tamperward 2.15.0 → 2.15.1

package/README.md

@@ -229,10 +229,19 @@ Since **2.15.0**, `tamperward doctor` is also the one-shot installation/posture
 report promised by `init`'s security model. It reuses `init`'s canonical wiring
 planner rather than maintaining a second definition of “installed correctly”, and
 reports named `OK`, `WARN`, or `BROKEN` checks for policy/schema, Claude hooks,
-pre-commit, generated CI wiring, CODEOWNERS, workflow permissions, binary/pin
+pre-commit, CI authority wiring, CODEOWNERS, workflow permissions, binary/pin
 alignment, verifier trust mode + declared inputs, platform residuals, CI verifier
 outer time, observer health, and (with `--github`) repository authority. Use
 `--json` for one machine-readable document with `authoritative: true|false`.
+
+**2.15.1 closes an authority-reporting gap in that surface.** The permission check now
+includes job-level overrides, not only workflow-root permissions; a policy schema newer
+than the running binary is BROKEN rather than certifiable; and the exact workflow(s)
+selected by `--workflow` or discovered as verifier authorities are also the workflow(s)
+used for CI-wiring and token-permission posture. A custom verifier workflow therefore
+does not get judged against an unrelated/missing generated file, and a second verifier
+workflow with a write-scoped job cannot hide behind a safe canonical workflow.
+
 Local early-layer gaps remain posture findings rather than silently changing the
 existing generated-CI exit contract; hard CI/GitHub validation failures still exit 2.
 

package/dist/cli/index.js

@@ -8416,52 +8416,90 @@ function pinsInFile(path) {
   }
   return Array.from(src.matchAll(/\btamperward@((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))\b/g), (m) => m[1]);
 }
-function workflowPermissionCheck(cwd) {
-  const rel = ".github/workflows/tamperward.yml";
-  const path = join13(cwd, rel);
-  if (!existsSync10(path)) return { id: "workflow-permissions", state: "BROKEN", detail: `${rel} is missing` };
-  let doc;
-  try {
-    doc = parse3(readFileSync13(path, "utf8"));
-  } catch (e) {
-    return {
-      id: "workflow-permissions",
-      state: "BROKEN",
-      detail: `${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`
-    };
+function permissionWrites(value) {
+  if (typeof value === "string") {
+    if (/write/i.test(value)) return [value];
+    if (/^(?:read-all|none)$/i.test(value)) return [];
+    return null;
   }
-  const root = asMapping(doc);
-  const permissions = asMapping(root?.permissions);
-  if (!permissions) {
-    return {
-      id: "workflow-permissions",
-      state: "BROKEN",
-      detail: "workflow does not declare least-privilege permissions; repository defaults could grant write access"
-    };
+  const mapping = asMapping(value);
+  if (!mapping) return null;
+  return Object.entries(mapping).filter(([, permission]) => typeof permission === "string" && /write/i.test(permission)).map(([name, permission]) => `${name}=${String(permission)}`);
+}
+function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperward.yml"]) {
+  const broken = [];
+  const warnings = [];
+  for (const rel of workflowRels) {
+    const path = resolve4(cwd, rel);
+    if (!existsSync10(path)) {
+      broken.push(`${rel} is missing`);
+      continue;
+    }
+    let doc;
+    try {
+      doc = parse3(readFileSync13(path, "utf8"));
+    } catch (e) {
+      broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
+      continue;
+    }
+    const root = asMapping(doc);
+    if (!root) {
+      broken.push(`${rel} is not a YAML mapping`);
+      continue;
+    }
+    const rootPermissions = root.permissions;
+    if (rootPermissions === void 0) {
+      broken.push(`${rel}: workflow does not declare least-privilege permissions; repository defaults could grant write access`);
+    } else {
+      const writes = permissionWrites(rootPermissions);
+      if (writes === null) {
+        broken.push(`${rel}: workflow permissions shape is unsupported`);
+      } else if (writes.length) {
+        broken.push(`${rel}: workflow grants write permission: ${writes.join(", ")}`);
+      } else {
+        const mapping = asMapping(rootPermissions);
+        if (mapping && mapping.contents !== "read") {
+          warnings.push(`${rel}: workflow permissions contain no writes but contents: read is not declared`);
+        }
+      }
+    }
+    const jobs = asMapping(root.jobs);
+    if (!jobs) continue;
+    for (const [name, rawJob] of Object.entries(jobs)) {
+      const job = asMapping(rawJob);
+      if (!job || job.permissions === void 0) continue;
+      const writes = permissionWrites(job.permissions);
+      if (writes === null) {
+        broken.push(`${rel} job "${name}": permissions shape is unsupported`);
+      } else if (writes.length) {
+        broken.push(`${rel} job "${name}" grants write permission: ${writes.join(", ")}`);
+      }
+    }
   }
-  const writes = Object.entries(permissions).filter(
-    ([, value]) => typeof value === "string" && /write/i.test(value)
-  );
-  if (writes.length) {
+  if (broken.length) {
     return {
       id: "workflow-permissions",
       state: "BROKEN",
-      detail: "workflow grants write permission: " + writes.map(([name]) => name).join(", ")
+      detail: broken.join("; ")
     };
   }
-  if (permissions.contents !== "read") {
+  if (warnings.length) {
     return {
       id: "workflow-permissions",
       state: "WARN",
-      detail: "workflow permissions are explicit but contents: read is not declared"
+      detail: warnings.join("; ")
     };
   }
-  return { id: "workflow-permissions", state: "OK", detail: "workflow token is explicitly read-only (contents: read)" };
+  return {
+    id: "workflow-permissions",
+    state: "OK",
+    detail: `${workflowRels.join(", ")}: workflow/job token permissions contain no write grants and workflow contents access is read-only`
+  };
 }
-function collectLocalPosture(cwd, policy) {
+function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow = false) {
   const checks = [];
   checks.push(
-    policy.version <= POLICY_VERSION ? { id: "policy", state: "OK", detail: `policy version ${policy.version} is understood (current schema ${POLICY_VERSION})` } : { id: "policy", state: "WARN", detail: `policy version ${policy.version} is newer than this binary's schema ${POLICY_VERSION}; only known gates can be evaluated` }
+    policy.version <= POLICY_VERSION ? { id: "policy", state: "OK", detail: `policy version ${policy.version} is understood (current schema ${POLICY_VERSION})` } : { id: "policy", state: "BROKEN", detail: `policy version ${policy.version} is newer than this binary's schema ${POLICY_VERSION}; authority cannot be certified for unknown policy semantics` }
   );
   let plan = [];
   try {
@@ -8488,9 +8526,29 @@ function collectLocalPosture(cwd, policy) {
   };
   addWiring("claude-hooks", "agent", true);
   addWiring("pre-commit", "pre-commit", false);
-  addWiring("ci-wiring", "ci", true);
+  const canonicalWorkflow = ".github/workflows/tamperward.yml";
+  if (authorityWorkflows?.length) {
+    const normalized = authorityWorkflows.map((x) => x.replace(/\\/g, "/"));
+    if (explicitWorkflow) {
+      checks.push({
+        id: "ci-wiring",
+        state: "OK",
+        detail: `explicit verifier authority workflow: ${normalized.join(", ")}; verifier step/timeout validated by doctor`
+      });
+    } else if (normalized.includes(canonicalWorkflow)) {
+      addWiring("ci-wiring", "ci", true);
+    } else {
+      checks.push({
+        id: "ci-wiring",
+        state: "OK",
+        detail: `discovered verifier authority workflow(s): ${normalized.join(", ")}; verifier step/timeout validated by doctor`
+      });
+    }
+  } else {
+    addWiring("ci-wiring", "ci", true);
+  }
   addWiring("codeowners", "codeowners", true);
-  checks.push(workflowPermissionCheck(cwd));
+  checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
     ...pinsInFile(join13(cwd, ".claude", "settings.json")),
     ...pinsInFile(join13(cwd, ".git", "hooks", "pre-commit")),
@@ -8744,7 +8802,13 @@ function runDoctor(opts = {}) {
       "policy"
     );
   }
-  const fail = (id, message) => err(message, opts, id, collectLocalPosture(cwd, policy));
+  let postureWorkflows = opts.workflow ? [opts.workflow] : void 0;
+  const fail = (id, message) => err(
+    message,
+    opts,
+    id,
+    collectLocalPosture(cwd, policy, postureWorkflows, Boolean(opts.workflow))
+  );
   if (!policy.verify?.command) {
     return fail("verifier", "trusted policy has no verify.command; generated CI cannot verify this repository");
   }
@@ -8771,6 +8835,7 @@ function runDoctor(opts = {}) {
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
   let verifyJobCount = 0;
+  const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
     const workflowPath = resolve4(cwd, workflowRel);
     if (!existsSync10(workflowPath)) {
@@ -8787,6 +8852,10 @@ function runDoctor(opts = {}) {
     }
     const jobs = verifyJobs(doc);
     verifyJobCount += jobs.length;
+    if (jobs.length > 0) {
+      authorityWorkflows.push(workflowRel);
+      postureWorkflows = [...authorityWorkflows];
+    }
     for (const { name, job } of jobs) {
       const timeout = job["timeout-minutes"];
       if (timeout === void 0 || timeout === null) {
@@ -8845,7 +8914,12 @@ function runDoctor(opts = {}) {
       );
     }
   }
-  const checks = collectLocalPosture(cwd, policy);
+  const checks = collectLocalPosture(
+    cwd,
+    policy,
+    authorityWorkflows,
+    Boolean(opts.workflow)
+  );
   checks.push({
     id: "ci-verifier",
     state: "OK",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.15.0",
+  "version": "2.15.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",