@holmes-lab/holmes-kit 0.3.9 → 0.3.11

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.3.11] - 2026-09-01
+
+### Fixed
+
+- **push gate: tag refs are names, not baselines** (dogfooded): pushing `--tags` sends
+  `refs/tags` lines whose shas are usually ancestors of the evidenced tip, and the exact-head
+  rule refused the release-tag push of the very version that shipped the gate. Only
+  `refs/heads` lines are judged now — a tag merely names an existing commit.
+
+<!-- @implements A-SPEC-209 -->
+## [0.3.10] - 2026-09-01
+
+### Fixed
+
+- **`test_run` false red on large suites** (measured on this repo, twice): every runner spawn
+  used `execFileSync`'s default 1MB `maxBuffer`, so a full `jest --json` for 289 suites
+  (>2MB) died with ENOBUFS and a GREEN suite reported `passed: false` with no failing test
+  named — the baseline never recorded, and the new push gate could never be satisfied. All six
+  runner spawns (jest/pytest/cargo/java/dotnet/go) now share a 256MB ceiling; regression pinned
+  with a >1MB green-output fixture (mutant-checked both ways).
+
 <!-- @implements A-SPEC-209 -->
 ## [0.3.9] - 2026-09-01
 

package/dist/.build-id

@@ -1 +1 @@
-ab67afc-mti0dz4k
+3d14357-mti358ve

package/dist/holmes/governance/push-gate.d.ts

@@ -32,6 +32,9 @@ export declare function judgePush(input: PushJudgeInput): PushVerdict;
 /**
  * The pre-push stdin format: `<local ref> <local sha> <remote ref> <remote sha>` per line.
  * A deletion push (all-zero local sha) deletes a remote ref — there is nothing to vouch for.
+ * Only BRANCH refs (refs/heads/) are judged: the gate guards the moment a code line becomes
+ * someone's baseline, and a tag merely NAMES an existing commit — dogfooded 2026-09-01, pushing
+ * v0.3.9 (an ancestor of the evidenced tip) was refused by the exact-head rule until this line.
  */
 export declare function parsePushLines(stdinText: string): Array<{
     localSha: string;

package/dist/holmes/governance/push-gate.js

@@ -50,6 +50,9 @@ function flatSubject(s) {
 /**
  * The pre-push stdin format: `<local ref> <local sha> <remote ref> <remote sha>` per line.
  * A deletion push (all-zero local sha) deletes a remote ref — there is nothing to vouch for.
+ * Only BRANCH refs (refs/heads/) are judged: the gate guards the moment a code line becomes
+ * someone's baseline, and a tag merely NAMES an existing commit — dogfooded 2026-09-01, pushing
+ * v0.3.9 (an ancestor of the evidenced tip) was refused by the exact-head rule until this line.
  */
 function parsePushLines(stdinText) {
     const out = [];
@@ -57,7 +60,9 @@ function parsePushLines(stdinText) {
         const parts = line.trim().split(/\s+/);
         if (parts.length !== 4)
             continue;
-        const [, localSha, , remoteSha] = parts;
+        const [localRef, localSha, , remoteSha] = parts;
+        if (!localRef.startsWith('refs/heads/'))
+            continue; // tags/notes: names, not baselines
         if (!/^[0-9a-f]{40}$/.test(localSha))
             continue;
         if (/^0{40}$/.test(localSha))

package/dist/holmes/review/test-runner.js

@@ -52,6 +52,12 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const python_env_1 = require("./python-env");
+// Runner stdout ceiling. Measured 2026-09-01 on this repo: a full `jest --json` for 289 suites /
+// 4568 tests emits >2MB, and execFileSync's DEFAULT maxBuffer (1MB) kills the child with ENOBUFS —
+// so a GREEN suite reported `passed: false`, twice, with no failing test named (the baseline never
+// recorded and the push gate could never be satisfied). Every runner spawn shares this ceiling:
+// evidence-bearing output must never be truncated into a false red.
+const RUNNER_MAX_BUFFER = 256 * 1024 * 1024;
 function planTestRun(scope) {
     if (scope.tier === 'full') {
         return { mode: 'full', testFiles: [], reason: 'full regression — run the entire suite' };
@@ -233,7 +239,7 @@ function runJest(files, mode, cwd) {
         ? [...pre, '--silent', '--json', '--runTestsByPath', '--', ...safeFiles]
         : [...pre, '--silent', '--json'];
     try {
-        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
         return { passed: true, tail: tailOf(out), executed: parseExecutedCounts(out, cwd) };
     }
     catch (e) {
@@ -271,7 +277,7 @@ function runPytest(files, mode, cwd) {
         }
     };
     try {
-        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
         return { passed: true, tail: tailOf(out), executed: read() };
     }
     catch (e) {
@@ -326,7 +332,7 @@ function runCargo(files, _mode, cwd, opts) {
     let out = '';
     let ok = true;
     try {
-        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
     }
     catch (e) {
         const err = e;
@@ -419,7 +425,7 @@ function runGradle(files, _mode, cwd, opts) {
     }
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
     }
     catch {
         ok = false;
@@ -451,7 +457,7 @@ function runDotnet(files, _mode, cwd, opts) {
     const report = path.join(dir, 'junit.xml');
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
     }
     catch {
         ok = false;
@@ -498,7 +504,7 @@ function runGo(files, mode, cwd, opts) {
     const runDir = (dirArg, creditFiles) => {
         let out = '';
         try {
-            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
         }
         catch (e) {
             const err = e;

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",