@holmes-lab/holmes-kit 0.2.0 → 0.3.0

package/dist/holmes/guardrail/impact-gate.js

@@ -0,0 +1,263 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLowRiskTarget = isLowRiskTarget;
+exports.evaluateEditEvidence = evaluateEditEvidence;
+exports.preEditEvidenceDecision = preEditEvidenceDecision;
+exports.loadEditEvidence = loadEditEvidence;
+// @implements A-SPEC-279
+// @implements A-SPEC-278
+// @implements A-SPEC-277
+// @implements A-SPEC-276
+const fs = __importStar(require("node:fs"));
+const crypto = __importStar(require("node:crypto"));
+const path = __importStar(require("node:path"));
+const spec_types_1 = require("../spec/spec-types");
+const CODE_EXTENSIONS = new Set([
+    '.ts', '.mts', '.cts', '.tsx', '.jsx', '.js', '.mjs', '.cjs', '.py', '.cs', '.java', '.go',
+    '.rs', '.cpp', '.cc', '.cxx', '.hpp', '.hh', '.h', '.rb', '.php', '.kt', '.kts', '.swift',
+    '.scala', '.sh', '.ex', '.exs', '.lua', '.r',
+]);
+/**
+ * Documents are edited constantly and almost never break anything, so demanding a graph analysis for
+ * every prose change would train people to route around the gate — the proportional path exists to
+ * keep the gate credible where it matters. The exception is documents that GOVERN: an ADR or a
+ * C-SPEC is prose that decides architecture, and A-SPEC-233 already treats those as full-regression
+ * material. Same locations, read from the type table rather than spelled twice.
+ */
+function isLowRiskTarget(target) {
+    const normalized = target.replace(/\\/g, '/');
+    const ext = path.extname(normalized).toLowerCase();
+    if (CODE_EXTENSIONS.has(ext))
+        return false;
+    const cspecDir = `.ax/specs/${spec_types_1.SPEC_TYPES['C-SPEC'].folder}/`;
+    if (normalized.startsWith('.ax/decisions/') || normalized.startsWith(cspecDir))
+        return false;
+    return true;
+}
+const REMEDIATION = {
+    'no-analysis': 'Run maintenance_analyze({ root, request, persist: true }) for this change and retry with the digest it returns.',
+    'basis-drift': 'HEAD moved after the analysis was taken — re-run maintenance_analyze so the evidence is computed on the current commit.',
+    // A separate code because it needs a separate sentence: dogfooding 2026-08-28 showed a file-drift
+    // refusal explaining itself as "HEAD moved", which was simply false. Same lesson as A-SPEC-269.
+    'target-drift': 'The file changed in the working tree after the analysis was taken — re-run maintenance_analyze so the evidence describes the content you are about to edit.',
+    'target-out-of-scope': 'The analysis never named this file. Re-run maintenance_analyze with a request that covers it, or widen the analysis, rather than editing outside the evidence.',
+    'contract-untested': 'Add or approve the T-SPEC for the impacted A-SPEC, then re-run the analysis so the contract is covered.',
+    'unproven-absence': 'The graph did not cover everything it would need to in order to claim no impact. Widen the analysis (supply changedFiles, add language coverage, or raise the walk bounds) before editing.',
+    'architecture-unchecked': 'Pass changedFiles (e.g. a base..head diff) to maintenance_analyze so the .ax/decisions and C-SPEC axis is actually assessed.',
+    'security-unchecked': 'The security axis was never examined — re-run maintenance_analyze against a tree it can actually scan so data-flow reachability is walked.',
+    'compatibility-unchecked': 'The compatibility axis was never examined — re-run maintenance_analyze where the spec store is readable so breaking-change declarations can be read.',
+    'basis-unverifiable': 'The analysis recorded no digest for this file, or the file cannot be read now, so drift cannot be ruled out — re-run maintenance_analyze with persist: true to take a verifiable basis.',
+};
+const RANK = { allow: 0, widen: 1, refuse: 2 };
+function evaluateEditEvidence(inputArgs) {
+    const target = inputArgs.target.replace(/\\/g, '/');
+    const lowRisk = isLowRiskTarget(target);
+    const reasons = [];
+    let decision = 'allow';
+    const escalate = (next) => { if (RANK[next] > RANK[decision])
+        decision = next; };
+    const artifact = inputArgs.artifact;
+    if (!artifact) {
+        // The proportional path: ordinary prose needs no graph evidence. A governing document does, and
+        // `isLowRiskTarget` has already excluded those.
+        if (lowRisk)
+            return { decision: 'allow', reasons: [], remediation: '', lowRisk: true };
+        reasons.push({ code: 'no-analysis', detail: `No impact analysis backs an edit to ${target}.` });
+        return { decision: 'refuse', reasons, remediation: REMEDIATION['no-analysis'], lowRisk };
+    }
+    // (2) An analysis describes one commit. Once HEAD moves, its claims are about a tree that no
+    // longer exists — the one condition that makes every other check meaningless.
+    if (artifact.graphBasis.head !== inputArgs.currentHead) {
+        reasons.push({
+            code: 'basis-drift',
+            detail: `The analysis was taken on ${artifact.graphBasis.head} but HEAD is now ${inputArgs.currentHead}.`,
+        });
+        escalate('refuse');
+    }
+    // (2b) HEAD standing still is not enough: the working tree can move under an analysis. Checked
+    // only for a file the analysis actually predicted — for anything else `target-out-of-scope` is
+    // the honest finding and a digest comparison would be noise.
+    if (artifact.predicted.files.includes(target)) {
+        const recorded = artifact.predicted.fileDigests[target];
+        if (!recorded || inputArgs.currentTargetDigest === null || inputArgs.currentTargetDigest === undefined) {
+            reasons.push({
+                code: 'basis-unverifiable',
+                detail: !recorded
+                    ? `The analysis recorded no digest for ${target}, so drift cannot be ruled out.`
+                    : `${target} could not be read now, so it cannot be compared against the analysed content.`,
+            });
+            escalate('widen');
+        }
+        else if (recorded !== inputArgs.currentTargetDigest) {
+            reasons.push({
+                code: 'target-drift',
+                detail: `${target} changed since the analysis: recorded ${recorded}, now ${inputArgs.currentTargetDigest}.`,
+            });
+            escalate('refuse');
+        }
+    }
+    // (3) Being AFFECTED is not being analysed. `impactedFiles` is reachable-by-call-edge, a tier
+    // A-SPEC-274 measured at zero true positives as an edit prediction, so it grants no permission.
+    if (!artifact.predicted.files.includes(target)) {
+        const affectedOnly = artifact.uncertainty.impactedFiles.includes(target);
+        reasons.push({
+            code: 'target-out-of-scope',
+            detail: affectedOnly
+                ? `${target} appears only as an impacted file, which is not the same as having been analysed as an edit candidate.`
+                : `${target} is not among the files this analysis predicted.`,
+        });
+        escalate('widen');
+    }
+    // (4) The analysis already writes this down when an impacted A-SPEC has no answering T-SPEC.
+    if (artifact.uncertainty.unknowns.some((line) => /No T-SPEC was found/i.test(line))) {
+        reasons.push({ code: 'contract-untested', detail: 'An impacted contract has no T-SPEC covering it.' });
+        escalate('widen');
+    }
+    // (6) Likewise for the architecture axis, which cannot be assessed without a changed-file basis.
+    if (artifact.uncertainty.unknowns.some((line) => /Architecture-governing documents were not assessed/i.test(line))) {
+        reasons.push({
+            code: 'architecture-unchecked',
+            detail: 'The architecture axis was never assessed, so no architecture constraint has been checked.',
+        });
+        escalate('widen');
+    }
+    // (6b) @implements A-SPEC-279 — the remaining two constraint axes. The condition is "was it
+    // EXAMINED", not "does a constraint exist": 61 of this repository's 192 A-SPECs declare a non-none
+    // breaking change, so widening on mere presence would fire on about a third of all edits and teach
+    // people to click past the gate. What the axes FOUND is reported by the analysis; what the gate
+    // acts on is an axis that was never looked at.
+    if (!artifact.uncertainty.securityAssessed) {
+        reasons.push({ code: 'security-unchecked', detail: 'No data-flow reachability was walked for this change.' });
+        escalate('widen');
+    }
+    if (!artifact.uncertainty.compatibilityAssessed) {
+        reasons.push({ code: 'compatibility-unchecked', detail: 'No breaking-change declaration was read for this change.' });
+        escalate('widen');
+    }
+    // (5) The asymmetric one. An EMPTY impact set is only trustworthy when the analysis could actually
+    // see everything; with a coverage hole or a truncated walk, emptiness is ignorance wearing the
+    // costume of a result.
+    const claimsNoImpact = artifact.predicted.symbols.length === 0 && artifact.predicted.tests.length === 0;
+    const { coverage } = artifact.uncertainty;
+    const incomplete = artifact.uncertainty.impactTruncated
+        || coverage.skippedFiles.length > 0
+        || coverage.unsupportedLanguages.length > 0
+        || coverage.scannedFiles === 0;
+    if (claimsNoImpact && incomplete) {
+        reasons.push({
+            code: 'unproven-absence',
+            detail: 'The analysis reports no impact, but its coverage was incomplete — absence was not established.',
+        });
+        escalate('widen');
+    }
+    // Lead with whichever refusal the caller must fix FIRST; a widen reason never speaks for a refusal.
+    const primary = reasons.find((r) => r.code === 'basis-drift')
+        ?? reasons.find((r) => r.code === 'target-drift')
+        ?? reasons[0];
+    return {
+        decision,
+        reasons,
+        remediation: primary ? REMEDIATION[primary.code] : '',
+        lowRisk,
+    };
+}
+/**
+ * @implements A-SPEC-278
+ * Turn a verdict into a hook decision, or into silence.
+ *
+ * Silence — `null` — is deliberate for both `off` and a clean `allow`. Returning `allow` would still
+ * be an opinion: if this gate were ever consulted ahead of another, its `allow` could mask that
+ * gate's denial. A gate that has nothing to say should say nothing.
+ */
+function preEditEvidenceDecision(verdict, mode) {
+    if (mode === 'off')
+        return null;
+    if (verdict.decision === 'allow')
+        return null;
+    const codes = verdict.reasons.map((r) => r.code).join(', ');
+    const detail = verdict.reasons.map((r) => r.detail).join(' ');
+    // @implements A-SPEC-333
+    // OUTCOME first, verdict second. Dogfooding the raised default (A-SPEC-332) showed this message
+    // saying `(refuse)` while the hook returned `allow` — the first words contradicted what happened,
+    // so a reader either believes the edit was blocked or stops reading the message, and an ignored
+    // warning is worse than none because it looks like coverage.
+    //
+    // The verdict word is KEPT, as the note below argues it should be: `refuse` and `widen` are
+    // different kinds of insufficiency. It moves into a parenthesis rather than leading the sentence.
+    const outcome = mode === 'block' ? 'edit denied' : 'warning only';
+    const reason = `[Holmes-Kit] pre-edit impact evidence — ${outcome} (verdict: ${verdict.decision}): ${codes}. ${detail} ${verdict.remediation}`.trim();
+    // `widen` denies under `block` too: "the evidence is not sufficient yet" is not permission. The
+    // separate verdict word survives in the message so the reader knows which kind of insufficiency.
+    return mode === 'block'
+        ? { permissionDecision: 'deny', permissionDecisionReason: reason }
+        : { permissionDecision: 'allow', permissionDecisionReason: reason };
+}
+/**
+ * @implements A-SPEC-278
+ * The I/O adapter, kept apart from the pure core on purpose: everything above this line is decided
+ * by fixtures, and only this function touches a disk. It reads the artifact the session declared
+ * and measures the target's current content so the core can compare them.
+ *
+ * A digest that names no stored artifact yields `artifact: null` — the same shape as "no analysis",
+ * because from the gate's side an unfindable analysis and an absent one justify equally little.
+ */
+function loadEditEvidence(projectRoot, target, digest, currentHead) {
+    const rel = target.replace(/\\/g, '/');
+    let artifact = null;
+    if (digest) {
+        const bare = digest.startsWith('sha256:') ? digest.slice(7) : digest;
+        if (/^[a-f0-9]{64}$/.test(bare)) {
+            const file = path.join(projectRoot, '.ax', 'evidence', 'maintenance', `${bare}.json`);
+            try {
+                artifact = JSON.parse(fs.readFileSync(file, 'utf8'));
+            }
+            catch {
+                artifact = null;
+            }
+        }
+    }
+    let currentTargetDigest = null;
+    try {
+        const resolved = path.resolve(projectRoot, rel);
+        if (resolved === projectRoot || resolved.startsWith(projectRoot + path.sep)) {
+            currentTargetDigest = `sha256:${crypto.createHash('sha256').update(fs.readFileSync(resolved)).digest('hex')}`;
+        }
+    }
+    catch {
+        currentTargetDigest = null;
+    }
+    return { target: rel, artifact, currentHead, currentTargetDigest };
+}

package/dist/holmes/guardrail/write-target.d.ts

@@ -71,7 +71,22 @@ export declare function writesFiles(toolName: string | undefined, input: unknown
  * A relative `raw` carries no grammar of its own, so the root decides.
  */
 export declare function pathFlavorFor(root: string, raw: string): path.PlatformPath;
-export declare function resolveTarget(root: string, raw: string, depth?: number): string;
+/**
+ * The filesystem operations `resolveTarget` consults, injectable so the CROSS-flavor scenario is
+ * testable from either host (A-SPEC-465): production always passes the real `fs`.
+ */
+export interface ResolveFs {
+    lstatSync(p: string): {
+        isSymbolicLink(): boolean;
+    };
+    readlinkSync(p: string): string;
+    realpathSync(p: string): string;
+}
+export interface ResolveOpts {
+    host?: path.PlatformPath;
+    fs?: ResolveFs;
+}
+export declare function resolveTarget(root: string, raw: string, depth?: number, opts?: ResolveOpts): string;
 /**
  * Whether a write lands inside a governance directory.
  *
@@ -117,3 +132,25 @@ export declare function specTargetOf(root: string, specsDir: string, raw: string
  */
 export declare function protectedFileKindOf(root: string, raw: string): string | null;
 export declare function protectedKindOf(root: string, raw: string): string | null;
+/**
+ * @implements A-SPEC-447
+ * Does `raw` land inside one of `roots`?
+ *
+ * The one containment question two gate rules ask — A-SPEC-445 for project code files, A-SPEC-446
+ * for the config files that can change this session. It lived inline in both, which is how one of
+ * two copies gets fixed.
+ *
+ * `impl` is the `path` implementation, injected rather than detected. Reading `process.platform`
+ * here would make the Windows verdicts checkable only on Windows, and this repository has already
+ * paid for that once: A-SPEC-220.1 records a gate asking `startsWith('/')` for "is absolute",
+ * which is false for `C:/proj/src/app.ts` and skipped the whole identity block on native Windows
+ * paths. Keeping the question about the STRING is what lets a POSIX run assert the win32 answers.
+ *
+ * No filesystem access: the file being written usually does not exist yet, and asking whether it
+ * is there would miss exactly the case these rules are for.
+ */
+export interface PathImpl {
+    resolve: (...parts: string[]) => string;
+    sep: string;
+}
+export declare function resolvesInside(raw: string, roots: readonly string[], impl?: PathImpl): boolean;

package/dist/holmes/guardrail/write-target.js

@@ -43,9 +43,11 @@ exports.isProtectedTarget = isProtectedTarget;
 exports.specTargetOf = specTargetOf;
 exports.protectedFileKindOf = protectedFileKindOf;
 exports.protectedKindOf = protectedKindOf;
+exports.resolvesInside = resolvesInside;
 // @implements A-SPEC-163
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
 /**
  * Tools known to only READ. Everything else that carries a path is treated as a write.
  *
@@ -136,17 +138,33 @@ function pathFlavorFor(root, raw) {
 }
 /** Compare paths in one spelling — win32 hands back backslashes that must not defeat a prefix test. */
 const foldSep = (p) => p.replace(/\\/g, '/');
-function resolveTarget(root, raw, depth = 0) {
+function resolveTarget(root, raw, depth = 0, opts = {}) {
     const pp = pathFlavorFor(root, raw);
     const abs = pp.resolve(root, raw);
+    // @implements A-SPEC-465 — W-7. The filesystem is consulted only in ITS OWN grammar. Asking a
+    // host about a foreign-flavor path leaks the host's spelling into the answer: on Windows,
+    // realpathSync('/') returns 'C:\', and the ancestor walk below joined it into the hybrid
+    // 'C:\/proj' — so protectedKindOf('/proj', …) answered null on a Windows host and '.ax/roles' on
+    // a POSIX host. Same string, different answer per host, which is the invariant A-SPEC-220.2
+    // exists to keep. When the chosen flavor is not the host's native one, resolve by string alone —
+    // fully platform-independent, and exactly what this function already returned whenever no
+    // ancestor existed on disk. The host's flavor is read off the `path` module's own separator (not
+    // process.platform; NOT module identity — `import * as path` yields a namespace object that is
+    // never `===` path.posix, which silently turned every posix resolution string-only and broke the
+    // symlink rule, caught by the A-SPEC-163 corner test). Injectable so the cross-flavor case is
+    // testable from either host.
+    const host = opts.host ?? (path.sep === '\\' ? path.win32 : path.posix);
+    if (pp !== host)
+        return abs;
+    const fsi = opts.fs ?? fs;
     // A DANGLING symlink still names where a write would land, and `realpath` fails on it — so the
     // link is followed explicitly. Without this, `ln -s .ax/ledger/not-yet-there innocent` then
     // writing `innocent` creates a file inside the protected directory while the gate sees a name
     // outside it. The depth cap stops a symlink cycle from spinning.
     if (depth < 8) {
         try {
-            if (fs.lstatSync(abs).isSymbolicLink()) {
-                return resolveTarget(pp.dirname(abs), fs.readlinkSync(abs), depth + 1);
+            if (fsi.lstatSync(abs).isSymbolicLink()) {
+                return resolveTarget(pp.dirname(abs), fsi.readlinkSync(abs), depth + 1, opts);
             }
         }
         catch { /* not a symlink, or unreadable — fall through to ancestor resolution */ }
@@ -155,7 +173,7 @@ function resolveTarget(root, raw, depth = 0) {
     let cur = abs;
     for (;;) {
         try {
-            return pp.join(fs.realpathSync(cur), ...parts.reverse());
+            return pp.join(fsi.realpathSync(cur), ...parts.reverse());
         }
         catch {
             const parent = pp.dirname(cur);
@@ -256,6 +274,13 @@ function protectedFileKindOf(root, raw) {
     const parent = pp.basename(pp.dirname(resolved)).toLowerCase();
     if (parent === '.agents' && (name === 'hooks.json' || name === 'mcp_config.json'))
         return `.agents/${name}`;
+    // @implements A-SPEC-266 — codex 는 훅 게이트가 없어(HARNESS_ENFORCES.codex=false) `.codex/config.toml`
+    // 의 [mcp_servers.holmes-kit] 가 codex 지배의 **유일한** 경로다. 이 슬라이스가 그 배선을 죽은 JSON 에서
+    // 실제 거버넌스로 바꿨으므로, `.agents/*`·`.mcp.json` 과 정확히 같은 성질이 된다 — 세션이 고칠 수 있으면
+    // 세션이 codex 게이트를 끈다. A-SPEC-193 §8 의 원칙을 새로 자격을 갖춘 파일에 적용해 같은 self-disarm
+    // 보호를 준다. 구식 `.codex/mcp_config.json` 도 잠근다 — 그 파일을 되살려 배선을 흐릴 수 없게.
+    if (parent === '.codex' && (name === 'config.toml' || name === 'mcp_config.json'))
+        return `.codex/${name}`;
     // Example/sample/template/dist copies carry no secret — the same exclusion the hook's regex had.
     if (/^\.env(\.[\w-]+)?$/.test(name) && !/\.(example|sample|template|dist)$/.test(name))
         return '.env';
@@ -275,3 +300,22 @@ function protectedKindOf(root, raw) {
     }
     return null;
 }
+function resolvesInside(raw, roots, impl = path) {
+    if (typeof raw !== 'string' || raw.length === 0 || roots.length === 0)
+        return false;
+    const expanded = raw === '~' || raw.startsWith('~/') ? impl.resolve(os.homedir(), raw.slice(1) || '.') : raw;
+    for (const root of roots) {
+        const base = impl.resolve(root);
+        const abs = impl.resolve(base, expanded);
+        // @implements A-SPEC-462 (Windows W-1) — drive/unc filesystems fold case, so a lowercased drive
+        // (`c:\proj`, which cmd.exe commonly emits) or an all-caps path must still be judged inside.
+        // Fold ONLY when the base's syntax says so (foldsCaseBySyntax) — POSIX stays case-sensitive, so
+        // `/Proj` ≠ `/proj` is preserved. The separator comparison is kept, so `C:\proj-old` ∉ `C:\proj`.
+        const fold = foldsCaseBySyntax(absoluteKindOf(base));
+        const b = fold ? base.toLowerCase() : base;
+        const a = fold ? abs.toLowerCase() : abs;
+        if (a === b || a.startsWith(b + impl.sep))
+            return true;
+    }
+    return false;
+}

package/dist/holmes/hooks/adapters/antigravity.js

@@ -169,7 +169,18 @@ function adaptPreToolUse(stdin, cwd = process.cwd(), run = runShippedHook) {
     if (out.decision === undefined) {
         return { decision: 'deny', reason: '[Holmes-Kit] 게이트가 답하지 않았습니다 — 판정 없이 진행하지 않습니다.' };
     }
-    return out.decision === 'deny' ? { decision: 'deny', reason: out.reason } : { decision: 'allow' };
+    // @implements A-SPEC-336
+    // The reason travels on an ALLOW too. It used to be dropped, which was harmless while the evidence
+    // gate was `off`: a clean allow carries no reason by rule (A-SPEC-278), so an allow-with-reason did
+    // not exist. Raising the default to `warn` (A-SPEC-332) created exactly that case, and this branch
+    // silently swallowed the warning — the gate was turned on to be seen, and one harness could not
+    // see it. Wiring parity cannot catch that; the behavioural parity test (A-SPEC-335) caught it on
+    // its first run.
+    //
+    // Still nothing when there is nothing to say: a silent gate must stay silent, or it masks another
+    // gate's verdict.
+    const decision = out.decision === 'deny' ? 'deny' : 'allow';
+    return out.reason ? { decision, reason: out.reason } : { decision };
 }
 /**
  * Stop: 게이트가 "막아라"라고 하면, 이 하네스에서 막는 말은 `continue` 다.

package/dist/holmes/hooks/corrupt-state-run.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Classify a spawnSync result into a gate VERDICT or an INFRASTRUCTURE failure.
+ *
+ * Split out of the test's runner so the killed-child case can be checked without racing an OOM.
+ * S-444's intermittent was a hook the parallel suite SIGKILLed: spawnSync then reports
+ * error===undefined (the spawn succeeded), signal set, and empty stdout, which the old runner
+ * returned as an empty verdict and the test read as "the gate did not block". A killed child and a
+ * gate that let something through are opposite conclusions and must not share an outcome.
+ *
+ * `status` alone is NOT a throw condition: the Stop hook exits 0 by design and carries its block
+ * decision in stdout JSON, so a zero exit with empty stdout is a legitimate (allow) verdict, not a
+ * failure. `error` (spawn failed) and `signal` (child killed) mean "no verdict was produced".
+ *
+ * @implements A-SPEC-464 — W-6. The signal branch closes the killed-child hole only on POSIX.
+ * Windows has no POSIX signals, so an external kill (taskkill / worker teardown / OOM) leaves
+ * signal=null and a NONZERO exit status with empty output, which fell through to a {'',''} verdict
+ * the suite reads as "the gate allowed". A FULLY SILENT unclean exit — empty stdout AND empty
+ * stderr AND a non-zero status (a nonzero number, or null when the platform reported no code) —
+ * produced no verdict and is infrastructure failure, same as the signal case. status===0 with empty
+ * output stays a legitimate allow (it fails this test), and any output at all is a verdict (a
+ * blocking hook exits non-zero WITH a reason, so it is never silent).
+ */
+export interface SpawnLike {
+    error?: Error;
+    signal?: NodeJS.Signals | null;
+    status?: number | null;
+    stdout?: string | Buffer | null;
+    stderr?: string | Buffer | null;
+}
+export declare function classifyRun(r: SpawnLike): {
+    stdout: string;
+    stderr: string;
+};

package/dist/holmes/hooks/corrupt-state-run.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRun = classifyRun;
+function classifyRun(r) {
+    if (r.error !== undefined)
+        throw r.error;
+    if (r.signal) {
+        throw new Error(`hook killed by ${r.signal} — infrastructure failure (OOM/kill under load), not a gate verdict`);
+    }
+    const stdout = String(r.stdout ?? '');
+    const stderr = String(r.stderr ?? '');
+    if (stdout === '' && stderr === '' && r.status !== 0) {
+        throw new Error(`hook exited ${r.status} with no output — no verdict produced (signalless external kill under load, e.g. Windows taskkill), not a gate verdict`);
+    }
+    return { stdout, stderr };
+}

package/dist/holmes/hooks/pre-tool-use.d.ts

@@ -1,6 +1,7 @@
 import { Spec } from '../spec/spec-parser';
 import { Approval } from '../guardrail/risk-gate';
 import { RiskAction, RiskAssessment, RmSignal } from '../guardrail/risk-types';
+import { type PreEditEvidenceMode } from '../guardrail/impact-gate';
 export declare function resolveRmSignals(command: string, cwd: string): Record<string, RmSignal> | undefined;
 /**
  * @implements A-SPEC-149
@@ -67,6 +68,31 @@ export declare function normalizeHookInput(raw: unknown): HookInput;
  * and inventing a denial there is its own failure mode. And an operator — never the session — can
  * escape via `HOLMES_GATE_BYPASS`.
  */
+/**
+ * @implements A-SPEC-278
+ * Pre-edit impact evidence, wired but OFF by default.
+ *
+ * `mode: 'off'` returns null before touching anything — a repository that never opted in must behave
+ * exactly as it did before this gate existed, and that includes not paying for a disk read. A
+ * covering `code-write` approval overrides it exactly as it overrides every other gate here, and
+ * actions that are not code or test writes are simply not this gate's business.
+ *
+ * The evidence digest comes from the ENVIRONMENT (`HOLMES_EVIDENCE`), never from the tool payload —
+ * the same rule the approval channel follows, because a session naming its own justification inside
+ * the request it is making is the session asserting its own authority.
+ */
+export declare function preEditEvidenceGate(o: {
+    action: string;
+    projectRoot: string;
+    relPath: string;
+    covered: boolean;
+    mode: PreEditEvidenceMode;
+    declaredDigest: string | null;
+    currentHead: string;
+}): {
+    permissionDecision: 'allow' | 'deny';
+    permissionDecisionReason?: string;
+} | null;
 export declare function decideOnGateError(opts: {
     governed: boolean;
     bypass: boolean;