@holmes-lab/holmes-kit 0.12.2 → 0.14.0

package/dist/holmes/guardrail/blind-spots.js

@@ -3,12 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GATE_BLIND_SPOTS = void 0;
 exports.blindSpotSummary = blindSpotSummary;
 exports.GATE_BLIND_SPOTS = [
-    { example: 'node ./cleanup.js', why: '스크립트 파일의 내용은 명령 문자열에 없습니다' },
-    { example: 'bash ./deploy.sh', why: '같은 이유 — 실행할 내용이 파일 안에 있습니다' },
-    { example: 'npm run clean', why: 'package.json의 스크립트 정의가 명령 문자열 밖에 있습니다' },
-    { example: 'make distclean', why: 'Makefile의 규칙이 명령 문자열 밖에 있습니다' },
-    { example: 'CMD="something"; $CMD', why: '실행될 명령이 실행 시점에 조립됩니다' },
-    { example: 'xargs rm < targets.txt', why: '대상 목록이 표준 입력으로 들어옵니다' },
+    { example: 'node ./cleanup.js', why: 'the script file\'s contents are not in the command string' },
+    { example: 'bash ./deploy.sh', why: 'same reason — what runs lives inside the file' },
+    { example: 'npm run clean', why: 'the script definition in package.json is outside the command string' },
+    { example: 'make distclean', why: 'the Makefile rule is outside the command string' },
+    { example: 'CMD="something"; $CMD', why: 'the command to run is assembled at execution time' },
+    { example: 'xargs rm < targets.txt', why: 'the target list arrives on standard input' },
 ];
 /**
  * One line for `doctor`.
@@ -18,23 +18,23 @@ exports.GATE_BLIND_SPOTS = [
  * parts include creating the script in the first place.
  */
 function blindSpotSummary() {
-    return '가드레일은 명령 문자열을 검사합니다 — 이미 저장소에 있는 스크립트를 실행하는 명령'
-        + `(${exports.GATE_BLIND_SPOTS.slice(0, 3).map((b) => b.example).join(', ')} 등)의 내용은 보지 못합니다.`
-        + ' 스크립트를 새로 작성하는 것은 승인이 필요합니다(A-SPEC-167).'
+    return 'The guardrail inspects the command string — it cannot see the contents of a command that runs a script already in the repository'
+        + ` (e.g. ${exports.GATE_BLIND_SPOTS.slice(0, 3).map((b) => b.example).join(', ')}).`
+        + ' Writing a new script requires approval (A-SPEC-167).'
         // @implements A-SPEC-170
         // Stated, not implied. Four sweep rounds each found runner-manifest names the previous round's
         // list had missed, so calling the list complete would be false — and this is the one place the
         // harness tells a user what it cannot see. It belongs in the prose, not in GATE_BLIND_SPOTS,
         // whose entries are commands a test executes against the gate.
-        + ' 루트 러너 매니페스트(Rakefile·Gemfile 등)의 이름 목록은 완전하지 않습니다 — 생태계마다 새로 생깁니다.'
+        + ' The list of root runner-manifest names (Rakefile, Gemfile, etc.) is not complete — every ecosystem adds new ones.'
         // @implements A-SPEC-175
         // The residual after REQ-175. Losing `.ax/specs` is now detected, because the ledger records the
         // approvals and `init`'s .gitignore block keeps `provenance*.jsonl` committed. Losing the whole
         // `.ax` takes that evidence with it, and a project then looks like one that never opted in. Every
         // shell route to either state is denied by this gate; what remains is deletion from outside the
         // session, and saying so is the only honest option left.
-        + ' `.ax` 전체가 세션 밖에서 삭제되면(에디터·Finder·세션 밖 git) 원장도 함께 사라져'
-        + ' 거버넌스를 켠 적 없는 프로젝트와 구별되지 않습니다 — `.ax/specs`만 사라진 경우는 탐지됩니다(REQ-175).'
+        + ' If the whole `.ax` is deleted from outside the session (editor, Finder, git outside the session), the ledger goes with it,'
+        + ' making the project indistinguishable from one that never opted in — losing only `.ax/specs` is detected (REQ-175).'
         // @implements A-SPEC-421
         // Measured against the INSTALLED build, which is the only place it shows: `tool_name: "Bash"`
         // with `rm -rf /` is denied and `tool_name: "mcp__shell__run"` with the same command is allowed.
@@ -43,7 +43,7 @@ function blindSpotSummary() {
         // is the shape of the gap, not a hypothetical. Denying unknown names instead was considered and
         // rejected: it would refuse every harness's Read, Grep and search tools and leave the guardrail
         // unusable. What is fixable here is the map, and an undeclared gap reads as coverage.
-        + ' 게이트는 **도구 이름**으로 판정하므로 이름을 모르는 도구는 검사하지 않습니다 —'
-        + ' MCP 서버가 제공하는 도구(`mcp__<서버>__<도구>`)는 셸을 실행하더라도 이 게이트를 거치지'
-        + ' 않습니다. MCP 서버는 각자의 승인 경로로 통제하십시오.';
+        + ' The gate dispatches on the **tool name**, so a tool whose name it does not know is not inspected —'
+        + ' a tool provided by an MCP server (`mcp__<server>__<tool>`) does not pass through this gate even when it runs a shell.'
+        + ' Control MCP servers through their own approval paths.';
 }

package/dist/holmes/guardrail/dependency-delta.d.ts

@@ -0,0 +1,3 @@
+export type DepLang = 'ts' | 'py';
+export declare function externalImportsOf(source: string, lang: DepLang): Set<string>;
+export declare function dependencyDelta(before: string, after: string, lang: DepLang): string[];

package/dist/holmes/guardrail/dependency-delta.js

@@ -0,0 +1,118 @@
+"use strict";
+// @implements A-SPEC-559.1
+// @implements A-SPEC-560.1
+// Pure external-dependency-delta detector: given a source file's content, extract its EXTERNAL
+// (non-relative, "bare") import specifiers normalized to the top-level package, and report which
+// external packages a before→after change newly introduces. The repo convention is `importTargetOf`'s
+// (`guardrail/forbidden-edges.ts`): a `.`-prefixed specifier is relative (internal); anything else is
+// external. Pure, deterministic, never throws — the git/env/queue wiring lives in the Stop hook.
+//
+// Hardened after the post-ship adversarial audit (REQ-560): prettier-style MULTILINE imports are the
+// most common real-world form and the original line-anchored regex missed them entirely; CRLF files
+// broke line-comment stripping into false deltas; a string-embedded `/*` swallowed real imports; and
+// the un-anchored require()/import() patterns matched inside string literals (our own test fixtures
+// self-triggered). The pipeline below is: normalize CRLF → strip line-START block comments only →
+// strip template/triple-quoted literals → strip line comments (URL-preserving) → match, with a
+// quote-parity rejection for require()/import() so string-embedded calls stay silent.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalImportsOf = externalImportsOf;
+exports.dependencyDelta = dependencyDelta;
+// A new import of one of these is a language builtin, not an added third-party dependency, so it is
+// NOT an architecture-drift signal. The lists are deliberately common-case, not exhaustive: a missed
+// builtin only produces an observe-first warning, never a block.
+const TS_BUILTINS = new Set([
+    'fs', 'path', 'os', 'crypto', 'util', 'events', 'stream', 'http', 'https', 'url', 'child_process',
+    'process', 'assert', 'buffer', 'net', 'tls', 'zlib', 'querystring', 'string_decoder', 'timers',
+    'tty', 'dgram', 'dns', 'readline', 'repl', 'vm', 'worker_threads', 'cluster', 'perf_hooks',
+    'async_hooks', 'v8', 'module', 'constants', 'punycode', 'inspector', 'diagnostics_channel', 'test',
+]);
+const PY_STDLIB = new Set([
+    'os', 'sys', 're', 'json', 'typing', 'pathlib', 'subprocess', 'time', 'datetime', 'collections',
+    'itertools', 'functools', 'math', 'random', 'logging', 'io', 'abc', 'enum', 'dataclasses', 'asyncio',
+    'contextlib', 'hashlib', 'base64', 'tempfile', 'shutil', 'glob', 'argparse', 'unittest', 'threading',
+    'queue', 'socket', 'struct', 'copy', 'warnings', 'traceback', 'inspect', 'textwrap', 'operator',
+    'importlib', 'urllib', 'pickle', 'csv', 'uuid', 'string', 'multiprocessing', 'concurrent', 'sqlite3',
+    'secrets', 'signal', 'types', 'ast', 'email', 'http', 'xml', 'array',
+]);
+/** Is position `idx` of `line` inside a single- or double-quoted string? (parity of quotes before it) */
+function insideString(line, idx) {
+    let sq = 0, dq = 0;
+    for (let i = 0; i < idx; i++) {
+        const c = line[i];
+        if (c === "'")
+            sq += 1;
+        else if (c === '"')
+            dq += 1;
+    }
+    return sq % 2 === 1 || dq % 2 === 1;
+}
+/** Top-level package of a TS/JS specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
+function tsTopLevel(spec) {
+    const parts = spec.split('/');
+    return spec.startsWith('@') && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0];
+}
+function externalImportsOf(source, lang) {
+    const out = new Set();
+    try {
+        let src = source.replace(/\r\n?/g, '\n'); // CRLF/CR → LF first
+        if (lang === 'ts') {
+            // Line-START-anchored block comments only: kills a commented-out import block WITHOUT letting a
+            // string-embedded "/*" swallow the real code after it (and keeps the scan linear — the engine
+            // only attempts matches at line starts).
+            src = src.replace(/^[ \t]*\/\*[\s\S]*?\*\//gm, '');
+            src = src.replace(/`[^`]*`/g, '``'); // template literals are data
+            src = src.replace(/(?<!:)\/\/.*$/gm, ''); // line comments; `https://` survives
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.') || raw.startsWith('node:'))
+                    return;
+                const pkg = tsTopLevel(raw);
+                if (pkg !== '' && !TS_BUILTINS.has(pkg))
+                    out.add(pkg);
+            };
+            // A from-clause ENDS some line — any non-quote prefix, so prettier's `} from 'pkg'` is caught.
+            for (const m of src.matchAll(/^[^'"`\n]*\bfrom\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]);
+            for (const m of src.matchAll(/^\s*import\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]); // side-effect import
+            // require()/dynamic import() are position-free, so reject matches sitting inside a string
+            // literal (quote parity before the match on its line) and method calls (`loader.require`).
+            for (const line of src.split('\n')) {
+                for (const m of line.matchAll(/(?<!\.)\brequire\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+                for (const m of line.matchAll(/\bimport\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+            }
+        }
+        else {
+            src = src.replace(/"""[\s\S]*?"""/g, '').replace(/'''[\s\S]*?'''/g, ''); // docstrings are data
+            src = src.split('\n').map((l) => l.replace(/#.*$/, '')).join('\n');
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.'))
+                    return;
+                const pkg = raw.split('.')[0];
+                if (pkg !== '' && !PY_STDLIB.has(pkg))
+                    out.add(pkg);
+            };
+            for (const m of src.matchAll(/^\s*import\s+(.+)$/gm)) {
+                // `import a, b as c` — every comma part counts; sanitize each to a leading dotted name so a
+                // trailing `;`/comment fragment can never fabricate a package token.
+                for (const part of m[1].split(','))
+                    add(/^[A-Za-z_][\w.]*/.exec(part.trim())?.[0]);
+            }
+            for (const m of src.matchAll(/^\s*from\s+([.\w]+)\s+import\b/gm))
+                add(m[1]);
+        }
+    }
+    catch {
+        return out; // never throw — observe-first
+    }
+    return out;
+}
+function dependencyDelta(before, after, lang) {
+    const had = externalImportsOf(before, lang);
+    return [...externalImportsOf(after, lang)].filter((x) => !had.has(x)).sort();
+}

package/dist/holmes/hooks/pre-tool-use.js

@@ -305,7 +305,7 @@ function preEditEvidenceGate(o) {
 }
 function decideOnGateError(opts) {
     if (opts.bypass) {
-        return { permissionDecision: 'allow', permissionDecisionReason: `[Holmes-Kit] 내부 오류를 HOLMES_GATE_BYPASS로 우회했습니다: ${opts.message}` };
+        return { permissionDecision: 'allow', permissionDecisionReason: `[Holmes-Kit] an internal error was bypassed via HOLMES_GATE_BYPASS: ${opts.message}` };
     }
     if (!opts.governed)
         return { permissionDecision: 'allow' };
@@ -313,8 +313,8 @@ function decideOnGateError(opts) {
     // spec chain that was never the problem.
     return {
         permissionDecision: 'deny',
-        permissionDecisionReason: `[Holmes-Kit] 내부 오류로 판정할 수 없습니다 — 게이트는 판정 불가 시 허용하지 않습니다: ${opts.message}`
-            + ' → `holmes-kit doctor`로 설치를 점검하세요. 운영자 판단으로 통과시키려면 환경에 HOLMES_GATE_BYPASS=1을 설정하십시오(세션이 스스로 설정할 수 없는 대역외 채널).',
+        permissionDecisionReason: `[Holmes-Kit] cannot judge due to an internal error — the gate does not allow when it cannot decide: ${opts.message}`
+            + ' → check the install with `holmes-kit doctor`. To let it through by operator judgment, set HOLMES_GATE_BYPASS=1 in the environment (an out-of-band channel a session cannot set itself).',
     };
 }
 // @implements A-SPEC-514.1
@@ -479,7 +479,7 @@ function evaluateHook(input, specsDir, opts) {
             // first legitimate use in every new project. The single-use guarantee still holds: the record
             // lands in the resolved root, which is the same file every later call resolves to.
             if ((0, provenance_chain_1.blankNonce)(acting?.nonce)) {
-                return deny('승인이 단일 사용(nonce)을 선언했으나 값이 비어 있습니다 — 1회성을 집행할 수 없어 거부합니다');
+                return deny('the approval declared single-use (nonce) but the value is empty — single-use cannot be enforced, so it is denied');
             }
             if (acting?.nonce) {
                 let won;
@@ -579,8 +579,8 @@ function evaluateHook(input, specsDir, opts) {
                 return {
                     permissionDecision: 'deny',
                     permissionDecisionReason: GRANTS_SELF
-                        ? '[Holmes-Kit] 명령이 HOLMES_ROLE/HOLMES_GATE_BYPASS를 지정하거나 읽습니다 — 세션이 스스로 권한을 부여하는 경로입니다.'
-                            + ' 역할은 에이전트를 기동하는 사람이 대역외로 정합니다. 운영자 판단으로 실행하려면 config-write를 포함한 승인이 필요합니다.'
+                        ? '[Holmes-Kit] the command sets or reads HOLMES_ROLE/HOLMES_GATE_BYPASS — a path by which a session grants itself authority.'
+                            + ' Roles are set out-of-band by whoever launches the agent. To run it by operator judgment, an approval that includes config-write is required.'
                         : '[Holmes-Kit] command reads or dumps process environment (holds the out-of-band HOLMES_APPROVAL / HOLMES_LEDGER_KEY secrets) — requires out-of-band approval',
                 };
             }
@@ -624,7 +624,7 @@ function evaluateHook(input, specsDir, opts) {
                 // containing that letter. Caught by a test, not by reading.
                 // @implements A-SPEC-463 — the path sits BETWEEN quotes here, so spaces inside it are part
                 // of the path, not an argument boundary. `[^'"\s]*` stopped at the first space and missed
-                // `open('C:\Users\이름 성\a.ts','w')`; `[^'"]*` keeps the space and still cannot cross a quote.
+                // `open('C:\Users\Given Family\a.ts','w')`; `[^'"]*` keeps the space and still cannot cross a quote.
                 const NOT_QUOTE = String.raw `[^'"]*`;
                 const QUOTED_PATH = new RegExp(String.raw `['"](` + NOT_QUOTE + String.raw `\.` + CODE_EXT + '|' + NOT_QUOTE + CONFIG_FILE + String.raw `)['"]`, 'g');
                 const out = [];
@@ -644,7 +644,7 @@ function evaluateHook(input, specsDir, opts) {
             // @implements A-SPEC-463 — Windows W-2. The extraction below approximated a path with a
             // character class that excludes spaces (`[^\s...]*`) preceded by an OPTIONAL opening quote
             // that no closing quote ever paired. A quoted path with a space — the Windows default home is
-            // `C:\Users\<이름 성>` — matched only up to the first space, never reached the extension, and
+            // `C:\Users\<Given Family>` — matched only up to the first space, never reached the extension, and
             // was captured as nothing, so the write was allowed. `pathAlt` is three alternatives: a
             // double- or single-quoted path (spaces kept, up to the closing quote) or the unquoted form
             // (still ends at the first shell word boundary — an un-escaped space is an argument break).
@@ -740,6 +740,7 @@ function evaluateHook(input, specsDir, opts) {
             // which is an ordinary backup and not this gate's business.
             // (A data heredoc body may still carry separators inside one segment, so the per-segment
             // text is split the way the whole command used to be — the base is the segment's either way.)
+            const CODE_TAIL_RE = new RegExp(`\\.${CODE_EXT}$`);
             for (const seg of segments) {
                 for (const sub of seg.text.split(/[;|&]+/)) {
                     if (!/\b(?:cp|mv|install|rsync|ln|dd)\b/.test(sub))
@@ -752,10 +753,72 @@ function evaluateHook(input, specsDir, opts) {
                             continue;
                         }
                     }
-                    const all = [...sub.matchAll(new RegExp(pathAlt(EXT_TAIL), 'g'))]
-                        .map(firstGroup).filter((x) => x !== undefined);
-                    if (all.length >= 2)
-                        candidates.push({ raw: all[all.length - 1], base: seg.base }); // last path is the destination
+                    // @implements A-SPEC-550.1 — for cp/mv/install/rsync/ln the DESTINATION is the last path
+                    // argument, whatever the source's extension. The old rule matched only code-extension paths
+                    // and required >=2 of them, so a NON-code source left the destination as the sole code path
+                    // and walked through: `cp /tmp/x.txt src/a.ts`, `install /dev/null src/a.ts`, and even
+                    // `cp /dev/stdin src/a.ts <<EOF` (content in the command). Judge the destination directly.
+                    // A code path that is a SOURCE (not last) is not the destination and is left alone, so a
+                    // read-out backup `cp src/a.ts /tmp/backup.ts` (destination outside) still resolves 'out'.
+                    const head = sub.split(/<<|>>|>/)[0]; // drop a heredoc/redirect tail
+                    // Quote-aware tokens: a quoted string is ONE argument even with spaces (Windows W-2 /
+                    // A-SPEC-463 — a backup to `"C:\Users\Full Name\a.ts"` must not be split into two).
+                    const rawToks = head.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+                    const unq = (t) => t.replace(/^['"]|['"]$/g, '');
+                    // @implements A-SPEC-557.1 — judge the LANDING path, not the last token's extension. GNU
+                    // `-t DIR`/`--target-directory[=]DIR` name an explicit destination directory and make every
+                    // positional a SOURCE; and a destination that is a directory lands each source at
+                    // `dir/basename(src)`. Both slipped a code file into the governed tree unjudged before.
+                    let targetDir;
+                    const positional = [];
+                    for (let i = 0; i < rawToks.length; i++) {
+                        const t = rawToks[i];
+                        const eq = /^--target-directory=(.+)$/.exec(t);
+                        if (eq) {
+                            targetDir = unq(eq[1]);
+                            continue;
+                        }
+                        if (t === '-t' || t === '--target-directory') {
+                            const n = rawToks[i + 1];
+                            if (n !== undefined) {
+                                targetDir = unq(n);
+                                i++;
+                            }
+                            continue;
+                        }
+                        if (t.startsWith('-'))
+                            continue; // any other flag
+                        positional.push(unq(t));
+                    }
+                    const baseName = (s) => s.split(/[/\\]/).pop() ?? s;
+                    const stripSlash = (s) => s.replace(/[/\\]+$/, '');
+                    const pushLanding = (destDir, sources) => {
+                        for (const src of sources)
+                            if (CODE_TAIL_RE.test(src))
+                                candidates.push({ raw: `${stripSlash(destDir)}/${baseName(src)}`, base: seg.base });
+                    };
+                    const looksLikeDir = (d) => {
+                        if (/[/\\]$/.test(d))
+                            return true; // trailing separator = explicit dir
+                        try {
+                            const abs = (0, write_target_1.absoluteKindOf)(d) !== null ? d : (seg.base === null ? undefined : (0, write_target_1.pathFlavorFor)(seg.base, d).resolve(seg.base, d));
+                            return abs !== undefined && fs.statSync(abs).isDirectory();
+                        }
+                        catch {
+                            return false;
+                        } // non-existent / unreadable ⇒ a file, not a dir
+                    };
+                    const argv = positional.slice(1); // positional[0] is the tool name
+                    if (targetDir !== undefined) {
+                        pushLanding(targetDir, argv); // -t DIR: every positional is a source
+                    }
+                    else if (argv.length >= 2) {
+                        const dest = argv[argv.length - 1];
+                        if (CODE_TAIL_RE.test(dest))
+                            candidates.push({ raw: dest, base: seg.base }); // dest is a code file
+                        else if (looksLikeDir(dest))
+                            pushLanding(dest, argv.slice(0, -1)); // dest is a directory
+                    }
                 }
             }
             // @implements A-SPEC-447 — same predicate as the config rule; it lived in two copies, which
@@ -772,7 +835,12 @@ function evaluateHook(input, specsDir, opts) {
                 return { permissionDecision: 'deny', permissionDecisionReason: UNRESOLVED_BASE_DENY };
             }
             if (codeVerdicts.includes('in') || codeVerdicts.includes('unknown')) {
-                const governed = readSpecsSync(specsDir).some((s) => s.status === 'approved');
+                // @implements A-SPEC-550.1 — governance is "specs EXIST", not "a spec is approved". The old
+                // `some(status==='approved')` slept through the authoring window: after `spec_slice_init` and
+                // before approval a repo has DRAFT specs, so `cat > test/x.test.js <<EOF` walked through while
+                // Write/Edit denied the same unapproved anchor — the exact tool-vs-shell asymmetry reported.
+                // A truly spec-less repo still has zero specs here, so ordinary ungoverned coding stays free.
+                const governed = readSpecsSync(specsDir).length > 0;
                 if (governed) {
                     return codeVerdicts.includes('in')
                         ? { permissionDecision: 'deny', permissionDecisionReason: '[Holmes-Kit] shell write to a project code file bypasses the No-Spec-No-Code gate — use the Write/Edit tools (gated) or supply out-of-band approval' }
@@ -786,7 +854,7 @@ function evaluateHook(input, specsDir, opts) {
     }
     // @implements A-SPEC-191 §27 (round 13) — `PATH_FIELDS` exists because `notebook_path` slipped
     // past a gate that knew only `file_path`, and this line still knew only `file_path`: a valid
-    // NotebookEdit was denied in EVERY project with "편집 대상 경로를 읽을 수 없습니다", which names
+    // NotebookEdit was denied in EVERY project with "cannot read the edit target path", which names
     // the wrong fault (the path was there and readable) and blocks a legitimate tool outright.
     const p1 = typeof input.tool_input.file_path === 'string' ? input.tool_input.file_path : undefined;
     const p2 = typeof input.tool_input.notebook_path === 'string' ? input.tool_input.notebook_path : undefined;
@@ -804,7 +872,7 @@ function evaluateHook(input, specsDir, opts) {
         // has to recognise.
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로를 읽을 수 없어 판정할 수 없습니다 (file_path 누락 또는 문자열이 아님)',
+            permissionDecisionReason: '[Holmes-Kit] cannot read the edit target path, so it cannot be judged (file_path missing or not a string)',
         };
     }
     const writesCode = (0, write_target_1.writesFiles)(input.tool_name, input.tool_input);
@@ -818,8 +886,8 @@ function evaluateHook(input, specsDir, opts) {
     if (writesCode && !p) {
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로를 읽을 수 없어 판정할 수 없습니다 (file_path 누락 또는 문자열이 아님)'
-                + ' — 이름을 알 수 없는 파일이 승인된 스펙에 덮이는지 확인할 방법이 없으므로 허용하지 않습니다.',
+            permissionDecisionReason: '[Holmes-Kit] cannot read the edit target path, so it cannot be judged (file_path missing or not a string)'
+                + ' — there is no way to check whether an unnamed file overwrites an approved spec, so it is not allowed.',
         };
     }
     if (!p || !writesCode)
@@ -880,9 +948,9 @@ function evaluateHook(input, specsDir, opts) {
         // nothing to govern"; an undecidable target is refused, not allowed.
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 네트워크 경로(UNC)는 로컬 파일시스템 정체로 해석할 수 없어'
-                + ' 프로젝트 안팎을 판정할 수 없습니다 — 판정할 수 없는 대상은 허용하지 않습니다.'
-                + ' 프로젝트를 로컬 드라이브에 두거나 드라이브 문자로 매핑한 경로를 사용하십시오.',
+            permissionDecisionReason: '[Holmes-Kit] a network path (UNC) cannot be resolved to a local filesystem identity,'
+                + ' so it cannot be judged inside or outside the project — an untellable target is not allowed.'
+                + ' Put the project on a local drive, or use a drive-letter-mapped path.',
         };
     }
     if (absKind === 'posix' || absKind === 'drive') {
@@ -918,8 +986,9 @@ function evaluateHook(input, specsDir, opts) {
             }
         })();
         const fold = (s) => (caseBlind ? s.toLowerCase() : s);
-        // 접기는 해석된 위치에만 적용한다 — 철자 그대로의 norm 을 접어 '안'이라 부르면, 프로젝트
-        // 밖을 가리키는 링크가 이름만으로 안에 들어온다. 해석이 먼저, 접기는 그 위에서.
+        // Case-folding applies only to the RESOLVED location — folding the literal-spelling norm and
+        // calling it 'inside' lets a link that points OUTSIDE the project enter by name alone. Resolve
+        // first, fold on top of that.
         const canonical = inside(norm, projectRoot) ? asProject(norm, projectRoot)
             : inside(realTarget, realRoot) ? asProject(realTarget, realRoot)
                 : inside(fold(realTarget), fold(realRoot)) ? asProject(realTarget, realRoot)
@@ -936,8 +1005,8 @@ function evaluateHook(input, specsDir, opts) {
     if (norm.includes('\u0000')) {
         return {
             permissionDecision: 'deny',
-            permissionDecisionReason: '[Holmes-Kit] 편집 대상 경로에 NUL 바이트가 있어 어느 파일인지 판정할 수 없습니다'
-                + ' — 이름을 확정할 수 없는 대상은 허용하지 않습니다.',
+            permissionDecisionReason: '[Holmes-Kit] the edit target path contains a NUL byte, so which file it is cannot be judged'
+                + ' — a target whose name cannot be pinned down is not allowed.',
         };
     }
     norm = norm.length > 1 ? norm.replace(/\/+$/, '') : norm;
@@ -964,15 +1033,15 @@ function evaluateHook(input, specsDir, opts) {
         if (rolesResolved === undefined) {
             return {
                 permissionDecision: 'deny',
-                permissionDecisionReason: '[Holmes-Kit] 역할 정책(.ax/roles/)은 이 게이트가 집행하는 권한 자체를 정의합니다 —'
-                    + ' 에이전트가 스스로 고칠 수 없습니다. config-write를 포함한 대역외 승인이 필요합니다.'
-                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: '역할 정책(.ax/roles/) 쓰기' }),
+                permissionDecisionReason: '[Holmes-Kit] the role policy (.ax/roles/) defines the very authority this gate enforces —'
+                    + ' an agent cannot change it itself. An out-of-band approval that includes config-write is required.'
+                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: 'writing the role policy (.ax/roles/)' }),
             };
         }
         if (rolesResolved.source === 'grant' && rolesResolved.approval.nonce)
             (0, approval_grants_1.consumeGrantFile)(opts.projectRoot, rolesResolved.approval.nonce);
     }
-    // @implements A-SPEC-191 §22 — 신원으로 묻는다. 철자 정규식은 프로젝트 안 링크 하나로 빗나갔다.
+    // @implements A-SPEC-191 §22 — ask by identity. A spelling regex was defeated by a single in-project link.
     const configKind = (0, write_target_1.protectedFileKindOf)(opts.projectRoot, norm);
     // @implements A-SPEC-163 — identity, not spelling. Measured: `.ax//ledger//p.jsonl`,
     // `.ax/./ledger/p.jsonl` and `.AX/roles/policy.yaml` all reached the protected file while the
@@ -982,11 +1051,11 @@ function evaluateHook(input, specsDir, opts) {
         // out-of-scope token does not, so config forgery cannot ride a narrow grant.
         const cfgResolved = (0, approval_grants_1.resolveApproval)(opts.projectRoot, weApproval, { kind: 'config-write', target: norm }, nowTs);
         if (cfgResolved === undefined) {
-            // @implements A-SPEC-193 §8 — 무엇을 막았는지 이름한다. 목록을 문장에 박아 두면 하네스가
-            // 늘 때마다 문면이 거짓이 된다(REQ-155: 엉뚱한 파일을 지목하는 진단의 값은 음수다).
-            const kindName = configKind ?? (0, write_target_1.protectedKindOf)(opts.projectRoot, norm) ?? '설정';
-            return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${kindName} 은(는) 훅·승인 설정입니다 — HOLMES_APPROVAL 을 위조하거나 거버넌스를 끌 수 있으므로 config-write 를 포함한 대역외 승인이 필요합니다`
-                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: `${kindName} 쓰기` }) };
+            // @implements A-SPEC-193 §8 — name what was blocked. Baking a list into the sentence makes the
+            // wording false as harnesses grow (REQ-155: a diagnosis that points at the wrong file has negative value).
+            const kindName = configKind ?? (0, write_target_1.protectedKindOf)(opts.projectRoot, norm) ?? 'config';
+            return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${kindName} is a hook/approval config — it can forge HOLMES_APPROVAL or turn governance off, so an out-of-band approval that includes config-write is required`
+                    + (0, approval_queue_1.queueHint)(opts.projectRoot, { kind: 'config-write', target: norm, why: `writing ${kindName}` }) };
         }
         if (cfgResolved.source === 'grant' && cfgResolved.approval.nonce)
             (0, approval_grants_1.consumeGrantFile)(opts.projectRoot, cfgResolved.approval.nonce);
@@ -1092,7 +1161,7 @@ function evaluateHook(input, specsDir, opts) {
                 if (violations.length > 0) {
                     return {
                         permissionDecision: 'deny',
-                        permissionDecisionReason: '[Holmes-Kit] 구조 제약 위반 — 승인된 C-SPEC 이 금지한 형태입니다:\n'
+                        permissionDecisionReason: '[Holmes-Kit] structural-constraint violation — a shape an approved C-SPEC forbids:\n'
                             + violations.map((v) => '  - ' + v).join('\n')
                             + '\n' + proposed_content_1.CSPEC_GATE_LIMITS,
                     };
@@ -1138,7 +1207,7 @@ function evaluateHook(input, specsDir, opts) {
             // told `id "" fails …`. Splitting loses nothing and can collide with nothing.
             // Split on the spec's OWN id at a token boundary. A raw `split(id)` fired mid-token whenever
             // the id was a prefix of another id in the same sentence — measured: `A-SPEC-901` whose parent
-            // `A-SPEC-9011` is missing rendered `depends_on "해당 스펙1" not found`, destroying the one
+            // `A-SPEC-9011` is missing rendered `depends_on "that spec 1" not found`, destroying the one
             // fact the author needed. This repository's own dotted ids (`A-SPEC-100.1`) make the prefix
             // relation ordinary, not exotic.
             const selfRe = (id) => new RegExp(`(?<![\\w.-])${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w.-])`, 'g');
@@ -1168,7 +1237,7 @@ function evaluateHook(input, specsDir, opts) {
             let reasonLeft = REASON_MAX;
             // SKIP, never cut (round-4): truncation mid-sentence sliced spec ids into other (or
             // nonexistent) ids, split astral chars, and — worst — one pathological first group zeroed
-            // the budget so later SHORT sentences vanished under a FALSE '잘림' label. clampBlockers'
+            // the budget so later SHORT sentences vanished under a FALSE 'truncated' label. clampBlockers'
             // discipline instead: an oversized sentence is replaced whole by an honest omission label,
             // and fitting sentences keep rendering out of the shared budget.
             const OMIT_OVER = ' (reason exceeds text budget — verify spec individually)';
@@ -1176,7 +1245,7 @@ function evaluateHook(input, specsDir, opts) {
             const shown0 = groups.slice(0, DISTINCT_REASON_CAP);
             // @implements A-SPEC-192 §5R (round 9) — a SHARE, not a race. First-come-full-draw made the
             // budget a cliff: one 1,199-character sentence (just under the cap) took the whole allowance
-            // and every short sibling vanished behind '예산 소진', while making that same sentence TEN
+            // and every short sibling vanished behind 'budget exhausted', while making that same sentence TEN
             // characters LONGER flipped it to the omission label and brought the siblings back — a
             // refusal that improves when the input gets worse. Each group is guaranteed its equal share
             // first; whatever the short ones do not use is then offered to the rest in order.
@@ -1308,7 +1377,7 @@ function evaluateHook(input, specsDir, opts) {
     // Stale-aware gate (rev.1): a target A-SPEC whose seal is PRESENT and BROKEN (edited after
     // approval) or STALE (a parent moved) is not a trustworthy approval, so code must not be written
     // against it — even though its status still reads 'approved'. The denial names staleness and
-    // spec_approve, deliberately DISTINCT from phaseCheck's "…이 approved가 아닙니다" (REQ-130's lesson:
+    // spec_approve, deliberately DISTINCT from phaseCheck's "… is not approved" (REQ-130's lesson:
     // two different failures must not share the same words). An ABSENT seal falls through — the backfill
     // closes that window and the Stop hook's unsealed-approval error blocks the turn regardless.
     const resolveSpec = (id) => specs.find((s) => s.id === id) ?? null;
@@ -1322,14 +1391,14 @@ function evaluateHook(input, specsDir, opts) {
         if (!seal.approvedDigest)
             return null; // absent seal: backfill + Stop hook territory
         if ((0, spec_digest_1.specDigest)(spec) !== seal.approvedDigest)
-            return `${id}는 승인 이후 내용이 변경되었습니다(post-approval-edit)`;
+            return `${id} was edited after approval (post-approval-edit)`;
         for (const pid of spec.dependsOn) {
             const parent = resolveSpec(pid);
             if (!parent || parent.status !== 'approved')
                 continue;
             const parentSeal = (0, spec_digest_1.sealOf)(parent).approvedDigest;
             if (parentSeal && seal.parentDigests[pid] !== parentSeal)
-                return `${id}의 부모 ${pid}가 재승인되어 체인이 stale입니다(stale-parent)`;
+                return `${id}'s parent ${pid} was re-approved, so the chain is stale (stale-parent)`;
         }
         return null;
     };
@@ -1345,7 +1414,7 @@ function evaluateHook(input, specsDir, opts) {
     // @implements A-SPEC-133 — the override is authorized by a token covering the code write.
     const codeWriteCovered = (0, risk_gate_1.approvalCovers)(weApproval, { kind: 'code-write', target: relPath }, nowTs);
     if (staleTarget && !codeWriteCovered) {
-        return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${staleTarget} — spec_approve로 재승인 후 진행하세요` };
+        return { permissionDecision: 'deny', permissionDecisionReason: `[Holmes-Kit] ${staleTarget} — re-approve with spec_approve, then proceed` };
     }
     // @implements A-SPEC-152
     // Role gate — BEFORE the spec gate on purpose: if this identity may not perform the action at all,
@@ -1641,7 +1710,7 @@ if (require.main === module) {
                         // @implements A-SPEC-133 — a master-key use becomes an audit line: the approval's
                         // narrowing (or its absence) travels with the record (r7-191: promised, never shipped).
                         inputs: [input.tool_name, target,
-                            ...(unlocked ? [(0, provenance_chain_1.approvalMarkers)(approval)] : []), // 한 항목·마지막 자리 — 표지가 갈라져 자기모순이 되지 않는다
+                            ...(unlocked ? [(0, provenance_chain_1.approvalMarkers)(approval)] : []), // one item, last position — the marker cannot split and self-contradict
                         ].filter(Boolean),
                         // round-9: a deny inherited the actor/rationale/authorization of an ambient approval that
                         // did NOT cover it, so the audit line credited an authorizer who authorized nothing.

package/dist/holmes/hooks/session-start.js

@@ -158,6 +158,23 @@ if (require.main === module) {
                         out.hookSpecificOutput.additionalContext += notice;
                 }
                 catch { /* the banner is never a gate */ }
+                // @implements A-SPEC-554.1 — remind the human of the current autonomy posture (surface only, the
+                // headless hook never decides), and clean up an expired/invalid session marker. Fail-open.
+                try {
+                    const { autonomyBanner, autonomyMarkerShouldPrune, SESSION_AUTONOMY_MARKER } = require('../governance/autonomy');
+                    const cwd = process.cwd();
+                    const nowIso = new Date().toISOString();
+                    const line = autonomyBanner(process.env, cwd, nowIso);
+                    if (line)
+                        out.hookSpecificOutput.additionalContext += '\n' + line;
+                    if (autonomyMarkerShouldPrune(cwd, nowIso)) {
+                        try {
+                            fs.rmSync(path.join(cwd, ...SESSION_AUTONOMY_MARKER), { force: true });
+                        }
+                        catch { /* housekeeping only */ }
+                    }
+                }
+                catch { /* the banner is never a gate */ }
                 process.stdout.write(JSON.stringify({ hookSpecificOutput: out.hookSpecificOutput }));
                 if (out.shouldRefresh) {
                     // Detached, unref'd child so the session start does not wait on the network. The refresh

package/dist/holmes/hooks/stop.d.ts

@@ -12,7 +12,7 @@ import type { TestOutcome } from '../review/test-runner';
  * or validation errors, it BLOCKS the stop and feeds the findings back so the model must fix them
  * before finishing. No model cooperation required — the governance fires whether or not it is asked.
  *
- * HARDENING H1 (GWT-실테스트 bridge): declared 4-quadrant coverage previously verified only the
+ * HARDENING H1 (GWT-to-real-test bridge): declared 4-quadrant coverage previously verified only the
  * T-SPEC DOCUMENT. Now, for every approved T-SPEC, its parent A-SPEC must have at least one anchored
  * TEST FILE containing REAL test cases (`it(`/`test(`) — declared coverage over an empty/absent test
  * suite blocks the stop. Evidence is supplied by the CLI (I/O half); evaluateStop stays pure.
@@ -114,6 +114,27 @@ export declare function changedAnchoredAspecs(root: string): string[] | undefine
  * which produces no violation. Failing closed here would block every ungoverned scratch directory.
  */
 export declare function unanchoredChangedSources(root: string): string[] | undefined;
+export interface DependencyReappraisal {
+    file: string;
+    aspecs: string[];
+    packages: string[];
+}
+export interface ReappraisalIO {
+    status?: () => string | undefined;
+    show?: (rel: string) => string | undefined;
+    read?: (rel: string) => string | undefined;
+}
+export declare function dependencyReappraisals(root: string, isApproved: (id: string) => boolean, io?: ReappraisalIO): DependencyReappraisal[];
+export declare function reappraisalWarningLine(reaps: DependencyReappraisal[]): string | null;
+export declare function escalateReappraisals(root: string, reaps: DependencyReappraisal[], opts: {
+    autonomous: boolean;
+    enqueue: (root: string, req: {
+        kind: string;
+        target: string;
+        why: string;
+    }) => boolean;
+    readQueueLines?: (root: string) => string[];
+}): number;
 /**
  * @implements A-SPEC-453
  * ART-5 evidence: approvals that happened without the approving act.