tamperward 2.17.1 → 2.19.0

package/dist/cli/index.js

@@ -2010,8 +2010,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve9) {
-  const obj = resolve9(expr);
+function metricsOf(expr, resolve10) {
+  const obj = resolve10(expr);
   if (!ts3.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -2025,7 +2025,7 @@ function metricsOf(expr, resolve9) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve9(p.initializer));
+    const n = numericOf(resolve10(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -2071,17 +2071,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve9 = resolverFor(sf);
+    const resolve10 = resolverFor(sf);
     const visit = (node) => {
       if (ts3.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve9(node.initializer);
+          const init = resolve10(node.initializer);
           if (!ts3.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve9);
+            const flat = metricsOf(init, resolve10);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts3.isSpreadAssignment(p)) {
@@ -2095,7 +2095,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve9);
+              const m = metricsOf(p.initializer, resolve10);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -2128,18 +2128,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve9 = resolverFor(sf);
+    const resolve10 = resolverFor(sf);
     const visit = (node) => {
       if (ts3.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve9(node.initializer));
+          const { items, opaque } = literals(resolve10(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve9(node.initializer));
+          const { items, opaque } = literals(resolve10(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -7084,6 +7084,12 @@ function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
 }
 
+// src/machine-output.ts
+var MACHINE_SCHEMA_VERSION = 1;
+function machineOutput(payload) {
+  return { ...payload, schema_version: MACHINE_SCHEMA_VERSION };
+}
+
 // src/cli/render/text.ts
 var ESC = "\x1B";
 var RESET = `${ESC}[0m`;
@@ -7303,7 +7309,7 @@ function report(input) {
       JSON.stringify(
         // `findings`, `scanned` and `ignoredFiles` keep their exact prior shape; `summary`
         // is additive, so an existing consumer reading only the old keys is unaffected.
-        { findings, scanned, ignoredFiles, summary: { block: blocks2, warn: findings.length - blocks2 } },
+        machineOutput({ findings, scanned, ignoredFiles, summary: { block: blocks2, warn: findings.length - blocks2 } }),
         null,
         2
       ) + "\n"
@@ -7379,7 +7385,9 @@ function check(opts) {
     process.stderr.write(`tamperward: ${cleared.length} blocking finding(s) cleared by ${how}: ${cleared.map((f) => f.rule + (f.file ? `(${f.file})` : "")).join(", ")}
 `);
   }
-  report({ findings, scanned: changes.length, ignoredFiles, json: opts.json, format: opts.format });
+  if (!opts.silent) {
+    report({ findings, scanned: changes.length, ignoredFiles, json: opts.json, format: opts.format });
+  }
   return hasBlocking(findings) ? 1 : 0;
 }
 function runCheck(opts) {
@@ -10695,6 +10703,17 @@ function verifierInputs(cmd, atBase, policy) {
   }
   return picked;
 }
+function verifierCoveredInputs(cmd, atBase, policy) {
+  const verifierOwned = verifierInputs(cmd, atBase, policy);
+  const verifierGlobs = policy.verify?.inputs ?? [];
+  const covered = /* @__PURE__ */ new Set();
+  for (const path of atBase) {
+    if (OVERLAY_CLASSES.some((category) => isProtected(path, policy, category)) || matchesAny(path, VERIFICATION_SURFACE) || verifierOwned.has(path) || verifierGlobs.length > 0 && matchesAny(path, verifierGlobs)) {
+      covered.add(path);
+    }
+  }
+  return covered;
+}
 function baseEntries(base, cwd) {
   return git2(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
     const tab = rec.indexOf("	");
@@ -10722,9 +10741,12 @@ function overlayDigest(dest, paths) {
 function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const entries = baseEntries(base, cwd);
   const atBase = entries.map((e) => e.path);
-  const verifierOwned = verifierInputs(cmd, atBase, policy);
   const verifierGlobs = policy.verify?.inputs ?? [];
-  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
+  const coveredBaseInputs = verifierCoveredInputs(cmd, atBase, policy);
+  const isOverlay = (p) => coveredBaseInputs.has(p) || // Candidate-added files do not exist in atBase and therefore cannot appear
+  // in the precomputed set. They still must be removed when they land on a
+  // protected class or the built-in verification surface.
+  OVERLAY_CLASSES.some((category) => isProtected(p, policy, category)) || matchesAny(p, VERIFICATION_SURFACE) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
   const restored = [];
   const restoredLinks = [];
   const baseProtected = /* @__PURE__ */ new Set();
@@ -10880,10 +10902,24 @@ function renderStageDiagnostics(out2, stage, result) {
 }
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
-  const out2 = (s) => void process.stdout.write(s + "\n");
-  if (opts.invalid) {
-    out2(`verify: ${opts.invalid} \u2014 failing closed`);
+  const out2 = opts.silent ? (_s) => {
+  } : (s) => void process.stdout.write(s + "\n");
+  const cannotVerify = (reason, detail, extra = {}) => {
+    if (opts.json) {
+      out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
+        verdict: "CANNOT_VERIFY",
+        reason,
+        ...detail ? { detail } : {},
+        ...extra
+      }));
+    } else if (detail) {
+      out2(`verify: ${detail} \u2014 failing closed`);
+    }
     return 2;
+  };
+  if (opts.invalid) {
+    return cannotVerify("INVALID_ARGUMENTS", opts.invalid);
   }
   let policy;
   try {
@@ -10891,24 +10927,24 @@ function runVerify(opts) {
     else if (opts.base) policy = loadPolicyAt(resolveBase(opts.base, cwd), cwd) ?? defaultPolicy();
     else policy = loadPolicy(cwd);
   } catch (e) {
-    out2(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
-    return 2;
+    return cannotVerify("POLICY_ERROR", `cannot load policy (${e instanceof Error ? e.message : String(e)})`);
   }
   if (opts.requireAncestor) {
     const requested = git2(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
     if (!baseIsAncestorOfHead(requested, cwd)) {
-      out2(
-        `verify: --require-ancestor: ${requested.slice(0, 10)} is not an ancestor of HEAD \u2014 the anchor would silently resolve to an older commit. Failing closed.`
+      return cannotVerify(
+        "BASE_NOT_ANCESTOR",
+        `--require-ancestor: ${requested.slice(0, 10)} is not an ancestor of HEAD; the anchor would silently resolve to an older commit`,
+        { base: requested }
       );
-      return 2;
     }
   }
   const cmd = opts.cmd ?? policy.verify?.command;
   if (!cmd) {
-    out2(
-      opts.base ? "verify: no suite command in the policy at the trusted base \u2014 the base governs the verifier, so a `verify:` block added only on the candidate is not used. Add it at the base, or pass --cmd explicitly." : "verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd"
+    return cannotVerify(
+      "NO_SUITE_COMMAND",
+      opts.base ? "no suite command in the policy at the trusted base; add it at the base or pass --cmd explicitly" : "no suite command; set policy verify.command or pass --cmd"
     );
-    return 2;
   }
   const budget = opts.budget ?? policy.verify?.budget ?? 300;
   const verifierBackend = opts.verifierBackend ?? prepareVerifierBackend(policy.verify);
@@ -10916,6 +10952,7 @@ function runVerify(opts) {
   if (!verifierBackend.available) {
     if (opts.json) {
       out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: "CANNOT_VERIFY",
         reason: "VERIFIER_BACKEND_UNAVAILABLE",
         verifier_backend: backendReport(),
@@ -10931,6 +10968,7 @@ function runVerify(opts) {
   if (!isolated && !localVerifierShell(process.platform, cmd)) {
     if (opts.json) {
       out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: "CANNOT_VERIFY",
         reason: "LOCAL_VERIFIER_UNSUPPORTED_PLATFORM",
         platform: process.platform,
@@ -10953,6 +10991,7 @@ function runVerify(opts) {
   if (dependencyEnvironment?.status === "unattestable" && !opts.allowDepDrift) {
     if (opts.json) {
       out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: "CANNOT_VERIFY",
         reason: "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
         verifier_backend: backendReport(),
@@ -10972,8 +11011,7 @@ function runVerify(opts) {
   try {
     base = resolveBase(opts.base ?? "HEAD", cwd);
   } catch {
-    out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
-    return 2;
+    return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
   const visRoot = mkdtempSync3(join16(tmpdir3(), "tw-verify-vis-"));
   const visDir = join16(visRoot, "t");
@@ -10990,17 +11028,22 @@ function runVerify(opts) {
   ) ?? checkDeps() : { ok: true };
   if (!dependencyAtEntry.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
-    out2("verify: the frozen dependency environment changed before the visible suite ran \u2014");
-    out2((dependencyAtEntry.reason ?? "dependency identity changed") + ". Failing closed, not open.");
-    return 2;
+    return cannotVerify(
+      "DEPENDENCY_DRIFT",
+      dependencyAtEntry.reason ?? "dependency identity changed before the visible suite ran",
+      { dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
+    );
   }
   try {
     mkdirSync6(visDir);
     materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
-    out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
-    return 2;
+    return cannotVerify(
+      "MATERIALIZATION_FAILED",
+      `could not materialize (${e instanceof Error ? e.message : String(e)})`,
+      { verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport() }
+    );
   }
   const visible = runStage(visDir);
   if (visible.failure === "backend" || visible.failure === "resource") {
@@ -11008,6 +11051,7 @@ function runVerify(opts) {
     const exhausted = visible.failure === "resource";
     if (opts.json) {
       out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: "CANNOT_VERIFY",
         reason: exhausted ? "VERIFIER_RESOURCE_EXHAUSTED" : "VERIFIER_BACKEND_RUNTIME_FAILURE",
         stage: "visible",
@@ -11028,16 +11072,20 @@ function runVerify(opts) {
   }
   if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
-    out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
-    out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
-    return 2;
+    return cannotVerify(
+      "WORKTREE_CHANGED",
+      "the working tree changed while the visible suite was running",
+      { stage: "visible", verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport() }
+    );
   }
   const dependencyAfterVisible = checkDeps();
   if (!dependencyAfterVisible.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
-    out2("verify: the frozen dependency environment changed while the visible suite was running \u2014");
-    out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
-    return 2;
+    return cannotVerify(
+      "DEPENDENCY_DRIFT",
+      dependencyAfterVisible.reason ?? "dependency identity changed while the visible suite was running",
+      { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
+    );
   }
   const priRoot = mkdtempSync3(join16(tmpdir3(), "tw-verify-pri-"));
   const priDir = join16(priRoot, "t");
@@ -11056,8 +11104,11 @@ function runVerify(opts) {
     ));
   } catch (e) {
     cleanup([visRoot, priRoot]);
-    out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
-    return 2;
+    return cannotVerify(
+      "MATERIALIZATION_FAILED",
+      `could not materialize pristine copy (${e instanceof Error ? e.message : String(e)})`,
+      { stage: "pristine", verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport() }
+    );
   }
   const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runStage(priDir);
@@ -11066,6 +11117,7 @@ function runVerify(opts) {
     const exhausted = pristine.failure === "resource";
     if (opts.json) {
       out2(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: "CANNOT_VERIFY",
         reason: exhausted ? "VERIFIER_RESOURCE_EXHAUSTED" : "VERIFIER_BACKEND_RUNTIME_FAILURE",
         stage: "pristine",
@@ -11094,13 +11146,14 @@ function runVerify(opts) {
   const depsMoved = !dependencyAfterPristine.ok && !opts.allowDepDrift;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
-    out2(
-      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the frozen dependency environment changed while the pristine suite was running") + " \u2014"
-    );
-    out2("the verdict would describe something other than what ran. Failing closed, not open.");
-    out2("(A suite that rewrites its own snapshots or test files in place will trip this; run it in");
-    out2("whatever mode your runner calls CI, so verification observes rather than updates.)");
-    return 2;
+    const reason = overlayMoved ? "PRISTINE_INTEGRITY_CHANGED" : treeMoved ? "WORKTREE_CHANGED" : "DEPENDENCY_DRIFT";
+    const detail = overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : dependencyAfterPristine.reason ?? "the frozen dependency environment changed while the pristine suite was running";
+    return cannotVerify(reason, detail, {
+      stage: "pristine",
+      verifier_backend: backendReport(),
+      dependency_environment: dependencyReport(),
+      oracle_assurance: oracleAssuranceReport()
+    });
   }
   let verdict2;
   let code2;
@@ -11122,6 +11175,7 @@ function runVerify(opts) {
   if (opts.json) {
     out2(
       JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
         verdict: verdict2,
         base,
         command: cmd,
@@ -11285,8 +11339,9 @@ var AGENT_SUPERVISOR = String.raw`
 const { spawn, spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 
-const [resultFile, budgetRaw, command, ...args] = process.argv.slice(1);
+const [resultFile, budgetRaw, machineRaw, command, ...args] = process.argv.slice(1);
 const budgetMs = budgetRaw === '' ? null : Number(budgetRaw);
+const machineMode = machineRaw === '1';
 let child;
 let timedOut = false;
 let finished = false;
@@ -11312,7 +11367,9 @@ function killTree(pid) {
 
 try {
   child = spawn(command, args, {
-    stdio: 'inherit',
+    // Machine mode owns stdout for the final envelope document. Preserve agent
+    // diagnostics by routing both child streams to the parent's stderr.
+    stdio: machineMode ? ['inherit', 2, 2] : 'inherit',
     detached: process.platform !== 'win32',
   });
 } catch (e) {
@@ -11349,8 +11406,9 @@ child.once('exit', (code, signal) => finish(code, signal));
 var LINUX_SUBREAPER_SUPERVISOR = String.raw`
 import ctypes, json, os, signal, subprocess, sys, time
 
-result_file, agent_env_file, agent_cwd, budget_raw, test_mode, command, *args = sys.argv[1:]
+result_file, agent_env_file, agent_cwd, budget_raw, test_mode, machine_raw, command, *args = sys.argv[1:]
 budget = None if budget_raw == "" else float(budget_raw)
+machine_mode = machine_raw == "1"
 libc = ctypes.CDLL(None, use_errno=True)
 PR_SET_DUMPABLE = 4
 PR_SET_CHILD_SUBREAPER = 36
@@ -11468,6 +11526,10 @@ try:
         cwd=agent_cwd,
         env=agent_env,
         start_new_session=True,
+        # In machine mode stdout is reserved for TamperWard's one final JSON
+        # document. Agent stdout is retained as diagnostics on stderr.
+        stdout=sys.stderr if machine_mode else None,
+        stderr=None,
     )
 except Exception as exc:
     # No candidate process exists, so the lifecycle domain is trivially empty.
@@ -11497,7 +11559,7 @@ write_result({
 })
 raise SystemExit(0)
 `;
-function runAgentSupervised(argv2, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode) {
+function runAgentSupervised(argv2, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
   const stateDir = mkdtempSync4(join17(tmpdir4(), "tw-agent-supervisor-"));
   const resultFile = join17(stateDir, "result.json");
   const agentEnvFile = join17(stateDir, "agent-env.json");
@@ -11530,6 +11592,7 @@ function runAgentSupervised(argv2, cwd, budgetSecs, linuxPythonCandidates, lifec
         cwd,
         budgetSecs === void 0 ? "" : String(budgetSecs),
         lifecycleTestMode ?? "",
+        machineMode ? "1" : "0",
         ...argv2
       ];
       supervisorCwd = "/";
@@ -11541,6 +11604,7 @@ function runAgentSupervised(argv2, cwd, budgetSecs, linuxPythonCandidates, lifec
         AGENT_SUPERVISOR,
         resultFile,
         budgetSecs === void 0 ? "" : String(budgetSecs * 1e3),
+        machineMode ? "1" : "0",
         ...argv2
       ];
     }
@@ -11660,8 +11724,7 @@ function stopObserverProcess(observer) {
     }
     const deadline = Date.now() + 2e3;
     while (Date.now() < deadline) {
-      const health = watcherTelemetry(observer.log);
-      if (health.health?.state === "stopped" || !pidAlive2(pid)) break;
+      if (!pidAlive2(pid)) break;
       waitMs(25);
     }
     if (pidAlive2(pid)) {
@@ -11674,22 +11737,22 @@ function stopObserverProcess(observer) {
   observer.finished = true;
   return beforeStop;
 }
-function observerSummary(observer, telemetry) {
+function observerSummary(observer, telemetry, write = out) {
   const h = telemetry.health;
   const counts = h ? `${h.event_count} event(s), ${h.dropped_events} dropped, ${h.error_count} error(s)` : "no valid health record";
   const reason = telemetry.reason ? `; ${telemetry.reason}` : "";
-  out(
+  write(
     `tamperward run \u2014 transient observer: ${telemetry.state} (advisory; ${counts}; log ${observer.log}${reason})`
   );
 }
-function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
-  observerSummary(observer, telemetry);
+function collectObserverFindings(observer, telemetry, cwd, base, head, policy, write = out) {
+  observerSummary(observer, telemetry, write);
   const strict = process.env.TAMPERWARD_TRANSIENT === "block";
   const drained = drainEvents(observer.log, 0);
   const { events } = drained;
   if (!drained.complete) {
     const issue = drained.issue ?? "read-stalled";
-    out(
+    write(
       `tamperward run \u2014 transient observer: telemetry was not fully classified (${issue}; ${drained.bytesRead}/${MAX_EVENT_SWEEP_BYTES} bytes read). ` + (strict ? "Strict transient policy fails closed." : "Observer telemetry remains advisory, so this degrades evidence but does not independently fail the envelope.")
     );
     if (strict) return { blocking: true };
@@ -11705,7 +11768,7 @@ function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
       changes.filter((change) => change.kind === "file").map((change) => change.path)
     );
   } catch (e) {
-    out(
+    write(
       `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).` + (strict ? " Strict transient policy fails closed." : "")
     );
     return { blocking: strict };
@@ -11716,16 +11779,16 @@ function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
   };
   const findings = transientFindings(events, persistent, policy, finalHash);
   for (const finding of findings) {
-    out(
+    write(
       `[observer] ${finding.severity === "block" ? "BLOCK" : "warn"} ${finding.rule}${finding.file ? " " + finding.file : ""}: ${finding.message}`
     );
   }
   return { blocking: findings.some((finding) => finding.severity === "block") };
 }
-function finishObserverAdvisory(observer) {
+function finishObserverAdvisory(observer, write = out) {
   if (!observer || observer.finished) return;
   const telemetry = stopObserverProcess(observer);
-  observerSummary(observer, telemetry);
+  observerSummary(observer, telemetry, write);
 }
 function git3(args, cwd) {
   return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
@@ -11784,6 +11847,8 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
 }
 function runEnvelope(opts) {
   const cwd = resolve7(opts.cwd ?? process.cwd());
+  const say = opts.json ? (_s) => {
+  } : out;
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -11834,8 +11899,8 @@ function runEnvelope(opts) {
     return 2;
   }
   const verifierBackend = prepareVerifierBackend(frozenPolicy.verify);
-  out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
-  out(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
+  say(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
+  say(`tamperward run \u2014 verifier backend: ${verifierBackendSummary(verifierBackend)}`);
   if (!verifierBackend.available) {
     err("tamperward run: the requested verifier backend cannot be established \u2014");
     err(`${verifierBackend.reason ?? "unknown backend failure"}. Failing closed before the agent starts.`);
@@ -11851,7 +11916,7 @@ function runEnvelope(opts) {
   }
   const dependencyEnvironment = verifierBackend.kind === "local" ? discoverDependencyEnvironment(cwd, frozenCmd) : null;
   if (dependencyEnvironment) {
-    out(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
+    say(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
     if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
       err("tamperward run: the verifier dependency environment cannot be attested \u2014");
       err(`${dependencyEnvironment.reason ?? "unknown dependency environment"}. Failing closed before the agent starts.`);
@@ -11859,11 +11924,11 @@ function runEnvelope(opts) {
       return 2;
     }
   } else {
-    out(`tamperward run \u2014 dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`);
+    say(`tamperward run \u2014 dependency environment: verifier-owned by ${verifierBackend.image ?? "isolated image"}`);
   }
   const observer = opts.observeTransients ? startSupervisedObserver(cwd, base, opts.observerEntry) : null;
   if (!observer) {
-    out("tamperward run \u2014 transient observer: disabled (advisory; pass --observe-transients to enable)");
+    say("tamperward run \u2014 transient observer: disabled (advisory; pass --observe-transients to enable)");
   }
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
@@ -11872,16 +11937,38 @@ function runEnvelope(opts) {
     cwd,
     opts.agentBudget,
     opts.linuxPythonCandidates,
-    opts.lifecycleTestMode
+    opts.lifecycleTestMode,
+    opts.json === true
   );
   const agentExit = agentRun.exit;
   const agentTimedOut = agentRun.timedOut;
+  const emitRunJson = (verdict3, exitCode2, extra = {}, complete = false) => {
+    if (!opts.json) return;
+    out(JSON.stringify(machineOutput({
+      verdict: verdict3,
+      exit_code: exitCode2,
+      complete,
+      base,
+      agent: {
+        exit_code: agentExit,
+        timed_out: agentTimedOut,
+        lifecycle_owned: agentRun.lifecycleOwned,
+        ...opts.agentBudget !== void 0 ? { budget_secs: opts.agentBudget } : {}
+      },
+      verifier_backend: verifierBackendReport(verifierBackend),
+      dependency_environment: dependencyEnvironment ? dependencyEnvironmentReport(dependencyEnvironment) : { status: "verifier-owned", roots: [], image: verifierBackend.image },
+      ...extra
+    })));
+  };
   if (agentRun.failure && !agentTimedOut) {
     err(`tamperward run: agent runtime failed to start/report cleanly (${agentRun.failure}).`);
   }
-  if (process.platform === "linux" && !agentRun.lifecycleOwned) {
-    err("tamperward run: the Linux agent lifecycle boundary was not established/drained \u2014 failing closed before adjudication.");
-    finishObserverAdvisory(observer);
+  if (!agentRun.lifecycleOwned) {
+    err("tamperward run: the agent lifecycle boundary was not established/drained \u2014 failing closed before adjudication.");
+    finishObserverAdvisory(observer, say);
+    emitRunJson("CANNOT_ADJUDICATE", 2, {
+      reason: "AGENT_LIFECYCLE_NOT_OWNED"
+    });
     return 2;
   }
   if (agentTimedOut) {
@@ -11894,9 +11981,10 @@ function runEnvelope(opts) {
     err("tamperward run: git object-replacement state changed during this run \u2014 a replace ref, graft");
     err("or shallow boundary now redirects what the trusted base resolves to. Nothing below could be");
     err("read against the anchor we started from. That is the finding.");
-    out(`
+    say(`
 tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
-    finishObserverAdvisory(observer);
+    finishObserverAdvisory(observer, say);
+    emitRunJson("OBJECT_REWRITE", 1);
     return 1;
   }
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
@@ -11904,36 +11992,41 @@ tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
     err("the agent rewrote history out from under the anchor. That is the finding.");
-    out(`
+    say(`
 tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMENT_FAILED`);
-    finishObserverAdvisory(observer);
+    finishObserverAdvisory(observer, say);
+    emitRunJson("HISTORY_REWRITE", 1, { head });
     return 1;
   }
   const protectedIgnored = (rel) => isProtected(rel, frozenPolicy);
   const fpBefore = treeFingerprint(cwd, protectedIgnored);
   let diffCode = 0;
   if (head !== base) {
-    out(`
+    say(`
 [envelope] policy check over committed changes (${base.slice(0, 10)}...${head.slice(0, 10)}):`);
-    diffCode = runCheck({ diff: `${base}...${head}`, cwd, policyOverride: frozenPolicy });
+    diffCode = runCheck({ diff: `${base}...${head}`, cwd, policyOverride: frozenPolicy, silent: opts.json });
   }
-  out("\n[envelope] policy check over the working tree (frozen policy, untracked included, no local ledger):");
-  const workCode = runCheck({ worktree: true, cwd, policyOverride: frozenPolicy, includeUntracked: true, ciLayer: true });
+  say("\n[envelope] policy check over the working tree (frozen policy, untracked included, no local ledger):");
+  const workCode = runCheck({ worktree: true, cwd, policyOverride: frozenPolicy, includeUntracked: true, ciLayer: true, silent: opts.json });
   const dependencyBeforeVerificationAttestation = dependencyEnvironment ? attestDependencyEnvironment(cwd, dependencyEnvironment) : void 0;
   const dependencyBeforeVerification = dependencyBeforeVerificationAttestation?.check ?? { ok: true };
   if (!dependencyBeforeVerification.ok) {
     err("tamperward run: the frozen dependency environment changed before verification began \u2014");
     err(`${dependencyBeforeVerification.reason ?? "dependency identity changed"}.`);
     if (!opts.allowDepDrift) {
-      out(`
+      say(`
 tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEMENT_FAILED`);
-      finishObserverAdvisory(observer);
+      finishObserverAdvisory(observer, say);
+      emitRunJson("DEPENDENCY_DRIFT", 1, {
+        head,
+        checks: { diff: diffCode, worktree: workCode }
+      });
       return 1;
     }
     err("(--allow-dep-drift: proceeding anyway, on the operator's judgement.)");
   }
   let verifierFinalDependencyAttestation;
-  out("\n[envelope] pristine verification against the trusted base:");
+  say("\n[envelope] pristine verification against the trusted base:");
   const verifyCode = runVerify({
     cwd,
     base,
@@ -11948,7 +12041,8 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
       }
     } : {},
     allowDepDrift: opts.allowDepDrift,
-    verifierBackend
+    verifierBackend,
+    silent: opts.json
   });
   if (opts.settle && opts.settle > 0) {
     waitForSettleSync(opts.settle);
@@ -11961,7 +12055,7 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
   const dependencyAfter = dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
   if (dependencyEnvironment && process.env.TAMPERWARD_DIAGNOSTICS === "1") {
     const metrics = dependencyEnvironmentDiagnostics(dependencyEnvironment);
-    out(
+    say(
       `tamperward run \u2014 dependency attestation diagnostics: full_snapshots=${metrics.fullSnapshots} reused_snapshots=${metrics.reusedSnapshots} total_ms=${Number(metrics.totalMs.toFixed(3))} verifier_final_attestation=${verifierFinalDependencyAttestation ? "yes" : "no"} run_lifecycle_owned=${agentRun.lifecycleOwned ? "yes" : "no"} entry_reuse=${canReuseAdjacentDependencyAttestation(agentRun.lifecycleOwned) ? "yes" : "no"}`
     );
   }
@@ -11989,7 +12083,8 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
       cwd,
       base,
       head,
-      frozenPolicy
+      frozenPolicy,
+      say
     );
     observerBlocked = observed.blocking;
   }
@@ -11998,10 +12093,25 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1 || notQuiescent || observerBlocked;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;
   const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : rewrote ? "OBJECT_REWRITE \u2014 the base the checks read is not the base we anchored to" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : observerBlocked ? "TRANSIENT_OBSERVER_BLOCK \u2014 observed temporal weakening under strict transient policy" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentTimedOut ? "AGENT_TIMEOUT \u2014 runtime budget expired; post-timeout enforcement clean" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";
+  const machineVerdict = enforcement === 2 ? "CANNOT_ADJUDICATE" : rewrote ? "OBJECT_REWRITE" : depsDrifted ? "DEPENDENCY_DRIFT" : notQuiescent ? "NOT_QUIESCENT" : observerBlocked ? "TRANSIENT_OBSERVER_BLOCK" : enforcement === 1 ? "ENFORCEMENT_FAILED" : agentTimedOut ? "AGENT_TIMEOUT" : agentExit !== 0 ? "AGENT_FAILED" : "VERIFIED";
   const agentSummary = agentTimedOut ? `AGENT_TIMEOUT (${opts.agentBudget}s; exit 124)` : `agent exit ${agentExit}`;
-  out(`
+  const exitCode = enforcement !== 0 ? enforcement : agentTimedOut ? 124 : agentExit;
+  if (opts.json) {
+    const cannotReason = enforcement !== 2 ? null : verifyCode === 2 ? "VERIFY_CANNOT_VERIFY" : diffCode === 2 ? "CHECK_DIFF_UNJUDGEABLE" : "CHECK_WORKTREE_UNJUDGEABLE";
+    emitRunJson(machineVerdict, exitCode, {
+      head,
+      checks: { diff: diffCode, worktree: workCode, verify: verifyCode },
+      observer: {
+        enabled: Boolean(opts.observeTransients),
+        blocking: observerBlocked
+      },
+      ...cannotReason ? { reason: cannotReason } : {}
+    }, true);
+  } else {
+    say(`
 tamperward run \u2014 ${agentSummary}; checks diff=${diffCode} worktree=${workCode} verify=${verifyCode} \u2192 ${verdict2}`);
-  return enforcement !== 0 ? enforcement : agentTimedOut ? 124 : agentExit;
+  }
+  return exitCode;
 }
 function parseRun(args) {
   const o = { argv: [] };
@@ -12013,6 +12123,7 @@ function parseRun(args) {
     } else if (a === "--base") o.base = args[++i];
     else if (a === "--cmd") o.cmd = args[++i];
     else if (a === "--budget") o.budget = Number(args[++i]);
+    else if (a === "--json") o.json = true;
     else if (a === "--agent-budget") o.agentBudget = Number(args[++i]);
     else if (a === "--allow-dirty") o.allowDirty = true;
     else if (a === "--settle") o.settle = Number(args[++i]);
@@ -12059,14 +12170,14 @@ function lifecyclePlatformCheck(platform = process.platform, linuxPython = platf
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
 function err2(message, opts, id = "doctor", checks = []) {
   if (opts?.json) {
-    const report2 = {
+    const report2 = machineOutput({
       command: "doctor",
       authoritative: false,
       checks: [
         ...checks.filter((check2) => check2.id !== id),
         { id, state: "BROKEN", detail: message }
       ]
-    };
+    });
     process.stdout.write(JSON.stringify(report2) + "\n");
   } else {
     process.stderr.write(`tamperward doctor: ${message}
@@ -12279,7 +12390,7 @@ function observerCheck(cwd) {
 function emitReport(opts, checks) {
   const authoritative = !checks.some((x) => x.state === "BROKEN");
   if (opts.json) {
-    const report2 = { command: "doctor", authoritative, checks };
+    const report2 = machineOutput({ command: "doctor", authoritative, checks });
     process.stdout.write(JSON.stringify(report2) + "\n");
     return;
   }
@@ -12627,6 +12738,384 @@ function runDoctor(opts = {}) {
   return 0;
 }
 
+// src/cli/trace-verify.ts
+import { execFileSync as execFileSync11, spawnSync as spawnSync5 } from "node:child_process";
+import {
+  existsSync as existsSync13,
+  mkdtempSync as mkdtempSync5,
+  readFileSync as readFileSync18,
+  readdirSync as readdirSync6,
+  realpathSync as realpathSync7,
+  rmSync as rmSync6,
+  symlinkSync as symlinkSync2
+} from "node:fs";
+import { tmpdir as tmpdir5 } from "node:os";
+import { isAbsolute as isAbsolute11, join as join19, relative as relative6, resolve as resolve9, sep as sep3 } from "node:path";
+var TRACE_ROOT = "/__tamperward_trusted_base__";
+function unescapeStraceString(s) {
+  return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function parseStraceFileAccess(raw) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of raw.split("\n")) {
+    if (!line.trim() || /\)\s+=\s+-1\b/.test(line)) continue;
+    const call = line.match(/\b(execveat|execve|openat2|openat|open|newfstatat|fstatat|statx|lstat|stat|access|readlinkat|readlink)\s*\(/);
+    if (!call) continue;
+    const afterCall = line.slice((call.index ?? 0) + call[0].length);
+    const quoted = afterCall.match(/"((?:\\.|[^"])*)"/);
+    if (!quoted) continue;
+    const path = unescapeStraceString(quoted[1]);
+    if (!path) continue;
+    const access = call[1].startsWith("execve") ? "exec" : "read";
+    const key2 = `${access}\0${path}`;
+    if (seen.has(key2)) continue;
+    seen.add(key2);
+    out2.push({ path, access });
+  }
+  return out2;
+}
+function inside3(root, path) {
+  const rel = relative6(resolve9(root), resolve9(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute11(rel);
+}
+function normalRepoPath(root, raw) {
+  const abs2 = isAbsolute11(raw) ? resolve9(raw) : resolve9(root, raw);
+  if (!inside3(root, abs2)) return null;
+  const rel = relative6(root, abs2).split(sep3).join("/");
+  return rel && rel !== ".." ? rel : null;
+}
+var CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "pytest.ini",
+  ".pytest.ini",
+  "setup.cfg",
+  "setup.py",
+  "tox.ini",
+  "pyproject.toml",
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  "pnpm-workspace.yaml",
+  ".pnpmfile.cjs",
+  ".pnp.cjs",
+  ".pnp.js",
+  ".pnp.loader.mjs",
+  ".nvmrc",
+  ".node-version",
+  ".python-version",
+  ".gitattributes",
+  ".rspec",
+  "phpunit.xml",
+  "phpunit.xml.dist"
+]);
+function likelyConfig(path) {
+  const base = path.split("/").at(-1) ?? path;
+  return CONFIG_BASENAMES.has(base) || /(?:^|\/)(?:config|configs)\//.test(path) || /^\.env(?:\.|$)/.test(base) || /^(?:jest|vitest|playwright|cypress|vite|babel|karma|ava)\.config\./.test(base) || /^tsconfig(?:\..+)?\.json$/.test(base) || /^\.?(?:babelrc|swcrc|nycrc|c8rc)/.test(base) || /(?:^|\/)conftest\.py$/.test(path);
+}
+function sortAccesses(values) {
+  return [...values].sort((a, b) => a.localeCompare(b));
+}
+function summarizeTraceRuns(opts) {
+  const repo = /* @__PURE__ */ new Map();
+  const external = /* @__PURE__ */ new Map();
+  opts.runs.forEach((run, index) => {
+    const perRun = /* @__PURE__ */ new Set();
+    for (const item of run) {
+      const rel = normalRepoPath(opts.root, item.path);
+      const isTracked = rel !== null && opts.tracked.has(rel);
+      const keyPath = isTracked ? rel : rel === null ? resolve9(opts.root, item.path) : null;
+      if (keyPath === null) continue;
+      const target = isTracked ? repo : external;
+      const key2 = `${isTracked ? "repo" : "external"}\0${keyPath}`;
+      let acc2 = target.get(keyPath);
+      if (!acc2) {
+        acc2 = { accesses: /* @__PURE__ */ new Set(), runs: /* @__PURE__ */ new Set() };
+        target.set(keyPath, acc2);
+      }
+      acc2.accesses.add(item.access);
+      if (!perRun.has(key2)) {
+        acc2.runs.add(index);
+        perRun.add(key2);
+      }
+    }
+  });
+  const totalRuns = opts.runs.length;
+  const repository_inputs = [...repo.entries()].map(([path, acc2]) => ({
+    path,
+    accesses: sortAccesses(acc2.accesses),
+    config: likelyConfig(path),
+    covered: opts.covered.has(path),
+    observed_runs: acc2.runs.size,
+    dynamic: acc2.runs.size < totalRuns
+  })).sort((a, b) => a.path.localeCompare(b.path));
+  const external_inputs = [...external.entries()].map(([path, acc2]) => ({
+    path,
+    accesses: sortAccesses(acc2.accesses),
+    observed_runs: acc2.runs.size,
+    dynamic: acc2.runs.size < totalRuns
+  })).sort((a, b) => a.path.localeCompare(b.path));
+  const uncovered_repository_inputs = repository_inputs.filter((x) => !x.covered).map((x) => x.path);
+  return {
+    repository_inputs,
+    external_inputs,
+    uncovered_repository_inputs,
+    // Exact paths are intentionally conservative. A maintainer may widen them to
+    // reviewed globs, but TamperWard never invents a broader trust surface.
+    suggested_verify_inputs: [...uncovered_repository_inputs]
+  };
+}
+function git4(args, cwd) {
+  return execFileSync11("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+    env: trustedGitEnv(),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function commandExists(command) {
+  const r = spawnSync5(command, ["--version"], { stdio: "ignore" });
+  return !r.error && r.status === 0;
+}
+function trackedAt(base, cwd) {
+  return git4(["ls-tree", "-r", "-z", "--name-only", base], cwd).split("\0").filter(Boolean);
+}
+function materializeBase(base, cwd, dest) {
+  const archive = spawnSync5("git", ["archive", "--format=tar", base], {
+    cwd,
+    env: trustedGitEnv(),
+    maxBuffer: 256 * 1024 * 1024
+  });
+  if (archive.error || archive.status !== 0 || !archive.stdout) {
+    throw new Error(
+      `git archive failed${archive.stderr?.length ? `: ${String(archive.stderr).trim()}` : ""}`
+    );
+  }
+  const untar = spawnSync5("tar", ["-xf", "-", "-C", dest], {
+    input: archive.stdout,
+    maxBuffer: 256 * 1024 * 1024
+  });
+  if (untar.error || untar.status !== 0) {
+    throw new Error(
+      `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
+    );
+  }
+  const hostModules = join19(cwd, "node_modules");
+  const tracedModules = join19(dest, "node_modules");
+  if (existsSync13(hostModules) && !existsSync13(tracedModules)) {
+    symlinkSync2(resolve9(hostModules), tracedModules, "dir");
+  }
+}
+function traceFiles(prefix) {
+  const dir = resolve9(prefix, "..");
+  const base = prefix.split(sep3).at(-1);
+  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join19(dir, name)).sort();
+}
+function rewriteTraceRoot(accesses, actualRoot) {
+  return accesses.map((item) => {
+    const abs2 = isAbsolute11(item.path) ? resolve9(item.path) : resolve9(actualRoot, item.path);
+    if (!inside3(actualRoot, abs2)) return { ...item, path: abs2 };
+    const rel = relative6(actualRoot, abs2).split(sep3).join("/");
+    try {
+      const real = resolve9(realpathSync7(abs2));
+      if (!inside3(actualRoot, real)) return { ...item, path: real };
+    } catch {
+    }
+    return { ...item, path: join19(TRACE_ROOT, ...rel.split("/")) };
+  });
+}
+function runOneTrace(cwd, base, command, budget) {
+  const root = mkdtempSync5(join19(tmpdir5(), "tw-trace-base-"));
+  const traceDir = mkdtempSync5(join19(tmpdir5(), "tw-trace-log-"));
+  try {
+    materializeBase(base, cwd, root);
+    const prefix = join19(traceDir, "trace");
+    const traced = spawnSync5(
+      "strace",
+      [
+        "-ff",
+        "-qq",
+        "-s",
+        "4096",
+        "-e",
+        "trace=%file",
+        "-o",
+        prefix,
+        "--",
+        "timeout",
+        "--signal=TERM",
+        "--kill-after=2s",
+        `${budget}s`,
+        "sh",
+        "-c",
+        command
+      ],
+      {
+        cwd: root,
+        env: process.env,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024
+      }
+    );
+    if (traced.error) throw traced.error;
+    const logs = traceFiles(prefix);
+    if (logs.length === 0) {
+      throw new Error("strace produced no trace files");
+    }
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync18(path, "utf8")));
+    return {
+      exit: traced.status ?? 1,
+      accesses: rewriteTraceRoot(accesses, root)
+    };
+  } finally {
+    rmSync6(root, { recursive: true, force: true });
+    rmSync6(traceDir, { recursive: true, force: true });
+  }
+}
+function renderText2(report2) {
+  const out2 = (s = "") => void process.stdout.write(s + "\n");
+  out2("tamperward trace-verify \u2014 ADVISORY observation, not an enforcement verdict");
+  out2(`trusted base: ${report2.base}`);
+  out2(`command: ${report2.command}`);
+  out2(`runs: ${report2.runs_completed}/${report2.runs_requested}; exits: ${report2.run_exits.join(", ")}`);
+  out2();
+  out2("repository inputs observed:");
+  if (!report2.repository_inputs.length) out2("  (none)");
+  for (const item of report2.repository_inputs) {
+    const flags = [
+      item.covered ? "covered" : "UNCOVERED",
+      item.config ? "config" : null,
+      item.dynamic ? `dynamic ${item.observed_runs}/${report2.runs_completed}` : null,
+      item.accesses.join("+")
+    ].filter(Boolean).join(", ");
+    out2(`  ${item.path}  [${flags}]`);
+  }
+  out2();
+  out2("external dependency/runtime paths observed:");
+  if (!report2.external_inputs.length) out2("  (none)");
+  for (const item of report2.external_inputs) {
+    out2(
+      `  ${item.path}  [${item.accesses.join("+")}${item.dynamic ? `, dynamic ${item.observed_runs}/${report2.runs_completed}` : ""}]`
+    );
+  }
+  out2();
+  out2("candidate verify.inputs entries for HUMAN REVIEW:");
+  if (!report2.suggested_verify_inputs.length) out2("  (none \u2014 all observed tracked inputs are already covered)");
+  for (const path of report2.suggested_verify_inputs) out2(`  - ${JSON.stringify(path)}`);
+  out2();
+  for (const note of report2.notes) out2(`note: ${note}`);
+}
+function runTraceVerify(opts = {}) {
+  const cwd = resolve9(opts.cwd ?? process.cwd());
+  if (process.platform !== "linux") {
+    process.stderr.write("tamperward trace-verify: Linux only in this release; unsupported platform \u2014 no parity is implied.\n");
+    return 2;
+  }
+  if (!commandExists("strace")) {
+    process.stderr.write("tamperward trace-verify: strace is required on Linux but was not found.\n");
+    return 2;
+  }
+  if (!commandExists("tar")) {
+    process.stderr.write("tamperward trace-verify: tar is required to materialize the trusted base but was not found.\n");
+    return 2;
+  }
+  if (!commandExists("timeout")) {
+    process.stderr.write("tamperward trace-verify: GNU timeout is required to bound traced verifier runs but was not found.\n");
+    return 2;
+  }
+  const runs = opts.runs ?? 2;
+  if (!Number.isInteger(runs) || runs <= 0) {
+    process.stderr.write(`tamperward trace-verify: --runs needs a positive integer (got ${JSON.stringify(opts.runs)}).
+`);
+    return 2;
+  }
+  const requestedBase = opts.base ?? "HEAD";
+  let base;
+  try {
+    const baseArg = assertRev(requestedBase);
+    base = git4(["rev-parse", "--verify", `${baseArg}^{commit}`], cwd).trim();
+  } catch (e) {
+    process.stderr.write(`tamperward trace-verify: cannot resolve trusted base ${JSON.stringify(requestedBase)} (${e instanceof Error ? e.message : String(e)}).
+`);
+    return 2;
+  }
+  let policy;
+  try {
+    policy = loadPolicyAt(base, cwd) ?? defaultPolicy();
+  } catch (e) {
+    process.stderr.write(`tamperward trace-verify: cannot load policy at trusted base (${e instanceof Error ? e.message : String(e)}).
+`);
+    return 2;
+  }
+  const command = opts.cmd ?? policy.verify?.command;
+  if (!command) {
+    process.stderr.write("tamperward trace-verify: no verifier command; set verify.command at the base or pass --cmd.\n");
+    return 2;
+  }
+  const budget = opts.budget ?? policy.verify?.budget ?? 300;
+  if (!Number.isFinite(budget) || budget <= 0) {
+    process.stderr.write(`tamperward trace-verify: --budget needs a positive number of seconds (got ${JSON.stringify(budget)}).
+`);
+    return 2;
+  }
+  const atBase = trackedAt(base, cwd);
+  const tracked = new Set(atBase);
+  const covered = verifierCoveredInputs(command, atBase, policy);
+  const observed = [];
+  const runExits = [];
+  try {
+    for (let i = 0; i < runs; i++) {
+      const result = runOneTrace(cwd, base, command, budget);
+      observed.push(result.accesses);
+      runExits.push(result.exit);
+    }
+  } catch (e) {
+    process.stderr.write(`tamperward trace-verify: tracing failed (${e instanceof Error ? e.message : String(e)}).
+`);
+    return 2;
+  }
+  const summary = summarizeTraceRuns({
+    root: TRACE_ROOT,
+    runs: observed,
+    tracked,
+    covered
+  });
+  const report2 = {
+    advisory: true,
+    platform: process.platform,
+    base,
+    command,
+    runs_requested: runs,
+    runs_completed: observed.length,
+    run_exits: runExits,
+    trace_complete: runExits.every((code2) => code2 === 0),
+    ...summary,
+    notes: [
+      "Observed reads are evidence from these runs, not proof that an unobserved path can never be read.",
+      "Dynamic paths are those observed in fewer than all repeated traces.",
+      "Suggestions are exact tracked paths only; TamperWard never edits .tamperward.yml or widens a glob automatically.",
+      "Review every suggestion before adding it to verify.inputs."
+    ]
+  };
+  if (opts.json) process.stdout.write(JSON.stringify(report2) + "\n");
+  else renderText2(report2);
+  return report2.trace_complete ? 0 : 1;
+}
+function parseTraceVerify(args) {
+  const out2 = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--json") out2.json = true;
+    else if (a === "--base") out2.base = args[++i];
+    else if (a === "--cmd") out2.cmd = args[++i];
+    else if (a === "--cwd") out2.cwd = args[++i];
+    else if (a === "--budget") out2.budget = Number(args[++i]);
+    else if (a === "--runs") out2.runs = Number(args[++i]);
+  }
+  return out2;
+}
+
 // src/cli/main.ts
 function parseAllow(args) {
   const o = {};
@@ -12715,6 +13204,11 @@ function validateFlatArgs(args, grammar) {
         if (!Number.isFinite(n) || n <= 0) {
           return { error: `${a} needs a positive number (got "${v}")`, seen, positionals };
         }
+      } else if (rule === "positive-integer") {
+        const n = Number(v);
+        if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+          return { error: `${a} needs a positive integer (got "${v}")`, seen, positionals };
+        }
       } else if (rule === "non-negative") {
         const n = Number(v);
         if (!Number.isFinite(n) || n < 0) {
@@ -12752,7 +13246,7 @@ function validateCliArgs(cmd, args) {
     const prefix = args.slice(0, delimiter3);
     const command = args.slice(delimiter3 + 1);
     const parsed = validateFlatArgs(prefix, {
-      flags: ["--allow-dirty", "--allow-dep-drift", "--observe-transients"],
+      flags: ["--allow-dirty", "--allow-dep-drift", "--observe-transients", "--json"],
       values: {
         "--base": "string",
         "--cmd": "string",
@@ -12817,6 +13311,18 @@ function validateCliArgs(cmd, args) {
       }
     }).error;
   }
+  if (cmd === "trace-verify") {
+    return validateFlatArgs(args, {
+      flags: ["--json"],
+      values: {
+        "--base": "string",
+        "--cmd": "string",
+        "--cwd": "string",
+        "--budget": "positive",
+        "--runs": "positive-integer"
+      }
+    }).error;
+  }
   if (cmd === "watch") {
     return validateFlatArgs(args, {
       values: { "--dir": "string", "--log": "string", "--base": "string" }
@@ -12841,7 +13347,8 @@ Formats:
   github  GitHub Actions view: one inline annotation per finding (so it shows up
           on the line in "Files changed") plus a job-summary table on the run
           page, alongside the same text output in the log.
-  json    the findings verbatim, plus a summary count.
+  json    versioned machine-readable output. Top-level schema_version identifies
+          the public JSON-schema major; published schemas live under schemas/.
   auto    github when GITHUB_ACTIONS=true, otherwise text.
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
@@ -12857,16 +13364,26 @@ Formats:
                                             (exit 1, or 0 under an out-of-band
                                             verify@<head-sha> approval); cannot-verify
                                             fails closed (2)
+  tamperward trace-verify [--base R]          advisory Linux verifier-input discovery:
+             [--cmd C] [--budget S] [--runs N] trace a trusted/known-good base with
+             [--json] [--cwd D]                strace, union repeated observations,
+                                               mark dynamic/config/external reads,
+                                               and suggest uncovered exact paths for
+                                               HUMAN review as verify.inputs. Never
+                                               edits policy; unsupported platforms
+                                               fail explicitly rather than claiming parity.
   tamperward run [opts] -- <agent cmd...>   enforcement envelope: record the trusted
              [--base R] [--cmd C]           base, run the agent, treat its exit as
              [--budget S] [--agent-budget S] untrusted, then re-adjudicate the tree it
              [--allow-dirty] [--settle S]   left (policy over base...HEAD and the
              [--allow-dep-drift] [--cwd D]  worktree, plus verify).
-             [--observe-transients]          --observe-transients starts a session-
+             [--observe-transients] [--json] --observe-transients starts a session-
                                             scoped observer before the agent and
                                             reports temporal evidence/health after it.
                                             --agent-budget bounds the agent runtime
                                             itself and still adjudicates after timeout.
+                                            --json emits one final versioned run verdict
+                                            document on stdout after agent adjudication.
                                             Exit: agent's
                                             code when clean; 124 on clean AGENT_TIMEOUT;
                                             1 on any blocking finding/masked failure;
@@ -12930,6 +13447,8 @@ function main(argv2) {
       return runWatch(rest);
     case "verify":
       return runVerify(parseVerify(rest));
+    case "trace-verify":
+      return runTraceVerify(parseTraceVerify(rest));
     case "run":
       return runEnvelope({
         ...parseRun(rest),