@holmes-lab/holmes-kit 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -5,6 +5,53 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.14.0] - 2026-09-06
+
+Closes the gate's oldest blind spot: it judged *where* a change landed, never *what kind* of change it
+was. A dependency swap inside an approved scope — a real architecture change — passed unreviewed. This
+release adds the **spec-evolution trigger**, then hardens it (and the autonomy layer it reports through)
+against everything a post-ship adversarial audit could find. Additive and observe-first: nothing new
+blocks a turn.
+
+### Added
+
+- **Spec-evolution trigger — external-dependency drift** (REQ-559): when a changed, in-scope source
+  file (inside an approved A-SPEC's scope, carrying its anchor) **newly introduces an external
+  dependency**, Holmes-Kit raises a **spec-reappraisal**. Manual mode warns at the turn boundary;
+  under autonomy it also files the drift into the out-of-band `holmes-kit approve` queue, so an
+  autonomous agent cannot quietly re-architect a slice. The detector (`dependencyDelta` /
+  `externalImportsOf`) is pure, TS/JS + Python, and judges only *newly added* bare (non-relative)
+  top-level packages — builtins and stdlib are not drift. Every path fails open: the signal never
+  affects the stop verdict.
+
+### Fixed
+
+- **The autonomy posture is now visible to hook-side processes** (REQ-560): a hook process never
+  inherits the MCP server's environment, so a project that opted in with `init --autonomy` (the switch
+  is persisted into `.mcp.json`) got **no session-start banner and no queue escalation** — the switch
+  was real but invisible to every hook surface. `autonomousApprovalEnabled` and the banner now also
+  judge the project default by reading `.mcp.json` directly (read-only; the file is agent-write
+  protected, so this opens no self-grant path, and the owner's edit now takes effect without a restart).
+- **Dependency detection hardened against real-world source** (REQ-560): prettier-style multiline
+  imports (`import {\n a,\n} from 'pkg'`) were missed entirely — the most common shape in formatted
+  code — and a pure reformat could even report a phantom new dependency. CRLF files broke comment
+  stripping, so a commented-out `require()` fired a false drift on every turn. A `/*` inside a string
+  swallowed the real imports after it. Python `import a, b` saw only the first package. Strings,
+  template literals, docstrings and `x.require()` calls no longer produce phantom dependencies, the
+  Python stdlib and Node builtin lists were widened, and a pathological file (30k unclosed `/*`) went
+  from 2.4s to 12ms.
+- **Reappraisal escalation respects decisions and non-ASCII paths** (REQ-560): an owner-decided
+  (granted/denied) reappraisal is no longer re-queued on the next turn while the tree stays dirty, and
+  an already-pending one is not duplicated. `git status`/`show` now run with `core.quotepath=false`, so
+  Korean- and space-named sources are seen at all — the same blindness affected the ART-8 and ART-1
+  evidence collectors, which are fixed alongside. The signal is also emitted on degraded-yield turns.
+- **Evidence runs are posture-neutral** (REQ-561): `test_run` handed the MCP server's
+  `HOLMES_AUTONOMOUS_APPROVAL` to its jest children, so on a project with autonomy enabled the
+  autonomy branch skipped the elicitation path and 9 elicitation tests went red **on a tree whose full
+  suite was green** — the gate became unusable for exactly the users who opted into autonomy. The
+  switch now joins the scrub list (`HOLMES_SPECS`, `HOLMES_GATE_BYPASS`, …): a posture is an approval
+  channel, never a property of the code under test.
+
 ## [0.13.0] - 2026-09-06
 
 Autonomy grows from a single env switch into a **three-layer, always-bounded** posture — so a team can

package/README.md

@@ -14,7 +14,7 @@
 
 ---
 
-### 🛡️ Currently Supported Features (v0.13.x Production Features)
+### 🛡️ Currently Supported Features (v0.14.x Production Features)
 
 - 📋 **Requirements & Specification Governance**: Strict **"No Spec, No Code"** enforcement with 4-tier spec chain traceability (`REQ ➔ H-SPEC ➔ A-SPEC ➔ T-SPEC`) and `// @implements A-SPEC-XXX` code anchors (comma-lists and every anchor in a file participate in the gate).
 - 🔴 **Inbuilt TDD — RED-first, enforced not asked** *(new in 0.9.0)*: the test-first discipline is a holmes-installed `holmes-tdd-slice` skill **and** a new constitution article **ART-8**. A changed A-SPEC must show a recorded `red-assertion → green` sequence in the ledger; a `red-error` (a test that could not run) is not a valid RED, so "the covering test failed *correctly*" is judged mechanically, not on trust. `test_run` classifies each covered file (`red-assertion`/`red-error`/`green`) and records per-A-SPEC outcomes the Stop hook reads. Ships at `redFirstEvidence: track` (observe-first, non-blocking; `strict`/`off` per repo), evidence-gated and jest-only for now. A T-SPEC may also declare `kills:` mutations and `test_run --mutate` reports which SURVIVED (a coverage gap). Where superpowers *asks* for RED-first and discriminating power, holmes-kit *proves* them.
@@ -22,7 +22,8 @@
 - ⬆️ **Zero-config upgrades** *(new in 0.11.0)*: `holmes-kit upgrade` moves **every** wired workspace to the latest in one command — plan → confirm → install → re-pin all recorded workspaces (`--dry-run`/`--yes` supported). Preparation is automatic (each `init` records the workspace; a session whose pin is behind nudges you to upgrade); the re-pin **write** stays your explicit choice, never a silent auto-install. Opt out of the nudge with `HOLMES_NO_AUTO_REPIN`.
 - 📊 **World-top-tier RTM dashboard** *(new in 0.12.0–0.12.1)*: `holmes-kit serve` — ask to *see* the RTM heatmap and the `rtm_dashboard` MCP tool launches the server idempotently and hands back the URL plus an honesty **census** (requirement/pipeline counts, coverage %, what's excluded). The heatmap is a real **2D coverage matrix** (requirements × pipeline stages, rows seriated by completeness, sequential-ramp cells with the percent printed in each). Drilling into a symbol renders that function's **CFG as a layered DAG** with **PDG (data/control-dependence) colour overlays**, served by `/api/cfg?file=&symbol=` from the same engine the taint lane uses — a non-CFG language is named, never faked. Tokenised palette (sequential ramp, status colours, UI/mono pairing) with light/dark.
 - 🔢 **Sensible spec numbering** *(new in 0.12.1)*: a brand-new project's first slice is now **REQ-100**, not REQ-201 — `spec_slice_init` shares the same id allocator as the reverse-draft path (`nextIdBase`, floor 100). Existing projects are untouched: the next id is always `max(existing)+1`, so a repo already numbering from 201 keeps the exact same sequence. Numbering past 999 yields 4-digit ids cleanly, and ADR references now recognise 4-digit ADRs (`ADR-1000+`).
-- 🤖 **Autonomous Approval — three layers, always bounded** *(reworked in 0.13.0; foundation 0.8.0)*: for teams that want the agent to self-drive the SDLC, autonomy is a posture the agent holds at two scopes — a **project default** you opt into at `holmes-kit init --autonomy` (persisted as the `HOLMES_AUTONOMOUS_APPROVAL` env in `.mcp.json`), and a **per-session envelope** you grant on the spot with `holmes-kit autonomy on --for 2h` (an expiring marker under the agent-write-protected `.ax/state/`). Under either, the agent seals **low-risk** specs itself (ledgered under an `autonomous:<client>` actor); every **governance-critical, high-risk, or irreversible** decision — `gate-behavior`/breaking A-SPECs, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/`C-SPEC` — is instead **refused and routed to the out-of-band `holmes-kit approve` queue** for a human, never silently self-approved. The active posture is **surfaced at every session start** so it can't be forgotten, and an agent can never grant it to itself: the env is env-only (blocked like `HOLMES_ROLE`), the session command needs a real TTY or an out-of-band `HOLMES_APPROVAL`, and the marker lives where agents can't write. Off = byte-identical to a fully human-gated project. *(new in 0.10.0)* `HOLMES_ELICIT=off` routes every decision straight to the same queue.
+- 🤖 **Autonomous Approval — three layers, always bounded** *(reworked in 0.13.0; foundation 0.8.0)*: for teams that want the agent to self-drive the SDLC, autonomy is a posture the agent holds at two scopes — a **project default** you opt into at `holmes-kit init --autonomy` (persisted as the `HOLMES_AUTONOMOUS_APPROVAL` env in `.mcp.json`), and a **per-session envelope** you grant on the spot with `holmes-kit autonomy on --for 2h` (an expiring marker under the agent-write-protected `.ax/state/`). Under either, the agent seals **low-risk** specs itself (ledgered under an `autonomous:<client>` actor); every **governance-critical, high-risk, or irreversible** decision — `gate-behavior`/breaking A-SPECs, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/`C-SPEC` — is instead **refused and routed to the out-of-band `holmes-kit approve` queue** for a human, never silently self-approved. The active posture is **surfaced at every session start** so it can't be forgotten *(0.14.0: the hook side now reads the project default out of `.mcp.json` directly, so an `init --autonomy` project sees its banner and escalations without an env round-trip)*, and an agent can never grant it to itself: the env is env-only (blocked like `HOLMES_ROLE`), the session command needs a real TTY or an out-of-band `HOLMES_APPROVAL`, and the marker lives where agents can't write. Off = byte-identical to a fully human-gated project. *(new in 0.10.0)* `HOLMES_ELICIT=off` routes every decision straight to the same queue.
+- 🧭 **Spec-Evolution Trigger** *(new in 0.14.0)*: the gate used to judge only *where* a change lands (file ∈ Files-to-Touch, anchored, approved) — never *what kind* of change it is, so a real architecture swap inside an approved scope passed unreviewed. Now, when a changed in-scope source **newly introduces an external dependency** (a swapped engine, a new runtime), Holmes-Kit raises a **spec-reappraisal**: manual mode warns at the turn boundary, and under autonomy it also files the drift in the out-of-band `holmes-kit approve` queue so the owner sees it — a decided reappraisal is never re-raised for the same drift. Observe-first by design: it never blocks a turn. Detection is TS/JS + Python, string- and comment-safe (prettier multiline imports, CRLF files, docstrings and template literals all judged correctly).
 - 🚢 **Release Autonomy + Docs-Currency Gate** *(new in 0.13.0)*: publishing is irreversible and outward, so `npm publish` stays **human-approved by default** — but a deterministic classifier (`releaseAutonomy`, reusing the same per-spec risk grade) lets a **low-risk** release (patch/minor, every spec auto-grade, autonomy on) self-publish under the ledger, while a **major** bump, any `gate-behavior`/security/architecture spec, or an upstream `REQ`/`H-SPEC` forces HITL. The `holmes-publish` playbook also gains a **docs-currency gate**: before any release it diffs the specs since the last tag and blocks if a user-facing change never reached `README`/`CHANGELOG` — a stale doc is a false claim.
 - 🌐 **English CLI & hook surface** *(new in 0.13.0)*: the operator-facing CLI and hook messages — `doctor` output, the CLI usage/errors, the hook `deny` reasons and ART citations, and the interactive `approve`/`init`/`upgrade`/`semantic-key` prompts — are now English, guarded by a hangul-absence test over the **rendered runtime output** (not just a source scan, which misses `\u`-escaped strings). The MCP tool responses (`spec_create`/`spec_approve`/ledger/review) are still being migrated and are next.
 - 🪧 **Session Banner + Update Notice** *(new in 0.8.0; refresh implemented + made uniform in 0.12.2)*: every session start emits an English intro (version + governance rule + npm URL) to both the human transcript and the agent context (SessionStart hook + MCP `instructions`); when a newer published version is on npm, an install-mode-aware `holmes-kit upgrade` command is appended. The registry refresh (dist-tags query → cached in `~/.holmes/update-check.json`) is detached, TTL-gated, and fail-silent, and now fires from **every harness's MCP-server startup** — not just Claude's SessionStart hook — so Claude / Antigravity / Codex are notified alike. Opts out via `HOLMES_NO_UPDATE_CHECK`/`CI`. Upgrade execution stays your explicit choice (`holmes-kit upgrade`), never a silent auto-install.

package/dist/.build-id

@@ -1 +1 @@
-55b0a37-mtp8gdtd
+b352d54-mtpi1283

package/dist/holmes/governance/autonomy.d.ts

@@ -14,6 +14,7 @@ export declare const SESSION_AUTONOMY_MARKER: readonly [".ax", "state", "autonom
 export declare function sessionAutonomyActive(root: string, now: string): boolean;
 /** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope
  *  (A-SPEC-553.1). `root`/`now` are optional so env-only callers are byte-identical. */
+export declare function projectDefaultAutonomy(root: string): boolean;
 export declare function autonomousApprovalEnabled(env: NodeJS.ProcessEnv, root?: string, now?: string): boolean;
 export declare function autonomyBanner(env: NodeJS.ProcessEnv, root: string, now: string): string;
 export declare function autonomyMarkerShouldPrune(root: string, now: string): boolean;

package/dist/holmes/governance/autonomy.js

@@ -37,6 +37,7 @@ exports.SESSION_AUTONOMY_MARKER = exports.AUTONOMY_ENV = void 0;
 exports.isHighRiskPath = isHighRiskPath;
 exports.specApprovalAutonomy = specApprovalAutonomy;
 exports.sessionAutonomyActive = sessionAutonomyActive;
+exports.projectDefaultAutonomy = projectDefaultAutonomy;
 exports.autonomousApprovalEnabled = autonomousApprovalEnabled;
 exports.autonomyBanner = autonomyBanner;
 exports.autonomyMarkerShouldPrune = autonomyMarkerShouldPrune;
@@ -158,17 +159,41 @@ function sessionAutonomyActive(root, now) {
 }
 /** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope
  *  (A-SPEC-553.1). `root`/`now` are optional so env-only callers are byte-identical. */
+// @implements A-SPEC-560.2 — hook-side processes never inherit the MCP server's env, so the project
+// default (persisted by `init --autonomy` into .mcp.json) must be judged by READING the file. The
+// post-ship audit's live evidence: a session with .mcp.json=1 showed no banner and never escalated —
+// the switch was real but invisible to every hook-side surface. Pure read-only judgement: .mcp.json
+// is agent-write-protected, so this opens no self-grant channel; a live read also removes the
+// restart-lag footgun (the owner's edit takes effect at the next hook run).
+function projectDefaultAutonomy(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(root, '.mcp.json'), 'utf8'));
+        for (const server of Object.values(parsed.mcpServers ?? {})) {
+            const v = server?.env?.[exports.AUTONOMY_ENV];
+            if (typeof v === 'string' && v !== '')
+                return true; // same truthiness convention as the env switch
+        }
+        return false;
+    }
+    catch {
+        return false; // absent / unparseable file is no signal — never a throw
+    }
+}
 function autonomousApprovalEnabled(env, root, now) {
     const v = env[exports.AUTONOMY_ENV];
     if (typeof v === 'string' && v !== '')
         return true;
+    if (root !== undefined && projectDefaultAutonomy(root))
+        return true; // @implements A-SPEC-560.2
     return root !== undefined && now !== undefined && sessionAutonomyActive(root, now);
 }
 // @implements A-SPEC-554.1 — the session-start REMINDER (the headless hook surfaces, it never decides).
 // Only ON postures get a line; OFF is silent (a permanent line is one nobody reads). Wired below.
 function autonomyBanner(env, root, now) {
     const v = env[exports.AUTONOMY_ENV];
-    if (typeof v === 'string' && v !== '') {
+    // @implements A-SPEC-560.2 — the project default is visible via env (server-side) OR .mcp.json
+    // (hook-side); either way the banner names the same posture.
+    if ((typeof v === 'string' && v !== '') || projectDefaultAutonomy(root)) {
         return '[Holmes-Kit] autonomous spec approval: ON (project default) — governance-critical, high-risk and irreversible specs still ask you.';
     }
     if (sessionAutonomyActive(root, now)) {

package/dist/holmes/guardrail/dependency-delta.d.ts

@@ -0,0 +1,3 @@
+export type DepLang = 'ts' | 'py';
+export declare function externalImportsOf(source: string, lang: DepLang): Set<string>;
+export declare function dependencyDelta(before: string, after: string, lang: DepLang): string[];

package/dist/holmes/guardrail/dependency-delta.js

@@ -0,0 +1,118 @@
+"use strict";
+// @implements A-SPEC-559.1
+// @implements A-SPEC-560.1
+// Pure external-dependency-delta detector: given a source file's content, extract its EXTERNAL
+// (non-relative, "bare") import specifiers normalized to the top-level package, and report which
+// external packages a before→after change newly introduces. The repo convention is `importTargetOf`'s
+// (`guardrail/forbidden-edges.ts`): a `.`-prefixed specifier is relative (internal); anything else is
+// external. Pure, deterministic, never throws — the git/env/queue wiring lives in the Stop hook.
+//
+// Hardened after the post-ship adversarial audit (REQ-560): prettier-style MULTILINE imports are the
+// most common real-world form and the original line-anchored regex missed them entirely; CRLF files
+// broke line-comment stripping into false deltas; a string-embedded `/*` swallowed real imports; and
+// the un-anchored require()/import() patterns matched inside string literals (our own test fixtures
+// self-triggered). The pipeline below is: normalize CRLF → strip line-START block comments only →
+// strip template/triple-quoted literals → strip line comments (URL-preserving) → match, with a
+// quote-parity rejection for require()/import() so string-embedded calls stay silent.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalImportsOf = externalImportsOf;
+exports.dependencyDelta = dependencyDelta;
+// A new import of one of these is a language builtin, not an added third-party dependency, so it is
+// NOT an architecture-drift signal. The lists are deliberately common-case, not exhaustive: a missed
+// builtin only produces an observe-first warning, never a block.
+const TS_BUILTINS = new Set([
+    'fs', 'path', 'os', 'crypto', 'util', 'events', 'stream', 'http', 'https', 'url', 'child_process',
+    'process', 'assert', 'buffer', 'net', 'tls', 'zlib', 'querystring', 'string_decoder', 'timers',
+    'tty', 'dgram', 'dns', 'readline', 'repl', 'vm', 'worker_threads', 'cluster', 'perf_hooks',
+    'async_hooks', 'v8', 'module', 'constants', 'punycode', 'inspector', 'diagnostics_channel', 'test',
+]);
+const PY_STDLIB = new Set([
+    'os', 'sys', 're', 'json', 'typing', 'pathlib', 'subprocess', 'time', 'datetime', 'collections',
+    'itertools', 'functools', 'math', 'random', 'logging', 'io', 'abc', 'enum', 'dataclasses', 'asyncio',
+    'contextlib', 'hashlib', 'base64', 'tempfile', 'shutil', 'glob', 'argparse', 'unittest', 'threading',
+    'queue', 'socket', 'struct', 'copy', 'warnings', 'traceback', 'inspect', 'textwrap', 'operator',
+    'importlib', 'urllib', 'pickle', 'csv', 'uuid', 'string', 'multiprocessing', 'concurrent', 'sqlite3',
+    'secrets', 'signal', 'types', 'ast', 'email', 'http', 'xml', 'array',
+]);
+/** Is position `idx` of `line` inside a single- or double-quoted string? (parity of quotes before it) */
+function insideString(line, idx) {
+    let sq = 0, dq = 0;
+    for (let i = 0; i < idx; i++) {
+        const c = line[i];
+        if (c === "'")
+            sq += 1;
+        else if (c === '"')
+            dq += 1;
+    }
+    return sq % 2 === 1 || dq % 2 === 1;
+}
+/** Top-level package of a TS/JS specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
+function tsTopLevel(spec) {
+    const parts = spec.split('/');
+    return spec.startsWith('@') && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0];
+}
+function externalImportsOf(source, lang) {
+    const out = new Set();
+    try {
+        let src = source.replace(/\r\n?/g, '\n'); // CRLF/CR → LF first
+        if (lang === 'ts') {
+            // Line-START-anchored block comments only: kills a commented-out import block WITHOUT letting a
+            // string-embedded "/*" swallow the real code after it (and keeps the scan linear — the engine
+            // only attempts matches at line starts).
+            src = src.replace(/^[ \t]*\/\*[\s\S]*?\*\//gm, '');
+            src = src.replace(/`[^`]*`/g, '``'); // template literals are data
+            src = src.replace(/(?<!:)\/\/.*$/gm, ''); // line comments; `https://` survives
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.') || raw.startsWith('node:'))
+                    return;
+                const pkg = tsTopLevel(raw);
+                if (pkg !== '' && !TS_BUILTINS.has(pkg))
+                    out.add(pkg);
+            };
+            // A from-clause ENDS some line — any non-quote prefix, so prettier's `} from 'pkg'` is caught.
+            for (const m of src.matchAll(/^[^'"`\n]*\bfrom\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]);
+            for (const m of src.matchAll(/^\s*import\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]); // side-effect import
+            // require()/dynamic import() are position-free, so reject matches sitting inside a string
+            // literal (quote parity before the match on its line) and method calls (`loader.require`).
+            for (const line of src.split('\n')) {
+                for (const m of line.matchAll(/(?<!\.)\brequire\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+                for (const m of line.matchAll(/\bimport\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+            }
+        }
+        else {
+            src = src.replace(/"""[\s\S]*?"""/g, '').replace(/'''[\s\S]*?'''/g, ''); // docstrings are data
+            src = src.split('\n').map((l) => l.replace(/#.*$/, '')).join('\n');
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.'))
+                    return;
+                const pkg = raw.split('.')[0];
+                if (pkg !== '' && !PY_STDLIB.has(pkg))
+                    out.add(pkg);
+            };
+            for (const m of src.matchAll(/^\s*import\s+(.+)$/gm)) {
+                // `import a, b as c` — every comma part counts; sanitize each to a leading dotted name so a
+                // trailing `;`/comment fragment can never fabricate a package token.
+                for (const part of m[1].split(','))
+                    add(/^[A-Za-z_][\w.]*/.exec(part.trim())?.[0]);
+            }
+            for (const m of src.matchAll(/^\s*from\s+([.\w]+)\s+import\b/gm))
+                add(m[1]);
+        }
+    }
+    catch {
+        return out; // never throw — observe-first
+    }
+    return out;
+}
+function dependencyDelta(before, after, lang) {
+    const had = externalImportsOf(before, lang);
+    return [...externalImportsOf(after, lang)].filter((x) => !had.has(x)).sort();
+}

package/dist/holmes/hooks/stop.d.ts

@@ -114,6 +114,27 @@ export declare function changedAnchoredAspecs(root: string): string[] | undefine
  * which produces no violation. Failing closed here would block every ungoverned scratch directory.
  */
 export declare function unanchoredChangedSources(root: string): string[] | undefined;
+export interface DependencyReappraisal {
+    file: string;
+    aspecs: string[];
+    packages: string[];
+}
+export interface ReappraisalIO {
+    status?: () => string | undefined;
+    show?: (rel: string) => string | undefined;
+    read?: (rel: string) => string | undefined;
+}
+export declare function dependencyReappraisals(root: string, isApproved: (id: string) => boolean, io?: ReappraisalIO): DependencyReappraisal[];
+export declare function reappraisalWarningLine(reaps: DependencyReappraisal[]): string | null;
+export declare function escalateReappraisals(root: string, reaps: DependencyReappraisal[], opts: {
+    autonomous: boolean;
+    enqueue: (root: string, req: {
+        kind: string;
+        target: string;
+        why: string;
+    }) => boolean;
+    readQueueLines?: (root: string) => string[];
+}): number;
 /**
  * @implements A-SPEC-453
  * ART-5 evidence: approvals that happened without the approving act.

package/dist/holmes/hooks/stop.js

@@ -36,6 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_CONSECUTIVE_BLOCKS = void 0;
 exports.changedAnchoredAspecs = changedAnchoredAspecs;
 exports.unanchoredChangedSources = unanchoredChangedSources;
+exports.dependencyReappraisals = dependencyReappraisals;
+exports.reappraisalWarningLine = reappraisalWarningLine;
+exports.escalateReappraisals = escalateReappraisals;
 exports.unrecordedApprovals = unrecordedApprovals;
 exports.rolledBackLedgers = rolledBackLedgers;
 exports.governanceLostPreflight = governanceLostPreflight;
@@ -50,6 +53,9 @@ exports.readGuardCount = readGuardCount;
 exports.writeGuardCount = writeGuardCount;
 const fs = __importStar(require("node:fs"));
 const npx_bin_1 = require("../project/npx-bin");
+const approval_queue_1 = require("../governance/approval-queue");
+const dependency_delta_1 = require("../guardrail/dependency-delta");
+const autonomy_1 = require("../governance/autonomy");
 const risk_gate_1 = require("../guardrail/risk-gate");
 const json_state_1 = require("../project/json-state");
 const node_child_process_1 = require("node:child_process");
@@ -74,7 +80,9 @@ function changedAnchoredAspecs(root) {
     const VENDORED = /^(?:reference|node_modules|dist|build|vendor|third_party)\//;
     let raw;
     try {
-        raw = (0, node_child_process_1.execFileSync)('git', ['status', '--porcelain', '-uall'], {
+        // @implements A-SPEC-560.3 — quotepath OFF, or a non-ASCII-named source arrives octal-escaped
+        // and its ART-8 evidence silently vanishes (shared defect with the reappraisal detector).
+        raw = (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], {
             cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)(),
         });
     }
@@ -120,7 +128,8 @@ function unanchoredChangedSources(root) {
     try {
         // `-uall`: without it git folds a wholly-untracked directory into one `?? src/` line and the
         // files inside it are never seen — which is precisely where a bypassed write lands.
-        raw = (0, node_child_process_1.execFileSync)('git', ['status', '--porcelain', '-uall'], {
+        // @implements A-SPEC-560.3 — quotepath OFF (same octal-escape blindness as the siblings).
+        raw = (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], {
             cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)(),
         });
     }
@@ -148,6 +157,141 @@ function unanchoredChangedSources(root) {
     }
     return out;
 }
+const REAPPRAISAL_VENDORED = /^(?:reference|node_modules|dist|build|vendor|third_party)\//;
+function depLangOf(rel) {
+    if (/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(rel))
+        return 'ts';
+    if (/\.py$/.test(rel))
+        return 'py';
+    return undefined;
+}
+function dependencyReappraisals(root, isApproved, io = {}) {
+    // @implements A-SPEC-560.3 — quotepath OFF: with the default core.quotepath, a Korean- (or any
+    // non-ASCII/quote-) named file arrives octal-escaped, the read then ENOENTs, and the signal is
+    // silently lost. Measured: 2 of 4 drifting files detected before this flag.
+    const status = io.status ?? (() => {
+        try {
+            return (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() });
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const show = io.show ?? ((rel) => {
+        try {
+            return (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'show', `HEAD:${rel}`], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() });
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const read = io.read ?? ((rel) => {
+        try {
+            return fs.readFileSync(path.join(root, rel), 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    });
+    let raw;
+    try {
+        raw = status();
+    }
+    catch {
+        raw = undefined;
+    }
+    if (raw === undefined)
+        return [];
+    const out = [];
+    for (const line of raw.split('\n')) {
+        if (line.trim() === '')
+            continue;
+        let rel = line.slice(3).trim().replace(/^"|"$/g, '');
+        if (rel.includes(' -> '))
+            rel = rel.split(' -> ')[1]; // renames name the destination
+        const lang = depLangOf(rel);
+        if (lang === undefined || REAPPRAISAL_VENDORED.test(rel))
+            continue;
+        let after;
+        try {
+            after = read(rel);
+        }
+        catch {
+            after = undefined;
+        }
+        if (after === undefined)
+            continue; // deleted / unreadable
+        const aspecs = [...new Set([...after.matchAll(/@implements\s+(A-SPEC-\d+(?:\.\d+)?)/g)].map((m) => m[1]))].filter(isApproved).sort();
+        if (aspecs.length === 0)
+            continue; // not inside an APPROVED A-SPEC scope
+        let before;
+        try {
+            before = show(rel);
+        }
+        catch {
+            before = undefined;
+        }
+        if (before === undefined)
+            continue; // no HEAD version = a new file, not in-scope drift
+        let packages = [];
+        try {
+            packages = (0, dependency_delta_1.dependencyDelta)(before, after, lang);
+        }
+        catch {
+            packages = [];
+        }
+        if (packages.length > 0)
+            out.push({ file: rel, aspecs, packages });
+    }
+    return out;
+}
+function reappraisalWarningLine(reaps) {
+    if (reaps.length === 0)
+        return null;
+    return reaps.map((r) => `[Holmes-Kit] spec-reappraisal: ${r.file} introduces external dependency ${r.packages.join(', ')} inside approved ${r.aspecs.join(', ')} scope — this looks like an architecture change; update the spec or open a sub-slice.`).join('\n');
+}
+// @implements A-SPEC-560.3 — decision-respecting escalation: a reappraisal the owner already decided
+// (granted/denied in the queue ledger) must not re-pend every turn while the tree stays dirty, and an
+// already-pending one needs no duplicate append. A reader failure fails OPEN (the signal survives).
+function escalateReappraisals(root, reaps, opts) {
+    if (!opts.autonomous)
+        return 0;
+    const readLines = opts.readQueueLines ?? ((r) => fs.readFileSync(path.join(r, approval_queue_1.QUEUE_RELPATH), 'utf8').split('\n'));
+    let lines;
+    try {
+        lines = readLines(root);
+    }
+    catch {
+        lines = [];
+    } // a broken reader fails OPEN — the signal survives
+    let n = 0;
+    for (const r of reaps) {
+        try {
+            const id = (0, approval_queue_1.approvalRequestId)('spec-reappraisal', r.file);
+            let decided = false;
+            let lastEvent;
+            for (const raw of lines) {
+                if (raw.trim() === '')
+                    continue;
+                try {
+                    const e = JSON.parse(raw);
+                    if (e.id !== id)
+                        continue;
+                    lastEvent = String(e.event);
+                    if (lastEvent === 'granted' || lastEvent === 'denied')
+                        decided = true;
+                }
+                catch { /* a corrupt line is not this id's history */ }
+            }
+            if (decided || lastEvent === 'requested')
+                continue; // decided, or already pending — no re-append
+            if (opts.enqueue(root, { kind: 'spec-reappraisal', target: r.file, why: `new external dependency ${r.packages.join(', ')} inside approved ${r.aspecs.join(', ')} — spec update or sub-slice needed` }))
+                n += 1;
+        }
+        catch { /* enqueue failure is best-effort; the warning still surfaced */ }
+    }
+    return n;
+}
 /**
  * @implements A-SPEC-453
  * ART-5 evidence: approvals that happened without the approving act.
@@ -769,6 +913,24 @@ if (require.main === module) {
             let out = evaluateStop(specs, { testCasesByAspec, provenance, executedByAspec, findings, findingsUnreadable, unanchoredChangedSources: unanchored, unrecordedApprovals: unrecorded, rolledBackLedgers: rolledBack, redFirstMode, changedAspecs, outcomesByAspec });
             // @implements A-SPEC-534.4 — track mode records ART-8 findings without blocking: surface them so
             // the operator observes RED-first gaps before an owner promotes the posture to strict.
+            // @implements A-SPEC-559.2 — spec-evolution trigger (observe-first, NEVER blocks): a dirty
+            // in-scope source that newly introduces an external dependency is an architecture-drift signal.
+            // Manual mode warns; autonomy mode also enqueues it so the owner sees the drift async. Fail-open.
+            // @implements A-SPEC-560.3 — placed BEFORE the guard decisions and their early returns, so a
+            // degraded-yield turn (guard state unwritable) still surfaces the drift; stderr-only, so no
+            // verdict path is affected.
+            try {
+                const approvedIds = new Set(specs.filter((s) => s.type === 'A-SPEC' && s.status === 'approved').map((s) => s.id));
+                const reaps = dependencyReappraisals(stopProjectRoot(), (id) => approvedIds.has(id));
+                const line = reappraisalWarningLine(reaps);
+                if (line)
+                    process.stderr.write(`${line}\n`);
+                const nowIso = new Date().toISOString();
+                if (line && (0, autonomy_1.autonomousApprovalEnabled)(process.env, stopProjectRoot(), nowIso)) {
+                    escalateReappraisals(stopProjectRoot(), reaps, { autonomous: true, enqueue: approval_queue_1.enqueueApprovalRequest });
+                }
+            }
+            catch { /* the reappraisal signal is advisory; a failure never affects the stop verdict */ }
             if (out.tracked && out.tracked.length > 0) {
                 process.stderr.write(`[Holmes-Kit] ART-8 RED-first (track): ${out.tracked.map((t) => t.detail).join(' | ')}\n`);
             }

package/dist/holmes/project/root.js

@@ -77,7 +77,15 @@ function cleanSubprocessEnv(env = process.env) {
  * evidence run would disarm every test that verifies a gate, and that contamination masks red as
  * green — the worse direction of the two.
  */
-const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE']);
+// @implements A-SPEC-561.1
+// `HOLMES_AUTONOMOUS_APPROVAL` joins the list for the SAME reason, pointing the same way as the
+// HOLMES_SPECS incident above: measured 2026-09-06, a project that opted into autonomy
+// (`init --autonomy` persists the switch into .mcp.json) starts its MCP server with that env, the
+// server's `test_run` handed it to the jest children, and REQ-551's autonomy branch then skipped the
+// elicitation path — 9 elicitation tests red on a tree whose full suite was green, twice, and
+// identically on the previous commit. A posture is an approval channel, never a property of the code
+// under test; an evidence run must judge the same in an autonomous workspace and a human-gated one.
+const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE', 'HOLMES_AUTONOMOUS_APPROVAL']);
 function cleanTestEnv(env = process.env) {
     const cleaned = cleanSubprocessEnv(env);
     for (const k of Object.keys(cleaned)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",