@holmes-lab/holmes-kit 0.19.2 → 0.19.4

package/dist/holmes/cli/test-platform.js

@@ -1,8 +1,48 @@
 "use strict";
-// @implements A-SPEC-220.3
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.posixOnly = posixOnly;
 exports.posixOnlyNonRoot = posixOnlyNonRoot;
+exports.foldsCase = foldsCase;
+exports.posixOnlyWithCommand = posixOnlyWithCommand;
+exports.win32Only = win32Only;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+// @implements A-SPEC-220.3
+// @implements A-SPEC-597
 /**
  * A test that cannot run here says so, instead of returning early and being counted as a pass.
  *
@@ -36,3 +76,88 @@ function posixOnlyNonRoot(reason, platform = process.platform, uid = typeof proc
     const base = posixOnly(reason, platform);
     return uid === 0 ? it.skip : base;
 }
+/**
+ * @implements A-SPEC-597
+ * Whether THIS directory's filesystem folds case — measured, never inferred from the platform.
+ *
+ * macOS defaults to case-insensitive APFS and Linux to case-sensitive ext4, but neither is a rule:
+ * a case-sensitive volume mounts fine on macOS, and `os.tmpdir()` need not share the repository's
+ * volume. The same reasoning already governs the write gate (`pre-tool-use.ts`), which probes the
+ * project root rather than trusting `process.platform`; a test must probe the directory it actually
+ * writes into.
+ *
+ * An unanswerable probe returns FALSE. Claiming "folds" when it cannot tell would let a
+ * folding-world assertion run — and pass vacuously — on a case-sensitive box; claiming "sensitive"
+ * merely runs the other assertion, which fails loudly if it is wrong. Be wrong toward the side that
+ * still produces information.
+ */
+function foldsCase(dir) {
+    if (typeof dir !== 'string' || dir === '')
+        return false;
+    const probe = path.join(dir, `.case-probe-${process.pid}-${(0, node_crypto_1.randomUUID)()}`);
+    try {
+        fs.writeFileSync(probe, '');
+        const flipped = path.join(dir, path.basename(probe).toUpperCase());
+        return fs.existsSync(flipped);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        // The probe leaves no trace, on every path out of here.
+        try {
+            fs.rmSync(probe, { force: true });
+        }
+        catch { /* nothing was created */ }
+    }
+}
+/** PATH lookup without a shell — spawning one to ask about a command is a cost and a surface. */
+function onPath(command) {
+    if (typeof command !== 'string' || command === '')
+        return false;
+    if (command.includes('/') || command.includes('\\'))
+        return fs.existsSync(command);
+    const sep = process.platform === 'win32' ? ';' : ':';
+    const exts = process.platform === 'win32' ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const dir of (process.env.PATH ?? '').split(sep)) {
+        if (dir === '')
+            continue;
+        for (const ext of exts) {
+            try {
+                if (fs.existsSync(path.join(dir, command + ext)))
+                    return true;
+            }
+            catch { /* unreadable PATH entry */ }
+        }
+    }
+    return false;
+}
+/**
+ * @implements A-SPEC-597
+ * As `posixOnlyNonRoot`, and additionally skipped when `command` is not on PATH.
+ *
+ * `chflags` is macOS/BSD only. Guarded by platform and uid alone, the assertion that uses it RAN on
+ * Linux and died with ENOENT — which reads as a defect in the code under test rather than as a tool
+ * this machine does not have. Availability of the tool is knowable at definition time, exactly like
+ * the platform and the uid, so it belongs in the same choice.
+ */
+function posixOnlyWithCommand(reason, command, platform = process.platform, uid = typeof process.getuid === 'function' ? process.getuid() : undefined, lookup = onPath) {
+    const base = posixOnlyNonRoot(reason, platform, uid); // reason is validated here, before anything else
+    return lookup(command) ? base : it.skip;
+}
+/**
+ * @implements A-SPEC-255
+ * The mirror of `posixOnly`: a test whose SUBJECT only exists on Windows.
+ *
+ * Without this, the Windows work had nowhere to put such a test and improvised
+ * `(process.platform === 'win32' ? it : it.skip)('…')` — a skip with no stated reason, which is the
+ * silence `posixOnly` was written to end, in different syntax. NTFS ACLs, PowerShell 5.1 parsing and
+ * 8.3 short names are real subjects; they simply cannot be exercised on a POSIX box, and saying so
+ * in the report is the honest form. `reason` is required for the same reason it is required there.
+ */
+function win32Only(reason, platform = process.platform) {
+    if (typeof reason !== 'string' || reason.trim().length === 0) {
+        throw new Error('win32Only(reason): 사유 없는 스킵은 문법만 바뀐 침묵입니다 — 왜 이 단언이 POSIX에서 무의미한지 적으십시오.');
+    }
+    return platform === 'win32' ? it : it.skip;
+}

package/dist/holmes/governance/approval-grants.js

@@ -132,11 +132,34 @@ function resolveApproval(root, envApproval, action, now) {
  * The nonce is flattened to a basename so a traversal-shaped nonce cannot reach outside the dir.
  */
 function consumeGrantFile(root, nonce) {
+    // @implements A-SPEC-596 — address the grant the SAME way `readGrants` does: by the nonce INSIDE
+    // the file, never by a path built from it. Building the path meant a grant whose filename differed
+    // from its nonce was honoured (reading scans, and never compares the two) yet never spent, with
+    // `force: true` swallowing the miss — a single-use grant that stayed spendable forever. Scanning
+    // also makes traversal structurally impossible: no nonce becomes a path, so none can point out.
+    const dir = path.join(root, exports.GRANTS_RELDIR);
+    const wanted = String(nonce);
+    let removed = 0;
     try {
-        const name = path.basename(String(nonce)) + '.json';
-        fs.rmSync(path.join(root, exports.GRANTS_RELDIR, name), { force: true });
+        for (const name of fs.readdirSync(dir).filter((n) => n.endsWith('.json'))) {
+            const file = path.join(dir, name);
+            try {
+                const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+                if (String(parsed?.nonce) !== wanted)
+                    continue; // someone else's grant is not ours to spend
+                fs.rmSync(file, { force: true });
+                removed++;
+            }
+            catch { /* corrupt or vanished: it was never honoured either, so it is not ours to spend */ }
+        }
     }
     catch {
-        /* the act already succeeded; a stuck file is bounded by expires */
+        // No directory, or it cannot be read: there is nothing to spend, which is an ordinary state.
+        return;
+    }
+    if (removed === 0) {
+        // Consumption runs AFTER the act succeeded, so this must never throw — but it must not be silent
+        // either: an unspent single-use grant is still spendable, and nobody would know.
+        process.stderr.write(`[Holmes-Kit] approval grant was used but no grant file matched it — the grant may still be spendable. Remove it by hand from ${exports.GRANTS_RELDIR}.\n`);
     }
 }

package/dist/holmes/governance/autonomy.d.ts

@@ -9,7 +9,23 @@ export declare function isHighRiskPath(p: string): boolean;
  * parent-aware rules (kept in the signature so callers wire it once); the current bound is decided
  * from the spec itself.
  */
-export declare function specApprovalAutonomy(spec: Spec, _resolveParent: (id: string) => Spec | null): ApprovalAutonomy;
+/**
+ * @implements A-SPEC-587
+ * The A-SPECs whose chain leads up to `spec`: one hop for an H-SPEC (A-SPECs that depend on it),
+ * two for a REQ (through its H-SPECs). Anything else has no downstream A-SPECs. Pure; `depends_on`
+ * is the only edge this repository's chain uses.
+ */
+export declare function descendantAspecs(spec: Spec, all: Spec[]): Spec[];
+/**
+ * @implements A-SPEC-587
+ * The autonomy verdict for approving THIS spec. `resolveParent` is accepted for future parent-aware
+ * rules. `descendants` — the A-SPECs beneath a REQ/H-SPEC (see `descendantAspecs`) — is what lets an
+ * upstream document be graded by the code it will admit: a REQ or H-SPEC carries no code of its
+ * own, so its risk IS the risk its A-SPECs declare (REQ-587, the owner's line: only irreversible,
+ * architectural or high-risk changes ask a human). Every downstream A-SPEC auto → auto; any hitl,
+ * or no A-SPEC at all (unknown scope) → human. The two-argument call keeps the old answer.
+ */
+export declare function specApprovalAutonomy(spec: Spec, resolveParent: (id: string) => Spec | null, descendants?: Spec[]): ApprovalAutonomy;
 export declare const SESSION_AUTONOMY_MARKER: readonly [".ax", "state", "autonomy.json"];
 export declare function sessionAutonomyActive(root: string, now: string): boolean;
 /** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope

package/dist/holmes/governance/autonomy.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SESSION_AUTONOMY_MARKER = exports.AUTONOMY_ENV = void 0;
 exports.isHighRiskPath = isHighRiskPath;
+exports.descendantAspecs = descendantAspecs;
 exports.specApprovalAutonomy = specApprovalAutonomy;
 exports.sessionAutonomyActive = sessionAutonomyActive;
 exports.projectDefaultAutonomy = projectDefaultAutonomy;
@@ -48,8 +49,9 @@ exports.releaseAutonomy = releaseAutonomy;
 // the MCP elicitation TUI. The governance chain (REQ→H→A→T→CPG + RTM + taint + phase gate) already
 // forces quality structurally, so a low/mid-risk spec self-approving under an explicitly-enabled
 // autonomous mode is a small, bounded relaxation (REQ-532). The bound is what this module owns: the
-// governance-critical specs — gate behaviour, architecture, taint/security boundaries, and every
-// upstream REQ/H-SPEC/C-SPEC — never leave the human channel.
+// governance-critical specs — gate behaviour, architecture (C-SPEC/ADR), taint/security boundaries —
+// never leave the human channel. An upstream REQ/H-SPEC is graded by the A-SPECs beneath it
+// (REQ-587): all auto → auto; any hitl, or none yet → human.
 //
 // PURE: the spec, a parent resolver, and (separately) the env are the only inputs; the wiring layer
 // (A-SPEC-532.2) injects process.env and the elicitor.
@@ -126,15 +128,45 @@ const AUTO_GRADES = new Set(['none', 'persisted-artifact', 'derived-artifact', '
  * parent-aware rules (kept in the signature so callers wire it once); the current bound is decided
  * from the spec itself.
  */
-function specApprovalAutonomy(spec, _resolveParent) {
+/**
+ * @implements A-SPEC-587
+ * The A-SPECs whose chain leads up to `spec`: one hop for an H-SPEC (A-SPECs that depend on it),
+ * two for a REQ (through its H-SPECs). Anything else has no downstream A-SPECs. Pure; `depends_on`
+ * is the only edge this repository's chain uses.
+ */
+function descendantAspecs(spec, all) {
+    const dependsOn = (s, id) => Array.isArray(s.dependsOn) && s.dependsOn.includes(id);
+    if (spec.type === 'H-SPEC')
+        return all.filter((s) => s.type === 'A-SPEC' && dependsOn(s, spec.id));
+    if (spec.type === 'REQ') {
+        const hs = all.filter((s) => s.type === 'H-SPEC' && dependsOn(s, spec.id));
+        return all.filter((s) => s.type === 'A-SPEC' && hs.some((h) => dependsOn(s, h.id)));
+    }
+    return [];
+}
+/**
+ * @implements A-SPEC-587
+ * The autonomy verdict for approving THIS spec. `resolveParent` is accepted for future parent-aware
+ * rules. `descendants` — the A-SPECs beneath a REQ/H-SPEC (see `descendantAspecs`) — is what lets an
+ * upstream document be graded by the code it will admit: a REQ or H-SPEC carries no code of its
+ * own, so its risk IS the risk its A-SPECs declare (REQ-587, the owner's line: only irreversible,
+ * architectural or high-risk changes ask a human). Every downstream A-SPEC auto → auto; any hitl,
+ * or no A-SPEC at all (unknown scope) → human. The two-argument call keeps the old answer.
+ */
+function specApprovalAutonomy(spec, resolveParent, descendants) {
     switch (spec.type) {
         case 'T-SPEC':
             return 'auto'; // tests are low risk
         case 'REQ':
-        case 'H-SPEC':
+        case 'H-SPEC': {
+            const below = (descendants ?? []).filter((s) => s.type === 'A-SPEC');
+            if (below.length === 0)
+                return 'hitl'; // unknown scope stays human
+            return below.every((a) => specApprovalAutonomy(a, resolveParent) === 'auto') ? 'auto' : 'hitl';
+        }
         case 'C-SPEC':
         case 'ADR': // @implements A-SPEC-571.1 — a decision is the human's to seal
-            return 'hitl'; // wide blast radius / structural constraint
+            return 'hitl'; // architecture / structural constraint — the owner's exception
         case 'A-SPEC': {
             const grade = breakingGrade(spec);
             if (grade === null || !AUTO_GRADES.has(grade))

package/dist/holmes/mcp/handlers.d.ts

@@ -183,6 +183,30 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
      * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
      * drift detection compares against — would silently go stale.
      */
+    spec_renumber(a: {
+        root?: string;
+        oldBase: string;
+        newBase: string;
+        dryRun?: boolean;
+    }): Promise<{
+        ok: boolean;
+        reason: string;
+        dryRun?: undefined;
+        plan?: undefined;
+        movedSpecs?: undefined;
+    } | {
+        ok: boolean;
+        dryRun: boolean;
+        plan: import("../spec/renumber").RenumberPlan;
+        reason?: undefined;
+        movedSpecs?: undefined;
+    } | {
+        ok: boolean;
+        dryRun: boolean;
+        movedSpecs: number;
+        plan: import("../spec/renumber").RenumberPlan;
+        reason?: undefined;
+    }>;
     spec_unseal(a: {
         root?: string;
         id: string;
@@ -579,15 +603,15 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         head?: string;
         since?: string;
     }): Promise<{
-        semanticWarm?: {
-            tier: string;
-            computed: number;
-            cached: number;
-        } | undefined;
         changed: number;
         nodes: number;
         edges: number;
         changeSource: ChangeSourceInfo;
+        semanticWarm?: {
+            tier: string;
+            computed: number;
+            cached: number;
+        };
     }>;
     context_bundle(a: {
         root: string;
@@ -779,6 +803,7 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
     }): Promise<{
         ok: boolean;
         approvedSpecs: string[];
+        alreadySealed: string[];
         refused: {
             id: string;
             reason: string;

package/dist/holmes/mcp/handlers.js

@@ -38,6 +38,7 @@ exports.isHandlerRefusal = isHandlerRefusal;
 exports.unreadableAmong = unreadableAmong;
 exports.makeHandlers = makeHandlers;
 exports.collectDecisions = collectDecisions;
+// @implements A-SPEC-599
 // @implements A-SPEC-293
 // @implements A-SPEC-292
 // @implements A-SPEC-290
@@ -255,6 +256,7 @@ const ignore_1 = require("../project/ignore");
 // @implements A-SPEC-126
 const scan_1 = require("../reverse/scan");
 const draft_1 = require("../reverse/draft");
+const renumber_1 = require("../spec/renumber");
 const adr_refs_1 = require("../spec/adr-refs");
 const spec_id_guard_1 = require("./spec-id-guard");
 const anchor_1 = require("../reverse/anchor");
@@ -376,7 +378,7 @@ function specStoreBlindReason(store, root, loaded) {
     // Compared through realpath: on macOS a temp root is `/var/...` while the same directory resolves
     // to `/private/var/...`, and a plain string compare calls the correctly-bound store foreign.
     const real = (p) => { try {
-        return fs.realpathSync(p);
+        return (0, root_2.canonicalPath)(p);
     }
     catch {
         return path.resolve(p);
@@ -779,10 +781,11 @@ function makeRawHandlers(store, opts) {
     // rides the existing seal path, but its actor names `autonomous:<client>` so an audit can tell a
     // self-approved seal from a human-approved (elicitation) or operator (env/grant) one. Single-use
     // by construction — it exists only inside this call, persisted nowhere.
-    const autonomousApproval = () => ({
+    const autonomousApproval = (derivedFrom) => ({
         actor: `autonomous:${opts?.clientName?.() ?? 'unknown'}`,
         token: crypto.randomUUID(),
-        rationale: `autonomous grant (${'HOLMES_AUTONOMOUS_APPROVAL'} enabled, spec grade auto)`,
+        // @implements A-SPEC-587 — an upstream grade is DERIVED; the audit line names the A-SPECs it came from.
+        rationale: `autonomous grant (${'HOLMES_AUTONOMOUS_APPROVAL'} enabled, spec grade auto${derivedFrom && derivedFrom.length > 0 ? ` — derived from ${derivedFrom.join(', ')}` : ''})`,
     });
     /**
      * Where the audit record for a governance act belongs — resolved BEFORE the act writes anything.
@@ -1241,6 +1244,38 @@ function makeRawHandlers(store, opts) {
          * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
          * drift detection compares against — would silently go stale.
          */
+        // @implements A-SPEC-255 — the WIRING only. The judgment is `planRenumber`, which is pure and
+        // tested directly; this handler adds no rules of its own. Re-sealing is deliberately absent:
+        // `spec_approve` is the only sealer, so the plan reports the two ORDERS and the caller runs them.
+        // @implements A-SPEC-255 — WIRING only. The judgment lives in `planRenumber`, which is pure and
+        // tested directly; nothing here adds a rule. Re-sealing is deliberately absent: `spec_approve`
+        // is the only sealer (a second sealer becomes a second truth), so the plan reports the two
+        // ORDERS and the caller runs them. `dryRun` defaults to true — a renumber is read before it runs.
+        async spec_renumber(a) {
+            const specsRoot = store.specsRoot;
+            if (typeof specsRoot !== 'string')
+                return { ok: false, reason: '파일 스토어에 묶인 서버에서만 리넘버할 수 있습니다.' };
+            const projectRoot = path.resolve(specsRoot, '..', '..');
+            const plan = (0, renumber_1.planRenumber)({
+                specs: (0, renumber_1.readSpecsForRenumber)(specsRoot),
+                sources: (0, renumber_1.readSourcesForRenumber)(projectRoot),
+                oldBase: String(a.oldBase), newBase: String(a.newBase),
+            });
+            if (plan.refusal)
+                return { ok: false, reason: plan.refusal };
+            if (a.dryRun !== false)
+                return { ok: true, dryRun: true, plan };
+            const movedSpecs = (0, renumber_1.applyRenumber)(specsRoot, { ...plan, anchors: [] });
+            (0, renumber_1.applyRenumber)(projectRoot, { ...plan, moves: [], dependsOn: [], slices: [] });
+            new ledger_store_1.FileLedgerStore(path.join(projectRoot, '.ax', 'ledger')).append({
+                ts: new Date().toISOString(),
+                actor: 'spec_renumber',
+                kind: 'spec-renumbered',
+                summary: `renumbered base ${a.oldBase} -> ${a.newBase}: ${movedSpecs} spec(s), ${plan.anchors.length} anchored file(s), ${plan.proseCandidates.length} prose candidate(s) left for a human`,
+                inputs: plan.moves.map((m) => `${m.oldId}->${m.newId}`),
+            });
+            return { ok: true, dryRun: false, movedSpecs, plan };
+        },
         async spec_unseal(a) {
             const all = await store.list();
             if (all.filter((s) => s.id === a.id).length > 1) {
@@ -1526,9 +1561,14 @@ function makeRawHandlers(store, opts) {
                     // @implements A-SPEC-553.1 — autonomy is the out-of-band env switch OR a valid, non-expired
                     // session envelope marker under this project's `.ax/state/` (which an agent cannot write).
                     const autonomyOn = (0, autonomy_1.autonomousApprovalEnabled)(process.env, a.root, new Date().toISOString());
+                    // @implements A-SPEC-587 — an upstream REQ/H-SPEC is graded by the A-SPECs beneath it, so
+                    // the store is consulted for its descendants (only then: the list is a cost the auto-grade
+                    // A-SPEC/T-SPEC path does not pay). Unknown scope (none yet) keeps the human answer.
+                    const upstream = target.spec.type === 'REQ' || target.spec.type === 'H-SPEC';
+                    const below = autonomyOn && upstream ? (0, autonomy_1.descendantAspecs)(target.spec, await store.list()) : undefined;
                     if (autonomyOn
-                        && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec])) === 'auto') {
-                        approveResolved = { approval: autonomousApproval(), source: 'autonomous' };
+                        && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec]), below) === 'auto') {
+                        approveResolved = { approval: autonomousApproval(below?.map((s) => s.id)), source: 'autonomous' };
                     }
                     else if (autonomyOn) {
                         // @implements A-SPEC-551.1 — hitl-grade spec under autonomy: the in-session elicitation
@@ -2765,7 +2805,7 @@ function makeRawHandlers(store, opts) {
                 graphSchema: RTM_GRAPH_SCHEMA,
                 extractorVersion: RTM_EXTRACTOR_VERSION,
                 sourceCommit: head,
-                specFingerprint: `n:${specs.length}/${specs.map((s) => `${s.id}:${s.status}`).sort().join(',')}`,
+                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
                 scanDigest: (0, graph_store_1.scanDigest)(scanned),
             });
             const g = opened.graph;
@@ -2863,8 +2903,26 @@ function makeRawHandlers(store, opts) {
                 deleted: changes.deleted,
                 renamed: changes.renamed,
             };
-            const g = new rtm_graph_1.RtmGraph();
+            let head = '';
             try {
+                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+            }
+            catch { /* non-git */ }
+            const graphPath = path.join(root, '.ax', 'rtm.sqlite');
+            const tempGraphPath = `${graphPath}.tmp-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+            const opened = (0, graph_store_1.openReusableGraph)(tempGraphPath, {
+                graphSchema: RTM_GRAPH_SCHEMA,
+                extractorVersion: RTM_EXTRACTOR_VERSION,
+                sourceCommit: head,
+                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
+                scanDigest: (0, graph_store_1.scanDigest)(scanned),
+            });
+            const g = opened.graph;
+            let result;
+            try {
+                // Explicit reindex is a persistence operation: discard the previous contents, rebuild the
+                // complete graph, then commit the matching basis before releasing the file (A-SPEC-589).
+                g.clear();
                 (0, rtm_builder_1.buildRtm)(specs, scanned, g);
                 // Scaffold note: `g` was just full-built at HEAD, so applying the
                 // diff on top of it is currently an idempotent no-op in practice
@@ -2877,6 +2935,7 @@ function makeRawHandlers(store, opts) {
                 // graph equals what a full rebuild would have produced. Measured: without this, rtm_reindex
                 // returned a graph with no call edges at all.
                 (0, incremental_1.applyIncremental)(g, changesToApply, { repoRoot: root, specs, scanOne, allScanned: () => scanned });
+                opened.commitBasis();
                 // @implements A-SPEC-478 — the semantic cache WARMING lives here, in the explicit heavy
                 // operation, so the ranking hot path only ever LOOKS UP vectors. Idempotent through the
                 // cache; a tier of none (the shipped default) computes nothing.
@@ -2891,12 +2950,39 @@ function makeRawHandlers(store, opts) {
                     }
                 }
                 catch { /* warming is best-effort; reindex's own result is unaffected */ }
-                return { changed, nodes: g.nodeCount(), edges: g.edgeCount(), changeSource,
+                result = { changed, nodes: g.nodeCount(), edges: g.edgeCount(), changeSource,
                     ...(semanticWarm !== undefined ? { semanticWarm } : {}) };
             }
             finally {
                 g.close(); // release native SQLite handle even if build/apply throws
             }
+            // Publish only after the complete temporary graph is closed. Rename the old file aside so a
+            // Windows reader either keeps the old complete graph or sees the new complete graph; it never
+            // observes a partially built database or a basis that belongs to another file (A-SPEC-589).
+            const backupPath = `${graphPath}.bak-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+            const hadOld = fs.existsSync(graphPath);
+            try {
+                if (hadOld)
+                    fs.renameSync(graphPath, backupPath);
+                fs.renameSync(tempGraphPath, graphPath);
+                if (hadOld)
+                    fs.rmSync(backupPath, { force: true });
+            }
+            catch (error) {
+                try {
+                    if (!fs.existsSync(graphPath) && fs.existsSync(backupPath))
+                        fs.renameSync(backupPath, graphPath);
+                }
+                catch { /* preserve the publication error; the old path is reported as unavailable */ }
+                throw error;
+            }
+            finally {
+                try {
+                    fs.rmSync(tempGraphPath, { force: true });
+                }
+                catch { /* already renamed or retained for diagnosis */ }
+            }
+            return result;
         },
         async context_bundle(a) {
             assertSpecStoreReachable('context_bundle', store, a.root); // @implements A-SPEC-433
@@ -3779,14 +3865,26 @@ depends_on:
             }
             const rawHandlers = makeRawHandlers(rawStore);
             const approvedSpecs = [];
+            const alreadySealed = [];
             const refused = [];
             if (idsToApprove.length === 0) {
                 // Reporting this as a success is how a caller ends up believing an unapproved slice was
                 // approved. Measured 2026-08-28: a broken-frontmatter REQ made the whole slice invisible
                 // here, and the tool answered `ok: true, approvedSpecs: []`.
-                return { ok: false, approvedSpecs, refused: [{ id: a.sliceName, reason: 'no specs matched this slice name' }] };
-            }
+                return { ok: false, approvedSpecs, alreadySealed, refused: [{ id: a.sliceName, reason: 'no specs matched this slice name' }] };
+            }
+            // @implements A-SPEC-587.2 — a sealed spec is SKIPPED, not re-sealed: re-approving asked the
+            // human the same question again (same request id back in the queue) and stopped the chain
+            // there, so the H-SPEC was never even attempted (measured 2026-09-10, three slices).
+            const sealed = (id) => {
+                const s = specs.find((x) => x.id === id);
+                return s?.status === 'approved' && typeof s.frontmatter?.approved_digest === 'string';
+            };
             for (const id of idsToApprove) {
+                if (sealed(id)) {
+                    alreadySealed.push(id);
+                    continue;
+                }
                 const res = (await rawHandlers.spec_approve({ root, id }));
                 if (res.approved || res.ok) {
                     approvedSpecs.push(id);
@@ -3800,11 +3898,11 @@ depends_on:
                 // again or, worse, succeed against an unsealed parent. Stop and say what is left.
                 break;
             }
-            for (const id of idsToApprove.slice(approvedSpecs.length + refused.length)) {
+            for (const id of idsToApprove.slice(approvedSpecs.length + alreadySealed.length + refused.length)) {
                 refused.push({ id, reason: 'not attempted — an earlier spec in the chain was refused' });
             }
-            // `ok` means the slice is approved. Anything less is not a success.
-            return { ok: refused.length === 0 && approvedSpecs.length > 0, approvedSpecs, refused };
+            // `ok` means the slice is approved — freshly or already. Anything less is not a success.
+            return { ok: refused.length === 0 && approvedSpecs.length + alreadySealed.length > 0, approvedSpecs, alreadySealed, refused };
         },
         async spec_remediate(a) {
             const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();

package/dist/holmes/mcp/spec-id-guard.d.ts

@@ -7,7 +7,7 @@
  * 현재 max 를 한 칸 넘게 뛸 수 없다. 막으면 max+1 은 다시 오염되지 않고 넘버링이 영구히 예측 가능하다.
  */
 /** id 의 base 숫자. "REQ-1403"→1403, "A-SPEC-250.1"→250(서브번호 무시), 레거시 "H-SPEC-050"→50. 못 뽑으면 null. */
-export declare function specIdBase(id: string): number | null;
+export { specIdBase } from '../spec/spec-id';
 export type IdVerdict = {
     ok: true;
 } | {

package/dist/holmes/mcp/spec-id-guard.js

@@ -9,19 +9,15 @@
  * 현재 max 를 한 칸 넘게 뛸 수 없다. 막으면 max+1 은 다시 오염되지 않고 넘버링이 영구히 예측 가능하다.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.specIdBase = specIdBase;
+exports.specIdBase = void 0;
 exports.sequentialIdVerdict = sequentialIdVerdict;
 /** id 의 base 숫자. "REQ-1403"→1403, "A-SPEC-250.1"→250(서브번호 무시), 레거시 "H-SPEC-050"→50. 못 뽑으면 null. */
-function specIdBase(id) {
-    if (typeof id !== 'string')
-        return null;
-    // 마지막 하이픈 뒤의 숫자 토막(점 앞)을 base 로 본다.
-    const m = /-(\d+)(?:\.\d+)?\s*$/.exec(id.trim());
-    if (!m)
-        return null;
-    const n = parseInt(m[1], 10);
-    return Number.isNaN(n) ? null : n;
-}
+// @implements A-SPEC-255 — the parser moved DOWN to the spec layer so `spec/renumber.ts` can share it
+// without importing mcp (C-SPEC-224 forbids that direction). Re-exported so existing callers and the
+// A-SPEC-252 tests keep their import path.
+var spec_id_1 = require("../spec/spec-id");
+Object.defineProperty(exports, "specIdBase", { enumerable: true, get: function () { return spec_id_1.specIdBase; } });
+const spec_id_2 = require("../spec/spec-id");
 /**
  * 새 id 의 base 가 코퍼스 max base 를 한 칸 넘게 뛰면 거부한다.
  *
@@ -37,13 +33,13 @@ function idSpaceOf(id) {
     return /^ADR-/.test(id.trim()) ? 'ADR' : 'functional';
 }
 function sequentialIdVerdict(newId, existingIds) {
-    const base = specIdBase(newId);
+    const base = (0, spec_id_2.specIdBase)(newId);
     if (base === null)
         return { ok: true };
     // @implements A-SPEC-571.1 — compare only within the same number space.
     const space = idSpaceOf(newId);
     const bases = (existingIds ?? []).filter((id) => idSpaceOf(id) === space)
-        .map(specIdBase).filter((n) => n !== null);
+        .map(spec_id_2.specIdBase).filter((n) => n !== null);
     if (bases.length === 0)
         return { ok: true };
     const maxBase = Math.max(...bases);

package/dist/holmes/mcp/tool-schemas.js

@@ -101,6 +101,19 @@ exports.TOOL_SCHEMAS = {
             required: ['id'],
         },
     },
+    spec_renumber: {
+        description: "Move a whole spec FAMILY (REQ/H-SPEC/A-SPEC/T-SPEC sharing one base, dot-suffixed members included) from one number to another, and report what a machine must not touch. The tool rewrites only places with a definite grammar: filenames, frontmatter `id`, every `depends_on` in the store, `slice` tags, and source `@implements` anchors. Prose — comments, test titles, CHANGELOG entries, `source.ref` citations — is REPORTED as candidates with file and line, never substituted: measured 2026-08-23, a bulk regex doing exactly that turned REQ-253's own source citation into a reference to itself, while a hand renumber left seven prose sites behind including a comment in the shipped install.ps1. Re-sealing is NOT performed here; `spec_approve` remains the only sealer. Instead the plan returns two orders, which are opposites because the two acts refuse in opposite directions: `unsealOrder` is child-first (spec_unseal refuses while an approved child depends on the target) and `approveOrder` is parent-first (spec_approve refuses while a parent is unsealed). A spec whose `depends_on` is empty appears in neither, because specDigest does not hash `id` and its seal survives the move. Refuses outright when the destination base is already claimed or the source base does not exist, emptying every list so a partial plan cannot become a partial move. `dryRun` defaults to TRUE.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                oldBase: str('The base number to move FROM, digits only (e.g. "596").'),
+                newBase: str('The base number to move TO, digits only (e.g. "599"). Must be unclaimed.'),
+                dryRun: { type: 'boolean', description: 'Default true — return the plan without touching anything. Pass false to apply.' },
+                root: str('Optional when the server is bound to a file store; if supplied it must resolve to the SAME project.'),
+            },
+            required: ['oldBase', 'newBase'],
+        },
+    },
     spec_unseal: {
         description: "The inverse of spec_approve: return ONE sealed (approved) spec to an editable `status: draft`, clearing `approved_digest` and `parent_digests` in a single ACT, and record `spec-unsealed` in the provenance ledger. Un-sealing WITHDRAWS a seal, so it requires the same out-of-band HOLMES_APPROVAL as spec_approve/spec_retire's sealed path (fail-closed): un-sealing an approved T-SPEC removes the code gate's demand, which unguarded would be an approval bypass. Refuses when an APPROVED spec depends on the target — that dependent's parent_digests would silently go stale — naming the blockers. Idempotent: un-sealing a spec that is already draft (never sealed) writes nothing and returns unsealed:false. Written only at the version this act read; a concurrent edit wins and the un-seal is refused for retry. Distinct from spec_retire (which withdraws authority to status:outdated); un-seal keeps the spec alive and editable.",
         inputSchema: {