@chrono-meta/fh-gate 1.4.45 → 1.4.46

package/CATALOG.md

@@ -8,6 +8,12 @@ AI reads this file first when searching past work. Open individual files for det
 
 <!-- Add entries in reverse date order (newest at top) -->
 
+### 2026-06-27 | forge-harness | #sister-asset, #cross-audit, #hermes-agent, #nous-research, #self-improving-agent, #skills, #memory, #messaging-gateway
+**File:** tracks/_contrib/session_2026_06_27_hermes-agent-nous-self-improving-cross-audit.md (committed via _contrib consent lane — authored in an ephemeral cloud session where tracks/_audit/ is gitignored/non-durable)
+Sister-asset cross-audit of **Hermes Agent (Nous Research)** vs FH, triggered by a LinkedIn post (esperer) distilling Hermes' official *Tips & Best Practices* (post = faithful doc summary, not original methodology; same summary circulates on Threads). ~90% of Hermes' best-practice surface is already present in FH (persistent memory · auto-skill-from-repetition · skill self-improvement · context economy · delegation · model selection — all grounded to `plugins/*/skills/`), and on the **self-improvement + governance** axis FH is *ahead*: Hermes *advises* "review auto-generated skills," FH *mechanically enforces* it (pre-commit 4-axis gate + steel/phantom-quench + HITL). Key honest finding — most apparent "gaps" dissolve: cron/daemon is a **deliberate FH boundary** (`self_evolution_routine.md` §8 "recommendation surface, not a daemon"), external-memory-providers **already audited** (companion-store pluggable, 2026-06-11). Only genuine absence = **messaging gateway** (Telegram/Slack daily-driver), which is a *delivery channel*, not methodology.
+- Decision: thin real increment (FH at/ahead of frontier on methodology). Convergence is evidence FH's core thesis is now frontier-standard; differentiator narrows to governance (sharpens positioning). Import candidates: messaging-gateway *boundary-record* (1 line in modes_and_value), front-load-context onboarding tip, write_approval framing — all C-tier/operator-gated.
+- Open: operator decision — (1) record messaging-gateway as deliberate out-of-scope boundary or leave unaddressed (recommend: record); (2) fold onboarding-tip wording into dialogue playbook or skip.
+
 ### 2026-06-27 | forge-harness | #sister-asset, #cross-audit, #loop-engineering, #harness-engineering, #verification, #generator-evaluator, #hitl
 **File:** tracks/_audit/session_2026_06_27_loop-engineering-silbal.md
 Full sister-asset cross-audit of the "Loop Engineering" video (실밸개발자, 2026-06-22, 37min, source-closed via yt-dlp transcript) vs FH — a Korean harness-engineering creator's self-stated Prompt→Context→**Harness→Loop** lineage. Strong independent convergence with FH: "verifiable goal or it's a token-burning machine" = Done-When/check-class; Generator≠Evaluator mandatory split (cites Lance Martin 6× measured) = judge-robustness/no-judge-only-path; Osmani's 6 components (Automation/Worktree/Skill/Connector/Sub-agent/Memory) = component-lens orthogonal to FH's 6-axis process-lens (same isomorphism already logged for ETCLOVG); Human-in→Human-on = HITL floor+governor. FH propagation increment beyond the frame: Surface-Class Degrade Invariant (irreversible→fail-closed, structurally blocking the video's #4 "production accident" mode that it only budget-caps) + Typed-Verdict Channel + surface-class-scoped HITL. Convergent with same-day frontier digest (reliability/control = consensus axis — Fowler, Statewright, both frontier-digest-sourced/not independently verified; Semantic Early-Stopping −38% = the video's stop-condition).

package/CLAUDE.md

@@ -177,7 +177,7 @@ that skill class, and not a retroactive sweep of all routers.
 the 4-axis verification chain runs **automatically before the first commit** of that session.
 No user request is needed — this is a mandatory autonomous step, not a proposal.
 
-**Commit gate**: `git commit` on FH asset changes is hard-blocked by `templates/.git-hooks/pre-commit` until all required axes PASS. Hook installation (one-time): `git config core.hooksPath templates/.git-hooks && chmod +x templates/.git-hooks/pre-commit`
+**Commit gate**: `git commit` on FH asset changes is hard-blocked by `templates/.git-hooks/pre-commit` until all required axes PASS. Hook installation (one-time): `git config core.hooksPath templates/.git-hooks && chmod +x templates/.git-hooks/pre-commit templates/.git-hooks/pre-push` (the same `core.hooksPath` also activates the **pre-push** Destructive-Op gate — see that section below).
 
 ```
 FH asset modified → Axis 1 (regression_guard.sh --pr {BRANCH})
@@ -257,6 +257,17 @@ regression of the judge-robustness principle (mechanical anchor over judge-only
 | Forward | `phantom-quench` | Phantom references, paths that don't exist, stale external links |
 | Record | `edit-manifest` RECORD | Logs predicted impact — closes the predict-verify loop for future harvest-loop |
 
+**Cross-family complement (Axis 2, autonomous when consented)**: `steel-quench` dispatches in-session at the
+session tier — **same family** as the governor, so it shares the governor's blind spots. For a **load-bearing**
+change (gates · irreversible-surface code · doctrine), `auto-decorrelation` is the standing cross-family
+verifier: when the configured sidecar panel is discoverable it recruits ≥1 **different-family** auditor (per
+the UAP mapping — e.g. `codex` `gpt-5.5`/xhigh for repo-grounded code/security, `agy`/Gemini for breadth) and
+degrades honestly to single-session when none is. **Autonomous once the operator has consented** (one-time,
+in the UAP — `[[user_adaptation_profile]]`); the governor keeps the terminal verdict and **source-grounds**
+every sidecar finding before acting on it (`[[feedback_judge_robustness_mechanical_anchor]]`). Dogfood
+2026-06-27: a cross-family pass caught a HIGH execution-side-effect blind spot the same-family reviewers +
+the target-tier sim all shared — the decorrelation value made concrete.
+
 ### Mode D Model Notice (fires once, at the same trigger as this gate)
 
 The moment FH self-development work begins (= the gate's own activation trigger: an FH asset is about
@@ -300,11 +311,18 @@ A gate guarding an irreversible boundary that silently proceeds when its tooling
 §unlisted → ask (fail-closed)`, corpus-grounding's fail-closed-no-generator — this section names the
 floor they share.)
 
-**Salience residual**: both irreversible surfaces are explicitly **un-hookable** (the pre-commit hook
-cannot catch a separate-repo go-public or a branch delete — they stay AI-behavioral), so this fail-closed
-direction is **prose, not hook-enforced** — a real weak-model fail-open risk, not a silent one. Backstop:
-the portable `templates/PRE-PUBLISH-CHECKLIST.md` carries the tooling-down item as a human-readable gate,
-and the direction is target-tier-sim'd (Sonnet) before it is relied on.
+**Salience residual** (corrected 2026-06-27 — the surfaces split, they are not uniformly un-hookable):
+the **pre-commit** hook cannot catch either irreversible surface *at commit time*. But "pre-commit can't"
+≠ "no hook can": the **Destructive-Op git surface** (remote branch delete · force/non-ff push) fires at
+*push* time and **is** caught — `templates/.git-hooks/pre-push` now mechanically enforces the enumerate
+(see §Destructive-Op Gate). **`npm publish`** is likewise caught — `scripts/public_surface_scan_files.sh`
+wired into `prepublishOnly` scans the published file set at the registry boundary (see §Pre-Publish Hook
+coverage (c)). What stays **genuinely un-hookable** is only the **separate-repo go-public surface**
+(`gh repo create --public` / visibility flip / first push to a new public remote — not an npm or git op
+against this repo, so no hook here sees it): for *that* surface the fail-closed direction is still **prose,
+not hook-enforced** — a real weak-model fail-open risk, not a silent one. Backstop for the prose half: the
+portable `templates/PRE-PUBLISH-CHECKLIST.md` carries the tooling-down item as a human-readable gate, and
+the direction is target-tier-sim'd (Sonnet) before it is relied on.
 
 ---
 
@@ -339,14 +357,28 @@ not marketplace-gate alone:
 `LICENSE`/`README` contains a **private harness name or internal codename** · **module paths encode
 internal acronyms**.
 
-**Hook coverage — two distinct actions**: **(a) repo-go-public** (`gh repo create --public` / visibility
-flip) is irreversible and usually in a **separate repo** — the pre-commit hook **cannot** catch it, so it
-stays **AI-behavioral** (proactive trigger below) **+ a portable checklist** (`templates/PRE-PUBLISH-CHECKLIST.md`).
-**(b) committing operator-private tokens into public-tracked content of THIS repo IS an effective publish** —
-caught mechanically by the pre-commit **confidentiality scan** (staged added lines vs the gitignored
-`.public-surface-patterns`; HIGH/MED block, `PUBLIC_SURFACE_OK=1` overrides + logs). Tier-independent but
-**only as strong as the loaded patterns** (committed `.defaults` keep it non-blind; company literals need
-the gitignored override populated per env).
+**Hook coverage — three distinct actions**: **(a) repo-go-public** (`gh repo create --public` / visibility
+flip / first push to a new public remote) is irreversible and usually in a **separate repo** — no hook of
+*this* repo can catch it, so it stays **AI-behavioral** (proactive trigger below) **+ a portable checklist**
+(`templates/PRE-PUBLISH-CHECKLIST.md`). **(b) committing operator-private tokens into public-tracked content
+of THIS repo IS an effective publish** — caught mechanically by the pre-commit **confidentiality scan**
+(staged added lines vs the gitignored `.public-surface-patterns`; HIGH/MED block, `PUBLIC_SURFACE_OK=1`
+overrides + logs). **(c) `npm publish`** is **mechanically gated against the loaded patterns, on the `npm` CLI path with scripts
+enabled** by `scripts/public_surface_scan_files.sh` (wired into `prepublishOnly`; also `npm run release` runs
+it *outside* the lifecycle). It scans the **full content of the exact npm-published file set** (`npm pack
+--dry-run`) — *not* just a commit diff — so a token committed before the scan existed, or carried in a
+`files[]` entry, is caught at the registry boundary (HIGH/MED block, `PUBLIC_SURFACE_OK=1` override + log;
+fail-closed if patterns/file-set unresolved, if the parse looks partial, **or if the gitignored operator
+override is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone / CI).
+**Named residuals (it is a denylist on the npm CLI, not a universal secret-scanner)**: (i) `npm publish
+--ignore-scripts` / a CI `.npmrc ignore-scripts=true` / `pnpm`/`yarn publish` **skip the lifecycle hook** —
+route publishes through `npm run release` or an explicit CI scan step; (ii) it scans only the **loaded
+patterns**, so an **un-patterned secret shape** (an API key the patterns don't describe) still ships; (iii) on
+a runner without the gitignored override it is defaults-only unless populated; (iv) it scans **working-tree
+content, not the final tarball bytes** — benign here (content-neutral lifecycle: prepare=chmod, no prepack)
+but re-open if a content-generating publish lifecycle is added (cross-family audit 2026-06-27). So of the Pre-Publish surface,
+**(b) commit-time and (c) npm-publish are mechanized** (with the residuals above); only **(a) separate-repo
+go-public stays genuinely un-hookable** (prose + checklist).
 
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Pre-Publish-Hook-Coverage` — the
 > two-layer pattern (literals only in the gitignored source), honest scope + residuals, and the PR #109
@@ -373,9 +405,31 @@ force-push, scrub of tracked history, bulk deletion of session records / tracks
    strongest available tier (floor semantics, §Tier-floor); a below-floor pass is provisional.
 3. **Destroy** only what passed — REVIEW blocks a scripted delete chain (script exits 1).
 
+**Mechanical floor (pre-push hook — git-side surfaces)**: for the surfaces that happen at *push* time
+— **remote branch/ref deletion** and **force / non-fast-forward push** (history rewrite) —
+`templates/.git-hooks/pre-push` enforces this gate **mechanically**, not just as prose. It detects the
+destructive refspec on stdin (delete = local SHA all-zeros; force = remote SHA not an ancestor of local),
+runs a **per-ref verdict** (branch delete: SAFE = fully merged → allowed · CHECK = commits off base, 0
+unique paths → blocked for a judged look · REVIEW = unique paths → blocked for recovery; force/non-ff and
+tag/notes deletes always block) and **blocks** unless `DESTRUCTIVE_OP_OK=1` (an explicit, logged operator
+acknowledgment — used *after* enumerate + recover) is set. The verdict is load-bearing (a merged-branch
+cleanup passes; a silent-loss CHECK does not), so this is the enumerate as a mechanical floor, not prose.
+**What it does and does NOT close (honest)**: it closes the **honest-weak-model** gap — an agent that
+simply *forgot* the prose gate is now mechanically stopped. It does **not** close the **injected/adversarial**
+gap: an agent under instruction can set the override or `--no-verify`, and a client-side hook is readable
+and bypassable by design. The hard floor for the adversarial case is **server-side branch protection**
+(GitHub *Restrict deletions* / *Restrict force pushes*) — this hook is the honest-model floor, branch
+protection is the hard floor. **Scope**: covers only git pushes *from a hook-installed repo* (`npm publish`
+is mechanized separately via `prepublishOnly` — see §Pre-Publish Hook coverage (c)); the remaining non-git
+surface — a separate-repo `gh repo create --public` / visibility flip — is genuinely un-hookable and stays
+prose + `PRE-PUBLISH-CHECKLIST.md`. **Portability**: bash-3.2 safe (macOS
+default `/bin/bash`); the original draft used a bash-4 associative array that crashed fail-OPEN on 3.2 —
+caught in test, a portability defect class worth noting.
+
 **Degrade direction**: per the Surface-Class Degrade Invariant above, if `predelete_check.sh` is missing
-or errors, this irreversible surface **fails closed** — enumerate by hand or take an explicit operator
-override; a tooling-down enumerate step never silently degrades into "just delete it."
+or errors, this irreversible surface **fails closed** — the pre-push hook blocks (enumerate by hand or
+take the explicit `DESTRUCTIVE_OP_OK=1` override); a tooling-down enumerate step never silently degrades
+into "just delete it."
 
 > Origin: 2026-06-10 branch cleanup — pre-deletion enumeration recovered a parallel session's card
 > (weekly-audit completion + #88 merge state) that existed **only on an unmerged branch** with zero

package/knowledge/shared/dialogue/ai_dialogue_playbook.md

@@ -15,7 +15,9 @@
 3. **Returning user**: AI proposes top 3 priorities from session card + cadence overdue notices
 4. **New user**: 2-sentence FH intro → project connect offer
 
-**Don't front-load**: avoid dumping context manually. FH auto-reads the right files. Start with intent, not background.
+**Don't front-load** *background* (front-load = pre-dumping context before stating intent): avoid dumping project context manually. FH auto-reads the right files. Start with intent, not background.
+
+**Do front-load *specifics***: for the immediate task, paste the concrete artifact — the full error traceback, the exact file path, the failing input — rather than describing it. This is not a contradiction of the line above: FH auto-reads *background* context, but it cannot guess the *specific* traceback/path the current task hinges on; pasting it directly removes a round-trip. (Sister-asset import, Hermes Agent cross-audit 2026-06-27.)
 
 ---
 
@@ -44,6 +46,8 @@ Lower levels cannot override higher. Conflicts → higher scope wins.
 
 **AI contribution model**: AI proposes (drafts all changes, prepares commits, creates PR draft) — user approves final push/PR. Human-in-the-loop is non-negotiable for shared repos.
 
+**Explaining the gate to a no-hook user (staged approve/deny framing)**: Mode A/B/D users get the gate mechanically (pre-commit hook + 4-axis). A **Mode C** user (plugin/skill only, no hook) gets no mechanical enforcement — so explain the *same* HITL as a **staged write**: an auto-generated change is *staged*, surfaced for an explicit approve/deny, and only then committed. The vocabulary travels even when the hook doesn't. (Sister-asset import of Hermes' `write_approval` framing, cross-audit 2026-06-27 — wording only; FH's mechanism is unchanged and stronger.)
+
 ---
 
 ## Amplifier / Coach Dual Mode

package/knowledge/shared/harness-core/harness_6axis_framework.md

@@ -134,5 +134,5 @@ Lower levels cannot override higher. AI contribution → PR proposal only (no di
 
 - arXiv:2603.25723 (*Natural-Language Agent Harnesses*, NLAH) — external academic sibling that independently converges on the same core thesis: a harness control layer can be an executable natural-language object, not code. NLAH measures the natural-language-harness form empirically; FH governs and compounds it.
 - arXiv:2606.06324 (*HarnessFix / ETCLOVG*, 2026-06) — sibling on the **orthogonal** axis: where NLAH and FH describe the harness as a *process/control* object, HarnessFix supplies a *component taxonomy* of what a deployed harness contains (7 layers — Execution · Tooling · Context · Lifecycle · Observability · Verification · Governance). Its **V layer maps onto FH's Axis-5 gate on 3 of its 4 functions** (intermediate validation → steel/phantom-quench · final-output eval → completion-claim discipline · regression testing → regression_guard); its *readiness-check* function maps to FH pre-flight gates (install-doctor / asset-placement-gate) that sit outside Axis-5. Its named **Observability** layer is a structural axis FH lacks — FH's nearest coverage is *retrospective audit* (weekly_audit, subagent_invocations_log), not runtime observability (import candidate for `harness-doctor`). Cross-audit: `tracks/_audit/session_2026_06_19_harnessfix-etclovg-cross-audit.md`.
-- "Loop Engineering" (실밸개발자 video, 2026-06-22) — independent-convergence sibling on the **component lens** (Osmani's 6 components: Automation/trigger · Worktree · Skill · Connector · Sub-agent maker/checker · Memory) and on **Axis-5**: its central claim "a verifiable goal or it's a token-burning machine" is FH's Done-When + check-class, and its mandatory Generator≠Evaluator split is FH's no-judge-only-path. FH increment beyond the frame = the Surface-Class Degrade Invariant (irreversible → fail-closed), which structurally blocks the video's "production accident" failure mode it only budget-caps. Cross-audit: `tracks/_audit/session_2026_06_27_loop-engineering-silbal.md`.
+- "Loop Engineering" (실밸개발자 video, 2026-06-22) — independent-convergence sibling on the **component lens** (Osmani's 6 components: Automation/trigger · Worktree · Skill · Connector · Sub-agent maker/checker · Memory) and on **Axis-5**: its central claim "a verifiable goal or it's a token-burning machine" is FH's Done-When + check-class, and its mandatory Generator≠Evaluator split is FH's no-judge-only-path. FH increment beyond the frame = the Surface-Class Degrade Invariant (irreversible → fail-closed), which structurally blocks the video's "production accident" failure mode it only budget-caps. **Vocabulary import (distilled 2026-06-27):** FH adopts the video's crisp one-line definition it otherwise lacked — *an autonomous loop = a scheduler (cron or `/loop`) + a state-reading judgment model that decides each next action* — the legible newcomer-facing phrasing for FH's `/loop` / autonomous-loop / `harvest-loop` assets. Cross-audit: `tracks/_audit/session_2026_06_27_loop-engineering-silbal.md`.
 - **Mechanical-anchor / Non-Model Ground — training-layer external anchors** (Axis-5, verified 2026-06-27): arXiv:2606.27369 (*RiVER*, 2026-06-25) trains LLMs on optimization/coding tasks using **deterministic execution feedback in place of ground-truth labels** — FH's "bind the terminal verdict to a non-model anchor, not a judge's agreement" stated at the training layer; arXiv:2606.27359 (*When are likely answers right?*, Zenn & Geiping, 2026-06-25) shows sequence probability is **predictive within a dataset but does not transfer to decoding decisions** — peer evidence that likelihood/self-consistency is not reliable correctness. Both are independent-convergence anchors for `feedback_judge_robustness_mechanical_anchor`, not FH measurements.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.45",
+  "version": "1.4.46",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -25,7 +25,8 @@
   "scripts": {
     "prepare": "chmod +x bin/fh-gate.js bin/fh-run.js bin/fh-goal.js scripts/fh-gate.sh scripts/fh-run.sh scripts/fh-goal.sh",
     "test": "bash scripts/selfcheck.sh",
-    "prepublishOnly": "bash scripts/selfcheck.sh"
+    "prepublishOnly": "bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
+    "release": "bash scripts/public_surface_scan_files.sh && npm publish"
   },
   "engines": {
     "node": ">=16"

package/plugins/fh-meta/agents/persona-innovator.md

@@ -157,6 +157,27 @@ had never wired into the innovator.)
   **bar it from any asset-insertion recommendation** — it may appear only as a caveated sister-link.
   (FH's phantom-citation discipline pulled forward from verify-time to ideation-intake.) The frontier
   is hype-dense; an uncited number is noise until sourced.
+- **H1-b — Source-credibility tier (PILOT, axis A, 2026-06-27 — measured, not yet a fixed floor).**
+  "Has a citation" ≠ "a recognized source" (operator: live data grows insight *only* from "검증되고
+  인정받는 소스"). Tier every citation: **T1** = peer-reviewed / DOI / a recognized venue or standards
+  body (arXiv-with-citations · OWASP/NIST · an established conference); **T2** = a named practitioner or
+  a maintained project (identifiable author · live repo · non-anonymous); **T3** = unvetted (blog /
+  forum / SNS) — usable only as a **pointer to verify**, never the terminal anchor. A quantified claim
+  anchored *only* by T3 stays `SPECULATIVE` (same bar as no citation). Mechanical pairing: the cited
+  source is **live-fetched and supports the claim** (phantom-quench — the mechanical anchor; a T3
+  mis-labelled T1 still must pass it), and its **tier is named** in the output. *Check class: judged
+  (the tier label) — pair: phantom-quench on the cited source; the SPECULATIVE bar degrades to the
+  phantom-quench verdict, not to the tier label alone.*
+  **Status — rule now, promotion apparatus deliberately NOT built (cross-family-reviewed 2026-06-27).**
+  H1-b is in force as a rule today. It does **not** claim a measured-promotion path yet, because the honest
+  promotion metric is **anchor-tier rate**, which the `operations.md` 60% gate does **not** measure (that
+  gate measures *proposal-acceptance* — a different quantity; reusing it here would be the exact H4
+  forced-fit this agent warns against), and `subagent_invocations_log.yaml` has **no `anchor_tier` field**
+  for any consumer to aggregate. So promoting H1-b to a hardened floor — and only *then* expanding to axes
+  B (decorrelated synthesis) / C (operator-taste calibration) / D — first requires **building a real
+  anchor-tier counter** (schema field + an aggregator), which is deferred until the rule has earned it
+  (evidence-threshold: don't wire the meter before the rule proves worth measuring). Self-application:
+  H1-b is subject to H3 — its own promotion is the evaluator's verdict, never the innovator's.
 - **H2 — Dedup-grep before naming.** Before proposing any name or frame, Grep/Read the *live target
   asset* (the actual SKILL / rules / CLAUDE.md row the concept would land in), not your memory of it.
   If the discriminator already exists there, drop the candidate — you were about to reinvent it.

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -74,6 +74,20 @@ diversity vs the orchestrator** (orchestrator = Claude/opus → recruit GPT or G
   surfaces a one-line `token-budget-gate` ask per run (*"recruiting codex (~N) — proceed?"*) unless the
   operator has set `paid_auto: true` in the UAP. One-time feature-consent ≠ consent to this spend now.
 - Dispatch via `agent-composer` (no re-implementation of dispatch).
+- **Liveness / hang-catch (mandatory — a hung sidecar never notifies).** A backgrounded CLI that hangs
+  (stuck on a sandbox/file-tool prompt, auth, or network) **does not exit**, so the background-completion
+  signal *never fires* — passive waiting is the wrong model and silently stalls the run (observed
+  2026-06-27: a `codex exec` that asked to read repo files hung at 0-output with no session log, and the
+  turn waited on a notification that could not come). So **bound it actively, never wait open-endedly**:
+  - Set an explicit timeout on every sidecar call (`timeout N …` or the dispatch tool's timeout).
+  - Watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
+    session/log advancing (e.g. `~/.codex/sessions/<today>`). 0 output **and** no session created after a
+    short bound (≈2–3 min for codex/agy) = **hung, not slow** → kill and recover, do not keep waiting.
+  - **Recover, don't stall**: kill → diagnose (a file-tool/sandbox hang is the common cause) → retry with
+    the **robust pattern** — inline the needed file content into the prompt via **stdin** so the sidecar
+    needs no file tools (verified fix 2026-06-27: `{ instructions; cat file1; cat file2; } | codex exec -`
+    succeeded where reading-files-itself hung) — or degrade to single-session with a recorded note.
+  This is the sidecar twin of `mcp-circuit-breaker` (stop a stuck external call instead of hanging on it).
 
 ## Step 5 — Role split + source-grounded acceptance (S-2)
 

package/plugins/fh-meta/skills/context-doctor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: context-doctor
-description: Reduces token waste in Claude Code sessions. Scans projects to automatically generate .claudeignore files, and guides on over-read files and /clear timing. In hub environments, regularly audits bloated CLAUDE.md/MEMORY.md/memory/*.md files and proposes compression. Usable standalone without a hub clone.
+description: Reduces token waste in Claude Code sessions across two axes — context footprint (auto-generates .claudeignore, guides over-read files and /clear timing) and command output (routes to a command-output proxy/hook such as rtk to trim verbose CLI stdout). In hub environments, regularly audits bloated CLAUDE.md/MEMORY.md/memory/*.md files and proposes compression. Usable standalone without a hub clone.
 user-invocable: true
 allowed-tools: ["Read", "Write", "Bash", "Glob", "Grep"]
 model: sonnet
@@ -14,10 +14,13 @@ complexity_routing:
 
 # context-doctor — Token Efficiency Diagnosis + Automatic Prescription
 
-Diagnoses the 3 main causes of session token waste and prescribes immediate remedies:
+Diagnoses the main causes of session token waste and prescribes immediate remedies:
 1. No `.claudeignore` → unnecessary files loaded wholesale into context
 2. Repeated full reads of large files → paying the same cost N times
 3. Not using `/clear` after direction changes → continuing work with accumulated noise
+4. Verbose CLI output → every `git`/`ls`/build/test call floods context with stdout (a *different* layer from 1–3 — see §Command-Output Reduction)
+
+**Two reduction axes — keep them distinct.** Causes 1–3 are the **context-footprint** axis (what gets read *into* context: files, history). Cause 4 is the **command-output** axis (tokens produced *by* the tools you run). `.claudeignore` cannot touch command output, and a command-output proxy cannot touch file reads — they are complementary, not substitutes.
 
 **Standalone install** — this skill works normally with plugin install only, without cloning the full meta-harness.
 
@@ -154,6 +157,21 @@ Keep it reversible: compress the *working copy* in context, not the source of tr
 
 > **Detail**: See `SKILL_detail.md §Headroom` — external tooling option (redundancy-category targeting, integration surfaces, caveats) — read when executing a compression pass and considering tooling.
 
+## Command-Output Reduction (the command-output axis)
+
+The reductions above all act on the **context-footprint** axis (files, history read *into* context). They do nothing for the **command-output** axis: the stdout of every shell call. A single `git log`, `npm test`, `ls -R`, or build run can dump thousands of tokens per call, and an agent makes dozens of calls per session — often the *largest* single token sink, and invisible to `.claudeignore`.
+
+**This axis is risk-gated — reduce it only when token cost is the binding constraint.** Unlike `.claudeignore` (which blocks provably-irrelevant *files* — near-lossless and reversible), command-output reduction works by **filtering live output, which is lossy by design**: a dropped middle line — an error inside build output, one file in a long listing — is invisible to the agent, which cannot know what it did not see. So the **default is to do nothing here**. Turn it on only in a genuinely token-scarce setting (a metered / quota-limited backend where token budget is the *binding* constraint — not where tokens are merely plentiful); there the savings outweigh the information-loss risk, and **everywhere else they do not**.
+
+**Two ways to reduce, safest first:**
+1. **Per-call narrow flags (default — non-lossy, no install).** Prefer narrow commands: `git log --oneline -N` over bare `git log`, `--quiet` on noisy tools, `head`/`tail` on long output. The agent chooses what to drop, per call — no blind heuristic. This suffices for almost every session.
+2. **A command-output proxy/hook (only under token scarcity).** A **Claude Code hook that rewrites verbose commands through a token-reducing proxy**, transparent (0 prompt-side overhead). Recommended tool: **`rtk` (Rust Token Killer)**, a CLI proxy that filters dev-command output (the tool reports ~60–90% savings on dev operations), wired so `git status` → `rtk git status` happens automatically.
+   - ⚠️ **Name collision**: there is an unrelated `reachingforthejack/rtk` (Rust Type Kit). Verify the Token-Killer build — `rtk gain` (savings analytics) should work; "command not found" means the wrong binary.
+   - **No-reinvention**: FH **routes to** this tool; it does not rebuild a token-killer. Install + hook wiring live in the user's own config (global `CLAUDE.md` / `settings.json`), never reimplemented here.
+   - ⚠️ **Never filter a command whose output a mechanical gate parses.** FH gates read raw command output (a pre-commit hook greps, `regression_guard` diffs). A filtered `git diff` / `git log` feeding a gate gives the gate wrong input — the same trap as grepping filtered prose for a verdict (typed-verdict-channel). Keep filtering off gate-input paths, and keep a raw escape hatch (`rtk proxy <cmd>`).
+
+**Prescription**: in a normal token environment, recommend the per-call flags (#1) and **do not** suggest installing a proxy — the lossy risk is not worth it. Only when the user states or exhibits a binding token constraint, surface #2 with the gate-input caveat above. Diagnosis + recommendation, never an auto-install.
+
 ## External User Environment Adaptation
 
 | Environment | Behavior |
@@ -201,6 +219,7 @@ Explicit invocation (`/context-doctor`) always runs regardless of suppress state
 - "token waste", "session is slow", "reading the whole file", "claudeignore", "context cleanup"
 - "context diet", "memory audit", "CLAUDE.md is heavy", "MEMORY.md size"
 - "context engineering", "context rot", "context collapse"
+- "command output is huge", "verbose output", "rtk", "token killer", "trim command output"
 
 ### Natural Language Triggers (activates without internal vocabulary)
 
@@ -216,6 +235,7 @@ Also activates when an external user expresses without token/context terminology
 | "Answers get weird as the session gets longer" | Accumulated context noise | Step 3 (/clear recommended) |
 | "Context is getting full", "context meter is high" | Approaching context limit | Step 3 — propose Wrap-then-Compact pattern |
 | "context engineering", "doing context engineering", "context rot setting in" | 2026 industry term for context discipline (Chroma 2025 / Anthropic) | Step 2 + Step 3 |
+| "every git command dumps a wall of text", "the build output eats my context" | Verbose command output flooding context | §Command-Output Reduction (route to proxy/hook) |
 
 ## Three-Doctor Loop Integration
 

package/plugins/fh-meta/skills/goal-quench/SKILL.md

@@ -65,6 +65,38 @@ Therefore:
 
 ---
 
+## Autonomy Ladder — how unattended a loop may run (orthogonal to the budget modes)
+
+The core/pro/max modes above key on **budget**. This ladder keys on a different axis — **how much human approval gates each action** — for a *recurring or unattended* loop (the autonomous-loop / `/loop` case), not a one-shot /goal. **Climbing a rung here changes *oversight*, never budget — the two never move together.** (Distilled 2026-06-27 from the "Loop Engineering" sister-asset's "training-mode dry-run → graduated autonomy"; cross-audit `tracks/_audit/session_2026_06_27_loop-engineering-silbal.md`.)
+
+Three rungs, climbed one at a time:
+
+| Rung | What runs | Human role |
+|---|---|---|
+| **① dry-run** | run once manually; observe outputs; **no irreversible actions** | reads every output |
+| **② step-approval** | each action is HITL-gated before it fires | approves per action |
+| **③ unattended** | the loop runs on its own | reviews after the fact |
+
+- **Graduation threshold (measured):** a loop climbs one rung only after **K consecutive clean rounds across a 2+ session/run window** — the *2+ window* reuses `operations.md`'s promotion-window discipline (`accepted ≥ 60%` / recurrence `N=3`). **`K=2` is a provisional default, not yet calibrated** — no loop-run data exists yet; revisit once it does (same honesty as this SKILL's `N=10` budget baseline). "Clean" = the round's Done-When passed **AND** a positive downstream verdict (pipeline-conductor / sidecar = CLEAN) **AND zero S/M-grade governor-catch and zero post-ship correction** — *not merely* the absence of a governor-catch, so a quieter or weaker governor cannot manufacture graduation. **The streak is recorded per round in a local autonomy ledger** (the hub keeps it at `tracks/_meta/autonomy_ledger.yaml`; a plugin-only user keeps their own — anywhere in their project, the path is theirs): date · task · done-when · verdict · governor-catch grades · `clean:` bool. Graduation reads that ledger. A *computation script* (`scripts/`) that auto-derives the current rung from the ledger is **deliberately deferred** until enough entries exist to compute over — building the meter before there is a stream to measure is the speculative-infra the evidence-threshold discipline forbids. *Check class: a **measured count** (ledger grep) over a **judged per-round grade** — and the grade must be bound to the round's own challenger / steel-quench S/M verdict (the upstream adversarial artifact), **never an author self-grade** (else "measured" laundering a judge-only path). Until ≥~5 entries make a computation script worth writing, the streak is judged-and-hand-recorded — provisional by construction.*
+- **Irreversible carve-out (non-negotiable — the FH increment over the video):** any action whose effect **cannot be undone within the loop** — not only the two examples (Destructive-Op delete/rewrite · Pre-Publish go-public) but **any irreversible side-effecting write** (an MCP `ask`-tier send, a payment, an outbound publish) — **never reaches rung ③**. Membership is the **mechanical surface test** of CLAUDE.md's Surface-Class Degrade Invariant + `mcp_tool_gating` (grep the action surface; do **not** self-label), not a match against the two examples. Such actions stay at rung ② (HITL) **permanently**, regardless of clean-round count. The video graduates a loop to fully unattended; FH caps graduation at the irreversible boundary. *Check class: judged — pair: a target-tier blind sim per CLAUDE.md §Target-tier sim gate (run 2026-06-27, Sonnet, PASS — a remote-branch-delete loop correctly held at rung ② despite 4 clean rounds). **Prose-enforced, not hook-enforced** — accepted residual, named not silent.*
+- **Demotion (fail toward oversight, with a liveness floor):** any governor-catch, failed Done-When, or correction **resets the clean-round counter and drops the loop one rung** — autonomy is earned per-window, surrendered on the first miss, never sticky. A failed **dry-run (①)** has no lower rung: it **blocks graduation and surfaces to the operator**, it does not demote. A loop that **flips promote/demote ≥ `N=3` times in a window** (reusing operations.md's recurrence-escalation) is a noisy boundary — **freeze at the lower rung and surface**, do not keep oscillating.
+
+### Two paths to autonomous completion (by surface reversibility)
+
+The clean-streak graduation above governs **unattended-no-review** operation (rung ③) — right for *narrow recurring loops* (digest / sync / poll) where nobody sees each result, so the demonstrated clean streak is the only safety. **Most substantive novel work — including FH self-development — rarely earns a clean streak by design.** It is not therefore undelegatable; it takes a second, *reviewed* path:
+
+- **Path 1 — clean-streak → unattended (rung ③):** narrow recurring tasks reviewed by nobody. Safety = the demonstrated clean streak (above).
+- **Path 2 — *deliver-then-review* (a reviewed mode at rung ②'s oversight, not a new rung):** autonomous *execution* with **mandatory review** — it is **not** unattended and **does not climb to ③** (only Path 1's clean streak reaches ③). **Intent-seeded, mechanically-reversible, reviewed** work — mapped-project acceleration / first-project creation (human intent via Q&A), and self-dev absorption of frontier-digest-style insights. Path 2 permits autonomous *execution to completion without per-step approval*, but operator review of the delivery is **mandatory before the work is consumed** — that review is what *substitutes for* pre-approval. All five conditions hold, or it is not Path 2:
+  - **(a) Human-selected direction — auditable, not narrated.** A human *selects* the direction; record it in the ledger (`seed: human-selected` or `innovator-proposed-human-confirmed`). An agent/innovator-proposed direction is a **candidate, not a seed**, until a human confirmation token is recorded — the machine never chooses *what* to pursue (self-echo guard, `[[fh_self_evolution_vision]]`).
+  - **(b) Mechanically-reversible surface — anchored to the carve-out partition, never a softer self-judged "reversible".** Admissible only if **all three**: **(i)** not a member of the line-81 **grep-gated** irreversible set (mechanical); **(ii)** **effect-confined** to git-tracked tree state — no file deletion, external/DB mutation, or out-of-tree write. *This conjunct is **judged, not grepped** — whether delivered code mutates external state at runtime is behavioral, not a static surface (`[[qa_static_dynamic_complementarity]]`); its pairing is the line-81 grep **plus** the operator's mandatory delivery review, and it **degrades safely** — unproven confinement → treat as irreversible → HITL.* **(iii)** **not yet consumed** (a *local, unpushed-to-shared* commit; the instant a delivery is pushed to a shared branch or read by a downstream cache / CI / registry it is *effectively published* and re-enters HITL, per CLAUDE.md §Pre-Publish (b)).
+  - **(c) Reviewable delivery.** Deliver as **discrete revertable units** (per-commit, not one opaque squash) so **rollback granularity ≥ delivery granularity**. A batch too large to actually review makes "roll back after seeing it" theoretical and voids the substitute-for-approval logic — cap the batch at what the operator can review; interdependent commits (revert 1 orphans 3) forfeit per-unit rollback and must be delivered batch-atomic with a higher review bar.
+  - **(d) Rollback feeds demotion.** A Path-2 delivery the operator rolls back **forces the next same-class run back to rung ② full step-approval (per-action *pre*-approval — stricter than Path 2's post-hoc review) until one clean delivery**, and counts toward the `N=3` noisy-boundary freeze — so the riskier, novel work-class is not handed the looser path. *Prose-enforced, not hook-enforced — accepted residual (the ledger records the rolled-back delivery; no hook yet gates the next run, same status as the carve-out's residual above).* (Rung ② names two oversight strengths: Path-2 = human reviews *after* each delivery; demoted = human approves *before* each action. The demotion tightens from the former to the latter.)
+  - **(e) Every action in the run is gated by (b) — not just the final delivery** *(cross-family review caught this 2026-06-27; the Claude same-family reviewers + the Sonnet sim shared the blind spot)*. Producing a Path-2 delivery often requires *executing* code — running a test suite, installing a package, a migration script, an API call. **Each such action is itself subject to (b)**: a preparation step that deletes files, mutates a DB, installs an untrusted dependency, or hits the network has an **irreversible *runtime* effect that no `git` rollback undoes** (git reverts the tree, never the execution that produced it). So it stops for HITL exactly like a delivery action — and a purely *exploratory/speculative* run that would do any of these is not "free" either. "Reversible" is a property of **every action in the run**, never only of the committed tree at the end.
+
+**Direction is always human (both paths).** The machine automates *execution* of a human-seeded direction, never the direction itself. **The irreversible carve-out holds regardless of path** — anything irreversible, effect-unconfined, or already-consumed (at *delivery or during the run*) stays pre-action HITL; Path 2 delegates only what (b) admits.
+
+---
+
 ## Triggers
 
 - `/goal-quench`