@holmes-lab/holmes-kit 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.4.1] - 2026-09-02
+
+Three shipped defects, all found by chasing measurements that did not add up. Two of them made the
+harness lie about its own evidence; the third kept the fix for the second from ever loading.
+
+### Fixed
+
+- **Governance was decided by the environment, not by the argument** (REQ-514):
+  `isGovernedProject` opened with `if (env.HOLMES_SPECS) return true`, discarding the `specsDir` it
+  was given. `holmes-kit init` writes `HOLMES_SPECS=.ax/specs` — the DEFAULT value, and therefore
+  not a governance signal — into `.mcp.json`, so every unspecced project read as governed and the
+  gate's error path denied where A-SPEC-144 says it must allow ("inventing a denial is its own
+  failure"). The judgement now takes `{ configured }` from the caller, which is the only party that
+  still holds the unresolved spelling; the parameter type changed so an old call fails to compile
+  rather than quietly reading ambient state. **Projects with specs, and projects wired to a
+  non-default spec root, are unaffected.**
+
+- **The evidence runner inherited the environment it was judging** (REQ-514): every git subprocess
+  in this package was already scrubbed, and the test runner was not. Measured, the MCP server's
+  `HOLMES_SPECS` reached jest and turned a green commit red twice. `cleanTestEnv` now wraps all six
+  test spawns (jest, pytest, cargo, gradle, dotnet, go), removing Holmes secrets plus
+  `HOLMES_SPECS`, `HOLMES_GATE_BYPASS` and `HOLMES_MCP_*` — an explicit list, never a prefix sweep,
+  so a project's own variables are never taken.
+
+- **A green `test_run` returned 1.4MB** (REQ-515): `tailOf` truncated by LINE, and jest `--json`
+  emits one line, so "the last 6 lines" was the whole document — 99.2% of the tool result. Failure
+  paths gave six clean lines and success paths gave everything, exactly backwards. `tail` is now
+  capped at 4,000 characters (keeping the END, where a runner's conclusion is), marks itself when
+  truncated, and a passing jest run reports `Test Suites: … / Tests: …` assembled from the JSON
+  rather than the JSON itself. **Measured: 1,421,327 characters → 71.**
+
+- **A large reply permanently disabled the MCP autoreload** (REQ-516): JSON-RPC puts `"id"` at the
+  END of a reply, so a 1.4MB response arrives as ~22 chunks of which the first begins with `{` but
+  carries no `"id"` and the last carries `"id"` but does not begin with `{`. The supervisor counted
+  replies per chunk, so neither matched, `inflight` never returned to zero, and the child was never
+  replaced again — measured live, a server three commits behind across four rebuilds. The root was
+  an asymmetry in one file: the stdin direction already buffered into lines and only stdout did not.
+  Counting is now line-based via a pure, exported `createResponseCounter`, using two bits and a
+  three-character tail rather than buffering the line. This defect was self-reinforcing: the
+  oversized reply above is what jammed the counter, and the jammed counter is what kept that reply's
+  fix from loading.
+
+### Added
+
+- **Taint vocabulary is language-aware** (REQ-513): the source/sink/sanitizer lists were JS-centric,
+  so Python could only ever report zero — measured on a 27,000-file repository, `subprocess.run`,
+  `os.environ` and `input(` were all unmatched. Vocabulary is now a per-language table selected by
+  file extension and never unioned (a union would let Python's `input(` taint an ordinary
+  TypeScript `input`), and `taint_scan { dataFlow: true }` routes Python through the flow-sensitive
+  lane. The TypeScript list is value-identical to the shipped one, which a test compares rather
+  than asserts. The language matrix moves Python from ○ to ● on the taint row.
+
 <!-- @implements A-SPEC-209 -->
 ## [0.4.0] - 2026-09-02
 

package/dist/.build-id

@@ -1 +1 @@
-3e5ef00-mtiwan92
+2b427b6-mtj2vv29

package/dist/holmes/cli/ci-gate.js

@@ -56,7 +56,9 @@ function runCiGate(targetDir, options) {
     }
     const specsDirName = options?.specsDir ?? (0, pre_tool_use_1.wiredSpecsDir)(process.argv, process.env);
     const specsDir = path.resolve(root, specsDirName);
-    if (!(0, pre_tool_use_1.isGovernedProject)(specsDir, process.env)) {
+    // @implements A-SPEC-514.1 — compare the SPELLING, before it was resolved against the root: an
+    // absolute path can never equal `.ax/specs`, so the comparison has to happen here.
+    if (!(0, pre_tool_use_1.isGovernedProject)(specsDir, { configured: specsDirName !== pre_tool_use_1.DEFAULT_SPECS_DIR })) {
         return {
             ok: true,
             violations: [],

package/dist/holmes/cpg/foundation/language-matrix.js

@@ -21,7 +21,7 @@ exports.renderLanguageSupport = renderLanguageSupport;
 const ast_store_1 = require("./ast-store");
 const cfg_1 = require("./cfg");
 const language_capability_1 = require("../language-capability");
-const language_parser_1 = require("../language-parser");
+const taint_vocabulary_1 = require("../../rtm/taint-vocabulary");
 const test_runner_1 = require("../../review/test-runner");
 exports.LAYERS = ['relations', 'ast', 'cfg', 'ddg', 'cdg', 'runner', 'taint'];
 /** The language families holmes-kit advertises, each with the probe inputs the derivation needs. */
@@ -70,10 +70,18 @@ function runnerCell(sampleFile) {
         : { support: 'none', basis: 'no test-runner adapter — execution evidence unavailable' };
 }
 function taintCell(astLang) {
-    const has = (0, language_parser_1.hasDataFlowWalk)(astLang);
-    return has
-        ? { support: 'full', basis: 'data-flow walk present (taint_scan analyses this language)' }
-        : { support: 'none', basis: 'no data-flow walk — taint_scan does not analyse this language' };
+    // @implements A-SPEC-513.1 — derived from the two things a taint verdict actually needs: a
+    // VOCABULARY for the language and a control/data-flow graph to judge it on. Before this the cell
+    // read `hasDataFlowWalk`, which described only the older facts extractor and therefore understated
+    // Python once its CFG/DDG landed.
+    const hasVocab = taint_vocabulary_1.TAINT_LANGUAGES.has(astLang) || (astLang === 'tsx' && taint_vocabulary_1.TAINT_LANGUAGES.has('typescript'));
+    const hasFlow = cfg_1.CFG_LANGUAGES.has(astLang) || (astLang === 'typescript' && cfg_1.CFG_LANGUAGES.has('tsx'));
+    if (hasVocab && hasFlow) {
+        return { support: 'full', basis: 'taint_scan { dataFlow: true } analyses this language (vocabulary + CFG/DDG)' };
+    }
+    if (hasVocab)
+        return { support: 'partial', basis: 'vocabulary present but no CFG/DDG to judge flow on' };
+    return { support: 'none', basis: 'no taint vocabulary for this language — taint_scan does not analyse it' };
 }
 // @implements A-SPEC-510.6
 /** Derive the whole matrix. Pure, cheap, and impossible to drift from its sources. */

package/dist/holmes/cpg/language-parser-walk.js

@@ -1202,7 +1202,11 @@ function extractDataFlowFromTree(tree, lang = 'typescript') {
                             args.push(exprOf(a));
                         }
                     }
-                    calls.push({ fn: enclosing(node), callee, args, line: node.startPosition.row + 1 });
+                    // @implements A-SPEC-512.3 — the callee AS WRITTEN, so a sink decision can read the
+                    // RECEIVER: `re.exec` and `child_process.exec` share a bare name but not a meaning.
+                    const calleeNode = node.childForFieldName('function');
+                    const calleeText = calleeNode ? calleeNode.text : callee;
+                    calls.push({ fn: enclosing(node), callee, calleeText, args, line: node.startPosition.row + 1 });
                 }
             }
         }

package/dist/holmes/cpg/language-parser.d.ts

@@ -54,6 +54,7 @@ export interface DataFlowFacts {
     calls: {
         fn: string;
         callee: string;
+        calleeText?: string;
         args: Expr[];
         line: number;
     }[];

package/dist/holmes/hooks/pre-tool-use.d.ts

@@ -103,11 +103,26 @@ export declare function decideOnGateError(opts: {
 };
 /**
  * Is this project governed? Computed on the ERROR path, so it must not re-run the logic that just
- * failed: presence of a configured spec root or a non-empty spec directory, nothing more. Any
+ * failed: an explicitly configured spec root, or a non-empty spec directory, nothing more. Any
  * problem reading it means NOT governed — the conservative direction here is the one that keeps an
  * unrelated failure from bricking a project that never asked for gating.
+ *
+ * IT DOES NOT READ THE ENVIRONMENT. It used to open with `if (env.HOLMES_SPECS) return true`, which
+ * discarded `specsDir` entirely and answered from ambient state. A-SPEC-144 sealed the rule as
+ * `specsDir !== DEFAULT_SPECS_DIR || the directory holds a file`, and the drift is traceable:
+ * A-SPEC-191 §17(a) started passing a RESOLVED ABSOLUTE path, which made the literal comparison
+ * always true — a dead condition — and the env short-circuit took its place. `holmes-kit init`
+ * writes `HOLMES_SPECS=.ax/specs` (the default value, i.e. NOT a governance signal) into .mcp.json,
+ * so every unspecced project read as governed and the error path denied where A-SPEC-144 says it
+ * must allow.
+ *
+ * Only the CALLER knows whether its spelling is the default, so the first disjunct arrives as
+ * `configured`. The parameter type changed from `ProcessEnv` deliberately: an old call now fails to
+ * compile instead of quietly reading ambient state.
  */
-export declare function isGovernedProject(specsDir: string, env?: NodeJS.ProcessEnv): boolean;
+export declare function isGovernedProject(specsDir: string, opts?: {
+    configured?: boolean;
+}): boolean;
 /**
  * The whole error-path decision, assembled from an environment.
  *

package/dist/holmes/hooks/pre-tool-use.js

@@ -317,15 +317,29 @@ function decideOnGateError(opts) {
             + ' → `holmes-kit doctor`로 설치를 점검하세요. 운영자 판단으로 통과시키려면 환경에 HOLMES_GATE_BYPASS=1을 설정하십시오(세션이 스스로 설정할 수 없는 대역외 채널).',
     };
 }
+// @implements A-SPEC-514.1
 /**
  * Is this project governed? Computed on the ERROR path, so it must not re-run the logic that just
- * failed: presence of a configured spec root or a non-empty spec directory, nothing more. Any
+ * failed: an explicitly configured spec root, or a non-empty spec directory, nothing more. Any
  * problem reading it means NOT governed — the conservative direction here is the one that keeps an
  * unrelated failure from bricking a project that never asked for gating.
+ *
+ * IT DOES NOT READ THE ENVIRONMENT. It used to open with `if (env.HOLMES_SPECS) return true`, which
+ * discarded `specsDir` entirely and answered from ambient state. A-SPEC-144 sealed the rule as
+ * `specsDir !== DEFAULT_SPECS_DIR || the directory holds a file`, and the drift is traceable:
+ * A-SPEC-191 §17(a) started passing a RESOLVED ABSOLUTE path, which made the literal comparison
+ * always true — a dead condition — and the env short-circuit took its place. `holmes-kit init`
+ * writes `HOLMES_SPECS=.ax/specs` (the default value, i.e. NOT a governance signal) into .mcp.json,
+ * so every unspecced project read as governed and the error path denied where A-SPEC-144 says it
+ * must allow.
+ *
+ * Only the CALLER knows whether its spelling is the default, so the first disjunct arrives as
+ * `configured`. The parameter type changed from `ProcessEnv` deliberately: an old call now fails to
+ * compile instead of quietly reading ambient state.
  */
-function isGovernedProject(specsDir, env = process.env) {
+function isGovernedProject(specsDir, opts = {}) {
     try {
-        if (env.HOLMES_SPECS)
+        if (opts.configured === true)
             return true;
         const stack = [specsDir];
         while (stack.length) {
@@ -365,7 +379,10 @@ function gateErrorDecision(message, env = process.env, argv = process.argv, proj
     const wired = wiredSpecsDir(argv, env);
     const specsDir = path.isAbsolute(wired) || projectRoot === undefined ? wired : path.join(projectRoot, wired);
     return decideOnGateError({
-        governed: isGovernedProject(specsDir, env),
+        // @implements A-SPEC-514.1 — the caller answers "did the operator point somewhere OTHER than
+        // the default?", because only the caller still holds the unresolved spelling. `.ax/specs` is
+        // what `init` writes; equal to the default means no governance intent was expressed.
+        governed: isGovernedProject(specsDir, { configured: wired !== exports.DEFAULT_SPECS_DIR }),
         // Environment ONLY. The session authors the payload and the operator authors the environment,
         // so an agent cannot grant itself relief from a gate it happens to be able to crash.
         bypass: !!env.HOLMES_GATE_BYPASS,

package/dist/holmes/mcp/handlers.d.ts

@@ -312,15 +312,27 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
      */
     taint_scan(a: {
         root: string;
+        dataFlow?: boolean;
     }): Promise<{
+        kind: string;
+        limits: ("name-based matching" | "no def-use" | "no sanitizers" | "call-edge-only")[];
+        maxPaths: number | undefined;
+        truncated: number;
+        pairs: import("../rtm/taint").TaintPair[];
+    } | {
         ok: boolean;
         reason: string;
-        kind?: undefined;
-        limits?: undefined;
-        maxPaths?: undefined;
-        truncated?: undefined;
-        pairs?: undefined;
     } | {
+        dataFlow: {
+            findings: Record<string, unknown>[];
+            /** Findings the reaching-definition evidence positively refuted (dead or fully sanitized). */
+            refutedByReachingDefs: number;
+            limits: ("no field sensitivity (obj.a and obj.b are one value)" | "no aliasing" | "no path sensitivity" | "no container/element tracking" | "no reflection or dynamic dispatch" | "sink matching is by callee NAME with no receiver type — RE.exec(s) is indistinguishable from child_process.exec(s)" | "no anonymous-function parameters (arrow/function-expression params are not bound)" | "not statement-order sensitive — a variable tainted anywhere in a function is tainted throughout it" | "reports reachability of tainted data to a sink, never exploitability")[];
+            converged: boolean;
+            truncated: number;
+            /** Which languages this run could actually judge, so a zero is readable. */
+            languagesAnalysed: (string | null)[];
+        };
         kind: string;
         limits: ("name-based matching" | "no def-use" | "no sanitizers" | "call-edge-only")[];
         maxPaths: number | undefined;

package/dist/holmes/mcp/handlers.js

@@ -1688,7 +1688,104 @@ function makeRawHandlers(store, opts) {
                 (0, rtm_builder_1.buildRtm)(await store.list(), scanned, g);
                 const cfg = taint_1.DEFAULT_TAINT_CONFIG;
                 const { pairs, truncated } = (0, taint_1.taintReachability)(g, cfg);
-                return { kind: 'call-reachability', limits: [...taint_1.TAINT_LIMITS], maxPaths: cfg.maxPaths, truncated, pairs };
+                const base = { kind: 'call-reachability', limits: [...taint_1.TAINT_LIMITS], maxPaths: cfg.maxPaths, truncated, pairs };
+                if (a.dataFlow !== true)
+                    return base;
+                // @implements A-SPEC-512.2
+                // OPT-IN def-use lane. Measured 2026-09-02: extracting data-flow facts over this
+                // repository costs 7.6s on top of the scan, which is why this follows the `cpg_scan
+                // lints:true` precedent instead of running by default. Before this slice the engine
+                // (A-SPEC-140.1, with its own 13-case benchmark) had NO caller at all — capability
+                // present, unreachable. Findings are filtered by reaching definitions: inter-procedural
+                // arrival is preserved, and only what the DDG positively refutes is dropped.
+                const { TreeSitterTsParser } = require('../cpg/language-parser');
+                const { taintDataFlow, DATAFLOW_LIMITS } = require('../rtm/dataflow-taint');
+                const { filterFindingsForFile } = require('../rtm/reaching-def-filter');
+                // @implements A-SPEC-513.1 — vocabulary is SELECTED per file language, never unioned:
+                // Python's `input(` must not taint a TypeScript `input`, and `req.body` means nothing in
+                // Python. Measured on jarvis: the shipped (JS) list missed `subprocess.run`, `os.environ`
+                // and `input(` entirely, so a Python repository could only ever report zero.
+                const { vocabularyFor } = require('../rtm/taint-vocabulary');
+                const parser = new TreeSitterTsParser();
+                const factSet = [];
+                const pythonFiles = [];
+                for (const f of scanned) {
+                    const vocab = vocabularyFor(f.sourcePath);
+                    if (!vocab)
+                        continue;
+                    if (/\.py$/i.test(f.sourcePath)) {
+                        pythonFiles.push(f.sourcePath);
+                        continue;
+                    }
+                    let src;
+                    try {
+                        src = fs.readFileSync(path.join(root, f.sourcePath), 'utf8');
+                    }
+                    catch {
+                        continue;
+                    }
+                    const facts = parser.extractDataFlow(src, f.sourcePath.endsWith('x') ? 'tsx' : 'typescript');
+                    if (facts)
+                        factSet.push({ file: f.sourcePath, facts });
+                }
+                const tsVocab = vocabularyFor('x.ts');
+                const raw = taintDataFlow(factSet, tsVocab);
+                const byFile = new Map();
+                for (const fnd of raw.findings)
+                    byFile.set(fnd.file, [...(byFile.get(fnd.file) ?? []), fnd]);
+                const kept = [];
+                let refuted = 0;
+                for (const [rel, fs2] of byFile) {
+                    const out = await filterFindingsForFile(root, rel, fs2, tsVocab);
+                    kept.push(...out.kept.map((f) => ({ ...f, lane: 'facts+reaching-defs' })));
+                    refuted += out.removed.length;
+                }
+                // @implements A-SPEC-513.1 — Python takes the flow-sensitive lane directly: its facts
+                // extractor has no Python walk, but its CFG/DDG do (S-510.7), and the judgement above
+                // them is language-agnostic.
+                const pyVocab = vocabularyFor('x.py');
+                if (pythonFiles.length > 0) {
+                    const { parseAst } = require('../cpg/foundation/ast-store');
+                    const { cfgOf, functionsIn } = require('../cpg/foundation/cfg');
+                    const { ddgOf } = require('../cpg/foundation/ddg');
+                    const { flowSensitiveTaint } = require('../rtm/flow-sensitive-taint');
+                    for (const rel of pythonFiles) {
+                        let src;
+                        try {
+                            src = fs.readFileSync(path.join(root, rel), 'utf8');
+                        }
+                        catch {
+                            continue;
+                        }
+                        const ast = await parseAst(src, rel);
+                        if (!ast || ast.errorCount > 0)
+                            continue;
+                        for (const fn of functionsIn(ast)) {
+                            const fcfg = cfgOf(ast, fn, src);
+                            if ('unsupported' in fcfg)
+                                continue;
+                            const fddg = ddgOf(ast, fcfg, fn, src);
+                            if ('unsupported' in fddg)
+                                continue;
+                            const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: pyVocab });
+                            for (const f of r.findings)
+                                kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                        }
+                    }
+                }
+                return {
+                    ...base,
+                    dataFlow: {
+                        findings: kept,
+                        /** Findings the reaching-definition evidence positively refuted (dead or fully sanitized). */
+                        refutedByReachingDefs: refuted,
+                        limits: [...DATAFLOW_LIMITS],
+                        converged: raw.converged,
+                        truncated: raw.truncated,
+                        /** Which languages this run could actually judge, so a zero is readable. */
+                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, pythonFiles.length > 0 ? 'python' : null].filter(Boolean))],
+                    },
+                };
             }
             finally {
                 g.close();

package/dist/holmes/mcp/supervisor.d.ts

@@ -15,6 +15,30 @@ export declare function autoreloadEnabled(env: NodeJS.ProcessEnv): boolean;
  * question, which is worse than the staleness it was fixing.
  */
 export declare function shouldSwap(loaded: string, disk: string | undefined, inflight: number): boolean;
+export interface ResponseCounter {
+    /** How many JSON-RPC replies COMPLETED in this chunk. */
+    push(chunk: string): number;
+}
+/**
+ * Counts JSON-RPC replies by LINE, because a chunk is not a line.
+ *
+ * The previous rule — `line.startsWith('{') && line.includes('"id"')` applied to each stdout chunk —
+ * held only while replies were small. JSON-RPC puts `"id"` at the END of a reply object, so a 1.4MB
+ * response arrives as ~22 chunks of which the first begins with `{` but carries no `"id"`, and the
+ * last carries `"id"` but does not begin with `{`. Measured: zero decrements, `inflight` stuck at 1
+ * forever, and the child never replaced again — live, the server ran three commits behind across
+ * four rebuilds while the isolated supervisor swapped correctly every time.
+ *
+ * The root was an asymmetry inside this one file: the stdin direction already buffers into lines and
+ * only this direction did not. It is fixed here rather than by buffering the line, because holding a
+ * 1.4MB string purely to count it would allocate a second copy of something already relayed. Two
+ * bits and a three-character tail are all the decision needs.
+ *
+ * Pure and exported for the same reason `shouldSwap` is: the sibling of this bug (incrementing
+ * before deciding, A-SPEC-162) also passed every unit test and was caught only by a live probe.
+ * The predicate was testable and its caller was not, which is exactly where both defects lived.
+ */
+export declare function createResponseCounter(): ResponseCounter;
 /**
  * Runs the real server as a child and relays stdio, replacing the child when the build changes.
  *

package/dist/holmes/mcp/supervisor.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Supervisor = exports.AUTORELOAD_ENV = void 0;
 exports.autoreloadEnabled = autoreloadEnabled;
 exports.shouldSwap = shouldSwap;
+exports.createResponseCounter = createResponseCounter;
 // @implements A-SPEC-162
 const node_child_process_1 = require("node:child_process");
 const path = __importStar(require("node:path"));
@@ -66,6 +67,59 @@ function shouldSwap(loaded, disk, inflight) {
         return false;
     return inflight === 0;
 }
+const ID_NEEDLE = '"id"';
+// @implements A-SPEC-516.1
+/**
+ * Counts JSON-RPC replies by LINE, because a chunk is not a line.
+ *
+ * The previous rule — `line.startsWith('{') && line.includes('"id"')` applied to each stdout chunk —
+ * held only while replies were small. JSON-RPC puts `"id"` at the END of a reply object, so a 1.4MB
+ * response arrives as ~22 chunks of which the first begins with `{` but carries no `"id"`, and the
+ * last carries `"id"` but does not begin with `{`. Measured: zero decrements, `inflight` stuck at 1
+ * forever, and the child never replaced again — live, the server ran three commits behind across
+ * four rebuilds while the isolated supervisor swapped correctly every time.
+ *
+ * The root was an asymmetry inside this one file: the stdin direction already buffers into lines and
+ * only this direction did not. It is fixed here rather than by buffering the line, because holding a
+ * 1.4MB string purely to count it would allocate a second copy of something already relayed. Two
+ * bits and a three-character tail are all the decision needs.
+ *
+ * Pure and exported for the same reason `shouldSwap` is: the sibling of this bug (incrementing
+ * before deciding, A-SPEC-162) also passed every unit test and was caught only by a live probe.
+ * The predicate was testable and its caller was not, which is exactly where both defects lived.
+ */
+function createResponseCounter() {
+    let startsWithBrace = null;
+    let sawId = false;
+    let carry = '';
+    const reset = () => { startsWithBrace = null; sawId = false; carry = ''; };
+    return {
+        push(chunk) {
+            let counted = 0;
+            const parts = chunk.split('\n');
+            parts.forEach((part, i) => {
+                if (startsWithBrace === null) {
+                    const firstChar = part.trimStart().charAt(0);
+                    if (firstChar !== '')
+                        startsWithBrace = firstChar === '{';
+                }
+                // The carry covers a needle torn across the boundary; without it a reply whose `"id"` lands
+                // on a chunk seam is invisible to both chunks.
+                if (!sawId && (carry + part).includes(ID_NEEDLE))
+                    sawId = true;
+                if (i < parts.length - 1) {
+                    if (startsWithBrace === true && sawId)
+                        counted++;
+                    reset(); // the line ended; nothing carries into the next
+                }
+                else {
+                    carry = part.slice(-(ID_NEEDLE.length - 1));
+                }
+            });
+            return counted;
+        },
+    };
+}
 /**
  * Runs the real server as a child and relays stdio, replacing the child when the build changes.
  *
@@ -160,15 +214,18 @@ class Supervisor {
         });
         child.stderr.on('data', (d) => process.stderr.write(d));
         this.child = child;
+        // @implements A-SPEC-516.1 — one counter per child: a half-read line from the process being
+        // replaced must not be finished by its successor's first chunk.
+        const counter = createResponseCounter();
         child.stdout.on('data', (d) => {
             const text = d.toString();
-            // Count replies out so `inflight` returns to zero; the id itself does not matter here, only
-            // that a response arrived for something that was counted in.
-            for (const line of text.split('\n')) {
-                if (line.trim().startsWith('{') && line.includes('"id"') && this.inflight > 0)
-                    this.inflight--;
-            }
+            // Relay FIRST. Counting is an observation and must never delay or alter the bytes.
             stdout.write(text);
+            // Count replies out so `inflight` returns to zero; the id itself does not matter here, only
+            // that a response arrived for something that was counted in. Never below zero — a negative
+            // count would let a swap happen mid-request, which is the mis-delivered answer this whole
+            // mechanism defers swaps to avoid.
+            this.inflight = Math.max(0, this.inflight - counter.push(text));
         });
     }
     stop() {

package/dist/holmes/mcp/tool-schemas.js

@@ -182,7 +182,14 @@ exports.TOOL_SCHEMAS = {
         description: 'Call-graph taint REACHABILITY screen: source-named functions (getenv/argv/req.body/…) that reach sink-named functions (exec/eval/query/…) through call edges. Returns { kind:"call-reachability", limits, maxPaths, truncated, pairs } where each pair is a source→sink candidate call path. This is a SCREENING signal that routes a security review — NOT a data-flow proof and NOT a vulnerability verdict (no def-use, no sanitizers, name-based matching, call-edge-only, as the limits state).',
         inputSchema: {
             type: 'object',
-            properties: { root: ROOT },
+            properties: {
+                root: ROOT,
+                // @implements A-SPEC-512.2 — opt-in def-use lane (measured +7.6s on a 500-file repo), the
+                // same shape `cpg_scan lints` uses. Adds `dataFlow: { findings, refutedByReachingDefs,
+                // limits }`: source→sink flows recovered from definitions and uses, with findings the
+                // reaching-definition evidence refutes (dead or fully sanitized values) removed.
+                dataFlow: { type: 'boolean', description: 'Also run the def-use data-flow lane (slower). Adds a `dataFlow` section with reaching-definition-filtered findings.' },
+            },
             required: ['root'],
         },
     },

package/dist/holmes/project/root.d.ts

@@ -1,4 +1,5 @@
 export declare function cleanSubprocessEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function cleanTestEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
  * Where a project begins, for a harness that must not require version control.
  *

package/dist/holmes/project/root.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.canonicalPath = exports.MARKER = void 0;
 exports.cleanSubprocessEnv = cleanSubprocessEnv;
+exports.cleanTestEnv = cleanTestEnv;
 exports.resolveProjectRoot = resolveProjectRoot;
 // @implements A-SPEC-205
 // @implements A-SPEC-128
@@ -56,6 +57,35 @@ function cleanSubprocessEnv(env = process.env) {
     }
     return cleaned;
 }
+// @implements A-SPEC-514.1
+/**
+ * The environment a TEST subprocess gets — the secret scrub plus the configuration that steers a
+ * project's own judgement.
+ *
+ * `cleanSubprocessEnv` removes secrets, and configuration is not a secret, which is exactly how
+ * `HOLMES_SPECS` reached jest. Measured 2026-09-02: `test_run` reported 1 failed / 2142 passed
+ * twice on a commit whose full suite was green, because the MCP server's `HOLMES_SPECS` reached
+ * the suite and `isGovernedProject` short-circuited on it. The recorded lesson until then was
+ * contamination masking RED as GREEN; this is the same root pointing the other way. Evidence that
+ * depends on the shell it was measured in is not evidence.
+ *
+ * The list is EXPLICIT rather than a `/^HOLMES_/` sweep. A prefix sweep would pass every test here
+ * and still take a variable some project's own suite needs — the same false red, from the other
+ * side.
+ *
+ * `HOLMES_GATE_BYPASS` is scrubbed too: the operator's out-of-band escape hatch leaking into an
+ * evidence run would disarm every test that verifies a gate, and that contamination masks red as
+ * green — the worse direction of the two.
+ */
+const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE']);
+function cleanTestEnv(env = process.env) {
+    const cleaned = cleanSubprocessEnv(env);
+    for (const k of Object.keys(cleaned)) {
+        if (TEST_SCRUB_KEYS.has(k.toUpperCase()))
+            delete cleaned[k];
+    }
+    return cleaned;
+}
 /** The marker directory that makes a directory a Holmes-Kit project. */
 exports.MARKER = '.ax';
 /**

package/dist/holmes/review/test-runner.d.ts

@@ -160,3 +160,18 @@ export declare function runGo(files: string[], mode: TestRunPlan['mode'], cwd: s
  * gate that ran part of its scope has verified less than it reports.
  */
 export declare function runTestScope(scope: TestScope, cwd: string): TestRunResult;
+export declare function tailOf(s: string, opts?: number | {
+    lines?: number;
+    maxChars?: number;
+}): string;
+/**
+ * The summary a green jest run always had — it was inside the `--json` payload rather than absent.
+ *
+ * jest writes its human summary to stderr, and the success branch reads stdout only, so the tail of
+ * a passing run carried no counts at all. The counts are right there in the JSON; this assembles
+ * them into the two lines a reader actually wanted.
+ *
+ * Returns null on anything it cannot read, and the caller falls back to the truncated original:
+ * a failed summary must not turn partial information into none.
+ */
+export declare function summarizeJestJson(stdout: string): string | null;