tamperward 2.39.0 → 2.39.2

package/dist/cli/index.js

@@ -19896,6 +19896,17 @@ var init_runtimes = __esm({
 });
 
 // src/adapters/contract.ts
+function immutableRuntimeCapabilities(caps) {
+  return Object.freeze({
+    preDeny: Object.freeze([...caps.preDeny]),
+    postObserve: Object.freeze([...caps.postObserve]),
+    endOfTurn: caps.endOfTurn,
+    unsupported: Object.freeze([...caps.unsupported])
+  });
+}
+function immutableRuntimeAdapter(adapter) {
+  return Object.freeze(adapter);
+}
 function unknownToolFinding(toolName) {
   const name = toolName.length > 80 ? toolName.slice(0, 77) + "..." : toolName;
   const detail = 'Copilot tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
@@ -19963,23 +19974,18 @@ var init_adapter = __esm({
     init_contract();
     ClaudeRuntimeAdapter = class {
       name = "claude-code";
-      /**
-       * Claude Code's live PreToolUse fires for EVERY tool and can synchronously deny it —
-       * shell, file edit, file read, MCP, and anything else — even under
-       * `--dangerously-skip-permissions`. The end-of-turn Stop sweep is live too. There is no
-       * live per-tool PostToolUse veto (Stop is the post-turn reconciliation), so `postObserve`
-       * is empty and `unsupported` names that gap explicitly rather than implying it.
-       */
-      capabilities = {
-        preDeny: OPERATION_KINDS,
+      capabilities = immutableRuntimeCapabilities({
+        preDeny: OPERATION_KINDS.filter((kind) => kind !== "mcp" && kind !== "other"),
         postObserve: [],
         endOfTurn: true,
         unsupported: [
+          "MCP pre-deny is not declared because Claude MCP calls are not reconstructed into Change[] before evaluation",
+          "catch-all other-tool pre-deny is not declared because unmodelled Claude tools are not reconstructed into Change[] before evaluation",
           "per-operation post-action veto (end-of-turn Stop sweep is the post-turn reconciliation)",
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         try {
           return eventFrom(parseInput(raw), phase);
@@ -20041,26 +20047,28 @@ var init_adapter = __esm({
         const parsed = this.parseEvent(raw, phase);
         if ("failure" in parsed) {
           const live2 = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd) : preToolUseFromRaw(raw, defaultCwd);
+          const findings2 = live2.findings ? [...live2.findings] : [];
           return {
             outcome: "parse-failure",
             detail: parsed.detail,
             wire: live2.stdout,
-            decision: { verdict: "deny", findings: [], reason: live2.stdout }
+            decision: { verdict: "deny", findings: findings2, reason: live2.stdout }
           };
         }
         const idv = this.validateIdentity(parsed.identity, defaultCwd);
         if (!idv.ok) {
-          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
-          const wire2 = this.denyPayload(findings, phase);
-          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire2 } };
+          const findings2 = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire2 = this.denyPayload(findings2, phase);
+          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings: findings2, reason: wire2 } };
         }
         const live = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd, idv.trustedRoot) : preToolUseFromRaw(raw, defaultCwd, idv.trustedRoot);
         const wire = live.stdout;
         const denied = wire.length > 0;
+        const findings = live.findings ? [...live.findings] : [];
         return {
           outcome: "ok",
           wire,
-          decision: { verdict: denied ? "deny" : "allow", findings: [], reason: denied ? wire : void 0 }
+          decision: { verdict: denied ? "deny" : "allow", findings, reason: denied ? wire : void 0 }
         };
       }
       /**
@@ -20074,7 +20082,7 @@ var init_adapter = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    claudeAdapter = new ClaudeRuntimeAdapter();
+    claudeAdapter = immutableRuntimeAdapter(new ClaudeRuntimeAdapter());
   }
 });
 
@@ -20376,7 +20384,7 @@ var init_adapter2 = __esm({
        * stop, so those are declared; every real gap is named in `unsupported`. The
        * `probe:codex-runtime` harness is what may later justify moving a kind into `preDeny`.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: POST_OBSERVE,
         endOfTurn: true,
@@ -20386,7 +20394,7 @@ var init_adapter2 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCodexEvent(raw, phase);
       }
@@ -20439,8 +20447,9 @@ var init_adapter2 = __esm({
           return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
         }
         if (phase === "end-of-turn") {
-          const wire = stopFromRaw(raw, defaultCwd, idv.trustedRoot).stdout;
-          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+          const swept = stopFromRaw(raw, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
@@ -20464,7 +20473,7 @@ var init_adapter2 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    codexAdapter = new CodexRuntimeAdapter();
+    codexAdapter = immutableRuntimeAdapter(new CodexRuntimeAdapter());
   }
 });
 
@@ -20705,7 +20714,7 @@ var init_adapter3 = __esm({
        * does not report. Every real gap is named in `unsupported`. The `probe:copilot-runtime`
        * harness is what may later justify moving a kind into `preDeny` or populating `postObserve`.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: [],
         endOfTurn: true,
@@ -20719,7 +20728,7 @@ var init_adapter3 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCopilotEvent(raw, phase);
       }
@@ -20778,12 +20787,13 @@ var init_adapter3 = __esm({
         if (phase === "end-of-turn") {
           const stopInput = copilotStopInput(raw);
           if (typeof stopInput !== "string") {
-            const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
-            const wire2 = this.denyPayload(findings, "end-of-turn");
-            return { outcome: "parse-failure", detail: stopInput.detail, wire: wire2, decision: { verdict: "deny", findings, reason: wire2 } };
+            const findings2 = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
+            const wire = this.denyPayload(findings2, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire, decision: { verdict: "deny", findings: findings2, reason: wire } };
           }
-          const wire = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot).stdout;
-          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+          const swept = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
         if (parsed.operation.kind === "unknown") {
           const detail = `unrecognized Copilot tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
@@ -20813,7 +20823,7 @@ var init_adapter3 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    copilotAdapter = new CopilotRuntimeAdapter();
+    copilotAdapter = immutableRuntimeAdapter(new CopilotRuntimeAdapter());
   }
 });
 
@@ -21151,7 +21161,7 @@ var init_adapter4 = __esm({
        * no post-execution veto). `endOfTurn` is true via `onAgentStop`. Every real gap is named in
        * `unsupported`, at the granularity #611 asks for.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: [],
         endOfTurn: true,
@@ -21163,7 +21173,7 @@ var init_adapter4 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCopilotSdkEvent(raw, phase);
       }
@@ -21258,7 +21268,7 @@ var init_adapter4 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    copilotSdkAdapter = new CopilotSdkHostedAdapter();
+    copilotSdkAdapter = immutableRuntimeAdapter(new CopilotSdkHostedAdapter());
   }
 });
 
@@ -21985,7 +21995,8 @@ function storedQualification(adapter, cwd, opts = {}) {
   const validated = validateStoredReport(raw);
   if ("reason" in validated) return { state: "rejected", reason: validated.reason };
   const stored = validated.report;
-  const { binding: current } = buildQualification(adapter, opts, cwd);
+  const currentQualification = buildQualification(adapter, opts, cwd);
+  const current = currentQualification.binding;
   const storedBinding = {
     runtime: stored.runtime,
     tamperward: stored.tamperward,
@@ -21999,6 +22010,12 @@ function storedQualification(adapter, cwd, opts = {}) {
     evidence_id: stored.evidence_id
   };
   const staleness = qualificationStaleness(storedBinding, current);
+  if (!staleness.stale && (stored.evidence_id !== current.evidence_id || JSON.stringify(stored.capabilities) !== JSON.stringify(currentQualification.assessments))) {
+    return {
+      state: "rejected",
+      reason: "stored qualification posture does not match retained evidence for the current binding"
+    };
+  }
   return { state: "recorded", report: stored, stale: staleness.stale, changed_inputs: staleness.changed };
 }
 function runRuntime(sub, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.0",
+  "version": "2.39.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",