@holmes-lab/holmes-kit 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.9.0] - 2026-09-04
+
+Internalized TDD discipline — RED-first evidence enforced by a new constitution article (ART-8),
+not a prompt — plus a doctor transparency check and a BUG-1 authoring fix. All additive and
+backward-compatible; existing behaviour is unchanged at the default settings.
+
+### Added
+
+- **Inbuilt TDD, made enforceable** (REQ-534): the superpowers TDD discipline is now a holmes-installed
+  skill AND deterministically enforced, not merely advised.
+  - **ART-8 RED-first evidence** (new constitution article): a changed A-SPEC must show a recorded
+    `red-assertion → green` sequence in the ledger. A `red-error` (a test that could not run — a
+    load/import/collection failure) is **not** a valid RED, so "the covering test failed *correctly*"
+    is judged mechanically. `test_run` classifies each covered file as `red-assertion | red-error |
+    green` and appends per-A-SPEC outcomes; the Stop hook reads them. Ships at
+    `guardrail.redFirstEvidence: track` (observe-first, non-blocking) — promote to `strict` per repo,
+    `off` disables. Evidence-gated (inert until outcomes are recorded) and jest-only for now.
+  - **`holmes-tdd-slice` skill**: restates the Iron Law and Red-Green-Refactor in holmes terms and
+    tags each rule with the article that enforces it (`[ART-1]`/`[ART-4]`/`[ART-8]`/honor-system).
+    Installed alongside the other recovery skills.
+  - **Discriminating power**: a T-SPEC may declare `kills:` (named mutations), and
+    `test_run --mutate <tspec>` applies each against the A-SPEC's source, reporting which SURVIVED
+    (a coverage gap). Selective and opt-in — never a blanket gate.
+- **doctor `mcp schema cost`** (REQ-535): reports holmes-kit's own advertised MCP schema cost
+  (computed live from the tool set, no hardcoded number) and WARNs when `HOLMES_MCP_PROFILE=full`
+  re-advertises the hook-enforced gate-duplicate tools; advises client-side deferred loading.
+  Advisory only (never FAIL), and it never claims to have detected a client's resident behaviour.
+
+### Fixed
+
+- **BUG-1 remainder** (REQ-536): `spec_slice_init` now safe-quotes the `slice` value with `yamlScalar`
+  — it was the one raw interpolation among the slice builders, so a `sliceName` containing a colon or
+  quote could break the generated A-SPEC's frontmatter YAML. And `spec_approve` on a missing id now
+  surfaces any unparseable spec file (with a YAML hint) instead of a bare "not found", closing the
+  silent-loss that hid a broken file behind a "not found".
+
 ## [0.8.1] - 2026-09-03
 
 Codex hard-enforcement completed and verified on real codex-cli 0.152.1 (GOAL-codex-enforcement),

package/README.md

@@ -14,9 +14,10 @@
 
 ---
 
-### 🛡️ Currently Supported Features (v0.8.x Production Features)
+### 🛡️ Currently Supported Features (v0.9.x Production Features)
 
 - 📋 **Requirements & Specification Governance**: Strict **"No Spec, No Code"** enforcement with 4-tier spec chain traceability (`REQ ➔ H-SPEC ➔ A-SPEC ➔ T-SPEC`) and `// @implements A-SPEC-XXX` code anchors (comma-lists and every anchor in a file participate in the gate).
+- 🔴 **Inbuilt TDD — RED-first, enforced not asked** *(new in 0.9.0)*: the test-first discipline is a holmes-installed `holmes-tdd-slice` skill **and** a new constitution article **ART-8**. A changed A-SPEC must show a recorded `red-assertion → green` sequence in the ledger; a `red-error` (a test that could not run) is not a valid RED, so "the covering test failed *correctly*" is judged mechanically, not on trust. `test_run` classifies each covered file (`red-assertion`/`red-error`/`green`) and records per-A-SPEC outcomes the Stop hook reads. Ships at `redFirstEvidence: track` (observe-first, non-blocking; `strict`/`off` per repo), evidence-gated and jest-only for now. A T-SPEC may also declare `kills:` mutations and `test_run --mutate` reports which SURVIVED (a coverage gap). Where superpowers *asks* for RED-first and discriminating power, holmes-kit *proves* them.
 - 🤖 **Autonomous Approval** *(new in 0.8.0)*: with the out-of-band `HOLMES_AUTONOMOUS_APPROVAL` switch on, an agent seals **low/mid-risk** specs itself (ledgered under an `autonomous:<client>` actor) — while `gate-behavior` changes, architecture/gate/taint files, and every upstream `REQ`/`H-SPEC`/`C-SPEC` still ask a human through the in-session TUI. The switch is env-only; a session cannot set it (blocked like `HOLMES_ROLE`). Off = byte-identical to before.
 - 🪧 **Session Banner + Update Notice** *(new in 0.8.0)*: every session start emits an English intro (version + governance rule + npm URL) to both the human transcript and the agent context (SessionStart hook + MCP `instructions`); when a newer published version is cached, an install-mode-aware update command is appended. Registry check is detached, fail-silent, and opts out via `HOLMES_NO_UPDATE_CHECK`/`CI`.
 - 🧱 **Deterministic Gate, Hardened** *(new in 0.8.0)*: shell writes are judged at the segment's **effective working directory** (`cd sub && cat > ../src/x.ts` is sealed, legitimate out-of-tree scratch writes are freed); the governing anchor is the **whole set**, not the first match. Every gate change ships with two consecutive clean adversarial rounds.
@@ -24,7 +25,7 @@
 - 🎯 **Graded Impact Surface** *(new in 0.3.0)*: `rankedImpact` (personalized-PageRank over the spec/code graph) beat its pre-registered naive baseline on **both recall and precision across 3 corpora (×1.6–×17)** — the necessary condition for any better-than-a-person phrasing, measured before claimed.
 - 🐞 **Causal Defect Localization & CPG** *(equalized in 0.5–0.7)*: AST Code Property Graph (CFG/DDG/CDG) & Dataflow Taint reachability across 7 languages (TS/JS, Python, Go, Rust, Java, C/C++, C#) — **42 language×layer cells graded on measured evidence** (11 corpora, 39,344 functions, zero invariant violations; C++ conditional on 67.9% parse coverage, disclosed in the matrix).
 - 📏 **Measured, Not Claimed** *(new in 0.3.x)*: performance is judged against a pre-registered modeled-human band (R 0.67–0.78 / P ≈0.9±). Current official grade: **band entry on recall; division-of-labor precision 0.727 = 81% of the modeled human — reproduced by an independent context-free judge on a fresh blind window.** No superhuman claims until both metrics exceed the band.
-- 🧪 **Self-Healing & Diagnostic Doctor**: Automated integrity checks and self-healing auto-fix remediation (`holmes-kit doctor --fix` & `spec_remediate`) — wiring-handshake checks run on Windows natively as of 0.3.2.
+- 🧪 **Self-Healing & Diagnostic Doctor**: Automated integrity checks and self-healing auto-fix remediation (`holmes-kit doctor --fix` & `spec_remediate`) — wiring-handshake checks run on Windows natively as of 0.3.2. As of 0.9.0, doctor also reports holmes-kit's own advertised **MCP schema token cost** (computed live) and warns when `HOLMES_MCP_PROFILE=full` needlessly re-advertises the hook-enforced gate-duplicate tools.
 - 🔔 **Approval UX** *(new in 0.3.1)*: in-session approval dialogs forewarn their 120s deadline and, on expiry, the refusal says exactly where the decision went (`npx holmes-kit approve` out-of-band queue) — no more silently dead dialogs.
 - 🚦 **Push & Server-Side Re-Validation** *(hardened in 0.8.0)*: a local `pre-push` evidence gate (test-run ledger head == push HEAD, green, executed > 0) plus a **server-side CI workflow** that re-runs `npm ci → build → full suite → tarball install probe`, so a `--no-verify` push or a hook-less clone is still caught.
 - 📊 **Automated RTM & Taint Heatmap**: Interactive standalone HTML/SVG report generation (`generateRtmHeatmap`) for spec coverage and security dataflow reachability.

package/dist/.build-id

@@ -1 +1 @@
-a14dfa1-mtkqq7jw
+2a5de17-mtm0zp6n

package/dist/holmes/cli/doctor.js

@@ -63,6 +63,8 @@ const mcp_version_1 = require("./mcp-version");
 const codex_toml_1 = require("./codex-toml");
 const agents_1 = require("./agents");
 const mcp_launcher_1 = require("./mcp-launcher");
+const tool_schemas_1 = require("../mcp/tool-schemas");
+const mcp_schema_cost_1 = require("./mcp-schema-cost");
 /**
  * Checks if a script path belongs to the packageRoot, supporting symlinked global installs.
  */
@@ -443,6 +445,16 @@ async function runDoctor(packageRoot, target, opts, extraChecks) {
     else {
         add('ledger signing', 'WARN', '원장이 서명되지 않습니다(HOLMES_LEDGER_KEY 없음) — 체인이 평문 해시라 파일을 쓸 수 있는 자가 승인 기록도 만들 수 있고, ART-5 의 원장 대조는 장벽이 아니라 비용이 됩니다', 'HOLMES_LEDGER_KEY 를 대역외(에이전트를 기동하는 사람의 환경)에서 설정한 뒤 서버를 다시 시작하십시오. 값은 이 보고서에 절대 출력되지 않습니다.');
     }
+    // @implements A-SPEC-535.1
+    // Advisory: holmes-kit's OWN advertised MCP schema cost, and the one holmes-controlled
+    // misconfiguration (HOLMES_MCP_PROFILE=full re-advertising hook-enforced gate-duplicates). Never
+    // FAIL — efficiency, not correctness. The number is derived from TOOL_SCHEMAS at runtime (no drift),
+    // and the resident-client cost is stated conditionally: a static checker cannot observe whether the
+    // client keeps schemas resident, so it never claims to have detected it.
+    {
+        const sc = (0, mcp_schema_cost_1.mcpSchemaCost)(tool_schemas_1.TOOL_SCHEMAS, tool_schemas_1.HOOK_ENFORCED_TOOLS, process.env.HOLMES_MCP_PROFILE);
+        add('mcp schema cost', sc.level, sc.detail, sc.fix);
+    }
     // @implements A-SPEC-457
     // Whether the ART-2 truncation backstop (A-SPEC-455) is even armed. That backstop compares the
     // committed ledger to the working copy and enumerates targets with `git ls-files .ax/ledger`; an

package/dist/holmes/cli/mcp-schema-cost.d.ts

@@ -0,0 +1,18 @@
+/**
+ * doctor advisory (REQ-535): report holmes-kit's OWN advertised MCP schema cost and flag the one
+ * holmes-controlled misconfiguration (HOLMES_MCP_PROFILE=full re-advertising hook-enforced
+ * gate-duplicates). Pure — no I/O. Never FAIL (efficiency, not correctness). Never claims to have
+ * detected that the client keeps schemas resident (a static checker cannot observe that); the
+ * resident-client cost is stated conditionally.
+ */
+export interface SchemaCostResult {
+    level: 'PASS' | 'WARN';
+    detail: string;
+    fix?: string;
+    advertised: number;
+    tokens: number;
+}
+export declare function mcpSchemaCost(schemas: Record<string, {
+    description?: string;
+    inputSchema?: unknown;
+}>, hidden: Set<string>, profileEnv: string | undefined): SchemaCostResult;

package/dist/holmes/cli/mcp-schema-cost.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpSchemaCost = mcpSchemaCost;
+function mcpSchemaCost(schemas, hidden, profileEnv) {
+    const jsonLen = (n) => JSON.stringify({ name: n, description: schemas[n]?.description, inputSchema: schemas[n]?.inputSchema }).length;
+    const names = Object.keys(schemas);
+    const advertisedNames = names.filter((n) => !hidden.has(n));
+    const hiddenNames = names.filter((n) => hidden.has(n));
+    const est = (ns) => Math.round(ns.reduce((s, n) => s + jsonLen(n), 0) / 4);
+    const tokens = est(advertisedNames);
+    const advertised = advertisedNames.length;
+    if (profileEnv === 'full' && hiddenNames.length > 0) {
+        return {
+            level: 'WARN',
+            detail: `HOLMES_MCP_PROFILE=full re-advertises ${hiddenNames.length} hook-enforced gate-duplicate tool(s) (${hiddenNames.join(', ')}) — about +${est(hiddenNames)} tokens/turn on a client that keeps MCP schemas resident. They are already enforced deterministically by the Stop/PreToolUse hooks and stay callable by name.`,
+            fix: 'Unset HOLMES_MCP_PROFILE unless you specifically need to invoke these tools by name.',
+            advertised, tokens,
+        };
+    }
+    return {
+        level: 'PASS',
+        detail: `holmes-kit advertises ${advertised} MCP tool(s) ≈ ${tokens} tokens in the default profile`
+            + `${hiddenNames.length ? ` (${hiddenNames.length} gate-duplicate tool(s) already hidden)` : ''}. `
+            + `If your MCP client keeps tool schemas resident, this is re-sent each turn — a fixed cost that shrinks as the session grows.`,
+        fix: 'If your MCP client supports on-demand/deferred tool loading, enabling it removes this overhead with no loss (tools load when searched).',
+        advertised, tokens,
+    };
+}

package/dist/holmes/config/config.d.ts

@@ -12,6 +12,14 @@ export interface AxConfig {
          * silently impose a new one.
          */
         preEditEvidence: 'off' | 'warn' | 'block';
+        /**
+         * @implements A-SPEC-534.3
+         * RED-first evidence enforcement (ART-8). `off` skips the check; `track` records violations
+         * without blocking a turn (observe-first, the ship default); `strict` blocks like any other
+         * article. Default `track` — unlike `preEditEvidence`, `track` never blocks, so observing
+         * RED-first across the repo is safe before an owner promotes it to `strict`.
+         */
+        redFirstEvidence: 'off' | 'track' | 'strict';
     };
     highRiskDomains: string[];
     storage: {

package/dist/holmes/config/config.js

@@ -47,7 +47,7 @@ exports.DEFAULT_CONFIG = {
     // first refusal is `no-analysis`. Warn reports the missing evidence without stopping work, which
     // is also the only path that accumulates the data a later block decision would need. Raised as an
     // authority question rather than decided by measurement — the user chose this level.
-    guardrail: { enforcement: 'block', enforceHighRisk: true, overrideRequiresAdr: true, preEditEvidence: 'warn' },
+    guardrail: { enforcement: 'block', enforceHighRisk: true, overrideRequiresAdr: true, preEditEvidence: 'warn', redFirstEvidence: 'track' },
     highRiskDomains: ['@auth', '@payment'],
     storage: { specStore: 'local-markdown' },
 };

package/dist/holmes/governance/constitution.d.ts

@@ -1,4 +1,5 @@
 import { Spec } from '../spec/spec-parser';
+import type { TestOutcome } from '../review/test-runner';
 /**
  * L1 — Governance CONSTITUTION (target-architecture §7 L1).
  *
@@ -56,6 +57,31 @@ export interface ConstitutionContext {
      * record cannot hide a missing test suite because the syntactic bound is still enforced.
      */
     executedByAspec?: Record<string, number>;
+    /**
+     * @implements A-SPEC-534.2
+     * RED-first evidence (ART-8). `changedAspecs` are the A-SPECs whose source changed in this work
+     * unit; `outcomesByAspec` are the recorded per-A-SPEC test outcomes (from the ledger). ART-8 fires
+     * only in `strict` mode here — `track`/`off` are the caller's report-only / ignore concerns (the
+     * config read and the track-mode recording are I/O, done by the Stop hook). Evidence-gated like
+     * ART-4: an A-SPEC with no recorded outcomes is not a violation.
+     */
+    redFirstMode?: 'strict' | 'track' | 'off';
+    changedAspecs?: string[];
+    outcomesByAspec?: Record<string, Array<{
+        outcome: TestOutcome;
+        ts: string;
+    }>>;
 }
+/**
+ * @implements A-SPEC-534.2
+ * ART-8 RED-first check (pure). For each changed A-SPEC that HAS recorded outcomes, require a
+ * `red-assertion` at ts_red followed by a `green` at ts_green > ts_red. A `red-error` is NOT a valid
+ * RED (a file that could not run its cases proves nothing). An A-SPEC with no outcomes is skipped
+ * (evidence-gated).
+ */
+export declare function redFirstViolations(changedAspecs: string[], outcomesByAspec: Record<string, Array<{
+    outcome: TestOutcome;
+    ts: string;
+}>>): ConstitutionViolation[];
 export declare const ARTICLES: Record<string, string>;
 export declare function verifyConstitution(ctx: ConstitutionContext): ConstitutionViolation[];

package/dist/holmes/governance/constitution.js

@@ -1,11 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ARTICLES = void 0;
+exports.redFirstViolations = redFirstViolations;
 exports.verifyConstitution = verifyConstitution;
 const basis_1 = require("../mcp/basis");
 const spec_types_1 = require("../spec/spec-types");
 const rtm_check_1 = require("../rtm/rtm-check");
 const validator_1 = require("../spec/validator");
+/**
+ * @implements A-SPEC-534.2
+ * ART-8 RED-first check (pure). For each changed A-SPEC that HAS recorded outcomes, require a
+ * `red-assertion` at ts_red followed by a `green` at ts_green > ts_red. A `red-error` is NOT a valid
+ * RED (a file that could not run its cases proves nothing). An A-SPEC with no outcomes is skipped
+ * (evidence-gated).
+ */
+function redFirstViolations(changedAspecs, outcomesByAspec) {
+    const v = [];
+    for (const aspec of changedAspecs) {
+        const outcomes = outcomesByAspec[aspec];
+        if (!outcomes || outcomes.length === 0)
+            continue; // evidence-gated: no record → no violation
+        // The EARLIEST red-assertion anchors the ordering; a green must come after it. A red-error is
+        // deliberately excluded — it means the cases never ran, so it cannot stand in for a real RED.
+        const reds = outcomes.filter((o) => o.outcome === 'red-assertion').map((o) => o.ts).sort();
+        const tsRed = reds[0];
+        const greenAfterRed = tsRed !== undefined && outcomes.some((o) => o.outcome === 'green' && o.ts > tsRed);
+        if (!greenAfterRed) {
+            v.push({ article: 'ART-8', detail: `${aspec}: source changed but no recorded red-assertion→green sequence — a covering test that never failed first proves nothing; make it fail (assertion, not error) before the code (ART-8)` });
+        }
+    }
+    return v;
+}
 exports.ARTICLES = {
     'ART-7': '열린 치명 발견은 미완이다 — severity critical 이 open 인 한 완료가 없다 (important/minor 는 review_status 보고에만 남는다: 기록을 피하게 만드는 차단은 원장을 죽인다)',
     'ART-6': '판단은 현재 빌드에서 내려야 한다 — 설치된 코드와 갈라진 서버에서 봉인된 리뷰 결과는 이미 사라진 세계를 기술한다',
@@ -14,6 +39,7 @@ exports.ARTICLES = {
     'ART-3': 'Spec validity — every governed spec satisfies its type rules, including honest 4-quadrant GWT coverage',
     'ART-4': 'Coverage honesty — declared coverage must be backed by real anchored test cases, not prose',
     'ART-5': 'Approval is out-of-band — a spec cannot self-approve; governance config cannot be self-written',
+    'ART-8': 'Test-first is observed — a changed A-SPEC must show a recorded red-assertion→green sequence before it is done (a red-error is not a valid RED)',
 };
 function verifyConstitution(ctx) {
     const governed = (0, spec_types_1.filterGoverned)(ctx.specs);
@@ -67,6 +93,13 @@ function verifyConstitution(ctx) {
             }
         }
     }
+    // @implements A-SPEC-534.2
+    // ART-8: RED-first evidence. Only `strict` mode emits a BLOCKING violation here; `track` (report
+    // only) and `off` are the caller's I/O concern (the config read + track-mode ledger recording live
+    // in the Stop hook, 534.3). Evidence-gated inside redFirstViolations.
+    if (ctx.redFirstMode === 'strict' && ctx.changedAspecs && ctx.outcomesByAspec) {
+        v.push(...redFirstViolations(ctx.changedAspecs, ctx.outcomesByAspec));
+    }
     // @implements A-SPEC-160
     // ART-6: a judgement sealed while the answering server ran code that no longer matched what was
     // installed. Measured 2026-08-08: such a server reported `impactedSpecs: []` for a commit touching

package/dist/holmes/hooks/stop.d.ts

@@ -1,5 +1,6 @@
 import { PendingRequest } from '../governance/approval-queue';
 import { Spec } from '../spec/spec-parser';
+import type { TestOutcome } from '../review/test-runner';
 /**
  * @implements A-SPEC-100.2
  * Stop-hook governance gate (Phase-2 #1: push, not pull).
@@ -81,7 +82,26 @@ export interface StopEvidence {
      * catches it already existed inside `rechainLedger` and ran from the CLI only.
      */
     rolledBackLedgers?: string[];
+    /**
+     * @implements A-SPEC-534.4
+     * ART-8 RED-first evidence. `changedAspecs` are the A-SPECs whose source is dirty this turn;
+     * `outcomesByAspec` are their recorded outcomes at the current baseline HEAD; `redFirstMode` is the
+     * config posture. `strict` blocks via the constitution; `track` records to `tracked` without
+     * blocking; `off`/absent does nothing.
+     */
+    changedAspecs?: string[];
+    outcomesByAspec?: Record<string, Array<{
+        outcome: TestOutcome;
+        ts: string;
+    }>>;
+    redFirstMode?: 'strict' | 'track' | 'off';
 }
+/**
+ * @implements A-SPEC-534.4
+ * ART-8 evidence (I/O half): the A-SPECs whose DIRTY source files carry an @implements anchor. git is
+ * a refinement — no repository means `undefined` (no signal), never a false clean.
+ */
+export declare function changedAnchoredAspecs(root: string): string[] | undefined;
 /**
  * @implements A-SPEC-452
  * ART-1 evidence: which changed source files claim nothing.
@@ -127,6 +147,10 @@ export declare function evaluateStop(specs: Spec[], evidence?: StopEvidence): {
         article: string;
         detail: string;
     }[];
+    tracked?: {
+        article: string;
+        detail: string;
+    }[];
 };
 /**
  * @implements A-SPEC-134

package/dist/holmes/hooks/stop.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_CONSECUTIVE_BLOCKS = void 0;
+exports.changedAnchoredAspecs = changedAnchoredAspecs;
 exports.unanchoredChangedSources = unanchoredChangedSources;
 exports.unrecordedApprovals = unrecordedApprovals;
 exports.rolledBackLedgers = rolledBackLedgers;
@@ -56,10 +57,50 @@ const test_scope_1 = require("../rtm/test-scope");
 const constitution_1 = require("../governance/constitution");
 const provenance_chain_1 = require("../governance/provenance-chain");
 const test_evidence_1 = require("../review/test-evidence");
+const test_outcomes_1 = require("../review/test-outcomes");
+const config_1 = require("../config/config");
 const pre_tool_use_1 = require("./pre-tool-use");
 const governance_history_1 = require("../guardrail/governance-history");
 const constitution_debt_1 = require("../governance/constitution-debt");
 const root_1 = require("../project/root");
+/**
+ * @implements A-SPEC-534.4
+ * ART-8 evidence (I/O half): the A-SPECs whose DIRTY source files carry an @implements anchor. git is
+ * a refinement — no repository means `undefined` (no signal), never a false clean.
+ */
+function changedAnchoredAspecs(root) {
+    const SOURCE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|cs|rb|php|swift)$/;
+    const VENDORED = /^(?:reference|node_modules|dist|build|vendor|third_party)\//;
+    let raw;
+    try {
+        raw = (0, node_child_process_1.execFileSync)('git', ['status', '--porcelain', '-uall'], {
+            cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)(),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    const ids = new Set();
+    for (const line of raw.split('\n')) {
+        if (line.trim() === '')
+            continue;
+        let rel = line.slice(3).trim().replace(/^"|"$/g, '');
+        if (rel.includes(' -> '))
+            rel = rel.split(' -> ')[1]; // renames name the destination
+        if (!SOURCE.test(rel) || VENDORED.test(rel))
+            continue;
+        let text;
+        try {
+            text = fs.readFileSync(path.join(root, rel), 'utf8');
+        }
+        catch {
+            continue;
+        } // deleted/unreadable
+        for (const m of text.matchAll(/@implements\s+(A-SPEC-\d+(?:\.\d+)?)/g))
+            ids.add(m[1]);
+    }
+    return [...ids].sort();
+}
 /**
  * @implements A-SPEC-452
  * ART-1 evidence: which changed source files claim nothing.
@@ -248,7 +289,21 @@ function evaluateStop(specs, evidence) {
     // L1: the Stop gate IS the constitution's re-verification point — every turn boundary re-runs the
     // inviolable articles (ART-2 RTM, ART-3 validity incl. 4-quadrant GWT, ART-4 coverage evidence).
     // The articles live in ONE place (governance/constitution.ts); this gate merely executes them.
-    const violations = (0, constitution_1.verifyConstitution)({ specs, testCasesByAspec: evidence?.testCasesByAspec, executedByAspec: evidence?.executedByAspec, findings: evidence?.findings });
+    // @implements A-SPEC-534.4 — ART-8 evidence rides through to the constitution, which emits a
+    // BLOCKING ART-8 violation only in `strict` mode. `track`/`off` produce none here.
+    const violations = (0, constitution_1.verifyConstitution)({
+        specs, testCasesByAspec: evidence?.testCasesByAspec, executedByAspec: evidence?.executedByAspec, findings: evidence?.findings,
+        redFirstMode: evidence?.redFirstMode, changedAspecs: evidence?.changedAspecs, outcomesByAspec: evidence?.outcomesByAspec,
+    });
+    // @implements A-SPEC-534.4 — `track` records ART-8 findings without blocking the turn. Computed
+    // separately (the constitution stays silent on ART-8 outside strict) and returned in `tracked` for
+    // the CLI to record; it never enters `problems`/the block decision.
+    let tracked;
+    if (evidence?.redFirstMode === 'track' && evidence.changedAspecs && evidence.outcomesByAspec) {
+        const t = (0, constitution_1.redFirstViolations)(evidence.changedAspecs, evidence.outcomesByAspec);
+        if (t.length)
+            tracked = t;
+    }
     const problems = violations.map((x) => `[${x.article}] ${x.detail}`);
     // @implements A-SPEC-247 — structured list so the caller can ask acknowledgeStop which of these
     // are waiting on an owner. Mirrors `problems` exactly, including the two synthesized below.
@@ -287,7 +342,7 @@ function evaluateStop(specs, evidence) {
         structured.push({ article: 'ART-2', detail });
     }
     if (problems.length === 0)
-        return { block: false };
+        return { block: false, ...(tracked ? { tracked } : {}) };
     const shown = problems.slice(0, 20);
     const more = problems.length > shown.length ? `\n…and ${problems.length - shown.length} more` : '';
     // @implements A-SPEC-134 — the distinct articles feed the constitution-debt state on a cap-yield.
@@ -301,6 +356,7 @@ function evaluateStop(specs, evidence) {
         block: true,
         articles,
         violations: structured,
+        ...(tracked ? { tracked } : {}),
         reason: `[Holmes-Kit] constitution gate: ${problems.length} article violation(s) must be ` +
             `fixed before finishing:\n${shown.join('\n')}${more}`,
     };
@@ -656,6 +712,25 @@ if (require.main === module) {
             catch {
                 executedByAspec = undefined;
             }
+            // @implements A-SPEC-534.4 — ART-8 RED-first evidence (I/O half). Outcomes recorded at the
+            // current baseline HEAD (where the dirty work's red+green ran); changed anchored A-SPECs from
+            // the working tree; the posture from config. Fail-open: any error leaves ART-8 inert this turn.
+            let redFirstMode;
+            let changedAspecs;
+            let outcomesByAspec;
+            try {
+                redFirstMode = (0, config_1.loadConfig)(stopProjectRoot()).guardrail.redFirstEvidence;
+                if (redFirstMode !== 'off') {
+                    const head = (0, node_child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: stopProjectRoot(), stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() }).toString().trim();
+                    changedAspecs = changedAnchoredAspecs(stopProjectRoot());
+                    outcomesByAspec = (0, test_outcomes_1.groupOutcomesByAspec)((0, test_outcomes_1.readOutcomes)(stopProjectRoot()), head);
+                }
+            }
+            catch {
+                redFirstMode = undefined;
+                changedAspecs = undefined;
+                outcomesByAspec = undefined;
+            }
             // Provenance-chain verification (fail-open: a verify error skips the check, never crashes).
             let provenance;
             // @implements A-SPEC-148
@@ -690,7 +765,12 @@ if (require.main === module) {
             const unrecorded = unrecordedApprovals(stopProjectRoot());
             // @implements A-SPEC-455
             const rolledBack = rolledBackLedgers(stopProjectRoot());
-            let out = evaluateStop(specs, { testCasesByAspec, provenance, executedByAspec, findings, findingsUnreadable, unanchoredChangedSources: unanchored, unrecordedApprovals: unrecorded, rolledBackLedgers: rolledBack });
+            let out = evaluateStop(specs, { testCasesByAspec, provenance, executedByAspec, findings, findingsUnreadable, unanchoredChangedSources: unanchored, unrecordedApprovals: unrecorded, rolledBackLedgers: rolledBack, redFirstMode, changedAspecs, outcomesByAspec });
+            // @implements A-SPEC-534.4 — track mode records ART-8 findings without blocking: surface them so
+            // the operator observes RED-first gaps before an owner promotes the posture to strict.
+            if (out.tracked && out.tracked.length > 0) {
+                process.stderr.write(`[Holmes-Kit] ART-8 RED-first (track): ${out.tracked.map((t) => t.detail).join(' | ')}\n`);
+            }
             // @implements A-SPEC-247 — before deciding to re-block, ask whether every unresolved debt is
             // already queued for the owner. If so, tell the user ONCE and let the turn finish; a single
             // non-waiting violation and we block exactly as before.

package/dist/holmes/mcp/handlers.d.ts

@@ -347,7 +347,25 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         head?: string;
         since?: string;
         mark?: string;
+        mutate?: string;
     }): Promise<{
+        mutate: {
+            tspec: string;
+            aspec: string | undefined;
+            coveringFiles: string[];
+            results: ({
+                mutation: import("../spec/kills").Mutation;
+                applied: boolean;
+                reason: string;
+            } | {
+                applied: boolean;
+                verdict?: "killed" | "survived";
+                mutation: import("../spec/kills").Mutation;
+                reason?: undefined;
+            })[];
+            survivors: import("../spec/kills").Mutation[];
+        };
+    } | {
         baselineRecorded?: string | undefined;
         scopeFallback?: "full" | undefined;
         tier: import("../rtm/test-scope").RegressionTier;
@@ -359,6 +377,7 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
         tail: string;
         unresolvedFiles: string[];
         changeSource: ChangeSourceInfo;
+        mutate?: undefined;
     }>;
     issue_localize(a: {
         root: string;

package/dist/holmes/mcp/handlers.js

@@ -68,7 +68,10 @@ const rtm_check_1 = require("../rtm/rtm-check");
 const test_scope_1 = require("../rtm/test-scope");
 const gap_analyzer_1 = require("../rtm/gap-analyzer");
 const test_runner_1 = require("../review/test-runner");
+const kills_1 = require("../spec/kills");
+const mutate_1 = require("../review/mutate");
 const test_evidence_1 = require("../review/test-evidence");
+const test_outcomes_1 = require("../review/test-outcomes");
 const localize_1 = require("../rtm/localize");
 const maintenance_analyze_1 = require("./maintenance-analyze");
 const maintenance_evidence_1 = require("./maintenance-evidence");
@@ -90,6 +93,53 @@ const root_1 = require("../project/root");
 // under that tree stopped at the minted marker. This is the harm §8 closed for `review_record`,
 // left open on the scan path. When the store is bound, the cache is the bound project's; otherwise
 // only an anchored answer may be written to, and an unanchored one falls back to a temp cache.
+// @implements A-SPEC-534.8
+// The governed source file a `kills` mutation targets: one that @implements the A-SPEC AND contains
+// the `where` literal. Bounded walk, skips vendored/test/hidden dirs. null when none qualifies.
+function sourceFileWithMutation(root, aspecId, where) {
+    if (!where)
+        return null;
+    const SOURCE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|cs|rb|php|swift)$/;
+    let found = null;
+    const walk = (d) => {
+        if (found)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(d, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (found)
+                return;
+            if (e.name === 'node_modules' || e.name === 'dist' || e.name === 'reference'
+                || e.name === 'vendor' || e.name === 'third_party' || e.name.startsWith('.'))
+                continue;
+            const p = path.join(d, e.name);
+            if (e.isDirectory()) {
+                walk(p);
+                continue;
+            }
+            if (!SOURCE.test(e.name) || /\.test\./.test(e.name))
+                continue;
+            let text;
+            try {
+                text = fs.readFileSync(p, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (text.includes(`@implements ${aspecId}`) && text.includes(where)) {
+                found = p;
+                return;
+            }
+        }
+    };
+    walk(root);
+    return found;
+}
 const cacheDirFor = (root) => {
     const r = (0, root_2.resolveProjectRoot)(root);
     if (r.marker !== 'given')
@@ -1259,8 +1309,15 @@ function makeRawHandlers(store, opts) {
             // element instead leaves a window in which an external edit is silently destroyed and the
             // STALE content gets sealed (measured: 17 of 40 concurrent edits lost, 35-55ms window).
             const cur = await store.read(a.id);
-            if (!cur)
-                return { ok: false, reason: `spec ${a.id} not found` };
+            // @implements A-SPEC-536.1 — BUG-1: a spec whose YAML is broken is dropped by read()/list(),
+            // so a bare "not found" hid that the file EXISTS but cannot be parsed. Surface the skipped
+            // files when there are any; byte-identical to the legacy message when there are none. The
+            // store's specsRoot is read through the same cast the reachability checks use (A-SPEC-169).
+            if (!cur) {
+                const dir = store.specsRoot;
+                const unreadable = typeof dir === 'string' ? (0, spec_store_1.unreadableSpecFiles)(dir) : [];
+                return { ok: false, reason: (0, spec_store_1.notFoundReason)(a.id, unreadable) };
+            }
             const spec = cur.spec;
             // @implements A-SPEC-188 — duplicates make the id ambiguous, for the SPEC and for its
             // PARENTS alike. Round-3 probed the parent half: with a stray duplicate of the parent
@@ -1829,6 +1886,26 @@ function makeRawHandlers(store, opts) {
             // Closes the decision->execution loop: scope -> run -> durable per-A-SPEC EXECUTION evidence
             // (what the constitution's ART-4 prefers over the syntactic count).
             const { root, specs, scanned, changedFiles, changedSymbols, changeSource, scopeFallback, anchorImpactedSpecs, changedTestFiles, unresolvedFiles } = await deriveChangedContext(store, a.root, a, 'test_run');
+            // @implements A-SPEC-534.8 — `mutate`: run a T-SPEC's declared `kills` mutations against the
+            // A-SPEC's source and report which SURVIVED (a discriminating-power gap). Selective, opt-in via
+            // the argument; absent → the ordinary run below is untouched.
+            if (a.mutate) {
+                const tspec = specs.find((s) => s.id === a.mutate && s.type === 'T-SPEC');
+                const kills = tspec ? (0, kills_1.parseKills)(tspec.frontmatter) : [];
+                const aspecId = tspec?.dependsOn[0];
+                const anchors = (0, test_scope_1.scanTestAnchors)(root);
+                const coveringFiles = aspecId
+                    ? Object.entries(anchors).filter(([, ids]) => ids.includes(aspecId)).map(([f]) => f) : [];
+                const results = kills.map((m) => {
+                    const src = aspecId ? sourceFileWithMutation(root, aspecId, m.where) : null;
+                    if (!src)
+                        return { mutation: m, applied: false, reason: 'no governed source anchors this A-SPEC and contains `where`' };
+                    const r = (0, mutate_1.runKillsOnFile)(src, m, coveringFiles, (files) => (0, test_runner_1.runJestOutcomes)(files, root));
+                    return { mutation: m, ...r };
+                });
+                const survivors = results.filter((r) => r.verdict === 'survived').map((r) => r.mutation);
+                return { mutate: { tspec: a.mutate, aspec: aspecId, coveringFiles, results, survivors } };
+            }
             const g = new rtm_graph_1.RtmGraph();
             let testScope;
             try {
@@ -1869,6 +1946,12 @@ function makeRawHandlers(store, opts) {
             if (verified) {
                 (0, test_evidence_1.writeTestEvidence)(root, { ts: new Date().toISOString(), head, tier: testScope.tier, passed: true, executedByAspec });
             }
+            // @implements A-SPEC-534.5 — RED-first outcome evidence for ART-8. Recorded UNCONDITIONALLY,
+            // unlike the green-only baseline above: a red-assertion recorded before the code is exactly what
+            // the red→green sequence needs. Append-only, one record per (A-SPEC, outcome) at this HEAD.
+            if (result.outcomeByFile) {
+                (0, test_outcomes_1.appendOutcomes)(root, (0, test_outcomes_1.buildOutcomeRecords)(result.outcomeByFile, anchors, head, new Date().toISOString()));
+            }
             // @implements A-SPEC-128
             // The baseline is written under EXACTLY the condition that already gates evidence: a run that
             // actually executed and passed. A red or skipped run must never become the reference point for
@@ -3060,7 +3143,7 @@ id: ${aspecId}
 type: A-SPEC
 title: ${(0, yaml_scalar_1.yamlScalar)(`Architecture Specification for ${a.title}`)}
 status: draft
-slice: ${a.sliceName}
+slice: ${(0, yaml_scalar_1.yamlScalar)(a.sliceName)}
 priority: P1
 independent_test: true
 depends_on:

package/dist/holmes/mcp/tool-schemas.js

@@ -203,6 +203,7 @@ exports.TOOL_SCHEMAS = {
                 head: str('Head rev (e.g. HEAD). Optional — omit to compare against a baseline.'),
                 since: str('Baseline label to compare against when no git range is given (default `last-green`, recorded by a passing test_run). Works with or without version control.'),
                 mark: str('Baseline label to record when the run passes (default `last-green`). Nothing is recorded for a red or skipped run.'),
+                mutate: str('T-SPEC id (e.g. T-SPEC-129.1). When set, runs that spec’s declared `kills` mutations against the A-SPEC’s source and reports which SURVIVED — a discriminating-power gap. Selective, opt-in; the ordinary run is skipped.'),
             },
             required: ['root'],
         },

package/dist/holmes/review/mutate.d.ts

@@ -0,0 +1,17 @@
+import { Mutation } from '../spec/kills';
+import { TestOutcome } from './test-runner';
+/**
+ * Did the mutation KILL the covering tests? A kill is a `red-assertion` in at least one covering
+ * file — the mutation broke behaviour and a test caught it. A green (or absent, or red-error) result
+ * is `survived`: the tests did not catch the change, which is a discriminating-power gap. Pure.
+ */
+export declare function mutationVerdict(outcomeByFile: Record<string, TestOutcome>, coveringFiles: string[]): 'killed' | 'survived';
+/**
+ * Apply one mutation to a source file, run the covering tests through the injected runner, judge the
+ * verdict, and ALWAYS restore the original source. `applied:false` when `where` is absent (the file
+ * is never touched).
+ */
+export declare function runKillsOnFile(sourceFile: string, mutation: Mutation, coveringFiles: string[], run: (files: string[]) => Record<string, TestOutcome>): {
+    applied: boolean;
+    verdict?: 'killed' | 'survived';
+};

package/dist/holmes/review/mutate.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mutationVerdict = mutationVerdict;
+exports.runKillsOnFile = runKillsOnFile;
+// @implements A-SPEC-534.8
+const fs = __importStar(require("node:fs"));
+const kills_1 = require("../spec/kills");
+/**
+ * Did the mutation KILL the covering tests? A kill is a `red-assertion` in at least one covering
+ * file — the mutation broke behaviour and a test caught it. A green (or absent, or red-error) result
+ * is `survived`: the tests did not catch the change, which is a discriminating-power gap. Pure.
+ */
+function mutationVerdict(outcomeByFile, coveringFiles) {
+    return coveringFiles.some((f) => outcomeByFile[f] === 'red-assertion') ? 'killed' : 'survived';
+}
+/**
+ * Apply one mutation to a source file, run the covering tests through the injected runner, judge the
+ * verdict, and ALWAYS restore the original source. `applied:false` when `where` is absent (the file
+ * is never touched).
+ */
+function runKillsOnFile(sourceFile, mutation, coveringFiles, run) {
+    const original = fs.readFileSync(sourceFile, 'utf8');
+    const mutated = (0, kills_1.applyMutation)(original, mutation);
+    if (mutated === null)
+        return { applied: false }; // where absent: never touch the file
+    fs.writeFileSync(sourceFile, mutated);
+    try {
+        return { applied: true, verdict: mutationVerdict(run(coveringFiles), coveringFiles) };
+    }
+    finally {
+        fs.writeFileSync(sourceFile, original); // ALWAYS restore, even if run() threw
+    }
+}

package/dist/holmes/review/test-outcomes.d.ts

@@ -0,0 +1,35 @@
+import { TestOutcome } from './test-runner';
+export declare const OUTCOMES_FILE: string;
+/**
+ * A durable, append-only record of a per-A-SPEC test outcome (REQ-534 RED-first evidence). Unlike
+ * `test-evidence.json` (overwritten each run), the SEQUENCE matters here — a red-assertion followed
+ * by a green is what ART-8 reads — so outcomes accumulate. `head` stamps the baseline commit the
+ * run sat on; the red (before code) and green (after code) of one slice share it while the tree is
+ * still dirty, which is exactly when the Stop gate reads them.
+ */
+export interface OutcomeRecord {
+    aspec: string;
+    outcome: TestOutcome;
+    ts: string;
+    head: string;
+    testFileDigest?: string;
+}
+/** Append outcome records as JSONL lines. Fail-open (recording must never break a run). */
+export declare function appendOutcomes(root: string, records: OutcomeRecord[]): boolean;
+/** Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers). */
+export declare function readOutcomes(root: string): OutcomeRecord[];
+/**
+ * @implements A-SPEC-534.5
+ * Expand per-file outcomes into per-A-SPEC records via the anchor map, stamping each with the run's
+ * head and ts. A file with no anchor (or an empty anchor list) contributes nothing — an outcome that
+ * cannot be attributed to an A-SPEC is not evidence about one. Pure.
+ */
+export declare function buildOutcomeRecords(outcomeByFile: Record<string, TestOutcome>, anchors: Record<string, string[]>, head: string, ts: string): OutcomeRecord[];
+/**
+ * Group outcomes by A-SPEC, keeping only records stamped with the given baseline `head` — a stale
+ * record from another commit cannot vouch for the current work (the isFresh discipline). Pure.
+ */
+export declare function groupOutcomesByAspec(records: OutcomeRecord[], head: string): Record<string, Array<{
+    outcome: TestOutcome;
+    ts: string;
+}>>;

package/dist/holmes/review/test-outcomes.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OUTCOMES_FILE = void 0;
+exports.appendOutcomes = appendOutcomes;
+exports.readOutcomes = readOutcomes;
+exports.buildOutcomeRecords = buildOutcomeRecords;
+exports.groupOutcomesByAspec = groupOutcomesByAspec;
+// @implements A-SPEC-534.3
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+exports.OUTCOMES_FILE = path.join('.ax', 'ledger', 'test-outcomes.jsonl');
+/** Append outcome records as JSONL lines. Fail-open (recording must never break a run). */
+function appendOutcomes(root, records) {
+    try {
+        const file = path.join(root, exports.OUTCOMES_FILE);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, records.map((r) => `${JSON.stringify(r)}\n`).join(''));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read every outcome record; missing file → [], broken lines skipped (same convention as the other ledgers). */
+function readOutcomes(root) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(root, exports.OUTCOMES_FILE), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of text.split('\n')) {
+        const s = line.trim();
+        if (!s)
+            continue;
+        try {
+            const r = JSON.parse(s);
+            if (r && typeof r === 'object' && typeof r.aspec === 'string' && typeof r.outcome === 'string'
+                && typeof r.ts === 'string' && typeof r.head === 'string') {
+                out.push(r);
+            }
+        }
+        catch { /* skip a corrupt line rather than fail the whole read */ }
+    }
+    return out;
+}
+/**
+ * @implements A-SPEC-534.5
+ * Expand per-file outcomes into per-A-SPEC records via the anchor map, stamping each with the run's
+ * head and ts. A file with no anchor (or an empty anchor list) contributes nothing — an outcome that
+ * cannot be attributed to an A-SPEC is not evidence about one. Pure.
+ */
+function buildOutcomeRecords(outcomeByFile, anchors, head, ts) {
+    const out = [];
+    for (const [file, outcome] of Object.entries(outcomeByFile)) {
+        for (const aspec of anchors[file] ?? [])
+            out.push({ aspec, outcome, ts, head });
+    }
+    return out;
+}
+/**
+ * Group outcomes by A-SPEC, keeping only records stamped with the given baseline `head` — a stale
+ * record from another commit cannot vouch for the current work (the isFresh discipline). Pure.
+ */
+function groupOutcomesByAspec(records, head) {
+    const out = {};
+    for (const r of records) {
+        if (r.head !== head)
+            continue;
+        (out[r.aspec] ??= []).push({ outcome: r.outcome, ts: r.ts });
+    }
+    return out;
+}

package/dist/holmes/review/test-runner.d.ts

@@ -32,6 +32,12 @@ export interface TestRunResult {
     unsupported?: string[];
     /** Which adapters actually ran, for evidence provenance. */
     ranWith?: string[];
+    /**
+     * @implements A-SPEC-534.5
+     * Per-file RED-first outcome (jest only). red-assertion | red-error | green, for the outcome ledger
+     * ART-8 reads. Other ecosystems do not classify outcomes yet, so they contribute nothing here.
+     */
+    outcomeByFile?: Record<string, TestOutcome>;
 }
 export type Ecosystem = 'jest' | 'pytest' | 'go' | 'rust' | 'java' | 'dotnet';
 /** Ecosystem of a test file, by extension/convention. `null` when no runner adapter exists for it. */
@@ -51,6 +57,24 @@ export declare function parseGoTestJson(out: string): Record<string, number>;
  * fabrications cannot produce evidence. Returns {} for unparseable output (caller falls back).
  */
 export declare function parseExecutedCounts(stdout: string, cwd: string): Record<string, number>;
+/**
+ * Per-file test outcome for RED-first evidence (REQ-534). `red-assertion` is a REAL red — a case ran
+ * and its assertion failed; `red-error` is a file that could not run its cases (load/collection/import
+ * error), which ART-8 (534.2) must NOT accept as a valid RED; `green` ran and all assertions passed.
+ */
+export type TestOutcome = 'red-assertion' | 'red-error' | 'green';
+/**
+ * @implements A-SPEC-534.1
+ * Classify each jest-executed file into red-assertion | red-error | green from `jest --json` stdout.
+ * Pure; unparseable/empty input → {} (same fail-soft convention as parseExecutedCounts).
+ *
+ * A failed assertion anywhere in a file wins (`red-assertion`) — that is a real red. A file that ran
+ * NO assertions but errored (testExecError, or status 'failed' with an empty assertion list — a
+ * load/collection/import failure) is `red-error`, which ART-8 must not accept as a valid RED. A file
+ * that executed ≥1 assertion with none failing is `green`. A file that only pended/skipped carries no
+ * evidence and is omitted entirely.
+ */
+export declare function classifyJestOutcomes(stdout: string, cwd: string): Record<string, TestOutcome>;
 /**
  * Parse pytest's built-in JUnit XML into per-file EXECUTED case counts — the pytest analogue of
  * parseExecutedCounts. `--junit-xml` ships with pytest core, so this needs no plugin, and it is the
@@ -75,6 +99,12 @@ export declare function parseJUnitXmlCounts(xml: string, ext?: string): Record<s
  * there), and a repo with no local jest could never yield meaningful suite evidence anyway.
  */
 export declare function jestEntry(cwd: string): string | null;
+/**
+ * @implements A-SPEC-534.8
+ * Run specific jest files and return only their RED-first outcomes — the runner `test_run --mutate`
+ * injects into runKillsOnFile. Scoped, jest only (the classifier is jest-only), fail-soft to {}.
+ */
+export declare function runJestOutcomes(files: string[], cwd: string): Record<string, TestOutcome>;
 /** Run the pytest half of a plan, taking execution evidence from pytest's built-in JUnit XML. */
 export declare function runPytest(files: string[], mode: TestRunPlan['mode'], cwd: string): {
     passed: boolean;

package/dist/holmes/review/test-runner.js

@@ -37,8 +37,10 @@ exports.planTestRun = planTestRun;
 exports.ecosystemOf = ecosystemOf;
 exports.parseGoTestJson = parseGoTestJson;
 exports.parseExecutedCounts = parseExecutedCounts;
+exports.classifyJestOutcomes = classifyJestOutcomes;
 exports.parseJUnitXmlCounts = parseJUnitXmlCounts;
 exports.jestEntry = jestEntry;
+exports.runJestOutcomes = runJestOutcomes;
 exports.runPytest = runPytest;
 exports.parseCargoTest = parseCargoTest;
 exports.runCargo = runCargo;
@@ -153,9 +155,57 @@ function parseExecutedCounts(stdout, cwd) {
         const abs = tr.name ?? tr.testFilePath ?? '';
         if (!abs)
             continue;
-        const rel = abs.startsWith(cwd) ? abs.slice(cwd.length).replace(/^[/\\]/, '') : abs;
         const ran = (tr.assertionResults ?? []).filter((a) => a.status === 'passed' || a.status === 'failed').length;
-        out[rel.split('\\').join('/')] = ran;
+        out[relTestPath(abs, cwd)] = ran;
+    }
+    return out;
+}
+/** Repo-relative, forward-slashed key for a jest test-file path — shared by the parsers below. */
+function relTestPath(abs, cwd) {
+    const rel = abs.startsWith(cwd) ? abs.slice(cwd.length).replace(/^[/\\]/, '') : abs;
+    return rel.split('\\').join('/');
+}
+/**
+ * @implements A-SPEC-534.1
+ * Classify each jest-executed file into red-assertion | red-error | green from `jest --json` stdout.
+ * Pure; unparseable/empty input → {} (same fail-soft convention as parseExecutedCounts).
+ *
+ * A failed assertion anywhere in a file wins (`red-assertion`) — that is a real red. A file that ran
+ * NO assertions but errored (testExecError, or status 'failed' with an empty assertion list — a
+ * load/collection/import failure) is `red-error`, which ART-8 must not accept as a valid RED. A file
+ * that executed ≥1 assertion with none failing is `green`. A file that only pended/skipped carries no
+ * evidence and is omitted entirely.
+ */
+function classifyJestOutcomes(stdout, cwd) {
+    const start = stdout.indexOf('{');
+    if (start < 0)
+        return {};
+    let data;
+    try {
+        data = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const tr of data?.testResults ?? []) {
+        const abs = tr.name ?? tr.testFilePath ?? '';
+        if (!abs)
+            continue;
+        const rel = relTestPath(abs, cwd);
+        const assertions = tr.assertionResults ?? [];
+        if (assertions.some((a) => a.status === 'failed')) {
+            out[rel] = 'red-assertion';
+            continue;
+        }
+        const executed = assertions.filter((a) => a.status === 'passed' || a.status === 'failed').length;
+        const errored = !!tr.testExecError || tr.status === 'failed';
+        if (executed === 0) {
+            if (errored)
+                out[rel] = 'red-error'; // ran nothing AND failed → could not execute its cases
+            continue; // otherwise all pending/skipped → no evidence, omit
+        }
+        out[rel] = errored ? 'red-error' : 'green';
     }
     return out;
 }
@@ -248,14 +298,25 @@ function runJest(files, mode, cwd) {
         // @implements A-SPEC-515.1 — the green path says what happened instead of handing back the
         // whole `--json` document. `tailOf` wraps the result too, so an unexpectedly long summary is
         // still bounded: a cap that any one path can escape is not a cap.
-        return { passed: true, tail: tailOf(summarizeJestJson(out) ?? out), executed: parseExecutedCounts(out, cwd) };
+        return { passed: true, tail: tailOf(summarizeJestJson(out) ?? out), executed: parseExecutedCounts(out, cwd), outcomes: classifyJestOutcomes(out, cwd) };
     }
     catch (e) {
         const err = e;
-        // A failing suite still emits --json on stdout, so execution evidence survives a red run.
-        return { passed: false, tail: tailOf(`${err.stdout ?? ''}\n${err.stderr ?? err.message ?? ''}`), executed: parseExecutedCounts(err.stdout ?? '', cwd) };
+        // A failing suite still emits --json on stdout, so execution evidence — and the red/green outcome
+        // classification (A-SPEC-534.1) — survives a red run.
+        return { passed: false, tail: tailOf(`${err.stdout ?? ''}\n${err.stderr ?? err.message ?? ''}`), executed: parseExecutedCounts(err.stdout ?? '', cwd), outcomes: classifyJestOutcomes(err.stdout ?? '', cwd) };
     }
 }
+/**
+ * @implements A-SPEC-534.8
+ * Run specific jest files and return only their RED-first outcomes — the runner `test_run --mutate`
+ * injects into runKillsOnFile. Scoped, jest only (the classifier is jest-only), fail-soft to {}.
+ */
+function runJestOutcomes(files, cwd) {
+    if (files.length === 0)
+        return {};
+    return runJest(files, 'scoped', cwd).outcomes;
+}
 /** Run the pytest half of a plan, taking execution evidence from pytest's built-in JUnit XML. */
 // @implements A-SPEC-502.1 — exported for the wiring test (a fake venv python capturing argv).
 function runPytest(files, mode, cwd) {
@@ -592,12 +653,16 @@ function runTestScope(scope, cwd) {
         let passed = true;
         const tails = [];
         const executedByFile = {};
+        const outcomeByFile = {}; // @implements A-SPEC-534.5 — jest only
         for (const eco of [...groups.keys()].sort()) {
             const r = runners[eco](groups.get(eco), plan.mode, cwd);
             ran.push(eco);
             passed = passed && r.passed;
             tails.push(`[${eco}] ${r.tail}`);
             Object.assign(executedByFile, r.executed);
+            const adapterOutcomes = r.outcomes;
+            if (adapterOutcomes)
+                Object.assign(outcomeByFile, adapterOutcomes);
             // @implements A-SPEC-137.1 — an adapter whose toolchain is absent reports its files as
             // unsupported; merge them so a scope that could not run them never reads as fully covered.
             const adapterUnsupported = r.unsupported;
@@ -613,6 +678,7 @@ function runTestScope(scope, cwd) {
         return {
             tier: scope.tier, mode: plan.mode, ranFiles: plan.testFiles, passed, skipped: false,
             tail: tails.join('\n'), executedByFile, ranWith: ran,
+            ...(Object.keys(outcomeByFile).length ? { outcomeByFile } : {}),
             ...(unsupported.length ? { unsupported } : {}),
         };
     }

package/dist/holmes/spec/kills.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A discriminating-power mutation (REQ-534 C-layer): a named change to production source that a
+ * covering test SHOULD turn red. Minimal DSL — a literal `where` replaced by `mutate`. `test_run
+ * --mutate` applies each and confirms the covering cases go red-assertion; a mutation that kills
+ * nothing is a coverage gap. Deliberately small; widen the DSL only when a real case needs it.
+ */
+export interface Mutation {
+    where: string;
+    mutate: string;
+}
+/** Extract well-formed {where,mutate} entries from `kills`. Lenient: anything else yields []. Pure. */
+export declare function parseKills(frontmatter: Record<string, unknown>): Mutation[];
+/** Replace the FIRST occurrence of `where` with `mutate`. null when `where` is empty or absent. Pure. */
+export declare function applyMutation(source: string, m: Mutation): string | null;

package/dist/holmes/spec/kills.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKills = parseKills;
+exports.applyMutation = applyMutation;
+/** Extract well-formed {where,mutate} entries from `kills`. Lenient: anything else yields []. Pure. */
+function parseKills(frontmatter) {
+    const raw = frontmatter.kills;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const item of raw) {
+        if (item && typeof item === 'object'
+            && typeof item.where === 'string'
+            && typeof item.mutate === 'string') {
+            out.push({ where: item.where, mutate: item.mutate });
+        }
+    }
+    return out;
+}
+/** Replace the FIRST occurrence of `where` with `mutate`. null when `where` is empty or absent. Pure. */
+function applyMutation(source, m) {
+    if (!m.where)
+        return null;
+    const i = source.indexOf(m.where);
+    if (i < 0)
+        return null;
+    return source.slice(0, i) + m.mutate + source.slice(i + m.where.length);
+}

package/dist/holmes/spec/spec-store.d.ts

@@ -59,6 +59,15 @@ export interface SpecStore {
  * exist" while looking straight at the file. The verdict stays; the silence does not.
  */
 export declare function unreadableSpecFiles(specsDir: string): string[];
+/**
+ * @implements A-SPEC-536.1
+ * The "not found" reason, enriched when the store is silently dropping unparseable files. BUG-1's
+ * silent-loss bit at the tool surface: a spec whose YAML frontmatter is broken is dropped by list()/
+ * read() and every handler answered a bare "spec <id> not found", hiding that the file EXISTS but
+ * cannot be parsed. When `unreadable` is empty the string is byte-identical to the legacy message
+ * (no regression); otherwise it names the skipped files and the usual cause.
+ */
+export declare function notFoundReason(id: string, unreadable: readonly string[]): string;
 export declare class LocalMarkdownRepository implements SpecStore {
     private readonly root;
     constructor(root: string);

package/dist/holmes/spec/spec-store.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MemorySpecStore = exports.LocalMarkdownRepository = exports.TargetPathOccupiedError = exports.SpecVersionConflictError = void 0;
 exports.unreadableSpecFiles = unreadableSpecFiles;
+exports.notFoundReason = notFoundReason;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -118,6 +119,22 @@ function unreadableSpecFiles(specsDir) {
     walk(specsDir);
     return out.sort();
 }
+/**
+ * @implements A-SPEC-536.1
+ * The "not found" reason, enriched when the store is silently dropping unparseable files. BUG-1's
+ * silent-loss bit at the tool surface: a spec whose YAML frontmatter is broken is dropped by list()/
+ * read() and every handler answered a bare "spec <id> not found", hiding that the file EXISTS but
+ * cannot be parsed. When `unreadable` is empty the string is byte-identical to the legacy message
+ * (no regression); otherwise it names the skipped files and the usual cause.
+ */
+function notFoundReason(id, unreadable) {
+    const base = `spec ${id} not found`;
+    if (unreadable.length === 0)
+        return base;
+    return `${base} — but ${unreadable.length} spec file(s) failed to parse and were skipped `
+        + `(a malformed one may be this spec): ${unreadable.join(', ')}. `
+        + `Check the YAML frontmatter (an unquoted ':' in a value is the usual cause).`;
+}
 class LocalMarkdownRepository {
     root;
     constructor(root) {

package/dist/holmes/spec/validator.js

@@ -257,6 +257,24 @@ function validateSpec(spec, resolve) {
         if (!def.parents.includes(parent.type))
             err('wrong-parent-type', `parent ${pid} is ${parent.type}, expected ${def.parents.join('|')}`);
     }
+    // @implements A-SPEC-534.7 — optional `kills` (discriminating-power mutations). Absent → no check
+    // (every existing T-SPEC is unaffected); present → it must be an array of {string where, string
+    // mutate}. A malformed shape is always an error, independent of status.
+    if (spec.type === 'T-SPEC' && spec.frontmatter.kills != null) {
+        const raw = spec.frontmatter.kills;
+        if (!Array.isArray(raw)) {
+            err('kills-shape', 'kills must be an array of {where, mutate}');
+        }
+        else {
+            raw.forEach((item, i) => {
+                const ok = !!item && typeof item === 'object'
+                    && typeof item.where === 'string'
+                    && typeof item.mutate === 'string';
+                if (!ok)
+                    err('kills-shape', `kills[${i}] must be {where: string, mutate: string}`);
+            });
+        }
+    }
     // gate: T-SPEC 4-quadrant coverage on approve attempt
     if (spec.type === 'T-SPEC' && spec.status === 'approved') {
         const cov = (spec.frontmatter.coverage ?? {});

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",

package/playbooks/tdd-slice/PLAYBOOK.md

@@ -0,0 +1,82 @@
+---
+name: holmes-tdd-slice
+description: >-
+  Use when writing or changing code under a Holmes-Kit gate — the built-in TDD discipline. Reach for
+  it when the gate says "Approved specification required before code modification", or when the Stop
+  hook prints an "ART-8 RED-first" observation. Restates the Iron Law and Red-Green-Refactor in holmes
+  terms and tags each rule with the article that enforces it (ART-1 no-spec-no-code, ART-4 coverage
+  honesty, ART-8 RED-first evidence), so you know which rules the gate checks and which are
+  honor-system. Key trap: a RED must be a red-assertion, not a red-error.
+---
+
+# tdd-slice
+
+테스트를 먼저 쓰고, **실패를 눈으로 본 뒤**, 통과시키는 최소 코드를 쓴다. 이것은 권고가 아니다 —
+holmes-kit은 이 규율의 상당 부분을 **헌법 조항으로 집행**한다. 그래서 이 스킬의 각 규칙 옆에는
+그것을 강제하는 조항이 붙어 있다: `[ART-N]`은 게이트가 막는 것, `[명예제]`는 네 판단에 맡기는 것.
+합리화로 빠져나갈 수 있는 규칙과 없는 규칙을 구별하라 — 없는 것은 정말 없다.
+
+## Iron Law
+
+**승인된 T-SPEC이 코드보다 먼저 있어야 하고, 그 커버 테스트가 코드 전에 RED로 관측돼야 한다.**
+
+- `[ART-1]` No Spec, No Code — 소스는 승인된 A-SPEC(+그것을 depends_on 하는 승인된 T-SPEC) 아래서만
+  바뀐다. 게이트가 코드 쓰기를 막는다. `promote-slice`가 그 승격을 다룬다.
+- `[ART-8]` 테스트-우선은 가정이 아니라 **관측**된다 — 소스가 바뀐 A-SPEC은 원장에
+  `red-assertion`(코드 전) → `green`(코드 후) 시퀀스를 남겨야 한다. 코드 뒤에 써서 즉시 통과한
+  테스트는 실패를 관측한 적이 없으니 아무것도 증명하지 못한다. 기본은 `track`(관측), 오너가
+  실측 후 `strict`(차단)로 올린다(config `redFirstEvidence`).
+
+## Red-Green-Refactor (holmes 판)
+
+1. **RED** — 커버 케이스를 `test_run`으로 돌려 **실패를 본다**. 이 실패는 `red-assertion`(케이스가
+   실행되고 어서션이 실패)이어야 한다.
+2. **GREEN** — 통과시키는 **최소** 코드를 쓴다. `test_run`이 `green`을 기록한다.
+3. **REFACTOR** — green을 유지한 채 정리한다. 원장은 그대로다.
+
+`test_run`이 매 실행마다 커버 파일별 outcome을 분류(`red-assertion`/`red-error`/`green`)해 원장에
+남긴다 — 이것이 ART-8이 읽는 증거다.
+
+## RED은 red-assertion 이어야 한다 (가장 흔한 함정)
+
+`[ART-8]` **`red-error`는 유효 RED가 아니다.** 심볼 부재로 인한 컴파일 실패, 임포트 오류,
+수집(collection) 실패는 케이스가 **실행조차 못 된** 상태다 — 그것은 "실패를 올바른 이유로
+관측했다"가 아니다. 함수가 아직 없어 컴파일이 깨지면, **틀린 값을 반환하는 스텁**을 먼저 넣어
+어서션이 붉어지게(=`red-assertion`) 만든 뒤 구현하라. superpowers가 "fails *correctly*"라 부른 것을
+holmes는 기계적으로 판별한다: `red-error`로는 red→green 시퀀스가 성립하지 않는다.
+
+## 좋은 테스트의 규칙
+
+- `[ART-4]` 선언한 커버리지는 **실제 앵커된 테스트 케이스**로 뒷받침돼야 한다 — 산문이 아니다.
+  T-SPEC이 커버를 선언하면 그 A-SPEC을 `@implements`로 앵커한 테스트 파일에 실제 케이스가 있고
+  실행돼야 한다. 없으면 게이트가 막는다.
+- `[ART-4]` 앵커는 **파일당 첫 줄**에 둔다 — 스캐너가 파일당 첫 `@implements`만 잡는다. 기존
+  파일의 비-첫줄에 새 A-SPEC 앵커를 넣으면 ART-4에 안 보인다. 새 테스트는 새 파일로.
+- `[명예제]` mock이 아니라 **실제 동작**을 단언하라. mock의 호출 여부를 재는 테스트는 제품이 아니라
+  네 mock을 시험한다. holmes의 T-SPEC 4분면(normal/negative/corner/boundary)은 관측 가능한 동작을
+  요구한다.
+- `[명예제]` 테스트를 쓰기 전에 **그 테스트를 실패시킬 프로덕션 변경을 한 문장으로 말하라**. 말할
+  수 없다면 그 테스트는 무엇도 지키지 못한다. (C층 `kills:`가 이를 스펙 필드로 승격한다.)
+
+## 집행 요약
+
+| 규칙 | 집행 |
+|---|---|
+| 스펙 없이 코드 없음 | `[ART-1]` PreToolUse 게이트 |
+| 커버 테스트가 실재·실행 | `[ART-4]` Stop 헌법 |
+| 코드 전 red-assertion→green | `[ART-8]` Stop 헌법(track/strict) |
+| mock 아닌 실동작·판별력 | `[명예제]` (C층 `kills:`로 선택 검증) |
+
+## 절차
+
+1. `promote-slice`로 대상 A-SPEC과 그 T-SPEC을 승인한다(`[ART-1]` 게이트를 연다).
+2. 커버 테스트를 **먼저** 쓴다. 심볼이 없어 컴파일이 깨지면 틀린-값 스텁을 넣는다.
+3. `test_run` — **red-assertion**을 본다. `red-error`면 그건 아직 RED가 아니다; 스텁으로 고쳐라.
+4. 통과시키는 최소 코드를 쓴다.
+5. `test_run` — `green`. 원장에 red→green이 남는다(`[ART-8]` 증거).
+6. green 유지하며 refactor.
+
+## 검증
+
+`src/holmes/playbooks/tdd-slice.test.ts` — 이 스킬이 집행 태그(ART-1/4/8)와 red-assertion/red-error
+구별을 담고, 설치기가 이를 발견함을 고정한다. 상시 스위트 포함.