@holmes-lab/holmes-kit 0.8.1 → 0.10.0

package/dist/holmes/mcp/elicit-approval.d.ts

@@ -20,6 +20,15 @@
  */
 /** Approval kinds that may ask in-session. Widening this set is a spec revision, not a drive-by. */
 export declare const ELICITABLE_KINDS: ReadonlySet<string>;
+/**
+ * @implements A-SPEC-540.1
+ * True when the operator has opted OUT of in-client elicitation via `HOLMES_ELICIT`. Then the server
+ * folds every elicitation to `silent` (refuse+enqueue) — the same path a client that never advertised
+ * the capability takes — so claude/agy/codex converge on ONE out-of-band decision surface
+ * (`holmes-kit approve`) instead of depending on each client's prompt rendering. Unset, or any
+ * non-disabling value, keeps elicitation ON — byte-identical to before.
+ */
+export declare function elicitationDisabled(env: NodeJS.ProcessEnv): boolean;
 export interface ElicitApprovalRequest {
     kind: string;
     target: string;

package/dist/holmes/mcp/elicit-approval.js

@@ -2,6 +2,7 @@
 // @implements A-SPEC-263.1
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_PRESENTATIONS = exports.ELICIT_TIMEOUT_MS = exports.ELICITABLE_KINDS = void 0;
+exports.elicitationDisabled = elicitationDisabled;
 exports.elicitTimeoutMsFor = elicitTimeoutMsFor;
 exports.classifyElicitError = classifyElicitError;
 exports.expiredNotice = expiredNotice;
@@ -31,6 +32,20 @@ exports.interpretElicitResult = interpretElicitResult;
  */
 /** Approval kinds that may ask in-session. Widening this set is a spec revision, not a drive-by. */
 exports.ELICITABLE_KINDS = new Set(['spec-approve', 'review-resolve']);
+/** The `HOLMES_ELICIT` values that turn the in-client prompt OFF. */
+const ELICIT_DISABLED_TOKENS = new Set(['off', '0', 'false', 'no', 'disabled']);
+/**
+ * @implements A-SPEC-540.1
+ * True when the operator has opted OUT of in-client elicitation via `HOLMES_ELICIT`. Then the server
+ * folds every elicitation to `silent` (refuse+enqueue) — the same path a client that never advertised
+ * the capability takes — so claude/agy/codex converge on ONE out-of-band decision surface
+ * (`holmes-kit approve`) instead of depending on each client's prompt rendering. Unset, or any
+ * non-disabling value, keeps elicitation ON — byte-identical to before.
+ */
+function elicitationDisabled(env) {
+    const v = env.HOLMES_ELICIT;
+    return typeof v === 'string' && ELICIT_DISABLED_TOKENS.has(v.trim().toLowerCase());
+}
 /**
  * The lock-holding path's timeout truth (and the stage-2 reason dialog's): review-resolve holds
  * the findings-ledger lock while the dialog waits, so its ceiling never grows (REQ-497 기아 방지).

package/dist/holmes/mcp/handlers.d.ts

@@ -158,6 +158,85 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         dependents: string[];
         reason?: undefined;
     }>;
+    /**
+     * @implements A-SPEC-538.1
+     * The inverse of spec_approve: returns a SEALED (approved) spec to an editable `draft`, clearing
+     * `approved_digest` and `parent_digests` in ONE act, and records `spec-unsealed`. Hand-editing
+     * only `status` leaves seal residue that later trips validation; this atomizes the reverse.
+     *
+     * Un-sealing WITHDRAWS a seal, so — like retiring a sealed document — it demands a covering
+     * out-of-band HOLMES_APPROVAL (fail-closed): un-sealing an approved T-SPEC removes the code
+     * gate's demand, so an unguarded un-seal would be an approval bypass. And it refuses when an
+     * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
+     * drift detection compares against — would silently go stale.
+     */
+    spec_unseal(a: {
+        root?: string;
+        id: string;
+    }): Promise<{
+        ok: boolean;
+        reason: string;
+        unsealed?: undefined;
+        id?: undefined;
+        dependents?: undefined;
+    } | {
+        ok: boolean;
+        unsealed: boolean;
+        id: string;
+        dependents: never[];
+        reason: string;
+    } | {
+        ok: boolean;
+        unsealed: boolean;
+        id: string;
+        dependents: string[];
+        reason?: undefined;
+    }>;
+    /**
+     * @implements A-SPEC-538.2
+     * Read-only: report a spec's approval/seal state — sealed?, approved_digest, each parent's seal
+     * state, and the concrete blockers still standing between it and approval — so a caller need not
+     * parse files to ask "what is the approval state right now". Reuses `sealOf` and `approvalBlockers`
+     * (the same predicates the code gate and spec_approve read) so the report cannot drift from the
+     * acts it describes. No writes, no ledger append.
+     */
+    approval_status(a: {
+        root?: string;
+        id: string;
+    }): Promise<{
+        ok: boolean;
+        reason: string;
+    } | {
+        id: string;
+        type?: string;
+        status: string;
+        sealed: boolean;
+        approvedDigest?: string;
+        parents: import("../spec/approval-status").ParentApproval[];
+        blockers: string[];
+        ok: boolean;
+        reason?: undefined;
+    }>;
+    /**
+     * @implements A-SPEC-538.3
+     * Read-only: return the provenance ledger's events in time order (optionally narrowed to one
+     * spec) so the governance history — approved / unsealed / retired / review-needed … — is legible
+     * at a glance without reading raw JSONL. Reuses FileLedgerStore.loadAll(); the ordering/filtering/
+     * projection is the pure `timelineFrom`. No writes. An absent ledger is an empty history, not an
+     * error.
+     */
+    ledger_timeline(a: {
+        root?: string;
+        id?: string;
+    }): Promise<{
+        ok: boolean;
+        reason: string;
+        events?: undefined;
+    } | {
+        ok: boolean;
+        events: import("../governance/ledger-timeline").TimelineEntry[];
+        reason?: undefined;
+    }>;
     spec_approve(a: {
         root?: string;
         id: string;
@@ -165,12 +244,21 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         ok: boolean;
         reason: string;
         findings?: undefined;
+        conflict?: undefined;
         approved?: undefined;
         digest?: undefined;
     } | {
         ok: boolean;
         reason: string;
         findings: import("../spec/validator").Finding[];
+        conflict?: undefined;
+        approved?: undefined;
+        digest?: undefined;
+    } | {
+        ok: boolean;
+        reason: string;
+        conflict: import("../spec/version-conflict").ConflictDetail;
+        findings?: undefined;
         approved?: undefined;
         digest?: undefined;
     } | {
@@ -179,6 +267,7 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         ok?: undefined;
         reason?: undefined;
         findings?: undefined;
+        conflict?: undefined;
     }>;
     spec_list(a: any): Promise<{
         specs: {
@@ -347,7 +436,25 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         head?: string;
         since?: string;
         mark?: string;
+        mutate?: string;
     }): Promise<{
+        mutate: {
+            tspec: string;
+            aspec: string | undefined;
+            coveringFiles: string[];
+            results: ({
+                mutation: import("../spec/kills").Mutation;
+                applied: boolean;
+                reason: string;
+            } | {
+                applied: boolean;
+                verdict?: "killed" | "survived";
+                mutation: import("../spec/kills").Mutation;
+                reason?: undefined;
+            })[];
+            survivors: import("../spec/kills").Mutation[];
+        };
+    } | {
         baselineRecorded?: string | undefined;
         scopeFallback?: "full" | undefined;
         tier: import("../rtm/test-scope").RegressionTier;
@@ -359,6 +466,7 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         tail: string;
         unresolvedFiles: string[];
         changeSource: ChangeSourceInfo;
+        mutate?: undefined;
     }>;
     issue_localize(a: {
         root: string;

package/dist/holmes/mcp/handlers.js

@@ -68,7 +68,10 @@ const rtm_check_1 = require("../rtm/rtm-check");
 const test_scope_1 = require("../rtm/test-scope");
 const gap_analyzer_1 = require("../rtm/gap-analyzer");
 const test_runner_1 = require("../review/test-runner");
+const kills_1 = require("../spec/kills");
+const mutate_1 = require("../review/mutate");
 const test_evidence_1 = require("../review/test-evidence");
+const test_outcomes_1 = require("../review/test-outcomes");
 const localize_1 = require("../rtm/localize");
 const maintenance_analyze_1 = require("./maintenance-analyze");
 const maintenance_evidence_1 = require("./maintenance-evidence");
@@ -90,6 +93,53 @@ const root_1 = require("../project/root");
 // under that tree stopped at the minted marker. This is the harm §8 closed for `review_record`,
 // left open on the scan path. When the store is bound, the cache is the bound project's; otherwise
 // only an anchored answer may be written to, and an unanchored one falls back to a temp cache.
+// @implements A-SPEC-534.8
+// The governed source file a `kills` mutation targets: one that @implements the A-SPEC AND contains
+// the `where` literal. Bounded walk, skips vendored/test/hidden dirs. null when none qualifies.
+function sourceFileWithMutation(root, aspecId, where) {
+    if (!where)
+        return null;
+    const SOURCE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|cs|rb|php|swift)$/;
+    let found = null;
+    const walk = (d) => {
+        if (found)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (found)
+                return;
+            if (e.name === 'node_modules' || e.name === 'dist' || e.name === 'reference'
+                || e.name === 'vendor' || e.name === 'third_party' || e.name.startsWith('.'))
+                continue;
+            const p = path.join(d, e.name);
+            if (e.isDirectory()) {
+                walk(p);
+                continue;
+            }
+            if (!SOURCE.test(e.name) || /\.test\./.test(e.name))
+                continue;
+            let text;
+            try {
+                text = fs.readFileSync(p, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (text.includes(`@implements ${aspecId}`) && text.includes(where)) {
+                found = p;
+                return;
+            }
+        }
+    };
+    walk(root);
+    return found;
+}
 const cacheDirFor = (root) => {
     const r = (0, root_2.resolveProjectRoot)(root);
     if (r.marker !== 'given')
@@ -139,6 +189,9 @@ const spec_digest_1 = require("../spec/spec-digest");
 const spec_store_2 = require("../spec/spec-store");
 const breaking_change_1 = require("../spec/breaking-change");
 const approval_blockers_1 = require("../spec/approval-blockers");
+const approval_status_1 = require("../spec/approval-status");
+const ledger_timeline_1 = require("../governance/ledger-timeline");
+const version_conflict_1 = require("../spec/version-conflict");
 const ledger_store_1 = require("../governance/ledger-store");
 const provenance_chain_1 = require("../governance/provenance-chain");
 const ledger_lock_1 = require("../governance/ledger-lock");
@@ -653,6 +706,11 @@ function makeRawHandlers(store, opts) {
     // stays byte-identical to the pre-elicitation one — nothing is ever worse than before the
     // channel existed.
     const tryElicit = async (kind, target, summary) => {
+        // @implements A-SPEC-540.1 — operator opt-out: with HOLMES_ELICIT=off the server never shows the
+        // in-client prompt, folding to the byte-identical `silent` (refuse+enqueue) path so claude/agy/
+        // codex all converge on one out-of-band surface (holmes-kit approve). Unset ⇒ unchanged.
+        if ((0, elicit_approval_1.elicitationDisabled)(process.env))
+            return { kind: 'silent' };
         if (!opts?.elicit || !elicit_approval_1.ELICITABLE_KINDS.has(kind))
             return { kind: 'silent' };
         try {
@@ -1124,6 +1182,146 @@ function makeRawHandlers(store, opts) {
             });
             return { ok: true, retired: true, id: a.id, dependents: dependents.map((s) => s.id) };
         },
+        /**
+         * @implements A-SPEC-538.1
+         * The inverse of spec_approve: returns a SEALED (approved) spec to an editable `draft`, clearing
+         * `approved_digest` and `parent_digests` in ONE act, and records `spec-unsealed`. Hand-editing
+         * only `status` leaves seal residue that later trips validation; this atomizes the reverse.
+         *
+         * Un-sealing WITHDRAWS a seal, so — like retiring a sealed document — it demands a covering
+         * out-of-band HOLMES_APPROVAL (fail-closed): un-sealing an approved T-SPEC removes the code
+         * gate's demand, so an unguarded un-seal would be an approval bypass. And it refuses when an
+         * APPROVED spec depends on the target, because that dependent's `parent_digests` — the snapshot
+         * drift detection compares against — would silently go stale.
+         */
+        async spec_unseal(a) {
+            const all = await store.list();
+            if (all.filter((s) => s.id === a.id).length > 1) {
+                return {
+                    ok: false,
+                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본이 진본인지 도구가 고를 수 없어 봉인 해제 전에 거부합니다.`,
+                };
+            }
+            const cur = await store.read(a.id);
+            if (!cur) {
+                const dir = store.specsRoot;
+                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
+                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
+            }
+            const spec = cur.spec;
+            if (!spec.type) {
+                return {
+                    ok: false,
+                    reason: `${a.id}에는 \`type:\` 선언이 없습니다(구형식 문서) — 어느 폴더에 속하는지 알 수 없어 봉인 해제할 수 없습니다.`
+                        + ` 먼저 spec_upgrade({ id: "${a.id}" })로 형식을 올린 뒤 다시 시도하십시오.`,
+                };
+            }
+            // Sealed ⇔ carries approved_digest. Un-sealing an already-draft spec writes NOTHING (a second
+            // un-seal is history, not graffiti) — mirrors spec_retire's idempotent no-op.
+            const sealed = typeof spec.frontmatter.approved_digest === 'string';
+            if (!sealed) {
+                return { ok: true, unsealed: false, id: a.id, dependents: [], reason: `${a.id}은(는) 이미 미봉인(draft) 상태입니다` };
+            }
+            const approvalRaw = process.env.HOLMES_APPROVAL;
+            let approval;
+            try {
+                approval = approvalRaw ? JSON.parse(approvalRaw) : undefined;
+            }
+            catch {
+                approval = undefined;
+            }
+            const resolved = resolveHandlerApproval(a.root, store, approval, { kind: 'spec-approve', target: a.id }, new Date().toISOString());
+            if (resolved === undefined) {
+                return {
+                    ok: false,
+                    reason: `${a.id}은(는) 봉인된 문서입니다 — 봉인 해제는 이 행위를 덮는 유효한 대역외 HOLMES_APPROVAL 이 필요합니다.`
+                        + ' 봉인을 해제하면 코드 게이트가 요구하던 approved 스펙의 봉인이 사라지므로, 해제가 승인 우회 경로가 되지 않도록 fail-closed 로 막습니다.'
+                        + ' (범위를 쓰면 kind "spec-approve")'
+                        + refusalQueueHint(a.root, store, { kind: 'spec-approve', target: a.id, why: '봉인된 스펙의 해제' }),
+                };
+            }
+            // @implements A-SPEC-245 — a grant that authorized breaking a seal is spent by it.
+            if (resolved.source === 'grant' && resolved.root && resolved.approval.nonce) {
+                (0, approval_grants_1.consumeGrantFile)(resolved.root, resolved.approval.nonce);
+            }
+            const dependents = all.filter((s) => s.id !== a.id && s.dependsOn.includes(a.id));
+            const blocking = dependents.filter((s) => s.status === 'approved').map((s) => s.id);
+            if (blocking.length > 0) {
+                return {
+                    ok: false,
+                    reason: `${a.id}의 봉인을 해제하면 approved 문서 ${blocking.join(', ')}의 parent_digests 가 stale 이 됩니다 — 지금 그 사슬을 지탱하고 있으므로 거부합니다.`
+                        + ' 해당 문서를 먼저 해제/폐기하거나 부모를 다른 문서로 옮기십시오.',
+                };
+            }
+            // Destination BEFORE the write (A-SPEC-188 order): a resolution failure leaves nothing behind.
+            const dest = resolveLedgerRoot(a.root);
+            if (!dest.ok)
+                return { ok: false, reason: dest.reason };
+            const ledgerRoot = dest.root;
+            const fm = { ...spec.frontmatter };
+            delete fm.approved_digest; // the seal this act withdraws
+            delete fm.parent_digests;
+            try {
+                await store.write({ ...spec, status: 'draft', frontmatter: fm }, { expectedVersion: cur.version });
+            }
+            catch (e) {
+                if (e instanceof spec_store_2.SpecVersionConflictError) {
+                    return { ok: false, reason: `봉인 해제 진행 중 ${a.id}이(가) 바뀌었습니다 — 확인 후 다시 시도하십시오. 이번 해제는 아무것도 쓰지 않았습니다.` };
+                }
+                throw e;
+            }
+            new ledger_store_1.FileLedgerStore(path.join(ledgerRoot, '.ax', 'ledger')).append({
+                ts: new Date().toISOString(),
+                actor: approval?.actor ?? 'unattributed',
+                kind: 'spec-unsealed',
+                summary: `unsealed ${a.id}`,
+                inputs: [a.id],
+                rationale: approval?.rationale ?? 'unsealed',
+                ...(approval ? { authorization: (0, provenance_chain_1.authorizationRef)(approval.actor, approval.token) } : {}),
+            });
+            return { ok: true, unsealed: true, id: a.id, dependents: dependents.map((s) => s.id) };
+        },
+        /**
+         * @implements A-SPEC-538.2
+         * Read-only: report a spec's approval/seal state — sealed?, approved_digest, each parent's seal
+         * state, and the concrete blockers still standing between it and approval — so a caller need not
+         * parse files to ask "what is the approval state right now". Reuses `sealOf` and `approvalBlockers`
+         * (the same predicates the code gate and spec_approve read) so the report cannot drift from the
+         * acts it describes. No writes, no ledger append.
+         */
+        async approval_status(a) {
+            assertSpecStoreReachable('approval_status', store, a.root); // @implements A-SPEC-419
+            const all = await store.list();
+            if (all.filter((s) => s.id === a.id).length > 1) {
+                return {
+                    ok: false,
+                    reason: `${a.id}이(가) 스토어에 두 번 이상 존재합니다 — 어느 사본의 상태를 물었는지 도구가 고를 수 없어 거부합니다.`,
+                };
+            }
+            const cur = await store.read(a.id);
+            if (!cur) {
+                const dir = store.specsRoot;
+                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
+                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
+            }
+            return { ok: true, ...(0, approval_status_1.describeApproval)(cur.spec, resolver(all)) };
+        },
+        /**
+         * @implements A-SPEC-538.3
+         * Read-only: return the provenance ledger's events in time order (optionally narrowed to one
+         * spec) so the governance history — approved / unsealed / retired / review-needed … — is legible
+         * at a glance without reading raw JSONL. Reuses FileLedgerStore.loadAll(); the ordering/filtering/
+         * projection is the pure `timelineFrom`. No writes. An absent ledger is an empty history, not an
+         * error.
+         */
+        async ledger_timeline(a) {
+            const dest = resolveLedgerRoot(a.root);
+            if (!dest.ok)
+                return { ok: false, reason: dest.reason };
+            const dir = path.join(dest.root, '.ax', 'ledger');
+            const events = fs.existsSync(dir) ? new ledger_store_1.FileLedgerStore(dir).loadAll() : [];
+            return { ok: true, events: (0, ledger_timeline_1.timelineFrom)(events, a.id) };
+        },
         async spec_approve(a) {
             const approvalRaw = process.env.HOLMES_APPROVAL;
             let approval;
@@ -1259,8 +1457,15 @@ function makeRawHandlers(store, opts) {
             // element instead leaves a window in which an external edit is silently destroyed and the
             // STALE content gets sealed (measured: 17 of 40 concurrent edits lost, 35-55ms window).
             const cur = await store.read(a.id);
-            if (!cur)
-                return { ok: false, reason: `spec ${a.id} not found` };
+            // @implements A-SPEC-536.1 — BUG-1: a spec whose YAML is broken is dropped by read()/list(),
+            // so a bare "not found" hid that the file EXISTS but cannot be parsed. Surface the skipped
+            // files when there are any; byte-identical to the legacy message when there are none. The
+            // store's specsRoot is read through the same cast the reachability checks use (A-SPEC-169).
+            if (!cur) {
+                const dir = store.specsRoot;
+                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
+                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
+            }
             const spec = cur.spec;
             // @implements A-SPEC-188 — duplicates make the id ambiguous, for the SPEC and for its
             // PARENTS alike. Round-3 probed the parent half: with a stray duplicate of the parent
@@ -1358,10 +1563,15 @@ function makeRawHandlers(store, opts) {
             }
             catch (e) {
                 if (e instanceof spec_store_2.SpecVersionConflictError) {
+                    // @implements A-SPEC-538.4 — the refusal is unchanged (refuse, write nothing, the edit
+                    // wins); it now also CARRIES the conflict: the version this act read, the version now on
+                    // disk, and what to retry. Re-read to learn the current version (null if it vanished).
+                    const now = await store.read(a.id).catch(() => null);
                     return {
                         ok: false,
                         reason: `승인 진행 중 ${a.id}이(가) 바뀌었습니다 — 바뀐 내용을 확인하고 다시 승인하십시오.`
                             + ' 이번 승인은 아무것도 쓰지 않았습니다.',
+                        conflict: (0, version_conflict_1.conflictDetail)({ id: a.id, expected: cur.version, current: now?.version ?? null }),
                     };
                 }
                 // @implements A-SPEC-188 — approval can RELOCATE the file (req_type classification moves
@@ -1829,6 +2039,26 @@ function makeRawHandlers(store, opts) {
             // Closes the decision->execution loop: scope -> run -> durable per-A-SPEC EXECUTION evidence
             // (what the constitution's ART-4 prefers over the syntactic count).
             const { root, specs, scanned, changedFiles, changedSymbols, changeSource, scopeFallback, anchorImpactedSpecs, changedTestFiles, unresolvedFiles } = await deriveChangedContext(store, a.root, a, 'test_run');
+            // @implements A-SPEC-534.8 — `mutate`: run a T-SPEC's declared `kills` mutations against the
+            // A-SPEC's source and report which SURVIVED (a discriminating-power gap). Selective, opt-in via
+            // the argument; absent → the ordinary run below is untouched.
+            if (a.mutate) {
+                const tspec = specs.find((s) => s.id === a.mutate && s.type === 'T-SPEC');
+                const kills = tspec ? (0, kills_1.parseKills)(tspec.frontmatter) : [];
+                const aspecId = tspec?.dependsOn[0];
+                const anchors = (0, test_scope_1.scanTestAnchors)(root);
+                const coveringFiles = aspecId
+                    ? Object.entries(anchors).filter(([, ids]) => ids.includes(aspecId)).map(([f]) => f) : [];
+                const results = kills.map((m) => {
+                    const src = aspecId ? sourceFileWithMutation(root, aspecId, m.where) : null;
+                    if (!src)
+                        return { mutation: m, applied: false, reason: 'no governed source anchors this A-SPEC and contains `where`' };
+                    const r = (0, mutate_1.runKillsOnFile)(src, m, coveringFiles, (files) => (0, test_runner_1.runJestOutcomes)(files, root));
+                    return { mutation: m, ...r };
+                });
+                const survivors = results.filter((r) => r.verdict === 'survived').map((r) => r.mutation);
+                return { mutate: { tspec: a.mutate, aspec: aspecId, coveringFiles, results, survivors } };
+            }
             const g = new rtm_graph_1.RtmGraph();
             let testScope;
             try {
@@ -1869,6 +2099,12 @@ function makeRawHandlers(store, opts) {
             if (verified) {
                 (0, test_evidence_1.writeTestEvidence)(root, { ts: new Date().toISOString(), head, tier: testScope.tier, passed: true, executedByAspec });
             }
+            // @implements A-SPEC-534.5 — RED-first outcome evidence for ART-8. Recorded UNCONDITIONALLY,
+            // unlike the green-only baseline above: a red-assertion recorded before the code is exactly what
+            // the red→green sequence needs. Append-only, one record per (A-SPEC, outcome) at this HEAD.
+            if (result.outcomeByFile) {
+                (0, test_outcomes_1.appendOutcomes)(root, (0, test_outcomes_1.buildOutcomeRecords)(result.outcomeByFile, anchors, head, new Date().toISOString()));
+            }
             // @implements A-SPEC-128
             // The baseline is written under EXACTLY the condition that already gates evidence: a run that
             // actually executed and passed. A red or skipped run must never become the reference point for
@@ -3060,7 +3296,7 @@ id: ${aspecId}
 type: A-SPEC
 title: ${(0, yaml_scalar_1.yamlScalar)(`Architecture Specification for ${a.title}`)}
 status: draft
-slice: ${a.sliceName}
+slice: ${(0, yaml_scalar_1.yamlScalar)(a.sliceName)}
 priority: P1
 independent_test: true
 depends_on:

package/dist/holmes/mcp/tool-schemas.js

@@ -101,6 +101,38 @@ exports.TOOL_SCHEMAS = {
             required: ['id'],
         },
     },
+    spec_unseal: {
+        description: "The inverse of spec_approve: return ONE sealed (approved) spec to an editable `status: draft`, clearing `approved_digest` and `parent_digests` in a single ACT, and record `spec-unsealed` in the provenance ledger. Un-sealing WITHDRAWS a seal, so it requires the same out-of-band HOLMES_APPROVAL as spec_approve/spec_retire's sealed path (fail-closed): un-sealing an approved T-SPEC removes the code gate's demand, which unguarded would be an approval bypass. Refuses when an APPROVED spec depends on the target — that dependent's parent_digests would silently go stale — naming the blockers. Idempotent: un-sealing a spec that is already draft (never sealed) writes nothing and returns unsealed:false. Written only at the version this act read; a concurrent edit wins and the un-seal is refused for retry. Distinct from spec_retire (which withdraws authority to status:outdated); un-seal keeps the spec alive and editable.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: str('Id of the spec to un-seal (return to draft).'),
+                root: str('Optional when the server is bound to a file store — the ledger location is derived from the store itself; if supplied it must resolve to the SAME project.'),
+            },
+            required: ['id'],
+        },
+    },
+    approval_status: {
+        description: "Read-only: report ONE spec's approval/seal state without the caller parsing files — { sealed, approvedDigest?, status, parents: [{ id, status, sealed, resolved }], blockers: [] }. `sealed` is the same approved_digest predicate the code gate reads; `blockers` is the exact list spec_approve would refuse on (empty once approved), so the report cannot drift from the acts it describes. Each parent entry shows that parent's OWN live seal state (an unresolved depends_on id is reported as status:'missing', resolved:false — not dropped). No writes, no ledger append. Refuses a duplicate or unknown id.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: str('Id of the spec whose approval/seal state to report.'),
+                root: str('Optional when the server is bound to a file store; if supplied it must resolve to the SAME project.'),
+            },
+            required: ['id'],
+        },
+    },
+    ledger_timeline: {
+        description: "Read-only: return the provenance ledger's events in time order — { events: [{ ts, kind, actor, summary, inputs }] } ascending by ts (tiebroken by chain seq). Pass an `id` to narrow to one spec (only events whose `inputs` reference it: spec-approved, spec-unsealed, spec-retired, review-needed …). The chain-integrity fields (hash/prevHash/seq/replicaId) are plumbing and are projected away — this is the governance history, not the tamper-evidence chain. No writes. An absent ledger is an empty history, not an error.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: str('Optional spec id — narrow the timeline to events that reference it.'),
+                root: str('Optional when the server is bound to a file store; the ledger location is derived from the store, or from this root.'),
+            },
+        },
+    },
     spec_approve: {
         description: 'Approve a spec as a sealing ACT: confirm the ledger destination BEFORE sealing → validate (zero errors) → record approved_digest + parent_digests snapshots → status: approved (written only at the version this act read; a concurrent edit wins and the approval is refused for retry) → append spec-approved to the provenance ledger. Requires a valid out-of-band HOLMES_APPROVAL in the SERVER environment (fail-closed; nothing in the request can substitute). Refuses an unsealed approved parent — seal parents first.',
         inputSchema: {
@@ -203,6 +235,7 @@ exports.TOOL_SCHEMAS = {
                 head: str('Head rev (e.g. HEAD). Optional — omit to compare against a baseline.'),
                 since: str('Baseline label to compare against when no git range is given (default `last-green`, recorded by a passing test_run). Works with or without version control.'),
                 mark: str('Baseline label to record when the run passes (default `last-green`). Nothing is recorded for a red or skipped run.'),
+                mutate: str('T-SPEC id (e.g. T-SPEC-129.1). When set, runs that spec’s declared `kills` mutations against the A-SPEC’s source and reports which SURVIVED — a discriminating-power gap. Selective, opt-in; the ordinary run is skipped.'),
             },
             required: ['root'],
         },

package/dist/holmes/review/mutate.d.ts

@@ -0,0 +1,17 @@
+import { Mutation } from '../spec/kills';
+import { TestOutcome } from './test-runner';
+/**
+ * Did the mutation KILL the covering tests? A kill is a `red-assertion` in at least one covering
+ * file — the mutation broke behaviour and a test caught it. A green (or absent, or red-error) result
+ * is `survived`: the tests did not catch the change, which is a discriminating-power gap. Pure.
+ */
+export declare function mutationVerdict(outcomeByFile: Record<string, TestOutcome>, coveringFiles: string[]): 'killed' | 'survived';
+/**
+ * Apply one mutation to a source file, run the covering tests through the injected runner, judge the
+ * verdict, and ALWAYS restore the original source. `applied:false` when `where` is absent (the file
+ * is never touched).
+ */
+export declare function runKillsOnFile(sourceFile: string, mutation: Mutation, coveringFiles: string[], run: (files: string[]) => Record<string, TestOutcome>): {
+    applied: boolean;
+    verdict?: 'killed' | 'survived';
+};

package/dist/holmes/review/mutate.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mutationVerdict = mutationVerdict;
+exports.runKillsOnFile = runKillsOnFile;
+// @implements A-SPEC-534.8
+const fs = __importStar(require("node:fs"));
+const kills_1 = require("../spec/kills");
+/**
+ * Did the mutation KILL the covering tests? A kill is a `red-assertion` in at least one covering
+ * file — the mutation broke behaviour and a test caught it. A green (or absent, or red-error) result
+ * is `survived`: the tests did not catch the change, which is a discriminating-power gap. Pure.
+ */
+function mutationVerdict(outcomeByFile, coveringFiles) {
+    return coveringFiles.some((f) => outcomeByFile[f] === 'red-assertion') ? 'killed' : 'survived';
+}
+/**
+ * Apply one mutation to a source file, run the covering tests through the injected runner, judge the
+ * verdict, and ALWAYS restore the original source. `applied:false` when `where` is absent (the file
+ * is never touched).
+ */
+function runKillsOnFile(sourceFile, mutation, coveringFiles, run) {
+    const original = fs.readFileSync(sourceFile, 'utf8');
+    const mutated = (0, kills_1.applyMutation)(original, mutation);
+    if (mutated === null)
+        return { applied: false }; // where absent: never touch the file
+    fs.writeFileSync(sourceFile, mutated);
+    try {
+        return { applied: true, verdict: mutationVerdict(run(coveringFiles), coveringFiles) };
+    }
+    finally {
+        fs.writeFileSync(sourceFile, original); // ALWAYS restore, even if run() threw
+    }
+}