@holmes-lab/holmes-kit 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.5.0] - 2026-09-02
+
+The seven-language goal (GOAL-7langs) starts shipping: the L1 substrate now parses every
+officially supported language, and Go becomes the third language with a full, corpus-validated
+control- and data-flow story. Grades in the language matrix are still measurements, not goals —
+a cell moves only when a real corpus proves it.
+
+### Added
+
+- **L1 AST for all seven languages** (REQ-518): five more grammars join the vendored wasm
+  substrate — go 0.25.0, rust 0.24.0, java 0.23.5, c-sharp 0.23.5, cpp 0.23.4 — each ABI-probed
+  against web-tree-sitter 0.27.0 before pinning (5/5 load+parse). The expansion is five pins and
+  five extension mappings; no code changed, which was the design claim being tested. All 30
+  language fixtures parse with zero span violations. `.h` maps to the C++ grammar (near-superset;
+  a mis-parse surfaces as errorCount>0 and every layer above refuses on it).
+- **Go CFG/DDG/CDG** (REQ-519): Go joins the shared lowering with its semantics pinned by intent,
+  written from a full statement census over two corpora (2,637 functions, 22 statement types)
+  rather than from the grammar docs. No implicit switch fallthrough (an explicit `fallthrough`
+  links to the next case); a bare `for {}` is INFINITE — no phantom exhaustion edge behind the
+  `for { select {…} }` daemon idiom; a `select` without `default` blocks; `defer` is a
+  registration-point statement (its arguments evaluate there, per the Go spec); `goto` refuses
+  the whole function, fail-closed. Receivers and NAMED RESULTS are parameters.
+  **Measured over gin+cobra: 2,637/2,637 functions lowered, zero refusals, zero dominator/DDG/CDG
+  invariant violations, 19,975 REACHING_DEF and 4,633 CDG edges (parse 337ms, build 1.5s).**
+
+### Fixed
+
+- **The language matrix could contradict itself** (REQ-517): the missing-edge list in a
+  relations cell was a hardcoded literal next to a derived present-list, so after REQ-511 the
+  generated doc read "calls, inherits (no imports/inherits)" — inherits present and absent in one
+  breath. Both the missing list and the full/partial judgement now derive from
+  EXTRACTABLE_RELATIONS by set difference, and a property test bans the contradiction SHAPE
+  itself (no edge may appear on both sides, any language, any future widening).
+
 <!-- @implements A-SPEC-209 -->
 ## [0.4.1] - 2026-09-02
 

package/dist/.build-id

@@ -1 +1 @@
-2b427b6-mtj2vv29
+8f00a9a-mtjc55io

package/dist/holmes/cpg/foundation/ast-store.d.ts

@@ -1,7 +1,7 @@
 /** The honest language envelope: exactly what the vendored grammars cover — nothing more. */
 export declare const AST_LANGUAGES: ReadonlyArray<{
     ext: RegExp;
-    lang: 'typescript' | 'tsx' | 'python';
+    lang: 'typescript' | 'tsx' | 'python' | 'go' | 'rust' | 'java' | 'csharp' | 'cpp';
     wasm: string;
 }>;
 export interface AstNodeRow {

package/dist/holmes/cpg/foundation/ast-store.js

@@ -67,6 +67,14 @@ exports.AST_LANGUAGES = [
     { ext: /\.(ts|mts|cts)$/, lang: 'typescript', wasm: 'tree-sitter-typescript.wasm' },
     { ext: /\.(js|mjs|cjs|jsx)$/, lang: 'tsx', wasm: 'tree-sitter-tsx.wasm' }, // TS grammar family parses JS (decision 3: no separate JS grammar)
     { ext: /\.py$/, lang: 'python', wasm: 'tree-sitter-python.wasm' },
+    // @implements A-SPEC-518.1 — the five languages the goal opens. `.h` goes to the C++ grammar on
+    // purpose (H-SPEC-518): C++ is a near-superset of C and a mis-parse surfaces as errorCount>0,
+    // which every layer above refuses on — revisited against the P2-C++ corpus.
+    { ext: /\.go$/, lang: 'go', wasm: 'tree-sitter-go.wasm' },
+    { ext: /\.rs$/, lang: 'rust', wasm: 'tree-sitter-rust.wasm' },
+    { ext: /\.java$/, lang: 'java', wasm: 'tree-sitter-java.wasm' },
+    { ext: /\.cs$/, lang: 'csharp', wasm: 'tree-sitter-c_sharp.wasm' },
+    { ext: /\.(cpp|cc|cxx|hpp|h)$/, lang: 'cpp', wasm: 'tree-sitter-cpp.wasm' },
 ];
 const GRAMMARS_DIR = (() => {
     // src/holmes/cpg/foundation → three up is the package root; identical depth from dist.

package/dist/holmes/cpg/foundation/cfg.js

@@ -10,6 +10,8 @@ exports.FUNCTION_TYPES = new Set([
     'generator_function', 'arrow_function', 'method_definition', 'function',
     // @implements A-SPEC-510.7 — Python's function node joins the same census.
     'function_definition', 'lambda',
+    // @implements A-SPEC-519.1 — Go: methods and function literals (closures/goroutine bodies).
+    'method_declaration', 'func_literal',
 ]);
 const TS_SIMPLE = new Set([
     'expression_statement', 'lexical_declaration', 'variable_declaration', 'debugger_statement',
@@ -46,8 +48,29 @@ const PY_RULES = {
     ]),
     block: 'block',
 };
+// @implements A-SPEC-519.1 — Go, classified from the FULL statement census over two corpora
+// (2,637 functions, 22 types — evidence REQ-519), not from reading the grammar's docs.
+// `defer`/`go` are pass-through statements (defer's args evaluate at registration per the Go
+// spec; goroutine bodies are func_literals that functionsIn owns separately). `goto` is absent
+// on purpose: zero corpus occurrences, and fail-closed refusal is the honest treatment.
+const GO_SIMPLE = new Set([
+    'expression_statement', 'short_var_declaration', 'assignment_statement', 'var_declaration',
+    'const_declaration', 'type_declaration', 'inc_statement', 'dec_statement', 'send_statement',
+    'defer_statement', 'go_statement', 'empty_statement',
+]);
+const GO_RULES = {
+    simple: GO_SIMPLE,
+    handled: new Set([
+        ...GO_SIMPLE,
+        'block', 'statement_list', 'if_statement', 'for_statement',
+        'expression_switch_statement', 'type_switch_statement', 'select_statement',
+        'labeled_statement', 'break_statement', 'continue_statement', 'return_statement',
+        'fallthrough_statement',
+    ]),
+    block: 'block',
+};
 const LANG_RULES = {
-    typescript: TS_RULES, tsx: TS_RULES, python: PY_RULES,
+    typescript: TS_RULES, tsx: TS_RULES, python: PY_RULES, go: GO_RULES,
 };
 // @implements A-SPEC-510.6
 /**
@@ -91,6 +114,7 @@ function cfgOf(ast, fn, source) {
     }
     const rules = LANG_RULES[ast.lang];
     const isPython = ast.lang === 'python';
+    const isGo = ast.lang === 'go';
     const kids = childrenIndex(ast);
     // Points: one per lowered statement (block ids after coalescing). 0=ENTRY, 1=EXIT.
     const stmtsOf = [[], []];
@@ -151,6 +175,8 @@ function cfgOf(ast, fn, source) {
             switch (t) {
                 case 'statement_block':
                 case 'block':
+                case 'statement_list':
+                    // Go's block carries one extra statement_list layer (probed shape) — both are containers.
                     return lowerSeq(stmtChildren(i), ctx);
                 case 'labeled_statement': {
                     const [labelNode, inner] = [kids.of(i)[0], stmtChildren(i).at(-1)];
@@ -164,9 +190,18 @@ function cfgOf(ast, fn, source) {
                     // @implements A-SPEC-510.7 — Python spells the arms as fields (`consequence`,
                     // `alternative` = elif_clause | else_clause), TS as positional children. Reading the
                     // fields where they exist keeps ONE lowering for both grammars.
-                    const cons = isPython ? (kids.of(i).find((k) => ast.nodes[k].type === 'block') ?? named[1]) : named[1];
+                    // @implements A-SPEC-519.1 — Go: consequence is the FIRST block child; the alternative
+                    // (an else block or an else-if chain's if_statement) is the last named child when it is
+                    // distinct from the consequence. The header point owns the init (:=) and condition.
+                    const goCons = isGo ? kids.of(i).find((k) => ast.nodes[k].type === 'block') : undefined;
+                    const cons = isGo ? goCons : isPython ? (kids.of(i).find((k) => ast.nodes[k].type === 'block') ?? named[1]) : named[1];
                     let alt;
-                    if (isPython) {
+                    if (isGo) {
+                        const last = named.at(-1);
+                        if (last !== goCons && ['block', 'if_statement'].includes(ast.nodes[last].type))
+                            alt = last;
+                    }
+                    else if (isPython) {
                         const clause = kids.of(i).find((k) => ['elif_clause', 'else_clause'].includes(ast.nodes[k].type));
                         if (clause !== undefined) {
                             alt = ast.nodes[clause].type === 'elif_clause'
@@ -202,9 +237,14 @@ function cfgOf(ast, fn, source) {
                         ? kids.of(i).filter((k) => ast.nodes[k].type === 'else_clause')
                             .flatMap((k) => stmtChildren(k)).find((k) => ast.nodes[k].type === 'block')
                         : undefined;
-                    const bodyIdx = isPython
+                    const bodyIdx = (isPython || isGo)
                         ? kids.of(i).filter((k) => ast.nodes[k].type === 'block').at(0)
                         : stmtChildren(i).at(-1);
+                    // @implements A-SPEC-519.1 — a bare Go `for {}` (no named non-block child) is INFINITE:
+                    // no exhaustion edge. `for { select {…} }` is the daemon idiom, and a phantom false edge
+                    // would hang spurious control dependence on everything after the loop. A for_clause with
+                    // an empty condition keeps the edge (documented over-approximation).
+                    const goInfinite = isGo && !kids.of(i).some((k) => ast.nodes[k].named && ast.nodes[k].type !== 'block' && ast.nodes[k].type !== 'comment');
                     const myBreak = { label, target: -1 }; // ONE owner: labeled and bare breaks share it
                     ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
                     ctx.contT.push({ label, target: header }, { label: null, target: header });
@@ -220,7 +260,7 @@ function cfgOf(ast, fn, source) {
                         link(header, ef.entry, 'false'); // exhaustion path enters `else`
                         exits.push(...ef.exits);
                     }
-                    else {
+                    else if (!goInfinite) {
                         exits.push({ from: header, kind: 'false' });
                     }
                     // break targets resolved lazily: edges recorded with target -1 fixed by caller — instead
@@ -282,6 +322,98 @@ function cfgOf(ast, fn, source) {
                         throw new Unsupported('with_statement without a block');
                     return lowerStmt(body, ctx);
                 }
+                // @implements A-SPEC-519.1 — Go's two switch forms. NO implicit fallthrough (each case
+                // leaves the switch), an explicit fallthrough_statement links to the NEXT case's entry,
+                // and a missing default leaves a header escape (no case matched). The binding of a type
+                // switch (`switch v := x.(type)`) lives on the header point, where the DDG collects it.
+                case 'expression_switch_statement':
+                case 'type_switch_statement': {
+                    const p = newPoint(i);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    const caseNodes = kids.of(i).filter((k) => ['expression_case', 'type_case', 'default_case'].includes(ast.nodes[k].type));
+                    let sawDefault = false;
+                    const exits = [];
+                    let pendingFalls = [];
+                    caseNodes.forEach((c, ci) => {
+                        if (ast.nodes[c].type === 'default_case')
+                            sawDefault = true;
+                        const bodyList = kids.of(c).find((k) => ast.nodes[k].type === 'statement_list');
+                        const stmts = bodyList === undefined ? [] : stmtChildren(bodyList);
+                        const fallIdx = stmts.filter((k) => ast.nodes[k].type === 'fallthrough_statement');
+                        const rest = stmts.filter((k) => ast.nodes[k].type !== 'fallthrough_statement');
+                        const cf = lowerSeq(rest, ctx);
+                        link(p, cf.entry, ast.nodes[c].type === 'default_case' ? 'default' : 'case');
+                        for (const f of pendingFalls)
+                            link(f, cf.entry, 'seq');
+                        pendingFalls = [];
+                        if (fallIdx.length > 0) {
+                            // The census shows fallthrough only as a case's LAST statement; a next case must
+                            // exist (its absence is a Go compile error) — refuse honestly if it does not.
+                            if (ci === caseNodes.length - 1)
+                                throw new Unsupported('fallthrough in last case');
+                            const fp = newPoint(fallIdx[0]);
+                            for (const e of cf.exits)
+                                link(e.from, fp, e.kind);
+                            pendingFalls.push(fp);
+                        }
+                        else {
+                            exits.push(...cf.exits);
+                        }
+                    });
+                    if (!sawDefault)
+                        exits.push({ from: p, kind: 'default' });
+                    ctx.breakT.splice(-2);
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: p, exits };
+                }
+                // @implements A-SPEC-519.1 — select: each communication case is a branch off the header;
+                // WITHOUT a default the statement BLOCKS until some case fires, so there is no "no arm
+                // matched" escape (the opposite of Python's match).
+                case 'select_statement': {
+                    const p = newPoint(i);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    let sawDefault = false;
+                    const exits = [];
+                    for (const c of kids.of(i)) {
+                        const cty = ast.nodes[c].type;
+                        if (cty !== 'communication_case' && cty !== 'default_case')
+                            continue;
+                        if (cty === 'default_case')
+                            sawDefault = true;
+                        const comm = kids.of(c).find((k) => ['receive_statement', 'send_statement', 'expression_statement'].includes(ast.nodes[k].type));
+                        const bodyList = kids.of(c).find((k) => ast.nodes[k].type === 'statement_list');
+                        const stmts = bodyList === undefined ? [] : stmtChildren(bodyList);
+                        let entry;
+                        let head;
+                        if (comm !== undefined) {
+                            const cp = newPoint(comm);
+                            entry = cp;
+                            head = { entry: cp, exits: [{ from: cp, kind: 'seq' }] };
+                        }
+                        else {
+                            head = undefined;
+                            entry = -1;
+                        }
+                        const bf = lowerSeq(stmts, ctx);
+                        if (head !== undefined) {
+                            for (const e of head.exits)
+                                link(e.from, bf.entry, e.kind);
+                        }
+                        else {
+                            entry = bf.entry;
+                        }
+                        link(p, entry, cty === 'default_case' ? 'default' : 'case');
+                        exits.push(...bf.exits);
+                    }
+                    if (sawDefault) { /* a ready default gives an immediate path — covered by its case edge */ }
+                    ctx.breakT.splice(-2);
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: p, exits };
+                }
                 case 'raise_statement': {
                     const p = newPoint(i);
                     link(p, ctx.catchT.at(-1) ?? EXIT, 'throw');

package/dist/holmes/cpg/foundation/ddg.js

@@ -6,12 +6,16 @@ exports.ddgViolations = ddgViolations;
 const cfg_1 = require("./cfg");
 /** Identifier positions that are DEF sites, keyed by the parent node type. */
 const PATTERN_TYPES = new Set(['object_pattern', 'array_pattern', 'shorthand_property_identifier_pattern',
-    'pair_pattern', 'rest_pattern', 'assignment_pattern']);
+    'pair_pattern', 'rest_pattern', 'assignment_pattern',
+    // @implements A-SPEC-519.1 — Go: an expression_list on a binding LHS carries the def context
+    // through to each identifier (`a, b := …`, `for i, v := range …`).
+    'expression_list']);
 function defUseOf(ast, cfg, fn, source) {
     const kids = (0, cfg_1.childrenIndex)(ast);
     const text = (i) => source.slice(ast.nodes[i].start, ast.nodes[i].end);
     // ── parameters: ENTRY defs (and part of the local namespace).
     const isPython = ast.lang === 'python';
+    const isGo = ast.lang === 'go';
     const params = new Map();
     const bareArrow = ast.nodes[fn.nodeIndex].type === 'arrow_function'
         && !kids.of(fn.nodeIndex).some((k) => ast.nodes[k].type === 'formal_parameters');
@@ -19,7 +23,11 @@ function defUseOf(ast, cfg, fn, source) {
         // Only formal_parameters — a declaration's NAME identifier is not a parameter (measured: the
         // early break on the name swallowed every real parameter of named functions).
         // @implements A-SPEC-510.7 — Python's parameter list node is `parameters`.
-        const isParamList = ast.nodes[k].type === 'formal_parameters' || ast.nodes[k].type === 'parameters';
+        // @implements A-SPEC-519.1 — Go's list node is `parameter_list`, and it appears up to THREE
+        // times on one declaration: receiver, parameters, NAMED RESULTS. All of them bind names at
+        // ENTRY, so Go must not break after the first (the probe pinned the second-list shape).
+        const isParamList = ast.nodes[k].type === 'formal_parameters' || ast.nodes[k].type === 'parameters'
+            || ast.nodes[k].type === 'parameter_list';
         if (!isParamList && !(bareArrow && ast.nodes[k].type === 'identifier'))
             continue;
         const collect = (n) => {
@@ -32,7 +40,7 @@ function defUseOf(ast, cfg, fn, source) {
                 collect(c);
         };
         collect(k);
-        if (isParamList)
+        if (isParamList && !isGo)
             break;
     }
     const defs = new Map();
@@ -65,7 +73,97 @@ function defUseOf(ast, cfg, fn, source) {
             }
             if (ty === 'property_identifier' || ty === 'statement_identifier' || ty === 'type_identifier')
                 return;
+            // @implements A-SPEC-519.1 — Go: a selector's field, a package qualifier and a label are
+            // names in other namespaces, never local value reads.
+            if (ty === 'field_identifier' || ty === 'package_identifier' || ty === 'label_name')
+                return;
             switch (ty) {
+                // @implements A-SPEC-519.1 — Go's binding shapes, written from the probed grammar.
+                case 'short_var_declaration': {
+                    // `a, b := e1, e2` — every LHS identifier is a def; the RHS list is uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walk(named[0], true);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'assignment_statement': {
+                    // `x = e` defs x; `x += e` defs AND uses it. No fields survive persistence, so the
+                    // operator is read from the unnamed token between the two expression_lists.
+                    const all = kids.of(n);
+                    const named = all.filter((c) => ast.nodes[c].named);
+                    const op = all.find((c) => !ast.nodes[c].named && text(c).endsWith('='));
+                    const compound = op !== undefined && text(op) !== '=';
+                    const lhs = named[0];
+                    if (lhs !== undefined) {
+                        for (const el of ast.nodes[lhs].type === 'expression_list' ? kids.of(lhs).filter((c) => ast.nodes[c].named) : [lhs]) {
+                            if (ast.nodes[el].type === 'identifier') {
+                                add(defs, stmt, text(el));
+                                if (compound)
+                                    add(uses, stmt, text(el));
+                            }
+                            else
+                                walk(el, false); // a.b / a[i] mutation: uses only
+                        }
+                    }
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'var_spec':
+                case 'const_spec': {
+                    // `var x, y T = e1, e2` — identifier children are defs, the value list is uses.
+                    for (const c of kids.of(n)) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
+                case 'inc_statement':
+                case 'dec_statement': {
+                    const arg = kids.of(n).find((c) => ast.nodes[c].named);
+                    if (arg !== undefined && ast.nodes[arg].type === 'identifier') {
+                        add(defs, stmt, text(arg));
+                        add(uses, stmt, text(arg));
+                    }
+                    else if (arg !== undefined)
+                        walk(arg, false);
+                    return;
+                }
+                case 'range_clause':
+                case 'receive_statement': {
+                    // `for i, v := range xs` / `case v := <-ch` — LHS binds, RHS is read. With `=` instead
+                    // of `:=` the LHS identifiers are still (re)defined; the same treatment holds.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named.length >= 2) {
+                        walk(named[0], true);
+                        for (const r of named.slice(1))
+                            walk(r, false);
+                    }
+                    else {
+                        for (const r of named)
+                            walk(r, false); // bare `for range xs` / `<-ch`
+                    }
+                    return;
+                }
+                case 'type_switch_statement': {
+                    // `switch v := x.(type)` — v defs at the header; everything else is uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const hasBind = kids.of(n).some((c) => !ast.nodes[c].named && text(c) === ':=');
+                    if (hasBind && named[0] !== undefined && ast.nodes[named[0]].type === 'expression_list') {
+                        walk(named[0], true);
+                        for (const r of named.slice(1))
+                            walk(r, false);
+                    }
+                    else {
+                        for (const r of named)
+                            walk(r, false);
+                    }
+                    return;
+                }
                 // @implements A-SPEC-510.7 — Python's assignment shapes.
                 case 'assignment': {
                     const named = kids.of(n).filter((c) => ast.nodes[c].named);

package/dist/holmes/cpg/foundation/language-matrix.js

@@ -43,9 +43,16 @@ function relationsCell(ext) {
     if (resolved.length === 0)
         return { support: 'none', basis: 'nothing reaches the graph' };
     // A-SPEC-286: the claim is made in the graph-resolved column, never the scanner's raw output.
-    return resolved.length >= 3
+    // @implements A-SPEC-517.1 — the MISSING list is derived from the same authority as the present
+    // list. It used to be the literal `(no imports/inherits)` next to a derived present-list, so when
+    // REQ-511 widened graphResolved the doc read "calls, inherits (no imports/inherits)" — inherits
+    // present and absent in one breath. The `>= 3` magic number was the same sin (a hardcoded "the
+    // full set has three kinds"); judging by set difference keeps both halves true if
+    // EXTRACTABLE_RELATIONS ever widens.
+    const missing = language_capability_1.EXTRACTABLE_RELATIONS.filter((r) => !resolved.includes(r));
+    return missing.length === 0
         ? { support: 'full', basis: `graph edges: ${resolved.join(', ')}` }
-        : { support: 'partial', basis: `graph edges: ${resolved.join(', ')} (no imports/inherits)` };
+        : { support: 'partial', basis: `graph edges: ${resolved.join(', ')} (no ${missing.join('/')})` };
 }
 function astCell(astLang) {
     // The TS grammar family covers tsx/js too — AST_LANGUAGES is the authority on which wasm applies.

package/grammars/manifest.json

@@ -18,6 +18,36 @@
       "package": "tree-sitter-python",
       "packageVersion": "0.25.0",
       "sha256": "16108b50df4ee9a30168794252ab55e7c93bfc5765d7fa0aa3e335752c515f47"
+    },
+    {
+      "file": "tree-sitter-go.wasm",
+      "package": "tree-sitter-go",
+      "packageVersion": "0.25.0",
+      "sha256": "9504573f352b20be7f2f1911754d710622aedc15afff16d5ed8fb5645681aee7"
+    },
+    {
+      "file": "tree-sitter-rust.wasm",
+      "package": "tree-sitter-rust",
+      "packageVersion": "0.24.0",
+      "sha256": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57"
+    },
+    {
+      "file": "tree-sitter-java.wasm",
+      "package": "tree-sitter-java",
+      "packageVersion": "0.23.5",
+      "sha256": "4fdeac4ca6ca089f06c6f7e562abcac1733cd465728cc7031ebb73c2019122c4"
+    },
+    {
+      "file": "tree-sitter-c_sharp.wasm",
+      "package": "tree-sitter-c-sharp",
+      "packageVersion": "0.23.5",
+      "sha256": "6f69e1cae44e1c32c1eccc170dc5a9778fb94ff716f71113fe1f8c4299aa2f40"
+    },
+    {
+      "file": "tree-sitter-cpp.wasm",
+      "package": "tree-sitter-cpp",
+      "packageVersion": "0.23.4",
+      "sha256": "174eb0deb75b2ec7881bcacda9f995648d8e683956e5c2267e69ab6dc503fcbf"
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",