tamperward 2.36.0 → 2.37.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/cli/index.js +2397 -180
  2. package/package.json +1 -1
  3. package/schemas/runtime-qualification-v1.schema.json +184 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "tamperward",
3
- "version": "2.36.0",
3
+ "version": "2.37.0",
4
4
  "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "hexrift",
package/schemas/runtime-qualification-v1.schema.json ADDED
@@ -0,0 +1,184 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v1/schemas/runtime-qualification-v1.schema.json",
4
+ "title": "TamperWard runtime qualification JSON output v1",
5
+ "type": "object",
6
+ "required": [
7
+ "schema_version",
8
+ "command",
9
+ "subcommand",
10
+ "recorded",
11
+ "stale",
12
+ "changed_inputs",
13
+ "runtime",
14
+ "tamperward",
15
+ "adapter",
16
+ "hook_config_hash",
17
+ "execution_mode",
18
+ "platform",
19
+ "model",
20
+ "tested_capabilities",
21
+ "timestamp",
22
+ "evidence_id",
23
+ "capabilities",
24
+ "in_loop_protection",
25
+ "final_authority",
26
+ "note"
27
+ ],
28
+ "properties": {
29
+ "schema_version": { "const": 1 },
30
+ "command": { "const": "runtime" },
31
+ "subcommand": { "enum": ["verify", "status"] },
32
+ "recorded": { "type": "boolean" },
33
+ "stale": { "type": "boolean" },
34
+ "changed_inputs": { "type": "array", "items": { "type": "string" } },
35
+ "runtime": {
36
+ "type": "object",
37
+ "required": ["id", "label", "version"],
38
+ "properties": {
39
+ "id": { "type": "string", "minLength": 1 },
40
+ "label": { "type": "string", "minLength": 1 },
41
+ "version": { "type": ["string", "null"] }
42
+ },
43
+ "additionalProperties": true
44
+ },
45
+ "tamperward": {
46
+ "type": "object",
47
+ "required": ["version", "commit"],
48
+ "properties": {
49
+ "version": { "type": "string", "minLength": 1 },
50
+ "commit": { "type": ["string", "null"] }
51
+ },
52
+ "additionalProperties": true
53
+ },
54
+ "adapter": {
55
+ "type": "object",
56
+ "required": ["name", "capability_hash"],
57
+ "properties": {
58
+ "name": { "type": "string", "minLength": 1 },
59
+ "capability_hash": { "type": "string", "minLength": 1 }
60
+ },
61
+ "additionalProperties": true
62
+ },
63
+ "hook_config_hash": { "type": ["string", "null"] },
64
+ "execution_mode": { "enum": ["headless", "interactive"] },
65
+ "platform": { "type": "string", "minLength": 1 },
66
+ "model": { "type": ["string", "null"] },
67
+ "tested_capabilities": {
68
+ "type": "array",
69
+ "items": {
70
+ "enum": [
71
+ "pre-deny:shell",
72
+ "pre-deny:native-edit",
73
+ "pre-deny:delete",
74
+ "pre-deny:rename",
75
+ "pre-deny:git-mutation",
76
+ "pre-deny:mcp",
77
+ "post-observe",
78
+ "end-of-turn",
79
+ "denial-reason-delivery",
80
+ "continue-after-denial",
81
+ "transport:missing-executable",
82
+ "transport:non-zero",
83
+ "transport:timeout",
84
+ "transport:malformed",
85
+ "transport:empty",
86
+ "hook-not-invoked",
87
+ "detached/quiescence"
88
+ ]
89
+ }
90
+ },
91
+ "timestamp": { "type": "string", "minLength": 1 },
92
+ "evidence_id": { "type": "string", "minLength": 1 },
93
+ "capabilities": {
94
+ "type": "array",
95
+ "items": {
96
+ "type": "object",
97
+ "required": ["id", "state", "evidence"],
98
+ "properties": {
99
+ "id": {
100
+ "enum": [
101
+ "pre-deny:shell",
102
+ "pre-deny:native-edit",
103
+ "pre-deny:delete",
104
+ "pre-deny:rename",
105
+ "pre-deny:git-mutation",
106
+ "pre-deny:mcp",
107
+ "post-observe",
108
+ "end-of-turn",
109
+ "denial-reason-delivery",
110
+ "continue-after-denial",
111
+ "transport:missing-executable",
112
+ "transport:non-zero",
113
+ "transport:timeout",
114
+ "transport:malformed",
115
+ "transport:empty",
116
+ "hook-not-invoked",
117
+ "detached/quiescence"
118
+ ]
119
+ },
120
+ "state": {
121
+ "enum": ["PROVEN", "PARTIAL", "UNPROVEN", "UNSUPPORTED", "FAIL-OPEN", "INCONCLUSIVE"]
122
+ },
123
+ "evidence": {
124
+ "type": "object",
125
+ "required": ["source", "detail"],
126
+ "properties": {
127
+ "source": {
128
+ "enum": ["adapter-declaration", "adapter-unsupported", "contract", "committed-evidence", "not-declared"]
129
+ },
130
+ "detail": { "type": "string" }
131
+ },
132
+ "additionalProperties": false
133
+ }
134
+ },
135
+ "additionalProperties": false
136
+ }
137
+ },
138
+ "in_loop_protection": { "enum": ["FULL", "PARTIAL", "NONE"] },
139
+ "final_authority": { "const": "AVAILABLE" },
140
+ "note": { "type": "string" }
141
+ },
142
+ "additionalProperties": true,
143
+ "description": "Emitted by `tamperward runtime verify --json` and `tamperward runtime status --json` (#599). A version-bound, operation-specific runtime capability report. PROVEN is reserved for a capability a retained real-runtime probe observed holding under the reported binding (evidence.source `committed-evidence`); a static adapter declaration alone grades PARTIAL, never PROVEN. `in_loop_protection` is FULL only when every required capability is PROVEN with no FAIL-OPEN/INCONCLUSIVE. `final_authority` is a constant AVAILABLE: CI / pristine verification is independent of the runtime hook. No percentage score. Additive within schema major 1.",
144
+ "examples": [
145
+ {
146
+ "schema_version": 1,
147
+ "command": "runtime",
148
+ "subcommand": "verify",
149
+ "recorded": true,
150
+ "stale": false,
151
+ "changed_inputs": [],
152
+ "runtime": { "id": "github-copilot-sdk-hosted", "label": "GitHub Copilot SDK (hosted)", "version": "copilot-runtime@1.0.85" },
153
+ "tamperward": { "version": "2.35.0", "commit": null },
154
+ "adapter": { "name": "github-copilot-sdk-hosted", "capability_hash": "0123456789abcdef" },
155
+ "hook_config_hash": null,
156
+ "execution_mode": "headless",
157
+ "platform": "darwin-arm64",
158
+ "model": "gpt-5.4",
159
+ "tested_capabilities": ["pre-deny:shell", "end-of-turn", "transport:timeout"],
160
+ "timestamp": "2026-09-23T00:00:00.000Z",
161
+ "evidence_id": "fedcba9876543210",
162
+ "capabilities": [
163
+ {
164
+ "id": "pre-deny:shell",
165
+ "state": "PROVEN",
166
+ "evidence": { "source": "committed-evidence", "detail": "returned-reject path: a rejected permission decision blocked shell tool dispatch — protected state not mutated [retained evidence copilot-sdk-capture-2026-09-20 · harness/adapters/copilot-sdk/evidence/capture-2026-09-20.json · sha256 c46fba989dc0]" }
167
+ },
168
+ {
169
+ "id": "end-of-turn",
170
+ "state": "PARTIAL",
171
+ "evidence": { "source": "adapter-unsupported", "detail": "onAgentStop is a lifecycle continuation control ({decision:\"block\"} forces another turn, guarded by stopHookActive), not a filesystem veto" }
172
+ },
173
+ {
174
+ "id": "transport:timeout",
175
+ "state": "INCONCLUSIVE",
176
+ "evidence": { "source": "committed-evidence", "detail": "callback-timeout path: a hung permission handler emits no permission.completed, so non-dispatch is intrinsically unobservable — timeout is not proven either way [retained evidence copilot-sdk-capture-2026-09-20 · harness/adapters/copilot-sdk/evidence/capture-2026-09-20.json · sha256 c46fba989dc0]" }
177
+ }
178
+ ],
179
+ "in_loop_protection": "PARTIAL",
180
+ "final_authority": "AVAILABLE",
181
+ "note": "PROVEN is reserved for a capability a retained real-runtime probe observed holding under this exact runtime/version/config binding; a declaration alone grades PARTIAL and an absent capability UNPROVEN/UNSUPPORTED. No live in-process probe runs here — grading is against committed, sanitized real-runtime evidence."
182
+ }
183
+ ]
184
+ }