tamperward 2.20.0 → 2.20.1

package/README.md

@@ -89,6 +89,9 @@ judged. In architectural terms, Tamperward separates **steering** from
 "pristine" verification restores the protected verification state from the
 trusted starting point and runs the checks again.
 
+For the complete component map, trust boundaries, data flows, and deployment
+surfaces, see [the full architecture diagram](./docs/architecture.md).
+
 > **Core invariant:** the agent may author the candidate tree, but it must not
 > choose the trusted baseline, the governing policy, the verifier, or the final
 > verdict.
@@ -110,31 +113,28 @@ trusted starting point and runs the checks again.
 ### The local enforcement envelope
 
 ```mermaid
-flowchart TB
-    subgraph R["tamperward run — outer enforcement envelope"]
-        E["Capture entry state"]
-        subgraph U["Agent-controlled lifecycle"]
-            H["In-loop steering hooks"]
-            A["Agent runtime"]
-            W["Candidate HEAD and worktree"]
-            H -.-> A
-            A --> W
-        end
-        J["Post-exit adjudication"]
-        C["Committed and worktree checks"]
-        V["Visible and pristine verification"]
-        Q["Ancestry, dependency drift, quiescence"]
-        X["Final exit verdict"]
-        E --> A
-        E --> J
-        W --> J
-        J --> C
-        J --> V
-        J --> Q
-        C --> X
-        V --> X
-        Q --> X
-    end
+graph TD
+    entry["Trusted entry snapshot"]
+    hooks["In-loop hooks and observer"]
+    agent["Agent runtime"]
+    tree["Candidate commit and worktree"]
+    adjudicate["Post-exit adjudication"]
+    checks["Diff and worktree checks"]
+    verify["Visible and pristine verification"]
+    integrity["Ancestry dependency and quiescence"]
+    verdict["Final exit verdict"]
+
+    entry --> agent
+    hooks --> agent
+    agent --> tree
+    entry --> adjudicate
+    tree --> adjudicate
+    adjudicate --> checks
+    adjudicate --> verify
+    adjudicate --> integrity
+    checks --> verdict
+    verify --> verdict
+    integrity --> verdict
 ```
 
 Before starting the agent, the envelope

package/dist/cli/index.js

@@ -1394,8 +1394,27 @@ function countAny(src) {
   }
   return r;
 }
-var NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|\bas\s+\(*\s*unknown\s*\)*\s+as\b|@ts-(?:ignore|expect-error|nocheck)\b/;
+var NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|@ts-(?:ignore|expect-error|nocheck)\b/;
 var BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
+function lineHasDoubleCast(line) {
+  let sf;
+  try {
+    sf = ts2.createSourceFile("line.ts", line, ts2.ScriptTarget.Latest, true, ts2.ScriptKind.TS);
+  } catch {
+    return false;
+  }
+  let found = false;
+  const visit = (n) => {
+    if (found) return;
+    if ((ts2.isAsExpression(n) || ts2.isTypeAssertionExpression(n)) && isDoubleCast(n)) {
+      found = true;
+      return;
+    }
+    ts2.forEachChild(n, visit);
+  };
+  visit(sf);
+  return found;
+}
 var BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
 var WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
 var tsAnyCast = {
@@ -1447,7 +1466,7 @@ var tsAnyCast = {
       }
       const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
       for (const l of addedLines(c)) {
-        if (NARROW_LINE.test(l.content) || jsdocCast && jsdocCast.test(l.content)) {
+        if (NARROW_LINE.test(l.content) || lineHasDoubleCast(l.content) || jsdocCast && jsdocCast.test(l.content)) {
           out2.push(
             makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
               file: c.path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.20.0",
+  "version": "2.20.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",