@holmes-lab/holmes-kit 0.19.6 → 0.20.1

package/dist/holmes/governance/approval-queue.js

@@ -41,9 +41,12 @@ exports.approvalRequestId = approvalRequestId;
 exports.foldQueue = foldQueue;
 exports.enqueueApprovalRequest = enqueueApprovalRequest;
 exports.enqueueApprovalRequestDetailed = enqueueApprovalRequestDetailed;
+exports.appendQueueEvent = appendQueueEvent;
 exports.readQueue = readQueue;
 exports.queueHint = queueHint;
-// @implements A-SPEC-244
+// @implements A-SPEC-244, A-SPEC-626
+const execution_context_1 = require("../project/execution-context");
+const root_1 = require("../project/root");
 const node_crypto_1 = require("node:crypto");
 const npx_bin_1 = require("../project/npx-bin");
 const fs = __importStar(require("node:fs"));
@@ -75,8 +78,12 @@ exports.QUEUE_RELPATH = path.join('.ax', 'approvals', 'queue.jsonl');
 // single-shot gate refusals nobody ever meant to decide, burying the real inbox (spec-approve 9,
 // config-write 1) and accumulating raw shell commands in a tracked file. Only these kinds seek a
 // decision; everything else routes to the local per-replica refusal log below. Wired RED-first.
+// @implements A-SPEC-651.4 — `review-resolve` is a decision too: resolving an open critical needs a
+// human, review_record's refusal points that human at `holmes-kit approve`, and without this entry the
+// request went to the refusal log so the inbox stayed empty (measured 2026-09-14 on Windows: two
+// expired session dialogs, then `approve --list` answered "No requests awaiting approval").
 exports.DECISION_KINDS = new Set([
-    'spec-approve', 'config-write', 'autonomy-grant', 'spec-reappraisal',
+    'spec-approve', 'config-write', 'autonomy-grant', 'spec-reappraisal', 'review-resolve',
 ]);
 const REFUSALS_FILE_RE = /^refusals\.([^.]+)\.jsonl$/;
 function refusalsFilename(replica) {
@@ -145,6 +152,7 @@ function foldQueue(lines, opts) {
     const pending = new Map();
     const decisions = {};
     const holds = {};
+    const subjects = {};
     let malformedLines = 0;
     for (const raw of Array.isArray(lines) ? lines : []) {
         const line = String(raw ?? '').trim();
@@ -163,6 +171,16 @@ function foldQueue(lines, opts) {
             malformedLines++;
             continue;
         }
+        let execution;
+        if ('execution' in e) {
+            try {
+                execution = (0, execution_context_1.validateExecution)(e.execution);
+            }
+            catch {
+                malformedLines++;
+                continue;
+            }
+        }
         const id = typeof e.id === 'string' ? e.id : undefined;
         switch (e.event) {
             case 'requested': {
@@ -170,6 +188,10 @@ function foldQueue(lines, opts) {
                     malformedLines++;
                     break;
                 }
+                // @implements A-SPEC-650 — remembered for every kind, before the inbox filter: a decided shell
+                // refusal still has a subject to show on the status surface.
+                if (!subjects[id])
+                    subjects[id] = { kind: String(e.kind ?? ''), target: String(e.target ?? '') };
                 // @implements A-SPEC-576.1 — the READER applies the writer's predicate.
                 // REQ-563 routed gate refusals away from the inbox and deliberately did NOT rewrite the
                 // 2,192 lines already written; append-only is the rule this ledger is worth something for.
@@ -198,6 +220,10 @@ function foldQueue(lines, opts) {
                         // @implements A-SPEC-562.2 — events written before attribution existed have no field;
                         // `unknown` names that honestly instead of pretending they came from this machine.
                         replica: typeof e.replica === 'string' && e.replica !== '' ? e.replica : 'unknown',
+                        // @implements A-SPEC-649 — the details ride the first filing; a repeat never rewrites them.
+                        ...(execution ? { execution } : {}),
+                        ...(typeof e.subject === 'string' && e.subject !== '' ? { subject: e.subject } : {}),
+                        ...(typeof e.risk === 'string' && e.risk !== '' ? { risk: e.risk } : {}),
                     });
                 }
                 break;
@@ -212,9 +238,28 @@ function foldQueue(lines, opts) {
                         ...(typeof e.reason === 'string' ? { reason: e.reason } : {}),
                         ts: typeof e.ts === 'string' ? e.ts : '',
                         ...(typeof e.covered === 'number' ? { covered: e.covered } : {}),
+                        ...(execution ? { execution } : {}),
+                        // @implements A-SPEC-650 — when a grant expires and who decided, for the outcome rows.
+                        ...(typeof e.expires === 'string' ? { expires: e.expires } : {}),
+                        ...(typeof e.actor === 'string' ? { actor: e.actor } : {}),
                     };
                 }
                 break;
+            // @implements A-SPEC-649 — the grant's later life, in the same ledger the screen reads.
+            // `consumed`: the act the grant authorized succeeded (written by consumeGrantFile) — the
+            // decision keeps its `granted` shape and gains the consumption time. `revoked`: the operator
+            // withdrew a live grant — a decision like any other (pending cleared, the hold answered).
+            case 'consumed':
+                if (id)
+                    decisions[id] = { ...(decisions[id] ?? { event: 'granted', ts: typeof e.ts === 'string' ? e.ts : '' }), consumedTs: typeof e.ts === 'string' ? e.ts : '' };
+                break;
+            case 'revoked':
+                if (id) {
+                    pending.delete(id);
+                    delete holds[id];
+                    decisions[id] = { event: 'revoked', ...(typeof e.reason === 'string' ? { reason: e.reason } : {}), ts: typeof e.ts === 'string' ? e.ts : '', ...(execution ? { execution } : {}) };
+                }
+                break;
             case 'held': {
                 const entry = id ? pending.get(id) : undefined;
                 if (entry) {
@@ -225,7 +270,7 @@ function foldQueue(lines, opts) {
                 // @implements A-SPEC-563.2 — record the hold by id too: a refusal-log request has no pending
                 // entry to hang the question on, and the question must still reach the retry.
                 if (id)
-                    holds[id] = { ...(typeof e.question === 'string' ? { question: e.question } : {}), ts: typeof e.ts === 'string' ? e.ts : '' };
+                    holds[id] = { ...(typeof e.question === 'string' ? { question: e.question } : {}), ts: typeof e.ts === 'string' ? e.ts : '', ...(execution ? { execution } : {}) };
                 break;
             }
             default:
@@ -236,8 +281,9 @@ function foldQueue(lines, opts) {
     const all = [...pending.values()];
     const ttl = typeof opts?.ttlMs === 'number' && typeof opts?.now === 'number'
         ? { ttlMs: opts.ttlMs, now: opts.now } : null;
+    const withSubjects = Object.keys(subjects).length > 0 ? { subjects } : {};
     if (ttl === null)
-        return { pending: all, expired: [], malformedLines, decisions, holds };
+        return { pending: all, expired: [], malformedLines, decisions, holds, ...withSubjects };
     // @implements A-SPEC-507.1 — strict excess only, and an unparseable lastTs stays ACTIVE: a
     // clockless entry must never be silently hidden by a clock it does not carry.
     const expired = [];
@@ -246,16 +292,8 @@ function foldQueue(lines, opts) {
         const last = Date.parse(p.lastTs);
         (Number.isFinite(last) && last + ttl.ttlMs < ttl.now ? expired : active).push(p);
     }
-    return { pending: active, expired, malformedLines, decisions, holds };
+    return { pending: active, expired, malformedLines, decisions, holds, ...withSubjects };
 }
-/**
- * Append a request event. Fire-and-forget.
- *
- * @implements A-SPEC-244
- * Every failure is swallowed into `false`: this runs INSIDE gate verdict paths, and the moment a
- * dead queue could change a verdict, killing the queue becomes a way to manipulate the gate. The
- * caller uses the boolean only to decide whether to print the review hint.
- */
 function enqueueApprovalRequest(root, req) {
     return enqueueApprovalRequestDetailed(root, req).written;
 }
@@ -298,6 +336,15 @@ function enqueueApprovalRequestDetailed(root, req) {
         catch {
             replica = undefined;
         }
+        // @implements A-SPEC-649 — the requesting execution, when this write happens inside a handler run
+        // (absent for hooks, the CLI and a foreign root — never guessed).
+        let execution;
+        try {
+            execution = (0, execution_context_1.executionForRoot)(root);
+        }
+        catch {
+            execution = undefined;
+        }
         const event = {
             event: 'requested',
             id: approvalRequestId(req.kind, req.target),
@@ -306,6 +353,9 @@ function enqueueApprovalRequestDetailed(root, req) {
             why: req.why,
             ts: new Date().toISOString(),
             ...(replica !== undefined && replica !== '' ? { replica } : {}),
+            ...(execution ? { execution } : {}),
+            ...(typeof req.subject === 'string' && req.subject !== '' ? { subject: req.subject } : {}),
+            ...(typeof req.risk === 'string' && req.risk !== '' ? { risk: req.risk } : {}),
             // @implements A-SPEC-564.2 — only the refusal log carries the feedback cost; inbox kinds have
             // no deny text to measure.
             ...(!exports.DECISION_KINDS.has(req.kind) && typeof req.reasonBytes === 'number' && Number.isFinite(req.reasonBytes)
@@ -362,6 +412,34 @@ function isPlainFile(file) {
         return true;
     }
 }
+/**
+ * @implements A-SPEC-649
+ * Append a lifecycle event (`consumed`, `revoked`) to the tracked queue: `.ax` must exist, the
+ * queue must be a plain file, the timestamp is this write's, and the active execution (if any) is
+ * attached — the same discipline as the CLI's decision writer. Fire-and-forget: `false` on failure.
+ */
+function appendQueueEvent(root, event) {
+    try {
+        let execution;
+        try {
+            execution = (0, execution_context_1.executionForRoot)((0, root_1.resolveProjectRoot)(root).root);
+        }
+        catch {
+            execution = undefined;
+        }
+        const file = path.join(root, exports.QUEUE_RELPATH);
+        if (!fs.existsSync(path.join(root, '.ax')))
+            return false;
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        if (!isPlainFile(file))
+            return false;
+        fs.appendFileSync(file, JSON.stringify({ ...event, ts: new Date().toISOString(), ...(execution ? { execution } : {}) }) + '\n');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Read and fold the queue on disk. A missing file is an empty queue, not an error. */
 function readQueue(root, opts) {
     const file = path.join(root, exports.QUEUE_RELPATH);

package/dist/holmes/governance/display-id-aliases.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Display-id history, read from the ledger's rename records.
+ *
+ * The entity model keeps identity immutable and the display id mutable, and every official rename is
+ * already in the ledger: `entity-renumbered` (inputs `entity:<uuid>`, `old-id:<X>`, `new-id:<Y>`), the
+ * legacy `spec-renumbered` (`X->Y`), and `entity-integrated` (same `old-id:`/`new-id:` form for the
+ * mapping steps an integration renumbers). Measured 2026-09-14: evidence consumers keyed by display id
+ * lost a renumbered document's red-first outcomes and timeline entirely. This module is the one place
+ * that turns those records into aliases; it reads only recorded renames and infers nothing.
+ */
+export interface DisplayIdRename {
+    oldId: string;
+    newId: string;
+    ts: string;
+}
+type RenameEvent = {
+    kind: string;
+    ts: string;
+    inputs?: string[];
+};
+/** Every recorded rename as an ordered pair, in ledger order (ts, then input order). */
+export declare function displayIdRenames(events: ReadonlyArray<RenameEvent>): DisplayIdRename[];
+/** The display ids an entity has carried, as the connected component of `id` over recorded renames. */
+export declare function aliasesOf(events: ReadonlyArray<RenameEvent>, id: string): string[];
+/** The display id the entity carries now: recorded renames applied forward from `id`, in ledger order. */
+export declare function currentDisplayId(events: ReadonlyArray<RenameEvent>, id: string): string;
+/** One pass over the renames, then memoized answers — for consumers that canonicalize many ids. */
+export declare function displayIdCanonicalizer(events: ReadonlyArray<RenameEvent>): (id: string) => string;
+export {};

package/dist/holmes/governance/display-id-aliases.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.displayIdRenames = displayIdRenames;
+exports.aliasesOf = aliasesOf;
+exports.currentDisplayId = currentDisplayId;
+exports.displayIdCanonicalizer = displayIdCanonicalizer;
+const RENAME_KINDS = new Set(['entity-renumbered', 'entity-integrated']);
+const ARROW = /^(\S+)->(\S+)$/;
+/** Every recorded rename as an ordered pair, in ledger order (ts, then input order). */
+function displayIdRenames(events) {
+    const indexed = events.map((e, i) => ({ e, i }));
+    indexed.sort((a, b) => (a.e.ts < b.e.ts ? -1 : a.e.ts > b.e.ts ? 1 : a.i - b.i));
+    const out = [];
+    for (const { e } of indexed) {
+        const inputs = e.inputs ?? [];
+        if (RENAME_KINDS.has(e.kind)) {
+            // An `old-id:` is paired with the next `new-id:` that follows it; an unpaired one is ignored.
+            let pending = null;
+            for (const input of inputs) {
+                if (input.startsWith('old-id:')) {
+                    pending = input.slice('old-id:'.length) || null;
+                    continue;
+                }
+                if (input.startsWith('new-id:')) {
+                    const newId = input.slice('new-id:'.length);
+                    if (pending && newId && newId !== pending)
+                        out.push({ oldId: pending, newId, ts: e.ts });
+                    pending = null;
+                }
+            }
+        }
+        else if (e.kind === 'spec-renumbered') {
+            for (const input of inputs) {
+                const m = ARROW.exec(input);
+                if (m && m[1] !== m[2])
+                    out.push({ oldId: m[1], newId: m[2], ts: e.ts });
+            }
+        }
+    }
+    return out;
+}
+/** The display ids an entity has carried, as the connected component of `id` over recorded renames. */
+function aliasesOf(events, id) {
+    const adjacent = new Map();
+    const link = (a, b) => {
+        (adjacent.get(a) ?? adjacent.set(a, new Set()).get(a)).add(b);
+        (adjacent.get(b) ?? adjacent.set(b, new Set()).get(b)).add(a);
+    };
+    for (const r of displayIdRenames(events))
+        link(r.oldId, r.newId);
+    const seen = new Set([id]);
+    const queue = [id];
+    while (queue.length) {
+        const cur = queue.shift();
+        for (const next of adjacent.get(cur) ?? [])
+            if (!seen.has(next)) {
+                seen.add(next);
+                queue.push(next);
+            }
+    }
+    return [...seen].sort();
+}
+/** The display id the entity carries now: recorded renames applied forward from `id`, in ledger order. */
+function currentDisplayId(events, id) {
+    let cur = id;
+    for (const r of displayIdRenames(events))
+        if (r.oldId === cur)
+            cur = r.newId;
+    return cur;
+}
+/** One pass over the renames, then memoized answers — for consumers that canonicalize many ids. */
+function displayIdCanonicalizer(events) {
+    const renames = displayIdRenames(events);
+    const memo = new Map();
+    return (id) => {
+        const hit = memo.get(id);
+        if (hit !== undefined)
+            return hit;
+        let cur = id;
+        for (const r of renames)
+            if (r.oldId === cur)
+                cur = r.newId;
+        memo.set(id, cur);
+        return cur;
+    };
+}

package/dist/holmes/governance/ledger-store.d.ts

@@ -1,5 +1,5 @@
 import { ProvenanceEvent } from './provenance-chain';
-import { LedgerEvent } from './provenance-ledger';
+import { LedgerEvent, DoubleSpend } from './provenance-ledger';
 /**
  * The ledger as a PORT — ADR-001's deferred half, applied to the one store whose shape was derived
  * from real use rather than guessed at.
@@ -24,6 +24,14 @@ import { LedgerEvent } from './provenance-ledger';
  * ADR-001 named speculative port design as the cost of deciding early; this is where that cost is
  * refused.
  */
+/** A-SPEC-642 — one verification failure: a chain break (`kind: 'chain'`) or an unreconciled double-spend. */
+export interface LedgerBroken {
+    replicaId: string | null;
+    detail?: string;
+    kind?: 'chain' | 'double-spend';
+    nonce?: string;
+    events?: DoubleSpend['events'];
+}
 export interface LedgerStore {
     /** This writer's identity — the one used for events this store appends. */
     replicaId(): string;
@@ -34,19 +42,43 @@ export interface LedgerStore {
     }[];
     /** Every event across every chain, deterministically ordered. */
     loadAll(): LedgerEvent[];
-    /** Per-chain verification; one broken chain fails the whole store and is named. */
+    /** Per-chain verification; one broken chain fails the whole store and is named. A-SPEC-642: cross-replica double-spends ride along as `kind: 'double-spend'` entries. */
     verifyAll(): {
         ok: boolean;
-        broken: {
-            replicaId: string | null;
-            detail?: string;
-        }[];
+        broken: LedgerBroken[];
     };
     /** Append to this writer's chain. Never modifies or removes an existing event. */
     append(body: Omit<ProvenanceEvent, 'prevHash' | 'hash' | 'seq'>): ProvenanceEvent;
     /** Spent on ANY chain — see the interface note. */
     isNonceConsumed(nonce: string): boolean;
+    /** A-SPEC-642 — single-use nonces consumed more than once across chains and not yet reconciled. */
+    doubleSpends(): DoubleSpend[];
+}
+/**
+ * @implements A-SPEC-643
+ * The chain file THIS process writes: `provenance.<replica>.jsonl`, resolved exactly as every other
+ * writer resolves it (the run's execution replica when registered, else the stored or hostname-derived
+ * id). Measured 2026-09-14: the shell gate, `risk_check` and `review_record` handed
+ * `consumeNonceExclusively` the legacy `provenance.jsonl`, so two clones spending the same approval
+ * offline both appended to one file and the origin's merge died with CONFLICT (add/add) before any
+ * double-spend could be seen. Consumptions belong on the writer's chain like every other event.
+ */
+export declare function writerChainFile(ledgerDir: string): string;
+/** A-SPEC-642 — thrown by approval resolution while the merged ledger holds an unreconciled double-spend. */
+export declare class LedgerConflictRefusal extends Error {
+    readonly holmesRefusal = true;
+    readonly code = "ledger-conflict";
+    constructor(message: string);
 }
+/**
+ * @implements A-SPEC-642
+ * The one sentence every authority-spending act refuses with while the merged ledger holds an
+ * unreconciled cross-replica double-spend, or null. Names the nonce, the replicas and the act that
+ * clears it, because a refusal that cannot be acted on is an obstacle rather than a gate. An absent
+ * ledger directory is a clean ledger. Not caught: an unreadable chain file throws here exactly as it
+ * throws in `isNonceConsumed`, and the callers' fail-closed handling applies.
+ */
+export declare function ledgerConflictReason(dir: string): string | null;
 /**
  * Local adapter — DELEGATES to `ProvenanceLedger` rather than re-implementing it.
  *
@@ -77,13 +109,11 @@ export declare class FileLedgerStore implements LedgerStore {
     loadAll(): LedgerEvent[];
     verifyAll(): {
         ok: boolean;
-        broken: {
-            replicaId: string | null;
-            detail?: string;
-        }[];
+        broken: LedgerBroken[];
     };
     append(body: Omit<ProvenanceEvent, 'prevHash' | 'hash' | 'seq'>): ProvenanceEvent;
     isNonceConsumed(nonce: string): boolean;
+    doubleSpends(): DoubleSpend[];
 }
 /**
  * In-memory adapter — the instrument that makes the contract testable.
@@ -104,13 +134,11 @@ export declare class MemoryLedgerStore implements LedgerStore {
     loadAll(): LedgerEvent[];
     verifyAll(): {
         ok: boolean;
-        broken: {
-            replicaId: string | null;
-            detail?: string;
-        }[];
+        broken: LedgerBroken[];
     };
     append(body: Omit<ProvenanceEvent, 'prevHash' | 'hash' | 'seq'>): ProvenanceEvent;
     isNonceConsumed(nonce: string): boolean;
+    doubleSpends(): DoubleSpend[];
 }
 /**
  * The cross-replica nonce check, bound to one ledger file, ready to hand to

package/dist/holmes/governance/ledger-store.js

@@ -33,12 +33,53 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryLedgerStore = exports.FileLedgerStore = void 0;
+exports.MemoryLedgerStore = exports.FileLedgerStore = exports.LedgerConflictRefusal = void 0;
+exports.writerChainFile = writerChainFile;
+exports.ledgerConflictReason = ledgerConflictReason;
 exports.nonceConsumedIn = nonceConsumedIn;
-// @implements A-SPEC-150
+// @implements A-SPEC-150, A-SPEC-624
+// @implements A-SPEC-643
+// @implements A-SPEC-642
 const provenance_chain_1 = require("./provenance-chain");
 const provenance_ledger_1 = require("./provenance-ledger");
 const path = __importStar(require("node:path"));
+/**
+ * @implements A-SPEC-643
+ * The chain file THIS process writes: `provenance.<replica>.jsonl`, resolved exactly as every other
+ * writer resolves it (the run's execution replica when registered, else the stored or hostname-derived
+ * id). Measured 2026-09-14: the shell gate, `risk_check` and `review_record` handed
+ * `consumeNonceExclusively` the legacy `provenance.jsonl`, so two clones spending the same approval
+ * offline both appended to one file and the origin's merge died with CONFLICT (add/add) before any
+ * double-spend could be seen. Consumptions belong on the writer's chain like every other event.
+ */
+function writerChainFile(ledgerDir) {
+    return provenance_ledger_1.ProvenanceLedger.at(ledgerDir).currentFile();
+}
+/** A-SPEC-642 — thrown by approval resolution while the merged ledger holds an unreconciled double-spend. */
+class LedgerConflictRefusal extends Error {
+    holmesRefusal = true;
+    code = 'ledger-conflict';
+    constructor(message) { super(message); this.name = 'LedgerConflictRefusal'; }
+}
+exports.LedgerConflictRefusal = LedgerConflictRefusal;
+/**
+ * @implements A-SPEC-642
+ * The one sentence every authority-spending act refuses with while the merged ledger holds an
+ * unreconciled cross-replica double-spend, or null. Names the nonce, the replicas and the act that
+ * clears it, because a refusal that cannot be acted on is an obstacle rather than a gate. An absent
+ * ledger directory is a clean ledger. Not caught: an unreadable chain file throws here exactly as it
+ * throws in `isNonceConsumed`, and the callers' fail-closed handling applies.
+ */
+function ledgerConflictReason(dir) {
+    const pending = new FileLedgerStore(dir).doubleSpends();
+    if (pending.length === 0)
+        return null;
+    const d = pending[0];
+    const replicas = [...new Set(d.events.map((e) => e.replicaId ?? 'legacy'))].join(', ');
+    return `the merged ledger holds an unreconciled cross-replica double-spend: single-use approval ${d.nonce} was consumed on replicas ${replicas}`
+        + ` — approvals, applies and recoveries are refused until an operator reconciles it (ledger_reconcile { nonce: "${d.nonce}" })`
+        + (pending.length > 1 ? `; ${pending.length - 1} more pending` : '');
+}
 /**
  * Local adapter — DELEGATES to `ProvenanceLedger` rather than re-implementing it.
  *
@@ -66,6 +107,9 @@ class FileLedgerStore {
         this.inner = provenance_ledger_1.ProvenanceLedger.at(dir, givenId);
     }
     replicaId() {
+        const execution = this.inner.executionContext();
+        if (execution)
+            return execution.replicaId;
         if (this.cachedId === undefined)
             this.cachedId = this.givenId ?? this.inner.replicaIdOf();
         return this.cachedId;
@@ -77,12 +121,13 @@ class FileLedgerStore {
     loadAll() { return this.inner.loadAll(); }
     verifyAll() {
         const r = this.inner.verifyAll();
-        return { ok: r.ok, broken: r.broken.map((b) => ({ replicaId: b.replicaId, detail: b.detail })) };
+        return { ok: r.ok, broken: r.broken.map((b) => ({ replicaId: b.replicaId, detail: b.detail, ...(b.kind ? { kind: b.kind } : {}), ...(b.nonce ? { nonce: b.nonce } : {}), ...(b.events ? { events: b.events } : {}) })) };
     }
     append(body) {
         return this.inner.append(body);
     }
     isNonceConsumed(nonce) { return this.inner.isNonceConsumed(nonce); }
+    doubleSpends() { return this.inner.doubleSpends(); }
 }
 exports.FileLedgerStore = FileLedgerStore;
 /**
@@ -137,6 +182,7 @@ class MemoryLedgerStore {
         return this.loadAll().some((e) => e.kind === 'nonce-consumed'
             && ((e.inputs ?? []).includes(nonce) || (e.inputs ?? []).includes(fp)));
     }
+    doubleSpends() { return (0, provenance_ledger_1.unreconciledDoubleSpends)(this.loadAll()); }
 }
 exports.MemoryLedgerStore = MemoryLedgerStore;
 // @implements A-SPEC-574.3

package/dist/holmes/governance/ledger-timeline.d.ts

@@ -1,6 +1,8 @@
+import { ExecutionContext } from '../project/execution-context';
 import { ProvenanceEvent } from './provenance-chain';
 /** One governance event, projected to what a timeline shows — chain-integrity fields dropped. */
 export interface TimelineEntry {
+    execution?: ExecutionContext;
     ts: string;
     kind: string;
     actor: string;
@@ -9,7 +11,7 @@ export interface TimelineEntry {
 }
 /** The subset of a ledger event this projection reads (structurally typed so callers can pass
  * FileLedgerStore.loadAll() results directly). */
-type TimelineSource = Pick<ProvenanceEvent, 'ts' | 'kind' | 'actor' | 'summary'> & Partial<Pick<ProvenanceEvent, 'inputs' | 'seq'>>;
+type TimelineSource = Pick<ProvenanceEvent, 'ts' | 'kind' | 'actor' | 'summary'> & Partial<Pick<ProvenanceEvent, 'inputs' | 'seq' | 'execution'>>;
 /**
  * @implements A-SPEC-538.3
  * Pure: order ledger events into a timeline, optionally narrowed to one spec. Ascending by `ts`

package/dist/holmes/governance/ledger-timeline.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.timelineFrom = timelineFrom;
+// @implements A-SPEC-538.3, A-SPEC-624
+// @implements A-SPEC-645
+const execution_context_1 = require("../project/execution-context");
+const display_id_aliases_1 = require("./display-id-aliases");
 /**
  * @implements A-SPEC-538.3
  * Pure: order ledger events into a timeline, optionally narrowed to one spec. Ascending by `ts`
@@ -9,7 +13,12 @@ exports.timelineFrom = timelineFrom;
  * (hash/prevHash/seq/replicaId) are plumbing, not timeline content, and are projected away.
  */
 function timelineFrom(events, id) {
-    const selected = id ? events.filter((e) => (e.inputs ?? []).includes(id)) : events.slice();
+    // @implements A-SPEC-645 — an id selects the events of every display id the entity has carried,
+    // resolved from the same events (renames are ledger records); an id with no history is itself.
+    const ids = id ? new Set((0, display_id_aliases_1.aliasesOf)(events, id)) : undefined;
+    // A rename record names the ids as `old-id:`/`new-id:` inputs; those reference the entity too.
+    const refersTo = (input) => input.startsWith('old-id:') ? input.slice(7) : input.startsWith('new-id:') ? input.slice(7) : input;
+    const selected = ids ? events.filter((e) => (e.inputs ?? []).some((input) => ids.has(refersTo(input)))) : events.slice();
     selected.sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : (a.seq ?? 0) - (b.seq ?? 0)));
     return selected.map((e) => ({
         ts: e.ts,
@@ -17,5 +26,6 @@ function timelineFrom(events, id) {
         actor: e.actor,
         summary: e.summary,
         inputs: e.inputs ?? [],
+        ...('execution' in e ? { execution: (0, execution_context_1.validateExecution)(e.execution) } : {}),
     }));
 }

package/dist/holmes/governance/provenance-chain.d.ts

@@ -1,3 +1,4 @@
+import { ExecutionContext } from '../project/execution-context';
 import { LockOptions } from './ledger-lock';
 /**
  * N3 — Decision PROVENANCE chain (target-architecture §7-N N3): "누가·언제·왜"의 완전 인과 재구성.
@@ -18,6 +19,7 @@ import { LockOptions } from './ledger-lock';
  * returning [] would erase the audit trail this exists to guarantee — same policy as DecisionLedger).
  */
 export interface ProvenanceEvent {
+    execution?: ExecutionContext;
     seq: number;
     ts: string;
     actor: string;

package/dist/holmes/governance/provenance-chain.js

@@ -50,7 +50,8 @@ exports.keyedSelfConsistent = keyedSelfConsistent;
 exports.bodyCanon = bodyCanon;
 exports.parseLedgerLines = parseLedgerLines;
 exports.consumeNonceExclusively = consumeNonceExclusively;
-// @implements A-SPEC-125.2
+// @implements A-SPEC-125.2, A-SPEC-624
+const execution_context_1 = require("../project/execution-context");
 const crypto = __importStar(require("node:crypto"));
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -61,6 +62,7 @@ function canonicalize(b) {
     return JSON.stringify({
         seq: b.seq, ts: b.ts, actor: b.actor, kind: b.kind, summary: b.summary,
         inputs: b.inputs ?? [], rationale: b.rationale ?? '', authorization: b.authorization ?? '',
+        ...('execution' in b ? { execution: (0, execution_context_1.validateExecution)(b.execution) } : {}),
     });
 }
 /**
@@ -83,7 +85,7 @@ function chainNext(chain, body, key) {
     const full = { seq: chain.length, ...body };
     return { ...full, prevHash, hash: computeHash(prevHash, full, key) };
 }
-const KNOWN_FIELDS = new Set(['seq', 'ts', 'actor', 'kind', 'summary', 'inputs', 'rationale', 'authorization', 'prevHash', 'hash']);
+const KNOWN_FIELDS = new Set(['seq', 'ts', 'actor', 'kind', 'summary', 'inputs', 'rationale', 'authorization', 'prevHash', 'hash', 'execution']);
 /**
  * Verify the whole chain: recomputed hashes, prevHash linkage, contiguous seq, AND no unknown fields.
  * The unknown-field check closes the canonicalization-gap attack (adversarial review #2): canonicalize
@@ -102,6 +104,14 @@ function verifyChain(chain, key) {
     let keyedSeen = false;
     for (let i = 0; i < chain.length; i++) {
         const e = chain[i];
+        if ('execution' in e) {
+            try {
+                (0, execution_context_1.validateExecution)(e.execution);
+            }
+            catch {
+                return { ok: false, brokenAt: i, detail: 'invalid execution context' };
+            }
+        }
         const unknown = Object.keys(e).filter((k) => !KNOWN_FIELDS.has(k));
         if (unknown.length > 0)
             return { ok: false, brokenAt: i, detail: `unknown field(s) outside the hashed schema: ${unknown.join(', ')} (smuggled data)` };
@@ -276,6 +286,7 @@ function bodyCanon(b) {
     return JSON.stringify({
         ts: b.ts, actor: b.actor, kind: b.kind, summary: b.summary,
         inputs: b.inputs ?? [], rationale: b.rationale ?? '', authorization: b.authorization ?? '',
+        ...('execution' in b ? { execution: (0, execution_context_1.validateExecution)(b.execution) } : {}),
     });
 }
 /**