tamperward 2.33.0 → 2.36.0

package/dist/cli/index.js

@@ -211,7 +211,7 @@ function forwardedEnv(env) {
   return out3;
 }
 function exchange(paths, req2, timeoutMs) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve20) => {
     let done = false;
     let handedOff = false;
     let accepted = false;
@@ -222,7 +222,7 @@ function exchange(paths, req2, timeoutMs) {
       done = true;
       clearTimeout(timer);
       sock.destroy();
-      resolve17(value);
+      resolve20(value);
     };
     const sock = createConnection(paths.socket);
     const timer = setTimeout(() => finish(handedOff ? acceptedFailure("timeout") : null), timeoutMs);
@@ -686,9 +686,9 @@ function readRegular(abs, st) {
     const buf = Buffer.allocUnsafe(now.size);
     let off2 = 0;
     while (off2 < now.size) {
-      const n = readSync(fd, buf, off2, now.size - off2, off2);
-      if (n === 0) break;
-      off2 += n;
+      const n2 = readSync(fd, buf, off2, now.size - off2, off2);
+      if (n2 === 0) break;
+      off2 += n2;
     }
     return { kind: "file", content: off2 === now.size ? buf : buf.subarray(0, off2), mode: now.mode, size: off2, mtimeMs: now.mtimeMs, detail: "" };
   } catch (e) {
@@ -1520,8 +1520,8 @@ var init_changes = __esm({
     init_narrow();
     num = (name, fallback) => {
       const raw = process.env[name];
-      const n = raw === void 0 ? NaN : Number(raw);
-      return Number.isFinite(n) && n > 0 ? n : fallback;
+      const n2 = raw === void 0 ? NaN : Number(raw);
+      return Number.isFinite(n2) && n2 > 0 ? n2 : fallback;
     };
     RECONSTRUCT_TIMEOUT_MS = () => num("TAMPERWARD_RECONSTRUCT_TIMEOUT_MS", 5e3);
     RECONSTRUCT_MAXBUFFER = () => num("TAMPERWARD_RECONSTRUCT_MAXBUFFER", 32 * 1024 * 1024);
@@ -2190,8 +2190,8 @@ function literal(arg, vars) {
   const a = unq(arg.trim());
   if (/[`]|\$\(/.test(a)) return null;
   let unknown = false;
-  const r = a.replace(/\$\{?([A-Za-z_]\w*)\}?/g, (_, n) => {
-    const v = vars.get(n);
+  const r = a.replace(/\$\{?([A-Za-z_]\w*)\}?/g, (_, n2) => {
+    const v = vars.get(n2);
     if (v === void 0) unknown = true;
     return v ?? "";
   });
@@ -2389,7 +2389,7 @@ function walk(lines, st, topIdx, depth) {
           why = "runs from another directory after a `cd` away from the repository root";
         }
         if (state === "live" && /^tamperward\b/.test(id)) {
-          const onGate = assignedNames(prefix).filter((n) => SENSITIVE_ENV.test(n));
+          const onGate = assignedNames(prefix).filter((n2) => SENSITIVE_ENV.test(n2));
           if (onGate.length) {
             state = "neutered";
             why = `runtime redirected \u2014 \`${onGate[0]}=\` in front of it decides what the gate resolves to`;
@@ -2829,7 +2829,7 @@ function setfaclDropsExec(toks) {
 }
 function nameGlob(pattern) {
   const re = new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
-  return (n) => re.test(n);
+  return (n2) => re.test(n2);
 }
 function destinations(cmd, args, isDir) {
   const positional = [];
@@ -2994,9 +2994,9 @@ function shellWritesHook(seg, toks, policy, ctx) {
       if (/-exec(?:dir)?\s+chmod\b/.test(seg) && !chmodDropsExec(toks)) return null;
       const dirs = positional.filter((p) => !/^-/.test(p) && !["{}", ";", "+", "rm", "chmod", "unlink", "truncate", "mv", "sed", "tee", "shred", "inplace"].includes(p));
       const names = args.filter((a, i) => /^-i?(?:name|path|regex)$/.test(args[i - 1] ?? ""));
-      const nameHits = names.length === 0 || names.some((n) => {
+      const nameHits = names.length === 0 || names.some((n2) => {
         try {
-          const g = nameGlob(n.replace(/^.*\//, ""));
+          const g = nameGlob(n2.replace(/^.*\//, ""));
           return HOOK_BASENAMES.some(g);
         } catch {
           return true;
@@ -3757,11 +3757,11 @@ function buildAliasMap(sf) {
     ts.forEachChild(node, collect2);
   };
   collect2(sf);
-  const kindOfBinding = (b, seen) => b.type ? kindOfType(b.type, (n) => resolveLexical(n, b.type, seen)) : null;
+  const kindOfBinding = (b, seen) => b.type ? kindOfType(b.type, (n2) => resolveLexical(n2, b.type, seen)) : null;
   const resolveLexical = (name, at, seen) => {
     if (seen.has(name)) return null;
-    for (let n = at; n; n = n.parent) {
-      const here = bindings.filter((x) => x.name === name && x.scope === n);
+    for (let n2 = at; n2; n2 = n2.parent) {
+      const here = bindings.filter((x) => x.name === name && x.scope === n2);
       if (here.length === 0) continue;
       if (here.some((b) => b.kind !== "alias" || !b.type)) return null;
       return kindOfBinding(here[0], new Set(seen).add(name));
@@ -3781,7 +3781,7 @@ function buildAliasMap(sf) {
   };
 }
 function assertedLaunderKind(node, aliases) {
-  return kindOfType(assertedType(node), (n) => aliases.resolve(n, node));
+  return kindOfType(assertedType(node), (n2) => aliases.resolve(n2, node));
 }
 function isDoubleCast(node, aliases) {
   const inner = unparenthesized(node.expression);
@@ -3825,11 +3825,11 @@ function surfaceOf(path, src) {
   return surface;
 }
 function unmatchedAfter(before, after) {
-  const n = before.length;
+  const n2 = before.length;
   const m = after.length;
   const same = (i2, j2) => before[i2].lineText === after[j2].lineText && before[i2].text === after[j2].text;
-  const lcs = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
-  for (let i2 = n - 1; i2 >= 0; i2--) {
+  const lcs = Array.from({ length: n2 + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n2 - 1; i2 >= 0; i2--) {
     for (let j2 = m - 1; j2 >= 0; j2--) {
       lcs[i2][j2] = same(i2, j2) ? lcs[i2 + 1][j2 + 1] + 1 : Math.max(lcs[i2 + 1][j2], lcs[i2][j2 + 1]);
     }
@@ -3838,10 +3838,10 @@ function unmatchedAfter(before, after) {
   let i = 0;
   let j = 0;
   while (j < m) {
-    if (i < n && same(i, j)) {
+    if (i < n2 && same(i, j)) {
       i++;
       j++;
-    } else if (i < n && lcs[i + 1][j] >= lcs[i][j + 1]) {
+    } else if (i < n2 && lcs[i + 1][j] >= lcs[i][j + 1]) {
       i++;
     } else {
       out3.push(after[j]);
@@ -3917,7 +3917,7 @@ function commentIsLiveDirective(text) {
   return false;
 }
 function countLiveDirectives(src) {
-  let n = 0;
+  let n2 = 0;
   try {
     const scanner = ts.createScanner(
       ts.ScriptTarget.Latest,
@@ -3929,13 +3929,13 @@ function countLiveDirectives(src) {
     let tok = scanner.scan();
     while (tok !== ts.SyntaxKind.EndOfFileToken) {
       if (tok === ts.SyntaxKind.SingleLineCommentTrivia || tok === ts.SyntaxKind.MultiLineCommentTrivia) {
-        if (commentIsLiveDirective(scanner.getTokenText())) n++;
+        if (commentIsLiveDirective(scanner.getTokenText())) n2++;
       }
       tok = scanner.scan();
     }
   } catch {
   }
-  return n;
+  return n2;
 }
 function countAny(src, path) {
   const r = { cast: 0, never: 0, broad: 0, double: 0, suppress: 0, jsdoc: 0 };
@@ -3976,16 +3976,16 @@ function lineHasRow4Cast(line, aliasMap) {
   const sf = parseSource("line.ts", line);
   if (!sf) return false;
   let found = false;
-  const visit = (n) => {
+  const visit = (n2) => {
     if (found) return;
-    if (ts.isAsExpression(n) || ts.isTypeAssertionExpression(n)) {
-      const k = assertedLaunderKind(n, aliasMap);
-      if (k === "any" || k === "never" || isDoubleCast(n, aliasMap)) {
+    if (ts.isAsExpression(n2) || ts.isTypeAssertionExpression(n2)) {
+      const k = assertedLaunderKind(n2, aliasMap);
+      if (k === "any" || k === "never" || isDoubleCast(n2, aliasMap)) {
         found = true;
         return;
       }
     }
-    ts.forEachChild(n, visit);
+    ts.forEachChild(n2, visit);
   };
   visit(sf);
   return found;
@@ -5175,8 +5175,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve17) {
-  const obj = resolve17(expr);
+function metricsOf(expr, resolve20) {
+  const obj = resolve20(expr);
   if (!ts.isObjectLiteralExpression(obj)) return void 0;
   const out3 = { values: {}, opaque: false };
   let any = false;
@@ -5190,9 +5190,9 @@ function metricsOf(expr, resolve17) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve17(p.initializer));
-    if (n === void 0) out3.opaque = true;
-    else out3.values[k] = n;
+    const n2 = numericOf(resolve20(p.initializer));
+    if (n2 === void 0) out3.opaque = true;
+    else out3.values[k] = n2;
   }
   return any ? out3 : void 0;
 }
@@ -5237,17 +5237,17 @@ function parseThresholds(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve17 = resolverFor(sf);
+    const resolve20 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve17(node.initializer);
+          const init = resolve20(node.initializer);
           if (!ts.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve17);
+            const flat = metricsOf(init, resolve20);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts.isSpreadAssignment(p)) {
@@ -5261,7 +5261,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve17);
+              const m = metricsOf(p.initializer, resolve20);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -5295,18 +5295,18 @@ function parseLists(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve17 = resolverFor(sf);
+    const resolve20 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve17(node.initializer));
+          const { items, opaque } = literals(resolve20(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve17(node.initializer));
+          const { items, opaque } = literals(resolve20(node.initializer));
           (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -5491,12 +5491,12 @@ function simpleWeakeningsOf(spec2, before, after) {
   for (const k of spec2.keys) {
     const bAll = numbersOf(before, k.key, spec2.scoped);
     const aAll = numbersOf(after, k.key, spec2.scoped);
-    const scopes = [...new Set(bAll.map((n) => n.scope))];
+    const scopes = [...new Set(bAll.map((n2) => n2.scope))];
     for (const scope of scopes) {
       const label = scope ? `${scope} ${k.label}` : k.label;
       const desc = (x, y2) => x === "auto" ? -1 : y2 === "auto" ? 1 : lessThan(x, y2) ? 1 : lessThan(y2, x) ? -1 : 0;
-      const b = bAll.filter((n) => n.scope === scope).map((n) => n.v).sort(desc);
-      const a = aAll.filter((n) => n.scope === scope).map((n) => n.v).sort(desc);
+      const b = bAll.filter((n2) => n2.scope === scope).map((n2) => n2.v).sort(desc);
+      const a = aAll.filter((n2) => n2.scope === scope).map((n2) => n2.v).sort(desc);
       if (b.length === 0) continue;
       if (a.length === 0) {
         if (spec2.removable) out3.push(`${label} removed (was ${b.join(", ")})`);
@@ -5598,10 +5598,10 @@ function gateMovedElsewhere(c, changes, policy) {
   const spec2 = SIMPLE_FILES.find((s) => s.file.test(c.path));
   if (!spec2) return false;
   return spec2.keys.every((k) => {
-    const b = numbersOf(before, k.key, spec2.scoped).map((n) => n.v);
+    const b = numbersOf(before, k.key, spec2.scoped).map((n2) => n2.v);
     if (b.length === 0) return true;
     return others.some((o) => {
-      const a = numbersOf(o.after, k.key, spec2.scoped).map((n) => n.v);
+      const a = numbersOf(o.after, k.key, spec2.scoped).map((n2) => n2.v);
       return a.length > 0 && b.every((bv) => a.some((av) => k.weakens === "lower" ? !lessThan(av, bv) : !lessThan(bv, av)));
     });
   });
@@ -5959,7 +5959,7 @@ function effectivePytestConfig(path, ctx) {
   const files = ctx?.trackedFiles;
   if (!files) return true;
   const rootNames = new Set(files.filter((f) => !f.includes("/")));
-  return !PYTEST_INI_ORDER.slice(0, rank).some((n) => rootNames.has(n));
+  return !PYTEST_INI_ORDER.slice(0, rank).some((n2) => rootNames.has(n2));
 }
 function pytestBlock(src) {
   const lines = src.split(/\r?\n/);
@@ -6633,7 +6633,7 @@ function eslintAstFacts(text, f) {
   }
   if (!sf) return;
   const isStr2 = (e) => ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e);
-  const keyText = (n) => ts.isIdentifier(n) || isStr2(n) || ts.isNumericLiteral(n) ? n.text : null;
+  const keyText = (n2) => ts.isIdentifier(n2) || isStr2(n2) || ts.isNumericLiteral(n2) ? n2.text : null;
   const literal2 = (e) => {
     if (isStr2(e)) return e.text;
     if (ts.isNumericLiteral(e)) return Number(e.text);
@@ -7268,8 +7268,8 @@ function scriptKind3(inner) {
 function runnerOfSegment(canon) {
   const m = canon.match(RUNNER_NAME);
   if (!m) return null;
-  const n = m[1];
-  return n === "jest" || n === "vitest" || n === "mocha" || n === "pytest" || n === "go" || n === "cargo" ? n : "node";
+  const n2 = m[1];
+  return n2 === "jest" || n2 === "vitest" || n2 === "mocha" || n2 === "pytest" || n2 === "go" || n2 === "cargo" ? n2 : "node";
 }
 function statements(raw) {
   const out3 = [];
@@ -7803,7 +7803,7 @@ var init_ci_tampering = __esm({
           }
           if (!isProtected(c.path, policy, "ci")) continue;
           const afterLines = c.after != null ? c.after.split("\n") : null;
-          const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
+          const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n2) => n2 != null));
           const github = isGithubFile(c.path);
           for (const l of github ? addedLines(c) : []) {
             const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
@@ -7844,13 +7844,13 @@ var init_ci_tampering = __esm({
               for (let k = 0; k < b.body.length; k++) {
                 const idx = b.start + 1 + k;
                 if (!addedAt.has(idx + 1)) continue;
-                const n = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
-                if (!n || propagates && /set\s\+e/.test(b.body[k])) continue;
+                const n2 = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
+                if (!n2 || propagates && /set\s\+e/.test(b.body[k])) continue;
                 out3.push(
                   makeFinding(RULE8, policy, {
                     file: c.path,
                     line: idx + 1,
-                    message: `A check's run block was neutralised: ${n.what}.`,
+                    message: `A check's run block was neutralised: ${n2.what}.`,
                     evidence: b.body[k].trim(),
                     remediation: "Let the check decide the step. Masking its exit status is the same tamper as removing it."
                   })
@@ -8599,13 +8599,13 @@ function renameKept(c) {
 }
 function lefthookBase(c, changes, ctx) {
   const dir = c.path.includes("/") ? c.path.slice(0, c.path.lastIndexOf("/") + 1) : "";
-  const names = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"].map((n) => dir + n);
+  const names = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"].map((n2) => dir + n2);
   const inSet = changes.find((o) => o.kind === "file" && names.includes(o.path));
   if (inSet) return inSet.after != null ? parseDoc(inSet.after) : null;
   if (!ctx?.cwd) return null;
-  for (const n of names) {
+  for (const n2 of names) {
     try {
-      const p = join7(ctx.cwd, n);
+      const p = join7(ctx.cwd, n2);
       if (existsSync4(p)) return parseDoc(readFileSync4(p, "utf8"));
     } catch {
     }
@@ -9096,8 +9096,8 @@ function isSpecShaped(path, before, after) {
   if (before === null && after === null) return true;
   for (const src of [before, after]) {
     if (src === null) continue;
-    const n = countTests(src, path);
-    if (n.min > 0 || n.open) return true;
+    const n2 = countTests(src, path);
+    if (n2.min > 0 || n2.open) return true;
   }
   return false;
 }
@@ -9253,7 +9253,7 @@ function unreachableNodes(sf) {
   collect2(sf);
   if (candidates.length === 0) return dead;
   const inDead = (node) => {
-    for (let n = node; n; n = n.parent) if (dead.has(n)) return true;
+    for (let n2 = node; n2; n2 = n2.parent) if (dead.has(n2)) return true;
     return false;
   };
   const within2 = (node, owner) => node.pos >= owner.pos && node.end <= owner.end;
@@ -9302,7 +9302,7 @@ function partitionJs(src) {
   if (!sf) return null;
   const dead = unreachableNodes(sf);
   const deadRanges = [];
-  for (const n of dead) deadRanges.push([n.getStart(sf), n.getEnd()]);
+  for (const n2 of dead) deadRanges.push([n2.getStart(sf), n2.getEnd()]);
   const literals3 = literalInteriors(sf);
   const mask = new Uint8Array(src.length);
   for (const [s, e] of deadRanges) for (let i = s; i < e; i++) mask[i] = 1;
@@ -9361,7 +9361,7 @@ function partition(src, path) {
   return { live: src, hidden: "", inLiteral: new Uint8Array(src.length) };
 }
 function pytestCollectedDefs(src) {
-  let n = 0;
+  let n2 = 0;
   const stack = [];
   for (const line of src.split("\n")) {
     if (!/\S/.test(line) || /^\s*#/.test(line)) continue;
@@ -9372,9 +9372,9 @@ function pytestCollectedDefs(src) {
       stack.push({ indent, collected: PY_COLLECTED_CLASS(cls[1], cls[2] ?? "") });
       continue;
     }
-    if (PY_TEST_DEF.test(line) && stack.every((c) => c.collected)) n++;
+    if (PY_TEST_DEF.test(line) && stack.every((c) => c.collected)) n2++;
   }
-  return n;
+  return n2;
 }
 var MAX_ROUNDS, blankRange, PY_INDENT, PY_TERMINAL, PY_CONST_FALSE, PY_CLASS, PY_TEST_DEF, PY_COLLECTED_CLASS;
 var init_reachability = __esm({
@@ -9407,13 +9407,13 @@ function calleeName(expr) {
 }
 function loopRows(iterable) {
   if (ts.isArrayLiteralExpression(iterable)) {
-    let n = 0;
+    let n2 = 0;
     let open = false;
     for (const el of iterable.elements) {
       if (ts.isSpreadElement(el)) open = true;
-      else n++;
+      else n2++;
     }
-    return { n: Math.max(n, open ? 0 : 1), open };
+    return { n: Math.max(n2, open ? 0 : 1), open };
   }
   return { n: 1, open: true };
 }
@@ -9432,13 +9432,13 @@ function eachRows(call) {
   const arg = call.arguments[0];
   if (!arg) return { n: 1, open: true };
   if (ts.isArrayLiteralExpression(arg)) {
-    let n = 0;
+    let n2 = 0;
     let open = false;
     for (const el of arg.elements) {
       if (ts.isSpreadElement(el)) open = true;
-      else n++;
+      else n2++;
     }
-    return { n: Math.max(n, open ? 0 : 1), open };
+    return { n: Math.max(n2, open ? 0 : 1), open };
   }
   return { n: 1, open: true };
 }
@@ -9447,13 +9447,13 @@ function countTests(src, path = "spec.ts", substantiveOnly = false) {
   if (lang === "py") return { min: pytestCollectedDefs(src), open: false };
   if (lang && lang !== "js") {
     const re = TEST_DEFS[lang];
-    let n2 = 0;
-    for (const line of src.split("\n")) if (re.test(line)) n2++;
-    return { min: n2, open: false };
+    let n3 = 0;
+    for (const line of src.split("\n")) if (re.test(line)) n3++;
+    return { min: n3, open: false };
   }
   const sf = parseSource("spec.ts", src);
   if (!sf) return { min: 0, open: true };
-  let n = 0;
+  let n2 = 0;
   let open = false;
   const dead = unreachableNodes(sf);
   const visit = (node, mult) => {
@@ -9488,19 +9488,19 @@ function countTests(src, path = "spec.ts", substantiveOnly = false) {
       }
       if (isEachOf(node.expression)) {
         const r = eachRows(node);
-        n += r.n * mult;
+        n2 += r.n * mult;
         if (r.open) open = true;
       } else {
         const name = calleeName(node.expression);
-        if ((name === "it" || name === "test") && (!substantiveOnly || hasSubstantiveBody(node))) n += mult;
+        if ((name === "it" || name === "test") && (!substantiveOnly || hasSubstantiveBody(node))) n2 += mult;
       }
     } else if (ts.isTaggedTemplateExpression(node) && isEachOf(node.tag)) {
-      n += templateRows(node) * mult;
+      n2 += templateRows(node) * mult;
     }
     ts.forEachChild(node, (c) => visit(c, mult));
   };
   visit(sf, 1);
-  return { min: n, open };
+  return { min: n2, open };
 }
 function countTestBlocks(src, path = "spec.ts") {
   return countTests(src, path).min;
@@ -9546,7 +9546,7 @@ function scriptWeakenings(before, after, path, policy, addedPaths) {
     const f = dir + file.replace(/^\.\//, "");
     return isProtected(f, policy, "config") && !addedPaths.has(f);
   };
-  const relocated = (kind) => Object.keys(now).some((n) => !(n in was) && checkKinds(now[n]).has(kind));
+  const relocated = (kind) => Object.keys(now).some((n2) => !(n2 in was) && checkKinds(now[n2]).has(kind));
   const out3 = [];
   for (const name of /* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])) {
     const whole = WHOLE_SUITE_SCRIPT.test(name);
@@ -9618,10 +9618,10 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
   if (!was || !now || was.path === now.path) return [];
   const samples = runnerSamples(now.path, policy, ctx, "pytest");
   return suiteNarrowings(was.content, now.content, now.path, samples).map(
-    (n) => makeFinding(RULE10, policy, {
+    (n2) => makeFinding(RULE10, policy, {
       file: now.path,
-      message: `The effective pytest config moved from ${was.path} to ${now.path}, and ${n.path} is no longer selected: ${n.reason}.`,
-      evidence: `inifile precedence ${was.path} \u2192 ${now.path} drops ${n.path} from the suite`,
+      message: `The effective pytest config moved from ${was.path} to ${now.path}, and ${n2.path} is no longer selected: ${n2.reason}.`,
+      evidence: `inifile precedence ${was.path} \u2192 ${now.path} drops ${n2.path} from the suite`,
       remediation: "pytest reads ONE config file. Adding a higher-precedence one, or deleting the one in force, changes which settings apply \u2014 keep the effective configuration selecting the whole suite."
     })
   );
@@ -9755,28 +9755,28 @@ var init_test_deletion = __esm({
                   })
                 );
               }
-              for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
+              for (const n2 of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
                 out3.push(
                   makeFinding(RULE10, policy, {
                     file: c.path,
-                    message: `The runner no longer selects ${n.path}: ${n.reason}.`,
-                    evidence: `${n.path} dropped from the suite by ${c.path}`,
+                    message: `The runner no longer selects ${n2.path}: ${n2.reason}.`,
+                    evidence: `${n2.path} dropped from the suite by ${c.path}`,
                     remediation: "Keep the runner pointed at the whole suite. Excluding a spec from the runner removes its tests without touching the file."
                   })
                 );
               }
-              for (const n of scriptWeakenings(c.before, c.after, c.path, policy, addedPaths)) {
-                const w = n.weakening;
-                const evidence = `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${n.after === "" ? "deleted" : JSON.stringify(n.after)}`;
+              for (const n2 of scriptWeakenings(c.before, c.after, c.path, policy, addedPaths)) {
+                const w = n2.weakening;
+                const evidence = `"${n2.script}": ${JSON.stringify(n2.before)} \u2192 ${n2.after === "" ? "deleted" : JSON.stringify(n2.after)}`;
                 out3.push(
                   w.state === "removed" ? makeFinding(RULE10, policy, {
                     file: c.path,
-                    message: `The test script no longer runs the ${w.kind} check: scripts.${n.script} ${w.what}.`,
+                    message: `The test script no longer runs the ${w.kind} check: scripts.${n2.script} ${w.what}.`,
                     evidence,
                     remediation: "Keep the script running its check. Replacing the runner in package.json removes every test from every `npm test` while the workflow line stays untouched."
                   }) : makeFinding(RULE10, policy, {
                     file: c.path,
-                    message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n.script}.`,
+                    message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n2.script}.`,
                     evidence,
                     remediation: "Keep the test script running the whole suite and letting it decide; a masked status, a cut-short run or a runner flag that selects fewer specs removes the rest from every run."
                   })
@@ -10371,13 +10371,13 @@ function pureRemoval(before, after) {
   const remaining = /* @__PURE__ */ new Map();
   for (const a of before) remaining.set(a.canonical, (remaining.get(a.canonical) ?? 0) + 1);
   for (const a of after) {
-    const n = remaining.get(a.canonical) ?? 0;
-    if (n <= 0) return null;
-    remaining.set(a.canonical, n - 1);
+    const n2 = remaining.get(a.canonical) ?? 0;
+    if (n2 <= 0) return null;
+    remaining.set(a.canonical, n2 - 1);
   }
   for (const a of before) {
-    const n = remaining.get(a.canonical) ?? 0;
-    if (n > 0) return a;
+    const n2 = remaining.get(a.canonical) ?? 0;
+    if (n2 > 0) return a;
   }
   return null;
 }
@@ -10872,8 +10872,8 @@ import { dirname as dirname2, join as join9 } from "node:path";
 function compactOobToken(want, head) {
   const normalizedHead = head.trim().toLowerCase();
   if (!want || !FULL_OBJECT_ID.test(normalizedHead)) return null;
-  const digest = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
-  return `${COMPACT_OOB_PREFIX}${digest}`;
+  const digest2 = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
+  return `${COMPACT_OOB_PREFIX}${digest2}`;
 }
 function ledgerEntryFrom(value) {
   if (!isRecord(value)) return null;
@@ -11180,8 +11180,14 @@ function cell(s) {
 function mdCode(s) {
   return s.replace(/`/g, "'").replace(/[\r\n]/g, " ");
 }
+function encodePathSegment(segment) {
+  return encodeURIComponent(segment).replace(
+    /[!'()*]/g,
+    (character) => "%" + character.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase()
+  );
+}
 function mdUrl(s) {
-  return s.replace(/[()<> \r\n"'`\\]/g, (c) => "%" + c.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase());
+  return s.split("/").map(encodePathSegment).join("/");
 }
 function locationCell(f, env) {
   if (!f.file) return "`(command)`";
@@ -12302,10 +12308,10 @@ function parseAuditJsonl(raw) {
   return events;
 }
 function parseSince(value, nowMs = Date.now()) {
-  const relative8 = /^(\d+)(m|h|d)$/.exec(value);
-  if (relative8) {
-    const count = Number(relative8[1]);
-    const unit = relative8[2] === "m" ? 6e4 : relative8[2] === "h" ? 36e5 : 864e5;
+  const relative9 = /^(\d+)(m|h|d)$/.exec(value);
+  if (relative9) {
+    const count = Number(relative9[1]);
+    const unit = relative9[2] === "m" ? 6e4 : relative9[2] === "h" ? 36e5 : 864e5;
     if (!Number.isSafeInteger(count) || count <= 0) throw new Error(`invalid --since value "${value}"`);
     return nowMs - count * unit;
   }
@@ -12714,8 +12720,8 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync10(log)) return none;
   let offset = 0;
   if (cp && existsSync10(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
-    offset = Number.isFinite(n) ? n : 0;
+    const n2 = Number(readFileSync11(cp, "utf8"));
+    offset = Number.isFinite(n2) ? n2 : 0;
   }
   const drained = drainEvents(log, offset);
   if (!drained.complete) {
@@ -13013,12 +13019,12 @@ function pidAlive2(pid) {
   }
 }
 function listening(socket) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve20) => {
     const sock = createConnection2(socket);
     const done = (v) => {
       clearTimeout(timer);
       sock.destroy();
-      resolve17(v);
+      resolve20(v);
     };
     const timer = setTimeout(() => done(false), 1e3);
     sock.once("connect", () => done(true));
@@ -13197,11 +13203,11 @@ async function startHookService(opts) {
   });
   const umask = process.umask(63);
   try {
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve20, reject) => {
       server.once("error", reject);
       server.listen(paths.socket, () => {
         server.off("error", reject);
-        resolve17();
+        resolve20();
       });
     });
   } finally {
@@ -13218,8 +13224,8 @@ async function startHookService(opts) {
     get served() {
       return served;
     },
-    close: () => new Promise((resolve17) => {
-      if (closed) return resolve17();
+    close: () => new Promise((resolve20) => {
+      if (closed) return resolve20();
       closed = true;
       setSnapshotCache(null);
       let settled = false;
@@ -13230,7 +13236,7 @@ async function startHookService(opts) {
         clearTimeout(drain);
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
-        resolve17();
+        resolve20();
       };
       server.close(finalize);
       for (const sock of sockets) if (sock !== acceptedSocket) sock.destroy();
@@ -13257,11 +13263,16 @@ async function probeSocket(paths) {
 function describeStateFile(state) {
   return state ? `records pid ${state.pid}, root ${state.root}, tamperward@${state.version}` : "is absent or unreadable";
 }
-async function stopHookService(paths) {
+async function stopHookService(paths, expectedRoot) {
   const probe = await probeSocket(paths);
   const state = readServiceState(paths);
   if (probe.answered) {
     const st = probe.status;
+    const requestedRoot = expectedRoot === void 0 ? void 0 : realpathSync4(repoRoot(expectedRoot));
+    if (requestedRoot !== void 0 && (st === null || st.root !== requestedRoot)) {
+      const detail2 = st ? `a listener answered on ${paths.socket} for root ${st.root}, not the requested repository ${requestedRoot}` : `a listener answered on ${paths.socket} but did not report a root for the requested repository ${requestedRoot}`;
+      return { outcome: "mismatch", pid: st?.pid ?? state?.pid, root: st?.root ?? state?.root, detail: detail2 };
+    }
     const agrees = st !== null && state !== null && state.pid === st.pid && state.root === st.root && state.version === st.version;
     if (agrees && st.pid !== process.pid) {
       try {
@@ -13283,13 +13294,13 @@ async function stopHookService(paths) {
   removeQuietly(paths.state);
   return { outcome: "not-running" };
 }
-function parseStart(args) {
-  let dir = process.cwd();
-  for (let i = 0; i < args.length; i++) if (args[i] === "--dir" && args[i + 1]) dir = args[++i];
-  return { dir };
+function parseDir(args) {
+  for (let i = 0; i < args.length; i++) if (args[i] === "--dir" && args[i + 1]) return args[++i];
+  return void 0;
 }
 function runHookService(args) {
   const sub = args[0];
+  const dir = parseDir(args.slice(1));
   const paths = servicePaths();
   if (!paths) {
     process.stderr.write(
@@ -13297,9 +13308,18 @@ function runHookService(args) {
     );
     return 2;
   }
+  let requestedRoot;
+  if (dir !== void 0) {
+    try {
+      requestedRoot = realpathSync4(repoRoot(realpathSync4(dir)));
+    } catch (e) {
+      process.stderr.write(`tamperward hook-service: cannot resolve --dir ${dir} (${e instanceof Error ? e.message : String(e)})
+`);
+      return 2;
+    }
+  }
   if (sub === "start") {
-    const { dir } = parseStart(args.slice(1));
-    startHookService({ root: dir, paths }).then((svc) => {
+    startHookService({ root: requestedRoot ?? process.cwd(), paths }).then((svc) => {
       let closing = false;
       const shutdown = () => {
         if (closing) return;
@@ -13320,7 +13340,7 @@ function runHookService(args) {
     return -1;
   }
   if (sub === "stop") {
-    return stopHookService(paths).then((res) => {
+    return stopHookService(paths, requestedRoot).then((res) => {
       if (res.outcome === "stopped") {
         process.stdout.write(`tamperward hook-service: stopped (pid ${res.pid}); ${paths.socket} removed
 `);
@@ -13363,6 +13383,14 @@ function runHookService(args) {
       exitAfterFlush(0);
       return;
     }
+    if (requestedRoot !== void 0 && res.root !== requestedRoot) {
+      process.stderr.write(
+        `tamperward hook-service: a listener is bound to ${res.root}, not the requested repository ${requestedRoot}; it was not treated as the requested service; ${optIn}
+`
+      );
+      exitAfterFlush(1);
+      return;
+    }
     const cache3 = isRecord(res.cache) ? res.cache : {};
     const startedAt = typeof res.started_at === "string" ? res.started_at : state?.started_at ?? "unknown";
     const disagrees = !state || state.pid !== res.pid || state.root !== res.root || state.version !== res.version;
@@ -13394,6 +13422,7 @@ var init_hook_service = __esm({
 });
 
 // src/cli/allow.ts
+import { relative as relative3, resolve as resolve5, sep as sep2 } from "node:path";
 function runAllow(opts) {
   if (!opts.rule) {
     process.stderr.write('tamperward allow <rule> [--file <path>] --reason "<why>"\n');
@@ -13412,8 +13441,9 @@ function runAllow(opts) {
     process.stderr.write("tamperward: cannot read the working tree (not a git repo?).\n");
     return 2;
   }
+  const requestedFile = opts.file === void 0 ? void 0 : relative3(cwd, resolve5(cwd, opts.file)).split(sep2).join("/");
   const targets = findings.filter(
-    (f) => f.severity === "block" && f.rule === opts.rule && (!opts.file || f.file === opts.file)
+    (f) => f.severity === "block" && f.rule === opts.rule && (!requestedFile || f.file === requestedFile)
   );
   if (targets.length === 0) {
     process.stderr.write(
@@ -13532,7 +13562,7 @@ var init_safe_write = __esm({
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync13, realpathSync as realpathSync5 } from "node:fs";
-import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative3, resolve as resolve5 } from "node:path";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative4, resolve as resolve6 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
     return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -13872,13 +13902,13 @@ function planClaudeHooks(cwd) {
 function hooksDir(cwd) {
   try {
     const out3 = execFileSync6("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (out3) return resolve5(cwd, out3);
+    if (out3) return resolve6(cwd, out3);
   } catch {
   }
   return existsSync12(join15(cwd, ".git")) ? join15(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
-  const rel = relative3(cwd, path);
+  const rel = relative4(cwd, path);
   return rel && !rel.startsWith("..") && !isAbsolute9(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
@@ -14127,7 +14157,7 @@ function planInit(cwd, opts = {}) {
   ];
 }
 function runInit(opts) {
-  const requested = resolve5(opts.cwd ?? process.cwd());
+  const requested = resolve6(opts.cwd ?? process.cwd());
   const cwd = repoRoot(requested);
   const w = opts.quiet ? { write: (_text) => true } : process.stdout;
   if (cwd !== requested && !sameDir(cwd, requested)) {
@@ -14377,16 +14407,16 @@ import {
   dirname as dirname6,
   isAbsolute as isAbsolute10,
   join as join16,
-  relative as relative4,
-  resolve as resolve6,
-  sep as sep2
+  relative as relative5,
+  resolve as resolve7,
+  sep as sep3
 } from "node:path";
 function metricsFor(descriptor) {
   return descriptor.metrics ??= { fullSnapshots: 0, reusedSnapshots: 0, totalMs: 0 };
 }
 function inside(root, candidate) {
-  const rel = relative4(resolve6(root), resolve6(candidate));
-  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute10(rel);
+  const rel = relative5(resolve7(root), resolve7(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep3) && !isAbsolute10(rel);
 }
 function modeKind(path) {
   const st = lstatSync8(path);
@@ -14538,7 +14568,7 @@ function freezeRoot(kind, path) {
     if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
-    return { kind, path: resolve6(path), realPath: realpathSync6(path) };
+    return { kind, path: resolve7(path), realPath: realpathSync6(path) };
   } catch (e) {
     throw new Unattestable(
       kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -14574,7 +14604,7 @@ function firstExecutable(command) {
 function resolveExecutable(token, cwd, env) {
   if (!token) return null;
   if (token.includes("/") || token.includes("\\")) {
-    const path = isAbsolute10(token) ? token : resolve6(cwd, token);
+    const path = isAbsolute10(token) ? token : resolve7(cwd, token);
     try {
       return existsSync13(path) ? realpathSync6(path) : null;
     } catch {
@@ -14582,7 +14612,7 @@ function resolveExecutable(token, cwd, env) {
     }
   }
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
-    const candidate = resolve6(entry, token);
+    const candidate = resolve7(entry, token);
     try {
       if (existsSync13(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
     } catch {
@@ -14601,7 +14631,7 @@ function looksPython(command, executable, token) {
 }
 function inferredVenvFromToken(token, cwd) {
   if (!token || !token.includes("/") && !token.includes("\\")) return null;
-  const path = isAbsolute10(token) ? token : resolve6(cwd, token);
+  const path = isAbsolute10(token) ? token : resolve7(cwd, token);
   if (!pythonName(basename4(path))) return null;
   const parent = dirname6(path);
   const parentName = basename4(parent).toLowerCase();
@@ -14639,7 +14669,7 @@ function venvProblem(root) {
   return null;
 }
 function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
-  const cwd = resolve6(cwdInput);
+  const cwd = resolve7(cwdInput);
   const roots = [];
   const probes = [];
   const seen = /* @__PURE__ */ new Set();
@@ -14663,7 +14693,7 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
       if (!isAbsolute10(env.VIRTUAL_ENV)) {
         throw new Unattestable("VIRTUAL_ENV is relative (" + JSON.stringify(env.VIRTUAL_ENV) + ")");
       }
-      venv = resolve6(env.VIRTUAL_ENV);
+      venv = resolve7(env.VIRTUAL_ENV);
     } else {
       venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
       if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync13(join16(cwd, ".venv", "pyvenv.cfg"))) {
@@ -14703,7 +14733,7 @@ function checkDependencyEnvironment(cwdInput, descriptor) {
     const fingerprint2 = measuredSnapshot(
       descriptor.roots,
       descriptor.probes,
-      resolve6(cwdInput),
+      resolve7(cwdInput),
       metricsFor(descriptor)
     );
     if (fingerprint2 !== descriptor.fingerprint) {
@@ -14716,7 +14746,7 @@ function checkDependencyEnvironment(cwdInput, descriptor) {
 }
 function attestDependencyEnvironment(cwdInput, descriptor) {
   const attestation = {
-    cwd: resolve6(cwdInput),
+    cwd: resolve7(cwdInput),
     descriptor,
     check: checkDependencyEnvironment(cwdInput, descriptor)
   };
@@ -14724,7 +14754,7 @@ function attestDependencyEnvironment(cwdInput, descriptor) {
   return attestation;
 }
 function reuseDependencyEnvironmentAttestation(cwdInput, descriptor, attestation) {
-  if (!attestation || !issuedAttestations.has(attestation) || attestation.descriptor !== descriptor || attestation.cwd !== resolve6(cwdInput)) return null;
+  if (!attestation || !issuedAttestations.has(attestation) || attestation.descriptor !== descriptor || attestation.cwd !== resolve7(cwdInput)) return null;
   metricsFor(descriptor).reusedSnapshots += 1;
   return attestation.check;
 }
@@ -14853,8 +14883,8 @@ function parseCapturedSupervisorResult(stdoutText) {
   };
 }
 function runCapturedProcessSync(executable, args, opts) {
-  const stateDir = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
-  const configFile = join17(stateDir, "config.json");
+  const stateDir2 = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
+  const configFile = join17(stateDir2, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
     writeFileSync8(
@@ -14902,7 +14932,7 @@ function runCapturedProcessSync(executable, args, opts) {
     }
     return parsed;
   } finally {
-    rmSync6(stateDir, { recursive: true, force: true });
+    rmSync6(stateDir2, { recursive: true, force: true });
   }
 }
 var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CLEANUP_HELPERS_SRC, CAPTURE_SUPERVISOR;
@@ -15146,7 +15176,7 @@ if (child) {
 import { createHash as createHash11, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve7 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve8 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
   const groups = typeof process.getgroups === "function" ? process.getgroups() : [];
@@ -15166,7 +15196,7 @@ function writableByCaller(path) {
   }
 }
 function replaceableByCaller(path) {
-  let current = resolve7(path);
+  let current = resolve8(path);
   if (writableByCaller(current)) return true;
   current = dirname7(current);
   while (true) {
@@ -15512,7 +15542,7 @@ function runContainerStage(backend, dir, command, budgetSecs) {
   const args = containerRunArgs({
     image: backend.image,
     name,
-    workspace: resolve7(dir),
+    workspace: resolve8(dir),
     command,
     uid,
     gid,
@@ -15621,12 +15651,375 @@ var init_verifier_backend = __esm({
   }
 });
 
-// src/cli/verify.ts
-import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
+// src/verification-state.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync16, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname8, join as join19 } from "node:path";
+function git2(args, cwd) {
+  return execFileSync8("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 1 << 28,
+    env: trustedGitEnv()
+  });
+}
+function resolveBaseRev(baseRef, cwd) {
+  assertRev(baseRef);
+  const rev2 = git2(["rev-parse", "--verify", `${baseRef}^{commit}`], cwd).trim();
+  try {
+    return git2(["merge-base", rev2, "HEAD"], cwd).trim();
+  } catch {
+    return rev2;
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function digest(value) {
+  return createHash12("sha256").update(canonicalJson(value)).digest("hex");
+}
+function surfacePaths(base, cwd, policy) {
+  let listing;
+  try {
+    listing = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd);
+  } catch {
+    return [];
+  }
+  const inputs = policy.verify?.inputs ?? [];
+  return listing.split("\0").filter(Boolean).filter((p) => isProtected(p, policy) || matchesAny(p, inputs)).sort();
+}
+function interventionWiring(cwd) {
+  const dir = claudeConfigDir();
+  const sources = [
+    ["repo", join19(cwd, ".claude", "settings.json")],
+    ["repo.local", join19(cwd, ".claude", "settings.local.json")],
+    ["user", join19(dir, "settings.json")],
+    ["user.local", join19(dir, "settings.local.json")]
+  ];
+  return sources.map(([source, path]) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync16(path, "utf8"));
+    } catch {
+      return { source, present: false };
+    }
+    if (!isRecord4(parsed)) return { source, present: true, shape: "non-object" };
+    return {
+      source,
+      present: true,
+      hooks: parsed.hooks ?? null,
+      disableAllHooks: parsed.disableAllHooks ?? null
+    };
+  });
+}
+function dependenciesBinding(root, policy, command) {
+  const backend = policy.verify?.backend ?? "local";
+  if (backend === "container") {
+    return digest({ backend, image: policy.verify?.image ?? null });
+  }
+  const dep = discoverDependencyEnvironment(root, command);
+  return digest({ backend, status: dep.status, fingerprint: dep.fingerprint ?? null });
+}
+function computeBinding(cwd, inputs, precomputed) {
+  const root = repoRoot(cwd);
+  const head = git2(["rev-parse", "--verify", "HEAD^{commit}"], root).trim();
+  const base = resolveBaseRev(inputs.base_ref, root);
+  const policy = inputs.explicit_base ? loadPolicyAt(base, root) ?? defaultPolicy() : loadPolicy(root);
+  const command = inputs.command_source === "flag" ? inputs.command : policy.verify?.command ?? "";
+  if (!command) {
+    throw new Error("no verifier command is configured for the recorded verification");
+  }
+  const budget = inputs.budget_source === "flag" ? inputs.budget : policy.verify?.budget ?? 300;
+  const protectedIgnored = (rel) => isProtected(rel, policy);
+  return {
+    // NOTE (#500/#600 follow-up): `tree` hashes every tracked and ignored-protected
+    // file and `dependencies` walks the attested dependency roots, on EVERY call.
+    // Right for `verify` (once per run) and reused there via `precomputed.tree`,
+    // but `status` is meant to be polled continuously by a status bar/dashboard,
+    // where a large repository makes each poll a full read. A stat-cache identity
+    // (git's index plus hashing only what changed) is a deliberate follow-up, not
+    // built here.
+    tree: precomputed?.tree ?? treeFingerprint(root, protectedIgnored),
+    head,
+    base,
+    policy: digest(policy),
+    verifier: digest({
+      command,
+      budget,
+      inputs: policy.verify?.inputs ?? [],
+      backend: policy.verify?.backend ?? "local",
+      image: policy.verify?.image ?? null
+    }),
+    surface: digest(surfacePaths(base, root, policy)),
+    intervention: digest(interventionWiring(root)),
+    dependencies: dependenciesBinding(root, policy, command)
+  };
+}
+function stateDir(cwd) {
+  const ctx = repoContext(cwd);
+  return ctx ? join19(ctx.gitDir, "tamperward") : null;
+}
+function verificationRecordPath(cwd) {
+  const dir = stateDir(cwd);
+  return dir ? join19(dir, "verification-state.json") : null;
+}
+function verifyingMarkerPath(cwd) {
+  const dir = stateDir(cwd);
+  return dir ? join19(dir, "verifying.json") : null;
+}
+function recordVerification(cwd, inputs, treeFingerprintValue) {
+  const path = verificationRecordPath(cwd);
+  if (!path) return false;
+  const binding = computeBinding(
+    repoRoot(cwd),
+    inputs,
+    treeFingerprintValue ? { tree: treeFingerprintValue } : void 0
+  );
+  const record = {
+    schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    verified_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tw_version: TW_VERSION,
+    inputs,
+    binding
+  };
+  mkdirSync8(dirname8(path), { recursive: true });
+  writeFileSync9(path, JSON.stringify(record) + "\n");
+  return true;
+}
+function invalidateVerificationRecordIfCurrent(cwd) {
+  const record = readVerificationRecord(cwd);
+  if (!record) return false;
+  let live;
+  try {
+    live = computeBinding(cwd, record.inputs);
+  } catch {
+    return false;
+  }
+  if (firstMismatch(record.binding, live)) return false;
+  const path = verificationRecordPath(cwd);
+  if (!path) return false;
+  try {
+    rmSync7(path, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isBinding(v) {
+  if (!isRecord4(v)) return false;
+  return BINDING_INPUTS.every((k) => {
+    const val = v[k];
+    return typeof val === "string" && val.length > 0;
+  });
+}
+function parseVerificationRecord(value) {
+  if (!isRecord4(value)) return null;
+  if (value.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
+  if (value.verdict !== "VERIFIED") return null;
+  if (typeof value.verified_at !== "string") return null;
+  if (typeof value.tw_version !== "string") return null;
+  const inputs = value.inputs;
+  if (!isRecord4(inputs)) return null;
+  if (typeof inputs.base_ref !== "string" || inputs.base_ref.length === 0) return null;
+  if (typeof inputs.explicit_base !== "boolean") return null;
+  if (inputs.command_source !== "policy" && inputs.command_source !== "flag") return null;
+  if (typeof inputs.command !== "string") return null;
+  if (inputs.budget_source !== "policy" && inputs.budget_source !== "flag") return null;
+  if (typeof inputs.budget !== "number" || !Number.isFinite(inputs.budget)) return null;
+  if (!isBinding(value.binding)) return null;
+  return {
+    schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    verified_at: value.verified_at,
+    tw_version: value.tw_version,
+    inputs: {
+      base_ref: inputs.base_ref,
+      explicit_base: inputs.explicit_base,
+      command_source: inputs.command_source,
+      command: inputs.command,
+      budget_source: inputs.budget_source,
+      budget: inputs.budget
+    },
+    binding: value.binding
+  };
+}
+function readVerificationRecord(cwd) {
+  const path = verificationRecordPath(cwd);
+  if (!path) return null;
+  let raw;
+  try {
+    raw = readFileSync16(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  return parseVerificationRecord(parsed);
+}
+function pidAlive3(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return isRecord4(e) && e.code === "EPERM";
+  }
+}
+function beginVerifying(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return false;
+  try {
+    const marker = {
+      schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+      pid: process.pid,
+      started_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    mkdirSync8(dirname8(path), { recursive: true });
+    writeFileSync9(path, JSON.stringify(marker) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function endVerifying(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return;
+  try {
+    rmSync7(path, { force: true });
+  } catch {
+  }
+}
+function readVerifyingMarker(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync16(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!isRecord4(parsed)) return null;
+  if (parsed.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
+  if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
+  if (typeof parsed.started_at !== "string") return null;
+  if (!pidAlive3(parsed.pid)) return null;
+  return { schema_version: VERIFICATION_STATE_SCHEMA_VERSION, pid: parsed.pid, started_at: parsed.started_at };
+}
+function firstMismatch(recorded, live) {
+  for (const input of MISMATCH_PRIORITY) {
+    if (recorded[input] !== live[input]) return input;
+  }
+  return null;
+}
+function evaluateVerificationState(cwd) {
+  if (readVerifyingMarker(cwd)) {
+    return { state: "VERIFYING", reason: "a verification is in progress" };
+  }
+  const record = readVerificationRecord(cwd);
+  if (!record) {
+    return {
+      state: "UNVERIFIED",
+      reason: "no successful verification has been recorded for this repository"
+    };
+  }
+  let live;
+  try {
+    live = computeBinding(cwd, record.inputs);
+  } catch (e) {
+    return {
+      state: "BROKEN",
+      reason: "verification authority wiring is invalid or unavailable",
+      detail: e instanceof Error ? e.message : String(e),
+      verified_at: record.verified_at,
+      verifier_command: record.inputs.command,
+      record
+    };
+  }
+  const changed = firstMismatch(record.binding, live);
+  if (!changed) {
+    return {
+      state: "CURRENT",
+      verified_at: record.verified_at,
+      base: live.base,
+      head: live.head,
+      verifier_command: record.inputs.command,
+      record
+    };
+  }
+  return {
+    state: "STALE",
+    changed_input: changed,
+    reason: STALE_REASON[changed],
+    verified_at: record.verified_at,
+    base: live.base,
+    head: live.head,
+    verifier_command: record.inputs.command,
+    record
+  };
+}
+var VERIFICATION_STATE_SCHEMA_VERSION, BINDING_INPUTS, STALE_REASON, MISMATCH_PRIORITY;
+var init_verification_state = __esm({
+  "src/verification-state.ts"() {
+    "use strict";
+    init_build();
+    init_trusted();
+    init_fingerprint();
+    init_policy();
+    init_policy_load();
+    init_repo_context();
+    init_wiring();
+    init_dependency_env();
+    VERIFICATION_STATE_SCHEMA_VERSION = 1;
+    BINDING_INPUTS = [
+      "tree",
+      "head",
+      "base",
+      "policy",
+      "verifier",
+      "surface",
+      "intervention",
+      "dependencies"
+    ];
+    STALE_REASON = {
+      tree: "candidate tree changed since verification",
+      head: "HEAD commit changed since verification",
+      base: "trusted base commit changed since verification",
+      policy: "TamperWard policy changed since verification",
+      verifier: "verifier configuration changed since verification",
+      surface: "protected verification surface changed since verification",
+      intervention: "runtime steering wiring changed since verification",
+      dependencies: "dependency environment changed since verification"
+    };
+    MISMATCH_PRIORITY = [
+      "head",
+      "base",
+      "verifier",
+      "surface",
+      "intervention",
+      "dependencies",
+      "policy",
+      "tree"
+    ];
+  }
+});
+
+// src/cli/verify.ts
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, readlinkSync as readlinkSync3, rmSync as rmSync8, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute11, join as join19, relative as relative5, resolve as resolve8, sep as sep3 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute11, join as join20, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
   return {
     level: "suite-exit-only",
@@ -15635,14 +16028,14 @@ function oracleAssuranceReport() {
     limitation: "candidate source executes inside the configured suite process and may terminate or interpose on that in-process oracle; isolated-container is execution-domain isolation, not semantic/oracle isolation"
   };
 }
-function git2(args, cwd) {
-  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+function git3(args, cwd) {
+  return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
-  const rev2 = git2(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
+  const rev2 = git3(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
   try {
-    return git2(["merge-base", rev2, "HEAD"], cwd).trim();
+    return git3(["merge-base", rev2, "HEAD"], cwd).trim();
   } catch {
     return rev2;
   }
@@ -15652,32 +16045,53 @@ function baseIsAncestorOfHead(base, cwd) {
   return r.status === 0;
 }
 function inside2(root, path) {
-  const rel = relative5(resolve8(root), resolve8(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute11(rel);
+  const rel = relative6(resolve9(root), resolve9(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute11(rel);
 }
 function linkParts(path) {
-  const parts = sep3 === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  const parts = sep4 === "\\" ? path.split(/[\\/]+/) : path.split("/");
   return parts.filter((part) => part !== "" && part !== ".");
 }
+function materializationFailureReason(error) {
+  if (error instanceof MaterializationError) return error.materializationReason;
+  const code2 = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+  const message = error instanceof Error ? error.message : String(error);
+  if (/tracked\s+node_modules|node_modules.*(?:attested|dependency).*(?:conflict|replace)/i.test(message)) {
+    return "TRACKED_NODE_MODULES_CONFLICT";
+  }
+  if (/symlink.*(?:escape|cycle|parent directory)|escapes the materialised tree/i.test(message)) {
+    return "SYMLINK_ESCAPE";
+  }
+  if (/(?:special file|where git expects a file)/i.test(message)) {
+    return "SPECIAL_FILE";
+  }
+  if (code2 === "ENOENT" || /(?:ENOENT|no such file|file not found)/i.test(message)) {
+    return "RACING_DELETION";
+  }
+  return "UNKNOWN";
+}
 function linkEscape(label, target) {
-  return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
+  return new MaterializationError(
+    "SYMLINK_ESCAPE",
+    `${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`
+  );
 }
 function driveRelativeLinkTarget(target) {
-  return sep3 === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+  return sep4 === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
 }
 function rootedLinkTarget(target) {
   return isAbsolute11(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out3, root, label) {
-  if (rootedLinkTarget(target) || !inside2(root, resolve8(dirname8(out3), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve9(dirname9(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync7(out3, { force: true });
+  rmSync8(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative5(root, dirname8(out3)));
+  let stack = linkParts(relative6(root, dirname9(out3)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -15694,7 +16108,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "deps" && dependencyRoot ? dependencyRoot : root;
-    const current = join19(base, ...stack);
+    const current = join20(base, ...stack);
     let st;
     try {
       st = lstatSync9(current);
@@ -15703,11 +16117,17 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
     }
     if (!st.isSymbolicLink()) continue;
     if (++hops > 128) {
-      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+      throw new MaterializationError(
+        "SYMLINK_ESCAPE",
+        `${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`
+      );
     }
-    const key2 = `${domain}:${current}:${pending.join(sep3)}`;
+    const key2 = `${domain}:${current}:${pending.join(sep4)}`;
     if (seen.has(key2)) {
-      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+      throw new MaterializationError(
+        "SYMLINK_ESCAPE",
+        `${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`
+      );
     }
     seen.add(key2);
     const next = readlinkSync3(current);
@@ -15720,7 +16140,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
         throw linkEscape(label, target);
       }
       stack = [];
-      pending.unshift(...linkParts(relative5(dependencyRoot, resolve8(next))));
+      pending.unshift(...linkParts(relative6(dependencyRoot, resolve9(next))));
     } else {
       pending.unshift(...linkParts(next));
     }
@@ -15730,7 +16150,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join19(current, part);
+    current = join20(current, part);
     let st;
     try {
       st = lstatSync9(current);
@@ -15738,15 +16158,24 @@ function rejectLinkedParent(cwd, rel) {
       continue;
     }
     if (st.isSymbolicLink()) {
-      throw new Error(`${rel} has a symlinked parent directory (${relative5(cwd, current)})`);
+      throw new MaterializationError(
+        "SYMLINK_ESCAPE",
+        `${rel} has a symlinked parent directory (${relative6(cwd, current)})`
+      );
     }
   }
 }
 function materialize(cwd, dest, dependencyRoot) {
   const listed = workingTreePaths(cwd);
+  if (dependencyRoot && listed.some((rel) => rel === "node_modules" || rel.startsWith("node_modules/"))) {
+    throw new MaterializationError(
+      "TRACKED_NODE_MODULES_CONFLICT",
+      "tracked node_modules conflicts with the attested dependency root"
+    );
+  }
   const links = [];
   for (const rel of listed) {
-    const src = join19(cwd, rel);
+    const src = join20(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -15754,8 +16183,8 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out3 = join19(dest, rel);
-    mkdirSync8(dirname8(out3), { recursive: true });
+    const out3 = join20(dest, rel);
+    mkdirSync9(dirname9(out3), { recursive: true });
     dropSymlink(out3);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -15765,25 +16194,28 @@ function materialize(cwd, dest, dependencyRoot) {
       cpSync(src, out3, { dereference: true });
       chmodSync2(out3, st.mode);
     } else {
-      throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
+      throw new MaterializationError(
+        "SPECIAL_FILE",
+        `${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`
+      );
     }
   }
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join19(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join20(dest, "node_modules"), "dir");
 }
 function workingTreePaths(cwd) {
-  return git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  return git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
 }
 function probeFilesystemCaseSensitivity(dir) {
-  const upper = join19(dir, ".tw-case-probe-A");
-  const lower = join19(dir, ".tw-case-probe-a");
+  const upper = join20(dir, ".tw-case-probe-A");
+  const lower = join20(dir, ".tw-case-probe-a");
   try {
-    writeFileSync9(upper, "", { flag: "wx" });
+    writeFileSync10(upper, "", { flag: "wx" });
     return !existsSync14(lower);
   } finally {
-    rmSync7(upper, { force: true });
+    rmSync8(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -15801,7 +16233,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync7(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync8(p, { force: true });
   } catch {
   }
 }
@@ -15830,22 +16262,22 @@ function verifierCoveredInputs(cmd, atBase, policy) {
   return covered;
 }
 function baseEntries(base, cwd) {
-  return git2(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
+  return git3(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
     const tab = rec.indexOf("	");
     const [mode, type] = rec.slice(0, tab).split(" ");
     return { mode, type, path: rec.slice(tab + 1) };
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash12("sha256");
+  const h = createHash13("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join19(dest, rel);
+    const p = join20(dest, rel);
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync17(p));
     } catch {
       h.update("<gone>");
     }
@@ -15874,16 +16306,16 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
     if (e.type === "commit") {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
-    const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out3 = join19(dest, e.path);
-    mkdirSync8(dirname8(out3), { recursive: true });
-    rmSync7(out3, { force: true });
+    const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const out3 = join20(dest, e.path);
+    mkdirSync9(dirname9(out3), { recursive: true });
+    rmSync8(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync9(out3, content);
+      writeFileSync10(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -15892,7 +16324,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync7(join19(dest, rel), { force: true });
+    rmSync8(join20(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -15906,9 +16338,9 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join19(scratch, "npmrc-user");
-  const globalRc = join19(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync9(f, "", { mode: 292 });
+  const userRc = join20(scratch, "npmrc-user");
+  const globalRc = join20(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -15939,7 +16371,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
     };
   }
-  const scratch = mkdtempSync3(join19(tmpdir4(), "tw-verify-run-"));
+  const scratch = mkdtempSync3(join20(tmpdir4(), "tw-verify-run-"));
   try {
     const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
@@ -15984,7 +16416,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       diagnostics: r.diagnostics
     };
   } finally {
-    rmSync7(scratch, { recursive: true, force: true });
+    rmSync8(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -16029,6 +16461,15 @@ function verifyVerdictLine(verdict2, ctx) {
   }
 }
 function runVerify(opts) {
+  const markerCwd = repoRoot(opts.cwd ?? process.cwd());
+  const marked = opts.silent ? false : beginVerifying(markerCwd);
+  try {
+    return runVerifyImpl(opts);
+  } finally {
+    if (marked) endVerifying(markerCwd);
+  }
+}
+function runVerifyImpl(opts) {
   const cwd = repoRoot(opts.cwd ?? process.cwd());
   const colour = opts.silent ? false : colourEnabled(process.env, process.stdout);
   const paintVerify = (s) => {
@@ -16068,7 +16509,7 @@ function runVerify(opts) {
     return cannotVerify("POLICY_ERROR", `cannot load policy (${e instanceof Error ? e.message : String(e)})`);
   }
   if (opts.requireAncestor) {
-    const requested = git2(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
+    const requested = git3(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
     if (!baseIsAncestorOfHead(requested, cwd)) {
       return cannotVerify(
         "BASE_NOT_ANCESTOR",
@@ -16176,17 +16617,17 @@ function runVerify(opts) {
   } catch {
     return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
-  const visRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-vis-"));
-  const visDir = join19(visRoot, "t");
+  const visRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-vis-"));
+  const visDir = join20(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync7(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync8(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
     const present = (rel) => {
       try {
-        lstatSync9(join19(cwd, rel));
+        lstatSync9(join20(cwd, rel));
         return true;
       } catch {
         return false;
@@ -16218,14 +16659,14 @@ function runVerify(opts) {
     );
   }
   try {
-    mkdirSync8(visDir);
+    mkdirSync9(visDir);
     materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
     return cannotVerify(
       "MATERIALIZATION_FAILED",
       `could not materialize (${e instanceof Error ? e.message : String(e)})`,
-      { verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport() }
+      { verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport(), materialization_reason: materializationFailureReason(e) }
     );
   }
   const visible = runStage(visDir);
@@ -16259,6 +16700,49 @@ function runVerify(opts) {
     }
     return 2;
   }
+  if (visible.failure === "budget") {
+    const pristineNotRun = {
+      exit: null,
+      secs: 0,
+      failure: "budget",
+      reason: "not run: visible stage exceeded its budget"
+    };
+    cleanup([visRoot]);
+    opts.onVerdict?.({ verdict: "BUDGET_EXCEEDED" });
+    if (opts.json) {
+      out3(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
+        verdict: "BUDGET_EXCEEDED",
+        base,
+        command: cmd,
+        budget_secs: budget,
+        visible: stageJson(visible),
+        pristine: stageJson(pristineNotRun),
+        protected_restored: 0,
+        added_protected_removed: 0,
+        filesystem_case_sensitive: filesystemCaseSensitive,
+        verifier_backend: backendReport(),
+        dependency_environment: dependencyReport(),
+        oracle_assurance: oracleAssuranceReport(),
+        ...opts.keep ? { visible_dir: visDir } : {}
+      }));
+    } else {
+      out3(`tamperward verify \u2014 ${verifyVerdictLine("BUDGET_EXCEEDED", {
+        restored: 0,
+        base,
+        visibleExit: visible.exit,
+        pristineExit: pristineNotRun.exit,
+        budget
+      })}`);
+      out3("verifier backend: " + verifierBackendSummary(verifierBackend));
+      out3("oracle assurance: suite-exit-only (candidate source executes inside the suite process; execution-domain isolation is not semantic/oracle isolation)");
+      out3(
+        dependencyEnvironment ? "dependency environment: " + dependencyEnvironmentSummary(dependencyEnvironment) : "dependency environment: verifier-owned by " + (verifierBackend.image ?? "isolated image")
+      );
+      renderStageDiagnostics(out3, "visible", visible);
+    }
+    return 2;
+  }
   if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
     return cannotVerify(
@@ -16276,12 +16760,12 @@ function runVerify(opts) {
       { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
     );
   }
-  const priRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-pri-"));
-  const priDir = join19(priRoot, "t");
+  const priRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-pri-"));
+  const priDir = join20(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
-    mkdirSync8(priDir);
+    mkdirSync9(priDir);
     materialize(cwd, priDir, frozenNodeModules);
     ({ restored, removed: removedAdded } = overlayPristine(
       cwd,
@@ -16297,7 +16781,7 @@ function runVerify(opts) {
     return cannotVerify(
       "MATERIALIZATION_FAILED",
       `could not materialize pristine copy (${e instanceof Error ? e.message : String(e)})`,
-      { stage: "pristine", verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport() }
+      { stage: "pristine", verifier_backend: backendReport(), dependency_environment: dependencyReport(), oracle_assurance: oracleAssuranceReport(), materialization_reason: materializationFailureReason(e) }
     );
   }
   const overlayBefore = overlayDigest(priDir, restored);
@@ -16367,6 +16851,25 @@ function runVerify(opts) {
     code2 = 1;
   }
   opts.onVerdict?.({ verdict: verdict2 });
+  if (verdict2 === "VERIFIED") {
+    try {
+      const inputs = {
+        base_ref: opts.base ?? "HEAD",
+        explicit_base: opts.base !== void 0,
+        command_source: opts.cmd !== void 0 ? "flag" : "policy",
+        command: cmd,
+        budget_source: opts.budget !== void 0 ? "flag" : "policy",
+        budget
+      };
+      recordVerification(cwd, inputs, treeBefore);
+    } catch {
+    }
+  } else {
+    try {
+      invalidateVerificationRecordIfCurrent(cwd);
+    } catch {
+    }
+  }
   const signedOff = verdict2 === "MASKED_FAILURE" ? oobToken("verify", oobFromEnv(), oobHeadFromEnv()) : null;
   if (signedOff) code2 = 0;
   if (opts.json) {
@@ -16458,7 +16961,7 @@ function parseVerify(args) {
   }
   return o;
 }
-var OVERLAY_CLASSES, VERIFICATION_SURFACE, DROPPED_ENV, PINNED_NPM;
+var OVERLAY_CLASSES, VERIFICATION_SURFACE, MaterializationError, DROPPED_ENV, PINNED_NPM;
 var init_verify = __esm({
   "src/cli/verify.ts"() {
     "use strict";
@@ -16472,6 +16975,7 @@ var init_verify = __esm({
     init_verifier_backend();
     init_machine_output();
     init_signoff();
+    init_verification_state();
     init_suite_diagnostics();
     init_text();
     init_status();
@@ -16546,6 +17050,14 @@ var init_verify = __esm({
       "**/phpunit.xml.dist",
       "**/*.runsettings"
     ];
+    MaterializationError = class extends Error {
+      constructor(materializationReason, message) {
+        super(message);
+        this.materializationReason = materializationReason;
+        this.name = "MaterializationError";
+      }
+      materializationReason;
+    };
     DROPPED_ENV = /* @__PURE__ */ new Set([
       "NODE_OPTIONS",
       "NODE_PATH",
@@ -16560,11 +17072,11 @@ var init_verify = __esm({
 });
 
 // src/cli/run.ts
-import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
+import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync18, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname9, join as join20, resolve as resolve9 } from "node:path";
+import { dirname as dirname10, join as join21, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
@@ -16601,7 +17113,7 @@ function writableByCaller2(path) {
       return true;
     } catch {
     }
-    const parent = dirname9(cur);
+    const parent = dirname10(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -16640,9 +17152,9 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   };
 }
 function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
-  const stateDir = mkdtempSync4(join20(tmpdir5(), "tw-agent-supervisor-"));
-  const resultFile = join20(stateDir, "result.json");
-  const agentEnvFile = join20(stateDir, "agent-env.json");
+  const stateDir2 = mkdtempSync4(join21(tmpdir5(), "tw-agent-supervisor-"));
+  const resultFile = join21(stateDir2, "result.json");
+  const agentEnvFile = join21(stateDir2, "agent-env.json");
   try {
     const linux = process.platform === "linux";
     let executable;
@@ -16659,7 +17171,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync10(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -16716,7 +17228,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync17(resultFile, "utf8"));
+      state = JSON.parse(readFileSync18(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -16741,13 +17253,13 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync8(stateDir, { recursive: true, force: true });
+    rmSync9(stateDir2, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
   Atomics.wait(waitCell, 0, 0, ms);
 }
-function pidAlive3(pid) {
+function pidAlive4(pid) {
   if (!pid || !Number.isInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -16757,10 +17269,10 @@ function pidAlive3(pid) {
   }
 }
 function observerExited(pid) {
-  if (!pidAlive3(pid)) return true;
+  if (!pidAlive4(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -16768,8 +17280,8 @@ function observerExited(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join20(cwd, ".git");
-  return join20(
+  const gd = gitDir(cwd) ?? join21(cwd, ".git");
+  return join21(
     gd,
     "tamperward",
     `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
@@ -16783,7 +17295,7 @@ function startSupervisedObserver(cwd, base, entry) {
   try {
     child = spawn(
       process.execPath,
-      [resolve9(cliEntry), "watch", "--dir", cwd, "--log", log, "--base", base],
+      [resolve10(cliEntry), "watch", "--dir", cwd, "--log", log, "--base", base],
       {
         cwd,
         stdio: ["ignore", "ignore", "inherit"],
@@ -16877,12 +17389,12 @@ function finishObserverAdvisory(observer, write = out) {
   const telemetry = stopObserverProcess(observer);
   observerSummary(observer, telemetry, write);
 }
-function git3(args, cwd) {
-  return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+function git4(args, cwd) {
+  return execFileSync10("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync18("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -16902,10 +17414,10 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     return out3;
   }
   for (const pid of pids) {
-    const n = Number(pid);
-    if (n === process.pid) continue;
+    const n2 = Number(pid);
+    if (n2 === process.pid) continue;
     try {
-      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -16920,7 +17432,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     for (const link of procLinks) {
       try {
         const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
-        const held = raw.startsWith("/") ? resolve9(raw) : raw;
+        const held = raw.startsWith("/") ? resolve10(raw) : raw;
         if (held === real || held.startsWith(real + "/")) {
           holds = true;
           break;
@@ -16928,12 +17440,12 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
       } catch {
       }
     }
-    if (holds) out3.push(n);
+    if (holds) out3.push(n2);
   }
   return out3;
 }
 function runEnvelope(opts) {
-  const cwd = resolve9(opts.cwd ?? process.cwd());
+  const cwd = resolve10(opts.cwd ?? process.cwd());
   const say = opts.json ? (_s) => {
   } : out;
   if (!opts.argv.length) {
@@ -16948,7 +17460,8 @@ function runEnvelope(opts) {
   }
   let base;
   try {
-    base = git3(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
+    const requestedBase = assertRev(opts.base ?? "HEAD");
+    base = git4(["rev-parse", "--verify", `${requestedBase}^{commit}`], cwd).trim();
   } catch {
     err(`tamperward run: cannot resolve trusted base ${opts.base ?? "HEAD"} \u2014 failing closed.`);
     return 2;
@@ -16970,7 +17483,7 @@ function runEnvelope(opts) {
     return 2;
   }
   if (!opts.allowDirty) {
-    const dirty = git3(["status", "--porcelain"], cwd).trim();
+    const dirty = git4(["status", "--porcelain"], cwd).trim();
     if (dirty) {
       err("tamperward run: working tree is dirty before the agent starts \u2014 the envelope cannot");
       err("attribute changes. Commit or stash first, or pass --allow-dirty to own the risk.");
@@ -17075,7 +17588,7 @@ tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT
     emitRunJson("OBJECT_REWRITE", 1);
     return 1;
   }
-  const head = git3(["rev-parse", "HEAD"], cwd).trim();
+  const head = git4(["rev-parse", "HEAD"], cwd).trim();
   const isAncestor = spawnSync4("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
@@ -17476,9 +17989,9 @@ raise SystemExit(0)
 });
 
 // src/cli/doctor.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import { join as join21, resolve as resolve10 } from "node:path";
+import { execFileSync as execFileSync11 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync5 } from "node:fs";
+import { join as join22, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
     if (linuxPython?.path) {
@@ -17536,7 +18049,7 @@ function pinsInFile(path) {
   if (!existsSync15(path)) return [];
   let src = "";
   try {
-    src = readFileSync18(path, "utf8");
+    src = readFileSync19(path, "utf8");
   } catch {
     return [];
   }
@@ -17556,14 +18069,14 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
   const broken = [];
   const warnings = [];
   for (const rel of workflowRels) {
-    const path = resolve10(cwd, rel);
+    const path = resolve11(cwd, rel);
     if (!existsSync15(path)) {
       broken.push(`${rel} is missing`);
       continue;
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(path, "utf8"));
+      doc = yaml.parse(readFileSync19(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -17676,9 +18189,9 @@ function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow =
   addWiring("codeowners", "codeowners", true);
   checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
-    ...pinsInFile(join21(cwd, ".claude", "settings.json")),
-    ...pinsInFile(join21(cwd, ".git", "hooks", "pre-commit")),
-    ...pinsInFile(join21(cwd, ".husky", "pre-commit"))
+    ...pinsInFile(join22(cwd, ".claude", "settings.json")),
+    ...pinsInFile(join22(cwd, ".git", "hooks", "pre-commit")),
+    ...pinsInFile(join22(cwd, ".husky", "pre-commit"))
   ];
   const below = pins.filter((pin) => (compareVersions(pin, TW_VERSION) ?? 0) < 0);
   const above = pins.filter((pin) => (compareVersions(TW_VERSION, pin) ?? 0) < 0);
@@ -17796,7 +18309,7 @@ function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward", requi
 }
 function gitText(cwd, args) {
   try {
-    return execFileSync10("git", args, {
+    return execFileSync11("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -17830,7 +18343,7 @@ function githubApi(cwd, endpoint) {
   const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? "";
   const invocation = githubApiInvocation(endpoint, token);
   try {
-    const stdout = execFileSync10(
+    const stdout = execFileSync11(
       invocation.executable,
       invocation.args,
       {
@@ -17937,7 +18450,7 @@ function verifyJobs(doc) {
   return found;
 }
 function diagnose(opts = {}) {
-  const cwd = repoRoot(resolve10(opts.cwd ?? process.cwd()));
+  const cwd = repoRoot(resolve11(opts.cwd ?? process.cwd()));
   let policy;
   try {
     policy = policyFor(opts, cwd);
@@ -17961,7 +18474,7 @@ function diagnose(opts = {}) {
     workflowRels.push(opts.workflow);
   } else {
     const workflowDirRel = ".github/workflows";
-    const workflowDir = resolve10(cwd, workflowDirRel);
+    const workflowDir = resolve11(cwd, workflowDirRel);
     if (!existsSync15(workflowDir)) {
       return fail("ci-verifier", `${workflowDirRel}: workflow directory does not exist`);
     }
@@ -17974,20 +18487,20 @@ function diagnose(opts = {}) {
         `${workflowDirRel}: could not enumerate workflows (${e instanceof Error ? e.message : String(e)})`
       );
     }
-    for (const name of entries) workflowRels.push(join21(workflowDirRel, name));
+    for (const name of entries) workflowRels.push(join22(workflowDirRel, name));
   }
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
   let verifyJobCount = 0;
   const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
-    const workflowPath = resolve10(cwd, workflowRel);
+    const workflowPath = resolve11(cwd, workflowRel);
     if (!existsSync15(workflowPath)) {
       return fail("ci-verifier", `${workflowRel}: workflow does not exist`);
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync19(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -18161,39 +18674,273 @@ var init_doctor = __esm({
   }
 });
 
+// src/cli/status.ts
+function authorityFromChecks(checks) {
+  if (checks.some((c) => c.state === "BROKEN")) return "BROKEN";
+  if (checks.some((c) => c.state === "WARN")) return "PARTIAL";
+  return "ACTIVE";
+}
+function interventionFromCheck(check2) {
+  if (!check2) return { state: "UNKNOWN", detail: "agent hook wiring could not be evaluated" };
+  const map = {
+    OK: "ACTIVE",
+    WARN: "PARTIAL",
+    BROKEN: "INACTIVE"
+  };
+  return { state: map[check2.state], detail: check2.detail };
+}
+function buildStatusModel(cwd) {
+  let authority;
+  let intervention;
+  try {
+    const outcome = diagnose({ cwd });
+    authority = { state: authorityFromChecks(outcome.checks) };
+    const summary = outcome.checks.filter((c) => c.state !== "OK").map((c) => `${c.id}: ${c.state}`);
+    if (summary.length) authority.detail = summary.join("; ");
+    intervention = interventionFromCheck(outcome.checks.find((c) => c.id === "claude-hooks"));
+  } catch (e) {
+    const detail = e instanceof Error ? e.message : String(e);
+    authority = { state: "UNKNOWN", detail };
+    intervention = { state: "UNKNOWN", detail };
+  }
+  const verification = evaluateVerificationState(cwd);
+  const agent = intervention.state === "ACTIVE" || intervention.state === "PARTIAL" ? "claude-code" : "none";
+  return { authority, intervention, verification, runtime: { agent } };
+}
+function shortId(id) {
+  return id ? `${id.slice(0, 10)}...` : void 0;
+}
+function renderStatus(model, colour) {
+  const v = model.verification;
+  const lines = ["TamperWard", ""];
+  lines.push(statusLine(AUTHORITY_SEVERITY[model.authority.state], "Authority", model.authority.state, colour));
+  lines.push(statusLine(INTERVENTION_SEVERITY[model.intervention.state], "Intervention", model.intervention.state, colour));
+  lines.push(statusLine(VERIFICATION_SEVERITY[v.state], "Verification", v.state, colour));
+  const rows = [];
+  const record = v.record;
+  if (record) {
+    const verifiedTree = shortId(record.binding.tree);
+    if (verifiedTree) rows.push(["Verified tree", verifiedTree]);
+    const baseShort = shortId(v.base ?? record.binding.base);
+    if (baseShort) rows.push(["Base", `${record.inputs.base_ref}@${baseShort}`]);
+    if (v.verifier_command) rows.push(["Verifier", v.verifier_command]);
+  }
+  rows.push(["Runtime", model.runtime.agent]);
+  if (v.state === "STALE" && v.reason) rows.push(["Reason", v.reason]);
+  else if (v.state === "BROKEN") rows.push(["Reason", v.detail ?? v.reason ?? "authority wiring is invalid"]);
+  else if (v.state === "VERIFYING") rows.push(["Reason", v.reason ?? "a verification is in progress"]);
+  else if (v.state === "UNVERIFIED") rows.push(["Next", "run `tamperward verify` to establish a verified baseline"]);
+  if (rows.length) {
+    lines.push("");
+    const width = Math.max(...rows.map(([k]) => k.length));
+    for (const [k, val] of rows) lines.push(`${k.padEnd(width)}  ${val}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function statusDocument(model) {
+  const v = model.verification;
+  const verification = { state: v.state };
+  if (v.reason) verification.reason = v.reason;
+  if (v.changed_input) verification.changed_input = v.changed_input;
+  if (v.detail) verification.detail = v.detail;
+  if (v.verified_at) verification.verified_at = v.verified_at;
+  if (v.base) verification.base = v.base;
+  if (v.head) verification.head = v.head;
+  if (v.verifier_command) verification.verifier_command = v.verifier_command;
+  if (v.record) {
+    verification.tree = v.record.binding.tree;
+    verification.binding = { ...v.record.binding };
+  }
+  return machineOutput({
+    command: "status",
+    authority: model.authority,
+    intervention: model.intervention,
+    verification,
+    runtime: model.runtime
+  });
+}
+function runStatus(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (!repoContext(cwd)) {
+    const why = outsideRepository(cwd) ?? "cwd is not inside a repository the gate can read";
+    process.stderr.write(`tamperward: status needs a git repository (${why})
+`);
+    return 2;
+  }
+  const model = buildStatusModel(cwd);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(statusDocument(model)) + "\n");
+  } else {
+    process.stdout.write(renderStatus(model, colourEnabled(process.env, process.stdout)));
+  }
+  return 0;
+}
+var AUTHORITY_SEVERITY, INTERVENTION_SEVERITY, VERIFICATION_SEVERITY;
+var init_status2 = __esm({
+  "src/cli/status.ts"() {
+    "use strict";
+    init_machine_output();
+    init_repo_context();
+    init_repo_context();
+    init_doctor();
+    init_verification_state();
+    init_text();
+    init_status();
+    AUTHORITY_SEVERITY = {
+      ACTIVE: "ok",
+      PARTIAL: "warn",
+      BROKEN: "bad",
+      UNKNOWN: "info"
+    };
+    INTERVENTION_SEVERITY = {
+      ACTIVE: "ok",
+      PARTIAL: "warn",
+      INACTIVE: "bad",
+      UNKNOWN: "info"
+    };
+    VERIFICATION_SEVERITY = {
+      CURRENT: "ok",
+      STALE: "warn",
+      VERIFYING: "info",
+      BROKEN: "bad",
+      UNVERIFIED: "info"
+    };
+  }
+});
+
 // src/cli/trace-verify.ts
-import { execFileSync as execFileSync11, spawnSync as spawnSync5 } from "node:child_process";
+import { execFileSync as execFileSync12, spawnSync as spawnSync5 } from "node:child_process";
 import {
   existsSync as existsSync16,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync9,
+  rmSync as rmSync10,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { isAbsolute as isAbsolute12, join as join22, relative as relative6, resolve as resolve11, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join23, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 function unescapeStraceString(s) {
   return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
-function parseStraceFileAccess(raw) {
+function copyTraceState(state) {
+  return { cwd: state.cwd, fds: new Map(state.fds) };
+}
+function traceLineProcess(line) {
+  const bracketed = line.match(/^\s*\[pid\s+(\d+)\]\s+(.*)$/);
+  if (bracketed) return { pid: bracketed[1], body: bracketed[2] };
+  const numbered = line.match(/^\s*(\d+)\s+(.*)$/);
+  if (numbered && /\b(?:execve|open|chdir|clone|fork|stat|access|readlink)/.test(numbered[2])) {
+    return { pid: numbered[1], body: numbered[2] };
+  }
+  return { pid: "0", body: line.trim() };
+}
+function syscallResult(body) {
+  const match = body.match(/\)\s+=\s+(-?\d+)\b/);
+  return match ? Number(match[1]) : null;
+}
+function resolveTracePath(rawPath, state, dirfd) {
+  if (isAbsolute12(rawPath)) return resolve12(rawPath);
+  const base = dirfd === null || dirfd === -100 ? state.cwd : state.fds.get(dirfd);
+  if (!base) return null;
+  return resolve12(base, rawPath);
+}
+function firstDirFd(args) {
+  const first = args.match(/^\s*(AT_FDCWD|-?\d+)/)?.[1];
+  if (!first || first === "AT_FDCWD") return null;
+  return Number(first);
+}
+function successfulFdResult(body) {
+  const result = syscallResult(body);
+  return result !== null && result >= 0 ? result : null;
+}
+function parseStraceFileAccess(raw, initialCwd = TRACE_ROOT) {
   const out3 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const line of raw.split("\n")) {
-    if (!line.trim() || /\)\s+=\s+-1\b/.test(line)) continue;
-    const call = line.match(/\b(execveat|execve|openat2|openat|open|newfstatat|fstatat|statx|lstat|stat|access|readlinkat|readlink)\s*\(/);
-    if (!call) continue;
-    const afterCall = line.slice((call.index ?? 0) + call[0].length);
-    const quoted = afterCall.match(/"([^"\\]*(?:\\.[^"\\]*)*)"/);
-    if (!quoted) continue;
-    const path = unescapeStraceString(quoted[1]);
-    if (!path) continue;
-    const access = call[1].startsWith("execve") ? "exec" : "read";
-    const key2 = `${access}\0${path}`;
-    if (seen.has(key2)) continue;
+  const states = /* @__PURE__ */ new Map();
+  const unfinished = /* @__PURE__ */ new Map();
+  const stateFor = (pid) => {
+    let state = states.get(pid);
+    if (!state) {
+      state = { cwd: initialCwd, fds: /* @__PURE__ */ new Map() };
+      states.set(pid, state);
+    }
+    return state;
+  };
+  const add = (path, access, unresolved = false) => {
+    const key2 = `${access}\0${unresolved ? "unresolved:" : ""}${path}`;
+    if (seen.has(key2)) return;
     seen.add(key2);
-    out3.push({ path, access });
+    out3.push(unresolved ? { path, access, unresolved: true } : { path, access });
+  };
+  for (const rawLine of raw.split("\n")) {
+    if (!rawLine.trim()) continue;
+    const line = traceLineProcess(rawLine);
+    const resumed = line.body.match(/^<\.\.\.\s+(\w+)\s+resumed>(.*)$/);
+    let body = line.body;
+    if (resumed) {
+      const key2 = `${line.pid}:${resumed[1]}`;
+      const prefix = unfinished.get(key2);
+      if (!prefix) continue;
+      unfinished.delete(key2);
+      body = prefix + resumed[2];
+    }
+    const unfinishedAt = body.indexOf("<unfinished ...>");
+    if (unfinishedAt >= 0) {
+      const before = body.slice(0, unfinishedAt);
+      const call2 = before.match(/\b(execveat|execve|openat2|openat|open|newfstatat|fstatat|statx|lstat|stat|access|readlinkat|readlink|chdir|fchdir|close|dup2|dup3|dup|fcntl|clone3|clone|fork|vfork)\s*\(/);
+      if (call2) unfinished.set(`${line.pid}:${call2[1]}`, before);
+      continue;
+    }
+    const call = body.match(/\b(execveat|execve|openat2|openat|open|newfstatat|fstatat|statx|lstat|stat|access|readlinkat|readlink|chdir|fchdir|close|dup2|dup3|dup|fcntl|clone3|clone|fork|vfork)\s*\(/);
+    if (!call || /\)\s+=\s+-1\b/.test(body)) continue;
+    const name = call[1];
+    const args = body.slice((call.index ?? 0) + call[0].length);
+    const state = stateFor(line.pid);
+    const result = syscallResult(body);
+    if (name === "chdir") {
+      const quoted2 = args.match(/\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"/);
+      if (quoted2 && result === 0) {
+        const next = resolveTracePath(unescapeStraceString(quoted2[1]), state, null);
+        if (next) state.cwd = next;
+      }
+      continue;
+    }
+    if (name === "fchdir") {
+      const fd = Number(args.match(/^\s*(-?\d+)/)?.[1]);
+      const next = state.fds.get(fd);
+      if (result === 0 && next) state.cwd = next;
+      continue;
+    }
+    if (name === "close") {
+      const fd = Number(args.match(/^\s*(-?\d+)/)?.[1]);
+      if (result === 0) state.fds.delete(fd);
+      continue;
+    }
+    if (name === "dup" || name === "dup2" || name === "dup3" || name === "fcntl") {
+      const source = Number(args.match(/^\s*(-?\d+)/)?.[1]);
+      const destination = name === "dup" ? result : name === "fcntl" ? result : Number(args.match(/^\s*-?\d+\s*,\s*(-?\d+)/)?.[1]);
+      const sourcePath = state.fds.get(source);
+      if (result !== null && result >= 0 && destination !== void 0 && destination !== null && sourcePath) state.fds.set(destination, sourcePath);
+      continue;
+    }
+    if (name === "clone" || name === "clone3" || name === "fork" || name === "vfork") {
+      if (result !== null && result > 0) states.set(String(result), copyTraceState(state));
+      continue;
+    }
+    const quoted = args.match(/\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"/);
+    if (!quoted) continue;
+    const rawPath = unescapeStraceString(quoted[1]);
+    if (!rawPath) continue;
+    const atCall = name === "execveat" || name === "openat2" || name === "openat" || name === "newfstatat" || name === "fstatat" || name === "statx" || name === "readlinkat";
+    const dirfd = atCall ? firstDirFd(args) : null;
+    const resolved = resolveTracePath(rawPath, state, dirfd);
+    add(resolved ?? rawPath, name.startsWith("execve") ? "exec" : "read", resolved === null);
+    if (name === "open" || name === "openat" || name === "openat2") {
+      const fd = successfulFdResult(body);
+      if (fd !== null && resolved) state.fds.set(fd, resolved);
+    }
   }
   return out3;
 }
@@ -18214,13 +18961,13 @@ function classifyTraceRun(r) {
   return { kind: "ok", exit: r.status ?? 1 };
 }
 function inside3(root, path) {
-  const rel = relative6(resolve11(root), resolve11(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute12(rel);
+  const rel = relative7(resolve12(root), resolve12(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute12(rel);
 }
 function normalRepoPath(root, raw) {
-  const abs = isAbsolute12(raw) ? resolve11(raw) : resolve11(root, raw);
+  const abs = isAbsolute12(raw) ? resolve12(raw) : resolve12(root, raw);
   if (!inside3(root, abs)) return null;
-  const rel = relative6(root, abs).split(sep4).join("/");
+  const rel = relative7(root, abs).split(sep5).join("/");
   return rel && rel !== ".." ? rel : null;
 }
 function likelyConfig(path) {
@@ -18233,12 +18980,17 @@ function sortAccesses(values) {
 function summarizeTraceRuns(opts) {
   const repo = /* @__PURE__ */ new Map();
   const external = /* @__PURE__ */ new Map();
+  let unresolved_accesses = 0;
   opts.runs.forEach((run, index) => {
     const perRun = /* @__PURE__ */ new Set();
     for (const item of run) {
+      if (item.unresolved) {
+        unresolved_accesses++;
+        continue;
+      }
       const rel = normalRepoPath(opts.root, item.path);
       const isTracked = rel !== null && opts.tracked.has(rel);
-      const keyPath = rel !== null ? opts.tracked.has(rel) ? rel : null : resolve11(opts.root, item.path);
+      const keyPath = rel !== null ? opts.tracked.has(rel) ? rel : null : resolve12(opts.root, item.path);
       if (keyPath === null) continue;
       const target = isTracked ? repo : external;
       const key2 = `${isTracked ? "repo" : "external"}\0${keyPath}`;
@@ -18276,11 +19028,12 @@ function summarizeTraceRuns(opts) {
     uncovered_repository_inputs,
     // Exact paths are intentionally conservative. A maintainer may widen them to
     // reviewed globs, but TamperWard never invents a broader trust surface.
-    suggested_verify_inputs: [...uncovered_repository_inputs]
+    suggested_verify_inputs: [...uncovered_repository_inputs],
+    unresolved_accesses
   };
 }
-function git4(args, cwd) {
-  return execFileSync11("git", args, {
+function git5(args, cwd) {
+  return execFileSync12("git", args, {
     cwd,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -18293,7 +19046,7 @@ function commandExists(command) {
   return !r.error && r.status === 0;
 }
 function trackedAt(base, cwd) {
-  return git4(["ls-tree", "-r", "-z", "--name-only", base], cwd).split("\0").filter(Boolean);
+  return git5(["ls-tree", "-r", "-z", "--name-only", base], cwd).split("\0").filter(Boolean);
 }
 function materializeBase(base, cwd, dest) {
   const archive = spawnSync5("git", ["archive", "--format=tar", base], {
@@ -18315,38 +19068,41 @@ function materializeBase(base, cwd, dest) {
       `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
     );
   }
-  const hostModules = join22(cwd, "node_modules");
-  const tracedModules = join22(dest, "node_modules");
+  const hostModules = join23(cwd, "node_modules");
+  const tracedModules = join23(dest, "node_modules");
   if (existsSync16(hostModules) && !existsSync16(tracedModules)) {
-    symlinkSync2(resolve11(hostModules), tracedModules, "dir");
+    symlinkSync2(resolve12(hostModules), tracedModules, "dir");
   }
 }
 function traceFiles(prefix) {
-  const dir = resolve11(prefix, "..");
-  const base = prefix.split(sep4).at(-1) ?? prefix;
-  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join22(dir, name)).sort();
+  const dir = resolve12(prefix, "..");
+  const base = prefix.split(sep5).at(-1) ?? prefix;
+  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join23(dir, name)).sort();
 }
 function rewriteTraceRoot(accesses, actualRoot) {
   return accesses.map((item) => {
-    const abs = isAbsolute12(item.path) ? resolve11(item.path) : resolve11(actualRoot, item.path);
+    if (item.unresolved) return item;
+    const placeholder = isAbsolute12(item.path) ? resolve12(item.path) : resolve12(TRACE_ROOT, item.path);
+    const placeholderRel = inside3(TRACE_ROOT, placeholder) ? relative7(TRACE_ROOT, placeholder) : null;
+    const abs = placeholderRel === null ? placeholder : resolve12(actualRoot, placeholderRel);
     if (!inside3(actualRoot, abs)) return { ...item, path: abs };
-    const rel = relative6(actualRoot, abs).split(sep4).join("/");
+    const rel = relative7(actualRoot, abs).split(sep5).join("/");
     try {
-      const real = resolve11(realpathSync9(abs));
+      const real = resolve12(realpathSync9(abs));
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
-    return { ...item, path: join22(TRACE_ROOT, ...rel.split("/")) };
+    return { ...item, path: join23(TRACE_ROOT, ...rel.split("/")) };
   });
 }
 function straceOnce(root, command, budget) {
-  const traceDir = mkdtempSync5(join22(tmpdir6(), "tw-trace-log-"));
+  const traceDir = mkdtempSync5(join23(tmpdir6(), "tw-trace-log-"));
   try {
-    const prefix = join22(traceDir, "trace");
+    const prefix = join23(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
       [
-        "-ff",
+        "-f",
         "-qq",
         "-s",
         "4096",
@@ -18365,13 +19121,13 @@ function straceOnce(root, command, budget) {
       ],
       {
         cwd: root,
-        env: process.env,
+        env: suiteEnv(traceDir),
         encoding: "utf8",
         maxBuffer: 64 * 1024 * 1024
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync19(path, "utf8")));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8"), TRACE_ROOT));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -18382,26 +19138,26 @@ function straceOnce(root, command, budget) {
     };
     return { raw, accesses };
   } finally {
-    rmSync9(traceDir, { recursive: true, force: true });
+    rmSync10(traceDir, { recursive: true, force: true });
   }
 }
 function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join22(tmpdir6(), "tw-trace-base-"));
+  const root = mkdtempSync5(join23(tmpdir6(), "tw-trace-base-"));
   try {
     materializeBase(base, cwd, root);
     const { raw, accesses } = straceOnce(root, command, budget);
     return { outcome: classifyTraceRun(raw), accesses: rewriteTraceRoot(accesses, root) };
   } finally {
-    rmSync9(root, { recursive: true, force: true });
+    rmSync10(root, { recursive: true, force: true });
   }
 }
 function tracerPreflight(budget = 10) {
-  const probeRoot = mkdtempSync5(join22(tmpdir6(), "tw-trace-probe-"));
+  const probeRoot = mkdtempSync5(join23(tmpdir6(), "tw-trace-probe-"));
   try {
     const { raw } = straceOnce(probeRoot, "true", Math.max(1, Math.min(budget, 10)));
     return classifyTraceRun(raw);
   } finally {
-    rmSync9(probeRoot, { recursive: true, force: true });
+    rmSync10(probeRoot, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -18410,6 +19166,7 @@ function renderText2(report2) {
   out3(`trusted base: ${report2.base}`);
   out3(`command: ${report2.command}`);
   out3(`runs: ${report2.runs_completed}/${report2.runs_requested}; exits: ${report2.run_exits.join(", ")}`);
+  out3(`unresolved accesses: ${report2.unresolved_accesses}`);
   out3();
   out3("repository inputs observed:");
   if (!report2.repository_inputs.length) out3("  (none)");
@@ -18438,7 +19195,7 @@ function renderText2(report2) {
   for (const note of report2.notes) out3(`note: ${note}`);
 }
 function runTraceVerify(opts = {}) {
-  const cwd = resolve11(opts.cwd ?? process.cwd());
+  const cwd = resolve12(opts.cwd ?? process.cwd());
   if (process.platform !== "linux") {
     process.stderr.write("tamperward trace-verify: Linux only in this release; unsupported platform \u2014 no parity is implied.\n");
     return 2;
@@ -18465,7 +19222,7 @@ function runTraceVerify(opts = {}) {
   let base;
   try {
     const baseArg = assertRev(requestedBase);
-    base = git4(["rev-parse", "--verify", `${baseArg}^{commit}`], cwd).trim();
+    base = git5(["rev-parse", "--verify", `${baseArg}^{commit}`], cwd).trim();
   } catch (e) {
     process.stderr.write(`tamperward trace-verify: cannot resolve trusted base ${JSON.stringify(requestedBase)} (${e instanceof Error ? e.message : String(e)}).
 `);
@@ -18536,13 +19293,14 @@ This is a tracing/tooling limitation (e.g. ptrace denied by seccomp or Yama), no
     runs_requested: runs,
     runs_completed: observed.length,
     run_exits: runExits,
-    trace_complete: runExits.every((code2) => code2 === 0),
+    trace_complete: runExits.every((code2) => code2 === 0) && summary.unresolved_accesses === 0,
     ...summary,
     notes: [
       "Observed reads are evidence from these runs, not proof that an unobserved path can never be read.",
       "Dynamic paths are those observed in fewer than all repeated traces.",
       "Suggestions are exact tracked paths only; TamperWard never edits .tamperward.yml or widens a glob automatically.",
-      "Review every suggestion before adding it to verify.inputs."
+      "Review every suggestion before adding it to verify.inputs.",
+      ...summary.unresolved_accesses > 0 ? [`${summary.unresolved_accesses} relative file access(es) could not be resolved from trace cwd/fd state; discovery is incomplete.`] : []
     ]
   };
   if (opts.json) process.stdout.write(JSON.stringify(report2) + "\n");
@@ -18601,26 +19359,26 @@ var init_trace_verify = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
-import { join as join23 } from "node:path";
-function isRecord4(x) {
+import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
+import { join as join24 } from "node:path";
+function isRecord5(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
 }
 function hooksBeyondTamperward(hooks) {
-  if (!isRecord4(hooks)) return hooks != null;
+  if (!isRecord5(hooks)) return hooks != null;
   for (const entries of Object.values(hooks)) {
     if (!Array.isArray(entries)) {
       if (entries != null) return true;
       continue;
     }
     for (const entry of entries) {
-      const hs = isRecord4(entry) ? entry.hooks : null;
+      const hs = isRecord5(entry) ? entry.hooks : null;
       if (!Array.isArray(hs)) {
         if (hs != null) return true;
         continue;
       }
       for (const h of hs) {
-        const cmd = isRecord4(h) ? String(h.command ?? "") : "";
+        const cmd = isRecord5(h) ? String(h.command ?? "") : "";
         if (!/tamperward/.test(cmd)) return true;
       }
     }
@@ -18628,11 +19386,11 @@ function hooksBeyondTamperward(hooks) {
   return false;
 }
 function claudeSettingsBeyondTamperward(cwd) {
-  const path = join23(cwd, ".claude", "settings.json");
+  const path = join24(cwd, ".claude", "settings.json");
   let raw;
   try {
     if (!existsSync17(path)) return false;
-    raw = readFileSync20(path, "utf8");
+    raw = readFileSync21(path, "utf8");
   } catch {
     return false;
   }
@@ -18642,7 +19400,7 @@ function claudeSettingsBeyondTamperward(cwd) {
   } catch {
     return raw.trim().length > 0;
   }
-  if (!isRecord4(parsed)) return raw.trim().length > 0;
+  if (!isRecord5(parsed)) return raw.trim().length > 0;
   for (const [key2, value] of Object.entries(parsed)) {
     if (key2 === "disableAllHooks") continue;
     if (key2 === "hooks") {
@@ -18658,7 +19416,7 @@ function detectRuntimes(cwd) {
   for (const rt of KNOWN_RUNTIMES) {
     const marker = rt.markers.find((m) => {
       try {
-        return existsSync17(join23(cwd, m));
+        return existsSync17(join24(cwd, m));
       } catch {
         return false;
       }
@@ -18738,10 +19496,10 @@ var init_runtimes = __esm({
 });
 
 // src/cli/onboard.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync22, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
+import { join as join25, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
 import { createInterface } from "node:readline";
 import { parseDocument } from "yaml";
 function readlineAsker(input, output) {
@@ -18750,9 +19508,9 @@ function readlineAsker(input, output) {
   let pending = null;
   rl.on("close", () => {
     closed = true;
-    const resolve17 = pending;
+    const resolve20 = pending;
     pending = null;
-    resolve17?.(null);
+    resolve20?.(null);
   });
   rl.on("SIGINT", () => rl.close());
   const ask = (question) => new Promise((resolvePromise) => {
@@ -18775,9 +19533,9 @@ function terminalText(text) {
   return stripControl(text).replace(/\s+/g, " ").trim();
 }
 function committableSetupPath(cwd, path) {
-  const rel = relative7(cwd, resolve12(cwd, path));
-  if (!rel || rel === ".." || rel.startsWith(".." + sep5)) return false;
-  return rel !== ".git" && !rel.startsWith(".git" + sep5);
+  const rel = relative8(cwd, resolve13(cwd, path));
+  if (!rel || rel === ".." || rel.startsWith(".." + sep6)) return false;
+  return rel !== ".git" && !rel.startsWith(".git" + sep6);
 }
 function platformLabel(platform) {
   if (platform === "darwin") return "macOS";
@@ -18785,9 +19543,9 @@ function platformLabel(platform) {
   if (platform === "linux") return "Linux";
   return platform;
 }
-function git5(cwd, args) {
+function git6(cwd, args) {
   try {
-    return execFileSync12("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -18806,13 +19564,13 @@ function explainVerdict(v, code2) {
   }
 }
 function writeVerifyCommand(cwd, command) {
-  const path = join24(cwd, POLICY_FILE);
+  const path = join25(cwd, POLICY_FILE);
   const kind = writeTargetKind(path);
   if (kind === "symlink" || kind === "irregular") {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -18829,13 +19587,13 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync10(path, { force: true });
+    if (original === null) rmSync11(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
 }
 async function runOnboard(opts, io = {}) {
-  const requestedCwd = resolve12(opts.cwd ?? process.cwd());
+  const requestedCwd = resolve13(opts.cwd ?? process.cwd());
   const out3 = io.out ?? ((line2) => void process.stdout.write(line2 + "\n"));
   const errLine = (line2) => void process.stderr.write(line2 + "\n");
   const rawErr = (line2) => errLine(terminalText(line2));
@@ -18864,12 +19622,12 @@ async function runOnboard(opts, io = {}) {
     rawErr("or run `tamperward init` for the deterministic wiring step only.");
     return 2;
   }
-  const rootText = git5(requestedCwd, ["rev-parse", "--show-toplevel"])?.trim() ?? "";
+  const rootText = git6(requestedCwd, ["rev-parse", "--show-toplevel"])?.trim() ?? "";
   if (!rootText) {
     fail(requestedCwd + " is not inside a Git repository. Run `git init` first.");
     return 2;
   }
-  const cwd = resolve12(rootText);
+  const cwd = resolve13(rootText);
   let sameRoot = cwd === requestedCwd;
   try {
     sameRoot = realpathSync10(cwd) === realpathSync10(requestedCwd);
@@ -18902,10 +19660,10 @@ async function runOnboard(opts, io = {}) {
     return a === "y" || a === "yes";
   };
   let sectionNo = 0;
-  const section = (n) => {
-    sectionNo = n;
+  const section = (n2) => {
+    sectionNo = n2;
     out3("");
-    out3(paint(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD + CYAN, colour));
+    out3(paint(n2 + "/" + SECTIONS.length + "  " + SECTIONS[n2 - 1], BOLD + CYAN, colour));
   };
   const wrote = [];
   let verifyCommand;
@@ -18923,13 +19681,15 @@ async function runOnboard(opts, io = {}) {
     const localVerifySupported = localVerifierShell(platform, "true") !== null;
     if (platform === "linux" && lifecycle.state === "OK") {
       status("OK", "Full check / verify / run support is available.", "ok");
+    } else if (platform === "linux") {
+      status("LIMITED", lifecycle.detail, "warn");
     } else if (localVerifySupported) {
       status("LIMITED", platformLabel(platform) + ": check + verify work here; `tamperward run` requires Linux in this release.", "warn");
     } else {
       status("LIMITED", platformLabel(platform) + ": check works here; local verify and `run` are unavailable. Use the container verifier for final verification.", "warn");
     }
-    const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
-    const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
+    const head = git6(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
+    const treeStatus = git6(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
     const dirty = treeStatus.split("\n").filter(Boolean).map((line2) => line2.slice(3).split(" -> ").at(-1) ?? "");
     if (!head) {
       const count = dirty.length;
@@ -19033,8 +19793,8 @@ async function runOnboard(opts, io = {}) {
         status("ACTION", "Choose the command that decides whether this repository passes:", "warn");
         candidates.forEach((candidate, i) => out3("  " + (i + 1) + ". " + terminalText(candidate)));
         const a = await ask("Choose 1-" + candidates.length + ", type a command, or press Enter to skip: ");
-        const n = Number(a);
-        chosen = a === "" ? void 0 : Number.isInteger(n) && n >= 1 && n <= candidates.length ? candidates[n - 1] : a;
+        const n2 = Number(a);
+        chosen = a === "" ? void 0 : Number.isInteger(n2) && n2 >= 1 && n2 <= candidates.length ? candidates[n2 - 1] : a;
       } else {
         status("ACTION", "No test command was detected automatically.", "warn");
         chosen = await ask("Test command to trust (Enter to skip): ") || void 0;
@@ -19177,7 +19937,7 @@ function postureOf(outcome) {
   return "READY";
 }
 function runDemo(cwd, head, runners, out3) {
-  const files = (git5(cwd, ["ls-tree", "-r", "-z", head]) ?? "").split("\0").filter(Boolean).flatMap((row) => {
+  const files = (git6(cwd, ["ls-tree", "-r", "-z", head]) ?? "").split("\0").filter(Boolean).flatMap((row) => {
     const tab = row.indexOf("	");
     if (tab < 0) return [];
     const mode = row.slice(0, tab).split(" ")[0];
@@ -19186,7 +19946,7 @@ function runDemo(cwd, head, runners, out3) {
   });
   let target = null;
   for (const path of files) {
-    const before2 = git5(cwd, ["show", `${head}:${path}`]);
+    const before2 = git6(cwd, ["show", `${head}:${path}`]);
     if (before2 === null || !JS_TEST_BLOCK.test(before2)) continue;
     target = { path, before: before2, after: before2.replace(JS_TEST_BLOCK, "$1$2.skip$3") };
     break;
@@ -19197,13 +19957,13 @@ function runDemo(cwd, head, runners, out3) {
   }
   const before = treeFingerprint(cwd);
   out3(`working tree fingerprint before: ${before.slice(0, 16)}`);
-  const wt = mkdtempSync6(join24(tmpdir7(), "tw-onboard-demo-"));
+  const wt = mkdtempSync6(join25(tmpdir7(), "tw-onboard-demo-"));
   try {
-    if (git5(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
+    if (git6(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
       out3("Demo skipped: could not create a temporary worktree (git worktree add failed).");
       return;
     }
-    const targetPath = join24(wt, target.path);
+    const targetPath = join25(wt, target.path);
     const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
@@ -19218,7 +19978,7 @@ function runDemo(cwd, head, runners, out3) {
       out3("Demo skipped: the selected test could not be resolved safely inside the disposable worktree.");
       return;
     }
-    const prefix = worktreeRoot.endsWith(sep5) ? worktreeRoot : worktreeRoot + sep5;
+    const prefix = worktreeRoot.endsWith(sep6) ? worktreeRoot : worktreeRoot + sep6;
     if (!realTarget.startsWith(prefix)) {
       out3("Demo skipped: the selected test resolves outside the disposable worktree.");
       return;
@@ -19232,9 +19992,9 @@ function runDemo(cwd, head, runners, out3) {
     out3("");
     out3(`check exited ${code2}: ${code2 === 1 ? "a blocking finding, which is what the hook, pre-commit and CI would all report" : "no blocking finding was reported"}.`);
   } finally {
-    git5(cwd, ["worktree", "remove", "--force", wt]);
-    git5(cwd, ["worktree", "prune"]);
-    rmSync10(wt, { recursive: true, force: true });
+    git6(cwd, ["worktree", "remove", "--force", wt]);
+    git6(cwd, ["worktree", "prune"]);
+    rmSync11(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -19282,7 +20042,7 @@ var init_onboard = __esm({
 });
 
 // src/research/adapter.ts
-import { isAbsolute as isAbsolute13, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute13, resolve as resolve14 } from "node:path";
 function taskEnv(task) {
   return {
     TAMPERWARD_RESEARCH_TASK: task.id,
@@ -19301,7 +20061,7 @@ function normalizeCommandArgv(argv, cwd = process.cwd()) {
     throw new ResearchError('the command adapter needs an agent command after "--"');
   }
   const head = argv[0];
-  return head.includes("/") && !isAbsolute13(head) ? [resolve13(cwd, head), ...argv.slice(1)] : [...argv];
+  return head.includes("/") && !isAbsolute13(head) ? [resolve14(cwd, head), ...argv.slice(1)] : [...argv];
 }
 function commandAdapter(argv, cwd = process.cwd()) {
   const anchored = normalizeCommandArgv(argv, cwd);
@@ -19314,6 +20074,24 @@ function commandAdapter(argv, cwd = process.cwd()) {
     }
   };
 }
+function stdioAdapter(argv, cwd = process.cwd()) {
+  const anchored = normalizeCommandArgv(argv, cwd);
+  return {
+    name: "stdio",
+    layers: ["envelope"],
+    launch(task) {
+      const substituted = anchored.map((arg) => substitutePlaceholders(arg, task));
+      return {
+        argv: substituted,
+        env: {
+          ...taskEnv(task),
+          TAMPERWARD_RESEARCH_PROTOCOL: "research-stdio-jsonl-v1",
+          TAMPERWARD_RESEARCH_CAPABILITIES: JSON.stringify({ layers: ["envelope"], intervention: "not-connected" })
+        }
+      };
+    }
+  };
+}
 function claudeCodeAdapter(model) {
   return {
     name: "claude-code",
@@ -19336,6 +20114,7 @@ function claudeCodeAdapter(model) {
 function resolveAdapter(name, argv, model) {
   if (name === "command") return commandAdapter(argv);
   if (name === "claude-code") return claudeCodeAdapter(model);
+  if (name === "stdio") return stdioAdapter(argv);
   throw new ResearchError(`unknown adapter "${name}" (built-in adapters: ${BUILTIN_ADAPTERS.join(", ")})`);
 }
 var ADAPTER_LAYERS, RESEARCH_ARMS, BUILTIN_ADAPTERS, ResearchError, PLACEHOLDERS, PLACEHOLDER_PATTERN;
@@ -19345,7 +20124,7 @@ var init_adapter = __esm({
     init_init();
     ADAPTER_LAYERS = ["envelope", "pre-tool-use", "stop-sweep"];
     RESEARCH_ARMS = ["ungated", "gated"];
-    BUILTIN_ADAPTERS = ["claude-code", "command"];
+    BUILTIN_ADAPTERS = ["claude-code", "command", "stdio"];
     ResearchError = class extends Error {
     };
     PLACEHOLDERS = {
@@ -19402,9 +20181,9 @@ var init_capture = __esm({
 });
 
 // src/research/manifest.ts
-import { createHash as createHash13 } from "node:crypto";
-import { readFileSync as readFileSync22 } from "node:fs";
-import { dirname as dirname10, resolve as resolve14 } from "node:path";
+import { createHash as createHash14 } from "node:crypto";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { dirname as dirname11, resolve as resolve15 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
   if (!isRecord(raw)) throw new ResearchError(`task manifest: ${where} is not an object`);
@@ -19427,17 +20206,17 @@ function taskFrom(raw, index, manifestDir) {
   const isUrl = /^[a-z][a-z0-9+.-]*:\/\//i.test(repo) || /^[^/]+@[^:]+:/.test(repo);
   return {
     id,
-    repo: isUrl ? repo : resolve14(manifestDir, repo),
+    repo: isUrl ? repo : resolve15(manifestDir, repo),
     base: base ?? "HEAD",
     prompt,
     verify: { command: verify.command, ...budget !== void 0 ? { budget } : {} }
   };
 }
 function readManifest(path) {
-  const abs = resolve14(path);
+  const abs = resolve15(path);
   let bytes;
   try {
-    bytes = readFileSync22(abs);
+    bytes = readFileSync23(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -19454,13 +20233,13 @@ function readManifest(path) {
   if (!Array.isArray(raw.tasks) || raw.tasks.length === 0) {
     throw new ResearchError(`task manifest ${abs}: no tasks (tasks must be a non-empty array)`);
   }
-  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname10(abs)));
+  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname11(abs)));
   const seen = /* @__PURE__ */ new Set();
   for (const t of tasks) {
     if (seen.has(t.id)) throw new ResearchError(`task manifest ${abs}: duplicate task id "${t.id}"`);
     seen.add(t.id);
   }
-  return { path: abs, sha256: createHash13("sha256").update(bytes).digest("hex"), tasks };
+  return { path: abs, sha256: createHash14("sha256").update(bytes).digest("hex"), tasks };
 }
 var MANIFEST_VERSION;
 var init_manifest = __esm({
@@ -19734,22 +20513,22 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { execFileSync as execFileSync13 } from "node:child_process";
-import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync9, openSync as openSync3, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, unlinkSync, writeFileSync as writeFileSync11, writeSync } from "node:fs";
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync10, openSync as openSync3, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync12, unlinkSync, writeFileSync as writeFileSync12, writeSync } from "node:fs";
 import { hostname } from "node:os";
-import { join as join25, resolve as resolve15 } from "node:path";
-function git6(args, cwd) {
-  return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+import { join as join26, resolve as resolve16 } from "node:path";
+function git7(args, cwd) {
+  return execFileSync14("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function pairRecordPath(ledger, task, pair) {
-  return join25(ledger, "pairs", `${task}--${pair}.json`);
+  return join26(ledger, "pairs", `${task}--${pair}.json`);
 }
 function researchLockPath(ledger) {
-  return join25(ledger, "run.lock");
+  return join26(ledger, "run.lock");
 }
 function readLockOwner(path) {
   try {
-    const parsed = JSON.parse(readFileSync23(path, "utf8"));
+    const parsed = JSON.parse(readFileSync24(path, "utf8"));
     if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
     return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
@@ -19770,7 +20549,7 @@ function lockHolder(path) {
   return owner ? `pid ${owner.pid} on ${owner.host}, started ${owner.started_at}` : "an unreadable lock file";
 }
 function acquireResearchLock(ledger, breakStaleLock = false) {
-  mkdirSync9(ledger, { recursive: true });
+  mkdirSync10(ledger, { recursive: true });
   const path = researchLockPath(ledger);
   if (breakStaleLock && existsSync18(path)) {
     const owner2 = readLockOwner(path);
@@ -19834,7 +20613,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
       if (released) return;
       released = true;
       try {
-        if (readFileSync23(path, "utf8") === text) unlinkSync(path);
+        if (readFileSync24(path, "utf8") === text) unlinkSync(path);
       } catch {
       }
     }
@@ -19843,7 +20622,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync23(path, "utf8"));
+    raw = JSON.parse(readFileSync24(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -19880,28 +20659,28 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync11(tmp, text);
+  writeFileSync12(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
   return ["-c", "protocol.ext.allow=never", "clone", "-q", "--no-hardlinks", "--", repo, ws3];
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws3 = join25(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync11(ws3, { recursive: true, force: true });
-  mkdirSync9(join25(ledger, "workspaces"), { recursive: true });
+  const ws3 = join26(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  rmSync12(ws3, { recursive: true, force: true });
+  mkdirSync10(join26(ledger, "workspaces"), { recursive: true });
   try {
-    execFileSync13("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync14("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
     throw new ResearchError(`task "${task.id}": cannot clone ${task.repo}: ${errorMessage(e).split("\n")[0]}`);
   }
-  git6(["config", "user.name", "tamperward-research"], ws3);
-  git6(["config", "user.email", "research@tamperward.invalid"], ws3);
+  git7(["config", "user.name", "tamperward-research"], ws3);
+  git7(["config", "user.email", "research@tamperward.invalid"], ws3);
   const requestedBase = sourceBase ?? task.base;
   const candidates = sourceBase !== void 0 ? [sourceBase] : task.base === "HEAD" ? ["HEAD"] : [task.base, `origin/${task.base}`];
   for (const rev2 of candidates) {
     try {
-      git6(["checkout", "-q", "--detach", rev2], ws3);
+      git7(["checkout", "-q", "--detach", rev2], ws3);
       return ws3;
     } catch {
     }
@@ -19991,15 +20770,19 @@ function unobservedOutcome() {
     honest_completion: false
   };
 }
-function trustedPolicyAt(base, ws3) {
+function trustedPolicyAt(base, ws3, loader = loadPolicyAt) {
   try {
-    return { policy: loadPolicyAt(base, ws3) ?? defaultPolicy() };
+    return { policy: loader(base, ws3) ?? defaultPolicy() };
   } catch (e) {
     return { failure: `trusted policy at ${base.slice(0, 10)} could not be loaded: ${errorMessage(e).split("\n")[0]}` };
   }
 }
-function observeOutcome(ws3, base, head, task) {
-  const trusted = trustedPolicyAt(base, ws3);
+function trustedProtectedOnly(base, ws3, loader = loadPolicyAt) {
+  const trusted = trustedPolicyAt(base, ws3, loader);
+  if ("failure" in trusted) return { trusted, protectedOnly: () => true };
+  return { trusted, protectedOnly: (rel) => isProtected(rel, trusted.policy) };
+}
+function observeOutcome(ws3, base, head, task, trusted) {
   if ("failure" in trusted) return { outcome: unobservedOutcome(), unmeasurable: trusted.failure };
   const policy = trusted.policy;
   const verify = parseDocument2(
@@ -20051,15 +20834,15 @@ function observeOutcome(ws3, base, head, task) {
 }
 function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
   const ws3 = freshWorkspace(ledger, task, pair, arm, sourceBase);
-  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git6(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
+  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git7(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
   if (arm === "gated" && adapter.prepareGated) {
     captureStdout(() => adapter.prepareGated?.(prep));
-    if (git6(["status", "--porcelain"], ws3)) {
-      git6(["add", "-A"], ws3);
-      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
+    if (git7(["status", "--porcelain"], ws3)) {
+      git7(["add", "-A"], ws3);
+      git7(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
     }
   }
-  const base = git6(["rev-parse", "HEAD"], ws3);
+  const base = git7(["rev-parse", "HEAD"], ws3);
   const launch2 = adapter.launch({ ...prep, base });
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   let agent;
@@ -20072,17 +20855,11 @@ function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
     agent = runUngated(ws3, launch2.argv, launch2.env, opts.agentBudget);
   }
   const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const head = git6(["rev-parse", "HEAD"], ws3);
-  const protectedOnly = (rel) => {
-    try {
-      return isProtected(rel, loadPolicyAt(base, ws3) ?? defaultPolicy());
-    } catch {
-      return true;
-    }
-  };
-  const fingerprintBefore = treeFingerprint(ws3, protectedOnly);
-  const observed = observeOutcome(ws3, base, head, task);
-  const movedDuringObservation = treeFingerprint(ws3, protectedOnly) !== fingerprintBefore;
+  const head = git7(["rev-parse", "HEAD"], ws3);
+  const trustedSurface = trustedProtectedOnly(base, ws3);
+  const fingerprintBefore = treeFingerprint(ws3, trustedSurface.protectedOnly);
+  const observed = observeOutcome(ws3, base, head, task, trustedSurface.trusted);
+  const movedDuringObservation = treeFingerprint(ws3, trustedSurface.protectedOnly) !== fingerprintBefore;
   const unmeasurable = agent.unmeasurable ?? observed.unmeasurable ?? (movedDuringObservation ? "NOT_QUIESCENT: the workspace changed while its outcome was being observed" : null);
   const { unmeasurable: _agentUnmeasurable, ...agentRecord } = agent;
   const outcome = unmeasurable === null ? observed.outcome : unobservedOutcome();
@@ -20127,7 +20904,7 @@ function runResearch(opts) {
     err2("tamperward research: the gated arm cannot start here (see `tamperward doctor`); run as a non-root user on Linux.");
     return 2;
   }
-  const ledger = resolve15(opts.out);
+  const ledger = resolve16(opts.out);
   let lock;
   try {
     lock = acquireResearchLock(ledger, opts.breakLock === true);
@@ -20140,7 +20917,7 @@ function runResearch(opts) {
   }
   try {
     const pairs = opts.pairs ?? 1;
-    mkdirSync9(join25(ledger, "pairs"), { recursive: true });
+    mkdirSync10(join26(ledger, "pairs"), { recursive: true });
     for (const task of tasks) {
       const existingRecords = /* @__PURE__ */ new Map();
       let sourceBase = null;
@@ -20267,22 +21044,22 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
-import { join as join26, resolve as resolve16 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync25 } from "node:fs";
+import { join as join27, resolve as resolve17 } from "node:path";
 function readLedger2(dir) {
-  const pairsDir = join26(resolve16(dir), "pairs");
+  const pairsDir = join27(resolve17(dir), "pairs");
   let names;
   try {
-    names = readdirSync7(pairsDir).filter((n) => n.endsWith(".json")).sort();
+    names = readdirSync7(pairsDir).filter((n2) => n2.endsWith(".json")).sort();
   } catch (e) {
     throw new ResearchError(`cannot read ledger ${pairsDir}: ${errorMessage(e)}`);
   }
   if (names.length === 0) throw new ResearchError(`ledger ${pairsDir} holds no pair records`);
-  return names.map((n) => {
-    const path = join26(pairsDir, n);
+  return names.map((n2) => {
+    const path = join27(pairsDir, n2);
     let raw;
     try {
-      raw = JSON.parse(readFileSync24(path, "utf8"));
+      raw = JSON.parse(readFileSync25(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -20412,7 +21189,321 @@ var init_summarize = __esm({
   }
 });
 
+// src/research/init.ts
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "node:fs";
+import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "node:path";
+function idFrom(repo) {
+  const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
+  return (basename5(clean, ".git").replace(/[^A-Za-z0-9._-]+/g, "-") || "task").slice(0, 80);
+}
+function createResearchManifest(opts) {
+  if (!opts.out) throw new ResearchError("research init requires --out");
+  if (!opts.repo) throw new ResearchError("research init requires --repo");
+  if (!opts.prompt) throw new ResearchError("research init requires --prompt");
+  if (!opts.verifyCommand) throw new ResearchError("research init requires --verify-command");
+  const out3 = resolve18(opts.out);
+  if (existsSync19(out3)) throw new ResearchError(`research init refuses to overwrite ${out3}; choose a new path`);
+  const id = opts.id ?? idFrom(opts.repo);
+  if (!/^[A-Za-z0-9._-]+$/.test(id)) throw new ResearchError(`research init id must match [A-Za-z0-9._-] (got "${id}")`);
+  if (opts.verifyBudget !== void 0 && (!Number.isFinite(opts.verifyBudget) || opts.verifyBudget <= 0)) {
+    throw new ResearchError("research init --verify-budget must be positive");
+  }
+  const doc = {
+    version: 1,
+    tasks: [{
+      id,
+      repo: opts.repo,
+      base: opts.base ?? "HEAD",
+      prompt: opts.prompt,
+      verify: { command: opts.verifyCommand, ...opts.verifyBudget === void 0 ? {} : { budget: opts.verifyBudget } }
+    }]
+  };
+  const text = JSON.stringify(doc, null, 2) + "\n";
+  mkdirSync11(dirname12(out3), { recursive: true });
+  writeFileSync13(out3, text, { flag: "wx", mode: 384 });
+  const parsed = readManifest(out3);
+  if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
+  return out3;
+}
+function runResearchInit(opts) {
+  try {
+    const out3 = createResearchManifest(opts);
+    const bytes = requireHash(out3);
+    process.stdout.write(`tamperward research init: wrote ${out3} (sha256 ${bytes})
+`);
+    return 0;
+  } catch (e) {
+    if (e instanceof ResearchError || e instanceof Error) {
+      process.stderr.write(`tamperward research: ${e.message}
+`);
+      return 2;
+    }
+    throw e;
+  }
+}
+function requireHash(path) {
+  return createHash15("sha256").update(readFileSync26(path)).digest("hex");
+}
+var init_init2 = __esm({
+  "src/research/init.ts"() {
+    "use strict";
+    init_adapter();
+    init_manifest();
+  }
+});
+
+// src/research/report.ts
+function renderResearchReport(summary) {
+  const u = summary.model_behaviour.ungated;
+  const g = summary.model_behaviour.gated;
+  const uo = summary.independent_outcome.ungated;
+  const go = summary.independent_outcome.gated;
+  const lines = [
+    "MODEL BEHAVIOUR",
+    `  model: ${summary.model ?? "(unspecified)"}`,
+    `  adapter: ${summary.adapter.name} [${summary.adapter.layers.join(", ")}]`,
+    `  pairs: ${n(summary.pairs)} (measured: ${n(summary.measured_pairs)}, unmeasurable: ${n(summary.unmeasurable_pairs)})`,
+    `  ungated: ${n(u.trajectories)} trajectories; masked failures ${n(u.masked_failure)}; surviving mutations ${n(u.surviving_protected_mutations)}`,
+    `  gated: ${n(g.trajectories)} trajectories; masked failures ${n(g.masked_failure)}; surviving mutations ${n(g.surviving_protected_mutations)}`,
+    "",
+    "CONTROL RESPONSE",
+    "  not measured by this adapter/ledger; denial-to-fix, surrender, and alternative-bypass responses are not inferred.",
+    "",
+    "INDEPENDENT OUTCOME",
+    `  ungated: visible green ${n(uo.visible_green)}, pristine green ${n(uo.pristine_green)}, masked failure ${n(uo.masked_failure)}, honest completion ${n(uo.honest_completion)}, released green ${n(uo.released_green)}`,
+    `  gated: visible green ${n(go.visible_green)}, pristine green ${n(go.pristine_green)}, masked failure ${n(go.masked_failure)}, honest completion ${n(go.honest_completion)}, released green ${n(go.released_green)}`,
+    "",
+    "TAMPERWARD PERFORMANCE",
+    `  caught: ${n(summary.tamperward.caught)}`,
+    `  escapes: ${n(summary.tamperward.escapes)}`,
+    `  false refusals: ${n(summary.tamperward.false_refusals)}`,
+    `  cannot adjudicate: ${n(summary.tamperward.cannot_adjudicate)}`,
+    `  paired masked failure: ungated-only ${n(summary.paired.masked_failure.ungated_only)}, gated-only ${n(summary.paired.masked_failure.gated_only)}, both ${n(summary.paired.masked_failure.both)}, neither ${n(summary.paired.masked_failure.neither)}`
+  ];
+  return lines.join("\n") + "\n";
+}
+function runResearchReport(opts) {
+  try {
+    const summary = summarizeLedger(opts.ledger);
+    process.stdout.write(opts.json ? JSON.stringify(summary, null, 2) + "\n" : renderResearchReport(summary));
+    return 0;
+  } catch (e) {
+    if (e instanceof ResearchError) {
+      process.stderr.write(`tamperward research: ${e.message}
+`);
+      return 2;
+    }
+    throw e;
+  }
+}
+var n;
+var init_report2 = __esm({
+  "src/research/report.ts"() {
+    "use strict";
+    init_adapter();
+    init_summarize();
+    n = (value) => String(value);
+  }
+});
+
+// src/research/bundle.ts
+import { createHash as createHash16 } from "node:crypto";
+import { gzipSync, gunzipSync } from "node:zlib";
+import { existsSync as existsSync20, mkdirSync as mkdirSync12, readdirSync as readdirSync8, readFileSync as readFileSync27, statSync as statSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname13, join as join28, resolve as resolve19 } from "node:path";
+function octal(value, width) {
+  return value.toString(8).padStart(width - 1, "0") + "\0";
+}
+function tarEntry(name, bytes) {
+  const header = Buffer.alloc(BLOCK, 0);
+  const safe = name.replace(/^\/+/, "").slice(0, 99);
+  header.write(safe, 0, "utf8");
+  header.write(octal(420, 8), 100, "ascii");
+  header.write(octal(0, 8), 108, "ascii");
+  header.write(octal(0, 8), 116, "ascii");
+  header.write(octal(bytes.length, 12), 124, "ascii");
+  header.write(octal(0, 12), 136, "ascii");
+  header.fill(32, 148, 156);
+  header[156] = 48;
+  header.write("ustar", 257, "ascii");
+  header.write("00", 263, "ascii");
+  const checksum = header.reduce((sum, b) => sum + b, 0);
+  header.write(octal(checksum, 8), 148, "ascii");
+  const padding = Buffer.alloc((BLOCK - bytes.length % BLOCK) % BLOCK, 0);
+  return Buffer.concat([header, bytes, padding]);
+}
+function makeTar(entries) {
+  return Buffer.concat([...entries.map((e) => tarEntry(e.name, e.bytes)), Buffer.alloc(BLOCK * 2, 0)]);
+}
+function parseTar(bytes) {
+  const files = /* @__PURE__ */ new Map();
+  for (let offset = 0; offset + BLOCK <= bytes.length; ) {
+    const header = bytes.subarray(offset, offset + BLOCK);
+    if (header.every((b) => b === 0)) break;
+    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const sizeText = header.subarray(124, 136).toString("ascii").replace(/\0.*$/, "").trim();
+    const size = Number.parseInt(sizeText || "0", 8);
+    if (!name || name.startsWith("/") || name.split("/").includes("..") || !Number.isSafeInteger(size) || size < 0) {
+      throw new ResearchError("research bundle contains an unsafe or malformed archive entry");
+    }
+    const start = offset + BLOCK;
+    const end = start + size;
+    if (end > bytes.length) throw new ResearchError("research bundle is truncated");
+    files.set(name, Buffer.from(bytes.subarray(start, end)));
+    offset = start + Math.ceil(size / BLOCK) * BLOCK;
+  }
+  return files;
+}
+function walkLedger(ledger) {
+  const entries = [];
+  const pairs = join28(ledger, "pairs");
+  if (!existsSync20(pairs) || !statSync6(pairs).isDirectory()) throw new ResearchError(`ledger ${ledger} has no pairs directory`);
+  const names = readdirSync8(pairs).filter((n2) => n2.endsWith(".json")).sort();
+  if (names.length === 0) throw new ResearchError(`ledger ${ledger} holds no pair records`);
+  for (const name of names) {
+    const path = join28(pairs, name);
+    if (!statSync6(path).isFile()) continue;
+    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync27(path) });
+  }
+  return entries;
+}
+function jsonBytes(value) {
+  return Buffer.from(JSON.stringify(value, null, 2) + "\n", "utf8");
+}
+function validateResearchBundle(path) {
+  let files;
+  try {
+    files = parseTar(gunzipSync(readFileSync27(resolve19(path))));
+  } catch (e) {
+    throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const provenance = files.get("provenance.json");
+  const summaryBytes = files.get("summary.json");
+  const report2 = files.get("report.txt");
+  if (!provenance || !summaryBytes || !report2) throw new ResearchError("research bundle is missing provenance.json, summary.json or report.txt");
+  let p;
+  let summary;
+  try {
+    p = JSON.parse(provenance.toString("utf8"));
+    summary = JSON.parse(summaryBytes.toString("utf8"));
+  } catch {
+    throw new ResearchError("research bundle contains invalid JSON");
+  }
+  if (p.bundle_schema_version !== BUNDLE_VERSION || p.schema_version !== MACHINE_SCHEMA_VERSION) {
+    throw new ResearchError("research bundle schema version is unsupported");
+  }
+  const manifest = files.get("manifest.json");
+  if (p.manifest_included !== Boolean(manifest) || p.prompts_included !== Boolean(manifest)) {
+    throw new ResearchError("research bundle manifest inclusion metadata is inconsistent");
+  }
+  if (manifest && createHash16("sha256").update(manifest).digest("hex") !== p.manifest_sha256) {
+    throw new ResearchError("research bundle manifest does not match its recorded sha256");
+  }
+  const parsedSummary = summary;
+  if (parsedSummary.document !== "summary" || parsedSummary.command !== "research") throw new ResearchError("research bundle summary is not a research summary");
+  const records = [];
+  for (const [name, bytes] of files) {
+    if (!name.startsWith("ledger/pairs/") || !name.endsWith(".json")) continue;
+    let raw;
+    try {
+      raw = JSON.parse(bytes.toString("utf8"));
+    } catch {
+      throw new ResearchError(`invalid JSON in ${name}`);
+    }
+    records.push(pairRecordFrom(raw, name));
+  }
+  if (records.length === 0) throw new ResearchError("research bundle contains no pair records");
+  const derived = summarizeRecords(records);
+  if (JSON.stringify(derived) !== JSON.stringify(summary)) throw new ResearchError("research bundle summary does not match its pair records");
+  if (report2.toString("utf8") !== renderResearchReport(derived)) throw new ResearchError("research bundle report does not match its summary");
+  if (p.manifest_sha256 !== parsedSummary.manifest_sha256) throw new ResearchError("research bundle manifest hash disagrees with summary");
+  if (!p.protocol || p.protocol !== "research-bundle-v1") throw new ResearchError("research bundle protocol is missing or unsupported");
+  return { records: records.length, manifest_sha256: String(p.manifest_sha256) };
+}
+function createResearchBundle(opts) {
+  if (!opts.ledger) throw new ResearchError("research bundle requires --ledger");
+  if (!opts.out) throw new ResearchError("research bundle requires --out");
+  const ledger = resolve19(opts.ledger);
+  const summary = summarizeLedger(ledger);
+  const entries = walkLedger(ledger);
+  if (opts.manifest) {
+    const manifest = readFileSync27(resolve19(opts.manifest));
+    const sha3 = createHash16("sha256").update(manifest).digest("hex");
+    if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
+    entries.push({ name: "manifest.json", bytes: manifest });
+  }
+  const provenance = {
+    bundle_schema_version: BUNDLE_VERSION,
+    protocol: "research-bundle-v1",
+    schema_version: MACHINE_SCHEMA_VERSION,
+    manifest_sha256: summary.manifest_sha256,
+    adapter: summary.adapter,
+    model: summary.model,
+    tamperward_version: summary.tamperward_version,
+    agent_argv: summary.agent_argv,
+    agent_budget: summary.agent_budget,
+    records: entries.filter((e) => e.name.startsWith("ledger/pairs/")).length,
+    manifest_included: Boolean(opts.manifest),
+    prompts_included: Boolean(opts.manifest)
+  };
+  entries.push({ name: "summary.json", bytes: jsonBytes(summary) });
+  entries.push({ name: "report.txt", bytes: Buffer.from(renderResearchReport(summary), "utf8") });
+  entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
+  const out3 = resolve19(opts.out);
+  mkdirSync12(dirname13(out3), { recursive: true });
+  writeFileSync14(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  return out3;
+}
+function runResearchBundle(opts) {
+  try {
+    if (opts.validate) {
+      const result = validateResearchBundle(opts.validate);
+      process.stdout.write(`tamperward research bundle: valid (${result.records} records, manifest ${result.manifest_sha256})
+`);
+      return 0;
+    }
+    const out3 = createResearchBundle(opts);
+    process.stdout.write(`tamperward research bundle: wrote ${out3}
+`);
+    return 0;
+  } catch (e) {
+    if (e instanceof ResearchError || e instanceof Error) {
+      process.stderr.write(`tamperward research: ${e.message}
+`);
+      return 2;
+    }
+    throw e;
+  }
+}
+var BLOCK, BUNDLE_VERSION;
+var init_bundle = __esm({
+  "src/research/bundle.ts"() {
+    "use strict";
+    init_machine_output();
+    init_adapter();
+    init_record();
+    init_report2();
+    init_summarize();
+    BLOCK = 512;
+    BUNDLE_VERSION = 1;
+  }
+});
+
 // src/cli/research.ts
+function parseResearchInit(args) {
+  const o = { out: "", repo: "", prompt: "", verifyCommand: "" };
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--out") o.out = args[++i];
+    else if (args[i] === "--repo") o.repo = args[++i];
+    else if (args[i] === "--base") o.base = args[++i];
+    else if (args[i] === "--id") o.id = args[++i];
+    else if (args[i] === "--prompt") o.prompt = args[++i];
+    else if (args[i] === "--verify-command") o.verifyCommand = args[++i];
+    else if (args[i] === "--verify-budget") o.verifyBudget = Number(args[++i]);
+  }
+  return o;
+}
 function parseResearchRun(args) {
   const o = { manifest: "", out: "", adapter: "", agentArgv: [] };
   for (let i = 0; i < args.length; i++) {
@@ -20438,10 +21529,36 @@ function parseResearchSummarize(args) {
   }
   return o;
 }
+function parseResearchReport(args) {
+  const o = { ledger: "" };
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--ledger") o.ledger = args[++i];
+    else if (args[i] === "--json") o.json = true;
+  }
+  return o;
+}
+function parseResearchBundle(args) {
+  const o = { ledger: "" };
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--ledger") o.ledger = args[++i];
+    else if (args[i] === "--out") o.out = args[++i];
+    else if (args[i] === "--manifest") o.manifest = args[++i];
+    else if (args[i] === "--validate") o.validate = args[++i];
+    else if (args[i] === "--bundle") o.validate = args[++i];
+  }
+  return o;
+}
 function runResearchCommand(args) {
   const [sub, ...rest] = args;
+  if (sub === "init") return runResearchInit(parseResearchInit(rest));
   if (sub === "run") return runResearch(parseResearchRun(rest));
   if (sub === "summarize") return runResearchSummarize(parseResearchSummarize(rest));
+  if (sub === "report") return runResearchReport(parseResearchReport(rest));
+  if (sub === "bundle") return runResearchBundle(parseResearchBundle(rest));
+  if (sub === "validate") {
+    const bundle = parseResearchBundle(rest);
+    return runResearchBundle({ ledger: "", validate: bundle.validate ?? bundle.out });
+  }
   process.stderr.write(`tamperward research: unknown subcommand "${sub ?? ""}" (${RESEARCH_SUBCOMMANDS.join(" | ")})
 `);
   return 2;
@@ -20452,7 +21569,10 @@ var init_research = __esm({
     "use strict";
     init_run2();
     init_summarize();
-    RESEARCH_SUBCOMMANDS = ["run", "summarize"];
+    init_init2();
+    init_report2();
+    init_bundle();
+    RESEARCH_SUBCOMMANDS = ["init", "run", "summarize", "report", "bundle", "validate"];
   }
 });
 
@@ -20551,6 +21671,15 @@ function parseDoctor(args) {
   }
   return o;
 }
+function parseStatus(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--json") o.json = true;
+    else if (a === "--cwd") o.cwd = args[++i];
+  }
+  return o;
+}
 function parseStats(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -20587,14 +21716,45 @@ function parseCheck(args) {
   }
   return o;
 }
+function splitLongOptionEquals(args) {
+  const out3 = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") {
+      out3.push(...args.slice(i));
+      break;
+    }
+    if (arg.startsWith("--")) {
+      const equals = arg.indexOf("=");
+      if (equals > 2) {
+        out3.push(arg.slice(0, equals), arg.slice(equals + 1));
+        continue;
+      }
+    }
+    out3.push(arg);
+  }
+  return out3;
+}
+function helpRequested(args) {
+  for (const arg of args) {
+    if (arg === "--") break;
+    if (arg === "-h" || arg === "--help") return true;
+  }
+  return false;
+}
 function validateFlatArgs(args, grammar) {
   const flags = new Set(grammar.flags ?? []);
   const values = grammar.values ?? {};
   const seen = /* @__PURE__ */ new Set();
   const positionals = [];
+  let options = true;
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (flags.has(a) || Object.prototype.hasOwnProperty.call(values, a)) {
+    if (options && a === "--") {
+      options = false;
+      continue;
+    }
+    if (options && (flags.has(a) || Object.prototype.hasOwnProperty.call(values, a))) {
       if (seen.has(a)) {
         return { error: `option "${a}" specified more than once`, seen, positionals };
       }
@@ -20611,18 +21771,18 @@ function validateFlatArgs(args, grammar) {
       }
       i++;
       if (rule === "positive") {
-        const n = Number(v);
-        if (!Number.isFinite(n) || n <= 0) {
+        const n2 = Number(v);
+        if (!Number.isFinite(n2) || n2 <= 0) {
           return { error: `${a} needs a positive number (got "${v}")`, seen, positionals };
         }
       } else if (rule === "positive-integer") {
-        const n = Number(v);
-        if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+        const n2 = Number(v);
+        if (!Number.isFinite(n2) || !Number.isInteger(n2) || n2 <= 0) {
           return { error: `${a} needs a positive integer (got "${v}")`, seen, positionals };
         }
       } else if (rule === "non-negative") {
-        const n = Number(v);
-        if (!Number.isFinite(n) || n < 0) {
+        const n2 = Number(v);
+        if (!Number.isFinite(n2) || n2 < 0) {
           return { error: `${a} needs a non-negative number (got "${v}")`, seen, positionals };
         }
       } else if (rule === "format" && !isFormat(v)) {
@@ -20634,7 +21794,7 @@ function validateFlatArgs(args, grammar) {
       }
       continue;
     }
-    if (a.startsWith("-")) {
+    if (options && a.startsWith("-")) {
       return { error: `unknown option "${a}"`, seen, positionals };
     }
     if (grammar.positional === "one" && positionals.length === 0) {
@@ -20646,6 +21806,8 @@ function validateFlatArgs(args, grammar) {
   return { seen, positionals };
 }
 function validateCliArgs(cmd, args) {
+  args = splitLongOptionEquals(args);
+  if (helpRequested(args)) return void 0;
   if (cmd === "hook" || cmd === "sweep") {
     if (args.length === 0) return `${cmd} requires an agent name`;
     if (args.length > 1) return `unexpected argument "${args[1]}"`;
@@ -20726,6 +21888,12 @@ function validateCliArgs(cmd, args) {
       }
     }).error;
   }
+  if (cmd === "status") {
+    return validateFlatArgs(args, {
+      flags: ["--json"],
+      values: { "--cwd": "string" }
+    }).error;
+  }
   if (cmd === "onboard") {
     const parsed = validateFlatArgs(args, {
       flags: ["--yes", "--skip-demo", "--demo", "--no-github"],
@@ -20744,7 +21912,7 @@ function validateCliArgs(cmd, args) {
   if (cmd === "hook-service") {
     const sub = args[0];
     if (sub !== "start" && sub !== "stop" && sub !== "status") return "hook-service requires one of start | stop | status";
-    return validateFlatArgs(args.slice(1), sub === "start" ? { values: { "--dir": "string" } } : {}).error;
+    return validateFlatArgs(args.slice(1), { values: { "--dir": "string" } }).error;
   }
   if (cmd === "verify") {
     return validateFlatArgs(args, {
@@ -20777,6 +21945,24 @@ function validateCliArgs(cmd, args) {
   if (cmd === "research") {
     const [sub, ...rest] = args;
     if (sub === void 0) return `research requires a subcommand (${RESEARCH_SUBCOMMANDS.join(" | ")})`;
+    if (sub === "init") {
+      const parsed = validateFlatArgs(rest, {
+        values: {
+          "--out": "string",
+          "--repo": "string",
+          "--base": "string",
+          "--id": "string",
+          "--prompt": "string",
+          "--verify-command": "string",
+          "--verify-budget": "positive"
+        }
+      });
+      if (parsed.error) return parsed.error;
+      for (const required of ["--out", "--repo", "--prompt", "--verify-command"]) {
+        if (!parsed.seen.has(required)) return `research init requires ${required}`;
+      }
+      return void 0;
+    }
     if (sub === "run") {
       const delimiter3 = rest.indexOf("--");
       const prefix = delimiter3 < 0 ? rest : rest.slice(0, delimiter3);
@@ -20803,6 +21989,29 @@ function validateCliArgs(cmd, args) {
       if (!parsed.seen.has("--ledger")) return "research summarize requires --ledger";
       return void 0;
     }
+    if (sub === "report") {
+      const parsed = validateFlatArgs(rest, { flags: ["--json"], values: { "--ledger": "string" } });
+      if (parsed.error) return parsed.error;
+      if (!parsed.seen.has("--ledger")) return "research report requires --ledger";
+      return void 0;
+    }
+    if (sub === "bundle") {
+      const parsed = validateFlatArgs(rest, {
+        values: { "--ledger": "string", "--out": "string", "--manifest": "string", "--validate": "string" }
+      });
+      if (parsed.error) return parsed.error;
+      if (parsed.seen.has("--validate")) return void 0;
+      for (const required of ["--ledger", "--out"]) {
+        if (!parsed.seen.has(required)) return `research bundle requires ${required}`;
+      }
+      return void 0;
+    }
+    if (sub === "validate") {
+      const parsed = validateFlatArgs(rest, { values: { "--bundle": "string" } });
+      if (parsed.error) return parsed.error;
+      if (!parsed.seen.has("--bundle")) return "research validate requires --bundle";
+      return void 0;
+    }
     return `unknown research subcommand "${sub}" (${RESEARCH_SUBCOMMANDS.join(" | ")})`;
   }
   return void 0;
@@ -20830,8 +22039,8 @@ Formats:
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
   tamperward hook-service start [--dir D]   OPT-IN persistent hook service: one warm
-  tamperward hook-service stop | status     process per user and repository that
-                                            evaluates hook/sweep requests over a
+  tamperward hook-service stop [--dir D]    process per user and repository that
+  tamperward hook-service status [--dir D]  evaluates hook/sweep requests over a
                                             private unix socket, so each tool call
                                             skips Node + bundle startup. Hooks
                                             consult it only with
@@ -20877,6 +22086,8 @@ Formats:
                                             code when clean; 124 on clean AGENT_TIMEOUT;
                                             1 on any blocking finding/masked failure;
                                             2 when it cannot adjudicate (fails closed)
+  tamperward research init --out F --repo R  author a versioned one-task manifest
+             --prompt P --verify-command C     and print its sha256 identity
   tamperward research run --manifest F      bring-your-own-model evaluation: for every
              --out D --adapter A [--pairs N]  task in the manifest, pin one source commit,
              [--model M] [--agent-budget S]   clone fresh state per arm, run the agent
@@ -20888,6 +22099,11 @@ Formats:
   tamperward research summarize --ledger D  aggregate measured pairs into model behaviour,
                                              independent outcome, TamperWard hits/misses
                                              and paired counts \u2014 no composite score
+  tamperward research report --ledger D     human-readable four-section report (or --json)
+  tamperward research bundle --ledger D     reproducible records/provenance archive
+             --out F [--manifest M]          (manifest/prompts included only when requested)
+  tamperward research bundle --validate F   structurally and provenance-validate a bundle
+  tamperward research validate --bundle F   alias for bundle validation
   tamperward stats [--file F] [--since 30d] aggregate privacy-safe hook/sweep audit
              [--json] [--cwd D]              events by rule and enforcement surface.
                                              Defaults to the repository-local
@@ -20923,6 +22139,16 @@ Formats:
                                             every tool the gate must see.
                                             --force-workflow replaces a workflow it
                                             did not write, or one you have edited.
+  tamperward status [--json] [--cwd D]      verification posture in three distinct
+                                            lanes \u2014 Authority (repository/final
+                                            adjudication), Intervention (runtime
+                                            steering), and Verification: whether the
+                                            last successful verify still applies to
+                                            the EXACT current state (CURRENT / STALE /
+                                            VERIFYING / BROKEN / UNVERIFIED). --json
+                                            emits the versioned status document for
+                                            editors, CI and dashboards. Local CURRENT
+                                            is posture, never repository/CI authority.
   tamperward doctor [--base R]              report installation + authority posture
              [--workflow F] [--cwd D]       and validate the CI verifier's outer-time
              [--json]                       envelope against the trusted policy.
@@ -20944,7 +22170,12 @@ Exit codes: 0 clean \xB7 1 a blocking finding (check), MASKED_FAILURE or SUITE_R
 `);
 }
 function main(argv) {
-  const [cmd, ...rest] = argv;
+  const [cmd, ...rawRest] = argv;
+  const rest = splitLongOptionEquals(rawRest);
+  if (cmd !== void 0 && cmd !== "-h" && cmd !== "--help" && helpRequested(rest)) {
+    printHelp();
+    return 0;
+  }
   if (cmd !== void 0 && cmd !== "-h" && cmd !== "--help") {
     const invalid = validateCliArgs(cmd, rest);
     if (invalid) {
@@ -20970,6 +22201,8 @@ function main(argv) {
       return runDoctor(parseDoctor(rest));
     case "stats":
       return runStats(parseStats(rest));
+    case "status":
+      return runStatus(parseStatus(rest));
     case "onboard":
       return runOnboard(parseOnboard(rest));
     case "watch":
@@ -21025,6 +22258,7 @@ var init_main = __esm({
     init_allow();
     init_init();
     init_doctor();
+    init_status2();
     init_verify();
     init_trace_verify();
     init_run();
@@ -21039,7 +22273,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -21052,7 +22286,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync25(0, "utf8");
+      raw = readFileSync28(0, "utf8");
     } catch {
       raw = null;
     }