tamperward 2.15.0 → 2.15.2

package/README.md

@@ -167,6 +167,19 @@ observer down deterministically. Observer health remains advisory; transient fin
 remain warnings by default and affect the envelope only when the operator explicitly
 sets `TAMPERWARD_TRANSIENT=block`.
 
+Since **2.15.2**, Stop-sweep event consumption uses the saved cursor as a real byte
+offset: it performs positioned reads of only new JSONL bytes instead of decoding the
+whole historical log on every turn. Each physical read is capped at **4 MiB**, and one
+authority decision drains at most **16 MiB** in bounded chunks. Only complete
+newline-terminated records advance the cursor, so a torn final watcher write is replayed
+after completion instead of being lost. Stop commits the cursor only after the entire
+bounded telemetry tail has been parsed and classified; malformed records, an oversized
+single record, a torn tail, or telemetry beyond the 16 MiB aggregate ceiling blocks Stop
+and retains the previous cursor rather than certifying unjudged bytes. Supervised
+`run --observe-transients` keeps observer evidence advisory by default, but when
+`TAMPERWARD_TRANSIENT=block` is explicitly enabled, any unclassified observer tail
+also fails the envelope closed.
+
 After the runtime exits its exit code is treated as untrusted, and the envelope
 checks that post-agent `HEAD` still descends from the entry commit; the committed
 changes over `entry...HEAD`; staged, unstaged and untracked non-ignored worktree
@@ -229,10 +242,19 @@ Since **2.15.0**, `tamperward doctor` is also the one-shot installation/posture
 report promised by `init`'s security model. It reuses `init`'s canonical wiring
 planner rather than maintaining a second definition of “installed correctly”, and
 reports named `OK`, `WARN`, or `BROKEN` checks for policy/schema, Claude hooks,
-pre-commit, generated CI wiring, CODEOWNERS, workflow permissions, binary/pin
+pre-commit, CI authority wiring, CODEOWNERS, workflow permissions, binary/pin
 alignment, verifier trust mode + declared inputs, platform residuals, CI verifier
 outer time, observer health, and (with `--github`) repository authority. Use
 `--json` for one machine-readable document with `authoritative: true|false`.
+
+**2.15.1 closes an authority-reporting gap in that surface.** The permission check now
+includes job-level overrides, not only workflow-root permissions; a policy schema newer
+than the running binary is BROKEN rather than certifiable; and the exact workflow(s)
+selected by `--workflow` or discovered as verifier authorities are also the workflow(s)
+used for CI-wiring and token-permission posture. A custom verifier workflow therefore
+does not get judged against an unrelated/missing generated file, and a second verifier
+workflow with a write-scoped job cannot hide behind a safe canonical workflow.
+
 Local early-layer gaps remain posture findings rather than silently changing the
 existing generated-CI exit contract; hard CI/GitHub validation failures still exit 2.
 

package/dist/cli/index.js

@@ -6829,7 +6829,7 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
@@ -7253,26 +7253,200 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
 var RULE11 = "transient-protected-mutation";
-function readEvents(log, offset) {
+var MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
+var MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
+var DEFAULT_EVENT_READ_IO = {
+  read: (fd, buffer, bufferOffset, length, position) => readSync2(fd, buffer, bufferOffset, length, position)
+};
+function readEvents(log, offset, maxBytes = MAX_EVENT_READ_BYTES, io = DEFAULT_EVENT_READ_IO) {
   let size = 0;
   try {
     size = statSync(log).size;
   } catch {
-    return { events: [], newOffset: offset };
+    return {
+      events: [],
+      newOffset: Math.max(0, Number.isFinite(offset) ? Math.floor(offset) : 0),
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  let start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  if (start > size) start = 0;
+  if (size <= start) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  const cap = Number.isFinite(maxBytes) && maxBytes > 0 ? Math.max(1, Math.floor(maxBytes)) : MAX_EVENT_READ_BYTES;
+  const available = size - start;
+  const requested = Math.min(available, cap);
+  const buffer = Buffer.allocUnsafe(requested);
+  const fd = openSync2(log, "r");
+  let bytesRead = 0;
+  try {
+    bytesRead = io.read(fd, buffer, 0, requested, start);
+  } finally {
+    closeSync2(fd);
+  }
+  if (bytesRead <= 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: available > 0,
+      malformedLines: 0,
+      incompleteTail: available > 0
+    };
+  }
+  const chunk = buffer.subarray(0, bytesRead);
+  const lastNewline = chunk.lastIndexOf(10);
+  const limitReached = start + bytesRead < size;
+  if (lastNewline < 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead,
+      limitReached,
+      malformedLines: 0,
+      incompleteTail: true
+    };
   }
-  if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync10(log, "utf8").slice(offset);
   const events = [];
-  for (const line of raw.split("\n")) {
+  let malformedLines = 0;
+  const complete = chunk.subarray(0, lastNewline + 1).toString("utf8");
+  for (const line of complete.split("\n")) {
     if (!line.trim()) continue;
     try {
       events.push(JSON.parse(line));
     } catch {
+      malformedLines++;
+    }
+  }
+  const newOffset = start + lastNewline + 1;
+  return {
+    events,
+    newOffset,
+    bytesRead,
+    limitReached,
+    malformedLines,
+    incompleteTail: newOffset < start + bytesRead
+  };
+}
+function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DEFAULT_EVENT_READ_IO) {
+  const start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  const aggregateCap = Number.isFinite(maxTotalBytes) && maxTotalBytes > 0 ? Math.max(1, Math.floor(maxTotalBytes)) : MAX_EVENT_SWEEP_BYTES;
+  const events = [];
+  let cursor = start;
+  let bytesRead = 0;
+  let batches = 0;
+  let malformedLines = 0;
+  while (bytesRead < aggregateCap) {
+    const remainingBudget = aggregateCap - bytesRead;
+    const batch = readEvents(
+      log,
+      cursor,
+      Math.min(MAX_EVENT_READ_BYTES, remainingBudget),
+      io
+    );
+    batches++;
+    bytesRead += batch.bytesRead;
+    malformedLines += batch.malformedLines;
+    events.push(...batch.events);
+    if (batch.malformedLines > 0) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "malformed-record"
+      };
+    }
+    if (batch.bytesRead === 0) {
+      if (batch.limitReached || batch.incompleteTail) {
+        return {
+          events,
+          newOffset: cursor,
+          bytesRead,
+          batches,
+          malformedLines,
+          complete: false,
+          issue: "read-stalled"
+        };
+      }
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (batch.limitReached && batch.newOffset === cursor) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "oversized-record"
+      };
+    }
+    if (!batch.limitReached && batch.incompleteTail) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "incomplete-record"
+      };
+    }
+    cursor = batch.newOffset;
+    if (!batch.limitReached) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (bytesRead >= aggregateCap) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "aggregate-limit"
+      };
     }
   }
-  return { events, newOffset: size };
+  return {
+    events,
+    newOffset: cursor,
+    bytesRead,
+    batches,
+    malformedLines,
+    complete: false,
+    issue: "aggregate-limit"
+  };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
   if (!isEnabled(RULE11, policy)) return [];
@@ -7316,7 +7490,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7564,6 +7738,17 @@ function cursorPath(cwd, sessionId) {
   const p = ptreePath(cwd, sessionId);
   return p ? p.replace(/ptree-/, "fscursor-") : null;
 }
+function observerIntegrityBlock(issue, bytesRead, malformedLines) {
+  const detail = issue === "malformed-record" ? `${malformedLines} malformed complete JSONL record(s)` : issue === "oversized-record" ? `one event record exceeded the ${MAX_EVENT_READ_BYTES}-byte per-record/read ceiling` : issue === "incomplete-record" ? "the event log ended with an incomplete JSONL record" : issue === "aggregate-limit" ? `more than ${MAX_EVENT_SWEEP_BYTES} observer bytes required classification in one Stop sweep` : "the positioned event-log read made no safe progress";
+  return {
+    rule: "tamperward-unavailable",
+    severity: "block",
+    message: `TamperWard could not fully classify transient observer telemetry (${detail}), so Stop is blocked rather than certifying an unjudged tail.`,
+    evidence: `observer_issue=${issue}; bytes_read=${bytesRead}; malformed_lines=${malformedLines}`,
+    remediation: "Let the watcher finish its current record or repair/rotate the malformed observer log, then retry Stop. Do not delete the cursor/log to bypass unjudged telemetry.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
+}
 function turnTransientBlocks(cwd, sessionId, policy, changes) {
   const none = { blocks: [], commit: () => {
   } };
@@ -7576,16 +7761,34 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync8(log)) return none;
   let offset = 0;
   if (cp && existsSync8(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
+    const n = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
-  const { events, newOffset } = readEvents(log, offset);
-  if (events.length === 0) return { ...none, commit: () => {
-    if (cp) try {
-      writeFileSync5(cp, String(newOffset));
-    } catch {
-    }
-  } };
+  const drained = drainEvents(log, offset);
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    recordObserverHealth(
+      "degraded",
+      `event telemetry was not fully classified (${issue}); Stop retained the prior cursor`
+    );
+    return {
+      blocks: [observerIntegrityBlock(issue, drained.bytesRead, drained.malformedLines)],
+      commit: () => {
+      }
+    };
+  }
+  const { events, newOffset } = drained;
+  if (events.length === 0) {
+    return {
+      ...none,
+      commit: () => {
+        if (cp) try {
+          writeFileSync5(cp, String(newOffset));
+        } catch {
+        }
+      }
+    };
+  }
   const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -7742,7 +7945,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 
 // src/verifier-limits.ts
@@ -7986,7 +8189,7 @@ function planClaudeHooks(cwd) {
   if (existsSync9(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -8132,7 +8335,7 @@ function planPreCommit(cwd) {
   if (existsSync9(path) && !statSync2(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync9(path) ? readFileSync11(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -8224,7 +8427,7 @@ function planCodeowners(cwd) {
     (r) => existsSync9(join12(cwd, r))
   );
   const path = join12(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const existing = existingRel ? readFileSync11(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -8273,7 +8476,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync11(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -8372,7 +8575,7 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync13, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync12, readdirSync as readdirSync3 } from "node:fs";
 import { join as join13, resolve as resolve4 } from "node:path";
 import { parse as parse3 } from "yaml";
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
@@ -8410,58 +8613,96 @@ function pinsInFile(path) {
   if (!existsSync10(path)) return [];
   let src = "";
   try {
-    src = readFileSync13(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return [];
   }
   return Array.from(src.matchAll(/\btamperward@((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))\b/g), (m) => m[1]);
 }
-function workflowPermissionCheck(cwd) {
-  const rel = ".github/workflows/tamperward.yml";
-  const path = join13(cwd, rel);
-  if (!existsSync10(path)) return { id: "workflow-permissions", state: "BROKEN", detail: `${rel} is missing` };
-  let doc;
-  try {
-    doc = parse3(readFileSync13(path, "utf8"));
-  } catch (e) {
-    return {
-      id: "workflow-permissions",
-      state: "BROKEN",
-      detail: `${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`
-    };
+function permissionWrites(value) {
+  if (typeof value === "string") {
+    if (/write/i.test(value)) return [value];
+    if (/^(?:read-all|none)$/i.test(value)) return [];
+    return null;
   }
-  const root = asMapping(doc);
-  const permissions = asMapping(root?.permissions);
-  if (!permissions) {
-    return {
-      id: "workflow-permissions",
-      state: "BROKEN",
-      detail: "workflow does not declare least-privilege permissions; repository defaults could grant write access"
-    };
+  const mapping = asMapping(value);
+  if (!mapping) return null;
+  return Object.entries(mapping).filter(([, permission]) => typeof permission === "string" && /write/i.test(permission)).map(([name, permission]) => `${name}=${String(permission)}`);
+}
+function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperward.yml"]) {
+  const broken = [];
+  const warnings = [];
+  for (const rel of workflowRels) {
+    const path = resolve4(cwd, rel);
+    if (!existsSync10(path)) {
+      broken.push(`${rel} is missing`);
+      continue;
+    }
+    let doc;
+    try {
+      doc = parse3(readFileSync12(path, "utf8"));
+    } catch (e) {
+      broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
+      continue;
+    }
+    const root = asMapping(doc);
+    if (!root) {
+      broken.push(`${rel} is not a YAML mapping`);
+      continue;
+    }
+    const rootPermissions = root.permissions;
+    if (rootPermissions === void 0) {
+      broken.push(`${rel}: workflow does not declare least-privilege permissions; repository defaults could grant write access`);
+    } else {
+      const writes = permissionWrites(rootPermissions);
+      if (writes === null) {
+        broken.push(`${rel}: workflow permissions shape is unsupported`);
+      } else if (writes.length) {
+        broken.push(`${rel}: workflow grants write permission: ${writes.join(", ")}`);
+      } else {
+        const mapping = asMapping(rootPermissions);
+        if (mapping && mapping.contents !== "read") {
+          warnings.push(`${rel}: workflow permissions contain no writes but contents: read is not declared`);
+        }
+      }
+    }
+    const jobs = asMapping(root.jobs);
+    if (!jobs) continue;
+    for (const [name, rawJob] of Object.entries(jobs)) {
+      const job = asMapping(rawJob);
+      if (!job || job.permissions === void 0) continue;
+      const writes = permissionWrites(job.permissions);
+      if (writes === null) {
+        broken.push(`${rel} job "${name}": permissions shape is unsupported`);
+      } else if (writes.length) {
+        broken.push(`${rel} job "${name}" grants write permission: ${writes.join(", ")}`);
+      }
+    }
   }
-  const writes = Object.entries(permissions).filter(
-    ([, value]) => typeof value === "string" && /write/i.test(value)
-  );
-  if (writes.length) {
+  if (broken.length) {
     return {
       id: "workflow-permissions",
       state: "BROKEN",
-      detail: "workflow grants write permission: " + writes.map(([name]) => name).join(", ")
+      detail: broken.join("; ")
     };
   }
-  if (permissions.contents !== "read") {
+  if (warnings.length) {
     return {
       id: "workflow-permissions",
       state: "WARN",
-      detail: "workflow permissions are explicit but contents: read is not declared"
+      detail: warnings.join("; ")
     };
   }
-  return { id: "workflow-permissions", state: "OK", detail: "workflow token is explicitly read-only (contents: read)" };
+  return {
+    id: "workflow-permissions",
+    state: "OK",
+    detail: `${workflowRels.join(", ")}: workflow/job token permissions contain no write grants and workflow contents access is read-only`
+  };
 }
-function collectLocalPosture(cwd, policy) {
+function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow = false) {
   const checks = [];
   checks.push(
-    policy.version <= POLICY_VERSION ? { id: "policy", state: "OK", detail: `policy version ${policy.version} is understood (current schema ${POLICY_VERSION})` } : { id: "policy", state: "WARN", detail: `policy version ${policy.version} is newer than this binary's schema ${POLICY_VERSION}; only known gates can be evaluated` }
+    policy.version <= POLICY_VERSION ? { id: "policy", state: "OK", detail: `policy version ${policy.version} is understood (current schema ${POLICY_VERSION})` } : { id: "policy", state: "BROKEN", detail: `policy version ${policy.version} is newer than this binary's schema ${POLICY_VERSION}; authority cannot be certified for unknown policy semantics` }
   );
   let plan = [];
   try {
@@ -8488,9 +8729,29 @@ function collectLocalPosture(cwd, policy) {
   };
   addWiring("claude-hooks", "agent", true);
   addWiring("pre-commit", "pre-commit", false);
-  addWiring("ci-wiring", "ci", true);
+  const canonicalWorkflow = ".github/workflows/tamperward.yml";
+  if (authorityWorkflows?.length) {
+    const normalized = authorityWorkflows.map((x) => x.replace(/\\/g, "/"));
+    if (explicitWorkflow) {
+      checks.push({
+        id: "ci-wiring",
+        state: "OK",
+        detail: `explicit verifier authority workflow: ${normalized.join(", ")}; verifier step/timeout validated by doctor`
+      });
+    } else if (normalized.includes(canonicalWorkflow)) {
+      addWiring("ci-wiring", "ci", true);
+    } else {
+      checks.push({
+        id: "ci-wiring",
+        state: "OK",
+        detail: `discovered verifier authority workflow(s): ${normalized.join(", ")}; verifier step/timeout validated by doctor`
+      });
+    }
+  } else {
+    addWiring("ci-wiring", "ci", true);
+  }
   addWiring("codeowners", "codeowners", true);
-  checks.push(workflowPermissionCheck(cwd));
+  checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
     ...pinsInFile(join13(cwd, ".claude", "settings.json")),
     ...pinsInFile(join13(cwd, ".git", "hooks", "pre-commit")),
@@ -8744,7 +9005,13 @@ function runDoctor(opts = {}) {
       "policy"
     );
   }
-  const fail = (id, message) => err(message, opts, id, collectLocalPosture(cwd, policy));
+  let postureWorkflows = opts.workflow ? [opts.workflow] : void 0;
+  const fail = (id, message) => err(
+    message,
+    opts,
+    id,
+    collectLocalPosture(cwd, policy, postureWorkflows, Boolean(opts.workflow))
+  );
   if (!policy.verify?.command) {
     return fail("verifier", "trusted policy has no verify.command; generated CI cannot verify this repository");
   }
@@ -8771,6 +9038,7 @@ function runDoctor(opts = {}) {
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
   let verifyJobCount = 0;
+  const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
     const workflowPath = resolve4(cwd, workflowRel);
     if (!existsSync10(workflowPath)) {
@@ -8778,7 +9046,7 @@ function runDoctor(opts = {}) {
     }
     let doc;
     try {
-      doc = parse3(readFileSync13(workflowPath, "utf8"));
+      doc = parse3(readFileSync12(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -8787,6 +9055,10 @@ function runDoctor(opts = {}) {
     }
     const jobs = verifyJobs(doc);
     verifyJobCount += jobs.length;
+    if (jobs.length > 0) {
+      authorityWorkflows.push(workflowRel);
+      postureWorkflows = [...authorityWorkflows];
+    }
     for (const { name, job } of jobs) {
       const timeout = job["timeout-minutes"];
       if (timeout === void 0 || timeout === null) {
@@ -8845,7 +9117,12 @@ function runDoctor(opts = {}) {
       );
     }
   }
-  const checks = collectLocalPosture(cwd, policy);
+  const checks = collectLocalPosture(
+    cwd,
+    policy,
+    authorityWorkflows,
+    Boolean(opts.workflow)
+  );
   checks.push({
     id: "ci-verifier",
     state: "OK",
@@ -8877,7 +9154,7 @@ function runDoctor(opts = {}) {
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join16, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
 
@@ -8913,7 +9190,7 @@ import {
   existsSync as existsSync11,
   lstatSync as lstatSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
   statSync as statSync3
@@ -8970,7 +9247,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync14(path));
+      h.update(readFileSync13(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -9004,7 +9281,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync14(path));
+          h.update(readFileSync13(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -9165,7 +9442,7 @@ function venvProblem(root) {
   const cfg = join14(root, "pyvenv.cfg");
   if (!existsSync11(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync14(cfg, "utf8");
+    const body = readFileSync13(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -9263,7 +9540,7 @@ function dependencyEnvironmentSummary(descriptor) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join15, resolve as resolve6 } from "node:path";
 var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
   memoryBytes: 2 * 1024 * 1024 * 1024,
@@ -9317,7 +9594,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash9("sha256").update(readFileSync15(path)).digest("hex");
+  return createHash9("sha256").update(readFileSync14(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -9965,7 +10242,7 @@ function overlayDigest(dest, paths) {
     try {
       const st = lstatSync5(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
     } catch {
       h.update("<gone>");
     }
@@ -10076,7 +10353,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync16(outFile, "utf8"));
+      r = JSON.parse(readFileSync15(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -10379,7 +10656,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync3 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join17, resolve as resolve8 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
@@ -10501,7 +10778,7 @@ function linuxDescendantPids(rootPid) {
   for (const name of names) {
     const pid = Number(name);
     try {
-      const stat = readFileSync17(`/proc/${name}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${name}/stat`, "utf8");
       const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
       const ppid = Number(fields[1]);
       if (!Number.isFinite(ppid)) continue;
@@ -10570,7 +10847,7 @@ function runAgentWithBudget(argv2, cwd, budgetSecs) {
     supervisorTimedOut = Boolean(supervisor.error) && supervisor.error.code === "ETIMEDOUT";
     let state = {};
     try {
-      state = JSON.parse(readFileSync17(resultFile, "utf8"));
+      state = JSON.parse(readFileSync16(resultFile, "utf8"));
     } catch {
     }
     if (supervisorTimedOut || state.timedOut) {
@@ -10684,7 +10961,16 @@ function observerSummary(observer, telemetry) {
 }
 function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
   observerSummary(observer, telemetry);
-  const { events } = readEvents(observer.log, 0);
+  const strict = process.env.TAMPERWARD_TRANSIENT === "block";
+  const drained = drainEvents(observer.log, 0);
+  const { events } = drained;
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    out(
+      `tamperward run \u2014 transient observer: telemetry was not fully classified (${issue}; ${drained.bytesRead}/${MAX_EVENT_SWEEP_BYTES} bytes read). ` + (strict ? "Strict transient policy fails closed." : "Observer telemetry remains advisory, so this degrades evidence but does not independently fail the envelope.")
+    );
+    if (strict) return { blocking: true };
+  }
   if (events.length === 0) return { blocking: false };
   let persistent = /* @__PURE__ */ new Set();
   try {
@@ -10697,9 +10983,9 @@ function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
     );
   } catch (e) {
     out(
-      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).`
+      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).` + (strict ? " Strict transient policy fails closed." : "")
     );
-    return { blocking: false };
+    return { blocking: strict };
   }
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -10723,7 +11009,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -10746,7 +11032,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.15.0",
+  "version": "2.15.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",