tamperward 2.27.0 → 2.29.0

package/dist/cli/index.js

@@ -211,7 +211,7 @@ function forwardedEnv(env) {
   return out3;
 }
 function exchange(paths, req2, timeoutMs) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let done = false;
     let handedOff = false;
     let accepted = false;
@@ -222,7 +222,7 @@ function exchange(paths, req2, timeoutMs) {
       done = true;
       clearTimeout(timer);
       sock.destroy();
-      resolve16(value);
+      resolve17(value);
     };
     const sock = createConnection(paths.socket);
     const timer = setTimeout(() => finish(handedOff ? acceptedFailure("timeout") : null), timeoutMs);
@@ -298,6 +298,7 @@ var init_hook_client = __esm({
     MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
     FORWARDED_ENV = [
       "TAMPERWARD_DENYLOG",
+      "TAMPERWARD_AUDIT_LOG",
       "TAMPERWARD_FSEVENTS",
       "TAMPERWARD_TRANSIENT",
       "CLAUDE_CONFIG_DIR",
@@ -3538,15 +3539,15 @@ function buildAliasMap(sf) {
     ts.forEachChild(node, collect2);
   };
   collect2(sf);
-  const resolve16 = (name, seen) => {
+  const resolve17 = (name, seen) => {
     if (seen.has(name)) return null;
     seen.add(name);
     const t = decls.get(name);
-    return t ? kindOfType(t, (n) => resolve16(n, seen)) : null;
+    return t ? kindOfType(t, (n) => resolve17(n, seen)) : null;
   };
   const resolved = /* @__PURE__ */ new Map();
   for (const name of decls.keys()) {
-    const k = resolve16(name, /* @__PURE__ */ new Set());
+    const k = resolve17(name, /* @__PURE__ */ new Set());
     if (k) resolved.set(name, k);
   }
   return resolved;
@@ -4933,8 +4934,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve16) {
-  const obj = resolve16(expr);
+function metricsOf(expr, resolve17) {
+  const obj = resolve17(expr);
   if (!ts.isObjectLiteralExpression(obj)) return void 0;
   const out3 = { values: {}, opaque: false };
   let any = false;
@@ -4948,7 +4949,7 @@ function metricsOf(expr, resolve16) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve16(p.initializer));
+    const n = numericOf(resolve17(p.initializer));
     if (n === void 0) out3.opaque = true;
     else out3.values[k] = n;
   }
@@ -4995,17 +4996,17 @@ function parseThresholds(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve16 = resolverFor(sf);
+    const resolve17 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve16(node.initializer);
+          const init = resolve17(node.initializer);
           if (!ts.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve16);
+            const flat = metricsOf(init, resolve17);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts.isSpreadAssignment(p)) {
@@ -5019,7 +5020,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve16);
+              const m = metricsOf(p.initializer, resolve17);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -5053,18 +5054,18 @@ function parseLists(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve16 = resolverFor(sf);
+    const resolve17 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve16(node.initializer));
+          const { items, opaque } = literals(resolve17(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve16(node.initializer));
+          const { items, opaque } = literals(resolve17(node.initializer));
           (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -11829,15 +11830,251 @@ var init_fs_events = __esm({
   }
 });
 
+// src/cli/audit.ts
+import { createHash as createHash5, randomBytes } from "node:crypto";
+import { appendFileSync as appendFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute8, join as join13, resolve as resolve4 } from "node:path";
+function sessionHash(sessionId) {
+  if (!sessionId) return void 0;
+  return "sha256:" + createHash5("sha256").update(sessionId).digest("hex").slice(0, 24);
+}
+function eventId() {
+  return "sha256:" + createHash5("sha256").update(randomBytes(32)).digest("hex").slice(0, 32);
+}
+function configuredAuditPath(cwd, env = process.env) {
+  const value = env[AUDIT_LOG_ENV];
+  if (!value) return null;
+  if (value === "auto") {
+    const ctx = repoContext(cwd);
+    return ctx ? join13(ctx.gitDir, "tamperward", "audit.jsonl") : null;
+  }
+  return isAbsolute8(value) ? value : resolve4(cwd, value);
+}
+function defaultAuditPath(cwd) {
+  const ctx = repoContext(cwd);
+  return ctx ? join13(ctx.gitDir, "tamperward", "audit.jsonl") : null;
+}
+function recordAuditFindings(findings, context) {
+  if (findings.length === 0) return;
+  const path = configuredAuditPath(context.cwd);
+  if (!path) return;
+  try {
+    mkdirSync5(dirname4(path), { recursive: true });
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const session = sessionHash(context.sessionId);
+    const lines = findings.map((finding) => {
+      const severity = finding.severity === "block" ? "block" : "warn";
+      const event = {
+        schema_version: AUDIT_SCHEMA_VERSION,
+        id: eventId(),
+        timestamp,
+        surface: context.surface,
+        agent: "claude-code",
+        rule: finding.rule,
+        severity,
+        decision: severity === "block" ? "deny" : "warn",
+        ...session ? { session } : {}
+      };
+      return JSON.stringify(event);
+    });
+    appendFileSync4(path, lines.join("\n") + "\n");
+  } catch {
+  }
+}
+function recordAuditSignal(rule, severity, context) {
+  const finding = {
+    rule,
+    severity,
+    message: "",
+    evidence: "",
+    remediation: "",
+    signoff: { required: severity === "block", command: "" }
+  };
+  recordAuditFindings([finding], context);
+}
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseAuditEvent(value, line = 0) {
+  const where = line > 0 ? `audit line ${line}` : "audit event";
+  if (!isRecord3(value)) throw new Error(`${where} must be a JSON object`);
+  const unknown = Object.keys(value).filter((key2) => !ALLOWED_KEYS.has(key2));
+  if (unknown.length) throw new Error(`${where} contains unsupported field "${unknown[0]}"`);
+  if (value.schema_version !== AUDIT_SCHEMA_VERSION) {
+    throw new Error(`${where} has unsupported schema_version ${String(value.schema_version)}`);
+  }
+  if (typeof value.id !== "string" || !/^sha256:[0-9a-f]{32}$/.test(value.id)) {
+    throw new Error(`${where} has an invalid id`);
+  }
+  if (typeof value.timestamp !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value.timestamp) || !Number.isFinite(Date.parse(value.timestamp))) {
+    throw new Error(`${where} has an invalid timestamp`);
+  }
+  if (value.surface !== "pretooluse" && value.surface !== "stop") {
+    throw new Error(`${where} has an invalid surface`);
+  }
+  if (typeof value.agent !== "string" || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(value.agent)) {
+    throw new Error(`${where} has an invalid agent`);
+  }
+  if (typeof value.rule !== "string" || !/^[a-z0-9][a-z0-9-]{0,79}$/.test(value.rule)) {
+    throw new Error(`${where} has an invalid rule`);
+  }
+  if (value.severity !== "block" && value.severity !== "warn") {
+    throw new Error(`${where} has an invalid severity`);
+  }
+  if (value.decision !== "deny" && value.decision !== "warn") {
+    throw new Error(`${where} has an invalid decision`);
+  }
+  if (value.severity === "block" && value.decision !== "deny" || value.severity === "warn" && value.decision !== "warn") {
+    throw new Error(`${where} has inconsistent severity and decision`);
+  }
+  if (value.session !== void 0 && (typeof value.session !== "string" || !/^sha256:[0-9a-f]{24}$/.test(value.session))) {
+    throw new Error(`${where} has an invalid session`);
+  }
+  return {
+    schema_version: AUDIT_SCHEMA_VERSION,
+    id: value.id,
+    timestamp: value.timestamp,
+    surface: value.surface,
+    agent: value.agent,
+    rule: value.rule,
+    severity: value.severity,
+    decision: value.decision,
+    ...typeof value.session === "string" ? { session: value.session } : {}
+  };
+}
+function parseAuditJsonl(raw) {
+  const events = [];
+  raw.split(/\r?\n/).forEach((line, index) => {
+    if (!line.trim()) return;
+    let value;
+    try {
+      value = JSON.parse(line);
+    } catch {
+      throw new Error(`audit line ${index + 1} is not valid JSON`);
+    }
+    events.push(parseAuditEvent(value, index + 1));
+  });
+  return events;
+}
+function parseSince(value, nowMs = Date.now()) {
+  const relative8 = /^(\d+)(m|h|d)$/.exec(value);
+  if (relative8) {
+    const count = Number(relative8[1]);
+    const unit = relative8[2] === "m" ? 6e4 : relative8[2] === "h" ? 36e5 : 864e5;
+    if (!Number.isSafeInteger(count) || count <= 0) throw new Error(`invalid --since value "${value}"`);
+    return nowMs - count * unit;
+  }
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`invalid --since value "${value}" (use e.g. 30d, 12h, 90m, or an ISO timestamp)`);
+  }
+  return parsed;
+}
+function summarizeAudit(events) {
+  const ordered = [...events].sort((a, b) => a.timestamp.localeCompare(b.timestamp) || a.id.localeCompare(b.id));
+  const rules = /* @__PURE__ */ new Map();
+  const surfaces = /* @__PURE__ */ new Map();
+  const sessions = /* @__PURE__ */ new Set();
+  for (const event of ordered) {
+    const bucket = rules.get(event.rule) ?? { events: 0, blocked: 0, warnings: 0 };
+    bucket.events++;
+    if (event.severity === "block") bucket.blocked++;
+    else bucket.warnings++;
+    rules.set(event.rule, bucket);
+    surfaces.set(event.surface, (surfaces.get(event.surface) ?? 0) + 1);
+    if (event.session) sessions.add(event.session);
+  }
+  const by_rule = [...rules.entries()].map(([rule, counts]) => ({ rule, ...counts })).sort((a, b) => b.events - a.events || a.rule.localeCompare(b.rule));
+  const by_surface = [...surfaces.entries()].map(([surface, count]) => ({ surface, events: count })).sort((a, b) => b.events - a.events || a.surface.localeCompare(b.surface));
+  return {
+    schema_version: AUDIT_SCHEMA_VERSION,
+    events: ordered.length,
+    blocked: ordered.filter((event) => event.severity === "block").length,
+    warnings: ordered.filter((event) => event.severity === "warn").length,
+    sessions: sessions.size,
+    first_event: ordered[0]?.timestamp ?? null,
+    last_event: ordered.at(-1)?.timestamp ?? null,
+    by_rule,
+    by_surface,
+    interpretation: "finding-is-not-proof-of-intent"
+  };
+}
+function renderAuditStats(summary) {
+  const out3 = [
+    "TamperWard audit stats",
+    "",
+    `Events      ${summary.events}`,
+    `Blocked     ${summary.blocked}`,
+    `Warnings    ${summary.warnings}`,
+    `Sessions    ${summary.sessions}`
+  ];
+  if (summary.first_event && summary.last_event) {
+    out3.push(`First       ${summary.first_event}`, `Last        ${summary.last_event}`);
+  }
+  if (summary.by_rule.length) {
+    out3.push("", "By rule");
+    const width = Math.max(...summary.by_rule.map((row) => row.rule.length));
+    for (const row of summary.by_rule) out3.push(`  ${row.rule.padEnd(width)}  ${row.events}`);
+  }
+  if (summary.by_surface.length) {
+    out3.push("", "By surface");
+    const width = Math.max(...summary.by_surface.map((row) => row.surface.length));
+    for (const row of summary.by_surface) out3.push(`  ${row.surface.padEnd(width)}  ${row.events}`);
+  }
+  out3.push("", "Note: an integrity finding is a signal, not proof of agent intent; legitimate refactors can trigger findings.");
+  return out3.join("\n") + "\n";
+}
+function runStats(opts = {}) {
+  const cwd = resolve4(opts.cwd ?? process.cwd());
+  const explicitFile = opts.file !== void 0;
+  const configured = process.env[AUDIT_LOG_ENV];
+  const file = opts.file ? isAbsolute8(opts.file) ? opts.file : resolve4(cwd, opts.file) : configured && configured !== "auto" ? isAbsolute8(configured) ? configured : resolve4(cwd, configured) : defaultAuditPath(cwd);
+  const cutoff = opts.since ? parseSince(opts.since) : null;
+  if (!file) throw new Error("stats needs --file outside a Git repository");
+  if (!existsSync9(file)) {
+    if (explicitFile) throw new Error(`audit file not found: ${file}`);
+    const empty2 = summarizeAudit([]);
+    process.stdout.write(opts.json ? JSON.stringify(empty2) + "\n" : renderAuditStats(empty2));
+    return 0;
+  }
+  let events = parseAuditJsonl(readFileSync10(file, "utf8"));
+  if (cutoff !== null) {
+    events = events.filter((event) => Date.parse(event.timestamp) >= cutoff);
+  }
+  const summary = summarizeAudit(events);
+  process.stdout.write(opts.json ? JSON.stringify(summary) + "\n" : renderAuditStats(summary));
+  return 0;
+}
+var AUDIT_SCHEMA_VERSION, AUDIT_LOG_ENV, ALLOWED_KEYS;
+var init_audit = __esm({
+  "src/cli/audit.ts"() {
+    "use strict";
+    init_repo_context();
+    AUDIT_SCHEMA_VERSION = 1;
+    AUDIT_LOG_ENV = "TAMPERWARD_AUDIT_LOG";
+    ALLOWED_KEYS = /* @__PURE__ */ new Set([
+      "schema_version",
+      "id",
+      "timestamp",
+      "surface",
+      "agent",
+      "rule",
+      "severity",
+      "decision",
+      "session"
+    ]);
+  }
+});
+
 // src/cli/hook.ts
-import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "node:fs";
-import { createHash as createHash5 } from "node:crypto";
+import { readFileSync as readFileSync11, appendFileSync as appendFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
 function setSnapshotCache(cache3) {
   snapshotCache = cache3;
 }
 function readStdin() {
   try {
-    return readFileSync10(0, "utf8");
+    return readFileSync11(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -11865,7 +12102,7 @@ function recordDenylog(blocks2) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync4(log, blocks2.map((b) => b.rule).join(",") + "\n");
+    appendFileSync5(log, blocks2.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -11873,7 +12110,7 @@ function errText2(e) {
   const m = e instanceof Error ? e.message : String(e);
   return m.length > 200 ? m.slice(0, 200) + "\u2026" : m;
 }
-function failClosed(kind, detail) {
+function failClosed(kind, detail, audit) {
   const f = {
     rule: "tamperward-unavailable",
     severity: "block",
@@ -11882,7 +12119,7 @@ function failClosed(kind, detail) {
     remediation: "Repair the Tamperward setup \u2014 most often an unparseable .tamperward.yml (check for merge-conflict markers) \u2014 then retry. Do not work around the gate while it is down.",
     signoff: { required: true, command: 'tamperward allow --reason "..."' }
   };
-  return verdict([f], kind);
+  return verdict([f], kind, audit);
 }
 function denyWire(reason, kind) {
   const payload = kind === "PreToolUse" ? {
@@ -11894,9 +12131,16 @@ function denyWire(reason, kind) {
   } : { decision: "block", reason };
   return JSON.stringify(payload) + "\n";
 }
-function verdict(blocks2, kind) {
+function verdict(blocks2, kind, audit) {
   if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
   recordDenylog(blocks2);
+  if (audit) {
+    recordAuditFindings(blocks2, {
+      cwd: audit.cwd,
+      surface: kind === "PreToolUse" ? "pretooluse" : "stop",
+      sessionId: audit.sessionId
+    });
+  }
   const reason = formatDenial(blocks2);
   return { exitCode: 0, stdout: denyWire(reason, kind) };
 }
@@ -12062,7 +12306,7 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   let dirty = false;
   for (const c of changes) {
     if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy)) continue;
-    const hash = createHash5("sha256").update(c.after).digest("hex").slice(0, 16);
+    const hash = createHash6("sha256").update(c.after).digest("hex").slice(0, 16);
     const prev = tree[c.path];
     tree[c.path] = {
       hash,
@@ -12077,8 +12321,8 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   if (dirty) savePtree(cwd, sessionId, tree);
 }
 function preToolUseVerdict(input, defaultCwd, trustedRoot) {
+  const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
   try {
-    const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
     if (trustedRoot !== void 0) {
       const v = validateClaimAgainstRoot(input.cwd, trustedRoot, defaultCwd ?? process.cwd());
       if (!v.ok) return failClosed("PreToolUse", `repository identity claim rejected: ${v.rejected}`);
@@ -12087,13 +12331,13 @@ function preToolUseVerdict(input, defaultCwd, trustedRoot) {
     turnBaseline(cwd, input.session_id);
     const policy = loadPolicy(cwd);
     const driftBlocks = effectDriftBlocks(cwd, input.session_id, policy);
-    if (driftBlocks) return verdict(driftBlocks, "PreToolUse");
+    if (driftBlocks) return verdict(driftBlocks, "PreToolUse", { cwd, sessionId: input.session_id });
     const changes = changesFromClaudeHook(input, cwd, sessionCwd);
     const blocks2 = evaluate(changes, policy, void 0, "tool-call", { cwd }).filter((f) => f.severity === "block");
     if (blocks2.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
-    return verdict(blocks2, "PreToolUse");
+    return verdict(blocks2, "PreToolUse", { cwd, sessionId: input.session_id });
   } catch (e) {
-    return failClosed("PreToolUse", errText2(e));
+    return failClosed("PreToolUse", errText2(e), { cwd: sessionCwd, sessionId: input.session_id });
   }
 }
 function cursorPath(cwd, sessionId) {
@@ -12117,19 +12361,21 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   const log = defaultEventLog(cwd);
   const telemetry = watcherTelemetry(log);
   if (telemetry.state !== "healthy") {
-    recordObserverHealth(telemetry.state, telemetry.reason);
+    recordObserverHealth(cwd, sessionId, telemetry.state, telemetry.reason);
   }
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync9(log)) return none;
+  if (!existsSync10(log)) return none;
   let offset = 0;
-  if (cp && existsSync9(cp)) {
-    const n = Number(readFileSync10(cp, "utf8"));
+  if (cp && existsSync10(cp)) {
+    const n = Number(readFileSync11(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const drained = drainEvents(log, offset);
   if (!drained.complete) {
     const issue = drained.issue ?? "read-stalled";
     recordObserverHealth(
+      cwd,
+      sessionId,
       "degraded",
       `event telemetry was not fully classified (${issue}); Stop retained the prior cursor`
     );
@@ -12157,7 +12403,7 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
     return e.kind === "file" && e.content != null ? contentHash(e.content) : null;
   };
   const findings = transientFindings(events, persistent, policy, finalHash);
-  recordWarns(findings.filter((f) => f.severity !== "block"));
+  recordWarns(cwd, sessionId, findings.filter((f) => f.severity !== "block"));
   return {
     blocks: findings.filter((f) => f.severity === "block"),
     commit: () => {
@@ -12168,20 +12414,23 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
     }
   };
 }
-function recordWarns(warns) {
+function recordWarns(cwd, sessionId, warns) {
+  if (warns.length === 0) return;
+  recordAuditFindings(warns, { cwd, surface: "stop", sessionId });
   const log = process.env.TAMPERWARD_DENYLOG;
-  if (!log || warns.length === 0) return;
+  if (!log) return;
   try {
-    appendFileSync4(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
+    appendFileSync5(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
   } catch {
   }
 }
-function recordObserverHealth(state, reason) {
+function recordObserverHealth(cwd, sessionId, state, reason) {
+  recordAuditSignal("transient-observer", "warn", { cwd, surface: "stop", sessionId });
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   const detail = (reason ?? "").replace(/[\r\n]+/g, " ").trim();
   try {
-    appendFileSync4(
+    appendFileSync5(
       log,
       `warn:transient-observer:${state}${detail ? ":" + detail : ""}
 `
@@ -12226,13 +12475,13 @@ function stopVerdict(input, defaultCwd, trustedRoot) {
       saveTurnTree(cwd, input.session_id, current);
     }
   } catch (e) {
-    return failClosed("Stop", errText2(e));
+    return failClosed("Stop", errText2(e), { cwd: sessionCwd, sessionId: input.session_id });
   }
   if (blocks2.length === 0) {
     advanceTurnBaseline(cwd, input.session_id);
     commitCursor();
   }
-  return verdict(blocks2, "Stop");
+  return verdict(blocks2, "Stop", { cwd, sessionId: input.session_id });
 }
 function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
@@ -12290,6 +12539,7 @@ var init_hook = __esm({
     init_disk();
     init_narrow();
     init_repo_context();
+    init_audit();
     snapshotCache = null;
     HookInputError = class extends Error {
     };
@@ -12298,7 +12548,7 @@ var init_hook = __esm({
 
 // src/ptree-cache.ts
 import { lstatSync as lstatSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function keyOf(st) {
   return `${st.dev}:${st.ino}:${st.size}:${st.mode}:${st.mtimeNs}:${st.ctimeNs}`;
 }
@@ -12338,7 +12588,7 @@ var init_ptree_cache = __esm({
       /** A path the caller has reason to distrust (an fs event, a sanctioned edit):
        *  its entry is forgotten so the next walk hashes it whatever its stat says. */
       markDirty(cwd, rel) {
-        this.map.delete(join13(cwd, rel));
+        this.map.delete(join14(cwd, rel));
       }
       /**
        * The snapshot entry for `rel`, from the cache when the six-field stat key
@@ -12348,7 +12598,7 @@ var init_ptree_cache = __esm({
        * time, the way the in-process path treats them.
        */
       entry(cwd, rel, compute) {
-        const abs = join13(cwd, rel);
+        const abs = join14(cwd, rel);
         let st;
         try {
           st = lstatSync5(abs, { bigint: true });
@@ -12391,13 +12641,13 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync12, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
 function readServiceState(paths) {
   try {
-    const v = JSON.parse(readFileSync11(paths.state, "utf8"));
+    const v = JSON.parse(readFileSync12(paths.state, "utf8"));
     if (!isRecord(v)) return null;
     const { pid, version, root, started_at } = v;
     if (typeof pid !== "number" || typeof version !== "string" || typeof root !== "string" || typeof started_at !== "string") return null;
@@ -12416,12 +12666,12 @@ function pidAlive2(pid) {
   }
 }
 function listening(socket) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const sock = createConnection2(socket);
     const done = (v) => {
       clearTimeout(timer);
       sock.destroy();
-      resolve16(v);
+      resolve17(v);
     };
     const timer = setTimeout(() => done(false), 1e3);
     sock.once("connect", () => done(true));
@@ -12479,7 +12729,7 @@ function removeQuietly(p) {
   }
 }
 function ensurePrivateDir(dir, uid) {
-  if (!existsSync10(dir)) mkdirSync5(dir, { recursive: true, mode: 448 });
+  if (!existsSync11(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
   const st = lstatSync6(dir);
   if (!st.isDirectory()) throw new Error(`${dir} is not a directory`);
   if (st.uid !== uid) throw new Error(`${dir} is owned by uid ${st.uid}, not ${uid}; refusing to serve from it`);
@@ -12574,11 +12824,11 @@ async function startHookService(opts) {
   });
   const umask = process.umask(63);
   try {
-    await new Promise((resolve16, reject) => {
+    await new Promise((resolve17, reject) => {
       server.once("error", reject);
       server.listen(paths.socket, () => {
         server.off("error", reject);
-        resolve16();
+        resolve17();
       });
     });
   } finally {
@@ -12595,14 +12845,14 @@ async function startHookService(opts) {
     get served() {
       return served;
     },
-    close: () => new Promise((resolve16) => {
-      if (closed) return resolve16();
+    close: () => new Promise((resolve17) => {
+      if (closed) return resolve17();
       closed = true;
       setSnapshotCache(null);
       server.close(() => {
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
-        resolve16();
+        resolve17();
       });
     })
   };
@@ -12631,7 +12881,7 @@ async function stopHookService(paths) {
       process.kill(state.pid, "SIGTERM");
     } catch {
     }
-    const gone = () => !pidAlive2(state.pid) || !existsSync10(paths.socket);
+    const gone = () => !pidAlive2(state.pid) || !existsSync11(paths.socket);
     const until = Date.now() + STOP_WAIT_MS;
     while (!gone() && Date.now() < until) sleepSync(50);
     if (!gone()) throw new Error(`hook service pid ${state.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
@@ -12816,7 +13066,7 @@ var init_verifier_limits = __esm({
 });
 
 // src/safe-write.ts
-import { randomBytes } from "node:crypto";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { lstatSync as lstatSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
 function writeTargetKind(path) {
   let st;
@@ -12845,7 +13095,7 @@ function existingMode(path, fallback) {
   return lstatSync7(path).mode & 511;
 }
 function atomicReplaceFile(path, content, mode) {
-  const tmp = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+  const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
   try {
     writeFileSync7(tmp, content, { encoding: "utf8", flag: "wx", mode });
     renameSync3(tmp, path);
@@ -12862,9 +13112,9 @@ var init_safe_write = __esm({
 
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync5 } from "node:fs";
-import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync13, realpathSync as realpathSync5 } from "node:fs";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative3, resolve as resolve5 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
     return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -12912,7 +13162,7 @@ function stalePin(command) {
   return pin !== null && (pin !== TW_VERSION || !OURS.test(command));
 }
 function bodyHash(body) {
-  return createHash6("sha256").update(body).digest("hex").slice(0, 16);
+  return createHash7("sha256").update(body).digest("hex").slice(0, 16);
 }
 function workflowFile(body) {
   return `${WORKFLOW_MARK} v${TW_VERSION} sha256:${bodyHash(body)}
@@ -12957,34 +13207,34 @@ function verifierCandidates(cwd) {
     if (!candidates.includes(command)) candidates.push(command);
   };
   try {
-    const pkg = JSON.parse(readFileSync12(join14(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync13(join15(cwd, "package.json"), "utf8"));
     const test = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts.test : void 0;
     if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
   } catch {
   }
   try {
-    const pyproject = readFileSync12(join14(cwd, "pyproject.toml"), "utf8");
+    const pyproject = readFileSync13(join15(cwd, "pyproject.toml"), "utf8");
     if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
   } catch {
   }
-  if (existsSync11(join14(cwd, "pytest.ini"))) add("pytest");
+  if (existsSync12(join15(cwd, "pytest.ini"))) add("pytest");
   try {
-    const setupCfg = readFileSync12(join14(cwd, "setup.cfg"), "utf8");
+    const setupCfg = readFileSync13(join15(cwd, "setup.cfg"), "utf8");
     if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
   } catch {
   }
   try {
-    const tox = readFileSync12(join14(cwd, "tox.ini"), "utf8");
+    const tox = readFileSync13(join15(cwd, "tox.ini"), "utf8");
     if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
   } catch {
   }
   try {
-    const cargo = readFileSync12(join14(cwd, "Cargo.toml"), "utf8");
+    const cargo = readFileSync13(join15(cwd, "Cargo.toml"), "utf8");
     if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
   } catch {
   }
   try {
-    const goMod = readFileSync12(join14(cwd, "go.mod"), "utf8");
+    const goMod = readFileSync13(join15(cwd, "go.mod"), "utf8");
     if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
   } catch {
   }
@@ -13024,10 +13274,10 @@ function verifierSetupMessage(cwd) {
   return lines.join("\n");
 }
 function planPolicy(cwd) {
-  const path = join14(cwd, POLICY_FILE);
+  const path = join15(cwd, POLICY_FILE);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "policy", path: POLICY_FILE, status: "error", detail: refused };
-  if (existsSync11(path)) {
+  if (existsSync12(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -13045,8 +13295,8 @@ function planPolicy(cwd) {
 }
 function planGitignore(cwd) {
   const rel = ".gitignore";
-  const path = join14(cwd, rel);
-  if (!existsSync11(join14(cwd, "node_modules"))) return null;
+  const path = join15(cwd, rel);
+  if (!existsSync12(join15(cwd, "node_modules"))) return null;
   let existing = "";
   let kind;
   try {
@@ -13056,7 +13306,7 @@ function planGitignore(cwd) {
   }
   const refused = refuseNonRegular(path);
   if (refused) return { item: "gitignore", path: rel, status: "error", detail: refused };
-  if (kind === "file") existing = readFileSync12(path, "utf8");
+  if (kind === "file") existing = readFileSync13(path, "utf8");
   try {
     const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
       cwd,
@@ -13107,14 +13357,14 @@ function gateVerdicts(event, groups, needle) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join14(cwd, rel);
+  const path = join15(cwd, rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "agent", path: rel, status: "error", detail: refused };
   let settings = {};
-  if (existsSync11(path)) {
+  if (existsSync12(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync13(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -13163,7 +13413,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync11(path) ? "update" : "create",
+    status: existsSync12(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -13196,7 +13446,7 @@ function planClaudeHooks(cwd) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
       if (needDisableFalse) settings.disableAllHooks = false;
-      mkdirSync6(dirname4(path), { recursive: true });
+      mkdirSync7(dirname5(path), { recursive: true });
       atomicReplaceFile(path, JSON.stringify(settings, null, 2) + "\n", existingMode(path, 420));
     }
   };
@@ -13204,14 +13454,14 @@ function planClaudeHooks(cwd) {
 function hooksDir(cwd) {
   try {
     const out3 = execFileSync6("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (out3) return resolve4(cwd, out3);
+    if (out3) return resolve5(cwd, out3);
   } catch {
   }
-  return existsSync11(join14(cwd, ".git")) ? join14(cwd, ".git", "hooks") : null;
+  return existsSync12(join15(cwd, ".git")) ? join15(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute8(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute9(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -13234,29 +13484,29 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync11(join14(cwd, ".husky"))) {
-    path = join14(cwd, ".husky", "pre-commit");
+  if (existsSync12(join15(cwd, ".husky"))) {
+    path = join15(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync11(join14(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync12(join15(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
-    if (basename3(dir) === "_" && basename3(dirname4(dir)) === ".husky") {
-      path = join14(dirname4(dir), "pre-commit");
+    if (basename3(dir) === "_" && basename3(dirname5(dir)) === ".husky") {
+      path = join15(dirname5(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join14(dir, "pre-commit");
+      path = join15(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join14(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join15(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "pre-commit", path: rel, status: "error", detail: refused };
-  const existing = existsSync11(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync12(path) ? readFileSync13(path, "utf8") : null;
   const hookMode = () => existingMode(path, 493) | 73;
   if (existing === null) {
     return {
@@ -13265,7 +13515,7 @@ function planPreCommit(cwd) {
       status: "create",
       detail: `create via ${note}`,
       apply: () => {
-        mkdirSync6(dirname4(path), { recursive: true });
+        mkdirSync7(dirname5(path), { recursive: true });
         atomicReplaceFile(path, `#!/bin/sh
 ${block.join("\n")}
 `, hookMode());
@@ -13342,12 +13592,12 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => writeTargetKind(join14(cwd, r)) !== "absent"
+    (r) => writeTargetKind(join15(cwd, r)) !== "absent"
   );
-  const path = join14(cwd, existingRel ?? rel);
+  const path = join15(cwd, existingRel ?? rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "codeowners", path: existingRel ?? rel, status: "error", detail: refused };
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const existing = existingRel ? readFileSync13(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (existingRel !== void 0 && missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -13373,21 +13623,21 @@ ${CODEOWNERS_MARK}
       warning: `${inferred.owner} was inferred from the origin remote and is not confirmed to be a user. If "${inferred.owner.slice(1)}" is an organisation, replace it with ${inferred.owner}/<team> in CODEOWNERS: GitHub rejects a bare organisation as an owner, and a rule with an invalid owner protects nothing.`
     } : {},
     apply: () => {
-      mkdirSync6(dirname4(path), { recursive: true });
+      mkdirSync7(dirname5(path), { recursive: true });
       atomicReplaceFile(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block, existingMode(path, 420));
     }
   };
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join14(cwd, rel);
+  const path = join15(cwd, rel);
   const write = () => {
-    mkdirSync6(dirname4(path), { recursive: true });
+    mkdirSync7(dirname5(path), { recursive: true });
     atomicReplaceFile(path, workflowFile(WORKFLOW_CONTENT), existingMode(path, 420));
   };
   const refused = refuseNonRegular(path);
   if (refused) return { item: "ci", path: rel, status: "error", detail: refused };
-  if (!existsSync11(path)) {
+  if (!existsSync12(path)) {
     return {
       item: "ci",
       path: rel,
@@ -13398,7 +13648,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync13(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -13459,7 +13709,7 @@ function planInit(cwd, opts = {}) {
   ];
 }
 function runInit(opts) {
-  const requested = resolve4(opts.cwd ?? process.cwd());
+  const requested = resolve5(opts.cwd ?? process.cwd());
   const cwd = repoRoot(requested);
   const w = opts.quiet ? { write: (_text) => true } : process.stdout;
   if (cwd !== requested && !sameDir(cwd, requested)) {
@@ -13657,7 +13907,7 @@ jobs:
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function treeFingerprint(cwd, keepIgnored) {
   const listed = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -13666,7 +13916,7 @@ function treeFingerprint(cwd, keepIgnored) {
     env: trustedGitEnv()
   }).split("\0").filter(Boolean);
   const files = [.../* @__PURE__ */ new Set([...listed, ...keepIgnored ? ignoredPaths({ cwd }, keepIgnored) : []])].sort();
-  const h = createHash7("sha256");
+  const h = createHash8("sha256");
   for (const rel of files) {
     h.update(rel);
     h.update("\0");
@@ -13690,12 +13940,12 @@ var init_fingerprint = __esm({
 });
 
 // src/dependency-env.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   lstatSync as lstatSync8,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync6,
   statSync as statSync3
@@ -13703,19 +13953,19 @@ import {
 import {
   basename as basename4,
   delimiter,
-  dirname as dirname5,
-  isAbsolute as isAbsolute9,
-  join as join15,
+  dirname as dirname6,
+  isAbsolute as isAbsolute10,
+  join as join16,
   relative as relative4,
-  resolve as resolve5,
+  resolve as resolve6,
   sep as sep2
 } from "node:path";
 function metricsFor(descriptor) {
   return descriptor.metrics ??= { fullSnapshots: 0, reusedSnapshots: 0, totalMs: 0 };
 }
 function inside(root, candidate) {
-  const rel = relative4(resolve5(root), resolve5(candidate));
-  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute9(rel);
+  const rel = relative4(resolve6(root), resolve6(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute10(rel);
 }
 function modeKind(path) {
   const st = lstatSync8(path);
@@ -13753,7 +14003,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync13(path));
+      h.update(readFileSync14(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -13774,7 +14024,7 @@ function fingerprintRoot(root, cwd, h) {
       );
     }
     for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join15(dir, entry.name);
+      const path = join16(dir, entry.name);
       const rel = namespace ? namespace + "/" + entry.name : entry.name;
       let ident;
       try {
@@ -13787,7 +14037,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync13(path));
+          h.update(readFileSync14(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -13843,10 +14093,10 @@ function fingerprintRoot(root, cwd, h) {
   walk2(root.realPath, "");
 }
 function snapshot(roots, probes, cwd) {
-  const h = createHash8("sha256");
+  const h = createHash9("sha256");
   for (const probe of probes) {
     h.update(
-      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync12(probe.path) ? "present" : "absent") + "\0"
+      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync13(probe.path) ? "present" : "absent") + "\0"
     );
   }
   for (const root of roots) fingerprintRoot(root, cwd, h);
@@ -13867,7 +14117,7 @@ function freezeRoot(kind, path) {
     if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
-    return { kind, path: resolve5(path), realPath: realpathSync6(path) };
+    return { kind, path: resolve6(path), realPath: realpathSync6(path) };
   } catch (e) {
     throw new Unattestable(
       kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -13903,17 +14153,17 @@ function firstExecutable(command) {
 function resolveExecutable(token, cwd, env) {
   if (!token) return null;
   if (token.includes("/") || token.includes("\\")) {
-    const path = isAbsolute9(token) ? token : resolve5(cwd, token);
+    const path = isAbsolute10(token) ? token : resolve6(cwd, token);
     try {
-      return existsSync12(path) ? realpathSync6(path) : null;
+      return existsSync13(path) ? realpathSync6(path) : null;
     } catch {
       return null;
     }
   }
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
-    const candidate = resolve5(entry, token);
+    const candidate = resolve6(entry, token);
     try {
-      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
+      if (existsSync13(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
     } catch {
     }
   }
@@ -13930,13 +14180,13 @@ function looksPython(command, executable, token) {
 }
 function inferredVenvFromToken(token, cwd) {
   if (!token || !token.includes("/") && !token.includes("\\")) return null;
-  const path = isAbsolute9(token) ? token : resolve5(cwd, token);
+  const path = isAbsolute10(token) ? token : resolve6(cwd, token);
   if (!pythonName(basename4(path))) return null;
-  const parent = dirname5(path);
+  const parent = dirname6(path);
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
-  const root = dirname5(parent);
-  return existsSync12(join15(root, "pyvenv.cfg")) ? root : null;
+  const root = dirname6(parent);
+  return existsSync13(join16(root, "pyvenv.cfg")) ? root : null;
 }
 function unsupportedEcosystem(command, token) {
   const name = token ? basename4(token).toLowerCase() : "";
@@ -13948,17 +14198,17 @@ function unsupportedEcosystem(command, token) {
 }
 function inferredVenv(executable) {
   if (!executable) return null;
-  const parent = dirname5(executable);
+  const parent = dirname6(executable);
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
-  const root = dirname5(parent);
-  return existsSync12(join15(root, "pyvenv.cfg")) ? root : null;
+  const root = dirname6(parent);
+  return existsSync13(join16(root, "pyvenv.cfg")) ? root : null;
 }
 function venvProblem(root) {
-  const cfg = join15(root, "pyvenv.cfg");
-  if (!existsSync12(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
+  const cfg = join16(root, "pyvenv.cfg");
+  if (!existsSync13(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync13(cfg, "utf8");
+    const body = readFileSync14(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -13968,7 +14218,7 @@ function venvProblem(root) {
   return null;
 }
 function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
-  const cwd = resolve5(cwdInput);
+  const cwd = resolve6(cwdInput);
   const roots = [];
   const probes = [];
   const seen = /* @__PURE__ */ new Set();
@@ -13982,21 +14232,21 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
     }
   };
   try {
-    const nodeModules = join15(cwd, "node_modules");
-    if (existsSync12(nodeModules)) addRoot("node_modules", nodeModules);
+    const nodeModules = join16(cwd, "node_modules");
+    if (existsSync13(nodeModules)) addRoot("node_modules", nodeModules);
     else probes.push({ kind: "node_modules", path: nodeModules });
     const token = firstExecutable(command);
     const executable = resolveExecutable(token, cwd, env);
     let venv = null;
     if (env.VIRTUAL_ENV?.trim()) {
-      if (!isAbsolute9(env.VIRTUAL_ENV)) {
+      if (!isAbsolute10(env.VIRTUAL_ENV)) {
         throw new Unattestable("VIRTUAL_ENV is relative (" + JSON.stringify(env.VIRTUAL_ENV) + ")");
       }
-      venv = resolve5(env.VIRTUAL_ENV);
+      venv = resolve6(env.VIRTUAL_ENV);
     } else {
       venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
-      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync12(join15(cwd, ".venv", "pyvenv.cfg"))) {
-        venv = join15(cwd, ".venv");
+      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync13(join16(cwd, ".venv", "pyvenv.cfg"))) {
+        venv = join16(cwd, ".venv");
       }
     }
     if (venv) {
@@ -14032,7 +14282,7 @@ function checkDependencyEnvironment(cwdInput, descriptor) {
     const fingerprint2 = measuredSnapshot(
       descriptor.roots,
       descriptor.probes,
-      resolve5(cwdInput),
+      resolve6(cwdInput),
       metricsFor(descriptor)
     );
     if (fingerprint2 !== descriptor.fingerprint) {
@@ -14045,7 +14295,7 @@ function checkDependencyEnvironment(cwdInput, descriptor) {
 }
 function attestDependencyEnvironment(cwdInput, descriptor) {
   const attestation = {
-    cwd: resolve5(cwdInput),
+    cwd: resolve6(cwdInput),
     descriptor,
     check: checkDependencyEnvironment(cwdInput, descriptor)
   };
@@ -14053,7 +14303,7 @@ function attestDependencyEnvironment(cwdInput, descriptor) {
   return attestation;
 }
 function reuseDependencyEnvironmentAttestation(cwdInput, descriptor, attestation) {
-  if (!attestation || !issuedAttestations.has(attestation) || attestation.descriptor !== descriptor || attestation.cwd !== resolve5(cwdInput)) return null;
+  if (!attestation || !issuedAttestations.has(attestation) || attestation.descriptor !== descriptor || attestation.cwd !== resolve6(cwdInput)) return null;
   metricsFor(descriptor).reusedSnapshots += 1;
   return attestation.check;
 }
@@ -14102,7 +14352,7 @@ var init_dependency_env = __esm({
 import { spawnSync } from "node:child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function emptySuiteDiagnostics() {
   return {
     stdout: { ...EMPTY_STREAM },
@@ -14181,8 +14431,8 @@ function parseCapturedSupervisorResult(stdoutText) {
   };
 }
 function runCapturedProcessSync(executable, args, opts) {
-  const stateDir = mkdtempSync2(join16(tmpdir3(), "tw-suite-capture-"));
-  const configFile = join16(stateDir, "config.json");
+  const stateDir = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
+  const configFile = join17(stateDir, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
     writeFileSync8(
@@ -14417,10 +14667,10 @@ if (child) {
 });
 
 // src/verifier-backend.ts
-import { createHash as createHash9, randomUUID } from "node:crypto";
+import { createHash as createHash10, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync16, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve7 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
   const groups = typeof process.getgroups === "function" ? process.getgroups() : [];
@@ -14440,12 +14690,12 @@ function writableByCaller(path) {
   }
 }
 function replaceableByCaller(path) {
-  let current = resolve6(path);
+  let current = resolve7(path);
   if (writableByCaller(current)) return true;
-  current = dirname6(current);
+  current = dirname7(current);
   while (true) {
     if (writableByCaller(current)) return true;
-    const parent = dirname6(current);
+    const parent = dirname7(current);
     if (parent === current) break;
     current = parent;
   }
@@ -14454,7 +14704,7 @@ function replaceableByCaller(path) {
 function findExecutable(name) {
   for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
     if (!raw) continue;
-    const candidate = join17(raw, name);
+    const candidate = join18(raw, name);
     try {
       accessSync2(candidate, constants3.X_OK);
       return realpathSync7(candidate);
@@ -14464,7 +14714,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash9("sha256").update(readFileSync15(path)).digest("hex");
+  return createHash10("sha256").update(readFileSync16(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -14786,7 +15036,7 @@ function runContainerStage(backend, dir, command, budgetSecs) {
   const args = containerRunArgs({
     image: backend.image,
     name,
-    workspace: resolve6(dir),
+    workspace: resolve7(dir),
     command,
     uid,
     gid,
@@ -14797,7 +15047,7 @@ function runContainerStage(backend, dir, command, budgetSecs) {
       backend.enginePath,
       dockerArgs(backend.daemonHost, args),
       {
-        cwd: dirname6(backend.enginePath),
+        cwd: dirname7(backend.enginePath),
         env: engineClientEnv(),
         timeoutMs: budgetSecs * 1e3,
         backstopMs: 3e4
@@ -14897,10 +15147,10 @@ var init_verifier_backend = __esm({
 
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
+import { createHash as createHash11 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve7, sep as sep3 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute11, join as join19, relative as relative5, resolve as resolve8, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
   return {
     level: "suite-exit-only",
@@ -14926,8 +15176,8 @@ function baseIsAncestorOfHead(base, cwd) {
   return r.status === 0;
 }
 function inside2(root, path) {
-  const rel = relative5(resolve7(root), resolve7(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute10(rel);
+  const rel = relative5(resolve8(root), resolve8(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute11(rel);
 }
 function linkParts(path) {
   const parts = sep3 === "\\" ? path.split(/[\\/]+/) : path.split("/");
@@ -14940,10 +15190,10 @@ function driveRelativeLinkTarget(target) {
   return sep3 === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
 }
 function rootedLinkTarget(target) {
-  return isAbsolute10(target) || driveRelativeLinkTarget(target);
+  return isAbsolute11(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out3, root, label) {
-  if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out3), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve8(dirname8(out3), target))) {
     throw linkEscape(label, target);
   }
   rmSync7(out3, { force: true });
@@ -14951,7 +15201,7 @@ function safeSymlink(target, out3, root, label) {
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative5(root, dirname7(out3)));
+  let stack = linkParts(relative5(root, dirname8(out3)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -14968,7 +15218,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "deps" && dependencyRoot ? dependencyRoot : root;
-    const current = join18(base, ...stack);
+    const current = join19(base, ...stack);
     let st;
     try {
       st = lstatSync9(current);
@@ -14989,12 +15239,12 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
     if (driveRelativeLinkTarget(next)) {
       throw linkEscape(label, target);
     }
-    if (isAbsolute10(next)) {
+    if (isAbsolute11(next)) {
       if (domain === "tree" || !dependencyRoot || !inside2(dependencyRoot, next)) {
         throw linkEscape(label, target);
       }
       stack = [];
-      pending.unshift(...linkParts(relative5(dependencyRoot, resolve7(next))));
+      pending.unshift(...linkParts(relative5(dependencyRoot, resolve8(next))));
     } else {
       pending.unshift(...linkParts(next));
     }
@@ -15004,7 +15254,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join18(current, part);
+    current = join19(current, part);
     let st;
     try {
       st = lstatSync9(current);
@@ -15020,7 +15270,7 @@ function materialize(cwd, dest, dependencyRoot) {
   const listed = workingTreePaths(cwd);
   const links = [];
   for (const rel of listed) {
-    const src = join18(cwd, rel);
+    const src = join19(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -15028,8 +15278,8 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out3 = join18(dest, rel);
-    mkdirSync7(dirname7(out3), { recursive: true });
+    const out3 = join19(dest, rel);
+    mkdirSync8(dirname8(out3), { recursive: true });
     dropSymlink(out3);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -15045,17 +15295,17 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join18(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join19(dest, "node_modules"), "dir");
 }
 function workingTreePaths(cwd) {
   return git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
 }
 function probeFilesystemCaseSensitivity(dir) {
-  const upper = join18(dir, ".tw-case-probe-A");
-  const lower = join18(dir, ".tw-case-probe-a");
+  const upper = join19(dir, ".tw-case-probe-A");
+  const lower = join19(dir, ".tw-case-probe-a");
   try {
     writeFileSync9(upper, "", { flag: "wx" });
-    return !existsSync13(lower);
+    return !existsSync14(lower);
   } finally {
     rmSync7(upper, { force: true });
   }
@@ -15111,15 +15361,15 @@ function baseEntries(base, cwd) {
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash10("sha256");
+  const h = createHash11("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join18(dest, rel);
+    const p = join19(dest, rel);
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync17(p));
     } catch {
       h.update("<gone>");
     }
@@ -15149,8 +15399,8 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out3 = join18(dest, e.path);
-    mkdirSync7(dirname7(out3), { recursive: true });
+    const out3 = join19(dest, e.path);
+    mkdirSync8(dirname8(out3), { recursive: true });
     rmSync7(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
@@ -15166,7 +15416,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync7(join18(dest, rel), { force: true });
+    rmSync7(join19(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -15180,8 +15430,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join18(scratch, "npmrc-user");
-  const globalRc = join18(scratch, "npmrc-global");
+  const userRc = join19(scratch, "npmrc-user");
+  const globalRc = join19(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync9(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -15213,7 +15463,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
     };
   }
-  const scratch = mkdtempSync3(join18(tmpdir4(), "tw-verify-run-"));
+  const scratch = mkdtempSync3(join19(tmpdir4(), "tw-verify-run-"));
   try {
     const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
@@ -15402,8 +15652,8 @@ function runVerify(opts) {
   } catch {
     return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
-  const visRoot = mkdtempSync3(join18(tmpdir4(), "tw-verify-vis-"));
-  const visDir = join18(visRoot, "t");
+  const visRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-vis-"));
+  const visDir = join19(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync7(d, { recursive: true, force: true });
@@ -15412,7 +15662,7 @@ function runVerify(opts) {
   if (!filesystemCaseSensitive) {
     const present = (rel) => {
       try {
-        lstatSync9(join18(cwd, rel));
+        lstatSync9(join19(cwd, rel));
         return true;
       } catch {
         return false;
@@ -15444,7 +15694,7 @@ function runVerify(opts) {
     );
   }
   try {
-    mkdirSync7(visDir);
+    mkdirSync8(visDir);
     materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
@@ -15498,12 +15748,12 @@ function runVerify(opts) {
       { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
     );
   }
-  const priRoot = mkdtempSync3(join18(tmpdir4(), "tw-verify-pri-"));
-  const priDir = join18(priRoot, "t");
+  const priRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-pri-"));
+  const priDir = join19(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
-    mkdirSync7(priDir);
+    mkdirSync8(priDir);
     materialize(cwd, priDir, frozenNodeModules);
     ({ restored, removed: removedAdded } = overlayPristine(
       cwd,
@@ -15772,10 +16022,10 @@ var init_verify = __esm({
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync9, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync18, readlinkSync as readlinkSync4, realpathSync as realpathSync9, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join20, resolve as resolve9 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
@@ -15812,7 +16062,7 @@ function writableByCaller2(path) {
       return true;
     } catch {
     }
-    const parent = dirname8(cur);
+    const parent = dirname9(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -15851,9 +16101,9 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   };
 }
 function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
-  const stateDir = mkdtempSync4(join19(tmpdir5(), "tw-agent-supervisor-"));
-  const resultFile = join19(stateDir, "result.json");
-  const agentEnvFile = join19(stateDir, "agent-env.json");
+  const stateDir = mkdtempSync4(join20(tmpdir5(), "tw-agent-supervisor-"));
+  const resultFile = join20(stateDir, "result.json");
+  const agentEnvFile = join20(stateDir, "agent-env.json");
   try {
     const linux = process.platform === "linux";
     let executable;
@@ -15927,7 +16177,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync17(resultFile, "utf8"));
+      state = JSON.parse(readFileSync18(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -15971,7 +16221,7 @@ function observerExited(pid) {
   if (!pidAlive3(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -15979,11 +16229,11 @@ function observerExited(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join19(cwd, ".git");
-  return join19(
+  const gd = gitDir(cwd) ?? join20(cwd, ".git");
+  return join20(
     gd,
     "tamperward",
-    `run-observer-${process.pid}-${Date.now()}-${randomBytes2(4).toString("hex")}.jsonl`
+    `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
   );
 }
 function startSupervisedObserver(cwd, base, entry) {
@@ -15994,7 +16244,7 @@ function startSupervisedObserver(cwd, base, entry) {
   try {
     child = spawn(
       process.execPath,
-      [resolve8(cliEntry), "watch", "--dir", cwd, "--log", log, "--base", base],
+      [resolve9(cliEntry), "watch", "--dir", cwd, "--log", log, "--base", base],
       {
         cwd,
         stdio: ["ignore", "ignore", "inherit"],
@@ -16093,7 +16343,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync18("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -16116,7 +16366,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -16131,7 +16381,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     for (const link of procLinks) {
       try {
         const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
-        const held = raw.startsWith("/") ? resolve8(raw) : raw;
+        const held = raw.startsWith("/") ? resolve9(raw) : raw;
         if (held === real || held.startsWith(real + "/")) {
           holds = true;
           break;
@@ -16144,7 +16394,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out3;
 }
 function runEnvelope(opts) {
-  const cwd = resolve8(opts.cwd ?? process.cwd());
+  const cwd = resolve9(opts.cwd ?? process.cwd());
   const say = opts.json ? (_s) => {
   } : out;
   if (!opts.argv.length) {
@@ -16688,8 +16938,8 @@ raise SystemExit(0)
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import { join as join20, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync5 } from "node:fs";
+import { join as join21, resolve as resolve10 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
     if (linuxPython?.path) {
@@ -16744,10 +16994,10 @@ function wiringState(status, authority) {
   return authority ? "BROKEN" : "WARN";
 }
 function pinsInFile(path) {
-  if (!existsSync14(path)) return [];
+  if (!existsSync15(path)) return [];
   let src = "";
   try {
-    src = readFileSync18(path, "utf8");
+    src = readFileSync19(path, "utf8");
   } catch {
     return [];
   }
@@ -16767,14 +17017,14 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
   const broken = [];
   const warnings = [];
   for (const rel of workflowRels) {
-    const path = resolve9(cwd, rel);
-    if (!existsSync14(path)) {
+    const path = resolve10(cwd, rel);
+    if (!existsSync15(path)) {
       broken.push(`${rel} is missing`);
       continue;
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(path, "utf8"));
+      doc = yaml.parse(readFileSync19(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -16887,9 +17137,9 @@ function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow =
   addWiring("codeowners", "codeowners", true);
   checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
-    ...pinsInFile(join20(cwd, ".claude", "settings.json")),
-    ...pinsInFile(join20(cwd, ".git", "hooks", "pre-commit")),
-    ...pinsInFile(join20(cwd, ".husky", "pre-commit"))
+    ...pinsInFile(join21(cwd, ".claude", "settings.json")),
+    ...pinsInFile(join21(cwd, ".git", "hooks", "pre-commit")),
+    ...pinsInFile(join21(cwd, ".husky", "pre-commit"))
   ];
   const below = pins.filter((pin) => (compareVersions(pin, TW_VERSION) ?? 0) < 0);
   const above = pins.filter((pin) => (compareVersions(TW_VERSION, pin) ?? 0) < 0);
@@ -17114,7 +17364,7 @@ function verifyJobs(doc) {
   return found;
 }
 function diagnose(opts = {}) {
-  const cwd = repoRoot(resolve9(opts.cwd ?? process.cwd()));
+  const cwd = repoRoot(resolve10(opts.cwd ?? process.cwd()));
   let policy;
   try {
     policy = policyFor(opts, cwd);
@@ -17138,8 +17388,8 @@ function diagnose(opts = {}) {
     workflowRels.push(opts.workflow);
   } else {
     const workflowDirRel = ".github/workflows";
-    const workflowDir = resolve9(cwd, workflowDirRel);
-    if (!existsSync14(workflowDir)) {
+    const workflowDir = resolve10(cwd, workflowDirRel);
+    if (!existsSync15(workflowDir)) {
       return fail("ci-verifier", `${workflowDirRel}: workflow directory does not exist`);
     }
     let entries;
@@ -17151,20 +17401,20 @@ function diagnose(opts = {}) {
         `${workflowDirRel}: could not enumerate workflows (${e instanceof Error ? e.message : String(e)})`
       );
     }
-    for (const name of entries) workflowRels.push(join20(workflowDirRel, name));
+    for (const name of entries) workflowRels.push(join21(workflowDirRel, name));
   }
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
   let verifyJobCount = 0;
   const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
-    const workflowPath = resolve9(cwd, workflowRel);
-    if (!existsSync14(workflowPath)) {
+    const workflowPath = resolve10(cwd, workflowRel);
+    if (!existsSync15(workflowPath)) {
       return fail("ci-verifier", `${workflowRel}: workflow does not exist`);
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync19(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -17320,16 +17570,16 @@ var init_doctor = __esm({
 // src/cli/trace-verify.ts
 import { execFileSync as execFileSync11, spawnSync as spawnSync5 } from "node:child_process";
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync6,
   realpathSync as realpathSync10,
   rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve10, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join22, relative as relative6, resolve as resolve11, sep as sep4 } from "node:path";
 function unescapeStraceString(s) {
   return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
@@ -17354,11 +17604,11 @@ function parseStraceFileAccess(raw) {
   return out3;
 }
 function inside3(root, path) {
-  const rel = relative6(resolve10(root), resolve10(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute11(rel);
+  const rel = relative6(resolve11(root), resolve11(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute12(rel);
 }
 function normalRepoPath(root, raw) {
-  const abs = isAbsolute11(raw) ? resolve10(raw) : resolve10(root, raw);
+  const abs = isAbsolute12(raw) ? resolve11(raw) : resolve11(root, raw);
   if (!inside3(root, abs)) return null;
   const rel = relative6(root, abs).split(sep4).join("/");
   return rel && rel !== ".." ? rel : null;
@@ -17378,7 +17628,7 @@ function summarizeTraceRuns(opts) {
     for (const item of run) {
       const rel = normalRepoPath(opts.root, item.path);
       const isTracked = rel !== null && opts.tracked.has(rel);
-      const keyPath = rel !== null ? opts.tracked.has(rel) ? rel : null : resolve10(opts.root, item.path);
+      const keyPath = rel !== null ? opts.tracked.has(rel) ? rel : null : resolve11(opts.root, item.path);
       if (keyPath === null) continue;
       const target = isTracked ? repo : external;
       const key2 = `${isTracked ? "repo" : "external"}\0${keyPath}`;
@@ -17455,36 +17705,36 @@ function materializeBase(base, cwd, dest) {
       `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
     );
   }
-  const hostModules = join21(cwd, "node_modules");
-  const tracedModules = join21(dest, "node_modules");
-  if (existsSync15(hostModules) && !existsSync15(tracedModules)) {
-    symlinkSync2(resolve10(hostModules), tracedModules, "dir");
+  const hostModules = join22(cwd, "node_modules");
+  const tracedModules = join22(dest, "node_modules");
+  if (existsSync16(hostModules) && !existsSync16(tracedModules)) {
+    symlinkSync2(resolve11(hostModules), tracedModules, "dir");
   }
 }
 function traceFiles(prefix) {
-  const dir = resolve10(prefix, "..");
+  const dir = resolve11(prefix, "..");
   const base = prefix.split(sep4).at(-1) ?? prefix;
-  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join21(dir, name)).sort();
+  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join22(dir, name)).sort();
 }
 function rewriteTraceRoot(accesses, actualRoot) {
   return accesses.map((item) => {
-    const abs = isAbsolute11(item.path) ? resolve10(item.path) : resolve10(actualRoot, item.path);
+    const abs = isAbsolute12(item.path) ? resolve11(item.path) : resolve11(actualRoot, item.path);
     if (!inside3(actualRoot, abs)) return { ...item, path: abs };
     const rel = relative6(actualRoot, abs).split(sep4).join("/");
     try {
-      const real = resolve10(realpathSync10(abs));
+      const real = resolve11(realpathSync10(abs));
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
-    return { ...item, path: join21(TRACE_ROOT, ...rel.split("/")) };
+    return { ...item, path: join22(TRACE_ROOT, ...rel.split("/")) };
   });
 }
 function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join21(tmpdir6(), "tw-trace-base-"));
-  const traceDir = mkdtempSync5(join21(tmpdir6(), "tw-trace-log-"));
+  const root = mkdtempSync5(join22(tmpdir6(), "tw-trace-base-"));
+  const traceDir = mkdtempSync5(join22(tmpdir6(), "tw-trace-log-"));
   try {
     materializeBase(base, cwd, root);
-    const prefix = join21(traceDir, "trace");
+    const prefix = join22(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
       [
@@ -17517,7 +17767,7 @@ function runOneTrace(cwd, base, command, budget) {
     if (logs.length === 0) {
       throw new Error("strace produced no trace files");
     }
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync19(path, "utf8")));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8")));
     return {
       exit: traced.status ?? 1,
       accesses: rewriteTraceRoot(accesses, root)
@@ -17561,7 +17811,7 @@ function renderText2(report2) {
   for (const note of report2.notes) out3(`note: ${note}`);
 }
 function runTraceVerify(opts = {}) {
-  const cwd = resolve10(opts.cwd ?? process.cwd());
+  const cwd = resolve11(opts.cwd ?? process.cwd());
   if (process.platform !== "linux") {
     process.stderr.write("tamperward trace-verify: Linux only in this release; unsupported platform \u2014 no parity is implied.\n");
     return 2;
@@ -17706,11 +17956,88 @@ var init_trace_verify = __esm({
   }
 });
 
+// src/runtimes.ts
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join23 } from "node:path";
+function detectRuntimes(cwd) {
+  const found = [];
+  for (const rt of KNOWN_RUNTIMES) {
+    const matchedMarker = rt.markers.find((m) => {
+      try {
+        return existsSync17(join23(cwd, m));
+      } catch {
+        return false;
+      }
+    });
+    if (matchedMarker !== void 0) found.push({ ...rt, matchedMarker });
+  }
+  return found;
+}
+function hasInLoopRuntime(detected) {
+  return detected.some((r) => r.steering === "in-loop");
+}
+function detectionHeadline(detected) {
+  if (detected.length === 0) {
+    return "No agent runtime detected. Wiring Claude Code in-loop steering plus the agent-neutral layers (pre-commit + CI) that protect any agent or human.";
+  }
+  if (detected.length === 1) {
+    const r = detected[0];
+    return `Detected ${r.label} \u2014 ${r.note}`;
+  }
+  const parts = detected.map((r) => `${r.label} (${r.steering === "in-loop" ? "in-loop" : "neutral layers"})`);
+  return `Detected ${detected.length} agent runtimes: ${parts.join(", ")}.`;
+}
+function neutralOnlyCaveat(detected) {
+  if (detected.length === 0 || hasInLoopRuntime(detected)) return null;
+  const names = detected.map((r) => r.label).join(", ");
+  const tracking = [...new Set(detected.map((r) => r.adapterTracking).filter(Boolean))].join(", ");
+  return `In-loop steering (deny-before-execute) ships for Claude Code only today, so on ${names} your live protection is the agent-neutral layers: pre-commit and CI. The Claude hook wiring is still written and is inert unless Claude Code runs in this repository.${tracking ? ` A native in-loop adapter is tracked in ${tracking}.` : ""}`;
+}
+var KNOWN_RUNTIMES;
+var init_runtimes = __esm({
+  "src/runtimes.ts"() {
+    "use strict";
+    KNOWN_RUNTIMES = [
+      {
+        id: "claude-code",
+        label: "Claude Code",
+        markers: [".claude/settings.json", ".claude"],
+        steering: "in-loop",
+        note: "native in-loop steering (PreToolUse deny + Stop sweep) plus the agent-neutral layers."
+      },
+      {
+        id: "cursor",
+        label: "Cursor",
+        markers: [".cursor", ".cursorrules"],
+        steering: "neutral",
+        adapterTracking: "#482",
+        note: "agent-neutral layers (pre-commit + CI) today; a native in-loop adapter is tracked in #482."
+      },
+      {
+        id: "copilot",
+        label: "GitHub Copilot",
+        markers: [".github/copilot-instructions.md", ".github/copilot"],
+        steering: "neutral",
+        adapterTracking: "#482",
+        note: "agent-neutral layers (pre-commit + CI) today; a native in-loop adapter is tracked in #482."
+      },
+      {
+        id: "codex",
+        label: "an AGENTS.md-aware agent (e.g. Codex)",
+        markers: [".codex", "AGENTS.md"],
+        steering: "neutral",
+        adapterTracking: "#482",
+        note: "agent-neutral layers (pre-commit + CI) today; a native in-loop adapter is tracked in #482."
+      }
+    ];
+  }
+});
+
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
+import { join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
 import { parseDocument } from "yaml";
 function readlineAsker(input, output) {
@@ -17719,9 +18046,9 @@ function readlineAsker(input, output) {
   let pending = null;
   rl.on("close", () => {
     closed = true;
-    const resolve16 = pending;
+    const resolve17 = pending;
     pending = null;
-    resolve16?.(null);
+    resolve17?.(null);
   });
   rl.on("SIGINT", () => rl.close());
   const ask = (question) => new Promise((resolvePromise) => {
@@ -17747,7 +18074,7 @@ function terminalText(text) {
   return stripControl(text).replace(/\s+/g, " ").trim();
 }
 function committableSetupPath(cwd, path) {
-  const rel = relative7(cwd, resolve11(cwd, path));
+  const rel = relative7(cwd, resolve12(cwd, path));
   if (!rel || rel === ".." || rel.startsWith(".." + sep5)) return false;
   return rel !== ".git" && !rel.startsWith(".git" + sep5);
 }
@@ -17778,13 +18105,13 @@ function explainVerdict(v, code2) {
   }
 }
 function writeVerifyCommand(cwd, command) {
-  const path = join22(cwd, POLICY_FILE);
+  const path = join24(cwd, POLICY_FILE);
   const kind = writeTargetKind(path);
   if (kind === "symlink" || kind === "irregular") {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync20(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -17807,7 +18134,7 @@ function writeVerifyCommand(cwd, command) {
   }
 }
 async function runOnboard(opts, io = {}) {
-  const requestedCwd = resolve11(opts.cwd ?? process.cwd());
+  const requestedCwd = resolve12(opts.cwd ?? process.cwd());
   const out3 = io.out ?? ((line) => void process.stdout.write(line + "\n"));
   const errLine = (line) => void process.stderr.write(line + "\n");
   const rawErr = (line) => errLine(terminalText(line));
@@ -17847,7 +18174,7 @@ async function runOnboard(opts, io = {}) {
     fail(requestedCwd + " is not inside a Git repository. Run `git init` first.");
     return 2;
   }
-  const cwd = resolve11(rootText);
+  const cwd = resolve12(rootText);
   let sameRoot = cwd === requestedCwd;
   try {
     sameRoot = realpathSync11(cwd) === realpathSync11(requestedCwd);
@@ -17932,11 +18259,15 @@ async function runOnboard(opts, io = {}) {
       }
     }
     section(2);
+    const detected = detectRuntimes(cwd);
+    status("RUNTIME", detectionHeadline(detected), "info");
+    const caveat = neutralOnlyCaveat(detected);
+    if (caveat) status("NOTE", caveat, "warn");
     const plan = planInit(cwd);
     const names = {
       policy: "Policy",
       gitignore: "Git ignore",
-      agent: "Claude hooks",
+      agent: "In-loop (Claude)",
       "pre-commit": "Pre-commit",
       ci: "CI workflow",
       codeowners: "CODEOWNERS"
@@ -18173,13 +18504,13 @@ function runDemo(cwd, head, runners, out3) {
   }
   const before = treeFingerprint(cwd);
   out3(`working tree fingerprint before: ${before.slice(0, 16)}`);
-  const wt = mkdtempSync6(join22(tmpdir7(), "tw-onboard-demo-"));
+  const wt = mkdtempSync6(join24(tmpdir7(), "tw-onboard-demo-"));
   try {
     if (git5(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
       out3("Demo skipped: could not create a temporary worktree (git worktree add failed).");
       return;
     }
-    const targetPath = join22(wt, target.path);
+    const targetPath = join24(wt, target.path);
     const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
@@ -18234,6 +18565,7 @@ var init_onboard = __esm({
     init_policy();
     init_policy_load();
     init_narrow();
+    init_runtimes();
     init_wiring();
     init_safe_write();
     Aborted = class extends Error {
@@ -18264,7 +18596,7 @@ var init_onboard = __esm({
 });
 
 // src/research/adapter.ts
-import { isAbsolute as isAbsolute12, resolve as resolve12 } from "node:path";
+import { isAbsolute as isAbsolute13, resolve as resolve13 } from "node:path";
 function taskEnv(task) {
   return {
     TAMPERWARD_RESEARCH_TASK: task.id,
@@ -18280,7 +18612,7 @@ function normalizeCommandArgv(argv, cwd = process.cwd()) {
     throw new ResearchError('the command adapter needs an agent command after "--"');
   }
   const head = argv[0];
-  return head.includes("/") && !isAbsolute12(head) ? [resolve12(cwd, head), ...argv.slice(1)] : [...argv];
+  return head.includes("/") && !isAbsolute13(head) ? [resolve13(cwd, head), ...argv.slice(1)] : [...argv];
 }
 function commandAdapter(argv, cwd = process.cwd()) {
   const anchored = normalizeCommandArgv(argv, cwd);
@@ -18379,9 +18711,9 @@ var init_capture = __esm({
 });
 
 // src/research/manifest.ts
-import { createHash as createHash12 } from "node:crypto";
-import { readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname9, resolve as resolve13 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { dirname as dirname10, resolve as resolve14 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
   if (!isRecord(raw)) throw new ResearchError(`task manifest: ${where} is not an object`);
@@ -18404,17 +18736,17 @@ function taskFrom(raw, index, manifestDir) {
   const isUrl = /^[a-z][a-z0-9+.-]*:\/\//i.test(repo) || /^[^/]+@[^:]+:/.test(repo);
   return {
     id,
-    repo: isUrl ? repo : resolve13(manifestDir, repo),
+    repo: isUrl ? repo : resolve14(manifestDir, repo),
     base: base ?? "HEAD",
     prompt,
     verify: { command: verify.command, ...budget !== void 0 ? { budget } : {} }
   };
 }
 function readManifest(path) {
-  const abs = resolve13(path);
+  const abs = resolve14(path);
   let bytes;
   try {
-    bytes = readFileSync21(abs);
+    bytes = readFileSync22(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -18431,13 +18763,13 @@ function readManifest(path) {
   if (!Array.isArray(raw.tasks) || raw.tasks.length === 0) {
     throw new ResearchError(`task manifest ${abs}: no tasks (tasks must be a non-empty array)`);
   }
-  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname9(abs)));
+  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname10(abs)));
   const seen = /* @__PURE__ */ new Set();
   for (const t of tasks) {
     if (seen.has(t.id)) throw new ResearchError(`task manifest ${abs}: duplicate task id "${t.id}"`);
     seen.add(t.id);
   }
-  return { path: abs, sha256: createHash12("sha256").update(bytes).digest("hex"), tasks };
+  return { path: abs, sha256: createHash13("sha256").update(bytes).digest("hex"), tasks };
 }
 var MANIFEST_VERSION;
 var init_manifest = __esm({
@@ -18626,18 +18958,18 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join23, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join25, resolve as resolve15 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function pairRecordPath(ledger, task, pair) {
-  return join23(ledger, "pairs", `${task}--${pair}.json`);
+  return join25(ledger, "pairs", `${task}--${pair}.json`);
 }
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync22(path, "utf8"));
+    raw = JSON.parse(readFileSync23(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -18678,9 +19010,9 @@ function writeRecordAtomically(path, text) {
   renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws3 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  const ws3 = join25(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
   rmSync11(ws3, { recursive: true, force: true });
-  mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
+  mkdirSync9(join25(ledger, "workspaces"), { recursive: true });
   try {
     execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws3], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
@@ -18926,16 +19258,16 @@ function runResearch(opts) {
     err2("tamperward research: the gated arm cannot start here (see `tamperward doctor`); run as a non-root user on Linux.");
     return 2;
   }
-  const ledger = resolve14(opts.out);
+  const ledger = resolve15(opts.out);
   const pairs = opts.pairs ?? 1;
-  mkdirSync8(join23(ledger, "pairs"), { recursive: true });
+  mkdirSync9(join25(ledger, "pairs"), { recursive: true });
   for (const task of tasks) {
     const existingRecords = /* @__PURE__ */ new Map();
     let sourceBase = null;
     try {
       for (let pair = 1; pair <= pairs; pair++) {
         const path = pairRecordPath(ledger, task.id, pair);
-        if (!existsSync16(path)) continue;
+        if (!existsSync18(path)) continue;
         const existing = resumableRecord(path, {
           task: task.id,
           pair,
@@ -19060,10 +19392,10 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync23 } from "node:fs";
-import { join as join24, resolve as resolve15 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
+import { join as join26, resolve as resolve16 } from "node:path";
 function readLedger2(dir) {
-  const pairsDir = join24(resolve15(dir), "pairs");
+  const pairsDir = join26(resolve16(dir), "pairs");
   let names;
   try {
     names = readdirSync7(pairsDir).filter((n) => n.endsWith(".json")).sort();
@@ -19072,10 +19404,10 @@ function readLedger2(dir) {
   }
   if (names.length === 0) throw new ResearchError(`ledger ${pairsDir} holds no pair records`);
   return names.map((n) => {
-    const path = join24(pairsDir, n);
+    const path = join26(pairsDir, n);
     let raw;
     try {
-      raw = JSON.parse(readFileSync23(path, "utf8"));
+      raw = JSON.parse(readFileSync24(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -19316,6 +19648,17 @@ function parseDoctor(args) {
   }
   return o;
 }
+function parseStats(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--file") o.file = args[++i];
+    else if (a === "--since") o.since = args[++i];
+    else if (a === "--json") o.json = true;
+  }
+  return o;
+}
 function parseCheck(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -19455,6 +19798,16 @@ function validateCliArgs(cmd, args) {
       }
     }).error;
   }
+  if (cmd === "stats") {
+    return validateFlatArgs(args, {
+      flags: ["--json"],
+      values: {
+        "--cwd": "string",
+        "--file": "string",
+        "--since": "string"
+      }
+    }).error;
+  }
   if (cmd === "onboard") {
     const parsed = validateFlatArgs(args, {
       flags: ["--yes", "--skip-demo", "--demo", "--no-github"],
@@ -19615,6 +19968,12 @@ Formats:
   tamperward research summarize --ledger D  aggregate measured pairs into model behaviour,
                                              independent outcome, TamperWard hits/misses
                                              and paired counts \u2014 no composite score
+  tamperward stats [--file F] [--since 30d] aggregate privacy-safe hook/sweep audit
+             [--json] [--cwd D]              events by rule and enforcement surface.
+                                             Defaults to the repository-local
+                                             .git/tamperward/audit.jsonl (or
+                                             TAMPERWARD_AUDIT_LOG). A finding is an
+                                             integrity signal, not proof of agent intent.
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
              [--file F] [--cwd D]
   tamperward onboard [--yes] [--cwd D]      guided first-run setup: preflight, the
@@ -19685,6 +20044,8 @@ function main(argv) {
       return runInit(parseInit(rest));
     case "doctor":
       return runDoctor(parseDoctor(rest));
+    case "stats":
+      return runStats(parseStats(rest));
     case "onboard":
       return runOnboard(parseOnboard(rest));
     case "watch":
@@ -19746,13 +20107,14 @@ var init_main = __esm({
     init_watch();
     init_onboard();
     init_research();
+    init_audit();
   }
 });
 
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -19765,7 +20127,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync24(0, "utf8");
+      raw = readFileSync25(0, "utf8");
     } catch {
       raw = null;
     }