@chrono-meta/fh-gate 1.4.64 → 1.4.65

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.64",
+      "version": "1.4.65",
       "description": "Hub meta-operations toolkit — 34 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.64",
+      "version": "1.4.65",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -104,11 +104,11 @@ For complex multi-step tasks, run `/agent-composer` first to plan which agents t
 
 The methodology layer (`tracks/`, `knowledge/`, `SKILL.md` docs) is Codex-compatible beta. Any AI model can follow skill workflows by reading SKILL.md files directly; the automation layer (hooks, plugin-channel agents under `plugins/*/agents/`, `/model`) is Claude Code-native and requires manual adaptation. FH's own agents are auto-loaded via the plugin channel when the plugin is enabled — `.claude/agents/` is the field-project override slot, not where FH ships its agents. Non-Claude runtimes use this `AGENTS.md`, `plugins/*/agents/*.md`, and `scripts/fh-run.sh` to apply the same methodology via adapter.
 
-### Non-Claude runtimes: two things CLAUDE.md holds that you will not auto-load
+### Non-Claude runtimes: three things CLAUDE.md holds that you will not auto-load
 
 `.claude/rules/*.md` with `paths:` frontmatter is a **Claude Code platform feature** — those files are
 auto-loaded into a Claude Code session when it reads a matching file, and **your runtime has no equivalent**.
-So two things that govern behavior are not going to reach you on their own. Read them explicitly:
+So three things that govern behavior are not going to reach you on their own. Read them explicitly:
 
 1. **FH asset changes run a mandatory 4-axis verification chain before the session's first commit.**
    Detail (axis definitions · marker required fields · lightweight exception · substantive carve-out):
@@ -122,6 +122,16 @@ So two things that govern behavior are not going to reach you on their own. Read
    approval plus a gitignored audit note. This binds every runtime, not just Claude Code — a leak does not
    un-happen, and the guard is worth nothing if it only lives where one runtime reads.
 
+3. **Before calling a material work product done, name what you are blind to.** CLAUDE.md routes the
+   everyday "commit and merge this" moment to `agent-composer` **§Author-Exposure Table** — a review
+   pass keyed on *what the author cannot self-detect* (cold entry → `beginner` · everyday friction →
+   `main-player` · outside currency → `expert` · optimistic self-verification → `challenger` +
+   cross-family · rebuilding what exists → `fact-checker` · ungrounded numbers → `phantom-quench`),
+   with a materiality gate and an `Exposure-unclear → challenger` default so "no row applies" is not
+   an exit. **This row exists because the triggering utterance names no agent** — nothing will fire it
+   for you. Your runtime *can* run these lenses: substitute `Agent(subagent_type=...)` per §M2 above
+   (`fh-run`, or `codex exec` reading the agent spec). The lens returns evidence, never the verdict.
+
 The irreversible-surface gates (Pre-Publish · Destructive-Op) likewise live in CLAUDE.md and fire on
 **intent**, not on a file — read them before any publish, delete, or history-rewrite. `pre-push` enforces
 the git-side destructive surface mechanically for every runtime.

package/CLAUDE.md

@@ -176,10 +176,36 @@ The forge-harness hub has a dual identity: **(a) a seed for others** + **(b) you
 - **Implementation:** Skills such as `harvest-loop` follow this principle — they generate skill drafts, prepare commits automatically, and propose PR creation. However, the final decision to submit a PR must always require the user's explicit approval (`y`). This ensures Human-in-the-loop while maximizing AI contribution.
 
 **PR Creation Principle:**
-- AI may commit and push automatically (when changes are approved)
+- AI may commit and push automatically (when changes are approved) — **to a feature branch, never to the integration branch**
 - **PR creation requires explicit user request** ("create PR", "PR 올려줘", "pull request")
 - **Reason:** Prevents PR fragmentation — logical units should be grouped into meaningful PRs, not atomized per commit
-- Default workflow: commit → push → wait for explicit PR request
+- Default workflow: branch → commit → push branch → wait for explicit PR request
+
+**Integration branch is PR-only** (operator decision 2026-07-20). Never `git push origin main`
+directly. Normal path: `git switch -c <branch>` → push the branch → `gh pr create` → after review
+`gh pr merge --squash --delete-branch --admin` (self-approval is impossible when you authored the PR,
+so `--admin` after a completed review is the normal route, not a shortcut).
+
+**Mechanically enforced** by `templates/.git-hooks/pre-push`, which blocks a direct push to
+`main`/`master` unless the explicit `MAIN_PUSH_OK=1` acknowledgment is set (same channel shape as
+`DESTRUCTIVE_OP_OK` / `PUBLIC_SURFACE_OK`). Known-pair calibrated: direct-to-main blocks,
+feature-branch push passes untouched, override honored — over-blocking would just train the override
+into muscle memory and disarm it.
+
+> **Two layers, and which one is the floor**: the **hard floor is server-side** — this repo now runs
+> `enforce_admins: true` with `required_approving_review_count: 0` (set 2026-07-20; the count must be
+> `0`, because enabling `enforce_admins` while it is `1` locks a solo operator out of merging their
+> own PRs — self-approval is impossible). The hook is the **shift-left layer**: it fails at push time
+> and prints the actual remedy, and it keeps holding if the server setting is ever relaxed. It is
+> deliberately not the floor — a client-side hook is bypassable with `--no-verify`.
+> *Origin*: before that change the server had `enforce_admins: false`, so an admin push *satisfied*
+> the rule and merely printed `Bypassed rule violations` — a notice, not a block. A rule that
+> announces its own bypass is not a floor.
+> ⚠️ **Unresolved residual**: `allow_force_pushes` on `main` is still `true`. Two documented API
+> attempts to set it `false` were accepted without error and did **not** persist (verified by
+> independent GET, not by the write response). Force/non-ff pushes are blocked locally by this same
+> hook, so the honest-model case is covered — but the **server-side** history-rewrite surface on
+> `main` remains open. Re-check before relying on it.
 
 ## Permission-Denial Guidance (When Auto-Mode Blocks an Action)
 
@@ -481,6 +507,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "keep watching X", "poll this", "check every N minutes", recurring WATCH item | built-in `/loop` (interval runner) — pair with the WATCH list, don't hand-poll |
 | "research this deeply", "survey the literature", "comprehensive analysis", "deep research", "look this up thoroughly", "조사해줘", "리서치" (general topic research, not trend-scan) | **Deep-Research Capability Ladder** (`knowledge/shared/harness-core/deep_research_capability_ladder.md`) — route to the highest available rung: built-in `/deep-research` if present → else Claude `WebSearch`+`WebFetch` synthesis (tier-sensitive) → `/frontier-digest` only if it's AI/harness trend-scan. No-reinvention: FH routes, does not build a research engine. |
 | "orchestrate agents", "parallel dispatch", "combine skills", "multiple agents" | `/agent-composer` |
+| **a material work product is about to be called done / merged / published** — public or irreversible surface · affects others · carries external claims or numbers · new behavior · security/data/permissions (proactive; the everyday "커밋하고 머지하자" utterance does **not** name an agent, so agent-composer never self-fires here — that is why this row exists) | `agent-composer` **§Author-Exposure Table** — name the exposure row, dispatch that review pass, then decide. Materiality gate + `Exposure-unclear → challenger` default live there; the lens returns evidence, never the verdict |
 | "broaden the grounded corpus", "add another version of the corpus", "ingest the full source as the grounding axiom", "여러 버전으로 통째로 가져와" (verbatim-relay corpus expansion — fail-closed grounding, no generator) | `/corpus-grounding-expander` |
 | "broaden these personas", "what other voices fit this cast", "map these roles to a decision lens", "페르소나 후보군 더 넓혀" (persona seed → tiered judgment-mapped cast; pairs with `persona-innovator` for naming) | `/persona-roster-expander` |
 | "connect a project", "map this project", "link to hub" | `auto_project_mapping.md` (mapping) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.64",
+  "version": "1.4.65",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.64",
+  "version": "1.4.65",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.64",
+  "version": "1.4.65",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/agent-composer/SKILL.md

@@ -63,6 +63,50 @@ For each subtask in the composition plan:
 | Code generation | `writes: true` + code tools | `writes: false` or no code tools |
 | Audit-only | `writes: false` (safe) | `writes: true` (risky for audit) |
 
+### Author-Exposure Table — a review pass, not a second executor
+
+The table above picks **who does the subtask**. This one adds a different question at a different
+stage: **what failure is the author structurally exposed to, now that the work is claimed done?**
+It never replaces capability fit and never selects the agent that performs the work — it adds a
+**review pass** before the work is released. A doc-writing subtask scores no "adversarial review"
+fit, yet its author is blind to cold-entry failure, and capability fit never surfaces that.
+
+**Materiality gate — run this pass only when the work product is material.** At least one of:
+public or otherwise irreversible surface · affects users other than the author · carries external
+claims, numbers, or citations · introduces new behavior · touches security, data, deletion, or
+permissions. Internal notes, wording fixes, and one-line edits do **not** trigger it — an
+unbounded trigger just trains the pass into being skipped.
+
+| Failure the author cannot self-detect | Review mechanism | Type |
+|---|---|---|
+| Cold entry — first contact breaks (missing install step, undefined term, no success signal) | `beginner` | agent |
+| Everyday-use friction invisible to the designer | `main-player` | agent |
+| Currency vs the outside field (needs external citation, not assertion) | `expert` | agent |
+| Self-verification only fails in the optimistic direction | `challenger` + `auto-decorrelation` | agent + pipeline |
+| Rebuilding something that already exists | `fact-checker` · `asset-placement-gate` | agent · skill |
+| Numbers/citations living in the artifact without grounding | `phantom-quench` | skill |
+| **Exposure unclear** (material, but no row above fits) | `challenger` | agent — default, not a skip |
+
+The `Type` column matters for the capability-fit checks above: `writes`/tooling scoring applies to
+**agent** rows only; skill and pipeline rows are invoked, not scored.
+
+**Behavioral rule — no silent skip, and "no row applies" is not an exit.** Name the row before the
+agent. If you believe none applies, you must (a) state which rows you considered, (b) give a
+one-line reason each is excluded, and (c) fall through to the **Exposure-unclear** row — the
+default is `challenger`, never nothing. (Origin: 2026-07-21 — four dispatches in one session were
+chosen by orchestrator judgment alone. They were right; that is luck, not a mechanism. In the same
+session one `beginner` dispatch blocked a public-repo merge on 4 findings the author had not seen.)
+
+**Behavioral rule — the lens does not hold the verdict.** A review pass returns `evidence`,
+`risk`, and a `recommended decision` only. It may **not** emit a terminal `block`/`approve`; the
+orchestrator declares the outcome, on its own stated grounds, and approval on an irreversible
+surface stays with the human regardless of what the lens returned.
+
+**Row-growth criterion (anti-case-crafting).** A new row is admissible only if the failure type has
+been **observed more than once**, is **not coverable by an existing row**, and names a *verifiable
+exposure axis* rather than a job title or a favorite tool. If rows keep accreting, that is the
+signal to fold the table into a smaller set of principled axes — not to keep appending.
+
 **Behavioral rule**: A `writes: false` agent (e.g. fact-checker, hub-persona-auditor) must NOT be assigned a task requiring edits. Capability fit scoring catches this statically before dispatch.
 
 **Behavioral rule**: Degraded composition — when any required-weight role is filled with general-purpose fallback, output `⚠️ degraded: [role]` in the composition plan. Do not silently use general-purpose for a specialized role.

package/plugins/fh-meta/skills/harness-doctor/SKILL.md

@@ -115,6 +115,7 @@ size instrument* is read. The footprint rows below apply to **both** scopes and
 | **Pointer-illusion**: a CLAUDE.md "detail/detailed procedure" pointer whose target is itself an always-loaded `.claude/rules/*.md` | S-tier — the split saves zero context (rules/ auto-loads regardless); move the target out of auto-load, keep the pointer |
 | weekly_audit 14~30 days elapsed | S-tier |
 | weekly_audit 30+ days elapsed | M-tier |
+| `tracks/_meta/*.md` **reference assets** (excluding dated chronological records — `fh_completed_*` · `fh_signal_*` · `frontier_digest_*` · `session_*` · `weekly_audit_*` · `*_log_*`, whose date lives in the filename by design) missing **both** a role/type tag and a version/date stamp | R-tier — taxonomy gap, not urgent. ⚠️ **Measured FP rate before you act on this**: run against FH itself 2026-07-21 it flagged **99/161 (61%)** un-narrowed and **19/26 (73%)** after narrowing — a row that flags most of a directory is noise, not signal. ⚠️ **No consumer**: grep found **no skill that reads `role`/`type` from these files**. Until one exists this is taxonomy for taxonomy's sake — treat as an inventory observation, never escalate |
 
 **Per-unit ≠ aggregate — do not slide between them.** "Every section earns its scope" (the per-unit
 doctrine test) and "the always-loaded total is affordable" (the budget test) are **different questions, and
@@ -229,6 +230,52 @@ FAIL, the safe direction); and the scope test reads directory *existence*, so th
 field→meta (acceptable: the operator names the target, and the footprint rows apply to **both** scopes
 regardless — but it does skip the field-only line rows).
 
+**Context-File Taxonomy check** (mechanical grep, R-tier only — a coverage lens, not a mandate): L1 (Step 2)
+checks `CLAUDE.md` / `.claudeignore` / `.claude/` existence, but nothing checks `tracks/_meta/*.md` context-file
+existence or taxonomy — this adds both. Note: `tpa_schema.md` classifies this file class (`session_card`) as
+**low** risk / "ephemeral state, low blast radius" — most `tracks/_meta/*.md` files are untagged by design, and
+that is expected, not a defect. This check surfaces untagged files for optional triage on the subset that
+function as durable references (e.g. `reference_next_session_starter.md`); it is not a mandate that every file
+in the directory carry a tag.
+
+Scan for two markers per file — a role/type tag (`role:` or `type:` in frontmatter, or a leading `# Role:`
+line) and a version/date stamp (a `YYYY-MM-DD` date or a `version:` frontmatter key, either in the first 10
+lines). A file missing either marker is untagged — report the file list and count; do not escalate past R
+without a human judging whether the specific file's staleness is actually a problem.
+
+```bash
+# find | while, not a glob — same reason as the always-loaded footprint scan above: an unmatched
+# glob aborts under zsh, and a silent zero-match run must still report, not disappear.
+TARGET="${1:?pass the target root explicitly — cwd is not the target}"
+total=0; untagged=0
+while IFS= read -r f; do
+  [ -n "$f" ] || continue
+  total=$((total + 1))
+  # 연대기 기록물은 파일명에 날짜가 있는 것이 설계다 — taxonomy 대상이 아니다(FP 원인의 78/99)
+  case "$(basename "$f")" in fh_completed_*|fh_signal_*|frontier_digest_*|session_*|weekly_audit_*|*_log_*) continue ;; esac
+  grep -qE '^(role|type):|^# ?Role:' "$f" && tag=yes || tag=no
+  head -10 "$f" | grep -qE '[0-9]{4}-[0-9]{2}-[0-9]{2}|^version:' && stamp=yes || stamp=no
+  if [ "$tag" = no ] || [ "$stamp" = no ]; then
+    untagged=$((untagged + 1))
+    echo "UNTAGGED: $f (role-tag=$tag version-stamp=$stamp)"
+  fi
+done < <(find "$TARGET/tracks/_meta" -maxdepth 1 -name '*.md' 2>/dev/null)
+echo "context-file-taxonomy: $untagged untagged of $total files"
+```
+
+**Named residuals of this scan**: `head -10` can miss a stamp in unusually long frontmatter; `^type:` is not
+fence-scoped, so a stray body line starting `type:` outside frontmatter false-positives `tag=yes` — both push
+toward under-reporting, not over-reporting.
+
+Origin (2026-07-20, frontier-auto): surfaced via [Frontier Digest 2026-07-14](https://github.com/chrono-meta/forge-harness/issues/102#issuecomment-4964058520),
+which described a durable-context-file pattern (role-tagged, versioned files shared across 50+ specialized
+agents) citing `aimultiple.com/llm-orchestration` as its source. A `/phantom-quench` pass on 2026-07-20 found
+that page's retrievable content does not actually discuss this pattern — the digest's citation is mis-attributed
+and no verified primary source has been located. The qualitative taxonomy idea (role/version tagging on context
+files) is adopted here on the digest's description alone and is `SPECULATIVE` per H1/H1-b until a verified
+primary source is found; the "40% fewer tool calls" figure the digest also reported is not cited anywhere in
+this check for the same reason.
+
 ### Step 3-L. Language Lint (`--lint` mode only)
 
 > Activate with `/harness-doctor --lint` or when harvest-loop surfaces a P10-series signal. Skipped in standard runs.