tamperward 2.32.0 → 2.33.0

package/README.md

@@ -239,11 +239,13 @@ node harness/perf/bench.mjs      # performance budgets (docs/PERF.md)
 ```
 
 Tamperward's own CI runs the engine it ships over every pull request — `check --diff`
-over the PR range, cleared only by an out-of-band label — and has, on more than one
+over the PR range, cleared only by an out-of-band exact-head label (generate one with
+`tamperward signoff-label`) — and has, on more than one
 occasion, blocked its own author's commits. Branch, then open a PR; `main` is
 protected and CI must be green. Changing a protected asset will block your own PR
 (working as intended); a reviewed, legitimate change is cleared by a maintainer
-applying a `tamperward:allow:<rule>` label, never by weakening the policy.
+applying a compact `tw1:<digest>` label, never by weakening the policy. Legacy full-SHA
+tokens remain accepted by the parser for CI systems whose label transport can hold them.
 
 The public surface is the CLI and its exit codes, the hook wire format, the
 `.tamperward.yml` schema, and the versioned machine-output schemas under `schemas/` —

package/dist/cli/index.js

@@ -8932,7 +8932,7 @@ They WILL FAIL in v10.0.0
                     makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
-                      evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
+                      evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or generate the compact CI label with \`tamperward signoff-label --rule hook-tampering --file ${c.path} --head <full-sha>\`, or make the gate live in it`,
                       remediation: "Run `tamperward check --staged` in the new hook, in a position where its failure fails the hook, or have a human sign off on a hook that does not."
                     })
                   );
@@ -8963,7 +8963,7 @@ They WILL FAIL in v10.0.0
                     makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
-                      evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
+                      evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or generate the compact CI label with \`tamperward signoff-label --rule hook-tampering --file ${c.path} --head <full-sha>\`, or restore it`,
                       remediation: "Restore the script, or have a human sign off. A line-by-line reading of a shell script cannot tell an honest restructuring from a neutered gate, so the gate script is held byte-for-byte: only raising its pin passes without a sign-off."
                     })
                   );
@@ -10869,6 +10869,12 @@ var init_policy_load = __esm({
 import { createHash as createHash3 } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync as readFileSync6, existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname2, join as join9 } from "node:path";
+function compactOobToken(want, head) {
+  const normalizedHead = head.trim().toLowerCase();
+  if (!want || !FULL_OBJECT_ID.test(normalizedHead)) return null;
+  const digest = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
+  return `${COMPACT_OOB_PREFIX}${digest}`;
+}
 function ledgerEntryFrom(value) {
   if (!isRecord(value)) return null;
   const { rule, file, fingerprint: fingerprint2, reason, recordedAt, expiresAt } = value;
@@ -10924,6 +10930,11 @@ function oobToken(want, oob, head) {
   for (const raw of oob) {
     const t = raw.trim();
     if (!t) continue;
+    if (t.startsWith(COMPACT_OOB_PREFIX)) {
+      const expected = head === void 0 ? null : compactOobToken(want, head);
+      if (expected !== null && t === expected) return t;
+      continue;
+    }
     const at = t.lastIndexOf("@");
     if (at === -1) {
       if (!head && t === want) return t;
@@ -10956,13 +10967,15 @@ function oobHeadFromEnv(env = process.env) {
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
 }
-var DEFAULT_TTL_MS, fingerprintOf;
+var DEFAULT_TTL_MS, COMPACT_OOB_PREFIX, FULL_OBJECT_ID, fingerprintOf;
 var init_signoff = __esm({
   "src/signoff.ts"() {
     "use strict";
     init_policy_load();
     init_narrow();
     DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+    COMPACT_OOB_PREFIX = "tw1:";
+    FULL_OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
     fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
   }
 });
@@ -14206,9 +14219,10 @@ version: 1
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
 # the PR's commit range. A block fails the check and clears ONLY via the out-of-band
-# label \`tamperward:allow:<rule>@<head-sha>\` applied by someone with triage access or higher \u2014
-# never a file the PR itself can commit. The verify step reads the same labels:
-# \`tamperward:allow:verify@<head-sha>\` accepts a masked failure a reviewer has judged.
+# compact label \`tw1:<digest>\` (print one with \`tamperward signoff-label\`) applied by
+# someone with triage access or higher \u2014 never a file the PR itself can commit. Legacy
+# \`tamperward:allow:<rule>@<head-sha>\` labels remain accepted. The verify step reads
+# the same labels: a token for \`verify\` accepts a masked failure a reviewer has judged.
 #
 # labeled/unlabeled re-run the gate because the sign-off is read from the EVENT payload:
 # a label applied after a failure could otherwise never take effect, and REVOKING a
@@ -14252,14 +14266,15 @@ jobs:
         env:
           LABELS: \${{ toJSON(github.event.pull_request.labels.*.name) }}
         run: |
-          RULES="$(printf '%s' "$LABELS" | jq -r '.[] | select(startswith("tamperward:allow:")) | sub("^tamperward:allow:"; "")' | paste -sd, -)"
+          RULES="$(printf '%s' "$LABELS" | jq -r '.[] | if startswith("tamperward:allow:") then sub("^tamperward:allow:"; "") elif startswith("tw1:") then . else empty end' | paste -sd, -)"
           echo "rules=$RULES" >> "$GITHUB_OUTPUT"
       - name: Tamperward gate (diff-time)
         env:
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
           # Binds each approval to the commit it was granted for: labels persist
           # across pushes, so an unbound one would clear every later finding on
-          # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
+          # the same PR. Compact labels hash the exact rule/file/head tuple; legacy
+          # labels must read tamperward:allow:<rule>@<head-sha>.
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
         run: tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
       # Diff-time detection is spelling-dependent by nature; pristine
@@ -14272,8 +14287,9 @@ jobs:
       # without one this step fails closed (exit 2) rather than passing quietly.
       - name: Tamperward verify (pristine re-execution)
         env:
-          # The same channel as the gate. \`tamperward:allow:verify@<head-sha>\`
-          # accepts a MASKED_FAILURE \u2014 a reviewer has read the intentional test
+          # The same channel as the gate. A compact token generated for \`verify\`
+          # (or legacy \`tamperward:allow:verify@<head-sha>\`) accepts a MASKED_FAILURE \u2014
+          # a reviewer has read the intentional test
           # change and agrees the original suite no longer applies. It clears
           # nothing else: a red visible suite, or a run that could not verify,
           # stays red whatever the labels say.
@@ -16398,10 +16414,12 @@ function runVerify(opts) {
         renderStageDiagnostics(out3, "pristine", pristine);
       }
     }
-    if (signedOff)
+    if (signedOff) {
+      const approval = signedOff.startsWith("tw1:") ? signedOff : `tamperward:allow:${signedOff}`;
       out3(
-        `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
+        `masked failure cleared by out-of-band approval (${approval}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
       );
+    }
     if (removedAdded > 0)
       out3(
         `(${removedAdded} protected file(s) added since ${base.slice(0, 10)} were removed from the pristine run: the pristine tree carries exactly the base's protected surface.)`
@@ -20438,6 +20456,33 @@ var init_research = __esm({
   }
 });
 
+// src/cli/signoff-label.ts
+function runSignoffLabel(opts) {
+  if (!opts.rule) {
+    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
+    return 2;
+  }
+  if (!opts.head) {
+    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
+    return 2;
+  }
+  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
+  const token = compactOobToken(want, opts.head);
+  if (!token) {
+    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
+    return 2;
+  }
+  process.stdout.write(`${token}
+`);
+  return 0;
+}
+var init_signoff_label = __esm({
+  "src/cli/signoff-label.ts"() {
+    "use strict";
+    init_signoff();
+  }
+});
+
 // src/cli/main.ts
 var main_exports = {};
 __export(main_exports, {
@@ -20517,6 +20562,16 @@ function parseStats(args) {
   }
   return o;
 }
+function parseSignoffLabel(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--rule") o.rule = args[++i];
+    else if (a === "--file") o.file = args[++i];
+    else if (a === "--head") o.head = args[++i];
+  }
+  return o;
+}
 function parseCheck(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -20638,6 +20693,11 @@ function validateCliArgs(cmd, args) {
     if (parsed.positionals.length === 0) return "allow requires a rule";
     return void 0;
   }
+  if (cmd === "signoff-label") {
+    return validateFlatArgs(args, {
+      values: { "--rule": "string", "--file": "string", "--head": "string" }
+    }).error;
+  }
   if (cmd === "init") {
     return validateFlatArgs(args, {
       flags: ["--dry-run", "--force-workflow"],
@@ -20790,8 +20850,8 @@ Formats:
              [--budget S] [--json] [--keep] as-is AND with protected files restored
              [--require-ancestor] [--cwd D]  from the trusted base; a visible-green /
                                             pristine-red result is a MASKED FAILURE
-                                            (exit 1, or 0 under an out-of-band
-                                            verify@<head-sha> approval); cannot-verify
+                                            (exit 1, or 0 under a compact tw1:<digest>
+                                            or legacy verify@<full-sha> approval); cannot-verify
                                             fails closed (2)
   tamperward trace-verify [--base R]          advisory Linux verifier-input discovery:
              [--cmd C] [--budget S] [--runs N] trace a trusted/known-good base with
@@ -20836,6 +20896,8 @@ Formats:
                                              integrity signal, not proof of agent intent.
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
              [--file F] [--cwd D]
+  tamperward signoff-label --rule <rule> --head <sha> [--file F]
+                                            print a compact, exact-head-bound CI label
   tamperward onboard [--yes] [--cwd D]      guided first-run setup: preflight, the
              [--base R] [--repo O/R]        init plan with a confirmation before any
              [--branch B] [--verify-command C] write, canonical init, explicit verifier
@@ -20900,6 +20962,8 @@ function main(argv) {
       return runAgentCommand("sweep", rest);
     case "allow":
       return runAllow(parseAllow(rest));
+    case "signoff-label":
+      return runSignoffLabel(parseSignoffLabel(rest));
     case "init":
       return runInit(parseInit(rest));
     case "doctor":
@@ -20968,6 +21032,7 @@ var init_main = __esm({
     init_onboard();
     init_research();
     init_audit();
+    init_signoff_label();
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",