tamperward 2.16.4 → 2.16.5

package/README.md

@@ -223,9 +223,31 @@ verifier's `--budget`). A clean timeout is `AGENT_TIMEOUT` / exit 124; enforceme
 cannot-adjudicate still outranks it. **From 2.16.4, `tamperward run` is Linux-only
 for authoritative lifecycle certification.** Windows, macOS and other non-Linux platforms
 fail closed before the agent starts because this release has no OS primitive there that can
-prove the detached execution domain is drained. Standalone `tamperward check` and
-`tamperward verify` remain available on those platforms. Dependency-attestation reuse
-remains disabled on all platforms.
+prove the detached execution domain is drained. From **2.16.5**, checkpointed-local
+`tamperward verify` also has an explicit host-shell contract: Linux, macOS and the
+supported POSIX Node platforms use `/bin/sh -c`; Windows local verification fails closed
+before candidate execution rather than depending on an incidental MSYS/Git-for-Windows
+`sh` on PATH. A digest-pinned container verifier is a separate backend and must pass its
+own Docker authority preflight. Dependency-attestation reuse remains disabled on all
+platforms.
+
+### Platform support
+
+| Capability | Linux | macOS | Windows |
+| --- | --- | --- | --- |
+| `check` / policy evaluation | Supported | Supported | Supported |
+| Claude hook / Stop adapter | Supported where Claude Code command hooks are available | Same | Same |
+| `watch` / observer telemetry | Supported; backend health is reported | Supported/degraded according to `fs.watch` health | Supported/degraded according to `fs.watch` health |
+| checkpointed-local `verify` | Supported via `/bin/sh` | Supported via `/bin/sh` | **Unsupported; fails before candidate execution** |
+| isolated-container `verify` | Supported when Docker authority preflight passes | Not claimed beyond Docker preflight | Not claimed beyond Docker preflight |
+| authoritative `run` | **Supported only with trusted non-root subreaper backend** | **Unsupported; fails before agent start** | **Unsupported; fails before agent start** |
+| CI coverage for this contract | Full suite + platform contract | Platform-contract job | Platform-contract job |
+
+The platform-contract CI job runs on real `ubuntu-latest`, `macos-latest` and
+`windows-latest` hosts. It verifies the declared shell/lifecycle selection and proves
+that Windows local verification refuses before a candidate command can produce a side
+effect. This matrix is intentionally narrower than the Linux adversarial suite; it tests
+the support boundary rather than implying feature parity where none is claimed.
 
 `tamperward verify` materialises two temporary copies — they are **not
 sandboxes**, and both execute agent-controlled code. The visible copy runs the

package/dist/cli/index.js

@@ -10218,15 +10218,37 @@ function suiteEnv(scratch) {
   env.YARN_IGNORE_PATH = "1";
   return env;
 }
+function localVerifierShell(platform = process.platform, command) {
+  switch (platform) {
+    case "linux":
+    case "darwin":
+    case "freebsd":
+    case "openbsd":
+    case "aix":
+    case "sunos":
+      return { executable: "/bin/sh", args: ["-c", command] };
+    default:
+      return null;
+  }
+}
 function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
+  const shell = localVerifierShell(process.platform, cmd);
+  if (!shell) {
+    return {
+      exit: null,
+      secs: 0,
+      failure: "backend",
+      reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
+    };
+  }
   const scratch = mkdtempSync3(join16(tmpdir3(), "tw-verify-run-"));
   try {
-    const r = runCapturedProcessSync("sh", ["-c", cmd], {
+    const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
       env: suiteEnv(scratch),
       timeoutMs: budgetSecs * 1e3,
-      detached: process.platform !== "win32",
+      detached: true,
       killGroupOnFinish: true,
       backstopMs: 3e4
     });
@@ -10339,6 +10361,22 @@ function runVerify(opts) {
     return 2;
   }
   const isolated = verifierBackend.kind === "container";
+  if (!isolated && !localVerifierShell(process.platform, cmd)) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "LOCAL_VERIFIER_UNSUPPORTED_PLATFORM",
+        platform: process.platform,
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
+      }));
+    } else {
+      out2(
+        `verify: checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined. Failing closed before candidate execution.`
+      );
+    }
+    return 2;
+  }
   const dependencyEnvironment = isolated ? null : opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
   const dependencyReport = () => dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : {
     status: "verifier-owned",
@@ -10604,6 +10642,12 @@ var err = (s) => process.stderr.write(s + "\n");
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
+function waitForSettleSync(seconds) {
+  if (!Number.isFinite(seconds) || seconds <= 0) return;
+  const ms = Math.ceil(seconds * 1e3);
+  const word = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  Atomics.wait(word, 0, 0, ms);
+}
 function canReuseAdjacentDependencyAttestation(_lifecycleOwned, _platform = process.platform) {
   return false;
 }
@@ -11216,8 +11260,9 @@ function runEnvelope(opts) {
   }
   const lifecyclePlatform = opts.lifecyclePlatformOverride ?? process.platform;
   if (!authoritativeRunLifecyclePlatform(lifecyclePlatform)) {
+    const alternative = lifecyclePlatform === "win32" ? "Use standalone tamperward check; checkpointed-local verify is unsupported on Windows, while container verify must pass its own Docker authority preflight." : "Use standalone tamperward check/verify or an isolated execution domain.";
     err(
-      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. Use standalone tamperward check/verify or an isolated execution domain.`
+      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. ${alternative}`
     );
     return 2;
   }
@@ -11339,10 +11384,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     verifierBackend
   });
   if (opts.settle && opts.settle > 0) {
-    try {
-      execFileSync9("sleep", [String(opts.settle)]);
-    } catch {
-    }
+    waitForSettleSync(opts.settle);
   }
   const mutatedDuringAdjudication = treeFingerprint(cwd, protectedIgnored) !== fpBefore;
   if (mutatedDuringAdjudication) {
@@ -11438,7 +11480,7 @@ function lifecyclePlatformCheck(platform = process.platform, linuxPython = platf
     return {
       id: "platform",
       state: "BROKEN",
-      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check/verify remain available."
+      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check remains available; checkpointed-local verify is unsupported because this release defines verifier command semantics only through POSIX /bin/sh. A container verifier must pass its own Docker authority preflight."
     };
   }
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.16.4",
+  "version": "2.16.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",