tamperward 2.39.1 → 2.39.3

package/dist/cli/index.js

@@ -19758,6 +19758,29 @@ var init_trace_verify = __esm({
   }
 });
 
+// src/immutable.ts
+function isPlainData(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === Array.prototype || proto === null;
+}
+function deepFreeze(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const walk2 = (node) => {
+    if (!isPlainData(node) || seen.has(node)) return;
+    seen.add(node);
+    Object.freeze(node);
+    for (const key2 of Reflect.ownKeys(node)) walk2(Reflect.get(node, key2));
+  };
+  walk2(value);
+  return value;
+}
+var init_immutable = __esm({
+  "src/immutable.ts"() {
+    "use strict";
+  }
+});
+
 // src/runtimes.ts
 import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
 import { join as join25 } from "node:path";
@@ -19854,7 +19877,8 @@ var KNOWN_RUNTIMES;
 var init_runtimes = __esm({
   "src/runtimes.ts"() {
     "use strict";
-    KNOWN_RUNTIMES = [
+    init_immutable();
+    KNOWN_RUNTIMES = deepFreeze([
       {
         id: "claude-code",
         // Markers are Claude Code files `init` never writes, so detection never mistakes
@@ -19891,11 +19915,22 @@ var init_runtimes = __esm({
         adapterTracking: "#482",
         note: "agent-neutral layers (pre-commit + CI) today; a native in-loop adapter is tracked in #482."
       }
-    ];
+    ]);
   }
 });
 
 // src/adapters/contract.ts
+function immutableRuntimeCapabilities(caps) {
+  return Object.freeze({
+    preDeny: Object.freeze([...caps.preDeny]),
+    postObserve: Object.freeze([...caps.postObserve]),
+    endOfTurn: caps.endOfTurn,
+    unsupported: Object.freeze([...caps.unsupported])
+  });
+}
+function immutableRuntimeAdapter(adapter) {
+  return Object.freeze(adapter);
+}
 function unknownToolFinding(toolName) {
   const name = toolName.length > 80 ? toolName.slice(0, 77) + "..." : toolName;
   const detail = 'Copilot tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
@@ -19923,11 +19958,22 @@ function failClosedResult(outcome, detail, phase, denyPayload) {
   const wire = denyPayload(findings, phase);
   return { outcome, detail, wire, decision: { verdict: "deny", findings, reason: wire } };
 }
-var OPERATION_KINDS;
+var STEERING_PHASES, CONTRACT_TO_RESEARCH_LAYER, OPERATION_KINDS;
 var init_contract = __esm({
   "src/adapters/contract.ts"() {
     "use strict";
-    OPERATION_KINDS = ["shell", "file-edit", "file-read", "mcp", "other"];
+    init_immutable();
+    STEERING_PHASES = Object.freeze(["pre-action", "post-action", "end-of-turn"]);
+    CONTRACT_TO_RESEARCH_LAYER = deepFreeze([
+      { source: "pre-action", layer: "pre-tool-use", note: "synchronous pre-execution deny (Claude PreToolUse)" },
+      { source: "end-of-turn", layer: "stop-sweep", note: "mandatory end-of-turn reconciliation (Claude Stop)" },
+      {
+        source: "post-exit-envelope",
+        layer: "envelope",
+        note: "the run envelope around the whole agent process; post-action outcome observation lives here, not in a per-tool veto"
+      }
+    ]);
+    OPERATION_KINDS = Object.freeze(["shell", "file-edit", "file-read", "mcp", "other"]);
   }
 });
 
@@ -19963,7 +20009,7 @@ var init_adapter = __esm({
     init_contract();
     ClaudeRuntimeAdapter = class {
       name = "claude-code";
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: OPERATION_KINDS.filter((kind) => kind !== "mcp" && kind !== "other"),
         postObserve: [],
         endOfTurn: true,
@@ -19974,7 +20020,7 @@ var init_adapter = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         try {
           return eventFrom(parseInput(raw), phase);
@@ -20071,7 +20117,7 @@ var init_adapter = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    claudeAdapter = new ClaudeRuntimeAdapter();
+    claudeAdapter = immutableRuntimeAdapter(new ClaudeRuntimeAdapter());
   }
 });
 
@@ -20373,7 +20419,7 @@ var init_adapter2 = __esm({
        * stop, so those are declared; every real gap is named in `unsupported`. The
        * `probe:codex-runtime` harness is what may later justify moving a kind into `preDeny`.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: POST_OBSERVE,
         endOfTurn: true,
@@ -20383,7 +20429,7 @@ var init_adapter2 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCodexEvent(raw, phase);
       }
@@ -20462,7 +20508,7 @@ var init_adapter2 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    codexAdapter = new CodexRuntimeAdapter();
+    codexAdapter = immutableRuntimeAdapter(new CodexRuntimeAdapter());
   }
 });
 
@@ -20703,7 +20749,7 @@ var init_adapter3 = __esm({
        * does not report. Every real gap is named in `unsupported`. The `probe:copilot-runtime`
        * harness is what may later justify moving a kind into `preDeny` or populating `postObserve`.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: [],
         endOfTurn: true,
@@ -20717,7 +20763,7 @@ var init_adapter3 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCopilotEvent(raw, phase);
       }
@@ -20812,7 +20858,7 @@ var init_adapter3 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    copilotAdapter = new CopilotRuntimeAdapter();
+    copilotAdapter = immutableRuntimeAdapter(new CopilotRuntimeAdapter());
   }
 });
 
@@ -21150,7 +21196,7 @@ var init_adapter4 = __esm({
        * no post-execution veto). `endOfTurn` is true via `onAgentStop`. Every real gap is named in
        * `unsupported`, at the granularity #611 asks for.
        */
-      capabilities = {
+      capabilities = immutableRuntimeCapabilities({
         preDeny: [],
         postObserve: [],
         endOfTurn: true,
@@ -21162,7 +21208,7 @@ var init_adapter4 = __esm({
           "network-egress control",
           "identity / authentication"
         ]
-      };
+      });
       parseEvent(raw, phase) {
         return normalizeCopilotSdkEvent(raw, phase);
       }
@@ -21257,7 +21303,7 @@ var init_adapter4 = __esm({
         return failClosedResult(outcome, detail, phase, (f, p) => this.denyPayload(f, p));
       }
     };
-    copilotSdkAdapter = new CopilotSdkHostedAdapter();
+    copilotSdkAdapter = immutableRuntimeAdapter(new CopilotSdkHostedAdapter());
   }
 });
 
@@ -21277,24 +21323,24 @@ var init_registry = __esm({
     init_adapter2();
     init_adapter3();
     init_adapter4();
-    RUNTIME_ADAPTERS = [
+    RUNTIME_ADAPTERS = Object.freeze([
       claudeAdapter,
       codexAdapter,
       copilotAdapter,
       copilotSdkAdapter
-    ];
-    ADAPTER_LABELS = {
+    ]);
+    ADAPTER_LABELS = Object.freeze({
       "claude-code": "Claude Code",
       codex: "Codex",
       "github-copilot-cli": "GitHub Copilot CLI",
       "github-copilot-sdk-hosted": "GitHub Copilot SDK (hosted)"
-    };
-    ADAPTER_ALIASES = {
+    });
+    ADAPTER_ALIASES = Object.freeze({
       claude: "claude-code",
       copilot: "github-copilot-cli",
       "copilot-cli": "github-copilot-cli",
       "copilot-sdk": "github-copilot-sdk-hosted"
-    };
+    });
   }
 });
 
@@ -21319,7 +21365,8 @@ var RETAINED_EVIDENCE;
 var init_evidence = __esm({
   "src/adapters/evidence.ts"() {
     "use strict";
-    RETAINED_EVIDENCE = [
+    init_immutable();
+    RETAINED_EVIDENCE = deepFreeze([
       {
         ref: "copilot-sdk-capture-2026-09-20",
         source: "harness/adapters/copilot-sdk/evidence/capture-2026-09-20.json",
@@ -21360,7 +21407,7 @@ var init_evidence = __esm({
           }
         ]
       }
-    ];
+    ]);
   }
 });
 
@@ -21579,19 +21626,19 @@ function evidenceId(binding, assessments) {
   };
   return sha16(JSON.stringify(projection));
 }
-var CAPABILITY_STATES, RUNTIME_CAPABILITY_IDS, EVIDENCE_SOURCES, FINAL_AUTHORITY, FAIL_OPEN_RE, PRE_DENY_UNPROVEN_RE, TRANSPORT_UNPROVEN_RE, LIFECYCLE_ONLY_RE, POST_ACTION_RE, TRANSPORT_KEYWORDS, PRE_DENY_IDS, REQUIRED_IN_LOOP_IDS;
+var CAPABILITY_STATES, RUNTIME_CAPABILITY_IDS, EVIDENCE_SOURCES, IN_LOOP_AGGREGATES, FINAL_AUTHORITY, FAIL_OPEN_RE, PRE_DENY_UNPROVEN_RE, TRANSPORT_UNPROVEN_RE, LIFECYCLE_ONLY_RE, POST_ACTION_RE, TRANSPORT_KEYWORDS, PRE_DENY_IDS, REQUIRED_IN_LOOP_IDS;
 var init_runtime_qualification = __esm({
   "src/runtime-qualification.ts"() {
     "use strict";
-    CAPABILITY_STATES = [
+    CAPABILITY_STATES = Object.freeze([
       "PROVEN",
       "PARTIAL",
       "UNPROVEN",
       "UNSUPPORTED",
       "FAIL-OPEN",
       "INCONCLUSIVE"
-    ];
-    RUNTIME_CAPABILITY_IDS = [
+    ]);
+    RUNTIME_CAPABILITY_IDS = Object.freeze([
       "pre-deny:shell",
       "pre-deny:native-edit",
       "pre-deny:delete",
@@ -21609,8 +21656,8 @@ var init_runtime_qualification = __esm({
       "transport:empty",
       "hook-not-invoked",
       "detached/quiescence"
-    ];
-    EVIDENCE_SOURCES = [
+    ]);
+    EVIDENCE_SOURCES = Object.freeze([
       "adapter-declaration",
       // structural preDeny / postObserve / endOfTurn membership
       "adapter-unsupported",
@@ -21621,7 +21668,8 @@ var init_runtime_qualification = __esm({
       // a committed real-runtime evidence record proved it
       "not-declared"
       // absent from every declaration — no proof either way
-    ];
+    ]);
+    IN_LOOP_AGGREGATES = Object.freeze(["FULL", "PARTIAL", "NONE"]);
     FINAL_AUTHORITY = "AVAILABLE";
     FAIL_OPEN_RE = /fails?\s+open/i;
     PRE_DENY_UNPROVEN_RE = /pre-action deny|pre-deny|shell pre-deny/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.1",
+  "version": "2.39.3",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",