tamperward 2.11.0 → 2.11.2

package/README.md

@@ -210,8 +210,11 @@ pinned Tamperward version, and label permissions restricted to trusted humans.
 The default local verifier is checkpointed same-host execution, not OS isolation.
 An optional digest-pinned container backend isolates final verification with no network,
 host dependency tree, HOME, temp, credential or socket sharing. Tamperward still is not a
-semantic-correctness oracle, and `tamperward run` does not pretend that a same-identity
-host agent is isolated from the Docker daemon.
+semantic-correctness oracle: verifier output reports `oracle_assurance: suite-exit-only`
+because candidate source still executes inside the configured suite process and can
+terminate or interpose on that in-process oracle. `isolated-container` therefore means
+execution-domain isolation, not semantic/oracle isolation. `tamperward run` also does
+not pretend that a same-identity host agent is isolated from the Docker daemon.
 
 Full assumptions and residual risks: [SPEC.md](./SPEC.md),
 [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md), and the
@@ -259,7 +262,14 @@ verify:
 local Docker daemon; Tamperward never pulls during adjudication. The materialised
 candidate/pristine tree is mounted read-only, the image owns runtime/dependencies,
 network is disabled, HOME/tmp are private, and optional suite output belongs in
-`$TAMPERWARD_OUTPUT_DIR` (`/workspace-out`). Images that declare Dockerfile
+`$TAMPERWARD_OUTPUT_DIR` (`/workspace-out`). The isolated verifier also applies a
+fixed host-protection envelope: **2 GiB memory, no additional swap, 2 CPUs and 256
+PIDs**, in addition to the configured wall-clock budget. Those limits are included in
+the JSON backend report. Docker-confirmed memory OOM is `CANNOT_VERIFY` with
+`VERIFIER_RESOURCE_EXHAUSTED`, never a suite failure; an exit such as 137 without
+`OOMKilled=true` remains the suite's own exit. v2.11.2 deliberately has no environment
+variable tuning knob for these ceilings because candidate-controlled CI/env must not
+weaken verifier containment. Images that declare Dockerfile
 `VOLUME` paths are refused: Docker mounts those paths writable even with
 `--read-only`, which would undermine the immutable verifier-image boundary. Image
 `ENTRYPOINT` is also overridden; the pinned image supplies the runtime/dependencies,

package/dist/cli/index.js

@@ -8581,6 +8581,13 @@ import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync5 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join14, resolve as resolve5 } from "node:path";
+var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
+  memoryBytes: 2 * 1024 * 1024 * 1024,
+  // Docker interprets memory-swap == memory as no additional swap allowance.
+  memorySwapBytes: 2 * 1024 * 1024 * 1024,
+  cpus: 2,
+  pids: 256
+});
 var DIGEST_IMAGE = /^(?!-)[^\s@]+@sha256:[0-9a-f]{64}$/i;
 var DEFAULT_DOCKER_HOST = "unix:///var/run/docker.sock";
 function identity() {
@@ -8808,7 +8815,8 @@ function prepareVerifierBackend(verify) {
     engine: "docker",
     enginePath,
     engineSha256: fileSha256(enginePath),
-    daemonHost
+    daemonHost,
+    resources: { ...DEFAULT_CONTAINER_RESOURCE_LIMITS }
   };
 }
 function verifierBackendReport(backend) {
@@ -8818,6 +8826,14 @@ function verifierBackendReport(backend) {
     available: backend.available,
     ...backend.image ? { image: backend.image } : {},
     ...backend.engine ? { engine: backend.engine } : {},
+    ...backend.kind === "container" ? {
+      resources: {
+        memory_bytes: (backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS).memoryBytes,
+        memory_swap_bytes: (backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS).memorySwapBytes,
+        cpus: (backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS).cpus,
+        pids: (backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS).pids
+      }
+    } : {},
     ...backend.reason ? { reason: backend.reason } : {}
   };
 }
@@ -8829,7 +8845,8 @@ function verifierBackendSummary(backend) {
   if (!backend.available) {
     return `container (isolated; unavailable: ${backend.reason ?? "unknown reason"}; image ${identity2})`;
   }
-  return `container (isolated via Docker; image ${identity2})`;
+  const resources = backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS;
+  return `container (isolated via Docker; image ${identity2}; ${Math.round(resources.memoryBytes / (1024 * 1024))} MiB memory, no extra swap, ${resources.cpus} CPUs, ${resources.pids} PIDs)`;
 }
 function cleanupContainer(backend, name) {
   if (!backend.enginePath || !backend.daemonHost || !engineStable(backend)) return;
@@ -8844,6 +8861,7 @@ function cleanupContainer(backend, name) {
   }
 }
 function containerRunArgs(input) {
+  const resources = input.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS;
   return [
     "run",
     "--name",
@@ -8860,8 +8878,14 @@ function containerRunArgs(input) {
     "ALL",
     "--security-opt",
     "no-new-privileges",
+    "--memory",
+    String(resources.memoryBytes),
+    "--memory-swap",
+    String(resources.memorySwapBytes),
+    "--cpus",
+    String(resources.cpus),
     "--pids-limit",
-    "256",
+    String(resources.pids),
     "--user",
     `${input.uid}:${input.gid}`,
     // Frozen candidate/pristine input is immutable in the verifier. A suite
@@ -8895,6 +8919,26 @@ function containerRunArgs(input) {
     input.command
   ];
 }
+function containerStateResult(state, secs) {
+  if (state?.OOMKilled) {
+    return {
+      exit: null,
+      secs,
+      failure: "resource",
+      resource: "memory",
+      reason: "verifier container exceeded its memory limit and was OOM-killed"
+    };
+  }
+  if (!state || state.Status !== "exited" || typeof state.ExitCode !== "number" || (state.Error ?? "") !== "") {
+    return {
+      exit: null,
+      secs,
+      failure: "backend",
+      reason: state?.Error ? `verifier container runtime error: ${state.Error}` : "Docker did not provide a trustworthy exited-container state"
+    };
+  }
+  return { exit: state.ExitCode, secs };
+}
 function runContainerStage(backend, dir, command, budgetSecs) {
   const t0 = Date.now();
   if (backend.kind !== "container" || !backend.available || !backend.image || !backend.enginePath || !backend.engineSha256 || !backend.daemonHost || !engineStable(backend)) {
@@ -8914,7 +8958,8 @@ function runContainerStage(backend, dir, command, budgetSecs) {
     workspace: resolve5(dir),
     command,
     uid,
-    gid
+    gid,
+    resources: backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS
   });
   try {
     const r = spawnSync(
@@ -8970,15 +9015,7 @@ function runContainerStage(backend, dir, command, budgetSecs) {
       }
     }
     cleanupContainer(backend, name);
-    if (!state || state.Status !== "exited" || typeof state.ExitCode !== "number" || state.OOMKilled || (state.Error ?? "") !== "") {
-      return {
-        exit: null,
-        secs,
-        failure: "backend",
-        reason: state?.OOMKilled ? "verifier container was OOM-killed" : state?.Error ? `verifier container runtime error: ${state.Error}` : "Docker did not provide a trustworthy exited-container state"
-      };
-    }
-    return { exit: state.ExitCode, secs };
+    return containerStateResult(state, secs);
   } catch (e) {
     cleanupContainer(backend, name);
     return {
@@ -8991,6 +9028,14 @@ function runContainerStage(backend, dir, command, budgetSecs) {
 }
 
 // src/cli/verify.ts
+function oracleAssuranceReport() {
+  return {
+    level: "suite-exit-only",
+    semantic_isolation: false,
+    candidate_code_executes_in_oracle_process: true,
+    limitation: "candidate source executes inside the configured suite process and may terminate or interpose on that in-process oracle; isolated-container is execution-domain isolation, not semantic/oracle isolation"
+  };
+}
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
 var VERIFICATION_SURFACE = [
   // Python / pytest — read from the rootdir, and conftest at any depth
@@ -9398,7 +9443,8 @@ function runVerify(opts) {
       out2(JSON.stringify({
         verdict: "CANNOT_VERIFY",
         reason: "VERIFIER_BACKEND_UNAVAILABLE",
-        verifier_backend: backendReport()
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2("verify: isolated verifier backend is unavailable \u2014 failing closed");
@@ -9419,7 +9465,8 @@ function runVerify(opts) {
         verdict: "CANNOT_VERIFY",
         reason: "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
         verifier_backend: backendReport(),
-        dependency_environment: dependencyReport()
+        dependency_environment: dependencyReport(),
+        oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2("verify: dependency environment is not attestable \u2014 failing closed");
@@ -9461,18 +9508,23 @@ function runVerify(opts) {
     return 2;
   }
   const visible = runStage(visDir);
-  if (visible.failure === "backend") {
+  if (visible.failure === "backend" || visible.failure === "resource") {
     cleanup([visRoot]);
+    const exhausted = visible.failure === "resource";
     if (opts.json) {
       out2(JSON.stringify({
         verdict: "CANNOT_VERIFY",
-        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        reason: exhausted ? "VERIFIER_RESOURCE_EXHAUSTED" : "VERIFIER_BACKEND_RUNTIME_FAILURE",
         stage: "visible",
+        ...visible.resource ? { resource: visible.resource } : {},
         detail: visible.reason,
-        verifier_backend: backendReport()
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
       }));
     } else {
-      out2("verify: isolated verifier backend failed while running the visible stage \u2014 failing closed");
+      out2(
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the visible stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the visible stage \u2014 failing closed"
+      );
       if (visible.reason) out2("verify: " + visible.reason);
     }
     return 2;
@@ -9512,18 +9564,23 @@ function runVerify(opts) {
   }
   const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runStage(priDir);
-  if (pristine.failure === "backend") {
+  if (pristine.failure === "backend" || pristine.failure === "resource") {
     cleanup([visRoot, priRoot]);
+    const exhausted = pristine.failure === "resource";
     if (opts.json) {
       out2(JSON.stringify({
         verdict: "CANNOT_VERIFY",
-        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        reason: exhausted ? "VERIFIER_RESOURCE_EXHAUSTED" : "VERIFIER_BACKEND_RUNTIME_FAILURE",
         stage: "pristine",
+        ...pristine.resource ? { resource: pristine.resource } : {},
         detail: pristine.reason,
-        verifier_backend: backendReport()
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
       }));
     } else {
-      out2("verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed");
+      out2(
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the pristine stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed"
+      );
       if (pristine.reason) out2("verify: " + pristine.reason);
     }
     return 2;
@@ -9572,6 +9629,7 @@ function runVerify(opts) {
         added_protected_removed: removedAdded,
         verifier_backend: backendReport(),
         dependency_environment: dependencyReport(),
+        oracle_assurance: oracleAssuranceReport(),
         ...signedOff ? { oob_signoff: signedOff } : {},
         ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
@@ -9585,6 +9643,9 @@ function runVerify(opts) {
     };
     out2(`tamperward verify \u2014 ${lines[verdict2]}`);
     out2(`verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+    out2(
+      "oracle assurance: suite-exit-only (candidate source executes inside the suite process; execution-domain isolation is not semantic/oracle isolation)"
+    );
     out2(
       dependencyEnvironment ? `dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : "") : `dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.11.0",
+  "version": "2.11.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",