@holmes-lab/holmes-kit 0.1.0

package/dist/holmes/governance/constitution.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARTICLES = void 0;
+exports.verifyConstitution = verifyConstitution;
+const basis_1 = require("../mcp/basis");
+const spec_types_1 = require("../spec/spec-types");
+const rtm_check_1 = require("../rtm/rtm-check");
+const validator_1 = require("../spec/validator");
+exports.ARTICLES = {
+    'ART-7': '열린 치명 발견은 미완이다 — severity critical 이 open 인 한 완료가 없다 (important/minor 는 review_status 보고에만 남는다: 기록을 피하게 만드는 차단은 원장을 죽인다)',
+    'ART-6': '판단은 현재 빌드에서 내려야 한다 — 설치된 코드와 갈라진 서버에서 봉인된 리뷰 결과는 이미 사라진 세계를 기술한다',
+    'ART-1': 'No Spec, No Code — source may only change under an approved A-SPEC (+ approved T-SPEC, test-first)',
+    'ART-2': 'RTM integrity — the governed spec graph must stay free of orphans, cycles, dangling refs, duplicates',
+    'ART-3': 'Spec validity — every governed spec satisfies its type rules, including honest 4-quadrant GWT coverage',
+    'ART-4': 'Coverage honesty — declared coverage must be backed by real anchored test cases, not prose',
+    'ART-5': 'Approval is out-of-band — a spec cannot self-approve; governance config cannot be self-written',
+};
+function verifyConstitution(ctx) {
+    const governed = (0, spec_types_1.filterGoverned)(ctx.specs);
+    // @implements A-SPEC-191 (§4b) — the early return may NOT swallow recorded findings: a project
+    // that reviews before authoring specs (measured: adopt flow, reverse_scan first) held an open
+    // critical while Stop passed, because ART-7 was accidentally coupled to spec-graph existence.
+    if (governed.length === 0 && (ctx.findings ?? []).length === 0)
+        return []; // rows 가 아니라 원본 기준 — 오염 행만 있는 원장도 감식 대상이다
+    const resolve = (id) => ctx.specs.find((s) => s.id === id) ?? null;
+    const v = [];
+    // ART-2: RTM integrity
+    for (const issue of (0, rtm_check_1.rtmCheck)(governed)) {
+        v.push({ article: 'ART-2', detail: `RTM ${issue.kind} [${issue.id}]: ${issue.detail}` });
+    }
+    // ART-3: spec validity (type rules + 4-quadrant GWT via validateSpec)
+    for (const s of governed) {
+        const r = (0, validator_1.validateSpec)(s, resolve);
+        if (!r.ok) {
+            for (const f of r.findings) {
+                if (f.level === 'error')
+                    v.push({ article: 'ART-3', detail: `spec ${s.id}: ${f.code} — ${f.message}` });
+            }
+        }
+    }
+    // ART-4: coverage honesty (only when evidence was supplied)
+    if (ctx.testCasesByAspec || ctx.executedByAspec) {
+        // Evidence aggregates over the SPEC FAMILY: a T-SPEC on A-SPEC-100 is satisfied by tests anchored
+        // to A-SPEC-100 OR any slice sub-id A-SPEC-100.N (exact matching falsely blocked legitimate
+        // sub-slice anchors — finding MED-6).
+        const familySum = (m, aspec) => {
+            if (!m)
+                return undefined;
+            const hits = Object.entries(m).filter(([id]) => id === aspec || id.startsWith(`${aspec}.`));
+            return hits.length > 0 ? hits.reduce((s, [, n]) => s + n, 0) : undefined;
+        };
+        for (const t of governed) {
+            if (t.type !== 'T-SPEC' || t.status !== 'approved')
+                continue;
+            const aspec = t.dependsOn[0];
+            if (!aspec)
+                continue;
+            // BASELINE (always enforced): the syntactic lower bound. Evidence can never waive it.
+            if (ctx.testCasesByAspec && (familySum(ctx.testCasesByAspec, aspec) ?? 0) === 0) {
+                v.push({ article: 'ART-4', detail: `${t.id}: declared coverage but NO anchored test file with real cases for ${aspec} (anchor the covering tests with the @implements marker for ${aspec})` });
+                continue;
+            }
+            // ADDITIVE: a recorded run that covered this A-SPEC and executed nothing is an extra violation.
+            const executed = familySum(ctx.executedByAspec, aspec);
+            if (executed === 0) {
+                v.push({ article: 'ART-4', detail: `${t.id}: a recorded test run covered ${aspec} but EXECUTED no cases` });
+            }
+        }
+    }
+    // @implements A-SPEC-160
+    // ART-6: a judgement sealed while the answering server ran code that no longer matched what was
+    // installed. Measured 2026-08-08: such a server reported `impactedSpecs: []` for a commit touching
+    // 39 specs, so anything recorded against it describes a world that was already gone.
+    //
+    // STRICTLY ADDITIVE. Only a PRESENT marker offends: a finding with no basis, or one whose basis
+    // shows agreement, is untouched. Treating absence as a violation would block every project holding
+    // a ledger written before REQ-157 — the bricking REQ-146 measured. Resolved findings are past
+    // judgements already dealt with.
+    // Defence in depth: the ledger is JSON lines anything may have written, and the supplier may
+    // not be FindingsLedger.list(). A row that is not an object with a string id cannot be judged —
+    // and must not be able to crash the gate into fail-open (round-3: a literal `null` line did).
+    const rows = (ctx.findings ?? []).filter((f) => !!f && typeof f === 'object' && typeof f.id === 'string');
+    for (const f of rows) {
+        if (f.status !== 'open')
+            continue;
+        if (!(0, basis_1.basisDiverged)(f.basis))
+            continue;
+        v.push({ article: 'ART-6', detail: `finding ${f.id}: 기록 시점에 서버가 설치된 빌드와 갈라져 있었습니다 (basis ${f.basis}) — 현재 빌드로 다시 리뷰하고 기록하세요` });
+    }
+    // @implements A-SPEC-191
+    // ART-7: an open critical finding means the work is NOT done. The severity was always recorded
+    // and review_status even computed `blocked` from it — but nothing enforced it, so a reviewer's
+    // "critical — must not ship" changed nothing about the next turn. Same additive shape as ART-6:
+    // only the PRESENT marker (severity string 'critical') offends; absent/unknown severities and
+    // resolved findings stay silent, so pre-REQ-157 ledgers cannot brick (the A-SPEC-146 trap).
+    //
+    // Judged on the LAST record per id: the ledger is append-only, so resolution IS a later line with
+    // the same id. Judging every line would make one recorded critical a violation forever — a trap,
+    // not a tooth. (ART-6 stays line-based above: a seal made in a diverged world is a past fact no
+    // later line can un-happen.)
+    const latest = new Map();
+    const lastOpenCritical = new Map();
+    for (const f of rows) {
+        latest.set(f.id, f); // supply order = record order
+        // LATEST open severity, not "ever critical" (r6): a canonically-closed critical must not be
+        // resurrected by a later MINOR re-finding's diverged resolve.
+        if (f.status === 'open')
+            lastOpenCritical.set(f.id, f.severity === 'critical');
+    }
+    for (const f of latest.values()) {
+        // typeof guard (round-2): the ledger is JSON lines anything may have written — a non-string
+        // summary crashed this very function, and a crash in verifyConstitution is a fail-open Stop
+        // (the CLI catches and exits 0). The gate must never be crashable by its own evidence.
+        const gist = typeof f.summary === 'string' && f.summary ? ` (${f.summary.slice(0, 80)})` : '';
+        if (f.status === 'open' && f.severity === 'critical') {
+            v.push({ article: 'ART-7', detail: `finding ${f.id}${gist}: 열린 치명 발견 — 결함을 고치고 재리뷰로 resolved 를 기록하기 전까지 이 작업은 완료될 수 없습니다` });
+            continue;
+        }
+        // @implements A-SPEC-191 (§4c) — the judgement class ART-6 exists to reject ("sealed in an
+        // already-gone world") was fully TRUSTED when it said "fixed": a resolved line stamped on a
+        // diverged server lifted the gate unconditionally (measured). A diverged resolution of a
+        // critical does not lift; re-verify on the current build and record again. Absent basis stays
+        // trusted (pre-REQ-157 ledgers — the A-SPEC-146 trap).
+        if (f.status === 'resolved' && lastOpenCritical.get(f.id) === true && (0, basis_1.basisDiverged)(f.basis)) {
+            v.push({ article: 'ART-7', detail: `finding ${f.id}${gist}: 해소가 갈라진 빌드에서 봉인되었습니다 (basis ${f.basis}) — 현재 빌드로 재검증해 다시 기록하십시오` });
+        }
+    }
+    return v;
+}

package/dist/holmes/governance/identity.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvIdentityProvider = void 0;
+/**
+ * Reads the claim from the process environment — the same out-of-band discipline `HOLMES_APPROVAL`
+ * established, and for the same reason: a session cannot set its own environment, so it cannot claim
+ * its own role. A role carried in the tool payload would be self-assertion, which is precisely what
+ * ART-5 forbids on the spec axis.
+ */
+class EnvIdentityProvider {
+    env;
+    constructor(env = process.env) {
+        this.env = env;
+    }
+    current() {
+        const raw = this.env.HOLMES_ROLE;
+        // A blank value is absence, not a role named "". Treating whitespace as a role would create a
+        // principal nobody registered and that no policy can grant anything to.
+        const role = typeof raw === 'string' && raw.trim() !== '' ? raw.trim() : undefined;
+        let actor;
+        try {
+            const approval = this.env.HOLMES_APPROVAL ? JSON.parse(this.env.HOLMES_APPROVAL) : undefined;
+            if (approval && typeof approval.actor === 'string')
+                actor = approval.actor;
+        }
+        catch { /* a malformed approval is no actor, never a throw */ }
+        return { actor, role, proven: false };
+    }
+}
+exports.EnvIdentityProvider = EnvIdentityProvider;

package/dist/holmes/governance/ledger-lock.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACQUIRE_MS = exports.STALE_MS = exports.LedgerLockError = void 0;
+exports.lockDirFor = lockDirFor;
+exports.withLedgerLock = withLedgerLock;
+// @implements A-SPEC-141
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Cross-process mutual exclusion for one ledger file.
+ *
+ * WHY this exists, measured rather than assumed. `ProvenanceChain.append()` was read-then-append and
+ * the single-use approval gate was check-then-act, so two agents running at once could both observe
+ * "nonce not consumed" and both proceed. Two real processes synchronized on a file barrier, 20
+ * trials: the single-use approval was spent TWICE 20/20 times, and the tamper-evident chain reported
+ * `ok:false` 17/20 times — reporting tampering that never happened. Sequential behaviour was, and
+ * remains, correct; the failure only appears when the critical sections overlap, which is precisely
+ * the case a harness with "agentic" in its name promises to support.
+ *
+ * `fs.mkdirSync` is the primitive: atomic on every platform this ships to, `EEXIST` when held, and
+ * with none of the file-vs-`O_EXCL` subtleties. A DIRECTORY rather than a lock FILE because a
+ * zero-byte file is what a cleanup script or `git clean` deletes mid-hold, while a directory holds
+ * its own metadata and cannot be removed non-empty by accident.
+ *
+ * LIMIT, stated rather than implied: single host, single filesystem with atomic `mkdir`. Networked
+ * filesystems (NFS, shared volumes) are out of scope and this does not pretend to cover them.
+ */
+/** Thrown when exclusion cannot be obtained within the acquire budget. Distinguishable on purpose. */
+class LedgerLockError extends Error {
+    // @implements A-SPEC-189 §7 (round 10) — a lock we could not take is a REFUSAL with a next step
+    // ('another process holds it; retry'), not a crash. The MCP boundary shapes refusals by this
+    // marker, so this one arrives as {ok:false, reason} instead of a raw -32603.
+    holmesRefusal = true;
+}
+exports.LedgerLockError = LedgerLockError;
+/**
+ * A hold older than this is treated as abandoned and broken.
+ *
+ * 30 seconds against a critical section that reads a few hundred bytes and appends one line —
+ * microseconds of real work, so this is roughly five orders of magnitude of headroom and cannot fire
+ * on a live holder that is merely slow. The number exists because a `kill -9`'d agent must not wedge
+ * every other agent forever.
+ */
+exports.STALE_MS = 30_000;
+/** Default budget for waiting on someone else's hold before failing. */
+exports.ACQUIRE_MS = 5_000;
+function lockDirFor(ledgerFile) {
+    return `${ledgerFile}.lock`;
+}
+/**
+ * Sleep without burning a core. Every caller of the ledger is synchronous (hooks and CLI entry
+ * points are short-lived processes), so a synchronous wait is the honest shape; `Atomics.wait` on a
+ * throwaway buffer parks the thread instead of spinning on `Date.now()`.
+ */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readHolder(dir) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(dir, 'holder.json'), 'utf8'));
+    }
+    catch {
+        return {}; // an unreadable holder file is not evidence of anything; age still decides staleness
+    }
+}
+/** Age of the hold, from the lock directory's mtime. `null` when it cannot be read (it may be gone). */
+function holdAgeMs(dir) {
+    try {
+        return Date.now() - fs.statSync(dir).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function release(dir) {
+    // Remove recursively: a body that wrote a stray file inside the hold must not turn release into a
+    // crash. `force` also makes a double-release (or a hold already broken by someone else) a no-op.
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch { /* release is best-effort by design */ }
+}
+/**
+ * Run `fn` while holding exclusion for `ledgerFile`.
+ *
+ * The hold is released in `finally`, including when `fn` throws, and a release problem never masks
+ * `fn`'s own error — the body's failure is the one the caller needs to see.
+ */
+function withLedgerLock(ledgerFile, fn, opts) {
+    const dir = lockDirFor(ledgerFile);
+    const acquireMs = opts?.acquireMs ?? exports.ACQUIRE_MS;
+    const staleMs = opts?.staleMs ?? exports.STALE_MS;
+    const deadline = Date.now() + acquireMs;
+    for (;;) {
+        try {
+            fs.mkdirSync(path.dirname(dir), { recursive: true });
+            fs.mkdirSync(dir); // ATOMIC: this is the whole mutual-exclusion primitive
+            try {
+                fs.writeFileSync(path.join(dir, 'holder.json'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }), 'utf8');
+            }
+            catch { /* diagnostics only; the hold is the directory, not the file */ }
+            break;
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            const age = holdAgeMs(dir);
+            if (age !== null && age > staleMs) {
+                // Break it — but never silently. Stealing a lock without a record is exactly the kind of
+                // invisible action this project refuses everywhere else.
+                const holder = readHolder(dir);
+                release(dir);
+                try {
+                    opts?.onStaleBreak?.({ pid: holder.pid, ageMs: age, ledgerFile });
+                }
+                catch { /* recording must not block recovery */ }
+                continue; // re-race for it; another breaker may win and that is fine
+            }
+            if (Date.now() >= deadline) {
+                const holder = readHolder(dir);
+                throw new LedgerLockError(`could not obtain exclusive ledger access within ${acquireMs}ms — held by pid ${holder.pid ?? 'unknown'} since ${holder.startedAt ?? 'unknown'}`);
+            }
+            sleepSync(15);
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        release(dir);
+    }
+}

package/dist/holmes/governance/ledger-store.conformance.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ledgerStoreConformance = ledgerStoreConformance;
+/**
+ * The ONE conformance suite every `LedgerStore` adapter must pass.
+ *
+ * Deliberately a single exported function rather than a copy per adapter: two copies drift, and
+ * "both adapters pass" quietly stops meaning anything. Everything here is expressed against the
+ * CONTRACT — no paths, no files, no knowledge of how an adapter stores anything. If a property
+ * cannot be written that way, that is itself the finding: the contract has leaked its
+ * implementation, and finding that now is the whole reason a second adapter exists.
+ */
+function ledgerStoreConformance(name, make) {
+    const evt = (actor, n, over = {}) => ({
+        ts: `2026-08-07T00:00:0${n}.000Z`, actor, kind: 'spec-approved',
+        summary: `${actor} ${n}`, inputs: [], rationale: 'r', ...over,
+    });
+    describe(`LedgerStore conformance — ${name} (A-SPEC-150)`, () => {
+        it('normal: an appended event is readable', () => {
+            const s = make();
+            s.append(evt('a', 0));
+            expect(s.loadAll().map((e) => e.summary)).toContain('a 0');
+        });
+        it('normal: the store reports its own replica identity', () => {
+            expect(make().replicaId()).toBeTruthy();
+        });
+        it('negative: reading leaves NO trace — a reader that writes is a defect regardless of what it breaks', () => {
+            // Promoted to the CONTRACT after the file adapter reintroduced it: resolving the replica id in
+            // the constructor made a mere read create `.ax/state/`. REQ-148 had already fixed exactly this
+            // in ProvenanceLedger, and it came back in the next implementation *because the contract did
+            // not require it*. Fixing it in one place is not fixing it.
+            const s = make();
+            const snapshot = () => JSON.stringify(s.loadAll());
+            const before = snapshot();
+            s.chains();
+            s.verifyAll();
+            s.loadAll();
+            s.isNonceConsumed('N-x');
+            s.replicaId();
+            expect(snapshot()).toBe(before);
+            expect(s.loadAll()).toEqual([]);
+        });
+        it('normal: an empty store verifies and reads empty', () => {
+            const s = make();
+            expect(s.loadAll()).toEqual([]);
+            expect(s.verifyAll().ok).toBe(true);
+        });
+        it('normal: verifyAll passes over what it wrote', () => {
+            const s = make();
+            s.append(evt('a', 0));
+            s.append(evt('a', 1));
+            expect(s.verifyAll().ok).toBe(true);
+            expect(s.verifyAll().broken).toEqual([]);
+        });
+        it('boundary: loadAll is deterministic — repeated reads agree exactly', () => {
+            const s = make();
+            s.append(evt('a', 0));
+            s.append(evt('a', 1));
+            expect(JSON.stringify(s.loadAll())).toBe(JSON.stringify(s.loadAll()));
+        });
+        it('normal: chains() reports the replica that wrote, by identity not location', () => {
+            const s = make();
+            s.append(evt('a', 0));
+            expect(s.chains().map((c) => c.replicaId)).toContain(s.replicaId());
+        });
+        it('negative: append is append-only — an earlier event is never altered', () => {
+            // The property the whole audit trail rests on. An adapter that rewrote history would still
+            // satisfy "the new event is readable", so this has to be asserted separately.
+            const s = make();
+            s.append(evt('a', 0));
+            const before = JSON.stringify(s.loadAll());
+            s.append(evt('a', 1));
+            expect(JSON.stringify(s.loadAll().slice(0, 1))).toBe(before);
+        });
+        it('corner: a nonce spent in the store is seen as spent', () => {
+            // REQ-148's rule promoted to the CONTRACT: judging from a single chain lets one single-use
+            // approval be spent once per replica. Any adapter that stores chains separately can get this
+            // wrong, so the contract — not one implementation — has to require it.
+            const s = make();
+            s.append(evt('a', 0, { kind: 'nonce-consumed', inputs: ['N-1'] }));
+            expect(s.isNonceConsumed('N-1')).toBe(true);
+            expect(s.isNonceConsumed('N-2')).toBe(false);
+        });
+        it('negative: an ordinary event does not count as a consumption', () => {
+            const s = make();
+            s.append(evt('a', 0));
+            expect(s.isNonceConsumed('N-1')).toBe(false);
+        });
+    });
+}

package/dist/holmes/governance/ledger-store.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryLedgerStore = exports.FileLedgerStore = void 0;
+// @implements A-SPEC-150
+const provenance_chain_1 = require("./provenance-chain");
+const provenance_ledger_1 = require("./provenance-ledger");
+/**
+ * Local adapter — DELEGATES to `ProvenanceLedger` rather than re-implementing it.
+ *
+ * That is load-bearing, not stylistic. REQ-141's per-file lock, REQ-147's read compatibility with the
+ * pre-split ledger, and REQ-148's replica split all live inside `ProvenanceLedger`. An adapter that
+ * wrote files itself would satisfy every conformance test while silently dropping all three, and
+ * nothing in this suite would notice — which is why a structural test pins the delegation too.
+ */
+class FileLedgerStore {
+    dir;
+    givenId;
+    inner;
+    cachedId;
+    /**
+     * The replica id is resolved LAZILY and the root derivation is delegated.
+     *
+     * Both were regressions I reintroduced here: resolving in the constructor made a mere read create
+     * `.ax/state/` (REQ-148 had fixed precisely that in ProvenanceLedger), and deriving the project
+     * root with a local regex duplicated a rule that already exists — two copies of one rule drift.
+     * The contract now demands the no-footprint property so the NEXT adapter cannot lose it either.
+     */
+    constructor(dir, givenId) {
+        this.dir = dir;
+        this.givenId = givenId;
+        this.inner = provenance_ledger_1.ProvenanceLedger.at(dir, givenId);
+    }
+    replicaId() {
+        if (this.cachedId === undefined)
+            this.cachedId = this.givenId ?? this.inner.replicaIdOf();
+        return this.cachedId;
+    }
+    chains() {
+        // `id` is the chain's NAME, not its path — the contract must stay satisfiable without a filesystem.
+        return this.inner.chains().map((c) => ({ replicaId: c.replicaId, id: c.replicaId ?? 'legacy' }));
+    }
+    loadAll() { return this.inner.loadAll(); }
+    verifyAll() {
+        const r = this.inner.verifyAll();
+        return { ok: r.ok, broken: r.broken.map((b) => ({ replicaId: b.replicaId, detail: b.detail })) };
+    }
+    append(body) {
+        return this.inner.append(body);
+    }
+    isNonceConsumed(nonce) { return this.inner.isNonceConsumed(nonce); }
+}
+exports.FileLedgerStore = FileLedgerStore;
+/**
+ * In-memory adapter — the instrument that makes the contract testable.
+ *
+ * Uses NO filesystem, deliberately. An in-memory store backed by a temp directory would be the file
+ * adapter in disguise and would prove nothing about coupling. It reuses the pure chain functions
+ * (`chainNext`, `verifyChain`) because those are the format, not the storage.
+ */
+class MemoryLedgerStore {
+    id;
+    byReplica = new Map();
+    constructor(id = 'memory') {
+        this.id = id;
+    }
+    replicaId() { return this.id; }
+    chains() {
+        return [...this.byReplica.keys()].sort((a, b) => String(a).localeCompare(String(b)))
+            .map((r) => ({ replicaId: r, id: r ?? 'legacy' }));
+    }
+    loadAll() {
+        const out = [];
+        for (const [replicaId, events] of this.byReplica)
+            for (const e of events)
+                out.push({ ...e, replicaId });
+        const key = (e) => `${e.ts} ${e.replicaId ?? ''} ${String(e.seq).padStart(12, '0')}`;
+        return out.sort((a, b) => (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0));
+    }
+    verifyAll() {
+        const broken = [];
+        for (const [replicaId, events] of this.byReplica) {
+            const r = (0, provenance_chain_1.verifyChain)(events, process.env.HOLMES_LEDGER_KEY || undefined);
+            if (!r.ok)
+                broken.push({ replicaId, detail: r.detail });
+        }
+        return { ok: broken.length === 0, broken };
+    }
+    append(body) {
+        const chain = this.byReplica.get(this.id) ?? [];
+        const evt = (0, provenance_chain_1.chainNext)(chain, body, process.env.HOLMES_LEDGER_KEY || undefined);
+        // Push onto a copy-then-set so an earlier event object is never mutated in place — append-only
+        // has to hold for the objects a caller already read, not just for the array.
+        this.byReplica.set(this.id, [...chain, evt]);
+        return evt;
+    }
+    isNonceConsumed(nonce) {
+        // @implements A-SPEC-191 §13 — the fingerprint form is what writers record now (§11c). An
+        // adapter that only knew the raw value would report 'not consumed' for every real consumption,
+        // and the conformance suite would still pass because it wrote raw values itself.
+        const { nonceFingerprint } = require('./provenance-chain');
+        const fp = nonceFingerprint(nonce);
+        return this.loadAll().some((e) => e.kind === 'nonce-consumed'
+            && ((e.inputs ?? []).includes(nonce) || (e.inputs ?? []).includes(fp)));
+    }
+}
+exports.MemoryLedgerStore = MemoryLedgerStore;

package/dist/holmes/governance/progress-ledger.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatProgressEntry = formatProgressEntry;
+exports.parseProgressLog = parseProgressLog;
+exports.appendProgress = appendProgress;
+exports.readProgress = readProgress;
+// @implements A-SPEC-125.2
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function formatProgressEntry(e) {
+    if (!e.ts || !e.kind || !e.summary)
+        throw new Error('progress entry requires ts, kind, summary');
+    return JSON.stringify({ ts: e.ts, kind: e.kind, summary: e.summary, ...(e.refs?.length ? { refs: e.refs } : {}), ...(e.suite != null ? { suite: e.suite } : {}), ...(e.head ? { head: e.head } : {}) });
+}
+function parseProgressLog(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        try {
+            const e = JSON.parse(t);
+            if (e && typeof e.ts === 'string' && typeof e.kind === 'string' && typeof e.summary === 'string')
+                out.push(e);
+        }
+        catch { /* skip corrupt line — append-only logs tolerate torn writes */ }
+    }
+    return out;
+}
+const LEDGER = path.join('.ax', 'ledger', 'progress.jsonl');
+function appendProgress(root, entry) {
+    try {
+        const file = path.join(root, LEDGER);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, formatProgressEntry(entry) + '\n');
+        return true;
+    }
+    catch {
+        return false;
+    } // fail-open: a ledger write must never break the workflow
+}
+function readProgress(root, lastN) {
+    try {
+        const all = parseProgressLog(fs.readFileSync(path.join(root, LEDGER), 'utf8'));
+        return lastN ? all.slice(-lastN) : all;
+    }
+    catch {
+        return [];
+    }
+}