@chrono-meta/fh-gate 1.4.64 → 1.4.66

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.64",
+      "version": "1.4.66",
       "description": "Hub meta-operations toolkit — 34 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.64",
+      "version": "1.4.66",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -104,11 +104,11 @@ For complex multi-step tasks, run `/agent-composer` first to plan which agents t
 
 The methodology layer (`tracks/`, `knowledge/`, `SKILL.md` docs) is Codex-compatible beta. Any AI model can follow skill workflows by reading SKILL.md files directly; the automation layer (hooks, plugin-channel agents under `plugins/*/agents/`, `/model`) is Claude Code-native and requires manual adaptation. FH's own agents are auto-loaded via the plugin channel when the plugin is enabled — `.claude/agents/` is the field-project override slot, not where FH ships its agents. Non-Claude runtimes use this `AGENTS.md`, `plugins/*/agents/*.md`, and `scripts/fh-run.sh` to apply the same methodology via adapter.
 
-### Non-Claude runtimes: two things CLAUDE.md holds that you will not auto-load
+### Non-Claude runtimes: four things CLAUDE.md holds that you will not auto-load
 
 `.claude/rules/*.md` with `paths:` frontmatter is a **Claude Code platform feature** — those files are
 auto-loaded into a Claude Code session when it reads a matching file, and **your runtime has no equivalent**.
-So two things that govern behavior are not going to reach you on their own. Read them explicitly:
+So four things that govern behavior are not going to reach you on their own. Read them explicitly:
 
 1. **FH asset changes run a mandatory 4-axis verification chain before the session's first commit.**
    Detail (axis definitions · marker required fields · lightweight exception · substantive carve-out):
@@ -122,6 +122,44 @@ So two things that govern behavior are not going to reach you on their own. Read
    approval plus a gitignored audit note. This binds every runtime, not just Claude Code — a leak does not
    un-happen, and the guard is worth nothing if it only lives where one runtime reads.
 
+3. **Before calling a material work product done, name what you are blind to.** CLAUDE.md routes the
+   everyday "commit and merge this" moment to `agent-composer` **§Author-Exposure Table** — a review
+   pass keyed on *what the author cannot self-detect* (cold entry → `beginner` · everyday friction →
+   `main-player` · outside currency → `expert` · optimistic self-verification → `challenger` +
+   cross-family · rebuilding what exists → `fact-checker` · ungrounded numbers → `phantom-quench`),
+   with a materiality gate and an `Exposure-unclear → challenger` default so "no row applies" is not
+   an exit. **This row exists because the triggering utterance names no agent** — nothing will fire it
+   for you. Your runtime *can* run these lenses: substitute `Agent(subagent_type=...)` per §M2 above
+   (`fh-run`, or `codex exec` reading the agent spec). The lens returns evidence, never the verdict.
+
+4. **General work is in scope here, and the mechanism for serving it is to marshal installed
+   capability.** CLAUDE.md §Intent Marshaling makes this the runtime default. It settles a *category*
+   question only — whether non-harness work belongs in this environment at all. Every ordinary check
+   about a specific request (is it safe, sensible, well-formed, worth doing) is yours and is unaffected.
+
+   The category answer is yes, for a concrete reason: the skill registry, the mapped field harnesses,
+   and the memory store exist **only** in this environment. So when the operator states a work intent in
+   plain language (write this doc, build this wiki page, organize this material — **any work-shaped ask,
+   not only harness building**), the scan below is what tells you whether capability for it is actually
+   present. An empty scan, reported with the scan cited, is a correct answer — see the third bullet.
+
+   Three constraints carry over unchanged to your runtime:
+   - **Enumerate rather than recall.** List the available skills, `LOCAL_SKILL_REGISTRY`, and the mapped
+     project assets. Recall under-reports what is installed, which is why the scan is a listing step.
+   - **Marshaling never upgrades a trust tier.** Run-first autonomy covers **FH-native capability whose
+     steps are per-action reversible**. A non-FH sibling capability stays at its registry `ask-tier`
+     (propose only), and an outward-mutating action (send · post · deploy · delete) keeps its own gate.
+   - **A capability gap is declared by citing the scan result**, not as a bare "nothing fits" — then
+     route at request scale (internal scan → external search → in-session synthesis). *Persist* routes
+     to the New-Skill gate; *install* routes to plugin-recommender's HITL. No new gates.
+
+   **This item exists because the triggering utterance is ordinary work language that names no skill and
+   no agent** — like item 3, no automatic trigger covers it; read it explicitly.
+
+> **Detail**: See `knowledge/shared/harness-core/intent_marshaling_general_work.md` — the 5-step loop,
+> the gate-routing table, the Sonnet-floor boundaries, and the origin defect — **open it directly**
+> before applying the ladder or when a gap appears.
+
 The irreversible-surface gates (Pre-Publish · Destructive-Op) likewise live in CLAUDE.md and fire on
 **intent**, not on a file — read them before any publish, delete, or history-rewrite. `pre-push` enforces
 the git-side destructive surface mechanically for every runtime.

package/CATALOG.md

@@ -8,6 +8,12 @@ AI reads this file first when searching past work. Open individual files for det
 
 <!-- Add entries in reverse date order (newest at top) -->
 
+### 2026-07-22 | forge-harness | #intent-marshaling, #doctrine, #purpose-organization, #leader-briefing, #conference, #pre-registration
+**File:** knowledge/shared/harness-core/intent_marshaling_general_work.md · CLAUDE.md §Intent Marshaling · (companion store) leader/TF briefing pair · handoff §5-§7
+Two operator insights forged into doctrine. **Intent Marshaling** (PR #161, mirrored to the field meta-harness as its PR #23): the runtime twin of intent-machinization — a work-shaped request in plain language triggers a mechanical capability scan (trust tiers carried in scan output), a one-line compose proposal, then run-first execution; gap declarable only by citing the scan; no new gates (install/persist/outward actions route to existing ones). Verified by Sonnet known-pair sim (2/2 separated) + codex cross-family R1 4/4-confirmed findings (2 HIGH: non-FH ask-tier auto-run hole, per-action reversibility fail-open) fixed to R2 CONVERGED. **Leader-judgment briefing pair** (companion store, operator-approved): QA-team edition (4 judgment axes, measured/pending boundary, act-by-act glossary from operator definitions) + org-TF edition (domain-agnostic layers as protagonist, field harness as the n=1 evidence case, method-stack 8/8 as the domain-agnostic quantitative anchor) — both persona-audited (SHIP_AFTER_M, all findings applied; the audits caught the docs' own optimism twice, which became a self-evidencing section). Conference talk submitted (title A) with **metric pre-registration** pinned in the handoff (calibration / field / org metric sets + before-baseline warning + freeze-timeline insurance).
+- Decision: marshaling autonomy covers FH-native per-action-reversible work only; non-FH registry hits keep ask-tier; specific initiative rows always outrank the fallback row. Briefing scope split two-audience (QA team vs org TF) rather than one doc.
+- Open: marshaling operational track record starts at zero (manifest prediction pending); AGENTS.md port of the marshaling anchor = deferred drift candidate; handoff-reachability defect (untracked file referenced for remote verification) recorded as signal S-1 with a mechanical-check prescription.
+
 > **Backfill note (2026-07-15):** the 07-12 / 07-13 / 07-14 entries below were reconstructed from git
 > history + the session card's completion log during the 2026-07-15 harness-doctor run, which found that
 > CATALOG had stopped at 07-10 while 30 FH-asset commits landed — i.e. 5 days of work were invisible to

package/CLAUDE.md

@@ -176,10 +176,36 @@ The forge-harness hub has a dual identity: **(a) a seed for others** + **(b) you
 - **Implementation:** Skills such as `harvest-loop` follow this principle — they generate skill drafts, prepare commits automatically, and propose PR creation. However, the final decision to submit a PR must always require the user's explicit approval (`y`). This ensures Human-in-the-loop while maximizing AI contribution.
 
 **PR Creation Principle:**
-- AI may commit and push automatically (when changes are approved)
+- AI may commit and push automatically (when changes are approved) — **to a feature branch, never to the integration branch**
 - **PR creation requires explicit user request** ("create PR", "PR 올려줘", "pull request")
 - **Reason:** Prevents PR fragmentation — logical units should be grouped into meaningful PRs, not atomized per commit
-- Default workflow: commit → push → wait for explicit PR request
+- Default workflow: branch → commit → push branch → wait for explicit PR request
+
+**Integration branch is PR-only** (operator decision 2026-07-20). Never `git push origin main`
+directly. Normal path: `git switch -c <branch>` → push the branch → `gh pr create` → after review
+`gh pr merge --squash --delete-branch --admin` (self-approval is impossible when you authored the PR,
+so `--admin` after a completed review is the normal route, not a shortcut).
+
+**Mechanically enforced** by `templates/.git-hooks/pre-push`, which blocks a direct push to
+`main`/`master` unless the explicit `MAIN_PUSH_OK=1` acknowledgment is set (same channel shape as
+`DESTRUCTIVE_OP_OK` / `PUBLIC_SURFACE_OK`). Known-pair calibrated: direct-to-main blocks,
+feature-branch push passes untouched, override honored — over-blocking would just train the override
+into muscle memory and disarm it.
+
+> **Two layers, and which one is the floor**: the **hard floor is server-side** — this repo now runs
+> `enforce_admins: true` with `required_approving_review_count: 0` (set 2026-07-20; the count must be
+> `0`, because enabling `enforce_admins` while it is `1` locks a solo operator out of merging their
+> own PRs — self-approval is impossible). The hook is the **shift-left layer**: it fails at push time
+> and prints the actual remedy, and it keeps holding if the server setting is ever relaxed. It is
+> deliberately not the floor — a client-side hook is bypassable with `--no-verify`.
+> *Origin*: before that change the server had `enforce_admins: false`, so an admin push *satisfied*
+> the rule and merely printed `Bypassed rule violations` — a notice, not a block. A rule that
+> announces its own bypass is not a floor.
+> ⚠️ **Unresolved residual**: `allow_force_pushes` on `main` is still `true`. Two documented API
+> attempts to set it `false` were accepted without error and did **not** persist (verified by
+> independent GET, not by the write response). Force/non-ff pushes are blocked locally by this same
+> hook, so the honest-model case is covered — but the **server-side** history-rewrite surface on
+> `main` remains open. Re-check before relying on it.
 
 ## Permission-Denial Guidance (When Auto-Mode Blocks an Action)
 
@@ -481,6 +507,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "keep watching X", "poll this", "check every N minutes", recurring WATCH item | built-in `/loop` (interval runner) — pair with the WATCH list, don't hand-poll |
 | "research this deeply", "survey the literature", "comprehensive analysis", "deep research", "look this up thoroughly", "조사해줘", "리서치" (general topic research, not trend-scan) | **Deep-Research Capability Ladder** (`knowledge/shared/harness-core/deep_research_capability_ladder.md`) — route to the highest available rung: built-in `/deep-research` if present → else Claude `WebSearch`+`WebFetch` synthesis (tier-sensitive) → `/frontier-digest` only if it's AI/harness trend-scan. No-reinvention: FH routes, does not build a research engine. |
 | "orchestrate agents", "parallel dispatch", "combine skills", "multiple agents" | `/agent-composer` |
+| **a material work product is about to be called done / merged / published** — public or irreversible surface · affects others · carries external claims or numbers · new behavior · security/data/permissions (proactive; the everyday "커밋하고 머지하자" utterance does **not** name an agent, so agent-composer never self-fires here — that is why this row exists) | `agent-composer` **§Author-Exposure Table** — name the exposure row, dispatch that review pass, then decide. Materiality gate + `Exposure-unclear → challenger` default live there; the lens returns evidence, never the verdict |
 | "broaden the grounded corpus", "add another version of the corpus", "ingest the full source as the grounding axiom", "여러 버전으로 통째로 가져와" (verbatim-relay corpus expansion — fail-closed grounding, no generator) | `/corpus-grounding-expander` |
 | "broaden these personas", "what other voices fit this cast", "map these roles to a decision lens", "페르소나 후보군 더 넓혀" (persona seed → tiered judgment-mapped cast; pairs with `persona-innovator` for naming) | `/persona-roster-expander` |
 | "connect a project", "map this project", "link to hub" | `auto_project_mapping.md` (mapping) |
@@ -497,6 +524,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "help me write a prompt", "build a prompt", "improve this prompt", "prompt template" | `/meta-prompt-builder` |
 | "/goal", "run this autonomously", "big multi-step task", "orchestrate this goal", or **any heavy autonomous/multi-agent run** (proactive — propose *before* running; it is expensive, so the proposal is mandatory, not the auto-run) | `/goal-quench` (budget gate + quality gate) |
 | "I don't know what to build", "how should I approach this", "organize this for me", "clarify this", "정리해줘" (ambiguous request before dispatch) | `/deep-clarify` |
+| **work-shaped request outside the harness domain** — "이 문서 만들어줘", "위키 페이지 써줘", "이 자료 표로 만들어줘", any general work ask no other row or skill catches (**fallback default** — a more specific row above/below always wins: 리서치→deep-research · ambiguous "정리해줘"→deep-clarify · heavy fleet→goal-quench) | **Intent-Marshaling loop** (§Intent Marshaling — mechanical capability scan → one-line compose proposal → run; gap → capability ladder) |
 | "memory feels bloated", "clean up memory", "memory too large", "memory hygiene" | `/memory-hygiene` |
 | "ready to PR", "about to push", "merge this", "PR 올려줘", FH asset changed in session | 4-axis auto-gate (see above — runs automatically, no proposal needed) |
 | **field verdict/gate/safety/irreversible code changed** in a mapped project (function returning a verdict enum / gate exit code / safety-invariant · publish/delete/history path) — **proactive, before merge** | **Field-Harness Load-Bearing Change Gate** (see above → degrade-lint → cross-family review → converge; same rigor as FH assets, applied to field code) |
@@ -573,6 +601,29 @@ Simple file-lookup agents may omit. Agent dispatch works from any mapped project
 
 ---
 
+## Intent Marshaling — General-Work Serving (runtime default)
+
+FH/PMH is a **purpose organization**, not only a meta-harness: when the leader states a work intent in
+plain language — wiki/document production, research-and-write, organizing, **any work-shaped ask, not
+just harness building** — the session **marshals installed capability** (skills · agents · mapped
+harnesses · memory) into a one-line composition proposal and runs it. "This is a harness hub, not for
+that" is a forbidden deflection — serving general work is identity (the registry + mapped harnesses +
+memory exist only here; a plain chatbot cannot marshal them). Marshal-by-feel is the defect this
+replaces (same shape as pre-#158 lens selection): the capability scan is **mechanical** (skill list ·
+`LOCAL_SKILL_REGISTRY` · mapped assets), never recall — and it **carries trust tiers**: run-first
+autonomy covers **FH-native capability with per-action-reversible steps only**; a non-FH sibling hit
+stays at its registry `ask-tier` (propose-only) and an outward-mutating action (send · post · deploy ·
+delete) keeps its own gate — marshaling never upgrades either. Capability gap (declared only by citing
+the scan result, never a bare "nothing fits") → the goal-quench Step C ladder semantics at request
+scale (internal scan → external search → in-session synthesis; **persist** routes to the New-Skill
+gate, **install** to plugin-recommender's HITL — no new gates).
+
+> **Detail (read before applying the ladder or when a gap appears)**:
+> `knowledge/shared/harness-core/intent_marshaling_general_work.md` — the 5-step loop, gate-routing
+> table, Sonnet-floor boundaries, and the origin defect.
+
+---
+
 ## Cross-Project Skill Bus (Active Throughout Session)
 
 Based on LOCAL_SKILL_REGISTRY (Step 1-c), **propose and connect skills from other projects directly**. Proposal: *"{Project} has `{skill-name}`. Want me to dispatch it via Agent?"*

package/knowledge/shared/harness-core/intent_marshaling_general_work.md

@@ -0,0 +1,75 @@
+# Intent Marshaling — General-Work Serving (runtime twin of intent machinization)
+
+> **Status**: doctrine (judgment-shaped, operator-forged 2026-07-22). Companion:
+> `harness_incubator_doctrine.md` covers **forge time** (`intent → forge → agreement → machinery`);
+> this file covers **run time** — what a mapped, skill-equipped environment does with a plain work
+> request. Floor companion: `sonnet_floor_doctrine.md`.
+
+## 1. Doctrine statement
+
+At forge time a harness machinizes intent into new machinery. At **run time**, an environment with
+installed skills, agents, mapped harnesses, and persistent memory is a **purpose organization**: the
+leader states a work intent in plain language, and the session **marshals installed capability into a
+composition and executes** — without the leader naming skills, agents, or files.
+
+**Scope is general work, not only harness work.** Wiki/document production, research-and-write,
+review, organizing, data shaping — any work-shaped request is in-scope. The environment moat is the
+point: a capability registry + mapped harnesses + memory exist *here*, so a plain chatbot session
+cannot marshal what it does not have. Serving general work is therefore **identity, not a favor** —
+"this is a harness hub, not for wiki work" is a forbidden deflection.
+
+## 2. Why doctrine, not mood (origin defect)
+
+2026-07-21: a session marshaled sim/persona skills onto wiki-polishing work "by feel" and the effect
+was large. That was orchestrator taste — the same failure shape lens selection had before the
+Author-Exposure Table (PR #158: picked right 4/4, but by judgment-luck, not machine). Taste survives
+only on strong tiers and good days; a Sonnet-tier session with the same assets would serve the same
+request thinly and call it done. This doctrine converts the marshal decision from taste into a
+mechanical default that survives at the Sonnet floor.
+
+## 3. The marshaling loop (every step Sonnet-runnable)
+
+| Step | Action | Mechanical form |
+|---|---|---|
+| **1 Intent read** | Restate the request as *deliverable + doneness* in one line. Genuinely ambiguous → the existing `/deep-clarify` route, not guessing. | one sentence, embedded in the compose proposal |
+| **2 Capability scan** | Scan what is actually installed/mapped — never recall from memory: ① in-session skill list (description match) ② `LOCAL_SKILL_REGISTRY` / Cross-Project Skill Bus ③ the target project's mapped harness assets. **The scan carries each hit's trust tier with it** (FH-native · non-FH sibling `ask-tier` · external) — trust is scan output, not a later afterthought. | list/grep, not vibes |
+| **3 Compose & run** | One-line composition proposal ("draft via X, then Y as the quality gate"), then **run-first, ask-last** — for **FH-native / session-installed capability whose actions are reversible**. A **non-FH sibling registry hit keeps its registry trust tier**: `ask-tier` = propose-only, never auto-run (`fh_detail_protocols.md` 1-c — sibling code is an injection surface). **Reversibility is judged per action, not per skill**: an installed skill whose step sends/posts/deploys/deletes outward hits that action's own gate (`mcp_tool_gating.md` ask-tier · the irreversibility gates) — marshaling never upgrades an ask-tier action to autonomous. | the one-liner IS the HITL surface for reversible work |
+| **4 Gap → ladder** | Gap may be declared **only by citing the Step-2 scan result** ("scanned ①②③, nothing covers X") — never a bare "nothing fits"; a gap claim without a named scan is the under-serve degrade direction this doctrine exists to close. Then reuse the goal-quench Phase 1.5 Step C **ladder semantics** (order + trust-gating + degrade direction — NOT its max-mode `fit_score` trigger, which stays goal-quench-local): internal registry scan → external search (`plugin-recommender`) → **in-session synthesis** from existing meta-skills (composition, not persisted) → net-new skill only as last resort. | same ladder order, no new machinery |
+| **5 Exposure check** | Deliverable is material (published · carries external claims · others rely on it) → the Author-Exposure Table (`agent-composer` §Author-Exposure) names the review pass before "done". | existing gate, unchanged |
+
+## 4. Gates — reused, none new
+
+| Surface | Gate |
+|---|---|
+| Scan · compose · run **FH-native** installed capability, **per-action reversible** | **none** — autonomous, one-line notice |
+| Dispatching a **non-FH sibling/registry skill** | its **registry trust tier** — `ask-tier` = propose-only, never auto-run (injection surface) |
+| An action that mutates **outward** (send · post · deploy · delete · payment — even via an installed skill) | that action's own gate (`mcp_tool_gating.md` ask-tier · irreversibility gates) — never converted to autonomous by marshaling |
+| External plugin/skill **install** | `plugin-recommender`'s own install-HITL (environment mutation) |
+| **Persisting** a synthesized skill | New-Skill Pre-Commit Gate + `asset-placement-gate` (ephemeral in-session composition needs neither) |
+| Irreversible surfaces (publish · delete · heavy autonomous fleet) | existing gates unchanged (Pre-Publish · Destructive-Op · the goal-quench proposal row) |
+
+## 5. Boundaries
+
+- **Not a heavy-orchestration auto-runner**: a run that would spawn a large multi-agent fleet still
+  proposes `/goal-quench` first (existing row). Marshaling defaults to the **cheapest composition
+  that serves the intent** — one skill beats three when one suffices.
+- **Sonnet floor**: every loop step is list/grep/one-liner/run — no depth-gated judgment on the
+  critical path. Depth escalation is dispatch (consent-gated), never substrate.
+- **Company residency unchanged** — marshaling never widens what may leave the machine.
+- **Operator-taste default**: tuning targets the operator's convenience (operator, 2026-07-22: "if
+  it's convenient for me, that's sufficient" — FH/PMH distributes *how the operator works well*).
+  Per-user adaptation is the UAP's layer, not this file's.
+- **Honesty**: marshaling quality is bounded by what is actually installed — a thin environment
+  marshals thin. The scan reports what it found; it never inflates the roster.
+
+## Done When (adoption, measured)
+
+- A general work request in a mapped environment produces a one-line composition proposal grounded in
+  an actual capability scan (check class: **measured** — target-tier sim at Sonnet, known-pair: one
+  work-shaped positive must marshal, one trivial/out-of-scope negative must NOT add ceremony).
+- No new gate machinery introduced; the mutation points (install · persist · non-FH dispatch ·
+  outward actions) route to existing gates (check class: **mandatory-pass** — grep this file for gate
+  names, confirm all resolve to pre-existing assets).
+- Trust tiers survive marshaling: no path in this file lets a non-FH `ask-tier` hit or an outward
+  action run without its own gate (check class: **mandatory-pass** — cross-family verified 2026-07-22,
+  codex F1/F2 closed).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.64",
+  "version": "1.4.66",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.64",
+  "version": "1.4.66",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.64",
+  "version": "1.4.66",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/agent-composer/SKILL.md

@@ -63,6 +63,50 @@ For each subtask in the composition plan:
 | Code generation | `writes: true` + code tools | `writes: false` or no code tools |
 | Audit-only | `writes: false` (safe) | `writes: true` (risky for audit) |
 
+### Author-Exposure Table — a review pass, not a second executor
+
+The table above picks **who does the subtask**. This one adds a different question at a different
+stage: **what failure is the author structurally exposed to, now that the work is claimed done?**
+It never replaces capability fit and never selects the agent that performs the work — it adds a
+**review pass** before the work is released. A doc-writing subtask scores no "adversarial review"
+fit, yet its author is blind to cold-entry failure, and capability fit never surfaces that.
+
+**Materiality gate — run this pass only when the work product is material.** At least one of:
+public or otherwise irreversible surface · affects users other than the author · carries external
+claims, numbers, or citations · introduces new behavior · touches security, data, deletion, or
+permissions. Internal notes, wording fixes, and one-line edits do **not** trigger it — an
+unbounded trigger just trains the pass into being skipped.
+
+| Failure the author cannot self-detect | Review mechanism | Type |
+|---|---|---|
+| Cold entry — first contact breaks (missing install step, undefined term, no success signal) | `beginner` | agent |
+| Everyday-use friction invisible to the designer | `main-player` | agent |
+| Currency vs the outside field (needs external citation, not assertion) | `expert` | agent |
+| Self-verification only fails in the optimistic direction | `challenger` + `auto-decorrelation` | agent + pipeline |
+| Rebuilding something that already exists | `fact-checker` · `asset-placement-gate` | agent · skill |
+| Numbers/citations living in the artifact without grounding | `phantom-quench` | skill |
+| **Exposure unclear** (material, but no row above fits) | `challenger` | agent — default, not a skip |
+
+The `Type` column matters for the capability-fit checks above: `writes`/tooling scoring applies to
+**agent** rows only; skill and pipeline rows are invoked, not scored.
+
+**Behavioral rule — no silent skip, and "no row applies" is not an exit.** Name the row before the
+agent. If you believe none applies, you must (a) state which rows you considered, (b) give a
+one-line reason each is excluded, and (c) fall through to the **Exposure-unclear** row — the
+default is `challenger`, never nothing. (Origin: 2026-07-21 — four dispatches in one session were
+chosen by orchestrator judgment alone. They were right; that is luck, not a mechanism. In the same
+session one `beginner` dispatch blocked a public-repo merge on 4 findings the author had not seen.)
+
+**Behavioral rule — the lens does not hold the verdict.** A review pass returns `evidence`,
+`risk`, and a `recommended decision` only. It may **not** emit a terminal `block`/`approve`; the
+orchestrator declares the outcome, on its own stated grounds, and approval on an irreversible
+surface stays with the human regardless of what the lens returned.
+
+**Row-growth criterion (anti-case-crafting).** A new row is admissible only if the failure type has
+been **observed more than once**, is **not coverable by an existing row**, and names a *verifiable
+exposure axis* rather than a job title or a favorite tool. If rows keep accreting, that is the
+signal to fold the table into a smaller set of principled axes — not to keep appending.
+
 **Behavioral rule**: A `writes: false` agent (e.g. fact-checker, hub-persona-auditor) must NOT be assigned a task requiring edits. Capability fit scoring catches this statically before dispatch.
 
 **Behavioral rule**: Degraded composition — when any required-weight role is filled with general-purpose fallback, output `⚠️ degraded: [role]` in the composition plan. Do not silently use general-purpose for a specialized role.

package/plugins/fh-meta/skills/harness-doctor/SKILL.md

@@ -115,6 +115,7 @@ size instrument* is read. The footprint rows below apply to **both** scopes and
 | **Pointer-illusion**: a CLAUDE.md "detail/detailed procedure" pointer whose target is itself an always-loaded `.claude/rules/*.md` | S-tier — the split saves zero context (rules/ auto-loads regardless); move the target out of auto-load, keep the pointer |
 | weekly_audit 14~30 days elapsed | S-tier |
 | weekly_audit 30+ days elapsed | M-tier |
+| `tracks/_meta/*.md` **reference assets** (excluding dated chronological records — `fh_completed_*` · `fh_signal_*` · `frontier_digest_*` · `session_*` · `weekly_audit_*` · `*_log_*`, whose date lives in the filename by design) missing **both** a role/type tag and a version/date stamp | R-tier — taxonomy gap, not urgent. ⚠️ **Measured FP rate before you act on this**: run against FH itself 2026-07-21 it flagged **99/161 (61%)** un-narrowed and **19/26 (73%)** after narrowing — a row that flags most of a directory is noise, not signal. ⚠️ **No consumer**: grep found **no skill that reads `role`/`type` from these files**. Until one exists this is taxonomy for taxonomy's sake — treat as an inventory observation, never escalate |
 
 **Per-unit ≠ aggregate — do not slide between them.** "Every section earns its scope" (the per-unit
 doctrine test) and "the always-loaded total is affordable" (the budget test) are **different questions, and
@@ -229,6 +230,52 @@ FAIL, the safe direction); and the scope test reads directory *existence*, so th
 field→meta (acceptable: the operator names the target, and the footprint rows apply to **both** scopes
 regardless — but it does skip the field-only line rows).
 
+**Context-File Taxonomy check** (mechanical grep, R-tier only — a coverage lens, not a mandate): L1 (Step 2)
+checks `CLAUDE.md` / `.claudeignore` / `.claude/` existence, but nothing checks `tracks/_meta/*.md` context-file
+existence or taxonomy — this adds both. Note: `tpa_schema.md` classifies this file class (`session_card`) as
+**low** risk / "ephemeral state, low blast radius" — most `tracks/_meta/*.md` files are untagged by design, and
+that is expected, not a defect. This check surfaces untagged files for optional triage on the subset that
+function as durable references (e.g. `reference_next_session_starter.md`); it is not a mandate that every file
+in the directory carry a tag.
+
+Scan for two markers per file — a role/type tag (`role:` or `type:` in frontmatter, or a leading `# Role:`
+line) and a version/date stamp (a `YYYY-MM-DD` date or a `version:` frontmatter key, either in the first 10
+lines). A file missing either marker is untagged — report the file list and count; do not escalate past R
+without a human judging whether the specific file's staleness is actually a problem.
+
+```bash
+# find | while, not a glob — same reason as the always-loaded footprint scan above: an unmatched
+# glob aborts under zsh, and a silent zero-match run must still report, not disappear.
+TARGET="${1:?pass the target root explicitly — cwd is not the target}"
+total=0; untagged=0
+while IFS= read -r f; do
+  [ -n "$f" ] || continue
+  total=$((total + 1))
+  # 연대기 기록물은 파일명에 날짜가 있는 것이 설계다 — taxonomy 대상이 아니다(FP 원인의 78/99)
+  case "$(basename "$f")" in fh_completed_*|fh_signal_*|frontier_digest_*|session_*|weekly_audit_*|*_log_*) continue ;; esac
+  grep -qE '^(role|type):|^# ?Role:' "$f" && tag=yes || tag=no
+  head -10 "$f" | grep -qE '[0-9]{4}-[0-9]{2}-[0-9]{2}|^version:' && stamp=yes || stamp=no
+  if [ "$tag" = no ] || [ "$stamp" = no ]; then
+    untagged=$((untagged + 1))
+    echo "UNTAGGED: $f (role-tag=$tag version-stamp=$stamp)"
+  fi
+done < <(find "$TARGET/tracks/_meta" -maxdepth 1 -name '*.md' 2>/dev/null)
+echo "context-file-taxonomy: $untagged untagged of $total files"
+```
+
+**Named residuals of this scan**: `head -10` can miss a stamp in unusually long frontmatter; `^type:` is not
+fence-scoped, so a stray body line starting `type:` outside frontmatter false-positives `tag=yes` — both push
+toward under-reporting, not over-reporting.
+
+Origin (2026-07-20, frontier-auto): surfaced via [Frontier Digest 2026-07-14](https://github.com/chrono-meta/forge-harness/issues/102#issuecomment-4964058520),
+which described a durable-context-file pattern (role-tagged, versioned files shared across 50+ specialized
+agents) citing `aimultiple.com/llm-orchestration` as its source. A `/phantom-quench` pass on 2026-07-20 found
+that page's retrievable content does not actually discuss this pattern — the digest's citation is mis-attributed
+and no verified primary source has been located. The qualitative taxonomy idea (role/version tagging on context
+files) is adopted here on the digest's description alone and is `SPECULATIVE` per H1/H1-b until a verified
+primary source is found; the "40% fewer tool calls" figure the digest also reported is not cited anywhere in
+this check for the same reason.
+
 ### Step 3-L. Language Lint (`--lint` mode only)
 
 > Activate with `/harness-doctor --lint` or when harvest-loop surfaces a P10-series signal. Skipped in standard runs.