@holmes-lab/holmes-kit 0.12.2 → 0.13.0

package/dist/holmes/cli/init.js

@@ -148,8 +148,8 @@ function writeFileSafe(file, content) {
             prev = fs.readFileSync(real, 'utf8');
         }
         catch (e) {
-            // §17: 읽지 못한 파일을 덮어쓰지 않는다 — 백업이 0바이트가 되고 사용자 설정이 사라진다.
-            throw new Error(`${file} 를 읽을 수 없어 덮어쓰지 않았습니다: ${e instanceof Error ? e.message : String(e)}`);
+            // §17: do not overwrite a file we could not read — the backup would be 0 bytes and the user's settings would be lost.
+            throw new Error(`could not read ${file}, so it was not overwritten: ${e instanceof Error ? e.message : String(e)}`);
         }
         if (prev !== content) {
             const stamp = `${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
@@ -158,7 +158,7 @@ function writeFileSafe(file, content) {
                 fs.writeFileSync(bak, prev, { flag: 'wx' });
                 madeBackup = bak;
             }
-            catch { /* 백업을 못 만들면 그대로 둔다 — 아래 쓰기는 원자적이다 */ }
+            catch { /* if the backup cannot be made, leave it — the write below is atomic */ }
         }
     }
     // Same discipline the playbook writer earned in round-5/6: unique suffix + 'wx' (a predictable
@@ -184,7 +184,7 @@ function writeFileSafe(file, content) {
         renamed = true;
     }
     catch (e) {
-        throw new Error(`${file} 를 쓰지 못했습니다: ${e instanceof Error ? e.message : String(e)}`);
+        throw new Error(`could not write ${file}: ${e instanceof Error ? e.message : String(e)}`);
     }
     finally {
         if (!renamed) {
@@ -222,7 +222,7 @@ function runInit(opts) {
                 // @implements A-SPEC-190 §16 (round 12) — this named a `prepare` script package.json does not
                 // declare (only build/mcp/release/test/typecheck exist), so the remedy sent readers to inspect
                 // npm settings for a hook that was never there. dist/ ships because `files` lists it.
-                '이 패키지는 컴파일된 dist/ 를 함께 배포합니다 — 저장소에서 쓰는 중이라면 `npm run build`, 설치본이라면 재설치하십시오.',
+                'This package ships a compiled dist/ — if you are working from the repository run `npm run build`, and if from an install, reinstall.',
             ] };
     }
     const s = readJson(settingsPath);
@@ -253,11 +253,23 @@ function runInit(opts) {
         // governance — the exact master-key behaviour A-SPEC-133's narrowing exists to end.
         return { ok: false, exitCode: 2, changes, messages: [
                 opts.remove
-                    ? '거버넌스 배선을 벗기는 것도 배선을 바꾸는 것입니다 — 대역외 승인이 필요합니다 (자기무장해제 방지).'
+                    ? 'Stripping governance wiring is also changing the wiring — an out-of-band approval is required (self-disarm prevention).'
                     : '--force changes existing governance wiring and requires an out-of-band approval that covers it.',
                 `Set HOLMES_APPROVAL='{"actor":"<you>","token":"<any>","rationale":"<why>"}' (scoped approvals need kind "governance-wiring") and re-run.`,
             ] };
     }
+    // @implements A-SPEC-552.1 — ENABLING autonomous approval is a self-disarm-shaped act: it lets the
+    // agent self-seal low-risk specs. Turning it ON therefore needs a human. The interactive raw-TTY
+    // path proves one answered (`autonomyInteractive`), so it needs no token; the non-interactive
+    // `--autonomy` flag (what an agent's Bash would reach for) requires an out-of-band HOLMES_APPROVAL
+    // that covers kind `autonomy-grant`. Turning it OFF or leaving it unspecified is always free.
+    if (opts.autonomy === true && !opts.autonomyInteractive
+        && !(0, risk_gate_1.approvalCovers)(opts.approval, { kind: 'autonomy-grant', target: opts.target }, new Date().toISOString())) {
+        return { ok: false, exitCode: 2, changes, messages: [
+                'Enabling autonomous spec approval needs a human: answer the interactive prompt at a terminal, or supply an out-of-band approval.',
+                `Set HOLMES_APPROVAL='{"actor":"<you>","token":"<any>","rationale":"<why>"}' (scoped approvals need kind "autonomy-grant") and re-run with --autonomy.`,
+            ] };
+    }
     const m = readJson(mcpPath);
     if (m.parseError) {
         return { ok: false, exitCode: 2, changes, messages: [`${mcpPath} is not valid JSON — refusing to touch it.`] };
@@ -318,13 +330,13 @@ function runInit(opts) {
             // operator has no other way to confirm the thing they switched on is still on.
             const prevEnv = m.value
                 ?.mcpServers?.[exports.SERVER_NAME]?.env ?? {};
-            const kept = Object.keys(prevEnv).filter((k) => !settings_merge_2.HOLMES_OWNED_MCP_ENV.includes(k));
+            const kept = Object.keys(prevEnv).filter((k) => !settings_merge_2.HOLMES_OWNED_MCP_ENV.includes(k) && k !== settings_merge_2.AUTONOMY_MCP_ENV);
             if (kept.length > 0)
                 messages.push(`Preserved your MCP server env: ${kept.join(', ')}`);
             // @implements A-SPEC-251.1 — compute the launch entry once (npx-pin for installs, node for source),
             // then merge; env preservation is unchanged.
             const mcpEntry = (0, mcp_launcher_1.mcpEntryForInstall)({ packageRoot: opts.packageRoot, mcpBinPath: mcpBin, flag: opts.mcpLauncher });
-            changes.push({ path: mcpPath, before: m.raw, after: JSON.stringify((0, settings_merge_1.mergeMcpServers)(m.value, exports.SERVER_NAME, mcpEntry, opts.specsDir), null, 2) + '\n' });
+            changes.push({ path: mcpPath, before: m.raw, after: JSON.stringify((0, settings_merge_1.mergeMcpServers)(m.value, exports.SERVER_NAME, mcpEntry, opts.specsDir, opts.autonomy), null, 2) + '\n' });
         }
         changes.push({ path: settingsPath, before: s.raw, after: JSON.stringify(settings, null, 2) + '\n' });
         const gitignoreAfter = (0, gitignore_merge_1.mergeGitignore)(gitignoreBefore);
@@ -432,7 +444,7 @@ function runInit(opts) {
                 messages.push(`Would remove ${planned.length} recovery skill(s): ${planned.map((p) => p.state === 'orphaned' ? p.name : (0, playbook_skills_1.invocableSkillName)(p.name)).join(', ')}`);
         }
         else {
-            // aliased 도 설치되지 않는다(쓰기 전에 거부된다) — 계획이 실행보다 많으면 그것도 거짓말이다.
+            // even an aliased one is not installed (it is refused before the write) — if the plan promises more than the run, that too is a lie.
             const planned = states.filter((x) => x.state !== 'foreign' && x.state !== 'orphaned' && x.state !== 'source-unreadable' && x.state !== 'aliased');
             for (const p of planned)
                 changes.push({ path: (0, playbook_skills_1.skillPathFor)(opts.target, p.name), before: null, after: null });
@@ -440,8 +452,8 @@ function runInit(opts) {
                 messages.push(`Would install/refresh ${planned.length} recovery skill(s): ${planned.map((p) => (0, playbook_skills_1.invocableSkillName)(p.name)).join(', ')}`);
         }
     }
-    // @implements A-SPEC-193 — 하네스별 배선물. 계산과 쓰기를 나누므로 dry-run 이 실제 실행과
-    // 같은 집합을 예고한다(A-SPEC-190 §9 의 규율). Claude 는 위에서 이미 배선했으므로 빈 목록이다.
+    // @implements A-SPEC-193 — per-harness wiring. Splitting compute from write means a dry-run predicts the same
+    // set the real run produces (the A-SPEC-190 §9 discipline). Claude was already wired above, so its list is empty.
     if (!opts.remove) {
         for (const agent of opts.agents ?? []) {
             for (const f of (0, agents_1.agentFiles)(agent, { target: opts.target, packageRoot: opts.packageRoot, specsDir: opts.specsDir, launcher: opts.mcpLauncher })) {
@@ -449,9 +461,9 @@ function runInit(opts) {
                 changes.push({ path: f.path, before, after: f.content });
             }
             messages.push(agents_1.HARNESS_ENFORCES[agent]
-                ? `${agent}: 게이트가 집행됩니다 (훅 배선됨).`
-                : `${agent}: 도구와 지침만 배선했습니다 — 이 하네스에서는 게이트를 집행하지 않습니다.`);
-            // 링크는 내용이 아니라 배치다 — dry-run 에서는 말만 하고, 실제 실행에서만 만든다.
+                ? `${agent}: the gate is enforced (hooks wired).`
+                : `${agent}: only tools and instructions were wired — this harness does not enforce the gate.`);
+            // a link is placement, not content — a dry-run only says so, and only the real run creates it.
             for (const link of (0, agents_1.agentLinks)(agent, { target: opts.target, packageRoot: opts.packageRoot, specsDir: opts.specsDir })) {
                 if (opts.dryRun) {
                     messages.push(`Would link ${link.path} -> ${link.target} (${link.why})`);
@@ -465,10 +477,10 @@ function runInit(opts) {
                     }
                 }
                 catch (e) {
-                    // 심링크를 만들 수 없는 파일시스템(일부 Windows 배치)에서는 사실을 말하고 넘어간다 —
-                    // 조용히 복사본을 만들면 그것이 곧 드리프트의 출발점이다.
-                    messages.push(`${link.path} 를 링크하지 못했습니다(${e instanceof Error ? e.message : String(e)}) —`
-                        + ` 이 하네스가 스킬을 보려면 ${link.target} 를 직접 링크하거나 복사하십시오.`);
+                    // on a filesystem that cannot make symlinks (some Windows setups), state the fact and move on —
+                    // silently making a copy is exactly where drift starts.
+                    messages.push(`could not link ${link.path} (${e instanceof Error ? e.message : String(e)}) —`
+                        + ` for this harness to see the skills, link or copy ${link.target} yourself.`);
                 }
             }
         }
@@ -487,7 +499,7 @@ function runInit(opts) {
                 return { ok: false, exitCode: 2, changes, messages: [
                         ...messages,
                         e instanceof Error ? e.message : String(e),
-                        '권한과 소유자를 확인한 뒤 다시 실행하십시오 — 읽지 못한 파일은 덮어쓰지 않았습니다.',
+                        'Check permissions and ownership, then run again — a file we could not read was not overwritten.',
                     ] };
             }
         }

package/dist/holmes/cli/interactive-prompt.d.ts

@@ -7,3 +7,11 @@ export declare function parseAgentList(input: string): Agent[];
  * Renders an interactive TTY checkbox selection menu using standard readline & ANSI codes.
  */
 export declare function promptAgentSelection(availableAgents?: readonly Agent[], currentWired?: Agent[]): Promise<Agent[]>;
+/**
+ * @implements A-SPEC-552.1
+ * The project autonomy-posture prompt. TTY-only (its raw-terminal read is the human-presence proof —
+ * an agent's non-TTY Bash cannot reach it, so a `true` here is a human answer, not a self-grant).
+ * Non-TTY returns false (leave HITL); the caller does not treat that as an interactive answer.
+ * Default is NO — autonomy is opt-in.
+ */
+export declare function promptAutonomy(): Promise<boolean>;

package/dist/holmes/cli/interactive-prompt.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseAgentList = parseAgentList;
 exports.promptAgentSelection = promptAgentSelection;
+exports.promptAutonomy = promptAutonomy;
 // @implements A-SPEC-200
 const readline = __importStar(require("node:readline"));
 const agents_1 = require("./agents");
@@ -149,3 +150,25 @@ async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWi
         render();
     });
 }
+/**
+ * @implements A-SPEC-552.1
+ * The project autonomy-posture prompt. TTY-only (its raw-terminal read is the human-presence proof —
+ * an agent's non-TTY Bash cannot reach it, so a `true` here is a human answer, not a self-grant).
+ * Non-TTY returns false (leave HITL); the caller does not treat that as an interactive answer.
+ * Default is NO — autonomy is opt-in.
+ */
+async function promptAutonomy() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return false;
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        process.stdout.write('\n  🔑 Autonomous spec approval\n'
+            + '  The agent may self-approve LOW-RISK specs (tests, benign changes). Governance-critical,\n'
+            + '  high-risk and irreversible specs (REQ/H-SPEC/C-SPEC, gate/security/architecture) ALWAYS\n'
+            + '  ask you. You can turn this off anytime: holmes-kit autonomy off.\n');
+        rl.question('  Grant autonomous spec approval for this project? [y/N] ', (ans) => {
+            rl.close();
+            resolve(/^\s*y(es)?\s*$/i.test(ans));
+        });
+    });
+}

package/dist/holmes/cli/semantic-key.js

@@ -57,34 +57,34 @@ const defaultIo = {
     write: (line) => process.stdout.write(line + '\n'),
 };
 const SOURCE_LABEL = {
-    'env': 'HOLMES_SEMANTIC_API_KEY (환경변수)',
-    'env-compat': 'GEMINI_API_KEY (환경변수)',
-    'keychain': 'macOS 키체인 (holmes-kit/semantic)',
+    'env': 'HOLMES_SEMANTIC_API_KEY (environment variable)',
+    'env-compat': 'GEMINI_API_KEY (environment variable)',
+    'keychain': 'macOS keychain (holmes-kit/semantic)',
     'file': '~/.holmes/credentials.json (0600)',
 };
 async function runSemanticKey(sub, io = defaultIo, cred = {}) {
     if (sub === 'set') {
-        const key = (await io.readSecret('cloud semantic 티어 API 키 입력(표시되지 않음): ')).trim();
+        const key = (await io.readSecret('enter the cloud semantic tier API key (not shown): ')).trim();
         if (key === '') {
-            io.write('빈 키는 저장하지 않습니다.');
+            io.write('An empty key is not saved.');
             return 2;
         }
         const where = (0, credentials_1.storeSemanticKey)(key, cred);
-        io.write(`저장됨: ${SOURCE_LABEL[where]} — 키 설정은 이그레스(스펙 산문·경로·심볼명 외부 전송) 동의입니다. 값은 어떤 출력에도 표시되지 않습니다.`);
+        io.write(`Saved: ${SOURCE_LABEL[where]} — setting a key is consent to egress (sending spec prose, paths, and symbol names externally). The value is never shown in any output.`);
         return 0;
     }
     if (sub === 'unset') {
         (0, credentials_1.removeSemanticKey)(cred);
-        io.write('semantic 키 제거됨 (키체인·파일 양쪽).');
+        io.write('Semantic key removed (both keychain and file).');
         return 0;
     }
     if (sub === 'status' || sub === undefined) {
         const r = (0, credentials_1.resolveSemanticKey)(cred);
         if (r === null) {
-            io.write('semantic 키: 없음 — cloud 티어 비활성. `holmes-kit semantic-key set` 으로 opt-in 하십시오(키 설정 = 이그레스 동의).');
+            io.write('Semantic key: none — cloud tier disabled. Opt in with `holmes-kit semantic-key set` (setting a key = consent to egress).');
         }
         else {
-            io.write(`semantic 키: 설정됨 — 출처 ${SOURCE_LABEL[r.source]}. 값은 표시되지 않습니다.`);
+            io.write(`Semantic key: set — source ${SOURCE_LABEL[r.source]}. The value is not shown.`);
         }
         return 0;
     }

package/dist/holmes/cli/settings-merge.d.ts

@@ -63,8 +63,9 @@ export declare function disableMcpServer(existing: Settings | undefined, name: s
  * put it there.
  */
 export declare const HOLMES_OWNED_MCP_ENV: readonly ["HOLMES_SPECS"];
+export declare const AUTONOMY_MCP_ENV = "HOLMES_AUTONOMOUS_APPROVAL";
 export declare function mergeMcpServers(existing: McpConfig | undefined, name: string, entry: {
     command: string;
     args: string[];
-}, specsDir: string): McpConfig;
+}, specsDir: string, autonomy?: boolean): McpConfig;
 export declare function removeMcpServer(existing: McpConfig | undefined, name: string): McpConfig;

package/dist/holmes/cli/settings-merge.js

@@ -1,7 +1,7 @@
 "use strict";
 // @implements A-SPEC-100.2
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HOLMES_OWNED_MCP_ENV = void 0;
+exports.AUTONOMY_MCP_ENV = exports.HOLMES_OWNED_MCP_ENV = void 0;
 exports.isHolmesCommand = isHolmesCommand;
 exports.hookScriptPath = hookScriptPath;
 exports.mergeHooks = mergeHooks;
@@ -95,11 +95,15 @@ function disableMcpServer(existing, name) {
  * put it there.
  */
 exports.HOLMES_OWNED_MCP_ENV = ['HOLMES_SPECS'];
+// @implements A-SPEC-552.1 — the autonomy posture key is holmes-MANAGED but NOT in HOLMES_OWNED_MCP_ENV:
+// that list means "always overwritten on a re-wire" (A-SPEC-179), and the posture is 3-state (undefined
+// PRESERVES it). It is listed here only so init does not report it as a "preserved user key".
+exports.AUTONOMY_MCP_ENV = 'HOLMES_AUTONOMOUS_APPROVAL';
 // @implements A-SPEC-251.1
 // The server entry (command/args) is COMPUTED by the caller (mcp-launcher: npx-pin for installs,
 // node for source checkouts) rather than assembled here, so all three harness wirings share one
 // launch contract. This merge owns only env preservation, not how the server is launched.
-function mergeMcpServers(existing, name, entry, specsDir) {
+function mergeMcpServers(existing, name, entry, specsDir, autonomy) {
     const out = { ...(existing ?? {}) };
     // @implements A-SPEC-179
     // Merge, not replace. Measured 2026-08-13 while previewing `--force` on holmes-kit's own
@@ -111,9 +115,17 @@ function mergeMcpServers(existing, name, entry, specsDir) {
     // the one field, defensively: a non-object entry must not throw during a re-wire.
     const prevEntry = existing?.mcpServers?.[name];
     const prev = (prevEntry && typeof prevEntry === 'object' ? prevEntry.env : undefined) ?? {};
+    const env = { ...prev, HOLMES_SPECS: specsDir };
+    // @implements A-SPEC-552.1 — the autonomy posture is 3-state: `true` sets the switch, `false`
+    // clears it (turning autonomy off is always free), and `undefined` leaves whatever was there
+    // (a re-wire that does not mention autonomy must not silently flip it).
+    if (autonomy === true)
+        env[exports.AUTONOMY_MCP_ENV] = '1';
+    else if (autonomy === false)
+        delete env[exports.AUTONOMY_MCP_ENV];
     out.mcpServers = {
         ...(out.mcpServers ?? {}),
-        [name]: { command: entry.command, args: entry.args, env: { ...prev, HOLMES_SPECS: specsDir } },
+        [name]: { command: entry.command, args: entry.args, env },
     };
     return out;
 }

package/dist/holmes/cli/upgrade.js

@@ -104,7 +104,7 @@ async function runUpgrade(io) {
         io.stderr('source checkout: upgrade via git (git pull && npm run build), not npm install.\n');
         return 1;
     }
-    const go = io.yes || await io.confirm('계속합니까? [y/N] ');
+    const go = io.yes || await io.confirm('Continue? [y/N] ');
     if (!go) {
         io.stdout(io.yes ? '' : 'aborted — nothing installed or re-pinned.\n');
         if (!io.yes && (!process.stdin.isTTY))
@@ -139,7 +139,7 @@ async function runUpgrade(io) {
     io.stdout('\nRe-pinning workspaces:\n');
     for (const w of registry.workspaces) {
         if (!fs.existsSync(w.target)) {
-            io.stdout(`  건너뜀 (경로 없음): ${w.target}\n`);
+            io.stdout(`  skipped (no path): ${w.target}\n`);
             skipped++;
             continue;
         }
@@ -158,20 +158,20 @@ async function runUpgrade(io) {
                 allowAdditive: true,
             });
             if (res.ok) {
-                io.stdout(`  재핀: ${w.target}\n`);
+                io.stdout(`  re-pinned: ${w.target}\n`);
                 repinned++;
             }
             else {
-                io.stdout(`  실패: ${w.target}\n`);
+                io.stdout(`  failed: ${w.target}\n`);
                 failed++;
             }
         }
         catch {
-            io.stdout(`  실패: ${w.target}\n`);
+            io.stdout(`  failed: ${w.target}\n`);
             failed++;
         }
     }
-    io.stdout(`\nUpgraded to ${plan.latest}. 재핀 ${repinned} · 건너뜀 ${skipped} · 실패 ${failed}. 새 세션에서 훅/MCP 가 새 배선을 읽습니다.\n`);
-    io.stdout(`(개별 워크스페이스는 언제든 ${(0, npx_bin_1.npxBin)()} holmes-kit init --agent <…> --force 로 재배선할 수 있습니다.)\n`);
+    io.stdout(`\nUpgraded to ${plan.latest}. re-pinned ${repinned} · skipped ${skipped} · failed ${failed}. A new session's hooks/MCP will read the new wiring.\n`);
+    io.stdout(`(You can re-wire any individual workspace at any time with ${(0, npx_bin_1.npxBin)()} holmes-kit init --agent <…> --force.)\n`);
     return 0;
 }

package/dist/holmes/cpg/proposed-content.js

@@ -68,5 +68,5 @@ function checkProposedContent(opts) {
  * A gate's silence reads as "safe". Stating the approximations where the reader already is — rather
  * than in a document they will not open — is what keeps a pass from becoming false confidence.
  */
-exports.CSPEC_GATE_LIMITS = '이 검사가 보장하지 않는 것: 제어 흐름을 보지 않으므로 분기에 따라 규칙을 비껴가는 코드는 통과합니다;'
-    + ' 모듈 최상위 호출은 파일 단위로 귀속됩니다; 판정 대상은 이 파일 하나이며 저장소 전체가 아닙니다.';
+exports.CSPEC_GATE_LIMITS = 'What this check does NOT guarantee: it does not read control flow, so code that dodges a rule on a branch passes;'
+    + ' a module-top-level call is attributed at file granularity; the judgement is over this one file, not the whole repository.';

package/dist/holmes/governance/autonomy.d.ts

@@ -10,5 +10,12 @@ export declare function isHighRiskPath(p: string): boolean;
  * from the spec itself.
  */
 export declare function specApprovalAutonomy(spec: Spec, _resolveParent: (id: string) => Spec | null): ApprovalAutonomy;
-/** Whether autonomous approval is enabled at all — the out-of-band switch, read at the wiring layer. */
-export declare function autonomousApprovalEnabled(env: NodeJS.ProcessEnv): boolean;
+export declare const SESSION_AUTONOMY_MARKER: readonly [".ax", "state", "autonomy.json"];
+export declare function sessionAutonomyActive(root: string, now: string): boolean;
+/** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope
+ *  (A-SPEC-553.1). `root`/`now` are optional so env-only callers are byte-identical. */
+export declare function autonomousApprovalEnabled(env: NodeJS.ProcessEnv, root?: string, now?: string): boolean;
+export declare function autonomyBanner(env: NodeJS.ProcessEnv, root: string, now: string): string;
+export declare function autonomyMarkerShouldPrune(root: string, now: string): boolean;
+export declare function versionBumpKind(from: string, to: string): 'major' | 'minor' | 'patch' | 'none';
+export declare function releaseAutonomy(specs: Spec[], versionBump: 'major' | 'minor' | 'patch' | 'none', env: NodeJS.ProcessEnv, root?: string, now?: string): ApprovalAutonomy;

package/dist/holmes/governance/autonomy.js

@@ -1,9 +1,59 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTONOMY_ENV = void 0;
+exports.SESSION_AUTONOMY_MARKER = exports.AUTONOMY_ENV = void 0;
 exports.isHighRiskPath = isHighRiskPath;
 exports.specApprovalAutonomy = specApprovalAutonomy;
+exports.sessionAutonomyActive = sessionAutonomyActive;
 exports.autonomousApprovalEnabled = autonomousApprovalEnabled;
+exports.autonomyBanner = autonomyBanner;
+exports.autonomyMarkerShouldPrune = autonomyMarkerShouldPrune;
+exports.versionBumpKind = versionBumpKind;
+exports.releaseAutonomy = releaseAutonomy;
+// @implements A-SPEC-532.1
+// Whether a spec approval may be sealed AUTONOMOUSLY by the agent, or must still ask a human through
+// the MCP elicitation TUI. The governance chain (REQ→H→A→T→CPG + RTM + taint + phase gate) already
+// forces quality structurally, so a low/mid-risk spec self-approving under an explicitly-enabled
+// autonomous mode is a small, bounded relaxation (REQ-532). The bound is what this module owns: the
+// governance-critical specs — gate behaviour, architecture, taint/security boundaries, and every
+// upstream REQ/H-SPEC/C-SPEC — never leave the human channel.
+//
+// PURE: the spec, a parent resolver, and (separately) the env are the only inputs; the wiring layer
+// (A-SPEC-532.2) injects process.env and the elicitor.
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const scope_judgment_1 = require("../guardrail/scope-judgment");
 /** The out-of-band switch. An agent cannot read or set it — the pre-tool-use gate blocks that
  *  (A-SPEC-532.2), the same self-disarm protection HOLMES_APPROVAL and HOLMES_GATE_BYPASS have. */
@@ -21,8 +71,16 @@ const HIGH_RISK_PREFIXES = [
     '.claude',
 ];
 const TAINT_MARKERS = ['taint', 'dataflow-taint', 'flow-sensitive'];
+// @implements A-SPEC-556.1 — the grader must judge a token by what it can ADMIT, to the same
+// standard as the enforcer `matchesFtt` (globs expand, prose imposes nothing). Case is folded: a NEW
+// file keeps its lexical spelling, so `src/holmes/Governance/x.ts` lands in the real governance/ on a
+// case-insensitive FS. A glob is high-risk when its literal prefix OVERLAPS a risk root in either
+// direction (`src/holmes/**` reaches the gate; `src/holmes/hooks/*` is inside it) — over-inclusive on
+// purpose, because a glob spanning the gate surface must never self-approve.
+const GLOB_RISK_ROOTS = [...HIGH_RISK_PREFIXES, 'src/holmes/rtm/'];
 function isHighRiskPath(p) {
-    const s = p.replace(/^\.\//, '').replace(/^["'`]|["'`]$/g, '');
+    const raw = p.replace(/^\.\//, '').replace(/^["'`]|["'`]$/g, '');
+    const s = raw.toLowerCase();
     if (HIGH_RISK_PREFIXES.some((pre) => s.startsWith(pre)))
         return true;
     if (s === '.mcp.json' || s.endsWith('/.mcp.json'))
@@ -30,6 +88,11 @@ function isHighRiskPath(p) {
     // A taint/security boundary file anywhere under rtm/ — the flow engine and its vocabulary.
     if (s.startsWith('src/holmes/rtm/') && TAINT_MARKERS.some((m) => s.includes(m)))
         return true;
+    if (raw.includes('*')) {
+        const litPrefix = s.split('*')[0];
+        if (GLOB_RISK_ROOTS.some((pre) => litPrefix.startsWith(pre) || pre.startsWith(litPrefix)))
+            return true;
+    }
     return false;
 }
 /** The declared breaking-change grade of an A-SPEC, or null when absent/blank. */
@@ -60,6 +123,10 @@ function specApprovalAutonomy(spec, _resolveParent) {
             if (grade === null || !AUTO_GRADES.has(grade))
                 return 'hitl'; // undeclared or gate-behavior
             const paths = (0, scope_judgment_1.fttPathTokens)(spec.sections['Files to Touch'] ?? '');
+            // @implements A-SPEC-556.1 — no path tokens (prose-only / empty FtT) is an UNCONSTRAINED scope:
+            // the enforcer imposes nothing, so the spec can write ANYWHERE incl. the gate. Never self-approve.
+            if (paths.length === 0)
+                return 'hitl';
             if (paths.some(isHighRiskPath))
                 return 'hitl'; // gate/governance/taint file
             return 'auto';
@@ -68,8 +135,102 @@ function specApprovalAutonomy(spec, _resolveParent) {
             return 'hitl'; // unknown kind: fail-safe to human
     }
 }
-/** Whether autonomous approval is enabled at all — the out-of-band switch, read at the wiring layer. */
-function autonomousApprovalEnabled(env) {
+// @implements A-SPEC-553.1 — the per-session autonomy envelope. A protected marker (an agent cannot
+// write `.ax/state/`, measured) with an absolute expiry lets a HITL-default project self-drive
+// low-risk specs for ONE bounded, audited session. Read at decision time; fail-closed on anything
+// unreadable/expired. Wired below (RED-first: stub returns false, then honored).
+exports.SESSION_AUTONOMY_MARKER = ['.ax', 'state', 'autonomy.json'];
+function sessionAutonomyActive(root, now) {
+    try {
+        const m = JSON.parse(fs.readFileSync(path.join(root, ...exports.SESSION_AUTONOMY_MARKER), 'utf8'));
+        if (m.enabled !== true)
+            return false;
+        const exp = Date.parse(String(m.expires));
+        const nowMs = Date.parse(now);
+        // A deadline we cannot read is one we assume passed (the ledger/grant doctrine): fail closed.
+        if (!Number.isFinite(exp) || !Number.isFinite(nowMs))
+            return false;
+        return nowMs < exp;
+    }
+    catch {
+        return false; // absent / unreadable / malformed marker grants nothing
+    }
+}
+/** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope
+ *  (A-SPEC-553.1). `root`/`now` are optional so env-only callers are byte-identical. */
+function autonomousApprovalEnabled(env, root, now) {
+    const v = env[exports.AUTONOMY_ENV];
+    if (typeof v === 'string' && v !== '')
+        return true;
+    return root !== undefined && now !== undefined && sessionAutonomyActive(root, now);
+}
+// @implements A-SPEC-554.1 — the session-start REMINDER (the headless hook surfaces, it never decides).
+// Only ON postures get a line; OFF is silent (a permanent line is one nobody reads). Wired below.
+function autonomyBanner(env, root, now) {
     const v = env[exports.AUTONOMY_ENV];
-    return typeof v === 'string' && v !== '';
+    if (typeof v === 'string' && v !== '') {
+        return '[Holmes-Kit] autonomous spec approval: ON (project default) — governance-critical, high-risk and irreversible specs still ask you.';
+    }
+    if (sessionAutonomyActive(root, now)) {
+        let expires = '';
+        try {
+            expires = String(JSON.parse(fs.readFileSync(path.join(root, ...exports.SESSION_AUTONOMY_MARKER), 'utf8')).expires);
+        }
+        catch { /* the marker parsed inside sessionAutonomyActive; a stray read failure just omits the time */ }
+        return `[Holmes-Kit] autonomous spec approval: ON (this session, until ${expires}) — governance-critical still ask you. End early: holmes-kit autonomy off.`;
+    }
+    return '';
+}
+// @implements A-SPEC-554.1 — true when a marker file exists but is NOT active (expired / disabled /
+// malformed): housekeeping the headless hook may do. A LIVE envelope is never prunable.
+function autonomyMarkerShouldPrune(root, now) {
+    try {
+        if (!fs.existsSync(path.join(root, ...exports.SESSION_AUTONOMY_MARKER)))
+            return false;
+        return !sessionAutonomyActive(root, now); // present but not active ⇒ expired/disabled/malformed
+    }
+    catch {
+        return false;
+    }
+}
+// @implements A-SPEC-555.1 — the semver bump between two `major.minor.patch` strings (non-numeric
+// fields read as 0; never throws).
+// @implements A-SPEC-558.1 — a DOWNGRADE (to < from) is not a normal forward bump; it is treated as
+// 'major' so a mis-set lower version can never self-publish (releaseAutonomy sends non-patch/minor
+// to a human).
+function versionBumpKind(from, to) {
+    const tri = (v) => {
+        const [a, b, c] = v.split('.').map((n) => { const x = parseInt(n, 10); return Number.isFinite(x) ? x : 0; });
+        return [a ?? 0, b ?? 0, c ?? 0];
+    };
+    const [fa, fb, fc] = tri(from), [ta, tb, tc] = tri(to);
+    const cmp = ta !== fa ? ta - fa : tb !== fb ? tb - fb : tc - fc;
+    if (cmp < 0)
+        return 'major'; // downgrade ⇒ high-risk
+    if (ta !== fa)
+        return 'major';
+    if (tb !== fb)
+        return 'minor';
+    if (tc !== fc)
+        return 'patch';
+    return 'none';
+}
+// @implements A-SPEC-555.1 — the RELEASE risk verdict, decided by what the release CONTAINS (reusing
+// the per-spec grade), never by the publish act. npm publish is irreversible + outward, so the
+// conservative default is 'hitl': a release self-publishes ONLY when autonomy is on, the bump is not
+// major, and every spec is auto-grade; any governance-critical spec, a major bump, or autonomy off
+// keeps a human in the loop. Wired below (RED-first).
+function releaseAutonomy(specs, versionBump, env, root, now) {
+    if (!autonomousApprovalEnabled(env, root, now))
+        return 'hitl'; // no autonomy ⇒ a human publishes
+    // @implements A-SPEC-558.1 — fail-closed on the edges: an empty/unknown spec set is not positive
+    // evidence of a low-risk release, and only a positive patch/minor bump self-publishes (a 'major',
+    // a downgrade-graded-major, or a no-op 'none' all keep a human in the loop).
+    if (specs.length === 0)
+        return 'hitl';
+    if (versionBump !== 'patch' && versionBump !== 'minor')
+        return 'hitl';
+    if (specs.some((s) => specApprovalAutonomy(s, () => null) === 'hitl'))
+        return 'hitl'; // any gov-critical change
+    return 'auto';
 }