tamperward 2.36.0 → 2.37.0

package/dist/cli/index.js

@@ -79,6 +79,22 @@ function shippedVersion() {
   }
   return null;
 }
+function shippedCommit() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(here, rel), "utf8"));
+        if (isRecord(pkg) && pkg.name === "tamperward") {
+          return typeof pkg.gitHead === "string" && GIT_HEAD_RE.test(pkg.gitHead) ? pkg.gitHead : null;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function requireShippedVersion() {
   if (RESOLVED_TW_VERSION === null) {
     throw new Error(
@@ -137,7 +153,7 @@ function resolvesToClaudeSettings(path, env = process.env) {
   if (isClaudeSettings(path, env)) return true;
   return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
 }
-var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS;
+var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS;
 var init_wiring = __esm({
   "src/wiring.ts"() {
     "use strict";
@@ -145,6 +161,8 @@ var init_wiring = __esm({
     PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
     RESOLVED_TW_VERSION = shippedVersion();
     TW_VERSION = RESOLVED_TW_VERSION ?? "0.0.0-unresolved";
+    GIT_HEAD_RE = /^[0-9a-f]{7,40}$/i;
+    TW_COMMIT = shippedCommit();
     PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
     PRE_MATCHER = PRE_TOOLS.join("|");
     MARKER = "# tamperward: block agent shortcuts before they land";
@@ -211,7 +229,7 @@ function forwardedEnv(env) {
   return out3;
 }
 function exchange(paths, req2, timeoutMs) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve23) => {
     let done = false;
     let handedOff = false;
     let accepted = false;
@@ -222,7 +240,7 @@ function exchange(paths, req2, timeoutMs) {
       done = true;
       clearTimeout(timer);
       sock.destroy();
-      resolve20(value);
+      resolve23(value);
     };
     const sock = createConnection(paths.socket);
     const timer = setTimeout(() => finish(handedOff ? acceptedFailure("timeout") : null), timeoutMs);
@@ -5175,8 +5193,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve20) {
-  const obj = resolve20(expr);
+function metricsOf(expr, resolve23) {
+  const obj = resolve23(expr);
   if (!ts.isObjectLiteralExpression(obj)) return void 0;
   const out3 = { values: {}, opaque: false };
   let any = false;
@@ -5190,7 +5208,7 @@ function metricsOf(expr, resolve20) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n2 = numericOf(resolve20(p.initializer));
+    const n2 = numericOf(resolve23(p.initializer));
     if (n2 === void 0) out3.opaque = true;
     else out3.values[k] = n2;
   }
@@ -5237,17 +5255,17 @@ function parseThresholds(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve20 = resolverFor(sf);
+    const resolve23 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve20(node.initializer);
+          const init = resolve23(node.initializer);
           if (!ts.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve20);
+            const flat = metricsOf(init, resolve23);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts.isSpreadAssignment(p)) {
@@ -5261,7 +5279,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve20);
+              const m = metricsOf(p.initializer, resolve23);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -5295,18 +5313,18 @@ function parseLists(src) {
   try {
     const sf = sourceOf(src);
     if (!sf) return res;
-    const resolve20 = resolverFor(sf);
+    const resolve23 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve20(node.initializer));
+          const { items, opaque } = literals(resolve23(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve20(node.initializer));
+          const { items, opaque } = literals(resolve23(node.initializer));
           (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -6976,10 +6994,10 @@ function lex(src) {
       i = j + 1;
       continue;
     }
-    const num2 = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
-    if (num2) {
-      out3.push({ t: "num", v: num2[0] });
-      i += num2[0].length;
+    const num3 = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
+    if (num3) {
+      out3.push({ t: "num", v: num3[0] });
+      i += num3[0].length;
       continue;
     }
     const op = src.slice(i).match(/^(?:==|!=|&&|\|\||<=|>=|[!()<>,[\]])/);
@@ -7004,13 +7022,13 @@ function foldConst(src) {
   let p = 0;
   const peek = () => toks[p];
   const eat = (v2) => toks[p]?.t === "op" && toks[p].v === v2 ? (p++, true) : false;
-  const num2 = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
+  const num3 = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
   const eq = (a, b) => {
     if (a === TRUTHY || b === TRUTHY) return void 0;
     if (typeof a === "string" && typeof b === "string") return a.toLowerCase() === b.toLowerCase();
     if (a === null && b === null) return true;
-    const x = num2(a);
-    const y2 = num2(b);
+    const x = num3(a);
+    const y2 = num3(b);
     return !Number.isNaN(x) && x === y2;
   };
   const or = () => {
@@ -7048,8 +7066,8 @@ function foldConst(src) {
         const e = eq(l, r);
         l = e === void 0 ? void 0 : t.v === "==" ? e : !e;
       } else {
-        const x = num2(l);
-        const y2 = num2(r);
+        const x = num3(l);
+        const y2 = num3(r);
         if (Number.isNaN(x) || Number.isNaN(y2)) l = void 0;
         else l = t.v === "<" ? x < y2 : t.v === ">" ? x > y2 : t.v === "<=" ? x <= y2 : x >= y2;
       }
@@ -12308,10 +12326,10 @@ function parseAuditJsonl(raw) {
   return events;
 }
 function parseSince(value, nowMs = Date.now()) {
-  const relative9 = /^(\d+)(m|h|d)$/.exec(value);
-  if (relative9) {
-    const count = Number(relative9[1]);
-    const unit = relative9[2] === "m" ? 6e4 : relative9[2] === "h" ? 36e5 : 864e5;
+  const relative13 = /^(\d+)(m|h|d)$/.exec(value);
+  if (relative13) {
+    const count = Number(relative13[1]);
+    const unit = relative13[2] === "m" ? 6e4 : relative13[2] === "h" ? 36e5 : 864e5;
     if (!Number.isSafeInteger(count) || count <= 0) throw new Error(`invalid --since value "${value}"`);
     return nowMs - count * unit;
   }
@@ -13019,12 +13037,12 @@ function pidAlive2(pid) {
   }
 }
 function listening(socket) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve23) => {
     const sock = createConnection2(socket);
     const done = (v) => {
       clearTimeout(timer);
       sock.destroy();
-      resolve20(v);
+      resolve23(v);
     };
     const timer = setTimeout(() => done(false), 1e3);
     sock.once("connect", () => done(true));
@@ -13203,11 +13221,11 @@ async function startHookService(opts) {
   });
   const umask = process.umask(63);
   try {
-    await new Promise((resolve20, reject) => {
+    await new Promise((resolve23, reject) => {
       server.once("error", reject);
       server.listen(paths.socket, () => {
         server.off("error", reject);
-        resolve20();
+        resolve23();
       });
     });
   } finally {
@@ -13224,8 +13242,8 @@ async function startHookService(opts) {
     get served() {
       return served;
     },
-    close: () => new Promise((resolve20) => {
-      if (closed) return resolve20();
+    close: () => new Promise((resolve23) => {
+      if (closed) return resolve23();
       closed = true;
       setSnapshotCache(null);
       let settled = false;
@@ -13236,7 +13254,7 @@ async function startHookService(opts) {
         clearTimeout(drain);
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
-        resolve20();
+        resolve23();
       };
       server.close(finalize);
       for (const sock of sockets) if (sock !== acceptedSocket) sock.destroy();
@@ -19508,9 +19526,9 @@ function readlineAsker(input, output) {
   let pending = null;
   rl.on("close", () => {
     closed = true;
-    const resolve20 = pending;
+    const resolve23 = pending;
     pending = null;
-    resolve20?.(null);
+    resolve23?.(null);
   });
   rl.on("SIGINT", () => rl.close());
   const ask = (question) => new Promise((resolvePromise) => {
@@ -21576,171 +21594,2326 @@ var init_research = __esm({
   }
 });
 
-// src/cli/signoff-label.ts
-function runSignoffLabel(opts) {
-  if (!opts.rule) {
-    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
-    return 2;
-  }
-  if (!opts.head) {
-    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
-    return 2;
-  }
-  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
-  const token = compactOobToken(want, opts.head);
-  if (!token) {
-    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
-    return 2;
-  }
-  process.stdout.write(`${token}
-`);
-  return 0;
+// src/adapters/contract.ts
+function steeringUnavailableFinding(detail) {
+  return {
+    rule: "tamperward-unavailable",
+    severity: "block",
+    message: `TamperWard could not evaluate this operation (${detail}), so it is denied rather than allowed.`,
+    evidence: detail,
+    remediation: "Repair the runtime steering path (hook config, transport, or event delivery), then retry. Do not work around the gate while it is down.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
 }
-var init_signoff_label = __esm({
-  "src/cli/signoff-label.ts"() {
+function failClosedResult(outcome, detail, phase, denyPayload) {
+  const findings = [steeringUnavailableFinding(detail)];
+  const wire = denyPayload(findings, phase);
+  return { outcome, detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+}
+var OPERATION_KINDS;
+var init_contract = __esm({
+  "src/adapters/contract.ts"() {
     "use strict";
-    init_signoff();
+    OPERATION_KINDS = ["shell", "file-edit", "file-read", "mcp", "other"];
   }
 });
 
-// src/cli/main.ts
-var main_exports = {};
-__export(main_exports, {
-  guardedMain: () => guardedMain,
-  main: () => main,
-  runHookFromRaw: () => runHookFromRaw,
-  validateCliArgs: () => validateCliArgs
-});
-function parseAllow(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--file") o.file = args[++i];
-    else if (a === "--reason") o.reason = args[++i];
-    else if (a === "--cwd") o.cwd = args[++i];
-    else if (!a.startsWith("--") && !o.rule) o.rule = a;
-  }
-  return o;
+// src/adapters/claude/adapter.ts
+function hookKindFor(phase) {
+  if (phase === "end-of-turn") return "Stop";
+  if (phase === "pre-action") return "PreToolUse";
+  throw new Error(`no deny-capable Claude hook for the observation-only phase "${phase}"`);
+}
+function operationKind(toolName) {
+  if (!toolName) return "other";
+  if (toolName === "Bash" || toolName === "BashOutput" || toolName === "KillShell") return "shell";
+  if (toolName === "Edit" || toolName === "Write" || toolName === "MultiEdit" || toolName === "NotebookEdit") return "file-edit";
+  if (toolName === "Read" || toolName === "Glob" || toolName === "Grep" || toolName === "NotebookRead") return "file-read";
+  if (toolName.startsWith("mcp__")) return "mcp";
+  return "other";
+}
+function eventFrom(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: operationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  return {
+    phase,
+    operation,
+    identity: { claimedCwd: input.cwd, sessionId: input.session_id }
+  };
 }
-function runAgentCommand(kind, args) {
-  const agent = args[0];
-  if (agent !== "claude") {
-    process.stderr.write(`tamperward: unsupported ${kind} agent "${agent ?? ""}" (only "claude" so far)
-`);
-    return 2;
+var ClaudeRuntimeAdapter, claudeAdapter;
+var init_adapter2 = __esm({
+  "src/adapters/claude/adapter.ts"() {
+    "use strict";
+    init_deny();
+    init_hook();
+    init_repo_context();
+    init_contract();
+    ClaudeRuntimeAdapter = class {
+      name = "claude-code";
+      /**
+       * Claude Code's live PreToolUse fires for EVERY tool and can synchronously deny it —
+       * shell, file edit, file read, MCP, and anything else — even under
+       * `--dangerously-skip-permissions`. The end-of-turn Stop sweep is live too. There is no
+       * live per-tool PostToolUse veto (Stop is the post-turn reconciliation), so `postObserve`
+       * is empty and `unsupported` names that gap explicitly rather than implying it.
+       */
+      capabilities = {
+        preDeny: OPERATION_KINDS,
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "per-operation post-action veto (end-of-turn Stop sweep is the post-turn reconciliation)",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        try {
+          return eventFrom(parseInput(raw), phase);
+        } catch (e) {
+          if (e instanceof HookInputError) return { failure: "parse-failure", detail: e.message };
+          throw e;
+        }
+      }
+      /**
+       * REVIEW POINT 5 — the runtime cwd is a CLAIM, not authority.
+       *
+       * The trusted repository root is derived from the RUNNER context (`defaultCwd`, else the
+       * process cwd) — INDEPENDENTLY of the claim — via git (`repoContext` →
+       * `git rev-parse --show-toplevel`, which resolves symlinks to a canonical path). The
+       * claim is then validated against THAT root with the shared `validateClaimAgainstRoot`:
+       * accepted only when it resolves to the same repository (its root, or a path inside it);
+       * rejected for a malformed path, a non-repository, a different repository, or a symlink
+       * that escapes into another repository. It never weakens what `preToolUseVerdict` does via
+       * `repoRoot()` — it is the explicit boundary that `decide` enforces BEFORE evaluating.
+       */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      /** The exact deny wire bytes for `phase`, through the SAME `denyWire` the live
+       *  `verdict()` uses (src/cli/hook.ts). Reuses `formatDenial`, so the reason text is
+       *  identical to the live path. Byte-for-byte equal to what a live deny emits. */
+      denyPayload(findings, phase) {
+        return denyWire(formatDenial(findings), hookKindFor(phase));
+      }
+      /**
+       * The authoritative synchronous path, enforced in order: parse → validate identity →
+       * decide. Each step that fails does so CLOSED (deny), except `post-action`, which is
+       * observation-only and returns `unsupported` (never a deny wire, never a PreToolUse
+       * fallthrough — BLOCKER 2).
+       *
+       *  1. `post-action` → `unsupported` (Claude has no per-tool post-action veto).
+       *  2. parse failure → `parse-failure`, byte-identical to the live fail-closed deny.
+       *  3. identity claim rejected → a fail-closed DENY, BEFORE any content evaluation, so a
+       *     runtime-supplied cwd pointing at another repository can never reach the detectors.
+       *  4. otherwise → delegate to the canonical `preToolUseFromRaw` / `stopFromRaw`, PASSING
+       *     the validated trusted root so the live path re-runs the same shared identity check.
+       *     `wire` is byte-identical to the live CLI — every deny/allow decision, the fail-closed
+       *     wrapping, repo-root resolution (#412), the turn baseline and the transport remain
+       *     exactly as src/cli/hook.ts computes them.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Claude Code has no per-tool post-action veto; the end-of-turn Stop sweep is its post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const live2 = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd) : preToolUseFromRaw(raw, defaultCwd);
+          return {
+            outcome: "parse-failure",
+            detail: parsed.detail,
+            wire: live2.stdout,
+            decision: { verdict: "deny", findings: [], reason: live2.stdout }
+          };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire2 = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire2 } };
+        }
+        const live = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd, idv.trustedRoot) : preToolUseFromRaw(raw, defaultCwd, idv.trustedRoot);
+        const wire = live.stdout;
+        const denied = wire.length > 0;
+        return {
+          outcome: "ok",
+          wire,
+          decision: { verdict: denied ? "deny" : "allow", findings: [], reason: denied ? wire : void 0 }
+        };
+      }
+      /**
+       * Map a transport failure (or a required hook that did not fire) onto a fail-closed
+       * DENY at the neutral seam. Claude's LIVE client additionally degrades a hook-service
+       * transport failure to the in-process verdict (src/cli/index.ts / hook-client.ts) rather
+       * than surfacing it here, so this method documents the contract guarantee for the seam;
+       * a partial adapter with no in-process fallback denies through exactly this path.
+       */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    claudeAdapter = new ClaudeRuntimeAdapter();
   }
-  return kind === "hook" ? runHookClaude() : runSweepClaude();
+});
+
+// src/adapters/apply-patch.ts
+import { isAbsolute as isAbsolute14, relative as relative9 } from "node:path";
+function readDisk2(path) {
+  return textOf2(inspectResolved(path));
 }
-function parseInit(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--cwd") o.cwd = args[++i];
-    else if (a === "--dry-run") o.dryRun = true;
-    else if (a === "--force-workflow") o.forceWorkflow = true;
-  }
-  return o;
+function relForDisplay2(path, cwd) {
+  const rel = relative9(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute14(rel) ? rel : path;
 }
-function parseOnboard(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--cwd") o.cwd = args[++i];
-    else if (a === "--base") o.base = args[++i];
-    else if (a === "--repo") o.repo = args[++i];
-    else if (a === "--branch") o.branch = args[++i];
-    else if (a === "--verify-command") o.verifyCommand = args[++i];
-    else if (a === "--skip-demo") o.skipDemo = true;
-    else if (a === "--demo") o.demo = true;
-    else if (a === "--no-github") o.noGithub = true;
-    else if (a === "--yes") o.yes = true;
+function parsePatchSections(patch) {
+  const lines = patch.replace(/\r\n/g, "\n").split("\n");
+  let i = 0;
+  while (i < lines.length && !/^\*\*\* Begin Patch/.test(lines[i])) i++;
+  if (i >= lines.length) throw new Error('apply_patch payload has no "*** Begin Patch" header');
+  i++;
+  const sections = [];
+  let current = null;
+  const flush = () => {
+    if (current) sections.push(current);
+    current = null;
+  };
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\*\*\* End Patch/.test(line)) {
+      flush();
+      return sections;
+    }
+    const add = /^\*\*\* Add File: (.*)$/.exec(line);
+    const upd = /^\*\*\* Update File: (.*)$/.exec(line);
+    const del = /^\*\*\* Delete File: (.*)$/.exec(line);
+    const move = /^\*\*\* Move to: (.*)$/.exec(line);
+    if (add) {
+      flush();
+      current = { op: "add", path: add[1].trim(), body: [] };
+    } else if (upd) {
+      flush();
+      current = { op: "update", path: upd[1].trim(), body: [] };
+    } else if (del) {
+      flush();
+      current = { op: "delete", path: del[1].trim(), body: [] };
+    } else if (move && current) {
+      current.moveTo = move[1].trim();
+    } else if (current) {
+      current.body.push(line);
+    }
+  }
+  throw new Error('apply_patch payload is missing its "*** End Patch" trailer');
+}
+function addedContent(body) {
+  return body.filter((l) => l.startsWith("+")).map((l) => l.slice(1)).join("\n");
+}
+function applyUpdate(before, body) {
+  const lines = before.split("\n");
+  const hunks = [];
+  let hunk = [];
+  for (const l of body) {
+    if (l.startsWith("@@")) {
+      if (hunk.length) hunks.push(hunk);
+      hunk = [];
+      continue;
+    }
+    hunk.push(l);
+  }
+  if (hunk.length) hunks.push(hunk);
+  let cursor = 0;
+  for (const h of hunks) {
+    const oldBlock = [];
+    const newBlock = [];
+    for (const l of h) {
+      if (l === "") {
+        oldBlock.push("");
+        newBlock.push("");
+      } else if (l.startsWith(" ")) {
+        oldBlock.push(l.slice(1));
+        newBlock.push(l.slice(1));
+      } else if (l.startsWith("-")) {
+        oldBlock.push(l.slice(1));
+      } else if (l.startsWith("+")) {
+        newBlock.push(l.slice(1));
+      } else {
+        return null;
+      }
+    }
+    if (oldBlock.length === 0) return null;
+    let at = -1;
+    for (let s = cursor; s <= lines.length - oldBlock.length; s++) {
+      let ok = true;
+      for (let k = 0; k < oldBlock.length; k++) {
+        if (lines[s + k] !== oldBlock[k]) {
+          ok = false;
+          break;
+        }
+      }
+      if (ok) {
+        at = s;
+        break;
+      }
+    }
+    if (at < 0) return null;
+    lines.splice(at, oldBlock.length, ...newBlock);
+    cursor = at + newBlock.length;
   }
-  return o;
+  return lines.join("\n");
 }
-function parseDoctor(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--cwd") o.cwd = args[++i];
-    else if (a === "--base") o.base = args[++i];
-    else if (a === "--workflow") o.workflow = args[++i];
-    else if (a === "--github") o.github = true;
-    else if (a === "--json") o.json = true;
-    else if (a === "--repo") o.repo = args[++i];
-    else if (a === "--branch") o.branch = args[++i];
+function applyPatchChanges(patch, abs, cwd) {
+  const out3 = [];
+  for (const section of parsePatchSections(patch)) {
+    const targetRel = relForDisplay2(abs(section.moveTo ?? section.path), cwd);
+    if (section.op === "add") {
+      out3.push(...synthFileChange(targetRel, null, addedContent(section.body)));
+    } else if (section.op === "delete") {
+      out3.push(...synthFileChange(targetRel, readDisk2(abs(section.path)), null));
+    } else {
+      const before = readDisk2(abs(section.path));
+      const after = applyUpdate(before ?? "", section.body);
+      if (after === null) {
+        throw new Error(
+          `cannot reconstruct the apply_patch update to ${section.path}: its hunks did not locate against the file on disk`
+        );
+      }
+      const synth = synthFileChange(targetRel, before, after);
+      if (section.moveTo && section.moveTo !== section.path) {
+        out3.push(...synth.map((c) => ({ ...c, op: "rename", oldPath: relForDisplay2(abs(section.path), cwd) })));
+      } else {
+        out3.push(...synth);
+      }
+    }
   }
-  return o;
+  return out3;
 }
-function parseStatus(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--json") o.json = true;
-    else if (a === "--cwd") o.cwd = args[++i];
+var init_apply_patch = __esm({
+  "src/adapters/apply-patch.ts"() {
+    "use strict";
+    init_changes();
+    init_disk();
   }
-  return o;
+});
+
+// src/adapters/codex/changes.ts
+import { isAbsolute as isAbsolute15, relative as relative10, resolve as resolve20 } from "node:path";
+function asStr2(v) {
+  return typeof v === "string" ? v : "";
 }
-function parseStats(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--cwd") o.cwd = args[++i];
-    else if (a === "--file") o.file = args[++i];
-    else if (a === "--since") o.since = args[++i];
-    else if (a === "--json") o.json = true;
-  }
-  return o;
+function readDisk3(path) {
+  return textOf2(inspectResolved(path));
 }
-function parseSignoffLabel(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--rule") o.rule = args[++i];
-    else if (a === "--file") o.file = args[++i];
-    else if (a === "--head") o.head = args[++i];
+function relForDisplay3(path, cwd) {
+  const rel = relative10(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute15(rel) ? rel : path;
+}
+function shellChanges(args) {
+  const cmd = args.command ?? args.argv;
+  if (Array.isArray(cmd)) {
+    const argv = cmd.map(asStr2).filter((s) => s.length > 0);
+    if (!argv.length) throw new Error("shell event carries no command/argv to reconstruct");
+    return [{ kind: "command", raw: argv.join(" "), argv }];
+  }
+  const raw = asStr2(cmd);
+  if (!raw) throw new Error("shell event carries no command to reconstruct");
+  return [{ kind: "command", raw, argv: raw.split(/\s+/) }];
+}
+function changesFromCodex(operation, cwd, base = cwd) {
+  const args = operation.args ?? {};
+  const abs = (path) => resolve20(base, path);
+  if (operation.kind === "shell") return shellChanges(args);
+  if (operation.kind !== "file-edit") return [];
+  if (operation.name === "apply_patch" || operation.name === "patch") {
+    const patch = asStr2(args.command) || asStr2(args.patch) || asStr2(args.input);
+    if (!patch) throw new Error("apply_patch event carries no command/patch/input to reconstruct");
+    return applyPatchChanges(patch, abs, cwd);
+  }
+  const fp = asStr2(args.path) || asStr2(args.file_path);
+  if (!fp) throw new Error(`${operation.name || "file-edit"} event carries no path to reconstruct`);
+  const before = readDisk3(abs(fp));
+  const old = args.old_string ?? args.old_str ?? args.old;
+  const next = args.new_string ?? args.new_str ?? args.new;
+  if (typeof old === "string" || typeof next === "string") {
+    const after = applyEdit(before, asStr2(old), asStr2(next), args.replace_all === true);
+    return synthFileChange(relForDisplay3(abs(fp), cwd), before, after);
+  }
+  const content = args.content ?? args.text;
+  if (typeof content === "string") {
+    return synthFileChange(relForDisplay3(abs(fp), cwd), before, content);
+  }
+  throw new Error(`${operation.name || "file-edit"} event for ${fp} carries no old_string/new_string/content to reconstruct`);
+}
+var init_changes2 = __esm({
+  "src/adapters/codex/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_apply_patch();
+    init_disk();
   }
-  return o;
+});
+
+// src/adapters/codex/deny.ts
+function assertCodexWirePhase(phase) {
+  if (phase !== "pre-action" && phase !== "end-of-turn") {
+    throw new Error(`unsupported Codex wire phase: ${phase}`);
+  }
+}
+function codexWire(reason, phase) {
+  assertCodexWirePhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : {
+    hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+    decision: "block",
+    reason
+  };
+  return JSON.stringify(payload) + "\n";
 }
-function parseCheck(args) {
-  const o = {};
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--staged") o.staged = true;
-    else if (a === "--worktree") o.worktree = true;
-    else if (a === "--json") o.json = true;
-    else if (a === "--format") {
-      const v = args[++i];
-      if (v !== void 0 && isFormat(v)) o.format = v;
-    } else if (a === "--diff") o.diff = args[++i];
-    else if (a === "--cwd") o.cwd = args[++i];
-  }
-  return o;
+function codexDenyWire(findings, phase) {
+  assertCodexWirePhase(phase);
+  if (findings.length === 0) return "";
+  return codexWire(formatDenial(findings), phase);
 }
-function splitLongOptionEquals(args) {
-  const out3 = [];
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === "--") {
-      out3.push(...args.slice(i));
-      break;
-    }
-    if (arg.startsWith("--")) {
-      const equals = arg.indexOf("=");
-      if (equals > 2) {
-        out3.push(arg.slice(0, equals), arg.slice(equals + 1));
-        continue;
-      }
-    }
-    out3.push(arg);
+var init_deny2 = __esm({
+  "src/adapters/codex/deny.ts"() {
+    "use strict";
+    init_deny();
   }
-  return out3;
+});
+
+// src/adapters/codex/schema.ts
+function codexOperationKind(toolName) {
+  if (!toolName) return "other";
+  if (SHELL_TOOLS.has(toolName)) return "shell";
+  if (FILE_EDIT_TOOLS.has(toolName)) return "file-edit";
+  if (toolName.startsWith(MCP_PREFIX)) return "mcp";
+  if (FILE_READ_TOOLS.has(toolName)) return "file-read";
+  return "other";
+}
+function inputFrom(parsed) {
+  return {
+    ...typeof parsed.hook_event_name === "string" ? { hook_event_name: parsed.hook_event_name } : {},
+    ...typeof parsed.tool_name === "string" ? { tool_name: parsed.tool_name } : {},
+    ...isRecord(parsed.tool_input) ? { tool_input: parsed.tool_input } : {},
+    ...typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {},
+    ...typeof parsed.session_id === "string" ? { session_id: parsed.session_id } : {},
+    ...typeof parsed.stop_hook_active === "boolean" ? { stop_hook_active: parsed.stop_hook_active } : {}
+  };
 }
-function helpRequested(args) {
-  for (const arg of args) {
-    if (arg === "--") break;
-    if (arg === "-h" || arg === "--help") return true;
+function eventFrom2(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: codexOperationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  const identity2 = { claimedCwd: input.cwd, sessionId: input.session_id };
+  return { phase, operation, identity: identity2 };
+}
+function normalizeCodexEvent(raw, phase) {
+  if (!raw.trim()) return eventFrom2({}, phase);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { failure: "parse-failure", detail: `the Codex hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
   }
-  return false;
+  if (!isRecord(parsed)) {
+    return {
+      failure: "parse-failure",
+      detail: `the Codex hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})`
+    };
+  }
+  return eventFrom2(inputFrom(parsed), phase);
+}
+var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, MCP_PREFIX;
+var init_schema = __esm({
+  "src/adapters/codex/schema.ts"() {
+    "use strict";
+    init_narrow();
+    SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+    FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Write", "Edit"]);
+    FILE_READ_TOOLS = /* @__PURE__ */ new Set(["view_image"]);
+    MCP_PREFIX = "mcp__";
+  }
+});
+
+// src/adapters/codex/adapter.ts
+var POST_OBSERVE, CodexRuntimeAdapter, codexAdapter;
+var init_adapter3 = __esm({
+  "src/adapters/codex/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes2();
+    init_deny2();
+    init_schema();
+    POST_OBSERVE = ["shell", "file-edit", "file-read", "mcp", "other"];
+    CodexRuntimeAdapter = class {
+      name = "codex";
+      /**
+       * CONSERVATIVE and honest. Pre-action deny ENFORCEMENT is not yet proven on a pinned
+       * Codex build, so `preDeny` is empty — the adapter never claims a synchronous veto it
+       * cannot demonstrate. Codex does surface post-execution tool outcomes and an end-of-turn
+       * stop, so those are declared; every real gap is named in `unsupported`. The
+       * `probe:codex-runtime` harness is what may later justify moving a kind into `preDeny`.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: POST_OBSERVE,
+        endOfTurn: true,
+        unsupported: [
+          "pre-action deny enforcement not yet proven on a pinned Codex build (see probe:codex-runtime)",
+          "fail-closed hook transport not yet proven (openai/codex#41979)",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCodexEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the Claude adapter does.
+       *  It never weakens the shared check. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Codex post-action is observation-only and cannot produce a deny wire");
+        }
+        return codexDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *
+       *  1. `post-action` → `unsupported` (observation-only; never a deny wire).
+       *  2. parse failure → a fail-closed deny in Codex's wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, re-wrapped in Codex's wire.
+       *  5. `pre-action` → reconstruct Change[] and run the SAME `evaluate` engine; a deny
+       *     carries the shared denial reason. A reconstruction that cannot be modelled fails
+       *     CLOSED to deny rather than allowing an unseen edit.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Codex post-action is observation-only; the end-of-turn Stop sweep is the post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Codex event: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const wire = stopFromRaw(raw, defaultCwd, idv.trustedRoot).stdout;
+          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+        }
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          turnBaseline(root, parsed.identity.sessionId);
+          const policy = loadPolicy(root);
+          const changes = changesFromCodex(parsed.operation, root, sessionCwd);
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required hook that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is Codex's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    codexAdapter = new CodexRuntimeAdapter();
+  }
+});
+
+// src/adapters/copilot/changes.ts
+import { isAbsolute as isAbsolute16, relative as relative11, resolve as resolve21 } from "node:path";
+function asStr3(v) {
+  return typeof v === "string" ? v : "";
+}
+function readDisk4(path) {
+  return textOf2(inspectResolved(path));
+}
+function relForDisplay4(path, cwd) {
+  const rel = relative11(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute16(rel) ? rel : path;
+}
+function shellChanges2(args) {
+  const cmd = args.command ?? args.input ?? args.argv;
+  if (Array.isArray(cmd)) {
+    const argv = cmd.map(asStr3).filter((s) => s.length > 0);
+    if (!argv.length) throw new Error("shell event carries no command/input/argv to reconstruct");
+    return [{ kind: "command", raw: argv.join(" "), argv }];
+  }
+  const raw = asStr3(cmd);
+  if (!raw) throw new Error("shell event carries no command/input to reconstruct");
+  return [{ kind: "command", raw, argv: raw.split(/\s+/) }];
+}
+function changesFromCopilot(operation, cwd, base = cwd) {
+  const args = operation.args ?? {};
+  const abs = (path) => resolve21(base, path);
+  if (operation.kind === "shell") return shellChanges2(args);
+  if (operation.kind !== "file-edit") return [];
+  const name = (operation.name || "").toLowerCase();
+  if (name === "apply_patch") {
+    const patch = asStr3(args.input) || asStr3(args.patch) || asStr3(args.command);
+    if (!patch) throw new Error("apply_patch event carries no input/patch/command to reconstruct");
+    return applyPatchChanges(patch, abs, cwd);
+  }
+  const fp = asStr3(args.path) || asStr3(args.file_path) || asStr3(args.filename);
+  if (!fp) throw new Error(`${operation.name || "file-edit"} event carries no path to reconstruct`);
+  const before = readDisk4(abs(fp));
+  const display2 = relForDisplay4(abs(fp), cwd);
+  if (name === "str_replace_editor") {
+    const old2 = args.old_str ?? args.old_string ?? args.old;
+    const next2 = args.new_str ?? args.new_string ?? args.new;
+    if (typeof old2 === "string" || typeof next2 === "string") {
+      return synthFileChange(display2, before, applyEdit(before, asStr3(old2), asStr3(next2), args.replace_all === true));
+    }
+    const fileText = args.file_text ?? args.content ?? args.text;
+    if (typeof fileText === "string") return synthFileChange(display2, before, fileText);
+    throw new Error(
+      `str_replace_editor sub-op "${asStr3(args.command) || "unknown"}" for ${fp} cannot be reconstructed exactly (only str_replace/create are modelled; others fail closed pending a real payload)`
+    );
+  }
+  if (Array.isArray(args.edits)) {
+    let after = before;
+    for (const raw of args.edits) {
+      const ed = isRecord(raw) ? raw : {};
+      after = applyEdit(after, asStr3(ed.old_string ?? ed.old_str), asStr3(ed.new_string ?? ed.new_str), ed.replace_all === true);
+    }
+    return synthFileChange(display2, before, after);
+  }
+  const old = args.old_string ?? args.old_str ?? args.old;
+  const next = args.new_string ?? args.new_str ?? args.new;
+  if (typeof old === "string" || typeof next === "string") {
+    return synthFileChange(display2, before, applyEdit(before, asStr3(old), asStr3(next), args.replace_all === true));
+  }
+  const content = args.content ?? args.text ?? args.file_text;
+  if (typeof content === "string") return synthFileChange(display2, before, content);
+  throw new Error(
+    `${operation.name || "file-edit"} event for ${fp} carries no old_string/new_string/content to reconstruct`
+  );
+}
+var init_changes3 = __esm({
+  "src/adapters/copilot/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_apply_patch();
+    init_disk();
+    init_narrow();
+  }
+});
+
+// src/adapters/copilot/deny.ts
+function assertCopilotWirePhase(phase) {
+  const known = ["pre-action", "end-of-turn"];
+  if (!known.includes(phase)) {
+    throw new Error(`unsupported Copilot wire phase: ${phase}`);
+  }
+}
+function copilotWire(reason, phase) {
+  assertCopilotWirePhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : { permissionDecision: "deny", permissionDecisionReason: reason };
+  return JSON.stringify(payload) + "\n";
+}
+function copilotDenyWire(findings, phase) {
+  assertCopilotWirePhase(phase);
+  if (findings.length === 0) return "";
+  return copilotWire(formatDenial(findings), phase);
+}
+var init_deny3 = __esm({
+  "src/adapters/copilot/deny.ts"() {
+    "use strict";
+    init_deny();
+  }
+});
+
+// src/adapters/copilot/schema.ts
+function copilotOperationKind(toolName) {
+  if (!toolName) return "other";
+  const name = toolName.toLowerCase();
+  if (SHELL_TOOLS2.has(name)) return "shell";
+  if (FILE_EDIT_TOOLS2.has(name)) return "file-edit";
+  if (name.startsWith(MCP_PREFIX2)) return "mcp";
+  if (FILE_READ_TOOLS2.has(name)) return "file-read";
+  return "other";
+}
+function argsFrom(parsed) {
+  if (isRecord(parsed.tool_input)) return parsed.tool_input;
+  const ta = parsed.toolArgs;
+  if (isRecord(ta)) return ta;
+  if (typeof ta === "string" && ta.trim()) {
+    try {
+      const decoded = JSON.parse(ta);
+      return isRecord(decoded) ? decoded : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function inputFrom2(parsed) {
+  const toolName = typeof parsed.tool_name === "string" ? parsed.tool_name : typeof parsed.toolName === "string" ? parsed.toolName : void 0;
+  const sessionId = typeof parsed.session_id === "string" ? parsed.session_id : typeof parsed.sessionId === "string" ? parsed.sessionId : void 0;
+  const args = argsFrom(parsed);
+  return {
+    ...toolName !== void 0 ? { tool_name: toolName } : {},
+    ...args !== void 0 ? { tool_input: args } : {},
+    ...typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {},
+    ...sessionId !== void 0 ? { session_id: sessionId } : {},
+    ...typeof parsed.stop_hook_active === "boolean" ? { stop_hook_active: parsed.stop_hook_active } : {}
+  };
+}
+function eventFrom3(input, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotOperationKind(input.tool_name), name: input.tool_name ?? "", args: input.tool_input ?? {} };
+  const identity2 = { claimedCwd: input.cwd, sessionId: input.session_id };
+  return { phase, operation, identity: identity2 };
+}
+function parseRaw(raw) {
+  if (!raw.trim()) return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { kind: "fail", detail: `the Copilot hook payload is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!isRecord(parsed)) {
+    return { kind: "fail", detail: `the Copilot hook payload is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})` };
+  }
+  return { kind: "ok", record: parsed };
+}
+function normalizeCopilotEvent(raw, phase) {
+  const parsed = parseRaw(raw);
+  if (parsed.kind === "absent") return eventFrom3({}, phase);
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  return eventFrom3(inputFrom2(parsed.record), phase);
+}
+function copilotStopInput(raw) {
+  const parsed = parseRaw(raw);
+  if (parsed.kind === "absent") return "{}";
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  const input = inputFrom2(parsed.record);
+  return JSON.stringify({
+    ...input.cwd !== void 0 ? { cwd: input.cwd } : {},
+    ...input.session_id !== void 0 ? { session_id: input.session_id } : {},
+    ...input.stop_hook_active !== void 0 ? { stop_hook_active: input.stop_hook_active } : {}
+  });
+}
+var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, MCP_PREFIX2;
+var init_schema2 = __esm({
+  "src/adapters/copilot/schema.ts"() {
+    "use strict";
+    init_narrow();
+    SHELL_TOOLS2 = /* @__PURE__ */ new Set(["bash", "powershell", "write_bash", "write_powershell"]);
+    FILE_EDIT_TOOLS2 = /* @__PURE__ */ new Set(["create", "edit", "write", "multiedit", "apply_patch", "str_replace_editor"]);
+    FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read"]);
+    MCP_PREFIX2 = "mcp__";
+  }
+});
+
+// src/adapters/copilot/adapter.ts
+var CopilotRuntimeAdapter, copilotAdapter;
+var init_adapter4 = __esm({
+  "src/adapters/copilot/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes3();
+    init_deny3();
+    init_schema2();
+    CopilotRuntimeAdapter = class {
+      name = "github-copilot-cli";
+      /**
+       * CONSERVATIVE and honest. Pre-action deny ENFORCEMENT is not yet proven on a pinned
+       * Copilot CLI build, so `preDeny` is empty — the adapter never claims a synchronous veto
+       * it has not demonstrated on the real runtime. `postObserve` is empty for milestone one:
+       * Copilot does expose a `postToolUse` observation surface, but this adapter does not yet
+       * consume it as a supported post-action path (`decide(..., 'post-action')` returns
+       * `unsupported`), so it declares no post-observe capability rather than advertising kinds it
+       * does not report. Every real gap is named in `unsupported`. The `probe:copilot-runtime`
+       * harness is what may later justify moving a kind into `preDeny` or populating `postObserve`.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "pre-action deny enforcement not yet proven on a pinned Copilot CLI build (see probe:copilot-runtime)",
+          "COMMAND preToolUse hook timeout fails OPEN on Copilot CLI: a timed-out hook lets the tool call proceed (crash / non-zero exit / exit 2 fail closed); an HTTP preToolUse hook fails OPEN on network error / timeout / non-2xx, so only the local command/exec transport is a qualification candidate",
+          "preToolUse is the only PRE-EXECUTION tool veto; agentStop can only block turn completion and force continuation (a lifecycle control, not a filesystem veto), and Copilot overrides the hook after 8 consecutive blocks (stop_hook_active lifecycle); postToolUse observation is not yet consumed by this adapter",
+          "apply_patch / str_replace_editor exact hook payloads are modelled from the published contract but not yet confirmed against a pinned real-run fixture (str_replace_editor sub-ops other than str_replace/create fail closed); a PascalCase Edit carrying a patch-style payload fails closed unless a fixture proves the Edit-field rewrite",
+          "shell-session write tools (write_bash / write_powershell) are classified as mutation-capable shell ops; their exact hook payload is not yet confirmed against a pinned fixture, so an event carrying no reconstructable command/input fails closed",
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCopilotEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the Claude and Codex
+       *  adapters do. It never weakens the shared check. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return {
+            ok: false,
+            rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against`
+          };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Copilot post-action is observation-only and cannot produce a deny wire");
+        }
+        return copilotDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *
+       *  1. `post-action` → `unsupported` (observation-only; never a deny wire).
+       *  2. parse failure → a fail-closed deny in Copilot's wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, whose wire is already Copilot's
+       *     agentStop `{decision:"block",reason}` shape and passes through unchanged.
+       *  5. `pre-action` → reconstruct Change[] and run the SAME `evaluate` engine; a deny
+       *     carries the shared denial reason. A reconstruction that cannot be modelled fails
+       *     CLOSED to deny rather than allowing an unseen edit.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return {
+            outcome: "unsupported",
+            detail: "Copilot post-action is observation-only; the end-of-turn agentStop sweep is the post-turn reconciliation."
+          };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const stopInput = copilotStopInput(raw);
+          if (typeof stopInput !== "string") {
+            const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
+            const wire2 = this.denyPayload(findings, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire: wire2, decision: { verdict: "deny", findings, reason: wire2 } };
+          }
+          const wire = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot).stdout;
+          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+        }
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          turnBaseline(root, parsed.identity.sessionId);
+          const policy = loadPolicy(root);
+          const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required hook that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is Copilot's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    copilotAdapter = new CopilotRuntimeAdapter();
+  }
+});
+
+// src/adapters/copilot-sdk/changes.ts
+import { execFileSync as execFileSync15 } from "node:child_process";
+import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync15, readFileSync as readFileSync28, rmSync as rmSync13, existsSync as existsSync21, realpathSync as realpathSync11 } from "node:fs";
+import { tmpdir as tmpdir8 } from "node:os";
+import { basename as basename6, dirname as dirname14, isAbsolute as isAbsolute17, relative as relative12, resolve as resolve22, join as join29 } from "node:path";
+function asStr4(v) {
+  return typeof v === "string" ? v : "";
+}
+function relForDisplay5(path, cwd) {
+  const rel = relative12(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute17(rel) ? rel : path;
+}
+function canonicalContainedTarget(abs, root) {
+  let realRoot;
+  try {
+    realRoot = realpathSync11(root);
+  } catch (e) {
+    throw new Error(`trusted repository root ${root} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  let dir = abs;
+  const tail = [];
+  while (!existsSync21(dir)) {
+    const parent = dirname14(dir);
+    if (parent === dir) break;
+    tail.unshift(basename6(dir));
+    dir = parent;
+  }
+  let realDir;
+  try {
+    realDir = realpathSync11(dir);
+  } catch (e) {
+    throw new Error(`write target ${abs} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const real = tail.length ? join29(realDir, ...tail) : realDir;
+  const rel = relative12(realRoot, real);
+  if (rel === "" || rel.startsWith("..") || isAbsolute17(rel)) {
+    throw new Error(`write target ${abs} resolves outside the trusted repository root ${realRoot} \u2014 refusing to judge a write beyond the repository`);
+  }
+  return { real, rel };
+}
+function sdkFileEditChanges(args, cwd, base = cwd) {
+  const path = asStr4(args.path) || asStr4(args.fileName) || asStr4(args.file_path);
+  if (!path) throw new Error("write event carries no fileName/path to reconstruct");
+  const abs = resolve22(base, path);
+  const canonical2 = canonicalContainedTarget(abs, cwd);
+  const claimedResolved = asStr4(args.resolvedPath);
+  if (claimedResolved && canonicalContainedTarget(resolve22(base, claimedResolved), cwd).real !== canonical2.real) {
+    throw new Error(`the runtime-claimed resolvedPath (${claimedResolved}) does not match the host-derived target for ${path} \u2014 refusing to judge a different path`);
+  }
+  const display2 = canonical2.rel;
+  const requestRel = relForDisplay5(abs, cwd);
+  const entry = inspectResolved(canonical2.real);
+  const isCreate = entry.kind === "absent";
+  const before = textOf2(entry);
+  if (!isCreate && before === null) {
+    throw new Error(`write target ${display2} exists but cannot be read to judge it (${entry.kind})`);
+  }
+  const newFileContents = typeof args.newFileContents === "string" ? args.newFileContents : void 0;
+  const rawDiff = asStr4(args.diff);
+  const afterFromDiff = rawDiff.trim() ? reconstructAfterViaGit(rawDiff, requestRel, before, isCreate) : void 0;
+  if (newFileContents !== void 0) {
+    if (afterFromDiff !== void 0 && afterFromDiff !== newFileContents) {
+      throw new Error(`write supplies both newFileContents and a diff that DISAGREE for ${display2}; ambiguous request \u2014 refusing to judge only one representation`);
+    }
+    return synthFileChange(display2, before, newFileContents);
+  }
+  if (afterFromDiff !== void 0) return synthFileChange(display2, before, afterFromDiff);
+  return null;
+}
+function stripPrefix(p) {
+  return /^[ab]\//.test(p) ? p.slice(2) : p;
+}
+function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
+  const bytes = Buffer.byteLength(rawDiff);
+  if (bytes > DIFF_MAX_BYTES()) throw new Error(`write diff for ${display2} is ${bytes} bytes (over the ${DIFF_MAX_BYTES()}-byte reconstruction budget)`);
+  const { op, patch } = canonicalPatch(rawDiff, display2, isCreate);
+  const dir = mkdtempSync7(join29(tmpdir8(), "hf-sdk-apply-"));
+  try {
+    const targetPath = join29(dir, TARGET);
+    if (op !== "create") writeFileSync15(targetPath, before ?? "");
+    const patchPath = join29(dir, "change.patch");
+    writeFileSync15(patchPath, patch);
+    const git8 = (extra) => execFileSync15("git", ["apply", ...extra, patchPath], {
+      cwd: dir,
+      encoding: "utf8",
+      timeout: APPLY_TIMEOUT_MS(),
+      maxBuffer: APPLY_MAXBUFFER(),
+      killSignal: "SIGKILL"
+    });
+    const stat = git8(["--numstat"]).trim();
+    const rows = stat ? stat.split("\n") : [];
+    if (rows.length !== 1) throw new Error(`write diff spans ${rows.length} files; a single permission target (${display2}) was expected`);
+    const statPath = rows[0].split("	")[2];
+    if (statPath !== TARGET) throw new Error(`write diff reconstructs a different file (${statPath}) than the bound target`);
+    git8(["--check"]);
+    git8([]);
+    return op === "delete" ? null : readFileSync28(targetPath, "utf8");
+  } catch (e) {
+    throw new Error(`could not reconstruct the write to ${display2} from its diff via git apply: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    rmSync13(dir, { recursive: true, force: true });
+  }
+}
+function canonicalPatch(raw, display2, isCreate) {
+  const lines = raw.replace(/\r\n/g, "\n").split("\n");
+  if (lines.length > DIFF_MAX_LINES()) {
+    throw new Error(`write diff for ${display2} is ${lines.length} lines (over the ${DIFF_MAX_LINES()}-line reconstruction budget)`);
+  }
+  const at = lines.findIndex((l) => l.startsWith("@@ "));
+  if (at < 0) throw new Error(`write diff for ${display2} has no hunk to reconstruct`);
+  const header = lines.slice(0, at);
+  const body = lines.slice(at);
+  let src;
+  let dst;
+  let hasGitLine = false;
+  let sawCreateMode = false;
+  let sawDeleteMode = false;
+  let sawSemanticHeader = false;
+  for (const line of header) {
+    if (line.trim() === "") continue;
+    if (line.startsWith("diff --git ")) {
+      if (hasGitLine) throw new Error(`write diff for ${display2} carries more than one diff --git header (contradictory / multi-file) \u2014 refusing to reconstruct`);
+      hasGitLine = true;
+      sawSemanticHeader = true;
+      for (const p of line.slice("diff --git ".length).trim().split(/\s+/)) assertBound(stripPrefix(p), display2);
+    } else if (line.startsWith("--- ")) {
+      if (src !== void 0) throw new Error(`write diff for ${display2} carries more than one --- endpoint (contradictory header) \u2014 refusing to reconstruct`);
+      src = line.slice(4).split("	")[0].trim();
+    } else if (line.startsWith("+++ ")) {
+      if (dst !== void 0) throw new Error(`write diff for ${display2} carries more than one +++ endpoint (contradictory header) \u2014 refusing to reconstruct`);
+      dst = line.slice(4).split("	")[0].trim();
+    } else if (line.startsWith("index ")) {
+      sawSemanticHeader = true;
+    } else if (/^new file mode\b/.test(line)) {
+      if (sawCreateMode) throw new Error(`write diff for ${display2} carries duplicate new file mode metadata \u2014 refusing to reconstruct`);
+      sawCreateMode = true;
+      sawSemanticHeader = true;
+    } else if (/^deleted file mode\b/.test(line)) {
+      if (sawDeleteMode) throw new Error(`write diff for ${display2} carries duplicate deleted file mode metadata \u2014 refusing to reconstruct`);
+      sawDeleteMode = true;
+      sawSemanticHeader = true;
+    } else {
+      throw new Error(`write diff for ${display2} carries an unsupported or unrecognized pre-hunk header line ("${line.trim().slice(0, 60)}") \u2014 refusing to reconstruct`);
+    }
+  }
+  let op;
+  if (src === void 0 && dst === void 0) {
+    if (sawSemanticHeader) throw new Error(`write diff for ${display2} carries Git file metadata but no --- / +++ endpoints (malformed)`);
+    op = isCreate ? "create" : "modify";
+  } else if (src !== void 0 && dst !== void 0) {
+    const srcNull = src === "/dev/null";
+    const dstNull = dst === "/dev/null";
+    if (srcNull && dstNull) throw new Error(`write diff for ${display2} has /dev/null on both sides`);
+    if (!srcNull) assertBound(stripPrefix(src), display2);
+    if (!dstNull) assertBound(stripPrefix(dst), display2);
+    op = srcNull ? "create" : dstNull ? "delete" : "modify";
+  } else {
+    throw new Error(`write diff for ${display2} has a one-sided --- / +++ endpoint pair (malformed) \u2014 refusing to repair it into a valid operation`);
+  }
+  if (sawCreateMode && op !== "create") throw new Error(`write diff for ${display2} carries new file mode metadata but its endpoints describe a ${op} \u2014 contradictory, refusing to reconstruct`);
+  if (sawDeleteMode && op !== "delete") throw new Error(`write diff for ${display2} carries deleted file mode metadata but its endpoints describe a ${op} \u2014 contradictory, refusing to reconstruct`);
+  if (op === "create" && !isCreate) throw new Error(`write diff for ${display2} proposes a create but the target already exists`);
+  if (op !== "create" && isCreate) throw new Error(`write diff for ${display2} proposes a ${op} but the target is absent`);
+  const source = op === "create" ? "/dev/null" : `a/${TARGET}`;
+  const dest = op === "delete" ? "/dev/null" : `b/${TARGET}`;
+  const joined = body.join("\n");
+  const patch = `--- ${source}
++++ ${dest}
+` + (joined.endsWith("\n") ? joined : joined + "\n");
+  return { op, patch };
+}
+function assertBound(declared, display2) {
+  if (declared !== display2) {
+    throw new Error(`write diff path (${declared}) does not match the permission request target (${display2}) \u2014 refusing to judge a different file`);
+  }
+}
+var num2, APPLY_TIMEOUT_MS, APPLY_MAXBUFFER, DIFF_MAX_BYTES, DIFF_MAX_LINES, TARGET;
+var init_changes4 = __esm({
+  "src/adapters/copilot-sdk/changes.ts"() {
+    "use strict";
+    init_changes();
+    init_disk();
+    num2 = (name, fallback) => {
+      const raw = process.env[name];
+      const n2 = raw === void 0 ? NaN : Number(raw);
+      return Number.isFinite(n2) && n2 > 0 ? n2 : fallback;
+    };
+    APPLY_TIMEOUT_MS = () => num2("TAMPERWARD_RECONSTRUCT_TIMEOUT_MS", 5e3);
+    APPLY_MAXBUFFER = () => num2("TAMPERWARD_RECONSTRUCT_MAXBUFFER", 32 * 1024 * 1024);
+    DIFF_MAX_BYTES = () => num2("TAMPERWARD_RECONSTRUCT_MAX_BYTES", 384 * 1024);
+    DIFF_MAX_LINES = () => num2("TAMPERWARD_RECONSTRUCT_MAX_LINES", 4e3);
+    TARGET = "target";
+  }
+});
+
+// src/adapters/copilot-sdk/deny.ts
+function assertPhase(phase) {
+  const known = ["pre-action", "end-of-turn"];
+  if (!known.includes(phase)) throw new Error(`unsupported Copilot SDK wire phase: ${phase}`);
+}
+function copilotSdkWire(reason, phase) {
+  assertPhase(phase);
+  const payload = phase === "end-of-turn" ? { decision: "block", reason } : { kind: "reject", feedback: reason };
+  return JSON.stringify(payload) + "\n";
+}
+function copilotSdkDenyWire(findings, phase) {
+  assertPhase(phase);
+  if (findings.length === 0) return "";
+  return copilotSdkWire(formatDenial(findings), phase);
+}
+var init_deny4 = __esm({
+  "src/adapters/copilot-sdk/deny.ts"() {
+    "use strict";
+    init_deny();
+  }
+});
+
+// src/adapters/copilot-sdk/schema.ts
+function copilotSdkOperationKind(kind) {
+  switch ((kind ?? "").toLowerCase()) {
+    case "shell":
+      return "shell";
+    case "write":
+      return "file-edit";
+    case "read":
+      return "file-read";
+    case "mcp":
+      return "mcp";
+    default:
+      return "other";
+  }
+}
+function str3(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function requestFrom2(parsed) {
+  const s = (k) => str3(parsed[k]);
+  return {
+    ...s("kind") !== void 0 ? { kind: s("kind") } : {},
+    ...s("toolName") !== void 0 ? { toolName: s("toolName") } : {},
+    ...s("fileName") !== void 0 ? { fileName: s("fileName") } : {},
+    ...s("resolvedPath") !== void 0 ? { resolvedPath: s("resolvedPath") } : {},
+    ...s("fullCommandText") !== void 0 ? { fullCommandText: s("fullCommandText") } : {},
+    ...s("diff") !== void 0 ? { diff: s("diff") } : {},
+    ...s("newFileContents") !== void 0 ? { newFileContents: s("newFileContents") } : {},
+    ...s("intention") !== void 0 ? { intention: s("intention") } : {},
+    ...s("cwd") !== void 0 ? { cwd: s("cwd") } : {},
+    ...s("sessionId") !== void 0 ? { sessionId: s("sessionId") } : {},
+    ...typeof parsed.stopHookActive === "boolean" ? { stopHookActive: parsed.stopHookActive } : {}
+  };
+}
+function argsFor(req2) {
+  const kind = copilotSdkOperationKind(req2.kind);
+  if (kind === "shell") return req2.fullCommandText !== void 0 ? { command: req2.fullCommandText } : {};
+  if (kind === "file-edit") {
+    return {
+      ...req2.fileName !== void 0 ? { path: req2.fileName } : {},
+      // The SDK's experimental runtime-resolved canonical path. Retained as an UNTRUSTED claim: the
+      // host derives its own canonical target and denies on mismatch — resolvedPath is never authority.
+      ...req2.resolvedPath !== void 0 ? { resolvedPath: req2.resolvedPath } : {},
+      ...req2.diff !== void 0 ? { diff: req2.diff } : {},
+      ...req2.newFileContents !== void 0 ? { newFileContents: req2.newFileContents } : {},
+      ...req2.intention !== void 0 ? { intention: req2.intention } : {}
+    };
+  }
+  return {};
+}
+function eventFrom4(req2, phase) {
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotSdkOperationKind(req2.kind), name: req2.toolName ?? "", args: argsFor(req2) };
+  const identity2 = { claimedCwd: req2.cwd, sessionId: req2.sessionId };
+  return { phase, operation, identity: identity2 };
+}
+function parseRaw2(raw) {
+  if (!raw.trim()) return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { kind: "fail", detail: `the Copilot SDK permission request is not valid JSON: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!isRecord(parsed)) {
+    return { kind: "fail", detail: `the Copilot SDK permission request is not a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})` };
+  }
+  return { kind: "ok", record: parsed };
+}
+function normalizeCopilotSdkEvent(raw, phase) {
+  const parsed = parseRaw2(raw);
+  if (parsed.kind === "absent") return eventFrom4({}, phase);
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  return eventFrom4(requestFrom2(parsed.record), phase);
+}
+function copilotSdkStopInput(raw) {
+  const parsed = parseRaw2(raw);
+  if (parsed.kind === "absent") return "{}";
+  if (parsed.kind === "fail") return { failure: "parse-failure", detail: parsed.detail };
+  const req2 = requestFrom2(parsed.record);
+  return JSON.stringify({
+    ...req2.cwd !== void 0 ? { cwd: req2.cwd } : {},
+    ...req2.sessionId !== void 0 ? { session_id: req2.sessionId } : {},
+    ...req2.stopHookActive !== void 0 ? { stop_hook_active: req2.stopHookActive } : {}
+  });
+}
+var init_schema3 = __esm({
+  "src/adapters/copilot-sdk/schema.ts"() {
+    "use strict";
+    init_narrow();
+  }
+});
+
+// src/adapters/copilot-sdk/adapter.ts
+var FILE_EDIT_NO_CONTENT_DETAIL, CopilotSdkHostedAdapter, copilotSdkAdapter;
+var init_adapter5 = __esm({
+  "src/adapters/copilot-sdk/adapter.ts"() {
+    "use strict";
+    init_engine();
+    init_policy_load();
+    init_hook();
+    init_session();
+    init_repo_context();
+    init_contract();
+    init_changes3();
+    init_changes4();
+    init_deny4();
+    init_schema3();
+    FILE_EDIT_NO_CONTENT_DETAIL = "this Copilot SDK write surfaced no usable content (no diff, no newFileContents), so content-aware pre-denial cannot be established for this measured configuration; the end-of-turn git sweep is the authority for the landed write. This adapter does not blanket-deny writes.";
+    CopilotSdkHostedAdapter = class {
+      name = "github-copilot-sdk-hosted";
+      /**
+       * CONSERVATIVE and honest. `preDeny` is empty: even shell pre-deny is only a CANDIDATE until the
+       * spike proves, on a pinned SDK, that a rejected/thrown/timed-out permission callback does NOT
+       * dispatch the tool (the decisive unknown #611 must measure). `postObserve` is empty (the SDK has
+       * no post-execution veto). `endOfTurn` is true via `onAgentStop`. Every real gap is named in
+       * `unsupported`, at the granularity #611 asks for.
+       */
+      capabilities = {
+        preDeny: [],
+        postObserve: [],
+        endOfTurn: true,
+        unsupported: [
+          "shell pre-deny enforcement is only a CANDIDATE until the spike proves on a pinned @github/copilot-sdk that a rejected permission decision actually blocks tool dispatch (see spike:copilot-sdk)",
+          "content-aware file-edit pre-deny is CONDITIONAL on the pinned runtime surfacing usable write content: the adapter reconstructs and content-judges a write carrying a diff / newFileContents, but a write that surfaces neither is unsupported for that measured configuration (allow-through; the end-of-turn sweep is authority) \u2014 never a blanket path deny",
+          "the SDK permission-handler failure semantics (synchronous throw / rejected Promise / timeout) are UNMEASURED: whether a broken decision path fails open (dispatches the tool) or closed is exactly what the spike must establish; a single observed fail-open makes the path ineligible for #482 / Round 4.1",
+          'onAgentStop is a lifecycle continuation control ({decision:"block"} forces another turn, guarded by stopHookActive), not a filesystem veto',
+          "network-egress control",
+          "identity / authentication"
+        ]
+      };
+      parseEvent(raw, phase) {
+        return normalizeCopilotSdkEvent(raw, phase);
+      }
+      /** Identity is a CLAIM validated against the runner's independently derived trusted root,
+       *  reusing `repoContext` / `validateClaimAgainstRoot` exactly as the other adapters do. */
+      validateIdentity(claim, defaultCwd) {
+        const base = defaultCwd ?? process.cwd();
+        const runnerCtx = repoContext(base);
+        if (!runnerCtx) {
+          return { ok: false, rejected: `runner cwd (${base}) is not in a repository, so there is no trusted root to validate against` };
+        }
+        const v = validateClaimAgainstRoot(claim.claimedCwd, runnerCtx.root, base);
+        return v.ok ? { ok: true, trustedRoot: v.trustedRoot } : { ok: false, rejected: v.rejected };
+      }
+      denyPayload(findings, phase) {
+        if (phase === "post-action") {
+          throw new Error("Copilot SDK post-action is observation-only and cannot produce a deny wire");
+        }
+        return copilotSdkDenyWire(findings, phase);
+      }
+      /**
+       * parse → validate identity → decide, every failure CLOSED (deny), in order:
+       *  1. `post-action` → `unsupported` (the SDK has no post-execution veto).
+       *  2. parse failure → a fail-closed deny in the SDK reject wire.
+       *  3. identity claim rejected → a fail-closed deny BEFORE any content evaluation.
+       *  4. `end-of-turn` → delegate to the canonical git sweep, whose wire is already the SDK
+       *     `onAgentStop` `{decision:"block",reason}` shape.
+       *  5. `pre-action` + shell → the SAME `evaluate` engine over the reconstructed command.
+       *  6. `pre-action` + file-edit → `unsupported` (content not surfaced; sweep is authority).
+       *  7. `pre-action` + read/mcp/other → no Change → allow.
+       */
+      decide(raw, phase, defaultCwd) {
+        if (phase === "post-action") {
+          return { outcome: "unsupported", detail: "Copilot SDK has no post-execution veto; the end-of-turn onAgentStop sweep is the post-turn reconciliation." };
+        }
+        const parsed = this.parseEvent(raw, phase);
+        if ("failure" in parsed) {
+          const findings = [steeringUnavailableFinding(`unparseable Copilot SDK permission request: ${parsed.detail}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "parse-failure", detail: parsed.detail, wire, unavailableReason: "parse-failure", decision: { verdict: "deny", findings, reason: wire } };
+        }
+        const idv = this.validateIdentity(parsed.identity, defaultCwd);
+        if (!idv.ok) {
+          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire = this.denyPayload(findings, phase);
+          return { outcome: "ok", wire, detail: idv.rejected, unavailableReason: "identity-rejected", decision: { verdict: "deny", findings, reason: wire } };
+        }
+        if (phase === "end-of-turn") {
+          const stopInput = copilotSdkStopInput(raw);
+          if (typeof stopInput !== "string") {
+            const findings2 = [steeringUnavailableFinding(`unparseable Copilot SDK permission request: ${stopInput.detail}`)];
+            const wire = this.denyPayload(findings2, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire, unavailableReason: "parse-failure", decision: { verdict: "deny", findings: findings2, reason: wire } };
+          }
+          const swept = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
+        }
+        let stage = "repo-context";
+        try {
+          const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
+          stage = "baseline";
+          turnBaseline(root, parsed.identity.sessionId);
+          const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
+          stage = "policy-load";
+          const policy = loadPolicy(root);
+          if (parsed.operation.kind === "file-edit") {
+            stage = "reconstruction";
+            const changes2 = sdkFileEditChanges(parsed.operation.args, root, sessionCwd);
+            if (changes2 === null) return { outcome: "unsupported", detail: FILE_EDIT_NO_CONTENT_DETAIL };
+            stage = "evaluate";
+            const findings2 = evaluate(changes2, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+            const wire2 = this.denyPayload(findings2, "pre-action");
+            return { outcome: "ok", wire: wire2, decision: { verdict: findings2.length ? "deny" : "allow", findings: findings2, reason: wire2 || void 0 } };
+          }
+          stage = "reconstruction";
+          const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
+          stage = "evaluate";
+          const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const findings = [steeringUnavailableFinding(detail)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, unavailableReason: stage, decision: { verdict: "deny", findings, reason: wire } };
+        }
+      }
+      /** A transport failure or a required callback that did not fire → a fail-closed deny at the
+       *  seam, through the adapter's own `denyPayload` so the wire is the SDK's native envelope. */
+      failClosed(outcome, detail, phase) {
+        return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
+      }
+    };
+    copilotSdkAdapter = new CopilotSdkHostedAdapter();
+  }
+});
+
+// src/adapters/registry.ts
+function adapterFor(id) {
+  const name = ADAPTER_ALIASES[id] ?? id;
+  return RUNTIME_ADAPTERS.find((a) => a.name === name) ?? null;
+}
+function labelFor(name) {
+  return ADAPTER_LABELS[name] ?? name;
+}
+var RUNTIME_ADAPTERS, ADAPTER_LABELS, ADAPTER_ALIASES;
+var init_registry = __esm({
+  "src/adapters/registry.ts"() {
+    "use strict";
+    init_adapter2();
+    init_adapter3();
+    init_adapter4();
+    init_adapter5();
+    RUNTIME_ADAPTERS = [
+      claudeAdapter,
+      codexAdapter,
+      copilotAdapter,
+      copilotSdkAdapter
+    ];
+    ADAPTER_LABELS = {
+      "claude-code": "Claude Code",
+      codex: "Codex",
+      "github-copilot-cli": "GitHub Copilot CLI",
+      "github-copilot-sdk-hosted": "GitHub Copilot SDK (hosted)"
+    };
+    ADAPTER_ALIASES = {
+      claude: "claude-code",
+      copilot: "github-copilot-cli",
+      "copilot-cli": "github-copilot-cli",
+      "copilot-sdk": "github-copilot-sdk-hosted"
+    };
+  }
+});
+
+// src/adapters/evidence.ts
+function sameIdSet(a, b) {
+  const ua = [...new Set(a)].sort();
+  const ub = [...new Set(b)].sort();
+  return ua.length === ub.length && ua.every((x, i) => x === ub[i]);
+}
+function evidenceBindingMatches(record, current) {
+  return record.runtime_id === current.runtime_id && record.runtime_version === current.runtime_version && record.model === current.model && record.platform === current.platform && record.execution_mode === current.execution_mode && record.hook_config_hash === current.hook_config_hash && // Pinned SDK/protocol component versions — order-insensitive set comparison.
+  sameIdSet(record.component_versions, current.component_versions) && // The TamperWard build (version+commit): a different TamperWard build is a different binding.
+  record.tamperward_version === current.tamperward_version && // Adapter capability hash — REQUIRED (fail-closed) on both sides. A `null` recorded hash
+  // (unrecoverable, never fabricated) can never equal a concrete current hash.
+  record.adapter_capability_hash !== null && current.adapter_capability_hash !== null && record.adapter_capability_hash === current.adapter_capability_hash && // The capability surface the probe tested — order-insensitive set comparison.
+  sameIdSet(record.tested_capabilities, current.tested_capabilities);
+}
+function matchRetainedEvidence(current, catalogue = RETAINED_EVIDENCE) {
+  return catalogue.find((r) => evidenceBindingMatches(r.binding, current)) ?? null;
+}
+var RETAINED_EVIDENCE;
+var init_evidence = __esm({
+  "src/adapters/evidence.ts"() {
+    "use strict";
+    RETAINED_EVIDENCE = [
+      {
+        ref: "copilot-sdk-capture-2026-09-20",
+        source: "harness/adapters/copilot-sdk/evidence/capture-2026-09-20.json",
+        source_artifact_sha256: "c46fba989dc0e772012c5fdb1291cf099326d24da2b551788be2e1e85113e49a",
+        binding: {
+          runtime_id: "github-copilot-sdk-hosted",
+          runtime_version: "copilot-runtime@1.0.85",
+          component_versions: ["@github/copilot-sdk@1.0.14", "copilot-protocol@3"],
+          // The capture's own provenance: tamperward@2.31.0+3671a5e6 (capture-2026-09-20.json).
+          tamperward_version: "2.31.0+3671a5e6",
+          // NOT authentically recoverable from the committed capture: the sanitized artifact records
+          // no adapter capability-declaration hash. We do NOT invent a historical hash. `null` makes
+          // the applicability match fail CLOSED (a null recorded hash can never equal a concrete
+          // current hash), so this record can never promote — the honest, safe outcome.
+          adapter_capability_hash: null,
+          // The capability ids the capture actually observed (the `observations` below).
+          tested_capabilities: ["pre-deny:shell", "hook-not-invoked", "transport:timeout"],
+          model: "gpt-5.4",
+          platform: "darwin-arm64",
+          execution_mode: "headless",
+          hook_config_hash: null
+        },
+        observations: [
+          {
+            id: "pre-deny:shell",
+            result: "proven",
+            detail: "returned-reject path (permission.completed result.kind denied): a rejected permission decision blocked shell tool dispatch \u2014 protected state not mutated (shell-pre-deny observation, boundary seq 2 < completion seq 3)"
+          },
+          {
+            id: "hook-not-invoked",
+            result: "proven",
+            detail: "callback-failure path: a broken permission callback (sync-throw, reject and adapter-throw, independently) failed CLOSED \u2014 the tool did not dispatch and protected state stayed intact"
+          },
+          {
+            id: "transport:timeout",
+            result: "inconclusive",
+            detail: "callback-timeout path: a hung permission handler emits no permission.completed (the pinned SDK has no handler timeout), so non-dispatch is intrinsically unobservable \u2014 timeout is not proven either way"
+          }
+        ]
+      }
+    ];
+  }
+});
+
+// src/runtime-qualification.ts
+import { createHash as createHash17 } from "node:crypto";
+function includesKind(set, kind) {
+  return set.includes(kind);
+}
+function find(unsupported, re) {
+  return unsupported.find((u) => re.test(u));
+}
+function indexEvidence(evidence) {
+  const m = /* @__PURE__ */ new Map();
+  if (!evidence) return m;
+  for (const o of evidence.observations) m.set(o.id, o);
+  return m;
+}
+function assessFromEvidence(id, index, evidence) {
+  const obs = index.get(id);
+  if (!obs || !evidence) return null;
+  const state = obs.result === "proven" ? "PROVEN" : obs.result === "fail-open" ? "FAIL-OPEN" : "INCONCLUSIVE";
+  return {
+    id,
+    state,
+    evidence: {
+      source: "committed-evidence",
+      detail: `${obs.detail} [retained evidence ${evidence.ref} \xB7 ${evidence.source} \xB7 sha256 ${evidence.source_artifact_sha256.slice(0, 12)}]`
+    }
+  };
+}
+function assessPreDeny(caps, id, kind, kindNote, index, evidence) {
+  const proven = assessFromEvidence(id, index, evidence);
+  if (proven) return proven;
+  if (includesKind(caps.preDeny, kind)) {
+    return {
+      id,
+      state: "PARTIAL",
+      evidence: {
+        source: "adapter-declaration",
+        detail: `declared preDeny includes '${kind}' (${kindNote}); the contract denies it at the adapter boundary, but no retained real-runtime probe proves this runtime/version invokes and honors the hook live`
+      }
+    };
+  }
+  const note = find(caps.unsupported, PRE_DENY_UNPROVEN_RE);
+  if (note) return { id, state: "UNPROVEN", evidence: { source: "adapter-unsupported", detail: note } };
+  return {
+    id,
+    state: "UNPROVEN",
+    evidence: {
+      source: "not-declared",
+      detail: `operation kind '${kind}' (${kindNote}) is absent from the declared preDeny set and unnamed in unsupported`
+    }
+  };
+}
+function assessTransport(caps, id, index, evidence) {
+  const observed = assessFromEvidence(id, index, evidence);
+  if (observed) return observed;
+  const kw = TRANSPORT_KEYWORDS[id];
+  const failOpen = caps.unsupported.find((u) => FAIL_OPEN_RE.test(u) && kw.test(u));
+  if (failOpen) return { id, state: "FAIL-OPEN", evidence: { source: "adapter-unsupported", detail: failOpen } };
+  const unproven = find(caps.unsupported, TRANSPORT_UNPROVEN_RE);
+  if (unproven) return { id, state: "UNPROVEN", evidence: { source: "adapter-unsupported", detail: unproven } };
+  return {
+    id,
+    state: "PARTIAL",
+    evidence: {
+      source: "contract",
+      detail: "the neutral steering contract maps this transport failure to a fail-closed deny at the adapter boundary (failsClosed); full live-runtime honoring across execution modes is not separately proven by static qualification"
+    }
+  };
+}
+function assessCapabilities(caps, evidence) {
+  const out3 = [];
+  const ev = indexEvidence(evidence);
+  const fromEvidence = (id) => assessFromEvidence(id, ev, evidence);
+  out3.push(assessPreDeny(caps, "pre-deny:shell", "shell", "a shell/exec tool call", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:native-edit", "file-edit", "a native file-edit tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:delete", "file-edit", "a delete proposed as a file-edit/native tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:rename", "file-edit", "a rename proposed as a file-edit/native tool", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:git-mutation", "shell", "a git mutation proposed as a shell command", ev, evidence));
+  out3.push(assessPreDeny(caps, "pre-deny:mcp", "mcp", "an MCP tool call", ev, evidence));
+  const postObserveEvidence = fromEvidence("post-observe");
+  if (postObserveEvidence) {
+    out3.push(postObserveEvidence);
+  } else if (caps.postObserve.length > 0) {
+    out3.push({
+      id: "post-observe",
+      state: "PARTIAL",
+      evidence: { source: "adapter-declaration", detail: `declared postObserve: [${[...caps.postObserve].sort().join(", ")}]; no retained real-runtime probe proves live post-action observation on this runtime/version` }
+    });
+  } else {
+    const note = find(caps.unsupported, POST_ACTION_RE);
+    out3.push(
+      note ? { id: "post-observe", state: "UNSUPPORTED", evidence: { source: "adapter-unsupported", detail: note } } : {
+        id: "post-observe",
+        state: "UNPROVEN",
+        evidence: { source: "not-declared", detail: "no post-action observation kind is declared and none is named unsupported" }
+      }
+    );
+  }
+  const endOfTurnEvidence = fromEvidence("end-of-turn");
+  if (endOfTurnEvidence) {
+    out3.push(endOfTurnEvidence);
+  } else if (!caps.endOfTurn) {
+    out3.push({ id: "end-of-turn", state: "UNSUPPORTED", evidence: { source: "adapter-declaration", detail: "endOfTurn is declared false" } });
+  } else {
+    const caveat = find(caps.unsupported, LIFECYCLE_ONLY_RE);
+    out3.push(
+      caveat ? { id: "end-of-turn", state: "PARTIAL", evidence: { source: "adapter-unsupported", detail: caveat } } : { id: "end-of-turn", state: "PARTIAL", evidence: { source: "adapter-declaration", detail: "endOfTurn is declared true (a stop event can run the mandatory sweep); no retained real-runtime probe proves this runtime/version delivers and honors the stop sweep live" } }
+    );
+  }
+  const hasDenyPath = caps.endOfTurn || caps.preDeny.length > 0;
+  out3.push(
+    hasDenyPath ? {
+      id: "denial-reason-delivery",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "a deny carries a human/agent-facing reason on the wire (SteeringDecision.reason); that the runtime delivers it to the agent is not separately proven by static qualification"
+      }
+    } : {
+      id: "denial-reason-delivery",
+      state: "UNPROVEN",
+      evidence: { source: "not-declared", detail: "the adapter declares no pre-deny or end-of-turn deny path, so no reason is delivered" }
+    }
+  );
+  out3.push({
+    id: "continue-after-denial",
+    state: "UNPROVEN",
+    evidence: { source: "not-declared", detail: "whether the agent can continue after a denial is not encoded in the neutral capability declaration and requires live evidence" }
+  });
+  for (const id of ["transport:missing-executable", "transport:non-zero", "transport:timeout", "transport:malformed", "transport:empty"]) {
+    out3.push(assessTransport(caps, id, ev, evidence));
+  }
+  out3.push(
+    fromEvidence("hook-not-invoked") ?? {
+      id: "hook-not-invoked",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "the neutral contract fails a required not-invoked hook CLOSED (failsClosed); that a configured hook is actually invoked/honored on this runtime/version is not proven by static qualification"
+      }
+    }
+  );
+  out3.push(
+    caps.endOfTurn ? {
+      id: "detached/quiescence",
+      state: "PARTIAL",
+      evidence: {
+        source: "contract",
+        detail: "the end-of-turn sweep reconciles the net tree at turn end, catching a detached/deferred effect the in-loop phase could only observe; continuous in-turn quiescence is not an in-loop guarantee"
+      }
+    } : {
+      id: "detached/quiescence",
+      state: "UNPROVEN",
+      evidence: { source: "not-declared", detail: "no end-of-turn sweep is declared, so a detached/deferred effect is not reconciled in-loop" }
+    }
+  );
+  return out3;
+}
+function aggregateInLoop(assessments) {
+  const byId = new Map(assessments.map((a) => [a.id, a]));
+  const required = REQUIRED_IN_LOOP_IDS.map((id) => byId.get(id)).filter((a) => a !== void 0);
+  const anyDangerous = required.some((a) => a.state === "FAIL-OPEN" || a.state === "INCONCLUSIVE");
+  const present = (id) => {
+    const s = byId.get(id)?.state;
+    return s === "PROVEN" || s === "PARTIAL";
+  };
+  const anyPreDenyPresent = PRE_DENY_IDS.some(present);
+  const endOfTurnPresent = present("end-of-turn");
+  if (!anyPreDenyPresent && !endOfTurnPresent) return "NONE";
+  if (!anyDangerous && required.every((a) => a.state === "PROVEN")) return "FULL";
+  return "PARTIAL";
+}
+function sha16(s) {
+  return createHash17("sha256").update(s).digest("hex").slice(0, 16);
+}
+function capabilityHash(caps) {
+  const stable = JSON.stringify({
+    preDeny: [...caps.preDeny].sort(),
+    postObserve: [...caps.postObserve].sort(),
+    endOfTurn: caps.endOfTurn,
+    unsupported: [...caps.unsupported].sort()
+  });
+  return sha16(stable);
+}
+function loadBearing(b) {
+  return {
+    "runtime.id": b.runtime.id,
+    "runtime.version": b.runtime.version ?? "\u2205",
+    "tamperward.version": b.tamperward.version,
+    "tamperward.commit": b.tamperward.commit ?? "\u2205",
+    "adapter.capability_hash": b.adapter.capability_hash,
+    "hook_config_hash": b.hook_config_hash ?? "\u2205",
+    "execution_mode": b.execution_mode,
+    "platform": b.platform,
+    "model": b.model ?? "\u2205",
+    "tested_capabilities": [...b.tested_capabilities].sort().join(",")
+  };
+}
+function qualificationStaleness(stored, current) {
+  const a = loadBearing(stored);
+  const b = loadBearing(current);
+  const changed = [];
+  for (const key2 of Object.keys(b)) {
+    if (a[key2] !== b[key2]) changed.push(`${key2}: ${a[key2]} \u2192 ${b[key2]}`);
+  }
+  return { stale: changed.length > 0, changed };
+}
+function evidenceId(binding, assessments) {
+  const projection = {
+    load_bearing: loadBearing(binding),
+    states: assessments.map((a) => [a.id, a.state])
+  };
+  return sha16(JSON.stringify(projection));
+}
+var CAPABILITY_STATES, RUNTIME_CAPABILITY_IDS, EVIDENCE_SOURCES, FINAL_AUTHORITY, FAIL_OPEN_RE, PRE_DENY_UNPROVEN_RE, TRANSPORT_UNPROVEN_RE, LIFECYCLE_ONLY_RE, POST_ACTION_RE, TRANSPORT_KEYWORDS, PRE_DENY_IDS, REQUIRED_IN_LOOP_IDS;
+var init_runtime_qualification = __esm({
+  "src/runtime-qualification.ts"() {
+    "use strict";
+    CAPABILITY_STATES = [
+      "PROVEN",
+      "PARTIAL",
+      "UNPROVEN",
+      "UNSUPPORTED",
+      "FAIL-OPEN",
+      "INCONCLUSIVE"
+    ];
+    RUNTIME_CAPABILITY_IDS = [
+      "pre-deny:shell",
+      "pre-deny:native-edit",
+      "pre-deny:delete",
+      "pre-deny:rename",
+      "pre-deny:git-mutation",
+      "pre-deny:mcp",
+      "post-observe",
+      "end-of-turn",
+      "denial-reason-delivery",
+      "continue-after-denial",
+      "transport:missing-executable",
+      "transport:non-zero",
+      "transport:timeout",
+      "transport:malformed",
+      "transport:empty",
+      "hook-not-invoked",
+      "detached/quiescence"
+    ];
+    EVIDENCE_SOURCES = [
+      "adapter-declaration",
+      // structural preDeny / postObserve / endOfTurn membership
+      "adapter-unsupported",
+      // named verbatim in the adapter's `unsupported[]` prose
+      "contract",
+      // the neutral steering contract guarantees this at the adapter boundary
+      "committed-evidence",
+      // a committed real-runtime evidence record proved it
+      "not-declared"
+      // absent from every declaration — no proof either way
+    ];
+    FINAL_AUTHORITY = "AVAILABLE";
+    FAIL_OPEN_RE = /fails?\s+open/i;
+    PRE_DENY_UNPROVEN_RE = /pre-action deny|pre-deny|shell pre-deny/i;
+    TRANSPORT_UNPROVEN_RE = /(?:fail-?closed|transport)[^.]*\b(?:not (?:yet )?proven|unproven|unmeasured)/i;
+    LIFECYCLE_ONLY_RE = /lifecycle continuation|not a filesystem veto|only block turn completion|block turn completion and force continuation/i;
+    POST_ACTION_RE = /post-action|post-observe|posttooluse|stop sweep is the post-turn/i;
+    TRANSPORT_KEYWORDS = {
+      "transport:missing-executable": /missing exec|executable|enoent|not found/i,
+      "transport:non-zero": /non-?zero|exit code|exit 2|non-?2xx/i,
+      "transport:timeout": /time-?out|timed[- ]out/i,
+      "transport:malformed": /malformed|parse/i,
+      "transport:empty": /\bempty\b/i
+    };
+    PRE_DENY_IDS = [
+      "pre-deny:shell",
+      "pre-deny:native-edit",
+      "pre-deny:delete",
+      "pre-deny:rename",
+      "pre-deny:git-mutation",
+      "pre-deny:mcp"
+    ];
+    REQUIRED_IN_LOOP_IDS = [
+      ...PRE_DENY_IDS,
+      "end-of-turn",
+      "transport:missing-executable",
+      "transport:non-zero",
+      "transport:timeout",
+      "transport:malformed",
+      "transport:empty",
+      "hook-not-invoked"
+    ];
+  }
+});
+
+// src/cli/runtime.ts
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync29, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join30, dirname as dirname15 } from "node:path";
+function storePath(cwd) {
+  const dir = gitDir(cwd);
+  return dir ? join30(dir, "tamperward", "runtime-qualification.json") : null;
+}
+function readStore(cwd) {
+  const path = storePath(cwd);
+  if (!path || !existsSync22(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync29(path, "utf8"));
+    if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+function isRec(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function asStringOrNull(v) {
+  return v === null || typeof v === "string" ? v : void 0;
+}
+function validateStoredReport(value) {
+  if (!isRec(value)) return { reason: "record is not an object" };
+  if (value.schema_version !== 1) return { reason: "unrecognized schema_version" };
+  if (value.command !== "runtime") return { reason: 'command is not "runtime"' };
+  const subcommand = value.subcommand;
+  if (subcommand !== "verify" && subcommand !== "status") return { reason: "invalid subcommand" };
+  const recorded = value.recorded;
+  const stale = value.stale;
+  if (typeof recorded !== "boolean" || typeof stale !== "boolean") return { reason: "invalid recorded/stale flags" };
+  const changedInputs = value.changed_inputs;
+  if (!Array.isArray(changedInputs) || !changedInputs.every((s) => typeof s === "string")) return { reason: "invalid changed_inputs" };
+  const runtime = value.runtime;
+  if (!isRec(runtime)) return { reason: "invalid runtime binding" };
+  const rId = runtime.id;
+  const rLabel = runtime.label;
+  const rVersion = asStringOrNull(runtime.version);
+  if (typeof rId !== "string" || !rId || typeof rLabel !== "string" || !rLabel || rVersion === void 0)
+    return { reason: "invalid runtime binding" };
+  const tw = value.tamperward;
+  if (!isRec(tw)) return { reason: "invalid tamperward binding" };
+  const twVersion = tw.version;
+  const twCommit = asStringOrNull(tw.commit);
+  if (typeof twVersion !== "string" || !twVersion || twCommit === void 0) return { reason: "invalid tamperward binding" };
+  const adapter = value.adapter;
+  if (!isRec(adapter)) return { reason: "invalid adapter binding" };
+  const adName = adapter.name;
+  const adHash = adapter.capability_hash;
+  if (typeof adName !== "string" || !adName || typeof adHash !== "string" || !adHash) return { reason: "invalid adapter binding" };
+  const hookConfigHash = asStringOrNull(value.hook_config_hash);
+  if (hookConfigHash === void 0) return { reason: "invalid hook_config_hash" };
+  const executionMode = value.execution_mode;
+  if (executionMode !== "headless" && executionMode !== "interactive") return { reason: "invalid execution_mode" };
+  const platform = value.platform;
+  if (typeof platform !== "string" || !platform) return { reason: "invalid platform" };
+  const model = asStringOrNull(value.model);
+  if (model === void 0) return { reason: "invalid model" };
+  const testedCapabilities = value.tested_capabilities;
+  if (!Array.isArray(testedCapabilities) || !testedCapabilities.every((c) => typeof c === "string" && CAP_ID_SET.has(c)))
+    return { reason: "invalid tested_capabilities" };
+  const timestamp = value.timestamp;
+  if (typeof timestamp !== "string" || !timestamp) return { reason: "invalid timestamp" };
+  const storedEvidenceId = value.evidence_id;
+  if (typeof storedEvidenceId !== "string" || !storedEvidenceId) return { reason: "invalid evidence_id" };
+  if (!Array.isArray(value.capabilities)) return { reason: "capabilities is not an array" };
+  const capabilities = [];
+  for (const c of value.capabilities) {
+    if (!isRec(c)) return { reason: "invalid capability entry" };
+    const id = RUNTIME_CAPABILITY_IDS.find((x) => x === c.id);
+    const state = CAPABILITY_STATES.find((x) => x === c.state);
+    if (!id || !state) return { reason: "invalid capability entry" };
+    const ev = c.evidence;
+    if (!isRec(ev)) return { reason: "invalid capability evidence" };
+    const source = EVIDENCE_SOURCES.find((x) => x === ev.source);
+    const detail = ev.detail;
+    if (!source || typeof detail !== "string") return { reason: "invalid capability evidence" };
+    capabilities.push({ id, state, evidence: { source, detail } });
+  }
+  const inLoop = value.in_loop_protection;
+  if (inLoop !== "FULL" && inLoop !== "PARTIAL" && inLoop !== "NONE") return { reason: "invalid in_loop_protection" };
+  if (value.final_authority !== FINAL_AUTHORITY) return { reason: "invalid final_authority" };
+  const note = value.note;
+  if (typeof note !== "string") return { reason: "invalid note" };
+  const base = {
+    runtime: { id: rId, label: rLabel, version: rVersion },
+    tamperward: { version: twVersion, commit: twCommit },
+    adapter: { name: adName, capability_hash: adHash },
+    hook_config_hash: hookConfigHash,
+    execution_mode: executionMode,
+    platform,
+    model,
+    tested_capabilities: testedCapabilities
+  };
+  const recomputedId = evidenceId(base, capabilities);
+  if (recomputedId !== storedEvidenceId) return { reason: `evidence_id mismatch (recorded ${storedEvidenceId}, recomputed ${recomputedId})` };
+  const recomputedAgg = aggregateInLoop(capabilities);
+  if (inLoop !== recomputedAgg) return { reason: `in_loop_protection mismatch (recorded ${inLoop}, recomputed ${recomputedAgg})` };
+  const report2 = {
+    schema_version: 1,
+    command: "runtime",
+    subcommand,
+    recorded,
+    stale,
+    changed_inputs: changedInputs,
+    runtime: base.runtime,
+    tamperward: base.tamperward,
+    adapter: base.adapter,
+    hook_config_hash: hookConfigHash,
+    execution_mode: executionMode,
+    platform,
+    model,
+    tested_capabilities: testedCapabilities,
+    timestamp,
+    evidence_id: storedEvidenceId,
+    capabilities,
+    in_loop_protection: inLoop,
+    final_authority: FINAL_AUTHORITY,
+    note
+  };
+  return { report: report2 };
+}
+function writeRecord(cwd, id, report2) {
+  const path = storePath(cwd);
+  if (!path) return false;
+  const existing = readStore(cwd);
+  const store = existing ?? { schema_version: report2.schema_version, updated_at: "", records: {} };
+  store.records[id] = report2;
+  store.updated_at = report2.timestamp;
+  try {
+    mkdirSync13(dirname15(path), { recursive: true });
+    writeFileSync16(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveRuntimeVersion(canonicalId) {
+  const override = process.env.TAMPERWARD_RUNTIME_VERSION;
+  if (override && override.trim()) return override.trim();
+  const bins = {
+    "claude-code": "claude",
+    codex: "codex",
+    "github-copilot-cli": "copilot"
+  };
+  const bin = bins[canonicalId];
+  if (!bin) return null;
+  try {
+    const out3 = execFileSync16(bin, ["--version"], { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "ignore"] });
+    const m = out3.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+    return m ? m[0] : out3.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function tamperwardBuildTag(version, commit) {
+  return commit ? `${version}+${commit.slice(0, 8)}` : version;
+}
+function resolveComponentVersions(_canonicalId) {
+  return [];
+}
+function resolveHookConfigHash(canonicalId, cwd) {
+  if (canonicalId === "claude-code") {
+    return sha16(JSON.stringify(interventionWiring(cwd)));
+  }
+  const files = {
+    "github-copilot-cli": join30(cwd, ".github", "hooks", "tamperward.json")
+  };
+  const file = files[canonicalId];
+  if (!file || !existsSync22(file)) return null;
+  try {
+    const raw = readFileSync29(file, "utf8");
+    let hooks = raw;
+    try {
+      const parsed = JSON.parse(raw);
+      hooks = parsed && typeof parsed === "object" && "hooks" in parsed ? parsed.hooks : parsed;
+    } catch {
+    }
+    return sha16(JSON.stringify(hooks ?? null));
+  } catch {
+    return null;
+  }
+}
+function buildQualification(adapter, opts, cwd) {
+  const canonical2 = adapter.name;
+  const capHash = capabilityHash(adapter.capabilities);
+  const mode = opts.mode ?? "headless";
+  const version = resolveRuntimeVersion(canonical2);
+  const platform = `${process.platform}-${process.arch}`;
+  const model = opts.model ?? null;
+  const hookConfigHash = resolveHookConfigHash(canonical2, cwd);
+  const commit = TW_COMMIT;
+  const testedRaw = [...RUNTIME_CAPABILITY_IDS];
+  const matchKey = {
+    runtime_id: canonical2,
+    runtime_version: version,
+    // No live resolver for a runtime's SDK/protocol component versions ships yet, so the
+    // current side is honestly the empty (unresolved) set. An unresolved component set never
+    // matches a probed non-empty one — it fails closed, never promotes. We do not fabricate one.
+    component_versions: resolveComponentVersions(canonical2),
+    tamperward_version: tamperwardBuildTag(TW_VERSION, commit),
+    adapter_capability_hash: capHash,
+    tested_capabilities: testedRaw,
+    model,
+    platform,
+    execution_mode: mode,
+    hook_config_hash: hookConfigHash
+  };
+  const evidence = matchRetainedEvidence(matchKey);
+  const assessments = assessCapabilities(adapter.capabilities, evidence);
+  const base = {
+    runtime: { id: canonical2, label: labelFor(canonical2), version },
+    tamperward: { version: TW_VERSION, commit },
+    adapter: { name: canonical2, capability_hash: capHash },
+    hook_config_hash: hookConfigHash,
+    execution_mode: mode,
+    platform,
+    model,
+    tested_capabilities: testedRaw
+  };
+  const eid = evidenceId(base, assessments);
+  const binding = { ...base, timestamp: (/* @__PURE__ */ new Date()).toISOString(), evidence_id: eid };
+  return { binding, assessments };
+}
+function reportFrom(subcommand, binding, assessments) {
+  return machineOutput({
+    command: "runtime",
+    subcommand,
+    recorded: true,
+    stale: false,
+    changed_inputs: [],
+    runtime: binding.runtime,
+    tamperward: binding.tamperward,
+    adapter: binding.adapter,
+    hook_config_hash: binding.hook_config_hash,
+    execution_mode: binding.execution_mode,
+    platform: binding.platform,
+    model: binding.model,
+    tested_capabilities: binding.tested_capabilities,
+    timestamp: binding.timestamp,
+    evidence_id: binding.evidence_id,
+    capabilities: assessments,
+    in_loop_protection: aggregateInLoop(assessments),
+    final_authority: FINAL_AUTHORITY,
+    note: HONESTY_NOTE
+  });
+}
+function resolveTarget(opts, cwd) {
+  if (opts.runtime) {
+    const a = adapterFor(opts.runtime);
+    return a ?? { error: `no shipped runtime adapter for "${opts.runtime}"` };
+  }
+  const detected = detectRuntimes(cwd);
+  for (const rt of detected) {
+    const a = adapterFor(rt.id);
+    if (a) return a;
+  }
+  const reason = detected.length > 0 ? "no adapter-backed runtime detected in this repository" : "no runtime detected in this repository";
+  return { error: `${reason}; pass --runtime <id> to qualify a specific runtime` };
+}
+function renderText3(report2, cwd) {
+  const colour = colourEnabled(process.env, process.stdout);
+  const w = (s) => process.stdout.write(s + "\n");
+  const dim = (s) => paint(s, DIM, colour);
+  w(`${paint(report2.runtime.label, BOLD, colour)} \u2014 runtime protection qualification`);
+  w(dim(`  runtime ${report2.runtime.version ?? "(version unresolved)"} \xB7 tamperward ${report2.tamperward.version} \xB7 adapter ${report2.adapter.capability_hash} \xB7 ${report2.execution_mode} \xB7 ${report2.platform}`));
+  w(dim(`  evidence ${report2.evidence_id} \xB7 ${report2.timestamp}`));
+  if (!report2.recorded) {
+    w("");
+    w(`${paint("[UNQUALIFIED]", severityColour("bad") + BOLD, colour)} no qualification recorded for this runtime.`);
+    if (report2.note) w(dim(`  ${report2.note.replace(/—/g, "-")}`));
+    w(`Run: ${paint("tamperward runtime verify", BOLD, colour)}`);
+    return;
+  }
+  if (report2.stale) {
+    w("");
+    w(`${paint("[STALE]", severityColour("bad") + BOLD, colour)} a load-bearing input changed \u2014 this qualification no longer applies:`);
+    for (const c of report2.changed_inputs) w(`  \xB7 ${c}`);
+    w(`Run: ${paint("tamperward runtime verify", BOLD, colour)}`);
+  }
+  w("");
+  const width = Math.max(...report2.capabilities.map((c) => c.id.length));
+  for (const cap of report2.capabilities) {
+    const sev = STATE_SEVERITY[cap.state];
+    const tag = paint(cap.state.padEnd(12), (sev === "bad" ? BOLD : "") + severityColour(sev), colour);
+    w(`  ${cap.id.padEnd(width)}  ${tag}`);
+  }
+  w("");
+  const agg = report2.in_loop_protection;
+  const aggTag = paint(agg, (AGGREGATE_SEVERITY[agg] === "bad" ? BOLD : "") + severityColour(AGGREGATE_SEVERITY[agg]), colour);
+  w(`  ${"In-loop protection".padEnd(width)}  ${aggTag}`);
+  w(`  ${"Final authority".padEnd(width)}  ${paint(report2.final_authority, severityColour("ok"), colour)}`);
+  w("");
+  w(dim("  Final authority (CI / pristine verification) is independent of the runtime hook: a weak in-loop"));
+  w(dim("  capability never weakens adjudication. Steering and authority remain separate."));
+  w("");
+  w(dim("  " + report2.note.replace(/—/g, "-")));
+  w("");
+  w(dim("  Evidence:"));
+  for (const cap of report2.capabilities) {
+    w(dim(`    ${cap.id} [${cap.state}] (${cap.evidence.source}): ${cap.evidence.detail}`));
+  }
+}
+function emit2(report2, opts, cwd) {
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(report2) + "\n");
+    return;
+  }
+  renderText3(report2, cwd);
+}
+function runRuntime(sub, opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (sub === "verify") {
+    const target = resolveTarget(opts, cwd);
+    if ("error" in target) {
+      process.stderr.write(`tamperward: ${target.error}
+`);
+      return 2;
+    }
+    const { binding, assessments } = buildQualification(target, opts, cwd);
+    const report2 = reportFrom("verify", binding, assessments);
+    const wrote = writeRecord(cwd, target.name, report2);
+    if (!wrote) {
+      const dest = storePath(cwd);
+      const reason = `could not persist the qualification to ${dest ?? "the git-local store (no repository found)"}; nothing was recorded, so \`tamperward runtime status\` will report UNQUALIFIED`;
+      const failure = {
+        ...report2,
+        recorded: false,
+        capabilities: [],
+        in_loop_protection: "NONE",
+        note: reason
+      };
+      emit2(failure, opts, cwd);
+      process.stderr.write(`tamperward: ${reason}
+`);
+      return 1;
+    }
+    emit2(report2, opts, cwd);
+    return 0;
+  }
+  if (sub === "status") {
+    const target = resolveTarget(opts, cwd);
+    if ("error" in target) {
+      process.stderr.write(`tamperward: ${target.error}
+`);
+      return 2;
+    }
+    const store = readStore(cwd);
+    const raw = store?.records[target.name];
+    const validated = raw === void 0 ? { reason: "none recorded" } : validateStoredReport(raw);
+    if ("reason" in validated) {
+      const { binding, assessments } = buildQualification(target, opts, cwd);
+      const note = raw === void 0 ? `No qualification recorded for ${binding.runtime.label}. Run: tamperward runtime verify` : `Stored qualification for ${binding.runtime.label} was rejected (${validated.reason}) and treated as unrecorded. Run: tamperward runtime verify`;
+      const empty2 = {
+        ...reportFrom("status", binding, assessments),
+        recorded: false,
+        capabilities: [],
+        in_loop_protection: "NONE",
+        note
+      };
+      emit2(empty2, opts, cwd);
+      return 0;
+    }
+    const stored = validated.report;
+    const { binding: current } = buildQualification(target, opts, cwd);
+    const storedBinding = {
+      runtime: stored.runtime,
+      tamperward: stored.tamperward,
+      adapter: stored.adapter,
+      hook_config_hash: stored.hook_config_hash,
+      execution_mode: stored.execution_mode,
+      platform: stored.platform,
+      model: stored.model,
+      tested_capabilities: stored.tested_capabilities,
+      timestamp: stored.timestamp,
+      evidence_id: stored.evidence_id
+    };
+    const staleness = qualificationStaleness(storedBinding, current);
+    const report2 = {
+      ...stored,
+      subcommand: "status",
+      stale: staleness.stale,
+      changed_inputs: staleness.changed
+    };
+    emit2(report2, opts, cwd);
+    return 0;
+  }
+  process.stderr.write(`tamperward: runtime requires one of verify | status (got "${sub ?? ""}")
+`);
+  return 2;
+}
+function parseRuntime(args) {
+  const [sub, ...rest] = args;
+  const opts = {};
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--cwd") opts.cwd = rest[++i];
+    else if (a === "--runtime") opts.runtime = rest[++i];
+    else if (a === "--model") opts.model = rest[++i];
+    else if (a === "--json") opts.json = true;
+    else if (a === "--mode") {
+      const v = rest[++i];
+      if (v === "headless" || v === "interactive") opts.mode = v;
+    }
+  }
+  return { sub, opts };
+}
+var HONESTY_NOTE, CAP_ID_SET, STATE_SEVERITY, AGGREGATE_SEVERITY, RUNTIME_SUBCOMMANDS;
+var init_runtime = __esm({
+  "src/cli/runtime.ts"() {
+    "use strict";
+    init_build();
+    init_wiring();
+    init_machine_output();
+    init_text();
+    init_status();
+    init_registry();
+    init_runtimes();
+    init_evidence();
+    init_verification_state();
+    init_runtime_qualification();
+    HONESTY_NOTE = "PROVEN is reserved for a capability a retained real-runtime probe observed holding under THIS exact runtime/version/config binding; a declaration alone grades PARTIAL (declared at the contract boundary, unproven live) and an absent capability UNPROVEN/UNSUPPORTED. No live in-process probe runs here \u2014 grading is against committed, sanitized real-runtime evidence, and absent a matching record nothing is PROVEN. This reports existing facts only \u2014 no promotion, no Round 4.1 eligibility claim.";
+    CAP_ID_SET = new Set(RUNTIME_CAPABILITY_IDS);
+    STATE_SEVERITY = {
+      PROVEN: "ok",
+      PARTIAL: "warn",
+      UNPROVEN: "warn",
+      UNSUPPORTED: "info",
+      "FAIL-OPEN": "bad",
+      INCONCLUSIVE: "bad"
+    };
+    AGGREGATE_SEVERITY = { FULL: "ok", PARTIAL: "warn", NONE: "bad" };
+    RUNTIME_SUBCOMMANDS = ["verify", "status"];
+  }
+});
+
+// src/cli/signoff-label.ts
+function runSignoffLabel(opts) {
+  if (!opts.rule) {
+    process.stderr.write("tamperward signoff-label --rule <rule> --head <full-head-sha> [--file <path>]\n");
+    return 2;
+  }
+  if (!opts.head) {
+    process.stderr.write("tamperward: --head is required and must be a full 40- or 64-character object id.\n");
+    return 2;
+  }
+  const want = opts.file ? `${opts.rule}:${opts.file}` : opts.rule;
+  const token = compactOobToken(want, opts.head);
+  if (!token) {
+    process.stderr.write("tamperward: --head must be a full 40- or 64-character hexadecimal object id.\n");
+    return 2;
+  }
+  process.stdout.write(`${token}
+`);
+  return 0;
+}
+var init_signoff_label = __esm({
+  "src/cli/signoff-label.ts"() {
+    "use strict";
+    init_signoff();
+  }
+});
+
+// src/cli/main.ts
+var main_exports = {};
+__export(main_exports, {
+  guardedMain: () => guardedMain,
+  main: () => main,
+  runHookFromRaw: () => runHookFromRaw,
+  validateCliArgs: () => validateCliArgs
+});
+function parseAllow(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--file") o.file = args[++i];
+    else if (a === "--reason") o.reason = args[++i];
+    else if (a === "--cwd") o.cwd = args[++i];
+    else if (!a.startsWith("--") && !o.rule) o.rule = a;
+  }
+  return o;
+}
+function runAgentCommand(kind, args) {
+  const agent = args[0];
+  if (agent !== "claude") {
+    process.stderr.write(`tamperward: unsupported ${kind} agent "${agent ?? ""}" (only "claude" so far)
+`);
+    return 2;
+  }
+  return kind === "hook" ? runHookClaude() : runSweepClaude();
+}
+function parseInit(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--dry-run") o.dryRun = true;
+    else if (a === "--force-workflow") o.forceWorkflow = true;
+  }
+  return o;
+}
+function parseOnboard(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--base") o.base = args[++i];
+    else if (a === "--repo") o.repo = args[++i];
+    else if (a === "--branch") o.branch = args[++i];
+    else if (a === "--verify-command") o.verifyCommand = args[++i];
+    else if (a === "--skip-demo") o.skipDemo = true;
+    else if (a === "--demo") o.demo = true;
+    else if (a === "--no-github") o.noGithub = true;
+    else if (a === "--yes") o.yes = true;
+  }
+  return o;
+}
+function parseDoctor(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--base") o.base = args[++i];
+    else if (a === "--workflow") o.workflow = args[++i];
+    else if (a === "--github") o.github = true;
+    else if (a === "--json") o.json = true;
+    else if (a === "--repo") o.repo = args[++i];
+    else if (a === "--branch") o.branch = args[++i];
+  }
+  return o;
+}
+function parseStatus(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--json") o.json = true;
+    else if (a === "--cwd") o.cwd = args[++i];
+  }
+  return o;
+}
+function parseStats(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--cwd") o.cwd = args[++i];
+    else if (a === "--file") o.file = args[++i];
+    else if (a === "--since") o.since = args[++i];
+    else if (a === "--json") o.json = true;
+  }
+  return o;
+}
+function parseSignoffLabel(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--rule") o.rule = args[++i];
+    else if (a === "--file") o.file = args[++i];
+    else if (a === "--head") o.head = args[++i];
+  }
+  return o;
+}
+function parseCheck(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--staged") o.staged = true;
+    else if (a === "--worktree") o.worktree = true;
+    else if (a === "--json") o.json = true;
+    else if (a === "--format") {
+      const v = args[++i];
+      if (v !== void 0 && isFormat(v)) o.format = v;
+    } else if (a === "--diff") o.diff = args[++i];
+    else if (a === "--cwd") o.cwd = args[++i];
+  }
+  return o;
+}
+function splitLongOptionEquals(args) {
+  const out3 = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") {
+      out3.push(...args.slice(i));
+      break;
+    }
+    if (arg.startsWith("--")) {
+      const equals = arg.indexOf("=");
+      if (equals > 2) {
+        out3.push(arg.slice(0, equals), arg.slice(equals + 1));
+        continue;
+      }
+    }
+    out3.push(arg);
+  }
+  return out3;
+}
+function helpRequested(args) {
+  for (const arg of args) {
+    if (arg === "--") break;
+    if (arg === "-h" || arg === "--help") return true;
+  }
+  return false;
 }
 function validateFlatArgs(args, grammar) {
   const flags = new Set(grammar.flags ?? []);
@@ -21791,6 +23964,12 @@ function validateFlatArgs(args, grammar) {
           seen,
           positionals
         };
+      } else if (rule === "mode" && v !== "headless" && v !== "interactive") {
+        return {
+          error: `${a} needs one of headless | interactive (got "${v}")`,
+          seen,
+          positionals
+        };
       }
       continue;
     }
@@ -21942,6 +24121,19 @@ function validateCliArgs(cmd, args) {
       values: { "--dir": "string", "--log": "string", "--base": "string" }
     }).error;
   }
+  if (cmd === "runtime") {
+    const [sub, ...rest] = args;
+    if (sub === void 0) return `runtime requires a subcommand (${RUNTIME_SUBCOMMANDS.join(" | ")})`;
+    if (sub !== "verify" && sub !== "status") {
+      return `unknown runtime subcommand "${sub}" (${RUNTIME_SUBCOMMANDS.join(" | ")})`;
+    }
+    const parsed = validateFlatArgs(rest, {
+      flags: ["--json"],
+      values: { "--cwd": "string", "--runtime": "string", "--mode": "mode", "--model": "string" }
+    });
+    if (parsed.error) return parsed.error;
+    return void 0;
+  }
   if (cmd === "research") {
     const [sub, ...rest] = args;
     if (sub === void 0) return `research requires a subcommand (${RESEARCH_SUBCOMMANDS.join(" | ")})`;
@@ -22149,6 +24341,26 @@ Formats:
                                             emits the versioned status document for
                                             editors, CI and dashboards. Local CURRENT
                                             is posture, never repository/CI authority.
+  tamperward runtime verify [--runtime ID]  qualify the in-loop runtime: an operation-
+             [--mode headless|interactive]  specific capability matrix (pre-deny:shell,
+             [--model M] [--json] [--cwd D]  native-edit, mcp, end-of-turn, transport:*,
+                                            \u2026) with an explicit state per capability
+                                            (PROVEN | PARTIAL | UNPROVEN | UNSUPPORTED |
+                                            FAIL-OPEN | INCONCLUSIVE; never a score),
+                                            derived from the shipped adapter's declared
+                                            capabilities and committed evidence. Bound to
+                                            the runtime version, TamperWard version/commit,
+                                            adapter hash, hook-config hash, execution mode,
+                                            platform and model; persisted git-locally.
+                                            Reports EXISTING facts only \u2014 no promotion, no
+                                            Round 4.1 claim. Final authority (CI / pristine
+                                            verify) stays separate from in-loop steering.
+  tamperward runtime status [--runtime ID]  render the latest recorded qualification
+             [--mode headless|interactive]  WITHOUT rerunning it, and mark it STALE when a
+             [--model M] [--json] [--cwd D]  load-bearing input (version/config/adapter/mode/
+                                            model/\u2026) changed since it was recorded. --mode and
+                                            --model select the binding staleness is compared
+                                            against, as for verify.
   tamperward doctor [--base R]              report installation + authority posture
              [--workflow F] [--cwd D]       and validate the CI verifier's outer-time
              [--json]                       envelope against the trusted policy.
@@ -22215,6 +24427,10 @@ function main(argv) {
       return runTraceVerify(parseTraceVerify(rest));
     case "research":
       return runResearchCommand(rest);
+    case "runtime": {
+      const { sub, opts } = parseRuntime(rest);
+      return runRuntime(sub, opts);
+    }
     case "run":
       return runEnvelope({
         ...parseRun(rest),
@@ -22265,6 +24481,7 @@ var init_main = __esm({
     init_watch();
     init_onboard();
     init_research();
+    init_runtime();
     init_audit();
     init_signoff_label();
   }
@@ -22273,7 +24490,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync28 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -22286,7 +24503,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync28(0, "utf8");
+      raw = readFileSync30(0, "utf8");
     } catch {
       raw = null;
     }