@holmes-lab/holmes-kit 0.19.6 → 0.20.0

package/dist/holmes/governance/ledger-store.js

@@ -33,12 +33,53 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryLedgerStore = exports.FileLedgerStore = void 0;
+exports.MemoryLedgerStore = exports.FileLedgerStore = exports.LedgerConflictRefusal = void 0;
+exports.writerChainFile = writerChainFile;
+exports.ledgerConflictReason = ledgerConflictReason;
 exports.nonceConsumedIn = nonceConsumedIn;
-// @implements A-SPEC-150
+// @implements A-SPEC-150, A-SPEC-624
+// @implements A-SPEC-643
+// @implements A-SPEC-642
 const provenance_chain_1 = require("./provenance-chain");
 const provenance_ledger_1 = require("./provenance-ledger");
 const path = __importStar(require("node:path"));
+/**
+ * @implements A-SPEC-643
+ * The chain file THIS process writes: `provenance.<replica>.jsonl`, resolved exactly as every other
+ * writer resolves it (the run's execution replica when registered, else the stored or hostname-derived
+ * id). Measured 2026-09-14: the shell gate, `risk_check` and `review_record` handed
+ * `consumeNonceExclusively` the legacy `provenance.jsonl`, so two clones spending the same approval
+ * offline both appended to one file and the origin's merge died with CONFLICT (add/add) before any
+ * double-spend could be seen. Consumptions belong on the writer's chain like every other event.
+ */
+function writerChainFile(ledgerDir) {
+    return provenance_ledger_1.ProvenanceLedger.at(ledgerDir).currentFile();
+}
+/** A-SPEC-642 — thrown by approval resolution while the merged ledger holds an unreconciled double-spend. */
+class LedgerConflictRefusal extends Error {
+    holmesRefusal = true;
+    code = 'ledger-conflict';
+    constructor(message) { super(message); this.name = 'LedgerConflictRefusal'; }
+}
+exports.LedgerConflictRefusal = LedgerConflictRefusal;
+/**
+ * @implements A-SPEC-642
+ * The one sentence every authority-spending act refuses with while the merged ledger holds an
+ * unreconciled cross-replica double-spend, or null. Names the nonce, the replicas and the act that
+ * clears it, because a refusal that cannot be acted on is an obstacle rather than a gate. An absent
+ * ledger directory is a clean ledger. Not caught: an unreadable chain file throws here exactly as it
+ * throws in `isNonceConsumed`, and the callers' fail-closed handling applies.
+ */
+function ledgerConflictReason(dir) {
+    const pending = new FileLedgerStore(dir).doubleSpends();
+    if (pending.length === 0)
+        return null;
+    const d = pending[0];
+    const replicas = [...new Set(d.events.map((e) => e.replicaId ?? 'legacy'))].join(', ');
+    return `the merged ledger holds an unreconciled cross-replica double-spend: single-use approval ${d.nonce} was consumed on replicas ${replicas}`
+        + ` — approvals, applies and recoveries are refused until an operator reconciles it (ledger_reconcile { nonce: "${d.nonce}" })`
+        + (pending.length > 1 ? `; ${pending.length - 1} more pending` : '');
+}
 /**
  * Local adapter — DELEGATES to `ProvenanceLedger` rather than re-implementing it.
  *
@@ -66,6 +107,9 @@ class FileLedgerStore {
         this.inner = provenance_ledger_1.ProvenanceLedger.at(dir, givenId);
     }
     replicaId() {
+        const execution = this.inner.executionContext();
+        if (execution)
+            return execution.replicaId;
         if (this.cachedId === undefined)
             this.cachedId = this.givenId ?? this.inner.replicaIdOf();
         return this.cachedId;
@@ -77,12 +121,13 @@ class FileLedgerStore {
     loadAll() { return this.inner.loadAll(); }
     verifyAll() {
         const r = this.inner.verifyAll();
-        return { ok: r.ok, broken: r.broken.map((b) => ({ replicaId: b.replicaId, detail: b.detail })) };
+        return { ok: r.ok, broken: r.broken.map((b) => ({ replicaId: b.replicaId, detail: b.detail, ...(b.kind ? { kind: b.kind } : {}), ...(b.nonce ? { nonce: b.nonce } : {}), ...(b.events ? { events: b.events } : {}) })) };
     }
     append(body) {
         return this.inner.append(body);
     }
     isNonceConsumed(nonce) { return this.inner.isNonceConsumed(nonce); }
+    doubleSpends() { return this.inner.doubleSpends(); }
 }
 exports.FileLedgerStore = FileLedgerStore;
 /**
@@ -137,6 +182,7 @@ class MemoryLedgerStore {
         return this.loadAll().some((e) => e.kind === 'nonce-consumed'
             && ((e.inputs ?? []).includes(nonce) || (e.inputs ?? []).includes(fp)));
     }
+    doubleSpends() { return (0, provenance_ledger_1.unreconciledDoubleSpends)(this.loadAll()); }
 }
 exports.MemoryLedgerStore = MemoryLedgerStore;
 // @implements A-SPEC-574.3

package/dist/holmes/governance/ledger-timeline.d.ts

@@ -1,6 +1,8 @@
+import { ExecutionContext } from '../project/execution-context';
 import { ProvenanceEvent } from './provenance-chain';
 /** One governance event, projected to what a timeline shows — chain-integrity fields dropped. */
 export interface TimelineEntry {
+    execution?: ExecutionContext;
     ts: string;
     kind: string;
     actor: string;
@@ -9,7 +11,7 @@ export interface TimelineEntry {
 }
 /** The subset of a ledger event this projection reads (structurally typed so callers can pass
  * FileLedgerStore.loadAll() results directly). */
-type TimelineSource = Pick<ProvenanceEvent, 'ts' | 'kind' | 'actor' | 'summary'> & Partial<Pick<ProvenanceEvent, 'inputs' | 'seq'>>;
+type TimelineSource = Pick<ProvenanceEvent, 'ts' | 'kind' | 'actor' | 'summary'> & Partial<Pick<ProvenanceEvent, 'inputs' | 'seq' | 'execution'>>;
 /**
  * @implements A-SPEC-538.3
  * Pure: order ledger events into a timeline, optionally narrowed to one spec. Ascending by `ts`

package/dist/holmes/governance/ledger-timeline.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.timelineFrom = timelineFrom;
+// @implements A-SPEC-538.3, A-SPEC-624
+// @implements A-SPEC-645
+const execution_context_1 = require("../project/execution-context");
+const display_id_aliases_1 = require("./display-id-aliases");
 /**
  * @implements A-SPEC-538.3
  * Pure: order ledger events into a timeline, optionally narrowed to one spec. Ascending by `ts`
@@ -9,7 +13,12 @@ exports.timelineFrom = timelineFrom;
  * (hash/prevHash/seq/replicaId) are plumbing, not timeline content, and are projected away.
  */
 function timelineFrom(events, id) {
-    const selected = id ? events.filter((e) => (e.inputs ?? []).includes(id)) : events.slice();
+    // @implements A-SPEC-645 — an id selects the events of every display id the entity has carried,
+    // resolved from the same events (renames are ledger records); an id with no history is itself.
+    const ids = id ? new Set((0, display_id_aliases_1.aliasesOf)(events, id)) : undefined;
+    // A rename record names the ids as `old-id:`/`new-id:` inputs; those reference the entity too.
+    const refersTo = (input) => input.startsWith('old-id:') ? input.slice(7) : input.startsWith('new-id:') ? input.slice(7) : input;
+    const selected = ids ? events.filter((e) => (e.inputs ?? []).some((input) => ids.has(refersTo(input)))) : events.slice();
     selected.sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : (a.seq ?? 0) - (b.seq ?? 0)));
     return selected.map((e) => ({
         ts: e.ts,
@@ -17,5 +26,6 @@ function timelineFrom(events, id) {
         actor: e.actor,
         summary: e.summary,
         inputs: e.inputs ?? [],
+        ...('execution' in e ? { execution: (0, execution_context_1.validateExecution)(e.execution) } : {}),
     }));
 }

package/dist/holmes/governance/provenance-chain.d.ts

@@ -1,3 +1,4 @@
+import { ExecutionContext } from '../project/execution-context';
 import { LockOptions } from './ledger-lock';
 /**
  * N3 — Decision PROVENANCE chain (target-architecture §7-N N3): "누가·언제·왜"의 완전 인과 재구성.
@@ -18,6 +19,7 @@ import { LockOptions } from './ledger-lock';
  * returning [] would erase the audit trail this exists to guarantee — same policy as DecisionLedger).
  */
 export interface ProvenanceEvent {
+    execution?: ExecutionContext;
     seq: number;
     ts: string;
     actor: string;

package/dist/holmes/governance/provenance-chain.js

@@ -50,7 +50,8 @@ exports.keyedSelfConsistent = keyedSelfConsistent;
 exports.bodyCanon = bodyCanon;
 exports.parseLedgerLines = parseLedgerLines;
 exports.consumeNonceExclusively = consumeNonceExclusively;
-// @implements A-SPEC-125.2
+// @implements A-SPEC-125.2, A-SPEC-624
+const execution_context_1 = require("../project/execution-context");
 const crypto = __importStar(require("node:crypto"));
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -61,6 +62,7 @@ function canonicalize(b) {
     return JSON.stringify({
         seq: b.seq, ts: b.ts, actor: b.actor, kind: b.kind, summary: b.summary,
         inputs: b.inputs ?? [], rationale: b.rationale ?? '', authorization: b.authorization ?? '',
+        ...('execution' in b ? { execution: (0, execution_context_1.validateExecution)(b.execution) } : {}),
     });
 }
 /**
@@ -83,7 +85,7 @@ function chainNext(chain, body, key) {
     const full = { seq: chain.length, ...body };
     return { ...full, prevHash, hash: computeHash(prevHash, full, key) };
 }
-const KNOWN_FIELDS = new Set(['seq', 'ts', 'actor', 'kind', 'summary', 'inputs', 'rationale', 'authorization', 'prevHash', 'hash']);
+const KNOWN_FIELDS = new Set(['seq', 'ts', 'actor', 'kind', 'summary', 'inputs', 'rationale', 'authorization', 'prevHash', 'hash', 'execution']);
 /**
  * Verify the whole chain: recomputed hashes, prevHash linkage, contiguous seq, AND no unknown fields.
  * The unknown-field check closes the canonicalization-gap attack (adversarial review #2): canonicalize
@@ -102,6 +104,14 @@ function verifyChain(chain, key) {
     let keyedSeen = false;
     for (let i = 0; i < chain.length; i++) {
         const e = chain[i];
+        if ('execution' in e) {
+            try {
+                (0, execution_context_1.validateExecution)(e.execution);
+            }
+            catch {
+                return { ok: false, brokenAt: i, detail: 'invalid execution context' };
+            }
+        }
         const unknown = Object.keys(e).filter((k) => !KNOWN_FIELDS.has(k));
         if (unknown.length > 0)
             return { ok: false, brokenAt: i, detail: `unknown field(s) outside the hashed schema: ${unknown.join(', ')} (smuggled data)` };
@@ -276,6 +286,7 @@ function bodyCanon(b) {
     return JSON.stringify({
         ts: b.ts, actor: b.actor, kind: b.kind, summary: b.summary,
         inputs: b.inputs ?? [], rationale: b.rationale ?? '', authorization: b.authorization ?? '',
+        ...('execution' in b ? { execution: (0, execution_context_1.validateExecution)(b.execution) } : {}),
     });
 }
 /**

package/dist/holmes/governance/provenance-ledger.d.ts

@@ -25,6 +25,28 @@ export interface LedgerEvent extends ProvenanceEvent {
     /** Which chain this came from; `null` for the pre-split legacy file. */
     replicaId: string | null;
 }
+/** A-SPEC-642 — one single-use nonce consumed by several events (any replicas), not yet reconciled. */
+export interface DoubleSpend {
+    nonce: string;
+    events: {
+        replicaId: string | null;
+        seq: number;
+        hash: string;
+        ts: string;
+    }[];
+}
+/** A-SPEC-642 — the event kind an operator's reconciliation appends. */
+export declare const DOUBLE_SPEND_RECONCILED = "nonce-double-spend-reconciled";
+/**
+ * @implements A-SPEC-642
+ * Single-use nonces consumed by two or more `nonce-consumed` events (on any replicas) that no
+ * `nonce-double-spend-reconciled` event has covered. Pure and hash-free on purpose: the gate and
+ * the approval channel ask this on every guarded act, at the cost `isNonceConsumed` already pays;
+ * chain integrity stays with `verifyAll`. A reconciliation covers a group only when it names the
+ * nonce input AND `event:<hash>` for every member — a later consumption of the same nonce is a new
+ * event the old reconciliation never saw, so the group is open again.
+ */
+export declare function unreconciledDoubleSpends(events: LedgerEvent[]): DoubleSpend[];
 export interface LedgerVerifyResult {
     ok: boolean;
     /** Per-chain failures, naming the replica so a report is actionable rather than merely alarming. */
@@ -33,6 +55,9 @@ export interface LedgerVerifyResult {
         file: string;
         detail?: string;
         brokenAt?: number;
+        kind?: 'chain' | 'double-spend';
+        nonce?: string;
+        events?: DoubleSpend['events'];
     }[];
 }
 /**
@@ -72,6 +97,7 @@ export declare class ProvenanceLedger {
      * `.ax/state/`, which is the REQ-148 footprint defect returning through a new door.
      */
     replicaIdOf(): string;
+    executionContext(): import("../project/execution-context").ExecutionContext | undefined;
     /** Every chain file present, legacy first. `replicaId` is null for the legacy chain. */
     chains(): {
         replicaId: string | null;
@@ -89,6 +115,8 @@ export declare class ProvenanceLedger {
      * ordering exists so output is stable and readable, not so it can be read as "this happened first".
      */
     loadAll(): LedgerEvent[];
+    /** @implements A-SPEC-642 — unreconciled cross-replica double-spends, structured. */
+    doubleSpends(): DoubleSpend[];
     /** Each chain verified on its own; one bad chain fails the whole ledger, and is named. */
     verifyAll(): LedgerVerifyResult;
     /**

package/dist/holmes/governance/provenance-ledger.js

@@ -33,14 +33,50 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProvenanceLedger = void 0;
+exports.ProvenanceLedger = exports.DOUBLE_SPEND_RECONCILED = void 0;
+exports.unreconciledDoubleSpends = unreconciledDoubleSpends;
 exports.isLedgerFilename = isLedgerFilename;
-// @implements A-SPEC-206
+// @implements A-SPEC-206, A-SPEC-624
+// @implements A-SPEC-642
+const execution_context_1 = require("../project/execution-context");
 // @implements A-SPEC-148
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const provenance_chain_1 = require("./provenance-chain");
 const replica_id_1 = require("./replica-id");
+/** A-SPEC-642 — the event kind an operator's reconciliation appends. */
+exports.DOUBLE_SPEND_RECONCILED = 'nonce-double-spend-reconciled';
+/**
+ * @implements A-SPEC-642
+ * Single-use nonces consumed by two or more `nonce-consumed` events (on any replicas) that no
+ * `nonce-double-spend-reconciled` event has covered. Pure and hash-free on purpose: the gate and
+ * the approval channel ask this on every guarded act, at the cost `isNonceConsumed` already pays;
+ * chain integrity stays with `verifyAll`. A reconciliation covers a group only when it names the
+ * nonce input AND `event:<hash>` for every member — a later consumption of the same nonce is a new
+ * event the old reconciliation never saw, so the group is open again.
+ */
+function unreconciledDoubleSpends(events) {
+    const groups = new Map();
+    for (const e of events) {
+        if (e.kind !== 'nonce-consumed')
+            continue;
+        for (const input of e.inputs ?? []) {
+            const list = groups.get(input) ?? [];
+            list.push({ replicaId: e.replicaId, seq: e.seq, hash: e.hash, ts: e.ts });
+            groups.set(input, list);
+        }
+    }
+    const reconciliations = events.filter((e) => e.kind === exports.DOUBLE_SPEND_RECONCILED).map((e) => new Set(e.inputs ?? []));
+    const out = [];
+    for (const [nonce, list] of groups) {
+        if (list.length < 2)
+            continue;
+        const covered = reconciliations.some((inputs) => inputs.has(nonce) && list.every((ev) => inputs.has('event:' + ev.hash)));
+        if (!covered)
+            out.push({ nonce, events: list });
+    }
+    return out.sort((a, b) => (a.nonce < b.nonce ? -1 : a.nonce > b.nonce ? 1 : 0));
+}
 const LEGACY = 'provenance.jsonl';
 const REPLICA_FILE = /^provenance\.([^.]+)\.jsonl$/;
 /**
@@ -85,6 +121,9 @@ class ProvenanceLedger {
     }
     cachedId;
     get replicaId() {
+        const execution = this.executionContext();
+        if (execution)
+            return execution.replicaId;
         if (this.cachedId === undefined)
             this.cachedId = this.replicaIdFn();
         return this.cachedId;
@@ -107,8 +146,12 @@ class ProvenanceLedger {
      * `.ax/state/`, which is the REQ-148 footprint defect returning through a new door.
      */
     replicaIdOf() {
+        const execution = this.executionContext();
+        if (execution)
+            return execution.replicaId;
         return this.cachedId ?? (0, replica_id_1.resolveReplicaId)(rootForLedgerDir(this.dir), process.env, { persist: false });
     }
+    executionContext() { return (0, execution_context_1.executionForRoot)(rootForLedgerDir(this.dir)); }
     /** Every chain file present, legacy first. `replicaId` is null for the legacy chain. */
     chains() {
         let names;
@@ -149,6 +192,7 @@ class ProvenanceLedger {
         return events.map((e) => ({
             ...e,
             inputs: e.inputs ? [...e.inputs] : undefined,
+            ...(e.execution ? { execution: { ...e.execution } } : {}),
         }));
     }
     /**
@@ -175,13 +219,20 @@ class ProvenanceLedger {
         this.indexCache = { key, events: out };
         return this.cloneEvents(out);
     }
+    /** @implements A-SPEC-642 — unreconciled cross-replica double-spends, structured. */
+    doubleSpends() { return unreconciledDoubleSpends(this.loadAll()); }
     /** Each chain verified on its own; one bad chain fails the whole ledger, and is named. */
     verifyAll() {
         const broken = [];
         for (const c of this.chains()) {
             const r = new provenance_chain_1.ProvenanceChain(c.file).verify();
             if (!r.ok)
-                broken.push({ replicaId: c.replicaId, file: c.file, detail: r.detail, brokenAt: r.brokenAt });
+                broken.push({ replicaId: c.replicaId, file: c.file, kind: 'chain', detail: r.detail, brokenAt: r.brokenAt });
+            if (r.ok) {
+                const mismatch = new provenance_chain_1.ProvenanceChain(c.file).load().find(e => e.execution && e.execution.replicaId !== c.replicaId);
+                if (mismatch)
+                    broken.push({ replicaId: c.replicaId, file: c.file, kind: 'chain', detail: 'execution replica differs from chain partition', brokenAt: mismatch.seq });
+            }
         }
         // @implements A-SPEC-458
         // Cross-replica double-spend. consumeNonceExclusively's lock is per-file, so two machines can
@@ -191,18 +242,14 @@ class ProvenanceLedger {
         // records is always a violation (REQ-141): there is no legitimate re-spend. Counted by the raw
         // input value, the same rule isNonceConsumed matches on — one consume path writes one form, so
         // a real double-spend records the same value twice.
-        const counts = new Map();
-        for (const e of this.loadAll()) {
-            if (e.kind !== 'nonce-consumed')
-                continue;
-            for (const inp of e.inputs ?? [])
-                counts.set(inp, (counts.get(inp) ?? 0) + 1);
-        }
-        for (const [nonce, n] of counts) {
-            if (n > 1) {
-                broken.push({ replicaId: null, file: '(cross-replica)',
-                    detail: `single-use nonce ${nonce.slice(0, 16)}… spent ${n} times across replicas — REQ-141 double-spend` });
-            }
+        // @implements A-SPEC-642 — structured, and RECONCILABLE: an operator's `nonce-double-spend-reconciled`
+        // event naming the nonce and every consuming event's hash retires the group; a later consumption
+        // reopens it. Measured 2026-09-14: the prose-only entry left the Stop hook blocking every turn
+        // end "at seq undefined" with no act that could ever clear it.
+        for (const d of unreconciledDoubleSpends(this.loadAll())) {
+            const replicas = [...new Set(d.events.map((e) => e.replicaId ?? 'legacy'))].join(', ');
+            broken.push({ replicaId: null, file: '(cross-replica)', kind: 'double-spend', nonce: d.nonce, events: d.events,
+                detail: `single-use nonce ${d.nonce} spent ${d.events.length} times across replicas (${replicas}) — REQ-141 double-spend; reconcile with ledger_reconcile` });
         }
         return { ok: broken.length === 0, broken };
     }
@@ -213,8 +260,14 @@ class ProvenanceLedger {
      * which is the defect this class exists to remove.
      */
     append(body) {
+        const execution = this.executionContext();
+        if ('execution' in body) {
+            const supplied = (0, execution_context_1.validateExecution)(body.execution);
+            if (execution && JSON.stringify(supplied) !== JSON.stringify(execution))
+                throw new Error('Supplied execution differs from the owned run');
+        }
         this.indexCache = undefined;
-        return new provenance_chain_1.ProvenanceChain(this.currentFile()).append(body);
+        return new provenance_chain_1.ProvenanceChain(this.currentFile()).append(execution ? { ...body, execution } : body);
     }
     /**
      * Has this nonce been spent on ANY replica?

package/dist/holmes/governance/session-context.d.ts

@@ -1,3 +1,4 @@
+import { ExecutionContext } from '../project/execution-context';
 /**
  * The session-context ledger: WHO attached (agent name@version) and — where a harness exposes it —
  * WITH WHAT (model ids, token totals). REQ-564's whole point is that none of this existed anywhere
@@ -21,6 +22,7 @@ export interface UsageTotals {
     cacheCreation: number;
 }
 export interface ClientRecord {
+    execution?: ExecutionContext;
     kind: 'client';
     sessionKey: string;
     client: string;
@@ -29,6 +31,7 @@ export interface ClientRecord {
     replica?: string;
 }
 export interface UsageRecord {
+    execution?: ExecutionContext;
     kind: 'usage';
     sessionKey: string;
     models: string[];

package/dist/holmes/governance/session-context.js

@@ -39,7 +39,8 @@ exports.appendSessionContext = appendSessionContext;
 exports.readSessionContext = readSessionContext;
 exports.makeSessionStamper = makeSessionStamper;
 exports.summarizeTranscript = summarizeTranscript;
-// @implements A-SPEC-564.1
+// @implements A-SPEC-564.1, A-SPEC-625
+const execution_context_1 = require("../project/execution-context");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const replica_id_1 = require("./replica-id");
@@ -56,14 +57,19 @@ function appendSessionContext(root, rec) {
     try {
         if (!fs.existsSync(path.join(root, '.ax')))
             return false;
+        const execution = (0, execution_context_1.observationExecution)(root, rec);
         let replica = 'local';
-        try {
-            replica = (0, replica_id_1.resolveReplicaId)(root) || 'local';
+        if (execution)
+            replica = execution.replicaId;
+        else {
+            try {
+                replica = (0, replica_id_1.resolveReplicaId)(root) || 'local';
+            }
+            catch { /* keep the fallback */ }
         }
-        catch { /* keep the fallback */ }
         const file = path.join(root, '.ax', 'ledger', sessionContextFilename(replica));
         fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.appendFileSync(file, `${JSON.stringify({ ...rec, replica })}\n`);
+        fs.appendFileSync(file, `${JSON.stringify({ ...rec, replica, ...(execution ? { execution } : {}) })}\n`);
         return true;
     }
     catch {
@@ -98,6 +104,11 @@ function readSessionContext(root) {
                 const r = JSON.parse(s);
                 if (r && typeof r === 'object' && (r.kind === 'client' || r.kind === 'usage')
                     && typeof r.sessionKey === 'string' && typeof r.ts === 'string') {
+                    if ('execution' in r) {
+                        r.execution = (0, execution_context_1.validateExecution)(r.execution);
+                        if (name !== sessionContextFilename(r.execution.replicaId) || r.replica !== r.execution.replicaId)
+                            continue;
+                    }
                     out.push({ r: r, i: i++ });
                 }
             }
@@ -114,24 +125,31 @@ function readSessionContext(root) {
  * session has one identity; a root-less call defers rather than consumes the chance.
  */
 function makeSessionStamper(info, append = appendSessionContext, sessionKey = `mcp-${process.pid}`) {
-    let stamped = false;
+    const stamped = new Set();
     return (root) => {
-        if (stamped || typeof root !== 'string' || root === '')
+        if (typeof root !== 'string' || root === '')
             return;
         try {
+            const execution = (0, execution_context_1.executionForRoot)(root);
+            const key = execution ? JSON.stringify(execution) : 'legacy';
+            if (stamped.has(key))
+                return;
             const v = (() => { try {
                 return info();
             }
             catch {
                 return undefined;
             } })();
-            stamped = append(root, {
+            const success = append(root, {
                 kind: 'client',
                 sessionKey,
                 client: v?.name ?? 'unknown',
                 clientVersion: v?.version ?? 'unknown',
                 ts: new Date().toISOString(),
+                ...(execution ? { execution } : {}),
             });
+            if (success)
+                stamped.add(key);
         }
         catch { /* observation must never break the observed call */ }
     };

package/dist/holmes/guardrail/risk-classifier.js

@@ -8,7 +8,7 @@ exports.classifyArchitectureReversal = classifyArchitectureReversal;
 exports.classifySecret = classifySecret;
 exports.classifyBlastRadius = classifyBlastRadius;
 exports.assessRisk = assessRisk;
-// @implements A-SPEC-125.1
+// @implements A-SPEC-125.1, A-SPEC-627
 const risk_types_1 = require("./risk-types");
 const AWS_KEY_RE = /AKIA[0-9A-Z]{16}/;
 const PEM_KEY_RE = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
@@ -263,7 +263,7 @@ function scopeAxToProject(cmd, projectRoot) {
 // 'echo x > .ax/approvals/grants/forged.json' passed while the Write gate refused the same file —
 // the exact two-copies drift this repository has paid for with isTestFile and a restated section
 // splitter. The directories are now written once; each rule keeps its own shape around them.
-const PROTECTED_AX_ALT = 'specs|decisions|ledger|cpg_cache|state|roles|approvals';
+const PROTECTED_AX_ALT = 'specs|decisions|ledger|cpg_cache|state|roles|approvals|entities';
 const PROTECTED_AX_PATH_RE = new RegExp(String.raw `(^|/)\.ax/(${PROTECTED_AX_ALT})(/|$)`);
 // A removal verb + a protected .ax path anywhere in a shell command — the command form of
 // the governance-path delete, which the structured `kind:'delete'` branch alone would miss.

package/dist/holmes/guardrail/write-target.js

@@ -45,7 +45,7 @@ exports.protectedFileKindOf = protectedFileKindOf;
 exports.protectedKindOf = protectedKindOf;
 exports.shellSegments = shellSegments;
 exports.resolvesInside = resolvesInside;
-// @implements A-SPEC-163
+// @implements A-SPEC-163, A-SPEC-627
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
@@ -193,6 +193,7 @@ const PROTECTED_DIRS = [
     path.join('.ax', 'roles'),
     path.join('.ax', 'cpg_cache'),
     path.join('.ax', 'state'),
+    path.join('.ax', 'entities'),
     '.claude',
 ];
 /**

package/dist/holmes/hooks/pre-tool-use.js

@@ -46,6 +46,8 @@ exports.wiredSpecsDir = wiredSpecsDir;
 exports.evaluateHook = evaluateHook;
 exports.readSpecsSync = readSpecsSync;
 // @implements A-SPEC-278
+// @implements A-SPEC-643
+// @implements A-SPEC-642
 // @implements A-SPEC-194, A-SPEC-195
 const registry_1 = require("../messages/registry");
 const root_1 = require("../project/root");
@@ -410,7 +412,6 @@ exports.DEFAULT_SPECS_DIR = '.ax/specs';
 function evaluateHook(input, specsDir, opts) {
     // @implements A-SPEC-133 — resolved once so every gate in this call shares one timestamp.
     const nowTs = opts?.now ?? new Date().toISOString();
-    const ledgerFile = path.join(opts.projectRoot, '.ax', 'ledger', 'provenance.jsonl');
     // @implements A-SPEC-125.4
     // Bash/shell risk gate: this branch runs BEFORE the Write/Edit phaseCheck logic below and
     // is intentionally fail-CLOSED — a classifier throw on the Bash surface denies, never
@@ -483,6 +484,16 @@ function evaluateHook(input, specsDir, opts) {
             // creating `.ax/ledger` is the wiring working, not a plant. Refusing there would deny the
             // first legitimate use in every new project. The single-use guarantee still holds: the record
             // lands in the resolved root, which is the same file every later call resolves to.
+            // @implements A-SPEC-643 — the writer's replica chain, resolved only on this path so ordinary hook
+            // calls leave no footprint; the spent check below still spans every chain in the directory.
+            const ledgerFile = (0, ledger_store_2.writerChainFile)(path.join(opts.projectRoot, '.ax', 'ledger'));
+            // @implements A-SPEC-642 — a covered command is still denied, and no nonce spent, while the
+            // merged ledger holds an unreconciled cross-replica double-spend; the reason names the exit.
+            {
+                const conflict = (0, ledger_store_2.ledgerConflictReason)(path.dirname(ledgerFile));
+                if (conflict)
+                    return deny(conflict);
+            }
             if ((0, provenance_chain_1.blankNonce)(acting?.nonce)) {
                 return deny('the approval declared single-use (nonce) but the value is empty — single-use cannot be enforced, so it is denied');
             }

package/dist/holmes/hooks/stop.js

@@ -53,6 +53,8 @@ exports.guardCountOrZero = guardCountOrZero;
 exports.readGuardCount = readGuardCount;
 exports.writeGuardCount = writeGuardCount;
 const fs = __importStar(require("node:fs"));
+// @implements A-SPEC-645
+// @implements A-SPEC-642
 const npx_bin_1 = require("../project/npx-bin");
 const approval_queue_1 = require("../governance/approval-queue");
 const dependency_delta_1 = require("../guardrail/dependency-delta");
@@ -68,6 +70,7 @@ const cycle_detect_1 = require("../cpg/cycle-detect");
 const provenance_chain_1 = require("../governance/provenance-chain");
 const test_evidence_1 = require("../review/test-evidence");
 const test_outcomes_1 = require("../review/test-outcomes");
+const display_id_aliases_1 = require("../governance/display-id-aliases");
 const config_1 = require("../config/config");
 const pre_tool_use_1 = require("./pre-tool-use");
 const governance_history_1 = require("../guardrail/governance-history");
@@ -501,8 +504,12 @@ function evaluateStop(specs, evidence) {
     // Tampered audit trail blocks finishing — wires the provenance chain's verify into the live gate
     // (review finding: verify() previously had no product caller, so the chain's guarantee was inert).
     if (evidence?.provenance && !evidence.provenance.ok) {
-        problems.push(`[ART-2] provenance chain broken at seq ${evidence.provenance.brokenAt}: ${evidence.provenance.detail}`);
-        structured.push({ article: 'ART-2', detail: `provenance chain broken at seq ${evidence.provenance.brokenAt}: ${evidence.provenance.detail}` });
+        // @implements A-SPEC-642 — a cross-replica double-spend has no sequence; "seq undefined" hid that.
+        const provenanceDetail = evidence.provenance.brokenAt === undefined
+            ? `provenance ledger conflict: ${evidence.provenance.detail}`
+            : `provenance chain broken at seq ${evidence.provenance.brokenAt}: ${evidence.provenance.detail}`;
+        problems.push(`[ART-2] ${provenanceDetail}`);
+        structured.push({ article: 'ART-2', detail: provenanceDetail });
     }
     // @implements A-SPEC-191 (§4a) — an existing-but-unreadable findings ledger is not a clean turn:
     // it may hold an open critical, and a "clean" verdict here would also CLEAR standing ART-7 debt.
@@ -913,7 +920,11 @@ if (require.main === module) {
                 if (redFirstMode !== 'off') {
                     const head = (0, node_child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: stopProjectRoot(), stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() }).toString().trim();
                     changedAspecs = changedAnchoredAspecs(stopProjectRoot());
-                    outcomesByAspec = (0, test_outcomes_1.groupOutcomesByAspec)((0, test_outcomes_1.readOutcomes)(stopProjectRoot()), head);
+                    // @implements A-SPEC-645 — a renumbered A-SPEC keeps its red-first evidence: records are
+                    // grouped under the display id the entity carries now, per the ledger's rename records.
+                    const { FileLedgerStore: LedgerForAliases } = require('../governance/ledger-store');
+                    const canonical = (0, display_id_aliases_1.displayIdCanonicalizer)(new LedgerForAliases(path.join(stopProjectRoot(), '.ax', 'ledger')).loadAll());
+                    outcomesByAspec = (0, test_outcomes_1.groupOutcomesByAspec)((0, test_outcomes_1.readOutcomes)(stopProjectRoot()), head, canonical);
                 }
             }
             catch {