@holmes-lab/holmes-kit 0.12.2 → 0.13.0

package/dist/holmes/guardrail/blind-spots.js

@@ -3,12 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GATE_BLIND_SPOTS = void 0;
 exports.blindSpotSummary = blindSpotSummary;
 exports.GATE_BLIND_SPOTS = [
-    { example: 'node ./cleanup.js', why: '스크립트 파일의 내용은 명령 문자열에 없습니다' },
-    { example: 'bash ./deploy.sh', why: '같은 이유 — 실행할 내용이 파일 안에 있습니다' },
-    { example: 'npm run clean', why: 'package.json의 스크립트 정의가 명령 문자열 밖에 있습니다' },
-    { example: 'make distclean', why: 'Makefile의 규칙이 명령 문자열 밖에 있습니다' },
-    { example: 'CMD="something"; $CMD', why: '실행될 명령이 실행 시점에 조립됩니다' },
-    { example: 'xargs rm < targets.txt', why: '대상 목록이 표준 입력으로 들어옵니다' },
+    { example: 'node ./cleanup.js', why: 'the script file\'s contents are not in the command string' },
+    { example: 'bash ./deploy.sh', why: 'same reason — what runs lives inside the file' },
+    { example: 'npm run clean', why: 'the script definition in package.json is outside the command string' },
+    { example: 'make distclean', why: 'the Makefile rule is outside the command string' },
+    { example: 'CMD="something"; $CMD', why: 'the command to run is assembled at execution time' },
+    { example: 'xargs rm < targets.txt', why: 'the target list arrives on standard input' },
 ];
 /**
  * One line for `doctor`.
@@ -18,23 +18,23 @@ exports.GATE_BLIND_SPOTS = [
  * parts include creating the script in the first place.
  */
 function blindSpotSummary() {
-    return '가드레일은 명령 문자열을 검사합니다 — 이미 저장소에 있는 스크립트를 실행하는 명령'
-        + `(${exports.GATE_BLIND_SPOTS.slice(0, 3).map((b) => b.example).join(', ')} 등)의 내용은 보지 못합니다.`
-        + ' 스크립트를 새로 작성하는 것은 승인이 필요합니다(A-SPEC-167).'
+    return 'The guardrail inspects the command string — it cannot see the contents of a command that runs a script already in the repository'
+        + ` (e.g. ${exports.GATE_BLIND_SPOTS.slice(0, 3).map((b) => b.example).join(', ')}).`
+        + ' Writing a new script requires approval (A-SPEC-167).'
         // @implements A-SPEC-170
         // Stated, not implied. Four sweep rounds each found runner-manifest names the previous round's
         // list had missed, so calling the list complete would be false — and this is the one place the
         // harness tells a user what it cannot see. It belongs in the prose, not in GATE_BLIND_SPOTS,
         // whose entries are commands a test executes against the gate.
-        + ' 루트 러너 매니페스트(Rakefile·Gemfile 등)의 이름 목록은 완전하지 않습니다 — 생태계마다 새로 생깁니다.'
+        + ' The list of root runner-manifest names (Rakefile, Gemfile, etc.) is not complete — every ecosystem adds new ones.'
         // @implements A-SPEC-175
         // The residual after REQ-175. Losing `.ax/specs` is now detected, because the ledger records the
         // approvals and `init`'s .gitignore block keeps `provenance*.jsonl` committed. Losing the whole
         // `.ax` takes that evidence with it, and a project then looks like one that never opted in. Every
         // shell route to either state is denied by this gate; what remains is deletion from outside the
         // session, and saying so is the only honest option left.
-        + ' `.ax` 전체가 세션 밖에서 삭제되면(에디터·Finder·세션 밖 git) 원장도 함께 사라져'
-        + ' 거버넌스를 켠 적 없는 프로젝트와 구별되지 않습니다 — `.ax/specs`만 사라진 경우는 탐지됩니다(REQ-175).'
+        + ' If the whole `.ax` is deleted from outside the session (editor, Finder, git outside the session), the ledger goes with it,'
+        + ' making the project indistinguishable from one that never opted in — losing only `.ax/specs` is detected (REQ-175).'
         // @implements A-SPEC-421
         // Measured against the INSTALLED build, which is the only place it shows: `tool_name: "Bash"`
         // with `rm -rf /` is denied and `tool_name: "mcp__shell__run"` with the same command is allowed.
@@ -43,7 +43,7 @@ function blindSpotSummary() {
         // is the shape of the gap, not a hypothetical. Denying unknown names instead was considered and
         // rejected: it would refuse every harness's Read, Grep and search tools and leave the guardrail
         // unusable. What is fixable here is the map, and an undeclared gap reads as coverage.
-        + ' 게이트는 **도구 이름**으로 판정하므로 이름을 모르는 도구는 검사하지 않습니다 —'
-        + ' MCP 서버가 제공하는 도구(`mcp__<서버>__<도구>`)는 셸을 실행하더라도 이 게이트를 거치지'
-        + ' 않습니다. MCP 서버는 각자의 승인 경로로 통제하십시오.';
+        + ' The gate dispatches on the **tool name**, so a tool whose name it does not know is not inspected —'
+        + ' a tool provided by an MCP server (`mcp__<server>__<tool>`) does not pass through this gate even when it runs a shell.'
+        + ' Control MCP servers through their own approval paths.';
 }

package/dist/holmes/hooks/pre-tool-use.js

@@ -305,7 +305,7 @@ function preEditEvidenceGate(o) {
 }
 function decideOnGateError(opts) {
     if (opts.bypass) {
-        return { permissionDecision: 'allow', permissionDecisionReason: `[Holmes-Kit] 내부 오류를 HOLMES_GATE_BYPASS로 우회했습니다: ${opts.message}` };
+        return { permissionDecision: 'allow', permissionDecisionReason: `[Holmes-Kit] an internal error was bypassed via HOLMES_GATE_BYPASS: ${opts.message}` };
     }
     if (!opts.governed)
         return { permissionDecision: 'allow' };
@@ -313,8 +313,8 @@ function decideOnGateError(opts) {
     // spec chain that was never the problem.
     return {
         permissionDecision: 'deny',
-        permissionDecisionReason: `[Holmes-Kit] 내부 오류로 판정할 수 없습니다 — 게이트는 판정 불가 시 허용하지 않습니다: ${opts.message}`
-            + ' → `holmes-kit doctor`로 설치를 점검하세요. 운영자 판단으로 통과시키려면 환경에 HOLMES_GATE_BYPASS=1을 설정하십시오(세션이 스스로 설정할 수 없는 대역외 채널).',
+        permissionDecisionReason: `[Holmes-Kit] cannot judge due to an internal error — the gate does not allow when it cannot decide: ${opts.message}`
+            + ' → check the install with `holmes-kit doctor`. To let it through by operator judgment, set HOLMES_GATE_BYPASS=1 in the environment (an out-of-band channel a session cannot set itself).',
     };
 }
 // @implements A-SPEC-514.1
@@ -479,7 +479,7 @@ function evaluateHook(input, specsDir, opts) {
             // first legitimate use in every new project. The single-use guarantee still holds: the record
             // lands in the resolved root, which is the same file every later call resolves to.
             if ((0, provenance_chain_1.blankNonce)(acting?.nonce)) {
-                return deny('승인이 단일 사용(nonce)을 선언했으나 값이 비어 있습니다 — 1회성을 집행할 수 없어 거부합니다');
+                return deny('the approval declared single-use (nonce) but the value is empty — single-use cannot be enforced, so it is denied');
             }
             if (acting?.nonce) {
                 let won;
@@ -579,8 +579,8 @@ function evaluateHook(input, specsDir, opts) {
                 return {
                     permissionDecision: 'deny',
                     permissionDecisionReason: GRANTS_SELF
-                        ? '[Holmes-Kit] 명령이 HOLMES_ROLE/HOLMES_GATE_BYPASS를 지정하거나 읽습니다 — 세션이 스스로 권한을 부여하는 경로입니다.'
-                            + ' 역할은 에이전트를 기동하는 사람이 대역외로 정합니다. 운영자 판단으로 실행하려면 config-write를 포함한 승인이 필요합니다.'
+                        ? '[Holmes-Kit] the command sets or reads HOLMES_ROLE/HOLMES_GATE_BYPASS — a path by which a session grants itself authority.'
+                            + ' Roles are set out-of-band by whoever launches the agent. To run it by operator judgment, an approval that includes config-write is required.'
                         : '[Holmes-Kit] command reads or dumps process environment (holds the out-of-band HOLMES_APPROVAL / HOLMES_LEDGER_KEY secrets) — requires out-of-band approval',
                 };
             }
@@ -624,7 +624,7 @@ function evaluateHook(input, specsDir, opts) {
                 // containing that letter. Caught by a test, not by reading.
                 // @implements A-SPEC-463 — the path sits BETWEEN quotes here, so spaces inside it are part
                 // of the path, not an argument boundary. `[^'"\s]*` stopped at the first space and missed
-                // `open('C:\Users\이름 성\a.ts','w')`; `[^'"]*` keeps the space and still cannot cross a quote.
+                // `open('C:\Users\Given Family\a.ts','w')`; `[^'"]*` keeps the space and still cannot cross a quote.
                 const NOT_QUOTE = String.raw `[^'"]*`;
                 const QUOTED_PATH = new RegExp(String.raw `['"](` + NOT_QUOTE + String.raw `\.` + CODE_EXT + '|' + NOT_QUOTE + CONFIG_FILE + String.raw `)['"]`, 'g');
                 const out = [];
@@ -644,7 +644,7 @@ function evaluateHook(input, specsDir, opts) {
             // @implements A-SPEC-463 — Windows W-2. The extraction below approximated a path with a
             // character class that excludes spaces (`[^\s...]*`) preceded by an OPTIONAL opening quote
             // that no closing quote ever paired. A quoted path with a space — the Windows default home is
-            // `C:\Users\<이름 성>` — matched only up to the first space, never reached the extension, and
+            // `C:\Users\<Given Family>` — matched only up to the first space, never reached the extension, and
             // was captured as nothing, so the write was allowed. `pathAlt` is three alternatives: a
             // double- or single-quoted path (spaces kept, up to the closing quote) or the unquoted form
             // (still ends at the first shell word boundary — an un-escaped space is an argument break).
@@ -740,6 +740,7 @@ function evaluateHook(input, specsDir, opts) {
             // which is an ordinary backup and not this gate's business.
             // (A data heredoc body may still carry separators inside one segment, so the per-segment
             // text is split the way the whole command used to be — the base is the segment's either way.)
+            const CODE_TAIL_RE = new RegExp(`\\.${CODE_EXT}$`);
             for (const seg of segments) {
                 for (const sub of seg.text.split(/[;|&]+/)) {
                     if (!/\b(?:cp|mv|install|rsync|ln|dd)\b/.test(sub))
@@ -752,10 +753,72 @@ function evaluateHook(input, specsDir, opts) {
                             continue;
                         }
                     }
-                    const all = [...sub.matchAll(new RegExp(pathAlt(EXT_TAIL), 'g'))]
-                        .map(firstGroup).filter((x) => x !== undefined);
-                    if (all.length >= 2)
-                        candidates.push({ raw: all[all.length - 1], base: seg.base }); // last path is the destination
+                    // @implements A-SPEC-550.1 — for cp/mv/install/rsync/ln the DESTINATION is the last path
+                    // argument, whatever the source's extension. The old rule matched only code-extension paths
+                    // and required >=2 of them, so a NON-code source left the destination as the sole code path
+                    // and walked through: `cp /tmp/x.txt src/a.ts`, `install /dev/null src/a.ts`, and even
+                    // `cp /dev/stdin src/a.ts <<EOF` (content in the command). Judge the destination directly.
+                    // A code path that is a SOURCE (not last) is not the destination and is left alone, so a
+                    // read-out backup `cp src/a.ts /tmp/backup.ts` (destination outside) still resolves 'out'.
+                    const head = sub.split(/<<|>>|>/)[0]; // drop a heredoc/redirect tail
+                    // Quote-aware tokens: a quoted string is ONE argument even with spaces (Windows W-2 /
+                    // A-SPEC-463 — a backup to `"C:\Users\Full Name\a.ts"` must not be split into two).
+                    const rawToks = head.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+                    const unq = (t) => t.replace(/^['"]|['"]$/g, '');
+                    // @implements A-SPEC-557.1 — judge the LANDING path, not the last token's extension. GNU
+                    // `-t DIR`/`--target-directory[=]DIR` name an explicit destination directory and make every
+                    // positional a SOURCE; and a destination that is a directory lands each source at
+                    // `dir/basename(src)`. Both slipped a code file into the governed tree unjudged before.
+                    let targetDir;
+                    const positional = [];
+                    for (let i = 0; i < rawToks.length; i++) {
+                        const t = rawToks[i];
+                        const eq = /^--target-directory=(.+)$/.exec(t);
+                        if (eq) {
+                            targetDir = unq(eq[1]);
+                            continue;
+                        }
+                        if (t === '-t' || t === '--target-directory') {
+                            const n = rawToks[i + 1];
+                            if (n !== undefined) {
+                                targetDir = unq(n);
+                                i++;
+                            }
+                            continue;
+                        }
+                        if (t.startsWith('-'))
+                            continue; // any other flag
+                        positional.push(unq(t));
+                    }
+                    const baseName = (s) => s.split(/[/\\]/).pop() ?? s;
+                    const stripSlash = (s) => s.replace(/[/\\]+$/, '');
+                    const pushLanding = (destDir, sources) => {
+                        for (const src of sources)
+                            if (CODE_TAIL_RE.test(src))
+                                candidates.push({ raw: `${stripSlash(destDir)}/${baseName(src)}`, base: seg.base });
+                    };
+                    const looksLikeDir = (d) => {
+                        if (/[/\\]$/.test(d))
+                            return true; // trailing separator = explicit dir
+                        try {
+                            const abs = (0, write_target_1.absoluteKindOf)(d) !== null ? d : (seg.base === null ? undefined : (0, write_target_1.pathFlavorFor)(seg.base, d).resolve(seg.base, d));
+                            return abs !== undefined && fs.statSync(abs).isDirectory();
+                        }
+                        catch {
+                            return false;
+                        } // non-existent / unreadable ⇒ a file, not a dir
+                    };
+                    const argv = positional.slice(1); // positional[0] is the tool name
+                    if (targetDir !== undefined) {
+                        pushLanding(targetDir, argv); // -t DIR: every positional is a source
+                    }
+                    else if (argv.length >= 2) {
+                        const dest = argv[argv.length - 1];
+                        if (CODE_TAIL_RE.test(dest))
+                            candidates.push({ raw: dest, base: seg.base }); // dest is a code file
+                        else if (looksLikeDir(dest))
+                            pushLanding(dest, argv.slice(0, -1)); // dest is a directory
+                    }
                 }
             }
             // @implements A-SPEC-447 — same predicate as the config rule; it lived in two copies, which
@@ -772,7 +835,12 @@ function evaluateHook(input, specsDir, opts) {
                 return { permissionDecision: 'deny', permissionDecisionReason: UNRESOLVED_BASE_DENY };
             }
             if (codeVerdicts.includes('in') || codeVerdicts.includes('unknown')) {
-                const governed = readSpecsSync(specsDir).some((s) => s.status === 'approved');
+                // @implements A-SPEC-550.1 — governance is "specs EXIST", not "a spec is approved". The old
+                // `some(status==='approved')` slept through the authoring window: after `spec_slice_init` and
+                // before approval a repo has DRAFT specs, so `cat > test/x.test.js <<EOF` walked through while
+                // Write/Edit denied the same unapproved anchor — the exact tool-vs-shell asymmetry reported.
+                // A truly spec-less repo still has zero specs here, so ordinary ungoverned coding stays free.
+                const governed = readSpecsSync(specsDir).length > 0;
                 if (governed) {
                     return codeVerdicts.includes('in')
                         ? { permissionDecision: 'deny', permissionDecisionReason: '[Holmes-Kit] shell write to a project code file bypasses the No-Spec-No-Code gate — use the Write/Edit tools (gated) or supply out-of-band approval' }
@@ -786,7 +854,7 @@ function evaluateHook(input, specsDir, opts) {
     }
     // @implements A-SPEC-191 §27 (round 13) — `PATH_FIELDS` exists because `notebook_path` slipped
     // past a gate that knew only `file_path`, and this line still knew only `file_path`: a valid
-    // NotebookEdit was denied in EVERY project with "편집 대상 경로를 읽을 수 없습니다", which names
+    // NotebookEdit was denied in EVERY project with "cannot read the edit target path", which names
     // the wrong fault (the path was there and readable) and blocks a legitimate tool outright.
     const p1 = typeof input.tool_input.file_path === 'string' ? input.tool_input.file_path : undefined;
     const p2 = typeof input.tool_input.notebook_path === 'string' ? input.tool_input.notebook_path : undefined;
@@ -804,7 +872,7 @@ function evaluateHook(input, specsDir, opts) {
         // has to recognise.
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로를 읽을 수 없어 판정할 수 없습니다 (file_path 누락 또는 문자열이 아님)',
+            permissionDecisionReason: '[Holmes-Kit] cannot read the edit target path, so it cannot be judged (file_path missing or not a string)',
         };
     }
     const writesCode = (0, write_target_1.writesFiles)(input.tool_name, input.tool_input);
@@ -818,8 +886,8 @@ function evaluateHook(input, specsDir, opts) {
     if (writesCode && !p) {
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로를 읽을 수 없어 판정할 수 없습니다 (file_path 누락 또는 문자열이 아님)'
-                + ' — 이름을 알 수 없는 파일이 승인된 스펙에 덮이는지 확인할 방법이 없으므로 허용하지 않습니다.',
+            permissionDecisionReason: '[Holmes-Kit] cannot read the edit target path, so it cannot be judged (file_path missing or not a string)'
+                + ' — there is no way to check whether an unnamed file overwrites an approved spec, so it is not allowed.',
         };
     }
     if (!p || !writesCode)
@@ -880,9 +948,9 @@ function evaluateHook(input, specsDir, opts) {
         // nothing to govern"; an undecidable target is refused, not allowed.
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 네트워크 경로(UNC)는 로컬 파일시스템 정체로 해석할 수 없어'
-                + ' 프로젝트 안팎을 판정할 수 없습니다 — 판정할 수 없는 대상은 허용하지 않습니다.'
-                + ' 프로젝트를 로컬 드라이브에 두거나 드라이브 문자로 매핑한 경로를 사용하십시오.',
+            permissionDecisionReason: '[Holmes-Kit] a network path (UNC) cannot be resolved to a local filesystem identity,'
+                + ' so it cannot be judged inside or outside the project — an untellable target is not allowed.'
+                + ' Put the project on a local drive, or use a drive-letter-mapped path.',
         };
     }
     if (absKind === 'posix' || absKind === 'drive') {
@@ -918,8 +986,9 @@ function evaluateHook(input, specsDir, opts) {
             }
         })();
         const fold = (s) => (caseBlind ? s.toLowerCase() : s);
-        // 접기는 해석된 위치에만 적용한다 — 철자 그대로의 norm 을 접어 '안'이라 부르면, 프로젝트
-        // 밖을 가리키는 링크가 이름만으로 안에 들어온다. 해석이 먼저, 접기는 그 위에서.
+        // Case-folding applies only to the RESOLVED location — folding the literal-spelling norm and
+        // calling it 'inside' lets a link that points OUTSIDE the project enter by name alone. Resolve
+        // first, fold on top of that.
         const canonical = inside(norm, projectRoot) ? asProject(norm, projectRoot)
             : inside(realTarget, realRoot) ? asProject(realTarget, realRoot)
                 : inside(fold(realTarget), fold(realRoot)) ? asProject(realTarget, realRoot)
@@ -936,8 +1005,8 @@ function evaluateHook(input, specsDir, opts) {
     if (norm.includes('\u0000')) {
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로에 NUL 바이트가 있어 어느 파일인지 판정할 수 없습니다'
-                + ' — 이름을 확정할 수 없는 대상은 허용하지 않습니다.',
+            permissionDecisionReason: '[Holmes-Kit] the edit target path contains a NUL byte, so which file it is cannot be judged'
+                + ' — a target whose name cannot be pinned down is not allowed.',
         };
     }
     norm = norm.length > 1 ? norm.replace(/\/+$/, '') : norm;
@@ -964,15 +1033,15 @@ function evaluateHook(input, specsDir, opts) {
         if (rolesResolved === undefined) {
             return {
                 permissionDecision: 'deny',
-                permissionDecisionReason: '[Holmes-Kit] 역할 정책(.ax/roles/)은 이 게이트가 집행하는 권한 자체를 정의합니다 —'
-                    + ' 에이전트가 스스로 고칠 수 없습니다. config-write를 포함한 대역외 승인이 필요합니다.'
-                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: '역할 정책(.ax/roles/) 쓰기' }),
+                permissionDecisionReason: '[Holmes-Kit] the role policy (.ax/roles/) defines the very authority this gate enforces —'
+                    + ' an agent cannot change it itself. An out-of-band approval that includes config-write is required.'
+                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: 'writing the role policy (.ax/roles/)' }),
             };
         }
         if (rolesResolved.source === 'grant' && rolesResolved.approval.nonce)
             (0, approval_grants_1.consumeGrantFile)(opts.projectRoot, rolesResolved.approval.nonce);
     }
-    // @implements A-SPEC-191 §22 — 신원으로 묻는다. 철자 정규식은 프로젝트 안 링크 하나로 빗나갔다.
+    // @implements A-SPEC-191 §22 — ask by identity. A spelling regex was defeated by a single in-project link.
     const configKind = (0, write_target_1.protectedFileKindOf)(opts.projectRoot, norm);
     // @implements A-SPEC-163 — identity, not spelling. Measured: `.ax//ledger//p.jsonl`,
     // `.ax/./ledger/p.jsonl` and `.AX/roles/policy.yaml` all reached the protected file while the
@@ -982,11 +1051,11 @@ function evaluateHook(input, specsDir, opts) {
         // out-of-scope token does not, so config forgery cannot ride a narrow grant.
         const cfgResolved = (0, approval_grants_1.resolveApproval)(opts.projectRoot, weApproval, { kind: 'config-write', target: norm }, nowTs);
         if (cfgResolved === undefined) {
-            // @implements A-SPEC-193 §8 — 무엇을 막았는지 이름한다. 목록을 문장에 박아 두면 하네스가
-            // 늘 때마다 문면이 거짓이 된다(REQ-155: 엉뚱한 파일을 지목하는 진단의 값은 음수다).
-            const kindName = configKind ?? (0, write_target_1.protectedKindOf)(opts.projectRoot, norm) ?? '설정';
-            return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${kindName} 은(는) 훅·승인 설정입니다 — HOLMES_APPROVAL 을 위조하거나 거버넌스를 끌 수 있으므로 config-write 를 포함한 대역외 승인이 필요합니다`
-                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: `${kindName} 쓰기` }) };
+            // @implements A-SPEC-193 §8 — name what was blocked. Baking a list into the sentence makes the
+            // wording false as harnesses grow (REQ-155: a diagnosis that points at the wrong file has negative value).
+            const kindName = configKind ?? (0, write_target_1.protectedKindOf)(opts.projectRoot, norm) ?? 'config';
+            return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${kindName} is a hook/approval config — it can forge HOLMES_APPROVAL or turn governance off, so an out-of-band approval that includes config-write is required`
+                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: `writing ${kindName}` }) };
         }
         if (cfgResolved.source === 'grant' && cfgResolved.approval.nonce)
             (0, approval_grants_1.consumeGrantFile)(opts.projectRoot, cfgResolved.approval.nonce);
@@ -1092,7 +1161,7 @@ function evaluateHook(input, specsDir, opts) {
                 if (violations.length > 0) {
                     return {
                         permissionDecision: 'deny',
-                        permissionDecisionReason: '[Holmes-Kit] 구조 제약 위반 — 승인된 C-SPEC 이 금지한 형태입니다:\n'
+                        permissionDecisionReason: '[Holmes-Kit] structural-constraint violation — a shape an approved C-SPEC forbids:\n'
                             + violations.map((v) => '  - ' + v).join('\n')
                             + '\n' + proposed_content_1.CSPEC_GATE_LIMITS,
                     };
@@ -1138,7 +1207,7 @@ function evaluateHook(input, specsDir, opts) {
             // told `id "" fails …`. Splitting loses nothing and can collide with nothing.
             // Split on the spec's OWN id at a token boundary. A raw `split(id)` fired mid-token whenever
             // the id was a prefix of another id in the same sentence — measured: `A-SPEC-901` whose parent
-            // `A-SPEC-9011` is missing rendered `depends_on "해당 스펙1" not found`, destroying the one
+            // `A-SPEC-9011` is missing rendered `depends_on "that spec 1" not found`, destroying the one
             // fact the author needed. This repository's own dotted ids (`A-SPEC-100.1`) make the prefix
             // relation ordinary, not exotic.
             const selfRe = (id) => new RegExp(`(?<![\\w.-])${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w.-])`, 'g');
@@ -1168,7 +1237,7 @@ function evaluateHook(input, specsDir, opts) {
             let reasonLeft = REASON_MAX;
             // SKIP, never cut (round-4): truncation mid-sentence sliced spec ids into other (or
             // nonexistent) ids, split astral chars, and — worst — one pathological first group zeroed
-            // the budget so later SHORT sentences vanished under a FALSE '잘림' label. clampBlockers'
+            // the budget so later SHORT sentences vanished under a FALSE 'truncated' label. clampBlockers'
             // discipline instead: an oversized sentence is replaced whole by an honest omission label,
             // and fitting sentences keep rendering out of the shared budget.
             const OMIT_OVER = ' (reason exceeds text budget — verify spec individually)';
@@ -1176,7 +1245,7 @@ function evaluateHook(input, specsDir, opts) {
             const shown0 = groups.slice(0, DISTINCT_REASON_CAP);
             // @implements A-SPEC-192 §5R (round 9) — a SHARE, not a race. First-come-full-draw made the
             // budget a cliff: one 1,199-character sentence (just under the cap) took the whole allowance
-            // and every short sibling vanished behind '예산 소진', while making that same sentence TEN
+            // and every short sibling vanished behind 'budget exhausted', while making that same sentence TEN
             // characters LONGER flipped it to the omission label and brought the siblings back — a
             // refusal that improves when the input gets worse. Each group is guaranteed its equal share
             // first; whatever the short ones do not use is then offered to the rest in order.
@@ -1308,7 +1377,7 @@ function evaluateHook(input, specsDir, opts) {
     // Stale-aware gate (rev.1): a target A-SPEC whose seal is PRESENT and BROKEN (edited after
     // approval) or STALE (a parent moved) is not a trustworthy approval, so code must not be written
     // against it — even though its status still reads 'approved'. The denial names staleness and
-    // spec_approve, deliberately DISTINCT from phaseCheck's "…이 approved가 아닙니다" (REQ-130's lesson:
+    // spec_approve, deliberately DISTINCT from phaseCheck's "… is not approved" (REQ-130's lesson:
     // two different failures must not share the same words). An ABSENT seal falls through — the backfill
     // closes that window and the Stop hook's unsealed-approval error blocks the turn regardless.
     const resolveSpec = (id) => specs.find((s) => s.id === id) ?? null;
@@ -1322,14 +1391,14 @@ function evaluateHook(input, specsDir, opts) {
         if (!seal.approvedDigest)
             return null; // absent seal: backfill + Stop hook territory
         if ((0, spec_digest_1.specDigest)(spec) !== seal.approvedDigest)
-            return `${id}는 승인 이후 내용이 변경되었습니다(post-approval-edit)`;
+            return `${id} was edited after approval (post-approval-edit)`;
         for (const pid of spec.dependsOn) {
             const parent = resolveSpec(pid);
             if (!parent || parent.status !== 'approved')
                 continue;
             const parentSeal = (0, spec_digest_1.sealOf)(parent).approvedDigest;
             if (parentSeal && seal.parentDigests[pid] !== parentSeal)
-                return `${id}의 부모 ${pid}가 재승인되어 체인이 stale입니다(stale-parent)`;
+                return `${id}'s parent ${pid} was re-approved, so the chain is stale (stale-parent)`;
         }
         return null;
     };
@@ -1345,7 +1414,7 @@ function evaluateHook(input, specsDir, opts) {
     // @implements A-SPEC-133 — the override is authorized by a token covering the code write.
     const codeWriteCovered = (0, risk_gate_1.approvalCovers)(weApproval, { kind: 'code-write', target: relPath }, nowTs);
     if (staleTarget && !codeWriteCovered) {
-        return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${staleTarget} — spec_approve로 재승인 후 진행하세요` };
+        return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${staleTarget} — re-approve with spec_approve, then proceed` };
     }
     // @implements A-SPEC-152
     // Role gate — BEFORE the spec gate on purpose: if this identity may not perform the action at all,
@@ -1641,7 +1710,7 @@ if (require.main === module) {
                         // @implements A-SPEC-133 — a master-key use becomes an audit line: the approval's
                         // narrowing (or its absence) travels with the record (r7-191: promised, never shipped).
                         inputs: [input.tool_name, target,
-                            ...(unlocked ? [(0, provenance_chain_1.approvalMarkers)(approval)] : []), // 한 항목·마지막 자리 — 표지가 갈라져 자기모순이 되지 않는다
+                            ...(unlocked ? [(0, provenance_chain_1.approvalMarkers)(approval)] : []), // one item, last position — the marker cannot split and self-contradict
                         ].filter(Boolean),
                         // round-9: a deny inherited the actor/rationale/authorization of an ambient approval that
                         // did NOT cover it, so the audit line credited an authorizer who authorized nothing.

package/dist/holmes/hooks/session-start.js

@@ -158,6 +158,23 @@ if (require.main === module) {
                         out.hookSpecificOutput.additionalContext += notice;
                 }
                 catch { /* the banner is never a gate */ }
+                // @implements A-SPEC-554.1 — remind the human of the current autonomy posture (surface only, the
+                // headless hook never decides), and clean up an expired/invalid session marker. Fail-open.
+                try {
+                    const { autonomyBanner, autonomyMarkerShouldPrune, SESSION_AUTONOMY_MARKER } = require('../governance/autonomy');
+                    const cwd = process.cwd();
+                    const nowIso = new Date().toISOString();
+                    const line = autonomyBanner(process.env, cwd, nowIso);
+                    if (line)
+                        out.hookSpecificOutput.additionalContext += '\n' + line;
+                    if (autonomyMarkerShouldPrune(cwd, nowIso)) {
+                        try {
+                            fs.rmSync(path.join(cwd, ...SESSION_AUTONOMY_MARKER), { force: true });
+                        }
+                        catch { /* housekeeping only */ }
+                    }
+                }
+                catch { /* the banner is never a gate */ }
                 process.stdout.write(JSON.stringify({ hookSpecificOutput: out.hookSpecificOutput }));
                 if (out.shouldRefresh) {
                     // Detached, unref'd child so the session start does not wait on the network. The refresh

package/dist/holmes/hooks/stop.d.ts

@@ -12,7 +12,7 @@ import type { TestOutcome } from '../review/test-runner';
  * or validation errors, it BLOCKS the stop and feeds the findings back so the model must fix them
  * before finishing. No model cooperation required — the governance fires whether or not it is asked.
  *
- * HARDENING H1 (GWT-실테스트 bridge): declared 4-quadrant coverage previously verified only the
+ * HARDENING H1 (GWT-to-real-test bridge): declared 4-quadrant coverage previously verified only the
  * T-SPEC DOCUMENT. Now, for every approved T-SPEC, its parent A-SPEC must have at least one anchored
  * TEST FILE containing REAL test cases (`it(`/`test(`) — declared coverage over an empty/absent test
  * suite blocks the stop. Evidence is supplied by the CLI (I/O half); evaluateStop stays pure.

package/dist/holmes/hooks/stop.js

@@ -318,27 +318,27 @@ function evaluateStop(specs, evidence) {
     // @implements A-SPEC-191 (§4a) — an existing-but-unreadable findings ledger is not a clean turn:
     // it may hold an open critical, and a "clean" verdict here would also CLEAR standing ART-7 debt.
     if (evidence?.findingsUnreadable) {
-        problems.push('[ART-7] findings 원장을 읽을 수 없습니다 — 열린 치명 발견의 존재를 확인할 수 없는 턴은 깨끗한 턴이 아닙니다 (원장 파일의 권한·형식을 복구하십시오)');
-        structured.push({ article: 'ART-7', detail: 'findings 원장을 읽을 수 없습니다' });
+        problems.push('[ART-7] the findings ledger cannot be read — a turn that cannot confirm whether an open critical exists is not a clean turn (repair the ledger file\'s permissions/format)');
+        structured.push({ article: 'ART-7', detail: 'the findings ledger cannot be read' });
     }
     // @implements A-SPEC-452 — ART-1's second enforcement point. `undefined` is no signal and says
     // nothing; an empty array is measured and clean. A file that claims nothing is a file the write
     // gate never judged, which is exactly what the two-step generator bypass produces.
     for (const file of evidence?.unanchoredChangedSources ?? []) {
-        const detail = `${file}: 변경된 소스에 @implements 앵커가 없습니다 — 이 파일이 무엇을 구현하는지 말하지 않습니다 (승인된 A-SPEC 을 만들고 앵커를 다십시오)`;
+        const detail = `${file}: the changed source has no @implements anchor — it does not say what it implements (create an approved A-SPEC and add the anchor)`;
         problems.push(`[ART-1] ${detail}`);
         structured.push({ article: 'ART-1', detail });
     }
     // @implements A-SPEC-453 — ART-5's second enforcement point. The seal is forgeable; the record
     // of the approving act is not.
     for (const id of evidence?.unrecordedApprovals ?? []) {
-        const detail = `${id}: 승인 상태인데 원장에 승인 행위 기록이 없습니다 — 봉인은 내용 해시라 스스로를 증명하지 못합니다 (spec_approve 로 승인하십시오)`;
+        const detail = `${id}: it is in the approved state but the ledger has no record of the approving act — a seal is a content hash and cannot prove itself (approve with spec_approve)`;
         problems.push(`[ART-5] ${detail}`);
         structured.push({ article: 'ART-5', detail });
     }
     // @implements A-SPEC-455
     for (const file of evidence?.rolledBackLedgers ?? []) {
-        const detail = `${file}: 커밋된 원장 이력이 되돌려졌습니다 — 작업본이 커밋본을 접두로 포함하지 않습니다 (원장은 덧붙이기만 합니다; holmes-kit ledger rechain 으로 확인하십시오)`;
+        const detail = `${file}: the committed ledger history was rolled back — the working copy does not contain the committed copy as a prefix (the ledger is append-only; check with holmes-kit ledger rechain)`;
         problems.push(`[ART-2] ${detail}`);
         structured.push({ article: 'ART-2', detail });
     }
@@ -440,18 +440,18 @@ function acknowledgeStop(violations, pending) {
  */
 function describeTokenHealth(raw) {
     if (raw === undefined || raw === '')
-        return 'HOLMES_APPROVAL 토큰 없음 (읽기 전용 — 승인이 필요한 행위만 막힙니다)';
+        return 'no HOLMES_APPROVAL token (read-only — only actions that need approval are blocked)';
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        return 'HOLMES_APPROVAL 무효: JSON 파싱 실패 — 승인이 필요한 행위가 막힙니다';
+        return 'HOLMES_APPROVAL invalid: JSON parse failed — actions that need approval are blocked';
     }
     if (!(0, risk_gate_1.isValidApproval)(parsed)) {
-        return 'HOLMES_APPROVAL 무효: 필수 필드(actor·token·rationale) 누락 — 승인이 필요한 행위가 막힙니다';
+        return 'HOLMES_APPROVAL invalid: missing required field(s) (actor/token/rationale) — actions that need approval are blocked';
     }
-    return 'HOLMES_APPROVAL 유효';
+    return 'HOLMES_APPROVAL valid';
 }
 function decideStopGuard(wantsBlock, priorConsecutiveBlocks, cap = exports.MAX_CONSECUTIVE_BLOCKS) {
     if (!wantsBlock)
@@ -523,7 +523,7 @@ function findProjectRoot(specsDir) {
             if (r.marker !== 'given')
                 return r.root;
         }
-        catch { /* 표지가 없으면 짓지 않는다 */ }
+        catch { /* if there is no marker, build nothing */ }
         return null;
     }
     return null;
@@ -814,7 +814,7 @@ if (require.main === module) {
             else if (ackWaiting.length > 0) {
                 // @implements A-SPEC-247 — acknowledged, not clean: name what is waiting so the user sees
                 // the standing approval debt exactly once, and the agent knows the ball is not in its court.
-                process.stderr.write(`[Holmes-Kit] 승인 대기 중 — 오너 결정을 기다리는 항목: ${ackWaiting.join(', ')}. ${(0, npx_bin_1.npxBin)()} holmes-kit approve 에서 결재하십시오. (이 부채로는 재차단하지 않습니다)\n`);
+                process.stderr.write(`[Holmes-Kit] awaiting approval — items waiting on the owner's decision: ${ackWaiting.join(', ')}. Decide them at ${(0, npx_bin_1.npxBin)()} holmes-kit approve. (This debt does not re-block.)\n`);
             }
             else if (guard.capped) {
                 process.stderr.write(`[Holmes-Kit] governance gate YIELDING after ${exports.MAX_CONSECUTIVE_BLOCKS} consecutive blocks — issues remain UNRESOLVED:\n${out.reason ?? ''}\n`);
@@ -826,7 +826,7 @@ if (require.main === module) {
         }
         catch (err) {
             process.stderr.write(`[Holmes-Kit Stop Hook] Error: ${err instanceof Error ? err.message : String(err)}\n`);
-            process.exitCode = 0; // fail-open — exitCode 로 파이프를 비운 뒤 자연 종료(잘림 방지)
+            process.exitCode = 0; // fail-open — drain the pipe via exitCode, then exit naturally (avoids truncation)
         }
     });
 }

package/dist/holmes/mcp/handlers.js

@@ -1383,10 +1383,23 @@ function makeRawHandlers(store, opts) {
                     // itself. The switch is env-only and an agent cannot set it (pre-tool-use blocks that,
                     // A-SPEC-532.2). Off, or a hitl-classed spec, falls straight through to the elicitor
                     // unchanged — the autonomous-OFF path is byte-identical to before.
-                    if ((0, autonomy_1.autonomousApprovalEnabled)(process.env)
+                    // @implements A-SPEC-553.1 — autonomy is the out-of-band env switch OR a valid, non-expired
+                    // session envelope marker under this project's `.ax/state/` (which an agent cannot write).
+                    const autonomyOn = (0, autonomy_1.autonomousApprovalEnabled)(process.env, a.root, new Date().toISOString());
+                    if (autonomyOn
                         && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec])) === 'auto') {
                         approveResolved = { approval: autonomousApproval(), source: 'autonomous' };
                     }
+                    else if (autonomyOn) {
+                        // @implements A-SPEC-551.1 — hitl-grade spec under autonomy: the in-session elicitation
+                        // dialog is auto-acceptable by an auto-mode client (the protocol cannot tell a human
+                        // from an auto-accept), so a governance-critical spec is never offered it. Do nothing
+                        // here — approveResolved stays undefined and the fail-closed refuse+enqueue path below
+                        // routes the act to the out-of-band human queue (holmes-kit approve). The A-SPEC-532.1
+                        // bound ("governance-critical specs never leave the human channel") thus becomes
+                        // ENFORCED, not aspirational. Autonomy OFF (the else) and the auto-grade branch above
+                        // stay byte-identical to before.
+                    }
                     else {
                         const resealing = typeof target.spec.frontmatter.approved_digest === 'string';
                         // The MODEL text is capped BEFORE the server markers are appended (round-2): a ~185+ char

package/dist/holmes/semantic/credentials.js

@@ -44,7 +44,7 @@ exports.removeSemanticKey = removeSemanticKey;
  * an agent assigning the env names (self-granted egress, the HOLMES_ROLE class); this module owns
  * the storage the human's CLI act writes to. A project-tree file is NEVER a source — a tree file
  * is a commit-accident surface and readable by every in-session tool, which is exactly what the
- * owner's ".env 는 임시 조치" call-out named.
+ * owner's ".env is a stopgap" call-out named.
  *
  * Resolution chain, the order being the contract:
  *   1. HOLMES_SEMANTIC_API_KEY  — dedicated name, CI/headless.

package/dist/holmes/spec/id-collision.js

@@ -49,13 +49,13 @@ function detectIdCollisions(entries) {
                 sealContents.set(en.approvedDigest, new Set([en.contentDigest]));
         }
         const sharedSeals = [...sealContents.entries()].filter(([, cs]) => cs.size > 1).map(([s]) => s).sort();
-        const parts = [...byKey.entries()].sort().map(([k, ens]) => `${k}[seal=${[...new Set(ens.map((en) => en.approvedDigest ?? '없음'))].sort().join('|')}] ← ${ens.map((en) => en.file).sort().join(', ')}`);
+        const parts = [...byKey.entries()].sort().map(([k, ens]) => `${k}[seal=${[...new Set(ens.map((en) => en.approvedDigest ?? 'none'))].sort().join('|')}] ← ${ens.map((en) => en.file).sort().join(', ')}`);
         issues.push({
             kind: 'id-collision',
             id,
             files: group.map((en) => en.file).sort(),
             detail: parts.join(' / ')
-                + (sharedSeals.length > 0 ? ` — 같은 approved_digest 를 서로 다른 내용이 공유(${sharedSeals.join(', ')}): post-approval edit 또는 봉인 복사 의심` : ''),
+                + (sharedSeals.length > 0 ? ` — different contents share the same approved_digest (${sharedSeals.join(', ')}): suspected post-approval edit or seal copy` : ''),
         });
     }
     // --- family-coexistence: a bare A/T-SPEC id alongside its own dot-suffix family ---