@chrono-meta/fh-gate 1.4.71 → 1.4.73

package/templates/PRE-PUBLISH-CHECKLIST.md

@@ -0,0 +1,85 @@
+# Pre-Publish Surface Gate — Portable Checklist
+
+> **Run this before making ANY repo or package publicly visible for the first time** — on any machine,
+> in any repo (not only forge-harness). Public exposure is irreversible: a repo is live the instant it
+> flips public and may be cached or forked before you scrub.
+>
+> **Order invariant: scrub before publish, never publish-then-scrub.**
+>
+> Highest risk: a repo **derived from internal/company assets** (operator-IP that originated in a private
+> harness). Origin of this checklist: `phantom-gate` shipped public, then needed a private →
+> de-company-scrub → re-public round-trip. The scrub happened *post*-publish. This checklist inverts that.
+
+> **Companion check — structure, not leak (값 스크럽 ≠ 구조 동일):** the inverse risk to the above — when
+> the artifact was *built against a de-id / MOCK proxy* and you now drop it into the **real target**, verify
+> its structural assumptions (column taxonomy, join / exclude rules, schema shape) against **one real-target
+> sample** *before* drop-in. A scrubbed proxy can match on values yet diverge in shape, silently producing
+> wrong output. `found→extend` (read the real target, don't overwrite blind) is the mechanism. This guards
+> *malfunction*, not disclosure — orthogonal to the leak scan below, run both.
+
+## When it applies
+
+Any first-time public action:
+- `gh repo create --public` / `gh repo create ... --public`
+- `gh repo edit --visibility public` (private → public flip)
+- first `git push` to a **new public remote**
+- `npm publish` · `python -m build && twine upload dist/*` · any registry publish
+
+## Step 0 — Cheap mechanical pre-flags (10 seconds)
+
+Any single hit → **stop, do the full scan below.** These catch the common internal-asset leak class.
+
+> ⚠️ **Step 0 is a *pre-filter*, never a clean bill of health.** The `<…>` below are placeholders. If you
+> have **not** filled them from your gitignored source (`.claude/rules/.public-surface-patterns` or
+> `CLAUDE.local.md`), the email line still works but the grep lines match *nothing* and a "no hits"
+> result here means **nothing was scanned**, not "clean". Authority for the verdict is **Step 1 PSA**,
+> which reports `NOT CONFIGURED` (≠ CLEAN) when its pattern source is absent. Never publish on Step 0 alone.
+
+```bash
+# author/commit email = corp domain?  (works without config — neutral = personal/noreply)
+git log --format='%ae' | sort -u
+
+# LICENSE / README carry a private harness name or internal codename?
+# (substitute your real private values from the gitignored source — literal <…> matches nothing)
+grep -rIE '<private-harness-name>|<internal-codename>|<corp-domain>' LICENSE README* 2>/dev/null
+
+# module paths encode internal acronyms?  (e.g. detectors/<internal-acronym>/)
+git ls-files | grep -iE '<internal-acronym>'
+```
+
+## Step 1 — Run both gates (must both be non-LEAK)
+
+| Gate | Catches | Pass condition |
+|---|---|---|
+| `/public-surface-audit --target .` | operator-private tokens: real username, corp asset names, absolute home paths, companion-store name | verdict **CLEAN** (or REVIEW with LOW-only, your call) — **not** LEAK, **not** NOT CONFIGURED |
+| `/marketplace-gate` Check 5 | broad public safety: API keys, internal domains, license correctness | Public Safety check passes |
+
+- **NOT CONFIGURED ≠ CLEAN.** If PSA reports NOT CONFIGURED, the pattern source is missing — set it up
+  (empty file = explicit "nothing to protect"). A missing scan is not a clean bill of health.
+- **Tooling-down = fail-CLOSED, not a free skip.** Publish is an irreversible surface, so if a gate's
+  tool is **applicable but unavailable** (skill uninstalled, command errors, backend unreachable), that
+  is **not** a pass — do a **manual-equivalent pass** or take an **explicit operator override**, never
+  silent-proceed. (A gate is only legitimately skipped when *genuinely not-applicable* — e.g. a
+  code-security pass on a repo that ships no code; grep the file list, don't assert "docs-only".)
+- **Generated artifacts count.** An exported HTML/PDF carrying a username is a real public-surface leak —
+  fix = regenerate from a sanitized source, not hand-edit.
+
+## Step 2 — If LEAK: scrub on a PRIVATE copy, then publish
+
+Do **not** "publish then fix". If the repo is already created, keep it **private** until clean.
+
+1. Keep/flip the repo **private** (`gh repo edit --visibility private` if already created).
+2. Full de-identify: corp email → neutral, private names/codenames → neutral handle, internal module
+   paths → generic, strip internal docs/logs. Re-run Step 1 until **non-LEAK**.
+3. Only then flip public / push / `twine upload`.
+
+## Step 3 — Record (if this was a near-miss or a real catch)
+
+A pre-publish catch is a process win worth logging:
+- forge-harness operator → `tracks/_meta/fh_signal_{date}_{source}.md` (or `field-harvest`).
+- A recurring leak class → candidate `#rule-candidate` (tighten the mechanical pre-flags in Step 0).
+
+---
+
+**Done when**: Step 0 pre-flags clean (or escalated to full scan) · Step 1 both gates non-LEAK ·
+publish executed *after* the gates passed, never before.

package/templates/degrade_direction_scan.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# degrade_direction_scan.sh — mechanical pre-screen for the "default-toward-PASS" smell
+#
+# The correlated blind spot measured 2026-07-03 across 3 harnesses (qasp/the-bible/pmh):
+#   "When a verdict surface cannot mechanically ground its judgment, it defaults toward
+#    PASS instead of safe-fail." Same-family review (even frontier + target-tier sim)
+#   shares the author's optimistic reading of that discretion and misses it; a
+#   different-family auditor catches it. This script is the cheap MECHANICAL pre-screen
+#   that runs BEFORE the cross-family pass — it flags the code shapes where a permissive
+#   value lands on an unconstrained branch, so the reviewer's attention goes there first.
+#
+# IT IS A REVIEW SURFACE, NOT A HARD GATE. Grep-heuristic → false positives are expected.
+# A hit means "prove this is not default-toward-PASS", not "this is a bug". It never
+# blocks a commit on its own (advisory exit code). The terminal verdict is the
+# cross-family adversarial review + governor source-grounding, never this scan alone.
+# (Irreversibility-gate note: because it is advisory, a degraded/empty run is a no-op,
+#  not a free pass — the cross-family review is the load-bearing check it feeds.)
+#
+# NAMED RECALL RESIDUALS (cross-family audit, gpt-5.5, 2026-07-28 — accepted, not closed):
+#   * Indirection defeats every probe. `allow() { exit 0; }` … `check || allow` is the same
+#     fail-open shape one function call away, and a line-oriented grep cannot follow it. This is
+#     inherent to the heuristic, not a bug to patch — it is why the terminal verdict is the
+#     cross-family review, and why a clean run is never evidence of safety.
+#   * The regression anchor proves the probes on the fixture GRAMMAR it ships, not on every
+#     spelling of each class (e.g. `if ! cmd; then :; fi`, arithmetic-context defaults).
+#
+# Usage:
+#   bash scripts/degrade_direction_scan.sh [path ...]        # scan dirs/files (default: .)
+#   git diff --name-only main..HEAD -- '*.py' | xargs bash scripts/degrade_direction_scan.sh
+# Exit:  0 = no smells found; 2 = smells found (ADVISORY signal — do not hard-block on it)
+set -uo pipefail
+
+TARGETS=("$@")
+[ ${#TARGETS[@]} -eq 0 ] && TARGETS=(".")
+
+# Permissive values a verdict/gate surface must never land on by *default* / fall-through.
+PASS='(True|"PASS"|'"'"'PASS'"'"'|"ALLOW"|'"'"'ALLOW'"'"'|"OK"|'"'"'OK'"'"'|"VALID"|'"'"'VALID'"'"'|"GRANTED"|'"'"'GRANTED'"'"'|"PASSED"|'"'"'PASSED'"'"'|allow|ALLOW)'
+
+# Collect target files. Scannable = py + sh (the smell probes are Python-shaped but bash surfaces —
+# incl. this gate's own pre-push/pre-commit-hook trigger category — must not be invisibly dropped).
+# Anything else is tracked as UNSCANNABLE so a load-bearing surface in another language is reported
+# as "not covered", never silently folded into an "advisory clean" (M#2, steel-quench 2026-07-03).
+FILES=(); UNSCANNABLE=()
+for t in "${TARGETS[@]}"; do
+  if [ -d "$t" ]; then
+    while IFS= read -r f; do FILES+=("$f"); done < <(find "$t" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null)
+    # Shebang pass — this is what makes git hooks visible at all. Measured 2026-07-28:
+    # `templates/.git-hooks` (files named `pre-push`, no extension, under a dotted directory) —
+    # FH's own mechanical floor — reported "no scannable (py/sh) target files", exit 0.
+    # Shebang pass. Deliberately NOT restricted to extensionless names: a cross-family audit
+    # (2026-07-28, gpt-5.5) found that an earlier draft skipped any dotted basename, so a shell
+    # file named `helper.bash` carrying an identical known-positive was dropped from a DIRECTORY
+    # target in silence — while the explicit-file branch reported the same file as UNSCANNABLE.
+    # Silent-drop on one path and honest-report on the other is the fail-open half. Confirmed by
+    # running both paths on the same fixture before accepting the finding.
+    while IFS= read -r f; do
+      b="${f##*/}"                      # basename — a dotted DIRECTORY (.git-hooks) is not an extension
+      case "$b" in
+        *.py|*.sh) continue ;;          # already collected above
+        *.md|*.json|*.yaml|*.yml|*.txt|*.lock|*.png|*.jpg|*.svg|*.pdf|*.zip) continue ;;
+      esac
+      head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && FILES+=("$f")
+    done < <(find "$t" -type f 2>/dev/null)
+  elif [ -f "$t" ]; then
+    tb="${t##*/}"
+    case "$tb" in
+      *.py|*.sh) FILES+=("$t") ;;
+      *.*) UNSCANNABLE+=("$t") ;;
+      *) if head -n1 "$t" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b'; then FILES+=("$t"); else UNSCANNABLE+=("$t"); fi ;;
+    esac
+  fi
+done
+if [ ${#FILES[@]} -eq 0 ]; then
+  if [ ${#UNSCANNABLE[@]} -gt 0 ]; then
+    echo "degrade-scan: ${#UNSCANNABLE[@]} changed file(s) are OUTSIDE the scannable set (py/sh) — NOT scanned, NOT 'clean':"
+    printf '  (unscannable) %s\n' "${UNSCANNABLE[@]}"
+    echo "A load-bearing surface in another language must go straight to cross-family review."
+    exit 2   # advisory non-clean — an orchestrator keying on exit code must not read this as clean
+  fi
+  echo "degrade-scan: no scannable (py/sh) target files"; exit 0
+fi
+
+hits=0
+emit() { printf '  %s:%s\n    [%s] %s\n' "$1" "$2" "$3" "$4"; hits=$((hits+1)); }
+
+for f in "${FILES[@]}"; do
+  # ---- Shell-shaped probes (S*) -------------------------------------------------------------
+  # Calibration finding (2026-07-28, known-pair): every probe below the S-block is PYTHON-shaped
+  # (`except:` / `.get(k, True)` / `if not x:` / `.split()`), none of which exist in bash. A .sh file
+  # was still COLLECTED and counted, so a fail-open shell gate printed "no smells in 1 scanned py/sh
+  # file" — a FALSE CLEAN, which is worse than honest non-coverage. A known-positive .sh carrying four
+  # distinct default-toward-PASS shapes scored 0/4. These probes close that; they run on any file
+  # whose basename ends in .sh OR that carries a shell shebang (see the is_sh test below).
+  is_sh=""; fb="${f##*/}"
+  case "$fb" in
+    *.sh) is_sh=1 ;;
+    *.py) ;;
+    # Any other collected file reached FILES only via the shebang pass, or is a dotted shell name
+    # like `helper.bash`. Re-check the shebang rather than keying on the extension — keying on the
+    # extension is what produced the collect-but-never-probe false clean this whole block exists to
+    # close (n+10). Collected-but-unprobed must not be reachable again.
+    *) head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && is_sh=1 ;;
+  esac
+  if [ -n "$is_sh" ]; then
+    # S1 — permissive short-circuit on a FAILING CHECK: `scan=$(...) || return 0`, `verify … || exit 0`.
+    #   The check errored and the surface reports success. Safe-fail is `|| return 1` / `|| exit 1`.
+    #   SCOPED to check-shaped left-hand sides (command substitution, or a verb like
+    #   scan/check/verify/grep/audit/validate/gate). A PRECONDITION guard — `[ -d x ] || exit 0`,
+    #   `[[ $d =~ … ]] || return 0` — is deliberately excluded: "this run does not apply here" is not
+    #   the same claim as "this check passed". Hand-measured 2026-07-28: unscoped, 6/6 sampled hits
+    #   were false positives, 4 of them precondition guards.
+    #   EXCEPTION, re-added after an adversarial pass on this very scoping: a `-f`/`-x` test is a
+    #   DEPENDENCY check, not a scope check. `[ -f "$GUARD_LIB" ] || exit 0` means "my guard library
+    #   is missing, therefore allow" — the fail-open shape that bit qasp on 2026-07-28. Excluding it
+    #   with the scope guards would have hidden exactly the class this scan exists to find.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S1:||→PASS(sh)" "failing check short-circuits to a permissive result (\`|| return 0\` / \`|| exit 0\` / \`|| true\`) — an errored check must fail closed, not report success"
+    done < <(grep -nE '\|\|[[:space:]]*(return[[:space:]]+0|exit[[:space:]]+0|true)([[:space:]]*(#|;|$))' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+             | grep -vE '^[0-9]+:[[:space:]]*(if[[:space:]]+)?\[\[?[[:space:]]*(-[dznN][[:space:]]|[^]]*=~)' \
+             | grep -E '(\$\(|`|\[[[:space:]]*-[fx][[:space:]]|\b(scan|check|verify|validate|audit|grep|gate|assert|lint|test_)[A-Za-z_]*[[:space:](])')
+
+    # S2 — `else` fall-through to a permissive exit/return within 2 lines (unenumerated case → allow).
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S2:else→PASS(sh)" "else/fall-through branch exits permissively — the unenumerated case should fail closed"
+    done < <(grep -nE -A2 '^[[:space:]]*else[[:space:]]*$' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S3 — empty/unset defaulted to a permissive VERDICT: `${V:-PASS}` / `V="PASS"` after a failed read.
+    #   "the value never arrived" must not be spelled the same way as "the value said PASS".
+    #   `${V:-0}` and `${V:-true}` are NOT flagged: numeric defaulting is the prescribed integer
+    #   sanitization against the pipefail-fallback class (see S5), and flagging it would push an
+    #   author to delete the remedy. Measured 2026-07-28 — `${PRS:-0}` in session_close_check.sh is
+    #   the fix, not the defect. Only explicit verdict words count.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S3:default→PASS(sh)" "unset/empty defaults to a permissive verdict — absent is not clean (\`not found\` ≠ \`0\`); default to the blocking value"
+    done < <(grep -nE "(\\$\{[A-Za-z_][A-Za-z0-9_]*:?-[[:space:]]*(PASS|OK|ALLOW|GRANTED|VALID|PASSED)\}|\|\|[[:space:]]*[A-Za-z_][A-Za-z0-9_]*=[\"']?(PASS|OK|ALLOW|GRANTED|VALID))" "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+
+    # S4 — empty-output guard treated as clean: `if [ -z "$out" ]; then return 0/exit 0`.
+    #   Identical to Probe E's falsy-sentinel class, in shell spelling: an errored scan produces empty
+    #   output, so "found nothing" and "never ran" become indistinguishable.
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S4:empty→PASS(sh)" "empty output treated as clean — a scan that errored also produces empty output; distinguish 'errored/absent' from 'verified clean'"
+    done < <(grep -nE -A2 '^[[:space:]]*(if|elif)[[:space:]]+\[+[[:space:]]*-z[[:space:]]' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
+    #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
+    #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+  fi
+
+  # Probe A — except/else/finally block returning a permissive value within 2 lines.
+  #   The classic "swallow the error → report success". A safe-fail returns BLOCK/None/raise.
+  while IFS= read -r line; do
+    ln="${line%%:*}"
+    emit "$f" "$ln" "A:except/else→PASS" "permissive return on an error/fall-through branch — safe-fail must return BLOCK/None or re-raise"
+  done < <(grep -nE -A2 '^[[:space:]]*(except([[:space:]][^:]*)?|else|finally)[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe B — dict default / setdefault to a permissive value (unknown key → PASS).
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "B:default→PASS" "unknown-key default is permissive — unenumerated case should default to safe-fail"
+  done < <(grep -nE "(\.get\([^,]+,[[:space:]]*$PASS[[:space:])]|setdefault\([^,]+,[[:space:]]*$PASS[[:space:])])" "$f" 2>/dev/null)
+
+  # Probe C — substring membership on a grounding/verdict/state line (loose match, not exact).
+  #   `if tok in text` masks paid⊂prepaid / 완료⊂미완료. Exact/word-boundary is the safe form.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C:substring-grounding" "substring 'in' on a verdict/state/present line — use exact or word-boundary match, not containment"
+  done < <(grep -nE '\b(verdict|present|ground|state|match|expected|assert)\w*\b' "$f" 2>/dev/null \
+           | grep -vE ':[[:space:]]*(#|//|from |import )' | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+           | grep -E '[^._a-zA-Z]in[[:space:]]' | grep -vE '\bfor\b|__contains__|not in|in \(|in \[|in \{|in range|in enumerate|in [A-Z_]+\b' \
+           | grep -oE '^[0-9]+' | sed 's/$/:/')
+
+  # Probe C2 — bare `VAR in VAR` in an if/return/assert/while context, WITHOUT a grounding keyword.
+  #   Probe C is keyword-gated (low-noise) and therefore misses the doc's own headline example
+  #   `tok in text` (paid⊂prepaid) when the variables aren't named verdict/state (M#4, steel-quench).
+  #   C2 closes that: simple var-in-var (not a collection literal / range / for) = a likely
+  #   containment check that should be exact/word-boundary if it grounds a verdict. Higher noise; advisory.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C2:substring-boolean" "bare 'X in Y' in if/return/assert — if this grounds a presence/verdict check, use exact/word-boundary match, not containment"
+  done < <(grep -nE '^[[:space:]]*(if|elif|return|assert|while)[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]+in[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*[:)]?[[:space:]]*$' "$f" 2>/dev/null \
+           | grep -vE '\bfor\b|in range|in enumerate|not in' \
+           | grep -vE '\b(verdict|present|ground|state|match|expected)\w*\b')
+
+  # Probe E — negated-falsy guard returning permissive (dominance-benchmark round-2 f2 class): an error
+  # SENTINEL (None / {} / "" / []) is falsy, so `if not X: return <PASS>` treats "the check errored / never
+  # ran" identically to "the check ran and found nothing clean". Distinguish errored from clean before allowing.
+  while IFS= read -r ln; do
+    emit "$f" "$ln" "E:falsy-sentinel→PASS" "negated-falsy guard returns permissive — a falsy error sentinel (None/{}/'') masquerades as 'clean'; a gate must distinguish 'errored/absent' from 'verified clean'"
+  done < <(grep -nE -A2 '^[[:space:]]*if[[:space:]]+not[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe F — positional field-select from a split result feeding a decision (round-2 c3 class): taking the
+  # decision from `parts[-1]`/`parts[0]` of an attacker-influenceable split lets a crafted field (e.g. a
+  # signed DENY whose free-form comment ends "::ALLOW") negate the verdict. Validate structure, don't select by position.
+  if grep -qE '\.r?split\(' "$f" 2>/dev/null; then
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "F:split-positional-verdict" "decision taken by position ([-1]/[0]) from a split result — an attacker-controlled trailing/leading field can negate the verdict; validate structure, don't select by position"
+    done < <(grep -nE '\[[[:space:]]*-?[01][[:space:]]*\]' "$f" 2>/dev/null \
+             | grep -iE 'decision|verdict|allow|deny|approv|grant|status|result|policy')
+  fi
+done
+
+echo "----"
+[ ${#UNSCANNABLE[@]} -gt 0 ] && printf 'note: %s changed file(s) outside py/sh — NOT covered by this scan (send to cross-family directly).\n' "${#UNSCANNABLE[@]}"
+if [ "$hits" -gt 0 ]; then
+  echo "degrade-scan: $hits smell(s) — ADVISORY. Each = 'prove this is not default-toward-PASS'."
+  echo "Terminal verdict = cross-family adversarial review (auto-decorrelation), not this scan."
+  exit 2
+fi
+# Scope-honest clean message (M#2): "clean" means only "no py/sh-pattern smells in the SCANNED set" —
+# it does NOT assert the changed load-bearing surface is safe (other languages, non-code surfaces,
+# and the lint's own recall gaps are out of scope). The load-bearing check is the cross-family review.
+echo "degrade-scan: no default-toward-PASS smells in ${#FILES[@]} scanned py/sh file(s) — does NOT cover other languages / non-code surfaces / the cross-family check (advisory)."
+exit 0

package/templates/predelete_check.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# predelete_check.sh — Destructive-Op Gate step 1: enumerate what branch deletion would lose.
+# Class: measured (mechanical enumeration) — the verdicts feed the gate's judged recovery step.
+# Usage: predelete_check.sh <repo-path> [<base-ref>=origin/main]
+# For every remote branch except the base: commits absent from base + paths absent from base.
+#   SAFE   — fully merged (0 commits off base)
+#   CHECK  — commits off base but 0 unique paths: content may still be NEWER than base on shared
+#            files (e.g. an unmerged session card) — needs a content-direction look before delete
+#   REVIEW — unique paths exist: recover/integrate BEFORE any deletion
+# Exit 1 when any REVIEW exists (blocks a scripted delete chain).
+#
+# DEGRADE DIRECTION — irreversible surface → fail-CLOSED (CLAUDE.md §Irreversibility Surface-Class
+# Degrade Invariant). A FAILED enumeration is NOT an empty (safe) enumeration. Fixed 2026-07-03
+# (cross-family sweep, default-toward-PASS class): the prior version degraded OPEN in three ways —
+#   (a) `git branch -r` failing / the repo not resolving → empty for-loop → exit 0 (green-light);
+#   (b) a branch or base ref that does not resolve → git errors swallowed by 2>/dev/null → n=0,uniq=0
+#       → printed SAFE (an errored ref is not "merged");
+#   (c) substring exclusion `grep -vE "origin/(main|HEAD)"` also skipped `origin/main-backup` etc.
+# Each is now closed: a resolution/enumeration failure exits non-zero (exit 2 = harness error, distinct
+# from exit 1 = REVIEW pending); an unresolvable branch ref is classified REVIEW (fail-closed); base/HEAD
+# exclusion is EXACT. A fetch failure is surfaced (stale enumeration is a real risk on this surface),
+# never silently swallowed.
+set -u
+repo="${1:?repo path}"; base="${2:-origin/main}"
+cd "$repo" || { echo "FAIL: cannot cd to repo '$repo'" >&2; exit 2; }
+git rev-parse --git-dir >/dev/null 2>&1 || { echo "FAIL: '$repo' is not a git repo" >&2; exit 2; }
+
+# Fetch: surface failure (stale enumeration on an irreversible surface is a real risk), do not swallow.
+if ! git fetch origin --quiet 2>/dev/null; then
+  echo "WARN: 'git fetch origin' failed — enumerating against possibly-STALE remote refs" >&2
+fi
+
+# Base must resolve, else every comparison is bogus and the old code would misclassify SAFE → fail-closed.
+git rev-parse --verify --quiet "${base}^{commit}" >/dev/null || {
+  echo "FAIL: base ref '$base' does not resolve — cannot enumerate; refusing to green-light delete" >&2
+  exit 2; }
+
+# Branch list: distinguish "command failed" (fail-closed) from "0 remote branches" (legitimately nothing).
+if ! branches_raw=$(git branch -r 2>/dev/null); then
+  echo "FAIL: 'git branch -r' failed — cannot enumerate remote branches" >&2; exit 2
+fi
+
+fail=0
+while IFS= read -r ref; do
+  ref="${ref#"${ref%%[![:space:]]*}"}"     # left-trim leading whitespace
+  ref="${ref%% *}"                          # drop any '-> origin/main' HEAD annotation
+  [ -z "$ref" ] && continue
+  # EXACT base/HEAD exclusion — a substring test would wrongly skip 'origin/main-backup'.
+  [ "$ref" = "$base" ] && continue
+  [ "$ref" = "origin/main" ] && continue
+  [ "$ref" = "origin/HEAD" ] && continue
+  b="${ref#origin/}"
+  # Ref must resolve, else classify REVIEW (fail-closed) — an errored ref is NOT 'merged/SAFE'.
+  if ! git rev-parse --verify --quiet "${ref}^{commit}" >/dev/null; then
+    echo "REVIEW  $b — ref does not resolve (enumeration error) → do NOT delete blind"
+    fail=1; continue
+  fi
+  n=$(git log --oneline "${base}..${ref}" 2>/dev/null | wc -l | tr -d ' ')
+  uniq=$(comm -23 <(git ls-tree -r --name-only "$ref" 2>/dev/null | sort) \
+                  <(git ls-tree -r --name-only "$base" 2>/dev/null | sort) | wc -l | tr -d ' ')
+  if [ "$uniq" -gt 0 ]; then
+    echo "REVIEW  $b — unique paths: $uniq, commits off base: $n → recover/integrate BEFORE delete"
+    fail=1
+  elif [ "$n" -gt 0 ]; then
+    echo "CHECK   $b — $n commits off base, 0 unique paths → verify content superseded (newer-version-on-shared-file risk; tip: compare tip date vs base coverage)"
+  else
+    echo "SAFE    $b — fully merged"
+  fi
+done <<< "$branches_raw"
+echo "--"
+echo "Gate order: enumerate -> recover -> destroy. REVIEW blocks; CHECK needs a judged look; only then delete."
+exit $fail