tamperward 2.41.0 → 2.42.0

package/dist/cli/index.js

@@ -11328,7 +11328,7 @@ var init_signoff = __esm({
 function machineOutput(payload) {
   return { ...payload, schema_version: MACHINE_SCHEMA_VERSION };
 }
-var MACHINE_SCHEMA_VERSION, VERIFY_VERDICTS, RUN_VERDICTS;
+var MACHINE_SCHEMA_VERSION, VERIFY_VERDICTS, VERIFY_CANNOT_VERIFY_REASONS, RUN_VERDICTS;
 var init_machine_output = __esm({
   "src/machine-output.ts"() {
     "use strict";
@@ -11340,6 +11340,23 @@ var init_machine_output = __esm({
       "BUDGET_EXCEEDED",
       "CANNOT_VERIFY"
     ];
+    VERIFY_CANNOT_VERIFY_REASONS = [
+      "INVALID_ARGUMENTS",
+      "POLICY_ERROR",
+      "BASE_NOT_ANCESTOR",
+      "NO_SUITE_COMMAND",
+      "VERIFIER_BACKEND_UNAVAILABLE",
+      "LOCAL_VERIFIER_UNSUPPORTED_PLATFORM",
+      "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
+      "BASE_UNRESOLVABLE",
+      "DEPENDENCY_DRIFT",
+      "MATERIALIZATION_FAILED",
+      "VERIFIER_BACKEND_RUNTIME_FAILURE",
+      "VERIFIER_RESOURCE_EXHAUSTED",
+      "WORKTREE_CHANGED",
+      "PRISTINE_INTEGRITY_CHANGED",
+      "PATH_CASE_COLLISION"
+    ];
     RUN_VERDICTS = [
       "VERIFIED",
       "AGENT_TIMEOUT",
@@ -25281,6 +25298,41 @@ var init_research = __esm({
   }
 });
 
+// src/cli/render/verify-github.ts
+function safeDetail(value) {
+  const normalized = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").replace(/\s+/g, " ").trim();
+  if (normalized.length <= DETAIL_LIMIT) return normalized;
+  return normalized.slice(0, DETAIL_LIMIT - 1).trimEnd() + "\u2026";
+}
+function workflowData(value) {
+  return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+function verifyWorkflowCommand(verdict2, exitCode, details = {}, env = process.env) {
+  if (env.GITHUB_ACTIONS !== "true" || verdict2 === "VERIFIED") return void 0;
+  if (verdict2 === "MASKED_FAILURE" && exitCode === 0) {
+    return "::warning title=TamperWard verify::MASKED_FAILURE: a trusted out-of-band sign-off was accepted; this is not a VERIFIED result. Review the verification summary.";
+  }
+  const parts = [ERROR_MESSAGES[verdict2]];
+  if (verdict2 === "CANNOT_VERIFY") {
+    if (details.reason) parts.push(`Reason: ${details.reason}`);
+    if (details.detail) parts.push(`Detail: ${safeDetail(details.detail)}`);
+  }
+  return `::error title=TamperWard verify::${workflowData(parts.join("\n"))}`;
+}
+var ERROR_MESSAGES, DETAIL_LIMIT;
+var init_verify_github = __esm({
+  "src/cli/render/verify-github.ts"() {
+    "use strict";
+    ERROR_MESSAGES = {
+      MASKED_FAILURE: "MASKED_FAILURE: the visible suite passed, but the suite restored from the trusted base failed. Review the test changes and verification summary.",
+      SUITE_RED: "SUITE_RED: the visible suite failed. Fix the failing change before merging.",
+      BUDGET_EXCEEDED: "BUDGET_EXCEEDED: verification exceeded its configured budget; CI could not establish a clean result.",
+      CANNOT_VERIFY: "CANNOT_VERIFY: CI could not establish a trusted verification result."
+    };
+    DETAIL_LIMIT = 320;
+  }
+});
+
 // src/cli/receipt.ts
 import { appendFileSync as appendFileSync3, readFileSync as readFileSync26, writeFileSync as writeFileSync14 } from "node:fs";
 function parseReceipt(args) {
@@ -25413,12 +25465,17 @@ function ciAdjudicate(cwd, opts) {
     } catch (e) {
       return {
         ci: { verdict: "CANNOT_VERIFY", binding, binding_error: `unreadable CI verify result: ${e instanceof Error ? e.message : String(e)}` },
-        exit: 2
+        exit: 2,
+        annotation: { detail: "The CI verify result could not be read. Check the verify step output and artifact path." }
       };
     }
     const check2 = readCiVerify(doc, binding, cwd, opts);
     if (check2.reason !== void 0) {
-      return { ci: { verdict: "CANNOT_VERIFY", binding, binding_error: check2.reason }, exit: 2 };
+      return {
+        ci: { verdict: "CANNOT_VERIFY", binding, binding_error: check2.reason },
+        exit: 2,
+        annotation: { detail: check2.reason }
+      };
     }
     const oob = oobFromEnv();
     const oobHead = oobHeadFromEnv();
@@ -25433,7 +25490,8 @@ function ciAdjudicate(cwd, opts) {
         ...check2.adjudicated_tree !== void 0 ? { adjudicated_tree: check2.adjudicated_tree } : {},
         ...bindingError ? { binding_error: bindingError } : {}
       },
-      exit: verdictExit(check2.verdict, signedOff)
+      exit: verdictExit(check2.verdict, signedOff),
+      annotation: { reason: check2.verifierReason, detail: check2.detail }
     };
   }
   const impl = opts.runVerifyImpl ?? runVerify;
@@ -25458,7 +25516,8 @@ function ciAdjudicate(cwd, opts) {
       ...binding ? { adjudicated_tree: binding.tree } : {},
       ...bindingError ? { binding_error: bindingError } : {}
     },
-    exit
+    exit,
+    annotation: { reason: summary?.reason, detail: summary?.detail }
   };
 }
 function isCommitId(v) {
@@ -25492,7 +25551,9 @@ function readCiVerify(doc, binding, cwd, opts) {
     }
   }
   const adjudicated_tree = typeof d.adjudicated_tree === "string" && d.adjudicated_tree.length > 0 ? d.adjudicated_tree : void 0;
-  return { verdict: d.verdict, adjudicated_tree };
+  const verifierReason = isOneOf(VERIFY_CANNOT_VERIFY_REASONS, d.reason) ? d.reason : void 0;
+  const detail = typeof d.detail === "string" ? d.detail : void 0;
+  return { verdict: d.verdict, verifierReason, detail, adjudicated_tree };
 }
 function isRecordObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -25571,7 +25632,7 @@ function runReceiptReconcile(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const guard = needRepo(cwd, "reconcile");
   if (guard !== null) return guard;
-  const { ci, exit } = ciAdjudicate(cwd, opts);
+  const { ci, exit, annotation: annotationDetails } = ciAdjudicate(cwd, opts);
   const claimed = loadClaimedReceipt(opts.receipt);
   const r = reconcile(ci, claimed);
   const claimedReceipt = claimed.disposition === "PRESENT" ? claimed.receipt : null;
@@ -25581,6 +25642,16 @@ function runReceiptReconcile(opts = {}) {
     process.stdout.write(renderReconcile(r, claimedReceipt, ci.binding, ci.adjudicated_tree, colourEnabled(process.env, process.stdout)));
   }
   writeJobSummary(r, claimedReceipt, ci.binding, ci.adjudicated_tree);
+  if (!opts.json) {
+    const annotation = verifyWorkflowCommand(ci.verdict, exit, annotationDetails);
+    if (annotation) process.stdout.write(`${annotation}
+`);
+  }
+  if (!opts.json) {
+    const annotation = verifyWorkflowCommand(ci.verdict, exit);
+    if (annotation) process.stdout.write(`${annotation}
+`);
+  }
   return exit;
 }
 function writeJobSummary(r, receipt, ciBinding, adjudicatedTree) {
@@ -25621,6 +25692,7 @@ var init_receipt = __esm({
     init_verify();
     init_signoff();
     init_text();
+    init_verify_github();
     init_status();
     RECEIPT_SUBCOMMANDS = ["export", "reconcile"];
     AGREEMENT_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.41.0",
+  "version": "2.42.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",