cli-watermark

Optimization: Heavy content lives in references/. Load on demand.

Language rule: Skill instructions are written in English. When generating user-facing output, detect the project's primary language (from README, comments, docs, commit messages) and produce the output in that language. If the project is bilingual, ask the user which language to use before proceeding.

SECURITY: This skill generates PRIVATE artifacts. NEVER commit watermark secrets, codebooks, or proof files to a public repo. All secrets go in {project}/.watermark/ (gitignored) or in a separate private repo.

CLI Watermark — Steganographic Code Fingerprinting

"Cartographers insert fictional towns to catch map plagiarists. We insert fictional decisions to catch code plagiarists."

Rules for the Watermarker

1. L8 first, always. Generate the timestamped commitment BEFORE applying any code-level layer. Anteriority is your strongest asset — if you apply L4 without L8, you have a clever trick but no legal proof.
2. Never publish secrets. secret.env and codebook.json are PRIVATE. Only PROOF.md, vectors.json, and .ots files can be shared.
3. Derive, don't invent. Every watermark value (constant, canary, ordering) must be deterministically derivable from the master secret. Ad-hoc choices are indefensible — "I just picked that number" loses in court.
4. Watermark the behavior, not the syntax. After 2 rewrites + clean code, only L4/L5/L7/L8 survive. Invest there first; L1/L2/L3 are supplementary signal.
5. Defense in depth. No single layer is proof. The legal argument is combinatorial: "What is the probability that N independent signals all match by coincidence?"
6. Keep the code clean. Watermarks must be invisible to code review. If a reviewer can spot a canary, an adversary can remove it. The best watermarks look like normal engineering decisions.
7. Re-watermark on release. Constants drift, APIs evolve, test vectors need updating. Each release = new L8 commitment + refresh of degraded layers.
8. Always have a Plan D². Assume every layer will be attacked. Know in advance which layers survive which attacks, and what your minimum viable proof is when half the layers are gone.
9. Protect to defend, never to trap. Watermarks prove authorship — they don't sabotage the adversary's code, don't phone home, don't create legal risk for you. Ethical watermarking = forensic evidence, not DRM.
10. Anticipate the adversary's evolution. The threat is not static. Today it's a single AI rewrite; tomorrow it's a specialized de-watermarking tool. Design for the adversary 2 years from now, not today's.