@holmes-lab/holmes-kit 0.20.1 → 0.20.2

package/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.20.2] - 2026-09-16
+
+Two findings the Windows cycle recorded and could not close, closed — without giving autonomy or the
+drift check one inch of slack.
+
+### Fixed
+- **A sealed spec can now admit a root-level file** (A-SPEC-654). `Files to Touch` tokens had to contain
+  a slash, so a spec listing `- jest.config.js` produced no token at all and its own anchored write was
+  refused as "outside its Files to Touch scope" — measured 2026-09-15 on Windows, where A-SPEC-652.4 had
+  to be redesigned around it. A list item whose first word is a filename with an extension is now a token;
+  a filename mentioned inside prose, a version-like item (`- 0.20.1`) and a bare word still yield nothing,
+  and the enforcer still admits exactly that one path.
+- **A CRLF checkout is no longer reported as skill drift.** Under `core.autocrlf=true`, git rewrote the
+  skill files the installer writes with LF, so `doctor` reported three untouched skills as `drifted` and
+  advised a refresh that produced LF for the next checkout to convert straight back (measured 2026-09-16,
+  Windows). `init`'s `.gitattributes` block now declares `.claude/skills/**/SKILL.md` and
+  `.agents/skills/**/SKILL.md` as `text eol=lf`, so checkout stops re-creating the difference. One
+  `holmes-kit skills refresh` converges an existing CRLF working tree.
+
+### Unchanged on purpose
+- **Autonomy did not widen with the new tokens.** Measured before the change: 36 A-SPECs in this
+  repository have prose-only Files to Touch and 8 of them would have gained tokens — one mentioning
+  `handlers.ts` in a sentence would have flipped from human approval to self-approval. The grader now
+  requires at least one directory-scoped token, so a spec whose tokens are all root-level files still asks
+  a human: a root-level file is project-wide configuration. A test walks every A-SPEC in the store and
+  asserts each verdict equals the pre-change verdict.
+- **The drift comparison is still byte-exact.** Folding CRLF into it was implemented, measured against
+  A-SPEC-190 §9a — whitespace-touched files are `drifted` *and a refresh reclaims them* — and reverted:
+  it would have made the first of those three mutations invisible rather than recoverable. That refusal
+  is pinned in the new suite.
+
+### Measured
+- macOS: 503 suites / 6,461 passed / 11 skipped; official `test_run` green, last-green recorded.
+- Still open: the Windows residual single-assertion reds. They need the failure text from the Windows box
+  (`npx jest --json`); nothing in this repository names why they fail, and guessing from a macOS run would
+  be inventing evidence.
+
 ## [0.20.1] - 2026-09-16
 
 The Windows release. 0.20.0's external matrix was run natively on Windows 11 (Node 24, npm 12, pytest 9)

package/dist/.build-id

@@ -1 +1 @@
-37e99456-mu2vxydy
+5796f530-mu3b082d

package/dist/holmes/cli/gitignore-merge.js

@@ -61,6 +61,16 @@ exports.ATTRIBUTE_LINES = [
     '# 남는 체인 이음새는 `holmes-kit ledger rechain`의 일이다.',
     '.ax/ledger/*.jsonl merge=union',
     '.ax/approvals/queue.jsonl merge=union',
+    // @implements A-SPEC-654
+    // The installer writes these with LF and doctor compares them byte for byte (A-SPEC-190 §9a: a
+    // whitespace-touched file is `drifted` so a refresh can reclaim it). Under `core.autocrlf=true`
+    // checkout rewrote them to CRLF, so three untouched skills read `drifted` and the advised refresh
+    // produced LF for the next checkout to convert straight back — measured 2026-09-16 on Windows.
+    // Declaring the files settles it where the disagreement is, instead of teaching the drift check to
+    // ignore a difference it exists to catch.
+    '# @implements A-SPEC-654 — 설치기가 LF 로 쓰는 파일은 체크아웃에서 CRLF 로 바뀌지 않는다.',
+    '.claude/skills/**/SKILL.md text eol=lf',
+    '.agents/skills/**/SKILL.md text eol=lf',
 ];
 /** As `mergeGitignore`, over `.gitattributes` — the same marker block machinery, so idempotence
  *  and user-content preservation are inherited rather than re-implemented. */

package/dist/holmes/governance/autonomy.js

@@ -178,6 +178,12 @@ function specApprovalAutonomy(spec, resolveParent, descendants) {
                 return 'hitl';
             if (paths.some(isHighRiskPath))
                 return 'hitl'; // gate/governance/taint file
+            // @implements A-SPEC-654 — a ROOT-level file is project-wide configuration (the test runner, the
+            // manifest, the ignore policy): admitting it at the gate was the point of that slice, but grading
+            // it auto would be a widening nobody asked for. A spec earns self-approval only when it also names
+            // a directory-scoped surface — the same doubt `paths.length === 0` already encodes.
+            if (!paths.some((p) => p.includes('/')))
+                return 'hitl';
             return 'auto';
         }
         default:

package/dist/holmes/guardrail/scope-judgment.d.ts

@@ -29,7 +29,18 @@ export declare function isTestPath(relPath: string): boolean;
  * one bounded fragment, so no ReDoS surface.
  */
 export declare function matchesFtt(token: string, relPath: string): boolean;
-/** Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none. */
+export declare function isRootFileToken(token: string): boolean;
+/**
+ * Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none.
+ *
+ * @implements A-SPEC-654
+ * The slashed match alone could not see a ROOT-level file, so a sealed spec listing `- jest.config.js`
+ * admitted nothing at all and its own anchored write was refused as out of scope (measured 2026-09-15 on
+ * Windows; A-SPEC-652.4 was redesigned around it). A bare filename counts only as a LIST ITEM's first
+ * word: `- \`tsconfig.test.json\` (신규)` is a token, while `\`cfg.ts\`, \`ddg.ts\` 를 고친다` — prose, and a
+ * word carrying a comma — stays what it always was, nothing. The enforcer is unchanged: a root token
+ * admits that exact path (`matchesFtt`), and the grader requires a directory-scoped token of its own.
+ */
 export declare function fttPathTokens(fttText: string): string[];
 export interface ScopeInput {
     relPath: string;

package/dist/holmes/guardrail/scope-judgment.js

@@ -25,6 +25,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isTestPath = isTestPath;
 exports.matchesFtt = matchesFtt;
+exports.isRootFileToken = isRootFileToken;
 exports.fttPathTokens = fttPathTokens;
 exports.judgeScope = judgeScope;
 /** Repo test conventions — the single census every dispensation consumer shares. */
@@ -63,9 +64,37 @@ function matchesFtt(token, relPath) {
         return relPath === tok; // file literal: that file only
     return relPath === tok || relPath.startsWith(tok + '/'); // dir literal: its subtree
 }
-/** Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none. */
+/**
+ * @implements A-SPEC-654
+ * A repository-ROOT file named as a Files-to-Touch item: a bare filename with an extension that starts
+ * with a letter, so a version (`0.20.1`) is not a file and a bare word (`README`) is not either.
+ */
+const ROOT_FILE = /^[\w@.-]+\.[A-Za-z][A-Za-z0-9]*$/;
+function isRootFileToken(token) {
+    return !token.includes('/') && ROOT_FILE.test(token);
+}
+/**
+ * Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none.
+ *
+ * @implements A-SPEC-654
+ * The slashed match alone could not see a ROOT-level file, so a sealed spec listing `- jest.config.js`
+ * admitted nothing at all and its own anchored write was refused as out of scope (measured 2026-09-15 on
+ * Windows; A-SPEC-652.4 was redesigned around it). A bare filename counts only as a LIST ITEM's first
+ * word: `- \`tsconfig.test.json\` (신규)` is a token, while `\`cfg.ts\`, \`ddg.ts\` 를 고친다` — prose, and a
+ * word carrying a comma — stays what it always was, nothing. The enforcer is unchanged: a root token
+ * admits that exact path (`matchesFtt`), and the grader requires a directory-scoped token of its own.
+ */
 function fttPathTokens(fttText) {
-    return fttText.match(/[\w@.*-]+(?:\/[\w@.*-]+)+/g) ?? [];
+    const tokens = [...(fttText.match(/[\w@.*-]+(?:\/[\w@.*-]+)+/g) ?? [])];
+    for (const line of fttText.split('\n')) {
+        const item = /^\s*[-*]\s+(.*)$/.exec(line);
+        if (!item)
+            continue;
+        const word = (item[1].trim().split(/\s+/)[0] ?? '').replace(/^[`'"]+|[`'"]+$/g, '');
+        if (isRootFileToken(word) && !tokens.includes(word))
+            tokens.push(word);
+    }
+    return tokens;
 }
 // @implements A-SPEC-508.1
 function judgeScope(input) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",