tamperward 2.23.20 → 2.24.1

package/README.md

@@ -626,11 +626,11 @@ option can never be reinterpreted as the agent command.
 
 ### The rules
 
-Eighteen rules are specified and seventeen ship (see the table in
+Nineteen rules are specified and eighteen ship (see the table in
 [SPEC.md](./SPEC.md)). The families: test protection (`test-deletion`,
 `test-skip`, `test-content-removal`, plus the warning-only JS/TS
 `assertion-weakening` heuristic), verification-signal protection
-(`coverage-lowering`, `snapshot-rewrite`, `snapshot-only-rewrite`), suppression
+(`coverage-lowering`, `coverage-exclusion`, `snapshot-rewrite`, `snapshot-only-rewrite`), suppression
 (`ts-any-cast`, `ts-any-launder`, `ts-cast-growth`, `lint-suppression`), pipeline protection
 (`ci-tampering`, `hook-tampering`, `no-verify`), and the effect/outcome layers
 (`transient-protected-mutation`, `pristine-verification`, plus the `run` envelope).
@@ -653,6 +653,13 @@ change removed, reported as a warning that never blocks by default. It fires on
 of legitimate mainline pairs across four real TypeScript libraries
 (`harness/fp-study/CAST-GROWTH-CORPUS.md`), so block is closed by corpus; the same
 pass removed every assertion from TamperWard's own `src/` (`docs/CAST-INVENTORY.md`).
+`coverage-exclusion` (2.24.0) is the per-function form of `coverage-lowering`: an
+inline `istanbul ignore` / `c8 ignore` / `v8 ignore` / `node:coverage ignore` /
+`# pragma: no cover` / `#[coverage(off)]` added to non-test source, or a `//go:build`
+constraint added to an existing Go file. It fired on 0 of the same 460 mainline
+pairs, but every real add in the deeper histories is an honest unreachable-branch
+marker (`harness/fp-study/COVERAGE-EXCLUSION-CORPUS.md`), so it warns and never
+blocks by default.
 
 ## What Tamperward does not do
 

package/dist/cli/index.js

@@ -571,6 +571,12 @@ function defaultPolicy(version = 1) {
       "ts-cast-growth": { severity: "warn" },
       "lint-suppression": { severity: "block" },
       "coverage-lowering": { severity: "block" },
+      // the per-function form of coverage-lowering: an inline `istanbul ignore` /
+      // `c8 ignore` / `v8 ignore` / `node:coverage ignore` / `# pragma: no cover` /
+      // `#[coverage(off)]` added to non-test source (#438). Also the ordinary way to
+      // mark a genuinely unreachable branch, so it WARNs until the corpus in
+      // harness/fp-study/coverage-exclusion-corpus.json earns block (SPEC §7).
+      "coverage-exclusion": { severity: "warn" },
       "ci-tampering": { severity: "block" },
       "hook-tampering": { severity: "block" },
       "no-verify": { severity: "block" },
@@ -4590,7 +4596,7 @@ function literals(e) {
   return { items, opaque };
 }
 function parseLists(src) {
-  const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
+  const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], ignoreRe: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
@@ -4606,7 +4612,7 @@ function parseLists(src) {
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
           const { items, opaque } = literals(resolve16(node.initializer));
-          res.ignore.push(...items);
+          (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
       }
@@ -4628,6 +4634,8 @@ function parseSwitches(src) {
         const k = keyName(node.name);
         const owner = ownerKey(node);
         if (k === "enabled" && owner === "coverage") res.enabled = bool2(node.initializer);
+        else if (k === "all" && owner === "coverage") res.all = bool2(node.initializer);
+        else if (k === "collectCoverage" && (owner === null || owner === "jest")) res.collectCoverage = bool2(node.initializer);
         else if (k === "perFile" && owner === "thresholds" && underKey(node, "coverage")) res.perFile = bool2(node.initializer);
       }
       ts.forEachChild(node, visit);
@@ -4736,13 +4744,19 @@ function narrowings(before, after, sources) {
   }
   const had = new Set(before.ignore);
   for (const g of after.ignore) {
-    if (!had.has(g) && !BENIGN_EXEMPTION.test(g)) out3.push(`coverage now exempts ${JSON.stringify(g)} (coveragePathIgnorePatterns / coverage.exclude)`);
+    if (!had.has(g) && !BENIGN_EXEMPTION.test(g)) out3.push(`coverage now exempts ${JSON.stringify(g)} (coverage.exclude)`);
+  }
+  const hadRe = new Set(before.ignoreRe);
+  for (const g of after.ignoreRe) {
+    if (!hadRe.has(g) && !BENIGN_EXEMPTION_RE.test(g)) out3.push(`coverage now exempts ${JSON.stringify(g)} (coveragePathIgnorePatterns)`);
   }
   return out3;
 }
 function switchWeakenings(before, after) {
   const out3 = [];
   if (before.enabled === true && after.enabled === false) out3.push("coverage.enabled switched off \u2014 the thresholds are never checked");
+  if (before.collectCoverage === true && after.collectCoverage === false) out3.push("collectCoverage switched off \u2014 coverage is no longer collected, so the thresholds are never checked");
+  if (before.all === true && after.all === false) out3.push("coverage.all switched off \u2014 a file no test imports is no longer measured");
   if (before.perFile === true && after.perFile !== true) out3.push("thresholds.perFile removed \u2014 a single uncovered file now hides behind the aggregate");
   return out3;
 }
@@ -4897,7 +4911,49 @@ function gateMovedElsewhere(c, changes, policy) {
     });
   });
 }
-var RULE5, METRICS, isMetric, norm, BENIGN_EXEMPTION, globs, globList, CANONICAL_SOURCES, NON_SOURCE, NYC_KEYS, COVERAGE_PY, CODECOV, SIMPLE_FILES, lessThan, numOf, SWITCHES, isJsConfig, coverageLowering;
+function flagWeakenings(c, added, removed, policy) {
+  const out3 = [];
+  const removedCheck = removed.find((l) => CHECK_COVERAGE.test(l.content));
+  if (removedCheck && !added.some((l) => CHECK_COVERAGE.test(l.content))) {
+    out3.push(
+      makeFinding(RULE5, policy, {
+        file: c.path,
+        message: "nyc --check-coverage was removed \u2014 the coverage thresholds are no longer enforced.",
+        evidence: removedCheck.content.trim(),
+        remediation: "Keep --check-coverage on; raise real coverage instead of switching the gate off."
+      })
+    );
+  }
+  const was = floorsOf(removed);
+  const now = floorsOf(added);
+  if (was.length === 0) return out3;
+  const high = was.reduce((a, b) => b.v > a.v ? b : a);
+  if (now.length === 0) {
+    out3.push(
+      makeFinding(RULE5, policy, {
+        file: c.path,
+        message: `--cov-fail-under removed (was ${high.v}) \u2014 the coverage floor is no longer enforced.`,
+        evidence: high.l.content.trim(),
+        remediation: "Keep the --cov-fail-under floor; raise real coverage instead of removing the gate."
+      })
+    );
+    return out3;
+  }
+  const low = now.reduce((a, b) => b.v < a.v ? b : a);
+  if (low.v < high.v) {
+    out3.push(
+      makeFinding(RULE5, policy, {
+        file: c.path,
+        line: low.l.newLine ?? void 0,
+        message: `--cov-fail-under lowered ${high.v} \u2192 ${low.v}.`,
+        evidence: low.l.content.trim(),
+        remediation: "Restore the coverage floor and raise real coverage; do not lower the gate to pass."
+      })
+    );
+  }
+  return out3;
+}
+var RULE5, METRICS, isMetric, norm, BENIGN_DIRS, BENIGN_EXEMPTION, BENIGN_EXEMPTION_RE, globs, globList, CANONICAL_SOURCES, NON_SOURCE, NYC_KEYS, COVERAGE_PY, CODECOV, SIMPLE_FILES, lessThan, numOf, SWITCHES, isJsConfig, COV_FAIL_UNDER, CHECK_COVERAGE, floorsOf, coverageLowering;
 var init_coverage_lowering = __esm({
   "src/detectors/coverage-lowering.ts"() {
     "use strict";
@@ -4912,7 +4968,9 @@ var init_coverage_lowering = __esm({
     METRICS = ["branches", "functions", "lines", "statements"];
     isMetric = (k) => METRICS.some((m) => m === k);
     norm = (p) => p.replace(/^\.\//, "");
-    BENIGN_EXEMPTION = /node_modules|(?:^|[/!])(?:dist|build|out|coverage|tmp|temp|vendor|test|tests|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|spec|specs|e2e|cypress|playwright|storybook|scripts?|examples?|docs?|bin|types?|typings|generated|__generated__|codegen|migrations?)(?:\/|$|\*)|\.(?:test|spec|stories|d|gen|generated|pb|e2e-spec)\.|\.(?:config|setup)\.|(?:^|[/!*])(?:manage|wsgi|asgi|__init__)\.py$|(?:^|[/!*])main\.[jt]sx?$|\.git\b|\.cache|\.next|\.nuxt|\.output|\.idea|\.d\.ts|\.json$|\.md$|\.css$|\.s[ac]ss$/i;
+    BENIGN_DIRS = /node_modules|(?:^|[/!])(?:dist|build|out|coverage|tmp|temp|vendor|test|tests|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|spec|specs|e2e|cypress|playwright|storybook|scripts?|examples?|docs?|bin|types?|typings|generated|__generated__|codegen|migrations?)(?:\/|$|\*)|\.(?:config|setup)\.|(?:^|[/!*])(?:manage|wsgi|asgi|__init__)\.py$|(?:^|[/!*])main\.[jt]sx?$|\.git\b|\.cache|\.next|\.nuxt|\.output|\.idea/i;
+    BENIGN_EXEMPTION = new RegExp(`${BENIGN_DIRS.source}|\\.(?:test|spec|stories|d|gen|generated|pb|e2e-spec)\\.|\\.d\\.ts|\\.json$|\\.md$|\\.css$|\\.s[ac]ss$`, "i");
+    BENIGN_EXEMPTION_RE = new RegExp(`${BENIGN_DIRS.source}|\\\\\\.(?:test|spec|stories|gen|generated|pb|e2e-spec)\\\\\\.|\\\\\\.(?:d\\\\\\.ts|json|md|css|s[ac]ss)\\$?$`, "i");
     globs = (patterns) => {
       const ms = patterns.map((g) => {
         try {
@@ -4935,12 +4993,12 @@ var init_coverage_lowering = __esm({
       label: m,
       weakens: "lower"
     }));
-    COVERAGE_PY = /(?:^|\/)(?:\.coveragerc|pyproject\.toml)$/;
+    COVERAGE_PY = /(?:^|\/)(?:\.coveragerc|pyproject\.toml|setup\.cfg|tox\.ini)$/;
     CODECOV = /(?:^|\/)\.?codecov\.yml$/;
     SIMPLE_FILES = [
       {
-        // coverage.py: `fail_under = 90` under [report] (.coveragerc, setup.cfg-style) or
-        // [tool.coverage.report] (pyproject.toml)
+        // coverage.py: `fail_under = 90` under [report] (.coveragerc), [coverage:report]
+        // (setup.cfg, tox.ini) or [tool.coverage.report] (pyproject.toml)
         file: COVERAGE_PY,
         keys: [{ key: /^\s*fail[_-]under\s*=\s*"?(\d+(?:\.\d+)?)/, label: "fail_under", weakens: "lower" }],
         removable: true
@@ -4999,6 +5057,12 @@ var init_coverage_lowering = __esm({
       }
     ];
     isJsConfig = (path) => /\.(?:[cm]?[jt]sx?|json)$/.test(path);
+    COV_FAIL_UNDER = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
+    CHECK_COVERAGE = /--check-coverage\b/;
+    floorsOf = (lines) => lines.flatMap((l) => {
+      const m = l.content.match(COV_FAIL_UNDER);
+      return m ? [{ v: Number(m[1]), l }] : [];
+    });
     coverageLowering = {
       id: RULE5,
       surface: ["file"],
@@ -5007,7 +5071,10 @@ var init_coverage_lowering = __esm({
         const out3 = [];
         for (const c of changes) {
           if (c.kind !== "file") continue;
-          if (!isProtected(c.path, policy, "config")) continue;
+          if (!isProtected(c.path, policy, "config")) {
+            if (isProtected(c.path, policy, "ci")) out3.push(...flagWeakenings(c, addedLines(c), removedLines(c), policy));
+            continue;
+          }
           if (c.after != null && c.op !== "delete") {
             const reasons = [];
             if (isJsConfig(c.path)) {
@@ -5057,6 +5124,7 @@ var init_coverage_lowering = __esm({
               })
             );
           }
+          out3.push(...flagWeakenings(c, added, removed, policy));
           for (const l of added) {
             for (const s of SWITCHES) {
               if (!s.re.test(l.content)) continue;
@@ -5110,6 +5178,93 @@ var init_coverage_lowering = __esm({
   }
 });
 
+// src/detectors/coverage-exclusion.ts
+function isText(line, idx, lang) {
+  const opener = LINE_COMMENT[lang];
+  let quote = null;
+  for (let j = 0; j < idx; j++) {
+    const ch = line[j];
+    if (quote) {
+      if (ch === "\\") j++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (opener && opener.test(line.slice(j, j + 2))) return true;
+  }
+  return quote !== null;
+}
+var RULE6, PATTERNS3, OUT_OF_SCOPE_PATH, LINE_COMMENT, coverageExclusion;
+var init_coverage_exclusion = __esm({
+  "src/detectors/coverage-exclusion.ts"() {
+    "use strict";
+    init_select();
+    init_files();
+    init_policy();
+    init_finding();
+    RULE6 = "coverage-exclusion";
+    PATTERNS3 = {
+      js: [
+        { re: /\/\*\s*istanbul\s+ignore\b/, why: "`istanbul ignore` takes the next statement, branch or the whole file out of the coverage measurement" },
+        { re: /\/\*\s*c8\s+ignore\b(?!\s*stop\b)/, why: "`c8 ignore` takes the next statement or the marked range out of the coverage measurement" },
+        { re: /\/\*\s*v8\s+ignore\b(?!\s*stop\b)/, why: "`v8 ignore` takes the next statement or the marked range out of the coverage measurement" },
+        { re: /\/\*\s*node:coverage\s+(?:ignore|disable)\b/, why: "`node:coverage ignore/disable` takes the following code out of the coverage measurement" }
+      ],
+      py: [{ re: /#\s*pragma[:\s]\s*no\s*cover\b/i, why: "`# pragma: no cover` takes the line or block out of the coverage measurement" }],
+      rs: [{ re: /#\s*!?\[[^\]]*\bcoverage\s*\(\s*off\s*\)/, why: "`#[coverage(off)]` takes the item out of the coverage measurement" }],
+      go: [
+        {
+          re: /^\s*\/\/\s*(?:go:build\b|\+build\b)/,
+          why: "a build constraint added to an existing file takes it out of the default build, and out of `go test -cover`",
+          existingOnly: true
+        }
+      ]
+    };
+    OUT_OF_SCOPE_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|out|coverage|generated|__generated__|codegen|examples?|docs?|scripts?|fixtures?|__fixtures__|__mocks__)\/|\.d\.[cm]?ts$|\.(?:generated|gen|pb)\.[^/]*$/;
+    LINE_COMMENT = { js: /^\/\//, go: /^\/\//, rs: /^\/\//, py: /^#/ };
+    coverageExclusion = {
+      id: RULE6,
+      surface: ["file"],
+      certainty: "mechanical",
+      run(changes, policy) {
+        const out3 = [];
+        for (const c of changes) {
+          if (c.kind !== "file" || c.op === "delete") continue;
+          const lang = langOf(c.path);
+          if (!lang) continue;
+          const patterns = PATTERNS3[lang];
+          if (!patterns) continue;
+          const category = protectedCategory(c.path, policy);
+          if (OUT_OF_SCOPE_PATH.test(c.path) || category === "tests" || category === "config") continue;
+          const removed = new Set(removedLines(c).map((l) => l.content.trim()));
+          const before = c.before ?? "";
+          for (const l of addedLines(c)) {
+            const trimmed = l.content.trim();
+            if (removed.has(trimmed)) continue;
+            for (const p of patterns) {
+              const m = p.re.exec(l.content);
+              if (!m || isText(l.content, m.index, lang)) continue;
+              if (p.existingOnly && (c.op === "add" || c.before == null || before.split("\n").some((b) => p.re.test(b)))) continue;
+              out3.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  line: l.newLine ?? void 0,
+                  message: `Coverage exclusion added: ${p.why}.`,
+                  evidence: trimmed,
+                  remediation: "Cover the code with a test instead of excluding it from the measurement; if it is genuinely unreachable, say so in review.",
+                  defaultSeverity: "warn"
+                })
+              );
+              break;
+            }
+          }
+        }
+        return out3;
+      }
+    };
+  }
+});
+
 // src/detectors/gh-expression.ts
 function foldExpressions(s) {
   return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
@@ -5878,7 +6033,7 @@ function ancestorOf(lines, i) {
   while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
   return h >= 0 ? h : null;
 }
-var RULE6, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var RULE7, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
 var init_ci_tampering = __esm({
   "src/detectors/ci-tampering.ts"() {
     "use strict";
@@ -5891,7 +6046,7 @@ var init_ci_tampering = __esm({
     init_gh_expression();
     init_invocation();
     init_invocation();
-    RULE6 = "ci-tampering";
+    RULE7 = "ci-tampering";
     USES = /^\s*-\s*uses:/;
     CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
     YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
@@ -5931,7 +6086,7 @@ var init_ci_tampering = __esm({
     REF_LINE = /^\s*ref:\s*(.+?)\s*$/;
     CHECKOUT = /^\s*-?\s*uses:\s*actions\/checkout(?:@|\s|$)/;
     ciTampering = {
-      id: RULE6,
+      id: RULE7,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
@@ -5943,7 +6098,7 @@ var init_ci_tampering = __esm({
           if (c.kind !== "file") continue;
           if (c.op === "rename" && c.oldPath && isActiveWorkflow(c.oldPath) && !isActiveWorkflow(c.path)) {
             out3.push(
-              makeFinding(RULE6, policy, {
+              makeFinding(RULE7, policy, {
                 file: c.path,
                 message: `A CI workflow was renamed so it no longer runs (${c.oldPath} \u2192 ${c.path}).`,
                 evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -5967,7 +6122,7 @@ var init_ci_tampering = __esm({
             }
             if (coe && isTruthy(coe[1])) {
               out3.push(
-                makeFinding(RULE6, policy, {
+                makeFinding(RULE7, policy, {
                   file: c.path,
                   line: l.newLine ?? void 0,
                   message: "continue-on-error: true added \u2014 failures will no longer fail the job.",
@@ -5977,7 +6132,7 @@ var init_ci_tampering = __esm({
               );
             } else if (cond && isAlwaysFalse(cond[1])) {
               out3.push(
-                makeFinding(RULE6, policy, {
+                makeFinding(RULE7, policy, {
                   file: c.path,
                   line: l.newLine ?? void 0,
                   message: `if: ${uncommented(cond[1])} added \u2014 this step can never run.`,
@@ -5997,7 +6152,7 @@ var init_ci_tampering = __esm({
                 const n = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
                 if (!n || propagates && /set\s\+e/.test(b.body[k])) continue;
                 out3.push(
-                  makeFinding(RULE6, policy, {
+                  makeFinding(RULE7, policy, {
                     file: c.path,
                     line: idx + 1,
                     message: `A check's run block was neutralised: ${n.what}.`,
@@ -6013,7 +6168,7 @@ var init_ci_tampering = __esm({
               const step = stepOf(afterLines, l.newLine - 1);
               if (step && !stepHasCheck(afterLines, step)) continue;
               out3.push(
-                makeFinding(RULE6, policy, {
+                makeFinding(RULE7, policy, {
                   file: c.path,
                   line: l.newLine,
                   message: "shell: \u2026 {0} added on a check step \u2014 the shell no longer stops on the first failure.",
@@ -6039,7 +6194,7 @@ var init_ci_tampering = __esm({
                   if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck2(x) || usesCheck(x))) continue;
                 }
                 out3.push(
-                  makeFinding(RULE6, policy, {
+                  makeFinding(RULE7, policy, {
                     file: c.path,
                     line: l.newLine,
                     message: `A check was pointed at ${dir} by working-directory \u2014 a directory holding no code or package the check could run.`,
@@ -6056,7 +6211,7 @@ var init_ci_tampering = __esm({
               const target = literalValue(ref[1]);
               if (target === null) continue;
               out3.push(
-                makeFinding(RULE6, policy, {
+                makeFinding(RULE7, policy, {
                   file: c.path,
                   line: l.newLine,
                   message: `actions/checkout was pinned to ref: ${target} \u2014 the checks run against that ref, not against the change under review.`,
@@ -6069,7 +6224,7 @@ var init_ci_tampering = __esm({
               triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
               for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
                 out3.push(
-                  makeFinding(RULE6, policy, {
+                  makeFinding(RULE7, policy, {
                     file: c.path,
                     message: `The workflow's triggers were narrowed: ${reason}.`,
                     evidence: reason,
@@ -6099,7 +6254,7 @@ var init_ci_tampering = __esm({
             if (s.state === "kept") continue;
             if (s.state === "neutralised") {
               out3.push(
-                makeFinding(RULE6, policy, {
+                makeFinding(RULE7, policy, {
                   file: c.path,
                   message: "A CI check command was neutralised in place: it still runs, but its result no longer decides (or its suite was narrowed).",
                   evidence: `${l.content.trim()} \u2192 ${s.by}`,
@@ -6109,7 +6264,7 @@ var init_ci_tampering = __esm({
               continue;
             }
             out3.push(
-              makeFinding(RULE6, policy, {
+              makeFinding(RULE7, policy, {
                 file: c.path,
                 message: isUsesLine ? "A CI check step (test/lint/typecheck) was removed." : "A CI check command was removed from a run block.",
                 evidence: l.content.trim(),
@@ -7139,7 +7294,7 @@ function claudeSettingsFindings(c, policy) {
   if (c.after == null) return null;
   const after = parseSettings(c.after);
   const before = c.before != null ? parseSettings(c.before) : null;
-  const finding = (reason) => makeFinding(RULE7, policy, {
+  const finding = (reason) => makeFinding(RULE8, policy, {
     file: c.path,
     message: `The Claude Code hook wiring was weakened: ${reason}.`,
     evidence: reason,
@@ -7164,7 +7319,7 @@ function policyFindings(c, policy, ctx) {
   const reasons = c.before == null ? policyAddWeakening(c.after, probe) : policyWeakening(c.before, c.after, probe);
   if (reasons === null) return null;
   return reasons.map(
-    (reason) => makeFinding(RULE7, policy, {
+    (reason) => makeFinding(RULE8, policy, {
       file: c.path,
       message: added ? `A policy file was added that weakens the baseline: ${reason}.` : `The policy was weakened: ${reason}.`,
       evidence: reason,
@@ -7210,6 +7365,50 @@ function syntheticBase(over) {
   }
   return base;
 }
+function freshLefthookBase(after) {
+  const base = {};
+  for (const [section, v] of Object.entries(after)) {
+    if (!isObj(v)) continue;
+    for (const group of ["commands", "scripts"]) {
+      const g = v[group];
+      if (!isObj(g)) continue;
+      for (const [name, cfg] of Object.entries(g)) {
+        if (!isObj(cfg)) continue;
+        const run = cfg.run ?? cfg.runner;
+        if (!namesGate(name) && !namesGate(run)) continue;
+        const sec = base[section] ??= {};
+        const grp = sec[group] ??= {};
+        grp[name] = { run: typeof run === "string" ? liveOrCanonical(run) : CANONICAL_GATE };
+      }
+    }
+  }
+  return base;
+}
+function freshPreCommitBase(after) {
+  const stagesOf = (v) => Array.isArray(v) && v.map(String).some((s) => COMMIT_STAGES.has(s)) ? v.map(String) : null;
+  const defaults = stagesOf(after.default_stages);
+  const repos = [];
+  for (const repo of Array.isArray(after.repos) ? after.repos : []) {
+    if (!isObj(repo)) continue;
+    const hooks = [];
+    for (const h of Array.isArray(repo.hooks) ? repo.hooks : []) {
+      if (!isObj(h)) continue;
+      if (![repo.repo, h.id, h.entry, h.name].some(namesGate)) continue;
+      const fresh = { id: h.id, name: h.name };
+      if (h.entry !== void 0) {
+        const args = Array.isArray(h.args) ? h.args.map(String).join(" ") : "";
+        fresh.entry = liveOrCanonical(`${typeof h.entry === "string" ? h.entry : ""} ${args}`.trim());
+      }
+      const stages = stagesOf(h.stages);
+      if (stages) fresh.stages = stages;
+      hooks.push(fresh);
+    }
+    repos.push({ repo: repo.repo, hooks });
+  }
+  const base = { repos };
+  if (defaults) base.default_stages = defaults;
+  return base;
+}
 function configFindings(c, changes, policy, ctx) {
   if (c.after == null) return null;
   let reasons;
@@ -7219,15 +7418,18 @@ function configFindings(c, changes, policy, ctx) {
     if (overBefore === null) return null;
     const base = lefthookBase(c, changes, ctx) ?? syntheticBase(overAfter ?? {});
     reasons = overAfter === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : lefthookWeakening(mergeDocs(base, overBefore), mergeDocs(base, overAfter));
+  } else if (c.before == null) {
+    const after = parseDoc(c.after);
+    if (after === null) return [];
+    reasons = isLefthook(c.path) ? lefthookWeakening(freshLefthookBase(after), after) : preCommitWeakening(freshPreCommitBase(after), after);
   } else {
-    if (c.before == null) return null;
     const before = parseDoc(c.before);
     const after = parseDoc(c.after);
     if (before === null) return null;
     reasons = after === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : isLefthook(c.path) ? lefthookWeakening(before, after) : preCommitWeakening(before, after);
   }
   return reasons.map(
-    (reason) => makeFinding(RULE7, policy, {
+    (reason) => makeFinding(RULE8, policy, {
       file: c.path,
       message: `The hook configuration was weakened: ${reason}.`,
       evidence: reason,
@@ -7278,7 +7480,7 @@ function huskyRuntimeWrite(path, content, ctx) {
     (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
   );
 }
-var RULE7, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
+var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
 var init_hook_tampering = __esm({
   "src/detectors/hook-tampering.ts"() {
     "use strict";
@@ -7291,7 +7493,7 @@ var init_hook_tampering = __esm({
     init_command();
     init_repo();
     init_hook_wiring();
-    RULE7 = "hook-tampering";
+    RULE8 = "hook-tampering";
     ownerExec2 = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
     EVENTS = ["PreToolUse", "Stop"];
     isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
@@ -7314,6 +7516,10 @@ var init_hook_tampering = __esm({
     envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
     mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
     carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
+    CANONICAL_GATE = "npx tamperward check --staged";
+    COMMIT_STAGES = /* @__PURE__ */ new Set(["pre-commit", "pre-push", "commit", "push"]);
+    namesGate = (v) => typeof v === "string" && /\btamperward\b/.test(v);
+    liveOrCanonical = (cmd) => gateOf(cmd) !== null ? cmd : CANONICAL_GATE;
     HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
     HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
     HUSKY_H_KNOWN = [
@@ -7353,9 +7559,9 @@ They WILL FAIL in v10.0.0
 "`;
     stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
     isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
-    isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
+    isHookNote = (path) => !/(?:^|\/)\.husky\/_\//.test(path) && /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
     hookTampering = {
-      id: RULE7,
+      id: RULE8,
       surface: ["file", "command"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
@@ -7368,7 +7574,7 @@ They WILL FAIL in v10.0.0
               if (isPackageJson(c.path) && c.before != null && c.after != null) {
                 for (const reason of packageJsonWeakening(c.before, c.after)) {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       message: `The hook installation was weakened: ${reason}.`,
                       evidence: reason,
@@ -7381,7 +7587,7 @@ They WILL FAIL in v10.0.0
             }
             if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec2(c.oldMode) && !ownerExec2(c.newMode)) {
               out3.push(
-                makeFinding(RULE7, policy, {
+                makeFinding(RULE8, policy, {
                   file: c.path,
                   message: `Execute permission was removed from a protected hook (${c.oldMode} \u2192 ${c.newMode}) \u2014 git will skip it.`,
                   evidence: `${c.path}: mode ${c.oldMode} \u2192 ${c.newMode}`,
@@ -7391,7 +7597,7 @@ They WILL FAIL in v10.0.0
             }
             if (c.op === "delete") {
               out3.push(
-                makeFinding(RULE7, policy, {
+                makeFinding(RULE8, policy, {
                   file: c.path,
                   message: "A protected hook/policy file was deleted.",
                   evidence: c.path,
@@ -7400,7 +7606,7 @@ They WILL FAIL in v10.0.0
               );
             } else if (c.op === "rename" && !renameKept(c)) {
               out3.push(
-                makeFinding(RULE7, policy, {
+                makeFinding(RULE8, policy, {
                   file: c.path,
                   message: `A protected hook/policy file was renamed (${c.oldPath} \u2192 ${c.path}).`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -7414,7 +7620,7 @@ They WILL FAIL in v10.0.0
               if (c.before != null && c.after != null) {
                 for (const reason of codeownersWeakening(c.before, c.after, [...repoGateFiles(ctx), c.path])) {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       message: `CODEOWNERS was weakened: ${reason}.`,
                       evidence: reason,
@@ -7427,6 +7633,7 @@ They WILL FAIL in v10.0.0
               out3.push(...semantic);
             } else if (!c.path.endsWith(POLICY_FILE)) {
               if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
+              if (isHookNote(c.path)) continue;
               const husky = isHuskyScript(c.path);
               const opts = husky ? { errexit: true } : {};
               const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;
@@ -7435,7 +7642,7 @@ They WILL FAIL in v10.0.0
                 const kept = afterPin !== null && (beforePin === "" ? afterPin === "" || PLAIN_SEMVER.test(afterPin) : pinNotBelow(afterPin, beforePin));
                 if (!kept) {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       message: "A protected hook script no longer matches the shape `tamperward init` writes.",
                       evidence: "the gate script no longer matches the shape init wrote; re-run init or sign off",
@@ -7458,7 +7665,7 @@ They WILL FAIL in v10.0.0
                 if (shebang || !live) {
                   const why = shebang ?? (gate.length ? `its \`${gate[0].identity}\` is ${gate[0].state}${gate[0].why ? ` (${gate[0].why})` : ""}` : "it runs no `tamperward check`");
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
                       evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
@@ -7467,7 +7674,7 @@ They WILL FAIL in v10.0.0
                   );
                 } else if (earlyExit) {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       line: earlyExit.newLine ?? void 0,
                       message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
@@ -7489,7 +7696,7 @@ They WILL FAIL in v10.0.0
                     deadGuard2 ? `a guard that can never be true was inserted (\`${deadGuard2.content.trim()}\`)` : null
                   ].filter((d) => d !== null);
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
                       evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
@@ -7501,7 +7708,7 @@ They WILL FAIL in v10.0.0
               }
               if (shebangChanged && c.after != null) {
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     file: c.path,
                     line: 1,
                     message: `A protected hook's interpreter was changed: ${shebang}.`,
@@ -7512,7 +7719,7 @@ They WILL FAIL in v10.0.0
               }
               if (earlyExit) {
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     file: c.path,
                     line: earlyExit.newLine ?? void 0,
                     message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
@@ -7524,7 +7731,7 @@ They WILL FAIL in v10.0.0
               const deadGuard = c.before == null || c.after == null ? added.find((l) => insertsDeadGuard(l.content)) : void 0;
               if (deadGuard) {
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     file: c.path,
                     line: deadGuard.newLine ?? void 0,
                     message: "A guard that can never be true was inserted into a protected hook \u2014 what it wraps no longer runs.",
@@ -7536,7 +7743,7 @@ They WILL FAIL in v10.0.0
               const lost = scriptWeakening(beforeLines, afterLines, opts);
               if (lost.length) {
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     file: c.path,
                     message: `A check invocation was removed from a protected hook: ${lost[0].reason}.`,
                     evidence: lost[0].evidence,
@@ -7555,7 +7762,7 @@ They WILL FAIL in v10.0.0
                 const m = l.content.match(INLINE);
                 if (m && m[2] === "warn" && removedSeverity.get(m[1]) === "block") {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       line: l.newLine ?? void 0,
                       message: `Rule "${m[1]}" was lowered from block to warn in the policy.`,
@@ -7565,7 +7772,7 @@ They WILL FAIL in v10.0.0
                   );
                 } else if (/enabled:\s*false\b/.test(l.content)) {
                   out3.push(
-                    makeFinding(RULE7, policy, {
+                    makeFinding(RULE8, policy, {
                       file: c.path,
                       line: l.newLine ?? void 0,
                       message: "A rule was disabled (enabled: false) in the policy.",
@@ -7583,7 +7790,7 @@ They WILL FAIL in v10.0.0
               const hiding = updateIndexHiding(toks, policy);
               if (hiding) {
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     file: repoRelative(hiding.file, ctx),
                     message: `Hook tampering via shell: ${hiding.reason}.`,
                     evidence: seg,
@@ -7599,7 +7806,7 @@ They WILL FAIL in v10.0.0
                 const file = target ? repoRelative(target, ctx) : void 0;
                 const outside = file !== void 0 && (isAbsolute6(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
                 out3.push(
-                  makeFinding(RULE7, policy, {
+                  makeFinding(RULE8, policy, {
                     ...file !== void 0 ? { file } : {},
                     message: `Hook tampering via shell: ${why}${outside}.`,
                     evidence: seg,
@@ -7835,7 +8042,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
   if (!was || !now || was.path === now.path) return [];
   const samples = runnerSamples(now.path, policy, ctx, "pytest");
   return suiteNarrowings(was.content, now.content, now.path, samples).map(
-    (n) => makeFinding(RULE8, policy, {
+    (n) => makeFinding(RULE9, policy, {
       file: now.path,
       message: `The effective pytest config moved from ${was.path} to ${now.path}, and ${n.path} is no longer selected: ${n.reason}.`,
       evidence: `inifile precedence ${was.path} \u2192 ${now.path} drops ${n.path} from the suite`,
@@ -7843,7 +8050,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
     })
   );
 }
-var RULE8, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
+var RULE9, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
 var init_test_deletion = __esm({
   "src/detectors/test-deletion.ts"() {
     "use strict";
@@ -7856,7 +8063,7 @@ var init_test_deletion = __esm({
     init_suite_config();
     init_invocation();
     init_narrow();
-    RULE8 = "test-deletion";
+    RULE9 = "test-deletion";
     JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
     TEST_DEFS = {
       py: /^\s*(?:async\s+)?def\s+test\w*\s*\(/,
@@ -7876,7 +8083,7 @@ var init_test_deletion = __esm({
     SLICE_SCRIPT = /^test:(?:unit|integration)$/;
     SED_INPLACE = /(?:^|\s)(?:-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b)/;
     testDeletion = {
-      id: RULE8,
+      id: RULE9,
       surface: ["file", "command"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
@@ -7908,7 +8115,7 @@ var init_test_deletion = __esm({
             if (c.op === "delete" && isTest) {
               if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: "A test file was deleted.",
                   evidence: c.path,
@@ -7917,7 +8124,7 @@ var init_test_deletion = __esm({
               );
             } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && !isTest) {
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: `A test file was renamed out of the test glob (${c.oldPath} \u2192 ${c.path}).`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -7926,7 +8133,7 @@ var init_test_deletion = __esm({
               );
             } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && isTest && leavesWalk(c.oldPath, c.path)) {
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: `A test file was renamed into a path the runner does not walk (${c.oldPath} \u2192 ${c.path}): ${leavesWalk(c.oldPath, c.path)}.`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -7941,7 +8148,7 @@ var init_test_deletion = __esm({
                 const removed = new Set([...significantLines(c.before, c.path)].filter((l) => !afterLines.has(l)));
                 if (isRelocation(removed, before.min - after.min)) continue;
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     message: `Test blocks removed: ${before.min} \u2192 ${after.min} it()/test() in this spec (each-table rows count as tests).`,
                     evidence: `${before.min - after.min} test block(s) removed from ${c.path}`,
@@ -7954,7 +8161,7 @@ var init_test_deletion = __esm({
               const readable = rn !== "pytest" || effectivePytestConfig(c.path, ctx);
               for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     message: `The runner no longer selects ${n.path}: ${n.reason}.`,
                     evidence: `${n.path} dropped from the suite by ${c.path}`,
@@ -7966,12 +8173,12 @@ var init_test_deletion = __esm({
                 const w = n.weakening;
                 const evidence = `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${n.after === "" ? "deleted" : JSON.stringify(n.after)}`;
                 out3.push(
-                  w.state === "removed" ? makeFinding(RULE8, policy, {
+                  w.state === "removed" ? makeFinding(RULE9, policy, {
                     file: c.path,
                     message: `The test script no longer runs the ${w.kind} check: scripts.${n.script} ${w.what}.`,
                     evidence,
                     remediation: "Keep the script running its check. Replacing the runner in package.json removes every test from every `npm test` while the workflow line stays untouched."
-                  }) : makeFinding(RULE8, policy, {
+                  }) : makeFinding(RULE9, policy, {
                     file: c.path,
                     message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n.script}.`,
                     evidence,
@@ -8062,7 +8269,7 @@ var init_test_deletion = __esm({
               }
               if (why) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     message: `Test removed via shell: ${why}.`,
                     evidence,
                     remediation: "Fix the code under test. Mutating a spec from the shell is still deleting the test \u2014 and is blocked the same way."
@@ -8118,7 +8325,7 @@ function significantLinesOrdered(src, path) {
   }
   return out3;
 }
-var RULE9, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, testContentRemoval;
+var RULE10, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, testContentRemoval;
 var init_test_content_removal = __esm({
   "src/detectors/test-content-removal.ts"() {
     "use strict";
@@ -8127,13 +8334,13 @@ var init_test_content_removal = __esm({
     init_finding();
     init_test_deletion();
     init_files();
-    RULE9 = "test-content-removal";
+    RULE10 = "test-content-removal";
     MIN_REMOVED_LINES = 3;
     MIN_REMOVED_ROWS = 2;
     ws = (s) => s.replace(/\s+/g, "");
     TEST_DIR_FILE = /(?:^|\/)(?:test|tests|__tests__|spec|specs)\//;
     testContentRemoval = {
-      id: RULE9,
+      id: RULE10,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy) {
@@ -8174,7 +8381,7 @@ var init_test_content_removal = __esm({
           const goneRows = table.rows.size && tableAfter.open ? [...table.rows].filter(([k]) => !tableAfter.rows.has(k) && !addedPool.includes(k)).map(([, text]) => text) : [];
           if (goneRows.length >= MIN_REMOVED_ROWS) {
             out3.push(
-              makeFinding(RULE9, policy, {
+              makeFinding(RULE10, policy, {
                 file: c.path,
                 message: `Rows removed from a test table: ${goneRows.length} case(s) gone from an each-table that spreads from elsewhere, and they reappear nowhere in the change.`,
                 evidence: goneRows.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -8185,7 +8392,7 @@ var init_test_content_removal = __esm({
           }
           if (gone.length >= MIN_REMOVED_LINES && netDrop >= MIN_REMOVED_LINES) {
             out3.push(
-              makeFinding(RULE9, policy, {
+              makeFinding(RULE10, policy, {
                 file: c.path,
                 message: `Test content removed from a surviving spec: ${gone.length} significant line(s) gone with no test block deleted.`,
                 evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -8208,14 +8415,14 @@ function namesProtectedSnapshot(seg, policy) {
   }
   return null;
 }
-var RULE10, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
+var RULE11, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
 var init_snapshot_rewrite = __esm({
   "src/detectors/snapshot-rewrite.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_command();
-    RULE10 = "snapshot-rewrite";
+    RULE11 = "snapshot-rewrite";
     RUNNER3 = /\b(?:jest|vitest|playwright|ava)\b/;
     PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
     UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
@@ -8225,12 +8432,12 @@ var init_snapshot_rewrite = __esm({
     REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
     MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}|\bfind\b.*\s-(?:delete\b|exec\s+rm\b)|\bgit\s+(?:checkout|restore)\b/;
     snapshotRewrite = {
-      id: RULE10,
+      id: RULE11,
       surface: ["command", "file"],
       certainty: "mechanical",
       run(changes, policy) {
         const out3 = [];
-        const warn = (input) => out3.push(makeFinding(RULE10, policy, { ...input, defaultSeverity: "warn" }));
+        const warn = (input) => out3.push(makeFinding(RULE11, policy, { ...input, defaultSeverity: "warn" }));
         for (const c of changes) {
           if (c.kind === "command") {
             for (const seg of segments(c.raw)) {
@@ -8278,16 +8485,16 @@ function isSnapshotChange(c, policy) {
   if (isProtected(c.path, policy, "snapshots")) return true;
   return c.oldPath != null && isProtected(c.oldPath, policy, "snapshots");
 }
-var RULE11, COMMIT_VIEWS, snapshotOnlyRewrite;
+var RULE12, COMMIT_VIEWS, snapshotOnlyRewrite;
 var init_snapshot_only = __esm({
   "src/detectors/snapshot-only.ts"() {
     "use strict";
     init_policy();
     init_finding();
-    RULE11 = "snapshot-only-rewrite";
+    RULE12 = "snapshot-only-rewrite";
     COMMIT_VIEWS = ["staged", "range"];
     snapshotOnlyRewrite = {
-      id: RULE11,
+      id: RULE12,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy, view) {
@@ -8300,7 +8507,7 @@ var init_snapshot_only = __esm({
         if (!first) return [];
         const names = snaps.map((c) => c.path).slice(0, 3).join(", ");
         return [
-          makeFinding(RULE11, policy, {
+          makeFinding(RULE12, policy, {
             file: first.path,
             message: `Only recorded expectations changed in this diff (${snaps.length} snapshot file${snaps.length === 1 ? "" : "s"}, no code change to explain them).`,
             evidence: names + (snaps.length > 3 ? ", \u2026" : ""),
@@ -8474,7 +8681,7 @@ function findingForBlock(path, before, after, policy) {
   const weakened2 = directionalWeakening(before.assertions, after.assertions);
   if (weakened2) {
     const message = weakened2.kind === "throw-specificity" ? `Assertion weakened in test "${before.identity}": exception-message specificity was removed from toThrow().` : `Assertion weakened in test "${before.identity}": ${weakened2.before.matcher} was replaced by weaker ${weakened2.after.matcher} on the same subject.`;
-    return makeFinding(RULE12, policy, {
+    return makeFinding(RULE13, policy, {
       file: path,
       message,
       evidence: `${weakened2.before.text} -> ${weakened2.after.text}`,
@@ -8483,7 +8690,7 @@ function findingForBlock(path, before, after, policy) {
   }
   const removed = pureRemoval(before.assertions, after.assertions);
   if (removed) {
-    return makeFinding(RULE12, policy, {
+    return makeFinding(RULE13, policy, {
       file: path,
       message: `Assertion removed from kept test "${before.identity}" without a replacement assertion.`,
       evidence: removed.text,
@@ -8492,7 +8699,7 @@ function findingForBlock(path, before, after, policy) {
   }
   return null;
 }
-var RULE12, TEST_CALLS, SUITE_CALLS, EXACT_MATCHERS, WEAK_MATCHERS, compact, assertionWeakening;
+var RULE13, TEST_CALLS, SUITE_CALLS, EXACT_MATCHERS, WEAK_MATCHERS, compact, assertionWeakening;
 var init_assertion_weakening = __esm({
   "src/detectors/assertion-weakening.ts"() {
     "use strict";
@@ -8500,14 +8707,14 @@ var init_assertion_weakening = __esm({
     init_policy();
     init_finding();
     init_files();
-    RULE12 = "assertion-weakening";
+    RULE13 = "assertion-weakening";
     TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
     SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite", "context"]);
     EXACT_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toMatchObject"]);
     WEAK_MATCHERS = /* @__PURE__ */ new Set(["toBeTruthy", "toBeDefined"]);
     compact = (s) => s.replace(/\s+/g, "");
     assertionWeakening = {
-      id: RULE12,
+      id: RULE13,
       surface: ["file"],
       certainty: "heuristic",
       run(changes, policy) {
@@ -8542,6 +8749,7 @@ var init_detectors = __esm({
     init_lint_suppression();
     init_test_skip();
     init_coverage_lowering();
+    init_coverage_exclusion();
     init_ci_tampering();
     init_hook_tampering();
     init_test_deletion();
@@ -8556,6 +8764,7 @@ var init_detectors = __esm({
       lintSuppression,
       testSkip,
       coverageLowering,
+      coverageExclusion,
       ciTampering,
       hookTampering,
       testDeletion,
@@ -10027,7 +10236,7 @@ function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DE
   };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
-  if (!isEnabled(RULE13, policy)) return [];
+  if (!isEnabled(RULE14, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -10047,7 +10256,7 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
     const modeChurn = modes.size > 1;
     if (!contentChurn && !modeChurn) continue;
     const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
-    const f = makeFinding(RULE13, policy, {
+    const f = makeFinding(RULE14, policy, {
       file: path,
       message: `Transient protected mutation: ${what}, leaving no net diff.`,
       evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
@@ -10062,14 +10271,14 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
   }
   return out3;
 }
-var RULE13, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
+var RULE14, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
 var init_fs_events = __esm({
   "src/detectors/fs-events.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_narrow();
-    RULE13 = "transient-protected-mutation";
+    RULE14 = "transient-protected-mutation";
     MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
     MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
     DEFAULT_EVENT_READ_IO = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.20",
+  "version": "2.24.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",