tamperward 2.15.2 → 2.16.1

package/README.md

@@ -325,8 +325,14 @@ Public rulesets can be read anonymously; set `GH_TOKEN` or `GITHUB_TOKEN` when
 authentication is required.
 
 A real deployment needs a verify command configured — the generated CI verify step
-**fails closed (exit 2) without one** rather than passing quietly. In
-`.tamperward.yml`:
+**fails closed (exit 2) without one** rather than passing quietly. Since 2.16.1,
+`tamperward init` ends with a separate **VERIFICATION SETUP** status: it says either
+`verification configured — <command>` or prominently reports
+`INCOMPLETE: verification not configured — CI will fail closed`. It can suggest a
+single high-confidence command such as `npm test`, `pytest`, `tox`, `cargo test`
+or `go test ./...`; multiple candidates are listed without choosing one. Suggestions
+are advisory only — init never writes an inferred verifier command because that command
+is part of the trust anchor. In `.tamperward.yml`:
 
 ```yaml
 verify:
@@ -369,6 +375,18 @@ restored `"test": "sh scripts/test.sh"` will happily call a script nothing
 restored. It bounds the class rather than closing it — see
 [the threat model](./docs/THREAT-MODEL-pristine-run.md).
 
+From **2.16.0**, verifier suite output is diagnostic evidence instead of discarded
+noise. Both visible and pristine stages continuously drain stdout/stderr through a
+trusted supervisor, retain only the final **16 KiB per stream**, and count the total
+bytes observed. Structured output exposes this under
+`visible.diagnostics` / `pristine.diagnostics` with
+`captured_bytes`, `retained_bytes`, `truncated`, and a bounded `tail` on a
+failed stage. Default human output remains quiet on success. On failure, retained
+diagnostics are rendered with every line prefixed and terminal/control characters
+escaped, so candidate output cannot become ANSI control traffic or a GitHub
+`::command::`. These bytes are evidence produced by candidate code; they never own
+the verifier verdict.
+
 The four primitives:
 
 ```bash

package/dist/cli/index.js

@@ -7085,13 +7085,14 @@ function watchTree(dir, cb, onState, onError) {
     }
   }
   const watchers = /* @__PURE__ */ new Map();
+  let closed = false;
   onState("fallback", 0);
   const addDir = (rel) => {
-    if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
+    if (closed || watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
       w = watch(rel ? join11(dir, rel) : dir, (kind, fname) => {
-        if (!fname) return;
+        if (closed || !fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
@@ -7129,9 +7130,14 @@ function watchTree(dir, cb, onState, onError) {
     }
   };
   walk2("");
-  return { close: () => {
-    for (const w of watchers.values()) w.close();
-  } };
+  return {
+    close: () => {
+      if (closed) return;
+      closed = true;
+      for (const w of watchers.values()) w.close();
+      watchers.clear();
+    }
+  };
 }
 function startWatcher(dir, log, policy) {
   try {
@@ -7215,8 +7221,11 @@ function startWatcher(dir, log, policy) {
     },
     (detail) => degrade(detail)
   );
+  let closed = false;
   return {
     close: () => {
+      if (closed) return;
+      closed = true;
       tree.close();
       health.state = "stopped";
       health.stopped_at = (/* @__PURE__ */ new Date()).toISOString();
@@ -8164,6 +8173,78 @@ function hooksShapeError(hooks) {
   }
   return null;
 }
+function verifierCandidates(cwd) {
+  const candidates = [];
+  const add = (command) => {
+    if (!candidates.includes(command)) candidates.push(command);
+  };
+  try {
+    const pkg = JSON.parse(readFileSync11(join12(cwd, "package.json"), "utf8"));
+    const test = pkg.scripts?.test;
+    if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
+  } catch {
+  }
+  try {
+    const pyproject = readFileSync11(join12(cwd, "pyproject.toml"), "utf8");
+    if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
+  } catch {
+  }
+  if (existsSync9(join12(cwd, "pytest.ini"))) add("pytest");
+  try {
+    const setupCfg = readFileSync11(join12(cwd, "setup.cfg"), "utf8");
+    if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
+  } catch {
+  }
+  try {
+    const tox = readFileSync11(join12(cwd, "tox.ini"), "utf8");
+    if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
+  } catch {
+  }
+  try {
+    const cargo = readFileSync11(join12(cwd, "Cargo.toml"), "utf8");
+    if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
+  } catch {
+  }
+  try {
+    const goMod = readFileSync11(join12(cwd, "go.mod"), "utf8");
+    if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
+  } catch {
+  }
+  return candidates;
+}
+function verifierSetupMessage(cwd) {
+  try {
+    const policy = loadPolicy(cwd);
+    const command = policy.verify?.command?.trim();
+    if (command) return `verification configured \u2014 ${command}`;
+  } catch (e) {
+    return `INCOMPLETE: verification not configured \u2014 policy cannot currently be loaded; CI will fail closed until the policy is fixed (${errText3(e)}).`;
+  }
+  const candidates = verifierCandidates(cwd);
+  const lines = [
+    "INCOMPLETE: verification not configured \u2014 CI will fail closed until .tamperward.yml names a trusted suite command."
+  ];
+  if (candidates.length === 1) {
+    lines.push(`Suggested verifier command: ${candidates[0]}`);
+    lines.push("Review it, then add:");
+    lines.push("verify:");
+    lines.push(`  command: "${candidates[0]}"`);
+    lines.push("  budget: 300");
+  } else if (candidates.length > 1) {
+    lines.push(`Detected verifier candidates: ${candidates.join(", ")}`);
+    lines.push("Choose the suite that defines merge authority, then add for example:");
+    lines.push("verify:");
+    lines.push('  command: "<reviewed suite command>"');
+    lines.push("  budget: 300");
+  } else {
+    lines.push("Add the reviewed suite command to .tamperward.yml, for example:");
+    lines.push("verify:");
+    lines.push('  command: "<your test command>"');
+    lines.push("  budget: 300");
+  }
+  lines.push("TamperWard does not write an inferred verifier command automatically because it is part of the trust anchor.");
+  return lines.join("\n");
+}
 function planPolicy(cwd) {
   const path = join12(cwd, POLICY_FILE);
   if (existsSync9(path)) {
@@ -8554,6 +8635,10 @@ WARNING (${a.item}): ${a.warning}
   }
   const errors = plan.filter((a) => a.status === "error");
   const changed = opts.dryRun ? plan.filter((a) => a.apply).length : applied;
+  w.write(`
+VERIFICATION SETUP
+${verifierSetupMessage(cwd)}
+`);
   if (errors.length) {
     w.write(`
 tamperward init: ${errors.length} item(s) need your attention above; the rest ${opts.dryRun ? "are planned" : "were applied"}.
@@ -9152,11 +9237,11 @@ function runDoctor(opts = {}) {
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute10, join as join16, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync4, symlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join17, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
@@ -9539,9 +9624,321 @@ function dependencyEnvironmentSummary(descriptor) {
 
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname6, join as join16, resolve as resolve6 } from "node:path";
+
+// src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname6, join as join15, resolve as resolve6 } from "node:path";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join15 } from "node:path";
+var DIAGNOSTIC_TAIL_BYTES = 16 * 1024;
+var EMPTY_STREAM = {
+  captured_bytes: 0,
+  retained_bytes: 0,
+  truncated: false,
+  tail: ""
+};
+function emptySuiteDiagnostics() {
+  return {
+    stdout: { ...EMPTY_STREAM },
+    stderr: { ...EMPTY_STREAM }
+  };
+}
+function decodeUtf8Tail(tail) {
+  let start = 0;
+  while (start < tail.length && (tail[start] & 192) === 128) start++;
+  return tail.subarray(start).toString("utf8");
+}
+function streamFromRaw(raw) {
+  let tail = Buffer.alloc(0);
+  try {
+    tail = Buffer.from(raw?.tail_b64 ?? "", "base64");
+  } catch {
+    tail = Buffer.alloc(0);
+  }
+  const captured = Number.isFinite(raw?.captured_bytes) ? Math.max(0, Number(raw?.captured_bytes)) : tail.length;
+  return {
+    captured_bytes: captured,
+    retained_bytes: tail.length,
+    truncated: captured > tail.length,
+    tail: decodeUtf8Tail(tail)
+  };
+}
+function scrubDiagnosticText(input) {
+  let out2 = "";
+  for (const ch of input) {
+    const cp = ch.codePointAt(0);
+    if (ch === "\n" || ch === "	") {
+      out2 += ch;
+    } else if (cp === 13) {
+      out2 += "\\r";
+    } else if (cp < 32 || cp >= 127 && cp <= 159) {
+      out2 += cp <= 255 ? `\\x${cp.toString(16).padStart(2, "0")}` : `\\u{${cp.toString(16)}}`;
+    } else {
+      out2 += ch;
+    }
+  }
+  return out2;
+}
+function diagnosticLines(stage, diagnostics) {
+  const lines = [];
+  for (const streamName of ["stdout", "stderr"]) {
+    const stream = diagnostics[streamName];
+    if (stream.captured_bytes === 0) continue;
+    const suffix = stream.truncated ? ` \u2014 tail ${stream.retained_bytes}/${stream.captured_bytes} bytes retained` : ` \u2014 ${stream.captured_bytes} bytes`;
+    lines.push(`${stage} suite ${streamName}${suffix}:`);
+    const scrubbed = scrubDiagnosticText(stream.tail);
+    const body = scrubbed.split("\n");
+    if (body.at(-1) === "") body.pop();
+    for (const line of body) lines.push(`  | ${line}`);
+  }
+  return lines;
+}
+var CAPTURE_SUPERVISOR = String.raw`
+const cp = require('node:child_process');
+const fs = require('node:fs');
+
+const [configFile] = process.argv.slice(1);
+const cfg = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+const CAP = Number(cfg.captureBytes);
+
+const fresh = () => ({ total: 0, tail: Buffer.alloc(0) });
+const stdout = fresh();
+const stderr = fresh();
+
+// Linux ordinary-exit hardening (#371): process-group ownership alone misses a
+// descendant that calls setsid(). Track the real descendant tree while the
+// suite is alive so a reparented session escape is still known when the main
+// child exits. This supplements, rather than replaces, group termination.
+const trackedDescendants = new Set();
+
+function linuxDescendants(rootPid) {
+  if (process.platform !== 'linux' || !rootPid) return [];
+  const byParent = new Map();
+  let names = [];
+  try { names = fs.readdirSync('/proc').filter((x) => /^\d+$/.test(x)); } catch { return []; }
+  for (const name of names) {
+    const pid = Number(name);
+    try {
+      const stat = fs.readFileSync('/proc/' + name + '/stat', 'utf8');
+      const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+      const ppid = Number(fields[1]);
+      if (!Number.isFinite(ppid)) continue;
+      const kids = byParent.get(ppid) || [];
+      kids.push(pid);
+      byParent.set(ppid, kids);
+    } catch {}
+  }
+  const out = [];
+  const seen = new Set([rootPid]);
+  const stack = [rootPid];
+  while (stack.length) {
+    const parent = stack.pop();
+    for (const pid of (byParent.get(parent) || [])) {
+      if (seen.has(pid)) continue;
+      seen.add(pid);
+      out.push(pid);
+      stack.push(pid);
+    }
+  }
+  return out;
+}
+
+function trackDescendants() {
+  if (!child || !child.pid || process.platform !== 'linux') return;
+  for (const pid of linuxDescendants(child.pid)) trackedDescendants.add(pid);
+}
+
+function append(state, chunk) {
+  const b = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+  state.total += b.length;
+  if (b.length >= CAP) {
+    state.tail = Buffer.from(b.subarray(b.length - CAP));
+    return;
+  }
+  if (state.tail.length + b.length <= CAP) {
+    state.tail = Buffer.concat([state.tail, b]);
+    return;
+  }
+  const keep = CAP - b.length;
+  state.tail = Buffer.concat([state.tail.subarray(state.tail.length - keep), b]);
+}
+
+function diag(state) {
+  return {
+    captured_bytes: state.total,
+    tail_b64: state.tail.toString('base64'),
+  };
+}
+
+let child;
+let done = false;
+let timedOut = false;
+let exitInfo = { exit: null, signal: null };
+let descendantTracker = null;
+
+function killOwned() {
+  if (!child || !child.pid) return;
+  trackDescendants();
+  if (cfg.detached && process.platform !== 'win32') {
+    try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+  }
+  try { child.kill('SIGKILL'); } catch {}
+  if (process.platform === 'linux') {
+    // Deepest-first is friendlier to short-lived process trees. PIDs are still
+    // rechecked by kill(2); races with natural exit are harmless.
+    for (const pid of Array.from(trackedDescendants).reverse()) {
+      try { process.kill(pid, 'SIGKILL'); } catch {}
+    }
+  }
+}
+
+function finish(extra) {
+  if (done) return;
+  done = true;
+  if (descendantTracker) clearInterval(descendantTracker);
+  try {
+    // stdout is reserved for the trusted supervisor result. Candidate suite
+    // stdout/stderr are separate pipes and are never inherited here.
+    process.stdout.write(JSON.stringify({
+      ...exitInfo,
+      timedOut,
+      ...extra,
+      stdout: diag(stdout),
+      stderr: diag(stderr),
+    }));
+  } catch {}
+  process.exit(0);
+}
+
+try {
+  child = cp.spawn(cfg.executable, cfg.args, {
+    cwd: cfg.cwd,
+    env: process.env,
+    detached: Boolean(cfg.detached) && process.platform !== 'win32',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+} catch (e) {
+  finish({ error: String(e) });
+}
+
+if (child) {
+  if (process.platform === 'linux') {
+    trackDescendants();
+    descendantTracker = setInterval(trackDescendants, 5);
+    descendantTracker.unref();
+  }
+  child.stdout.on('data', (b) => append(stdout, b));
+  child.stderr.on('data', (b) => append(stderr, b));
+
+  const timer = setTimeout(() => {
+    timedOut = true;
+    killOwned();
+    // Backstop if a platform fails to emit close after the forced kill.
+    setTimeout(() => finish({}), 1000).unref();
+  }, Number(cfg.timeoutMs));
+  timer.unref();
+
+  child.on('error', (e) => {
+    clearTimeout(timer);
+    killOwned();
+    finish({ error: String(e) });
+  });
+
+  child.on('exit', (code, signal) => {
+    exitInfo = {
+      exit: code == null ? null : Number(code),
+      signal: signal == null ? null : String(signal),
+    };
+    if (cfg.killGroupOnFinish) killOwned();
+  });
+
+  // close fires after the stdio pipes close, so the retained tails include all
+  // output that was drained before owned descendants were terminated.
+  child.on('close', (code, signal) => {
+    clearTimeout(timer);
+    if (exitInfo.exit === null && code != null) exitInfo.exit = Number(code);
+    if (exitInfo.signal === null && signal != null) exitInfo.signal = String(signal);
+    finish({});
+  });
+}
+`;
+function parseCapturedSupervisorResult(stdoutText) {
+  let raw;
+  try {
+    raw = JSON.parse(stdoutText);
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const diagnostics = {
+    stdout: streamFromRaw(raw.stdout),
+    stderr: streamFromRaw(raw.stderr)
+  };
+  return {
+    exit: typeof raw.exit === "number" ? raw.exit : null,
+    signal: typeof raw.signal === "string" ? raw.signal : null,
+    timedOut: Boolean(raw.timedOut),
+    ...typeof raw.error === "string" && raw.error ? { error: raw.error } : {},
+    diagnostics
+  };
+}
+function runCapturedProcessSync(executable, args, opts) {
+  const stateDir = mkdtempSync2(join15(tmpdir2(), "tw-suite-capture-"));
+  const configFile = join15(stateDir, "config.json");
+  const backstop = opts.backstopMs ?? 3e4;
+  try {
+    writeFileSync7(
+      configFile,
+      JSON.stringify({
+        executable,
+        args,
+        cwd: opts.cwd,
+        timeoutMs: opts.timeoutMs,
+        detached: Boolean(opts.detached),
+        killGroupOnFinish: Boolean(opts.killGroupOnFinish),
+        captureBytes: DIAGNOSTIC_TAIL_BYTES
+      }),
+      { mode: 384 }
+    );
+    const supervisor = spawnSync(
+      process.execPath,
+      ["-e", CAPTURE_SUPERVISOR, configFile],
+      {
+        cwd: opts.cwd,
+        env: opts.env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        // The trusted result is at most two 16 KiB tails plus small metadata.
+        // A candidate that somehow writes into the supervisor's stdout through
+        // same-UID /proc can only overflow/corrupt this bounded channel and make
+        // parsing fail closed; its suite streams are never inherited here.
+        maxBuffer: 256 * 1024,
+        timeout: opts.timeoutMs + backstop,
+        killSignal: "SIGKILL"
+      }
+    );
+    const parsed = parseCapturedSupervisorResult(supervisor.stdout ?? "");
+    const diagnostics = parsed?.diagnostics ?? emptySuiteDiagnostics();
+    if (!parsed) {
+      const supervisorTimedOut = Boolean(supervisor.error) && supervisor.error.code === "ETIMEDOUT";
+      return {
+        exit: null,
+        signal: supervisor.signal ? String(supervisor.signal) : null,
+        timedOut: supervisorTimedOut,
+        error: supervisor.error?.message ?? "suite capture supervisor did not produce a result",
+        diagnostics
+      };
+    }
+    return parsed;
+  } finally {
+    rmSync3(stateDir, { recursive: true, force: true });
+  }
+}
+
+// src/verifier-backend.ts
 var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
   memoryBytes: 2 * 1024 * 1024 * 1024,
   // Docker interprets memory-swap == memory as no additional swap allowance.
@@ -9584,7 +9981,7 @@ function replaceableByCaller(path) {
 function findExecutable(name) {
   for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
     if (!raw) continue;
-    const candidate = join15(raw, name);
+    const candidate = join16(raw, name);
     try {
       accessSync(candidate, constants2.X_OK);
       return realpathSync4(candidate);
@@ -9594,7 +9991,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash9("sha256").update(readFileSync14(path)).digest("hex");
+  return createHash9("sha256").update(readFileSync15(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -9609,7 +10006,7 @@ function dockerArgs(host, args) {
 }
 function dockerAvailable(enginePath, host) {
   try {
-    const r = spawnSync(enginePath, dockerArgs(host, ["version"]), {
+    const r = spawnSync2(enginePath, dockerArgs(host, ["version"]), {
       stdio: "ignore",
       timeout: 5e3,
       killSignal: "SIGKILL",
@@ -9637,7 +10034,7 @@ function declaredImageVolumePaths(metadata) {
 }
 function inspectImageMetadata(enginePath, host, image) {
   try {
-    const r = spawnSync(enginePath, dockerArgs(host, ["image", "inspect", image]), {
+    const r = spawnSync2(enginePath, dockerArgs(host, ["image", "inspect", image]), {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 1e4,
@@ -9812,7 +10209,7 @@ function verifierBackendSummary(backend) {
 function cleanupContainer(backend, name) {
   if (!backend.enginePath || !backend.daemonHost || !engineStable(backend)) return;
   try {
-    spawnSync(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
+    spawnSync2(backend.enginePath, dockerArgs(backend.daemonHost, ["rm", "-f", "-v", name]), {
       stdio: "ignore",
       timeout: 1e4,
       killSignal: "SIGKILL",
@@ -9923,29 +10320,45 @@ function runContainerStage(backend, dir, command, budgetSecs) {
     resources: backend.resources ?? DEFAULT_CONTAINER_RESOURCE_LIMITS
   });
   try {
-    const r = spawnSync(
+    const r = runCapturedProcessSync(
       backend.enginePath,
       dockerArgs(backend.daemonHost, args),
       {
-        stdio: "ignore",
-        timeout: budgetSecs * 1e3,
-        killSignal: "SIGKILL",
-        env: engineClientEnv()
+        cwd: dirname6(backend.enginePath),
+        env: engineClientEnv(),
+        timeoutMs: budgetSecs * 1e3,
+        backstopMs: 3e4
       }
     );
     const secs = Math.round((Date.now() - t0) / 1e3);
+    if (r.timedOut) {
+      cleanupContainer(backend, name);
+      return {
+        exit: null,
+        secs,
+        failure: "budget",
+        reason: "verifier stage exceeded its budget",
+        diagnostics: r.diagnostics
+      };
+    }
     if (r.error) {
       cleanupContainer(backend, name);
-      const code2 = r.error.code;
-      return code2 === "ETIMEDOUT" ? { exit: null, secs, failure: "budget", reason: "verifier stage exceeded its budget" } : { exit: null, secs, failure: "backend", reason: `Docker client failed: ${r.error.message}` };
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `Docker client failed: ${r.error}`,
+        diagnostics: r.diagnostics
+      };
     }
-    if (r.status === null) {
+    if (r.exit === null) {
       cleanupContainer(backend, name);
       return {
         exit: null,
         secs,
         failure: "backend",
-        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`
+        reason: `Docker client did not return a status${r.signal ? ` (signal ${r.signal})` : ""}`,
+        diagnostics: r.diagnostics
       };
     }
     if (!engineStable(backend)) {
@@ -9953,10 +10366,11 @@ function runContainerStage(backend, dir, command, budgetSecs) {
         exit: null,
         secs,
         failure: "backend",
-        reason: "Docker engine identity changed before verifier result inspection"
+        reason: "Docker engine identity changed before verifier result inspection",
+        diagnostics: r.diagnostics
       };
     }
-    const inspected = spawnSync(
+    const inspected = spawnSync2(
       backend.enginePath,
       dockerArgs(backend.daemonHost, ["inspect", "--format", "{{json .State}}", name]),
       {
@@ -9976,7 +10390,10 @@ function runContainerStage(backend, dir, command, budgetSecs) {
       }
     }
     cleanupContainer(backend, name);
-    return containerStateResult(state, secs);
+    return {
+      ...containerStateResult(state, secs),
+      diagnostics: r.diagnostics
+    };
   } catch (e) {
     cleanupContainer(backend, name);
     return {
@@ -10081,7 +10498,7 @@ function resolveBase(base, cwd) {
   }
 }
 function baseIsAncestorOfHead(base, cwd) {
-  const r = spawnSync2("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
+  const r = spawnSync3("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
 function inside2(root, path) {
@@ -10105,7 +10522,7 @@ function safeSymlink(target, out2, root, label) {
   if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out2), target))) {
     throw linkEscape(label, target);
   }
-  rmSync3(out2, { force: true });
+  rmSync4(out2, { force: true });
   symlinkSync(target, out2);
 }
 function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
@@ -10128,7 +10545,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "tree" ? root : dependencyRoot;
-    const current = join16(base, ...stack);
+    const current = join17(base, ...stack);
     let st;
     try {
       st = lstatSync5(current);
@@ -10164,7 +10581,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join16(current, part);
+    current = join17(current, part);
     let st;
     try {
       st = lstatSync5(current);
@@ -10180,7 +10597,7 @@ function materialize(cwd, dest, dependencyRoot) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   const links = [];
   for (const rel of listed) {
-    const src = join16(cwd, rel);
+    const src = join17(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -10188,7 +10605,7 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out2 = join16(dest, rel);
+    const out2 = join17(dest, rel);
     mkdirSync6(dirname7(out2), { recursive: true });
     dropSymlink(out2);
     if (st.isSymbolicLink()) {
@@ -10205,11 +10622,11 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join16(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join17(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync5(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync5(p).isSymbolicLink()) rmSync4(p, { force: true });
   } catch {
   }
 }
@@ -10238,11 +10655,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join16(dest, rel);
+    const p = join17(dest, rel);
     try {
       const st = lstatSync5(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {
       h.update("<gone>");
     }
@@ -10266,15 +10683,15 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join16(dest, e.path);
+    const out2 = join17(dest, e.path);
     mkdirSync6(dirname7(out2), { recursive: true });
-    rmSync3(out2, { force: true });
+    rmSync4(out2, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out2, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out2, target });
     } else {
-      writeFileSync7(out2, content);
+      writeFileSync8(out2, content);
       chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -10283,7 +10700,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join16(dest, rel), { force: true });
+    rmSync4(join17(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -10291,27 +10708,6 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   }
   return { restored, removed };
 }
-var SUPERVISOR = `
-const cp = require('node:child_process');
-const fs = require('node:fs');
-const [cmd, budgetMs, outFile] = process.argv.slice(1);
-const child = cp.spawn('sh', ['-c', cmd], { stdio: 'ignore', detached: process.platform !== 'win32' });
-const killGroup = () => {
-  try { process.kill(-child.pid, 'SIGKILL'); } catch {}
-  try { child.kill('SIGKILL'); } catch {}
-};
-let done = false;
-const finish = (r) => {
-  if (done) return;
-  done = true;
-  killGroup();
-  fs.writeFileSync(outFile, JSON.stringify(r));
-  process.exit(0);
-};
-const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
-child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
-child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
-`;
 var DROPPED_ENV = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "NODE_PATH",
@@ -10328,9 +10724,9 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join16(scratch, "npmrc-user");
-  const globalRc = join16(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync7(f, "", { mode: 292 });
+  const userRc = join17(scratch, "npmrc-user");
+  const globalRc = join17(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync8(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -10339,31 +10735,75 @@ function suiteEnv(scratch) {
 }
 function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join16(tmpdir2(), "tw-verify-run-"));
-  const outFile = join16(outDir, "result.json");
+  const scratch = mkdtempSync3(join17(tmpdir3(), "tw-verify-run-"));
   try {
-    spawnSync2(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+    const r = runCapturedProcessSync("sh", ["-c", cmd], {
       cwd: dir,
-      env: suiteEnv(outDir),
-      stdio: "ignore",
-      timeout: budgetSecs * 1e3 + 3e4,
-      // backstop only; the supervisor enforces the budget
-      killSignal: "SIGKILL"
+      env: suiteEnv(scratch),
+      timeoutMs: budgetSecs * 1e3,
+      detached: process.platform !== "win32",
+      killGroupOnFinish: true,
+      backstopMs: 3e4
     });
     const secs = Math.round((Date.now() - t0) / 1e3);
-    let r;
-    try {
-      r = JSON.parse(readFileSync15(outFile, "utf8"));
-    } catch {
-      return { exit: null, secs };
+    if (r.timedOut) {
+      return {
+        exit: null,
+        secs,
+        failure: "budget",
+        reason: "verifier stage exceeded its budget",
+        diagnostics: r.diagnostics
+      };
+    }
+    if (r.error) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: r.error,
+        diagnostics: r.diagnostics
+      };
     }
-    if (r.timedOut || r.error) return { exit: null, secs };
-    if (r.exit === null || r.exit === void 0) return { exit: null, secs };
-    return { exit: r.exit, secs };
+    if (r.exit === null) {
+      return {
+        exit: null,
+        secs,
+        failure: "backend",
+        reason: `verifier suite did not return an exit code${r.signal ? ` (signal ${r.signal})` : ""}`,
+        diagnostics: r.diagnostics
+      };
+    }
+    return { exit: r.exit, secs, diagnostics: r.diagnostics };
   } finally {
-    rmSync3(outDir, { recursive: true, force: true });
+    rmSync4(scratch, { recursive: true, force: true });
   }
 }
+function diagnosticsJson(diagnostics, includeTail) {
+  if (!diagnostics) return void 0;
+  const stream = (d) => ({
+    captured_bytes: d.captured_bytes,
+    retained_bytes: d.retained_bytes,
+    truncated: d.truncated,
+    ...includeTail && d.captured_bytes > 0 ? { tail: d.tail } : {}
+  });
+  return {
+    stdout: stream(diagnostics.stdout),
+    stderr: stream(diagnostics.stderr)
+  };
+}
+function stageJson(result) {
+  const includeTail = result.exit !== 0 || result.failure !== void 0;
+  return {
+    exit: result.exit,
+    secs: result.secs,
+    ...result.reason ? { reason: result.reason } : {},
+    ...result.diagnostics ? { diagnostics: diagnosticsJson(result.diagnostics, includeTail) } : {}
+  };
+}
+function renderStageDiagnostics(out2, stage, result) {
+  if (!result.diagnostics) return;
+  for (const line of diagnosticLines(stage, result.diagnostics)) out2(line);
+}
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const out2 = (s) => void process.stdout.write(s + "\n");
@@ -10445,11 +10885,11 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join16(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join16(visRoot, "t");
+  const visRoot = mkdtempSync3(join17(tmpdir3(), "tw-verify-vis-"));
+  const visDir = join17(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync3(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync4(d, { recursive: true, force: true });
   };
   const protectedIgnored = (rel) => isProtected(rel, policy);
   const treeBefore = treeFingerprint(cwd, protectedIgnored);
@@ -10479,14 +10919,16 @@ function runVerify(opts) {
         stage: "visible",
         ...visible.resource ? { resource: visible.resource } : {},
         detail: visible.reason,
+        diagnostics: diagnosticsJson(visible.diagnostics, true),
         verifier_backend: backendReport(),
         oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2(
-        exhausted ? "verify: isolated verifier resource envelope was exhausted during the visible stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the visible stage \u2014 failing closed"
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the visible stage \u2014 failing closed" : "verify: verifier execution backend failed while running the visible stage \u2014 failing closed"
       );
       if (visible.reason) out2("verify: " + visible.reason);
+      renderStageDiagnostics(out2, "visible", visible);
     }
     return 2;
   }
@@ -10503,8 +10945,8 @@ function runVerify(opts) {
     out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join16(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join16(priRoot, "t");
+  const priRoot = mkdtempSync3(join17(tmpdir3(), "tw-verify-pri-"));
+  const priDir = join17(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -10535,14 +10977,16 @@ function runVerify(opts) {
         stage: "pristine",
         ...pristine.resource ? { resource: pristine.resource } : {},
         detail: pristine.reason,
+        diagnostics: diagnosticsJson(pristine.diagnostics, true),
         verifier_backend: backendReport(),
         oracle_assurance: oracleAssuranceReport()
       }));
     } else {
       out2(
-        exhausted ? "verify: isolated verifier resource envelope was exhausted during the pristine stage \u2014 failing closed" : "verify: isolated verifier backend failed while running the pristine stage \u2014 failing closed"
+        exhausted ? "verify: isolated verifier resource envelope was exhausted during the pristine stage \u2014 failing closed" : "verify: verifier execution backend failed while running the pristine stage \u2014 failing closed"
       );
       if (pristine.reason) out2("verify: " + pristine.reason);
+      renderStageDiagnostics(out2, "pristine", pristine);
     }
     return 2;
   }
@@ -10584,8 +11028,8 @@ function runVerify(opts) {
         base,
         command: cmd,
         budget_secs: budget,
-        visible: { exit: visible.exit, secs: visible.secs },
-        pristine: { exit: pristine.exit, secs: pristine.secs },
+        visible: stageJson(visible),
+        pristine: stageJson(pristine),
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
         verifier_backend: backendReport(),
@@ -10610,6 +11054,14 @@ function runVerify(opts) {
     out2(
       dependencyEnvironment ? `dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : "") : `dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`
     );
+    if (verdict2 !== "VERIFIED") {
+      if (visible.exit !== 0 || visible.failure !== void 0) {
+        renderStageDiagnostics(out2, "visible", visible);
+      }
+      if (pristine.exit !== 0 || pristine.failure !== void 0) {
+        renderStageDiagnostics(out2, "pristine", pristine);
+      }
+    }
     if (signedOff)
       out2(
         `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
@@ -10654,11 +11106,11 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync3 } from "node:child_process";
+import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join17, resolve as resolve8 } from "node:path";
+import { mkdtempSync as mkdtempSync4, readdirSync as readdirSync5, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync5 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join18, resolve as resolve8 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err2 = (s) => process.stderr.write(s + "\n");
 var AGENT_SUPERVISOR = String.raw`
@@ -10778,7 +11230,7 @@ function linuxDescendantPids(rootPid) {
   for (const name of names) {
     const pid = Number(name);
     try {
-      const stat = readFileSync16(`/proc/${name}/stat`, "utf8");
+      const stat = readFileSync17(`/proc/${name}/stat`, "utf8");
       const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
       const ppid = Number(fields[1]);
       if (!Number.isFinite(ppid)) continue;
@@ -10806,7 +11258,7 @@ function killAgentTree(pid) {
   if (!Number.isInteger(pid) || pid <= 1) return;
   if (process.platform === "win32") {
     try {
-      spawnSync3("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", timeout: 5e3 });
+      spawnSync4("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", timeout: 5e3 });
     } catch {
     }
     return;
@@ -10828,11 +11280,11 @@ function killAgentTree(pid) {
   }
 }
 function runAgentWithBudget(argv2, cwd, budgetSecs) {
-  const stateDir = mkdtempSync3(join17(tmpdir3(), "tw-agent-supervisor-"));
-  const resultFile = join17(stateDir, "result.json");
+  const stateDir = mkdtempSync4(join18(tmpdir4(), "tw-agent-supervisor-"));
+  const resultFile = join18(stateDir, "result.json");
   let supervisorTimedOut = false;
   try {
-    const supervisor = spawnSync3(
+    const supervisor = spawnSync4(
       process.execPath,
       ["-e", AGENT_SUPERVISOR, resultFile, String(budgetSecs * 1e3), ...argv2],
       {
@@ -10847,7 +11299,7 @@ function runAgentWithBudget(argv2, cwd, budgetSecs) {
     supervisorTimedOut = Boolean(supervisor.error) && supervisor.error.code === "ETIMEDOUT";
     let state = {};
     try {
-      state = JSON.parse(readFileSync16(resultFile, "utf8"));
+      state = JSON.parse(readFileSync17(resultFile, "utf8"));
     } catch {
     }
     if (supervisorTimedOut || state.timedOut) {
@@ -10874,7 +11326,7 @@ function runAgentWithBudget(argv2, cwd, budgetSecs) {
       failure: state.failure ?? "agent supervisor did not produce a final status"
     };
   } finally {
-    rmSync4(stateDir, { recursive: true, force: true });
+    rmSync5(stateDir, { recursive: true, force: true });
   }
 }
 var waitCell = new Int32Array(new SharedArrayBuffer(4));
@@ -10891,8 +11343,8 @@ function pidAlive2(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join17(cwd, ".git");
-  return join17(
+  const gd = gitDir(cwd) ?? join18(cwd, ".git");
+  return join18(
     gd,
     "tamperward",
     `run-observer-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.jsonl`
@@ -11009,7 +11461,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -11032,7 +11484,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -11137,7 +11589,7 @@ function runEnvelope(opts) {
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
   const agentRun = opts.agentBudget === void 0 ? (() => {
-    const agent = spawnSync3(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
+    const agent = spawnSync4(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
     return {
       exit: agent.status ?? 1,
       timedOut: false,
@@ -11177,7 +11629,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     err2("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
   }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
-  const isAncestor = spawnSync3("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
+  const isAncestor = spawnSync4("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err2(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err2("the agent rewrote history out from under the anchor. That is the finding.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.15.2",
+  "version": "2.16.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",