tamperward 2.16.3 → 2.16.4

package/README.md

@@ -220,11 +220,12 @@ BROKEN platform posture rather than misdiagnosing it as a missing Python install
 `--agent-budget <seconds>`
 adds an operator-owned wall-clock boundary around the same lifecycle (separate from the
 verifier's `--budget`). A clean timeout is `AGENT_TIMEOUT` / exit 124; enforcement or
-cannot-adjudicate still outranks it. Windows retains `taskkill /T /F`; other non-Linux
-platforms retain process-group/fingerprint/quiescence safeguards but do not claim the Linux
-subreaper boundary. A detached process that escapes those weaker platform controls remains
-an explicit residual tracked in **#379**, not part of the Linux guarantee.
-Dependency-attestation reuse remains disabled on all platforms.
+cannot-adjudicate still outranks it. **From 2.16.4, `tamperward run` is Linux-only
+for authoritative lifecycle certification.** Windows, macOS and other non-Linux platforms
+fail closed before the agent starts because this release has no OS primitive there that can
+prove the detached execution domain is drained. Standalone `tamperward check` and
+`tamperward verify` remain available on those platforms. Dependency-attestation reuse
+remains disabled on all platforms.
 
 `tamperward verify` materialises two temporary copies — they are **not
 sandboxes**, and both execute agent-controlled code. The visible copy runs the

package/dist/cli/index.js

@@ -10601,6 +10601,9 @@ function parseVerify(args) {
 // src/cli/run.ts
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
+function authoritativeRunLifecyclePlatform(platform = process.platform) {
+  return platform === "linux";
+}
 function canReuseAdjacentDependencyAttestation(_lifecycleOwned, _platform = process.platform) {
   return false;
 }
@@ -11211,6 +11214,13 @@ function runEnvelope(opts) {
       return 2;
     }
   }
+  const lifecyclePlatform = opts.lifecyclePlatformOverride ?? process.platform;
+  if (!authoritativeRunLifecyclePlatform(lifecyclePlatform)) {
+    err(
+      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. Use standalone tamperward check/verify or an isolated execution domain.`
+    );
+    return 2;
+  }
   const verifierBackend = prepareVerifierBackend(frozenPolicy.verify);
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
   out(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
@@ -11427,14 +11437,14 @@ function lifecyclePlatformCheck(platform = process.platform, linuxPython = platf
   if (platform === "win32") {
     return {
       id: "platform",
-      state: "WARN",
-      detail: "Windows: taskkill /T /F is a best-effort tree fallback, not the Linux subreaper/ECHILD boundary; detached-domain residual tracked in #379 and verifier-entry attestation reuse stays disabled"
+      state: "BROKEN",
+      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check/verify remain available."
     };
   }
   return {
     id: "platform",
-    state: "WARN",
-    detail: `${platform}: POSIX process-group/fingerprint/quiescence safeguards are available, but the Linux subreaper/ECHILD detached-domain boundary is unavailable; residual tracked in #379 and verifier-entry attestation reuse stays disabled`
+    state: "BROKEN",
+    detail: `${platform}: authoritative tamperward run lifecycle ownership is unavailable because this release has no subreaper/ECHILD-equivalent backend; run fails closed before agent start. Standalone check/verify remain available.`
   };
 }
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.16.3",
+  "version": "2.16.4",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",