tamperward 2.16.4 → 2.17.0

package/README.md

@@ -223,9 +223,31 @@ verifier's `--budget`). A clean timeout is `AGENT_TIMEOUT` / exit 124; enforceme
 cannot-adjudicate still outranks it. **From 2.16.4, `tamperward run` is Linux-only
 for authoritative lifecycle certification.** Windows, macOS and other non-Linux platforms
 fail closed before the agent starts because this release has no OS primitive there that can
-prove the detached execution domain is drained. Standalone `tamperward check` and
-`tamperward verify` remain available on those platforms. Dependency-attestation reuse
-remains disabled on all platforms.
+prove the detached execution domain is drained. From **2.16.5**, checkpointed-local
+`tamperward verify` also has an explicit host-shell contract: Linux, macOS and the
+supported POSIX Node platforms use `/bin/sh -c`; Windows local verification fails closed
+before candidate execution rather than depending on an incidental MSYS/Git-for-Windows
+`sh` on PATH. A digest-pinned container verifier is a separate backend and must pass its
+own Docker authority preflight. Dependency-attestation reuse remains disabled on all
+platforms.
+
+### Platform support
+
+| Capability | Linux | macOS | Windows |
+| --- | --- | --- | --- |
+| `check` / policy evaluation | Supported | Supported | Supported |
+| Claude hook / Stop adapter | Supported where Claude Code command hooks are available | Same | Same |
+| `watch` / observer telemetry | Supported; backend health is reported | Supported/degraded according to `fs.watch` health | Supported/degraded according to `fs.watch` health |
+| checkpointed-local `verify` | Supported via `/bin/sh` | Supported via `/bin/sh` | **Unsupported; fails before candidate execution** |
+| isolated-container `verify` | Supported when Docker authority preflight passes | Not claimed beyond Docker preflight | Not claimed beyond Docker preflight |
+| authoritative `run` | **Supported only with trusted non-root subreaper backend** | **Unsupported; fails before agent start** | **Unsupported; fails before agent start** |
+| CI coverage for this contract | Full suite + platform contract | Platform-contract job | Platform-contract job |
+
+The platform-contract CI job runs on real `ubuntu-latest`, `macos-latest` and
+`windows-latest` hosts. It verifies the declared shell/lifecycle selection and proves
+that Windows local verification refuses before a candidate command can produce a side
+effect. This matrix is intentionally narrower than the Linux adversarial suite; it tests
+the support boundary rather than implying feature parity where none is claimed.
 
 `tamperward verify` materialises two temporary copies — they are **not
 sandboxes**, and both execute agent-controlled code. The visible copy runs the
@@ -483,17 +505,20 @@ option can never be reinterpreted as the agent command.
 
 ### The rules
 
-Seventeen rules are specified and fifteen ship (see the table in
+Seventeen rules are specified and sixteen ship (see the table in
 [SPEC.md](./SPEC.md)). The families: test protection (`test-deletion`,
-`test-skip`, `test-content-removal`), verification-signal protection
+`test-skip`, `test-content-removal`, plus the warning-only JS/TS
+`assertion-weakening` heuristic), verification-signal protection
 (`coverage-lowering`, `snapshot-rewrite`, `snapshot-only-rewrite`), suppression
 (`ts-any-cast`, `ts-any-launder`, `lint-suppression`), pipeline protection
 (`ci-tampering`, `hook-tampering`, `no-verify`), and the effect/outcome layers
 (`transient-protected-mutation`, `pristine-verification`, plus the `run` envelope).
-Some ambiguous syntactic classes deliberately remain warnings or unimplemented —
-`assertion-weakening` and `guard-removal` are reserved names with no detector, and
-`ts-any-launder` is a permanent warn — rather than being promoted to blockers
-without precision evidence.
+`assertion-weakening` ships only the AST-proven one-way subset — statically
+proven exact/structural values weakened to truthy/defined, positive exception
+specificity removed, or a pure assertion removed from the same suite-qualified
+test. It measured 12/12 true-positive fires with 0/20 false positives on the
+committed detector-specific replay and remains `warn`; `guard-removal` is still
+reserved with no detector, and `ts-any-launder` is a permanent warn.
 
 ## What Tamperward does not do
 

package/dist/cli/index.js

@@ -6201,6 +6201,214 @@ var snapshotOnlyRewrite = {
   }
 };
 
+// src/detectors/assertion-weakening.ts
+import ts6 from "typescript";
+var RULE11 = "assertion-weakening";
+var TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
+var SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite", "context"]);
+var EXACT_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toMatchObject"]);
+var WEAK_MATCHERS = /* @__PURE__ */ new Set(["toBeTruthy", "toBeDefined"]);
+var compact = (s) => s.replace(/\s+/g, "");
+function literalTitle(node) {
+  if (!node) return null;
+  if (ts6.isStringLiteral(node) || ts6.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  return null;
+}
+function scriptKindForPath(path) {
+  const lower = path.toLowerCase();
+  if (lower.endsWith(".tsx")) return ts6.ScriptKind.TSX;
+  if (lower.endsWith(".ts") || lower.endsWith(".mts") || lower.endsWith(".cts")) {
+    return ts6.ScriptKind.TS;
+  }
+  if (lower.endsWith(".jsx")) return ts6.ScriptKind.JSX;
+  return ts6.ScriptKind.JS;
+}
+function staticFacts(node) {
+  if (!node) return null;
+  if (node.kind === ts6.SyntaxKind.TrueKeyword) return { defined: true, truthy: true };
+  if (node.kind === ts6.SyntaxKind.FalseKeyword) return { defined: true, truthy: false };
+  if (node.kind === ts6.SyntaxKind.NullKeyword) return { defined: true, truthy: false };
+  if (ts6.isIdentifier(node) && node.text === "undefined") {
+    return { defined: false, truthy: false };
+  }
+  if (ts6.isVoidExpression(node)) return { defined: false, truthy: false };
+  if (ts6.isStringLiteral(node) || ts6.isNoSubstitutionTemplateLiteral(node)) {
+    return { defined: true, truthy: node.text.length > 0 };
+  }
+  if (ts6.isNumericLiteral(node)) {
+    return { defined: true, truthy: Number(node.text) !== 0 };
+  }
+  if (ts6.isBigIntLiteral(node)) {
+    return { defined: true, truthy: node.text.replace(/n$/i, "") !== "0" };
+  }
+  if (ts6.isPrefixUnaryExpression(node) && (node.operator === ts6.SyntaxKind.MinusToken || node.operator === ts6.SyntaxKind.PlusToken) && ts6.isNumericLiteral(node.operand)) {
+    const value = Number(node.operand.text) * (node.operator === ts6.SyntaxKind.MinusToken ? -1 : 1);
+    return { defined: true, truthy: value !== 0 };
+  }
+  if (ts6.isObjectLiteralExpression(node) || ts6.isArrayLiteralExpression(node) || ts6.isRegularExpressionLiteral(node) || ts6.isArrowFunction(node) || ts6.isFunctionExpression(node) || ts6.isClassExpression(node) || ts6.isNewExpression(node)) {
+    return { defined: true, truthy: true };
+  }
+  return null;
+}
+function expectAssertion(node, sf) {
+  if (!ts6.isPropertyAccessExpression(node.expression)) return null;
+  const matcher = node.expression.name.text;
+  let receiver = node.expression.expression;
+  let polarity = "";
+  if (ts6.isPropertyAccessExpression(receiver) && receiver.name.text === "not") {
+    polarity = "not";
+    receiver = receiver.expression;
+  }
+  if (!ts6.isCallExpression(receiver) || !ts6.isIdentifier(receiver.expression) || receiver.expression.text !== "expect" || receiver.arguments.length !== 1) {
+    return null;
+  }
+  const subject = compact(receiver.arguments[0].getText(sf));
+  const args = node.arguments.map((arg) => compact(arg.getText(sf)));
+  return {
+    subject,
+    polarity,
+    matcher,
+    args,
+    firstArgFacts: staticFacts(node.arguments[0]),
+    canonical: [subject, polarity, matcher, ...args].join("|"),
+    text: node.getText(sf).replace(/\s+/g, " ")
+  };
+}
+function simpleCallName(node) {
+  return ts6.isIdentifier(node.expression) ? node.expression.text : null;
+}
+function callbackFor(node) {
+  const cb = node.arguments[1];
+  return cb && (ts6.isArrowFunction(cb) || ts6.isFunctionExpression(cb)) ? cb : null;
+}
+function blocks(src, path) {
+  const out2 = /* @__PURE__ */ new Map();
+  if (langOf(path) !== "js") return out2;
+  try {
+    const sf = ts6.createSourceFile(path, src, ts6.ScriptTarget.Latest, true, scriptKindForPath(path));
+    const visit = (node, suites) => {
+      if (ts6.isCallExpression(node)) {
+        const call = simpleCallName(node);
+        const title = literalTitle(node.arguments[0]);
+        const cb = callbackFor(node);
+        if (call && SUITE_CALLS.has(call) && title !== null && cb) {
+          const nextSuites = [...suites, title];
+          ts6.forEachChild(cb, (child) => visit(child, nextSuites));
+          return;
+        }
+        if (call && TEST_CALLS.has(call) && title !== null && cb) {
+          const assertions = [];
+          const collect2 = (child) => {
+            if (child !== cb && ts6.isCallExpression(child)) {
+              const nestedCall = simpleCallName(child);
+              if (nestedCall && (TEST_CALLS.has(nestedCall) || SUITE_CALLS.has(nestedCall))) {
+                return;
+              }
+            }
+            if (ts6.isCallExpression(child)) {
+              const a = expectAssertion(child, sf);
+              if (a) assertions.push(a);
+            }
+            ts6.forEachChild(child, collect2);
+          };
+          collect2(cb);
+          const identity2 = [...suites, title].join(" > ");
+          const list2 = out2.get(identity2) ?? [];
+          list2.push({ title, identity: identity2, assertions });
+          out2.set(identity2, list2);
+          return;
+        }
+      }
+      ts6.forEachChild(node, (child) => visit(child, suites));
+    };
+    visit(sf, []);
+  } catch {
+  }
+  return out2;
+}
+function pureRemoval(before, after) {
+  if (after.length >= before.length) return null;
+  const remaining = /* @__PURE__ */ new Map();
+  for (const a of before) remaining.set(a.canonical, (remaining.get(a.canonical) ?? 0) + 1);
+  for (const a of after) {
+    const n = remaining.get(a.canonical) ?? 0;
+    if (n <= 0) return null;
+    remaining.set(a.canonical, n - 1);
+  }
+  for (const a of before) {
+    const n = remaining.get(a.canonical) ?? 0;
+    if (n > 0) return a;
+  }
+  return null;
+}
+function factsProveWeakMatcher(oldA, newMatcher) {
+  if (!EXACT_MATCHERS.has(oldA.matcher) || oldA.args.length !== 1) return false;
+  const facts = oldA.firstArgFacts;
+  if (!facts) return false;
+  if (newMatcher === "toBeDefined") return facts.defined;
+  if (newMatcher === "toBeTruthy") return facts.truthy === true;
+  return false;
+}
+function directionalWeakening(before, after) {
+  for (const oldA of before) {
+    for (const newA of after) {
+      if (oldA.subject !== newA.subject) continue;
+      if (oldA.polarity !== "" || newA.polarity !== "") continue;
+      if (WEAK_MATCHERS.has(newA.matcher) && newA.args.length === 0 && factsProveWeakMatcher(oldA, newA.matcher)) {
+        return { before: oldA, after: newA, kind: "matcher" };
+      }
+      if (oldA.matcher === "toThrow" && oldA.args.length > 0 && newA.matcher === "toThrow" && newA.args.length === 0) {
+        return { before: oldA, after: newA, kind: "throw-specificity" };
+      }
+    }
+  }
+  return null;
+}
+function findingForBlock(path, before, after, policy) {
+  const weakened = directionalWeakening(before.assertions, after.assertions);
+  if (weakened) {
+    const message = weakened.kind === "throw-specificity" ? `Assertion weakened in test "${before.identity}": exception-message specificity was removed from toThrow().` : `Assertion weakened in test "${before.identity}": ${weakened.before.matcher} was replaced by weaker ${weakened.after.matcher} on the same subject.`;
+    return makeFinding(RULE11, policy, {
+      file: path,
+      message,
+      evidence: `${weakened.before.text} -> ${weakened.after.text}`,
+      remediation: "Keep the stronger expectation and fix the code under test. If the contract genuinely changed, review the test change explicitly; this rule is warning-only while its precision is measured."
+    });
+  }
+  const removed = pureRemoval(before.assertions, after.assertions);
+  if (removed) {
+    return makeFinding(RULE11, policy, {
+      file: path,
+      message: `Assertion removed from kept test "${before.identity}" without a replacement assertion.`,
+      evidence: removed.text,
+      remediation: "Keep the assertion and fix the code under test. If the assertion is genuinely obsolete, review the test change explicitly; this rule is warning-only while its precision is measured."
+    });
+  }
+  return null;
+}
+var assertionWeakening = {
+  id: RULE11,
+  surface: ["file"],
+  certainty: "heuristic",
+  run(changes, policy) {
+    const out2 = [];
+    for (const c of changes) {
+      if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null || langOf(c.path) !== "js" || !isProtected(c.path, policy, "tests") || isProtected(c.path, policy, "snapshots")) {
+        continue;
+      }
+      const beforeBlocks = blocks(c.before, c.path);
+      const afterBlocks = blocks(c.after, c.path);
+      for (const [identity2, oldList] of beforeBlocks) {
+        const newList = afterBlocks.get(identity2);
+        if (!newList || oldList.length !== 1 || newList.length !== 1) continue;
+        const f = findingForBlock(c.path, oldList[0], newList[0], policy);
+        if (f) out2.push(f);
+      }
+    }
+    return out2;
+  }
+};
+
 // src/detectors/index.ts
 var allDetectors = [
   noVerify,
@@ -6213,7 +6421,8 @@ var allDetectors = [
   testDeletion,
   testContentRemoval,
   snapshotRewrite,
-  snapshotOnlyRewrite
+  snapshotOnlyRewrite,
+  assertionWeakening
 ];
 
 // src/engine.ts
@@ -6575,9 +6784,9 @@ function orderFindings(findings) {
     return (a.line ?? 0) - (b.line ?? 0);
   });
 }
-function countsPhrase(blocks, warns) {
+function countsPhrase(blocks2, warns) {
   const parts = [];
-  if (blocks) parts.push(`${blocks} blocking`);
+  if (blocks2) parts.push(`${blocks2} blocking`);
   if (warns) parts.push(`${warns} warning${warns === 1 ? "" : "s"}`);
   return parts.join(", ");
 }
@@ -6589,7 +6798,7 @@ var SIGNOFF_NOTE = "A blocking finding clears only with a human sign-off. In CI
 function renderText(input, opts) {
   const { scanned, ignoredFiles } = input;
   const findings = orderFindings(input.findings);
-  const blocks = findings.filter((f) => f.severity === "block");
+  const blocks2 = findings.filter((f) => f.severity === "block");
   const warns = findings.filter((f) => f.severity === "warn");
   const c = opts.colour;
   const out2 = [];
@@ -6597,8 +6806,8 @@ function renderText(input, opts) {
     return `${paint("tamperward: clean", GREEN, c)} \u2014 no integrity findings (${scopePhrase(scanned, ignoredFiles)}).
 `;
   }
-  const headColour = blocks.length ? RED : YELLOW;
-  out2.push(paint(`tamperward: ${countsPhrase(blocks.length, warns.length)}`, BOLD + headColour, c));
+  const headColour = blocks2.length ? RED : YELLOW;
+  out2.push(paint(`tamperward: ${countsPhrase(blocks2.length, warns.length)}`, BOLD + headColour, c));
   out2.push(paint(`(${scopePhrase(scanned, ignoredFiles)})`, DIM, c));
   out2.push("");
   const LABEL = "sign-off".length;
@@ -6618,7 +6827,7 @@ function renderText(input, opts) {
     if (f.signoff.required) row("sign-off", [stripControl(f.signoff.command)]);
     out2.push("");
   }
-  if (blocks.length > 0) {
+  if (blocks2.length > 0) {
     out2.push(
       wrap(SIGNOFF_NOTE, opts.width - 2).map((l) => paint(l, DIM, c)).join("\n")
     );
@@ -6668,7 +6877,7 @@ function locationCell(f, env) {
 }
 function renderSummary(input, env = process.env) {
   const findings = orderFindings(input.findings);
-  const blocks = findings.filter((f) => f.severity === "block");
+  const blocks2 = findings.filter((f) => f.severity === "block");
   const warns = findings.filter((f) => f.severity === "warn");
   const scope = scopePhrase(input.scanned, input.ignoredFiles);
   if (findings.length === 0) {
@@ -6678,7 +6887,7 @@ No integrity findings (${scope}).
 `;
   }
   const out2 = [
-    `## Tamperward: ${countsPhrase(blocks.length, warns.length)}`,
+    `## Tamperward: ${countsPhrase(blocks2.length, warns.length)}`,
     "",
     `${scope}. Every finding below is also annotated on the diff in **Files changed**.`,
     "",
@@ -6731,12 +6940,12 @@ function report(input) {
   const { findings, scanned, ignoredFiles } = input;
   const format = resolveFormat(input);
   if (format === "json") {
-    const blocks = findings.filter((f) => f.severity === "block").length;
+    const blocks2 = findings.filter((f) => f.severity === "block").length;
     process.stdout.write(
       JSON.stringify(
         // `findings`, `scanned` and `ignoredFiles` keep their exact prior shape; `summary`
         // is additive, so an existing consumer reading only the old keys is unaffected.
-        { findings, scanned, ignoredFiles, summary: { block: blocks, warn: findings.length - blocks } },
+        { findings, scanned, ignoredFiles, summary: { block: blocks2, warn: findings.length - blocks2 } },
         null,
         2
       ) + "\n"
@@ -6833,10 +7042,10 @@ import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writ
 import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
-function formatDenial(blocks) {
-  const lead = blocks[0];
+function formatDenial(blocks2) {
+  const lead = blocks2[0];
   const lines = ["Tamperward blocked this change \u2014 it weakens a protected safety net to pass checks.", ""];
-  for (const f of blocks) {
+  for (const f of blocks2) {
     const loc = f.file ? ` (${escapeControl(f.file)}${f.line ? `:${f.line}` : ""})` : "";
     lines.push(`  \u2022 ${f.rule}${loc}: ${f.message}`);
   }
@@ -6845,7 +7054,7 @@ function formatDenial(blocks) {
   lines.push(
     "The other shortcuts are blocked too: skipping the hooks, editing the hook or CI workflow, lowering the coverage gate, and rewriting a protected file from the shell will each be denied."
   );
-  if (blocks.some((b) => b.signoff.required)) {
+  if (blocks2.some((b) => b.signoff.required)) {
     lines.push(`If this change is genuinely correct, a human must sign off: ${lead.signoff.command}`);
   }
   return lines.join("\n") + "\n";
@@ -7263,7 +7472,7 @@ function runWatch(args) {
 
 // src/detectors/fs-events.ts
 import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
-var RULE11 = "transient-protected-mutation";
+var RULE12 = "transient-protected-mutation";
 var MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
 var MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
 var DEFAULT_EVENT_READ_IO = {
@@ -7458,7 +7667,7 @@ function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DE
   };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
-  if (!isEnabled(RULE11, policy)) return [];
+  if (!isEnabled(RULE12, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -7478,7 +7687,7 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
     const modeChurn = modes.size > 1;
     if (!contentChurn && !modeChurn) continue;
     const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
-    const f = makeFinding(RULE11, policy, {
+    const f = makeFinding(RULE12, policy, {
       file: path,
       message: `Transient protected mutation: ${what}, leaving no net diff.`,
       evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
@@ -7517,11 +7726,11 @@ function parseInput(raw) {
   }
   return parsed;
 }
-function recordDenylog(blocks) {
+function recordDenylog(blocks2) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync4(log, blocks.map((b) => b.rule).join(",") + "\n");
+    appendFileSync4(log, blocks2.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -7540,10 +7749,10 @@ function failClosed(kind, detail) {
   };
   return verdict([f], kind);
 }
-function verdict(blocks, kind) {
-  if (blocks.length === 0) return { exitCode: 0, stdout: "" };
-  recordDenylog(blocks);
-  const reason = formatDenial(blocks);
+function verdict(blocks2, kind) {
+  if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
+  recordDenylog(blocks2);
+  const reason = formatDenial(blocks2);
   const payload = kind === "PreToolUse" ? {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
@@ -7600,14 +7809,14 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
     if (c.oldPath) seen.add(c.oldPath);
   }
   const changes = [];
-  const blocks = [];
+  const blocks2 = [];
   const trusted = base ?? "HEAD";
   const candidates = base ? [base, "HEAD", ""] : ["HEAD", ""];
   for (const rel of [...d.changed, ...d.deleted]) {
     if (seen.has(rel)) continue;
     const unjudgeable = unjudgeableFinding(cwd, rel);
     if (unjudgeable) {
-      blocks.push(unjudgeable);
+      blocks2.push(unjudgeable);
       continue;
     }
     const after = fileOnDisk(rel, { cwd });
@@ -7627,7 +7836,7 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
       }
     }
     if (before == null) {
-      blocks.push({
+      blocks2.push({
         rule: "hidden-drift",
         severity: "block",
         file: rel,
@@ -7660,12 +7869,12 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
     if (seen.has(rel)) continue;
     const unjudgeable = unjudgeableFinding(cwd, rel);
     if (unjudgeable) {
-      blocks.push(unjudgeable);
+      blocks2.push(unjudgeable);
       continue;
     }
     const after = fileOnDisk(rel, { cwd });
     if (after == null) {
-      blocks.push({
+      blocks2.push({
         rule: "hidden-drift",
         severity: "block",
         file: rel,
@@ -7678,7 +7887,7 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
     }
     changes.push(...synthFileChange(rel, null, after));
   }
-  return { changes, blocks };
+  return { changes, blocks: blocks2 };
 }
 function effectDriftBlocks(cwd, sessionId, policy) {
   if (!sessionId || !isGitRepo(cwd)) return null;
@@ -7703,8 +7912,8 @@ function effectDriftBlocks(cwd, sessionId, policy) {
   );
   const gap = uncoveredDrift(cwd, policy, expected, current, scoped, base, loadTurnTree(cwd, sessionId));
   const judged = [...scoped, ...gap.changes];
-  const blocks = evaluate(judged, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks, unjudgeableProtected(cwd, policy, judged));
-  if (blocks.length > 0) return blocks;
+  const blocks2 = evaluate(judged, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks, unjudgeableProtected(cwd, policy, judged));
+  if (blocks2.length > 0) return blocks2;
   savePtree(cwd, sessionId, current);
   return null;
 }
@@ -7736,9 +7945,9 @@ function preToolUseVerdict(input) {
     const driftBlocks = effectDriftBlocks(cwd, input.session_id, policy);
     if (driftBlocks) return verdict(driftBlocks, "PreToolUse");
     const changes = changesFromClaudeHook(input, cwd);
-    const blocks = evaluate(changes, policy, void 0, "tool-call", { cwd }).filter((f) => f.severity === "block");
-    if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
-    return verdict(blocks, "PreToolUse");
+    const blocks2 = evaluate(changes, policy, void 0, "tool-call", { cwd }).filter((f) => f.severity === "block");
+    if (blocks2.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
+    return verdict(blocks2, "PreToolUse");
   } catch (e) {
     return failClosed("PreToolUse", errText2(e));
   }
@@ -7840,7 +8049,7 @@ function stopVerdict(input) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const cwd = input.cwd ?? process.cwd();
   if (!isGitRepo(cwd)) return { exitCode: 0, stdout: "" };
-  let blocks;
+  let blocks2;
   let commitCursor = () => {
   };
   try {
@@ -7855,22 +8064,22 @@ function stopVerdict(input) {
       changes = changes.concat(gap.changes);
       hiddenBlocks = gap.blocks;
     }
-    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks, unjudgeableProtected(cwd, policy, changes));
+    blocks2 = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks, unjudgeableProtected(cwd, policy, changes));
     const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
-    blocks = blocks.concat(transient.blocks);
+    blocks2 = blocks2.concat(transient.blocks);
     commitCursor = transient.commit;
-    if (blocks.length === 0 && input.session_id && current) {
+    if (blocks2.length === 0 && input.session_id && current) {
       savePtree(cwd, input.session_id, current);
       saveTurnTree(cwd, input.session_id, current);
     }
   } catch (e) {
     return failClosed("Stop", errText2(e));
   }
-  if (blocks.length === 0) {
+  if (blocks2.length === 0) {
     advanceTurnBaseline(cwd, input.session_id);
     commitCursor();
   }
-  return verdict(blocks, "Stop");
+  return verdict(blocks2, "Stop");
 }
 function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
@@ -10218,15 +10427,37 @@ function suiteEnv(scratch) {
   env.YARN_IGNORE_PATH = "1";
   return env;
 }
+function localVerifierShell(platform = process.platform, command) {
+  switch (platform) {
+    case "linux":
+    case "darwin":
+    case "freebsd":
+    case "openbsd":
+    case "aix":
+    case "sunos":
+      return { executable: "/bin/sh", args: ["-c", command] };
+    default:
+      return null;
+  }
+}
 function runLocalSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
+  const shell = localVerifierShell(process.platform, cmd);
+  if (!shell) {
+    return {
+      exit: null,
+      secs: 0,
+      failure: "backend",
+      reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
+    };
+  }
   const scratch = mkdtempSync3(join16(tmpdir3(), "tw-verify-run-"));
   try {
-    const r = runCapturedProcessSync("sh", ["-c", cmd], {
+    const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
       env: suiteEnv(scratch),
       timeoutMs: budgetSecs * 1e3,
-      detached: process.platform !== "win32",
+      detached: true,
       killGroupOnFinish: true,
       backstopMs: 3e4
     });
@@ -10339,6 +10570,22 @@ function runVerify(opts) {
     return 2;
   }
   const isolated = verifierBackend.kind === "container";
+  if (!isolated && !localVerifierShell(process.platform, cmd)) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "LOCAL_VERIFIER_UNSUPPORTED_PLATFORM",
+        platform: process.platform,
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
+      }));
+    } else {
+      out2(
+        `verify: checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined. Failing closed before candidate execution.`
+      );
+    }
+    return 2;
+  }
   const dependencyEnvironment = isolated ? null : opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
   const dependencyReport = () => dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : {
     status: "verifier-owned",
@@ -10604,6 +10851,12 @@ var err = (s) => process.stderr.write(s + "\n");
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
+function waitForSettleSync(seconds) {
+  if (!Number.isFinite(seconds) || seconds <= 0) return;
+  const ms = Math.ceil(seconds * 1e3);
+  const word = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  Atomics.wait(word, 0, 0, ms);
+}
 function canReuseAdjacentDependencyAttestation(_lifecycleOwned, _platform = process.platform) {
   return false;
 }
@@ -11216,8 +11469,9 @@ function runEnvelope(opts) {
   }
   const lifecyclePlatform = opts.lifecyclePlatformOverride ?? process.platform;
   if (!authoritativeRunLifecyclePlatform(lifecyclePlatform)) {
+    const alternative = lifecyclePlatform === "win32" ? "Use standalone tamperward check; checkpointed-local verify is unsupported on Windows, while container verify must pass its own Docker authority preflight." : "Use standalone tamperward check/verify or an isolated execution domain.";
     err(
-      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. Use standalone tamperward check/verify or an isolated execution domain.`
+      `tamperward run: authoritative agent lifecycle ownership is unavailable on ${lifecyclePlatform}; this release only certifies run on Linux with the trusted subreaper/ECHILD backend. Failing closed before the agent starts. ${alternative}`
     );
     return 2;
   }
@@ -11339,10 +11593,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
     verifierBackend
   });
   if (opts.settle && opts.settle > 0) {
-    try {
-      execFileSync9("sleep", [String(opts.settle)]);
-    } catch {
-    }
+    waitForSettleSync(opts.settle);
   }
   const mutatedDuringAdjudication = treeFingerprint(cwd, protectedIgnored) !== fpBefore;
   if (mutatedDuringAdjudication) {
@@ -11438,7 +11689,7 @@ function lifecyclePlatformCheck(platform = process.platform, linuxPython = platf
     return {
       id: "platform",
       state: "BROKEN",
-      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check/verify remain available."
+      detail: "Windows: authoritative tamperward run lifecycle ownership is unavailable; taskkill /T /F is only a best-effort tree fallback, so run fails closed before agent start. Standalone check remains available; checkpointed-local verify is unsupported because this release defines verifier command semantics only through POSIX /bin/sh. A container verifier must pass its own Docker authority preflight."
     };
   }
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.16.4",
+  "version": "2.17.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",