@chrono-meta/fh-gate 1.4.44 → 1.4.46

package/CATALOG.md

@@ -8,6 +8,24 @@ AI reads this file first when searching past work. Open individual files for det
 
 <!-- Add entries in reverse date order (newest at top) -->
 
+### 2026-06-27 | forge-harness | #sister-asset, #cross-audit, #hermes-agent, #nous-research, #self-improving-agent, #skills, #memory, #messaging-gateway
+**File:** tracks/_contrib/session_2026_06_27_hermes-agent-nous-self-improving-cross-audit.md (committed via _contrib consent lane — authored in an ephemeral cloud session where tracks/_audit/ is gitignored/non-durable)
+Sister-asset cross-audit of **Hermes Agent (Nous Research)** vs FH, triggered by a LinkedIn post (esperer) distilling Hermes' official *Tips & Best Practices* (post = faithful doc summary, not original methodology; same summary circulates on Threads). ~90% of Hermes' best-practice surface is already present in FH (persistent memory · auto-skill-from-repetition · skill self-improvement · context economy · delegation · model selection — all grounded to `plugins/*/skills/`), and on the **self-improvement + governance** axis FH is *ahead*: Hermes *advises* "review auto-generated skills," FH *mechanically enforces* it (pre-commit 4-axis gate + steel/phantom-quench + HITL). Key honest finding — most apparent "gaps" dissolve: cron/daemon is a **deliberate FH boundary** (`self_evolution_routine.md` §8 "recommendation surface, not a daemon"), external-memory-providers **already audited** (companion-store pluggable, 2026-06-11). Only genuine absence = **messaging gateway** (Telegram/Slack daily-driver), which is a *delivery channel*, not methodology.
+- Decision: thin real increment (FH at/ahead of frontier on methodology). Convergence is evidence FH's core thesis is now frontier-standard; differentiator narrows to governance (sharpens positioning). Import candidates: messaging-gateway *boundary-record* (1 line in modes_and_value), front-load-context onboarding tip, write_approval framing — all C-tier/operator-gated.
+- Open: operator decision — (1) record messaging-gateway as deliberate out-of-scope boundary or leave unaddressed (recommend: record); (2) fold onboarding-tip wording into dialogue playbook or skip.
+
+### 2026-06-27 | forge-harness | #sister-asset, #cross-audit, #loop-engineering, #harness-engineering, #verification, #generator-evaluator, #hitl
+**File:** tracks/_audit/session_2026_06_27_loop-engineering-silbal.md
+Full sister-asset cross-audit of the "Loop Engineering" video (실밸개발자, 2026-06-22, 37min, source-closed via yt-dlp transcript) vs FH — a Korean harness-engineering creator's self-stated Prompt→Context→**Harness→Loop** lineage. Strong independent convergence with FH: "verifiable goal or it's a token-burning machine" = Done-When/check-class; Generator≠Evaluator mandatory split (cites Lance Martin 6× measured) = judge-robustness/no-judge-only-path; Osmani's 6 components (Automation/Worktree/Skill/Connector/Sub-agent/Memory) = component-lens orthogonal to FH's 6-axis process-lens (same isomorphism already logged for ETCLOVG); Human-in→Human-on = HITL floor+governor. FH propagation increment beyond the frame: Surface-Class Degrade Invariant (irreversible→fail-closed, structurally blocking the video's #4 "production accident" mode that it only budget-caps) + Typed-Verdict Channel + surface-class-scoped HITL. Convergent with same-day frontier digest (reliability/control = consensus axis — Fowler, Statewright, both frontier-digest-sourced/not independently verified; Semantic Early-Stopping −38% = the video's stop-condition).
+- Decision: A-tier full audit (new loop-engineering resolution, not the C-tier dedup path). Import 3 (loop=cron+state-reading-model one-liner; training-mode-dry-run→graduated-autonomy ladder; Lance Martin 6× as external judge-robustness anchor — re-verify source before any published cite). No external delivery (YouTube = no write surface); creator-channel quarterly re-scan (active Harness→Loop thread).
+- Open: import-3 distillation is operator-gated (HITL); phantom-citation guard on the Lance Martin "6×" and any digest arXiv IDs before they enter a shipped asset.
+
+### 2026-06-26 | forge-harness | #sister-asset, #cross-audit, #harness-engineering, #awesome-list, #listing-target, #irreversibility, #phantom-citation
+**File:** tracks/_audit/session_2026_06_26_awesome-harness-engineering.md
+Sister-asset cross-audit of `ai-boost/awesome-harness-engineering` (~2k★, CC0, 180+ items, the now-named consensus field index) vs FH — breadth-index ↔ FH operating-governance depth; the list's own philosophy ("the model can't do it alone") is FH's thesis stated by the field. Import-first (bidirectionality): Harmonist (IDE-hook non-model gate "even frontier models cannot override" = independent convergence with FH's pre-commit 4-axis + judge-robustness anchor), OAP (fail-closed + *cryptographic* audit — the crypto-marker FH's GPG-option residual lacks), nah (intent-taxonomy permission guard ↔ mcp_tool_gating), OWASP LLM06 (the *real* external anchor for #121). Dedup/independent-convergence: "What makes a harness a harness" 4-condition litmus (FH already imported via sanguinekim §6) + NLAH (already governance-moat-measured). FH propagation increment = Surface-Class Degrade Invariant (irreversible→fail-closed direction, absent from the list's gates) + adversarial-derivation provenance + surface-class-scoped HITL floor.
+- Decision: FH not listed → early-listing window under Generators & Meta-Harnesses (fh-gate npm); submission deferred to operator HITL + Pre-Publish Gate + 3-persona audit (external-facing PR, governance-depth single entry not self-promo).
+- Open: (1) listing-PR GO is operator-owned; (2) side-finding — frontier-digest emitted a **phantom arXiv (2606.26094 ≠ the cited title)**, NOT cited; logged as auto-pipeline phantom-injection signal.
+
 ### 2026-06-24 | forge-harness | #sister-asset, #cross-audit, #ponytail, #measurement-integrity, #mechanical-anchor, #agent-portability, #growth-lessons
 **File:** tracks/_audit/session_2026_06_24_ponytail-lazy-senior-dev.md (+ cross-ref links: multi_model_sidecar_strategy.md, measurement-integrity-checklist.md)
 Full sister-asset cross-audit of `ponytail` (DietrichGebert/ponytail@dedc97c, ~50k★ reviewer-claimed/unverified, "lazy senior dev" minimal-code field skill) vs FH, run with 3 sidecars (Codex repo-grounded gpt-5.5 + Gemini 3.1 Pro breadth, identity-probe verified + CC FH-doctrine extraction); governor source-closed every load-bearing claim to repo file:line (phantom-quench: 10 GROUNDED/0 PHANTOM). Convergence on 4 axes (strongest = axis C verify-instrument, where independence is clearest; A/D may be shared-ecosystem-standard): portable-AGENTS.md+thin-adapter distribution · safety-guard-never-cut + *measured* (20/20 adversarial tier vs bare prompt 95%) · verify-instrument-before-measuring (twice — #126 baseline artifact + hook-bleed) · residual-as-tracked-debt (un-named gap = the only failure signal). FH increment = the safety guard is prose at every host (hooks only inject ruleset; check-rule-copies.js guards text-drift not runtime), so FH's mechanical-anchor + adversarial-regression layer is the gap to fill.

package/CLAUDE.md

@@ -177,7 +177,7 @@ that skill class, and not a retroactive sweep of all routers.
 the 4-axis verification chain runs **automatically before the first commit** of that session.
 No user request is needed — this is a mandatory autonomous step, not a proposal.
 
-**Commit gate**: `git commit` on FH asset changes is hard-blocked by `templates/.git-hooks/pre-commit` until all required axes PASS. Hook installation (one-time): `git config core.hooksPath templates/.git-hooks && chmod +x templates/.git-hooks/pre-commit`
+**Commit gate**: `git commit` on FH asset changes is hard-blocked by `templates/.git-hooks/pre-commit` until all required axes PASS. Hook installation (one-time): `git config core.hooksPath templates/.git-hooks && chmod +x templates/.git-hooks/pre-commit templates/.git-hooks/pre-push` (the same `core.hooksPath` also activates the **pre-push** Destructive-Op gate — see that section below).
 
 ```
 FH asset modified → Axis 1 (regression_guard.sh --pr {BRANCH})
@@ -257,6 +257,17 @@ regression of the judge-robustness principle (mechanical anchor over judge-only
 | Forward | `phantom-quench` | Phantom references, paths that don't exist, stale external links |
 | Record | `edit-manifest` RECORD | Logs predicted impact — closes the predict-verify loop for future harvest-loop |
 
+**Cross-family complement (Axis 2, autonomous when consented)**: `steel-quench` dispatches in-session at the
+session tier — **same family** as the governor, so it shares the governor's blind spots. For a **load-bearing**
+change (gates · irreversible-surface code · doctrine), `auto-decorrelation` is the standing cross-family
+verifier: when the configured sidecar panel is discoverable it recruits ≥1 **different-family** auditor (per
+the UAP mapping — e.g. `codex` `gpt-5.5`/xhigh for repo-grounded code/security, `agy`/Gemini for breadth) and
+degrades honestly to single-session when none is. **Autonomous once the operator has consented** (one-time,
+in the UAP — `[[user_adaptation_profile]]`); the governor keeps the terminal verdict and **source-grounds**
+every sidecar finding before acting on it (`[[feedback_judge_robustness_mechanical_anchor]]`). Dogfood
+2026-06-27: a cross-family pass caught a HIGH execution-side-effect blind spot the same-family reviewers +
+the target-tier sim all shared — the decorrelation value made concrete.
+
 ### Mode D Model Notice (fires once, at the same trigger as this gate)
 
 The moment FH self-development work begins (= the gate's own activation trigger: an FH asset is about
@@ -300,11 +311,18 @@ A gate guarding an irreversible boundary that silently proceeds when its tooling
 §unlisted → ask (fail-closed)`, corpus-grounding's fail-closed-no-generator — this section names the
 floor they share.)
 
-**Salience residual**: both irreversible surfaces are explicitly **un-hookable** (the pre-commit hook
-cannot catch a separate-repo go-public or a branch delete — they stay AI-behavioral), so this fail-closed
-direction is **prose, not hook-enforced** — a real weak-model fail-open risk, not a silent one. Backstop:
-the portable `templates/PRE-PUBLISH-CHECKLIST.md` carries the tooling-down item as a human-readable gate,
-and the direction is target-tier-sim'd (Sonnet) before it is relied on.
+**Salience residual** (corrected 2026-06-27 — the surfaces split, they are not uniformly un-hookable):
+the **pre-commit** hook cannot catch either irreversible surface *at commit time*. But "pre-commit can't"
+≠ "no hook can": the **Destructive-Op git surface** (remote branch delete · force/non-ff push) fires at
+*push* time and **is** caught — `templates/.git-hooks/pre-push` now mechanically enforces the enumerate
+(see §Destructive-Op Gate). **`npm publish`** is likewise caught — `scripts/public_surface_scan_files.sh`
+wired into `prepublishOnly` scans the published file set at the registry boundary (see §Pre-Publish Hook
+coverage (c)). What stays **genuinely un-hookable** is only the **separate-repo go-public surface**
+(`gh repo create --public` / visibility flip / first push to a new public remote — not an npm or git op
+against this repo, so no hook here sees it): for *that* surface the fail-closed direction is still **prose,
+not hook-enforced** — a real weak-model fail-open risk, not a silent one. Backstop for the prose half: the
+portable `templates/PRE-PUBLISH-CHECKLIST.md` carries the tooling-down item as a human-readable gate, and
+the direction is target-tier-sim'd (Sonnet) before it is relied on.
 
 ---
 
@@ -339,14 +357,28 @@ not marketplace-gate alone:
 `LICENSE`/`README` contains a **private harness name or internal codename** · **module paths encode
 internal acronyms**.
 
-**Hook coverage — two distinct actions**: **(a) repo-go-public** (`gh repo create --public` / visibility
-flip) is irreversible and usually in a **separate repo** — the pre-commit hook **cannot** catch it, so it
-stays **AI-behavioral** (proactive trigger below) **+ a portable checklist** (`templates/PRE-PUBLISH-CHECKLIST.md`).
-**(b) committing operator-private tokens into public-tracked content of THIS repo IS an effective publish** —
-caught mechanically by the pre-commit **confidentiality scan** (staged added lines vs the gitignored
-`.public-surface-patterns`; HIGH/MED block, `PUBLIC_SURFACE_OK=1` overrides + logs). Tier-independent but
-**only as strong as the loaded patterns** (committed `.defaults` keep it non-blind; company literals need
-the gitignored override populated per env).
+**Hook coverage — three distinct actions**: **(a) repo-go-public** (`gh repo create --public` / visibility
+flip / first push to a new public remote) is irreversible and usually in a **separate repo** — no hook of
+*this* repo can catch it, so it stays **AI-behavioral** (proactive trigger below) **+ a portable checklist**
+(`templates/PRE-PUBLISH-CHECKLIST.md`). **(b) committing operator-private tokens into public-tracked content
+of THIS repo IS an effective publish** — caught mechanically by the pre-commit **confidentiality scan**
+(staged added lines vs the gitignored `.public-surface-patterns`; HIGH/MED block, `PUBLIC_SURFACE_OK=1`
+overrides + logs). **(c) `npm publish`** is **mechanically gated against the loaded patterns, on the `npm` CLI path with scripts
+enabled** by `scripts/public_surface_scan_files.sh` (wired into `prepublishOnly`; also `npm run release` runs
+it *outside* the lifecycle). It scans the **full content of the exact npm-published file set** (`npm pack
+--dry-run`) — *not* just a commit diff — so a token committed before the scan existed, or carried in a
+`files[]` entry, is caught at the registry boundary (HIGH/MED block, `PUBLIC_SURFACE_OK=1` override + log;
+fail-closed if patterns/file-set unresolved, if the parse looks partial, **or if the gitignored operator
+override is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone / CI).
+**Named residuals (it is a denylist on the npm CLI, not a universal secret-scanner)**: (i) `npm publish
+--ignore-scripts` / a CI `.npmrc ignore-scripts=true` / `pnpm`/`yarn publish` **skip the lifecycle hook** —
+route publishes through `npm run release` or an explicit CI scan step; (ii) it scans only the **loaded
+patterns**, so an **un-patterned secret shape** (an API key the patterns don't describe) still ships; (iii) on
+a runner without the gitignored override it is defaults-only unless populated; (iv) it scans **working-tree
+content, not the final tarball bytes** — benign here (content-neutral lifecycle: prepare=chmod, no prepack)
+but re-open if a content-generating publish lifecycle is added (cross-family audit 2026-06-27). So of the Pre-Publish surface,
+**(b) commit-time and (c) npm-publish are mechanized** (with the residuals above); only **(a) separate-repo
+go-public stays genuinely un-hookable** (prose + checklist).
 
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Pre-Publish-Hook-Coverage` — the
 > two-layer pattern (literals only in the gitignored source), honest scope + residuals, and the PR #109
@@ -373,9 +405,31 @@ force-push, scrub of tracked history, bulk deletion of session records / tracks
    strongest available tier (floor semantics, §Tier-floor); a below-floor pass is provisional.
 3. **Destroy** only what passed — REVIEW blocks a scripted delete chain (script exits 1).
 
+**Mechanical floor (pre-push hook — git-side surfaces)**: for the surfaces that happen at *push* time
+— **remote branch/ref deletion** and **force / non-fast-forward push** (history rewrite) —
+`templates/.git-hooks/pre-push` enforces this gate **mechanically**, not just as prose. It detects the
+destructive refspec on stdin (delete = local SHA all-zeros; force = remote SHA not an ancestor of local),
+runs a **per-ref verdict** (branch delete: SAFE = fully merged → allowed · CHECK = commits off base, 0
+unique paths → blocked for a judged look · REVIEW = unique paths → blocked for recovery; force/non-ff and
+tag/notes deletes always block) and **blocks** unless `DESTRUCTIVE_OP_OK=1` (an explicit, logged operator
+acknowledgment — used *after* enumerate + recover) is set. The verdict is load-bearing (a merged-branch
+cleanup passes; a silent-loss CHECK does not), so this is the enumerate as a mechanical floor, not prose.
+**What it does and does NOT close (honest)**: it closes the **honest-weak-model** gap — an agent that
+simply *forgot* the prose gate is now mechanically stopped. It does **not** close the **injected/adversarial**
+gap: an agent under instruction can set the override or `--no-verify`, and a client-side hook is readable
+and bypassable by design. The hard floor for the adversarial case is **server-side branch protection**
+(GitHub *Restrict deletions* / *Restrict force pushes*) — this hook is the honest-model floor, branch
+protection is the hard floor. **Scope**: covers only git pushes *from a hook-installed repo* (`npm publish`
+is mechanized separately via `prepublishOnly` — see §Pre-Publish Hook coverage (c)); the remaining non-git
+surface — a separate-repo `gh repo create --public` / visibility flip — is genuinely un-hookable and stays
+prose + `PRE-PUBLISH-CHECKLIST.md`. **Portability**: bash-3.2 safe (macOS
+default `/bin/bash`); the original draft used a bash-4 associative array that crashed fail-OPEN on 3.2 —
+caught in test, a portability defect class worth noting.
+
 **Degrade direction**: per the Surface-Class Degrade Invariant above, if `predelete_check.sh` is missing
-or errors, this irreversible surface **fails closed** — enumerate by hand or take an explicit operator
-override; a tooling-down enumerate step never silently degrades into "just delete it."
+or errors, this irreversible surface **fails closed** — the pre-push hook blocks (enumerate by hand or
+take the explicit `DESTRUCTIVE_OP_OK=1` override); a tooling-down enumerate step never silently degrades
+into "just delete it."
 
 > Origin: 2026-06-10 branch cleanup — pre-deletion enumeration recovered a parallel session's card
 > (weekly-audit completion + #88 merge state) that existed **only on an unmerged branch** with zero

package/knowledge/shared/dialogue/ai_dialogue_playbook.md

@@ -15,7 +15,9 @@
 3. **Returning user**: AI proposes top 3 priorities from session card + cadence overdue notices
 4. **New user**: 2-sentence FH intro → project connect offer
 
-**Don't front-load**: avoid dumping context manually. FH auto-reads the right files. Start with intent, not background.
+**Don't front-load** *background* (front-load = pre-dumping context before stating intent): avoid dumping project context manually. FH auto-reads the right files. Start with intent, not background.
+
+**Do front-load *specifics***: for the immediate task, paste the concrete artifact — the full error traceback, the exact file path, the failing input — rather than describing it. This is not a contradiction of the line above: FH auto-reads *background* context, but it cannot guess the *specific* traceback/path the current task hinges on; pasting it directly removes a round-trip. (Sister-asset import, Hermes Agent cross-audit 2026-06-27.)
 
 ---
 
@@ -44,6 +46,8 @@ Lower levels cannot override higher. Conflicts → higher scope wins.
 
 **AI contribution model**: AI proposes (drafts all changes, prepares commits, creates PR draft) — user approves final push/PR. Human-in-the-loop is non-negotiable for shared repos.
 
+**Explaining the gate to a no-hook user (staged approve/deny framing)**: Mode A/B/D users get the gate mechanically (pre-commit hook + 4-axis). A **Mode C** user (plugin/skill only, no hook) gets no mechanical enforcement — so explain the *same* HITL as a **staged write**: an auto-generated change is *staged*, surfaced for an explicit approve/deny, and only then committed. The vocabulary travels even when the hook doesn't. (Sister-asset import of Hermes' `write_approval` framing, cross-audit 2026-06-27 — wording only; FH's mechanism is unchanged and stronger.)
+
 ---
 
 ## Amplifier / Coach Dual Mode

package/knowledge/shared/harness-core/claude_md_gate_details.md

@@ -27,6 +27,20 @@ operator is at the keyboard. Autonomous mode keeps the honest residual + weekly-
 fake-close it. Gemini cross-analysis 2026-06-16 reached this verdict independently, converging with the
 existing FH stance.
 
+**External anchor (verified 2026-06-27): Open Agent Passport (OAP), arXiv:2603.20953** ("Before the Tool
+Call: Deterministic Pre-Action Authorization for Autonomous AI Agents", Uchibeke, 2026-03; Apache-2.0,
+DOI 10.5281/zenodo.18901596) intercepts tool calls before execution and emits a **cryptographically
+signed audit record** (median 53ms; 0% vs 74.6% social-engineering success under restrictive vs
+permissive policy). It is independent convergence on the *direction* the GPG hard-close gestures at —
+**crypto-signed provenance over runner self-attestation** — and a peer-grade anchor for the
+fabricated-marker residual. **Caveat (FH's point still stands):** OAP's signature is only as strong as
+its key custody — if the signing key is held by the same runtime being audited, it is the same
+"runner-computed signature = false security" failure named above. So OAP corroborates the *crypto-audit
+direction*, not a dissolution of the irreducibility argument: the genuine close still needs an
+*operator-held, uncached* key. Sister cross-link only — FH does not adopt runtime pre-action
+interception (a different mechanism from the commit-time marker); this anchor strengthens the case for
+the existing GPG-option residual, it does not mandate new infra.
+
 ---
 
 ## §Sim-Dispatch-Fallback

package/knowledge/shared/harness-core/harness_6axis_framework.md

@@ -134,3 +134,5 @@ Lower levels cannot override higher. AI contribution → PR proposal only (no di
 
 - arXiv:2603.25723 (*Natural-Language Agent Harnesses*, NLAH) — external academic sibling that independently converges on the same core thesis: a harness control layer can be an executable natural-language object, not code. NLAH measures the natural-language-harness form empirically; FH governs and compounds it.
 - arXiv:2606.06324 (*HarnessFix / ETCLOVG*, 2026-06) — sibling on the **orthogonal** axis: where NLAH and FH describe the harness as a *process/control* object, HarnessFix supplies a *component taxonomy* of what a deployed harness contains (7 layers — Execution · Tooling · Context · Lifecycle · Observability · Verification · Governance). Its **V layer maps onto FH's Axis-5 gate on 3 of its 4 functions** (intermediate validation → steel/phantom-quench · final-output eval → completion-claim discipline · regression testing → regression_guard); its *readiness-check* function maps to FH pre-flight gates (install-doctor / asset-placement-gate) that sit outside Axis-5. Its named **Observability** layer is a structural axis FH lacks — FH's nearest coverage is *retrospective audit* (weekly_audit, subagent_invocations_log), not runtime observability (import candidate for `harness-doctor`). Cross-audit: `tracks/_audit/session_2026_06_19_harnessfix-etclovg-cross-audit.md`.
+- "Loop Engineering" (실밸개발자 video, 2026-06-22) — independent-convergence sibling on the **component lens** (Osmani's 6 components: Automation/trigger · Worktree · Skill · Connector · Sub-agent maker/checker · Memory) and on **Axis-5**: its central claim "a verifiable goal or it's a token-burning machine" is FH's Done-When + check-class, and its mandatory Generator≠Evaluator split is FH's no-judge-only-path. FH increment beyond the frame = the Surface-Class Degrade Invariant (irreversible → fail-closed), which structurally blocks the video's "production accident" failure mode it only budget-caps. **Vocabulary import (distilled 2026-06-27):** FH adopts the video's crisp one-line definition it otherwise lacked — *an autonomous loop = a scheduler (cron or `/loop`) + a state-reading judgment model that decides each next action* — the legible newcomer-facing phrasing for FH's `/loop` / autonomous-loop / `harvest-loop` assets. Cross-audit: `tracks/_audit/session_2026_06_27_loop-engineering-silbal.md`.
+- **Mechanical-anchor / Non-Model Ground — training-layer external anchors** (Axis-5, verified 2026-06-27): arXiv:2606.27369 (*RiVER*, 2026-06-25) trains LLMs on optimization/coding tasks using **deterministic execution feedback in place of ground-truth labels** — FH's "bind the terminal verdict to a non-model anchor, not a judge's agreement" stated at the training layer; arXiv:2606.27359 (*When are likely answers right?*, Zenn & Geiping, 2026-06-25) shows sequence probability is **predictive within a dataset but does not transfer to decoding decisions** — peer evidence that likelihood/self-consistency is not reliable correctness. Both are independent-convergence anchors for `feedback_judge_robustness_mechanical_anchor`, not FH measurements.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.44",
+  "version": "1.4.46",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -25,7 +25,8 @@
   "scripts": {
     "prepare": "chmod +x bin/fh-gate.js bin/fh-run.js bin/fh-goal.js scripts/fh-gate.sh scripts/fh-run.sh scripts/fh-goal.sh",
     "test": "bash scripts/selfcheck.sh",
-    "prepublishOnly": "bash scripts/selfcheck.sh"
+    "prepublishOnly": "bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
+    "release": "bash scripts/public_surface_scan_files.sh && npm publish"
   },
   "engines": {
     "node": ">=16"

package/plugins/fh-commons/skills/convergence-loop/SKILL.md

@@ -153,3 +153,15 @@ Setup complete (gate name, pass criteria, max rounds confirmed)
 + Convergence declared (all items pass for 2 consecutive rounds) or escalation triggered
 + Per-round result table output
 ```
+
+## External anchor (independent convergence)
+
+arXiv:2606.27009 (*Semantic Early-Stopping for Iterative LLM Agent Loops*, 2026-06-25, verified
+2026-06-27) externally validates this skill's core thesis — **stop on convergence, not a fixed
+iteration cap** — measuring −38% tokens vs fixed caps when stopping is *judge-free* (consecutive draft
+embeddings stop changing in meaning). **Sharpening, not blind validation**: the same paper finds
+*quality-gated* stopping (a judge call each round) counterproductive due to judging cost, and that an
+oracle picking the best round beats any stopping rule — so the harder problem is *which* round was
+best, not *when* to stop. Implication for this skill's judge/checklist-gated rounds: per-round
+verification cost is real; prefer a cheap convergence signal where one exists, and keep `max rounds N`
+bounded.

package/plugins/fh-commons/skills/token-budget-gate/SKILL.md

@@ -173,3 +173,15 @@ Calibration data improves future estimates for the same task type (no model trai
 
 **Downstream**:
 - No mandatory chain — gate verdict is the output; task execution follows user decision
+
+---
+
+## External anchor (independent convergence)
+
+arXiv:2606.27009 (*Semantic Early-Stopping for Iterative LLM Agent Loops*, 2026-06-25, verified
+2026-06-27) measures **−38% tokens** by stopping iterative agent loops on semantic convergence instead
+of a fixed iteration cap — external evidence that the largest avoidable spend in loop-shaped work is
+*over-iteration*, the cost class this gate exists to flag. Caveat (provenance-honest): the same paper
+found *judge-gated* stopping counterproductive (judging cost outweighs the saving), so the saving is
+real only when the convergence signal is cheap. Pairs with `convergence-loop` (the stop-rule side of
+the same finding).

package/plugins/fh-meta/agents/persona-innovator.md

@@ -2,7 +2,7 @@
 name: persona-innovator
 description: Generates naming candidates, frame proposals, and external frontier absorption signals for harness evolution. Combines the harness owner's ideation algorithm with external frontier scanning. Use when new naming or frames are needed, or during autonomous meta-simulation rounds. Supports environments without naming history (Path B).
 tools: Read, Grep, Glob, WebSearch, WebFetch
-version: 0.2
+version: 0.3
 ---
 
 You are the **Persona Innovator** — an ideation agent that simulates the harness owner's Layer 2 (ideation) and Layer 2-a (naming) capabilities while extending them with external frontier signals.
@@ -145,8 +145,61 @@ For each gap or absorbed signal:
 4. **Matrix position**: where does this sit relative to existing named concepts? (complement / extend / replace)
 5. **Gating condition**: what real-world validation should precede official adoption? (simplicity guard applied)
 
+## Self-floor discipline (FH floors, applied to the innovator itself)
+
+These are FH's own governance floors turned reflexively on this agent's process — an ideation tool
+must obey the floors it helps the harness enforce. Run them as declared steps, not by luck. (Origin:
+2026-06-27 Mode-F run whose self-reported blocks B1–B6 mapped exactly onto floors FH already held but
+had never wired into the innovator.)
+
+- **H1 — Provenance floor at intake.** Any *quantified* external claim you surface (a multiplier, %,
+  benchmark, "N× faster") must carry a primary-source citation. Without one, mark it `SPECULATIVE` and
+  **bar it from any asset-insertion recommendation** — it may appear only as a caveated sister-link.
+  (FH's phantom-citation discipline pulled forward from verify-time to ideation-intake.) The frontier
+  is hype-dense; an uncited number is noise until sourced.
+- **H1-b — Source-credibility tier (PILOT, axis A, 2026-06-27 — measured, not yet a fixed floor).**
+  "Has a citation" ≠ "a recognized source" (operator: live data grows insight *only* from "검증되고
+  인정받는 소스"). Tier every citation: **T1** = peer-reviewed / DOI / a recognized venue or standards
+  body (arXiv-with-citations · OWASP/NIST · an established conference); **T2** = a named practitioner or
+  a maintained project (identifiable author · live repo · non-anonymous); **T3** = unvetted (blog /
+  forum / SNS) — usable only as a **pointer to verify**, never the terminal anchor. A quantified claim
+  anchored *only* by T3 stays `SPECULATIVE` (same bar as no citation). Mechanical pairing: the cited
+  source is **live-fetched and supports the claim** (phantom-quench — the mechanical anchor; a T3
+  mis-labelled T1 still must pass it), and its **tier is named** in the output. *Check class: judged
+  (the tier label) — pair: phantom-quench on the cited source; the SPECULATIVE bar degrades to the
+  phantom-quench verdict, not to the tier label alone.*
+  **Status — rule now, promotion apparatus deliberately NOT built (cross-family-reviewed 2026-06-27).**
+  H1-b is in force as a rule today. It does **not** claim a measured-promotion path yet, because the honest
+  promotion metric is **anchor-tier rate**, which the `operations.md` 60% gate does **not** measure (that
+  gate measures *proposal-acceptance* — a different quantity; reusing it here would be the exact H4
+  forced-fit this agent warns against), and `subagent_invocations_log.yaml` has **no `anchor_tier` field**
+  for any consumer to aggregate. So promoting H1-b to a hardened floor — and only *then* expanding to axes
+  B (decorrelated synthesis) / C (operator-taste calibration) / D — first requires **building a real
+  anchor-tier counter** (schema field + an aggregator), which is deferred until the rule has earned it
+  (evidence-threshold: don't wire the meter before the rule proves worth measuring). Self-application:
+  H1-b is subject to H3 — its own promotion is the evaluator's verdict, never the innovator's.
+- **H2 — Dedup-grep before naming.** Before proposing any name or frame, Grep/Read the *live target
+  asset* (the actual SKILL / rules / CLAUDE.md row the concept would land in), not your memory of it.
+  If the discriminator already exists there, drop the candidate — you were about to reinvent it.
+  No-reinvention is mechanized at your own input, not discovered downstream.
+- **H3 — No self-adopt.** Your output is generator-side only. You may rank and recommend, but you
+  **never declare a candidate "ready to adopt"** — that verdict belongs to a separate evaluator
+  (steel-quench / challenger). State explicitly that adoption is gated on that pass. (no-judge-only-path,
+  applied to you: a generator that grades its own output inflates.)
+- **H4 — Threshold-reuse quantity-match.** When a candidate reuses an existing FH gate/threshold (e.g.
+  the 60/40 promotion gate), state whether that gate *measures the same quantity* the candidate needs.
+  If it measures something else (proposal-outcomes vs verification-pass-streaks), flag a **forced-fit
+  risk** instead of asserting the reuse.
+
 ## Output format
 
+### Section 0 — Ground-state & blocks (always first)
+
+Tag every candidate and signal `GROUNDED` (anchored in an FH asset or a cited primary source) or
+`SPECULATIVE` (not yet anchored — H1 applies). Then list **where the ideation process got blocked** —
+each block: what stalled · why · what would unblock it. An empty block list on a non-trivial run is a
+smell (you self-graded the friction away); the friction is part of the yield, not a failure to hide.
+
 ### Section 1 — Naming candidates (from internal gaps)
 
 For each candidate:
@@ -175,7 +228,9 @@ Limit to 3–5 signals.
 
 ### Section 3 — Recommended next action (1 item)
 
-Single highest-leverage action: either (a) officially adopt a naming candidate or (b) absorb an external signal. State why this one, not the others.
+Single highest-leverage action you *recommend* (not adopt — H3): either (a) a naming candidate to put
+forward for adoption or (b) an external signal to absorb. State why this one, not the others, and that
+adoption is gated on the separate-evaluator pass.
 
 ## Simplicity guard
 

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -74,6 +74,20 @@ diversity vs the orchestrator** (orchestrator = Claude/opus → recruit GPT or G
   surfaces a one-line `token-budget-gate` ask per run (*"recruiting codex (~N) — proceed?"*) unless the
   operator has set `paid_auto: true` in the UAP. One-time feature-consent ≠ consent to this spend now.
 - Dispatch via `agent-composer` (no re-implementation of dispatch).
+- **Liveness / hang-catch (mandatory — a hung sidecar never notifies).** A backgrounded CLI that hangs
+  (stuck on a sandbox/file-tool prompt, auth, or network) **does not exit**, so the background-completion
+  signal *never fires* — passive waiting is the wrong model and silently stalls the run (observed
+  2026-06-27: a `codex exec` that asked to read repo files hung at 0-output with no session log, and the
+  turn waited on a notification that could not come). So **bound it actively, never wait open-endedly**:
+  - Set an explicit timeout on every sidecar call (`timeout N …` or the dispatch tool's timeout).
+  - Watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
+    session/log advancing (e.g. `~/.codex/sessions/<today>`). 0 output **and** no session created after a
+    short bound (≈2–3 min for codex/agy) = **hung, not slow** → kill and recover, do not keep waiting.
+  - **Recover, don't stall**: kill → diagnose (a file-tool/sandbox hang is the common cause) → retry with
+    the **robust pattern** — inline the needed file content into the prompt via **stdin** so the sidecar
+    needs no file tools (verified fix 2026-06-27: `{ instructions; cat file1; cat file2; } | codex exec -`
+    succeeded where reading-files-itself hung) — or degrade to single-session with a recorded note.
+  This is the sidecar twin of `mcp-circuit-breaker` (stop a stuck external call instead of hanging on it).
 
 ## Step 5 — Role split + source-grounded acceptance (S-2)
 

package/plugins/fh-meta/skills/context-doctor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: context-doctor
-description: Reduces token waste in Claude Code sessions. Scans projects to automatically generate .claudeignore files, and guides on over-read files and /clear timing. In hub environments, regularly audits bloated CLAUDE.md/MEMORY.md/memory/*.md files and proposes compression. Usable standalone without a hub clone.
+description: Reduces token waste in Claude Code sessions across two axes — context footprint (auto-generates .claudeignore, guides over-read files and /clear timing) and command output (routes to a command-output proxy/hook such as rtk to trim verbose CLI stdout). In hub environments, regularly audits bloated CLAUDE.md/MEMORY.md/memory/*.md files and proposes compression. Usable standalone without a hub clone.
 user-invocable: true
 allowed-tools: ["Read", "Write", "Bash", "Glob", "Grep"]
 model: sonnet
@@ -14,10 +14,13 @@ complexity_routing:
 
 # context-doctor — Token Efficiency Diagnosis + Automatic Prescription
 
-Diagnoses the 3 main causes of session token waste and prescribes immediate remedies:
+Diagnoses the main causes of session token waste and prescribes immediate remedies:
 1. No `.claudeignore` → unnecessary files loaded wholesale into context
 2. Repeated full reads of large files → paying the same cost N times
 3. Not using `/clear` after direction changes → continuing work with accumulated noise
+4. Verbose CLI output → every `git`/`ls`/build/test call floods context with stdout (a *different* layer from 1–3 — see §Command-Output Reduction)
+
+**Two reduction axes — keep them distinct.** Causes 1–3 are the **context-footprint** axis (what gets read *into* context: files, history). Cause 4 is the **command-output** axis (tokens produced *by* the tools you run). `.claudeignore` cannot touch command output, and a command-output proxy cannot touch file reads — they are complementary, not substitutes.
 
 **Standalone install** — this skill works normally with plugin install only, without cloning the full meta-harness.
 
@@ -154,6 +157,21 @@ Keep it reversible: compress the *working copy* in context, not the source of tr
 
 > **Detail**: See `SKILL_detail.md §Headroom` — external tooling option (redundancy-category targeting, integration surfaces, caveats) — read when executing a compression pass and considering tooling.
 
+## Command-Output Reduction (the command-output axis)
+
+The reductions above all act on the **context-footprint** axis (files, history read *into* context). They do nothing for the **command-output** axis: the stdout of every shell call. A single `git log`, `npm test`, `ls -R`, or build run can dump thousands of tokens per call, and an agent makes dozens of calls per session — often the *largest* single token sink, and invisible to `.claudeignore`.
+
+**This axis is risk-gated — reduce it only when token cost is the binding constraint.** Unlike `.claudeignore` (which blocks provably-irrelevant *files* — near-lossless and reversible), command-output reduction works by **filtering live output, which is lossy by design**: a dropped middle line — an error inside build output, one file in a long listing — is invisible to the agent, which cannot know what it did not see. So the **default is to do nothing here**. Turn it on only in a genuinely token-scarce setting (a metered / quota-limited backend where token budget is the *binding* constraint — not where tokens are merely plentiful); there the savings outweigh the information-loss risk, and **everywhere else they do not**.
+
+**Two ways to reduce, safest first:**
+1. **Per-call narrow flags (default — non-lossy, no install).** Prefer narrow commands: `git log --oneline -N` over bare `git log`, `--quiet` on noisy tools, `head`/`tail` on long output. The agent chooses what to drop, per call — no blind heuristic. This suffices for almost every session.
+2. **A command-output proxy/hook (only under token scarcity).** A **Claude Code hook that rewrites verbose commands through a token-reducing proxy**, transparent (0 prompt-side overhead). Recommended tool: **`rtk` (Rust Token Killer)**, a CLI proxy that filters dev-command output (the tool reports ~60–90% savings on dev operations), wired so `git status` → `rtk git status` happens automatically.
+   - ⚠️ **Name collision**: there is an unrelated `reachingforthejack/rtk` (Rust Type Kit). Verify the Token-Killer build — `rtk gain` (savings analytics) should work; "command not found" means the wrong binary.
+   - **No-reinvention**: FH **routes to** this tool; it does not rebuild a token-killer. Install + hook wiring live in the user's own config (global `CLAUDE.md` / `settings.json`), never reimplemented here.
+   - ⚠️ **Never filter a command whose output a mechanical gate parses.** FH gates read raw command output (a pre-commit hook greps, `regression_guard` diffs). A filtered `git diff` / `git log` feeding a gate gives the gate wrong input — the same trap as grepping filtered prose for a verdict (typed-verdict-channel). Keep filtering off gate-input paths, and keep a raw escape hatch (`rtk proxy <cmd>`).
+
+**Prescription**: in a normal token environment, recommend the per-call flags (#1) and **do not** suggest installing a proxy — the lossy risk is not worth it. Only when the user states or exhibits a binding token constraint, surface #2 with the gate-input caveat above. Diagnosis + recommendation, never an auto-install.
+
 ## External User Environment Adaptation
 
 | Environment | Behavior |
@@ -201,6 +219,7 @@ Explicit invocation (`/context-doctor`) always runs regardless of suppress state
 - "token waste", "session is slow", "reading the whole file", "claudeignore", "context cleanup"
 - "context diet", "memory audit", "CLAUDE.md is heavy", "MEMORY.md size"
 - "context engineering", "context rot", "context collapse"
+- "command output is huge", "verbose output", "rtk", "token killer", "trim command output"
 
 ### Natural Language Triggers (activates without internal vocabulary)
 
@@ -216,6 +235,7 @@ Also activates when an external user expresses without token/context terminology
 | "Answers get weird as the session gets longer" | Accumulated context noise | Step 3 (/clear recommended) |
 | "Context is getting full", "context meter is high" | Approaching context limit | Step 3 — propose Wrap-then-Compact pattern |
 | "context engineering", "doing context engineering", "context rot setting in" | 2026 industry term for context discipline (Chroma 2025 / Anthropic) | Step 2 + Step 3 |
+| "every git command dumps a wall of text", "the build output eats my context" | Verbose command output flooding context | §Command-Output Reduction (route to proxy/hook) |
 
 ## Three-Doctor Loop Integration
 

package/plugins/fh-meta/skills/goal-quench/SKILL.md

@@ -65,6 +65,38 @@ Therefore:
 
 ---
 
+## Autonomy Ladder — how unattended a loop may run (orthogonal to the budget modes)
+
+The core/pro/max modes above key on **budget**. This ladder keys on a different axis — **how much human approval gates each action** — for a *recurring or unattended* loop (the autonomous-loop / `/loop` case), not a one-shot /goal. **Climbing a rung here changes *oversight*, never budget — the two never move together.** (Distilled 2026-06-27 from the "Loop Engineering" sister-asset's "training-mode dry-run → graduated autonomy"; cross-audit `tracks/_audit/session_2026_06_27_loop-engineering-silbal.md`.)
+
+Three rungs, climbed one at a time:
+
+| Rung | What runs | Human role |
+|---|---|---|
+| **① dry-run** | run once manually; observe outputs; **no irreversible actions** | reads every output |
+| **② step-approval** | each action is HITL-gated before it fires | approves per action |
+| **③ unattended** | the loop runs on its own | reviews after the fact |
+
+- **Graduation threshold (measured):** a loop climbs one rung only after **K consecutive clean rounds across a 2+ session/run window** — the *2+ window* reuses `operations.md`'s promotion-window discipline (`accepted ≥ 60%` / recurrence `N=3`). **`K=2` is a provisional default, not yet calibrated** — no loop-run data exists yet; revisit once it does (same honesty as this SKILL's `N=10` budget baseline). "Clean" = the round's Done-When passed **AND** a positive downstream verdict (pipeline-conductor / sidecar = CLEAN) **AND zero S/M-grade governor-catch and zero post-ship correction** — *not merely* the absence of a governor-catch, so a quieter or weaker governor cannot manufacture graduation. **The streak is recorded per round in a local autonomy ledger** (the hub keeps it at `tracks/_meta/autonomy_ledger.yaml`; a plugin-only user keeps their own — anywhere in their project, the path is theirs): date · task · done-when · verdict · governor-catch grades · `clean:` bool. Graduation reads that ledger. A *computation script* (`scripts/`) that auto-derives the current rung from the ledger is **deliberately deferred** until enough entries exist to compute over — building the meter before there is a stream to measure is the speculative-infra the evidence-threshold discipline forbids. *Check class: a **measured count** (ledger grep) over a **judged per-round grade** — and the grade must be bound to the round's own challenger / steel-quench S/M verdict (the upstream adversarial artifact), **never an author self-grade** (else "measured" laundering a judge-only path). Until ≥~5 entries make a computation script worth writing, the streak is judged-and-hand-recorded — provisional by construction.*
+- **Irreversible carve-out (non-negotiable — the FH increment over the video):** any action whose effect **cannot be undone within the loop** — not only the two examples (Destructive-Op delete/rewrite · Pre-Publish go-public) but **any irreversible side-effecting write** (an MCP `ask`-tier send, a payment, an outbound publish) — **never reaches rung ③**. Membership is the **mechanical surface test** of CLAUDE.md's Surface-Class Degrade Invariant + `mcp_tool_gating` (grep the action surface; do **not** self-label), not a match against the two examples. Such actions stay at rung ② (HITL) **permanently**, regardless of clean-round count. The video graduates a loop to fully unattended; FH caps graduation at the irreversible boundary. *Check class: judged — pair: a target-tier blind sim per CLAUDE.md §Target-tier sim gate (run 2026-06-27, Sonnet, PASS — a remote-branch-delete loop correctly held at rung ② despite 4 clean rounds). **Prose-enforced, not hook-enforced** — accepted residual, named not silent.*
+- **Demotion (fail toward oversight, with a liveness floor):** any governor-catch, failed Done-When, or correction **resets the clean-round counter and drops the loop one rung** — autonomy is earned per-window, surrendered on the first miss, never sticky. A failed **dry-run (①)** has no lower rung: it **blocks graduation and surfaces to the operator**, it does not demote. A loop that **flips promote/demote ≥ `N=3` times in a window** (reusing operations.md's recurrence-escalation) is a noisy boundary — **freeze at the lower rung and surface**, do not keep oscillating.
+
+### Two paths to autonomous completion (by surface reversibility)
+
+The clean-streak graduation above governs **unattended-no-review** operation (rung ③) — right for *narrow recurring loops* (digest / sync / poll) where nobody sees each result, so the demonstrated clean streak is the only safety. **Most substantive novel work — including FH self-development — rarely earns a clean streak by design.** It is not therefore undelegatable; it takes a second, *reviewed* path:
+
+- **Path 1 — clean-streak → unattended (rung ③):** narrow recurring tasks reviewed by nobody. Safety = the demonstrated clean streak (above).
+- **Path 2 — *deliver-then-review* (a reviewed mode at rung ②'s oversight, not a new rung):** autonomous *execution* with **mandatory review** — it is **not** unattended and **does not climb to ③** (only Path 1's clean streak reaches ③). **Intent-seeded, mechanically-reversible, reviewed** work — mapped-project acceleration / first-project creation (human intent via Q&A), and self-dev absorption of frontier-digest-style insights. Path 2 permits autonomous *execution to completion without per-step approval*, but operator review of the delivery is **mandatory before the work is consumed** — that review is what *substitutes for* pre-approval. All five conditions hold, or it is not Path 2:
+  - **(a) Human-selected direction — auditable, not narrated.** A human *selects* the direction; record it in the ledger (`seed: human-selected` or `innovator-proposed-human-confirmed`). An agent/innovator-proposed direction is a **candidate, not a seed**, until a human confirmation token is recorded — the machine never chooses *what* to pursue (self-echo guard, `[[fh_self_evolution_vision]]`).
+  - **(b) Mechanically-reversible surface — anchored to the carve-out partition, never a softer self-judged "reversible".** Admissible only if **all three**: **(i)** not a member of the line-81 **grep-gated** irreversible set (mechanical); **(ii)** **effect-confined** to git-tracked tree state — no file deletion, external/DB mutation, or out-of-tree write. *This conjunct is **judged, not grepped** — whether delivered code mutates external state at runtime is behavioral, not a static surface (`[[qa_static_dynamic_complementarity]]`); its pairing is the line-81 grep **plus** the operator's mandatory delivery review, and it **degrades safely** — unproven confinement → treat as irreversible → HITL.* **(iii)** **not yet consumed** (a *local, unpushed-to-shared* commit; the instant a delivery is pushed to a shared branch or read by a downstream cache / CI / registry it is *effectively published* and re-enters HITL, per CLAUDE.md §Pre-Publish (b)).
+  - **(c) Reviewable delivery.** Deliver as **discrete revertable units** (per-commit, not one opaque squash) so **rollback granularity ≥ delivery granularity**. A batch too large to actually review makes "roll back after seeing it" theoretical and voids the substitute-for-approval logic — cap the batch at what the operator can review; interdependent commits (revert 1 orphans 3) forfeit per-unit rollback and must be delivered batch-atomic with a higher review bar.
+  - **(d) Rollback feeds demotion.** A Path-2 delivery the operator rolls back **forces the next same-class run back to rung ② full step-approval (per-action *pre*-approval — stricter than Path 2's post-hoc review) until one clean delivery**, and counts toward the `N=3` noisy-boundary freeze — so the riskier, novel work-class is not handed the looser path. *Prose-enforced, not hook-enforced — accepted residual (the ledger records the rolled-back delivery; no hook yet gates the next run, same status as the carve-out's residual above).* (Rung ② names two oversight strengths: Path-2 = human reviews *after* each delivery; demoted = human approves *before* each action. The demotion tightens from the former to the latter.)
+  - **(e) Every action in the run is gated by (b) — not just the final delivery** *(cross-family review caught this 2026-06-27; the Claude same-family reviewers + the Sonnet sim shared the blind spot)*. Producing a Path-2 delivery often requires *executing* code — running a test suite, installing a package, a migration script, an API call. **Each such action is itself subject to (b)**: a preparation step that deletes files, mutates a DB, installs an untrusted dependency, or hits the network has an **irreversible *runtime* effect that no `git` rollback undoes** (git reverts the tree, never the execution that produced it). So it stops for HITL exactly like a delivery action — and a purely *exploratory/speculative* run that would do any of these is not "free" either. "Reversible" is a property of **every action in the run**, never only of the committed tree at the end.
+
+**Direction is always human (both paths).** The machine automates *execution* of a human-seeded direction, never the direction itself. **The irreversible carve-out holds regardless of path** — anything irreversible, effect-unconfined, or already-consumed (at *delivery or during the run*) stays pre-action HITL; Path 2 delegates only what (b) admits.
+
+---
+
 ## Triggers
 
 - `/goal-quench`