tamperward 2.40.0 → 2.41.0

package/dist/cli/index.js

@@ -162,7 +162,39 @@ function runtimeWiringOf(path) {
 function resolvesToRuntimeWiring(path) {
   return runtimeWiringOf(path) ?? (isAbsolute(path) ? runtimeWiringOf(canonicalPath(path)) : null);
 }
-var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS, CODEX_HOOK_CONFIG, COPILOT_HOOK_CONFIG;
+function codexWiringTables() {
+  const q = (cmd) => JSON.stringify(cmd);
+  return [
+    `# ${RUNTIME_WIRING_NOTE}`,
+    "[hooks]",
+    "[[hooks.PreToolUse]]",
+    'matcher = "*"',
+    "[[hooks.PreToolUse.hooks]]",
+    'type = "command"',
+    `command = ${q(CODEX_HOOK_CMD)}`,
+    "[[hooks.Stop]]",
+    "[[hooks.Stop.hooks]]",
+    'type = "command"',
+    `command = ${q(CODEX_SWEEP_CMD)}`,
+    ""
+  ].join("\n");
+}
+function copilotWiringDocument() {
+  return {
+    version: 1,
+    hooks: {
+      preToolUse: [{ type: "command", command: COPILOT_HOOK_CMD, timeout: 60 }],
+      agentStop: [{ type: "command", command: COPILOT_SWEEP_CMD, timeout: 60 }]
+    }
+  };
+}
+function runtimeGatePins(text) {
+  return [...text.matchAll(RUNTIME_GATE_RE)].map((m) => m[1]);
+}
+function withoutRuntimeGatePins(text) {
+  return text.replace(RUNTIME_GATE_RE, "tamperward@<pin> $2 $3");
+}
+var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS, CODEX_HOOK_CONFIG, COPILOT_HOOK_CONFIG, CODEX_HOOK_CMD, CODEX_SWEEP_CMD, COPILOT_HOOK_CMD, COPILOT_SWEEP_CMD, RUNTIME_GATE_RE, RUNTIME_WIRING_NOTE, COPILOT_WIRING_NOTE;
 var init_wiring = __esm({
   "src/wiring.ts"() {
     "use strict";
@@ -185,6 +217,13 @@ var init_wiring = __esm({
     CLAUDE_SETTINGS = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|managed-settings\.json)$/;
     CODEX_HOOK_CONFIG = /(?:^|\/)\.codex\/config\.toml$/;
     COPILOT_HOOK_CONFIG = /(?:^|\/)\.github\/hooks\/tamperward\.json$/;
+    CODEX_HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook codex${AUTHORITY_FAIL_CLOSED}`;
+    CODEX_SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep codex${AUTHORITY_FAIL_CLOSED}`;
+    COPILOT_HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook copilot${AUTHORITY_FAIL_CLOSED}`;
+    COPILOT_SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep copilot${AUTHORITY_FAIL_CLOSED}`;
+    RUNTIME_GATE_RE = /\btamperward@(\S+) (hook|sweep) (codex|copilot)\b/g;
+    RUNTIME_WIRING_NOTE = "tamperward: experimental hook wiring. This runtime has not passed a pinned live qualification; run `tamperward runtime verify` to see what is proven. Editing these entries is editing the gate.";
+    COPILOT_WIRING_NOTE = RUNTIME_WIRING_NOTE;
   }
 });
 
@@ -2765,11 +2804,20 @@ function codexHooksTables(toml) {
   }
   return out3.join("\n");
 }
+function runtimeGatePinRaise(was, now) {
+  if (now === was) return "same";
+  if (withoutRuntimeGatePins(now) !== withoutRuntimeGatePins(was)) return "changed";
+  const before = runtimeGatePins(was);
+  const after = runtimeGatePins(now);
+  return after.every((pin, i) => pinNotBelow(pin, before[i])) ? "raised" : "lowered";
+}
 function codexHooksWeakening(before, after) {
   const was = codexHooksTables(before);
   if (!was) return [];
   const now = codexHooksTables(after);
-  if (now === was) return [];
+  const change = runtimeGatePinRaise(was, now);
+  if (change === "same" || change === "raised") return [];
+  if (change === "lowered") return ["the tamperward pin in the [hooks] tables was lowered or is no longer a plain version \u2014 the gate only ever raises its pin"];
   if (GATE.test(was) && !GATE.test(now)) return ["the tamperward hook entries were removed from the [hooks] tables \u2014 Codex no longer runs the gate"];
   return ["the [hooks] tables changed \u2014 the PreToolUse and Stop wiring Codex reads is no longer what it was"];
 }
@@ -2788,7 +2836,9 @@ function copilotHooksWeakening(before, after) {
   if (was === null || was.hooks === null) return [];
   const now = hooksMember(after);
   if (now === null) return ["the file no longer parses as JSON \u2014 the Copilot CLI loads no hook from it"];
-  if (now.hooks === was.hooks) return [];
+  const change = runtimeGatePinRaise(was.hooks, now.hooks ?? "");
+  if (change === "same" || change === "raised") return [];
+  if (change === "lowered") return ['the tamperward pin in "hooks" was lowered or is no longer a plain version \u2014 the gate only ever raises its pin'];
   if (GATE.test(was.hooks) && !GATE.test(now.hooks ?? "")) return ['the tamperward hook entries were removed from "hooks" \u2014 the Copilot CLI no longer runs the gate'];
   return ['the "hooks" entries changed \u2014 the preToolUse and agentStop wiring the Copilot CLI reads is no longer what it was'];
 }
@@ -14012,11 +14062,200 @@ var init_verifier_limits = __esm({
   }
 });
 
+// src/immutable.ts
+function isPlainData(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === Array.prototype || proto === null;
+}
+function deepFreeze(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const walk2 = (node) => {
+    if (!isPlainData(node) || seen.has(node)) return;
+    seen.add(node);
+    Object.freeze(node);
+    for (const key2 of Reflect.ownKeys(node)) walk2(Reflect.get(node, key2));
+  };
+  walk2(value);
+  return value;
+}
+var init_immutable = __esm({
+  "src/immutable.ts"() {
+    "use strict";
+  }
+});
+
+// src/runtimes.ts
+import { existsSync as existsSync7, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { join as join15 } from "node:path";
+function isRecord4(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+function hooksBeyondTamperward(hooks) {
+  if (!isRecord4(hooks)) return hooks != null;
+  for (const entries of Object.values(hooks)) {
+    if (!Array.isArray(entries)) {
+      if (entries != null) return true;
+      continue;
+    }
+    for (const entry of entries) {
+      const hs = isRecord4(entry) ? entry.hooks : null;
+      if (!Array.isArray(hs)) {
+        if (hs != null) return true;
+        continue;
+      }
+      for (const h of hs) {
+        const cmd = isRecord4(h) ? String(h.command ?? "") : "";
+        if (!/tamperward/.test(cmd)) return true;
+      }
+    }
+  }
+  return false;
+}
+function claudeSettingsBeyondTamperward(cwd) {
+  const path = join15(cwd, ".claude", "settings.json");
+  let raw;
+  try {
+    if (!existsSync7(path)) return false;
+    raw = readFileSync8(path, "utf8");
+  } catch {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return raw.trim().length > 0;
+  }
+  if (!isRecord4(parsed)) return raw.trim().length > 0;
+  for (const [key2, value] of Object.entries(parsed)) {
+    if (key2 === "disableAllHooks") continue;
+    if (key2 === "hooks") {
+      if (hooksBeyondTamperward(value)) return true;
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+function codexDirBeyondTamperward(cwd) {
+  const dir = join15(cwd, ".codex");
+  let entries;
+  try {
+    if (!existsSync7(dir) || !statSync3(dir).isDirectory()) return false;
+    entries = readdirSync3(dir);
+  } catch {
+    return false;
+  }
+  if (entries.some((e) => e !== "config.toml")) return true;
+  if (!entries.includes("config.toml")) return false;
+  let raw;
+  try {
+    raw = readFileSync8(join15(dir, "config.toml"), "utf8");
+  } catch {
+    return false;
+  }
+  return raw.split("\n").some((line) => {
+    const t = line.trim();
+    return t !== "" && !t.startsWith("#") && !/^\[\[?hooks/.test(t) && !codexWiringLines().has(t);
+  });
+}
+function codexWiringLines() {
+  if (!wiringLines) wiringLines = new Set(codexWiringTables().split("\n").map((l) => l.trim()).filter(Boolean));
+  return wiringLines;
+}
+function detectRuntimes(cwd) {
+  const found = [];
+  for (const rt of KNOWN_RUNTIMES) {
+    const marker = rt.markers.find((m) => {
+      try {
+        return existsSync7(join15(cwd, m));
+      } catch {
+        return false;
+      }
+    });
+    const matchedMarker = marker ?? rt.detectExtra?.(cwd) ?? void 0;
+    if (matchedMarker !== void 0) found.push({ ...rt, matchedMarker });
+  }
+  return found;
+}
+function hasInLoopRuntime(detected) {
+  return detected.some((r) => r.steering === "in-loop");
+}
+function detectionHeadline(detected) {
+  if (detected.length === 0) {
+    return "No agent runtime detected. Wiring Claude Code in-loop steering plus the agent-neutral layers (pre-commit + CI) that protect any agent or human.";
+  }
+  if (detected.length === 1) {
+    const r = detected[0];
+    return `Detected ${r.label} \u2014 ${r.note}`;
+  }
+  const parts = detected.map((r) => `${r.label} (${r.steering === "in-loop" ? "in-loop" : "neutral layers"})`);
+  return `Detected ${detected.length} agent runtimes: ${parts.join(", ")}.`;
+}
+function neutralOnlyCaveat(detected) {
+  const neutral = detected.filter((r) => r.steering === "neutral");
+  if (neutral.length === 0) return null;
+  const names = neutral.map((r) => r.label).join(", ");
+  const claudeAlso = hasInLoopRuntime(detected);
+  const lead = claudeAlso ? `In-loop steering (deny-before-execute) ships for Claude Code only today: Claude Code here gets it, but on ${names} your live protection is ` : `In-loop steering (deny-before-execute) ships for Claude Code only today, so on ${names} your live protection is `;
+  const tail = claudeAlso ? "" : " The Claude hook wiring is still written and is inert unless Claude Code runs in this repository.";
+  return `${lead}the agent-neutral layers: pre-commit and CI.${tail}`;
+}
+var wiringLines, KNOWN_RUNTIMES;
+var init_runtimes = __esm({
+  "src/runtimes.ts"() {
+    "use strict";
+    init_immutable();
+    init_wiring();
+    wiringLines = null;
+    KNOWN_RUNTIMES = deepFreeze([
+      {
+        id: "claude-code",
+        // Markers are Claude Code files `init` never writes, so detection never mistakes
+        // TamperWard's own generated `.claude/settings.json` for evidence a human runs
+        // Claude here (#526). `detectExtra` looks at that generated file's CONTENT for
+        // real use (configuration beyond the two hooks init merges in).
+        label: "Claude Code",
+        markers: ["CLAUDE.md", ".claude/settings.local.json", ".claude/commands", ".claude/agents"],
+        detectExtra: (cwd) => claudeSettingsBeyondTamperward(cwd) ? ".claude/settings.json" : null,
+        steering: "in-loop",
+        note: "native in-loop steering (PreToolUse deny + Stop sweep) plus the agent-neutral layers."
+      },
+      {
+        id: "cursor",
+        label: "Cursor",
+        markers: [".cursor", ".cursorrules"],
+        steering: "neutral",
+        note: "agent-neutral layers (pre-commit + CI) today; no in-loop adapter ships for Cursor."
+      },
+      {
+        id: "copilot",
+        label: "GitHub Copilot",
+        markers: [".github/copilot-instructions.md", ".github/copilot"],
+        steering: "neutral",
+        note: "agent-neutral layers (pre-commit + CI) today; the experimental Copilot adapters are not qualified for in-loop steering (see `tamperward runtime verify`)."
+      },
+      {
+        id: "codex",
+        label: "an AGENTS.md-aware agent (e.g. Codex)",
+        // `.codex/config.toml` is a file `init` writes (the hook wiring), so the directory
+        // counts only for what else it holds, or for configuration in that file beyond the
+        // hooks tables init appends (#526).
+        markers: ["AGENTS.md"],
+        detectExtra: (cwd) => codexDirBeyondTamperward(cwd) ? ".codex" : null,
+        steering: "neutral",
+        note: "agent-neutral layers (pre-commit + CI) today; the experimental Codex adapter is not qualified for in-loop steering (see `tamperward runtime verify`)."
+      }
+    ]);
+  }
+});
+
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync8, realpathSync as realpathSync5 } from "node:fs";
-import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative4, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, realpathSync as realpathSync5 } from "node:fs";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join16, relative as relative4, resolve as resolve6 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
     return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -14109,34 +14348,34 @@ function verifierCandidates(cwd) {
     if (!candidates.includes(command)) candidates.push(command);
   };
   try {
-    const pkg = JSON.parse(readFileSync8(join15(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join16(cwd, "package.json"), "utf8"));
     const test = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts.test : void 0;
     if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
   } catch {
   }
   try {
-    const pyproject = readFileSync8(join15(cwd, "pyproject.toml"), "utf8");
+    const pyproject = readFileSync9(join16(cwd, "pyproject.toml"), "utf8");
     if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
   } catch {
   }
-  if (existsSync7(join15(cwd, "pytest.ini"))) add("pytest");
+  if (existsSync8(join16(cwd, "pytest.ini"))) add("pytest");
   try {
-    const setupCfg = readFileSync8(join15(cwd, "setup.cfg"), "utf8");
+    const setupCfg = readFileSync9(join16(cwd, "setup.cfg"), "utf8");
     if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
   } catch {
   }
   try {
-    const tox = readFileSync8(join15(cwd, "tox.ini"), "utf8");
+    const tox = readFileSync9(join16(cwd, "tox.ini"), "utf8");
     if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
   } catch {
   }
   try {
-    const cargo = readFileSync8(join15(cwd, "Cargo.toml"), "utf8");
+    const cargo = readFileSync9(join16(cwd, "Cargo.toml"), "utf8");
     if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
   } catch {
   }
   try {
-    const goMod = readFileSync8(join15(cwd, "go.mod"), "utf8");
+    const goMod = readFileSync9(join16(cwd, "go.mod"), "utf8");
     if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
   } catch {
   }
@@ -14176,10 +14415,10 @@ function verifierSetupMessage(cwd) {
   return lines.join("\n");
 }
 function planPolicy(cwd) {
-  const path = join15(cwd, POLICY_FILE);
+  const path = join16(cwd, POLICY_FILE);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "policy", path: POLICY_FILE, status: "error", detail: refused };
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -14197,8 +14436,8 @@ function planPolicy(cwd) {
 }
 function planGitignore(cwd) {
   const rel = ".gitignore";
-  const path = join15(cwd, rel);
-  if (!existsSync7(join15(cwd, "node_modules"))) return null;
+  const path = join16(cwd, rel);
+  if (!existsSync8(join16(cwd, "node_modules"))) return null;
   let existing = "";
   let kind;
   try {
@@ -14208,7 +14447,7 @@ function planGitignore(cwd) {
   }
   const refused = refuseNonRegular(path);
   if (refused) return { item: "gitignore", path: rel, status: "error", detail: refused };
-  if (kind === "file") existing = readFileSync8(path, "utf8");
+  if (kind === "file") existing = readFileSync9(path, "utf8");
   try {
     const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
       cwd,
@@ -14259,14 +14498,14 @@ function gateVerdicts(event, groups, needle) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join15(cwd, rel);
+  const path = join16(cwd, rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "agent", path: rel, status: "error", detail: refused };
   let settings = {};
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync8(path, "utf8"));
+      parsed = JSON.parse(readFileSync9(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -14315,7 +14554,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync7(path) ? "update" : "create",
+    status: existsSync8(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -14359,7 +14598,7 @@ function hooksDir(cwd) {
     if (out3) return resolve6(cwd, out3);
   } catch {
   }
-  return existsSync7(join15(cwd, ".git")) ? join15(cwd, ".git", "hooks") : null;
+  return existsSync8(join16(cwd, ".git")) ? join16(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative4(cwd, path);
@@ -14386,29 +14625,29 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync7(join15(cwd, ".husky"))) {
-    path = join15(cwd, ".husky", "pre-commit");
+  if (existsSync8(join16(cwd, ".husky"))) {
+    path = join16(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join15(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join16(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename3(dir) === "_" && basename3(dirname5(dir)) === ".husky") {
-      path = join15(dirname5(dir), "pre-commit");
+      path = join16(dirname5(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join15(dir, "pre-commit");
+      path = join16(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join15(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join16(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "pre-commit", path: rel, status: "error", detail: refused };
-  const existing = existsSync7(path) ? readFileSync8(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync9(path, "utf8") : null;
   const hookMode = () => existingMode(path, 493) | 73;
   if (existing === null) {
     return {
@@ -14494,12 +14733,12 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => writeTargetKind(join15(cwd, r)) !== "absent"
+    (r) => writeTargetKind(join16(cwd, r)) !== "absent"
   );
-  const path = join15(cwd, existingRel ?? rel);
+  const path = join16(cwd, existingRel ?? rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "codeowners", path: existingRel ?? rel, status: "error", detail: refused };
-  const existing = existingRel ? readFileSync8(path, "utf8") : null;
+  const existing = existingRel ? readFileSync9(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (existingRel !== void 0 && missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -14532,14 +14771,14 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join15(cwd, rel);
+  const path = join16(cwd, rel);
   const write = () => {
     mkdirSync7(dirname5(path), { recursive: true });
     atomicReplaceFile(path, workflowFile(WORKFLOW_CONTENT), existingMode(path, 420));
   };
   const refused = refuseNonRegular(path);
   if (refused) return { item: "ci", path: rel, status: "error", detail: refused };
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return {
       item: "ci",
       path: rel,
@@ -14550,7 +14789,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync8(path, "utf8");
+    src = readFileSync9(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -14598,6 +14837,96 @@ function sameDir(a, b) {
     return false;
   }
 }
+function planCodexHooks(cwd) {
+  const rel = ".codex/config.toml";
+  const path = join16(cwd, rel);
+  const item = "codex-hooks";
+  const refused = refuseNonRegular(path);
+  if (refused) return { item, path: rel, status: "error", detail: refused };
+  const warning = RUNTIME_WARNING("Codex", "codex");
+  const tables = codexWiringTables();
+  if (!existsSync8(path)) {
+    return {
+      item,
+      path: rel,
+      status: "create",
+      detail: "wire the PreToolUse deny and Stop sweep [hooks] tables (experimental)",
+      warning,
+      apply: () => {
+        mkdirSync7(dirname5(path), { recursive: true });
+        atomicReplaceFile(path, tables, 420);
+      }
+    };
+  }
+  const current = readFileSync9(path, "utf8");
+  const existing = codexHooksTables(current);
+  if (!existing) {
+    const next = current + (current.endsWith("\n") || current === "" ? "" : "\n") + "\n" + tables;
+    return {
+      item,
+      path: rel,
+      status: "update",
+      detail: "append the PreToolUse deny and Stop sweep [hooks] tables (experimental)",
+      warning,
+      apply: () => atomicReplaceFile(path, next, existingMode(path, 420))
+    };
+  }
+  if (existing === codexHooksTables(tables)) return { item, path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
+  if (withoutRuntimeGatePins(existing) === withoutRuntimeGatePins(codexHooksTables(tables))) {
+    const pins = [...new Set(runtimeGatePins(existing))];
+    const next = current.replace(/\btamperward@\S+ (hook|sweep) codex\b/g, `tamperward@${TW_VERSION} $1 codex`);
+    return {
+      item,
+      path: rel,
+      status: "update",
+      detail: `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`,
+      warning,
+      apply: () => atomicReplaceFile(path, next, existingMode(path, 420))
+    };
+  }
+  return {
+    item,
+    path: rel,
+    status: "error",
+    detail: "the [hooks] tables are not the shape init writes \u2014 remove them or add the tamperward entries by hand, then re-run init (refusing to rewrite a hand-written hooks block)"
+  };
+}
+function planCopilotHooks(cwd) {
+  const rel = ".github/hooks/tamperward.json";
+  const path = join16(cwd, rel);
+  const item = "copilot-hooks";
+  const refused = refuseNonRegular(path);
+  if (refused) return { item, path: rel, status: "error", detail: refused };
+  const warning = RUNTIME_WARNING("Copilot CLI", "copilot");
+  const document = copilotWiringDocument();
+  const content = JSON.stringify({ $comment: COPILOT_WIRING_NOTE, ...document }, null, 2) + "\n";
+  const write = () => {
+    mkdirSync7(dirname5(path), { recursive: true });
+    atomicReplaceFile(path, content, existingMode(path, 420));
+  };
+  if (!existsSync8(path)) {
+    return { item, path: rel, status: "create", detail: "wire the preToolUse deny and agentStop sweep hooks (experimental)", warning, apply: write };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync9(path, "utf8"));
+  } catch {
+    return { item, path: rel, status: "error", detail: "exists but is not valid JSON \u2014 fix it, then re-run init (refusing to overwrite)" };
+  }
+  const hooks = isRecord(parsed) ? JSON.stringify(parsed.hooks ?? null) : "null";
+  const wanted = JSON.stringify(document.hooks);
+  if (hooks === wanted) return { item, path: rel, status: "ok", detail: "preToolUse + agentStop hooks already wired" };
+  if (withoutRuntimeGatePins(hooks) === withoutRuntimeGatePins(wanted)) {
+    const pins = [...new Set(runtimeGatePins(hooks))];
+    return { item, path: rel, status: "update", detail: `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`, warning, apply: write };
+  }
+  return {
+    item,
+    path: rel,
+    status: "error",
+    detail: "the hooks are not the shape init writes \u2014 remove the file or restore the tamperward entries by hand, then re-run init (refusing to rewrite a hand-written hooks file)"
+  };
+}
 function planInit(cwd, opts = {}) {
   requireShippedVersion();
   const gitignore = planGitignore(cwd);
@@ -14605,11 +14934,24 @@ function planInit(cwd, opts = {}) {
     planned("policy", POLICY_FILE, () => planPolicy(cwd)),
     ...gitignore ? [gitignore] : [],
     planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
+    ...runtimeWiringPlans(cwd),
     planned("pre-commit", "(hooks)", () => planPreCommit(cwd)),
     planned("ci", ".github/workflows/tamperward.yml", () => planWorkflow(cwd, opts.forceWorkflow ?? false)),
     planned("codeowners", ".github/CODEOWNERS", () => planCodeowners(cwd))
   ];
 }
+function runtimeWiringPlans(cwd) {
+  let detected;
+  try {
+    detected = new Set(detectRuntimes(cwd).map((r) => r.id));
+  } catch {
+    detected = /* @__PURE__ */ new Set();
+  }
+  return [
+    ...detected.has("codex") ? [planned("codex-hooks", ".codex/config.toml", () => planCodexHooks(cwd))] : [],
+    ...detected.has("copilot") ? [planned("copilot-hooks", ".github/hooks/tamperward.json", () => planCopilotHooks(cwd))] : []
+  ];
+}
 function runInit(opts) {
   const requested = resolve6(opts.cwd ?? process.cwd());
   const cwd = repoRoot(requested);
@@ -14664,7 +15006,7 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
   );
   return 0;
 }
-var errText3, isPlainObject, HOOK_RE, SWEEP_RE, PRECOMMIT_RE, LEGACY_OURS, PRE_GLOBAL_OURS, CODEOWNERS_MARK, CODEOWNERS_PATHS, POLICY_CONTENT, WORKFLOW_CONTENT, WORKFLOW_MARK, WORKFLOW_MARK_RE, MANAGED_HOOKS;
+var errText3, isPlainObject, HOOK_RE, SWEEP_RE, PRECOMMIT_RE, LEGACY_OURS, PRE_GLOBAL_OURS, CODEOWNERS_MARK, CODEOWNERS_PATHS, POLICY_CONTENT, WORKFLOW_CONTENT, WORKFLOW_MARK, WORKFLOW_MARK_RE, MANAGED_HOOKS, RUNTIME_WARNING;
 var init_init = __esm({
   "src/cli/init.ts"() {
     "use strict";
@@ -14672,6 +15014,8 @@ var init_init = __esm({
     init_policy_load();
     init_verifier_limits();
     init_wiring();
+    init_hook_wiring();
+    init_runtimes();
     init_narrow();
     init_hook_tampering();
     init_repo_context();
@@ -14857,6 +15201,7 @@ jobs:
               always_run: true`
       }
     ];
+    RUNTIME_WARNING = (label, id) => `EXPERIMENTAL: the ${label} hook wiring was written because this repository shows ${label} markers, but the ${label} adapter has not passed a pinned live qualification. \`tamperward runtime verify --runtime ${id}\` grades what is proven; until it reports in-loop steering, the agent-neutral layers (pre-commit + CI) are the live protection.`;
   }
 });
 
@@ -14897,20 +15242,20 @@ var init_fingerprint = __esm({
 // src/dependency-env.ts
 import { createHash as createHash10 } from "node:crypto";
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync9,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync9,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync10,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync6,
-  statSync as statSync3
+  statSync as statSync4
 } from "node:fs";
 import {
   basename as basename4,
   delimiter,
   dirname as dirname6,
   isAbsolute as isAbsolute10,
-  join as join16,
+  join as join17,
   relative as relative5,
   resolve as resolve7,
   sep as sep3
@@ -14945,7 +15290,7 @@ function fingerprintRoot(root, cwd, h) {
       root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
     );
   }
-  if (!statSync3(root.path).isDirectory()) {
+  if (!statSync4(root.path).isDirectory()) {
     throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
@@ -14955,10 +15300,10 @@ function fingerprintRoot(root, cwd, h) {
   const hashFile = (path, label) => {
     let st;
     try {
-      st = statSync3(path);
+      st = statSync4(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync9(path));
+      h.update(readFileSync10(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -14972,14 +15317,14 @@ function fingerprintRoot(root, cwd, h) {
     visited.add(realDir);
     let entries;
     try {
-      entries = readdirSync3(dir, { withFileTypes: true });
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch (e) {
       throw new Unattestable(
         "dependency directory " + JSON.stringify(dir) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
       );
     }
     for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join16(dir, entry.name);
+      const path = join17(dir, entry.name);
       const rel = namespace ? namespace + "/" + entry.name : entry.name;
       let ident;
       try {
@@ -14992,7 +15337,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync9(path));
+          h.update(readFileSync10(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -15021,7 +15366,7 @@ function fingerprintRoot(root, cwd, h) {
         } catch {
           continue;
         }
-        const followed = statSync3(path);
+        const followed = statSync4(path);
         if (followed.isFile()) {
           hashFile(resolved, "@target:" + rel);
           continue;
@@ -15051,7 +15396,7 @@ function snapshot(roots, probes, cwd) {
   const h = createHash10("sha256");
   for (const probe of probes) {
     h.update(
-      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync8(probe.path) ? "present" : "absent") + "\0"
+      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync9(probe.path) ? "present" : "absent") + "\0"
     );
   }
   for (const root of roots) fingerprintRoot(root, cwd, h);
@@ -15069,7 +15414,7 @@ function measuredSnapshot(roots, probes, cwd, metrics) {
 }
 function freezeRoot(kind, path) {
   try {
-    if (!statSync3(path).isDirectory()) {
+    if (!statSync4(path).isDirectory()) {
       throw new Error("not a directory");
     }
     return { kind, path: resolve7(path), realPath: realpathSync6(path) };
@@ -15110,7 +15455,7 @@ function resolveExecutable(token, cwd, env) {
   if (token.includes("/") || token.includes("\\")) {
     const path = isAbsolute10(token) ? token : resolve7(cwd, token);
     try {
-      return existsSync8(path) ? realpathSync6(path) : null;
+      return existsSync9(path) ? realpathSync6(path) : null;
     } catch {
       return null;
     }
@@ -15118,7 +15463,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve7(entry, token);
     try {
-      if (existsSync8(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
+      if (existsSync9(candidate) && statSync4(candidate).isFile()) return realpathSync6(candidate);
     } catch {
     }
   }
@@ -15141,7 +15486,7 @@ function inferredVenvFromToken(token, cwd) {
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname6(parent);
-  return existsSync8(join16(root, "pyvenv.cfg")) ? root : null;
+  return existsSync9(join17(root, "pyvenv.cfg")) ? root : null;
 }
 function unsupportedEcosystem(command, token) {
   const name = token ? basename4(token).toLowerCase() : "";
@@ -15157,13 +15502,13 @@ function inferredVenv(executable) {
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname6(parent);
-  return existsSync8(join16(root, "pyvenv.cfg")) ? root : null;
+  return existsSync9(join17(root, "pyvenv.cfg")) ? root : null;
 }
 function venvProblem(root) {
-  const cfg = join16(root, "pyvenv.cfg");
-  if (!existsSync8(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
+  const cfg = join17(root, "pyvenv.cfg");
+  if (!existsSync9(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync9(cfg, "utf8");
+    const body = readFileSync10(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -15187,8 +15532,8 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
     }
   };
   try {
-    const nodeModules = join16(cwd, "node_modules");
-    if (existsSync8(nodeModules)) addRoot("node_modules", nodeModules);
+    const nodeModules = join17(cwd, "node_modules");
+    if (existsSync9(nodeModules)) addRoot("node_modules", nodeModules);
     else probes.push({ kind: "node_modules", path: nodeModules });
     const token = firstExecutable(command);
     const executable = resolveExecutable(token, cwd, env);
@@ -15200,8 +15545,8 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
       venv = resolve7(env.VIRTUAL_ENV);
     } else {
       venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
-      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync8(join16(cwd, ".venv", "pyvenv.cfg"))) {
-        venv = join16(cwd, ".venv");
+      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync9(join17(cwd, ".venv", "pyvenv.cfg"))) {
+        venv = join17(cwd, ".venv");
       }
     }
     if (venv) {
@@ -15307,7 +15652,7 @@ var init_dependency_env = __esm({
 import { spawnSync } from "node:child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function emptySuiteDiagnostics() {
   return {
     stdout: { ...EMPTY_STREAM },
@@ -15387,8 +15732,8 @@ function parseCapturedSupervisorResult(stdoutText) {
   };
 }
 function runCapturedProcessSync(executable, args, opts) {
-  const stateDir2 = mkdtempSync2(join17(tmpdir3(), "tw-suite-capture-"));
-  const configFile = join17(stateDir2, "config.json");
+  const stateDir2 = mkdtempSync2(join18(tmpdir3(), "tw-suite-capture-"));
+  const configFile = join18(stateDir2, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
     writeFileSync7(
@@ -15679,8 +16024,8 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash11, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants4, readFileSync as readFileSync10, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve8 } from "node:path";
+import { accessSync as accessSync2, constants as constants4, readFileSync as readFileSync11, realpathSync as realpathSync7, statSync as statSync5 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname7, join as join19, resolve as resolve8 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
   const groups = typeof process.getgroups === "function" ? process.getgroups() : [];
@@ -15688,7 +16033,7 @@ function identity() {
 }
 function writableByCaller(path) {
   try {
-    const st = statSync4(path);
+    const st = statSync5(path);
     const { uid, groups } = identity();
     if (uid === 0) return true;
     if ((st.mode & 2) !== 0) return true;
@@ -15714,7 +16059,7 @@ function replaceableByCaller(path) {
 function findExecutable(name) {
   for (const raw of (process.env.PATH ?? "").split(delimiter2)) {
     if (!raw) continue;
-    const candidate = join18(raw, name);
+    const candidate = join19(raw, name);
     try {
       accessSync2(candidate, constants4.X_OK);
       return realpathSync7(candidate);
@@ -15724,7 +16069,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash11("sha256").update(readFileSync10(path)).digest("hex");
+  return createHash11("sha256").update(readFileSync11(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -16158,8 +16503,8 @@ var init_verifier_backend = __esm({
 // src/verification-state.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7 } from "node:fs";
-import { dirname as dirname8, join as join19 } from "node:path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync12, rmSync as rmSync7 } from "node:fs";
+import { dirname as dirname8, join as join20 } from "node:path";
 function git2(args, cwd) {
   return execFileSync8("git", args, {
     cwd,
@@ -16209,19 +16554,19 @@ function surfacePaths(base, cwd, policy) {
 function interventionWiring(cwd) {
   const dir = claudeConfigDir();
   const sources = [
-    ["repo", join19(cwd, ".claude", "settings.json")],
-    ["repo.local", join19(cwd, ".claude", "settings.local.json")],
-    ["user", join19(dir, "settings.json")],
-    ["user.local", join19(dir, "settings.local.json")]
+    ["repo", join20(cwd, ".claude", "settings.json")],
+    ["repo.local", join20(cwd, ".claude", "settings.local.json")],
+    ["user", join20(dir, "settings.json")],
+    ["user.local", join20(dir, "settings.local.json")]
   ];
   return sources.map(([source, path]) => {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(path, "utf8"));
+      parsed = JSON.parse(readFileSync12(path, "utf8"));
     } catch {
       return { source, present: false };
     }
-    if (!isRecord4(parsed)) return { source, present: true, shape: "non-object" };
+    if (!isRecord5(parsed)) return { source, present: true, shape: "non-object" };
     return {
       source,
       present: true,
@@ -16279,11 +16624,11 @@ function stateDir(cwd) {
 }
 function verificationRecordPath(cwd) {
   const dir = stateDir(cwd);
-  return dir ? join19(dir, "verification-state.json") : null;
+  return dir ? join20(dir, "verification-state.json") : null;
 }
 function verifyingMarkerPath(cwd) {
   const dir = stateDir(cwd);
-  return dir ? join19(dir, "verifying.json") : null;
+  return dir ? join20(dir, "verifying.json") : null;
 }
 function recordVerification(cwd, inputs, treeFingerprintValue) {
   const path = verificationRecordPath(cwd);
@@ -16330,24 +16675,24 @@ function invalidateVerificationRecordIfCurrent(cwd) {
     return false;
   }
 }
-function isRecord4(v) {
+function isRecord5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function isBinding(v) {
-  if (!isRecord4(v)) return false;
+  if (!isRecord5(v)) return false;
   return BINDING_INPUTS.every((k) => {
     const val = v[k];
     return typeof val === "string" && val.length > 0;
   });
 }
 function parseVerificationRecord(value) {
-  if (!isRecord4(value)) return null;
+  if (!isRecord5(value)) return null;
   if (value.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
   if (value.verdict !== "VERIFIED") return null;
   if (typeof value.verified_at !== "string") return null;
   if (typeof value.tw_version !== "string") return null;
   const inputs = value.inputs;
-  if (!isRecord4(inputs)) return null;
+  if (!isRecord5(inputs)) return null;
   if (typeof inputs.base_ref !== "string" || inputs.base_ref.length === 0) return null;
   if (typeof inputs.explicit_base !== "boolean") return null;
   if (inputs.command_source !== "policy" && inputs.command_source !== "flag") return null;
@@ -16389,7 +16734,7 @@ function pidAlive3(pid) {
     process.kill(pid, 0);
     return true;
   } catch (e) {
-    return isRecord4(e) && e.code === "EPERM";
+    return isRecord5(e) && e.code === "EPERM";
   }
 }
 function beginVerifying(cwd) {
@@ -16427,7 +16772,7 @@ function readVerifyingMarker(cwd) {
   } catch {
     return null;
   }
-  if (!isRecord4(parsed)) return null;
+  if (!isRecord5(parsed)) return null;
   if (parsed.schema_version !== VERIFICATION_STATE_SCHEMA_VERSION) return null;
   if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
   if (typeof parsed.started_at !== "string") return null;
@@ -16572,8 +16917,8 @@ var init_verification_state = __esm({
 // src/verification-receipt.ts
 import { createHash as createHash13 } from "node:crypto";
 import { mkdirSync as mkdirSync9, rmSync as rmSync8 } from "node:fs";
-import { dirname as dirname9, join as join20 } from "node:path";
-function isRecord5(v) {
+import { dirname as dirname9, join as join21 } from "node:path";
+function isRecord6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function canonicalJson2(value) {
@@ -16611,7 +16956,7 @@ function receiptFromRecord(record) {
 }
 function receiptPath(cwd) {
   const ctx = repoContext(cwd);
-  return ctx ? join20(stateDirectory(ctx.gitDir), "verification-receipt.json") : null;
+  return ctx ? join21(stateDirectory(ctx.gitDir), "verification-receipt.json") : null;
 }
 function storeReceipt(cwd, receipt) {
   try {
@@ -16636,10 +16981,10 @@ function isOneOf(list3, v) {
   return typeof v === "string" && list3.includes(v);
 }
 function isStages(v) {
-  return isRecord5(v) && isOneOf(RECEIPT_STAGE_RESULTS, v.candidate) && isOneOf(RECEIPT_STAGE_RESULTS, v.pristine) && isOneOf(RECEIPT_INTEGRITY_RESULTS, v.integrity);
+  return isRecord6(v) && isOneOf(RECEIPT_STAGE_RESULTS, v.candidate) && isOneOf(RECEIPT_STAGE_RESULTS, v.pristine) && isOneOf(RECEIPT_INTEGRITY_RESULTS, v.integrity);
 }
 function isBinding2(v) {
-  if (!isRecord5(v)) return false;
+  if (!isRecord6(v)) return false;
   return BINDING_INPUTS.every((k) => {
     const val = v[k];
     return typeof val === "string" && val.length > 0;
@@ -16649,7 +16994,7 @@ function classifyReceipt(value) {
   if (value === null || value === void 0) {
     return { disposition: "ABSENT", detail: "no local verification receipt was provided" };
   }
-  if (!isRecord5(value)) {
+  if (!isRecord6(value)) {
     return { disposition: "UNKNOWN_SCHEMA", detail: "receipt is not a JSON object" };
   }
   if (value.schema_version !== RECEIPT_SCHEMA_VERSION) {
@@ -16803,9 +17148,9 @@ var init_verification_receipt = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync8, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync8, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname10, isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute11, join as join22, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
   return {
     level: "suite-exit-only",
@@ -16894,7 +17239,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "deps" && dependencyRoot ? dependencyRoot : root;
-    const current = join21(base, ...stack);
+    const current = join22(base, ...stack);
     let st;
     try {
       st = lstatSync10(current);
@@ -16936,7 +17281,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join21(current, part);
+    current = join22(current, part);
     let st;
     try {
       st = lstatSync10(current);
@@ -16961,7 +17306,7 @@ function materialize(cwd, dest, dependencyRoot) {
   }
   const links = [];
   for (const rel of listed) {
-    const src = join21(cwd, rel);
+    const src = join22(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -16969,7 +17314,7 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out3 = join21(dest, rel);
+    const out3 = join22(dest, rel);
     mkdirSync10(dirname10(out3), { recursive: true });
     dropSymlink(out3);
     if (st.isSymbolicLink()) {
@@ -16989,17 +17334,17 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join21(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join22(dest, "node_modules"), "dir");
 }
 function workingTreePaths(cwd) {
   return git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
 }
 function probeFilesystemCaseSensitivity(dir) {
-  const upper = join21(dir, ".tw-case-probe-A");
-  const lower = join21(dir, ".tw-case-probe-a");
+  const upper = join22(dir, ".tw-case-probe-A");
+  const lower = join22(dir, ".tw-case-probe-a");
   try {
     writeFileSync8(upper, "", { flag: "wx" });
-    return !existsSync9(lower);
+    return !existsSync10(lower);
   } finally {
     rmSync9(upper, { force: true });
   }
@@ -17059,11 +17404,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join21(dest, rel);
+    const p = join22(dest, rel);
     try {
       const st = lstatSync10(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync12(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync13(p));
     } catch {
       h.update("<gone>");
     }
@@ -17093,7 +17438,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out3 = join21(dest, e.path);
+    const out3 = join22(dest, e.path);
     mkdirSync10(dirname10(out3), { recursive: true });
     rmSync9(out3, { force: true });
     if (e.mode === "120000") {
@@ -17110,7 +17455,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync9(join21(dest, rel), { force: true });
+    rmSync9(join22(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -17124,8 +17469,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join21(scratch, "npmrc-user");
-  const globalRc = join21(scratch, "npmrc-global");
+  const userRc = join22(scratch, "npmrc-user");
+  const globalRc = join22(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync8(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -17157,7 +17502,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
     };
   }
-  const scratch = mkdtempSync3(join21(tmpdir4(), "tw-verify-run-"));
+  const scratch = mkdtempSync3(join22(tmpdir4(), "tw-verify-run-"));
   try {
     const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
@@ -17403,8 +17748,8 @@ function runVerifyImpl(opts) {
   } catch {
     return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
-  const visRoot = mkdtempSync3(join21(tmpdir4(), "tw-verify-vis-"));
-  const visDir = join21(visRoot, "t");
+  const visRoot = mkdtempSync3(join22(tmpdir4(), "tw-verify-vis-"));
+  const visDir = join22(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync9(d, { recursive: true, force: true });
@@ -17413,7 +17758,7 @@ function runVerifyImpl(opts) {
   if (!filesystemCaseSensitive) {
     const present = (rel) => {
       try {
-        lstatSync10(join21(cwd, rel));
+        lstatSync10(join22(cwd, rel));
         return true;
       } catch {
         return false;
@@ -17546,8 +17891,8 @@ function runVerifyImpl(opts) {
       { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
     );
   }
-  const priRoot = mkdtempSync3(join21(tmpdir4(), "tw-verify-pri-"));
-  const priDir = join21(priRoot, "t");
+  const priRoot = mkdtempSync3(join22(tmpdir4(), "tw-verify-pri-"));
+  const priDir = join22(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -17877,9 +18222,9 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync5, readFileSync as readFileSync14, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync6, writeFileSync as writeFileSync9 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
+import { dirname as dirname11, join as join23, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
@@ -17933,7 +18278,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   for (const candidate of candidates) {
     try {
       const real = realpathSync8(candidate);
-      const st = statSync5(real);
+      const st = statSync6(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
         real,
@@ -17955,9 +18300,9 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   };
 }
 function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
-  const stateDir2 = mkdtempSync4(join22(tmpdir5(), "tw-agent-supervisor-"));
-  const resultFile = join22(stateDir2, "result.json");
-  const agentEnvFile = join22(stateDir2, "agent-env.json");
+  const stateDir2 = mkdtempSync4(join23(tmpdir5(), "tw-agent-supervisor-"));
+  const resultFile = join23(stateDir2, "result.json");
+  const agentEnvFile = join23(stateDir2, "agent-env.json");
   try {
     const linux = process.platform === "linux";
     let executable;
@@ -18031,7 +18376,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync13(resultFile, "utf8"));
+      state = JSON.parse(readFileSync14(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -18075,7 +18420,7 @@ function observerExited(pid) {
   if (!pidAlive4(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync13(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -18083,8 +18428,8 @@ function observerExited(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join22(cwd, ".git");
-  return join22(
+  const gd = gitDir(cwd) ?? join23(cwd, ".git");
+  return join23(
     stateDirectory(gd),
     `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
   );
@@ -18196,7 +18541,7 @@ function git4(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync13("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -18211,7 +18556,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   }
   let pids;
   try {
-    pids = readdirSync4("/proc").filter((d) => /^\d+$/.test(d));
+    pids = readdirSync5("/proc").filter((d) => /^\d+$/.test(d));
   } catch {
     return out3;
   }
@@ -18219,7 +18564,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n2 = Number(pid);
     if (n2 === process.pid) continue;
     try {
-      const stat = readFileSync13(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -18227,7 +18572,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     const procLinks = [`/proc/${pid}/cwd`, `/proc/${pid}/exe`];
     try {
-      for (const fd of readdirSync4(`/proc/${pid}/fd`)) procLinks.push(`/proc/${pid}/fd/${fd}`);
+      for (const fd of readdirSync5(`/proc/${pid}/fd`)) procLinks.push(`/proc/${pid}/fd/${fd}`);
     } catch {
     }
     let holds = false;
@@ -18792,8 +19137,8 @@ raise SystemExit(0)
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "node:fs";
-import { join as join23, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "node:fs";
+import { join as join24, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
     if (linuxPython?.path) {
@@ -18848,10 +19193,10 @@ function wiringState(status, authority) {
   return authority ? "BROKEN" : "WARN";
 }
 function pinsInFile(path) {
-  if (!existsSync10(path)) return [];
+  if (!existsSync11(path)) return [];
   let src = "";
   try {
-    src = readFileSync14(path, "utf8");
+    src = readFileSync15(path, "utf8");
   } catch {
     return [];
   }
@@ -18872,13 +19217,13 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
   const warnings = [];
   for (const rel of workflowRels) {
     const path = resolve11(cwd, rel);
-    if (!existsSync10(path)) {
+    if (!existsSync11(path)) {
       broken.push(`${rel} is missing`);
       continue;
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync14(path, "utf8"));
+      doc = yaml.parse(readFileSync15(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -18991,9 +19336,9 @@ function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow =
   addWiring("codeowners", "codeowners", true);
   checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
-    ...pinsInFile(join23(cwd, ".claude", "settings.json")),
-    ...pinsInFile(join23(cwd, ".git", "hooks", "pre-commit")),
-    ...pinsInFile(join23(cwd, ".husky", "pre-commit"))
+    ...pinsInFile(join24(cwd, ".claude", "settings.json")),
+    ...pinsInFile(join24(cwd, ".git", "hooks", "pre-commit")),
+    ...pinsInFile(join24(cwd, ".husky", "pre-commit"))
   ];
   const below = pins.filter((pin) => (compareVersions(pin, TW_VERSION) ?? 0) < 0);
   const above = pins.filter((pin) => (compareVersions(TW_VERSION, pin) ?? 0) < 0);
@@ -19277,19 +19622,19 @@ function diagnose(opts = {}) {
   } else {
     const workflowDirRel = ".github/workflows";
     const workflowDir = resolve11(cwd, workflowDirRel);
-    if (!existsSync10(workflowDir)) {
+    if (!existsSync11(workflowDir)) {
       return fail("ci-verifier", `${workflowDirRel}: workflow directory does not exist`);
     }
     let entries;
     try {
-      entries = readdirSync5(workflowDir).filter((name) => /\.ya?ml$/i.test(name)).sort();
+      entries = readdirSync6(workflowDir).filter((name) => /\.ya?ml$/i.test(name)).sort();
     } catch (e) {
       return fail(
         "ci-verifier",
         `${workflowDirRel}: could not enumerate workflows (${e instanceof Error ? e.message : String(e)})`
       );
     }
-    for (const name of entries) workflowRels.push(join23(workflowDirRel, name));
+    for (const name of entries) workflowRels.push(join24(workflowDirRel, name));
   }
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
@@ -19297,12 +19642,12 @@ function diagnose(opts = {}) {
   const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
     const workflowPath = resolve11(cwd, workflowRel);
-    if (!existsSync10(workflowPath)) {
+    if (!existsSync11(workflowPath)) {
       return fail("ci-verifier", `${workflowRel}: workflow does not exist`);
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync14(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync15(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -19616,16 +19961,16 @@ var init_status2 = __esm({
 // src/cli/trace-verify.ts
 import { execFileSync as execFileSync12, spawnSync as spawnSync5 } from "node:child_process";
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync6,
+  readFileSync as readFileSync16,
+  readdirSync as readdirSync7,
   realpathSync as realpathSync9,
   rmSync as rmSync11,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { isAbsolute as isAbsolute12, join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join25, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 function unescapeStraceString(s) {
   return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
@@ -19873,16 +20218,16 @@ function materializeBase(base, cwd, dest) {
       `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
     );
   }
-  const hostModules = join24(cwd, "node_modules");
-  const tracedModules = join24(dest, "node_modules");
-  if (existsSync11(hostModules) && !existsSync11(tracedModules)) {
+  const hostModules = join25(cwd, "node_modules");
+  const tracedModules = join25(dest, "node_modules");
+  if (existsSync12(hostModules) && !existsSync12(tracedModules)) {
     symlinkSync2(resolve12(hostModules), tracedModules, "dir");
   }
 }
 function traceFiles(prefix) {
   const dir = resolve12(prefix, "..");
   const base = prefix.split(sep5).at(-1) ?? prefix;
-  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join24(dir, name)).sort();
+  return readdirSync7(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join25(dir, name)).sort();
 }
 function rewriteTraceRoot(accesses, actualRoot) {
   return accesses.map((item) => {
@@ -19897,13 +20242,13 @@ function rewriteTraceRoot(accesses, actualRoot) {
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
-    return { ...item, path: join24(TRACE_ROOT, ...rel.split("/")) };
+    return { ...item, path: join25(TRACE_ROOT, ...rel.split("/")) };
   });
 }
 function straceOnce(root, command, budget) {
-  const traceDir = mkdtempSync5(join24(tmpdir6(), "tw-trace-log-"));
+  const traceDir = mkdtempSync5(join25(tmpdir6(), "tw-trace-log-"));
   try {
-    const prefix = join24(traceDir, "trace");
+    const prefix = join25(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
       [
@@ -19932,7 +20277,7 @@ function straceOnce(root, command, budget) {
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync15(path, "utf8"), TRACE_ROOT));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync16(path, "utf8"), TRACE_ROOT));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -19947,7 +20292,7 @@ function straceOnce(root, command, budget) {
   }
 }
 function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join24(tmpdir6(), "tw-trace-base-"));
+  const root = mkdtempSync5(join25(tmpdir6(), "tw-trace-base-"));
   try {
     materializeBase(base, cwd, root);
     const { raw, accesses } = straceOnce(root, command, budget);
@@ -19957,7 +20302,7 @@ function runOneTrace(cwd, base, command, budget) {
   }
 }
 function tracerPreflight(budget = 10) {
-  const probeRoot = mkdtempSync5(join24(tmpdir6(), "tw-trace-probe-"));
+  const probeRoot = mkdtempSync5(join25(tmpdir6(), "tw-trace-probe-"));
   try {
     const { raw } = straceOnce(probeRoot, "true", Math.max(1, Math.min(budget, 10)));
     return classifyTraceRun(raw);
@@ -20163,163 +20508,6 @@ var init_trace_verify = __esm({
   }
 });
 
-// src/immutable.ts
-function isPlainData(value) {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === Array.prototype || proto === null;
-}
-function deepFreeze(value) {
-  const seen = /* @__PURE__ */ new WeakSet();
-  const walk2 = (node) => {
-    if (!isPlainData(node) || seen.has(node)) return;
-    seen.add(node);
-    Object.freeze(node);
-    for (const key2 of Reflect.ownKeys(node)) walk2(Reflect.get(node, key2));
-  };
-  walk2(value);
-  return value;
-}
-var init_immutable = __esm({
-  "src/immutable.ts"() {
-    "use strict";
-  }
-});
-
-// src/runtimes.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
-import { join as join25 } from "node:path";
-function isRecord6(x) {
-  return typeof x === "object" && x !== null && !Array.isArray(x);
-}
-function hooksBeyondTamperward(hooks) {
-  if (!isRecord6(hooks)) return hooks != null;
-  for (const entries of Object.values(hooks)) {
-    if (!Array.isArray(entries)) {
-      if (entries != null) return true;
-      continue;
-    }
-    for (const entry of entries) {
-      const hs = isRecord6(entry) ? entry.hooks : null;
-      if (!Array.isArray(hs)) {
-        if (hs != null) return true;
-        continue;
-      }
-      for (const h of hs) {
-        const cmd = isRecord6(h) ? String(h.command ?? "") : "";
-        if (!/tamperward/.test(cmd)) return true;
-      }
-    }
-  }
-  return false;
-}
-function claudeSettingsBeyondTamperward(cwd) {
-  const path = join25(cwd, ".claude", "settings.json");
-  let raw;
-  try {
-    if (!existsSync12(path)) return false;
-    raw = readFileSync16(path, "utf8");
-  } catch {
-    return false;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return raw.trim().length > 0;
-  }
-  if (!isRecord6(parsed)) return raw.trim().length > 0;
-  for (const [key2, value] of Object.entries(parsed)) {
-    if (key2 === "disableAllHooks") continue;
-    if (key2 === "hooks") {
-      if (hooksBeyondTamperward(value)) return true;
-      continue;
-    }
-    return true;
-  }
-  return false;
-}
-function detectRuntimes(cwd) {
-  const found = [];
-  for (const rt of KNOWN_RUNTIMES) {
-    const marker = rt.markers.find((m) => {
-      try {
-        return existsSync12(join25(cwd, m));
-      } catch {
-        return false;
-      }
-    });
-    const matchedMarker = marker ?? rt.detectExtra?.(cwd) ?? void 0;
-    if (matchedMarker !== void 0) found.push({ ...rt, matchedMarker });
-  }
-  return found;
-}
-function hasInLoopRuntime(detected) {
-  return detected.some((r) => r.steering === "in-loop");
-}
-function detectionHeadline(detected) {
-  if (detected.length === 0) {
-    return "No agent runtime detected. Wiring Claude Code in-loop steering plus the agent-neutral layers (pre-commit + CI) that protect any agent or human.";
-  }
-  if (detected.length === 1) {
-    const r = detected[0];
-    return `Detected ${r.label} \u2014 ${r.note}`;
-  }
-  const parts = detected.map((r) => `${r.label} (${r.steering === "in-loop" ? "in-loop" : "neutral layers"})`);
-  return `Detected ${detected.length} agent runtimes: ${parts.join(", ")}.`;
-}
-function neutralOnlyCaveat(detected) {
-  const neutral = detected.filter((r) => r.steering === "neutral");
-  if (neutral.length === 0) return null;
-  const names = neutral.map((r) => r.label).join(", ");
-  const claudeAlso = hasInLoopRuntime(detected);
-  const lead = claudeAlso ? `In-loop steering (deny-before-execute) ships for Claude Code only today: Claude Code here gets it, but on ${names} your live protection is ` : `In-loop steering (deny-before-execute) ships for Claude Code only today, so on ${names} your live protection is `;
-  const tail = claudeAlso ? "" : " The Claude hook wiring is still written and is inert unless Claude Code runs in this repository.";
-  return `${lead}the agent-neutral layers: pre-commit and CI.${tail}`;
-}
-var KNOWN_RUNTIMES;
-var init_runtimes = __esm({
-  "src/runtimes.ts"() {
-    "use strict";
-    init_immutable();
-    KNOWN_RUNTIMES = deepFreeze([
-      {
-        id: "claude-code",
-        // Markers are Claude Code files `init` never writes, so detection never mistakes
-        // TamperWard's own generated `.claude/settings.json` for evidence a human runs
-        // Claude here (#526). `detectExtra` looks at that generated file's CONTENT for
-        // real use (configuration beyond the two hooks init merges in).
-        label: "Claude Code",
-        markers: ["CLAUDE.md", ".claude/settings.local.json", ".claude/commands", ".claude/agents"],
-        detectExtra: (cwd) => claudeSettingsBeyondTamperward(cwd) ? ".claude/settings.json" : null,
-        steering: "in-loop",
-        note: "native in-loop steering (PreToolUse deny + Stop sweep) plus the agent-neutral layers."
-      },
-      {
-        id: "cursor",
-        label: "Cursor",
-        markers: [".cursor", ".cursorrules"],
-        steering: "neutral",
-        note: "agent-neutral layers (pre-commit + CI) today; no in-loop adapter ships for Cursor."
-      },
-      {
-        id: "copilot",
-        label: "GitHub Copilot",
-        markers: [".github/copilot-instructions.md", ".github/copilot"],
-        steering: "neutral",
-        note: "agent-neutral layers (pre-commit + CI) today; the experimental Copilot adapters are not qualified for in-loop steering (see `tamperward runtime verify`)."
-      },
-      {
-        id: "codex",
-        label: "an AGENTS.md-aware agent (e.g. Codex)",
-        markers: [".codex", "AGENTS.md"],
-        steering: "neutral",
-        note: "agent-neutral layers (pre-commit + CI) today; the experimental Codex adapter is not qualified for in-loop steering (see `tamperward runtime verify`)."
-      }
-    ]);
-  }
-});
-
 // src/adapters/contract.ts
 function immutableRuntimeCapabilities(caps) {
   return Object.freeze({
@@ -23231,6 +23419,62 @@ var init_onboard = __esm({
   }
 });
 
+// src/cli/runtime-hook.ts
+import { readFileSync as readFileSync20 } from "node:fs";
+function isRuntimeHookAgent(agent) {
+  return RUNTIME_HOOK_AGENTS.some((known) => known === agent);
+}
+function runRuntimeHookFromRaw(kind, agent, raw, cwd = process.cwd()) {
+  if (!isRuntimeHookAgent(agent)) {
+    return { exitCode: 2, stdout: "", stderr: `tamperward: unsupported ${kind === "Stop" ? "sweep" : "hook"} agent "${agent}" (claude, ${RUNTIME_HOOK_AGENTS.join(", ")})
+` };
+  }
+  const adapter = adapterFor(agent);
+  if (!adapter) {
+    return { exitCode: 2, stdout: "", stderr: `tamperward: no adapter is registered for "${agent}"
+` };
+  }
+  const phase = kind === "Stop" ? "end-of-turn" : "pre-action";
+  try {
+    const r = adapter.decide(raw, phase, cwd);
+    return { exitCode: 0, stdout: r.wire ?? "", stderr: "" };
+  } catch (e) {
+    const detail = e instanceof Error ? e.message : String(e);
+    const wire = adapter.denyPayload([steeringUnavailableFinding(detail)], phase);
+    return { exitCode: 0, stdout: wire, stderr: "" };
+  }
+}
+function runRuntimeHook(kind, agent) {
+  let raw;
+  try {
+    raw = readFileSync20(0, "utf8");
+  } catch (e) {
+    raw = "";
+    const r2 = runRuntimeHookFromRaw(kind, agent, "", process.cwd());
+    if (r2.exitCode !== 0) {
+      process.stderr.write(r2.stderr);
+      return r2.exitCode;
+    }
+    const adapter = adapterFor(agent);
+    const detail = `cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`;
+    process.stdout.write(adapter ? adapter.denyPayload([steeringUnavailableFinding(detail)], kind === "Stop" ? "end-of-turn" : "pre-action") : "");
+    return 0;
+  }
+  const r = runRuntimeHookFromRaw(kind, agent, raw, process.cwd());
+  if (r.stdout) process.stdout.write(r.stdout);
+  if (r.stderr) process.stderr.write(r.stderr);
+  return r.exitCode;
+}
+var RUNTIME_HOOK_AGENTS;
+var init_runtime_hook = __esm({
+  "src/cli/runtime-hook.ts"() {
+    "use strict";
+    init_registry();
+    init_contract();
+    RUNTIME_HOOK_AGENTS = Object.freeze(["codex", "copilot"]);
+  }
+});
+
 // src/research/adapter.ts
 import { isAbsolute as isAbsolute17, resolve as resolve17 } from "node:path";
 function taskEnv(task) {
@@ -23372,7 +23616,7 @@ var init_capture = __esm({
 
 // src/research/manifest.ts
 import { createHash as createHash16 } from "node:crypto";
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { dirname as dirname14, resolve as resolve18 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
@@ -23406,7 +23650,7 @@ function readManifest(path) {
   const abs = resolve18(path);
   let bytes;
   try {
-    bytes = readFileSync20(abs);
+    bytes = readFileSync21(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -23825,7 +24069,7 @@ var init_record = __esm({
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync15, linkSync, mkdirSync as mkdirSync12, openSync as openSync4, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync11, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync15, linkSync, mkdirSync as mkdirSync12, openSync as openSync4, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync11, writeSync as writeSync2 } from "node:fs";
 import { hostname } from "node:os";
 import { join as join29, resolve as resolve19 } from "node:path";
 function git7(args, cwd) {
@@ -23839,7 +24083,7 @@ function researchLockPath(ledger) {
 }
 function readLockOwner(path) {
   try {
-    const parsed = JSON.parse(readFileSync21(path, "utf8"));
+    const parsed = JSON.parse(readFileSync22(path, "utf8"));
     if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
     return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
@@ -23924,7 +24168,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
       if (released) return;
       released = true;
       try {
-        if (readFileSync21(path, "utf8") === text) unlinkSync(path);
+        if (readFileSync22(path, "utf8") === text) unlinkSync(path);
       } catch {
       }
     }
@@ -23933,7 +24177,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync21(path, "utf8"));
+    raw = JSON.parse(readFileSync22(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -24355,7 +24599,7 @@ var init_run2 = __esm({
 });
 
 // src/research/ledger-files.ts
-import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync3, lstatSync as lstatSync12, openSync as openSync5, readFileSync as readFileSync22, readdirSync as readdirSync7, realpathSync as realpathSync12 } from "node:fs";
+import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync3, lstatSync as lstatSync12, openSync as openSync5, readFileSync as readFileSync23, readdirSync as readdirSync8, realpathSync as realpathSync12 } from "node:fs";
 import { join as join30, resolve as resolve20 } from "node:path";
 function lstatOrNull(path) {
   try {
@@ -24398,7 +24642,7 @@ function readRegularFile(path, realPairsDir, name) {
     if (!opened.isFile() || !sameInode || opened.nlink !== 1) {
       throw new ResearchError(`ledger record ${path} changed between listing and reading; refusing to read it`);
     }
-    return readFileSync22(fd);
+    return readFileSync23(fd);
   } finally {
     closeSync6(fd);
   }
@@ -24414,7 +24658,7 @@ function readPairFiles(ledger) {
   const realPairsDir = realpathSync12.native(pairsDir);
   let names;
   try {
-    names = readdirSync7(pairsDir).filter((n2) => n2.endsWith(".json")).sort();
+    names = readdirSync8(pairsDir).filter((n2) => n2.endsWith(".json")).sort();
   } catch (e) {
     throw new ResearchError(`cannot read ledger ${pairsDir}: ${errorMessage(e)}`);
   }
@@ -24571,7 +24815,7 @@ var init_summarize = __esm({
 
 // src/research/init.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync24, writeFileSync as writeFileSync12 } from "node:fs";
 import { basename as basename6, dirname as dirname15, resolve as resolve21 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
@@ -24623,7 +24867,7 @@ function runResearchInit(opts) {
   }
 }
 function requireHash(path) {
-  return createHash17("sha256").update(readFileSync23(path)).digest("hex");
+  return createHash17("sha256").update(readFileSync24(path)).digest("hex");
 }
 var init_init2 = __esm({
   "src/research/init.ts"() {
@@ -24691,7 +24935,7 @@ var init_report2 = __esm({
 import { createHash as createHash18 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "node:fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname16, resolve as resolve22 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
@@ -24797,7 +25041,7 @@ function jsonBytes(value) {
 function validateResearchBundle(path) {
   let files;
   try {
-    files = parseTar(gunzipSync(readFileSync24(resolve22(path))));
+    files = parseTar(gunzipSync(readFileSync25(resolve22(path))));
   } catch (e) {
     throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -24867,7 +25111,7 @@ function createResearchBundle(opts) {
   const { records, entries } = packagedRecords(ledger);
   const summary = summarizeRecords(records);
   if (opts.manifest) {
-    const manifest = readFileSync24(resolve22(opts.manifest));
+    const manifest = readFileSync25(resolve22(opts.manifest));
     const sha3 = createHash18("sha256").update(manifest).digest("hex");
     if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
     entries.push({ name: "manifest.json", bytes: manifest });
@@ -25038,7 +25282,7 @@ var init_research = __esm({
 });
 
 // src/cli/receipt.ts
-import { appendFileSync as appendFileSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync14 } from "node:fs";
+import { appendFileSync as appendFileSync3, readFileSync as readFileSync26, writeFileSync as writeFileSync14 } from "node:fs";
 function parseReceipt(args) {
   const [sub, ...rest] = args;
   const exportOpts = {};
@@ -25165,7 +25409,7 @@ function ciAdjudicate(cwd, opts) {
   if (opts.ciResult !== void 0) {
     let doc;
     try {
-      doc = JSON.parse(readFileSync25(opts.ciResult, "utf8"));
+      doc = JSON.parse(readFileSync26(opts.ciResult, "utf8"));
     } catch (e) {
       return {
         ci: { verdict: "CANNOT_VERIFY", binding, binding_error: `unreadable CI verify result: ${e instanceof Error ? e.message : String(e)}` },
@@ -25311,7 +25555,7 @@ function loadClaimedReceipt(path) {
   }
   let raw;
   try {
-    raw = readFileSync25(path, "utf8");
+    raw = readFileSync26(path, "utf8");
   } catch (e) {
     return { disposition: "MALFORMED", detail: `receipt file could not be read (${e instanceof Error ? e.message : String(e)})` };
   }
@@ -25435,13 +25679,9 @@ function parseAllow(args) {
   return o;
 }
 function runAgentCommand(kind, args) {
-  const agent = args[0];
-  if (agent !== "claude") {
-    process.stderr.write(`tamperward: unsupported ${kind} agent "${agent ?? ""}" (only "claude" so far)
-`);
-    return 2;
-  }
-  return kind === "hook" ? runHookClaude() : runSweepClaude();
+  const agent = args[0] ?? "";
+  if (agent === "claude") return kind === "hook" ? runHookClaude() : runSweepClaude();
+  return runRuntimeHook(kind === "hook" ? "PreToolUse" : "Stop", agent);
 }
 function parseInit(args) {
   const o = {};
@@ -26161,6 +26401,7 @@ var init_main = __esm({
     init_run();
     init_watch();
     init_onboard();
+    init_runtime_hook();
     init_research();
     init_runtime();
     init_receipt();
@@ -26172,7 +26413,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -26185,7 +26426,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync26(0, "utf8");
+      raw = readFileSync27(0, "utf8");
     } catch {
       raw = null;
     }