@chrono-meta/fh-gate 1.4.59 → 1.4.61

package/CLAUDE.md

@@ -173,7 +173,7 @@ Simplification guard: trivial denials with one obvious fix → state block + sin
 
 - **Returning user** (session files OR mapped project tracks exist): fixed 4-door menu —
 
-  > 🐿️  **Welcome back to FH.** *① Map a project · ② Create a new project · ③ Accelerate a mapped project (work · Full-Harness · skills/agents/plugins) — {field candidates} · ④ Cross-project synergy*
+  > 🐿️  **Welcome back to FH.** *① Map a project · ② Create a new project · ③ Accelerate **or diagnose** a mapped project (work · Full-Harness · skills/agents/plugins · 진단) — {field candidates} · ④ Cross-project synergy*
   >
   > (When **FH-dev state exists** — the operator — the welcome line is **"The FH operator — good to see you."** in place of "Welcome back to FH.")
 
@@ -277,20 +277,20 @@ Record sim results in the Axes 2–3 marker + sub-agent invocation log.
 > headless `claude -p --model` fallback when in-session model-pin is unavailable, the saturation-disguise
 > retry (compact-then-retry once), and the credit-pool caveat — read when a model-pinned dispatch fails.
 
-**Measurement-integrity pre-flight** (when the sim/dispatch is a *cross-model measurement* — pinned to
-a specific tier, comparing model behaviors, or feeding a paper/published claim): consult
-`knowledge/shared/harness-core/measurement-integrity-checklist.md` first — pin the **display name** not
-a slug (silent fallback to a weaker model is a measured failure), take **reps ≥ 3** on any
-borderline/contested verdict (single draw = noise), and use a **discriminating** identity probe (a
-generic "OK" proves nothing about which model answered). The instrument must be verified before the
-measurement is trusted.
+**Measurement-integrity pre-flight**: when the sim/dispatch is a *cross-model measurement* (pinned to a
+tier, comparing model behaviors, or feeding a published claim), **the instrument must be verified before
+the measurement is trusted**.
+
+> **Detail**: See `knowledge/shared/harness-core/measurement-integrity-checklist.md` — pin the display
+> name not a slug (silent fallback to a weaker model is a measured failure) · reps ≥ 3 on any
+> borderline/contested verdict (single draw = noise) · use a discriminating identity probe (a generic
+> "OK" proves nothing about which model answered) — read **before** running any cross-model measurement.
 
 **Floor-tier canary (optional pre-screen — token-free, *below* the Sonnet sim)**: a local model ≤ Sonnet
-can blind-pre-screen a salience-dependent edit *before* the Sonnet dispatch is spent. **Canary, NOT gate**:
-a PASS adds cheap floor confidence and you still run the Sonnet sim; a FAIL never blocks alone. The terminal
-verdict stays with the **Sonnet-or-higher governor bound to a mechanical anchor** (an opus judge is the
-dispatch-recommended strengthener, not a requirement — `sonnet_floor_doctrine.md`) — **no judge-only path**,
-no weak-local-judge regression of the judge-robustness principle (mechanical anchor over judge-only verdict).
+can blind-pre-screen a salience-dependent edit before the Sonnet dispatch is spent. **Canary, NOT gate**:
+a PASS adds cheap floor confidence and you still run the Sonnet sim; a FAIL never blocks alone. The
+terminal verdict stays with the **Sonnet-or-higher governor bound to a mechanical anchor** — **no
+judge-only path**, no weak-local-judge regression of the judge-robustness principle.
 
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Floor-Tier-Canary` — the local
 > model/panel options, the blind-probe procedure, dogfood evidence, and the FAIL-triage (real salience gap
@@ -308,13 +308,14 @@ no weak-local-judge regression of the judge-robustness principle (mechanical anc
 **Cross-family complement (Axis 2, autonomous when consented)**: `steel-quench` dispatches in-session at the
 session tier — **same family** as the governor, so it shares the governor's blind spots. For a **load-bearing**
 change (gates · irreversible-surface code · doctrine), `auto-decorrelation` is the standing cross-family
-verifier: when the configured sidecar panel is discoverable it recruits ≥1 **different-family** auditor (per
-the UAP mapping — e.g. `codex` `gpt-5.5`/xhigh for repo-grounded code/security, `agy`/Gemini for breadth) and
-degrades honestly to single-session when none is. **Autonomous once the operator has consented** (one-time,
-in the UAP — `[[user_adaptation_profile]]`); the governor keeps the terminal verdict and **source-grounds**
-every sidecar finding before acting on it (`[[feedback_judge_robustness_mechanical_anchor]]`). Dogfood
-2026-06-27: a cross-family pass caught a HIGH execution-side-effect blind spot the same-family reviewers +
-the target-tier sim all shared — the decorrelation value made concrete.
+verifier: it recruits ≥1 **different-family** auditor when the sidecar panel is discoverable, and degrades
+honestly to single-session when none is. **Autonomous once the operator has consented** (one-time, in the
+UAP — `[[user_adaptation_profile]]`); the governor keeps the terminal verdict and **source-grounds** every
+sidecar finding before acting on it (`[[feedback_judge_robustness_mechanical_anchor]]`).
+
+> **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Cross-Family-Complement` — the
+> UAP sidecar mapping (which family for which task class) and the 2026-06-27 dogfood evidence — read when
+> recruiting or configuring a cross-family auditor.
 
 ### Mode D Model Notice (fires once, at the same trigger as this gate)
 
@@ -331,161 +332,103 @@ advisory) is governed separately by `capability_escalation_consent.md`.
 
 ## Field-Harness Load-Bearing Change Gate (cross-family, pre-merge)
 
-The 4-axis gate above fires on **FH asset** changes. But the correlated blind spot it guards —
-*"when a verdict surface cannot mechanically ground its judgment, it defaults toward PASS instead
-of safe-fail"* — is **model-family-level, not FH-specific**. It lives in any load-bearing code the
-AI writes, including **mapped field projects** (qasp · the-bible · pmh). FH is the meta-harness:
-accelerating a field harness *to FH grade* means the field's load-bearing changes get the **same
-cross-family adversarial gate** as FH's own assets. Not doing so is the exact gap that shipped **9
-default-toward-PASS holes across 3 harnesses undetected** (measured 2026-07-03). Root principle:
-**prose-specified verdict logic grants discretion; discretion's degrade direction is unconstrained
-(→ optimistic PASS); same-family reviewers share the author's optimistic reading and miss it.**
+The 4-axis gate above fires on **FH asset** changes; this gate applies the **same cross-family
+adversarial rigor to load-bearing field code** (qasp · the-bible · pmh). The blind spot it guards is
+model-family-level, not FH-specific: **prose-specified verdict logic grants discretion; discretion's
+degrade direction is unconstrained (→ optimistic PASS); same-family reviewers share the author's
+optimistic reading and miss it.**
 
 **Trigger (per changed file — grep-assisted, salience-dependent, no field hook)**: an AI-authored
-change to a **load-bearing field surface** — a function returning a **verdict/gate enum or exit code** (PASS/FAIL/BLOCK/allow/deny),
-an **irreversible-op** path (publish/delete/history-rewrite), or a **safety invariant** (the-bible
-L1 floor, qasp verdict-binding, a pre-push/pre-commit hook). File+symbol based (grep the diff for a
-verdict-enum return / gate exit / safety-marked function) — but a **strong-advisory grep trigger,
-not a hook**: the FH pre-commit gate is FH-internal and deliberately never installed into field
-projects, so an agent under merge pressure can still under-trigger (unmarked safety logic,
-boolean-return gate helpers, config-driven allow/deny, shell/CI irreversible paths escape the grep).
-The under-trigger residual is named honestly in the detail doc — it is not claimed to be airtight.
-
-**Gate (before merge, not after)**:
-1. **Degrade-direction lint** (mechanical pre-screen — `scripts/degrade_direction_scan.sh`): flags
-   fall-through / `except` / `.get(default)` / unknown-branch landing on a **permissive** value.
-   **Advisory review surface, NOT a hard gate** — grep-heuristic, FP-tolerant; a hit = *"prove this
-   isn't default-toward-PASS"*, never a solo block (exit 2 = advisory). Points attention; the
-   cross-family review decides. (Portable field copy: `templates/degrade_direction_scan.sh`.)
-2. **Cross-family adversarial review** (`auto-decorrelation` → ≥1 different-family auditor, e.g.
-   `codex` gpt-5.5/high for repo-grounded verdict code) — the same standing verifier the 4-axis
-   gate uses for load-bearing FH changes, now on field load-bearing changes. Governor keeps the
-   terminal verdict + **source-grounds** every finding (mechanical anchor over agreement).
-3. **Confirm→fix→re-verify loop** until CONVERGED (no reachable false-PASS / false-CONFIRMED /
-   masked-FAIL / crash-where-safe-fail). **Each fix ships a mechanical regression test reproducing
-   the closed hole** — the anchor leg is a *required* convergence sub-condition, not incidental: two
-   decorrelated models agreeing is still judgment (mechanical anchor over agreement). Documented
-   recall-limits of a deliberately-precise no-judge oracle (separator-negation, positional multiset
-   masking) are **not** blockers.
-
-*(Role deconfliction: this gate reviews **field code being authored**; the Irreversibility gates
-below gate **the act** of publish/delete/rewrite — disjoint by role and by location, no double-gate.)*
-
-**Degrade direction — cross-family unavailable is NOT a silent same-family pass** (the gate's own
-standard, dogfood-caught 2026-07-03): if no different-family auditor is reachable, the gate does
-**not** fall back to same-family review and proceed — that inherits `auto-decorrelation`'s general
-*silent-degrade / never-hard-fail*, which is **fail-OPEN** for a load-bearing pre-merge surface
-(the gate's entire value is decorrelation; same-family review shares the author's blind spot). It
-marks the change **NOT-CONVERGED** and either blocks the autonomous merge / asks the operator, or
-proceeds only under an **explicit, logged same-family-only acknowledgment** — never a silent
-same-family pass. This **overrides** the delegated skill's default degrade for this surface,
-consistent with §Irreversibility Surface-Class Degrade Invariant (applicable-but-tooling-down ≠ free skip).
-
-**Residency**: sanitize company code (redact vendor/domain literals) before any external-family
-dispatch; domain data never leaves. **Autonomy**: autonomous once the operator has consented (UAP),
-same as the FH cross-family complement. **In autonomous loops** (innovator loop-engineering ·
-`/goal` · cluster orchestration): this gate is **part of the delegated pipeline**, not an
-afterthought — a load-bearing field change produced autonomously runs the lint → cross-family →
-converge loop *before* it is Done. Autonomy floor (§Floor governance): the skip/run judgment is
-trusted only at opus-tier+; below-floor RUNS the review by default (run-first, ask-last — asks only
-when no runnable path exists), never silently skips (sonnet_floor_doctrine.md §Autonomy at Sonnet).
-
-> **Detail** (discretion principle · 4-face signature · gate mechanics · n=7 qasp evidence):
-> `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md`.
+change to a **verdict/gate enum or exit code** (PASS/FAIL/BLOCK/allow/deny), an **irreversible-op**
+path (publish/delete/history-rewrite), or a **safety invariant** (floor, verdict-binding, a
+pre-push/pre-commit hook). Grep the diff for verdict-enum returns / gate exits / safety-marked
+functions — strong-advisory trigger, so under-trigger is a named residual, not an airtight claim.
+
+**Gate (before merge, not after)**: ① **degrade-direction lint**
+(`scripts/degrade_direction_scan.sh` — advisory pre-screen, FP-tolerant, never a solo block) →
+② **cross-family adversarial review** (`auto-decorrelation` → ≥1 different-family auditor; governor
+keeps the terminal verdict + **source-grounds** every finding — mechanical anchor over agreement) →
+③ **confirm→fix→re-verify until CONVERGED**, **each fix shipping a mechanical regression test**
+reproducing the closed hole (the anchor leg is a *required* convergence sub-condition). *(Role
+deconfliction: this gate reviews **field code being authored**; the Irreversibility gates below gate
+**the act** of publish/delete/rewrite — disjoint, no double-gate.)*
+
+**Degrade direction (fail-closed)**: no different-family auditor reachable → **NOT-CONVERGED** —
+block the autonomous merge / ask the operator / proceed only under an **explicit, logged
+same-family-only acknowledgment**; never a silent same-family pass (§Irreversibility Surface-Class
+Degrade Invariant). **Residency**: sanitize company code before any external-family dispatch; domain data never leaves.
+**Autonomy**: autonomous once UAP-consented; **in autonomous loops the gate is part of the delegated
+pipeline**, not an afterthought, and a below-floor orchestrator RUNS the review by default
+(run-first, ask-last — `sonnet_floor_doctrine.md`).
+
+> **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md` — the discretion
+> principle, the four-faces failure signature, why same-family review misses it, the full gate
+> mechanics, the n=7 qasp field evidence incl. the **9 default-toward-PASS holes across 3 harnesses**
+> (2026-07-03), the named under-trigger residuals, and autonomous-loop baking — read when applying
+> or auditing this gate.
 
 ## Field-Harness Diagnostic — "진단해줘 / 개선해줘" on a mapped project (compose → rank → HITL)
 
 The gate above fires on a **specific field code change**. This is its **on-demand pull sibling**: when
 the operator, working in a mapped project, asks to *diagnose* or *improve* the harness itself ("진단해줘",
-"개선해줘", "check this project"), don't hand-pick one skill — **compose the checks FH already has into a
-single ranked diagnostic list and get per-item approval.** The value is that the operator asks once and
-the harness surfaces *everything* worth fixing, ranked, instead of the operator having to know which of a
-dozen skills to invoke. Every fix is HITL — the diagnostic **proposes**, never auto-edits.
-
-**Composition (no-reinvention — every row is an existing check; the diagnostic only *routes and ranks*):**
-
-| Lens | Existing check | Catches (real examples from 2026-07-08) |
-|---|---|---|
-| **Confidentiality / leak** | `/public-surface-audit` (incl. Step 3c ignore-verification) | a hardcoded internal API host literal in a SKILL body; a `local_*_context.md` that is **tracked** when it should be gitignored (the gitignore-mistake class) |
-| **Split integrity** | `/phantom-quench` **Step 2.7** (bidirectional) | orphan detail sections + phantom pointers in a SKILL.md ↔ SKILL_detail.md pair |
-| **Token / salience** | salience-split candidates (`/context-doctor` · `/salience-splitter` targets) | oversized always-loaded SKILL.md / CLAUDE.md — trim candidates |
-| **Structure** | `/harness-doctor` (L1–L4) | orphaned/redundant/decorative units, missing Done-When, ≥70% overlap |
-| **Verdict/gate degrade** | `scripts/degrade_direction_scan.sh` | a field verdict/gate helper that degrades toward permissive (advisory pre-screen) |
-| **Loop-readiness** (황민호 loop-eng 5-question lens, 2026-07-10 — detail home: `loop_engineering.md`, incl. the FH loop inventory + design-time discipline) | *Loop-runtime axis — net-new vs Structure* (harness-doctor scans static form; this scans whether the path closes a loop). **Mechanical grep**: `/goal-quench`·`/loop` wiring present · check-class token declared. **Judged**: is the persisted state (card/handoff/memory) actually reloaded · is the declared check-class anchored, not judged-only · does the path halt. Done-When *presence* → see Structure row (no double-grep). **Adversarial pair** (for the judged sub-checks — decorrelated, behavior-vs-checklist): a target-tier blind sim that *runs* the path and observes whether it halts + persists, rather than re-checklisting it (the harness litmus shares this lens's axis, so it is a co-lens, not the adversary). | an agent path that *runs but doesn't loop*: no completion criterion (Done-When absent), judged-only validation with no anchor, no halt/budget guard (runaway/cost), or no state carried to the next run — the 5 questions (initiate · complete · validate · halt · persist) with 0 answers |
-
-**Output**: one ranked list, `M` (must-fix) / `S` (should-fix) / `R` (recommended) — same tiering as
-harness-doctor — each item stating *lens · file:line · one-line fix*. **Then HITL**: the operator approves
-per item (or a batch); an approved fix routes to the owning skill's normal path (and, if it is itself a
-load-bearing field change, through the Load-Bearing Change Gate above). **Nothing is auto-fixed** — the
-diagnostic's job is the *intelligent list*, the human's job is the *go*.
-
-**Guards**: (a) fires on a **project-level** "진단/개선" ask, not a single-file edit request (those go
-straight to the relevant skill); (b) **once per ask** — not a per-turn nag; (c) **company residency** —
-run leak/confidentiality lenses locally, sanitize before any cross-family dispatch, and *surface*
-company-sensitive findings (tracked company hosts, git-history rewrites) for operator decision rather
-than auto-fixing them (dogfood 2026-07-08: the `local_pmh_context.md` tracked-company-hosts finding was
-surfaced, not auto-untracked — history rewrite is the operator's call); (d) **autonomy floor** — the
-compose/rank judgment is trusted at opus-tier+; below-floor, run the individual checks and present raw
-rather than silently skipping a lens. Scale to the ask: a quick "뭐 고칠 거 있어?" runs the cheap
-mechanical lenses (leak · split · token); "제대로 진단해줘" runs all five + harness-doctor depth.
+"개선해줘", "check this project"), don't hand-pick one skill — **compose the checks FH already has**
+(no-reinvention: the diagnostic only *routes and ranks* existing checks) across **six lenses** —
+confidentiality/leak (`/public-surface-audit` incl. Step 3c ignore-verification) · split integrity (`/phantom-quench` Step 2.7) ·
+token/salience (`/context-doctor` · `/salience-splitter`) · structure (`/harness-doctor` L1–L4) ·
+verdict/gate degrade (`scripts/degrade_direction_scan.sh`) · loop-readiness (5-question lens —
+`loop_engineering.md`) — into **one ranked `M`/`S`/`R` list** (same tiering as harness-doctor; each
+item: *lens · file:line · one-line fix*). **Then HITL per item — nothing is auto-fixed**: the diagnostic's job is the
+intelligent list, the human's job is the *go*; an approved fix routes to the owning skill's normal
+path (and, if load-bearing field code, through the Load-Bearing Change Gate above).
+
+**Guards**: (a) **project-level** "진단/개선" ask only (single-file asks go straight to the skill);
+(b) **once per ask**; (c) **company residency** — leak lenses run locally, sanitize before
+cross-family dispatch, company-sensitive findings are *surfaced* for operator decision, never
+auto-fixed; (d) **autonomy floor** — compose/rank trusted at opus-tier+; below-floor, run the
+individual checks and present raw rather than silently skipping a lens. Scale to the ask: a quick
+"뭐 고칠 거 있어?" = cheap mechanical lenses (leak · split · token); "제대로 진단해줘" = all six +
+harness-doctor depth.
+
+> **Detail**: See `knowledge/shared/harness-core/field_harness_diagnostic.md` — the full lens table
+> (incl. loop-readiness mechanics + its adversarial pairing), the 2026-07-08 dogfood examples, and
+> guard rationale — read when actually running the diagnostic.
 
 ## Onboarding / Acceleration Autopilot — "새 프로젝트 · 하네스 작성 · 가속화" (discover → compose → rank → install-HITL)
 
 The **install-direction twin of the Field-Harness Diagnostic**: same `compose → rank → HITL` engine, but
 it decides *what to install/wire* instead of *what to fix*. When the operator enters an onboarding /
 acceleration door (returning-menu ①②③: "새 프로젝트", "하네스 작성/작성해줘", "이 프로젝트 가속화",
-"harness-ify", "accelerate this project"), don't hand-run one skill — **auto-discover the local state,
-let the innovator center a recommend cascade, produce a ranked install plan, and gate every install.**
-
-**Flow:**
-
-1. **Phase 0 — State Audit + branch (auto-discovery)**: read the target's existing `.claude/agents|skills`,
-   `CLAUDE.md`, mapped `tracks/`, **locally-connected sibling repos** (the env-delta SessionStart hook already
-   emits "N unmapped sibling repos"), and the `LOCAL_SKILL_REGISTRY` + stack/language. Then **branch**:
-   *new-build* (no prior harness) · *extend-existing* (harness present → found→extend, never fork) ·
-   *maintain* (mature harness → route to the Field-Harness Diagnostic instead).
-   **new-build sub-branch — simulate-first (incubator doctrine)**: judge the project's character before
-   building. Clear · small · low failure-cost → build immediately (current flow). Uncertain · exploratory ·
-   failure-expensive → **flag simulate-first as an option**: doctrine says such a project *should* be
-   chamber-simulated before emit. The chamber **run orchestration is now wired** (`scripts/chamber_run.sh`
-   — an intent-driven, resumable 7-step runner: budget-entry cap, ≥3-blind-persona gate, Emission Gate,
-   G4 ledger auto-append; run #3 exercised it 2026-07-14). But a **live one-command autonomous
-   simulate→EMIT of a field harness is NOT yet a capability**: step-4 persona dispatch is human/Claude-driven
-   (bash cannot spawn the isolated Agents — the honest muscle boundary), the EMIT terminus is HITL, and
-   **EMIT has never fired — the ledger's real runs are 2/2 KILL** (the chamber to date *screens*, it has not
-   *birthed*). So today this branch = a one-line HITL recommendation to run the chamber (`chamber_run.sh`),
-   then fall back to Full-Harness Mode §6 for the actual onboarding; the runner gates and records a
-   human-driven run — it must **not** be presented as a push-button autonomous emit. The same branch applies
-   to a **new capability of an existing harness** — the incubate-in-chamber-then-transplant flow is likewise
-   run-orchestrated but not autonomously emitting today. Rationale + economics:
-   `knowledge/shared/harness-core/harness_incubator_doctrine.md §3`. This audit-and-branch pre-step
-   is imported from the revfactory/harness Phase-0 State Audit (sister-audit 2026-07-07) — it tightens FH's
-   found→extend reflex and is the "이미 로컬에 연결돼 있으면 자동 탐색" mechanism.
-2. **Innovator-centered recommend**: `persona-innovator` centers the cascade (Mode I on acceleration / Mode F
-   on FH-dev), composing `plugin-recommender` (Tier 0 platform → Tier 1 official → Tier 2/3) +
-   `cross-ecosystem-synergy-detection` (locally-connected skills worth wiring) + inferred technical level
-   (conversation-cue read, also imported from revfactory) to shape *what* and *how much*.
-3. **Ranked install plan**: one list, `M`/`S`/`R`, each item = *what · why · source (Tier 0 built-in / Tier 1
-   official / local sibling / FH scaffold) · exact install command*. No-reinvention: an official/built-in that
-   covers the need ranks above a net-new scaffold.
-4. **Install — HITL, non-overwriting**: per-item approval; **never clobber an existing `.claude/`** (propose
-   merge/skip if present — this is FH's edge over revfactory's post-plan auto-write and harness-100's raw
-   `cp`). Any generated/installed FH asset runs the **4-axis gate**; a field scaffold runs
-   `asset-placement-gate` + `steel-quench`. **"끝까지 해줘 / 자율로 완주" → full-autonomy**: run the whole
-   plan under the `/goal-quench` budget+quality gate (token cost accepted by the operator), still
-   non-overwriting and still gated per asset — autonomy removes the per-item *prompt*, never the *gate*.
-
-**Guards**: (a) **non-overwriting is inviolable** — the one thing both revfactory surfaces get wrong; FH
-proposes merge, never clobbers; (b) **no-reinvention** — Tier 0/1 first, scaffold only what adds governance;
-(c) **company residency** — discovery of a company sibling repo surfaces it, does not auto-map/leak it;
-promoted to a machine field (`residency` on the skill registry, `fh_detail_protocols.md §1-c`) so any
-derived recommendation naming a `company`/`operator-private` entry lands only in gitignored `tracks/_meta/`
-or the private companion store, never a tracked public file (chamber run #7, 2026-07-14 — the guard was
-prose-only and the field didn't exist);
-(d) **autonomy floor** — the discover/rank judgment is trusted at opus-tier+; below-floor, present the raw
-recommend and ask; (e) **once per door-entry**, not a per-turn nag. This is the door ③ (accelerate) engine
-and the new-project/harness-write path made autonomous — the operator asks once and the harness discovers,
-ranks, and (on request) installs everything worth wiring.
+"harness-ify", "accelerate this project"), don't hand-run one skill:
+
+1. **Phase 0 — State Audit + branch**: auto-discover existing `.claude/`, `CLAUDE.md`, mapped
+   `tracks/`, sibling repos, `LOCAL_SKILL_REGISTRY` → branch *new-build* / *extend-existing*
+   (found→extend, never fork) / *maintain* (→ Field-Harness Diagnostic instead). New-build that is
+   uncertain · exploratory · failure-expensive → **flag simulate-first**: a one-line HITL
+   recommendation to run the chamber (`scripts/chamber_run.sh`), then Full-Harness Mode §6 for the
+   actual onboarding — **never presented as a push-button autonomous emit** (EMIT has never fired;
+   the chamber to date *screens*, it has not *birthed*).
+2. **Innovator-centered recommend**: `persona-innovator` (Mode I acceleration / Mode F FH-dev)
+   composing `plugin-recommender` + `cross-ecosystem-synergy-detection` + inferred technical level.
+3. **Ranked install plan**: one `M`/`S`/`R` list — *what · why · source tier · exact install
+   command*; an official/built-in that covers the need outranks a net-new scaffold.
+4. **Install — HITL, non-overwriting**: per-item approval; installed FH assets run the **4-axis
+   gate**, field scaffolds run `asset-placement-gate` + `steel-quench`. **"끝까지 해줘 / 자율로
+   완주" → full-autonomy** under the `/goal-quench` budget+quality gate — autonomy removes the
+   per-item *prompt*, never the *gate*.
+
+**Guards (inviolable)**: (a) **non-overwriting** — propose merge, never clobber an existing
+`.claude/`; (b) **no-reinvention** — Tier 0/1 first, scaffold only what adds governance; (c)
+**company residency** — a company sibling repo is surfaced, never auto-mapped/leaked; `residency` is
+a machine field on the skill registry (`fh_detail_protocols.md §1-c`), so recommendations naming a
+`company`/`operator-private` entry land only in gitignored `tracks/_meta/` or the private companion
+store; (d) **autonomy floor** — discover/rank trusted at opus-tier+; below-floor, present the raw
+recommend and ask; (e) **once per door-entry**. This is the door ③ engine made autonomous — the
+operator asks once and the harness discovers, ranks, and (on request) installs everything worth wiring.
+
+> **Detail**: See `knowledge/shared/harness-core/onboarding_acceleration_autopilot.md` — the full
+> Phase-0 branch logic (incl. the chamber/simulate-first honesty boundary + `chamber_run.sh` runner
+> scope), revfactory provenance, and guard evidence (chamber run #7) — read when executing this
+> autopilot.
 
 ## Irreversibility Gates — Surface-Class Degrade Invariant (shared spine of the two gates below)
 
@@ -559,32 +502,23 @@ not marketplace-gate alone:
 `LICENSE`/`README` contains a **private harness name or internal codename** · **module paths encode
 internal acronyms**.
 
-**Hook coverage — three distinct actions**: **(a) repo-go-public** (`gh repo create --public` / visibility
-flip / first push to a new public remote) is irreversible and usually in a **separate repo** — no hook of
-*this* repo can catch it, so it stays **AI-behavioral** (proactive trigger below) **+ a portable checklist**
-(`templates/PRE-PUBLISH-CHECKLIST.md`). **(b) committing operator-private tokens into public-tracked content
-of THIS repo IS an effective publish** — caught mechanically by the pre-commit **confidentiality scan**
-(staged added lines vs the gitignored `.public-surface-patterns`; HIGH/MED block, `PUBLIC_SURFACE_OK=1`
-overrides + logs). **(c) `npm publish`** is **mechanically gated against the loaded patterns, on the `npm` CLI path with scripts
-enabled** by `scripts/public_surface_scan_files.sh` (wired into `prepublishOnly`; also `npm run release` runs
-it *outside* the lifecycle). It scans the **full content of the exact npm-published file set** (`npm pack
---dry-run`) — *not* just a commit diff — so a token committed before the scan existed, or carried in a
-`files[]` entry, is caught at the registry boundary (HIGH/MED block, `PUBLIC_SURFACE_OK=1` override + log;
-fail-closed if patterns/file-set unresolved, if the parse looks partial, **or if the gitignored operator
-override is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone / CI).
-**Named residuals (it is a denylist on the npm CLI, not a universal secret-scanner)**: (i) `npm publish
---ignore-scripts` / a CI `.npmrc ignore-scripts=true` / `pnpm`/`yarn publish` **skip the lifecycle hook** —
-route publishes through `npm run release` or an explicit CI scan step; (ii) it scans only the **loaded
-patterns**, so an **un-patterned secret shape** (an API key the patterns don't describe) still ships; (iii) on
-a runner without the gitignored override it is defaults-only unless populated; (iv) it scans **working-tree
-content, not the final tarball bytes** — benign here (content-neutral lifecycle: prepare=chmod, no prepack)
-but re-open if a content-generating publish lifecycle is added (cross-family audit 2026-06-27). So of the Pre-Publish surface,
-**(b) commit-time and (c) npm-publish are mechanized** (with the residuals above); only **(a) separate-repo
-go-public stays genuinely un-hookable** (prose + checklist).
+**Hook coverage — three distinct actions, two of them mechanized**:
+
+| Action | Enforcement |
+|---|---|
+| **(a) repo-go-public** (`gh repo create --public` · visibility flip · first push to a new public remote) | **Un-hookable** — separate repo, no hook here sees it. Stays **AI-behavioral** (the proactive trigger below) + the portable `templates/PRE-PUBLISH-CHECKLIST.md`. |
+| **(b) committing operator-private tokens into public-tracked content of THIS repo** (= an effective publish of that content) | **Mechanized** — pre-commit confidentiality scan, staged added lines vs the gitignored `.public-surface-patterns`. HIGH/MED block; `PUBLIC_SURFACE_OK=1` overrides + logs. |
+| **(c) `npm publish`** | **Mechanized** — `scripts/public_surface_scan_files.sh` via `prepublishOnly`, scanning the full content of the exact published file set. HIGH/MED block; same override + log; fail-closed on unresolved patterns/file-set. |
+
+So only **(a) stays genuinely un-hookable** — that is where this gate's prose is the only floor, which is
+why the proactive trigger matters. (b) and (c) are denylists on their own paths, **not** universal
+secret-scanners: they carry named residuals.
 
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Pre-Publish-Hook-Coverage` — the
-> two-layer pattern (literals only in the gitignored source), honest scope + residuals, and the PR #109
-> (`fh_signal_2026-06-17` Wave 4) / phantom-gate origin — read when configuring or auditing the scan.
+> two-layer pattern (literals only in the gitignored source), honest scope, the full named-residual list for
+> (b) and (c) (`--ignore-scripts` / non-npm clients · un-patterned secret shapes · override-not-populated ·
+> worktree-vs-tarball bytes), and the PR #109 (`fh_signal_2026-06-17` Wave 4) / phantom-gate origin — read
+> when configuring or auditing the scan, or before relying on it as a floor.
 
 ---
 
@@ -607,36 +541,22 @@ force-push, scrub of tracked history, bulk deletion of session records / tracks
    strongest available tier (floor semantics, §Tier-floor); a below-floor pass is provisional.
 3. **Destroy** only what passed — REVIEW blocks a scripted delete chain (script exits 1).
 
-**Mechanical floor (pre-push hook — git-side surfaces)**: for the surfaces that happen at *push* time
-— **remote branch/ref deletion** and **force / non-fast-forward push** (history rewrite) —
-`templates/.git-hooks/pre-push` enforces this gate **mechanically**, not just as prose. It detects the
-destructive refspec on stdin (delete = local SHA all-zeros; force = remote SHA not an ancestor of local),
-runs a **per-ref verdict** (branch delete: SAFE = fully merged → allowed · CHECK = commits off base, 0
-unique paths → blocked for a judged look · REVIEW = unique paths → blocked for recovery; force/non-ff and
-tag/notes deletes always block) and **blocks** unless `DESTRUCTIVE_OP_OK=1` (an explicit, logged operator
-acknowledgment — used *after* enumerate + recover) is set. The verdict is load-bearing (a merged-branch
-cleanup passes; a silent-loss CHECK does not), so this is the enumerate as a mechanical floor, not prose.
-**What it does and does NOT close (honest)**: it closes the **honest-weak-model** gap — an agent that
-simply *forgot* the prose gate is now mechanically stopped. It does **not** close the **injected/adversarial**
-gap: an agent under instruction can set the override or `--no-verify`, and a client-side hook is readable
-and bypassable by design. The hard floor for the adversarial case is **server-side branch protection**
-(GitHub *Restrict deletions* / *Restrict force pushes*) — this hook is the honest-model floor, branch
-protection is the hard floor. **Scope**: covers only git pushes *from a hook-installed repo* (`npm publish`
-is mechanized separately via `prepublishOnly` — see §Pre-Publish Hook coverage (c)); the remaining non-git
-surface — a separate-repo `gh repo create --public` / visibility flip — is genuinely un-hookable and stays
-prose + `PRE-PUBLISH-CHECKLIST.md`. **Portability**: bash-3.2 safe (macOS
-default `/bin/bash`); the original draft used a bash-4 associative array that crashed fail-OPEN on 3.2 —
-caught in test, a portability defect class worth noting.
+**Mechanical floor (pre-push hook — git-side surfaces)**: at *push* time, **remote branch/ref deletion**
+and **force / non-fast-forward push** are enforced **mechanically** by `templates/.git-hooks/pre-push` —
+it runs the per-ref verdict above and **blocks** unless `DESTRUCTIVE_OP_OK=1` (an explicit, logged operator
+acknowledgment, used *after* enumerate + recover). It closes the **honest-weak-model** gap (a forgotten
+prose gate is now stopped); it does **not** close the injected/adversarial one — the hard floor there is
+**server-side branch protection**. Non-git surfaces are out of its scope.
 
 **Degrade direction**: per the Surface-Class Degrade Invariant above, if `predelete_check.sh` is missing
 or errors, this irreversible surface **fails closed** — the pre-push hook blocks (enumerate by hand or
 take the explicit `DESTRUCTIVE_OP_OK=1` override); a tooling-down enumerate step never silently degrades
 into "just delete it."
 
-> Origin: 2026-06-10 branch cleanup — pre-deletion enumeration recovered a parallel session's card
-> (weekly-audit completion + #88 merge state) that existed **only on an unmerged branch** with zero
-> unique paths: exactly the CHECK class, invisible to "is it merged?" intuition. Deletion without the
-> gate destroys live state without anyone noticing.
+> **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Destructive-Op-Hook-Coverage`
+> — the per-ref verdict mechanics, what the hook does/does not close (honest scope + adversarial residual),
+> the bash-3.2 portability defect class, and the 2026-06-10 origin incident — read when auditing or
+> configuring the pre-push gate.
 
 ---
 
@@ -645,38 +565,37 @@ into "just delete it."
 At any point during a session, when the following signals are detected, propose the relevant skill in one line.
 Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?"`
 
+> **Row diet (2026-07-17, Step 0.5 probe 13/18)**: rows whose skill frontmatter `description` already
+> catches the utterance at high confidence were removed — platform-native skill matching owns those
+> (plugin-recommender · harness-doctor · synergy · frontier-digest · sim-conductor · install-wizard ·
+> asset-placement-gate · marketplace-gate · public-surface-audit · verify-bidirectional ·
+> mcp-circuit-breaker · token-budget-gate · salience-splitter — the last one earned removal by a
+> description strengthening in the same change, not by its original description). This table keeps only: **proactive
+> safety gates** (publish · destructive · MCP-mount) · **non-skill protocol routes** (gates, doctrine
+> sections, deep-research ladder) · **disambiguators and weak-description rows**. Before adding a row
+> back, probe whether the description alone catches it.
+
 | Conversation Signal Keywords | Proposed Skill |
 |---|---|
-| "plugin", "what tool should I use", "install", "recommend" (tool exploration) | `/plugin-recommender` |
-| "context is getting long", "token limit", "/clear", "slow", "context" (burden) | `/context-doctor` |
+| "context is getting long", "token limit", "/clear", "slow", "context", "토큰 아깝다" (burden already felt — retrospective; future-cost estimates go to `/token-budget-gate`) | `/context-doctor` |
 | "wrap up this week", "review", "audit", "weekly", "retrospective" | `/harvest-loop` |
 | "pull this into FH", "reverse-harvest", "worth keeping", "harvest pattern", "field pattern" | `/field-harvest` |
 | "용광로모드", "crucible mode", "absorb this whole corpus", "throw everything in", "re-forge FH identity", "melt this down" (total-immersion absorption, not cherry-pick — esp. a whole corpus on a core FH axis, or a frontier showcase risking FOMO) | `knowledge/shared/harness-core/crucible_mode.md` (read it, run the chain: total-ingest → steel-quench/phantom-quench melt → governor identity-bonding → sim/persona reforge → field-harvest rebirth; the core invariants stay unmeltable) |
-| "harness is complex", "too many skills", "check structure", "harness" | `/harness-doctor` |
 | "review this PR", "check diff", "code review" | code diff → built-in `/code-review`·`/review` · FH-asset coherence → `/hub-cc-pr-reviewer` (role split) |
 | "keep watching X", "poll this", "check every N minutes", recurring WATCH item | built-in `/loop` (interval runner) — pair with the WATCH list, don't hand-poll |
-| "are these in sync", "synergy", "can these integrate", "any overlap" | `/cross-ecosystem-synergy-detection` |
-| "latest trends", "frontier", "external resources" | `/frontier-digest` |
 | "research this deeply", "survey the literature", "comprehensive analysis", "deep research", "look this up thoroughly", "조사해줘", "리서치" (general topic research, not trend-scan) | **Deep-Research Capability Ladder** (`knowledge/shared/harness-core/deep_research_capability_ladder.md`) — route to the highest available rung: built-in `/deep-research` if present → else Claude `WebSearch`+`WebFetch` synthesis (tier-sensitive) → `/frontier-digest` only if it's AI/harness trend-scan. No-reinvention: FH routes, does not build a research engine. |
 | "orchestrate agents", "parallel dispatch", "combine skills", "multiple agents" | `/agent-composer` |
-| "run a simulation", "external user perspective", "internal audit", "quality check" | `/sim-conductor` |
 | "broaden the grounded corpus", "add another version of the corpus", "ingest the full source as the grounding axiom", "여러 버전으로 통째로 가져와" (verbatim-relay corpus expansion — fail-closed grounding, no generator) | `/corpus-grounding-expander` |
 | "broaden these personas", "what other voices fit this cast", "map these roles to a decision lens", "페르소나 후보군 더 넓혀" (persona seed → tiered judgment-mapped cast; pairs with `persona-innovator` for naming) | `/persona-roster-expander` |
-| "first install", "FH setup", "wizard", "install-wizard" | `/install-wizard` |
 | "connect a project", "map this project", "link to hub" | `auto_project_mapping.md` (mapping) |
 | "harness-ify this project", "full harness setup", "프로젝트 하네스화", "promote to full harness" | `auto_project_mapping.md §6` (Full-Harness Mode) |
 | "check install", "verify setup", "confirm install", "install-doctor" | `/install-doctor` |
-| "where does this go", "asset location", "hub vs project", "placement" | `/asset-placement-gate` |
-| "add to marketplace", "OK to publish", "pre-publish check" | `/marketplace-gate` |
-| "did I leak anything", "public surface audit", "private token scan", "is my split clean", "check tracked files for private tokens" | `/public-surface-audit` |
 | "publish", "make public", "make this repo public", "go public", "gh repo create --public", "flip to public", "first public push", "publish the package", "npm publish", "twine upload", **opening/updating a PR or pushing content to the public hub** (esp. company-origin) (publish intent — **proactive**, fire *before* the action; adding content to an already-public repo IS publishing that content) | **Pre-Publish Surface Gate** (see above → `/public-surface-audit` + `/marketplace-gate` Check 5 must PASS first). The commit-time half is now **hook-enforced** (mechanical confidentiality scan — see Pre-Publish Gate §Hook coverage (b)), so this proactive trigger is the salience layer over a mechanical floor. |
 | "delete the branch", "브랜치 삭제", "브랜치 정리", "clean up branches", "force-push", "rewrite history", "지워도 돼?" (destructive intent — **proactive**, fire *before* the action) | **Destructive-Op Gate** (see above → enumerate → recover → destroy; `templates/predelete_check.sh`) |
-| "look at this again", "is this right", "counterargument", "re-validate" | `/verify-bidirectional` |
-| "MCP failing", "tool keeps erroring", "circuit-breaker", "same error looping" | `/mcp-circuit-breaker` |
+| **"새 기능 검증해줘", "test this feature", "이 TC 확인해줘" — verifying the user's PRODUCT/feature (not FH itself)** | **Route to the mapped field harness first** (Cross-Project Skill Bus / registry) — the field harness owns product verification. The harness-verification rows in this table (`verify-bidirectional` · `prompt-regression` · `sim-conductor` · `pipeline-conductor`) verify the *harness*, and must not shadow a product-verification ask (a field project's *harness assets* — its skills/rules — still use those FH verification rows) |
+| "지난주에 뭐 했지", "what did we do last week", "예전에 이거 한 적 있나" (recall intent) | §Searching Past Work (CATALOG-first) — read CATALOG.md, then open only candidate files |
 | "add this MCP server", "mount this MCP", "mcp.json에 추가", "connect this tool server" (external-MCP mount intent — **proactive**, fire *before* first tool call; mount intent only — a failing/erroring mounted server is `/mcp-circuit-breaker`'s row above) | `templates/.claude/rules/mcp_tool_gating.md` (name-keyed ask/allow table — never trust server annotations or names; fill §3 at mount time) |
-| "token budget", "how expensive", "estimate tokens", "will this cost a lot" | `/token-budget-gate` |
 | "did my rule change break anything", "regression check", "test harness changes" | `/prompt-regression` |
-| "SKILL.md too large", "split this skill", "skill is bloated", "skill file too long" | `/salience-splitter` |
 | "review for the team", "CTO review", "decision-maker", "share with leadership", "approval deck" | `/apex-review` |
 | "run full pipeline", "verify everything", "end-to-end sweep", "chain all verifications" | `/pipeline-conductor` |
 | "help me write a prompt", "build a prompt", "improve this prompt", "prompt template" | `/meta-prompt-builder` |

package/README.ja.md

@@ -129,13 +129,14 @@ Project B  ──→  CLAUDE.md でハブを接続
 
 スケールが第二の要点です。**スキル · エージェント · プラグイン**は1つの道具です。**ハーネス**は一段上 —
 1つの*星 (star)* です: あるプロジェクトの道具 · ルール · ゲート · 記憶が、1つの働く体へと束ねられたもの。
-**forge-harness はその星たちが暮らす銀河です** — 複数のハーネスを1つの重力圏に収め、軌道に
-とどめ（共通の床、ドリフトなし）、散り散りになる代わりに共に進化させます。そしてこの系はただの
-容れ物ではなく*ゆりかご (nursery)* です: FH はフィールドハーネスを**自らのサンドボックス内で
-シミュレーションとして走らせることができ** — 1回あたりは高くつきますが、総コストは安くなります。
-試行錯誤が一箇所に集まり複利で積み上がるからです — シミュレーションが検証されれば、その
-プロジェクトを独立した特化ハーネスとして**送り出します**。これが目指す目標です。実際には、
-その重力は4つのものから生まれます:
+**forge-harness はその星たちが暮らす銀河です**: 複数のハーネスを共通の床の上に束ねてドリフトを防ぎ、
+散り散りになる代わりに共に進化させます。
+
+この銀河はただの容れ物ではありません。FH はフィールドハーネスを**自らのサンドボックス内で
+シミュレーションとして走らせることができ** — 1回あたりは高くつきますが、試行錯誤が一箇所に集まり
+複利で積み上がるため総コストは安くなります — シミュレーションが検証されれば、その
+プロジェクトを独立した特化ハーネスとして**送り出します (EMIT)**。これが目指す目標です。実際には、
+4つの方法で働きます:
 
 **① 組み立て (Assemble)** — FH はハーネスの*クラスター*を最適なトークンコストで運用し、プロジェクトに合う
 ハーネスを手に握らせます。スキルを1つずつ配線するのではなく、**ハーネス**を — そのプラグイン · スキル ·

package/README.ko.md

@@ -129,12 +129,13 @@ Project B  ──→  CLAUDE.md에서 허브 연결
 
 스케일이 두 번째 핵심입니다. **스킬 · 에이전트 · 플러그인**은 하나의 도구입니다. **하네스**는 한 급 위 —
 하나의 *별(star)*입니다: 한 프로젝트의 도구 · 규칙 · 게이트 · 기억이 하나의 작동하는 몸으로 묶인 것.
-**forge-harness는 그 별들이 사는 은하계입니다** — 여러 하네스를 하나의 중력계에 담아, 궤도에
-잡아두고(공통 바닥, 드리프트 없음), 흩어지는 대신 함께 진화하게 합니다. 그리고 이 계(系)는 그저
-담는 그릇이 아니라 *요람(nursery)*입니다: FH는 현장 하네스를 **자기 샌드박스 안에서 시뮬레이션으로
-돌려볼 수 있고** — 한 번 돌리는 값은 비싸지만 총비용은 쌉니다, 시행착오가 한 곳에 모여 복리로
-쌓이니까 — 시뮬레이션이 검증되면 그 프로젝트를 독립된 특화 하네스로 **배출**합니다. 이것이
-지향하는 목표입니다. 실제로 그 중력은 네 가지에서 나옵니다:
+**forge-harness는 그 별들이 사는 은하계입니다**: 여러 하네스를 공통 바닥 위에 묶어 드리프트를 막고,
+흩어지는 대신 함께 진화하게 합니다.
+
+이 은하계는 담는 그릇에 그치지 않습니다. FH는 현장 하네스를 자기 샌드박스 안에서 **시뮬레이션으로
+돌려보고** — 한 번 돌리는 값은 비싸도 시행착오가 한곳에 모여 복리로 쌓이므로 총비용은 쌉니다 —
+검증이 끝나면 그 프로젝트를 독립된 특화 하네스로 **내보냅니다(EMIT)**. 이것은 지향하는 목표입니다.
+구체적으로는 네 가지 방식으로 작동합니다:
 
 **① 조립(Assemble)** — FH는 하네스의 *클러스터*를 최적 토큰 비용으로 운용하며, 프로젝트에 맞는
 하네스를 손에 쥐어줍니다. 스킬을 하나하나 배선하는 게 아니라, **하네스**를 — 그 플러그인 · 스킬 ·