@holmes-lab/holmes-kit 0.12.2 → 0.13.0

package/CHANGELOG.md

@@ -5,6 +5,86 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.13.0] - 2026-09-06
+
+Autonomy grows from a single env switch into a **three-layer, always-bounded** posture — so a team can
+let the agent self-drive the SDLC without ever losing the human gate on governance-critical, high-risk,
+or irreversible decisions — and that same risk grade now governs **releases**. Also: a uniform English
+operator surface, and two shell-write gate bypasses closed. Additive; a project that never opts into
+autonomy is byte-identical to before.
+
+### Added
+
+- **Three-layer autonomous approval** (REQ-552 / REQ-553 / REQ-554): autonomy is now a posture the agent
+  can hold at two scopes above the always-escalate boundary. A **project default** you opt into at
+  `holmes-kit init --autonomy` (an interactive prompt defaulting to No; `--autonomy`/`--no-autonomy` skip
+  it) persists as the `HOLMES_AUTONOMOUS_APPROVAL` env in `.mcp.json`. A **per-session envelope** you
+  grant with `holmes-kit autonomy on [--for 2h]` writes an **expiring marker** under the
+  agent-write-protected `.ax/state/`; `holmes-kit autonomy status`/`off` read and end it. The active
+  posture is **surfaced at every session start** (SessionStart hook) and the stale marker is pruned
+  there. An agent still cannot grant autonomy to itself: the env is env-only (blocked like
+  `HOLMES_ROLE`), the session command needs a real TTY or an out-of-band `HOLMES_APPROVAL`, and the
+  marker lives where agents can't write. `doctor` reports the project posture.
+- **Release autonomy classifier + docs-currency gate** (REQ-555): `releaseAutonomy(specs, versionBump,
+  env, root, now)` decides a release by **what it contains** — reusing the same per-spec risk grade —
+  returning `auto` only when autonomy is on, the bump is patch/minor, and every spec is auto-grade; a
+  **major** bump, any `gate-behavior`/security/architecture spec, or an upstream `REQ`/`H-SPEC` returns
+  `hitl`. `versionBumpKind(from, to)` classifies semver major/minor/patch/none. The `holmes-publish`
+  playbook adds a **docs-currency gate** (diff the specs since the last tag; block if a user-facing
+  change never reached `README`/`CHANGELOG`) and reworks its step 3 to this classification. `npm publish`
+  remains human-approved by default — it is irreversible and outward.
+
+- **A maker's colophon** (REQ-548): an undocumented subcommand prints a short detective-themed
+  colophon and credit. Deliberately absent from `--help` — a mark for those who go looking.
+
+### Changed
+
+- **Autonomy hitl boundary is now enforced through the out-of-band queue** (REQ-551): under autonomy, a
+  governance-critical spec used to be reachable through the in-session elicitation prompt (a side-door
+  that a test even blessed). It is now **refused and routed to the `holmes-kit approve` queue** instead —
+  `gate-behavior`/breaking A-SPECs, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/
+  `C-SPEC` never self-approve, whatever the autonomy posture. This supersedes the README's earlier
+  "still ask through the in-session TUI" description.
+- **Uniform English operator surface** (REQ-549): every operator-facing message — `doctor` output, the
+  CLI usage/errors, the hook `deny` reasons and ART citations, and the interactive `approve`/`init`/
+  `upgrade`/`semantic-key` prompts — is now English, guarded by a hangul-absence test over the
+  **rendered runtime output** (not just source scan, which misses `\u`-escaped strings). Playbook
+  triggers pinned to former Korean deny phrases were re-pinned to the new English wording.
+
+### Fixed
+
+- **shell-write gate: two bypasses closed** (REQ-550): the gate now treats a project as **governed when
+  any spec exists** — a fresh project holding only *unapproved drafts* was previously ungoverned, so a
+  code write slipped through the draft window — and it classifies `cp`/`mv` by their **destination**
+  (a copy/move landing on a source path is sealed even when the source file isn't code, which the old
+  "≥2 code paths" heuristic missed). Reproduced in the reported draft-only state before the fix.
+- **Release classifier & `autonomy off` fail CLOSED on the edges** (REQ-558): a pre-release adversarial
+  audit found the release-autonomy classifier failing OPEN — `releaseAutonomy([], …)` returned `auto`
+  (an empty/unknown spec set self-publishing), a same-major **downgrade** (`1.5.0`→`1.4.0`) graded as a
+  normal `minor`, and a `none` bump reached `auto` — and `holmes-kit autonomy off` swallowing an
+  `rmSync` failure to report "OFF" while the marker (and autonomy) survived. Now: an empty spec set,
+  any non-`patch`/`minor` bump, and a downgrade are all `hitl`; and `off` re-checks the marker and
+  reports `still ON` (exit 1) if it cannot be removed. A dead `void` stub was removed; the README's
+  English-surface claim was narrowed to the CLI/hook surfaces it actually covers.
+
+### Security
+
+- **Autonomy grader / enforcer parity** (REQ-556): under autonomy, the spec-approval risk grader
+  (`isHighRiskPath`) judged an A-SPEC's `Files to Touch` with a literal `startsWith`, while the write
+  authorization that same field confers is decided by the glob-aware, prose-permissive enforcer
+  (`matchesFtt`). The gap let an agent **self-approve a spec that writes the gate's own code** by
+  spelling `Files to Touch` as a glob (`src/holmes/**/*.ts`), as prose (no path tokens), empty, or in a
+  different case (`src/holmes/Governance/…`) — all graded `auto`. The grader now judges by what a token
+  can **admit**: zero path tokens ⇒ `hitl` (unconstrained scope), a glob whose prefix overlaps a
+  gate/governance/taint root ⇒ high-risk, and paths are case-folded. Verified with two consecutive clean
+  adversarial rounds.
+- **shell-write gate: directory-destination and `-t` bypasses closed** (REQ-557): `cp /tmp/evil.ts src/`
+  (a directory destination) and `cp -t src /tmp/evil.ts` (GNU `--target-directory`) landed a code file
+  inside the governed tree **unjudged**, because the REQ-550 rule only inspected the last token's
+  extension. The gate now parses `-t`/`--target-directory` as the destination and, for a directory
+  destination, judges each source's landing path `dir/basename(src)`. Read-out backups, out-of-tree and
+  non-code landings, and ungoverned repos are unaffected.
+
 ## [0.12.2] - 2026-09-05
 
 Makes the update-notification actually work. Measured this release: the "new version available" notice

package/README.md

@@ -14,7 +14,7 @@
 
 ---
 
-### 🛡️ Currently Supported Features (v0.9.x Production Features)
+### 🛡️ Currently Supported Features (v0.13.x Production Features)
 
 - 📋 **Requirements & Specification Governance**: Strict **"No Spec, No Code"** enforcement with 4-tier spec chain traceability (`REQ ➔ H-SPEC ➔ A-SPEC ➔ T-SPEC`) and `// @implements A-SPEC-XXX` code anchors (comma-lists and every anchor in a file participate in the gate).
 - 🔴 **Inbuilt TDD — RED-first, enforced not asked** *(new in 0.9.0)*: the test-first discipline is a holmes-installed `holmes-tdd-slice` skill **and** a new constitution article **ART-8**. A changed A-SPEC must show a recorded `red-assertion → green` sequence in the ledger; a `red-error` (a test that could not run) is not a valid RED, so "the covering test failed *correctly*" is judged mechanically, not on trust. `test_run` classifies each covered file (`red-assertion`/`red-error`/`green`) and records per-A-SPEC outcomes the Stop hook reads. Ships at `redFirstEvidence: track` (observe-first, non-blocking; `strict`/`off` per repo), evidence-gated and jest-only for now. A T-SPEC may also declare `kills:` mutations and `test_run --mutate` reports which SURVIVED (a coverage gap). Where superpowers *asks* for RED-first and discriminating power, holmes-kit *proves* them.
@@ -22,9 +22,11 @@
 - ⬆️ **Zero-config upgrades** *(new in 0.11.0)*: `holmes-kit upgrade` moves **every** wired workspace to the latest in one command — plan → confirm → install → re-pin all recorded workspaces (`--dry-run`/`--yes` supported). Preparation is automatic (each `init` records the workspace; a session whose pin is behind nudges you to upgrade); the re-pin **write** stays your explicit choice, never a silent auto-install. Opt out of the nudge with `HOLMES_NO_AUTO_REPIN`.
 - 📊 **World-top-tier RTM dashboard** *(new in 0.12.0–0.12.1)*: `holmes-kit serve` — ask to *see* the RTM heatmap and the `rtm_dashboard` MCP tool launches the server idempotently and hands back the URL plus an honesty **census** (requirement/pipeline counts, coverage %, what's excluded). The heatmap is a real **2D coverage matrix** (requirements × pipeline stages, rows seriated by completeness, sequential-ramp cells with the percent printed in each). Drilling into a symbol renders that function's **CFG as a layered DAG** with **PDG (data/control-dependence) colour overlays**, served by `/api/cfg?file=&symbol=` from the same engine the taint lane uses — a non-CFG language is named, never faked. Tokenised palette (sequential ramp, status colours, UI/mono pairing) with light/dark.
 - 🔢 **Sensible spec numbering** *(new in 0.12.1)*: a brand-new project's first slice is now **REQ-100**, not REQ-201 — `spec_slice_init` shares the same id allocator as the reverse-draft path (`nextIdBase`, floor 100). Existing projects are untouched: the next id is always `max(existing)+1`, so a repo already numbering from 201 keeps the exact same sequence. Numbering past 999 yields 4-digit ids cleanly, and ADR references now recognise 4-digit ADRs (`ADR-1000+`).
-- 🤖 **Autonomous Approval** *(new in 0.8.0)*: with the out-of-band `HOLMES_AUTONOMOUS_APPROVAL` switch on, an agent seals **low/mid-risk** specs itself (ledgered under an `autonomous:<client>` actor) — while `gate-behavior` changes, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/`C-SPEC` still ask a human through the in-session TUI. The switch is env-only; a session cannot set it (blocked like `HOLMES_ROLE`). Off = byte-identical to before. *(new in 0.10.0)* Set **`HOLMES_ELICIT=off`** to skip the in-session prompt entirely and route every decision to the out-of-band `holmes-kit approve` queue instead — one decision surface that behaves identically across Claude Code / Antigravity / Codex.
+- 🤖 **Autonomous Approval — three layers, always bounded** *(reworked in 0.13.0; foundation 0.8.0)*: for teams that want the agent to self-drive the SDLC, autonomy is a posture the agent holds at two scopes — a **project default** you opt into at `holmes-kit init --autonomy` (persisted as the `HOLMES_AUTONOMOUS_APPROVAL` env in `.mcp.json`), and a **per-session envelope** you grant on the spot with `holmes-kit autonomy on --for 2h` (an expiring marker under the agent-write-protected `.ax/state/`). Under either, the agent seals **low-risk** specs itself (ledgered under an `autonomous:<client>` actor); every **governance-critical, high-risk, or irreversible** decision — `gate-behavior`/breaking A-SPECs, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/`C-SPEC` — is instead **refused and routed to the out-of-band `holmes-kit approve` queue** for a human, never silently self-approved. The active posture is **surfaced at every session start** so it can't be forgotten, and an agent can never grant it to itself: the env is env-only (blocked like `HOLMES_ROLE`), the session command needs a real TTY or an out-of-band `HOLMES_APPROVAL`, and the marker lives where agents can't write. Off = byte-identical to a fully human-gated project. *(new in 0.10.0)* `HOLMES_ELICIT=off` routes every decision straight to the same queue.
+- 🚢 **Release Autonomy + Docs-Currency Gate** *(new in 0.13.0)*: publishing is irreversible and outward, so `npm publish` stays **human-approved by default** — but a deterministic classifier (`releaseAutonomy`, reusing the same per-spec risk grade) lets a **low-risk** release (patch/minor, every spec auto-grade, autonomy on) self-publish under the ledger, while a **major** bump, any `gate-behavior`/security/architecture spec, or an upstream `REQ`/`H-SPEC` forces HITL. The `holmes-publish` playbook also gains a **docs-currency gate**: before any release it diffs the specs since the last tag and blocks if a user-facing change never reached `README`/`CHANGELOG` — a stale doc is a false claim.
+- 🌐 **English CLI & hook surface** *(new in 0.13.0)*: the operator-facing CLI and hook messages — `doctor` output, the CLI usage/errors, the hook `deny` reasons and ART citations, and the interactive `approve`/`init`/`upgrade`/`semantic-key` prompts — are now English, guarded by a hangul-absence test over the **rendered runtime output** (not just a source scan, which misses `\u`-escaped strings). The MCP tool responses (`spec_create`/`spec_approve`/ledger/review) are still being migrated and are next.
 - 🪧 **Session Banner + Update Notice** *(new in 0.8.0; refresh implemented + made uniform in 0.12.2)*: every session start emits an English intro (version + governance rule + npm URL) to both the human transcript and the agent context (SessionStart hook + MCP `instructions`); when a newer published version is on npm, an install-mode-aware `holmes-kit upgrade` command is appended. The registry refresh (dist-tags query → cached in `~/.holmes/update-check.json`) is detached, TTL-gated, and fail-silent, and now fires from **every harness's MCP-server startup** — not just Claude's SessionStart hook — so Claude / Antigravity / Codex are notified alike. Opts out via `HOLMES_NO_UPDATE_CHECK`/`CI`. Upgrade execution stays your explicit choice (`holmes-kit upgrade`), never a silent auto-install.
-- 🧱 **Deterministic Gate, Hardened** *(new in 0.8.0)*: shell writes are judged at the segment's **effective working directory** (`cd sub && cat > ../src/x.ts` is sealed, legitimate out-of-tree scratch writes are freed); the governing anchor is the **whole set**, not the first match. Every gate change ships with two consecutive clean adversarial rounds.
+- 🧱 **Deterministic Gate, Hardened** *(new in 0.8.0; further hardened in 0.13.0)*: shell writes are judged at the segment's **effective working directory** (`cd sub && cat > ../src/x.ts` is sealed, legitimate out-of-tree scratch writes are freed); the governing anchor is the **whole set**, not the first match. *(0.13.0)* Two more bypasses are closed: the gate treats a project as **governed when any spec exists** (a fresh project holding only unapproved drafts is no longer an ungoverned free-for-all), and it classifies `cp`/`mv` by their **destination** (a copy/move landing on a source path is sealed even when the source file isn't code). Every gate change ships with two consecutive clean adversarial rounds.
 - 🧠 **3-Tier Semantic Layer** *(new in 0.3.0)*: knowledge-graph semantic search with an explicit consent ladder — `none` (default, **zero egress**), `local` (bge-m3, no egress, optional module), `cloud` (gemini-embedding-001, opt-in via `GEMINI_API_KEY`). Measured on 305 traceability cases: recall 0.486 (lexical) → 0.667 (local) → **0.887 (cloud)**; on lexical-zero requests: 0% → 52% → **92%**. Surfaced only additively — rerank, evidence (`semCos`), and `semanticAlternates` — never as a hard filter.
 - 🎯 **Graded Impact Surface** *(new in 0.3.0)*: `rankedImpact` (personalized-PageRank over the spec/code graph) beat its pre-registered naive baseline on **both recall and precision across 3 corpora (×1.6–×17)** — the necessary condition for any better-than-a-person phrasing, measured before claimed.
 - 🐞 **Causal Defect Localization & CPG** *(equalized in 0.5–0.7)*: AST Code Property Graph (CFG/DDG/CDG) & Dataflow Taint reachability across 7 languages (TS/JS, Python, Go, Rust, Java, C/C++, C#) — **42 language×layer cells graded on measured evidence** (11 corpora, 39,344 functions, zero invariant violations; C++ conditional on 67.9% parse coverage, disclosed in the matrix).
@@ -118,6 +120,9 @@ npx holmes-kit init      # drop the npx prefix if you installed with -g
   [X] 🚀 Antigravity CLI (AGY) (.agents/mcp_config.json, hooks.json, skills)
   [ ] 💻 Codex CLI            (.codex/config.toml)
 ```
+*It then asks — defaulting to **No** — whether to grant **autonomous spec approval** (low-risk specs
+self-seal; governance-critical, high-risk and irreversible always stay human). Skip the prompt with
+`--autonomy` / `--no-autonomy`, or turn it on later per-session with `holmes-kit autonomy on`.*
 
 ### 3. Verify Health
 ```bash
@@ -191,7 +196,11 @@ flowchart LR
 | :--- | :--- |
 | `holmes-kit init` | Interactive agent harness setup (Claude, Antigravity, Codex) |
 | `holmes-kit init --agent all` | Non-interactive instant setup for all supported agents |
+| `holmes-kit init --autonomy` | Opt the project into autonomous spec approval (low-risk only; governance-critical still HITL) |
 | `holmes-kit init --dry-run` | Preview files and configuration changes without writing |
+| `holmes-kit autonomy status` | Show the current autonomous-approval posture (project default + session envelope) |
+| `holmes-kit autonomy on --for 2h` | Self-drive low-risk specs for this session only (expiring; needs a TTY or `HOLMES_APPROVAL`) |
+| `holmes-kit autonomy off` | End session autonomy immediately |
 | `holmes-kit doctor` | Comprehensive health check of specs, hooks, MCP, and anchors |
 | `holmes-kit doctor --fix` | Automatically self-heal and repair broken hooks or missing skills |
 | `holmes-kit ci` | Run non-interactive headless governance gate for GitHub Actions / GitLab CI |

package/dist/.build-id

@@ -1 +1 @@
-7bd28fc-mtnyp765
+55b0a37-mtp8gdtd

package/dist/holmes/cli/approve-context.js

@@ -58,7 +58,7 @@ const MAX_BODY = 2400;
 // Round-6: and folded UNDER A MARGIN, so no body byte can start a line and pose as a template row.
 const BODY_INDENT = '  \u2502 ';
 // Round-10: the clip ran AFTER escaping, so it counted escape-expanded units — 500 non-breaking
-// spaces (503 source characters) reported "603자 잘림", a statement false on its face on the screen
+// spaces (503 source characters) reported "clipped at 603 chars", a statement false on its face on the screen
 // whose job is saying how much is not shown, and it cut MAX_BODY's real budget by six. It also let
 // the cut land INSIDE an escape, leaving a bare `00` that was the tail of `\u3000` (round-1's
 // severed-surrogate lesson, one representation later). The source is clipped first; the notice then
@@ -108,20 +108,20 @@ function specContext(root, id) {
     walk(specsDir);
     // The absolute specs path alone can exceed a row on a real machine, so it gets one of its own.
     if (found.length === 0) {
-        return `맥락을 읽을 수 없습니다: 스펙 ${(0, screen_safe_1.rowField)(id, 24)} 를 찾지 못했습니다\n   ${(0, screen_safe_1.rowField)(specsDir, 76)}`;
+        return `cannot read context: spec ${(0, screen_safe_1.rowField)(id, 24)} was not found\n   ${(0, screen_safe_1.rowField)(specsDir, 76)}`;
     }
     if (found.length > 1) {
         return [
-            `맥락이 모호합니다: ${(0, screen_safe_1.rowField)(id, 40)} 를 주장하는 파일이 ${found.length}건입니다:`,
+            `context is ambiguous: ${found.length} file(s) claim ${(0, screen_safe_1.rowField)(id, 40)}:`,
             ...found.map((f) => `   ${(0, screen_safe_1.rowField)(f.file, 72)}`).sort(),
-            '어느 것이 승인 대상인지 확정되기 전에는 본문을 보여 주지 않습니다',
+            'the body is not shown until which one is the approval target is settled',
         ].join('\n')
-            + `\n   (holmes-kit doctor 의 'spec id 선점 충돌'을 확인하십시오)`;
+            + `\n   (check 'spec id preemption collision' in holmes-kit doctor)`;
     }
     const { spec, file } = found[0];
     const body = [spec.preamble ?? '', ...Object.entries(spec.sections).map(([h, t]) => `## ${h}\n${t}`)]
         .filter((s2) => s2.trim() !== '').join('\n\n');
-    return clip(`■ ${(0, screen_safe_1.flattenField)(spec.id, 40)} — ${(0, screen_safe_1.flattenField)(spec.title, 120)}\n   [현재 상태: ${(0, screen_safe_1.flattenField)(spec.status, 20)}]  (${(0, screen_safe_1.flattenField)(file, 60)})\n\n${body}`);
+    return clip(`■ ${(0, screen_safe_1.flattenField)(spec.id, 40)} — ${(0, screen_safe_1.flattenField)(spec.title, 120)}\n   [current status: ${(0, screen_safe_1.flattenField)(spec.status, 20)}]  (${(0, screen_safe_1.flattenField)(file, 60)})\n\n${body}`);
 }
 function findingContext(root, id) {
     const file = path.join(root, '.ax', 'ledger', 'findings.jsonl');
@@ -136,7 +136,7 @@ function findingContext(root, id) {
     // were justified as well.
     catch (e) {
         return [
-            '맥락을 읽을 수 없습니다: 발견 원장을 읽지 못했습니다',
+            'cannot read context: could not read the findings ledger',
             `   ${(0, screen_safe_1.rowField)(file, 76)}`,
             `   ${(0, screen_safe_1.rowField)(String(e instanceof Error ? e.message : e).split('\n')[0], 76)}`,
         ].join('\n');
@@ -155,8 +155,8 @@ function findingContext(root, id) {
     // Round-3: this was the one sibling site that skipped flattenField, and it is outside clip() —
     // a review-resolve target that is not in the ledger repainted the whole interactive screen.
     if (!latest)
-        return `맥락을 읽을 수 없습니다: 발견 ${(0, screen_safe_1.rowField)(id, 24)} 의 기록이 원장에 없습니다`;
-    return clip(`■ 발견 ${(0, screen_safe_1.flattenField)(id, 60)}\n   [${(0, screen_safe_1.flattenField)(String(latest.severity ?? '?'), 20)} · ${(0, screen_safe_1.flattenField)(String(latest.status ?? '?'), 20)}${latest.category ? ' · ' + (0, screen_safe_1.flattenField)(String(latest.category), 40) : ''}]\n\n${(0, screen_safe_1.flattenField)(String(latest.summary ?? '(요약 없음)'), 2000)}`);
+        return `cannot read context: no record of finding ${(0, screen_safe_1.rowField)(id, 24)} in the ledger`;
+    return clip(`■ finding ${(0, screen_safe_1.flattenField)(id, 60)}\n   [${(0, screen_safe_1.flattenField)(String(latest.severity ?? '?'), 20)} · ${(0, screen_safe_1.flattenField)(String(latest.status ?? '?'), 20)}${latest.category ? ' · ' + (0, screen_safe_1.flattenField)(String(latest.category), 40) : ''}]\n\n${(0, screen_safe_1.flattenField)(String(latest.summary ?? '(no summary)'), 2000)}`);
 }
 function renderDecisionContext(root, entry) {
     try {
@@ -175,6 +175,6 @@ function renderDecisionContext(root, entry) {
     }
     catch (e) {
         // Belt and braces: no context failure may kill the decision surface.
-        return `맥락을 읽을 수 없습니다:\n   ${(0, screen_safe_1.rowField)(String(e instanceof Error ? e.message : e).split('\n')[0], 76)}`;
+        return `cannot read context:\n   ${(0, screen_safe_1.rowField)(String(e instanceof Error ? e.message : e).split('\n')[0], 76)}`;
     }
 }

package/dist/holmes/cli/approve-ref.js

@@ -5,13 +5,13 @@ const screen_safe_1 = require("./screen-safe");
 function resolveRequestRef(pending, ref) {
     const r = ref.trim();
     if (r === '')
-        return { ok: false, reason: '참조가 비어 있습니다 — 목록의 번호나 id 접두를 주십시오' };
+        return { ok: false, reason: 'the reference is empty — give a list number or an id prefix' };
     if (pending.length === 0)
-        return { ok: false, reason: '승인 대기 중인 요청이 없습니다' };
+        return { ok: false, reason: 'no requests awaiting approval' };
     if (/^\d+$/.test(r)) {
         const n = Number(r);
         if (n < 1 || n > pending.length) {
-            return { ok: false, reason: `번호 ${(0, screen_safe_1.rowField)(r, 20)} 는 목록 밖입니다 — 유효 범위는 1..${pending.length} 입니다` };
+            return { ok: false, reason: `number ${(0, screen_safe_1.rowField)(r, 20)} is out of the list — the valid range is 1..${pending.length}` };
         }
         return { ok: true, entry: pending[n - 1] };
     }
@@ -24,7 +24,7 @@ function resolveRequestRef(pending, ref) {
     if (matches.length === 1)
         return { ok: true, entry: matches[0] };
     if (matches.length === 0) {
-        return { ok: false, reason: `참조 '${(0, screen_safe_1.rowField)(r, 60)}' 에 맞는 대기 요청이 없습니다 — 목록의 번호나 id 접두를 확인하십시오` };
+        return { ok: false, reason: `no pending request matches reference '${(0, screen_safe_1.rowField)(r, 60)}' — check a list number or an id prefix` };
     }
     return {
         ok: false,
@@ -33,7 +33,7 @@ function resolveRequestRef(pending, ref) {
         // id) wrapped it past a row and pushed the question off the top of the screen. The refusal keeps
         // one row; each candidate gets its own, which is also how the operator copies one.
         reason: [
-            `참조 '${(0, screen_safe_1.rowField)(r, 30)}' 가 ${matches.length}건에 맞습니다 — 더 길게 주십시오:`,
+            `reference '${(0, screen_safe_1.rowField)(r, 30)}' matches ${matches.length} — give a longer one:`,
             ...matches.map((m) => `   ${(0, screen_safe_1.rowField)(m.id, 60)}`),
         ].join('\n'),
     };

package/dist/holmes/cli/approve-watch.d.ts

@@ -24,7 +24,7 @@ export declare function decideByKey(stream: KeyStream, _item: Pick<PendingReques
  */
 export declare function presentByKey(root: string, io: ApproveIO, actor: string, stream: KeyStream, state: ReturnType<typeof readQueue>): Promise<void>;
 /** The idle line, printed once on entering idle (not on every poll — flood is the template's enemy). */
-export declare const WATCH_IDLE = "\u25C6 \uC2B9\uC778 \uB300\uAE30 \uC911\u2026 (Ctrl-C \uB85C \uC885\uB8CC)";
+export declare const WATCH_IDLE = "\u25C6 awaiting approval\u2026 (Ctrl-C to exit)";
 /** Default idle poll cadence. The reaction DEADLINE is a tested judgment (T-SPEC), not this number. */
 export declare const DEFAULT_POLL_MS = 500;
 export interface WatchOpts {

package/dist/holmes/cli/approve-watch.js

@@ -85,25 +85,25 @@ function decideByKey(stream, _item) {
 async function presentByKey(root, io, actor, stream, state) {
     for (const p of state.pending) {
         io.print(`\n─ ${(0, approve_1.subjectCells)('─  ', p)}`);
-        io.print('[a]승인  [d]거부  [q]질문  [s]건너뜀 > ');
+        io.print('[a]approve  [d]deny  [q]question  [s]skip > ');
         const d = await decideByKey(stream, p);
         if (d === 'granted') {
             const r = (0, approve_1.grantRequest)(root, p.id, { actor });
-            io.print(r.ok ? `✓ 승인 — ${(0, approve_1.subjectCells)('✓ 승인 — ', p)}` : `✗ ${r.reason}`);
+            io.print(r.ok ? `✓ approved — ${(0, approve_1.subjectCells)('✓ approved — ', p)}` : `✗ ${r.reason}`);
         }
         else if (d === 'denied') {
-            const r = (0, approve_1.denyRequest)(root, p.id, '운영자가 watch에서 단일 키로 거부(사유 즉답 생략)', actor);
-            io.print(r.ok ? `✗ 거부 — ${(0, approve_1.subjectCells)('✗ 거부 — ', p)}` : `✗ ${r.reason}`);
+            const r = (0, approve_1.denyRequest)(root, p.id, 'denied by the operator with a single key in watch (no immediate reason)', actor);
+            io.print(r.ok ? `✗ denied — ${(0, approve_1.subjectCells)('✗ denied — ', p)}` : `✗ ${r.reason}`);
         }
         else if (typeof d === 'object') {
             const r = (0, approve_1.holdRequest)(root, p.id, d.question, actor);
-            io.print(r.ok ? `? 보류 — 질문이 다음 거부 문면에 실립니다` : `✗ ${r.reason}`);
+            io.print(r.ok ? `? held — the question rides on the next denial message` : `✗ ${r.reason}`);
         }
         // skipped: leave it pending, silently
     }
 }
 /** The idle line, printed once on entering idle (not on every poll — flood is the template's enemy). */
-exports.WATCH_IDLE = '◆ 승인 대기 중… (Ctrl-C 로 종료)';
+exports.WATCH_IDLE = '◆ awaiting approval… (Ctrl-C to exit)';
 /** Default idle poll cadence. The reaction DEADLINE is a tested judgment (T-SPEC), not this number. */
 exports.DEFAULT_POLL_MS = 500;
 /** Exported for test: the shipped idle wait must resolve at once on abort, not after the timer. */

package/dist/holmes/cli/approve.d.ts

@@ -12,7 +12,7 @@ export declare function grantRequest(root: string, id: string, opts: {
     rationale?: string;
 }): DecisionResult;
 export declare function denyRequest(root: string, id: string, reason: string, actor: string): DecisionResult;
-/** Hold with a question — 추후 승인/거부. The agent carries the question to the user. */
+/** Hold with a question — approve/deny later. The agent carries the question to the user. */
 export declare function holdRequest(root: string, id: string, question: string, actor: string): DecisionResult;
 /**
  * The review screen. Pure.
@@ -36,7 +36,7 @@ export declare function renderPending(state: QueueState, view?: {
 }): string;
 /**
  * @implements A-SPEC-262.1
- * What a decision line must say. Round-1: `✓ 승인 — <expires> 까지 유효` named NOTHING, so an index
+ * What a decision line must say. Round-1: `✓ approved — valid until <expires>` named NOTHING, so an index
  * that resolved against a shifted queue granted a different request than the operator read, with no
  * way to see it from the screen. Every decision now echoes the request it acted on.
  */
@@ -44,7 +44,7 @@ export declare function renderPending(state: QueueState, view?: {
  * @implements A-SPEC-262.1
  * The kind cell and the subject, fitted to what is LEFT OF THE ROW after the caller's own prefix.
  *
- * Round-8: the budgets were global constants derived once, from `✓ 승인 — ` — and `✓ 거부 기록됨 — `
+ * Round-8: the budgets were global constants derived once, from `✓ approved — ` — and `✓ denied — `
  * is seven columns wider, so every denial echo ran to 88 columns and wrapped. Round-7 had widened
  * the kind cell without re-measuring any line that carries it. A constant cannot know which prefix
  * it will be printed behind, so the line computes its own room and the prefix is passed in. The