@chrono-meta/fh-gate 1.4.48 → 1.4.50

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -100,11 +100,20 @@ Local 4090 = **canary tier** (evidence-of, never terminal verdict).
 
 ## Step 6 — Degrade ladder (the intelligent scale-down)
 
+**Consent branch first — declined ≠ degraded** (`[[capability_escalation_consent]]`): if the UAP has
+`sidecar_consent: declined`, do **not** probe/recruit — route straight to **Tier-3 CC-only sub-agent
+verification** (multiple isolated Claude sub-agents, isolation-decorrelation) as a **first-class chosen
+mode**, with an honest *same-family* note but **no "reduced value / degraded" framing** — the user chose
+this floor. `unset` → ask-once at first load-bearing need (accept → proceed; decline → record + this
+branch). Only proceed to the discovery ladder below when consent is `accepted`.
+
 1. frontier cross-family CLI present → recruit it (decorrelated, at-floor) — best.
 2. only local 4090 present → canary pre-screen + in-session opus governor (canary, not full decorrelation).
 3. nothing present → in-session same-family + **honest below-floor/same-family note** (residual named).
 
-Env non-determinism (CLI presence varies) → **silent degrade, never hard-fail**.
+Env non-determinism (CLI presence varies) → **silent degrade, never hard-fail**. Distinguish this
+**unavailable-but-wanted** case (consent given, panel down → degrade-with-note; for a *load-bearing corp*
+surface, fail-closed per `local_pmh_context.md`) from the **declined** case above (chosen floor, first-class).
 
 ## Step 7 — Output
 

package/plugins/fh-meta/skills/context-doctor/SKILL.md

@@ -117,7 +117,7 @@ Run the audit bash (§Step-Bash) and apply thresholds:
 | CLAUDE.md | Exceeds 300 lines | Section-by-section compression / move completed sections to archive |
 | MEMORY.md | Exceeds 180 lines | Check entry count + move `✅ CLOSED` items to archive section |
 | memory/*.md single file | Exceeds 30K (300 lines) | Suggest splitting accumulated history into separate files |
-| SKILL.md (any) | > 300 lines AND no SKILL_detail.md | Propose `/skill-splitter` — governance-semantic split (not compression); compression removes content, splitting routes it on-demand |
+| SKILL.md (any) | > 300 lines AND no SKILL_detail.md | Propose `/salience-splitter` — governance-semantic split (not compression); compression removes content, splitting routes it on-demand |
 
 **Frequency**: When explicitly called with `/context-doctor` or auto-invoked at session start when MEMORY.md is detected at 180+ lines.
 
@@ -259,7 +259,7 @@ context-doctor (token/context) · harness-doctor (structure) · sim-conductor (s
 |---|---|
 | Want to also check structure after resolving token waste | `/harness-doctor` |
 | Want to validate prescription results from external user perspective | `/sim-conductor Area A` |
-| SKILL.md diagnosed as over-loaded (> 300 lines, no SKILL_detail.md) | `/skill-splitter` — governance-semantic split |
+| SKILL.md diagnosed as over-loaded (> 300 lines, no SKILL_detail.md) | `/salience-splitter` — governance-semantic split |
 | All three skills mentioned simultaneously | Three-Doctor Loop circuit activated — diagnosis→prescription→re-diagnosis cycle
 
 ## Done When
@@ -278,4 +278,4 @@ context-doctor (token/context) · harness-doctor (structure) · sim-conductor (s
 **→ Three-Doctor Loop chain (auto-propose after diagnosis):**
 - Prescription modifies SKILL.md / rules / CLAUDE.md → **propose `/harness-doctor`** re-check after fix (structural integrity)
 - Prescription addresses user-facing context (onboarding, README, install guides) → **propose `/sim-conductor Area A`** (external user impact validation)
-- SKILL.md detected as over-loaded → **auto-propose `/skill-splitter`**: `"I see [skill-name] SKILL.md is [N] lines with no SKILL_detail.md. Want me to run /skill-splitter to do a governance-semantic split?"`
+- SKILL.md detected as over-loaded → **auto-propose `/salience-splitter`**: `"I see [skill-name] SKILL.md is [N] lines with no SKILL_detail.md. Want me to run /salience-splitter to do a governance-semantic split?"`

package/plugins/fh-meta/skills/context-doctor/SKILL_detail.md

@@ -73,11 +73,11 @@ wc -l memory/MEMORY.md 2>/dev/null
 # memory/*.md files exceeding 30K
 find memory -name "*.md" -size +30k 2>/dev/null | xargs wc -l | sort -rn | head -10
 
-# SKILL.md files > 300 lines with no SKILL_detail.md (skill-splitter candidates)
+# SKILL.md files > 300 lines with no SKILL_detail.md (salience-splitter candidates)
 find plugins -name "SKILL.md" 2>/dev/null | while read f; do
   lines=$(wc -l < "$f")
   detail=$(dirname "$f")/SKILL_detail.md
-  [ "$lines" -gt 300 ] && [ ! -f "$detail" ] && echo "[skill-splitter candidate] $f ($lines lines)"
+  [ "$lines" -gt 300 ] && [ ! -f "$detail" ] && echo "[salience-splitter candidate] $f ($lines lines)"
 done
 ```
 

package/plugins/fh-meta/skills/goal-quench/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: goal-quench
 description: >-
-  Wraps /goal with a tiered safety + orchestration ladder. core (default): a token budget gate (pre-run estimate), mid-run budget thresholds, and an automatic post-run quality verification via pipeline-conductor — closing /goal's two gaps (Haiku evaluates completion, pipeline-conductor evaluates correctness). pro: adds context-doctor token reduction and agent-composer goal decomposition. max: adds plugin-recommender capability-gap fill and cross-ecosystem-synergy-detection pre-validation. The Phase-1 budget verdict auto-recommends the mode. Triggered by "goal with quality gate", "safe goal", "goal-quench", "orchestrate this goal", or before running /goal on high-stakes tasks.
+  Wraps /goal with a tiered safety + orchestration ladder. core (default): a token budget gate (pre-run estimate), mid-run budget thresholds, and an automatic post-run quality verification via pipeline-conductor — closing /goal's two gaps (Haiku evaluates completion, pipeline-conductor evaluates correctness). pro: adds context-doctor token reduction and agent-composer goal decomposition. max: adds internal-first capability-gap fill (LOCAL_SKILL_REGISTRY skill-bus scan → plugin-recommender external search → auto_project_mapping map/cluster) and cross-ecosystem-synergy-detection pre-validation. The Phase-1 budget verdict auto-recommends the mode. Triggered by "goal with quality gate", "safe goal", "goal-quench", "orchestrate this goal", or before running /goal on high-stakes tasks.
 user-invocable: true
 allowed-tools: ["Read", "Write", "Bash", "Grep"]
 model: sonnet
@@ -39,7 +39,7 @@ goal-quench is a ladder, not a fixed shape. The default (**core**) is the narrow
 |---|---|---|---|
 | **core** (default) | budget gate + mid-run thresholds + post-run quality gate | token-budget-gate, pipeline-conductor --quick | budget GREEN / YELLOW |
 | **pro** | token-reduction pre-pass + goal decomposition into Waves | + context-doctor, agent-composer | budget ORANGE |
-| **max** | capability-gap fill + synergy pre-validation before the run | + plugin-recommender, cross-ecosystem-synergy-detection | budget RED |
+| **max** | **internal-first** capability-gap fill (skill-bus scan → external → map/cluster) + synergy pre-validation | + LOCAL_SKILL_REGISTRY scan, plugin-recommender, cross-ecosystem-synergy-detection, auto_project_mapping | budget RED |
 
 Each mode is a **superset** of the one before it — pro does everything core does, plus more. Nothing in core is removed by escalating.
 
@@ -105,6 +105,7 @@ The clean-streak graduation above governs **unattended-no-review** operation (ru
 - "goal-quench", before any long /goal session
 - `/goal-quench --pro`, `/goal-quench --max`, "orchestrate this goal", "decompose this goal", "optimize then run this goal"
 - "this goal is too big for one run", "find a tool for this goal if FH lacks one" (→ max mode)
+- "assemble capabilities for this project", "develop project X with everything FH has", "what can FH + tools do for this project", "use all of FH's and others' sharp parts on this" (→ max mode, **project-dev capability-assembly** entry — internal skill-bus scan first, then external gap-fill, then map+cluster; token-efficient, non-expert-friendly)
 - Automatically proposed when user mentions `/goal` on tasks estimated > 15K tokens
 - Mode is auto-recommended by the Phase-1 budget verdict (GREEN/YELLOW → core, ORANGE → pro, RED → max)
 
@@ -190,14 +191,16 @@ goal-quench does **not** re-implement agent-composer's gates — its destructive
 
 > **Detail**: See `SKILL_detail.md §Queue-Format` — queue file format, plan-ready output text, sidecar `.active` fields — read when writing the queue (Step B) or the sidecar fields (Step D).
 
-### Step C — plugin-recommender + synergy pre-validation · max only
+### Step C — capability fill: internal-first, then external · max only
 
-Triggered only when agent-composer Step 0.2 reports a capability **GAP** (`fit_score < 0.5` on a required-weight sub-task):
-1. `plugin-recommender` searches FH + Codex + Claude Code marketplaces for a fitting skill/agent.
-2. For each candidate, `cross-ecosystem-synergy-detection` pre-validates fit + overlap **before anything is installed**.
-3. User decides: install / skip / general-purpose fallback (agent-composer's degraded-composition rule applies — `⚠️ degraded: [role]`).
+Triggered only when agent-composer Step 0.2 reports a capability **GAP** (`fit_score < 0.5` on a required-weight sub-task). Fill order is **internal before external** — honors no-reinvention (use FH's + sibling projects' sharp parts before installing anything), and cheaper **on an internal hit** (a local registry read ≪ an external marketplace search; on an internal *miss* the scan is added overhead before the same external path):
 
-max mode never installs anything silently — discovery and synergy-check are surfaced for approval first.
+1. **Internal scan first.** Run the `LOCAL_SKILL_REGISTRY` scan / Cross-Project Skill Bus (the runtime-root-derived scan under `.claude/registry/`) to check whether an existing **FH meta-skill or a sibling-project skill** already fills the gap. **Trust-gated dispatch** (the fields the registry carries are *consumed*, not just surfaced): an **FH meta-skill** hit → propose directly (Agent + Context Card, no install, token-cheap); a **non-FH sibling** hit → if `trust≠trusted` OR `writes≠read-only` → **ask-tier HITL before dispatch** (never propose-directly — sibling code is an injection surface), else propose. **Degrade direction**: if `.claude/registry/` is missing/malformed, treat as an internal-miss and **fall through to external (step 2), warn** — never silently skip capability fill (that drops the GAP sub-task unnoticed; capability-fill is a reversible surface → advisory-degrade per the Surface-Class Degrade Invariant).
+2. **External only if internal has nothing.** `plugin-recommender` searches FH + Codex + Claude Code marketplaces + external repos for a fitting skill/agent; `cross-ecosystem-synergy-detection` pre-validates fit + overlap **before anything is installed**.
+3. User decides: use-internal / install-external / skip / general-purpose fallback (agent-composer's degraded-composition rule applies — `⚠️ degraded: [role]`).
+4. **Approved external capability → map + cluster (deferred to session close).** An adopted external skill or a newly-relevant sibling project is registered via `auto_project_mapping` — but that write **edits CLAUDE.md's track-mapping table and creates `tracks/{project}/` (an FH-asset change that trips the 4-axis auto-gate and shifts the onboarding is-mapped signal — [[feedback_tracks_dir_is_mapped_signal]])**, so it is **deferred to session close**, not run mid-`/goal`-loop: it passes the 4-axis gate as its own change instead of interrupting the run. The **next** run then discovers the capability internally at step 1 — the loop compounds.
+
+max mode never installs or maps anything silently — internal hit, external discovery, synergy-check, and mapping are all surfaced for approval first.
 
 ### Step D — scope-driven sidecar configuration · pro + max
 
@@ -308,8 +311,10 @@ After each goal-quench run, append a calibration entry to `tracks/_meta/goal_que
 - `token-budget-gate` — Phase 1 cost estimation (all modes)
 - `context-doctor` — Phase 1.5 Step A token-reduction pre-pass (pro + max)
 - `agent-composer` — Phase 1.5 Step B goal decomposition into Waves (pro + max)
-- `plugin-recommender` — Phase 1.5 Step C capability-gap fill (max only, GAP-triggered)
+- `LOCAL_SKILL_REGISTRY` scan / Cross-Project Skill Bus — Phase 1.5 Step C internal-first scan (max only, GAP-triggered, before external)
+- `plugin-recommender` — Phase 1.5 Step C external capability-gap fill (max only, GAP-triggered, only if no internal hit)
 - `cross-ecosystem-synergy-detection` — Phase 1.5 Step C pre-validation of discovered candidates (max only)
+- `auto_project_mapping` — Phase 1.5 Step C map/cluster of an adopted external capability (max only, approval-gated, deferred to session close)
 - `pipeline-conductor` — Phase 3 quality gate (`--quick` for core/pro, `--full` for max; called by Stop hook)
 - `field-harvest` — capture calibration data as reusable pattern after 10 runs
 
@@ -321,7 +326,9 @@ After each goal-quench run, append a calibration entry to `tracks/_meta/goal_que
 Phase 1: token-budget-gate verdict output + mode resolved (core default, or pro/max via budget verdict / explicit flag)
 + .claude/goal-quench.active written (with mode: field) + thresholds injected
 + If pro/max: Phase 1.5 ran — context-doctor pre-pass + agent-composer plan;
-  max additionally: GAP-triggered plugin-recommender + cross-ecosystem-synergy-detection pre-validation
+  max additionally: GAP-triggered internal LOCAL_SKILL_REGISTRY scan FIRST (trust-gated dispatch);
+  plugin-recommender + cross-ecosystem-synergy pre-validation ONLY if no internal hit;
+  auto_project_mapping map/cluster deferred to session close only if an external capability was adopted (each surfaced for approval)
 + Phase 3 (on next response after /goal): .pending file detected + pipeline-conductor run
   (--quick for core/pro, --full for max)
 + Verification verdict output (CLEAN/PENDING/BLOCKED/ESCALATE)

package/plugins/fh-meta/skills/harness-doctor/SKILL.md

@@ -76,7 +76,7 @@ confirms the gap*, never a verdict the report emits on its own; surface each gap
 | CLAUDE.md 100~200 lines | S-tier warning |
 | CLAUDE.md 200+ lines | M-tier — separation or reduction needed |
 | 15+ `##` sections in CLAUDE.md | S-tier warning |
-| SKILL.md > 300 lines AND no `SKILL_detail.md` | S-tier — propose `/skill-splitter` (governance-semantic split, not compression) |
+| SKILL.md > 300 lines AND no `SKILL_detail.md` | S-tier — propose `/salience-splitter` (governance-semantic split, not compression) |
 | Rules files unreferenced in CLAUDE.md | R-tier |
 | weekly_audit 14~30 days elapsed | S-tier |
 | weekly_audit 30+ days elapsed | M-tier |
@@ -318,7 +318,7 @@ Verdict: PASS (M-tier 0, "Structure healthy") | CONDITIONAL_PASS (S/R remain, no
 **Three-Doctor Loop chain** (auto-propose after prescription report):
 - M-tier + context/token waste → propose `/context-doctor`
 - M-tier + user-facing behavior changes → propose `/sim-conductor Area A`
-- SKILL.md S-tier (> 300 lines, no SKILL_detail.md) → auto-propose `/skill-splitter`: `"I see [skill] SKILL.md is [N] lines with no SKILL_detail.md. Want me to run /skill-splitter?"`
+- SKILL.md S-tier (> 300 lines, no SKILL_detail.md) → auto-propose `/salience-splitter`: `"I see [skill] SKILL.md is [N] lines with no SKILL_detail.md. Want me to run /salience-splitter?"`
 - Both → propose full Three-Doctor Loop: context-doctor → sim-conductor Area A
 
 ---

package/plugins/fh-meta/skills/harvest-loop/SKILL.md

@@ -137,7 +137,7 @@ FAIL routing: First FAIL → 1 re-synthesis allowed. FAIL after re-synthesis →
 
 ### Step 6 — Curator Lifecycle Review
 
-**6-1 SKILL.md Lifecycle**: 30+ day unused → [STALE] candidate. `pinned: true` → never touch. ≥70% overlap → merge candidate suggestion. **> 300 lines AND no `SKILL_detail.md`** → propose `/skill-splitter` (governance-semantic split — not compression; the grew-through-harvest pattern is a natural split trigger).
+**6-1 SKILL.md Lifecycle**: 30+ day unused → [STALE] candidate. `pinned: true` → never touch. ≥70% overlap → merge candidate suggestion. **> 300 lines AND no `SKILL_detail.md`** → propose `/salience-splitter` (governance-semantic split — not compression; the grew-through-harvest pattern is a natural split trigger).
 
 **6-1-a Archive-candidate auto-tag**: When 0 invocations in 30 days detected (cross-check `tracks/_meta/skill_usage.md`), auto-append `#archive-candidate` tag to that skill's CATALOG.md entry. No file deletion — tag only. User reviews tagged entries at next session start.
 

package/plugins/fh-meta/skills/install-wizard/SKILL.md

@@ -139,7 +139,9 @@ Y (add integration plan items to Step 1) / N (add-only, keep existing rules) / S
 
 **[Prerequisite] install-doctor conflict diagnosis (only in environments without install history)**: if `~/.cc_sentinels/{project-name}_wizard_done` doesn't exist (first install), call `/install-doctor --plugin fh-meta` first. CONFLICT/WARNING items → add ❗ markers to Step 2 proposal list. Items the doctor already diagnosed (`FH plugin install` · `zshrc hook` · `.claudeignore`) → map results directly, skip re-diagnosis; all other items → check directly.
 
-Auto-check each item as PASS / MISS / FAIL. Check items: `.claudeignore` · `local_fh_context.md` · `zshrc hook` · `weekly_audit` freshness · `sentinel` setup · FH plugin install · `.git/info/exclude` · MCP plugin · `deep-insight` plugin (optional) · `fh_env_context.jsonc` · `phantom-gate` (Python + AI-output projects only) · domain pattern pack (optional, none ship by default) · local-LLM offload (optional — surface ONLY if the Step 0 bash emitted the literal line `Local LLM runtime: detected`; absent that line, this item does not exist).
+Auto-check each item as PASS / MISS / FAIL. Check items: `.claudeignore` · `local_fh_context.md` · `zshrc hook` · `weekly_audit` freshness · `sentinel` setup · FH plugin install · `.git/info/exclude` · MCP plugin · `deep-insight` plugin (optional) · `fh_env_context.jsonc` · `phantom-gate` (Python + AI-output projects only) · domain pattern pack (optional, none ship by default) · local-LLM offload (optional — surface ONLY if the Step 0 bash emitted the literal line `Local LLM runtime: detected`; absent that line, this item does not exist) · **`env-delta SessionStart hook`** (Mode D — `scripts/fh_env_delta_scan.sh` registered in SessionStart; MISS if absent when the hub has sibling repos) · **`capability-escalation consent`** (per `[[capability_escalation_consent]]` — negotiate BOTH axes at onboarding so no later escalation is a surprise: *"Allow cross-family sidecars (external billing) for load-bearing verification?"* → `sidecar_consent`, and *"Allow Sonnet→Opus floor-up on depth-heavy turns (~3–5× cost)? Decline = stay at the Sonnet floor, asked per-occasion instead."* → `floorup_consent`; record both to the UAP. MISS if the UAP lacks either field — a skipped user is asked-once at first need, never sprung).
+
+**env-delta detection (Mode D — the mechanical floor for claim ② auto-trigger)**: FH's "undeployed-asset discovery + auto-mapping" (CLAUDE.md claim ②) previously fired **only on explicit invocation** — a new sibling repo pulled, or a task-first session in an unmapped project, was **not** self-detected (the onboarding menu is suppressed on task-first entry by the metadata-is-not-intent / task-first guards, which are load-bearing and must stay). The `scripts/fh_env_delta_scan.sh` SessionStart hook (sibling of `fh_session_load.sh`) closes this **mechanically**: it scans the projects root for git repos that are neither mapped (`tracks/{name}/`) nor wizard-done nor skip-sentineled, and emits a **one-line PROPOSAL** into turn-0 context, firing regardless of task-first entry. It **proposes only** — mapping/install stays HITL; a skipped repo is recorded via a `{name}_mapping_skipped` sentinel so it never re-nags. This is the mechanical anchor over the prose/salience layer (three-family audit 2026-07-06 rated ② PARTIAL/THEATER precisely because the auto-trigger lived only in prose).
 
 **Local-LLM offload (conditional, recommend-only)**: when Step 0 detected a local LLM runtime (Ollama / LM Studio), surface one optional item — route to `/plugin-recommender` for local-model offload tooling. FH recommends, never rebuilds (no-reinvention). Two complementary offload shapes the user picks per workload: **input-side context routing** (a small local model returns line ranges, so the cloud model receives only the dense slices instead of whole files) and **output-side generation delegation** (the local model generates and self-reviews code while the frontier model decomposes and validates). The benefit is tier-dependent — largest in headless/scripted pipelines and on weaker cloud tiers; an interactive session already triages via targeted reads. Local models suit **bounded, well-specified** work (triage, codebase explanation, instructed maintenance), not long-horizon autonomous tasks where small models loop or hallucinate — so the frontier model keeps decomposition and validation. Skip silently when no local runtime is present.
 

package/plugins/fh-meta/skills/memory-hygiene/SKILL.md

@@ -9,8 +9,17 @@ model: sonnet
 # memory-hygiene — Stale Memory Detection and Re-Verification
 
 > Addresses the "stale-but-confident" failure mode: verified information that silently drifts
-> while remaining highly ranked in retrieval — identified as a critical harness failure mode
+> while remaining highly ranked in retrieval — identified as a harness failure mode
 > in *Scaling the Harness in Agentic AI* (arXiv:2605.26112).
+>
+> **Sister asset**: arXiv:2607.01935 (*A-TMA: Decoupling State-Aware Memory Failures in Long-Term
+> Agent Memory*, Shi/Tang/Tung 2026) names this exact class "ghost memory" — outdated / current /
+> transitional facts intermixing during retrieval — and benchmarks it (LTP; conflict-accuracy +0.240,
+> temporal-F1 0.03→0.17 on LoCoMo with a bank-maintenance layer). It is the tighter external frame for
+> what memory-hygiene detects: this skill is the FH-native *detection + archival* pass over the same
+> failure A-TMA formalizes at the retrieval layer. (Source-verified 2026-07-03; a broader bounded-memory
+> testbed, arXiv:2607.02255 AgenticSTS, was considered and set aside — it targets context-assembly, not
+> staleness, so it is not the sister here.)
 
 FH is an online-first harness. Its memory entries point to live external resources (GitHub
 repos, arXiv records, Zenodo DOIs, monitoring routines). These drift faster than in

package/plugins/fh-meta/skills/public-surface-audit/SKILL.md

@@ -103,38 +103,16 @@ literal private token.
 
 ## Step 3. Scan
 
-For each pattern in Step 1, grep the tracked set, then drop allowlisted hits.
-
-```bash
-cd "$REPO_PATH" || exit 1
-# Build the tracked-file list once.
-git ls-files > /tmp/_psa_tracked.txt
-
-# Load your real patterns from the gitignored source (one "severity<TAB>regex" per line).
-PATTERN_SRC="${PSA_PATTERNS:-.claude/rules/.public-surface-patterns}"
-# Absent file ≠ CLEAN. An absent file is unconfigured (silent-failure risk); an EMPTY file is an
-# explicit "no tokens to protect" → CLEAN. Distinguish the two.
-[ -e "$PATTERN_SRC" ] || { echo "⚪ NOT CONFIGURED: no pattern source at $PATTERN_SRC. Create it (empty = explicit CLEAN) before trusting any verdict. Not scanning."; exit 2; }
-
-# One grep pass per pattern row; the regex comes from the file, never hardcoded here.
-while IFS=$'\t' read -r severity regex; do
-  [ -z "$regex" ] && continue
-  grep -nIE "$regex" $(cat /tmp/_psa_tracked.txt) 2>/dev/null | sed "s/^/[$severity] /"
-done < "$PATTERN_SRC"
-```
-
-For each pattern, run `grep -nIE "<regex>" $(git ls-files)`:
-- `-n` → line numbers (required for `file:line` output)
-- `-I` → skip binary files
-- `-E` → extended regex (alternation in the pattern table)
-
-Then remove any hit whose `file` + matched `token` is on the Step 2 allowlist. Do this for **every**
+For each pattern in Step 1, grep the tracked set, then drop allowlisted hits. Do this for **every**
 pattern row before producing the report — do not stop at the first HIT.
 
-**Binary / generated carve-out**: `-I` already skips binaries. Additionally note (do not auto-suppress)
-hits inside generated artifacts (e.g. `paper/*.html` exported from a private source) — these are real
-leaks on the public surface and must be reported, but the fix is "regenerate from a sanitized source",
-not "edit the HTML by hand". Flag them with a `(generated artifact)` note.
+**Binary / generated carve-out**: skip binaries. Additionally note (do not auto-suppress) hits inside
+generated artifacts (e.g. `paper/*.html` exported from a private source) — these are real leaks on the
+public surface and must be reported, but the fix is "regenerate from a sanitized source," not "edit the
+HTML by hand." Flag them with a `(generated artifact)` note.
+
+> **Detail**: See `SKILL_detail.md §Step3-Scan-Script` — the grep-per-pattern bash implementation,
+> flag reference (`-n`/`-I`/`-E`) — read when executing this step.
 
 ---
 
@@ -151,23 +129,13 @@ reports):
   `changeme`, `REDACTED`, `xxxx`, AWS-doc keys like `AKIAIOSFODNN7EXAMPLE`). A high-entropy *example* is
   not a secret.
 
-```bash
-# FP-hygiene tests the MATCHED TOKEN only — never the whole line. A line-level `grep -v` would
-# suppress a real leak that merely *mentions* an example (e.g. `user=<realname> # see EXAMPLE.md`),
-# violating PSA's "allowlist tight" rule. So extract the matched span per hit and drop it only when
-# the span is *entirely* a placeholder/example (anchored ^…$).
-PLACEHOLDER='^(<[a-z0-9_-]+>|\{project\}|EXAMPLE|dummy|changeme|REDACTED|xxxx)$'
-grep -nIE "$regex" $(cat /tmp/_psa_tracked.txt) 2>/dev/null | while IFS= read -r hit; do
-  tok=$(printf '%s' "$hit" | grep -oiE "$regex" | head -1)
-  printf '%s' "$tok" | grep -qiE "$PLACEHOLDER" && continue   # token IS a placeholder → drop
-  printf '%s\n' "$hit"
-done
-```
-
 This differs from the Step 2 allowlist: Step 2 suppresses by **file::token legitimacy**, Step 3b by
 **token value-shape**. Both run — Step 2 then Step 3b. Keep it tight (PSA's "allowlist tight" rule): if a
 token only *contains* an example substring but is otherwise a real private value, it still reports.
 
+> **Detail**: See `SKILL_detail.md §Step3b-FP-Hygiene-Script` — the token-shape-only extraction bash
+> implementation (never line-level) — read when executing this step.
+
 ---
 
 ## Step 3c. Ignore-Verification — the gitignore-mistake safeguard (root-cause, runs before Step 4)
@@ -178,39 +146,14 @@ tracked leak. For each expected-private path, `git check-ignore -v` reports whet
 by which layer** (committed `.gitignore` · local `.git/info/exclude` · global `core.excludesFile`). A
 path that resolves to no ignore rule is a MISS — surface it before it is ever `git add`ed.
 
-```bash
-# Expected-private set = conventional FH local-only files, EXTENDED with any `# private-path: <path>`
-# lines the operator added to the gitignored pattern source (self-extends per repo — not a frozen
-# operator snapshot). Built one-path-per-line + while-read so it is portable across bash AND zsh
-# (zsh does not word-split an unquoted variable, so `for f in $VAR` would break). A non-existent file
-# is skipped; an all-absent set emits n/a, never a silent pass.
-present=$({ printf '%s\n' CLAUDE.local.md .claude/rules/.public-surface-patterns \
-             .claude/rules/local_fh_context.md tracks/_meta/user_adaptation_profile.md
-           grep -E '^# private-path:' .claude/rules/.public-surface-patterns 2>/dev/null \
-             | sed -E 's/^# private-path:[[:space:]]*//'; } \
-         | awk 'NF' | sort -u | while IFS= read -r f; do [ -e "$f" ] && printf '%s\n' "$f"; done)
-[ -z "$present" ] && echo "n/a (no expected-private files present in this repo — add '# private-path:' lines to the pattern source if any exist)"
-printf '%s\n' "$present" | while IFS= read -r f; do
-  [ -z "$f" ] && continue
-  # Tracked status is tested FIRST: a file can match an ignore rule yet still be force-added
-  # (`git add -f`) — the exact ignored-but-committed mechanism behind the PR #109 leak. Tracked wins,
-  # so an ignored-but-committed file reports TRACKED (not a false-clean OK).
-  if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
-    echo "TRACKED $f (already committed — Step 3 scans its contents; un-track if it must be private: git rm --cached)"
-  elif rule=$(git check-ignore -v "$f" 2>/dev/null); then
-    echo "OK      $f → ignored by [$rule]"
-  else
-    echo "MISS    $f (exists, NOT ignored, NOT tracked — one 'git add .' from a leak; add an ignore rule)"
-  fi
-done
-```
-
 - **OK** — ignored; the report names which layer covers it (operator-private files should resolve to
   `.git/info/exclude` or `.gitignore`, never end up tracked).
 - **MISS** — exists but no ignore rule covers it → counts as **🟠 MED** in the Step 4 verdict (a latent
   leak, not yet a breach).
 - **TRACKED** — already committed: Step 3 scans its *contents*; this also flags it for un-tracking if it
-  was meant to be private.
+  was meant to be private. Tracked status is tested **before** ignore status — a file can match an
+  ignore rule yet still be force-added (`git add -f`), the exact ignored-but-committed mechanism behind
+  the PR #109 leak, so TRACKED must win over a false-clean OK.
 
 Why this is the safeguard for **gitignore mistakes** (a wrong assumption about what is ignored):
 `.gitignore` is committed/shared, `.git/info/exclude` is local/personal, and a global `core.excludesFile`
@@ -218,6 +161,10 @@ ignores across all repos — `git check-ignore -v` is the one command that says
 applies, so an "I thought it was ignored" error surfaces here instead of in a public PR (the PR #109
 class of leak). Diagnostic-only: this step never writes — it reports, the operator adds the ignore rule.
 
+> **Detail**: See `SKILL_detail.md §Step3c-Ignore-Verification-Script` — the expected-private-path
+> enumeration + `git check-ignore`/`git ls-files --error-unmatch` bash implementation, bash/zsh
+> portability note — read when executing this step.
+
 ---
 
 ## Step 4. Report

package/plugins/fh-meta/skills/public-surface-audit/SKILL_detail.md

@@ -0,0 +1,150 @@
+---
+name: public-surface-audit-detail
+description: On-demand execution detail for public-surface-audit — scan scripts, report/JSON templates, provenance.
+load: on-demand
+---
+
+## §Step3-Scan-Script
+
+```bash
+cd "$REPO_PATH" || exit 1
+# Build the tracked-file list once.
+git ls-files > /tmp/_psa_tracked.txt
+
+# Load your real patterns from the gitignored source (one "severity<TAB>regex" per line).
+PATTERN_SRC="${PSA_PATTERNS:-.claude/rules/.public-surface-patterns}"
+# Absent file ≠ CLEAN. An absent file is unconfigured (silent-failure risk); an EMPTY file is an
+# explicit "no tokens to protect" → CLEAN. Distinguish the two.
+[ -e "$PATTERN_SRC" ] || { echo "⚪ NOT CONFIGURED: no pattern source at $PATTERN_SRC. Create it (empty = explicit CLEAN) before trusting any verdict. Not scanning."; exit 2; }
+
+# One grep pass per pattern row; the regex comes from the file, never hardcoded here.
+while IFS=$'\t' read -r severity regex; do
+  [ -z "$regex" ] && continue
+  grep -nIE "$regex" $(cat /tmp/_psa_tracked.txt) 2>/dev/null | sed "s/^/[$severity] /"
+done < "$PATTERN_SRC"
+```
+
+For each pattern, run `grep -nIE "<regex>" $(git ls-files)`:
+- `-n` → line numbers (required for `file:line` output)
+- `-I` → skip binary files
+- `-E` → extended regex (alternation in the pattern table)
+
+Then remove any hit whose `file` + matched `token` is on the Step 2 allowlist. Do this for **every**
+pattern row before producing the report — do not stop at the first HIT.
+
+**Binary / generated carve-out**: `-I` already skips binaries. Additionally note (do not auto-suppress)
+hits inside generated artifacts (e.g. `paper/*.html` exported from a private source) — these are real
+leaks on the public surface and must be reported, but the fix is "regenerate from a sanitized source",
+not "edit the HTML by hand". Flag them with a `(generated artifact)` note.
+
+---
+
+## §Step3b-FP-Hygiene-Script
+
+```bash
+# FP-hygiene tests the MATCHED TOKEN only — never the whole line. A line-level `grep -v` would
+# suppress a real leak that merely *mentions* an example (e.g. `user=<realname> # see EXAMPLE.md`),
+# violating PSA's "allowlist tight" rule. So extract the matched span per hit and drop it only when
+# the span is *entirely* a placeholder/example (anchored ^…$).
+PLACEHOLDER='^(<[a-z0-9_-]+>|\{project\}|EXAMPLE|dummy|changeme|REDACTED|xxxx)$'
+grep -nIE "$regex" $(cat /tmp/_psa_tracked.txt) 2>/dev/null | while IFS= read -r hit; do
+  tok=$(printf '%s' "$hit" | grep -oiE "$regex" | head -1)
+  printf '%s' "$tok" | grep -qiE "$PLACEHOLDER" && continue   # token IS a placeholder → drop
+  printf '%s\n' "$hit"
+done
+```
+
+This differs from the Step 2 allowlist: Step 2 suppresses by **file::token legitimacy**, Step 3b by
+**token value-shape**. Both run — Step 2 then Step 3b. Keep it tight (PSA's "allowlist tight" rule): if a
+token only *contains* an example substring but is otherwise a real private value, it still reports.
+
+---
+
+## §Step3c-Ignore-Verification-Script
+
+```bash
+# Expected-private set = conventional FH local-only files, EXTENDED with any `# private-path: <path>`
+# lines the operator added to the gitignored pattern source (self-extends per repo — not a frozen
+# operator snapshot). Built one-path-per-line + while-read so it is portable across bash AND zsh
+# (zsh does not word-split an unquoted variable, so `for f in $VAR` would break). A non-existent file
+# is skipped; an all-absent set emits n/a, never a silent pass.
+present=$({ printf '%s\n' CLAUDE.local.md .claude/rules/.public-surface-patterns \
+             .claude/rules/local_fh_context.md tracks/_meta/user_adaptation_profile.md
+           grep -E '^# private-path:' .claude/rules/.public-surface-patterns 2>/dev/null \
+             | sed -E 's/^# private-path:[[:space:]]*//'; } \
+         | awk 'NF' | sort -u | while IFS= read -r f; do [ -e "$f" ] && printf '%s\n' "$f"; done)
+[ -z "$present" ] && echo "n/a (no expected-private files present in this repo — add '# private-path:' lines to the pattern source if any exist)"
+printf '%s\n' "$present" | while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  # Tracked status is tested FIRST: a file can match an ignore rule yet still be force-added
+  # (`git add -f`) — the exact ignored-but-committed mechanism behind the PR #109 leak. Tracked wins,
+  # so an ignored-but-committed file reports TRACKED (not a false-clean OK).
+  if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
+    echo "TRACKED $f (already committed — Step 3 scans its contents; un-track if it must be private: git rm --cached)"
+  elif rule=$(git check-ignore -v "$f" 2>/dev/null); then
+    echo "OK      $f → ignored by [$rule]"
+  else
+    echo "MISS    $f (exists, NOT ignored, NOT tracked — one 'git add .' from a leak; add an ignore rule)"
+  fi
+done
+```
+
+Why this is the safeguard for **gitignore mistakes** (a wrong assumption about what is ignored):
+`.gitignore` is committed/shared, `.git/info/exclude` is local/personal, and a global `core.excludesFile`
+ignores across all repos — `git check-ignore -v` is the one command that says *which* rule (if any)
+applies, so an "I thought it was ignored" error surfaces here instead of in a public PR (the PR #109
+class of leak). Diagnostic-only: this step never writes — it reports, the operator adds the ignore rule.
+
+---
+
+## §Report-Template
+
+```
+public-surface-audit — Operator-Private Token Scan
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  Target: {REPO_PATH}   |   Tracked files scanned: {N}
+
+  🔴 HIGH  ({count})
+    {file}:{line}  →  {matched token}   [class: username | company asset]
+  🟠 MED   ({count})
+    {file}:{line}  →  {matched token}   [class: absolute home path | ignore-MISS (Step 3c)]
+  🟡 LOW   ({count})
+    {file}:{line}  →  {matched token}   [class: companion-store | private wiring]
+
+  Allowlist-suppressed: {count} hit(s) (legitimate references — not leaks)
+
+  Verdict:
+    ⚪ NOT CONFIGURED — pattern source absent (nothing scanned — NOT a clean result; set up first)
+    🟢 CLEAN        — pattern source present (incl. empty), 0 HIGH + 0 MED + 0 LOW (after allowlist)
+    🟡 REVIEW       — 0 HIGH + 0 MED, LOW-only (drift, not a breach)
+    🔴 LEAK         — 1+ HIGH or 1+ MED (block publish / fix before commit)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+---
+
+## §JSON-Schema
+
+```json
+{
+  "target": "{REPO_PATH}",
+  "tracked_files": 0,
+  "findings": [
+    {"file": "path", "line": 42, "token": "<matched>", "severity": "HIGH", "class": "username"}
+  ],
+  "counts": {"HIGH": 0, "MED": 0, "LOW": 0, "suppressed": 0},
+  "verdict": "CLEAN"
+}
+```
+
+---
+
+## §Sister-Asset-Provenance
+
+Step 3b (FP hygiene) and Step 5 (`--json`) were imported from **garrytan/gstack** `gstack-redact`
+(`lib/redact-engine.ts`) during a hands-on sister-asset cross-audit (2026-06-06; see
+`tracks/_audit/session_2026_06_06_gstack_sister_handson.md`). They are adapted to PSA's operator-IP
+ontology — `gstack-redact`'s generic secret/PII classes (AWS / PEM / JWT / hostname) stay out of PSA's
+scope (orthogonal coverage: PSA = operator-IP leak, redact = generic secret). The reverse direction
+(PSA's operator private-codename + bare-username classes, which `gstack-redact` structurally cannot
+detect) is a candidate contribution back to gstack.

package/plugins/fh-meta/skills/{skill-splitter → salience-splitter}/SKILL.md

@@ -1,15 +1,25 @@
 ---
-name: skill-splitter
-description: Splits an over-loaded SKILL.md into always-loaded (SKILL.md) + on-demand (SKILL_detail.md) layers using a governance-semantic criterion — not length, but when the content is needed. Connects the two files with imperative pointers. Based on paper §9.5 Protocol-Priority Split pattern. Diagnoses, classifies, splits, and verifies in one pass.
+name: salience-splitter
+description: Splits an over-loaded always-loaded context asset — a SKILL.md, CLAUDE.md, or memory index — into a lean always-loaded layer + an on-demand layer, using a governance-semantic criterion (not length, but when the content is needed), connected by imperative pointers. Based on paper §9.5 Protocol-Priority Split pattern. Diagnoses, classifies, splits, and verifies in one pass. Renamed from skill-splitter (old name still routes here).
 user-invocable: true
 allowed-tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
 model: sonnet
 ---
 
-# skill-splitter — SKILL.md Governance-Semantic Split
+# salience-splitter — Governance-Semantic Context Split
 
-> A SKILL.md that does everything in one file is not simple — it is unscoped.
-> The goal is two files each smaller than the original, not one file and its appendix.
+> **Renamed from `skill-splitter` (2026-07-05).** Old-name references still route here. The rename reflects
+> the generalized scope: the split criterion applies to **any always-loaded context asset** — a SKILL.md,
+> a CLAUDE.md, or a memory index — not only skills. The label now names the substance (salience-tiering of
+> always-loaded context), not one instance of it. Dogfood: applied to a memory index 2026-07-05.
+
+> An always-loaded asset that holds everything in one layer is not simple — it is unscoped.
+> The goal is a lean always-loaded layer + an on-demand layer, not one file and its appendix.
+
+**Scope (all three share one criterion — salience: what must be in attention every load):**
+- **SKILL.md** → always-loaded SKILL.md + on-demand `SKILL_detail.md`
+- **CLAUDE.md** → lean rules + on-demand detail docs (imperative `> **Detail**: See …` pointers)
+- **memory index** → hot `MEMORY.md` + on-demand `MEMORY_archive.md` (cold/closed/superseded entries)
 
 ## Trigger Phrases
 
@@ -19,7 +29,7 @@ model: sonnet
 | "context-doctor flagged this skill", "SKILL.md is bloated" | Post-diagnosis split |
 | "I can't see the key parts", "too much detail in the skill file" | Readability problem |
 | "separate the bash from the logic", "move the templates out" | Structural refactor request |
-| `/skill-splitter` | Explicit invocation |
+| `/salience-splitter` | Explicit invocation |
 
 ---
 
@@ -63,7 +73,7 @@ Step 4 — Verify
 
 > **Detail**: See `SKILL_detail.md §Verification-Checklist` — pre-commit checklist table (8 checks) — read when running Step 4 verification.
 
-> **Detail**: See `SKILL_detail.md §Split-Execution` — step-by-step trimming procedure, SKILL_detail.md front-matter format, orphan §section check — read when executing Steps 2–3.
+> **Detail**: See `SKILL_detail.md §Split-Execution` — step-by-step trimming procedure, SKILL_detail.md front-matter format, orphan-section check — read when executing Steps 2–3.
 
 > **Detail**: See `SKILL_detail.md §Classification` — ambiguous content decision algorithm, behavioral-vs-implementation test, 12 annotated examples — read when unsure which layer a section belongs to.
 
@@ -76,7 +86,7 @@ Pointers must be **imperative** (not advisory). The difference:
 | Form | Risk |
 |---|---|
 | Advisory: `"see SKILL_detail.md for details"` | Consumer agent may skip |
-| **Imperative**: `"> **Detail**: See \`SKILL_detail.md §SectionName\` — [what's there] — read when [specific condition]."` | Consumer agent loads on trigger |
+| **Imperative**: `"> **Detail**: See \`SKILL_detail.md §<SectionName>\` — [what's there] — read when [specific condition]."` | Consumer agent loads on trigger |
 
 Every removed section must have exactly one imperative pointer at the point of removal in SKILL.md.
 
@@ -113,7 +123,7 @@ Run on a SKILL.md when **any one** of:
 ```
 Step 1 classification table produced
 + SKILL.md trimmed: triggers · principles · step overview · decision tables · Done When retained
-+ SKILL.md has imperative pointer for every removed section (> **Detail**: See SKILL_detail.md §X)
++ SKILL.md has imperative pointer for every removed section (> **Detail**: See SKILL_detail.md §<X>)
 + SKILL_detail.md created: ## §SectionName header for every pointer in SKILL.md
 + phantom-quench: 0 phantoms (all §pointers resolve)
   → Fallback (skill unavailable): run §Verification-Checklist manually from SKILL_detail.md

package/plugins/fh-meta/skills/{skill-splitter → salience-splitter}/SKILL_detail.md

@@ -1,10 +1,10 @@
 ---
-name: skill-splitter-detail
-description: Detail reference for skill-splitter — content classification algorithm, pointer format variants, verification checklist. Load when executing a specific step.
+name: salience-splitter-detail
+description: Detail reference for salience-splitter — content classification algorithm, pointer format variants, verification checklist. Load when executing a specific step.
 load: on-demand
 ---
 
-# skill-splitter — Detail Reference
+# salience-splitter — Detail Reference
 
 > Load when executing a specific step. SKILL.md contains the core principle, step overview, pointer format requirement, and Done When.
 
@@ -70,13 +70,13 @@ Behavioral rules always pass this test (even if rarely triggered, the consumer n
 ### Standard pointer (single section reference)
 
 ```markdown
-> **Detail**: See `SKILL_detail.md §SectionName` — [one-line description of what's there] — read when [specific condition that triggers need].
+> **Detail**: See `SKILL_detail.md §<SectionName>` — [one-line description of what's there] — read when [specific condition that triggers need].
 ```
 
 ### Multi-item pointer (several related sections)
 
 ```markdown
-> **Detail**: See `SKILL_detail.md §SectionName-A` (bash scripts) · `§SectionName-B` (format templates) — read when executing this step.
+> **Detail**: See `SKILL_detail.md §<SectionName-A>` (bash scripts) · `§<SectionName-B>` (format templates) — read when executing this step.
 ```
 
 ### Pointer placement rules
@@ -96,7 +96,7 @@ Advisory (risky — consumer may skip):
 
 Imperative (required form):
 ```
-"> **Detail**: See `SKILL_detail.md §Step6-Detail` — bash for STALE detection, memory scan, skill usage leaderboard — read when executing Step 6."
+"> **Detail**: See `SKILL_detail.md §<Step6-Detail>` — bash for STALE detection, memory scan, skill usage leaderboard — read when executing Step 6."
 ```
 
 The imperative form includes: