@holmes-lab/holmes-kit 0.13.0 → 0.15.0

package/dist/holmes/guardrail/dependency-delta.js

@@ -0,0 +1,118 @@
+"use strict";
+// @implements A-SPEC-559.1
+// @implements A-SPEC-560.1
+// Pure external-dependency-delta detector: given a source file's content, extract its EXTERNAL
+// (non-relative, "bare") import specifiers normalized to the top-level package, and report which
+// external packages a before→after change newly introduces. The repo convention is `importTargetOf`'s
+// (`guardrail/forbidden-edges.ts`): a `.`-prefixed specifier is relative (internal); anything else is
+// external. Pure, deterministic, never throws — the git/env/queue wiring lives in the Stop hook.
+//
+// Hardened after the post-ship adversarial audit (REQ-560): prettier-style MULTILINE imports are the
+// most common real-world form and the original line-anchored regex missed them entirely; CRLF files
+// broke line-comment stripping into false deltas; a string-embedded `/*` swallowed real imports; and
+// the un-anchored require()/import() patterns matched inside string literals (our own test fixtures
+// self-triggered). The pipeline below is: normalize CRLF → strip line-START block comments only →
+// strip template/triple-quoted literals → strip line comments (URL-preserving) → match, with a
+// quote-parity rejection for require()/import() so string-embedded calls stay silent.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalImportsOf = externalImportsOf;
+exports.dependencyDelta = dependencyDelta;
+// A new import of one of these is a language builtin, not an added third-party dependency, so it is
+// NOT an architecture-drift signal. The lists are deliberately common-case, not exhaustive: a missed
+// builtin only produces an observe-first warning, never a block.
+const TS_BUILTINS = new Set([
+    'fs', 'path', 'os', 'crypto', 'util', 'events', 'stream', 'http', 'https', 'url', 'child_process',
+    'process', 'assert', 'buffer', 'net', 'tls', 'zlib', 'querystring', 'string_decoder', 'timers',
+    'tty', 'dgram', 'dns', 'readline', 'repl', 'vm', 'worker_threads', 'cluster', 'perf_hooks',
+    'async_hooks', 'v8', 'module', 'constants', 'punycode', 'inspector', 'diagnostics_channel', 'test',
+]);
+const PY_STDLIB = new Set([
+    'os', 'sys', 're', 'json', 'typing', 'pathlib', 'subprocess', 'time', 'datetime', 'collections',
+    'itertools', 'functools', 'math', 'random', 'logging', 'io', 'abc', 'enum', 'dataclasses', 'asyncio',
+    'contextlib', 'hashlib', 'base64', 'tempfile', 'shutil', 'glob', 'argparse', 'unittest', 'threading',
+    'queue', 'socket', 'struct', 'copy', 'warnings', 'traceback', 'inspect', 'textwrap', 'operator',
+    'importlib', 'urllib', 'pickle', 'csv', 'uuid', 'string', 'multiprocessing', 'concurrent', 'sqlite3',
+    'secrets', 'signal', 'types', 'ast', 'email', 'http', 'xml', 'array',
+]);
+/** Is position `idx` of `line` inside a single- or double-quoted string? (parity of quotes before it) */
+function insideString(line, idx) {
+    let sq = 0, dq = 0;
+    for (let i = 0; i < idx; i++) {
+        const c = line[i];
+        if (c === "'")
+            sq += 1;
+        else if (c === '"')
+            dq += 1;
+    }
+    return sq % 2 === 1 || dq % 2 === 1;
+}
+/** Top-level package of a TS/JS specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
+function tsTopLevel(spec) {
+    const parts = spec.split('/');
+    return spec.startsWith('@') && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0];
+}
+function externalImportsOf(source, lang) {
+    const out = new Set();
+    try {
+        let src = source.replace(/\r\n?/g, '\n'); // CRLF/CR → LF first
+        if (lang === 'ts') {
+            // Line-START-anchored block comments only: kills a commented-out import block WITHOUT letting a
+            // string-embedded "/*" swallow the real code after it (and keeps the scan linear — the engine
+            // only attempts matches at line starts).
+            src = src.replace(/^[ \t]*\/\*[\s\S]*?\*\//gm, '');
+            src = src.replace(/`[^`]*`/g, '``'); // template literals are data
+            src = src.replace(/(?<!:)\/\/.*$/gm, ''); // line comments; `https://` survives
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.') || raw.startsWith('node:'))
+                    return;
+                const pkg = tsTopLevel(raw);
+                if (pkg !== '' && !TS_BUILTINS.has(pkg))
+                    out.add(pkg);
+            };
+            // A from-clause ENDS some line — any non-quote prefix, so prettier's `} from 'pkg'` is caught.
+            for (const m of src.matchAll(/^[^'"`\n]*\bfrom\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]);
+            for (const m of src.matchAll(/^\s*import\s*['"]([^'"\n]+)['"]/gm))
+                add(m[1]); // side-effect import
+            // require()/dynamic import() are position-free, so reject matches sitting inside a string
+            // literal (quote parity before the match on its line) and method calls (`loader.require`).
+            for (const line of src.split('\n')) {
+                for (const m of line.matchAll(/(?<!\.)\brequire\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+                for (const m of line.matchAll(/\bimport\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g)) {
+                    if (!insideString(line, m.index ?? 0))
+                        add(m[1]);
+                }
+            }
+        }
+        else {
+            src = src.replace(/"""[\s\S]*?"""/g, '').replace(/'''[\s\S]*?'''/g, ''); // docstrings are data
+            src = src.split('\n').map((l) => l.replace(/#.*$/, '')).join('\n');
+            const add = (raw) => {
+                if (raw === undefined || raw === '' || raw.startsWith('.'))
+                    return;
+                const pkg = raw.split('.')[0];
+                if (pkg !== '' && !PY_STDLIB.has(pkg))
+                    out.add(pkg);
+            };
+            for (const m of src.matchAll(/^\s*import\s+(.+)$/gm)) {
+                // `import a, b as c` — every comma part counts; sanitize each to a leading dotted name so a
+                // trailing `;`/comment fragment can never fabricate a package token.
+                for (const part of m[1].split(','))
+                    add(/^[A-Za-z_][\w.]*/.exec(part.trim())?.[0]);
+            }
+            for (const m of src.matchAll(/^\s*from\s+([.\w]+)\s+import\b/gm))
+                add(m[1]);
+        }
+    }
+    catch {
+        return out; // never throw — observe-first
+    }
+    return out;
+}
+function dependencyDelta(before, after, lang) {
+    const had = externalImportsOf(before, lang);
+    return [...externalImportsOf(after, lang)].filter((x) => !had.has(x)).sort();
+}

package/dist/holmes/hooks/stop.d.ts

@@ -114,6 +114,27 @@ export declare function changedAnchoredAspecs(root: string): string[] | undefine
  * which produces no violation. Failing closed here would block every ungoverned scratch directory.
  */
 export declare function unanchoredChangedSources(root: string): string[] | undefined;
+export interface DependencyReappraisal {
+    file: string;
+    aspecs: string[];
+    packages: string[];
+}
+export interface ReappraisalIO {
+    status?: () => string | undefined;
+    show?: (rel: string) => string | undefined;
+    read?: (rel: string) => string | undefined;
+}
+export declare function dependencyReappraisals(root: string, isApproved: (id: string) => boolean, io?: ReappraisalIO): DependencyReappraisal[];
+export declare function reappraisalWarningLine(reaps: DependencyReappraisal[]): string | null;
+export declare function escalateReappraisals(root: string, reaps: DependencyReappraisal[], opts: {
+    autonomous: boolean;
+    enqueue: (root: string, req: {
+        kind: string;
+        target: string;
+        why: string;
+    }) => boolean;
+    readQueueLines?: (root: string) => string[];
+}): number;
 /**
  * @implements A-SPEC-453
  * ART-5 evidence: approvals that happened without the approving act.

package/dist/holmes/hooks/stop.js

@@ -36,6 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_CONSECUTIVE_BLOCKS = void 0;
 exports.changedAnchoredAspecs = changedAnchoredAspecs;
 exports.unanchoredChangedSources = unanchoredChangedSources;
+exports.dependencyReappraisals = dependencyReappraisals;
+exports.reappraisalWarningLine = reappraisalWarningLine;
+exports.escalateReappraisals = escalateReappraisals;
 exports.unrecordedApprovals = unrecordedApprovals;
 exports.rolledBackLedgers = rolledBackLedgers;
 exports.governanceLostPreflight = governanceLostPreflight;
@@ -50,6 +53,9 @@ exports.readGuardCount = readGuardCount;
 exports.writeGuardCount = writeGuardCount;
 const fs = __importStar(require("node:fs"));
 const npx_bin_1 = require("../project/npx-bin");
+const approval_queue_1 = require("../governance/approval-queue");
+const dependency_delta_1 = require("../guardrail/dependency-delta");
+const autonomy_1 = require("../governance/autonomy");
 const risk_gate_1 = require("../guardrail/risk-gate");
 const json_state_1 = require("../project/json-state");
 const node_child_process_1 = require("node:child_process");
@@ -74,7 +80,9 @@ function changedAnchoredAspecs(root) {
     const VENDORED = /^(?:reference|node_modules|dist|build|vendor|third_party)\//;
     let raw;
     try {
-        raw = (0, node_child_process_1.execFileSync)('git', ['status', '--porcelain', '-uall'], {
+        // @implements A-SPEC-560.3 — quotepath OFF, or a non-ASCII-named source arrives octal-escaped
+        // and its ART-8 evidence silently vanishes (shared defect with the reappraisal detector).
+        raw = (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], {
             cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)(),
         });
     }
@@ -120,7 +128,8 @@ function unanchoredChangedSources(root) {
     try {
         // `-uall`: without it git folds a wholly-untracked directory into one `?? src/` line and the
         // files inside it are never seen — which is precisely where a bypassed write lands.
-        raw = (0, node_child_process_1.execFileSync)('git', ['status', '--porcelain', '-uall'], {
+        // @implements A-SPEC-560.3 — quotepath OFF (same octal-escape blindness as the siblings).
+        raw = (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], {
             cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)(),
         });
     }
@@ -148,6 +157,141 @@ function unanchoredChangedSources(root) {
     }
     return out;
 }
+const REAPPRAISAL_VENDORED = /^(?:reference|node_modules|dist|build|vendor|third_party)\//;
+function depLangOf(rel) {
+    if (/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(rel))
+        return 'ts';
+    if (/\.py$/.test(rel))
+        return 'py';
+    return undefined;
+}
+function dependencyReappraisals(root, isApproved, io = {}) {
+    // @implements A-SPEC-560.3 — quotepath OFF: with the default core.quotepath, a Korean- (or any
+    // non-ASCII/quote-) named file arrives octal-escaped, the read then ENOENTs, and the signal is
+    // silently lost. Measured: 2 of 4 drifting files detected before this flag.
+    const status = io.status ?? (() => {
+        try {
+            return (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'status', '--porcelain', '-uall'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() });
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const show = io.show ?? ((rel) => {
+        try {
+            return (0, node_child_process_1.execFileSync)('git', ['-c', 'core.quotepath=false', 'show', `HEAD:${rel}`], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() });
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const read = io.read ?? ((rel) => {
+        try {
+            return fs.readFileSync(path.join(root, rel), 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    });
+    let raw;
+    try {
+        raw = status();
+    }
+    catch {
+        raw = undefined;
+    }
+    if (raw === undefined)
+        return [];
+    const out = [];
+    for (const line of raw.split('\n')) {
+        if (line.trim() === '')
+            continue;
+        let rel = line.slice(3).trim().replace(/^"|"$/g, '');
+        if (rel.includes(' -> '))
+            rel = rel.split(' -> ')[1]; // renames name the destination
+        const lang = depLangOf(rel);
+        if (lang === undefined || REAPPRAISAL_VENDORED.test(rel))
+            continue;
+        let after;
+        try {
+            after = read(rel);
+        }
+        catch {
+            after = undefined;
+        }
+        if (after === undefined)
+            continue; // deleted / unreadable
+        const aspecs = [...new Set([...after.matchAll(/@implements\s+(A-SPEC-\d+(?:\.\d+)?)/g)].map((m) => m[1]))].filter(isApproved).sort();
+        if (aspecs.length === 0)
+            continue; // not inside an APPROVED A-SPEC scope
+        let before;
+        try {
+            before = show(rel);
+        }
+        catch {
+            before = undefined;
+        }
+        if (before === undefined)
+            continue; // no HEAD version = a new file, not in-scope drift
+        let packages = [];
+        try {
+            packages = (0, dependency_delta_1.dependencyDelta)(before, after, lang);
+        }
+        catch {
+            packages = [];
+        }
+        if (packages.length > 0)
+            out.push({ file: rel, aspecs, packages });
+    }
+    return out;
+}
+function reappraisalWarningLine(reaps) {
+    if (reaps.length === 0)
+        return null;
+    return reaps.map((r) => `[Holmes-Kit] spec-reappraisal: ${r.file} introduces external dependency ${r.packages.join(', ')} inside approved ${r.aspecs.join(', ')} scope — this looks like an architecture change; update the spec or open a sub-slice.`).join('\n');
+}
+// @implements A-SPEC-560.3 — decision-respecting escalation: a reappraisal the owner already decided
+// (granted/denied in the queue ledger) must not re-pend every turn while the tree stays dirty, and an
+// already-pending one needs no duplicate append. A reader failure fails OPEN (the signal survives).
+function escalateReappraisals(root, reaps, opts) {
+    if (!opts.autonomous)
+        return 0;
+    const readLines = opts.readQueueLines ?? ((r) => fs.readFileSync(path.join(r, approval_queue_1.QUEUE_RELPATH), 'utf8').split('\n'));
+    let lines;
+    try {
+        lines = readLines(root);
+    }
+    catch {
+        lines = [];
+    } // a broken reader fails OPEN — the signal survives
+    let n = 0;
+    for (const r of reaps) {
+        try {
+            const id = (0, approval_queue_1.approvalRequestId)('spec-reappraisal', r.file);
+            let decided = false;
+            let lastEvent;
+            for (const raw of lines) {
+                if (raw.trim() === '')
+                    continue;
+                try {
+                    const e = JSON.parse(raw);
+                    if (e.id !== id)
+                        continue;
+                    lastEvent = String(e.event);
+                    if (lastEvent === 'granted' || lastEvent === 'denied')
+                        decided = true;
+                }
+                catch { /* a corrupt line is not this id's history */ }
+            }
+            if (decided || lastEvent === 'requested')
+                continue; // decided, or already pending — no re-append
+            if (opts.enqueue(root, { kind: 'spec-reappraisal', target: r.file, why: `new external dependency ${r.packages.join(', ')} inside approved ${r.aspecs.join(', ')} — spec update or sub-slice needed` }))
+                n += 1;
+        }
+        catch { /* enqueue failure is best-effort; the warning still surfaced */ }
+    }
+    return n;
+}
 /**
  * @implements A-SPEC-453
  * ART-5 evidence: approvals that happened without the approving act.
@@ -769,6 +913,24 @@ if (require.main === module) {
             let out = evaluateStop(specs, { testCasesByAspec, provenance, executedByAspec, findings, findingsUnreadable, unanchoredChangedSources: unanchored, unrecordedApprovals: unrecorded, rolledBackLedgers: rolledBack, redFirstMode, changedAspecs, outcomesByAspec });
             // @implements A-SPEC-534.4 — track mode records ART-8 findings without blocking: surface them so
             // the operator observes RED-first gaps before an owner promotes the posture to strict.
+            // @implements A-SPEC-559.2 — spec-evolution trigger (observe-first, NEVER blocks): a dirty
+            // in-scope source that newly introduces an external dependency is an architecture-drift signal.
+            // Manual mode warns; autonomy mode also enqueues it so the owner sees the drift async. Fail-open.
+            // @implements A-SPEC-560.3 — placed BEFORE the guard decisions and their early returns, so a
+            // degraded-yield turn (guard state unwritable) still surfaces the drift; stderr-only, so no
+            // verdict path is affected.
+            try {
+                const approvedIds = new Set(specs.filter((s) => s.type === 'A-SPEC' && s.status === 'approved').map((s) => s.id));
+                const reaps = dependencyReappraisals(stopProjectRoot(), (id) => approvedIds.has(id));
+                const line = reappraisalWarningLine(reaps);
+                if (line)
+                    process.stderr.write(`${line}\n`);
+                const nowIso = new Date().toISOString();
+                if (line && (0, autonomy_1.autonomousApprovalEnabled)(process.env, stopProjectRoot(), nowIso)) {
+                    escalateReappraisals(stopProjectRoot(), reaps, { autonomous: true, enqueue: approval_queue_1.enqueueApprovalRequest });
+                }
+            }
+            catch { /* the reappraisal signal is advisory; a failure never affects the stop verdict */ }
             if (out.tracked && out.tracked.length > 0) {
                 process.stderr.write(`[Holmes-Kit] ART-8 RED-first (track): ${out.tracked.map((t) => t.detail).join(' | ')}\n`);
             }

package/dist/holmes/mcp/handlers.js

@@ -189,6 +189,7 @@ const approval_grants_1 = require("../governance/approval-grants");
 const spec_digest_1 = require("../spec/spec-digest");
 const spec_store_2 = require("../spec/spec-store");
 const breaking_change_1 = require("../spec/breaking-change");
+const compat_impact_1 = require("../spec/compat-impact");
 const approval_blockers_1 = require("../spec/approval-blockers");
 const approval_status_1 = require("../spec/approval-status");
 const ledger_timeline_1 = require("../governance/ledger-timeline");
@@ -1560,6 +1561,22 @@ function makeRawHandlers(store, opts) {
             const breakingIssue = (0, breaking_change_1.checkBreakingChangeDeclared)(candidate);
             if (breakingIssue)
                 return { ok: false, reason: breakingIssue };
+            // @implements A-SPEC-565.1 — the compat declaration duty rides the SAME act (REQ-565): sealing
+            // is when "did you consider the three harnesses and the three OSes" is due, and act-time is
+            // what keeps 512 already-approved specs out of retroactive violation (the 38-violation incident
+            // above). The bound reader feeds the OS cross-check from this root's working tree.
+            const compatIssue = (0, compat_impact_1.checkCompatDeclared)(candidate, {
+                // No root → no working tree to read: the OS cross-check skips file-by-file (fail-open),
+                // while the declaration syntax itself is still enforced — the duty never depends on `root`.
+                readFile: (rel) => { try {
+                    return a.root ? fs.readFileSync(path.join(a.root, rel), 'utf8') : null;
+                }
+                catch {
+                    return null;
+                } },
+            });
+            if (compatIssue)
+                return { ok: false, reason: compatIssue };
             // @implements A-SPEC-182
             // A document whose prose is still the generator's placeholder must not be sealed. Measured
             // 2026-08-13 on a brownfield adoption: H-SPEC-100 took `status: approved` and an
@@ -3347,6 +3364,8 @@ independent_test: true
 depends_on:
   - ${hspecId}
 breaking_change: 'none'
+harness_impact: 'none: TODO — 3하네스(claude/codex/agy) 영향 검토 후 기술'
+os_impact: 'none: TODO — 3OS(windows/mac/linux) 영향 검토 후 기술'
 ---
 
 ## Objective

package/dist/holmes/project/root.js

@@ -77,7 +77,15 @@ function cleanSubprocessEnv(env = process.env) {
  * evidence run would disarm every test that verifies a gate, and that contamination masks red as
  * green — the worse direction of the two.
  */
-const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE']);
+// @implements A-SPEC-561.1
+// `HOLMES_AUTONOMOUS_APPROVAL` joins the list for the SAME reason, pointing the same way as the
+// HOLMES_SPECS incident above: measured 2026-09-06, a project that opted into autonomy
+// (`init --autonomy` persists the switch into .mcp.json) starts its MCP server with that env, the
+// server's `test_run` handed it to the jest children, and REQ-551's autonomy branch then skipped the
+// elicitation path — 9 elicitation tests red on a tree whose full suite was green, twice, and
+// identically on the previous commit. A posture is an approval channel, never a property of the code
+// under test; an evidence run must judge the same in an autonomous workspace and a human-gated one.
+const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE', 'HOLMES_AUTONOMOUS_APPROVAL']);
 function cleanTestEnv(env = process.env) {
     const cleaned = cleanSubprocessEnv(env);
     for (const k of Object.keys(cleaned)) {

package/dist/holmes/review/test-outcomes.d.ts

@@ -1,5 +1,7 @@
 import { TestOutcome } from './test-runner';
 export declare const OUTCOMES_FILE: string;
+export declare function outcomesFilename(replica: string): string;
+export declare function isOutcomesFilename(name: string): boolean;
 /**
  * A durable, append-only record of a per-A-SPEC test outcome (REQ-534 RED-first evidence). Unlike
  * `test-evidence.json` (overwritten each run), the SEQUENCE matters here — a red-assertion followed
@@ -14,9 +16,22 @@ export interface OutcomeRecord {
     head: string;
     testFileDigest?: string;
 }
-/** Append outcome records as JSONL lines. Fail-open (recording must never break a run). */
+/**
+ * Append outcome records as JSONL lines. Fail-open (recording must never break a run).
+ *
+ * @implements A-SPEC-562.1 — writes to THIS machine's chain (`test-outcomes.<replica>.jsonl`), never
+ * to the shared legacy file, so two machines appending in parallel produce two files git merges
+ * without a conflict. The call site is unchanged; only the destination moved.
+ */
 export declare function appendOutcomes(root: string, records: OutcomeRecord[]): boolean;
-/** Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers). */
+/**
+ * Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers).
+ *
+ * @implements A-SPEC-562.1 — reads the legacy file AND every replica chain, merged by `ts`. The sort
+ * is what keeps ART-8 honest after a merge: the article reads a red-assertion FOLLOWED BY a green, and
+ * with two machines that pair can straddle two files. A stable sort keeps same-timestamp records in
+ * read order rather than inventing an ordering between them.
+ */
 export declare function readOutcomes(root: string): OutcomeRecord[];
 /**
  * @implements A-SPEC-534.5

package/dist/holmes/review/test-outcomes.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OUTCOMES_FILE = void 0;
+exports.outcomesFilename = outcomesFilename;
+exports.isOutcomesFilename = isOutcomesFilename;
 exports.appendOutcomes = appendOutcomes;
 exports.readOutcomes = readOutcomes;
 exports.buildOutcomeRecords = buildOutcomeRecords;
@@ -41,11 +43,30 @@ exports.groupOutcomesByAspec = groupOutcomesByAspec;
 // @implements A-SPEC-534.3
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const replica_id_1 = require("../governance/replica-id");
 exports.OUTCOMES_FILE = path.join('.ax', 'ledger', 'test-outcomes.jsonl');
-/** Append outcome records as JSONL lines. Fail-open (recording must never break a run). */
+// @implements A-SPEC-562.1 — outcomes join the ledger's REPLICA convention (A-SPEC-148): one file per
+// machine, so two machines appending never conflict on merge and a colleague's clone carries both
+// histories. The shape mirrors `isLedgerFilename` exactly — legacy single file OR a dot-free segment —
+// because two rules disagreeing about the same file is worse than either being wrong. Wired below.
+const OUTCOMES_LEGACY = 'test-outcomes.jsonl';
+const OUTCOMES_REPLICA_FILE = /^test-outcomes\.([^.]+)\.jsonl$/;
+function outcomesFilename(replica) {
+    return `test-outcomes.${replica}.jsonl`;
+}
+function isOutcomesFilename(name) {
+    return name === OUTCOMES_LEGACY || OUTCOMES_REPLICA_FILE.test(name);
+}
+/**
+ * Append outcome records as JSONL lines. Fail-open (recording must never break a run).
+ *
+ * @implements A-SPEC-562.1 — writes to THIS machine's chain (`test-outcomes.<replica>.jsonl`), never
+ * to the shared legacy file, so two machines appending in parallel produce two files git merges
+ * without a conflict. The call site is unchanged; only the destination moved.
+ */
 function appendOutcomes(root, records) {
     try {
-        const file = path.join(root, exports.OUTCOMES_FILE);
+        const file = path.join(root, '.ax', 'ledger', outcomesFilename((0, replica_id_1.resolveReplicaId)(root)));
         fs.mkdirSync(path.dirname(file), { recursive: true });
         fs.appendFileSync(file, records.map((r) => `${JSON.stringify(r)}\n`).join(''));
         return true;
@@ -54,30 +75,48 @@ function appendOutcomes(root, records) {
         return false;
     }
 }
-/** Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers). */
+/**
+ * Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers).
+ *
+ * @implements A-SPEC-562.1 — reads the legacy file AND every replica chain, merged by `ts`. The sort
+ * is what keeps ART-8 honest after a merge: the article reads a red-assertion FOLLOWED BY a green, and
+ * with two machines that pair can straddle two files. A stable sort keeps same-timestamp records in
+ * read order rather than inventing an ordering between them.
+ */
 function readOutcomes(root) {
-    let text;
+    const dir = path.join(root, '.ax', 'ledger');
+    let names;
     try {
-        text = fs.readFileSync(path.join(root, exports.OUTCOMES_FILE), 'utf8');
+        names = fs.readdirSync(dir).filter(isOutcomesFilename).sort();
     }
     catch {
         return [];
     }
     const out = [];
-    for (const line of text.split('\n')) {
-        const s = line.trim();
-        if (!s)
-            continue;
+    let i = 0;
+    for (const name of names) {
+        let text;
         try {
-            const r = JSON.parse(s);
-            if (r && typeof r === 'object' && typeof r.aspec === 'string' && typeof r.outcome === 'string'
-                && typeof r.ts === 'string' && typeof r.head === 'string') {
-                out.push(r);
+            text = fs.readFileSync(path.join(dir, name), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of text.split('\n')) {
+            const s = line.trim();
+            if (!s)
+                continue;
+            try {
+                const r = JSON.parse(s);
+                if (r && typeof r === 'object' && typeof r.aspec === 'string' && typeof r.outcome === 'string'
+                    && typeof r.ts === 'string' && typeof r.head === 'string') {
+                    out.push({ r: r, i: i++ });
+                }
             }
+            catch { /* skip a corrupt line rather than fail the whole read */ }
         }
-        catch { /* skip a corrupt line rather than fail the whole read */ }
     }
-    return out;
+    return out.sort((a, b) => (a.r.ts < b.r.ts ? -1 : a.r.ts > b.r.ts ? 1 : a.i - b.i)).map((e) => e.r);
 }
 /**
  * @implements A-SPEC-534.5

package/dist/holmes/spec/approval-blockers.js

@@ -10,6 +10,7 @@ exports.unactionableCriteriaBlocker = unactionableCriteriaBlocker;
 const acceptance_quality_1 = require("./acceptance-quality");
 const validator_1 = require("./validator");
 const breaking_change_1 = require("./breaking-change");
+const compat_impact_1 = require("./compat-impact");
 const spec_digest_1 = require("./spec-digest");
 const spec_types_1 = require("./spec-types");
 const draft_1 = require("../reverse/draft");
@@ -204,6 +205,13 @@ function approvalBlockers(spec, resolve) {
     const breaking = (0, breaking_change_1.checkBreakingChangeDeclared)(candidate);
     if (breaking)
         out.push(breaking);
+    // @implements A-SPEC-565.1 — the compat duty pre-announced where breaking_change is: whatever the
+    // act refuses with, the gate must already have told the author (A-SPEC-182's parity). No file
+    // reader here — the gate context has no root — so the OS *content* cross-check stays act-only;
+    // the declaration syntax and the FtT harness-surface contradiction are fully pre-announced.
+    const compat = (0, compat_impact_1.checkCompatDeclared)(candidate);
+    if (compat)
+        out.push(compat);
     const stubs = placeholderSections(spec);
     if (stubs.length > 0) {
         out.push((0, exports.placeholderMessage)(stubs));

package/dist/holmes/spec/compat-impact.d.ts

@@ -0,0 +1,26 @@
+import { Spec } from './spec-parser';
+/**
+ * REQ-565's enforcement device: the obligation to declare HARNESS (claude/codex/agy) and OS
+ * (windows/mac/linux) impact lives on the ACT of approval — the exact shape ADR-013 gave
+ * `breaking_change`, and for the same measured reason (a static `requiredFields` predicate turned
+ * 38 already-approved specs into ART-3 violations and bricked the harness; act-time converges
+ * instead: any spec that changes re-approves and acquires the fields, a spec that never changes
+ * can introduce no new incompatibility).
+ *
+ * WHY a gate and not a habit, measured twice in one day: an observability design came out
+ * Claude-biased (Stop hook + transcript_path is a Claude-only channel — the owner caught it), and
+ * the Stop hook's own header records that voluntarily-invoked discipline fired 0/143 times. Memory
+ * is rationale storage; control is a gate.
+ *
+ * WHAT THIS DOES NOT DO: verify the declarations are TRUE. Truth belongs to the layers that measure
+ * it — adapter parity (A-SPEC-336~338), doctor's wiring checks, on-device E2E. This gate makes
+ * skipping the thought impossible and makes a false declaration an auditable record.
+ */
+export declare const HARNESS_CELLS: readonly ["claude", "codex", "agy"];
+export declare const OS_CELLS: readonly ["windows", "mac", "linux"];
+export declare const CELL_VERDICTS: readonly ["supported", "unavailable", "n-a"];
+export interface CompatCheckOpts {
+    /** Repo-relative reader for the OS cross-check; null = file absent (skip, fail-open). */
+    readFile?: (rel: string) => string | null;
+}
+export declare function checkCompatDeclared(spec: Spec, opts?: CompatCheckOpts): string | null;