tamperward 2.31.1 → 2.33.0

package/README.md

@@ -239,11 +239,13 @@ node harness/perf/bench.mjs      # performance budgets (docs/PERF.md)
 ```
 
 Tamperward's own CI runs the engine it ships over every pull request — `check --diff`
-over the PR range, cleared only by an out-of-band label — and has, on more than one
+over the PR range, cleared only by an out-of-band exact-head label (generate one with
+`tamperward signoff-label`) — and has, on more than one
 occasion, blocked its own author's commits. Branch, then open a PR; `main` is
 protected and CI must be green. Changing a protected asset will block your own PR
 (working as intended); a reviewed, legitimate change is cleared by a maintainer
-applying a `tamperward:allow:<rule>` label, never by weakening the policy.
+applying a compact `tw1:<digest>` label, never by weakening the policy. Legacy full-SHA
+tokens remain accepted by the parser for CI systems whose label transport can hold them.
 
 The public surface is the CLI and its exit codes, the hook wire format, the
 `.tamperward.yml` schema, and the versioned machine-output schemas under `schemas/` —

package/dist/cli/index.js

@@ -8932,7 +8932,7 @@ They WILL FAIL in v10.0.0
                     makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
-                      evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
+                      evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or generate the compact CI label with \`tamperward signoff-label --rule hook-tampering --file ${c.path} --head <full-sha>\`, or make the gate live in it`,
                       remediation: "Run `tamperward check --staged` in the new hook, in a position where its failure fails the hook, or have a human sign off on a hook that does not."
                     })
                   );
@@ -8963,7 +8963,7 @@ They WILL FAIL in v10.0.0
                     makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
-                      evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
+                      evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or generate the compact CI label with \`tamperward signoff-label --rule hook-tampering --file ${c.path} --head <full-sha>\`, or restore it`,
                       remediation: "Restore the script, or have a human sign off. A line-by-line reading of a shell script cannot tell an honest restructuring from a neutered gate, so the gate script is held byte-for-byte: only raising its pin passes without a sign-off."
                     })
                   );
@@ -10869,6 +10869,12 @@ var init_policy_load = __esm({
 import { createHash as createHash3 } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync as readFileSync6, existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname2, join as join9 } from "node:path";
+function compactOobToken(want, head) {
+  const normalizedHead = head.trim().toLowerCase();
+  if (!want || !FULL_OBJECT_ID.test(normalizedHead)) return null;
+  const digest = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
+  return `${COMPACT_OOB_PREFIX}${digest}`;
+}
 function ledgerEntryFrom(value) {
   if (!isRecord(value)) return null;
   const { rule, file, fingerprint: fingerprint2, reason, recordedAt, expiresAt } = value;
@@ -10924,6 +10930,11 @@ function oobToken(want, oob, head) {
   for (const raw of oob) {
     const t = raw.trim();
     if (!t) continue;
+    if (t.startsWith(COMPACT_OOB_PREFIX)) {
+      const expected = head === void 0 ? null : compactOobToken(want, head);
+      if (expected !== null && t === expected) return t;
+      continue;
+    }
     const at = t.lastIndexOf("@");
     if (at === -1) {
       if (!head && t === want) return t;
@@ -10956,13 +10967,15 @@ function oobHeadFromEnv(env = process.env) {
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
 }
-var DEFAULT_TTL_MS, fingerprintOf;
+var DEFAULT_TTL_MS, COMPACT_OOB_PREFIX, FULL_OBJECT_ID, fingerprintOf;
 var init_signoff = __esm({
   "src/signoff.ts"() {
     "use strict";
     init_policy_load();
     init_narrow();
     DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+    COMPACT_OOB_PREFIX = "tw1:";
+    FULL_OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
     fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
   }
 });
@@ -14206,9 +14219,10 @@ version: 1
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
 # the PR's commit range. A block fails the check and clears ONLY via the out-of-band
-# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with triage access or higher \u2014
-# never a file the PR itself can commit. The verify step reads the same labels:
-# \`tamperward:allow:verify@<head-sha>\` accepts a masked failure a reviewer has judged.
+# compact label \`tw1:<digest>\` (print one with \`tamperward signoff-label\`) applied by
+# someone with triage access or higher \u2014 never a file the PR itself can commit. Legacy
+# \`tamperward:allow:<rule>@<head-sha>\` labels remain accepted. The verify step reads
+# the same labels: a token for \`verify\` accepts a masked failure a reviewer has judged.
 #
 # labeled/unlabeled re-run the gate because the sign-off is read from the EVENT payload:
 # a label applied after a failure could otherwise never take effect, and REVOKING a
@@ -14252,14 +14266,15 @@ jobs:
         env:
           LABELS: \${{ toJSON(github.event.pull_request.labels.*.name) }}
         run: |
-          RULES="$(printf '%s' "$LABELS" | jq -r '.[] | select(startswith("tamperward:allow:")) | sub("^tamperward:allow:"; "")' | paste -sd, -)"
+          RULES="$(printf '%s' "$LABELS" | jq -r '.[] | if startswith("tamperward:allow:") then sub("^tamperward:allow:"; "") elif startswith("tw1:") then . else empty end' | paste -sd, -)"
           echo "rules=$RULES" >> "$GITHUB_OUTPUT"
       - name: Tamperward gate (diff-time)
         env:
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
           # Binds each approval to the commit it was granted for: labels persist
           # across pushes, so an unbound one would clear every later finding on
-          # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
+          # the same PR. Compact labels hash the exact rule/file/head tuple; legacy
+          # labels must read tamperward:allow:<rule>@<head-sha>.
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
         run: tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
       # Diff-time detection is spelling-dependent by nature; pristine
@@ -14272,8 +14287,9 @@ jobs:
       # without one this step fails closed (exit 2) rather than passing quietly.
       - name: Tamperward verify (pristine re-execution)
         env:
-          # The same channel as the gate. \`tamperward:allow:verify@<head-sha>\`
-          # accepts a MASKED_FAILURE \u2014 a reviewer has read the intentional test
+          # The same channel as the gate. A compact token generated for \`verify\`
+          # (or legacy \`tamperward:allow:verify@<head-sha>\`) accepts a MASKED_FAILURE \u2014
+          # a reviewer has read the intentional test
           # change and agrees the original suite no longer applies. It clears
           # nothing else: a red visible suite, or a run that could not verify,
           # stays red whatever the labels say.
@@ -16398,10 +16414,12 @@ function runVerify(opts) {
         renderStageDiagnostics(out3, "pristine", pristine);
       }
     }
-    if (signedOff)
+    if (signedOff) {
+      const approval = signedOff.startsWith("tw1:") ? signedOff : `tamperward:allow:${signedOff}`;
       out3(
-        `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
+        `masked failure cleared by out-of-band approval (${approval}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
       );
+    }
     if (removedAdded > 0)
       out3(
         `(${removedAdded} protected file(s) added since ${base.slice(0, 10)} were removed from the pristine run: the pristine tree carries exactly the base's protected surface.)`
@@ -19715,8 +19733,10 @@ var init_record = __esm({
 });
 
 // src/research/run.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync9, openSync as openSync3, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, unlinkSync, writeFileSync as writeFileSync11, writeSync } from "node:fs";
+import { hostname } from "node:os";
 import { join as join25, resolve as resolve15 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -19724,6 +19744,102 @@ function git6(args, cwd) {
 function pairRecordPath(ledger, task, pair) {
   return join25(ledger, "pairs", `${task}--${pair}.json`);
 }
+function researchLockPath(ledger) {
+  return join25(ledger, "run.lock");
+}
+function readLockOwner(path) {
+  try {
+    const parsed = JSON.parse(readFileSync23(path, "utf8"));
+    if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
+    if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
+    return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
+  } catch {
+    return null;
+  }
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code !== "ESRCH";
+  }
+}
+function lockHolder(path) {
+  const owner = readLockOwner(path);
+  return owner ? `pid ${owner.pid} on ${owner.host}, started ${owner.started_at}` : "an unreadable lock file";
+}
+function acquireResearchLock(ledger, breakStaleLock = false) {
+  mkdirSync9(ledger, { recursive: true });
+  const path = researchLockPath(ledger);
+  if (breakStaleLock && existsSync18(path)) {
+    const owner2 = readLockOwner(path);
+    if (!owner2) {
+      throw new ResearchError(`research output ${ledger} has an unreadable lock at ${path}; verify no run is active, then remove it deliberately`);
+    }
+    if (owner2.host !== hostname() || processAlive(owner2.pid)) {
+      throw new ResearchError(
+        `research output ${ledger} is still locked by ${lockHolder(path)}; refusing to break an active lock (a reused pid looks alive: if that owner is certainly gone, remove ${path} deliberately)`
+      );
+    }
+    const claimed = `${path}.stale-${process.pid}-${randomUUID2()}`;
+    let moved = true;
+    try {
+      renameSync4(path, claimed);
+    } catch (e) {
+      if (e.code !== "ENOENT") {
+        throw new ResearchError(`research output ${ledger} stale lock recovery failed for ${path}`);
+      }
+      moved = false;
+    }
+    if (moved) {
+      const inspected = readLockOwner(claimed);
+      if (inspected && inspected.token === owner2.token) {
+        unlinkSync(claimed);
+      } else {
+        try {
+          linkSync(claimed, path);
+          unlinkSync(claimed);
+        } catch {
+        }
+        throw new ResearchError(`research output ${ledger}: the lock at ${path} changed while it was being broken; refusing (rerun --break-lock only once no run is active)`);
+      }
+    }
+  }
+  const owner = {
+    pid: process.pid,
+    host: hostname(),
+    started_at: (/* @__PURE__ */ new Date()).toISOString(),
+    token: randomUUID2()
+  };
+  const text = JSON.stringify(owner) + "\n";
+  let fd = -1;
+  try {
+    fd = openSync3(path, "wx", 384);
+    writeSync(fd, text);
+    closeSync3(fd);
+    fd = -1;
+  } catch (e) {
+    if (fd !== -1) closeSync3(fd);
+    if (e.code === "EEXIST") {
+      throw new ResearchError(
+        `research output ${ledger} is already locked by ${lockHolder(path)}; refusing concurrent writers. Verify the owner is not running, then remove ${path} deliberately or rerun with --break-lock`
+      );
+    }
+    throw new ResearchError(`research output ${ledger} cannot create lock ${path}`);
+  }
+  let released = false;
+  return {
+    release() {
+      if (released) return;
+      released = true;
+      try {
+        if (readFileSync23(path, "utf8") === text) unlinkSync(path);
+      } catch {
+      }
+    }
+  };
+}
 function resumableRecord(path, expected) {
   let raw;
   try {
@@ -20012,84 +20128,46 @@ function runResearch(opts) {
     return 2;
   }
   const ledger = resolve15(opts.out);
-  const pairs = opts.pairs ?? 1;
-  mkdirSync9(join25(ledger, "pairs"), { recursive: true });
-  for (const task of tasks) {
-    const existingRecords = /* @__PURE__ */ new Map();
-    let sourceBase = null;
-    try {
-      for (let pair = 1; pair <= pairs; pair++) {
-        const path = pairRecordPath(ledger, task.id, pair);
-        if (!existsSync18(path)) continue;
-        const existing = resumableRecord(path, {
-          task: task.id,
-          pair,
-          manifest_sha256: manifestSha,
-          adapter: { name: adapter.name, layers: adapter.layers },
-          model: opts.model ?? null,
-          tamperward_version: TW_VERSION,
-          agent_argv: agentArgvIdentity,
-          agent_budget: opts.agentBudget ?? null,
-          verify_command: task.verify.command,
-          source_base: sourceBase
-        });
-        sourceBase ??= existing.arms.ungated.base;
-        if (existing.arms.ungated.base !== sourceBase) {
-          throw new ResearchError(
-            `ledger record ${path} belongs to a different source commit (${existing.arms.ungated.base.slice(0, 12)}\u2026 != ${sourceBase.slice(0, 12)}\u2026); use a new --out, or remove it deliberately`
-          );
-        }
-        existingRecords.set(pair, existing);
-      }
-    } catch (e) {
-      if (e instanceof ResearchError) {
-        err2(`tamperward research: ${e.message}`);
-        return 2;
-      }
-      throw e;
+  let lock;
+  try {
+    lock = acquireResearchLock(ledger, opts.breakLock === true);
+  } catch (e) {
+    if (e instanceof ResearchError) {
+      err2(`tamperward research: ${e.message}`);
+      return 2;
     }
-    for (let pair = 1; pair <= pairs; pair++) {
-      const path = pairRecordPath(ledger, task.id, pair);
-      const existing = existingRecords.get(pair);
-      if (existing) {
-        if (!opts.json) out2(`tamperward research \u2014 task ${task.id} pair ${pair}: already recorded (${path}); skipping`);
-        continue;
-      }
-      let record;
+    throw e;
+  }
+  try {
+    const pairs = opts.pairs ?? 1;
+    mkdirSync9(join25(ledger, "pairs"), { recursive: true });
+    for (const task of tasks) {
+      const existingRecords = /* @__PURE__ */ new Map();
+      let sourceBase = null;
       try {
-        const arms = {};
-        for (const arm of RESEARCH_ARMS) {
-          if (!opts.json) out2(`tamperward research \u2014 task ${task.id} pair ${pair}: ${arm} arm`);
-          arms[arm] = runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase ?? void 0);
-          if (arm === "ungated") {
-            const resolvedSource = arms[arm]?.base;
-            if (!resolvedSource) throw new ResearchError(`task "${task.id}" pair ${pair}: ungated arm produced no source base`);
-            if (sourceBase !== null && resolvedSource !== sourceBase) {
-              throw new ResearchError(
-                `task "${task.id}" pair ${pair}: source base moved (${resolvedSource.slice(0, 12)}\u2026 != ${sourceBase.slice(0, 12)}\u2026)`
-              );
-            }
-            sourceBase ??= resolvedSource;
+        for (let pair = 1; pair <= pairs; pair++) {
+          const path = pairRecordPath(ledger, task.id, pair);
+          if (!existsSync18(path)) continue;
+          const existing = resumableRecord(path, {
+            task: task.id,
+            pair,
+            manifest_sha256: manifestSha,
+            adapter: { name: adapter.name, layers: adapter.layers },
+            model: opts.model ?? null,
+            tamperward_version: TW_VERSION,
+            agent_argv: agentArgvIdentity,
+            agent_budget: opts.agentBudget ?? null,
+            verify_command: task.verify.command,
+            source_base: sourceBase
+          });
+          sourceBase ??= existing.arms.ungated.base;
+          if (existing.arms.ungated.base !== sourceBase) {
+            throw new ResearchError(
+              `ledger record ${path} belongs to a different source commit (${existing.arms.ungated.base.slice(0, 12)}\u2026 != ${sourceBase.slice(0, 12)}\u2026); use a new --out, or remove it deliberately`
+            );
           }
+          existingRecords.set(pair, existing);
         }
-        const ungated = arms.ungated;
-        const gated = arms.gated;
-        if (!ungated || !gated) throw new ResearchError(`task "${task.id}" pair ${pair}: an arm produced no record`);
-        record = {
-          schema_version: MACHINE_SCHEMA_VERSION,
-          command: "research",
-          document: "pair",
-          task: task.id,
-          pair,
-          adapter: { name: adapter.name, layers: [...adapter.layers] },
-          model: opts.model ?? null,
-          tamperward_version: TW_VERSION,
-          agent_argv: [...agentArgvIdentity],
-          agent_budget: opts.agentBudget ?? null,
-          manifest_sha256: manifestSha,
-          verify_command: task.verify.command,
-          arms: { ungated, gated }
-        };
       } catch (e) {
         if (e instanceof ResearchError) {
           err2(`tamperward research: ${e.message}`);
@@ -20097,20 +20175,72 @@ function runResearch(opts) {
         }
         throw e;
       }
-      const text = JSON.stringify(record);
-      writeRecordAtomically(path, text + "\n");
-      if (opts.json) {
-        out2(text);
-      } else {
-        const g = record.arms.gated;
-        const u = record.arms.ungated;
-        out2(
-          `tamperward research \u2014 task ${task.id} pair ${pair}: ungated ${u.outcome.verify_verdict} (masked=${u.outcome.masked_failure}, surviving=${u.outcome.surviving_protected_mutations}); gated ${g.outcome.verify_verdict} (masked=${g.outcome.masked_failure}, surviving=${g.outcome.surviving_protected_mutations}), tamperward ${g.treatment?.verdict ?? "n/a"} \u2192 ${g.treatment?.disposition ?? "n/a"}` + (u.measured && g.measured ? "" : `; UNMEASURABLE (${[u.unmeasurable, g.unmeasurable].filter(Boolean).join(" / ")})`) + `; recorded ${path}`
-        );
+      for (let pair = 1; pair <= pairs; pair++) {
+        const path = pairRecordPath(ledger, task.id, pair);
+        const existing = existingRecords.get(pair);
+        if (existing) {
+          if (!opts.json) out2(`tamperward research \u2014 task ${task.id} pair ${pair}: already recorded (${path}); skipping`);
+          continue;
+        }
+        let record;
+        try {
+          const arms = {};
+          for (const arm of RESEARCH_ARMS) {
+            if (!opts.json) out2(`tamperward research \u2014 task ${task.id} pair ${pair}: ${arm} arm`);
+            arms[arm] = runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase ?? void 0);
+            if (arm === "ungated") {
+              const resolvedSource = arms[arm]?.base;
+              if (!resolvedSource) throw new ResearchError(`task "${task.id}" pair ${pair}: ungated arm produced no source base`);
+              if (sourceBase !== null && resolvedSource !== sourceBase) {
+                throw new ResearchError(
+                  `task "${task.id}" pair ${pair}: source base moved (${resolvedSource.slice(0, 12)}\u2026 != ${sourceBase.slice(0, 12)}\u2026)`
+                );
+              }
+              sourceBase ??= resolvedSource;
+            }
+          }
+          const ungated = arms.ungated;
+          const gated = arms.gated;
+          if (!ungated || !gated) throw new ResearchError(`task "${task.id}" pair ${pair}: an arm produced no record`);
+          record = {
+            schema_version: MACHINE_SCHEMA_VERSION,
+            command: "research",
+            document: "pair",
+            task: task.id,
+            pair,
+            adapter: { name: adapter.name, layers: [...adapter.layers] },
+            model: opts.model ?? null,
+            tamperward_version: TW_VERSION,
+            agent_argv: [...agentArgvIdentity],
+            agent_budget: opts.agentBudget ?? null,
+            manifest_sha256: manifestSha,
+            verify_command: task.verify.command,
+            arms: { ungated, gated }
+          };
+        } catch (e) {
+          if (e instanceof ResearchError) {
+            err2(`tamperward research: ${e.message}`);
+            return 2;
+          }
+          throw e;
+        }
+        const text = JSON.stringify(record);
+        writeRecordAtomically(path, text + "\n");
+        if (opts.json) {
+          out2(text);
+        } else {
+          const g = record.arms.gated;
+          const u = record.arms.ungated;
+          out2(
+            `tamperward research \u2014 task ${task.id} pair ${pair}: ungated ${u.outcome.verify_verdict} (masked=${u.outcome.masked_failure}, surviving=${u.outcome.surviving_protected_mutations}); gated ${g.outcome.verify_verdict} (masked=${g.outcome.masked_failure}, surviving=${g.outcome.surviving_protected_mutations}), tamperward ${g.treatment?.verdict ?? "n/a"} \u2192 ${g.treatment?.disposition ?? "n/a"}` + (u.measured && g.measured ? "" : `; UNMEASURABLE (${[u.unmeasurable, g.unmeasurable].filter(Boolean).join(" / ")})`) + `; recorded ${path}`
+          );
+        }
       }
     }
+    return 0;
+  } finally {
+    lock.release();
   }
-  return 0;
 }
 var err2, out2;
 var init_run2 = __esm({
@@ -20296,6 +20426,7 @@ function parseResearchRun(args) {
     else if (a === "--pairs") o.pairs = Number(args[++i]);
     else if (a === "--model") o.model = args[++i];
     else if (a === "--agent-budget") o.agentBudget = Number(args[++i]);
+    else if (a === "--break-lock") o.breakLock = true;
     else if (a === "--json") o.json = true;
   }
   return o;
@@ -20325,6 +20456,33 @@ var init_research = __esm({
   }
 });
 
+// src/cli/signoff-label.ts
+function runSignoffLabel(opts) {
+  if (!opts.rule) {
+    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
+    return 2;
+  }
+  if (!opts.head) {
+    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
+    return 2;
+  }
+  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
+  const token = compactOobToken(want, opts.head);
+  if (!token) {
+    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
+    return 2;
+  }
+  process.stdout.write(`${token}
+`);
+  return 0;
+}
+var init_signoff_label = __esm({
+  "src/cli/signoff-label.ts"() {
+    "use strict";
+    init_signoff();
+  }
+});
+
 // src/cli/main.ts
 var main_exports = {};
 __export(main_exports, {
@@ -20404,6 +20562,16 @@ function parseStats(args) {
   }
   return o;
 }
+function parseSignoffLabel(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--rule") o.rule = args[++i];
+    else if (a === "--file") o.file = args[++i];
+    else if (a === "--head") o.head = args[++i];
+  }
+  return o;
+}
 function parseCheck(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -20525,6 +20693,11 @@ function validateCliArgs(cmd, args) {
     if (parsed.positionals.length === 0) return "allow requires a rule";
     return void 0;
   }
+  if (cmd === "signoff-label") {
+    return validateFlatArgs(args, {
+      values: { "--rule": "string", "--file": "string", "--head": "string" }
+    }).error;
+  }
   if (cmd === "init") {
     return validateFlatArgs(args, {
       flags: ["--dry-run", "--force-workflow"],
@@ -20608,7 +20781,7 @@ function validateCliArgs(cmd, args) {
       const delimiter3 = rest.indexOf("--");
       const prefix = delimiter3 < 0 ? rest : rest.slice(0, delimiter3);
       const parsed = validateFlatArgs(prefix, {
-        flags: ["--json"],
+        flags: ["--break-lock", "--json"],
         values: {
           "--manifest": "string",
           "--out": "string",
@@ -20677,8 +20850,8 @@ Formats:
              [--budget S] [--json] [--keep] as-is AND with protected files restored
              [--require-ancestor] [--cwd D]  from the trusted base; a visible-green /
                                             pristine-red result is a MASKED FAILURE
-                                            (exit 1, or 0 under an out-of-band
-                                            verify@<head-sha> approval); cannot-verify
+                                            (exit 1, or 0 under a compact tw1:<digest>
+                                            or legacy verify@<full-sha> approval); cannot-verify
                                             fails closed (2)
   tamperward trace-verify [--base R]          advisory Linux verifier-input discovery:
              [--cmd C] [--budget S] [--runs N] trace a trusted/known-good base with
@@ -20707,9 +20880,11 @@ Formats:
   tamperward research run --manifest F      bring-your-own-model evaluation: for every
              --out D --adapter A [--pairs N]  task in the manifest, pin one source commit,
              [--model M] [--agent-budget S]   clone fresh state per arm, run the agent
-             [--json] [-- <agent cmd...>]     ungated and under the run envelope, then
-                                             observe both with verify + check. Records
+             [--break-lock] [--json]         ungated and under the run envelope, then
+             [-- <agent cmd...>]             observe both with verify + check. Records
                                              are resumable by full experiment identity.
+                                             --break-lock recovers a verified stale
+                                             output lock (see the research guide).
   tamperward research summarize --ledger D  aggregate measured pairs into model behaviour,
                                              independent outcome, TamperWard hits/misses
                                              and paired counts \u2014 no composite score
@@ -20721,6 +20896,8 @@ Formats:
                                              integrity signal, not proof of agent intent.
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
              [--file F] [--cwd D]
+  tamperward signoff-label --rule <rule> --head <sha> [--file F]
+                                            print a compact, exact-head-bound CI label
   tamperward onboard [--yes] [--cwd D]      guided first-run setup: preflight, the
              [--base R] [--repo O/R]        init plan with a confirmation before any
              [--branch B] [--verify-command C] write, canonical init, explicit verifier
@@ -20785,6 +20962,8 @@ function main(argv) {
       return runAgentCommand("sweep", rest);
     case "allow":
       return runAllow(parseAllow(rest));
+    case "signoff-label":
+      return runSignoffLabel(parseSignoffLabel(rest));
     case "init":
       return runInit(parseInit(rest));
     case "doctor":
@@ -20853,6 +21032,7 @@ var init_main = __esm({
     init_onboard();
     init_research();
     init_audit();
+    init_signoff_label();
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.31.1",
+  "version": "2.33.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",