@holmes-lab/holmes-kit 0.3.8 → 0.3.9

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.3.9] - 2026-09-01
+
+Scope de-amplification and the push gate — the governance model stops taxing legitimate work
+(one test-class addition used to cost >=3 human interventions) and starts guarding the one
+moment nothing guarded: the push.
+
+### Added
+
+- **Tenure/admission scope model** (A-SPEC-508.1): a file already anchored on disk is IN its
+  specs' scope — editing it is free and silent (the double registration with `Files to Touch`
+  is gone). Only NEW claims (a new file's anchors, a re-anchor) pass admission: an FtT **glob**
+  (`src/core/**`, `test_*.py`), the **test-file dispensation** (a new test joining an approved
+  spec is coverage growth, which ART-4 asks for), or an out-of-band approval. All disk anchors
+  participate (first-match-only is dead), deleting an anchor line warns (RTM loss made audible)
+  but never blocks, and a re-anchor refusal names the transfer. Dogfooded: 96+ anchored files
+  in this repo, zero tenure regressions (pinned as a permanent sweep test).
+- **pre-push evidence gate** (A-SPEC-509.1): `npx holmes-kit install-push-gate` installs a
+  git pre-push hook (honoring `core.hooksPath`; a foreign hook is never overwritten) that
+  refuses a push unless the test-evidence ledger vouches for EXACTLY the pushed HEAD — green,
+  with real executions. Commit-message success claims never move the verdict; an unbacked claim
+  is surfaced as a warning. Collection failures allow (this safens the default; security stays
+  with the tool gates), `--no-verify` is respected, and doctor diagnoses a missing hook. Live
+  probe on this repo: a stale-ledger push was refused with both heads and the recovery command.
+
+### Fixed
+
+- **FtT parent-directory amplification**: a FILE token in Files-to-Touch silently covered its
+  whole sibling directory (`src/a/x.ts` admitted all of `src/a/`); a file token now names that
+  file only, and directory intent is written as a glob.
+
 <!-- @implements A-SPEC-209 -->
 ## [0.3.8] - 2026-09-01
 

package/bin/holmes-pre-push.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// @implements A-SPEC-509.1
+// HOLMES-KIT PUSH GATE v1 — thin stdin adapter over dist/holmes/governance/push-gate-runner.js.
+// Fail-open by contract (H-SPEC-509): this gate safens the default, it is not a security
+// boundary, so any load or collection failure lets the push proceed.
+try {
+  const { runPrePush } = require('../dist/holmes/governance/push-gate-runner.js');
+  let text = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (c) => { text += c; });
+  process.stdin.on('end', () => {
+    let code = 0;
+    try {
+      code = runPrePush({ cwd: process.cwd(), stdinText: text, write: (s) => process.stderr.write(s) });
+    } catch { code = 0; }
+    process.exit(code);
+  });
+} catch {
+  process.exit(0);
+}

package/dist/.build-id

@@ -1 +1 @@
-809f8c3-mthx43ms
+ab67afc-mti0dz4k

package/dist/holmes/cli/doctor.d.ts

@@ -102,6 +102,12 @@ export declare function runDoctor(packageRoot: string, target?: string, opts?: D
  * very first run against a healthy server).
  */
 export declare function wiringSpawnCheck(command: string, args: string[], timeoutMs?: number, platform?: NodeJS.Platform): Promise<Check>;
+/**
+ * Push-gate presence, diagnosed only where it applies: a repo that opted into governance (.ax)
+ * AND has git. Absence or a hook without our signature is a WARN carrying the install command —
+ * the same honest-diagnosis lineage as the codex-wiring WARN (never a gate).
+ */
+export declare function pushGateCheck(target: string): Check | null;
 export declare function formatChecks(checks: Check[]): string;
 /**
  * Prove that EVERY wired harness can actually start a server, not merely that its file parses.

package/dist/holmes/cli/doctor.js

@@ -40,6 +40,7 @@ exports.prefixVerdict = prefixVerdict;
 exports.probeEnv = probeEnv;
 exports.runDoctor = runDoctor;
 exports.wiringSpawnCheck = wiringSpawnCheck;
+exports.pushGateCheck = pushGateCheck;
 exports.formatChecks = formatChecks;
 exports.wiringHandshakeChecks = wiringHandshakeChecks;
 exports.semanticTierVerdict = semanticTierVerdict;
@@ -972,6 +973,13 @@ async function runDoctor(packageRoot, target, opts, extraChecks) {
         }
     }
     add('environment', 'PASS', present);
+    // @implements A-SPEC-509.1 — honest diagnosis, not a gate: a governed git repo without our
+    // pre-push evidence gate is told so once, with the one command that installs it.
+    {
+        const pg = pushGateCheck(target ?? process.cwd());
+        if (pg)
+            checks.push(pg);
+    }
     if (extraChecks) {
         checks.push(...extraChecks);
     }
@@ -1227,6 +1235,35 @@ function mcpHandshakeCheck(packageRoot, timeoutMs = 15000) {
         send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'holmes-doctor', version: '1' } } });
     });
 }
+// @implements A-SPEC-509.1
+/**
+ * Push-gate presence, diagnosed only where it applies: a repo that opted into governance (.ax)
+ * AND has git. Absence or a hook without our signature is a WARN carrying the install command —
+ * the same honest-diagnosis lineage as the codex-wiring WARN (never a gate).
+ */
+function pushGateCheck(target) {
+    try {
+        if (!fs.existsSync(path.join(target, '.ax')))
+            return null;
+        if (!fs.existsSync(path.join(target, '.git')))
+            return null;
+        const { PUSH_HOOK_SIGNATURE } = require('../governance/push-gate');
+        const { effectiveHooksDir } = require('../governance/push-gate-runner');
+        // core.hooksPath honored (live-probe finding): diagnose where git actually looks.
+        const hookPath = path.join(effectiveHooksDir(target), 'pre-push');
+        const installed = fs.existsSync(hookPath) && fs.readFileSync(hookPath, 'utf8').includes(PUSH_HOOK_SIGNATURE);
+        return installed
+            ? { name: 'push gate', level: 'PASS', detail: 'pre-push 증빙 게이트가 설치되어 있습니다 (test_run 원장 대조)' }
+            : {
+                name: 'push gate', level: 'WARN',
+                detail: 'pre-push 증빙 게이트가 설치되어 있지 않습니다 — 미검증 HEAD 가 다른 에이전트의 기준선이 될 수 있습니다',
+                fix: 'npx holmes-kit install-push-gate 를 실행하십시오 (기존 훅은 덮지 않습니다)',
+            };
+    }
+    catch {
+        return null;
+    } // diagnosis must never crash doctor
+}
 function formatChecks(checks) {
     const lines = checks.map((c) => {
         const head = `${c.level.padEnd(4)} ${c.name} — ${c.detail}`;

package/dist/holmes/cli/index.js

@@ -80,6 +80,8 @@ const KNOWN_FLAGS = {
     ledger: ['help', 'target', 'ref', 'dry-run'],
     // @implements A-SPEC-477 — the human's opt-in act for the cloud semantic tier.
     'semantic-key': ['help'],
+    // @implements A-SPEC-509.1 — the explicit installation act for the pre-push evidence gate.
+    'install-push-gate': ['help', 'target'],
 };
 // @implements A-SPEC-171 — subcommands that render their OWN usage on `--help`. A-SPEC-171 governs
 // "help before any side effect"; a command whose usage lives past this handler (approve, whose
@@ -897,6 +899,40 @@ async function main(argv) {
         await runServeCommand({ root: target, port });
         return 0;
     }
+    // @implements A-SPEC-509.1 — installing the pre-push evidence gate is an EXPLICIT operator act:
+    // holmes-kit never rewires a repository's git hooks as a side effect, and it never overwrites a
+    // hook it did not write (a foreign pre-push is refused byte-intact, with manual-merge guidance).
+    if (cmd === 'install-push-gate') {
+        const target = typeof flags.target === 'string' ? path.resolve(flags.target) : process.cwd();
+        if (!fs.existsSync(path.join(target, '.git'))) {
+            process.stderr.write(`✗ ${target} 는 git 저장소가 아닙니다 — pre-push 게이트는 .git/hooks 에 설치됩니다\n`);
+            return 1;
+        }
+        const { PUSH_HOOK_SIGNATURE } = require('../governance/push-gate');
+        // Live-probe finding (2026-09-01, this repo): `core.hooksPath` redirects git away from
+        // `.git/hooks`, so installing there is a SILENT no-op — wiring presence is not enforcement.
+        // Install where git actually looks, honoring the operator's config instead of editing it.
+        const { effectiveHooksDir } = require('../governance/push-gate-runner');
+        const hookPath = path.join(effectiveHooksDir(target), 'pre-push');
+        // dist/holmes/cli → three up is the package root, the same derivation server.ts uses.
+        const runner = path.join(path.resolve(__dirname, '..', '..', '..'), 'bin', 'holmes-pre-push.js');
+        const script = `#!/usr/bin/env node\n// ${PUSH_HOOK_SIGNATURE} — \`npx holmes-kit install-push-gate\` 가 설치했습니다.\n`
+            + `// test-evidence 원장과 push HEAD 를 대조합니다. 로드 실패는 통과(fail-open) — 게이트 오류가 push 를 막지 않습니다.\n`
+            + `try { require(${JSON.stringify(runner)}); } catch { process.exit(0); }\n`;
+        if (fs.existsSync(hookPath)) {
+            const current = fs.readFileSync(hookPath, 'utf8');
+            if (!current.includes(PUSH_HOOK_SIGNATURE)) {
+                process.stderr.write(`✗ 기존 pre-push 훅이 있고 holmes-kit 이 쓴 것이 아닙니다 — 덮지 않습니다.\n`
+                    + `  수동 병합: 기존 훅 끝에 \`node ${runner} || exit 1\` 형태로 이 게이트를 이어 붙이십시오.\n`);
+                return 1;
+            }
+        }
+        fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+        fs.writeFileSync(hookPath, script);
+        fs.chmodSync(hookPath, 0o755);
+        process.stdout.write(`✓ pre-push 증빙 게이트 설치 — ${hookPath}\n  통과 조건: test_run 원장 head == push HEAD, 초록, 실행 > 0. 우회: git push --no-verify\n`);
+        return 0;
+    }
     if (cmd === 'init') {
         const mode = (typeof flags.mode === 'string' ? flags.mode : 'guardrail');
         // @implements A-SPEC-251.1 — an unknown launch mode is refused, not defaulted: substituting a

package/dist/holmes/governance/push-gate-runner.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Where git ACTUALLY looks for hooks. Live probe (2026-09-01): this repo carries
+ * `core.hooksPath=.git/hooks-disabled`, so a hook written to `.git/hooks` never ran and the
+ * install success message was a lie — presence is not enforcement. A relative hooksPath is
+ * resolved against the repo root, matching git's own semantics.
+ */
+export declare function effectiveHooksDir(repoRoot: string): string;
+export interface PrePushIo {
+    cwd: string;
+    stdinText: string;
+    /** Refusals and notices land here (stderr in the shipped hook). */
+    write: (s: string) => void;
+}
+/** Exit code of the hook: 0 = push proceeds, 1 = refused. */
+export declare function runPrePush(io: PrePushIo): 0 | 1;

package/dist/holmes/governance/push-gate-runner.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effectiveHooksDir = effectiveHooksDir;
+exports.runPrePush = runPrePush;
+// @implements A-SPEC-509.1
+/**
+ * The push gate's IMPURE half: collect (stdin lines, git facts, the evidence ledger) and hand
+ * everything to the pure judgePush. Any collection failure ALLOWS — this gate safens the default
+ * and must never be the thing that bricks a push (security stays with the tool gates).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const push_gate_1 = require("./push-gate");
+const test_evidence_1 = require("../review/test-evidence");
+/**
+ * Where git ACTUALLY looks for hooks. Live probe (2026-09-01): this repo carries
+ * `core.hooksPath=.git/hooks-disabled`, so a hook written to `.git/hooks` never ran and the
+ * install success message was a lie — presence is not enforcement. A relative hooksPath is
+ * resolved against the repo root, matching git's own semantics.
+ */
+function effectiveHooksDir(repoRoot) {
+    try {
+        const p = (0, node_child_process_1.execFileSync)('git', ['config', 'core.hooksPath'], { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (p)
+            return path.isAbsolute(p) ? p : path.join(repoRoot, p);
+    }
+    catch { /* unset config exits 1 — the default location applies */ }
+    return path.join(repoRoot, '.git', 'hooks');
+}
+/** Exit code of the hook: 0 = push proceeds, 1 = refused. */
+function runPrePush(io) {
+    try {
+        const lines = (0, push_gate_1.parsePushLines)(io.stdinText);
+        if (lines.length === 0)
+            return 0; // deletions / nothing to judge
+        const hasGovernance = fs.existsSync(path.join(io.cwd, '.ax'));
+        if (!hasGovernance)
+            return 0; // un-adopted: silent
+        const evidence = (0, test_evidence_1.readTestEvidence)(io.cwd) ?? null;
+        let refused = false;
+        for (const line of lines) {
+            let claimCommits = [];
+            try {
+                const range = /^0{40}$/.test(line.remoteSha)
+                    ? ['-n', '20', line.localSha] // new branch: a bounded recent window
+                    : [`${line.remoteSha}..${line.localSha}`];
+                claimCommits = (0, node_child_process_1.execFileSync)('git', ['log', '--format=%H%x09%s', ...range], { cwd: io.cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+                    .split('\n').filter(Boolean).map((l) => {
+                    const [sha, ...rest] = l.split('\t');
+                    return { sha, subject: rest.join('\t') };
+                });
+            }
+            catch { /* claim surfacing is optional — judgment inputs stay deterministic */ }
+            const v = (0, push_gate_1.judgePush)({ pushedHead: line.localSha, evidence, hasGovernance, claimCommits });
+            for (const n of v.notices)
+                io.write(n + '\n');
+            if (!v.allow) {
+                io.write((v.reason ?? '[Holmes-Kit push 게이트] 거부') + '\n');
+                refused = true;
+            }
+        }
+        return refused ? 1 : 0;
+    }
+    catch {
+        return 0; // fail-open by contract (H-SPEC-509)
+    }
+}

package/dist/holmes/governance/push-gate.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The push gate's PURE judgment. A push is the moment a commit becomes other agents' baseline
+ * (field basis: a multi-agent regression reached production unguarded), so the default is made
+ * safe: the test-evidence ledger must vouch for EXACTLY the head being pushed, green, with real
+ * executions. Deterministic facts only — commit-message prose ("전체 스위트 초록") never moves
+ * the verdict; an unbacked claim is SURFACED as a notice so the dishonesty is audible.
+ *
+ * Deliberately NOT a security boundary: collection failures and un-adopted repos pass (the tool
+ * gates own security). And `git push --no-verify` is git's own escape hatch — respected, not
+ * re-litigated: this gate safens the default, it does not take the human's final say.
+ */
+import type { TestEvidence } from '../review/test-evidence';
+/** Identifies OUR installed hook — the single truth doctor and re-install both key on. */
+export declare const PUSH_HOOK_SIGNATURE = "HOLMES-KIT PUSH GATE v1";
+export interface PushJudgeInput {
+    pushedHead: string;
+    evidence: TestEvidence | null;
+    /** `.ax` exists — the repo opted into governance. */
+    hasGovernance: boolean;
+    /** Commits in the pushed range, for the claim cross-check (surfacing only). */
+    claimCommits: Array<{
+        sha: string;
+        subject: string;
+    }>;
+}
+export interface PushVerdict {
+    allow: boolean;
+    reason?: string;
+    notices: string[];
+}
+export declare function judgePush(input: PushJudgeInput): PushVerdict;
+/**
+ * The pre-push stdin format: `<local ref> <local sha> <remote ref> <remote sha>` per line.
+ * A deletion push (all-zero local sha) deletes a remote ref — there is nothing to vouch for.
+ */
+export declare function parsePushLines(stdinText: string): Array<{
+    localSha: string;
+    remoteSha: string;
+}>;

package/dist/holmes/governance/push-gate.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PUSH_HOOK_SIGNATURE = void 0;
+exports.judgePush = judgePush;
+exports.parsePushLines = parsePushLines;
+/** Identifies OUR installed hook — the single truth doctor and re-install both key on. */
+exports.PUSH_HOOK_SIGNATURE = 'HOLMES-KIT PUSH GATE v1';
+/** Prose that CLAIMS a test success — a surfacing pattern, never a judgment input. */
+const SUCCESS_CLAIM_RE = /초록|green|pass(es|ed)?\b|✅/i;
+// @implements A-SPEC-509.1
+function judgePush(input) {
+    if (!input.hasGovernance)
+        return { allow: true, notices: [] }; // un-adopted: never coerce adoption
+    const notices = [];
+    const ev = input.evidence;
+    // Claim cross-check first — it rides allow AND deny alike.
+    for (const c of input.claimCommits) {
+        if (!SUCCESS_CLAIM_RE.test(c.subject))
+            continue;
+        if (ev && ev.head === c.sha)
+            continue; // the ledger backs this claim
+        notices.push(`[Holmes-Kit] 커밋 ${c.sha.slice(0, 7)}의 메시지가 테스트 성공을 주장하지만 test_run 원장이 그 커밋을 뒷받침하지 않습니다: "${flatSubject(c.subject)}"`);
+    }
+    if (!ev) {
+        // Adopted but no ledger yet: pass honestly, say how to activate. A broken ledger folds here
+        // too — the gate is a default-safener, not a security boundary, so it must not dead-lock a
+        // repo whose ledger file was corrupted.
+        notices.push('[Holmes-Kit] test-evidence 원장이 없어 push 증빙 대조를 건너뜁니다 — test_run을 실행하면 다음 push부터 대조가 활성화됩니다');
+        return { allow: true, notices };
+    }
+    const executed = Object.values(ev.executedByAspec).reduce((a, b) => a + b, 0);
+    if (ev.head === input.pushedHead && ev.passed === true && executed > 0) {
+        return { allow: true, notices };
+    }
+    const why = ev.head !== input.pushedHead
+        ? `원장 head ${ev.head.slice(0, 7)} ≠ push head ${input.pushedHead.slice(0, 7)} — 증빙 이후 커밋이 있습니다`
+        : ev.passed !== true
+            ? `원장이 붉은 실행(passed: false)입니다 — 붉은 스위트는 기준선이 될 수 없습니다`
+            : `원장이 아무것도 실행하지 않았습니다(executed 0) — no-op 초록은 증빙이 아닙니다`;
+    return {
+        allow: false,
+        reason: `[Holmes-Kit push 게이트] ${why}. 복구: 현재 HEAD에서 test_run(또는 전체 스위트)을 초록으로 실행해 원장을 갱신한 뒤 다시 push하십시오. 의도적 우회는 git push --no-verify.`,
+        notices,
+    };
+}
+/** One control-character-free line of a commit subject for interpolation into gate text. */
+function flatSubject(s) {
+    return s.replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 80);
+}
+/**
+ * The pre-push stdin format: `<local ref> <local sha> <remote ref> <remote sha>` per line.
+ * A deletion push (all-zero local sha) deletes a remote ref — there is nothing to vouch for.
+ */
+function parsePushLines(stdinText) {
+    const out = [];
+    for (const line of stdinText.split('\n')) {
+        const parts = line.trim().split(/\s+/);
+        if (parts.length !== 4)
+            continue;
+        const [, localSha, , remoteSha] = parts;
+        if (!/^[0-9a-f]{40}$/.test(localSha))
+            continue;
+        if (/^0{40}$/.test(localSha))
+            continue; // deletion: not judged
+        out.push({ localSha, remoteSha });
+    }
+    return out;
+}

package/dist/holmes/guardrail/scope-judgment.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The de-amplified scope judgment — PURE (no fs, no git; the hook gathers, this decides).
+ *
+ * Field basis (2026-08-23, jarvis): one test-class addition to an ALREADY-ANCHORED file cost
+ * >=3 human interventions, because the old model re-checked Files-to-Touch on every edit of an
+ * anchored file (double registration: the anchor said "this file belongs to X" and FtT had to
+ * say it again), while its matcher quietly widened every FILE token to the file's whole parent
+ * directory (`src/a/x.ts` covered all of `src/a/`). Both directions were amplification.
+ *
+ * The model here splits TENURE from ADMISSION:
+ *  - TENURE: a file already anchored ON DISK is in its specs' scope — editing it is free. The
+ *    entitlement comes from the fact that the file passed admission when it first joined (gated
+ *    writes are the only way anchors legitimately reach disk), or was deliberately grandfathered
+ *    at adoption (REQ-508's explicit acceptance of the 252-file reality).
+ *  - ADMISSION: joining a file to a spec — a new file's payload anchors, or a re-anchor bringing
+ *    an id the disk does not carry — must pass a gate: an FtT glob match, or the test-file
+ *    dispensation (coverage growth is what ART-4 ASKS for), or the caller's out-of-band
+ *    code-write approval (judged by the hook, not here).
+ *
+ * Anchor DELETION never blocks (un-anchoring may be legitimate refactoring) but is surfaced as
+ * a warning — silent RTM loss is the failure mode C12 taught us to fear.
+ */
+/** Repo test conventions — the single census every dispensation consumer shares. */
+export declare function isTestPath(relPath: string): boolean;
+/**
+ * One FtT token against one repo-relative path. `**` crosses separators, `*` does not; a literal
+ * token with an extension names EXACTLY that file (the parent-directory widening is gone); a
+ * literal directory token covers its subtree. The regex build is linear — each glob char maps to
+ * one bounded fragment, so no ReDoS surface.
+ */
+export declare function matchesFtt(token: string, relPath: string): boolean;
+/** Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none. */
+export declare function fttPathTokens(fttText: string): string[];
+export interface ScopeInput {
+    relPath: string;
+    isNewFile: boolean;
+    /** All @implements A-SPEC ids found ON DISK (string-literal-stripped) — the full set, not the first. */
+    diskAnchorIds: string[];
+    /** All A-SPEC ids the write payload carries (content / new_string, stripped). */
+    payloadAnchorIds: string[];
+    approvedIds: ReadonlySet<string>;
+    fttTokensOf: (id: string) => string[];
+    /** Disk anchors this edit deliberately removes (hook-computed: anchors(old)−anchors(new)). */
+    removedAnchorIds?: string[];
+}
+export interface ScopeVerdict {
+    decision: 'in-scope' | 'admission-required';
+    failedAdmissions: Array<{
+        id: string;
+        reason: string;
+    }>;
+    warnings: string[];
+}
+export declare function judgeScope(input: ScopeInput): ScopeVerdict;

package/dist/holmes/guardrail/scope-judgment.js

@@ -0,0 +1,106 @@
+"use strict";
+// @implements A-SPEC-508.1
+/**
+ * The de-amplified scope judgment — PURE (no fs, no git; the hook gathers, this decides).
+ *
+ * Field basis (2026-08-23, jarvis): one test-class addition to an ALREADY-ANCHORED file cost
+ * >=3 human interventions, because the old model re-checked Files-to-Touch on every edit of an
+ * anchored file (double registration: the anchor said "this file belongs to X" and FtT had to
+ * say it again), while its matcher quietly widened every FILE token to the file's whole parent
+ * directory (`src/a/x.ts` covered all of `src/a/`). Both directions were amplification.
+ *
+ * The model here splits TENURE from ADMISSION:
+ *  - TENURE: a file already anchored ON DISK is in its specs' scope — editing it is free. The
+ *    entitlement comes from the fact that the file passed admission when it first joined (gated
+ *    writes are the only way anchors legitimately reach disk), or was deliberately grandfathered
+ *    at adoption (REQ-508's explicit acceptance of the 252-file reality).
+ *  - ADMISSION: joining a file to a spec — a new file's payload anchors, or a re-anchor bringing
+ *    an id the disk does not carry — must pass a gate: an FtT glob match, or the test-file
+ *    dispensation (coverage growth is what ART-4 ASKS for), or the caller's out-of-band
+ *    code-write approval (judged by the hook, not here).
+ *
+ * Anchor DELETION never blocks (un-anchoring may be legitimate refactoring) but is surfaced as
+ * a warning — silent RTM loss is the failure mode C12 taught us to fear.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTestPath = isTestPath;
+exports.matchesFtt = matchesFtt;
+exports.fttPathTokens = fttPathTokens;
+exports.judgeScope = judgeScope;
+/** Repo test conventions — the single census every dispensation consumer shares. */
+function isTestPath(relPath) {
+    const base = relPath.split('/').at(-1) ?? '';
+    if (/\.(test|spec)\.[^.]+$/.test(base))
+        return true; // x.test.ts / x.spec.tsx
+    if (/^test_[^/]*\.py$/.test(base))
+        return true; // pytest collection default
+    if (/_test\.(py|go)$/.test(base))
+        return true; // pytest alt / go test
+    const segs = relPath.split('/').slice(0, -1);
+    return segs.some((s) => s === 'tests' || s === '__tests__' || s === 'test');
+}
+/**
+ * One FtT token against one repo-relative path. `**` crosses separators, `*` does not; a literal
+ * token with an extension names EXACTLY that file (the parent-directory widening is gone); a
+ * literal directory token covers its subtree. The regex build is linear — each glob char maps to
+ * one bounded fragment, so no ReDoS surface.
+ */
+function matchesFtt(token, relPath) {
+    const tok = token.replace(/\/+$/, '');
+    if (tok === '')
+        return false;
+    if (tok.includes('*')) {
+        const rx = tok.split(/(\*\*|\*)/).map((part) => {
+            if (part === '**')
+                return '.*';
+            if (part === '*')
+                return '[^/]*';
+            return part.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+        }).join('');
+        return new RegExp(`^${rx}$`).test(relPath);
+    }
+    if (/\.[A-Za-z0-9]+$/.test(tok))
+        return relPath === tok; // file literal: that file only
+    return relPath === tok || relPath.startsWith(tok + '/'); // dir literal: its subtree
+}
+/** Concrete path-like tokens of a Files-to-Touch section (globs included) — prose yields none. */
+function fttPathTokens(fttText) {
+    return fttText.match(/[\w@.*-]+(?:\/[\w@.*-]+)+/g) ?? [];
+}
+// @implements A-SPEC-508.1
+function judgeScope(input) {
+    const disk = new Set(input.diskAnchorIds);
+    const warnings = (input.removedAnchorIds ?? [])
+        .filter((id) => disk.has(id))
+        .map((id) => `이 편집은 ${id} 앵커를 제거합니다 — RTM 추적 연결이 끊깁니다(커버리지·그래프·게이트가 이 파일을 더는 ${id}에 귀속시키지 않음). 의도한 재구성이면 진행하고, 아니면 앵커를 보존하십시오`);
+    // NEW CLAIMS are the only thing admission ever judges: a new file's anchors, or a re-anchor
+    // bringing an id the disk does not carry. An existing file that claims nothing new is in scope
+    // by tenure — including the vacuous cases (no anchors at all, draft-only anchors): the gates
+    // that own those questions (No-Spec-No-Code, stale-seal) run on their own lanes.
+    const newClaims = input.payloadAnchorIds.filter((id) => !disk.has(id));
+    if (!input.isNewFile && newClaims.length === 0) {
+        return { decision: 'in-scope', failedAdmissions: [], warnings };
+    }
+    const claims = input.isNewFile ? input.payloadAnchorIds : newClaims;
+    const failedAdmissions = [];
+    for (const id of claims) {
+        const tokens = input.fttTokensOf(id);
+        if (tokens.length === 0)
+            continue; // prose-only imposes nothing
+        if (tokens.some((t) => matchesFtt(t, input.relPath)))
+            continue; // FtT glob admits
+        if (isTestPath(input.relPath) && input.approvedIds.has(id))
+            continue; // coverage dispensation
+        failedAdmissions.push({
+            id,
+            reason: input.isNewFile
+                ? `${id}의 'Files to Touch' 밖이고 테스트 특례에도 해당하지 않습니다`
+                : `재앵커(이관): ${id}는 이 파일의 디스크 앵커가 아니며, 'Files to Touch' 관문과 테스트 특례 모두 통과하지 못했습니다`,
+        });
+    }
+    return {
+        decision: failedAdmissions.length > 0 ? 'admission-required' : 'in-scope',
+        failedAdmissions,
+        warnings,
+    };
+}

package/dist/holmes/hooks/pre-tool-use.d.ts

@@ -138,6 +138,7 @@ export declare function evaluateHook(input: {
         file_path?: string;
         notebook_path?: string;
         content?: string;
+        old_string?: string;
         new_string?: string;
         command?: string;
     };

package/dist/holmes/hooks/pre-tool-use.js

@@ -1218,11 +1218,10 @@ function evaluateHook(input, specsDir, opts) {
     const payloadAnchor = ANCHOR_RE.exec([input.tool_input.content ?? '', input.tool_input.new_string ?? ''].join('\n'));
     const diskAnchor = ANCHOR_RE.exec(onDiskContent);
     const m = diskAnchor ?? payloadAnchor;
-    // RE-ANCHORING must be scope-checked against the NEW spec (review C6: on-disk precedence meant an
-    // edit that rewrites the anchor line was judged under the OLD spec, so a file could be re-attributed
-    // to any spec without that spec's Files-to-Touch ever being consulted — which then mis-credits
-    // coverage evidence). Both the current and the incoming anchor must accept the path.
-    const anchorsToScope = [m?.[1], payloadAnchor?.[1] !== m?.[1] ? payloadAnchor?.[1] : undefined].filter(Boolean);
+    // RE-ANCHORING scope (review C6) moved into judgeScope below (S-508.1): every payload anchor the
+    // disk does not carry is an ADMISSION, judged against the incoming spec's gate — the C6 property
+    // (a rewrite of the anchor line is judged under the NEW spec) is preserved there, now for the
+    // FULL anchor set instead of the first match.
     // @implements A-SPEC-132
     // Stale-aware gate (rev.1): a target A-SPEC whose seal is PRESENT and BROKEN (edited after
     // approval) or STALE (a parent moved) is not a trustworthy approval, so code must not be written
@@ -1307,33 +1306,46 @@ function evaluateHook(input, specsDir, opts) {
                 + (lost ? `\n${governance_history_1.GOVERNANCE_LOST_HINT}` : ''),
         };
     }
-    // Marker self-attestation mitigation: an @implements anchor is a claim the writer makes. When the
-    // anchored A-SPEC's `Files to Touch` names CONCRETE paths, the file must fall under one of them —
-    // so anchoring evil.ts (or an unrelated edit) to a random approved spec fails when that spec scoped
-    // its files. Applies to EVERY governed code Write/Edit, not just new files: the earlier new-file-only
-    // scoping left "create it some other way, then edit freely" open, and a stale anchor blessed
-    // unrelated edits forever. The legitimate flow is to extend the spec's Files-to-Touch FIRST
-    // (editing an approved spec's sections is allowed; only the approval transition is gated).
-    // Still bounded: only when concrete paths are listed (a prose/TODO section imposes nothing), and a
-    // valid out-of-band approval overrides. Verified 0/93 violations across this repo's anchored files.
-    for (const anchorId of anchorsToScope) {
-        const aspec = specs.find((s) => s.id === anchorId);
-        const ftt = aspec?.sections['Files to Touch'] ?? '';
-        const listed = ftt.match(/[\w@.-]+(?:\/[\w@.*-]+)+/g) ?? []; // concrete path-like tokens only
-        if (listed.length === 0)
-            continue; // prose-only section imposes nothing
-        const rel = relPath;
-        const covered = listed.some((t) => {
-            const tok = t.replace(/\/?\*+$/, ''); // dir/** -> dir
-            const dir = /\.[A-Za-z0-9]+$/.test(tok) ? tok.replace(/\/[^/]*$/, '') : tok; // file -> its dir
-            return rel === tok || rel.startsWith(tok + '/') || rel.startsWith(dir + '/');
-        });
-        if (!covered && !codeWriteCovered) { // @implements A-SPEC-133 — same code-write coverage as the stale gate
-            return {
-                permissionDecision: 'deny',
-                permissionDecisionReason: `[Holmes-Kit] ${rel} is anchored to ${anchorId} but falls outside its 'Files to Touch' scope — extend that section first (spec edit is allowed) or supply out-of-band approval`,
-            };
-        }
+    // @implements A-SPEC-508.1
+    // De-amplified scope: TENURE vs ADMISSION (S-508.1 replaced the per-edit FtT re-check that made
+    // one test-class addition cost >=3 human interventions, and the file-token→parent-directory
+    // widening that quietly covered whole sibling trees). A file already anchored on disk is in its
+    // specs' scope — editing it is free and silent. Only NEW CLAIMS (a new file's anchors, or a
+    // re-anchor bringing an id the disk does not carry) pass admission: FtT glob, or the test-file
+    // dispensation (ART-4 asks for coverage — the gate must not refuse it), or the out-of-band
+    // code-write approval. Anchor deletion never blocks but rides the allow as a warning — silent
+    // RTM loss is the C12 failure mode, made audible.
+    const { judgeScope, fttPathTokens: fttTokens } = require('../guardrail/scope-judgment');
+    const { anchorSpecIds, stripStringLiterals } = require('../rtm/anchor-ids');
+    const oldStr = input.tool_input.old_string ?? '';
+    const newPayload = [input.tool_input.content ?? '', input.tool_input.new_string ?? ''].join('\n');
+    // Deletion intent: a WRITE replaces the whole file, so disk→content is the comparison; an EDIT
+    // only proves a deletion when its old_string carried the anchor (a fragment NOT containing an
+    // anchor says nothing about it — no evidence, no warning). Discriminate by TOOL NAME, not by
+    // which payload fields exist: the antigravity adapter aliases `content` alongside `new_string`
+    // for its fragment-replace tool, and field-based detection read that as a whole-file wipe of
+    // every disk anchor (14 false warnings, caught by the A-SPEC-338 spawn-parity pin).
+    const isWholeFileWrite = input.tool_name.toLowerCase() === 'write';
+    const beforeIds = anchorSpecIds(stripStringLiterals(isWholeFileWrite ? onDiskContent : oldStr));
+    const afterIds = new Set(anchorSpecIds(stripStringLiterals(newPayload)));
+    const scopeVerdict = judgeScope({
+        relPath,
+        isNewFile: onDiskContent === '' && !fs.existsSync(p),
+        diskAnchorIds: anchorSpecIds(stripStringLiterals(onDiskContent)),
+        payloadAnchorIds: anchorSpecIds(stripStringLiterals(newPayload)),
+        approvedIds: new Set(specs.filter((s) => s.status === 'approved').map((s) => s.id)),
+        fttTokensOf: (id) => fttTokens(specs.find((s) => s.id === id)?.sections['Files to Touch'] ?? ''),
+        removedAnchorIds: beforeIds.filter((id) => !afterIds.has(id)),
+    });
+    const scopeWarnings = scopeVerdict.warnings.map((w) => `[Holmes-Kit] ${w}`).join('\n');
+    if (scopeVerdict.decision === 'admission-required' && !codeWriteCovered) { // @implements A-SPEC-133 — same code-write coverage as the stale gate
+        const failed = scopeVerdict.failedAdmissions
+            .map((f) => `${relPath} is anchored to ${f.id} but falls outside its 'Files to Touch' scope (${f.reason})`).join('; ');
+        return {
+            permissionDecision: 'deny',
+            permissionDecisionReason: `[Holmes-Kit] ${failed} — extend that section first (spec edit is allowed), add it as a test under the anchored spec, or supply out-of-band approval`
+                + (scopeWarnings ? `\n${scopeWarnings}` : ''),
+        };
     }
     // @implements A-SPEC-278
     // Pre-edit impact evidence, deliberately the LAST gate on this path.
@@ -1361,9 +1373,19 @@ function evaluateHook(input, specsDir, opts) {
             declaredDigest: process.env.HOLMES_EVIDENCE?.trim() || null,
             currentHead: evidenceHead,
         });
-        if (evidenceDecision)
+        if (evidenceDecision) {
+            // @implements A-SPEC-508.1 — an allow-with-reason from the evidence gate must not swallow
+            // the anchor-deletion warning: both ride the same reason field, newline-joined.
+            if (scopeWarnings && evidenceDecision.permissionDecision === 'allow') {
+                return { ...evidenceDecision, permissionDecisionReason: [evidenceDecision.permissionDecisionReason, scopeWarnings].filter(Boolean).join('\n') };
+            }
             return evidenceDecision;
+        }
     }
+    // @implements A-SPEC-508.1 — anchor-deletion warnings ride the allow (allow-with-reason, the
+    // same channel A-SPEC-278 uses): the write proceeds, but the RTM loss is on the record.
+    if (scopeWarnings)
+        return { permissionDecision: 'allow', permissionDecisionReason: scopeWarnings };
     return { permissionDecision: 'allow' };
 }
 // Synchronous spec loader for hook context (fail-open: directory read errors are skipped)

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",