tamperward 2.33.0 → 2.34.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.33.0",
+  "version": "2.34.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -54,7 +54,7 @@
   },
   "dependencies": {
     "picomatch": "^4.0.2",
-    "typescript": "^5.6.3",
+    "typescript": "~5.9.3",
     "yaml": "^2.6.1"
   },
   "devDependencies": {

package/schemas/audit-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/hexrift/tamperward/blob/main/schemas/audit-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/audit-v1.schema.json",
   "title": "TamperWard audit event v1",
   "type": "object",
   "additionalProperties": false,
@@ -96,5 +96,18 @@
         }
       }
     }
+  ],
+  "examples": [
+    {
+      "schema_version": 1,
+      "id": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "timestamp": "2026-09-23T14:00:00.000Z",
+      "surface": "pretooluse",
+      "agent": "claude-code",
+      "rule": "test-deletion",
+      "severity": "block",
+      "decision": "deny",
+      "session": "sha256:bbbbbbbbbbbbbbbbbbbbbbbb"
+    }
   ]
 }

package/schemas/check-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/main/schemas/check-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/check-v1.schema.json",
   "title": "TamperWard check JSON output v1",
   "type": "object",
   "required": [
@@ -100,5 +100,17 @@
       "additionalProperties": true
     }
   },
-  "additionalProperties": true
+  "additionalProperties": true,
+  "examples": [
+    {
+      "schema_version": 1,
+      "findings": [],
+      "scanned": 0,
+      "ignoredFiles": 0,
+      "summary": {
+        "block": 0,
+        "warn": 0
+      }
+    }
+  ]
 }

package/schemas/doctor-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/main/schemas/doctor-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/doctor-v1.schema.json",
   "title": "TamperWard doctor JSON output v1",
   "type": "object",
   "required": [
@@ -91,5 +91,19 @@
         }
       }
     }
+  ],
+  "examples": [
+    {
+      "schema_version": 1,
+      "command": "doctor",
+      "authoritative": true,
+      "checks": [
+        {
+          "id": "platform",
+          "state": "OK",
+          "detail": "Linux lifecycle is available."
+        }
+      ]
+    }
   ]
 }

package/schemas/research-stdio-v1.schema.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/research-stdio-v1.schema.json",
+  "title": "TamperWard research stdio JSONL protocol v1",
+  "description": "One JSON object per line. Capability declarations are evidence, not permission to claim an enforcement layer that is not connected.",
+  "oneOf": [
+    {
+      "type": "object",
+      "required": ["type", "run_id", "status"],
+      "properties": {"type": {"const": "run"}, "run_id": {"type": "string", "minLength": 1}, "status": {"enum": ["started", "finished"]}},
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "protocol", "runtime", "capabilities"],
+      "properties": {
+        "type": {"const": "hello"},
+        "protocol": {"const": "research-stdio-jsonl-v1"},
+        "runtime": {"type": "string", "minLength": 1},
+        "capabilities": {
+          "type": "object",
+          "required": ["layers", "intervention"],
+          "properties": {
+            "layers": {"type": "array", "items": {"enum": ["envelope", "pre-tool-use", "stop-sweep"]}},
+            "intervention": {"enum": ["enforced", "advisory", "not-connected"]}
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "task", "arm", "cwd", "base"],
+      "properties": {
+        "type": {"const": "start"}, "task": {"type": "string", "minLength": 1},
+        "arm": {"enum": ["ungated", "gated"]}, "cwd": {"type": "string", "minLength": 1},
+        "base": {"type": "string", "minLength": 1}, "prompt": {"type": "string"}
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "event"],
+      "properties": {"type": {"const": "event"}, "event": {"enum": ["tool", "edit", "turn"]}, "request_id": {"type": "string"}, "name": {"type": "string"}, "detail": {"type": "string"}},
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "action", "request_id", "reason"],
+      "properties": {"type": {"const": "intervention"}, "action": {"enum": ["deny", "allow"]}, "request_id": {"type": "string", "minLength": 1}, "reason": {"type": "string", "minLength": 1}},
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "status"],
+      "properties": {"type": {"const": "complete"}, "status": {"enum": ["completed", "failed", "cancelled"]}, "exit_code": {"type": "integer", "minimum": 0}},
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": ["type", "message"],
+      "properties": {"type": {"const": "error"}, "message": {"type": "string", "minLength": 1}},
+      "additionalProperties": false
+    }
+  ]
+}

package/schemas/research-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/main/schemas/research-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/research-v1.schema.json",
   "title": "TamperWard research JSON output v1",
   "description": "Emitted by `tamperward research run --json` (one `pair` document per line, identical to the ledger record under <out>/pairs/) and `tamperward research summarize` (one `summary` document). `document` is the shape discriminator. Both keep TamperWard's own verdict (`treatment` / `tamperward`) apart from the independent outcome (`outcome` / `independent_outcome`); there is no composite score. Additive within schema major 1.",
   "type": "object",
@@ -675,5 +675,95 @@
       },
       "additionalProperties": true
     }
-  }
+  },
+  "examples": [
+    {
+      "schema_version": 1,
+      "command": "research",
+      "document": "pair",
+      "task": "example",
+      "pair": 1,
+      "adapter": {
+        "name": "command",
+        "layers": []
+      },
+      "model": null,
+      "tamperward_version": "2.33.0",
+      "agent_argv": [
+        "true"
+      ],
+      "agent_budget": null,
+      "manifest_sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "verify_command": "true",
+      "arms": {
+        "ungated": {
+          "arm": "ungated",
+          "workspace": "/tmp/tamperward-example",
+          "base": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "head": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "started_at": "2026-09-23T14:00:00.000Z",
+          "finished_at": "2026-09-23T14:00:01.000Z",
+          "agent": {
+            "exit_code": 0,
+            "signal": null,
+            "timed_out": false,
+            "failure": null
+          },
+          "treatment": null,
+          "outcome": {
+            "verify_verdict": "VERIFIED",
+            "visible_exit": 0,
+            "pristine_exit": 0,
+            "visible_green": true,
+            "pristine_green": true,
+            "masked_failure": false,
+            "surviving_protected_mutations": 0,
+            "warn_findings": 0,
+            "rules": [],
+            "honest_completion": true
+          },
+          "released_green": true,
+          "measured": true,
+          "unmeasurable": null
+        },
+        "gated": {
+          "arm": "gated",
+          "workspace": "/tmp/tamperward-example-gated",
+          "base": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "head": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "started_at": "2026-09-23T14:00:00.000Z",
+          "finished_at": "2026-09-23T14:00:01.000Z",
+          "agent": {
+            "exit_code": 0,
+            "signal": null,
+            "timed_out": false,
+            "failure": null
+          },
+          "treatment": {
+            "verdict": "VERIFIED",
+            "exit_code": 0,
+            "complete": true,
+            "disposition": "passed",
+            "envelope": null
+          },
+          "outcome": {
+            "verify_verdict": "VERIFIED",
+            "visible_exit": 0,
+            "pristine_exit": 0,
+            "visible_green": true,
+            "pristine_green": true,
+            "masked_failure": false,
+            "surviving_protected_mutations": 0,
+            "warn_findings": 0,
+            "rules": [],
+            "honest_completion": true
+          },
+          "released_green": true,
+          "measured": true,
+          "unmeasurable": null
+        }
+      }
+    }
+  ],
+  "additionalProperties": true
 }

package/schemas/run-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/main/schemas/run-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/run-v1.schema.json",
   "title": "TamperWard run JSON output v1",
   "type": "object",
   "required": [
@@ -504,5 +504,38 @@
     }
   },
   "additionalProperties": true,
-  "description": "Emitted by `tamperward run --json` as the single stdout document once the wrapped agent has started; agent stdout is routed to stderr in this mode. Pre-agent failures emit no document (stderr + exit 2). Additive within schema major 1."
+  "description": "Emitted by `tamperward run --json` as the single stdout document once the wrapped agent has started; agent stdout is routed to stderr in this mode. Pre-agent failures emit no document (stderr + exit 2). Additive within schema major 1.",
+  "examples": [
+    {
+      "schema_version": 1,
+      "verdict": "VERIFIED",
+      "exit_code": 0,
+      "complete": true,
+      "base": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "head": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "agent": {
+        "exit_code": 0,
+        "timed_out": false,
+        "lifecycle_owned": true
+      },
+      "checks": {
+        "diff": 0,
+        "worktree": 0,
+        "verify": 0
+      },
+      "verifier_backend": {
+        "kind": "local",
+        "trust": "checkpointed-local",
+        "available": true
+      },
+      "dependency_environment": {
+        "status": "none",
+        "roots": []
+      },
+      "observer": {
+        "enabled": false,
+        "blocking": false
+      }
+    }
+  ]
 }

package/schemas/stats-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/hexrift/tamperward/blob/main/schemas/stats-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/stats-v1.schema.json",
   "title": "TamperWard audit stats v1",
   "type": "object",
   "additionalProperties": false,
@@ -115,5 +115,19 @@
     "interpretation": {
       "const": "finding-is-not-proof-of-intent"
     }
-  }
+  },
+  "examples": [
+    {
+      "schema_version": 1,
+      "events": 0,
+      "blocked": 0,
+      "warnings": 0,
+      "sessions": 0,
+      "first_event": null,
+      "last_event": null,
+      "by_rule": [],
+      "by_surface": [],
+      "interpretation": "finding-is-not-proof-of-intent"
+    }
+  ]
 }

package/schemas/verify-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/main/schemas/verify-v1.schema.json",
+  "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/verify-v1.schema.json",
   "title": "TamperWard verify JSON output v1",
   "type": "object",
   "required": [
@@ -95,6 +95,16 @@
     "oob_signoff": {
       "type": "string"
     },
+    "materialization_reason": {
+      "enum": [
+        "TRACKED_NODE_MODULES_CONFLICT",
+        "SYMLINK_ESCAPE",
+        "SPECIAL_FILE",
+        "RACING_DELETION",
+        "UNKNOWN"
+      ],
+      "description": "Additional fail-closed detail when reason is MATERIALIZATION_FAILED."
+    },
     "visible_dir": {
       "type": "string"
     },
@@ -607,5 +617,12 @@
       "additionalProperties": true
     }
   },
-  "additionalProperties": true
+  "additionalProperties": true,
+  "examples": [
+    {
+      "schema_version": 1,
+      "verdict": "CANNOT_VERIFY",
+      "reason": "INVALID_ARGUMENTS"
+    }
+  ]
 }