tamperward 2.16.0 → 2.16.1

package/README.md

@@ -325,8 +325,14 @@ Public rulesets can be read anonymously; set `GH_TOKEN` or `GITHUB_TOKEN` when
 authentication is required.
 
 A real deployment needs a verify command configured — the generated CI verify step
-**fails closed (exit 2) without one** rather than passing quietly. In
-`.tamperward.yml`:
+**fails closed (exit 2) without one** rather than passing quietly. Since 2.16.1,
+`tamperward init` ends with a separate **VERIFICATION SETUP** status: it says either
+`verification configured — <command>` or prominently reports
+`INCOMPLETE: verification not configured — CI will fail closed`. It can suggest a
+single high-confidence command such as `npm test`, `pytest`, `tox`, `cargo test`
+or `go test ./...`; multiple candidates are listed without choosing one. Suggestions
+are advisory only — init never writes an inferred verifier command because that command
+is part of the trust anchor. In `.tamperward.yml`:
 
 ```yaml
 verify:

package/dist/cli/index.js

@@ -8173,6 +8173,78 @@ function hooksShapeError(hooks) {
   }
   return null;
 }
+function verifierCandidates(cwd) {
+  const candidates = [];
+  const add = (command) => {
+    if (!candidates.includes(command)) candidates.push(command);
+  };
+  try {
+    const pkg = JSON.parse(readFileSync11(join12(cwd, "package.json"), "utf8"));
+    const test = pkg.scripts?.test;
+    if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
+  } catch {
+  }
+  try {
+    const pyproject = readFileSync11(join12(cwd, "pyproject.toml"), "utf8");
+    if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
+  } catch {
+  }
+  if (existsSync9(join12(cwd, "pytest.ini"))) add("pytest");
+  try {
+    const setupCfg = readFileSync11(join12(cwd, "setup.cfg"), "utf8");
+    if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
+  } catch {
+  }
+  try {
+    const tox = readFileSync11(join12(cwd, "tox.ini"), "utf8");
+    if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
+  } catch {
+  }
+  try {
+    const cargo = readFileSync11(join12(cwd, "Cargo.toml"), "utf8");
+    if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
+  } catch {
+  }
+  try {
+    const goMod = readFileSync11(join12(cwd, "go.mod"), "utf8");
+    if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
+  } catch {
+  }
+  return candidates;
+}
+function verifierSetupMessage(cwd) {
+  try {
+    const policy = loadPolicy(cwd);
+    const command = policy.verify?.command?.trim();
+    if (command) return `verification configured \u2014 ${command}`;
+  } catch (e) {
+    return `INCOMPLETE: verification not configured \u2014 policy cannot currently be loaded; CI will fail closed until the policy is fixed (${errText3(e)}).`;
+  }
+  const candidates = verifierCandidates(cwd);
+  const lines = [
+    "INCOMPLETE: verification not configured \u2014 CI will fail closed until .tamperward.yml names a trusted suite command."
+  ];
+  if (candidates.length === 1) {
+    lines.push(`Suggested verifier command: ${candidates[0]}`);
+    lines.push("Review it, then add:");
+    lines.push("verify:");
+    lines.push(`  command: "${candidates[0]}"`);
+    lines.push("  budget: 300");
+  } else if (candidates.length > 1) {
+    lines.push(`Detected verifier candidates: ${candidates.join(", ")}`);
+    lines.push("Choose the suite that defines merge authority, then add for example:");
+    lines.push("verify:");
+    lines.push('  command: "<reviewed suite command>"');
+    lines.push("  budget: 300");
+  } else {
+    lines.push("Add the reviewed suite command to .tamperward.yml, for example:");
+    lines.push("verify:");
+    lines.push('  command: "<your test command>"');
+    lines.push("  budget: 300");
+  }
+  lines.push("TamperWard does not write an inferred verifier command automatically because it is part of the trust anchor.");
+  return lines.join("\n");
+}
 function planPolicy(cwd) {
   const path = join12(cwd, POLICY_FILE);
   if (existsSync9(path)) {
@@ -8563,6 +8635,10 @@ WARNING (${a.item}): ${a.warning}
   }
   const errors = plan.filter((a) => a.status === "error");
   const changed = opts.dryRun ? plan.filter((a) => a.apply).length : applied;
+  w.write(`
+VERIFICATION SETUP
+${verifierSetupMessage(cwd)}
+`);
   if (errors.length) {
     w.write(`
 tamperward init: ${errors.length} item(s) need your attention above; the rest ${opts.dryRun ? "are planned" : "were applied"}.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.16.0",
+  "version": "2.16.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",