@chrono-meta/fh-gate 1.4.48 → 1.4.50

package/CATALOG.md

@@ -8,6 +8,12 @@ AI reads this file first when searching past work. Open individual files for det
 
 <!-- Add entries in reverse date order (newest at top) -->
 
+### 2026-07-07 | forge-harness | #sister-asset, #cross-audit, #revfactory, #harness-100, #agent-composer, #benchmarking, #linkedin, #source-verification, #diffusion-llm
+**File:** tracks/_audit/session_2026_07_07_revfactory-harness.md
+Sister-asset cross-audit of `revfactory/harness` + `revfactory/harness-100` (AX TF lead-recommended benchmarking target) vs FH — their axis = one-shot team-architecture generation + a 200-harness ready library (breadth/quick-start); FH's axis = dynamic composition (`agent-composer`) + governance (4-axis gate, irreversibility floors, continuity), which their pipeline lacks entirely. Plus LinkedIn source-verification for the operator's 2 queued insight links: diffusion-LLM paradigm-shift paper confirmed accurate (ICML 2026 Outstanding Paper Award, JustGRPO, arXiv:2601.15165 via official ICML blog); "Claude Code loop-engineering" post confirmed to be about `k021/claude-code-skills` — the *same* sister-asset Gemini already analyzed, not new content.
+- Decision: no functional import beyond a C-tier team-pattern naming label for `agent-composer` output; FH's governance moat holds (revfactory doesn't compete on that axis). Both LinkedIn links closed.
+- Open: adopt 6-pattern naming in agent-composer (operator HITL); harness-100-style pre-built library stays gated behind the existing 3+-recurrence trigger.
+
 ### 2026-06-27 | forge-harness | #sister-asset, #cross-audit, #hermes-agent, #nous-research, #self-improving-agent, #skills, #memory, #messaging-gateway
 **File:** tracks/_contrib/session_2026_06_27_hermes-agent-nous-self-improving-cross-audit.md (committed via _contrib consent lane — authored in an ephemeral cloud session where tracks/_audit/ is gitignored/non-durable)
 Sister-asset cross-audit of **Hermes Agent (Nous Research)** vs FH, triggered by a LinkedIn post (esperer) distilling Hermes' official *Tips & Best Practices* (post = faithful doc summary, not original methodology; same summary circulates on Threads). ~90% of Hermes' best-practice surface is already present in FH (persistent memory · auto-skill-from-repetition · skill self-improvement · context economy · delegation · model selection — all grounded to `plugins/*/skills/`), and on the **self-improvement + governance** axis FH is *ahead*: Hermes *advises* "review auto-generated skills," FH *mechanically enforces* it (pre-commit 4-axis gate + steel/phantom-quench + HITL). Key honest finding — most apparent "gaps" dissolve: cron/daemon is a **deliberate FH boundary** (`self_evolution_routine.md` §8 "recommendation surface, not a daemon"), external-memory-providers **already audited** (companion-store pluggable, 2026-06-11). Only genuine absence = **messaging gateway** (Telegram/Slack daily-driver), which is a *delivery channel*, not methodology.
@@ -177,7 +183,7 @@ CC built-ins utilization imports (operator-approved; video claims verified 9/13
 ### 2026-06-10 | forge-harness | #ingest-gate, #contradiction-scan, #crossref-lint, #llm-wiki, #karpathy
 **File:** .claude/rules/sync_push_protocols.md (+ harness-doctor SKILL.md, probes.md)
 Karpathy LLM-Wiki sister-audit imports (operator-approved; convergence case n=5, citable primary source): I1 — contradiction scan as Sync step 3 (ingest gate, judged + verify-bidirectional pair): new knowledge grepped against existing claims before indexing, conflicts flagged in both files, old-claim removal is HITL. I2 — harness-doctor L4 knowledge cross-ref lint: no CATALOG entry = S-tier index orphan, no inbound ref = R-tier orphan page. Probes G-SYNC-01/G-LINT-01 added (30 total).
-- Decision: scale escape (W1) deliberately NOT built — watch-item with trigger (CATALOG hundreds of entries / repeated search misses); operator-preferred first remedy = skill-splitter-style CATALOG split-mapping, RAG hybrid only after that.
+- Decision: scale escape (W1) deliberately NOT built — watch-item with trigger (CATALOG hundreds of entries / repeated search misses); operator-preferred first remedy = salience-splitter-style CATALOG split-mapping, RAG hybrid only after that.
 - Open: npm republish (harness-doctor SKILL.md shipped) — folded into the open 1.4.8 handoff.
 
 ### 2026-06-10 | forge-harness | #golden-probes, #offline-eval, #doc-code-coupling, #anthropic-4layer
@@ -282,7 +288,7 @@ Post-merge micro R-tier cleanup: corrected two prompt-regression probe expectati
 
 ### 2026-06-03 | forge-harness | #goal-quench, #skill-evolution, #mode-ladder, #sidecar-routing
 **File:** plugins/fh-meta/skills/goal-quench/SKILL.md
-Evolved goal-quench into a fluid core→pro→max mode ladder. Core: token-budget-gate + pipeline-conductor --quick; pro: +context-doctor +agent-composer; max: +plugin-recommender +cross-ecosystem-synergy-detection. Phase-1 budget verdict auto-recommends mode. Ran full-harness dogfood sweep (33 skills): fixed phantom refs, dead blocks, stale agent forks (4 deleted), trigger collision, and 3 skill-splitter splits.
+Evolved goal-quench into a fluid core→pro→max mode ladder. Core: token-budget-gate + pipeline-conductor --quick; pro: +context-doctor +agent-composer; max: +plugin-recommender +cross-ecosystem-synergy-detection. Phase-1 budget verdict auto-recommends mode. Ran full-harness dogfood sweep (33 skills): fixed phantom refs, dead blocks, stale agent forks (4 deleted), trigger collision, and 3 salience-splitter splits.
 - Decision: RED tier reframed as max-mode decomposition on-ramp, not hard block
 
 ### 2026-06-02 | _audit | sister-asset, token-efficiency, compression, headroom

package/CHEATSHEET.md

@@ -511,7 +511,7 @@ Claude agents feature
 |---|---|---|
 | `install-wizard` | First-install onboarding (zshrc, sentinels, the FH self-gate) | "first-time setup", "run the install wizard" |
 | `hub-cc-pr-reviewer` | Reads a PR diff → 8-matrix baseline-consistency check → review comment + merge call | "review this PR", "check this diff" |
-| `skill-splitter` | Splits an over-large SKILL.md that "does everything" into scoped files | "this skill is bloated", "SKILL.md too large", "split this skill" |
+| `salience-splitter` | Splits an over-large SKILL.md that "does everything" into scoped files | "this skill is bloated", "SKILL.md too large", "split this skill" |
 
 ### Agents (sub-agents, dispatched — not slash commands)
 

package/CLAUDE.md

@@ -142,7 +142,7 @@ Compose session-card candidates **into door ③ (field) and the 🔧 door (FH-de
 
 **Identity marker**: every greeting response (Step ②) opens with 🐿️ then an identity-revealing welcome line **on the same line** (a space after 🐿️; exact count not significant — the renderer collapses it — the invariant is *same-line*, not 🐿️ alone) — new / exploratory = "Welcome to FH." · returning = "Welcome back to FH." · operator (FH-dev state) = "The FH operator — good to see you." It is embedded in all skeletons above (do not strip it when composing doors); the exploratory branch template (`fh_detail_protocols.md` Step 2) uses the "Welcome to FH." line.
 
-**Guards**: explicit task-entry utterance → skip onboarding · once per session · code/debug requests → start working directly · project routing is a suggestion, mention at most once
+**Guards**: explicit task-entry utterance → skip onboarding **menu** (the door skeleton / greeting) — but this **never skips the Mode D companion-store freshness load** (pull + INDEX read + card-vs-commit reconcile); that is a data-load, not the menu, and it fires even when the first message is a task (measured miss 2026-07-05: task-first entry skipped the companion-store pull → stale memory → wrong recommendations; now hook-backed via `scripts/fh_session_load.sh`, see `modes_and_value.md §Session-start freshness`) · once per session · code/debug requests → start working directly · project routing is a suggestion, mention at most once
 **Metadata-is-not-intent guard**: the trigger is the user's **typed message only**. Session metadata — branch name (auto-derived from the first message, e.g. `claude/korean-greeting-*`), repo name, file paths — is **never** a task spec and never suppresses or redirects the greeting trigger. A bare greeting fires onboarding even when the branch name looks like a feature request; if the only "task" signal lives in metadata and not in what the user typed, treat the message as a greeting and run the greeting branch + door skeleton above.
 
 ## New Skill Creation Pre-Commit Gate
@@ -285,6 +285,75 @@ unknown) and surface **one line** — then proceed, never block:
 inviolable; a pin is not a cap — tier-floor resolution §Floor governance) · field-project operation
 sessions (no FH asset modification) never see this notice — the Sonnet default stays friction-free.
 
+> **Related — capability-escalation consent**: whether a session actually *escalates* to a stronger
+> model or a cross-family sidecar (not just this advisory notice) is governed separately by
+> `knowledge/shared/harness-core/capability_escalation_consent.md` — the negotiated-consent protocol
+> (UAP `sidecar_consent`/`floorup_consent`) that decides ask-once vs. no-surprise floor-up/sidecar use.
+> This notice is the passive advisory; that doc is the active escalation gate.
+
+## Field-Harness Load-Bearing Change Gate (cross-family, pre-merge)
+
+The 4-axis gate above fires on **FH asset** changes. But the correlated blind spot it guards —
+*"when a verdict surface cannot mechanically ground its judgment, it defaults toward PASS instead
+of safe-fail"* — is **model-family-level, not FH-specific**. It lives in any load-bearing code the
+AI writes, including **mapped field projects** (qasp · the-bible · pmh). FH is the meta-harness:
+accelerating a field harness *to FH grade* means the field's load-bearing changes get the **same
+cross-family adversarial gate** as FH's own assets. Not doing so is the exact gap that shipped **9
+default-toward-PASS holes across 3 harnesses undetected** (measured 2026-07-03). Root principle:
+**prose-specified verdict logic grants discretion; discretion's degrade direction is unconstrained
+(→ optimistic PASS); same-family reviewers share the author's optimistic reading and miss it.**
+
+**Trigger (per changed file — grep-assisted, salience-dependent, no field hook)**: an AI-authored
+change to a **load-bearing field surface** — a function returning a **verdict/gate enum or exit code** (PASS/FAIL/BLOCK/allow/deny),
+an **irreversible-op** path (publish/delete/history-rewrite), or a **safety invariant** (the-bible
+L1 floor, qasp verdict-binding, a pre-push/pre-commit hook). File+symbol based (grep the diff for a
+verdict-enum return / gate exit / safety-marked function) — but a **strong-advisory grep trigger,
+not a hook**: the FH pre-commit gate is FH-internal and deliberately never installed into field
+projects, so an agent under merge pressure can still under-trigger (unmarked safety logic,
+boolean-return gate helpers, config-driven allow/deny, shell/CI irreversible paths escape the grep).
+The under-trigger residual is named honestly in the detail doc — it is not claimed to be airtight.
+
+**Gate (before merge, not after)**:
+1. **Degrade-direction lint** (mechanical pre-screen — `scripts/degrade_direction_scan.sh`): flags
+   fall-through / `except` / `.get(default)` / unknown-branch landing on a **permissive** value.
+   **Advisory review surface, NOT a hard gate** — grep-heuristic, FP-tolerant; a hit = *"prove this
+   isn't default-toward-PASS"*, never a solo block (exit 2 = advisory). Points attention; the
+   cross-family review decides. (Portable field copy: `templates/degrade_direction_scan.sh`.)
+2. **Cross-family adversarial review** (`auto-decorrelation` → ≥1 different-family auditor, e.g.
+   `codex` gpt-5.5/high for repo-grounded verdict code) — the same standing verifier the 4-axis
+   gate uses for load-bearing FH changes, now on field load-bearing changes. Governor keeps the
+   terminal verdict + **source-grounds** every finding (mechanical anchor over agreement).
+3. **Confirm→fix→re-verify loop** until CONVERGED (no reachable false-PASS / false-CONFIRMED /
+   masked-FAIL / crash-where-safe-fail). **Each fix ships a mechanical regression test reproducing
+   the closed hole** — the anchor leg is a *required* convergence sub-condition, not incidental: two
+   decorrelated models agreeing is still judgment (mechanical anchor over agreement). Documented
+   recall-limits of a deliberately-precise no-judge oracle (separator-negation, positional multiset
+   masking) are **not** blockers.
+
+*(Role deconfliction: this gate reviews **field code being authored**; the Irreversibility gates
+below gate **the act** of publish/delete/rewrite — disjoint by role and by location, no double-gate.)*
+
+**Degrade direction — cross-family unavailable is NOT a silent same-family pass** (the gate's own
+standard, dogfood-caught 2026-07-03): if no different-family auditor is reachable, the gate does
+**not** fall back to same-family review and proceed — that inherits `auto-decorrelation`'s general
+*silent-degrade / never-hard-fail*, which is **fail-OPEN** for a load-bearing pre-merge surface
+(the gate's entire value is decorrelation; same-family review shares the author's blind spot). It
+marks the change **NOT-CONVERGED** and either blocks the autonomous merge / asks the operator, or
+proceeds only under an **explicit, logged same-family-only acknowledgment** — never a silent
+same-family pass. This **overrides** the delegated skill's default degrade for this surface,
+consistent with §Irreversibility Surface-Class Degrade Invariant (applicable-but-tooling-down ≠ free skip).
+
+**Residency**: sanitize company code (redact vendor/domain literals) before any external-family
+dispatch; domain data never leaves. **Autonomy**: autonomous once the operator has consented (UAP),
+same as the FH cross-family complement. **In autonomous loops** (innovator loop-engineering ·
+`/goal` · cluster orchestration): this gate is **part of the delegated pipeline**, not an
+afterthought — a load-bearing field change produced autonomously runs the lint → cross-family →
+converge loop *before* it is Done. Autonomy floor (§Floor governance): the skip/run judgment is
+trusted only at opus-tier+; below-floor runs the review or asks, never silently skips.
+
+> **Detail** (discretion principle · 4-face signature · gate mechanics · n=7 qasp evidence):
+> `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md`.
+
 ## Irreversibility Gates — Surface-Class Degrade Invariant (shared spine of the two gates below)
 
 The two gates that follow (Pre-Publish, Destructive-Op) guard **irreversible surfaces**. The floor they
@@ -474,7 +543,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "add this MCP server", "mount this MCP", "mcp.json에 추가", "connect this tool server" (external-MCP mount intent — **proactive**, fire *before* first tool call; mount intent only — a failing/erroring mounted server is `/mcp-circuit-breaker`'s row above) | `templates/.claude/rules/mcp_tool_gating.md` (name-keyed ask/allow table — never trust server annotations or names; fill §3 at mount time) |
 | "token budget", "how expensive", "estimate tokens", "will this cost a lot" | `/token-budget-gate` |
 | "did my rule change break anything", "regression check", "test harness changes" | `/prompt-regression` |
-| "SKILL.md too large", "split this skill", "skill is bloated", "skill file too long" | `/skill-splitter` |
+| "SKILL.md too large", "split this skill", "skill is bloated", "skill file too long" | `/salience-splitter` |
 | "review for the team", "CTO review", "decision-maker", "share with leadership", "approval deck" | `/apex-review` |
 | "run full pipeline", "verify everything", "end-to-end sweep", "chain all verifications" | `/pipeline-conductor` |
 | "help me write a prompt", "build a prompt", "improve this prompt", "prompt template" | `/meta-prompt-builder` |
@@ -482,6 +551,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "I don't know what to build", "how should I approach this", "organize this for me", "clarify this", "정리해줘" (ambiguous request before dispatch) | `/deep-clarify` |
 | "memory feels bloated", "clean up memory", "memory too large", "memory hygiene" | `/memory-hygiene` |
 | "ready to PR", "about to push", "merge this", "PR 올려줘", FH asset changed in session | 4-axis auto-gate (see above — runs automatically, no proposal needed) |
+| **field verdict/gate/safety/irreversible code changed** in a mapped project (function returning a verdict enum / gate exit code / safety-invariant · publish/delete/history path) — **proactive, before merge** | **Field-Harness Load-Bearing Change Gate** (see above → degrade-lint → cross-family review → converge; same rigor as FH assets, applied to field code) |
 
 **Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed.
 For per-skill utterance patterns, see the relevant `SKILL.md §Trigger Phrases` section.

package/README.md

@@ -214,7 +214,7 @@ two more signatures keep it running: `harvest-loop` (each session's lessons beco
 | `token-budget-gate` *(fh-commons)* | Pre-task token cost estimate | "How expensive is this?" |
 | `mcp-circuit-breaker` *(fh-commons)* | MCP tool failure pattern detection | "MCP keeps failing" |
 | `quench-challenger` *(fh-commons)* | Adversarial pressure-test agent | "Challenge this with a devil" |
-| *(+ additional assets)* | marketplace-gate · contention-layer · edit-manifest · fact-checker · goal-quench · hub-persona-auditor · install-doctor · memory-hygiene · persona-innovator · prompt-regression · public-surface-audit · skill-splitter | |
+| *(+ additional assets)* | marketplace-gate · contention-layer · edit-manifest · fact-checker · goal-quench · hub-persona-auditor · install-doctor · memory-hygiene · persona-innovator · prompt-regression · public-surface-audit · salience-splitter | |
 
 | Active count | Diagnosis |
 |:---:|---|
@@ -233,7 +233,7 @@ two more signatures keep it running: `harvest-loop` (each session's lessons beco
 | Gate / Guard | `token-budget-gate` · `asset-placement-gate` · `marketplace-gate` |
 | Discovery | `plugin-recommender` · `cross-ecosystem-synergy-detection` · `frontier-digest` · `verify-bidirectional` |
 | Content / Simulation | `sim-conductor` · `apex-review` · `meta-prompt-builder` · `deep-clarify` |
-| Setup | `install-wizard` · `hub-cc-pr-reviewer` · `skill-splitter` |
+| Setup | `install-wizard` · `hub-cc-pr-reviewer` · `salience-splitter` |
 
 > **Full phrasebook** — every skill + agent with its one-line definition and the plain-language phrase
 > that triggers it: [`CHEATSHEET.md` §12](CHEATSHEET.md#12-skills--agents--what-each-does-and-what-to-say).
@@ -286,7 +286,7 @@ pinned stronger model is recommended only for harness-editing sessions.
 This is stated as an **invariant, not a per-model leaderboard**. Two structural laws, neither of which a
 new release overturns:
 
-1. **Operation (구동) flattens across tiers** — the rules-in-context do the work, so every tier ceilings
+1. **Operation flattens across tiers** — the rules-in-context do the work, so every tier ceilings
    on rule-application (Sonnet 5 tied Opus 4.8 at the battery ceiling in a 2026-07-03 replication).
 2. **Depth (design increments) is tier-ordered, and the order is fixed *within a generation*** — a lower
    tier never overtakes the higher of the **same** generation (tiers are priced to be worth it, so the

package/knowledge/shared/harness-core/capability_escalation_consent.md

@@ -0,0 +1,125 @@
+# Capability-Escalation Consent Protocol
+
+> **Principle**: any escalation that raises **cost or trust surface** — recruiting a **cross-family
+> sidecar** (external model families see the work) or a **model-tier floor-up** (Sonnet → Opus, higher
+> $/token) — is **consent-gated and negotiated up front**, never sprung silently. A user who was never
+> asked, then finds a paid/external escalation happened, feels **blindsided (뒤통수)**. The harness
+> must run **intelligently on Claude Code alone at the Sonnet floor** for anyone who declined, using
+> **sub-agents** in place of cross-family sidecars — as a *first-class mode*, not a degraded one.
+
+This is a **규약 (convention)**, not a per-call decision: the same answer holds for the whole session
+once settled, and is **remembered across sessions** (UAP) so it is asked at most once.
+
+---
+
+## Two escalation axes (same consent shape)
+
+| Axis | Escalation | Why it needs consent | Floor when declined |
+|---|---|---|---|
+| **(a) Cross-family sidecar** | recruit codex / agy / gemini / local-4090 as a verifier | work leaves the Claude boundary (external family sees it) + external billing | **Tier-3 CC-only sub-agent** (isolation-decorrelation, honest same-family note) |
+| **(b) Model-tier floor-up** | Sonnet → Opus for a depth-heavy turn | higher $/token (Opus ≈ 3–5× Sonnet); the operator's real cost lever | **stay at Sonnet** (the established minimum-recommended floor) |
+
+**Sonnet = minimum-recommended model is already established** — so the declined-floor is safe: the
+harness is *designed* to run well at Sonnet, not crippled by it (`[[feedback_harness_aerodynamics_perceived_perf]]`).
+
+---
+
+## When consent is settled — two entry points
+
+### 1. Onboarding negotiation (install-wizard) — the no-surprise path
+
+install-wizard **explicitly negotiates both axes** at setup, as named items:
+- *"Allow cross-family sidecars (codex/agy/local) for adversarial verification of load-bearing changes? They add external-family decorrelation but external billing applies."* → records `sidecar_consent`.
+- *"Allow automatic Sonnet→Opus floor-up on depth-heavy turns? Opus is ~3–5× the cost; declining keeps you at the Sonnet floor and asks per-occasion instead."* → records `floorup_consent`.
+
+Settling this at onboarding is the **whole point**: the escalation is then *expected*, never a surprise
+on the bill or the egress log.
+
+### 2. Runtime ask-once (for anyone who skipped onboarding setup) — the graceful path
+
+A user who skipped explicit setup is **not** auto-escalated. Instead, the **first time** an escalation
+is actually needed:
+- **Ask once**, at the moment of need, framed with the cost/trust reason:
+  *"This turn needs Opus depth (higher cost) — proceed at Opus, or stay at Sonnet?"* /
+  *"This load-bearing change is best verified cross-family (external billing) — recruit a sidecar, or verify with CC sub-agents only?"*
+- **Accept** → record consent (UAP), proceed, no re-ask.
+- **Decline** → record decline (UAP), **mark the escalation "recommended only"** going forward (surface
+  it as a one-line recommendation when relevant, **never a re-nag**), and **proceed at the floor**
+  (Sonnet / Tier-3 sub-agent).
+
+The ask fires **once per axis**; the answer is remembered. A declined axis becomes a standing floor, not
+a per-turn question.
+
+---
+
+## The declined mode is first-class, not "degraded"
+
+When an axis is declined (or no sidecar is reachable), the fallback is **the user's chosen normal
+operating mode**, and must be framed that way:
+
+- **Cross-family declined → Tier-3 CC-only sub-agent verification.** Multiple **isolated** Claude
+  sub-agents adversarially verify (isolation-decorrelation), with an **honest same-family note**
+  ("no cross-family diversity — verification is isolation-decorrelated only"). This is intelligent
+  operation, **not** "reduced value / degraded" language. (`[[feedback_judge_robustness_mechanical_anchor]]`
+  still holds: the governor keeps the terminal verdict + a mechanical anchor.)
+- **Floor-up declined → stay at Sonnet**, run the turn with good harness structure. No apology framing.
+
+**Reframe rule**: the Sidecar Resolution Protocol's Tier-3 line and auto-decorrelation's degrade ladder
+must not read "no diversity; reduced value" for a *declined* user — that pathologizes their choice.
+Distinguish **declined** (chosen floor — first-class) from **unavailable-but-wanted** (genuine
+degrade-with-note). Only the latter carries the degrade framing.
+
+### Reconciliation with the corp fail-closed invariant
+
+The pmh corp degrade-invariant (`local_pmh_context.md` auto-decorrelation Step 6) says a load-bearing
+change with **no reachable cross-family panel → NOT-CONVERGED / ask operator**. That is the
+**unavailable-but-expected** case (consent given, panel down). The **declined** case is different: the
+user opted out, so Tier-3 sub-agent verification **is** the standing bar (with the honest same-family
+note), and load-bearing changes proceed under it — not blocked. Membership: `floorup_consent`/
+`sidecar_consent == declined` in the UAP routes to the first-class floor; absence of a *wanted* panel
+routes to fail-closed.
+
+---
+
+## UAP persistence (behavioral pref — never domain content)
+
+`operational_adaptation.md` UAP gains two fields:
+- `sidecar_consent: accepted | declined | unset`
+- `floorup_consent: accepted | declined | unset`
+
+**READ** (session start / at point of need): `declined` → route to floor, surface as recommendation
+only, no re-nag. `accepted` → escalation available (still per-need, no auto-run). `unset` → ask-once
+on first need (runtime path above).
+**WRITE**: on onboarding settle, or on the first runtime accept/decline.
+
+Ephemeral/cloud sessions (UAP wiped) → operate from the **Sonnet floor + CC-only** default (the safe
+floor), do not fabricate consent.
+
+---
+
+## Cost lens (why this IS the cost-governance mechanism)
+
+The floor-up consent prompt is **the operator's cost lever made explicit** (measured: Sonnet-economized
+≈ 34× subscription; Opus-full 40–60×, `cost_report_2026-07-07`). Default Sonnet floor + escalate-Opus-
+**only-where-depth-pays**-with-consent is precisely "amortize Opus on the turns that earn it." Pair with
+a **free internal-model execution lane** where the environment has one (`[[feedback_multimodel_3lane_architecture]]`)
+to offload exec cost off the paid API entirely. The protocol turns hard-won economizing into a mechanical default.
+
+---
+
+## Done When
+
+- **Both axes negotiated at onboarding** (install-wizard names sidecar + floor-up as consent items). *[mandatory-pass — grep install-wizard for both items]*
+- **Runtime ask-once wired** for `unset` consent at first need; decline → recommend-only + floor, no re-nag. *[judged — pair: Sonnet target-tier blind sim of a skipped-onboarding session hitting first floor-up]*
+- **UAP fields present + READ applied** (`sidecar_consent`, `floorup_consent`). *[mandatory-pass — grep operational_adaptation.md]*
+- **Declined-mode reframed first-class** (no "degraded/reduced-value" language on a declined user's Tier-3 path). *[judged — pair: challenger reads auto-decorrelation + Sidecar Resolution for pathologizing language]*
+- **Corp fail-closed reconciled** (declined ≠ unavailable-but-wanted). *[judged — pair: the target-tier sim above exercises both branches]*
+
+## Guards
+
+- **Human override inviolable** — a consent is a default, never a cap; the operator can always force a
+  tier/sidecar for a given turn (`[[feedback_verify_before_downgrade]]` floor governance).
+- **Never auto-switch the session model** — the floor-up ASK proposes; the human acts (`/model`). The
+  protocol never flips the model itself.
+- **Sonnet floor is a floor, not a ceiling** — declined-floor-up still escalates *within* Sonnet's
+  harness depth (sub-agents, good structure); it does not cap capability, only cost/trust surface.

package/knowledge/shared/harness-core/fh_detail_protocols.md

@@ -37,12 +37,31 @@ ls ../ | grep -iE '(forge-harness|meta-harness|-harness|-hub)'
 ls .claude/registry/LOCAL_SKILL_REGISTRY.md 2>/dev/null
 ```
 - File exists and modified within 7 days → load into session
-- Missing or older than 7 days → regenerate:
+- Missing or older than 7 days → regenerate.
+
+**No hardcoded root — derive the install location (users install FH anywhere).** The projects root is
+the *parent of the FH repo*, discovered at runtime, never a literal `~/projects` / `~/PycharmProjects`
+(a hardcoded root silently returns 0 on any machine whose layout differs — the 2026-07-05 dead-path
+`fail-open` bug: `find ~/projects` on a `~/PycharmProjects` machine → 0 catches → the registry is
+overwritten empty and cross-project summon goes dark):
 ```bash
-find ~/projects -path "*/.claude/skills/*/SKILL.md" \
-  -not -path "*/forge-harness/*" 2>/dev/null
+HUB="${CLAUDE_PROJECT_DIR:-$(pwd)}"          # FH 레포 위치 (설치 위치 무관, 감지)
+ROOT="$(cd "$HUB/.." 2>/dev/null && pwd)"     # 형제 프로젝트가 사는 부모 = 프로젝트 루트
+# 두 레이아웃 모두 포착: .claude/skills/*/SKILL.md AND 루트-레벨 */SKILL.md (예: gstack).
+# vendored(.venv·site-packages·node_modules·.git) 제외 — 없으면 playwright/streamlit 스킬까지 삼킴.
+FOUND="$(find "$ROOT" -name SKILL.md \
+  -not -path "*/.venv/*"  -not -path "*/site-packages/*" \
+  -not -path "*/node_modules/*"  -not -path "*/.git/*" \
+  -not -path "$HUB/*" 2>/dev/null)"    # exclude FH's own subtree by DERIVED path, not a name-literal (works when FH is cloned under any dir name)
 ```
-Group by project → update `.claude/registry/LOCAL_SKILL_REGISTRY.md`. Propose cross-project skills when request maps to registry. Scan once per session.
+Then **fail-closed** (irreversible-ish: a silent empty overwrite blinds the bus): if `$FOUND` is empty
+**and** the existing registry has >0 entries, do **not** overwrite — flag `⚠️ scan returned 0 (root=$ROOT);
+kept existing registry` and skip the rewrite. Only rewrite when the scan is non-empty (or the registry
+was absent). Group by project (parent dir name). Record per skill: name · path · description · trigger
+phrases · `requires_cwd` · `direct-executable` · `origin(FH|project|external)`+trust. **Non-FH skills are
+propose-only (ask-tier), never auto-run** — a cross-project skill body is an injection surface. Propose
+cross-project skills when a request maps to the registry. Scan once per session. (Detection belongs at
+install too — `/install-wizard` records HUB/ROOT so the runtime never guesses; see install-wizard.)
 
 ### Step 2 — Active Proposal
 

package/knowledge/shared/harness-core/field_verdict_crossfamily_gate.md

@@ -0,0 +1,143 @@
+---
+name: field_verdict_crossfamily_gate
+description: Load-bearing field-project verdict/gate/safety code gets the same cross-family adversarial gate as FH assets — the correlated default-toward-PASS blind spot is model-family-level, not FH-specific.
+type: reference
+date: 2026-07-03
+tags: [cross-family, decorrelation, verdict-binding, field-harness, degrade-direction, correlated-blindspot, mode-d]
+---
+
+# Field-Harness Load-Bearing Change Gate — cross-family, pre-merge
+
+> Compressed rule + trigger table live in `CLAUDE.md §Field-Harness Load-Bearing Change Gate`.
+> This is the detail: the root principle, the failure signature, the gate mechanics, and the
+> field evidence (qasp, 2026-07-03).
+
+## 1. The root principle — prose specification grants discretion, not depth
+
+Specifying an engine's decision logic in **conversational / prose** terms ("add more depth",
+"break it down and analyze", "consider carefully whether it passed") does **not** add depth —
+it grants **discretion**. The model fills that discretion with its **optimistic prior**. On a
+verdict surface, the optimistic prior is *PASS*. So wherever a verdict surface's judgment is
+under-constrained, its **degrade direction is toward PASS** — the exact opposite of safe-fail.
+
+Corollary: **real depth in an engine = removing discretion (more mechanical constraint), not
+better prose.** "깊이를 더해라" applied to engine logic is a category error. This is the same
+axis as FH's `[[feedback_judge_robustness_mechanical_anchor]]` (terminal verdict needs a
+mechanical anchor, never judge-only) and the source-level reinforcement question (does the
+*format* of an emitted anchor change computation, not just its content).
+
+Negative example (반면교사): **CaseCraft** hung loose prompts on the engine logic → the engine's
+verdicts inherited the LLM's unconstrained optimistic reading → holes. **qasp / pmh overcame it**
+by mechanizing the verdict surface (verdict-binding = mechanical ground truth only, no-judge,
+fail-closed gates, mechanical anchors). See `[[project_qasp_casecraft_positioning]]`.
+
+## 2. The failure signature — one sentence, four faces
+
+> **"When a verdict surface cannot mechanically ground its judgment, it defaults toward PASS
+> instead of safe-fail."**
+
+Every instance is a form of **discretion leaking into verdict logic**:
+
+| Face | The discretion | Safe-fail form |
+|---|---|---|
+| **default-PASS-on-absence** | unconstrained `else` / fall-through picks the permissive value | explicit `BLOCK`/`None`/raise |
+| **affordance-without-grounding** | score-heuristic "judgment" of what counts as a match | hard grounding gate (target-text must score > 0) |
+| **substring-not-exact** | loose definition of "present" (`tok in text` → paid⊂prepaid, 완료⊂미완료) | exact / word-boundary match |
+| **unknown-to-permissive-default** | unenumerated branch defaults to allow | enumerate-or-safe-fail |
+
+## 3. Why same-family review misses it — and cross-family catches it
+
+The blind spot is **directional** (the degrade direction on the unhappy path) and rests on a
+**shared optimistic prior**. A same-family reviewer — even a frontier model, even a target-tier
+blind sim — reads the under-constrained branch the same optimistic way the author wrote it, so
+it does not *see* the discretion as a hole. A **different-family** auditor does not share that
+prior, so it reads the same branch adversarially and names the false-PASS.
+
+This is not "cross-family is smarter" — it is **decorrelation**: the value is that the auditor's
+error distribution is *different*, so it covers the author's directional blind spot. Governor
+discipline still applies: sidecar findings are **candidates**, not terminal; the governor
+source-grounds each (does the real pipeline reach it? does an existing mechanical anchor mitigate
+it?) before acting — mechanical anchor over agreement.
+
+## 4. The gate (before merge, not after)
+
+1. **Degrade-direction lint** — `scripts/degrade_direction_scan.sh` (portable copy:
+   `templates/degrade_direction_scan.sh`). A cheap **mechanical pre-screen**: greps the changed
+   files for the code shapes above (except/else→PASS, `.get(k, <pass>)`/`setdefault`,
+   substring-on-grounding-line). **Advisory review surface, NOT a hard gate** — grep-heuristic,
+   false positives expected; a hit means *"prove this is not default-toward-PASS"*, and it never
+   blocks alone (exit 2 = advisory). It points attention; it does not decide. Opt-out per line:
+   `# noqa: degrade`. It scans **py + sh**; a changed load-bearing surface in any other language is
+   reported as *unscannable / not-covered* (exit 2), never folded into an "advisory clean". **Efficacy
+   caveat**: in the n=7 qasp sweep the lint itself caught nothing — the catches were the cross-family
+   audit + accumulated regression tests. It is a token-free pre-screen ahead of a paid cross-family
+   dispatch, *not a proven detector*; revisit if it never surfaces what the cross-family pass wouldn't.
+2. **Cross-family adversarial review** — `auto-decorrelation` recruits ≥1 different-family auditor
+   (e.g. `codex` gpt-5.5 / high for repo-grounded verdict code). The same standing verifier the
+   4-axis gate uses for load-bearing FH assets, now applied to **field** load-bearing changes.
+3. **Confirm → fix → re-verify loop** — iterate until the cross-family pass is **CONVERGED**: no
+   reachable false-PASS / false-CONFIRMED / masked-FAIL / crash-where-safe-fail-required. **Each fix
+   ships a mechanical regression test** reproducing the closed hole — a *required* convergence
+   sub-condition, not incidental. (Two decorrelated models agreeing is still judgment; in the n=7
+   sweep the round-6 over-correction was caught by an accumulated regression test, so the anchor leg
+   is made mandatory — mechanical anchor over agreement.) Documented recall-limits of a
+   deliberately-precise no-judge oracle (e.g. separator-negation `un-paid`, row-level positional
+   state swap in a multiset projection) are **not** blockers — inherent precision>recall tradeoffs,
+   fixture-tracked, not discretion-holes.
+
+**Degrade direction — cross-family unavailable ≠ silent same-family pass** (the gate's own standard,
+dogfood-caught 2026-07-03): the gate delegates the cross-family step to `auto-decorrelation`, whose
+*general* degrade is "missing sidecar CLIs never hard-fail → in-session same-family + honest note."
+That silent-degrade is **fail-OPEN for a load-bearing pre-merge surface** — same-family review shares
+the author's directional blind spot, so proceeding on it defeats the gate's entire decorrelation
+value while *claiming* the gate ran. So for this surface the gate **overrides** the default degrade:
+cross-family unreachable → mark **NOT-CONVERGED** and block the autonomous merge / ask the operator,
+or proceed only under an explicit **logged same-family-only acknowledgment** — never a silent
+same-family pass. (This is the same fail-closed direction the target-tier Sonnet sim itself chose:
+"if no cross-family sidecar is reachable, say so explicitly … not silently treat that as a pass.")
+
+**Trigger (per changed file — grep-assisted, salience-dependent, no field hook)** — an AI-authored
+change to a load-bearing field surface: a function returning a **verdict/gate enum or exit code**
+(PASS/FAIL/BLOCK/allow/deny), an **irreversible-op** path (publish/delete/history-rewrite), or a
+**safety invariant** (the-bible L1 floor, qasp verdict-binding, a pre-push/pre-commit hook). The
+grep recipe (verdict-enum return / gate exit / safety-marked function) is a **strong-advisory
+trigger, not a hook** — the FH pre-commit gate is FH-internal and never installed into field
+projects, so it is salience-dependent, and the "safety invariant" category is interpretive, not
+grep-decidable. **Named under-trigger residual** (do not claim airtight): unmarked safety logic,
+boolean-return gate helpers, config-driven allow/deny, and shell/CI irreversible paths can escape
+the grep — an agent under merge pressure can under-trigger by treating a change as non-load-bearing.
+That residual is the reason the gate is reinforced by the always-on Autonomous-Initiative trigger
+row + the operator's proactive framing, not by the grep alone.
+
+**Residency** — sanitize company code (redact vendor/domain literals) before any external-family
+dispatch; domain data never leaves. **Autonomy** — autonomous once the operator has consented in
+the UAP (`tracks/_meta/user_adaptation_profile.md`, defined in `.claude/rules/operational_adaptation.md`),
+same as the FH cross-family complement.
+
+## 5. Field evidence — qasp verdict-binding sweep, 2026-07-03 (n=7)
+
+The gap that motivated this rule: FH's cross-family decorrelation rigor had **never been
+auto-applied to field-harness code** — only to FH's own assets. A one-time sweep of 3 mapped
+harnesses (qasp / the-bible / pmh) found **9 HIGH default-toward-PASS holes**, all one signature.
+
+qasp was fixed under this exact gate, and the **loop itself became the evidence**: each
+confirm→fix→re-verify round, a **different family** caught the residual discretion that the
+*previous same-family fix* had left — 7 rounds to CONVERGED. Even the frontier author's own
+round-6 fix over-corrected (trusted a raw `"PASS"` string), and a **mechanical anchor** (a
+round-1 regression test) caught it. Both legs of the doctrine — cross-family audit *and*
+accumulated mechanical tests — fired against same-family error.
+
+Positioning note: this is an **observational** field study, not yet a controlled claim. The
+controlled follow-up (same- vs cross-family yield on a fixed bug corpus) is what turns the
+observation into a result. Raw study: a private companion store's `paper-signals/` (Mode D;
+`research_candidate_correlated_blindspot_verdict_code_2026-07-03.md`).
+
+## 6. When baked into autonomous loops
+
+In innovator-based loop-engineering (operator delegates a goal), `/goal`, or cluster
+orchestration, this gate is **part of the delegated pipeline**, not an afterthought: a
+load-bearing field change produced autonomously runs the degrade-lint → cross-family review →
+converge loop **before it is considered done**. The autonomy floor applies — the skip/run
+judgment on borderline cases is trusted only at opus-tier or above; a below-floor orchestrator
+runs the review or asks, never silently skips (`[[feedback_judge_robustness_mechanical_anchor]]`,
+CLAUDE.md §Floor governance).

package/knowledge/shared/harness-core/measurement-integrity-checklist.md

@@ -1,7 +1,7 @@
 # Measurement-Integrity Checklist — cross-model measurement pre-flight
 
 > A cross-model measurement is only trustworthy if its **instrument** is verified first.
-> Measurement integrity is a *precondition*, not a result. Three observed failure modes, each with a
+> Measurement integrity is a *precondition*, not a result. Four observed failure modes, each with a
 > concrete countermeasure. Consult this before any FH measurement that compares models (sims, sidecar
 > comparisons, capability-equalizer runs, the-bible model panels, A6-class experiments).
 
@@ -16,6 +16,7 @@ becomes a gate other skills invoke, revisit the weight.
 | 1 | **Silent model fallback** — passing a model *slug* silently resolved to a weaker model (e.g. an `agy` slug fell back to Flash) instead of the intended one. The run *looks* like the named model but isn't. | **Pin the display name, not the slug** (e.g. `"Gemini 3.1 Pro (High)"`, not a bare slug). Confirm the resolved identity, don't assume the slug binds. |
 | 2 | **Non-deterministic borderline verdicts** — contested/borderline cases flip across runs (observed: haiku 4/4 flip; flagship models flip too — flipping is **not** a tier signal). A single draw is noise, not a measurement. | **reps ≥ 3 on any borderline/contested verdict.** A single run on a contested case is inadmissible. Report the flip pattern (STABLE vs FLIP), not just the modal verdict. |
 | 3 | **Generic self-identity probe** — a probe any model passes ("are you working? → OK") proves nothing about *which* model answered. | **Use a discriminating probe** — one that two different models answer *differently*. A generic-pass probe is invalid. The probe is a **pattern, not a fixed string**: a probe that discriminates Opus 4.8 from Sonnet 4.6 today may both-pass a future model generation, so **re-validate the probe each model generation** (same staleness class `memory-hygiene` exists to catch). |
+| 4 | **Serving-path / quantization variance** — the *same* display-name model served over two different backends (different quantization/infra) is a **different instrument** and yields materially different measurements. Observed: one GLM-5.2 model family gave effect-size delta **+0.21** when served via an internal NVFP4-quantized deployment vs **+0.08** via an OpenRouter relay — same model name, ~2.6× different effect (n=864, reps≥3). A correctly-pinned display name (item #1) is **necessary but not sufficient**. | **Pin *and record* the serving path** — backend host + quantization, not just the display name. Two runs are comparable only if the serving path matches; a name match across different infra is an implicit apples-to-oranges. When you cannot hold it fixed, **report the serving path as a measured variable**, not a constant. |
 
 ## Why these are entangled (and why they matter beyond their own scope)
 
@@ -28,10 +29,17 @@ single-draw artifact. Item #3 (discriminating probe) **embodies** the judge-robu
 mechanical-anchor principle — don't trust self-reported identity, prove it discriminatingly
 ([[feedback_judge_robustness_mechanical_anchor]]).
 
+Item #4 (serving-path variance) **sharpens** item #1 into a two-part identity: #1 catches the *wrong
+model* (a slug that fell back); #4 catches the *right model on the wrong instrument* (a correct name
+served over a different quantization/backend). The verified identity a measurement records is therefore
+**name + serving path**, not name alone — a family-decorrelation claim (cross-family sidecar) is only
+sound once the serving path of each family is itself pinned, else "different family" silently smuggles
+"different infra" ([[reference_measurement_serving_path_variance]]).
+
 ## Done When
 
-- The checklist enumerates all three failure modes, each with its countermeasure.
-  *Check class: mandatory-pass (binary — three items present, each with a countermeasure).*
+- The checklist enumerates all four failure modes, each with its countermeasure.
+  *Check class: mandatory-pass (binary — four items present, each with a countermeasure).*
 - The probe item specifies a **discriminating** test and rejects generic probes.
   *Check class: judged, pair: a probe that two different models both pass must FAIL this check; a
   discriminating one must distinguish them.*
@@ -57,3 +65,15 @@ mechanical log.
 ambiguity). Sister findings: [[feedback_correlated_blindspot_union_over_majority]] (reps≥3 prerequisite),
 [[feedback_judge_robustness_mechanical_anchor]] (discriminating-probe = mechanical anchor),
 [[reference_agy_model_catalog]] (display-name pin — agy slug fallback documented there).
+
+**#4 added** (2026-07-05): serving-path variance surfaced in a cross-family verdict-invariance run
+(n=864, borderline fixtures × 2 conditions × K=6 paraphrase × reps≥3). An identical GLM-5.2 model name
+served over an internal NVFP4-quantized deployment vs an OpenRouter relay gave +0.21 vs +0.08
+effect-size delta — quantifying that "same model name ⇒ same measurement" is false. Provenance +
+generalizable finding: [[reference_measurement_serving_path_variance]].
+
+**External corroboration** (2026-07): the local-LLM community independently reports the same hazard —
+practitioners conflate "running model X" with running a *pruned/quantized derivative* of X (aggressive
+low-bit quantization + expert pruning measurably degrade long-context quality while the model *name* is
+unchanged). This is a general measurement pitfall, not FH-specific: a leaderboard or replication that
+pins only the display name silently compares different instruments across serving paths.

package/knowledge/shared/harness-core/multi_model_sidecar_strategy.md

@@ -138,6 +138,64 @@ A sidecar is recruited where it adds *decorrelated* value; its ceiling is still
 harness lifts a model to its own ceiling, it does not move it ([[feedback_harness_ceiling_principle]]).
 "Aggressive" Codex/Gemini use is bounded by the fit task-class above, never a blanket main-seat swap.
 
+### Vendor-native harness — the main layer stays multi-CLI, never Copilot-consolidated
+
+The harness-depth thesis has a **per-vendor corollary**: a frontier model realizes its *highest effective
+capability inside its own vendor-native CLI/harness* — Claude in Claude Code, GPT in the Codex CLI, Gemini
+in Antigravity — because each vendor tunes its full agentic loop (infer→act→observe + tools + context +
+control) for its own model. A **universal router that wraps all of them** (GitHub Copilot) is a *thin*
+surface with no vendor-native harness depth, so routing any model through it **strips the native-harness
+buff and degrades that model's realized intelligence** — not just Claude's. This makes the earlier
+"router shell" row (Copilot / Gemini CLI / Codex CLI as one class) **too coarse**: the *native* CLIs
+(`codex`, `agy`/Antigravity) are full vendor harnesses and belong at their fit task-class above; only the
+*cross-vendor* router (Copilot) is the thin surface.
+
+**Consequences (design-locked):**
+- **Main orchestration stays as-is** — FH pipeline + each vendor's native agent (Claude Code + Codex +
+  Antigravity), each on its own subscription/CLI. The synergy of that native-multi-CLI layer outweighs any
+  cost-consolidation Copilot offers; do **not** collapse the main layer into one router.
+- **Copilot's proper position = a harness-less sidecar** — lightweight inline autocomplete + simple Q&A.
+  It is *not* an orchestration layer and *not* the preferred cross-family access when native CLIs reach.
+- **Never route a model through Copilot when its native CLI is reachable** — copilot-Claude ⟪ native CC,
+  copilot-GPT ⟪ native Codex, copilot-Gemini ⟪ native Antigravity (harness depth + no decorrelation gain
+  if same family as governor + usage-credit cost).
+- **The one legitimate Copilot cross-family use is egress-bounded** — in a *restricted corporate network*
+  where the native `codex`/`agy` CLIs cannot reach out, Copilot's **enterprise Pro+ catalog** becomes the
+  fallback *access* path to non-Claude frontier families (GPT/Gemini) for a one-shot decorrelation call —
+  still a sidecar, never the main seat (company-env panel: [[reference_corp_env_decorrelation_panel]]).
+  On a personal machine with a *free* Copilot tier this cross-family value does not even exist — free tier
+  is autocomplete/QA only, which is exactly its demoted role. (Derived 2026-07-03, operator + cross-vendor
+  Gemini concurrence; extends the governor=native-CC point to every vendor.)
+
+### Batch-judging corollary — the native harness is for interactive/agentic work, not batch scoring
+
+The vendor-native harness gives a model its highest capability for **interactive, agentic** tasks
+(repo-grounded audit, multi-step design, tool-use) — but that *same* agentic loop is a **liability for
+high-volume batch judging**: a deterministic verdict emitted over N fixtures, where there is nothing for a
+tool-use loop to do. Measured 2026-07-04 (H1 verdict-invariance run): the native `codex exec` spins a full
+agentic session per judge (hooks + reasoning ≈ an order of magnitude more tokens than a bare completion),
+and native `agy -p` (once its headless permission-wait is cleared) returns *agentic prose* — a "Summary of
+Work" — rather than a parseable last-line verdict. Both **complete**, but at a cost/parse profile wrong for
+batch.
+
+So the dispatch splits by *shape of the task*, not just by family:
+
+- **Batch cross-family judging** (steel-quench Step 0.6 verdict-invariance, auto-decorrelation over many
+  items, any fixed-fixture flip count) → **clean completion APIs** (OpenRouter, model pinned by
+  *display-name* + `served`-field silent-route check) **+ free local** (a 4090 ollama endpoint). Clean,
+  cheap, parseable, per-call pinnable. *Caveat*: a local thinking model needs a large enough output budget
+  or it truncates inside `<think>` and emits an empty verdict — a config axis, not a capacity limit.
+- **Interactive / agentic verification** (repo-grounded catching, the divergence audits where cross-family
+  disagreement *localizes* a bug) → the **native CLIs** (`codex`, `agy`/Antigravity), where the harness
+  earns its overhead.
+
+This is **not** a contradiction of the harness-depth thesis — it *is* it. The harness lifts capability
+exactly where judgment + tools + iteration matter; for a one-shot self-contained verdict the loop has no
+work, so its depth becomes pure cost. Pick the naked API for batch scoring, the native harness for agentic
+audit. (Derived 2026-07-04, operator + H1 measurement; the batch-side dual of the vendor-native thesis
+above. The native-harness Gemini path via `agy` is headless-usable again once tool-permission auto-proceed
+is set — see [[reference_agy_model_catalog]] for the pin/permission mechanics.)
+
 **Maintenance-Cost Rule** — a compatibility layer is cheap as a *thin entrypoint*, expensive when it
 *duplicates canonical knowledge*. The test:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.48",
+  "version": "1.4.50",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [