tamperward 2.34.0 → 2.37.0

package/dist/cli/index.js

@@ -79,6 +79,22 @@ function shippedVersion() {
   }
   return null;
 }
+function shippedCommit() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(here, rel), "utf8"));
+        if (isRecord(pkg) && pkg.name === "tamperward") {
+          return typeof pkg.gitHead === "string" && GIT_HEAD_RE.test(pkg.gitHead) ? pkg.gitHead : null;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function requireShippedVersion() {
   if (RESOLVED_TW_VERSION === null) {
     throw new Error(
@@ -137,7 +153,7 @@ function resolvesToClaudeSettings(path, env = process.env) {
   if (isClaudeSettings(path, env)) return true;
   return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
 }
-var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS;
+var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS;
 var init_wiring = __esm({
   "src/wiring.ts"() {
     "use strict";
@@ -145,6 +161,8 @@ var init_wiring = __esm({
     PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
     RESOLVED_TW_VERSION = shippedVersion();
     TW_VERSION = RESOLVED_TW_VERSION ?? "0.0.0-unresolved";
+    GIT_HEAD_RE = /^[0-9a-f]{7,40}$/i;
+    TW_COMMIT = shippedCommit();
     PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
     PRE_MATCHER = PRE_TOOLS.join("|");
     MARKER = "# tamperward: block agent shortcuts before they land";
@@ -211,7 +229,7 @@ function forwardedEnv(env) {
   return out3;
 }
 function exchange(paths, req2, timeoutMs) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve23) => {
     let done = false;
     let handedOff = false;
     let accepted = false;
@@ -222,7 +240,7 @@ function exchange(paths, req2, timeoutMs) {
       done = true;
       clearTimeout(timer);
       sock.destroy();
-      resolve20(value);
+      resolve23(value);
     };
     const sock = createConnection(paths.socket);
     const timer = setTimeout(() => finish(handedOff ? acceptedFailure("timeout") : null), timeoutMs);
@@ -5175,8 +5193,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve20) {
-  const obj = resolve20(expr);
+function metricsOf(expr, resolve23) {
+  const obj = resolve23(expr);
   if (!ts.isObjectLiteralExpression(obj)) return void 0;
   const out3 = { values: {}, opaque: false };
   let any = false;
@@ -5190,7 +5208,7 @@ function metricsOf(expr, resolve20) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n2 = numericOf(resolve20(p.initializer));
+    const n2 = numericOf(resolve23(p.initializer));
     if (n2 === void 0) out3.opaque = true;
     else out3.values[k] = n2;
   }
@@ -5237,17 +5255,17 @@ function parseThresholds(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve20 = resolverFor(sf);
+    const resolve23 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve20(node.initializer);
+          const init = resolve23(node.initializer);
           if (!ts.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve20);
+            const flat = metricsOf(init, resolve23);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts.isSpreadAssignment(p)) {
@@ -5261,7 +5279,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve20);
+              const m = metricsOf(p.initializer, resolve23);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -5295,18 +5313,18 @@ function parseLists(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve20 = resolverFor(sf);
+    const resolve23 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve20(node.initializer));
+          const { items, opaque } = literals(resolve23(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve20(node.initializer));
+          const { items, opaque } = literals(resolve23(node.initializer));
           (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -6976,10 +6994,10 @@ function lex(src) {
       i = j + 1;
       continue;
     }
-    const num2 = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
-    if (num2) {
-      out3.push({ t: "num", v: num2[0] });
-      i += num2[0].length;
+    const num3 = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
+    if (num3) {
+      out3.push({ t: "num", v: num3[0] });
+      i += num3[0].length;
       continue;
     }
     const op = src.slice(i).match(/^(?:==|!=|&&|\|\||<=|>=|[!()<>,[\]])/);
@@ -7004,13 +7022,13 @@ function foldConst(src) {
   let p = 0;
   const peek = () => toks[p];
   const eat = (v2) => toks[p]?.t === "op" && toks[p].v === v2 ? (p++, true) : false;
-  const num2 = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
+  const num3 = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
   const eq = (a, b) => {
     if (a === TRUTHY || b === TRUTHY) return void 0;
     if (typeof a === "string" && typeof b === "string") return a.toLowerCase() === b.toLowerCase();
     if (a === null && b === null) return true;
-    const x = num2(a);
-    const y2 = num2(b);
+    const x = num3(a);
+    const y2 = num3(b);
     return !Number.isNaN(x) && x === y2;
   };
   const or = () => {
@@ -7048,8 +7066,8 @@ function foldConst(src) {
         const e = eq(l, r);
         l = e === void 0 ? void 0 : t.v === "==" ? e : !e;
       } else {
-        const x = num2(l);
-        const y2 = num2(r);
+        const x = num3(l);
+        const y2 = num3(r);
         if (Number.isNaN(x) || Number.isNaN(y2)) l = void 0;
         else l = t.v === "<" ? x < y2 : t.v === ">" ? x > y2 : t.v === "<=" ? x <= y2 : x >= y2;
       }
@@ -10872,8 +10890,8 @@ import { dirname as dirname2, join as join9 } from "node:path";
 function compactOobToken(want, head) {
   const normalizedHead = head.trim().toLowerCase();
   if (!want || !FULL_OBJECT_ID.test(normalizedHead)) return null;
-  const digest = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
-  return `${COMPACT_OOB_PREFIX}${digest}`;
+  const digest2 = createHash3("sha256").update(`tamperward:oob:v1\0${want}\0${normalizedHead}`).digest("base64url");
+  return `${COMPACT_OOB_PREFIX}${digest2}`;
 }
 function ledgerEntryFrom(value) {
   if (!isRecord(value)) return null;
@@ -12308,10 +12326,10 @@ function parseAuditJsonl(raw) {
   return events;
 }
 function parseSince(value, nowMs = Date.now()) {
-  const relative9 = /^(\d+)(m|h|d)$/.exec(value);
-  if (relative9) {
-    const count = Number(relative9[1]);
-    const unit = relative9[2] === "m" ? 6e4 : relative9[2] === "h" ? 36e5 : 864e5;
+  const relative13 = /^(\d+)(m|h|d)$/.exec(value);
+  if (relative13) {
+    const count = Number(relative13[1]);
+    const unit = relative13[2] === "m" ? 6e4 : relative13[2] === "h" ? 36e5 : 864e5;
     if (!Number.isSafeInteger(count) || count <= 0) throw new Error(`invalid --since value "${value}"`);
     return nowMs - count * unit;
   }
@@ -13019,12 +13037,12 @@ function pidAlive2(pid) {
   }
 }
 function listening(socket) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve23) => {
     const sock = createConnection2(socket);
     const done = (v) => {
       clearTimeout(timer);
       sock.destroy();
-      resolve20(v);
+      resolve23(v);
     };
     const timer = setTimeout(() => done(false), 1e3);
     sock.once("connect", () => done(true));
@@ -13203,11 +13221,11 @@ async function startHookService(opts) {
   });
   const umask = process.umask(63);
   try {
-    await new Promise((resolve20, reject) => {
+    await new Promise((resolve23, reject) => {
       server.once("error", reject);
       server.listen(paths.socket, () => {
         server.off("error", reject);
-        resolve20();
+        resolve23();
       });
     });
   } finally {
@@ -13224,8 +13242,8 @@ async function startHookService(opts) {
     get served() {
       return served;
     },
-    close: () => new Promise((resolve20) => {
-      if (closed) return resolve20();
+    close: () => new Promise((resolve23) => {
+      if (closed) return resolve23();
       closed = true;
       setSnapshotCache(null);
       let settled = false;
@@ -13236,7 +13254,7 @@ async function startHookService(opts) {
         clearTimeout(drain);
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
-        resolve20();
+        resolve23();
       };
       server.close(finalize);
       for (const sock of sockets) if (sock !== acceptedSocket) sock.destroy();
@@ -14883,8 +14901,8 @@ function parseCapturedSupervisorResult(stdoutText) {
   };
 }
 function runCapturedProcessSync(executable, args, opts) {
-  const stateDir = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
-  const configFile = join17(stateDir, "config.json");
+  const stateDir2 = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
+  const configFile = join17(stateDir2, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
     writeFileSync8(
@@ -14932,7 +14950,7 @@ function runCapturedProcessSync(executable, args, opts) {
     }
     return parsed;
   } finally {
-    rmSync6(stateDir, { recursive: true, force: true });
+    rmSync6(stateDir2, { recursive: true, force: true });
   }
 }
 var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CLEANUP_HELPERS_SRC, CAPTURE_SUPERVISOR;
@@ -15651,12 +15669,375 @@ var init_verifier_backend = __esm({
   }
 });
 
-// src/cli/verify.ts
-import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
+// src/verification-state.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync16, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname8, join as join19 } from "node:path";
+function git2(args, cwd) {
+  return execFileSync8("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 1 << 28,
+    env: trustedGitEnv()
+  });
+}
+function resolveBaseRev(baseRef, cwd) {
+  assertRev(baseRef);
+  const rev2 = git2(["rev-parse", "--verify", `${baseRef}^{commit}`], cwd).trim();
+  try {
+    return git2(["merge-base", rev2, "HEAD"], cwd).trim();
+  } catch {
+    return rev2;
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function digest(value) {
+  return createHash12("sha256").update(canonicalJson(value)).digest("hex");
+}
+function surfacePaths(base, cwd, policy) {
+  let listing;
+  try {
+    listing = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd);
+  } catch {
+    return [];
+  }
+  const inputs = policy.verify?.inputs ?? [];
+  return listing.split("\0").filter(Boolean).filter((p) => isProtected(p, policy) || matchesAny(p, inputs)).sort();
+}
+function interventionWiring(cwd) {
+  const dir = claudeConfigDir();
+  const sources = [
+    ["repo", join19(cwd, ".claude", "settings.json")],
+    ["repo.local", join19(cwd, ".claude", "settings.local.json")],
+    ["user", join19(dir, "settings.json")],
+    ["user.local", join19(dir, "settings.local.json")]
+  ];
+  return sources.map(([source, path]) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync16(path, "utf8"));
+    } catch {
+      return { source, present: false };
+    }
+    if (!isRecord4(parsed)) return { source, present: true, shape: "non-object" };
+    return {
+      source,
+      present: true,
+      hooks: parsed.hooks ?? null,
+      disableAllHooks: parsed.disableAllHooks ?? null
+    };
+  });
+}
+function dependenciesBinding(root, policy, command) {
+  const backend = policy.verify?.backend ?? "local";
+  if (backend === "container") {
+    return digest({ backend, image: policy.verify?.image ?? null });
+  }
+  const dep = discoverDependencyEnvironment(root, command);
+  return digest({ backend, status: dep.status, fingerprint: dep.fingerprint ?? null });
+}
+function computeBinding(cwd, inputs, precomputed) {
+  const root = repoRoot(cwd);
+  const head = git2(["rev-parse", "--verify", "HEAD^{commit}"], root).trim();
+  const base = resolveBaseRev(inputs.base_ref, root);
+  const policy = inputs.explicit_base ? loadPolicyAt(base, root) ?? defaultPolicy() : loadPolicy(root);
+  const command = inputs.command_source === "flag" ? inputs.command : policy.verify?.command ?? "";
+  if (!command) {
+    throw new Error("no verifier command is configured for the recorded verification");
+  }
+  const budget = inputs.budget_source === "flag" ? inputs.budget : policy.verify?.budget ?? 300;
+  const protectedIgnored = (rel) => isProtected(rel, policy);
+  return {
+    // NOTE (#500/#600 follow-up): `tree` hashes every tracked and ignored-protected
+    // file and `dependencies` walks the attested dependency roots, on EVERY call.
+    // Right for `verify` (once per run) and reused there via `precomputed.tree`,
+    // but `status` is meant to be polled continuously by a status bar/dashboard,
+    // where a large repository makes each poll a full read. A stat-cache identity
+    // (git's index plus hashing only what changed) is a deliberate follow-up, not
+    // built here.
+    tree: precomputed?.tree ?? treeFingerprint(root, protectedIgnored),
+    head,
+    base,
+    policy: digest(policy),
+    verifier: digest({
+      command,
+      budget,
+      inputs: policy.verify?.inputs ?? [],
+      backend: policy.verify?.backend ?? "local",
+      image: policy.verify?.image ?? null
+    }),
+    surface: digest(surfacePaths(base, root, policy)),
+    intervention: digest(interventionWiring(root)),
+    dependencies: dependenciesBinding(root, policy, command)
+  };
+}
+function stateDir(cwd) {
+  const ctx = repoContext(cwd);
+  return ctx ? join19(ctx.gitDir, "tamperward") : null;
+}
+function verificationRecordPath(cwd) {
+  const dir = stateDir(cwd);
+  return dir ? join19(dir, "verification-state.json") : null;
+}
+function verifyingMarkerPath(cwd) {
+  const dir = stateDir(cwd);
+  return dir ? join19(dir, "verifying.json") : null;
+}
+function recordVerification(cwd, inputs, treeFingerprintValue) {
+  const path = verificationRecordPath(cwd);
+  if (!path) return false;
+  const binding = computeBinding(
+    repoRoot(cwd),
+    inputs,
+    treeFingerprintValue ? { tree: treeFingerprintValue } : void 0
+  );
+  const record = {
+    schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    verified_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tw_version: TW_VERSION,
+    inputs,
+    binding
+  };
+  mkdirSync8(dirname8(path), { recursive: true });
+  writeFileSync9(path, JSON.stringify(record) + "\n");
+  return true;
+}
+function invalidateVerificationRecordIfCurrent(cwd) {
+  const record = readVerificationRecord(cwd);
+  if (!record) return false;
+  let live;
+  try {
+    live = computeBinding(cwd, record.inputs);
+  } catch {
+    return false;
+  }
+  if (firstMismatch(record.binding, live)) return false;
+  const path = verificationRecordPath(cwd);
+  if (!path) return false;
+  try {
+    rmSync7(path, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isBinding(v) {
+  if (!isRecord4(v)) return false;
+  return BINDING_INPUTS.every((k) => {
+    const val = v[k];
+    return typeof val === "string" && val.length > 0;
+  });
+}
+function parseVerificationRecord(value) {
+  if (!isRecord4(value)) return null;
+  if (value.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
+  if (value.verdict !== "VERIFIED") return null;
+  if (typeof value.verified_at !== "string") return null;
+  if (typeof value.tw_version !== "string") return null;
+  const inputs = value.inputs;
+  if (!isRecord4(inputs)) return null;
+  if (typeof inputs.base_ref !== "string" || inputs.base_ref.length === 0) return null;
+  if (typeof inputs.explicit_base !== "boolean") return null;
+  if (inputs.command_source !== "policy" && inputs.command_source !== "flag") return null;
+  if (typeof inputs.command !== "string") return null;
+  if (inputs.budget_source !== "policy" && inputs.budget_source !== "flag") return null;
+  if (typeof inputs.budget !== "number" || !Number.isFinite(inputs.budget)) return null;
+  if (!isBinding(value.binding)) return null;
+  return {
+    schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    verified_at: value.verified_at,
+    tw_version: value.tw_version,
+    inputs: {
+      base_ref: inputs.base_ref,
+      explicit_base: inputs.explicit_base,
+      command_source: inputs.command_source,
+      command: inputs.command,
+      budget_source: inputs.budget_source,
+      budget: inputs.budget
+    },
+    binding: value.binding
+  };
+}
+function readVerificationRecord(cwd) {
+  const path = verificationRecordPath(cwd);
+  if (!path) return null;
+  let raw;
+  try {
+    raw = readFileSync16(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  return parseVerificationRecord(parsed);
+}
+function pidAlive3(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return isRecord4(e) && e.code === "EPERM";
+  }
+}
+function beginVerifying(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return false;
+  try {
+    const marker = {
+      schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
+      pid: process.pid,
+      started_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    mkdirSync8(dirname8(path), { recursive: true });
+    writeFileSync9(path, JSON.stringify(marker) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function endVerifying(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return;
+  try {
+    rmSync7(path, { force: true });
+  } catch {
+  }
+}
+function readVerifyingMarker(cwd) {
+  const path = verifyingMarkerPath(cwd);
+  if (!path) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync16(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!isRecord4(parsed)) return null;
+  if (parsed.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
+  if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
+  if (typeof parsed.started_at !== "string") return null;
+  if (!pidAlive3(parsed.pid)) return null;
+  return { schema_version: VERIFICATION_STATE_SCHEMA_VERSION, pid: parsed.pid, started_at: parsed.started_at };
+}
+function firstMismatch(recorded, live) {
+  for (const input of MISMATCH_PRIORITY) {
+    if (recorded[input] !== live[input]) return input;
+  }
+  return null;
+}
+function evaluateVerificationState(cwd) {
+  if (readVerifyingMarker(cwd)) {
+    return { state: "VERIFYING", reason: "a verification is in progress" };
+  }
+  const record = readVerificationRecord(cwd);
+  if (!record) {
+    return {
+      state: "UNVERIFIED",
+      reason: "no successful verification has been recorded for this repository"
+    };
+  }
+  let live;
+  try {
+    live = computeBinding(cwd, record.inputs);
+  } catch (e) {
+    return {
+      state: "BROKEN",
+      reason: "verification authority wiring is invalid or unavailable",
+      detail: e instanceof Error ? e.message : String(e),
+      verified_at: record.verified_at,
+      verifier_command: record.inputs.command,
+      record
+    };
+  }
+  const changed = firstMismatch(record.binding, live);
+  if (!changed) {
+    return {
+      state: "CURRENT",
+      verified_at: record.verified_at,
+      base: live.base,
+      head: live.head,
+      verifier_command: record.inputs.command,
+      record
+    };
+  }
+  return {
+    state: "STALE",
+    changed_input: changed,
+    reason: STALE_REASON[changed],
+    verified_at: record.verified_at,
+    base: live.base,
+    head: live.head,
+    verifier_command: record.inputs.command,
+    record
+  };
+}
+var VERIFICATION_STATE_SCHEMA_VERSION, BINDING_INPUTS, STALE_REASON, MISMATCH_PRIORITY;
+var init_verification_state = __esm({
+  "src/verification-state.ts"() {
+    "use strict";
+    init_build();
+    init_trusted();
+    init_fingerprint();
+    init_policy();
+    init_policy_load();
+    init_repo_context();
+    init_wiring();
+    init_dependency_env();
+    VERIFICATION_STATE_SCHEMA_VERSION = 1;
+    BINDING_INPUTS = [
+      "tree",
+      "head",
+      "base",
+      "policy",
+      "verifier",
+      "surface",
+      "intervention",
+      "dependencies"
+    ];
+    STALE_REASON = {
+      tree: "candidate tree changed since verification",
+      head: "HEAD commit changed since verification",
+      base: "trusted base commit changed since verification",
+      policy: "TamperWard policy changed since verification",
+      verifier: "verifier configuration changed since verification",
+      surface: "protected verification surface changed since verification",
+      intervention: "runtime steering wiring changed since verification",
+      dependencies: "dependency environment changed since verification"
+    };
+    MISMATCH_PRIORITY = [
+      "head",
+      "base",
+      "verifier",
+      "surface",
+      "intervention",
+      "dependencies",
+      "policy",
+      "tree"
+    ];
+  }
+});
+
+// src/cli/verify.ts
+import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, readlinkSync as readlinkSync3, rmSync as rmSync8, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute11, join as join19, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute11, join as join20, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
   return {
     level: "suite-exit-only",
@@ -15665,14 +16046,14 @@ function oracleAssuranceReport() {
     limitation: "candidate source executes inside the configured suite process and may terminate or interpose on that in-process oracle; isolated-container is execution-domain isolation, not semantic/oracle isolation"
   };
 }
-function git2(args, cwd) {
-  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+function git3(args, cwd) {
+  return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
-  const rev2 = git2(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
+  const rev2 = git3(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
   try {
-    return git2(["merge-base", rev2, "HEAD"], cwd).trim();
+    return git3(["merge-base", rev2, "HEAD"], cwd).trim();
   } catch {
     return rev2;
   }
@@ -15720,15 +16101,15 @@ function rootedLinkTarget(target) {
   return isAbsolute11(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out3, root, label) {
-  if (rootedLinkTarget(target) || !inside2(root, resolve9(dirname8(out3), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve9(dirname9(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync7(out3, { force: true });
+  rmSync8(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative6(root, dirname8(out3)));
+  let stack = linkParts(relative6(root, dirname9(out3)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -15745,7 +16126,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "deps" && dependencyRoot ? dependencyRoot : root;
-    const current = join19(base, ...stack);
+    const current = join20(base, ...stack);
     let st;
     try {
       st = lstatSync9(current);
@@ -15787,7 +16168,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join19(current, part);
+    current = join20(current, part);
     let st;
     try {
       st = lstatSync9(current);
@@ -15812,7 +16193,7 @@ function materialize(cwd, dest, dependencyRoot) {
   }
   const links = [];
   for (const rel of listed) {
-    const src = join19(cwd, rel);
+    const src = join20(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -15820,8 +16201,8 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out3 = join19(dest, rel);
-    mkdirSync8(dirname8(out3), { recursive: true });
+    const out3 = join20(dest, rel);
+    mkdirSync9(dirname9(out3), { recursive: true });
     dropSymlink(out3);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -15840,19 +16221,19 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join19(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join20(dest, "node_modules"), "dir");
 }
 function workingTreePaths(cwd) {
-  return git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  return git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
 }
 function probeFilesystemCaseSensitivity(dir) {
-  const upper = join19(dir, ".tw-case-probe-A");
-  const lower = join19(dir, ".tw-case-probe-a");
+  const upper = join20(dir, ".tw-case-probe-A");
+  const lower = join20(dir, ".tw-case-probe-a");
   try {
-    writeFileSync9(upper, "", { flag: "wx" });
+    writeFileSync10(upper, "", { flag: "wx" });
     return !existsSync14(lower);
   } finally {
-    rmSync7(upper, { force: true });
+    rmSync8(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -15870,7 +16251,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync7(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync8(p, { force: true });
   } catch {
   }
 }
@@ -15899,22 +16280,22 @@ function verifierCoveredInputs(cmd, atBase, policy) {
   return covered;
 }
 function baseEntries(base, cwd) {
-  return git2(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
+  return git3(["ls-tree", "-r", "-z", base], cwd).split("\0").filter(Boolean).map((rec) => {
     const tab = rec.indexOf("	");
     const [mode, type] = rec.slice(0, tab).split(" ");
     return { mode, type, path: rec.slice(tab + 1) };
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash12("sha256");
+  const h = createHash13("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join19(dest, rel);
+    const p = join20(dest, rel);
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync17(p));
     } catch {
       h.update("<gone>");
     }
@@ -15943,16 +16324,16 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
     if (e.type === "commit") {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
-    const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out3 = join19(dest, e.path);
-    mkdirSync8(dirname8(out3), { recursive: true });
-    rmSync7(out3, { force: true });
+    const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const out3 = join20(dest, e.path);
+    mkdirSync9(dirname9(out3), { recursive: true });
+    rmSync8(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync9(out3, content);
+      writeFileSync10(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -15961,7 +16342,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync7(join19(dest, rel), { force: true });
+    rmSync8(join20(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -15975,9 +16356,9 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join19(scratch, "npmrc-user");
-  const globalRc = join19(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync9(f, "", { mode: 292 });
+  const userRc = join20(scratch, "npmrc-user");
+  const globalRc = join20(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -16008,7 +16389,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
     };
   }
-  const scratch = mkdtempSync3(join19(tmpdir4(), "tw-verify-run-"));
+  const scratch = mkdtempSync3(join20(tmpdir4(), "tw-verify-run-"));
   try {
     const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
@@ -16053,7 +16434,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       diagnostics: r.diagnostics
     };
   } finally {
-    rmSync7(scratch, { recursive: true, force: true });
+    rmSync8(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -16098,6 +16479,15 @@ function verifyVerdictLine(verdict2, ctx) {
   }
 }
 function runVerify(opts) {
+  const markerCwd = repoRoot(opts.cwd ?? process.cwd());
+  const marked = opts.silent ? false : beginVerifying(markerCwd);
+  try {
+    return runVerifyImpl(opts);
+  } finally {
+    if (marked) endVerifying(markerCwd);
+  }
+}
+function runVerifyImpl(opts) {
   const cwd = repoRoot(opts.cwd ?? process.cwd());
   const colour = opts.silent ? false : colourEnabled(process.env, process.stdout);
   const paintVerify = (s) => {
@@ -16137,7 +16527,7 @@ function runVerify(opts) {
     return cannotVerify("POLICY_ERROR", `cannot load policy (${e instanceof Error ? e.message : String(e)})`);
   }
   if (opts.requireAncestor) {
-    const requested = git2(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
+    const requested = git3(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
     if (!baseIsAncestorOfHead(requested, cwd)) {
       return cannotVerify(
         "BASE_NOT_ANCESTOR",
@@ -16245,17 +16635,17 @@ function runVerify(opts) {
   } catch {
     return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
-  const visRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-vis-"));
-  const visDir = join19(visRoot, "t");
+  const visRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-vis-"));
+  const visDir = join20(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync7(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync8(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
     const present = (rel) => {
       try {
-        lstatSync9(join19(cwd, rel));
+        lstatSync9(join20(cwd, rel));
         return true;
       } catch {
         return false;
@@ -16287,7 +16677,7 @@ function runVerify(opts) {
     );
   }
   try {
-    mkdirSync8(visDir);
+    mkdirSync9(visDir);
     materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
@@ -16388,12 +16778,12 @@ function runVerify(opts) {
       { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
     );
   }
-  const priRoot = mkdtempSync3(join19(tmpdir4(), "tw-verify-pri-"));
-  const priDir = join19(priRoot, "t");
+  const priRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-pri-"));
+  const priDir = join20(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
-    mkdirSync8(priDir);
+    mkdirSync9(priDir);
     materialize(cwd, priDir, frozenNodeModules);
     ({ restored, removed: removedAdded } = overlayPristine(
       cwd,
@@ -16479,6 +16869,25 @@ function runVerify(opts) {
     code2 = 1;
   }
   opts.onVerdict?.({ verdict: verdict2 });
+  if (verdict2 === "VERIFIED") {
+    try {
+      const inputs = {
+        base_ref: opts.base ?? "HEAD",
+        explicit_base: opts.base !== void 0,
+        command_source: opts.cmd !== void 0 ? "flag" : "policy",
+        command: cmd,
+        budget_source: opts.budget !== void 0 ? "flag" : "policy",
+        budget
+      };
+      recordVerification(cwd, inputs, treeBefore);
+    } catch {
+    }
+  } else {
+    try {
+      invalidateVerificationRecordIfCurrent(cwd);
+    } catch {
+    }
+  }
   const signedOff = verdict2 === "MASKED_FAILURE" ? oobToken("verify", oobFromEnv(), oobHeadFromEnv()) : null;
   if (signedOff) code2 = 0;
   if (opts.json) {
@@ -16584,6 +16993,7 @@ var init_verify = __esm({
     init_verifier_backend();
     init_machine_output();
     init_signoff();
+    init_verification_state();
     init_suite_diagnostics();
     init_text();
     init_status();
@@ -16680,11 +17090,11 @@ var init_verify = __esm({
 });
 
 // src/cli/run.ts
-import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
+import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync18, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname9, join as join20, resolve as resolve10 } from "node:path";
+import { dirname as dirname10, join as join21, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
@@ -16721,7 +17131,7 @@ function writableByCaller2(path) {
       return true;
     } catch {
     }
-    const parent = dirname9(cur);
+    const parent = dirname10(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -16760,9 +17170,9 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   };
 }
 function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
-  const stateDir = mkdtempSync4(join20(tmpdir5(), "tw-agent-supervisor-"));
-  const resultFile = join20(stateDir, "result.json");
-  const agentEnvFile = join20(stateDir, "agent-env.json");
+  const stateDir2 = mkdtempSync4(join21(tmpdir5(), "tw-agent-supervisor-"));
+  const resultFile = join21(stateDir2, "result.json");
+  const agentEnvFile = join21(stateDir2, "agent-env.json");
   try {
     const linux = process.platform === "linux";
     let executable;
@@ -16779,7 +17189,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync10(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -16836,7 +17246,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync17(resultFile, "utf8"));
+      state = JSON.parse(readFileSync18(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -16861,13 +17271,13 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync8(stateDir, { recursive: true, force: true });
+    rmSync9(stateDir2, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
   Atomics.wait(waitCell, 0, 0, ms);
 }
-function pidAlive3(pid) {
+function pidAlive4(pid) {
   if (!pid || !Number.isInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -16877,10 +17287,10 @@ function pidAlive3(pid) {
   }
 }
 function observerExited(pid) {
-  if (!pidAlive3(pid)) return true;
+  if (!pidAlive4(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -16888,8 +17298,8 @@ function observerExited(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join20(cwd, ".git");
-  return join20(
+  const gd = gitDir(cwd) ?? join21(cwd, ".git");
+  return join21(
     gd,
     "tamperward",
     `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
@@ -16997,12 +17407,12 @@ function finishObserverAdvisory(observer, write = out) {
   const telemetry = stopObserverProcess(observer);
   observerSummary(observer, telemetry, write);
 }
-function git3(args, cwd) {
-  return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+function git4(args, cwd) {
+  return execFileSync10("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync18("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -17025,7 +17435,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n2 = Number(pid);
     if (n2 === process.pid) continue;
     try {
-      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -17069,7 +17479,7 @@ function runEnvelope(opts) {
   let base;
   try {
     const requestedBase = assertRev(opts.base ?? "HEAD");
-    base = git3(["rev-parse", "--verify", `${requestedBase}^{commit}`], cwd).trim();
+    base = git4(["rev-parse", "--verify", `${requestedBase}^{commit}`], cwd).trim();
   } catch {
     err(`tamperward run: cannot resolve trusted base ${opts.base ?? "HEAD"} \u2014 failing closed.`);
     return 2;
@@ -17091,7 +17501,7 @@ function runEnvelope(opts) {
     return 2;
   }
   if (!opts.allowDirty) {
-    const dirty = git3(["status", "--porcelain"], cwd).trim();
+    const dirty = git4(["status", "--porcelain"], cwd).trim();
     if (dirty) {
       err("tamperward run: working tree is dirty before the agent starts \u2014 the envelope cannot");
       err("attribute changes. Commit or stash first, or pass --allow-dirty to own the risk.");
@@ -17196,7 +17606,7 @@ tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT
     emitRunJson("OBJECT_REWRITE", 1);
     return 1;
   }
-  const head = git3(["rev-parse", "HEAD"], cwd).trim();
+  const head = git4(["rev-parse", "HEAD"], cwd).trim();
   const isAncestor = spawnSync4("git", ["merge-base", "--is-ancestor", base, head], { cwd, env: trustedGitEnv() });
   if (isAncestor.status !== 0) {
     err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
@@ -17597,9 +18007,9 @@ raise SystemExit(0)
 });
 
 // src/cli/doctor.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import { join as join21, resolve as resolve11 } from "node:path";
+import { execFileSync as execFileSync11 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync5 } from "node:fs";
+import { join as join22, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
     if (linuxPython?.path) {
@@ -17657,7 +18067,7 @@ function pinsInFile(path) {
   if (!existsSync15(path)) return [];
   let src = "";
   try {
-    src = readFileSync18(path, "utf8");
+    src = readFileSync19(path, "utf8");
   } catch {
     return [];
   }
@@ -17684,7 +18094,7 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(path, "utf8"));
+      doc = yaml.parse(readFileSync19(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -17797,9 +18207,9 @@ function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow =
   addWiring("codeowners", "codeowners", true);
   checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
-    ...pinsInFile(join21(cwd, ".claude", "settings.json")),
-    ...pinsInFile(join21(cwd, ".git", "hooks", "pre-commit")),
-    ...pinsInFile(join21(cwd, ".husky", "pre-commit"))
+    ...pinsInFile(join22(cwd, ".claude", "settings.json")),
+    ...pinsInFile(join22(cwd, ".git", "hooks", "pre-commit")),
+    ...pinsInFile(join22(cwd, ".husky", "pre-commit"))
   ];
   const below = pins.filter((pin) => (compareVersions(pin, TW_VERSION) ?? 0) < 0);
   const above = pins.filter((pin) => (compareVersions(TW_VERSION, pin) ?? 0) < 0);
@@ -17917,7 +18327,7 @@ function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward", requi
 }
 function gitText(cwd, args) {
   try {
-    return execFileSync10("git", args, {
+    return execFileSync11("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -17951,7 +18361,7 @@ function githubApi(cwd, endpoint) {
   const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? "";
   const invocation = githubApiInvocation(endpoint, token);
   try {
-    const stdout = execFileSync10(
+    const stdout = execFileSync11(
       invocation.executable,
       invocation.args,
       {
@@ -18095,7 +18505,7 @@ function diagnose(opts = {}) {
         `${workflowDirRel}: could not enumerate workflows (${e instanceof Error ? e.message : String(e)})`
       );
     }
-    for (const name of entries) workflowRels.push(join21(workflowDirRel, name));
+    for (const name of entries) workflowRels.push(join22(workflowDirRel, name));
   }
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
@@ -18108,7 +18518,7 @@ function diagnose(opts = {}) {
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync18(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync19(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -18282,19 +18692,153 @@ var init_doctor = __esm({
   }
 });
 
+// src/cli/status.ts
+function authorityFromChecks(checks) {
+  if (checks.some((c) => c.state === "BROKEN")) return "BROKEN";
+  if (checks.some((c) => c.state === "WARN")) return "PARTIAL";
+  return "ACTIVE";
+}
+function interventionFromCheck(check2) {
+  if (!check2) return { state: "UNKNOWN", detail: "agent hook wiring could not be evaluated" };
+  const map = {
+    OK: "ACTIVE",
+    WARN: "PARTIAL",
+    BROKEN: "INACTIVE"
+  };
+  return { state: map[check2.state], detail: check2.detail };
+}
+function buildStatusModel(cwd) {
+  let authority;
+  let intervention;
+  try {
+    const outcome = diagnose({ cwd });
+    authority = { state: authorityFromChecks(outcome.checks) };
+    const summary = outcome.checks.filter((c) => c.state !== "OK").map((c) => `${c.id}: ${c.state}`);
+    if (summary.length) authority.detail = summary.join("; ");
+    intervention = interventionFromCheck(outcome.checks.find((c) => c.id === "claude-hooks"));
+  } catch (e) {
+    const detail = e instanceof Error ? e.message : String(e);
+    authority = { state: "UNKNOWN", detail };
+    intervention = { state: "UNKNOWN", detail };
+  }
+  const verification = evaluateVerificationState(cwd);
+  const agent = intervention.state === "ACTIVE" || intervention.state === "PARTIAL" ? "claude-code" : "none";
+  return { authority, intervention, verification, runtime: { agent } };
+}
+function shortId(id) {
+  return id ? `${id.slice(0, 10)}...` : void 0;
+}
+function renderStatus(model, colour) {
+  const v = model.verification;
+  const lines = ["TamperWard", ""];
+  lines.push(statusLine(AUTHORITY_SEVERITY[model.authority.state], "Authority", model.authority.state, colour));
+  lines.push(statusLine(INTERVENTION_SEVERITY[model.intervention.state], "Intervention", model.intervention.state, colour));
+  lines.push(statusLine(VERIFICATION_SEVERITY[v.state], "Verification", v.state, colour));
+  const rows = [];
+  const record = v.record;
+  if (record) {
+    const verifiedTree = shortId(record.binding.tree);
+    if (verifiedTree) rows.push(["Verified tree", verifiedTree]);
+    const baseShort = shortId(v.base ?? record.binding.base);
+    if (baseShort) rows.push(["Base", `${record.inputs.base_ref}@${baseShort}`]);
+    if (v.verifier_command) rows.push(["Verifier", v.verifier_command]);
+  }
+  rows.push(["Runtime", model.runtime.agent]);
+  if (v.state === "STALE" && v.reason) rows.push(["Reason", v.reason]);
+  else if (v.state === "BROKEN") rows.push(["Reason", v.detail ?? v.reason ?? "authority wiring is invalid"]);
+  else if (v.state === "VERIFYING") rows.push(["Reason", v.reason ?? "a verification is in progress"]);
+  else if (v.state === "UNVERIFIED") rows.push(["Next", "run `tamperward verify` to establish a verified baseline"]);
+  if (rows.length) {
+    lines.push("");
+    const width = Math.max(...rows.map(([k]) => k.length));
+    for (const [k, val] of rows) lines.push(`${k.padEnd(width)}  ${val}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function statusDocument(model) {
+  const v = model.verification;
+  const verification = { state: v.state };
+  if (v.reason) verification.reason = v.reason;
+  if (v.changed_input) verification.changed_input = v.changed_input;
+  if (v.detail) verification.detail = v.detail;
+  if (v.verified_at) verification.verified_at = v.verified_at;
+  if (v.base) verification.base = v.base;
+  if (v.head) verification.head = v.head;
+  if (v.verifier_command) verification.verifier_command = v.verifier_command;
+  if (v.record) {
+    verification.tree = v.record.binding.tree;
+    verification.binding = { ...v.record.binding };
+  }
+  return machineOutput({
+    command: "status",
+    authority: model.authority,
+    intervention: model.intervention,
+    verification,
+    runtime: model.runtime
+  });
+}
+function runStatus(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (!repoContext(cwd)) {
+    const why = outsideRepository(cwd) ?? "cwd is not inside a repository the gate can read";
+    process.stderr.write(`tamperward: status needs a git repository (${why})
+`);
+    return 2;
+  }
+  const model = buildStatusModel(cwd);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(statusDocument(model)) + "\n");
+  } else {
+    process.stdout.write(renderStatus(model, colourEnabled(process.env, process.stdout)));
+  }
+  return 0;
+}
+var AUTHORITY_SEVERITY, INTERVENTION_SEVERITY, VERIFICATION_SEVERITY;
+var init_status2 = __esm({
+  "src/cli/status.ts"() {
+    "use strict";
+    init_machine_output();
+    init_repo_context();
+    init_repo_context();
+    init_doctor();
+    init_verification_state();
+    init_text();
+    init_status();
+    AUTHORITY_SEVERITY = {
+      ACTIVE: "ok",
+      PARTIAL: "warn",
+      BROKEN: "bad",
+      UNKNOWN: "info"
+    };
+    INTERVENTION_SEVERITY = {
+      ACTIVE: "ok",
+      PARTIAL: "warn",
+      INACTIVE: "bad",
+      UNKNOWN: "info"
+    };
+    VERIFICATION_SEVERITY = {
+      CURRENT: "ok",
+      STALE: "warn",
+      VERIFYING: "info",
+      BROKEN: "bad",
+      UNVERIFIED: "info"
+    };
+  }
+});
+
 // src/cli/trace-verify.ts
-import { execFileSync as execFileSync11, spawnSync as spawnSync5 } from "node:child_process";
+import { execFileSync as execFileSync12, spawnSync as spawnSync5 } from "node:child_process";
 import {
   existsSync as existsSync16,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync9,
+  rmSync as rmSync10,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { isAbsolute as isAbsolute12, join as join22, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join23, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 function unescapeStraceString(s) {
   return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
@@ -18506,8 +19050,8 @@ function summarizeTraceRuns(opts) {
     unresolved_accesses
   };
 }
-function git4(args, cwd) {
-  return execFileSync11("git", args, {
+function git5(args, cwd) {
+  return execFileSync12("git", args, {
     cwd,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -18520,7 +19064,7 @@ function commandExists(command) {
   return !r.error && r.status === 0;
 }
 function trackedAt(base, cwd) {
-  return git4(["ls-tree", "-r", "-z", "--name-only", base], cwd).split("\0").filter(Boolean);
+  return git5(["ls-tree", "-r", "-z", "--name-only", base], cwd).split("\0").filter(Boolean);
 }
 function materializeBase(base, cwd, dest) {
   const archive = spawnSync5("git", ["archive", "--format=tar", base], {
@@ -18542,8 +19086,8 @@ function materializeBase(base, cwd, dest) {
       `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
     );
   }
-  const hostModules = join22(cwd, "node_modules");
-  const tracedModules = join22(dest, "node_modules");
+  const hostModules = join23(cwd, "node_modules");
+  const tracedModules = join23(dest, "node_modules");
   if (existsSync16(hostModules) && !existsSync16(tracedModules)) {
     symlinkSync2(resolve12(hostModules), tracedModules, "dir");
   }
@@ -18551,7 +19095,7 @@ function materializeBase(base, cwd, dest) {
 function traceFiles(prefix) {
   const dir = resolve12(prefix, "..");
   const base = prefix.split(sep5).at(-1) ?? prefix;
-  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join22(dir, name)).sort();
+  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join23(dir, name)).sort();
 }
 function rewriteTraceRoot(accesses, actualRoot) {
   return accesses.map((item) => {
@@ -18566,13 +19110,13 @@ function rewriteTraceRoot(accesses, actualRoot) {
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
-    return { ...item, path: join22(TRACE_ROOT, ...rel.split("/")) };
+    return { ...item, path: join23(TRACE_ROOT, ...rel.split("/")) };
   });
 }
 function straceOnce(root, command, budget) {
-  const traceDir = mkdtempSync5(join22(tmpdir6(), "tw-trace-log-"));
+  const traceDir = mkdtempSync5(join23(tmpdir6(), "tw-trace-log-"));
   try {
-    const prefix = join22(traceDir, "trace");
+    const prefix = join23(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
       [
@@ -18601,7 +19145,7 @@ function straceOnce(root, command, budget) {
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync19(path, "utf8"), TRACE_ROOT));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8"), TRACE_ROOT));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -18612,26 +19156,26 @@ function straceOnce(root, command, budget) {
     };
     return { raw, accesses };
   } finally {
-    rmSync9(traceDir, { recursive: true, force: true });
+    rmSync10(traceDir, { recursive: true, force: true });
   }
 }
 function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join22(tmpdir6(), "tw-trace-base-"));
+  const root = mkdtempSync5(join23(tmpdir6(), "tw-trace-base-"));
   try {
     materializeBase(base, cwd, root);
     const { raw, accesses } = straceOnce(root, command, budget);
     return { outcome: classifyTraceRun(raw), accesses: rewriteTraceRoot(accesses, root) };
   } finally {
-    rmSync9(root, { recursive: true, force: true });
+    rmSync10(root, { recursive: true, force: true });
   }
 }
 function tracerPreflight(budget = 10) {
-  const probeRoot = mkdtempSync5(join22(tmpdir6(), "tw-trace-probe-"));
+  const probeRoot = mkdtempSync5(join23(tmpdir6(), "tw-trace-probe-"));
   try {
     const { raw } = straceOnce(probeRoot, "true", Math.max(1, Math.min(budget, 10)));
     return classifyTraceRun(raw);
   } finally {
-    rmSync9(probeRoot, { recursive: true, force: true });
+    rmSync10(probeRoot, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -18696,7 +19240,7 @@ function runTraceVerify(opts = {}) {
   let base;
   try {
     const baseArg = assertRev(requestedBase);
-    base = git4(["rev-parse", "--verify", `${baseArg}^{commit}`], cwd).trim();
+    base = git5(["rev-parse", "--verify", `${baseArg}^{commit}`], cwd).trim();
   } catch (e) {
     process.stderr.write(`tamperward trace-verify: cannot resolve trusted base ${JSON.stringify(requestedBase)} (${e instanceof Error ? e.message : String(e)}).
 `);
@@ -18833,26 +19377,26 @@ var init_trace_verify = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
-import { join as join23 } from "node:path";
-function isRecord4(x) {
+import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
+import { join as join24 } from "node:path";
+function isRecord5(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
 }
 function hooksBeyondTamperward(hooks) {
-  if (!isRecord4(hooks)) return hooks != null;
+  if (!isRecord5(hooks)) return hooks != null;
   for (const entries of Object.values(hooks)) {
     if (!Array.isArray(entries)) {
       if (entries != null) return true;
       continue;
     }
     for (const entry of entries) {
-      const hs = isRecord4(entry) ? entry.hooks : null;
+      const hs = isRecord5(entry) ? entry.hooks : null;
       if (!Array.isArray(hs)) {
         if (hs != null) return true;
         continue;
       }
       for (const h of hs) {
-        const cmd = isRecord4(h) ? String(h.command ?? "") : "";
+        const cmd = isRecord5(h) ? String(h.command ?? "") : "";
         if (!/tamperward/.test(cmd)) return true;
       }
     }
@@ -18860,11 +19404,11 @@ function hooksBeyondTamperward(hooks) {
   return false;
 }
 function claudeSettingsBeyondTamperward(cwd) {
-  const path = join23(cwd, ".claude", "settings.json");
+  const path = join24(cwd, ".claude", "settings.json");
   let raw;
   try {
     if (!existsSync17(path)) return false;
-    raw = readFileSync20(path, "utf8");
+    raw = readFileSync21(path, "utf8");
   } catch {
     return false;
   }
@@ -18874,7 +19418,7 @@ function claudeSettingsBeyondTamperward(cwd) {
   } catch {
     return raw.trim().length > 0;
   }
-  if (!isRecord4(parsed)) return raw.trim().length > 0;
+  if (!isRecord5(parsed)) return raw.trim().length > 0;
   for (const [key2, value] of Object.entries(parsed)) {
     if (key2 === "disableAllHooks") continue;
     if (key2 === "hooks") {
@@ -18890,7 +19434,7 @@ function detectRuntimes(cwd) {
   for (const rt of KNOWN_RUNTIMES) {
     const marker = rt.markers.find((m) => {
       try {
-        return existsSync17(join23(cwd, m));
+        return existsSync17(join24(cwd, m));
       } catch {
         return false;
       }
@@ -18970,10 +19514,10 @@ var init_runtimes = __esm({
 });
 
 // src/cli/onboard.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync22, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join24, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
+import { join as join25, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
 import { createInterface } from "node:readline";
 import { parseDocument } from "yaml";
 function readlineAsker(input, output) {
@@ -18982,9 +19526,9 @@ function readlineAsker(input, output) {
   let pending = null;
   rl.on("close", () => {
     closed = true;
-    const resolve20 = pending;
+    const resolve23 = pending;
     pending = null;
-    resolve20?.(null);
+    resolve23?.(null);
   });
   rl.on("SIGINT", () => rl.close());
   const ask = (question) => new Promise((resolvePromise) => {
@@ -19017,9 +19561,9 @@ function platformLabel(platform) {
   if (platform === "linux") return "Linux";
   return platform;
 }
-function git5(cwd, args) {
+function git6(cwd, args) {
   try {
-    return execFileSync12("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -19038,13 +19582,13 @@ function explainVerdict(v, code2) {
   }
 }
 function writeVerifyCommand(cwd, command) {
-  const path = join24(cwd, POLICY_FILE);
+  const path = join25(cwd, POLICY_FILE);
   const kind = writeTargetKind(path);
   if (kind === "symlink" || kind === "irregular") {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -19061,7 +19605,7 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync10(path, { force: true });
+    if (original === null) rmSync11(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
@@ -19096,7 +19640,7 @@ async function runOnboard(opts, io = {}) {
     rawErr("or run `tamperward init` for the deterministic wiring step only.");
     return 2;
   }
-  const rootText = git5(requestedCwd, ["rev-parse", "--show-toplevel"])?.trim() ?? "";
+  const rootText = git6(requestedCwd, ["rev-parse", "--show-toplevel"])?.trim() ?? "";
   if (!rootText) {
     fail(requestedCwd + " is not inside a Git repository. Run `git init` first.");
     return 2;
@@ -19162,8 +19706,8 @@ async function runOnboard(opts, io = {}) {
     } else {
       status("LIMITED", platformLabel(platform) + ": check works here; local verify and `run` are unavailable. Use the container verifier for final verification.", "warn");
     }
-    const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
-    const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
+    const head = git6(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
+    const treeStatus = git6(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
     const dirty = treeStatus.split("\n").filter(Boolean).map((line2) => line2.slice(3).split(" -> ").at(-1) ?? "");
     if (!head) {
       const count = dirty.length;
@@ -19411,7 +19955,7 @@ function postureOf(outcome) {
   return "READY";
 }
 function runDemo(cwd, head, runners, out3) {
-  const files = (git5(cwd, ["ls-tree", "-r", "-z", head]) ?? "").split("\0").filter(Boolean).flatMap((row) => {
+  const files = (git6(cwd, ["ls-tree", "-r", "-z", head]) ?? "").split("\0").filter(Boolean).flatMap((row) => {
     const tab = row.indexOf("	");
     if (tab < 0) return [];
     const mode = row.slice(0, tab).split(" ")[0];
@@ -19420,7 +19964,7 @@ function runDemo(cwd, head, runners, out3) {
   });
   let target = null;
   for (const path of files) {
-    const before2 = git5(cwd, ["show", `${head}:${path}`]);
+    const before2 = git6(cwd, ["show", `${head}:${path}`]);
     if (before2 === null || !JS_TEST_BLOCK.test(before2)) continue;
     target = { path, before: before2, after: before2.replace(JS_TEST_BLOCK, "$1$2.skip$3") };
     break;
@@ -19431,13 +19975,13 @@ function runDemo(cwd, head, runners, out3) {
   }
   const before = treeFingerprint(cwd);
   out3(`working tree fingerprint before: ${before.slice(0, 16)}`);
-  const wt = mkdtempSync6(join24(tmpdir7(), "tw-onboard-demo-"));
+  const wt = mkdtempSync6(join25(tmpdir7(), "tw-onboard-demo-"));
   try {
-    if (git5(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
+    if (git6(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
       out3("Demo skipped: could not create a temporary worktree (git worktree add failed).");
       return;
     }
-    const targetPath = join24(wt, target.path);
+    const targetPath = join25(wt, target.path);
     const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
@@ -19466,9 +20010,9 @@ function runDemo(cwd, head, runners, out3) {
     out3("");
     out3(`check exited ${code2}: ${code2 === 1 ? "a blocking finding, which is what the hook, pre-commit and CI would all report" : "no blocking finding was reported"}.`);
   } finally {
-    git5(cwd, ["worktree", "remove", "--force", wt]);
-    git5(cwd, ["worktree", "prune"]);
-    rmSync10(wt, { recursive: true, force: true });
+    git6(cwd, ["worktree", "remove", "--force", wt]);
+    git6(cwd, ["worktree", "prune"]);
+    rmSync11(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -19655,9 +20199,9 @@ var init_capture = __esm({
 });
 
 // src/research/manifest.ts
-import { createHash as createHash13 } from "node:crypto";
-import { readFileSync as readFileSync22 } from "node:fs";
-import { dirname as dirname10, resolve as resolve15 } from "node:path";
+import { createHash as createHash14 } from "node:crypto";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { dirname as dirname11, resolve as resolve15 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
   if (!isRecord(raw)) throw new ResearchError(`task manifest: ${where} is not an object`);
@@ -19690,7 +20234,7 @@ function readManifest(path) {
   const abs = resolve15(path);
   let bytes;
   try {
-    bytes = readFileSync22(abs);
+    bytes = readFileSync23(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -19707,13 +20251,13 @@ function readManifest(path) {
   if (!Array.isArray(raw.tasks) || raw.tasks.length === 0) {
     throw new ResearchError(`task manifest ${abs}: no tasks (tasks must be a non-empty array)`);
   }
-  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname10(abs)));
+  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname11(abs)));
   const seen = /* @__PURE__ */ new Set();
   for (const t of tasks) {
     if (seen.has(t.id)) throw new ResearchError(`task manifest ${abs}: duplicate task id "${t.id}"`);
     seen.add(t.id);
   }
-  return { path: abs, sha256: createHash13("sha256").update(bytes).digest("hex"), tasks };
+  return { path: abs, sha256: createHash14("sha256").update(bytes).digest("hex"), tasks };
 }
 var MANIFEST_VERSION;
 var init_manifest = __esm({
@@ -19987,22 +20531,22 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { execFileSync as execFileSync13 } from "node:child_process";
-import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync9, openSync as openSync3, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, unlinkSync, writeFileSync as writeFileSync11, writeSync } from "node:fs";
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync10, openSync as openSync3, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync12, unlinkSync, writeFileSync as writeFileSync12, writeSync } from "node:fs";
 import { hostname } from "node:os";
-import { join as join25, resolve as resolve16 } from "node:path";
-function git6(args, cwd) {
-  return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+import { join as join26, resolve as resolve16 } from "node:path";
+function git7(args, cwd) {
+  return execFileSync14("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function pairRecordPath(ledger, task, pair) {
-  return join25(ledger, "pairs", `${task}--${pair}.json`);
+  return join26(ledger, "pairs", `${task}--${pair}.json`);
 }
 function researchLockPath(ledger) {
-  return join25(ledger, "run.lock");
+  return join26(ledger, "run.lock");
 }
 function readLockOwner(path) {
   try {
-    const parsed = JSON.parse(readFileSync23(path, "utf8"));
+    const parsed = JSON.parse(readFileSync24(path, "utf8"));
     if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
     return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
@@ -20023,7 +20567,7 @@ function lockHolder(path) {
   return owner ? `pid ${owner.pid} on ${owner.host}, started ${owner.started_at}` : "an unreadable lock file";
 }
 function acquireResearchLock(ledger, breakStaleLock = false) {
-  mkdirSync9(ledger, { recursive: true });
+  mkdirSync10(ledger, { recursive: true });
   const path = researchLockPath(ledger);
   if (breakStaleLock && existsSync18(path)) {
     const owner2 = readLockOwner(path);
@@ -20087,7 +20631,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
       if (released) return;
       released = true;
       try {
-        if (readFileSync23(path, "utf8") === text) unlinkSync(path);
+        if (readFileSync24(path, "utf8") === text) unlinkSync(path);
       } catch {
       }
     }
@@ -20096,7 +20640,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync23(path, "utf8"));
+    raw = JSON.parse(readFileSync24(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -20133,28 +20677,28 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync11(tmp, text);
+  writeFileSync12(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
   return ["-c", "protocol.ext.allow=never", "clone", "-q", "--no-hardlinks", "--", repo, ws3];
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws3 = join25(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync11(ws3, { recursive: true, force: true });
-  mkdirSync9(join25(ledger, "workspaces"), { recursive: true });
+  const ws3 = join26(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  rmSync12(ws3, { recursive: true, force: true });
+  mkdirSync10(join26(ledger, "workspaces"), { recursive: true });
   try {
-    execFileSync13("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync14("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
     throw new ResearchError(`task "${task.id}": cannot clone ${task.repo}: ${errorMessage(e).split("\n")[0]}`);
   }
-  git6(["config", "user.name", "tamperward-research"], ws3);
-  git6(["config", "user.email", "research@tamperward.invalid"], ws3);
+  git7(["config", "user.name", "tamperward-research"], ws3);
+  git7(["config", "user.email", "research@tamperward.invalid"], ws3);
   const requestedBase = sourceBase ?? task.base;
   const candidates = sourceBase !== void 0 ? [sourceBase] : task.base === "HEAD" ? ["HEAD"] : [task.base, `origin/${task.base}`];
   for (const rev2 of candidates) {
     try {
-      git6(["checkout", "-q", "--detach", rev2], ws3);
+      git7(["checkout", "-q", "--detach", rev2], ws3);
       return ws3;
     } catch {
     }
@@ -20308,15 +20852,15 @@ function observeOutcome(ws3, base, head, task, trusted) {
 }
 function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
   const ws3 = freshWorkspace(ledger, task, pair, arm, sourceBase);
-  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git6(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
+  const prep = { id: task.id, prompt: task.prompt, cwd: ws3, base: git7(["rev-parse", "HEAD"], ws3), arm, model: opts.model };
   if (arm === "gated" && adapter.prepareGated) {
     captureStdout(() => adapter.prepareGated?.(prep));
-    if (git6(["status", "--porcelain"], ws3)) {
-      git6(["add", "-A"], ws3);
-      git6(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
+    if (git7(["status", "--porcelain"], ws3)) {
+      git7(["add", "-A"], ws3);
+      git7(["commit", "-qm", "tamperward research: wire enforcement (gated arm)"], ws3);
     }
   }
-  const base = git6(["rev-parse", "HEAD"], ws3);
+  const base = git7(["rev-parse", "HEAD"], ws3);
   const launch2 = adapter.launch({ ...prep, base });
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   let agent;
@@ -20329,7 +20873,7 @@ function runTrajectory(ledger, task, pair, arm, adapter, opts, sourceBase) {
     agent = runUngated(ws3, launch2.argv, launch2.env, opts.agentBudget);
   }
   const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const head = git6(["rev-parse", "HEAD"], ws3);
+  const head = git7(["rev-parse", "HEAD"], ws3);
   const trustedSurface = trustedProtectedOnly(base, ws3);
   const fingerprintBefore = treeFingerprint(ws3, trustedSurface.protectedOnly);
   const observed = observeOutcome(ws3, base, head, task, trustedSurface.trusted);
@@ -20391,7 +20935,7 @@ function runResearch(opts) {
   }
   try {
     const pairs = opts.pairs ?? 1;
-    mkdirSync9(join25(ledger, "pairs"), { recursive: true });
+    mkdirSync10(join26(ledger, "pairs"), { recursive: true });
     for (const task of tasks) {
       const existingRecords = /* @__PURE__ */ new Map();
       let sourceBase = null;
@@ -20518,10 +21062,10 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
-import { join as join26, resolve as resolve17 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync25 } from "node:fs";
+import { join as join27, resolve as resolve17 } from "node:path";
 function readLedger2(dir) {
-  const pairsDir = join26(resolve17(dir), "pairs");
+  const pairsDir = join27(resolve17(dir), "pairs");
   let names;
   try {
     names = readdirSync7(pairsDir).filter((n2) => n2.endsWith(".json")).sort();
@@ -20530,10 +21074,10 @@ function readLedger2(dir) {
   }
   if (names.length === 0) throw new ResearchError(`ledger ${pairsDir} holds no pair records`);
   return names.map((n2) => {
-    const path = join26(pairsDir, n2);
+    const path = join27(pairsDir, n2);
     let raw;
     try {
-      raw = JSON.parse(readFileSync24(path, "utf8"));
+      raw = JSON.parse(readFileSync25(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -20664,9 +21208,9 @@ var init_summarize = __esm({
 });
 
 // src/research/init.ts
-import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync25, writeFileSync as writeFileSync12 } from "node:fs";
-import { basename as basename5, dirname as dirname11, resolve as resolve18 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "node:fs";
+import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
   return (basename5(clean, ".git").replace(/[^A-Za-z0-9._-]+/g, "-") || "task").slice(0, 80);
@@ -20694,8 +21238,8 @@ function createResearchManifest(opts) {
     }]
   };
   const text = JSON.stringify(doc, null, 2) + "\n";
-  mkdirSync10(dirname11(out3), { recursive: true });
-  writeFileSync12(out3, text, { flag: "wx", mode: 384 });
+  mkdirSync11(dirname12(out3), { recursive: true });
+  writeFileSync13(out3, text, { flag: "wx", mode: 384 });
   const parsed = readManifest(out3);
   if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
   return out3;
@@ -20717,7 +21261,7 @@ function runResearchInit(opts) {
   }
 }
 function requireHash(path) {
-  return createHash14("sha256").update(readFileSync25(path)).digest("hex");
+  return createHash15("sha256").update(readFileSync26(path)).digest("hex");
 }
 var init_init2 = __esm({
   "src/research/init.ts"() {
@@ -20782,10 +21326,10 @@ var init_report2 = __esm({
 });
 
 // src/research/bundle.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { existsSync as existsSync20, mkdirSync as mkdirSync11, readdirSync as readdirSync8, readFileSync as readFileSync26, statSync as statSync6, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname12, join as join27, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync12, readdirSync as readdirSync8, readFileSync as readFileSync27, statSync as statSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname13, join as join28, resolve as resolve19 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
 }
@@ -20831,14 +21375,14 @@ function parseTar(bytes) {
 }
 function walkLedger(ledger) {
   const entries = [];
-  const pairs = join27(ledger, "pairs");
+  const pairs = join28(ledger, "pairs");
   if (!existsSync20(pairs) || !statSync6(pairs).isDirectory()) throw new ResearchError(`ledger ${ledger} has no pairs directory`);
   const names = readdirSync8(pairs).filter((n2) => n2.endsWith(".json")).sort();
   if (names.length === 0) throw new ResearchError(`ledger ${ledger} holds no pair records`);
   for (const name of names) {
-    const path = join27(pairs, name);
+    const path = join28(pairs, name);
     if (!statSync6(path).isFile()) continue;
-    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync26(path) });
+    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync27(path) });
   }
   return entries;
 }
@@ -20848,7 +21392,7 @@ function jsonBytes(value) {
 function validateResearchBundle(path) {
   let files;
   try {
-    files = parseTar(gunzipSync(readFileSync26(resolve19(path))));
+    files = parseTar(gunzipSync(readFileSync27(resolve19(path))));
   } catch (e) {
     throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -20871,7 +21415,7 @@ function validateResearchBundle(path) {
   if (p.manifest_included !== Boolean(manifest) || p.prompts_included !== Boolean(manifest)) {
     throw new ResearchError("research bundle manifest inclusion metadata is inconsistent");
   }
-  if (manifest && createHash15("sha256").update(manifest).digest("hex") !== p.manifest_sha256) {
+  if (manifest && createHash16("sha256").update(manifest).digest("hex") !== p.manifest_sha256) {
     throw new ResearchError("research bundle manifest does not match its recorded sha256");
   }
   const parsedSummary = summary;
@@ -20902,8 +21446,8 @@ function createResearchBundle(opts) {
   const summary = summarizeLedger(ledger);
   const entries = walkLedger(ledger);
   if (opts.manifest) {
-    const manifest = readFileSync26(resolve19(opts.manifest));
-    const sha3 = createHash15("sha256").update(manifest).digest("hex");
+    const manifest = readFileSync27(resolve19(opts.manifest));
+    const sha3 = createHash16("sha256").update(manifest).digest("hex");
     if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
     entries.push({ name: "manifest.json", bytes: manifest });
   }
@@ -20925,8 +21469,8 @@ function createResearchBundle(opts) {
   entries.push({ name: "report.txt", bytes: Buffer.from(renderResearchReport(summary), "utf8") });
   entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
   const out3 = resolve19(opts.out);
-  mkdirSync11(dirname12(out3), { recursive: true });
-  writeFileSync13(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  mkdirSync12(dirname13(out3), { recursive: true });
+  writeFileSync14(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
   return out3;
 }
 function runResearchBundle(opts) {
@@ -21050,39 +21594,2194 @@ var init_research = __esm({
   }
 });
 
-// src/cli/signoff-label.ts
-function runSignoffLabel(opts) {
-  if (!opts.rule) {
-    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
-    return 2;
-  }
-  if (!opts.head) {
-    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
-    return 2;
-  }
-  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
-  const token = compactOobToken(want, opts.head);
-  if (!token) {
-    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
-    return 2;
-  }
-  process.stdout.write(`${token}
-`);
-  return 0;
+// src/adapters/contract.ts
+function steeringUnavailableFinding(detail) {
+  return {
+    rule: "tamperward-unavailable",
+    severity: "block",
+    message: `TamperWard could not evaluate this operation (${detail}), so it is denied rather than allowed.`,
+    evidence: detail,
+    remediation: "Repair the runtime steering path (hook config, transport, or event delivery), then retry. Do not work around the gate while it is down.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
 }
-var init_signoff_label = __esm({
-  "src/cli/signoff-label.ts"() {
+function failClosedResult(outcome, detail, phase, denyPayload) {
+  const findings = [steeringUnavailableFinding(detail)];
+  const wire = denyPayload(findings, phase);
+  return { outcome, detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+}
+var OPERATION_KINDS;
+var init_contract = __esm({
+  "src/adapters/contract.ts"() {
     "use strict";
-    init_signoff();
+    OPERATION_KINDS = ["shell", "file-edit", "file-read", "mcp", "other"];
   }
 });
 
-// src/cli/main.ts
-var main_exports = {};
-__export(main_exports, {
-  guardedMain: () => guardedMain,
-  main: () => main,
-  runHookFromRaw: () => runHookFromRaw,
+// src/adapters/claude/adapter.ts
+function hookKindFor(phase) {
+  if (phase === "end-of-turn") return "Stop";
+  if (phase === "pre-action") return "PreToolUse";
+  throw new Error(`no deny-capable Claude hook for the observation-only phase "${phase}"`);
+}
+function operationKind(toolName) {
+  if (!toolName) return "other";
+  if (toolName === "Bash" || toolName === "BashOutput" || toolName === "KillShell") return "shell";
+  if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit" || toolName === "NotebookEdit") return "file-edit";
+  if (toolName === "Read" || toolName === "Glob" || toolName === "Grep" || toolName === "NotebookRead") return "file-read";
+  if (toolName.startsWith("mcp__")) return "mcp";
+  return "other";
+}
+function eventFrom(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: operationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  return {
+    phase,
+    operation,
+    identity: { claimedCwd: input.cwd, sessionId: input.session_id }
+  };
+}
+var ClaudeRuntimeAdapter, claudeAdapter;
+var init_adapter2 = __esm({
+  "src/adapters/claude/adapter.ts"() {
+    "use strict";
+    init_deny();
+    init_hook();
+    init_repo_context();
+    init_contract();
+    ClaudeRuntimeAdapter = class {
+      name = "claude-code";
+      /**
+       * Claude Code's live PreToolUse fires for EVERY tool and can synchronously deny it —
+       * shell, file edit, file read, MCP, and anything else — even under
+       * `--dangerously-skip-permissions`. The end-of-turn Stop sweep is live too. There is no
+       * live per-tool PostToolUse veto (Stop is the post-turn reconciliation), so `postObserve`
+       * is empty and `unsupported` names that gap explicitly rather than implying it.
+       */
+      capabilities = {
+        preDeny: OPERATION_KINDS,
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "per-operation post-action veto (end-of-turn Stop sweep is the post-turn reconciliation)",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        try {
+          return eventFrom(parseInput(raw), phase);
+        } catch (e) {
+          if (e instanceof HookInputError) return { failure: "parse-failure", detail: e.message };
+          throw e;
+        }
+      }
+      /**
+       * REVIEW POINT 5 — the runtime cwd is a CLAIM, not authority.
+       *
+       * The trusted repository root is derived from the RUNNER context (`defaultCwd`, else the
+       * process cwd) — INDEPENDENTLY of the claim — via git (`repoContext` →
+       * `git rev-parse --show-toplevel`, which resolves symlinks to a canonical path). The
+       * claim is then validated against THAT root with the shared `validateClaimAgainstRoot`:
+       * accepted only when it resolves to the same repository (its root, or a path inside it);
+       * rejected for a malformed path, a non-repository, a different repository, or a symlink
+       * that escapes into another repository. It never weakens what `preToolUseVerdict` does via
+       * `repoRoot()` — it is the explicit boundary that `decide` enforces BEFORE evaluating.
+       */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      /** The exact deny wire bytes for `phase`, through the SAME `denyWire` the live
+       *  `verdict()` uses (src/cli/hook.ts). Reuses `formatDenial`, so the reason text is
+       *  identical to the live path. Byte-for-byte equal to what a live deny emits. */
+      denyPayload(findings, phase) {
+        return denyWire(formatDenial(findings), hookKindFor(phase));
+      }
+      /**
+       * The authoritative synchronous path, enforced in order: parse → validate identity →
+       * decide. Each step that fails does so CLOSED (deny), except `post-action`, which is
+       * observation-only and returns `unsupported` (never a deny wire, never a PreToolUse
+       * fallthrough — BLOCKER 2).
+       *
+       *  1. `post-action` → `unsupported` (Claude has no per-tool post-action veto).
+       *  2. parse failure → `parse-failure`, byte-identical to the live fail-closed deny.
+       *  3. identity claim rejected → a fail-closed DENY, BEFORE any content evaluation, so a
+       *     runtime-supplied cwd pointing at another repository can never reach the detectors.
+       *  4. otherwise → delegate to the canonical `preToolUseFromRaw` / `stopFromRaw`, PASSING
+       *     the validated trusted root so the live path re-runs the same shared identity check.
+       *     `wire` is byte-identical to the live CLI — every deny/allow decision, the fail-closed
+       *     wrapping, repo-root resolution (#412), the turn baseline and the transport remain
+       *     exactly as src/cli/hook.ts computes them.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Claude Code has no per-tool post-action veto; the end-of-turn Stop sweep is its post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const live2 = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd) : preToolUseFromRaw(raw, defaultCwd);
+          return {
+            outcome: "parse-failure",
+            detail: parsed.detail,
+            wire: live2.stdout,
+            decision: { verdict: "deny", findings: [], reason: live2.stdout }
+          };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire2 = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire2 } };
+        }
+        const live = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd, idv.trustedRoot) : preToolUseFromRaw(raw, defaultCwd, idv.trustedRoot);
+        const wire = live.stdout;
+        const denied = wire.length > 0;
+        return {
+          outcome: "ok",
+          wire,
+          decision: { verdict: denied ? "deny" : "allow", findings: [], reason: denied ? wire : void 0 }
+        };
+      }
+      /**
+       * Map a transport failure (or a required hook that did not fire) onto a fail-closed
+       * DENY at the neutral seam. Claude's LIVE client additionally degrades a hook-service
+       * transport failure to the in-process verdict (src/cli/index.ts / hook-client.ts) rather
+       * than surfacing it here, so this method documents the contract guarantee for the seam;
+       * a partial adapter with no in-process fallback denies through exactly this path.
+       */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    claudeAdapter = new ClaudeRuntimeAdapter();
+  }
+});
+
+// src/adapters/apply-patch.ts
+import { isAbsolute as isAbsolute14, relative as relative9 } from "node:path";
+function readDisk2(path) {
+  return textOf2(inspectResolved(path));
+}
+function relForDisplay2(path, cwd) {
+  const rel = relative9(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute14(rel) ? rel : path;
+}
+function parsePatchSections(patch) {
+  const lines = patch.replace(/\r\n/g, "\n").split("\n");
+  let i = 0;
+  while (i < lines.length && !/^\*\*\* Begin Patch/.test(lines[i])) i++;
+  if (i >= lines.length) throw new Error('apply_patch payload has no "*** Begin Patch" header');
+  i++;
+  const sections = [];
+  let current = null;
+  const flush = () => {
+    if (current) sections.push(current);
+    current = null;
+  };
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\*\*\* End Patch/.test(line)) {
+      flush();
+      return sections;
+    }
+    const add = /^\*\*\* Add File: (.*)$/.exec(line);
+    const upd = /^\*\*\* Update File: (.*)$/.exec(line);
+    const del = /^\*\*\* Delete File: (.*)$/.exec(line);
+    const move = /^\*\*\* Move to: (.*)$/.exec(line);
+    if (add) {
+      flush();
+      current = { op: "add", path: add[1].trim(), body: [] };
+    } else if (upd) {
+      flush();
+      current = { op: "update", path: upd[1].trim(), body: [] };
+    } else if (del) {
+      flush();
+      current = { op: "delete", path: del[1].trim(), body: [] };
+    } else if (move && current) {
+      current.moveTo = move[1].trim();
+    } else if (current) {
+      current.body.push(line);
+    }
+  }
+  throw new Error('apply_patch payload is missing its "*** End Patch" trailer');
+}
+function addedContent(body) {
+  return body.filter((l) => l.startsWith("+")).map((l) => l.slice(1)).join("\n");
+}
+function applyUpdate(before, body) {
+  const lines = before.split("\n");
+  const hunks = [];
+  let hunk = [];
+  for (const l of body) {
+    if (l.startsWith("@@")) {
+      if (hunk.length) hunks.push(hunk);
+      hunk = [];
+      continue;
+    }
+    hunk.push(l);
+  }
+  if (hunk.length) hunks.push(hunk);
+  let cursor = 0;
+  for (const h of hunks) {
+    const oldBlock = [];
+    const newBlock = [];
+    for (const l of h) {
+      if (l === "") {
+        oldBlock.push("");
+        newBlock.push("");
+      } else if (l.startsWith(" ")) {
+        oldBlock.push(l.slice(1));
+        newBlock.push(l.slice(1));
+      } else if (l.startsWith("-")) {
+        oldBlock.push(l.slice(1));
+      } else if (l.startsWith("+")) {
+        newBlock.push(l.slice(1));
+      } else {
+        return null;
+      }
+    }
+    if (oldBlock.length === 0) return null;
+    let at = -1;
+    for (let s = cursor; s <= lines.length - oldBlock.length; s++) {
+      let ok = true;
+      for (let k = 0; k < oldBlock.length; k++) {
+        if (lines[s + k] !== oldBlock[k]) {
+          ok = false;
+          break;
+        }
+      }
+      if (ok) {
+        at = s;
+        break;
+      }
+    }
+    if (at < 0) return null;
+    lines.splice(at, oldBlock.length, ...newBlock);
+    cursor = at + newBlock.length;
+  }
+  return lines.join("\n");
+}
+function applyPatchChanges(patch, abs, cwd) {
+  const out3 = [];
+  for (const section of parsePatchSections(patch)) {
+    const targetRel = relForDisplay2(abs(section.moveTo ?? section.path), cwd);
+    if (section.op === "add") {
+      out3.push(...synthFileChange(targetRel, null, addedContent(section.body)));
+    } else if (section.op === "delete") {
+      out3.push(...synthFileChange(targetRel, readDisk2(abs(section.path)), null));
+    } else {
+      const before = readDisk2(abs(section.path));
+      const after = applyUpdate(before ?? "", section.body);
+      if (after === null) {
+        throw new Error(
+          `cannot reconstruct the apply_patch update to ${section.path}: its hunks did not locate against the file on disk`
+        );
+      }
+      const synth = synthFileChange(targetRel, before, after);
+      if (section.moveTo && section.moveTo !== section.path) {
+        out3.push(...synth.map((c) => ({ ...c, op: "rename", oldPath: relForDisplay2(abs(section.path), cwd) })));
+      } else {
+        out3.push(...synth);
+      }
+    }
+  }
+  return out3;
+}
+var init_apply_patch = __esm({
+  "src/adapters/apply-patch.ts"() {
+    "use strict";
+    init_changes();
+    init_disk();
+  }
+});
+
+// src/adapters/codex/changes.ts
+import { isAbsolute as isAbsolute15, relative as relative10, resolve as resolve20 } from "node:path";
+function asStr2(v) {
+  return typeof v === "string" ? v : "";
+}
+function readDisk3(path) {
+  return textOf2(inspectResolved(path));
+}
+function relForDisplay3(path, cwd) {
+  const rel = relative10(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute15(rel) ? rel : path;
+}
+function shellChanges(args) {
+  const cmd = args.command ?? args.argv;
+  if (Array.isArray(cmd)) {
+    const argv = cmd.map(asStr2).filter((s) => s.length > 0);
+    if (!argv.length) throw new Error("shell event carries no command/argv to reconstruct");
+    return [{ kind: "command", raw: argv.join(" "), argv }];
+  }
+  const raw = asStr2(cmd);
+  if (!raw) throw new Error("shell event carries no command to reconstruct");
+  return [{ kind: "command", raw, argv: raw.split(/\s+/) }];
+}
+function changesFromCodex(operation, cwd, base = cwd) {
+  const args = operation.args ?? {};
+  const abs = (path) => resolve20(base, path);
+  if (operation.kind === "shell") return shellChanges(args);
+  if (operation.kind !== "file-edit") return [];
+  if (operation.name === "apply_patch" || operation.name === "patch") {
+    const patch = asStr2(args.command) || asStr2(args.patch) || asStr2(args.input);
+    if (!patch) throw new Error("apply_patch event carries no command/patch/input to reconstruct");
+    return applyPatchChanges(patch, abs, cwd);
+  }
+  const fp = asStr2(args.path) || asStr2(args.file_path);
+  if (!fp) throw new Error(`${operation.name || "file-edit"} event carries no path to reconstruct`);
+  const before = readDisk3(abs(fp));
+  const old = args.old_string ?? args.old_str ?? args.old;
+  const next = args.new_string ?? args.new_str ?? args.new;
+  if (typeof old === "string" || typeof next === "string") {
+    const after = applyEdit(before, asStr2(old), asStr2(next), args.replace_all === true);
+    return synthFileChange(relForDisplay3(abs(fp), cwd), before, after);
+  }
+  const content = args.content ?? args.text;
+  if (typeof content === "string") {
+    return synthFileChange(relForDisplay3(abs(fp), cwd), before, content);
+  }
+  throw new Error(`${operation.name || "file-edit"} event for ${fp} carries no old_string/new_string/content to reconstruct`);
+}
+var init_changes2 = __esm({
+  "src/adapters/codex/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_apply_patch();
+    init_disk();
+  }
+});
+
+// src/adapters/codex/deny.ts
+function assertCodexWirePhase(phase) {
+  if (phase !== "pre-action" && phase !== "end-of-turn") {
+    throw new Error(`unsupported Codex wire phase: ${phase}`);
+  }
+}
+function codexWire(reason, phase) {
+  assertCodexWirePhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : {
+    hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+    decision: "block",
+    reason
+  };
+  return JSON.stringify(payload) + "\n";
+}
+function codexDenyWire(findings, phase) {
+  assertCodexWirePhase(phase);
+  if (findings.length === 0) return "";
+  return codexWire(formatDenial(findings), phase);
+}
+var init_deny2 = __esm({
+  "src/adapters/codex/deny.ts"() {
+    "use strict";
+    init_deny();
+  }
+});
+
+// src/adapters/codex/schema.ts
+function codexOperationKind(toolName) {
+  if (!toolName) return "other";
+  if (SHELL_TOOLS.has(toolName)) return "shell";
+  if (FILE_EDIT_TOOLS.has(toolName)) return "file-edit";
+  if (toolName.startsWith(MCP_PREFIX)) return "mcp";
+  if (FILE_READ_TOOLS.has(toolName)) return "file-read";
+  return "other";
+}
+function inputFrom(parsed) {
+  return {
+    ...typeof parsed.hook_event_name === "string" ? { hook_event_name: parsed.hook_event_name } : {},
+    ...typeof parsed.tool_name === "string" ? { tool_name: parsed.tool_name } : {},
+    ...isRecord(parsed.tool_input) ? { tool_input: parsed.tool_input } : {},
+    ...typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {},
+    ...typeof parsed.session_id === "string" ? { session_id: parsed.session_id } : {},
+    ...typeof parsed.stop_hook_active === "boolean" ? { stop_hook_active: parsed.stop_hook_active } : {}
+  };
+}
+function eventFrom2(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: codexOperationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  const identity2 = { claimedCwd: input.cwd, sessionId: input.session_id };
+  return { phase, operation, identity: identity2 };
+}
+function normalizeCodexEvent(raw, phase) {
+  if (!raw.trim()) return eventFrom2({}, phase);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { failure: "parse-failure", detail: `the Codex hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!isRecord(parsed)) {
+    return {
+      failure: "parse-failure",
+      detail: `the Codex hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})`
+    };
+  }
+  return eventFrom2(inputFrom(parsed), phase);
+}
+var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, MCP_PREFIX;
+var init_schema = __esm({
+  "src/adapters/codex/schema.ts"() {
+    "use strict";
+    init_narrow();
+    SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+    FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Write", "Edit"]);
+    FILE_READ_TOOLS = /* @__PURE__ */ new Set(["view_image"]);
+    MCP_PREFIX = "mcp__";
+  }
+});
+
+// src/adapters/codex/adapter.ts
+var POST_OBSERVE, CodexRuntimeAdapter, codexAdapter;
+var init_adapter3 = __esm({
+  "src/adapters/codex/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes2();
+    init_deny2();
+    init_schema();
+    POST_OBSERVE = ["shell", "file-edit", "file-read", "mcp", "other"];
+    CodexRuntimeAdapter = class {
+      name = "codex";
+      /**
+       * CONSERVATIVE and honest. Pre-action deny ENFORCEMENT is not yet proven on a pinned
+       * Codex build, so `preDeny` is empty — the adapter never claims a synchronous veto it
+       * cannot demonstrate. Codex does surface post-execution tool outcomes and an end-of-turn
+       * stop, so those are declared; every real gap is named in `unsupported`. The
+       * `probe:codex-runtime` harness is what may later justify moving a kind into `preDeny`.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: POST_OBSERVE,
+        endOfTurn: true,
+        unsupported: [
+          "pre-action deny enforcement not yet proven on a pinned Codex build (see probe:codex-runtime)",
+          "fail-closed hook transport not yet proven (openai/codex#41979)",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCodexEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the Claude adapter does.
+       *  It never weakens the shared check. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Codex post-action is observation-only and cannot produce a deny wire");
+        }
+        return codexDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *
+       *  1. `post-action` → `unsupported` (observation-only; never a deny wire).
+       *  2. parse failure → a fail-closed deny in Codex's wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, re-wrapped in Codex's wire.
+       *  5. `pre-action` → reconstruct Change[] and run the SAME `evaluate` engine; a deny
+       *     carries the shared denial reason. A reconstruction that cannot be modelled fails
+       *     CLOSED to deny rather than allowing an unseen edit.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Codex post-action is observation-only; the end-of-turn Stop sweep is the post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Codex event: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const wire = stopFromRaw(raw, defaultCwd, idv.trustedRoot).stdout;
+          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+        }
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          turnBaseline(root, parsed.identity.sessionId);
+          const policy = loadPolicy(root);
+          const changes = changesFromCodex(parsed.operation, root, sessionCwd);
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required hook that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is Codex's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    codexAdapter = new CodexRuntimeAdapter();
+  }
+});
+
+// src/adapters/copilot/changes.ts
+import { isAbsolute as isAbsolute16, relative as relative11, resolve as resolve21 } from "node:path";
+function asStr3(v) {
+  return typeof v === "string" ? v : "";
+}
+function readDisk4(path) {
+  return textOf2(inspectResolved(path));
+}
+function relForDisplay4(path, cwd) {
+  const rel = relative11(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute16(rel) ? rel : path;
+}
+function shellChanges2(args) {
+  const cmd = args.command ?? args.input ?? args.argv;
+  if (Array.isArray(cmd)) {
+    const argv = cmd.map(asStr3).filter((s) => s.length > 0);
+    if (!argv.length) throw new Error("shell event carries no command/input/argv to reconstruct");
+    return [{ kind: "command", raw: argv.join(" "), argv }];
+  }
+  const raw = asStr3(cmd);
+  if (!raw) throw new Error("shell event carries no command/input to reconstruct");
+  return [{ kind: "command", raw, argv: raw.split(/\s+/) }];
+}
+function changesFromCopilot(operation, cwd, base = cwd) {
+  const args = operation.args ?? {};
+  const abs = (path) => resolve21(base, path);
+  if (operation.kind === "shell") return shellChanges2(args);
+  if (operation.kind !== "file-edit") return [];
+  const name = (operation.name || "").toLowerCase();
+  if (name === "apply_patch") {
+    const patch = asStr3(args.input) || asStr3(args.patch) || asStr3(args.command);
+    if (!patch) throw new Error("apply_patch event carries no input/patch/command to reconstruct");
+    return applyPatchChanges(patch, abs, cwd);
+  }
+  const fp = asStr3(args.path) || asStr3(args.file_path) || asStr3(args.filename);
+  if (!fp) throw new Error(`${operation.name || "file-edit"} event carries no path to reconstruct`);
+  const before = readDisk4(abs(fp));
+  const display2 = relForDisplay4(abs(fp), cwd);
+  if (name === "str_replace_editor") {
+    const old2 = args.old_str ?? args.old_string ?? args.old;
+    const next2 = args.new_str ?? args.new_string ?? args.new;
+    if (typeof old2 === "string" || typeof next2 === "string") {
+      return synthFileChange(display2, before, applyEdit(before, asStr3(old2), asStr3(next2), args.replace_all === true));
+    }
+    const fileText = args.file_text ?? args.content ?? args.text;
+    if (typeof fileText === "string") return synthFileChange(display2, before, fileText);
+    throw new Error(
+      `str_replace_editor sub-op "${asStr3(args.command) || "unknown"}" for ${fp} cannot be reconstructed exactly (only str_replace/create are modelled; others fail closed pending a real payload)`
+    );
+  }
+  if (Array.isArray(args.edits)) {
+    let after = before;
+    for (const raw of args.edits) {
+      const ed = isRecord(raw) ? raw : {};
+      after = applyEdit(after, asStr3(ed.old_string ?? ed.old_str), asStr3(ed.new_string ?? ed.new_str), ed.replace_all === true);
+    }
+    return synthFileChange(display2, before, after);
+  }
+  const old = args.old_string ?? args.old_str ?? args.old;
+  const next = args.new_string ?? args.new_str ?? args.new;
+  if (typeof old === "string" || typeof next === "string") {
+    return synthFileChange(display2, before, applyEdit(before, asStr3(old), asStr3(next), args.replace_all === true));
+  }
+  const content = args.content ?? args.text ?? args.file_text;
+  if (typeof content === "string") return synthFileChange(display2, before, content);
+  throw new Error(
+    `${operation.name || "file-edit"} event for ${fp} carries no old_string/new_string/content to reconstruct`
+  );
+}
+var init_changes3 = __esm({
+  "src/adapters/copilot/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_apply_patch();
+    init_disk();
+    init_narrow();
+  }
+});
+
+// src/adapters/copilot/deny.ts
+function assertCopilotWirePhase(phase) {
+  const known = ["pre-action", "end-of-turn"];
+  if (!known.includes(phase)) {
+    throw new Error(`unsupported Copilot wire phase: ${phase}`);
+  }
+}
+function copilotWire(reason, phase) {
+  assertCopilotWirePhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : { permissionDecision: "deny", permissionDecisionReason: reason };
+  return JSON.stringify(payload) + "\n";
+}
+function copilotDenyWire(findings, phase) {
+  assertCopilotWirePhase(phase);
+  if (findings.length === 0) return "";
+  return copilotWire(formatDenial(findings), phase);
+}
+var init_deny3 = __esm({
+  "src/adapters/copilot/deny.ts"() {
+    "use strict";
+    init_deny();
+  }
+});
+
+// src/adapters/copilot/schema.ts
+function copilotOperationKind(toolName) {
+  if (!toolName) return "other";
+  const name = toolName.toLowerCase();
+  if (SHELL_TOOLS2.has(name)) return "shell";
+  if (FILE_EDIT_TOOLS2.has(name)) return "file-edit";
+  if (name.startsWith(MCP_PREFIX2)) return "mcp";
+  if (FILE_READ_TOOLS2.has(name)) return "file-read";
+  return "other";
+}
+function argsFrom(parsed) {
+  if (isRecord(parsed.tool_input)) return parsed.tool_input;
+  const ta = parsed.toolArgs;
+  if (isRecord(ta)) return ta;
+  if (typeof ta === "string" && ta.trim()) {
+    try {
+      const decoded = JSON.parse(ta);
+      return isRecord(decoded) ? decoded : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function inputFrom2(parsed) {
+  const toolName = typeof parsed.tool_name === "string" ? parsed.tool_name : typeof parsed.toolName === "string" ? parsed.toolName : void 0;
+  const sessionId = typeof parsed.session_id === "string" ? parsed.session_id : typeof parsed.sessionId === "string" ? parsed.sessionId : void 0;
+  const args = argsFrom(parsed);
+  return {
+    ...toolName !== void 0 ? { tool_name: toolName } : {},
+    ...args !== void 0 ? { tool_input: args } : {},
+    ...typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {},
+    ...sessionId !== void 0 ? { session_id: sessionId } : {},
+    ...typeof parsed.stop_hook_active === "boolean" ? { stop_hook_active: parsed.stop_hook_active } : {}
+  };
+}
+function eventFrom3(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotOperationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  const identity2 = { claimedCwd: input.cwd, sessionId: input.session_id };
+  return { phase, operation, identity: identity2 };
+}
+function parseRaw(raw) {
+  if (!raw.trim()) return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { kind: "fail", detail: `the Copilot hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!isRecord(parsed)) {
+    return { kind: "fail", detail: `the Copilot hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})` };
+  }
+  return { kind: "ok", record: parsed };
+}
+function normalizeCopilotEvent(raw, phase) {
+  const parsed = parseRaw(raw);
+  if (parsed.kind === "absent") return eventFrom3({}, phase);
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  return eventFrom3(inputFrom2(parsed.record), phase);
+}
+function copilotStopInput(raw) {
+  const parsed = parseRaw(raw);
+  if (parsed.kind === "absent") return "{}";
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  const input = inputFrom2(parsed.record);
+  return JSON.stringify({
+    ...input.cwd !== void 0 ? { cwd: input.cwd } : {},
+    ...input.session_id !== void 0 ? { session_id: input.session_id } : {},
+    ...input.stop_hook_active !== void 0 ? { stop_hook_active: input.stop_hook_active } : {}
+  });
+}
+var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, MCP_PREFIX2;
+var init_schema2 = __esm({
+  "src/adapters/copilot/schema.ts"() {
+    "use strict";
+    init_narrow();
+    SHELL_TOOLS2 = /* @__PURE__ */ new Set(["bash", "powershell", "write_bash", "write_powershell"]);
+    FILE_EDIT_TOOLS2 = /* @__PURE__ */ new Set(["create", "edit", "write", "multiedit", "apply_patch", "str_replace_editor"]);
+    FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read"]);
+    MCP_PREFIX2 = "mcp__";
+  }
+});
+
+// src/adapters/copilot/adapter.ts
+var CopilotRuntimeAdapter, copilotAdapter;
+var init_adapter4 = __esm({
+  "src/adapters/copilot/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes3();
+    init_deny3();
+    init_schema2();
+    CopilotRuntimeAdapter = class {
+      name = "github-copilot-cli";
+      /**
+       * CONSERVATIVE and honest. Pre-action deny ENFORCEMENT is not yet proven on a pinned
+       * Copilot CLI build, so `preDeny` is empty — the adapter never claims a synchronous veto
+       * it has not demonstrated on the real runtime. `postObserve` is empty for milestone one:
+       * Copilot does expose a `postToolUse` observation surface, but this adapter does not yet
+       * consume it as a supported post-action path (`decide(..., 'post-action')` returns
+       * `unsupported`), so it declares no post-observe capability rather than advertising kinds it
+       * does not report. Every real gap is named in `unsupported`. The `probe:copilot-runtime`
+       * harness is what may later justify moving a kind into `preDeny` or populating `postObserve`.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "pre-action deny enforcement not yet proven on a pinned Copilot CLI build (see probe:copilot-runtime)",
+          "COMMAND preToolUse hook timeout fails OPEN on Copilot CLI: a timed-out hook lets the tool call proceed (crash / non-zero exit / exit 2 fail closed); an HTTP preToolUse hook fails OPEN on network error / timeout / non-2xx, so only the local command/exec transport is a qualification candidate",
+          "preToolUse is the only PRE-EXECUTION tool veto; agentStop can only block turn completion and force continuation (a lifecycle control, not a filesystem veto), and Copilot overrides the hook after 8 consecutive blocks (stop_hook_active lifecycle); postToolUse observation is not yet consumed by this adapter",
+          "apply_patch / str_replace_editor exact hook payloads are modelled from the published contract but not yet confirmed against a pinned real-run fixture (str_replace_editor sub-ops other than str_replace/create fail closed); a PascalCase Edit carrying a patch-style payload fails closed unless a fixture proves the Edit-field rewrite",
+          "shell-session write tools (write_bash / write_powershell) are classified as mutation-capable shell ops; their exact hook payload is not yet confirmed against a pinned fixture, so an event carrying no reconstructable command/input fails closed",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCopilotEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the Claude and Codex
+       *  adapters do. It never weakens the shared check. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return {
+            ok: false,
+            rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against`
+          };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Copilot post-action is observation-only and cannot produce a deny wire");
+        }
+        return copilotDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *
+       *  1. `post-action` → `unsupported` (observation-only; never a deny wire).
+       *  2. parse failure → a fail-closed deny in Copilot's wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, whose wire is already Copilot's
+       *     agentStop `{decision:"block",reason}` shape and passes through unchanged.
+       *  5. `pre-action` → reconstruct Change[] and run the SAME `evaluate` engine; a deny
+       *     carries the shared denial reason. A reconstruction that cannot be modelled fails
+       *     CLOSED to deny rather than allowing an unseen edit.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Copilot post-action is observation-only; the end-of-turn agentStop sweep is the post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const stopInput = copilotStopInput(raw);
+          if (typeof stopInput !== "string") {
+            const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
+            const wire2 = this.denyPayload(findings, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire: wire2, decision: { verdict: "deny", findings, reason: wire2 } };
+          }
+          const wire = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot).stdout;
+          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+        }
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          turnBaseline(root, parsed.identity.sessionId);
+          const policy = loadPolicy(root);
+          const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required hook that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is Copilot's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    copilotAdapter = new CopilotRuntimeAdapter();
+  }
+});
+
+// src/adapters/copilot-sdk/changes.ts
+import { execFileSync as execFileSync15 } from "node:child_process";
+import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync15, readFileSync as readFileSync28, rmSync as rmSync13, existsSync as existsSync21, realpathSync as realpathSync11 } from "node:fs";
+import { tmpdir as tmpdir8 } from "node:os";
+import { basename as basename6, dirname as dirname14, isAbsolute as isAbsolute17, relative as relative12, resolve as resolve22, join as join29 } from "node:path";
+function asStr4(v) {
+  return typeof v === "string" ? v : "";
+}
+function relForDisplay5(path, cwd) {
+  const rel = relative12(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute17(rel) ? rel : path;
+}
+function canonicalContainedTarget(abs, root) {
+  let realRoot;
+  try {
+    realRoot = realpathSync11(root);
+  } catch (e) {
+    throw new Error(`trusted repository root ${root} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  let dir = abs;
+  const tail = [];
+  while (!existsSync21(dir)) {
+    const parent = dirname14(dir);
+    if (parent === dir) break;
+    tail.unshift(basename6(dir));
+    dir = parent;
+  }
+  let realDir;
+  try {
+    realDir = realpathSync11(dir);
+  } catch (e) {
+    throw new Error(`write target ${abs} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const real = tail.length ? join29(realDir, ...tail) : realDir;
+  const rel = relative12(realRoot, real);
+  if (rel === "" || rel.startsWith("..") || isAbsolute17(rel)) {
+    throw new Error(`write target ${abs} resolves outside the trusted repository root ${realRoot} \u2014 refusing to judge a write beyond the repository`);
+  }
+  return { real, rel };
+}
+function sdkFileEditChanges(args, cwd, base = cwd) {
+  const path = asStr4(args.path) || asStr4(args.fileName) || asStr4(args.file_path);
+  if (!path) throw new Error("write event carries no fileName/path to reconstruct");
+  const abs = resolve22(base, path);
+  const canonical2 = canonicalContainedTarget(abs, cwd);
+  const claimedResolved = asStr4(args.resolvedPath);
+  if (claimedResolved && canonicalContainedTarget(resolve22(base, claimedResolved), cwd).real !== canonical2.real) {
+    throw new Error(`the runtime-claimed resolvedPath (${claimedResolved}) does not match the host-derived target for ${path} \u2014 refusing to judge a different path`);
+  }
+  const display2 = canonical2.rel;
+  const requestRel = relForDisplay5(abs, cwd);
+  const entry = inspectResolved(canonical2.real);
+  const isCreate = entry.kind === "absent";
+  const before = textOf2(entry);
+  if (!isCreate && before === null) {
+    throw new Error(`write target ${display2} exists but cannot be read to judge it (${entry.kind})`);
+  }
+  const newFileContents = typeof args.newFileContents === "string" ? args.newFileContents : void 0;
+  const rawDiff = asStr4(args.diff);
+  const afterFromDiff = rawDiff.trim() ? reconstructAfterViaGit(rawDiff, requestRel, before, isCreate) : void 0;
+  if (newFileContents !== void 0) {
+    if (afterFromDiff !== void 0 && afterFromDiff !== newFileContents) {
+      throw new Error(`write supplies both newFileContents and a diff that DISAGREE for ${display2}; ambiguous request \u2014 refusing to judge only one representation`);
+    }
+    return synthFileChange(display2, before, newFileContents);
+  }
+  if (afterFromDiff !== void 0) return synthFileChange(display2, before, afterFromDiff);
+  return null;
+}
+function stripPrefix(p) {
+  return /^[ab]\//.test(p) ? p.slice(2) : p;
+}
+function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
+  const bytes = Buffer.byteLength(rawDiff);
+  if (bytes > DIFF_MAX_BYTES()) throw new Error(`write diff for ${display2} is ${bytes} bytes (over the ${DIFF_MAX_BYTES()}-byte reconstruction budget)`);
+  const { op, patch } = canonicalPatch(rawDiff, display2, isCreate);
+  const dir = mkdtempSync7(join29(tmpdir8(), "hf-sdk-apply-"));
+  try {
+    const targetPath = join29(dir, TARGET);
+    if (op !== "create") writeFileSync15(targetPath, before ?? "");
+    const patchPath = join29(dir, "change.patch");
+    writeFileSync15(patchPath, patch);
+    const git8 = (extra) => execFileSync15("git", ["apply", ...extra, patchPath], {
+      cwd: dir,
+      encoding: "utf8",
+      timeout: APPLY_TIMEOUT_MS(),
+      maxBuffer: APPLY_MAXBUFFER(),
+      killSignal: "SIGKILL"
+    });
+    const stat = git8(["--numstat"]).trim();
+    const rows = stat ? stat.split("\n") : [];
+    if (rows.length !== 1) throw new Error(`write diff spans ${rows.length} files; a single permission target (${display2}) was expected`);
+    const statPath = rows[0].split("	")[2];
+    if (statPath !== TARGET) throw new Error(`write diff reconstructs a different file (${statPath}) than the bound target`);
+    git8(["--check"]);
+    git8([]);
+    return op === "delete" ? null : readFileSync28(targetPath, "utf8");
+  } catch (e) {
+    throw new Error(`could not reconstruct the write to ${display2} from its diff via git apply: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    rmSync13(dir, { recursive: true, force: true });
+  }
+}
+function canonicalPatch(raw, display2, isCreate) {
+  const lines = raw.replace(/\r\n/g, "\n").split("\n");
+  if (lines.length > DIFF_MAX_LINES()) {
+    throw new Error(`write diff for ${display2} is ${lines.length} lines (over the ${DIFF_MAX_LINES()}-line reconstruction budget)`);
+  }
+  const at = lines.findIndex((l) => l.startsWith("@@ "));
+  if (at < 0) throw new Error(`write diff for ${display2} has no hunk to reconstruct`);
+  const header = lines.slice(0, at);
+  const body = lines.slice(at);
+  let src;
+  let dst;
+  let hasGitLine = false;
+  let sawCreateMode = false;
+  let sawDeleteMode = false;
+  let sawSemanticHeader = false;
+  for (const line of header) {
+    if (line.trim() === "") continue;
+    if (line.startsWith("diff --git ")) {
+      if (hasGitLine) throw new Error(`write diff for ${display2} carries more than one diff --git header (contradictory / multi-file) \u2014 refusing to reconstruct`);
+      hasGitLine = true;
+      sawSemanticHeader = true;
+      for (const p of line.slice("diff --git ".length).trim().split(/\s+/)) assertBound(stripPrefix(p), display2);
+    } else if (line.startsWith("--- ")) {
+      if (src !== void 0) throw new Error(`write diff for ${display2} carries more than one --- endpoint (contradictory header) \u2014 refusing to reconstruct`);
+      src = line.slice(4).split("	")[0].trim();
+    } else if (line.startsWith("+++ ")) {
+      if (dst !== void 0) throw new Error(`write diff for ${display2} carries more than one +++ endpoint (contradictory header) \u2014 refusing to reconstruct`);
+      dst = line.slice(4).split("	")[0].trim();
+    } else if (line.startsWith("index ")) {
+      sawSemanticHeader = true;
+    } else if (/^new file mode\b/.test(line)) {
+      if (sawCreateMode) throw new Error(`write diff for ${display2} carries duplicate new file mode metadata \u2014 refusing to reconstruct`);
+      sawCreateMode = true;
+      sawSemanticHeader = true;
+    } else if (/^deleted file mode\b/.test(line)) {
+      if (sawDeleteMode) throw new Error(`write diff for ${display2} carries duplicate deleted file mode metadata \u2014 refusing to reconstruct`);
+      sawDeleteMode = true;
+      sawSemanticHeader = true;
+    } else {
+      throw new Error(`write diff for ${display2} carries an unsupported or unrecognized pre-hunk header line ("${line.trim().slice(0, 60)}") \u2014 refusing to reconstruct`);
+    }
+  }
+  let op;
+  if (src === void 0 && dst === void 0) {
+    if (sawSemanticHeader) throw new Error(`write diff for ${display2} carries Git file metadata but no --- / +++ endpoints (malformed)`);
+    op = isCreate ? "create" : "modify";
+  } else if (src !== void 0 && dst !== void 0) {
+    const srcNull = src === "/dev/null";
+    const dstNull = dst === "/dev/null";
+    if (srcNull && dstNull) throw new Error(`write diff for ${display2} has /dev/null on both sides`);
+    if (!srcNull) assertBound(stripPrefix(src), display2);
+    if (!dstNull) assertBound(stripPrefix(dst), display2);
+    op = srcNull ? "create" : dstNull ? "delete" : "modify";
+  } else {
+    throw new Error(`write diff for ${display2} has a one-sided --- / +++ endpoint pair (malformed) \u2014 refusing to repair it into a valid operation`);
+  }
+  if (sawCreateMode && op !== "create") throw new Error(`write diff for ${display2} carries new file mode metadata but its endpoints describe a ${op} \u2014 contradictory, refusing to reconstruct`);
+  if (sawDeleteMode && op !== "delete") throw new Error(`write diff for ${display2} carries deleted file mode metadata but its endpoints describe a ${op} \u2014 contradictory, refusing to reconstruct`);
+  if (op === "create" && !isCreate) throw new Error(`write diff for ${display2} proposes a create but the target already exists`);
+  if (op !== "create" && isCreate) throw new Error(`write diff for ${display2} proposes a ${op} but the target is absent`);
+  const source = op === "create" ? "/dev/null" : `a/${TARGET}`;
+  const dest = op === "delete" ? "/dev/null" : `b/${TARGET}`;
+  const joined = body.join("\n");
+  const patch = `--- ${source}
++++ ${dest}
+` + (joined.endsWith("\n") ? joined : joined + "\n");
+  return { op, patch };
+}
+function assertBound(declared, display2) {
+  if (declared !== display2) {
+    throw new Error(`write diff path (${declared}) does not match the permission request target (${display2}) \u2014 refusing to judge a different file`);
+  }
+}
+var num2, APPLY_TIMEOUT_MS, APPLY_MAXBUFFER, DIFF_MAX_BYTES, DIFF_MAX_LINES, TARGET;
+var init_changes4 = __esm({
+  "src/adapters/copilot-sdk/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_disk();
+    num2 = (name, fallback) => {
+      const raw = process.env[name];
+      const n2 = raw === void 0 ? NaN : Number(raw);
+      return Number.isFinite(n2) && n2 > 0 ? n2 : fallback;
+    };
+    APPLY_TIMEOUT_MS = () => num2("TAMPERWARD_RECONSTRUCT_TIMEOUT_MS", 5e3);
+    APPLY_MAXBUFFER = () => num2("TAMPERWARD_RECONSTRUCT_MAXBUFFER", 32 * 1024 * 1024);
+    DIFF_MAX_BYTES = () => num2("TAMPERWARD_RECONSTRUCT_MAX_BYTES", 384 * 1024);
+    DIFF_MAX_LINES = () => num2("TAMPERWARD_RECONSTRUCT_MAX_LINES", 4e3);
+    TARGET = "target";
+  }
+});
+
+// src/adapters/copilot-sdk/deny.ts
+function assertPhase(phase) {
+  const known = ["pre-action", "end-of-turn"];
+  if (!known.includes(phase)) throw new Error(`unsupported Copilot SDK wire phase: ${phase}`);
+}
+function copilotSdkWire(reason, phase) {
+  assertPhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : { kind: "reject", feedback: reason };
+  return JSON.stringify(payload) + "\n";
+}
+function copilotSdkDenyWire(findings, phase) {
+  assertPhase(phase);
+  if (findings.length === 0) return "";
+  return copilotSdkWire(formatDenial(findings), phase);
+}
+var init_deny4 = __esm({
+  "src/adapters/copilot-sdk/deny.ts"() {
+    "use strict";
+    init_deny();
+  }
+});
+
+// src/adapters/copilot-sdk/schema.ts
+function copilotSdkOperationKind(kind) {
+  switch ((kind ?? "").toLowerCase()) {
+    case "shell":
+      return "shell";
+    case "write":
+      return "file-edit";
+    case "read":
+      return "file-read";
+    case "mcp":
+      return "mcp";
+    default:
+      return "other";
+  }
+}
+function str3(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function requestFrom2(parsed) {
+  const s = (k) => str3(parsed[k]);
+  return {
+    ...s("kind") !== void 0 ? { kind: s("kind") } : {},
+    ...s("toolName") !== void 0 ? { toolName: s("toolName") } : {},
+    ...s("fileName") !== void 0 ? { fileName: s("fileName") } : {},
+    ...s("resolvedPath") !== void 0 ? { resolvedPath: s("resolvedPath") } : {},
+    ...s("fullCommandText") !== void 0 ? { fullCommandText: s("fullCommandText") } : {},
+    ...s("diff") !== void 0 ? { diff: s("diff") } : {},
+    ...s("newFileContents") !== void 0 ? { newFileContents: s("newFileContents") } : {},
+    ...s("intention") !== void 0 ? { intention: s("intention") } : {},
+    ...s("cwd") !== void 0 ? { cwd: s("cwd") } : {},
+    ...s("sessionId") !== void 0 ? { sessionId: s("sessionId") } : {},
+    ...typeof parsed.stopHookActive === "boolean" ? { stopHookActive: parsed.stopHookActive } : {}
+  };
+}
+function argsFor(req2) {
+  const kind = copilotSdkOperationKind(req2.kind);
+  if (kind === "shell") return req2.fullCommandText !== void 0 ? { command: req2.fullCommandText } : {};
+  if (kind === "file-edit") {
+    return {
+      ...req2.fileName !== void 0 ? { path: req2.fileName } : {},
+      // The SDK's experimental runtime-resolved canonical path. Retained as an UNTRUSTED claim: the
+      // host derives its own canonical target and denies on mismatch — resolvedPath is never authority.
+      ...req2.resolvedPath !== void 0 ? { resolvedPath: req2.resolvedPath } : {},
+      ...req2.diff !== void 0 ? { diff: req2.diff } : {},
+      ...req2.newFileContents !== void 0 ? { newFileContents: req2.newFileContents } : {},
+      ...req2.intention !== void 0 ? { intention: req2.intention } : {}
+    };
+  }
+  return {};
+}
+function eventFrom4(req2, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotSdkOperationKind(req2.kind), name: req2.toolName ?? "", args: argsFor(req2) };
+  const identity2 = { claimedCwd: req2.cwd, sessionId: req2.sessionId };
+  return { phase, operation, identity: identity2 };
+}
+function parseRaw2(raw) {
+  if (!raw.trim()) return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { kind: "fail", detail: `the Copilot SDK permission request is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!isRecord(parsed)) {
+    return { kind: "fail", detail: `the Copilot SDK permission request is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})` };
+  }
+  return { kind: "ok", record: parsed };
+}
+function normalizeCopilotSdkEvent(raw, phase) {
+  const parsed = parseRaw2(raw);
+  if (parsed.kind === "absent") return eventFrom4({}, phase);
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  return eventFrom4(requestFrom2(parsed.record), phase);
+}
+function copilotSdkStopInput(raw) {
+  const parsed = parseRaw2(raw);
+  if (parsed.kind === "absent") return "{}";
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  const req2 = requestFrom2(parsed.record);
+  return JSON.stringify({
+    ...req2.cwd !== void 0 ? { cwd: req2.cwd } : {},
+    ...req2.sessionId !== void 0 ? { session_id: req2.sessionId } : {},
+    ...req2.stopHookActive !== void 0 ? { stop_hook_active: req2.stopHookActive } : {}
+  });
+}
+var init_schema3 = __esm({
+  "src/adapters/copilot-sdk/schema.ts"() {
+    "use strict";
+    init_narrow();
+  }
+});
+
+// src/adapters/copilot-sdk/adapter.ts
+var FILE_EDIT_NO_CONTENT_DETAIL, CopilotSdkHostedAdapter, copilotSdkAdapter;
+var init_adapter5 = __esm({
+  "src/adapters/copilot-sdk/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes3();
+    init_changes4();
+    init_deny4();
+    init_schema3();
+    FILE_EDIT_NO_CONTENT_DETAIL = "this Copilot SDK write surfaced no usable content (no diff, no newFileContents), so content-aware pre-denial cannot be established for this measured configuration; the end-of-turn git sweep is the authority for the landed write. This adapter does not blanket-deny writes.";
+    CopilotSdkHostedAdapter = class {
+      name = "github-copilot-sdk-hosted";
+      /**
+       * CONSERVATIVE and honest. `preDeny` is empty: even shell pre-deny is only a CANDIDATE until the
+       * spike proves, on a pinned SDK, that a rejected/thrown/timed-out permission callback does NOT
+       * dispatch the tool (the decisive unknown #611 must measure). `postObserve` is empty (the SDK has
+       * no post-execution veto). `endOfTurn` is true via `onAgentStop`. Every real gap is named in
+       * `unsupported`, at the granularity #611 asks for.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "shell pre-deny enforcement is only a CANDIDATE until the spike proves on a pinned @github/copilot-sdk that a rejected permission decision actually blocks tool dispatch (see spike:copilot-sdk)",
+          "content-aware file-edit pre-deny is CONDITIONAL on the pinned runtime surfacing usable write content: the adapter reconstructs and content-judges a write carrying a diff / newFileContents, but a write that surfaces neither is unsupported for that measured configuration (allow-through; the end-of-turn sweep is authority) \u2014 never a blanket path deny",
+          "the SDK permission-handler failure semantics (synchronous throw / rejected Promise / timeout) are UNMEASURED: whether a broken decision path fails open (dispatches the tool) or closed is exactly what the spike must establish; a single observed fail-open makes the path ineligible for #482 / Round 4.1",
+          'onAgentStop is a lifecycle continuation control ({decision:"block"} forces another turn, guarded by stopHookActive), not a filesystem veto',
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCopilotSdkEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the other adapters do. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Copilot SDK post-action is observation-only and cannot produce a deny wire");
+        }
+        return copilotSdkDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *  1. `post-action` → `unsupported` (the SDK has no post-execution veto).
+       *  2. parse failure → a fail-closed deny in the SDK reject wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, whose wire is already the SDK
+       *     `onAgentStop` `{decision:"block",reason}` shape.
+       *  5. `pre-action` + shell → the SAME `evaluate` engine over the reconstructed command.
+       *  6. `pre-action` + file-edit → `unsupported` (content not surfaced; sweep is authority).
+       *  7. `pre-action` + read/mcp/other → no Change → allow.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return { outcome: "unsupported", detail: "Copilot SDK has no post-execution veto; the end-of-turn onAgentStop sweep is the post-turn reconciliation." };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Copilot SDK permission request: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, unavailableReason: "parse-failure", decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, unavailableReason: "identity-rejected", decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const stopInput = copilotSdkStopInput(raw);
+          if (typeof stopInput !== "string") {
+            const findings2 = [steeringUnavailableFinding(`unparseable Copilot SDK permission request: ${stopInput.detail}`)];
+            const wire = this.denyPayload(findings2, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire, unavailableReason: "parse-failure", decision: { verdict: "deny", findings: findings2, reason: wire } };
+          }
+          const swept = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
+        }
+        let stage = "repo-context";
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          stage = "baseline";
+          turnBaseline(root, parsed.identity.sessionId);
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          stage = "policy-load";
+          const policy = loadPolicy(root);
+          if (parsed.operation.kind === "file-edit") {
+            stage = "reconstruction";
+            const changes2 = sdkFileEditChanges(parsed.operation.args, root, sessionCwd);
+            if (changes2 === null) return { outcome: "unsupported", detail: FILE_EDIT_NO_CONTENT_DETAIL };
+            stage = "evaluate";
+            const findings2 = evaluate(changes2, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+            const wire2 = this.denyPayload(findings2, "pre-action");
+            return { outcome: "ok", wire: wire2, decision: { verdict: findings2.length ? "deny" : "allow", findings: findings2, reason: wire2 || void 0 } };
+          }
+          stage = "reconstruction";
+          const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
+          stage = "evaluate";
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, unavailableReason: stage, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required callback that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is the SDK's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    copilotSdkAdapter = new CopilotSdkHostedAdapter();
+  }
+});
+
+// src/adapters/registry.ts
+function adapterFor(id) {
+  const name = ADAPTER_ALIASES[id] ?? id;
+  return RUNTIME_ADAPTERS.find((a) => a.name === name) ?? null;
+}
+function labelFor(name) {
+  return ADAPTER_LABELS[name] ?? name;
+}
+var RUNTIME_ADAPTERS, ADAPTER_LABELS, ADAPTER_ALIASES;
+var init_registry = __esm({
+  "src/adapters/registry.ts"() {
+    "use strict";
+    init_adapter2();
+    init_adapter3();
+    init_adapter4();
+    init_adapter5();
+    RUNTIME_ADAPTERS = [
+      claudeAdapter,
+      codexAdapter,
+      copilotAdapter,
+      copilotSdkAdapter
+    ];
+    ADAPTER_LABELS = {
+      "claude-code": "Claude Code",
+      codex: "Codex",
+      "github-copilot-cli": "GitHub Copilot CLI",
+      "github-copilot-sdk-hosted": "GitHub Copilot SDK (hosted)"
+    };
+    ADAPTER_ALIASES = {
+      claude: "claude-code",
+      copilot: "github-copilot-cli",
+      "copilot-cli": "github-copilot-cli",
+      "copilot-sdk": "github-copilot-sdk-hosted"
+    };
+  }
+});
+
+// src/adapters/evidence.ts
+function sameIdSet(a, b) {
+  const ua = [...new Set(a)].sort();
+  const ub = [...new Set(b)].sort();
+  return ua.length === ub.length && ua.every((x, i) => x === ub[i]);
+}
+function evidenceBindingMatches(record, current) {
+  return record.runtime_id === current.runtime_id && record.runtime_version === current.runtime_version && record.model === current.model && record.platform === current.platform && record.execution_mode === current.execution_mode && record.hook_config_hash === current.hook_config_hash && // Pinned SDK/protocol component versions — order-insensitive set comparison.
+  sameIdSet(record.component_versions, current.component_versions) && // The TamperWard build (version+commit): a different TamperWard build is a different binding.
+  record.tamperward_version === current.tamperward_version && // Adapter capability hash — REQUIRED (fail-closed) on both sides. A `null` recorded hash
+  // (unrecoverable, never fabricated) can never equal a concrete current hash.
+  record.adapter_capability_hash !== null && current.adapter_capability_hash !== null && record.adapter_capability_hash === current.adapter_capability_hash && // The capability surface the probe tested — order-insensitive set comparison.
+  sameIdSet(record.tested_capabilities, current.tested_capabilities);
+}
+function matchRetainedEvidence(current, catalogue = RETAINED_EVIDENCE) {
+  return catalogue.find((r) => evidenceBindingMatches(r.binding, current)) ?? null;
+}
+var RETAINED_EVIDENCE;
+var init_evidence = __esm({
+  "src/adapters/evidence.ts"() {
+    "use strict";
+    RETAINED_EVIDENCE = [
+      {
+        ref: "copilot-sdk-capture-2026-09-20",
+        source: "harness/adapters/copilot-sdk/evidence/capture-2026-09-20.json",
+        source_artifact_sha256: "c46fba989dc0e772012c5fdb1291cf099326d24da2b551788be2e1e85113e49a",
+        binding: {
+          runtime_id: "github-copilot-sdk-hosted",
+          runtime_version: "copilot-runtime@1.0.85",
+          component_versions: ["@github/copilot-sdk@1.0.14", "copilot-protocol@3"],
+          // The capture's own provenance: tamperward@2.31.0+3671a5e6 (capture-2026-09-20.json).
+          tamperward_version: "2.31.0+3671a5e6",
+          // NOT authentically recoverable from the committed capture: the sanitized artifact records
+          // no adapter capability-declaration hash. We do NOT invent a historical hash. `null` makes
+          // the applicability match fail CLOSED (a null recorded hash can never equal a concrete
+          // current hash), so this record can never promote — the honest, safe outcome.
+          adapter_capability_hash: null,
+          // The capability ids the capture actually observed (the `observations` below).
+          tested_capabilities: ["pre-deny:shell", "hook-not-invoked", "transport:timeout"],
+          model: "gpt-5.4",
+          platform: "darwin-arm64",
+          execution_mode: "headless",
+          hook_config_hash: null
+        },
+        observations: [
+          {
+            id: "pre-deny:shell",
+            result: "proven",
+            detail: "returned-reject path (permission.completed result.kind denied): a rejected permission decision blocked shell tool dispatch \u2014 protected state not mutated (shell-pre-deny observation, boundary seq 2 < completion seq 3)"
+          },
+          {
+            id: "hook-not-invoked",
+            result: "proven",
+            detail: "callback-failure path: a broken permission callback (sync-throw, reject and adapter-throw, independently) failed CLOSED \u2014 the tool did not dispatch and protected state stayed intact"
+          },
+          {
+            id: "transport:timeout",
+            result: "inconclusive",
+            detail: "callback-timeout path: a hung permission handler emits no permission.completed (the pinned SDK has no handler timeout), so non-dispatch is intrinsically unobservable \u2014 timeout is not proven either way"
+          }
+        ]
+      }
+    ];
+  }
+});
+
+// src/runtime-qualification.ts
+import { createHash as createHash17 } from "node:crypto";
+function includesKind(set, kind) {
+  return set.includes(kind);
+}
+function find(unsupported, re) {
+  return unsupported.find((u) => re.test(u));
+}
+function indexEvidence(evidence) {
+  const m = /* @__PURE__ */ new Map();
+  if (!evidence) return m;
+  for (const o of evidence.observations) m.set(o.id, o);
+  return m;
+}
+function assessFromEvidence(id, index, evidence) {
+  const obs = index.get(id);
+  if (!obs || !evidence) return null;
+  const state = obs.result === "proven" ? "PROVEN" : obs.result === "fail-open" ? "FAIL-OPEN" : "INCONCLUSIVE";
+  return {
+    id,
+    state,
+    evidence: {
+      source: "committed-evidence",
+      detail: `${obs.detail} [retained evidence ${evidence.ref} \xB7 ${evidence.source} \xB7 sha256 ${evidence.source_artifact_sha256.slice(0, 12)}]`
+    }
+  };
+}
+function assessPreDeny(caps, id, kind, kindNote, index, evidence) {
+  const proven = assessFromEvidence(id, index, evidence);
+  if (proven) return proven;
+  if (includesKind(caps.preDeny, kind)) {
+    return {
+      id,
+      state: "PARTIAL",
+      evidence: {
+        source: "adapter-declaration",
+        detail: `declared preDeny includes '${kind}' (${kindNote}); the contract denies it at the adapter boundary, but no retained real-runtime probe proves this runtime/version invokes and honors the hook live`
+      }
+    };
+  }
+  const note = find(caps.unsupported, PRE_DENY_UNPROVEN_RE);
+  if (note) return { id, state: "UNPROVEN", evidence: { source: "adapter-unsupported", detail: note } };
+  return {
+    id,
+    state: "UNPROVEN",
+    evidence: {
+      source: "not-declared",
+      detail: `operation kind '${kind}' (${kindNote}) is absent from the declared preDeny set and unnamed in unsupported`
+    }
+  };
+}
+function assessTransport(caps, id, index, evidence) {
+  const observed = assessFromEvidence(id, index, evidence);
+  if (observed) return observed;
+  const kw = TRANSPORT_KEYWORDS[id];
+  const failOpen = caps.unsupported.find((u) => FAIL_OPEN_RE.test(u) && kw.test(u));
+  if (failOpen) return { id, state: "FAIL-OPEN", evidence: { source: "adapter-unsupported", detail: failOpen } };
+  const unproven = find(caps.unsupported, TRANSPORT_UNPROVEN_RE);
+  if (unproven) return { id, state: "UNPROVEN", evidence: { source: "adapter-unsupported", detail: unproven } };
+  return {
+    id,
+    state: "PARTIAL",
+    evidence: {
+      source: "contract",
+      detail: "the neutral steering contract maps this transport failure to a fail-closed deny at the adapter boundary (failsClosed); full live-runtime honoring across execution modes is not separately proven by static qualification"
+    }
+  };
+}
+function assessCapabilities(caps, evidence) {
+  const out3 = [];
+  const ev = indexEvidence(evidence);
+  const fromEvidence = (id) => assessFromEvidence(id, ev, evidence);
+  out3.push(assessPreDeny(caps, "pre-deny:shell", "shell", "a shell/exec tool call", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:native-edit", "file-edit", "a native file-edit tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:delete", "file-edit", "a delete proposed as a file-edit/native tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:rename", "file-edit", "a rename proposed as a file-edit/native tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:git-mutation", "shell", "a git mutation proposed as a shell command", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:mcp", "mcp", "an MCP tool call", ev, evidence));
+  const postObserveEvidence = fromEvidence("post-observe");
+  if (postObserveEvidence) {
+    out3.push(postObserveEvidence);
+  } else if (caps.postObserve.length > 0) {
+    out3.push({
+      id: "post-observe",
+      state: "PARTIAL",
+      evidence: { source: "adapter-declaration", detail: `declared postObserve: [${[...caps.postObserve].sort().join(", ")}]; no retained real-runtime probe proves live post-action observation on this runtime/version` }
+    });
+  } else {
+    const note = find(caps.unsupported, POST_ACTION_RE);
+    out3.push(
+      note ? { id: "post-observe", state: "UNSUPPORTED", evidence: { source: "adapter-unsupported", detail: note } } : {
+        id: "post-observe",
+        state: "UNPROVEN",
+        evidence: { source: "not-declared", detail: "no post-action observation kind is declared and none is named unsupported" }
+      }
+    );
+  }
+  const endOfTurnEvidence = fromEvidence("end-of-turn");
+  if (endOfTurnEvidence) {
+    out3.push(endOfTurnEvidence);
+  } else if (!caps.endOfTurn) {
+    out3.push({ id: "end-of-turn", state: "UNSUPPORTED", evidence: { source: "adapter-declaration", detail: "endOfTurn is declared false" } });
+  } else {
+    const caveat = find(caps.unsupported, LIFECYCLE_ONLY_RE);
+    out3.push(
+      caveat ? { id: "end-of-turn", state: "PARTIAL", evidence: { source: "adapter-unsupported", detail: caveat } } : { id: "end-of-turn", state: "PARTIAL", evidence: { source: "adapter-declaration", detail: "endOfTurn is declared true (a stop event can run the mandatory sweep); no retained real-runtime probe proves this runtime/version delivers and honors the stop sweep live" } }
+    );
+  }
+  const hasDenyPath = caps.endOfTurn || caps.preDeny.length > 0;
+  out3.push(
+    hasDenyPath ? {
+      id: "denial-reason-delivery",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "a deny carries a human/agent-facing reason on the wire (SteeringDecision.reason); that the runtime delivers it to the agent is not separately proven by static qualification"
+      }
+    } : {
+      id: "denial-reason-delivery",
+      state: "UNPROVEN",
+      evidence: { source: "not-declared", detail: "the adapter declares no pre-deny or end-of-turn deny path, so no reason is delivered" }
+    }
+  );
+  out3.push({
+    id: "continue-after-denial",
+    state: "UNPROVEN",
+    evidence: { source: "not-declared", detail: "whether the agent can continue after a denial is not encoded in the neutral capability declaration and requires live evidence" }
+  });
+  for (const id of ["transport:missing-executable", "transport:non-zero", "transport:timeout", "transport:malformed", "transport:empty"]) {
+    out3.push(assessTransport(caps, id, ev, evidence));
+  }
+  out3.push(
+    fromEvidence("hook-not-invoked") ?? {
+      id: "hook-not-invoked",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "the neutral contract fails a required not-invoked hook CLOSED (failsClosed); that a configured hook is actually invoked/honored on this runtime/version is not proven by static qualification"
+      }
+    }
+  );
+  out3.push(
+    caps.endOfTurn ? {
+      id: "detached/quiescence",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "the end-of-turn sweep reconciles the net tree at turn end, catching a detached/deferred effect the in-loop phase could only observe; continuous in-turn quiescence is not an in-loop guarantee"
+      }
+    } : {
+      id: "detached/quiescence",
+      state: "UNPROVEN",
+      evidence: { source: "not-declared", detail: "no end-of-turn sweep is declared, so a detached/deferred effect is not reconciled in-loop" }
+    }
+  );
+  return out3;
+}
+function aggregateInLoop(assessments) {
+  const byId = new Map(assessments.map((a) => [a.id, a]));
+  const required = REQUIRED_IN_LOOP_IDS.map((id) => byId.get(id)).filter((a) => a !== void 0);
+  const anyDangerous = required.some((a) => a.state === "FAIL-OPEN" || a.state === "INCONCLUSIVE");
+  const present = (id) => {
+    const s = byId.get(id)?.state;
+    return s === "PROVEN" || s === "PARTIAL";
+  };
+  const anyPreDenyPresent = PRE_DENY_IDS.some(present);
+  const endOfTurnPresent = present("end-of-turn");
+  if (!anyPreDenyPresent && !endOfTurnPresent) return "NONE";
+  if (!anyDangerous && required.every((a) => a.state === "PROVEN")) return "FULL";
+  return "PARTIAL";
+}
+function sha16(s) {
+  return createHash17("sha256").update(s).digest("hex").slice(0, 16);
+}
+function capabilityHash(caps) {
+  const stable = JSON.stringify({
+    preDeny: [...caps.preDeny].sort(),
+    postObserve: [...caps.postObserve].sort(),
+    endOfTurn: caps.endOfTurn,
+    unsupported: [...caps.unsupported].sort()
+  });
+  return sha16(stable);
+}
+function loadBearing(b) {
+  return {
+    "runtime.id": b.runtime.id,
+    "runtime.version": b.runtime.version ?? "\u2205",
+    "tamperward.version": b.tamperward.version,
+    "tamperward.commit": b.tamperward.commit ?? "\u2205",
+    "adapter.capability_hash": b.adapter.capability_hash,
+    "hook_config_hash": b.hook_config_hash ?? "\u2205",
+    "execution_mode": b.execution_mode,
+    "platform": b.platform,
+    "model": b.model ?? "\u2205",
+    "tested_capabilities": [...b.tested_capabilities].sort().join(",")
+  };
+}
+function qualificationStaleness(stored, current) {
+  const a = loadBearing(stored);
+  const b = loadBearing(current);
+  const changed = [];
+  for (const key2 of Object.keys(b)) {
+    if (a[key2] !== b[key2]) changed.push(`${key2}: ${a[key2]} \u2192 ${b[key2]}`);
+  }
+  return { stale: changed.length > 0, changed };
+}
+function evidenceId(binding, assessments) {
+  const projection = {
+    load_bearing: loadBearing(binding),
+    states: assessments.map((a) => [a.id, a.state])
+  };
+  return sha16(JSON.stringify(projection));
+}
+var CAPABILITY_STATES, RUNTIME_CAPABILITY_IDS, EVIDENCE_SOURCES, FINAL_AUTHORITY, FAIL_OPEN_RE, PRE_DENY_UNPROVEN_RE, TRANSPORT_UNPROVEN_RE, LIFECYCLE_ONLY_RE, POST_ACTION_RE, TRANSPORT_KEYWORDS, PRE_DENY_IDS, REQUIRED_IN_LOOP_IDS;
+var init_runtime_qualification = __esm({
+  "src/runtime-qualification.ts"() {
+    "use strict";
+    CAPABILITY_STATES = [
+      "PROVEN",
+      "PARTIAL",
+      "UNPROVEN",
+      "UNSUPPORTED",
+      "FAIL-OPEN",
+      "INCONCLUSIVE"
+    ];
+    RUNTIME_CAPABILITY_IDS = [
+      "pre-deny:shell",
+      "pre-deny:native-edit",
+      "pre-deny:delete",
+      "pre-deny:rename",
+      "pre-deny:git-mutation",
+      "pre-deny:mcp",
+      "post-observe",
+      "end-of-turn",
+      "denial-reason-delivery",
+      "continue-after-denial",
+      "transport:missing-executable",
+      "transport:non-zero",
+      "transport:timeout",
+      "transport:malformed",
+      "transport:empty",
+      "hook-not-invoked",
+      "detached/quiescence"
+    ];
+    EVIDENCE_SOURCES = [
+      "adapter-declaration",
+      // structural preDeny / postObserve / endOfTurn membership
+      "adapter-unsupported",
+      // named verbatim in the adapter's `unsupported[]` prose
+      "contract",
+      // the neutral steering contract guarantees this at the adapter boundary
+      "committed-evidence",
+      // a committed real-runtime evidence record proved it
+      "not-declared"
+      // absent from every declaration — no proof either way
+    ];
+    FINAL_AUTHORITY = "AVAILABLE";
+    FAIL_OPEN_RE = /fails?\s+open/i;
+    PRE_DENY_UNPROVEN_RE = /pre-action deny|pre-deny|shell pre-deny/i;
+    TRANSPORT_UNPROVEN_RE = /(?:fail-?closed|transport)[^.]*\b(?:not (?:yet )?proven|unproven|unmeasured)/i;
+    LIFECYCLE_ONLY_RE = /lifecycle continuation|not a filesystem veto|only block turn completion|block turn completion and force continuation/i;
+    POST_ACTION_RE = /post-action|post-observe|posttooluse|stop sweep is the post-turn/i;
+    TRANSPORT_KEYWORDS = {
+      "transport:missing-executable": /missing exec|executable|enoent|not found/i,
+      "transport:non-zero": /non-?zero|exit code|exit 2|non-?2xx/i,
+      "transport:timeout": /time-?out|timed[- ]out/i,
+      "transport:malformed": /malformed|parse/i,
+      "transport:empty": /\bempty\b/i
+    };
+    PRE_DENY_IDS = [
+      "pre-deny:shell",
+      "pre-deny:native-edit",
+      "pre-deny:delete",
+      "pre-deny:rename",
+      "pre-deny:git-mutation",
+      "pre-deny:mcp"
+    ];
+    REQUIRED_IN_LOOP_IDS = [
+      ...PRE_DENY_IDS,
+      "end-of-turn",
+      "transport:missing-executable",
+      "transport:non-zero",
+      "transport:timeout",
+      "transport:malformed",
+      "transport:empty",
+      "hook-not-invoked"
+    ];
+  }
+});
+
+// src/cli/runtime.ts
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync29, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join30, dirname as dirname15 } from "node:path";
+function storePath(cwd) {
+  const dir = gitDir(cwd);
+  return dir ? join30(dir, "tamperward", "runtime-qualification.json") : null;
+}
+function readStore(cwd) {
+  const path = storePath(cwd);
+  if (!path || !existsSync22(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync29(path, "utf8"));
+    if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+function isRec(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function asStringOrNull(v) {
+  return v === null || typeof v === "string" ? v : void 0;
+}
+function validateStoredReport(value) {
+  if (!isRec(value)) return { reason: "record is not an object" };
+  if (value.schema_version !== 1) return { reason: "unrecognized schema_version" };
+  if (value.command !== "runtime") return { reason: 'command is not "runtime"' };
+  const subcommand = value.subcommand;
+  if (subcommand !== "verify" && subcommand !== "status") return { reason: "invalid subcommand" };
+  const recorded = value.recorded;
+  const stale = value.stale;
+  if (typeof recorded !== "boolean" || typeof stale !== "boolean") return { reason: "invalid recorded/stale flags" };
+  const changedInputs = value.changed_inputs;
+  if (!Array.isArray(changedInputs) || !changedInputs.every((s) => typeof s === "string")) return { reason: "invalid changed_inputs" };
+  const runtime = value.runtime;
+  if (!isRec(runtime)) return { reason: "invalid runtime binding" };
+  const rId = runtime.id;
+  const rLabel = runtime.label;
+  const rVersion = asStringOrNull(runtime.version);
+  if (typeof rId !== "string" || !rId || typeof rLabel !== "string" || !rLabel || rVersion === void 0)
+    return { reason: "invalid runtime binding" };
+  const tw = value.tamperward;
+  if (!isRec(tw)) return { reason: "invalid tamperward binding" };
+  const twVersion = tw.version;
+  const twCommit = asStringOrNull(tw.commit);
+  if (typeof twVersion !== "string" || !twVersion || twCommit === void 0) return { reason: "invalid tamperward binding" };
+  const adapter = value.adapter;
+  if (!isRec(adapter)) return { reason: "invalid adapter binding" };
+  const adName = adapter.name;
+  const adHash = adapter.capability_hash;
+  if (typeof adName !== "string" || !adName || typeof adHash !== "string" || !adHash) return { reason: "invalid adapter binding" };
+  const hookConfigHash = asStringOrNull(value.hook_config_hash);
+  if (hookConfigHash === void 0) return { reason: "invalid hook_config_hash" };
+  const executionMode = value.execution_mode;
+  if (executionMode !== "headless" && executionMode !== "interactive") return { reason: "invalid execution_mode" };
+  const platform = value.platform;
+  if (typeof platform !== "string" || !platform) return { reason: "invalid platform" };
+  const model = asStringOrNull(value.model);
+  if (model === void 0) return { reason: "invalid model" };
+  const testedCapabilities = value.tested_capabilities;
+  if (!Array.isArray(testedCapabilities) || !testedCapabilities.every((c) => typeof c === "string" && CAP_ID_SET.has(c)))
+    return { reason: "invalid tested_capabilities" };
+  const timestamp = value.timestamp;
+  if (typeof timestamp !== "string" || !timestamp) return { reason: "invalid timestamp" };
+  const storedEvidenceId = value.evidence_id;
+  if (typeof storedEvidenceId !== "string" || !storedEvidenceId) return { reason: "invalid evidence_id" };
+  if (!Array.isArray(value.capabilities)) return { reason: "capabilities is not an array" };
+  const capabilities = [];
+  for (const c of value.capabilities) {
+    if (!isRec(c)) return { reason: "invalid capability entry" };
+    const id = RUNTIME_CAPABILITY_IDS.find((x) => x === c.id);
+    const state = CAPABILITY_STATES.find((x) => x === c.state);
+    if (!id || !state) return { reason: "invalid capability entry" };
+    const ev = c.evidence;
+    if (!isRec(ev)) return { reason: "invalid capability evidence" };
+    const source = EVIDENCE_SOURCES.find((x) => x === ev.source);
+    const detail = ev.detail;
+    if (!source || typeof detail !== "string") return { reason: "invalid capability evidence" };
+    capabilities.push({ id, state, evidence: { source, detail } });
+  }
+  const inLoop = value.in_loop_protection;
+  if (inLoop !== "FULL" && inLoop !== "PARTIAL" && inLoop !== "NONE") return { reason: "invalid in_loop_protection" };
+  if (value.final_authority !== FINAL_AUTHORITY) return { reason: "invalid final_authority" };
+  const note = value.note;
+  if (typeof note !== "string") return { reason: "invalid note" };
+  const base = {
+    runtime: { id: rId, label: rLabel, version: rVersion },
+    tamperward: { version: twVersion, commit: twCommit },
+    adapter: { name: adName, capability_hash: adHash },
+    hook_config_hash: hookConfigHash,
+    execution_mode: executionMode,
+    platform,
+    model,
+    tested_capabilities: testedCapabilities
+  };
+  const recomputedId = evidenceId(base, capabilities);
+  if (recomputedId !== storedEvidenceId) return { reason: `evidence_id mismatch (recorded ${storedEvidenceId}, recomputed ${recomputedId})` };
+  const recomputedAgg = aggregateInLoop(capabilities);
+  if (inLoop !== recomputedAgg) return { reason: `in_loop_protection mismatch (recorded ${inLoop}, recomputed ${recomputedAgg})` };
+  const report2 = {
+    schema_version: 1,
+    command: "runtime",
+    subcommand,
+    recorded,
+    stale,
+    changed_inputs: changedInputs,
+    runtime: base.runtime,
+    tamperward: base.tamperward,
+    adapter: base.adapter,
+    hook_config_hash: hookConfigHash,
+    execution_mode: executionMode,
+    platform,
+    model,
+    tested_capabilities: testedCapabilities,
+    timestamp,
+    evidence_id: storedEvidenceId,
+    capabilities,
+    in_loop_protection: inLoop,
+    final_authority: FINAL_AUTHORITY,
+    note
+  };
+  return { report: report2 };
+}
+function writeRecord(cwd, id, report2) {
+  const path = storePath(cwd);
+  if (!path) return false;
+  const existing = readStore(cwd);
+  const store = existing ?? { schema_version: report2.schema_version, updated_at: "", records: {} };
+  store.records[id] = report2;
+  store.updated_at = report2.timestamp;
+  try {
+    mkdirSync13(dirname15(path), { recursive: true });
+    writeFileSync16(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveRuntimeVersion(canonicalId) {
+  const override = process.env.TAMPERWARD_RUNTIME_VERSION;
+  if (override && override.trim()) return override.trim();
+  const bins = {
+    "claude-code": "claude",
+    codex: "codex",
+    "github-copilot-cli": "copilot"
+  };
+  const bin = bins[canonicalId];
+  if (!bin) return null;
+  try {
+    const out3 = execFileSync16(bin, ["--version"], { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "ignore"] });
+    const m = out3.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+    return m ? m[0] : out3.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function tamperwardBuildTag(version, commit) {
+  return commit ? `${version}+${commit.slice(0, 8)}` : version;
+}
+function resolveComponentVersions(_canonicalId) {
+  return [];
+}
+function resolveHookConfigHash(canonicalId, cwd) {
+  if (canonicalId === "claude-code") {
+    return sha16(JSON.stringify(interventionWiring(cwd)));
+  }
+  const files = {
+    "github-copilot-cli": join30(cwd, ".github", "hooks", "tamperward.json")
+  };
+  const file = files[canonicalId];
+  if (!file || !existsSync22(file)) return null;
+  try {
+    const raw = readFileSync29(file, "utf8");
+    let hooks = raw;
+    try {
+      const parsed = JSON.parse(raw);
+      hooks = parsed && typeof parsed === "object" && "hooks" in parsed ? parsed.hooks : parsed;
+    } catch {
+    }
+    return sha16(JSON.stringify(hooks ?? null));
+  } catch {
+    return null;
+  }
+}
+function buildQualification(adapter, opts, cwd) {
+  const canonical2 = adapter.name;
+  const capHash = capabilityHash(adapter.capabilities);
+  const mode = opts.mode ?? "headless";
+  const version = resolveRuntimeVersion(canonical2);
+  const platform = `${process.platform}-${process.arch}`;
+  const model = opts.model ?? null;
+  const hookConfigHash = resolveHookConfigHash(canonical2, cwd);
+  const commit = TW_COMMIT;
+  const testedRaw = [...RUNTIME_CAPABILITY_IDS];
+  const matchKey = {
+    runtime_id: canonical2,
+    runtime_version: version,
+    // No live resolver for a runtime's SDK/protocol component versions ships yet, so the
+    // current side is honestly the empty (unresolved) set. An unresolved component set never
+    // matches a probed non-empty one — it fails closed, never promotes. We do not fabricate one.
+    component_versions: resolveComponentVersions(canonical2),
+    tamperward_version: tamperwardBuildTag(TW_VERSION, commit),
+    adapter_capability_hash: capHash,
+    tested_capabilities: testedRaw,
+    model,
+    platform,
+    execution_mode: mode,
+    hook_config_hash: hookConfigHash
+  };
+  const evidence = matchRetainedEvidence(matchKey);
+  const assessments = assessCapabilities(adapter.capabilities, evidence);
+  const base = {
+    runtime: { id: canonical2, label: labelFor(canonical2), version },
+    tamperward: { version: TW_VERSION, commit },
+    adapter: { name: canonical2, capability_hash: capHash },
+    hook_config_hash: hookConfigHash,
+    execution_mode: mode,
+    platform,
+    model,
+    tested_capabilities: testedRaw
+  };
+  const eid = evidenceId(base, assessments);
+  const binding = { ...base, timestamp: (/* @__PURE__ */ new Date()).toISOString(), evidence_id: eid };
+  return { binding, assessments };
+}
+function reportFrom(subcommand, binding, assessments) {
+  return machineOutput({
+    command: "runtime",
+    subcommand,
+    recorded: true,
+    stale: false,
+    changed_inputs: [],
+    runtime: binding.runtime,
+    tamperward: binding.tamperward,
+    adapter: binding.adapter,
+    hook_config_hash: binding.hook_config_hash,
+    execution_mode: binding.execution_mode,
+    platform: binding.platform,
+    model: binding.model,
+    tested_capabilities: binding.tested_capabilities,
+    timestamp: binding.timestamp,
+    evidence_id: binding.evidence_id,
+    capabilities: assessments,
+    in_loop_protection: aggregateInLoop(assessments),
+    final_authority: FINAL_AUTHORITY,
+    note: HONESTY_NOTE
+  });
+}
+function resolveTarget(opts, cwd) {
+  if (opts.runtime) {
+    const a = adapterFor(opts.runtime);
+    return a ?? { error: `no shipped runtime adapter for "${opts.runtime}"` };
+  }
+  const detected = detectRuntimes(cwd);
+  for (const rt of detected) {
+    const a = adapterFor(rt.id);
+    if (a) return a;
+  }
+  const reason = detected.length > 0 ? "no adapter-backed runtime detected in this repository" : "no runtime detected in this repository";
+  return { error: `${reason}; pass --runtime <id> to qualify a specific runtime` };
+}
+function renderText3(report2, cwd) {
+  const colour = colourEnabled(process.env, process.stdout);
+  const w = (s) => process.stdout.write(s + "\n");
+  const dim = (s) => paint(s, DIM, colour);
+  w(`${paint(report2.runtime.label, BOLD, colour)} \u2014 runtime protection qualification`);
+  w(dim(`  runtime ${report2.runtime.version ?? "(version unresolved)"} \xB7 tamperward ${report2.tamperward.version} \xB7 adapter ${report2.adapter.capability_hash} \xB7 ${report2.execution_mode} \xB7 ${report2.platform}`));
+  w(dim(`  evidence ${report2.evidence_id} \xB7 ${report2.timestamp}`));
+  if (!report2.recorded) {
+    w("");
+    w(`${paint("[UNQUALIFIED]", severityColour("bad") + BOLD, colour)} no qualification recorded for this runtime.`);
+    if (report2.note) w(dim(`  ${report2.note.replace(/—/g, "-")}`));
+    w(`Run: ${paint("tamperward runtime verify", BOLD, colour)}`);
+    return;
+  }
+  if (report2.stale) {
+    w("");
+    w(`${paint("[STALE]", severityColour("bad") + BOLD, colour)} a load-bearing input changed \u2014 this qualification no longer applies:`);
+    for (const c of report2.changed_inputs) w(`  \xB7 ${c}`);
+    w(`Run: ${paint("tamperward runtime verify", BOLD, colour)}`);
+  }
+  w("");
+  const width = Math.max(...report2.capabilities.map((c) => c.id.length));
+  for (const cap of report2.capabilities) {
+    const sev = STATE_SEVERITY[cap.state];
+    const tag = paint(cap.state.padEnd(12), (sev === "bad" ? BOLD : "") + severityColour(sev), colour);
+    w(`  ${cap.id.padEnd(width)}  ${tag}`);
+  }
+  w("");
+  const agg = report2.in_loop_protection;
+  const aggTag = paint(agg, (AGGREGATE_SEVERITY[agg] === "bad" ? BOLD : "") + severityColour(AGGREGATE_SEVERITY[agg]), colour);
+  w(`  ${"In-loop protection".padEnd(width)}  ${aggTag}`);
+  w(`  ${"Final authority".padEnd(width)}  ${paint(report2.final_authority, severityColour("ok"), colour)}`);
+  w("");
+  w(dim("  Final authority (CI / pristine verification) is independent of the runtime hook: a weak in-loop"));
+  w(dim("  capability never weakens adjudication. Steering and authority remain separate."));
+  w("");
+  w(dim("  " + report2.note.replace(/—/g, "-")));
+  w("");
+  w(dim("  Evidence:"));
+  for (const cap of report2.capabilities) {
+    w(dim(`    ${cap.id} [${cap.state}] (${cap.evidence.source}): ${cap.evidence.detail}`));
+  }
+}
+function emit2(report2, opts, cwd) {
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(report2) + "\n");
+    return;
+  }
+  renderText3(report2, cwd);
+}
+function runRuntime(sub, opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (sub === "verify") {
+    const target = resolveTarget(opts, cwd);
+    if ("error" in target) {
+      process.stderr.write(`tamperward: ${target.error}
+`);
+      return 2;
+    }
+    const { binding, assessments } = buildQualification(target, opts, cwd);
+    const report2 = reportFrom("verify", binding, assessments);
+    const wrote = writeRecord(cwd, target.name, report2);
+    if (!wrote) {
+      const dest = storePath(cwd);
+      const reason = `could not persist the qualification to ${dest ?? "the git-local store (no repository found)"}; nothing was recorded, so \`tamperward runtime status\` will report UNQUALIFIED`;
+      const failure = {
+        ...report2,
+        recorded: false,
+        capabilities: [],
+        in_loop_protection: "NONE",
+        note: reason
+      };
+      emit2(failure, opts, cwd);
+      process.stderr.write(`tamperward: ${reason}
+`);
+      return 1;
+    }
+    emit2(report2, opts, cwd);
+    return 0;
+  }
+  if (sub === "status") {
+    const target = resolveTarget(opts, cwd);
+    if ("error" in target) {
+      process.stderr.write(`tamperward: ${target.error}
+`);
+      return 2;
+    }
+    const store = readStore(cwd);
+    const raw = store?.records[target.name];
+    const validated = raw === void 0 ? { reason: "none recorded" } : validateStoredReport(raw);
+    if ("reason" in validated) {
+      const { binding, assessments } = buildQualification(target, opts, cwd);
+      const note = raw === void 0 ? `No qualification recorded for ${binding.runtime.label}. Run: tamperward runtime verify` : `Stored qualification for ${binding.runtime.label} was rejected (${validated.reason}) and treated as unrecorded. Run: tamperward runtime verify`;
+      const empty2 = {
+        ...reportFrom("status", binding, assessments),
+        recorded: false,
+        capabilities: [],
+        in_loop_protection: "NONE",
+        note
+      };
+      emit2(empty2, opts, cwd);
+      return 0;
+    }
+    const stored = validated.report;
+    const { binding: current } = buildQualification(target, opts, cwd);
+    const storedBinding = {
+      runtime: stored.runtime,
+      tamperward: stored.tamperward,
+      adapter: stored.adapter,
+      hook_config_hash: stored.hook_config_hash,
+      execution_mode: stored.execution_mode,
+      platform: stored.platform,
+      model: stored.model,
+      tested_capabilities: stored.tested_capabilities,
+      timestamp: stored.timestamp,
+      evidence_id: stored.evidence_id
+    };
+    const staleness = qualificationStaleness(storedBinding, current);
+    const report2 = {
+      ...stored,
+      subcommand: "status",
+      stale: staleness.stale,
+      changed_inputs: staleness.changed
+    };
+    emit2(report2, opts, cwd);
+    return 0;
+  }
+  process.stderr.write(`tamperward: runtime requires one of verify | status (got "${sub ?? ""}")
+`);
+  return 2;
+}
+function parseRuntime(args) {
+  const [sub, ...rest] = args;
+  const opts = {};
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--cwd") opts.cwd = rest[++i];
+    else if (a === "--runtime") opts.runtime = rest[++i];
+    else if (a === "--model") opts.model = rest[++i];
+    else if (a === "--json") opts.json = true;
+    else if (a === "--mode") {
+      const v = rest[++i];
+      if (v === "headless" || v === "interactive") opts.mode = v;
+    }
+  }
+  return { sub, opts };
+}
+var HONESTY_NOTE, CAP_ID_SET, STATE_SEVERITY, AGGREGATE_SEVERITY, RUNTIME_SUBCOMMANDS;
+var init_runtime = __esm({
+  "src/cli/runtime.ts"() {
+    "use strict";
+    init_build();
+    init_wiring();
+    init_machine_output();
+    init_text();
+    init_status();
+    init_registry();
+    init_runtimes();
+    init_evidence();
+    init_verification_state();
+    init_runtime_qualification();
+    HONESTY_NOTE = "PROVEN is reserved for a capability a retained real-runtime probe observed holding under THIS exact runtime/version/config binding; a declaration alone grades PARTIAL (declared at the contract boundary, unproven live) and an absent capability UNPROVEN/UNSUPPORTED. No live in-process probe runs here \u2014 grading is against committed, sanitized real-runtime evidence, and absent a matching record nothing is PROVEN. This reports existing facts only \u2014 no promotion, no Round 4.1 eligibility claim.";
+    CAP_ID_SET = new Set(RUNTIME_CAPABILITY_IDS);
+    STATE_SEVERITY = {
+      PROVEN: "ok",
+      PARTIAL: "warn",
+      UNPROVEN: "warn",
+      UNSUPPORTED: "info",
+      "FAIL-OPEN": "bad",
+      INCONCLUSIVE: "bad"
+    };
+    AGGREGATE_SEVERITY = { FULL: "ok", PARTIAL: "warn", NONE: "bad" };
+    RUNTIME_SUBCOMMANDS = ["verify", "status"];
+  }
+});
+
+// src/cli/signoff-label.ts
+function runSignoffLabel(opts) {
+  if (!opts.rule) {
+    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
+    return 2;
+  }
+  if (!opts.head) {
+    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
+    return 2;
+  }
+  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
+  const token = compactOobToken(want, opts.head);
+  if (!token) {
+    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
+    return 2;
+  }
+  process.stdout.write(`${token}
+`);
+  return 0;
+}
+var init_signoff_label = __esm({
+  "src/cli/signoff-label.ts"() {
+    "use strict";
+    init_signoff();
+  }
+});
+
+// src/cli/main.ts
+var main_exports = {};
+__export(main_exports, {
+  guardedMain: () => guardedMain,
+  main: () => main,
+  runHookFromRaw: () => runHookFromRaw,
   validateCliArgs: () => validateCliArgs
 });
 function parseAllow(args) {
@@ -21145,6 +23844,15 @@ function parseDoctor(args) {
   }
   return o;
 }
+function parseStatus(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--json") o.json = true;
+    else if (a === "--cwd") o.cwd = args[++i];
+  }
+  return o;
+}
 function parseStats(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -21256,6 +23964,12 @@ function validateFlatArgs(args, grammar) {
           seen,
           positionals
         };
+      } else if (rule === "mode" && v !== "headless" && v !== "interactive") {
+        return {
+          error: `${a} needs one of headless | interactive (got "${v}")`,
+          seen,
+          positionals
+        };
       }
       continue;
     }
@@ -21353,6 +24067,12 @@ function validateCliArgs(cmd, args) {
       }
     }).error;
   }
+  if (cmd === "status") {
+    return validateFlatArgs(args, {
+      flags: ["--json"],
+      values: { "--cwd": "string" }
+    }).error;
+  }
   if (cmd === "onboard") {
     const parsed = validateFlatArgs(args, {
       flags: ["--yes", "--skip-demo", "--demo", "--no-github"],
@@ -21401,6 +24121,19 @@ function validateCliArgs(cmd, args) {
       values: { "--dir": "string", "--log": "string", "--base": "string" }
     }).error;
   }
+  if (cmd === "runtime") {
+    const [sub, ...rest] = args;
+    if (sub === void 0) return `runtime requires a subcommand (${RUNTIME_SUBCOMMANDS.join(" | ")})`;
+    if (sub !== "verify" && sub !== "status") {
+      return `unknown runtime subcommand "${sub}" (${RUNTIME_SUBCOMMANDS.join(" | ")})`;
+    }
+    const parsed = validateFlatArgs(rest, {
+      flags: ["--json"],
+      values: { "--cwd": "string", "--runtime": "string", "--mode": "mode", "--model": "string" }
+    });
+    if (parsed.error) return parsed.error;
+    return void 0;
+  }
   if (cmd === "research") {
     const [sub, ...rest] = args;
     if (sub === void 0) return `research requires a subcommand (${RESEARCH_SUBCOMMANDS.join(" | ")})`;
@@ -21598,6 +24331,36 @@ Formats:
                                             every tool the gate must see.
                                             --force-workflow replaces a workflow it
                                             did not write, or one you have edited.
+  tamperward status [--json] [--cwd D]      verification posture in three distinct
+                                            lanes \u2014 Authority (repository/final
+                                            adjudication), Intervention (runtime
+                                            steering), and Verification: whether the
+                                            last successful verify still applies to
+                                            the EXACT current state (CURRENT / STALE /
+                                            VERIFYING / BROKEN / UNVERIFIED). --json
+                                            emits the versioned status document for
+                                            editors, CI and dashboards. Local CURRENT
+                                            is posture, never repository/CI authority.
+  tamperward runtime verify [--runtime ID]  qualify the in-loop runtime: an operation-
+             [--mode headless|interactive]  specific capability matrix (pre-deny:shell,
+             [--model M] [--json] [--cwd D]  native-edit, mcp, end-of-turn, transport:*,
+                                            \u2026) with an explicit state per capability
+                                            (PROVEN | PARTIAL | UNPROVEN | UNSUPPORTED |
+                                            FAIL-OPEN | INCONCLUSIVE; never a score),
+                                            derived from the shipped adapter's declared
+                                            capabilities and committed evidence. Bound to
+                                            the runtime version, TamperWard version/commit,
+                                            adapter hash, hook-config hash, execution mode,
+                                            platform and model; persisted git-locally.
+                                            Reports EXISTING facts only \u2014 no promotion, no
+                                            Round 4.1 claim. Final authority (CI / pristine
+                                            verify) stays separate from in-loop steering.
+  tamperward runtime status [--runtime ID]  render the latest recorded qualification
+             [--mode headless|interactive]  WITHOUT rerunning it, and mark it STALE when a
+             [--model M] [--json] [--cwd D]  load-bearing input (version/config/adapter/mode/
+                                            model/\u2026) changed since it was recorded. --mode and
+                                            --model select the binding staleness is compared
+                                            against, as for verify.
   tamperward doctor [--base R]              report installation + authority posture
              [--workflow F] [--cwd D]       and validate the CI verifier's outer-time
              [--json]                       envelope against the trusted policy.
@@ -21650,6 +24413,8 @@ function main(argv) {
       return runDoctor(parseDoctor(rest));
     case "stats":
       return runStats(parseStats(rest));
+    case "status":
+      return runStatus(parseStatus(rest));
     case "onboard":
       return runOnboard(parseOnboard(rest));
     case "watch":
@@ -21662,6 +24427,10 @@ function main(argv) {
       return runTraceVerify(parseTraceVerify(rest));
     case "research":
       return runResearchCommand(rest);
+    case "runtime": {
+      const { sub, opts } = parseRuntime(rest);
+      return runRuntime(sub, opts);
+    }
     case "run":
       return runEnvelope({
         ...parseRun(rest),
@@ -21705,12 +24474,14 @@ var init_main = __esm({
     init_allow();
     init_init();
     init_doctor();
+    init_status2();
     init_verify();
     init_trace_verify();
     init_run();
     init_watch();
     init_onboard();
     init_research();
+    init_runtime();
     init_audit();
     init_signoff_label();
   }
@@ -21719,7 +24490,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -21732,7 +24503,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync27(0, "utf8");
+      raw = readFileSync30(0, "utf8");
     } catch {
       raw = null;
     }