumptions and residual risks: [SPEC.md](./SPEC.md),
 [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md), and the
@@ -246,11 +249,26 @@ verify:
   command: npm test
   budget: 300
   inputs: ['scripts/**']   # what the command DELEGATES to
+  # Optional stronger final-verification boundary:
+  # backend: container
+  # image: ghcr.io/acme/verifier@sha256:<64-hex-digest>
 ```
 
+`backend: local` is the default and is reported as `checkpointed-local`. With
+`backend: container`, the image must be digest-pinned and already present on the fixed
+local Docker daemon; Tamperward never pulls during adjudication. The materialised
+candidate/pristine tree is mounted read-only, the image owns runtime/dependencies,
+network is disabled, HOME/tmp are private, and optional suite output belongs in
+`$TAMPERWARD_OUTPUT_DIR` (`/workspace-out`). Images that declare Dockerfile
+`VOLUME` paths are refused: Docker mounts those paths writable even with
+`--read-only`, which would undermine the immutable verifier-image boundary. Image
+`ENTRYPOINT` is also overridden; the pinned image supplies the runtime/dependencies,
+while the trusted policy's `verify.command` remains the command that is adjudicated.
+
 That block is itself a guarded surface: changing the command, lowering the budget,
-narrowing `inputs`, or removing it is flagged as policy weakening — a verifier an
-agent can point at `true` is no verification at all.
+narrowing `inputs`, removing `backend: container`, or changing its pinned image is
+flagged as policy weakening — a verifier an agent can redirect is no verification at
+all.
 
 `inputs` names the files the command *executes*, so the pristine run gets the
 base's copy of them too. A command token that names a file present at the base is
@@ -266,9 +284,14 @@ The four primitives:
 npx tamperward check --staged                # pre-commit view
 npx tamperward check --diff "main...HEAD"    # CI view over the PR's commit range
 npx tamperward verify --base main            # pristine-suite re-execution
-npx tamperward run -- <agent command...>     # the outer envelope around an agent
+npx tamperward run -- <agent command...>     # same-host envelope (local verifier only)
 ```
 
+The isolated backend is a **frozen-artifact final verifier**. `tamperward run`
+deliberately refuses `backend: container` before launching the agent because the agent
+would share the host identity that controls Docker. Use isolated `tamperward verify`
+from trusted CI, or after an externally isolated agent hands off the frozen candidate.
+
 ### CLI reference
 
 Every flag below is what the command's parser actually reads (`src/cli/index.ts`,

package/dist/cli/index.js

@@ -1651,8 +1651,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve7) {
-  const obj = resolve7(expr);
+function metricsOf(expr, resolve8) {
+  const obj = resolve8(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1666,7 +1666,7 @@ function metricsOf(expr, resolve7) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve7(p.initializer));
+    const n = numericOf(resolve8(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1712,17 +1712,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve7 = resolverFor(sf);
+    const resolve8 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve7(node.initializer);
+          const init = resolve8(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve7);
+            const flat = metricsOf(init, resolve8);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1736,7 +1736,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve7);
+              const m = metricsOf(p.initializer, resolve8);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1769,18 +1769,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve7 = resolverFor(sf);
+    const resolve8 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve7(node.initializer));
+          const { items, opaque } = literals(resolve8(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve7(node.initializer));
+          const { items, opaque } = literals(resolve8(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -3064,6 +3064,18 @@ function policyWeakening(before, after) {
           `verify.inputs narrowed (removed ${droppedInputs.join(", ")}) \u2014 the pristine run would execute the candidate's copy of those files`
         );
       }
+      const beforeBackend = bv.backend ?? "local";
+      const afterBackend = av.backend ?? "local";
+      if (beforeBackend === "container" && afterBackend !== "container") {
+        reasons.push(
+          `verify.backend lowered container \u2192 ${afterBackend} \u2014 final verification would leave the isolated trust domain`
+        );
+      }
+      if (beforeBackend === "container" && afterBackend === "container" && av.image !== bv.image) {
+        reasons.push(
+          `verify.image changed (${bv.image ?? "<missing>"} \u2192 ${av.image ?? "<missing>"}) \u2014 the trusted verifier image identity changed`
+        );
+      }
     }
   }
   return reasons;
@@ -6342,6 +6354,21 @@ function validate(r, where) {
       bad(`verify.budget must be a positive number of seconds, got ${show(v.budget)}`);
     }
     if (v.inputs !== void 0 && !isStringList(v.inputs)) bad(`verify.inputs must be a list of globs, got ${show(v.inputs)}`);
+    if (v.backend !== void 0 && v.backend !== "local" && v.backend !== "container") {
+      bad(`verify.backend must be "local" or "container", got ${show(v.backend)}`);
+    }
+    if (v.image !== void 0 && typeof v.image !== "string") {
+      bad(`verify.image must be an immutable container image reference, got ${show(v.image)}`);
+    }
+    const backend = v.backend ?? "local";
+    if (backend === "container") {
+      if (typeof v.image !== "string") bad('verify.image is required when verify.backend is "container"');
+      if (!/^(?!-)[^\s@]+@sha256:[0-9a-f]{64}$/i.test(v.image)) {
+        bad(`verify.image must be pinned by sha256 digest (name@sha256:<64 hex>), got ${show(v.image)}`);
+      }
+    } else if (v.image !== void 0) {
+      bad('verify.image is only valid when verify.backend is "container"');
+    }
   }
 }
 function parsePolicy(raw, where = POLICY_FILE) {
@@ -6374,7 +6401,9 @@ function parsePolicy(raw, where = POLICY_FILE) {
         // Rebuilding the block field-by-field means a field added later and
         // not listed here is SILENTLY DROPPED — which is how `inputs` first
         // shipped as a no-op that parsed, validated, and restored nothing.
-        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {}
+        ...Array.isArray(r.verify.inputs) ? { inputs: r.verify.inputs.map(String) } : {},
+        ...r.verify.backend ? { backend: r.verify.backend } : {},
+        ...r.verify.image ? { image: r.verify.image } : {}
       }
     } : {}
   };
@@ -8162,11 +8191,11 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash10 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute10, join as join14, relative as relative5, resolve as resolve5, sep as sep2 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join15, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
@@ -8547,6 +8576,420 @@ function dependencyEnvironmentSummary(descriptor) {
   return "attested " + kinds + " (sha256 " + (descriptor.fingerprint?.slice(0, 12) ?? "unknown") + "...)";
 }
 
+// src/verifier-backend.ts
+import { createHash as createHash9, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync5 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname6, join as join14, resolve as resolve5 } from "node:path";
+var DIGEST_IMAGE = /^(?!-)[^\s@]+@sha256:[0-9a-f]{64}$/i;
+var DEFAULT_DOCKER_HOST = "unix:///var/run/docker.sock";
+function identity() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const groups = typeof process.getgroups === "function" ? process.getgroups() : [];
+  return { uid, groups };
+}
+function writableByCaller(path) {
+  try {
+    const st = statSync5(path);
+    const { uid, groups } = identity();
+    if (uid === 0) return true;
+    if ((st.mode & 2) !== 0) return true;
+    if (uid !== null && st.uid === uid && (st.mode & 128) !== 0) return true;
+    if (groups.includes(st.gid) && (st.mode & 16) !== 0) return true;
+    return false;
+  } catch {
+    return true;
+  }
+}
+function replaceableByCaller(path) {
+  let current = resolve5(path);
+  if (writableByCaller(current)) return true;
+  current = dirname6(current);
+  while (true) {
+    if (writableByCaller(current)) return true;
+    const parent = dirname6(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return false;
+}
+function findExecutable(name) {
+  for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
+    if (!raw) continue;
+    const candidate = join14(raw, name);
+    try {
+      accessSync(candidate, constants2.X_OK);
+      return realpathSync4(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function fileSha256(path) {
+  return createHash9("sha256").update(readFileSync14(path)).digest("hex");
+}
+function engineClientEnv() {
+  return {
+    PATH: "/usr/bin:/bin",
+    HOME: "/nonexistent",
+    LANG: "C",
+    LC_ALL: "C"
+  };
+}
+function dockerArgs(host, args) {
+  return ["--host", host, ...args];
+}
+function dockerAvailable(enginePath, host) {
+  try {
+    const r = spawnSync(enginePath, dockerArgs(host, ["version"]), {
+      stdio: "ignore",
+      timeout: 5e3,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+function declaredImageVolumePaths(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    throw new Error("image metadata must be a Docker image-inspect object");
+  }
+  const config = metadata.Config;
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("image metadata Config must be an object");
+  }
+  const volumes = config.Volumes;
+  if (volumes === void 0 || volumes === null) return [];
+  if (typeof volumes !== "object" || Array.isArray(volumes)) {
+    throw new Error("image metadata Config.Volumes must be a mapping or null");
+  }
+  return Object.keys(volumes).sort();
+}
+function inspectImageMetadata(enginePath, host, image) {
+  try {
+    const r = spawnSync(enginePath, dockerArgs(host, ["image", "inspect", image]), {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e4,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+    if (r.error || r.status !== 0) {
+      return {
+        metadata: null,
+        reason: "the digest-pinned verifier image is not present locally; TamperWard refuses to pull during adjudication"
+      };
+    }
+    const parsed = JSON.parse(r.stdout ?? "");
+    if (!Array.isArray(parsed) || parsed.length !== 1) {
+      return { metadata: null, reason: "Docker returned malformed verifier image metadata" };
+    }
+    return { metadata: parsed[0] };
+  } catch {
+    return { metadata: null, reason: "Docker returned unreadable verifier image metadata" };
+  }
+}
+function engineStable(backend) {
+  if (!backend.enginePath || !backend.engineSha256) return false;
+  try {
+    if (realpathSync4(backend.enginePath) !== backend.enginePath) return false;
+    if (replaceableByCaller(backend.enginePath)) return false;
+    return fileSha256(backend.enginePath) === backend.engineSha256;
+  } catch {
+    return false;
+  }
+}
+function prepareVerifierBackend(verify) {
+  const kind = verify?.backend ?? "local";
+  if (kind === "local") {
+    return { kind: "local", trust: "checkpointed-local", available: true };
+  }
+  const image = verify?.image;
+  if (!image || !DIGEST_IMAGE.test(image)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      ...image ? { image } : {},
+      reason: "container verifier requires an immutable runtime-safe image reference name@sha256:<64 hex>"
+    };
+  }
+  const forced = process.env.TAMPERWARD_CONTAINER_ENGINE;
+  if (forced && forced !== "docker") {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      reason: `unsupported isolated verifier engine ${JSON.stringify(forced)}; Docker is the tested backend`
+    };
+  }
+  const enginePath = findExecutable("docker");
+  if (!enginePath) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      reason: "Docker executable was not found on the operator PATH"
+    };
+  }
+  if (replaceableByCaller(enginePath)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      reason: "Docker engine executable is writable/replaceable by the caller identity; it cannot be verifier authority"
+    };
+  }
+  const daemonHost = DEFAULT_DOCKER_HOST;
+  if (!dockerAvailable(enginePath, daemonHost)) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `Docker is unavailable at the fixed verifier endpoint ${daemonHost}`
+    };
+  }
+  const inspectedImage = inspectImageMetadata(enginePath, daemonHost, image);
+  if (!inspectedImage.metadata) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: inspectedImage.reason ?? "Docker could not attest the verifier image metadata"
+    };
+  }
+  let declaredVolumes;
+  try {
+    declaredVolumes = declaredImageVolumePaths(inspectedImage.metadata);
+  } catch (e) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `Docker verifier image metadata is invalid: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (declaredVolumes.length > 0) {
+    return {
+      kind: "container",
+      trust: "isolated-container",
+      available: false,
+      image,
+      engine: "docker",
+      enginePath,
+      daemonHost,
+      reason: `the verifier image declares writable Docker VOLUME path(s): ${declaredVolumes.join(", ")}; --read-only does not make image-declared volumes immutable`
+    };
+  }
+  return {
+    kind: "container",
+    trust: "isolated-container",
+    available: true,
+    image,
+    engine: "docker",
+    enginePath,
+    engineSha256: fileSha256(enginePath),
+    daemonHost
+  };
+}
+function verifierBackendReport(backend) {
+  return {
+    kind: backend.kind,
+    trust: backend.trust,
+    available: backend.available,
+    ...backend.image ? { image: backend.image } : {},
+    ...backend.engine ? { engine: backend.engine } : {},
+    ...backend.reason ? { reason: backend.reason } : {}
+  };
+}
+function verifierBackendSummary(backend) {
+  if (backend.kind === "local") {
+    return "local (checkpointed same-host; weaker trust boundary)";
+  }
+  const identity2 = backend.image ?? "<missing image>";
+  if (!backend.available) {
+    return `container (isolated; unavailable: ${backend.reason ?? "unknown reason"}; image ${identity2})`;
+  }
+  return `container (isolated via Docker; image ${identity2})`;
+}
+function cleanupContainer(backend, name) {
+  if (!backend.enginePath || !backend.daemonHost || !engineStable(backend)) return;
+  try {
+    spawnSync(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
+      stdio: "ignore",
+      timeout: 1e4,
+      killSignal: "SIGKILL",
+      env: engineClientEnv()
+    });
+  } catch {
+  }
+}
+function containerRunArgs(input) {
+  return [
+    "run",
+    "--name",
+    input.name,
+    // Keep the stopped container until the trusted host has inspected .State.
+    // Docker CLI exit codes overlap candidate exit codes; container metadata is
+    // the authority that tells us whether the suite actually ran.
+    "--pull",
+    "never",
+    "--network",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--pids-limit",
+    "256",
+    "--user",
+    `${input.uid}:${input.gid}`,
+    // Frozen candidate/pristine input is immutable in the verifier. A suite
+    // needing outputs writes to /workspace-out, HOME or /tmp instead.
+    "--mount",
+    `type=bind,src=${input.workspace},dst=/workspace,ro`,
+    "--tmpfs",
+    "/tmp:rw,nosuid,nodev,mode=1777",
+    "--tmpfs",
+    `/home/tamperward:rw,nosuid,nodev,mode=700,uid=${input.uid},gid=${input.gid}`,
+    "--tmpfs",
+    `/workspace-out:rw,nosuid,nodev,mode=700,uid=${input.uid},gid=${input.gid}`,
+    "--workdir",
+    "/workspace",
+    "--env",
+    "HOME=/home/tamperward",
+    "--env",
+    "TMPDIR=/tmp",
+    "--env",
+    "CI=1",
+    "--env",
+    "TAMPERWARD_OUTPUT_DIR=/workspace-out",
+    "--env",
+    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    // The image supplies immutable runtime/dependencies, not command policy.
+    // Docker otherwise appends our command to an image ENTRYPOINT.
+    "--entrypoint",
+    "/bin/sh",
+    input.image,
+    "-c",
+    input.command
+  ];
+}
+function runContainerStage(backend, dir, command, budgetSecs) {
+  const t0 = Date.now();
+  if (backend.kind !== "container" || !backend.available || !backend.image || !backend.enginePath || !backend.engineSha256 || !backend.daemonHost || !engineStable(backend)) {
+    return {
+      exit: null,
+      secs: 0,
+      failure: "backend",
+      reason: "isolated verifier authority is incomplete or changed before stage execution"
+    };
+  }
+  const name = `tamperward-verify-${process.pid}-${randomUUID().slice(0, 12)}`;
+  const uid = typeof process.getuid === "function" ? process.getuid() : 65534;
+  const gid = typeof process.getgid === "function" ? process.getgid() : 65534;
+  const args = containerRunArgs({
+    image: backend.image,
+    name,
+    workspace: resolve5(dir),
+    command,
+    uid,
+    gid
+  });
+  try {
+    const r = spawnSync(
+      backend.enginePath,
+      dockerArgs(backend.daemonHost, args),
+      {
+        stdio: "ignore",
+        timeout: budgetSecs * 1e3,
+        killSignal: "SIGKILL",
+        env: engineClientEnv()
+      }
+    );
+    const secs = Math.round((Date.now() - t0) / 1e3);
+    if (r.error) {
+      cleanupContainer(backend, name);
+      const code = r.error.code;
+      return code === "ETIMEDOUT" ? { exit: null, secs, failure: "budget", reason: "verifier stage exceeded its budget" } : { exit: null, secs, failure: "backend", reason: `Docker client failed: ${r.error.message}` };
+    }
+    if (r.status === null) {
+      cleanupContainer(backend, name);
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`
+      };
+    }
+    if (!engineStable(backend)) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: "Docker engine identity changed before verifier result inspection"
+      };
+    }
+    const inspected = spawnSync(
+      backend.enginePath,
+      dockerArgs(backend.daemonHost, ["inspect", "--format", "{{json .State}}", name]),
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 1e4,
+        killSignal: "SIGKILL",
+        env: engineClientEnv()
+      }
+    );
+    let state = null;
+    if (!inspected.error && inspected.status === 0) {
+      try {
+        state = JSON.parse((inspected.stdout ?? "").trim());
+      } catch {
+        state = null;
+      }
+    }
+    cleanupContainer(backend, name);
+    if (!state || state.Status !== "exited" || typeof state.ExitCode !== "number" || state.OOMKilled || (state.Error ?? "") !== "") {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: state?.OOMKilled ? "verifier container was OOM-killed" : state?.Error ? `verifier container runtime error: ${state.Error}` : "Docker did not provide a trustworthy exited-container state"
+      };
+    }
+    return { exit: state.ExitCode, secs };
+  } catch (e) {
+    cleanupContainer(backend, name);
+    return {
+      exit: null,
+      secs: Math.round((Date.now() - t0) / 1e3),
+      failure: "backend",
+      reason: `Docker verifier execution failed: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+
 // src/cli/verify.ts
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
 var VERIFICATION_SURFACE = [
@@ -8632,11 +9075,11 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
+  const r = spawnSync2("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
 function inside2(root, path) {
-  const rel = relative5(resolve5(root), resolve5(path));
+  const rel = relative5(resolve6(root), resolve6(path));
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute10(rel);
 }
 function linkParts(path) {
@@ -8653,7 +9096,7 @@ function rootedLinkTarget(target) {
   return isAbsolute10(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out2, root, label) {
-  if (rootedLinkTarget(target) || !inside2(root, resolve5(dirname6(out2), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve6(dirname7(out2), target))) {
     throw linkEscape(label, target);
   }
   rmSync3(out2, { force: true });
@@ -8661,7 +9104,7 @@ function safeSymlink(target, out2, root, label) {
 }
 function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative5(root, dirname6(out2)));
+  let stack = linkParts(relative5(root, dirname7(out2)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -8679,7 +9122,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "tree" ? root : dependencyRoot;
-    const current = join14(base, ...stack);
+    const current = join15(base, ...stack);
     let st;
     try {
       st = lstatSync4(current);
@@ -8705,7 +9148,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
         throw linkEscape(label, target);
       }
       stack = [];
-      pending.unshift(...linkParts(relative5(dependencyRoot, resolve5(next))));
+      pending.unshift(...linkParts(relative5(dependencyRoot, resolve6(next))));
     } else {
       pending.unshift(...linkParts(next));
     }
@@ -8715,7 +9158,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join14(current, part);
+    current = join15(current, part);
     let st;
     try {
       st = lstatSync4(current);
@@ -8731,7 +9174,7 @@ function materialize(cwd, dest, dependencyRoot) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   const links = [];
   for (const rel of listed) {
-    const src = join14(cwd, rel);
+    const src = join15(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -8739,8 +9182,8 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out2 = join14(dest, rel);
-    mkdirSync6(dirname6(out2), { recursive: true });
+    const out2 = join15(dest, rel);
+    mkdirSync6(dirname7(out2), { recursive: true });
     dropSymlink(out2);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -8756,7 +9199,7 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join14(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join15(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8785,15 +9228,15 @@ function baseEntries(base, cwd) {
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash9("sha256");
+  const h = createHash10("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join14(dest, rel);
+    const p = join15(dest, rel);
     try {
       const st = lstatSync4(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync14(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
     } catch {
       h.update("<gone>");
     }
@@ -8817,8 +9260,8 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join14(dest, e.path);
-    mkdirSync6(dirname6(out2), { recursive: true });
+    const out2 = join15(dest, e.path);
+    mkdirSync6(dirname7(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
@@ -8834,7 +9277,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join14(dest, rel), { force: true });
+    rmSync3(join15(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -8879,8 +9322,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join14(scratch, "npmrc-user");
-  const globalRc = join14(scratch, "npmrc-global");
+  const userRc = join15(scratch, "npmrc-user");
+  const globalRc = join15(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -8888,12 +9331,12 @@ function suiteEnv(scratch) {
   env.YARN_IGNORE_PATH = "1";
   return env;
 }
-function runSuite(dir, cmd, budgetSecs) {
+function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join14(tmpdir2(), "tw-verify-run-"));
-  const outFile = join14(outDir, "result.json");
+  const outDir = mkdtempSync2(join15(tmpdir2(), "tw-verify-run-"));
+  const outFile = join15(outDir, "result.json");
   try {
-    spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+    spawnSync2(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
       env: suiteEnv(outDir),
       stdio: "ignore",
@@ -8904,7 +9347,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync14(outFile, "utf8"));
+      r = JSON.parse(readFileSync15(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -8948,13 +9391,34 @@ function runVerify(opts) {
     return 2;
   }
   const budget = opts.budget ?? policy.verify?.budget ?? 300;
-  const dependencyEnvironment = opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
-  const dependencyReport = () => dependencyEnvironmentReport(dependencyEnvironment);
-  if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
+  const verifierBackend = opts.verifierBackend ?? prepareVerifierBackend(policy.verify);
+  const backendReport = () => verifierBackendReport(verifierBackend);
+  if (!verifierBackend.available) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_UNAVAILABLE",
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend is unavailable \u2014 failing closed");
+      out2("verify: " + (verifierBackend.reason ?? "unknown backend failure"));
+    }
+    return 2;
+  }
+  const isolated = verifierBackend.kind === "container";
+  const dependencyEnvironment = isolated ? null : opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
+  const dependencyReport = () => dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : {
+    status: "verifier-owned",
+    roots: [],
+    image: verifierBackend.image
+  };
+  if (dependencyEnvironment?.status === "unattestable" && !opts.allowDepDrift) {
     if (opts.json) {
       out2(JSON.stringify({
         verdict: "CANNOT_VERIFY",
         reason: "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
+        verifier_backend: backendReport(),
         dependency_environment: dependencyReport()
       }));
     } else {
@@ -8963,7 +9427,9 @@ function runVerify(opts) {
     }
     return 2;
   }
-  const frozenNodeModules = dependencyEnvironment.roots.find((root) => root.kind === "node_modules")?.realPath ?? null;
+  const frozenNodeModules = dependencyEnvironment ? dependencyEnvironment.roots.find((root) => root.kind === "node_modules")?.realPath ?? null : null;
+  const checkDeps = () => dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
+  const runStage = (dir) => isolated ? runContainerStage(verifierBackend, dir, cmd, budget) : runLocalSuite(dir, cmd, budget);
   let base;
   try {
     base = resolveBase(opts.base ?? "HEAD", cwd);
@@ -8971,15 +9437,15 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join14(visRoot, "t");
+  const visRoot = mkdtempSync2(join15(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join15(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
   };
   const protectedIgnored = (rel) => isProtected(rel, policy);
   const treeBefore = treeFingerprint(cwd, protectedIgnored);
-  const dependencyAtEntry = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const dependencyAtEntry = checkDeps();
   if (!dependencyAtEntry.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
     out2("verify: the frozen dependency environment changed before the visible suite ran \u2014");
@@ -8994,22 +9460,38 @@ function runVerify(opts) {
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
-  const visible = runSuite(visDir, cmd, budget);
+  const visible = runStage(visDir);
+  if (visible.failure === "backend") {
+    cleanup([visRoot]);
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        stage: "visible",
+        detail: visible.reason,
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend failed while running the visible stage \u2014 failing closed");
+      if (visible.reason) out2("verify: " + visible.reason);
+    }
+    return 2;
+  }
   if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
     out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
     out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
     return 2;
   }
-  const dependencyAfterVisible = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const dependencyAfterVisible = checkDeps();
   if (!dependencyAfterVisible.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
     out2("verify: the frozen dependency environment changed while the visible suite was running \u2014");
     out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join14(priRoot, "t");
+  const priRoot = mkdtempSync2(join15(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join15(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -9029,10 +9511,26 @@ function runVerify(opts) {
     return 2;
   }
   const overlayBefore = overlayDigest(priDir, restored);
-  const pristine = runSuite(priDir, cmd, budget);
+  const pristine = runStage(priDir);
+  if (pristine.failure === "backend") {
+    cleanup([visRoot, priRoot]);
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        stage: "pristine",
+        detail: pristine.reason,
+        verifier_backend: backendReport()
+      }));
+    } else {
+      out2("verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed");
+      if (pristine.reason) out2("verify: " + pristine.reason);
+    }
+    return 2;
+  }
   const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
   const treeMoved = treeFingerprint(cwd, protectedIgnored) !== treeBefore;
-  const dependencyAfterPristine = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const dependencyAfterPristine = checkDeps();
   const depsMoved = !dependencyAfterPristine.ok && !opts.allowDepDrift;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
@@ -9072,6 +9570,7 @@ function runVerify(opts) {
         pristine: { exit: pristine.exit, secs: pristine.secs },
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
+        verifier_backend: backendReport(),
         dependency_environment: dependencyReport(),
         ...signedOff ? { oob_signoff: signedOff } : {},
         ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
@@ -9085,7 +9584,10 @@ function runVerify(opts) {
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
     out2(`tamperward verify \u2014 ${lines[verdict2]}`);
-    out2(`dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : ""));
+    out2(`verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+    out2(
+      dependencyEnvironment ? `dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : "") : `dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`
+    );
     if (signedOff)
       out2(
         `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
@@ -9130,9 +9632,9 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync5 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
+import { readdirSync as readdirSync4, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync6 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -9140,7 +9642,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync15("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -9149,7 +9651,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync5(cwd);
+    real = realpathSync6(cwd);
   } catch {
     return out2;
   }
@@ -9163,7 +9665,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -9178,7 +9680,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     for (const link of procLinks) {
       try {
         const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
-        const held = raw.startsWith("/") ? resolve6(raw) : raw;
+        const held = raw.startsWith("/") ? resolve7(raw) : raw;
         if (held === real || held.startsWith(real + "/")) {
           holds = true;
           break;
@@ -9191,7 +9693,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve6(opts.cwd ?? process.cwd());
+  const cwd = resolve7(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -9227,18 +9729,37 @@ function runEnvelope(opts) {
       return 2;
     }
   }
-  const dependencyEnvironment = discoverDependencyEnvironment(cwd, frozenCmd);
+  const verifierBackend = prepareVerifierBackend(frozenPolicy.verify);
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
-  out(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
-  if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
-    err("tamperward run: the verifier dependency environment cannot be attested \u2014");
-    err(`${dependencyEnvironment.reason ?? "unknown dependency environment"}. Failing closed before the agent starts.`);
-    err("(Pass --allow-dep-drift only if you explicitly own this dependency-integrity risk.)");
+  out(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+  if (!verifierBackend.available) {
+    err("tamperward run: the requested verifier backend cannot be established \u2014");
+    err(`${verifierBackend.reason ?? "unknown backend failure"}. Failing closed before the agent starts.`);
+    return 2;
+  }
+  if (verifierBackend.kind === "container") {
+    err("tamperward run: container verification requires a frozen candidate handoff from an");
+    err("agent domain that cannot control the verifier engine. `run` executes the agent under");
+    err("this host identity, so it cannot honestly provide that separation. Failing closed");
+    err("before the agent starts; use standalone `tamperward verify` in trusted CI or after");
+    err("an externally isolated agent produces the frozen candidate artifact.");
     return 2;
   }
+  const dependencyEnvironment = verifierBackend.kind === "local" ? discoverDependencyEnvironment(cwd, frozenCmd) : null;
+  if (dependencyEnvironment) {
+    out(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
+    if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
+      err("tamperward run: the verifier dependency environment cannot be attested \u2014");
+      err(`${dependencyEnvironment.reason ?? "unknown dependency environment"}. Failing closed before the agent starts.`);
+      err("(Pass --allow-dep-drift only if you explicitly own this dependency-integrity risk.)");
+      return 2;
+    }
+  } else {
+    out(`tamperward run \u2014 dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`);
+  }
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
-  const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
+  const agent = spawnSync3(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
   if (objectRewriteState(cwd) !== rewritesBefore) {
     err("tamperward run: git object-replacement state changed during this run \u2014 a replace ref, graft");
@@ -9248,7 +9769,7 @@ function runEnvelope(opts) {
 tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
     return 1;
   }
-  const dependencyBeforeAdjudication = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const dependencyBeforeAdjudication = dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
   if (!dependencyBeforeAdjudication.ok) {
     err("tamperward run: the frozen dependency environment changed before adjudication began \u2014");
     err(`${dependencyBeforeAdjudication.reason ?? "dependency identity changed"}.`);
@@ -9260,7 +9781,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     err("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
   }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
+  const isAncestor = spawnSync3("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err("the agent rewrote history out from under the anchor. That is the finding.");
@@ -9285,8 +9806,9 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     cmd: frozenCmd,
     budget: frozenBudget,
     policyOverride: frozenPolicy,
-    dependencyEnvironment,
-    allowDepDrift: opts.allowDepDrift
+    ...dependencyEnvironment ? { dependencyEnvironment } : {},
+    allowDepDrift: opts.allowDepDrift,
+    verifierBackend
   });
   if (opts.settle && opts.settle > 0) {
     try {
@@ -9299,8 +9821,8 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err("tamperward run: the working tree changed while it was being adjudicated \u2014");
     err("the verdict below would describe a tree that no longer exists.");
   }
-  const dependencyAfter = checkDependencyEnvironment(cwd, dependencyEnvironment);
-  const depsDrifted = !opts.allowDepDrift && !dependencyAfter.ok;
+  const dependencyAfter = dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
+  const depsDrifted = Boolean(dependencyEnvironment) && !opts.allowDepDrift && !dependencyAfter.ok;
   if (depsDrifted) {
     err("tamperward run: the frozen dependency environment changed during this run \u2014");
     err(`${dependencyAfter.reason ?? "dependency identity changed"}. Both verification runs depend on it.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.9",
+  "version": "2.11.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",