@holmes-lab/holmes-kit 0.19.3 → 0.19.4

package/dist/holmes/governance/approval-grants.js

@@ -132,11 +132,34 @@ function resolveApproval(root, envApproval, action, now) {
  * The nonce is flattened to a basename so a traversal-shaped nonce cannot reach outside the dir.
  */
 function consumeGrantFile(root, nonce) {
+    // @implements A-SPEC-596 — address the grant the SAME way `readGrants` does: by the nonce INSIDE
+    // the file, never by a path built from it. Building the path meant a grant whose filename differed
+    // from its nonce was honoured (reading scans, and never compares the two) yet never spent, with
+    // `force: true` swallowing the miss — a single-use grant that stayed spendable forever. Scanning
+    // also makes traversal structurally impossible: no nonce becomes a path, so none can point out.
+    const dir = path.join(root, exports.GRANTS_RELDIR);
+    const wanted = String(nonce);
+    let removed = 0;
     try {
-        const name = path.basename(String(nonce)) + '.json';
-        fs.rmSync(path.join(root, exports.GRANTS_RELDIR, name), { force: true });
+        for (const name of fs.readdirSync(dir).filter((n) => n.endsWith('.json'))) {
+            const file = path.join(dir, name);
+            try {
+                const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+                if (String(parsed?.nonce) !== wanted)
+                    continue; // someone else's grant is not ours to spend
+                fs.rmSync(file, { force: true });
+                removed++;
+            }
+            catch { /* corrupt or vanished: it was never honoured either, so it is not ours to spend */ }
+        }
     }
     catch {
-        /* the act already succeeded; a stuck file is bounded by expires */
+        // No directory, or it cannot be read: there is nothing to spend, which is an ordinary state.
+        return;
+    }
+    if (removed === 0) {
+        // Consumption runs AFTER the act succeeded, so this must never throw — but it must not be silent
+        // either: an unspent single-use grant is still spendable, and nobody would know.
+        process.stderr.write(`[Holmes-Kit] approval grant was used but no grant file matched it — the grant may still be spendable. Remove it by hand from ${exports.GRANTS_RELDIR}.\n`);
     }
 }

package/dist/holmes/governance/autonomy.d.ts

@@ -9,7 +9,23 @@ export declare function isHighRiskPath(p: string): boolean;
  * parent-aware rules (kept in the signature so callers wire it once); the current bound is decided
  * from the spec itself.
  */
-export declare function specApprovalAutonomy(spec: Spec, _resolveParent: (id: string) => Spec | null): ApprovalAutonomy;
+/**
+ * @implements A-SPEC-587
+ * The A-SPECs whose chain leads up to `spec`: one hop for an H-SPEC (A-SPECs that depend on it),
+ * two for a REQ (through its H-SPECs). Anything else has no downstream A-SPECs. Pure; `depends_on`
+ * is the only edge this repository's chain uses.
+ */
+export declare function descendantAspecs(spec: Spec, all: Spec[]): Spec[];
+/**
+ * @implements A-SPEC-587
+ * The autonomy verdict for approving THIS spec. `resolveParent` is accepted for future parent-aware
+ * rules. `descendants` — the A-SPECs beneath a REQ/H-SPEC (see `descendantAspecs`) — is what lets an
+ * upstream document be graded by the code it will admit: a REQ or H-SPEC carries no code of its
+ * own, so its risk IS the risk its A-SPECs declare (REQ-587, the owner's line: only irreversible,
+ * architectural or high-risk changes ask a human). Every downstream A-SPEC auto → auto; any hitl,
+ * or no A-SPEC at all (unknown scope) → human. The two-argument call keeps the old answer.
+ */
+export declare function specApprovalAutonomy(spec: Spec, resolveParent: (id: string) => Spec | null, descendants?: Spec[]): ApprovalAutonomy;
 export declare const SESSION_AUTONOMY_MARKER: readonly [".ax", "state", "autonomy.json"];
 export declare function sessionAutonomyActive(root: string, now: string): boolean;
 /** Whether autonomous approval is enabled — the out-of-band env switch, OR a valid session envelope

package/dist/holmes/governance/autonomy.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SESSION_AUTONOMY_MARKER = exports.AUTONOMY_ENV = void 0;
 exports.isHighRiskPath = isHighRiskPath;
+exports.descendantAspecs = descendantAspecs;
 exports.specApprovalAutonomy = specApprovalAutonomy;
 exports.sessionAutonomyActive = sessionAutonomyActive;
 exports.projectDefaultAutonomy = projectDefaultAutonomy;
@@ -48,8 +49,9 @@ exports.releaseAutonomy = releaseAutonomy;
 // the MCP elicitation TUI. The governance chain (REQ→H→A→T→CPG + RTM + taint + phase gate) already
 // forces quality structurally, so a low/mid-risk spec self-approving under an explicitly-enabled
 // autonomous mode is a small, bounded relaxation (REQ-532). The bound is what this module owns: the
-// governance-critical specs — gate behaviour, architecture, taint/security boundaries, and every
-// upstream REQ/H-SPEC/C-SPEC — never leave the human channel.
+// governance-critical specs — gate behaviour, architecture (C-SPEC/ADR), taint/security boundaries —
+// never leave the human channel. An upstream REQ/H-SPEC is graded by the A-SPECs beneath it
+// (REQ-587): all auto → auto; any hitl, or none yet → human.
 //
 // PURE: the spec, a parent resolver, and (separately) the env are the only inputs; the wiring layer
 // (A-SPEC-532.2) injects process.env and the elicitor.
@@ -126,15 +128,45 @@ const AUTO_GRADES = new Set(['none', 'persisted-artifact', 'derived-artifact', '
  * parent-aware rules (kept in the signature so callers wire it once); the current bound is decided
  * from the spec itself.
  */
-function specApprovalAutonomy(spec, _resolveParent) {
+/**
+ * @implements A-SPEC-587
+ * The A-SPECs whose chain leads up to `spec`: one hop for an H-SPEC (A-SPECs that depend on it),
+ * two for a REQ (through its H-SPECs). Anything else has no downstream A-SPECs. Pure; `depends_on`
+ * is the only edge this repository's chain uses.
+ */
+function descendantAspecs(spec, all) {
+    const dependsOn = (s, id) => Array.isArray(s.dependsOn) && s.dependsOn.includes(id);
+    if (spec.type === 'H-SPEC')
+        return all.filter((s) => s.type === 'A-SPEC' && dependsOn(s, spec.id));
+    if (spec.type === 'REQ') {
+        const hs = all.filter((s) => s.type === 'H-SPEC' && dependsOn(s, spec.id));
+        return all.filter((s) => s.type === 'A-SPEC' && hs.some((h) => dependsOn(s, h.id)));
+    }
+    return [];
+}
+/**
+ * @implements A-SPEC-587
+ * The autonomy verdict for approving THIS spec. `resolveParent` is accepted for future parent-aware
+ * rules. `descendants` — the A-SPECs beneath a REQ/H-SPEC (see `descendantAspecs`) — is what lets an
+ * upstream document be graded by the code it will admit: a REQ or H-SPEC carries no code of its
+ * own, so its risk IS the risk its A-SPECs declare (REQ-587, the owner's line: only irreversible,
+ * architectural or high-risk changes ask a human). Every downstream A-SPEC auto → auto; any hitl,
+ * or no A-SPEC at all (unknown scope) → human. The two-argument call keeps the old answer.
+ */
+function specApprovalAutonomy(spec, resolveParent, descendants) {
     switch (spec.type) {
         case 'T-SPEC':
             return 'auto'; // tests are low risk
         case 'REQ':
-        case 'H-SPEC':
+        case 'H-SPEC': {
+            const below = (descendants ?? []).filter((s) => s.type === 'A-SPEC');
+            if (below.length === 0)
+                return 'hitl'; // unknown scope stays human
+            return below.every((a) => specApprovalAutonomy(a, resolveParent) === 'auto') ? 'auto' : 'hitl';
+        }
         case 'C-SPEC':
         case 'ADR': // @implements A-SPEC-571.1 — a decision is the human's to seal
-            return 'hitl'; // wide blast radius / structural constraint
+            return 'hitl'; // architecture / structural constraint — the owner's exception
         case 'A-SPEC': {
             const grade = breakingGrade(spec);
             if (grade === null || !AUTO_GRADES.has(grade))

package/dist/holmes/mcp/handlers.d.ts

@@ -183,6 +183,30 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
      * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
      * drift detection compares against — would silently go stale.
      */
+    spec_renumber(a: {
+        root?: string;
+        oldBase: string;
+        newBase: string;
+        dryRun?: boolean;
+    }): Promise<{
+        ok: boolean;
+        reason: string;
+        dryRun?: undefined;
+        plan?: undefined;
+        movedSpecs?: undefined;
+    } | {
+        ok: boolean;
+        dryRun: boolean;
+        plan: import("../spec/renumber").RenumberPlan;
+        reason?: undefined;
+        movedSpecs?: undefined;
+    } | {
+        ok: boolean;
+        dryRun: boolean;
+        movedSpecs: number;
+        plan: import("../spec/renumber").RenumberPlan;
+        reason?: undefined;
+    }>;
     spec_unseal(a: {
         root?: string;
         id: string;
@@ -579,15 +603,15 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         head?: string;
         since?: string;
     }): Promise<{
-        semanticWarm?: {
-            tier: string;
-            computed: number;
-            cached: number;
-        } | undefined;
         changed: number;
         nodes: number;
         edges: number;
         changeSource: ChangeSourceInfo;
+        semanticWarm?: {
+            tier: string;
+            computed: number;
+            cached: number;
+        };
     }>;
     context_bundle(a: {
         root: string;
@@ -779,6 +803,7 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
     }): Promise<{
         ok: boolean;
         approvedSpecs: string[];
+        alreadySealed: string[];
         refused: {
             id: string;
             reason: string;

package/dist/holmes/mcp/handlers.js

@@ -38,6 +38,7 @@ exports.isHandlerRefusal = isHandlerRefusal;
 exports.unreadableAmong = unreadableAmong;
 exports.makeHandlers = makeHandlers;
 exports.collectDecisions = collectDecisions;
+// @implements A-SPEC-599
 // @implements A-SPEC-293
 // @implements A-SPEC-292
 // @implements A-SPEC-290
@@ -255,6 +256,7 @@ const ignore_1 = require("../project/ignore");
 // @implements A-SPEC-126
 const scan_1 = require("../reverse/scan");
 const draft_1 = require("../reverse/draft");
+const renumber_1 = require("../spec/renumber");
 const adr_refs_1 = require("../spec/adr-refs");
 const spec_id_guard_1 = require("./spec-id-guard");
 const anchor_1 = require("../reverse/anchor");
@@ -376,7 +378,7 @@ function specStoreBlindReason(store, root, loaded) {
     // Compared through realpath: on macOS a temp root is `/var/...` while the same directory resolves
     // to `/private/var/...`, and a plain string compare calls the correctly-bound store foreign.
     const real = (p) => { try {
-        return fs.realpathSync(p);
+        return (0, root_2.canonicalPath)(p);
     }
     catch {
         return path.resolve(p);
@@ -779,10 +781,11 @@ function makeRawHandlers(store, opts) {
     // rides the existing seal path, but its actor names `autonomous:<client>` so an audit can tell a
     // self-approved seal from a human-approved (elicitation) or operator (env/grant) one. Single-use
     // by construction — it exists only inside this call, persisted nowhere.
-    const autonomousApproval = () => ({
+    const autonomousApproval = (derivedFrom) => ({
         actor: `autonomous:${opts?.clientName?.() ?? 'unknown'}`,
         token: crypto.randomUUID(),
-        rationale: `autonomous grant (${'HOLMES_AUTONOMOUS_APPROVAL'} enabled, spec grade auto)`,
+        // @implements A-SPEC-587 — an upstream grade is DERIVED; the audit line names the A-SPECs it came from.
+        rationale: `autonomous grant (${'HOLMES_AUTONOMOUS_APPROVAL'} enabled, spec grade auto${derivedFrom && derivedFrom.length > 0 ? ` — derived from ${derivedFrom.join(', ')}` : ''})`,
     });
     /**
      * Where the audit record for a governance act belongs — resolved BEFORE the act writes anything.
@@ -1241,6 +1244,38 @@ function makeRawHandlers(store, opts) {
          * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
          * drift detection compares against — would silently go stale.
          */
+        // @implements A-SPEC-255 — the WIRING only. The judgment is `planRenumber`, which is pure and
+        // tested directly; this handler adds no rules of its own. Re-sealing is deliberately absent:
+        // `spec_approve` is the only sealer, so the plan reports the two ORDERS and the caller runs them.
+        // @implements A-SPEC-255 — WIRING only. The judgment lives in `planRenumber`, which is pure and
+        // tested directly; nothing here adds a rule. Re-sealing is deliberately absent: `spec_approve`
+        // is the only sealer (a second sealer becomes a second truth), so the plan reports the two
+        // ORDERS and the caller runs them. `dryRun` defaults to true — a renumber is read before it runs.
+        async spec_renumber(a) {
+            const specsRoot = store.specsRoot;
+            if (typeof specsRoot !== 'string')
+                return { ok: false, reason: '파일 스토어에 묶인 서버에서만 리넘버할 수 있습니다.' };
+            const projectRoot = path.resolve(specsRoot, '..', '..');
+            const plan = (0, renumber_1.planRenumber)({
+                specs: (0, renumber_1.readSpecsForRenumber)(specsRoot),
+                sources: (0, renumber_1.readSourcesForRenumber)(projectRoot),
+                oldBase: String(a.oldBase), newBase: String(a.newBase),
+            });
+            if (plan.refusal)
+                return { ok: false, reason: plan.refusal };
+            if (a.dryRun !== false)
+                return { ok: true, dryRun: true, plan };
+            const movedSpecs = (0, renumber_1.applyRenumber)(specsRoot, { ...plan, anchors: [] });
+            (0, renumber_1.applyRenumber)(projectRoot, { ...plan, moves: [], dependsOn: [], slices: [] });
+            new ledger_store_1.FileLedgerStore(path.join(projectRoot, '.ax', 'ledger')).append({
+                ts: new Date().toISOString(),
+                actor: 'spec_renumber',
+                kind: 'spec-renumbered',
+                summary: `renumbered base ${a.oldBase} -> ${a.newBase}: ${movedSpecs} spec(s), ${plan.anchors.length} anchored file(s), ${plan.proseCandidates.length} prose candidate(s) left for a human`,
+                inputs: plan.moves.map((m) => `${m.oldId}->${m.newId}`),
+            });
+            return { ok: true, dryRun: false, movedSpecs, plan };
+        },
         async spec_unseal(a) {
             const all = await store.list();
             if (all.filter((s) => s.id === a.id).length > 1) {
@@ -1526,9 +1561,14 @@ function makeRawHandlers(store, opts) {
                     // @implements A-SPEC-553.1 — autonomy is the out-of-band env switch OR a valid, non-expired
                     // session envelope marker under this project's `.ax/state/` (which an agent cannot write).
                     const autonomyOn = (0, autonomy_1.autonomousApprovalEnabled)(process.env, a.root, new Date().toISOString());
+                    // @implements A-SPEC-587 — an upstream REQ/H-SPEC is graded by the A-SPECs beneath it, so
+                    // the store is consulted for its descendants (only then: the list is a cost the auto-grade
+                    // A-SPEC/T-SPEC path does not pay). Unknown scope (none yet) keeps the human answer.
+                    const upstream = target.spec.type === 'REQ' || target.spec.type === 'H-SPEC';
+                    const below = autonomyOn && upstream ? (0, autonomy_1.descendantAspecs)(target.spec, await store.list()) : undefined;
                     if (autonomyOn
-                        && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec])) === 'auto') {
-                        approveResolved = { approval: autonomousApproval(), source: 'autonomous' };
+                        && (0, autonomy_1.specApprovalAutonomy)(target.spec, resolver([target.spec]), below) === 'auto') {
+                        approveResolved = { approval: autonomousApproval(below?.map((s) => s.id)), source: 'autonomous' };
                     }
                     else if (autonomyOn) {
                         // @implements A-SPEC-551.1 — hitl-grade spec under autonomy: the in-session elicitation
@@ -2765,7 +2805,7 @@ function makeRawHandlers(store, opts) {
                 graphSchema: RTM_GRAPH_SCHEMA,
                 extractorVersion: RTM_EXTRACTOR_VERSION,
                 sourceCommit: head,
-                specFingerprint: `n:${specs.length}/${specs.map((s) => `${s.id}:${s.status}`).sort().join(',')}`,
+                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
                 scanDigest: (0, graph_store_1.scanDigest)(scanned),
             });
             const g = opened.graph;
@@ -2863,8 +2903,26 @@ function makeRawHandlers(store, opts) {
                 deleted: changes.deleted,
                 renamed: changes.renamed,
             };
-            const g = new rtm_graph_1.RtmGraph();
+            let head = '';
             try {
+                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)(), stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+            }
+            catch { /* non-git */ }
+            const graphPath = path.join(root, '.ax', 'rtm.sqlite');
+            const tempGraphPath = `${graphPath}.tmp-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+            const opened = (0, graph_store_1.openReusableGraph)(tempGraphPath, {
+                graphSchema: RTM_GRAPH_SCHEMA,
+                extractorVersion: RTM_EXTRACTOR_VERSION,
+                sourceCommit: head,
+                specFingerprint: (0, graph_store_1.specFingerprint)(specs),
+                scanDigest: (0, graph_store_1.scanDigest)(scanned),
+            });
+            const g = opened.graph;
+            let result;
+            try {
+                // Explicit reindex is a persistence operation: discard the previous contents, rebuild the
+                // complete graph, then commit the matching basis before releasing the file (A-SPEC-589).
+                g.clear();
                 (0, rtm_builder_1.buildRtm)(specs, scanned, g);
                 // Scaffold note: `g` was just full-built at HEAD, so applying the
                 // diff on top of it is currently an idempotent no-op in practice
@@ -2877,6 +2935,7 @@ function makeRawHandlers(store, opts) {
                 // graph equals what a full rebuild would have produced. Measured: without this, rtm_reindex
                 // returned a graph with no call edges at all.
                 (0, incremental_1.applyIncremental)(g, changesToApply, { repoRoot: root, specs, scanOne, allScanned: () => scanned });
+                opened.commitBasis();
                 // @implements A-SPEC-478 — the semantic cache WARMING lives here, in the explicit heavy
                 // operation, so the ranking hot path only ever LOOKS UP vectors. Idempotent through the
                 // cache; a tier of none (the shipped default) computes nothing.
@@ -2891,12 +2950,39 @@ function makeRawHandlers(store, opts) {
                     }
                 }
                 catch { /* warming is best-effort; reindex's own result is unaffected */ }
-                return { changed, nodes: g.nodeCount(), edges: g.edgeCount(), changeSource,
+                result = { changed, nodes: g.nodeCount(), edges: g.edgeCount(), changeSource,
                     ...(semanticWarm !== undefined ? { semanticWarm } : {}) };
             }
             finally {
                 g.close(); // release native SQLite handle even if build/apply throws
             }
+            // Publish only after the complete temporary graph is closed. Rename the old file aside so a
+            // Windows reader either keeps the old complete graph or sees the new complete graph; it never
+            // observes a partially built database or a basis that belongs to another file (A-SPEC-589).
+            const backupPath = `${graphPath}.bak-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+            const hadOld = fs.existsSync(graphPath);
+            try {
+                if (hadOld)
+                    fs.renameSync(graphPath, backupPath);
+                fs.renameSync(tempGraphPath, graphPath);
+                if (hadOld)
+                    fs.rmSync(backupPath, { force: true });
+            }
+            catch (error) {
+                try {
+                    if (!fs.existsSync(graphPath) && fs.existsSync(backupPath))
+                        fs.renameSync(backupPath, graphPath);
+                }
+                catch { /* preserve the publication error; the old path is reported as unavailable */ }
+                throw error;
+            }
+            finally {
+                try {
+                    fs.rmSync(tempGraphPath, { force: true });
+                }
+                catch { /* already renamed or retained for diagnosis */ }
+            }
+            return result;
         },
         async context_bundle(a) {
             assertSpecStoreReachable('context_bundle', store, a.root); // @implements A-SPEC-433
@@ -3779,14 +3865,26 @@ depends_on:
             }
             const rawHandlers = makeRawHandlers(rawStore);
             const approvedSpecs = [];
+            const alreadySealed = [];
             const refused = [];
             if (idsToApprove.length === 0) {
                 // Reporting this as a success is how a caller ends up believing an unapproved slice was
                 // approved. Measured 2026-08-28: a broken-frontmatter REQ made the whole slice invisible
                 // here, and the tool answered `ok: true, approvedSpecs: []`.
-                return { ok: false, approvedSpecs, refused: [{ id: a.sliceName, reason: 'no specs matched this slice name' }] };
-            }
+                return { ok: false, approvedSpecs, alreadySealed, refused: [{ id: a.sliceName, reason: 'no specs matched this slice name' }] };
+            }
+            // @implements A-SPEC-587.2 — a sealed spec is SKIPPED, not re-sealed: re-approving asked the
+            // human the same question again (same request id back in the queue) and stopped the chain
+            // there, so the H-SPEC was never even attempted (measured 2026-09-10, three slices).
+            const sealed = (id) => {
+                const s = specs.find((x) => x.id === id);
+                return s?.status === 'approved' && typeof s.frontmatter?.approved_digest === 'string';
+            };
             for (const id of idsToApprove) {
+                if (sealed(id)) {
+                    alreadySealed.push(id);
+                    continue;
+                }
                 const res = (await rawHandlers.spec_approve({ root, id }));
                 if (res.approved || res.ok) {
                     approvedSpecs.push(id);
@@ -3800,11 +3898,11 @@ depends_on:
                 // again or, worse, succeed against an unsealed parent. Stop and say what is left.
                 break;
             }
-            for (const id of idsToApprove.slice(approvedSpecs.length + refused.length)) {
+            for (const id of idsToApprove.slice(approvedSpecs.length + alreadySealed.length + refused.length)) {
                 refused.push({ id, reason: 'not attempted — an earlier spec in the chain was refused' });
             }
-            // `ok` means the slice is approved. Anything less is not a success.
-            return { ok: refused.length === 0 && approvedSpecs.length > 0, approvedSpecs, refused };
+            // `ok` means the slice is approved — freshly or already. Anything less is not a success.
+            return { ok: refused.length === 0 && approvedSpecs.length + alreadySealed.length > 0, approvedSpecs, alreadySealed, refused };
         },
         async spec_remediate(a) {
             const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();

package/dist/holmes/mcp/spec-id-guard.d.ts

@@ -7,7 +7,7 @@
  * 현재 max 를 한 칸 넘게 뛸 수 없다. 막으면 max+1 은 다시 오염되지 않고 넘버링이 영구히 예측 가능하다.
  */
 /** id 의 base 숫자. "REQ-1403"→1403, "A-SPEC-250.1"→250(서브번호 무시), 레거시 "H-SPEC-050"→50. 못 뽑으면 null. */
-export declare function specIdBase(id: string): number | null;
+export { specIdBase } from '../spec/spec-id';
 export type IdVerdict = {
     ok: true;
 } | {

package/dist/holmes/mcp/spec-id-guard.js

@@ -9,19 +9,15 @@
  * 현재 max 를 한 칸 넘게 뛸 수 없다. 막으면 max+1 은 다시 오염되지 않고 넘버링이 영구히 예측 가능하다.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.specIdBase = specIdBase;
+exports.specIdBase = void 0;
 exports.sequentialIdVerdict = sequentialIdVerdict;
 /** id 의 base 숫자. "REQ-1403"→1403, "A-SPEC-250.1"→250(서브번호 무시), 레거시 "H-SPEC-050"→50. 못 뽑으면 null. */
-function specIdBase(id) {
-    if (typeof id !== 'string')
-        return null;
-    // 마지막 하이픈 뒤의 숫자 토막(점 앞)을 base 로 본다.
-    const m = /-(\d+)(?:\.\d+)?\s*$/.exec(id.trim());
-    if (!m)
-        return null;
-    const n = parseInt(m[1], 10);
-    return Number.isNaN(n) ? null : n;
-}
+// @implements A-SPEC-255 — the parser moved DOWN to the spec layer so `spec/renumber.ts` can share it
+// without importing mcp (C-SPEC-224 forbids that direction). Re-exported so existing callers and the
+// A-SPEC-252 tests keep their import path.
+var spec_id_1 = require("../spec/spec-id");
+Object.defineProperty(exports, "specIdBase", { enumerable: true, get: function () { return spec_id_1.specIdBase; } });
+const spec_id_2 = require("../spec/spec-id");
 /**
  * 새 id 의 base 가 코퍼스 max base 를 한 칸 넘게 뛰면 거부한다.
  *
@@ -37,13 +33,13 @@ function idSpaceOf(id) {
     return /^ADR-/.test(id.trim()) ? 'ADR' : 'functional';
 }
 function sequentialIdVerdict(newId, existingIds) {
-    const base = specIdBase(newId);
+    const base = (0, spec_id_2.specIdBase)(newId);
     if (base === null)
         return { ok: true };
     // @implements A-SPEC-571.1 — compare only within the same number space.
     const space = idSpaceOf(newId);
     const bases = (existingIds ?? []).filter((id) => idSpaceOf(id) === space)
-        .map(specIdBase).filter((n) => n !== null);
+        .map(spec_id_2.specIdBase).filter((n) => n !== null);
     if (bases.length === 0)
         return { ok: true };
     const maxBase = Math.max(...bases);

package/dist/holmes/mcp/tool-schemas.js

@@ -101,6 +101,19 @@ exports.TOOL_SCHEMAS = {
             required: ['id'],
         },
     },
+    spec_renumber: {
+        description: "Move a whole spec FAMILY (REQ/H-SPEC/A-SPEC/T-SPEC sharing one base, dot-suffixed members included) from one number to another, and report what a machine must not touch. The tool rewrites only places with a definite grammar: filenames, frontmatter `id`, every `depends_on` in the store, `slice` tags, and source `@implements` anchors. Prose — comments, test titles, CHANGELOG entries, `source.ref` citations — is REPORTED as candidates with file and line, never substituted: measured 2026-08-23, a bulk regex doing exactly that turned REQ-253's own source citation into a reference to itself, while a hand renumber left seven prose sites behind including a comment in the shipped install.ps1. Re-sealing is NOT performed here; `spec_approve` remains the only sealer. Instead the plan returns two orders, which are opposites because the two acts refuse in opposite directions: `unsealOrder` is child-first (spec_unseal refuses while an approved child depends on the target) and `approveOrder` is parent-first (spec_approve refuses while a parent is unsealed). A spec whose `depends_on` is empty appears in neither, because specDigest does not hash `id` and its seal survives the move. Refuses outright when the destination base is already claimed or the source base does not exist, emptying every list so a partial plan cannot become a partial move. `dryRun` defaults to TRUE.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                oldBase: str('The base number to move FROM, digits only (e.g. "596").'),
+                newBase: str('The base number to move TO, digits only (e.g. "599"). Must be unclaimed.'),
+                dryRun: { type: 'boolean', description: 'Default true — return the plan without touching anything. Pass false to apply.' },
+                root: str('Optional when the server is bound to a file store; if supplied it must resolve to the SAME project.'),
+            },
+            required: ['oldBase', 'newBase'],
+        },
+    },
     spec_unseal: {
         description: "The inverse of spec_approve: return ONE sealed (approved) spec to an editable `status: draft`, clearing `approved_digest` and `parent_digests` in a single ACT, and record `spec-unsealed` in the provenance ledger. Un-sealing WITHDRAWS a seal, so it requires the same out-of-band HOLMES_APPROVAL as spec_approve/spec_retire's sealed path (fail-closed): un-sealing an approved T-SPEC removes the code gate's demand, which unguarded would be an approval bypass. Refuses when an APPROVED spec depends on the target — that dependent's parent_digests would silently go stale — naming the blockers. Idempotent: un-sealing a spec that is already draft (never sealed) writes nothing and returns unsealed:false. Written only at the version this act read; a concurrent edit wins and the un-seal is refused for retry. Distinct from spec_retire (which withdraws authority to status:outdated); un-seal keeps the spec alive and editable.",
         inputSchema: {

package/dist/holmes/project/install-scripts-policy.d.ts

@@ -12,8 +12,22 @@
  * This module is the pure re-statement of that rule: no I/O, no process, no platform — the same
  * verdict on every OS, shared by the test that pins package.json and by doctor (A-SPEC-580).
  */
-/** Dependencies whose install script must actually RUN for the module to load. */
-export declare const NATIVE_INSTALL_SCRIPT_DEPS: readonly ["better-sqlite3"];
+/**
+ * Dependencies whose install script must actually RUN for the module to load.
+ *
+ * A-SPEC-595, measured 2026-09-10: `sharp@0.32.6` belongs here on EVERY platform, not just the
+ * Windows machine that first hit it. `npm pack sharp@0.32.6` yields a tarball with zero entries
+ * matching `.node`, `prebuilds/` or `vendor/`; its declared hook is
+ * `(node install/libvips && node install/dll-copy && prebuild-install) || (node install/can-compile
+ * && node-gyp rebuild && node install/dll-copy)`; the lockfile records `hasInstallScript: true`;
+ * and this repository's macOS tree holds `build/Release/sharp-darwin-arm64v8.node` and
+ * `vendor/8.14.5` only because that script ran. (sharp 0.33+ moved to platform packages that DO
+ * ship prebuilds — a version bump makes this entry a re-measurement, not a given.)
+ *
+ * This list is what doctor reads, and `allowScripts` is a root-manifest policy that does not
+ * transfer to consumers — so a name missing here is a name no consumer is ever told to approve.
+ */
+export declare const NATIVE_INSTALL_SCRIPT_DEPS: readonly ["better-sqlite3", "sharp"];
 /** Native dependencies that ship prebuilds and load with the script blocked (measured). */
 export declare const PREBUILT_NATIVE_DEPS: readonly ["tree-sitter", "tree-sitter-typescript", "tree-sitter-python", "tree-sitter-c-sharp", "tree-sitter-java", "tree-sitter-go", "tree-sitter-rust", "tree-sitter-cpp"];
 export type AllowScripts = Record<string, boolean>;

package/dist/holmes/project/install-scripts-policy.js

@@ -20,8 +20,22 @@ exports.policyVerdict = policyVerdict;
  * This module is the pure re-statement of that rule: no I/O, no process, no platform — the same
  * verdict on every OS, shared by the test that pins package.json and by doctor (A-SPEC-580).
  */
-/** Dependencies whose install script must actually RUN for the module to load. */
-exports.NATIVE_INSTALL_SCRIPT_DEPS = ['better-sqlite3'];
+/**
+ * Dependencies whose install script must actually RUN for the module to load.
+ *
+ * A-SPEC-595, measured 2026-09-10: `sharp@0.32.6` belongs here on EVERY platform, not just the
+ * Windows machine that first hit it. `npm pack sharp@0.32.6` yields a tarball with zero entries
+ * matching `.node`, `prebuilds/` or `vendor/`; its declared hook is
+ * `(node install/libvips && node install/dll-copy && prebuild-install) || (node install/can-compile
+ * && node-gyp rebuild && node install/dll-copy)`; the lockfile records `hasInstallScript: true`;
+ * and this repository's macOS tree holds `build/Release/sharp-darwin-arm64v8.node` and
+ * `vendor/8.14.5` only because that script ran. (sharp 0.33+ moved to platform packages that DO
+ * ship prebuilds — a version bump makes this entry a re-measurement, not a given.)
+ *
+ * This list is what doctor reads, and `allowScripts` is a root-manifest policy that does not
+ * transfer to consumers — so a name missing here is a name no consumer is ever told to approve.
+ */
+exports.NATIVE_INSTALL_SCRIPT_DEPS = ['better-sqlite3', 'sharp'];
 /** Native dependencies that ship prebuilds and load with the script blocked (measured). */
 exports.PREBUILT_NATIVE_DEPS = [
     'tree-sitter', 'tree-sitter-typescript', 'tree-sitter-python', 'tree-sitter-c-sharp',

package/dist/holmes/review/point-in-time-replay.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.materializeTreeAt = materializeTreeAt;
 exports.verifyTreeFidelity = verifyTreeFidelity;
+// @implements A-SPEC-599
 // @implements A-SPEC-297
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -56,12 +57,14 @@ function git(repoRoot, args) {
 }
 /** `path mode sha` triples the commit records for the pathspec, keyed by repo-relative path. */
 function blobsAt(repoRoot, commitish, pathspec) {
-    const out = git(repoRoot, ['ls-tree', '-r', `${commitish}^{tree}`, '--', pathspec]);
+    const out = git(repoRoot, ['ls-tree', '-rz', `${commitish}^{tree}`, '--', pathspec]);
     const blobs = new Map();
-    for (const line of out.split('\n')) {
+    for (const line of out.split('\0')) {
         if (line.trim() === '')
             continue;
-        const [meta, file] = line.split('\t');
+        const tab = line.indexOf('\t');
+        const meta = line.slice(0, tab);
+        const file = line.slice(tab + 1);
         const parts = meta.split(/\s+/);
         if (parts[1] !== 'blob')
             continue; // submodules and trees are not files we can compare
@@ -119,6 +122,43 @@ function materializeTreeAt(repoRoot, commitish, pathspec, destDir, opts) {
         const tar = (0, node_child_process_1.execFileSync)('git', ['-C', repoRoot, 'archive', '--format=tar', commitish, '--', pathspec], { maxBuffer: 512 * 1024 * 1024 });
         fs.writeFileSync(tarPath, tar);
         (0, node_child_process_1.execFileSync)('tar', ['-x', '-C', destDir, '-f', tarPath], { maxBuffer: 512 * 1024 * 1024 });
+        // Archive preserves modes/layout, but applies EOL/export substitutions. Read raw objects in
+        // one batch so fidelity is independent of user config and committed attributes alike.
+        const refsPath = path.join(path.dirname(tarPath), 'objects.txt');
+        fs.writeFileSync(refsPath, [...blobs.values()].join('\n') + '\n');
+        const refs = fs.openSync(refsPath, 'r');
+        let raw;
+        try {
+            raw = (0, node_child_process_1.execFileSync)('git', ['-C', repoRoot, 'cat-file', '--batch'], {
+                stdio: [refs, 'pipe', 'pipe'], maxBuffer: 512 * 1024 * 1024,
+            });
+        }
+        finally {
+            fs.closeSync(refs);
+        }
+        let offset = 0;
+        for (const [file, sha] of blobs) {
+            const end = raw.indexOf(10, offset);
+            const header = raw.subarray(offset, end).toString('ascii').split(' ');
+            const size = Number(header[2]);
+            if (end < offset || header[0] !== sha || header[1] !== 'blob' || !Number.isSafeInteger(size)
+                || size < 0 || end + 1 + size >= raw.length)
+                throw new Error('invalid cat-file response');
+            const bytes = raw.subarray(end + 1, end + 1 + size);
+            offset = end + 1 + size + 1;
+            const target = path.join(destDir, file);
+            // Keep archive's symlink representation; never follow it to overwrite a target.
+            try {
+                if (fs.lstatSync(target).isSymbolicLink())
+                    continue;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            fs.mkdirSync(path.dirname(target), { recursive: true });
+            fs.writeFileSync(target, bytes);
+        }
     }
     catch (err) {
         return { ok: false, reason: `archive-or-extract-failed: could not materialize ${commitish}: ${err.message}` };

package/dist/holmes/rtm/graph-store.d.ts

@@ -27,6 +27,8 @@ export interface GraphBasis {
      */
     scanDigest: string;
 }
+/** Deterministic content fingerprint for every spec field consumed by buildRtm. */
+export declare function specFingerprint(specs: readonly unknown[]): string;
 /**
  * Content address of a scan: every file's path and its symbols/edges, sorted so the digest depends
  * on the scan's CONTENT and not on the order the scanner happened to walk the tree in.