tamperward 2.39.24 → 2.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/cli/index.js +673 -346
  2. package/package.json +1 -1
  3. package/schemas/audit-v1.schema.json +33 -1
  4. package/schemas/stats-v1.schema.json +166 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "tamperward",
3
- "version": "2.39.24",
3
+ "version": "2.41.0",
4
4
  "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "hexrift",
package/schemas/audit-v1.schema.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v2.38.0/schemas/audit-v1.schema.json",
3
+ "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v2.40.0/schemas/audit-v1.schema.json",
4
4
  "title": "TamperWard audit event v1",
5
5
  "type": "object",
6
6
  "additionalProperties": false,
@@ -55,6 +55,25 @@
55
55
  "session": {
56
56
  "type": "string",
57
57
  "pattern": "^sha256:[0-9a-f]{24}$"
58
+ },
59
+ "hook_latency_ms": {
60
+ "type": "integer",
61
+ "minimum": 0,
62
+ "description": "Wall-clock milliseconds from the hook reading its input to the deny being written. Present only on events the hook itself records."
63
+ },
64
+ "verify_wall_clock_ms": {
65
+ "type": "integer",
66
+ "minimum": 0,
67
+ "description": "Wall-clock milliseconds of a `tamperward verify` run, where a producer records it."
68
+ },
69
+ "bare_suite_wall_clock_ms": {
70
+ "type": "integer",
71
+ "minimum": 0,
72
+ "description": "Wall-clock milliseconds of the same suite run without TamperWard, the comparison for verify_wall_clock_ms."
73
+ },
74
+ "oob_signoff": {
75
+ "type": "boolean",
76
+ "description": "True when an out-of-band sign-off (a CI label or local allow) was needed to clear this finding."
58
77
  }
59
78
  },
60
79
  "allOf": [
@@ -108,6 +127,19 @@
108
127
  "severity": "block",
109
128
  "decision": "deny",
110
129
  "session": "sha256:bbbbbbbbbbbbbbbbbbbbbbbb"
130
+ },
131
+ {
132
+ "schema_version": 1,
133
+ "id": "sha256:cccccccccccccccccccccccccccccccc",
134
+ "timestamp": "2026-09-23T14:00:00.000Z",
135
+ "surface": "pretooluse",
136
+ "agent": "claude-code",
137
+ "rule": "test-deletion",
138
+ "severity": "block",
139
+ "decision": "deny",
140
+ "session": "sha256:bbbbbbbbbbbbbbbbbbbbbbbb",
141
+ "hook_latency_ms": 42,
142
+ "oob_signoff": false
111
143
  }
112
144
  ]
113
145
  }
package/schemas/stats-v1.schema.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v2.38.0/schemas/stats-v1.schema.json",
3
+ "$id": "https://raw.githubusercontent.com/hexrift/tamperward/v2.40.0/schemas/stats-v1.schema.json",
4
4
  "title": "TamperWard audit stats v1",
5
5
  "type": "object",
6
6
  "additionalProperties": false,
@@ -14,6 +14,8 @@
14
14
  "last_event",
15
15
  "by_rule",
16
16
  "by_surface",
17
+ "latency",
18
+ "oob_signoffs",
17
19
  "interpretation"
18
20
  ],
19
21
  "properties": {
@@ -112,6 +114,128 @@
112
114
  }
113
115
  }
114
116
  },
117
+ "latency": {
118
+ "type": "object",
119
+ "additionalProperties": false,
120
+ "required": [
121
+ "hook_latency_ms",
122
+ "verify_wall_clock_ms",
123
+ "bare_suite_wall_clock_ms"
124
+ ],
125
+ "properties": {
126
+ "hook_latency_ms": {
127
+ "anyOf": [
128
+ {
129
+ "type": "null"
130
+ },
131
+ {
132
+ "type": "object",
133
+ "additionalProperties": false,
134
+ "required": [
135
+ "samples",
136
+ "p50",
137
+ "p95",
138
+ "max"
139
+ ],
140
+ "properties": {
141
+ "samples": {
142
+ "type": "integer",
143
+ "minimum": 1
144
+ },
145
+ "p50": {
146
+ "type": "integer",
147
+ "minimum": 0
148
+ },
149
+ "p95": {
150
+ "type": "integer",
151
+ "minimum": 0
152
+ },
153
+ "max": {
154
+ "type": "integer",
155
+ "minimum": 0
156
+ }
157
+ }
158
+ }
159
+ ]
160
+ },
161
+ "verify_wall_clock_ms": {
162
+ "anyOf": [
163
+ {
164
+ "type": "null"
165
+ },
166
+ {
167
+ "type": "object",
168
+ "additionalProperties": false,
169
+ "required": [
170
+ "samples",
171
+ "p50",
172
+ "p95",
173
+ "max"
174
+ ],
175
+ "properties": {
176
+ "samples": {
177
+ "type": "integer",
178
+ "minimum": 1
179
+ },
180
+ "p50": {
181
+ "type": "integer",
182
+ "minimum": 0
183
+ },
184
+ "p95": {
185
+ "type": "integer",
186
+ "minimum": 0
187
+ },
188
+ "max": {
189
+ "type": "integer",
190
+ "minimum": 0
191
+ }
192
+ }
193
+ }
194
+ ]
195
+ },
196
+ "bare_suite_wall_clock_ms": {
197
+ "anyOf": [
198
+ {
199
+ "type": "null"
200
+ },
201
+ {
202
+ "type": "object",
203
+ "additionalProperties": false,
204
+ "required": [
205
+ "samples",
206
+ "p50",
207
+ "p95",
208
+ "max"
209
+ ],
210
+ "properties": {
211
+ "samples": {
212
+ "type": "integer",
213
+ "minimum": 1
214
+ },
215
+ "p50": {
216
+ "type": "integer",
217
+ "minimum": 0
218
+ },
219
+ "p95": {
220
+ "type": "integer",
221
+ "minimum": 0
222
+ },
223
+ "max": {
224
+ "type": "integer",
225
+ "minimum": 0
226
+ }
227
+ }
228
+ }
229
+ ]
230
+ }
231
+ },
232
+ "description": "Nearest-rank percentiles over the events that carry each duration; null when none did."
233
+ },
234
+ "oob_signoffs": {
235
+ "type": "integer",
236
+ "minimum": 0,
237
+ "description": "Events that recorded an out-of-band sign-off."
238
+ },
115
239
  "interpretation": {
116
240
  "const": "finding-is-not-proof-of-intent"
117
241
  }
@@ -127,6 +251,47 @@
127
251
  "last_event": null,
128
252
  "by_rule": [],
129
253
  "by_surface": [],
254
+ "latency": {
255
+ "hook_latency_ms": null,
256
+ "verify_wall_clock_ms": null,
257
+ "bare_suite_wall_clock_ms": null
258
+ },
259
+ "oob_signoffs": 0,
260
+ "interpretation": "finding-is-not-proof-of-intent"
261
+ },
262
+ {
263
+ "schema_version": 1,
264
+ "events": 2,
265
+ "blocked": 2,
266
+ "warnings": 0,
267
+ "sessions": 1,
268
+ "first_event": "2026-09-23T14:00:00.000Z",
269
+ "last_event": "2026-09-23T14:05:00.000Z",
270
+ "by_rule": [
271
+ {
272
+ "rule": "test-deletion",
273
+ "events": 2,
274
+ "blocked": 2,
275
+ "warnings": 0
276
+ }
277
+ ],
278
+ "by_surface": [
279
+ {
280
+ "surface": "pretooluse",
281
+ "events": 2
282
+ }
283
+ ],
284
+ "latency": {
285
+ "hook_latency_ms": {
286
+ "samples": 2,
287
+ "p50": 40,
288
+ "p95": 55,
289
+ "max": 55
290
+ },
291
+ "verify_wall_clock_ms": null,
292
+ "bare_suite_wall_clock_ms": null
293
+ },
294
+ "oob_signoffs": 1,
130
295
  "interpretation": "finding-is-not-proof-of-intent"
131
296
  }
132
297
  ]