tamperward 2.16.3 → 2.16.5

package/README.md

@@ -220,11 +220,34 @@ BROKEN platform posture rather than misdiagnosing it as a missing Python install
 `--agent-budget <seconds>`
 adds an operator-owned wall-clock boundary around the same lifecycle (separate from the
 verifier's `--budget`). A clean timeout is `AGENT_TIMEOUT` / exit 124; enforcement or
-cannot-adjudicate still outranks it. Windows retains `taskkill /T /F`; other non-Linux
-platforms retain process-group/fingerprint/quiescence safeguards but do not claim the Linux
-subreaper boundary. A detached process that escapes those weaker platform controls remains
-an explicit residual tracked in **#379**, not part of the Linux guarantee.
-Dependency-attestation reuse remains disabled on all platforms.
+cannot-adjudicate still outranks it. **From 2.16.4, `tamperward run` is Linux-only
+for authoritative lifecycle certification.** Windows, macOS and other non-Linux platforms
+fail closed before the agent starts because this release has no OS primitive there that can
+prove the detached execution domain is drained. From **2.16.5**, checkpointed-local
+`tamperward verify` also has an explicit host-shell contract: Linux, macOS and the
+supported POSIX Node platforms use `/bin/sh -c`; Windows local verification fails closed
+before candidate execution rather than depending on an incidental MSYS/Git-for-Windows
+`sh` on PATH. A digest-pinned container verifier is a separate backend and must pass its
+own Docker authority preflight. Dependency-attestation reuse remains disabled on all
+platforms.
+
+### Platform support
+
+| Capability | Linux | macOS | Windows |
+| --- | --- | --- | --- |
+| `check` / policy evaluation | Supported | Supported | Supported |
+| Claude hook / Stop adapter | Supported where Claude Code command hooks are available | Same | Same |
+| `watch` / observer telemetry | Supported; backend health is reported | Supported/degraded according to `fs.watch` health | Supported/degraded according to `fs.watch` health |
+| checkpointed-local `verify` | Supported via `/bin/sh` | Supported via `/bin/sh` | **Unsupported; fails before candidate execution** |
+| isolated-container `verify` | Supported when Docker authority preflight passes | Not claimed beyond Docker preflight | Not claimed beyond Docker preflight |
+| authoritative `run` | **Supported only with trusted non-root subreaper backend** | **Unsupported; fails before agent start** | **Unsupported; fails before agent start** |
+| CI coverage for this contract | Full suite + platform contract | Platform-contract job | Platform-contract job |
+
+The platform-contract CI job runs on real `ubuntu-latest`, `macos-latest` and
+`windows-latest` hosts. It verifies the declared shell/lifecycle selection and proves
+that Windows local verification refuses before a candidate command can produce a side
+effect. This matrix is intentionally narrower than the Linux adversarial suite; it tests
+the support boundary rather than implying feature parity where none is claimed.
 
 `tamperward verify` materialises two temporary copies — they are **not
 sandboxes**, and both execute agent-controlled code. The visible copy runs the

package/dist/cli/index.js

@@ -10218,15 +10218,37 @@ function suiteEnv(scratch) {
   env.YARN_IGNORE_PATH = "1";
   return env;
 }
+function localVerifierShell(platform = process.platform, command) {
+  switch (platform) {
+    case "linux":
+    case "darwin":
+    case "freebsd":
+    case "openbsd":
+    case "aix":
+    case "sunos":
+      return { executable: "/bin/sh", args: ["-c", command] };
+    default:
+      return null;
+  }
+}
 function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
+  const shell = localVerifierShell(process.platform, cmd);
+  if (!shell) {
+    return {
+      exit: null,
+      secs: 0,
+      failure: "backend",
+      reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
+    };
+  }
   const scratch = mkdtempSync3(join16(tmpdir3(), "tw-verify-run-"));
   try {
-    const r = runCapturedProcessSync("sh", ["-c", cmd], {
+    const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
       env: suiteEnv(scratch),
       timeoutMs: budgetSecs * 1e3,
-      detached: process.platform !== "win32",
+      detached: true,
       killGroupOnFinish: true,
       backstopMs: 3e4
     });
@@ -10339,6 +10361,22 @@ function runVerify(opts) {
     return 2;
   }
   const isolated = verifierBackend.kind === "container";
+  if (!isolated && !localVerifierShell(process.platform, cmd)) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "LOCAL_VERIFIER_UNSUPPORTED_PLATFORM",
+        platform: process.platform,
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
+      }));
+    } else {
+      out2(
+        `verify: checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined. Failing closed before candidate execution.`
+      );
+    }
+    return 2;
+  }
   const dependencyEnvironment = isolated ? null : opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
   const dependencyReport = () => dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : {
     status: "verifier-owned",
@@ -10601,6 +10639,15 @@ function parseVerify(args) {
 // src/cli/run.ts
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
+function authoritativeRunLifecyclePlatform(platform = process.platform) {
+  return platform === "linux";
+}
+function waitForSettleSync(seconds) {
+  if (!Number.isFinite(seconds) || seconds <= 0) return;
+  const ms = Math.ceil(seconds * 1e3);
+  const word = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  Atomics.wait(word, 0, 0, ms);
+}
 function canReuseAdjacentDependencyAttestation(_lifecycleOwned, _platform = process.platform) {
   return false;
 }
@@ -11211,6 +11258,14 @@ function runEnvelope(opts) {
       return 2;
     }
   }
+  const lifecyclePlatform = opts.lifecyclePlatformOverride ?? process.platform;
+  if (!authoritativeRunLifecyclePlatform(lifecyclePlatform)) {
+    const alternative = lifecyclePlatform === "win32" ? "Use standalone tamperward check; checkpointed-local verify is unsupported on Windows, while container verify must pass its own Docker authority preflight." : "Use standalone tamperward check/verify or an isolated execution domain.";
+    err(
+      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. ${alternative}`
+    );
+    return 2;
+  }
   const verifierBackend = prepareVerifierBackend(frozenPolicy.verify);
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
   out(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
@@ -11329,10 +11384,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     verifierBackend
   });
   if (opts.settle && opts.settle > 0) {
-    try {
-      execFileSync9("sleep", [String(opts.settle)]);
-    } catch {
-    }
+    waitForSettleSync(opts.settle);
   }
   const mutatedDuringAdjudication = treeFingerprint(cwd, protectedIgnored) !== fpBefore;
   if (mutatedDuringAdjudication) {
@@ -11427,14 +11479,14 @@ function lifecyclePlatformCheck(platform = process.platform, linuxPython = platf
   if (platform === "win32") {
     return {
       id: "platform",
-      state: "WARN",
-      detail: "Windows: taskkill /T /F is a best-effort tree fallback, not the Linux subreaper/ECHILD boundary; detached-domain residual tracked in #379 and verifier-entry attestation reuse stays disabled"
+      state: "BROKEN",
+      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check remains available; checkpointed-local verify is unsupported because this release defines verifier command semantics only through POSIX /bin/sh. A container verifier must pass its own Docker authority preflight."
     };
   }
   return {
     id: "platform",
-    state: "WARN",
-    detail: `${platform}: POSIX process-group/fingerprint/quiescence safeguards are available, but the Linux subreaper/ECHILD detached-domain boundary is unavailable; residual tracked in #379 and verifier-entry attestation reuse stays disabled`
+    state: "BROKEN",
+    detail: `${platform}: authoritative tamperward run lifecycle ownership is unavailable because this release has no subreaper/ECHILD-equivalent backend; run fails closed before agent start. Standalone check/verify remain available.`
   };
 }
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.16.3",
+  "version": "2.16.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",