@chrono-meta/fh-gate 1.4.71 → 1.4.73

package/scripts/degrade_direction_scan.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# degrade_direction_scan.sh — mechanical pre-screen for the "default-toward-PASS" smell
+#
+# The correlated blind spot measured 2026-07-03 across 3 harnesses (qasp/the-bible/pmh):
+#   "When a verdict surface cannot mechanically ground its judgment, it defaults toward
+#    PASS instead of safe-fail." Same-family review (even frontier + target-tier sim)
+#   shares the author's optimistic reading of that discretion and misses it; a
+#   different-family auditor catches it. This script is the cheap MECHANICAL pre-screen
+#   that runs BEFORE the cross-family pass — it flags the code shapes where a permissive
+#   value lands on an unconstrained branch, so the reviewer's attention goes there first.
+#
+# IT IS A REVIEW SURFACE, NOT A HARD GATE. Grep-heuristic → false positives are expected.
+# A hit means "prove this is not default-toward-PASS", not "this is a bug". It never
+# blocks a commit on its own (advisory exit code). The terminal verdict is the
+# cross-family adversarial review + governor source-grounding, never this scan alone.
+# (Irreversibility-gate note: because it is advisory, a degraded/empty run is a no-op,
+#  not a free pass — the cross-family review is the load-bearing check it feeds.)
+#
+# NAMED RECALL RESIDUALS (cross-family audit, gpt-5.5, 2026-07-28 — accepted, not closed):
+#   * Indirection defeats every probe. `allow() { exit 0; }` … `check || allow` is the same
+#     fail-open shape one function call away, and a line-oriented grep cannot follow it. This is
+#     inherent to the heuristic, not a bug to patch — it is why the terminal verdict is the
+#     cross-family review, and why a clean run is never evidence of safety.
+#   * The regression anchor proves the probes on the fixture GRAMMAR it ships, not on every
+#     spelling of each class (e.g. `if ! cmd; then :; fi`, arithmetic-context defaults).
+#
+# Usage:
+#   bash scripts/degrade_direction_scan.sh [path ...]        # scan dirs/files (default: .)
+#   git diff --name-only main..HEAD -- '*.py' | xargs bash scripts/degrade_direction_scan.sh
+# Exit:  0 = no smells found; 2 = smells found (ADVISORY signal — do not hard-block on it)
+set -uo pipefail
+
+TARGETS=("$@")
+[ ${#TARGETS[@]} -eq 0 ] && TARGETS=(".")
+
+# Permissive values a verdict/gate surface must never land on by *default* / fall-through.
+PASS='(True|"PASS"|'"'"'PASS'"'"'|"ALLOW"|'"'"'ALLOW'"'"'|"OK"|'"'"'OK'"'"'|"VALID"|'"'"'VALID'"'"'|"GRANTED"|'"'"'GRANTED'"'"'|"PASSED"|'"'"'PASSED'"'"'|allow|ALLOW)'
+
+# Collect target files. Scannable = py + sh (the smell probes are Python-shaped but bash surfaces —
+# incl. this gate's own pre-push/pre-commit-hook trigger category — must not be invisibly dropped).
+# Anything else is tracked as UNSCANNABLE so a load-bearing surface in another language is reported
+# as "not covered", never silently folded into an "advisory clean" (M#2, steel-quench 2026-07-03).
+FILES=(); UNSCANNABLE=()
+for t in "${TARGETS[@]}"; do
+  if [ -d "$t" ]; then
+    while IFS= read -r f; do FILES+=("$f"); done < <(find "$t" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null)
+    # Shebang pass — this is what makes git hooks visible at all. Measured 2026-07-28:
+    # `templates/.git-hooks` (files named `pre-push`, no extension, under a dotted directory) —
+    # FH's own mechanical floor — reported "no scannable (py/sh) target files", exit 0.
+    # Shebang pass. Deliberately NOT restricted to extensionless names: a cross-family audit
+    # (2026-07-28, gpt-5.5) found that an earlier draft skipped any dotted basename, so a shell
+    # file named `helper.bash` carrying an identical known-positive was dropped from a DIRECTORY
+    # target in silence — while the explicit-file branch reported the same file as UNSCANNABLE.
+    # Silent-drop on one path and honest-report on the other is the fail-open half. Confirmed by
+    # running both paths on the same fixture before accepting the finding.
+    while IFS= read -r f; do
+      b="${f##*/}"                      # basename — a dotted DIRECTORY (.git-hooks) is not an extension
+      case "$b" in
+        *.py|*.sh) continue ;;          # already collected above
+        *.md|*.json|*.yaml|*.yml|*.txt|*.lock|*.png|*.jpg|*.svg|*.pdf|*.zip) continue ;;
+      esac
+      head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && FILES+=("$f")
+    done < <(find "$t" -type f 2>/dev/null)
+  elif [ -f "$t" ]; then
+    tb="${t##*/}"
+    case "$tb" in
+      *.py|*.sh) FILES+=("$t") ;;
+      *.*) UNSCANNABLE+=("$t") ;;
+      *) if head -n1 "$t" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b'; then FILES+=("$t"); else UNSCANNABLE+=("$t"); fi ;;
+    esac
+  fi
+done
+if [ ${#FILES[@]} -eq 0 ]; then
+  if [ ${#UNSCANNABLE[@]} -gt 0 ]; then
+    echo "degrade-scan: ${#UNSCANNABLE[@]} changed file(s) are OUTSIDE the scannable set (py/sh) — NOT scanned, NOT 'clean':"
+    printf '  (unscannable) %s\n' "${UNSCANNABLE[@]}"
+    echo "A load-bearing surface in another language must go straight to cross-family review."
+    exit 2   # advisory non-clean — an orchestrator keying on exit code must not read this as clean
+  fi
+  echo "degrade-scan: no scannable (py/sh) target files"; exit 0
+fi
+
+hits=0
+emit() { printf '  %s:%s\n    [%s] %s\n' "$1" "$2" "$3" "$4"; hits=$((hits+1)); }
+
+for f in "${FILES[@]}"; do
+  # ---- Shell-shaped probes (S*) -------------------------------------------------------------
+  # Calibration finding (2026-07-28, known-pair): every probe below the S-block is PYTHON-shaped
+  # (`except:` / `.get(k, True)` / `if not x:` / `.split()`), none of which exist in bash. A .sh file
+  # was still COLLECTED and counted, so a fail-open shell gate printed "no smells in 1 scanned py/sh
+  # file" — a FALSE CLEAN, which is worse than honest non-coverage. A known-positive .sh carrying four
+  # distinct default-toward-PASS shapes scored 0/4. These probes close that; they run on any file
+  # whose basename ends in .sh OR that carries a shell shebang (see the is_sh test below).
+  is_sh=""; fb="${f##*/}"
+  case "$fb" in
+    *.sh) is_sh=1 ;;
+    *.py) ;;
+    # Any other collected file reached FILES only via the shebang pass, or is a dotted shell name
+    # like `helper.bash`. Re-check the shebang rather than keying on the extension — keying on the
+    # extension is what produced the collect-but-never-probe false clean this whole block exists to
+    # close (n+10). Collected-but-unprobed must not be reachable again.
+    *) head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && is_sh=1 ;;
+  esac
+  if [ -n "$is_sh" ]; then
+    # S1 — permissive short-circuit on a FAILING CHECK: `scan=$(...) || return 0`, `verify … || exit 0`.
+    #   The check errored and the surface reports success. Safe-fail is `|| return 1` / `|| exit 1`.
+    #   SCOPED to check-shaped left-hand sides (command substitution, or a verb like
+    #   scan/check/verify/grep/audit/validate/gate). A PRECONDITION guard — `[ -d x ] || exit 0`,
+    #   `[[ $d =~ … ]] || return 0` — is deliberately excluded: "this run does not apply here" is not
+    #   the same claim as "this check passed". Hand-measured 2026-07-28: unscoped, 6/6 sampled hits
+    #   were false positives, 4 of them precondition guards.
+    #   EXCEPTION, re-added after an adversarial pass on this very scoping: a `-f`/`-x` test is a
+    #   DEPENDENCY check, not a scope check. `[ -f "$GUARD_LIB" ] || exit 0` means "my guard library
+    #   is missing, therefore allow" — the fail-open shape that bit qasp on 2026-07-28. Excluding it
+    #   with the scope guards would have hidden exactly the class this scan exists to find.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S1:||→PASS(sh)" "failing check short-circuits to a permissive result (\`|| return 0\` / \`|| exit 0\` / \`|| true\`) — an errored check must fail closed, not report success"
+    done < <(grep -nE '\|\|[[:space:]]*(return[[:space:]]+0|exit[[:space:]]+0|true)([[:space:]]*(#|;|$))' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+             | grep -vE '^[0-9]+:[[:space:]]*(if[[:space:]]+)?\[\[?[[:space:]]*(-[dznN][[:space:]]|[^]]*=~)' \
+             | grep -E '(\$\(|`|\[[[:space:]]*-[fx][[:space:]]|\b(scan|check|verify|validate|audit|grep|gate|assert|lint|test_)[A-Za-z_]*[[:space:](])')
+
+    # S2 — `else` fall-through to a permissive exit/return within 2 lines (unenumerated case → allow).
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S2:else→PASS(sh)" "else/fall-through branch exits permissively — the unenumerated case should fail closed"
+    done < <(grep -nE -A2 '^[[:space:]]*else[[:space:]]*$' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S3 — empty/unset defaulted to a permissive VERDICT: `${V:-PASS}` / `V="PASS"` after a failed read.
+    #   "the value never arrived" must not be spelled the same way as "the value said PASS".
+    #   `${V:-0}` and `${V:-true}` are NOT flagged: numeric defaulting is the prescribed integer
+    #   sanitization against the pipefail-fallback class (see S5), and flagging it would push an
+    #   author to delete the remedy. Measured 2026-07-28 — `${PRS:-0}` in session_close_check.sh is
+    #   the fix, not the defect. Only explicit verdict words count.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S3:default→PASS(sh)" "unset/empty defaults to a permissive verdict — absent is not clean (\`not found\` ≠ \`0\`); default to the blocking value"
+    done < <(grep -nE "(\\$\{[A-Za-z_][A-Za-z0-9_]*:?-[[:space:]]*(PASS|OK|ALLOW|GRANTED|VALID|PASSED)\}|\|\|[[:space:]]*[A-Za-z_][A-Za-z0-9_]*=[\"']?(PASS|OK|ALLOW|GRANTED|VALID))" "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+
+    # S4 — empty-output guard treated as clean: `if [ -z "$out" ]; then return 0/exit 0`.
+    #   Identical to Probe E's falsy-sentinel class, in shell spelling: an errored scan produces empty
+    #   output, so "found nothing" and "never ran" become indistinguishable.
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S4:empty→PASS(sh)" "empty output treated as clean — a scan that errored also produces empty output; distinguish 'errored/absent' from 'verified clean'"
+    done < <(grep -nE -A2 '^[[:space:]]*(if|elif)[[:space:]]+\[+[[:space:]]*-z[[:space:]]' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
+    #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
+    #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+  fi
+
+  # Probe A — except/else/finally block returning a permissive value within 2 lines.
+  #   The classic "swallow the error → report success". A safe-fail returns BLOCK/None/raise.
+  while IFS= read -r line; do
+    ln="${line%%:*}"
+    emit "$f" "$ln" "A:except/else→PASS" "permissive return on an error/fall-through branch — safe-fail must return BLOCK/None or re-raise"
+  done < <(grep -nE -A2 '^[[:space:]]*(except([[:space:]][^:]*)?|else|finally)[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe B — dict default / setdefault to a permissive value (unknown key → PASS).
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "B:default→PASS" "unknown-key default is permissive — unenumerated case should default to safe-fail"
+  done < <(grep -nE "(\.get\([^,]+,[[:space:]]*$PASS[[:space:])]|setdefault\([^,]+,[[:space:]]*$PASS[[:space:])])" "$f" 2>/dev/null)
+
+  # Probe C — substring membership on a grounding/verdict/state line (loose match, not exact).
+  #   `if tok in text` masks paid⊂prepaid / 완료⊂미완료. Exact/word-boundary is the safe form.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C:substring-grounding" "substring 'in' on a verdict/state/present line — use exact or word-boundary match, not containment"
+  done < <(grep -nE '\b(verdict|present|ground|state|match|expected|assert)\w*\b' "$f" 2>/dev/null \
+           | grep -vE ':[[:space:]]*(#|//|from |import )' | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+           | grep -E '[^._a-zA-Z]in[[:space:]]' | grep -vE '\bfor\b|__contains__|not in|in \(|in \[|in \{|in range|in enumerate|in [A-Z_]+\b' \
+           | grep -oE '^[0-9]+' | sed 's/$/:/')
+
+  # Probe C2 — bare `VAR in VAR` in an if/return/assert/while context, WITHOUT a grounding keyword.
+  #   Probe C is keyword-gated (low-noise) and therefore misses the doc's own headline example
+  #   `tok in text` (paid⊂prepaid) when the variables aren't named verdict/state (M#4, steel-quench).
+  #   C2 closes that: simple var-in-var (not a collection literal / range / for) = a likely
+  #   containment check that should be exact/word-boundary if it grounds a verdict. Higher noise; advisory.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C2:substring-boolean" "bare 'X in Y' in if/return/assert — if this grounds a presence/verdict check, use exact/word-boundary match, not containment"
+  done < <(grep -nE '^[[:space:]]*(if|elif|return|assert|while)[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]+in[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*[:)]?[[:space:]]*$' "$f" 2>/dev/null \
+           | grep -vE '\bfor\b|in range|in enumerate|not in' \
+           | grep -vE '\b(verdict|present|ground|state|match|expected)\w*\b')
+
+  # Probe E — negated-falsy guard returning permissive (dominance-benchmark round-2 f2 class): an error
+  # SENTINEL (None / {} / "" / []) is falsy, so `if not X: return <PASS>` treats "the check errored / never
+  # ran" identically to "the check ran and found nothing clean". Distinguish errored from clean before allowing.
+  while IFS= read -r ln; do
+    emit "$f" "$ln" "E:falsy-sentinel→PASS" "negated-falsy guard returns permissive — a falsy error sentinel (None/{}/'') masquerades as 'clean'; a gate must distinguish 'errored/absent' from 'verified clean'"
+  done < <(grep -nE -A2 '^[[:space:]]*if[[:space:]]+not[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe F — positional field-select from a split result feeding a decision (round-2 c3 class): taking the
+  # decision from `parts[-1]`/`parts[0]` of an attacker-influenceable split lets a crafted field (e.g. a
+  # signed DENY whose free-form comment ends "::ALLOW") negate the verdict. Validate structure, don't select by position.
+  if grep -qE '\.r?split\(' "$f" 2>/dev/null; then
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "F:split-positional-verdict" "decision taken by position ([-1]/[0]) from a split result — an attacker-controlled trailing/leading field can negate the verdict; validate structure, don't select by position"
+    done < <(grep -nE '\[[[:space:]]*-?[01][[:space:]]*\]' "$f" 2>/dev/null \
+             | grep -iE 'decision|verdict|allow|deny|approv|grant|status|result|policy')
+  fi
+done
+
+echo "----"
+[ ${#UNSCANNABLE[@]} -gt 0 ] && printf 'note: %s changed file(s) outside py/sh — NOT covered by this scan (send to cross-family directly).\n' "${#UNSCANNABLE[@]}"
+if [ "$hits" -gt 0 ]; then
+  echo "degrade-scan: $hits smell(s) — ADVISORY. Each = 'prove this is not default-toward-PASS'."
+  echo "Terminal verdict = cross-family adversarial review (auto-decorrelation), not this scan."
+  exit 2
+fi
+# Scope-honest clean message (M#2): "clean" means only "no py/sh-pattern smells in the SCANNED set" —
+# it does NOT assert the changed load-bearing surface is safe (other languages, non-code surfaces,
+# and the lint's own recall gaps are out of scope). The load-bearing check is the cross-family review.
+echo "degrade-scan: no default-toward-PASS smells in ${#FILES[@]} scanned py/sh file(s) — does NOT cover other languages / non-code surfaces / the cross-family check (advisory)."
+exit 0

package/scripts/fh-gate.sh

@@ -59,13 +59,87 @@ FH_TASK_DESCRIPTION="${FH_TASK_DESCRIPTION:-}"
 FH_DIFF_PATH="${FH_DIFF_PATH:-}"
 
 case "$FH_BACKEND" in
-  claude|codex|auto) ;;
+  claude|codex|auto|cross) ;;
   *)
-    echo "ERROR: FH_BACKEND must be 'claude', 'codex', or 'auto' (got: $FH_BACKEND)" >&2
+    echo "ERROR: FH_BACKEND must be 'claude', 'codex', 'auto', or 'cross' (got: $FH_BACKEND)" >&2
     exit $EXIT_ARG_ERROR
     ;;
 esac
 
+# ── FH_BACKEND=cross — decorrelated review (2026-07-26) ───────────────────────────────────────
+# `auto` is a FALLBACK: it picks codex if present, else claude, and runs ONE leg. That is backend
+# SELECTION, not decorrelation. A same-family reviewer shares the author's optimistic reading, which
+# is the failure mode the FH load-bearing gate exists to catch — and a 7-round cross-family audit of
+# that gate found 30 issues an in-family pass had not.
+#
+# `cross` runs BOTH families and UNIONs their findings. Union, not vote: detection is the task, and a
+# finding only one leg saw is still a finding (majority voting would discard exactly the decorrelated
+# signal this mode is for). The verdict is the most severe across legs.
+#
+# THE INVARIANT THAT MATTERS MOST: the output declares WHICH LEGS ACTUALLY RAN (`FH_GATE_LEGS:`).
+# `cross` is a REQUEST, not a guarantee — a machine may have only one family installed. When a leg is
+# unavailable or errors, this degrades to the surviving leg and SAYS SO, loudly, in both the human and
+# the machine-readable output. A single-leg result that reads as if it were cross-checked is the same
+# class of defect as a check that did not run reading as PASS.
+#
+# COST: cross is ~2x. It is deliberately NOT a default — [[feedback_decorrelation_not_fanout_cost_boundary]]
+# says match the parallelisation axis to the failure mode rather than multiply. Callers should request
+# it for load-bearing verdict/gate/irreversible-surface changes, which is exactly the trigger the
+# pre-commit load-bearing leg already computes.
+if [[ "$FH_BACKEND" == "cross" ]]; then
+  _CROSS_LEGS=""; _CROSS_OUT=""; _CROSS_WORST="PASS"; _CROSS_RAN=0; _CROSS_ERR=""
+  _sev_rank() { case "$1" in PASS) echo 0 ;; PENDING) echo 1 ;; ESCALATE) echo 2 ;; BLOCKED) echo 3 ;; *) echo -1 ;; esac; }
+  for _leg in claude codex; do
+    command -v "$_leg" >/dev/null 2>&1 || { _CROSS_ERR="${_CROSS_ERR}${_CROSS_ERR:+, }$_leg (not installed)"; continue; }
+    # `set -e` is on: an assignment from a command substitution carries the child's exit status, and
+    # this child EXITS NON-ZERO BY DESIGN for every non-PASS verdict (PENDING 1 / BLOCKED 2 /
+    # ESCALATE 3). Written bare, the first leg that found anything would kill the whole cross run —
+    # i.e. cross would work only when there was nothing to find. `|| _legrc=$?` keeps the status
+    # without letting it abort. Verified against a BLOCKED leg, not assumed.
+    _legrc=0
+    _legout=$(FH_BACKEND="$_leg" "$0" "$@" 2>/dev/null) || _legrc=$?
+    if [ "$_legrc" -ge 10 ]; then
+      _CROSS_ERR="${_CROSS_ERR}${_CROSS_ERR:+, }$_leg (harness error $_legrc)"; continue
+    fi
+    _legverdict=$(printf '%s' "$_legout" | grep -m1 '^FH_GATE_VERDICT:' | awk '{print $2}')
+    [ -z "$_legverdict" ] && { _CROSS_ERR="${_CROSS_ERR}${_CROSS_ERR:+, }$_leg (no verdict line)"; continue; }
+    _CROSS_RAN=$((_CROSS_RAN+1))
+    _CROSS_LEGS="${_CROSS_LEGS}${_CROSS_LEGS:+,}$_leg"
+    [ "$(_sev_rank "$_legverdict")" -gt "$(_sev_rank "$_CROSS_WORST")" ] && _CROSS_WORST="$_legverdict"
+    _CROSS_OUT="${_CROSS_OUT}
+# ── leg: $_leg (verdict $_legverdict) ──
+$(printf '%s' "$_legout" | sed -n '/^---$/,$p')"
+  done
+
+  if [ "$_CROSS_RAN" -eq 0 ]; then
+    echo "ERROR: FH_BACKEND=cross — no leg produced a verdict (${_CROSS_ERR:-none available}). Failing closed." >&2
+    exit $EXIT_HARNESS_ERROR
+  fi
+
+  printf 'FH_STATUS: SUCCESS\n'
+  printf 'FH_GATE_VERDICT: %s\n' "$_CROSS_WORST"
+  printf 'FH_GATE_MODE: cross\n'
+  printf 'FH_GATE_LEGS: %s\n' "$_CROSS_LEGS"
+  if [ "$_CROSS_RAN" -lt 2 ]; then
+    # Degraded, and it must be impossible to mistake this for a two-family result.
+    printf 'FH_GATE_DECORRELATED: no\n'
+    printf 'FH_GATE_DEGRADED: %s\n' "$_CROSS_ERR"
+    echo "WARN: FH_BACKEND=cross ran a SINGLE leg ($_CROSS_LEGS) — $_CROSS_ERR." >&2
+    echo "      This verdict is NOT decorrelated. Treat it as $_CROSS_LEGS alone." >&2
+  else
+    printf 'FH_GATE_DECORRELATED: yes\n'
+  fi
+  printf '%s\n' "$_CROSS_OUT"
+  echo "→ fh-gate: cross mode — legs [$_CROSS_LEGS], union verdict $_CROSS_WORST" >&2
+  case "$_CROSS_WORST" in
+    PASS)     exit $EXIT_PASS ;;
+    PENDING)  exit $EXIT_PENDING ;;
+    BLOCKED)  exit $EXIT_BLOCKED ;;
+    ESCALATE) exit $EXIT_ESCALATE ;;
+    *)        exit $EXIT_HARNESS_ERROR ;;
+  esac
+fi
+
 # FH_TIMEOUT lands in command position via the unquoted ${_TIMEOUT_CMD} idiom below.
 # `timeout DURATION COMMAND [ARG]...` treats the word after the duration as the command,
 # so an unvalidated value word-splits into arbitrary execution with no shell metacharacters

package/scripts/fh_session_load.sh

@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# fh_session_load.sh — Mode D SessionStart companion-store freshness load (mechanical).
+#
+# WHY: the session-start companion-store load (refresh the private companion store + read its
+# INDEX + card-vs-commit freshness) is documented in CLAUDE.local.md / modes_and_value.md
+# §Session-start freshness as PROSE. Prose is salience-dependent: when the operator opens a
+# session with an immediate task, the load silently does not fire and the agent operates on
+# stale local memory. (Measured miss 2026-07-05: stale sidecar-tool version + a missed standing
+# instruction, both because the companion refresh was skipped on task-first entry.) A
+# SessionStart hook fires BEFORE the first user turn regardless of what the user types — so it
+# closes the salience gap mechanically. This is the deferred hook in operational_adaptation.md
+# §Guards whose measured revisit-trigger has now fired.
+#
+# WHAT: refresh the companion store, then emit a SHORT, IMPERATIVE freshness delta to stdout.
+# A SessionStart hook's stdout is injected into the session context, so this block becomes
+# unavoidable context the agent sees at turn 0.
+#
+# Graceful: if no companion store is configured (non-Mode-D user / ephemeral clone), emit
+# nothing and exit 0 — this hook is a silent no-op outside Mode D. Offline-safe: refresh
+# failure never blocks the session.
+#
+# Config (operator-local, opt-in): register in .claude/settings.local.json SessionStart and pass
+# the companion-store path via the BE_DIR env in that gitignored registration (the public script
+# hard-codes no private path). HUB_DIR overrides the hub path. Never commit the registration to
+# the public settings.json — the hook is Mode-D-only.
+
+set -uo pipefail
+
+FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$HOME/projects/forge-harness}}"
+
+# ── frontier-digest: 부재를 0으로 읽지 않는다 ────────────────────────────────────
+# 왜: digest 는 launchd 로 매일 09:00 에 돌지만 **31회 중 6회(19%) 산출물 없이 끝났다**
+# (2026-07-21 실측: exit 1 / 재시도 후에도 없음 / Attempt 에서 hang — 세 형태).
+# 그런데 세션 시작은 "있으면 읽는다"만 했다 → **실패가 '오늘은 뉴스 없음'으로 읽혔다.**
+# 부재와 실패는 0이 아니다. 로그가 있는데 산출물이 없으면 그건 부재가 아니라 FAILED 다.
+# Portable mtime (epoch). GNU-first: on GNU/coreutils `stat -f %m` exits 0 with filesystem-format
+# output (never reaching a BSD fallback), so probe `stat -c %Y` FIRST — on BSD/macOS it errors and
+# falls through to `-f %m`. Always echoes a numeric value (0 on total failure) so `-gt` never breaks.
+# (codex cross-family review 2026-07-05 [MED]: BSD-first order silently mis-parsed on GNU.)
+_mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0; }
+
+_FD_LOG="$FH/tracks/_meta/logs/frontier_digest_$(date +%Y_%m_%d).log"
+_FD_LOCK="$FH/tracks/_meta/logs/.frontier_digest.lock"
+# 스케줄 전 부재 ≠ 실패: 잡은 launchd 로 09:00 에 돈다(com.forge-harness.frontier-digest.plist).
+# 2026-07-23 08:07 세션이 "잡이 안 돌았을 수 있다" 경고를 받았고 잡은 09:00 에 정상 완주 —
+# 경고가 나중에 읽히면 오보처럼 보인다. 그래서 ① 스케줄 전엔 경고하지 않고 ② 모든 분기에
+# 발화 시각을 스탬프하고 ③ 러너 생존 신호(로그 갱신 or 락)가 있는 동안은 실패 판정을 보류한다.
+_FD_SCHED=900                              # 09:00, HHMM 를 10진 정수로
+_FD_NOW="${FD_NOW_HHMM:-$(date +%H%M)}"    # FD_NOW_HHMM = known-pair 캘리브레이션 전용(숫자 4자리만)
+_FD_STAMP="$(date +%H:%M) 기준"
+# 존재 판정은 러너 digest_ready 와 동일 술어(glob + -size +1k). 정확명 [ -f ] 는 러너와 관대함이
+# 갈린다 — partial 파일(>0 <1k)이 성공으로 오독되고, suffix 착지가 영구 오경보가 된다
+# (divergent-leniency: 같은 상태를 두 술어가 다르게 읽으면 한쪽 결과가 무음으로 샌다).
+_fd_ready() { find "$FH/tracks/_meta" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+if _fd_ready; then
+  :
+elif [ "$((10#$_FD_NOW))" -lt "$_FD_SCHED" ]; then
+  echo "ℹ️  [frontier-digest] 오늘 digest 는 09:00 예정 — 아직 전이다($_FD_STAMP). 부재는 정상."
+elif [ -f "$_FD_LOG" ]; then
+  _FD_LOG_AGE=$(( $(date +%s) - $(_mtime "$_FD_LOG") ))
+  # 러너 생존 신호 2종 — 어느 쪽이든 있으면 FAILED 대신 보류:
+  #   ① 로그 최근 갱신(임계 2100s > 러너 최장 침묵창 = watchdog 1800s)
+  #   ② 락 존재이면서 비-stale — stale 임계는 러너 자신의 락-브레이크 술어(-mmin +240)와 동일.
+  #      락은 슬립-복귀 직후(로그는 오래됐지만 러너가 살아 재개하는 케이스)를 커버한다.
+  _FD_ALIVE=""
+  if [ -d "$_FD_LOCK" ] && [ -z "$(find "$_FD_LOCK" -maxdepth 0 -mmin +240 2>/dev/null)" ]; then
+    _FD_ALIVE="락 존재"
+  fi
+  [ "$_FD_LOG_AGE" -lt 2100 ] && _FD_ALIVE="${_FD_ALIVE:+$_FD_ALIVE · }로그 ${_FD_LOG_AGE}s 전 갱신"
+  if [ -n "$_FD_ALIVE" ]; then
+    echo "ℹ️  [frontier-digest] 잡이 아직 돌고 있는 중일 수 있다($_FD_STAMP, $_FD_ALIVE) — 실패 판정 보류, 나중에 재확인."
+  else
+    echo "⚠️  [frontier-digest] 오늘 잡은 돌았는데 **산출물이 없다**($_FD_STAMP) — 부재가 아니라 실패다."
+    echo "    마지막 로그: $(tail -1 "$_FD_LOG" 2>/dev/null | cut -c1-90)"
+    echo "    → 수동 재실행하거나 실패 원인을 보라. '오늘은 뉴스 없음'으로 읽지 말 것."
+  fi
+else
+  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+fi
+BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+
+# Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
+[ -d "$BE/.git" ] || exit 0
+
+# (_mtime is defined above the frontier-digest block — single definition, both sections use it.)
+
+# 1) Refresh the companion store — fail-fast, never block the first turn, never mutate into a
+#    merge/conflict. (codex cross-family review 2026-07-05 [HIGH]/[MED].)
+#    - fail-fast env: no credential/SSH/host-key prompts can hang SessionStart.
+#    - fetch + merge --ff-only: a fast-forward is the only safe hook mutation; a diverged companion
+#      simply does not advance (no merge commit, no conflict state left behind) and we say so.
+export GIT_TERMINAL_PROMPT=0
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
+
+# Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
+# slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
+# 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
+# watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
+# reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
+# to running the command with NO deadline — a missing watchdog must never become a permanently
+# skipped fetch misreported as "offline" (challenger catch 2026-07-12).
+if command -v perl >/dev/null 2>&1; then
+  _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
+else
+  _deadline() { shift; "$@"; }
+fi
+PULL_NOTE=""
+if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
+  if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
+    PULL_NOTE="fetched + fast-forwarded"
+  else
+    PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
+  fi
+else
+  PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
+fi
+
+# 2) Session card date (the pointer the operator's close chain writes last).
+CARD="$FH/tracks/_meta/reference_next_session_starter.md"
+CARD_EPOCH=0
+[ -f "$CARD" ] && CARD_EPOCH="$(_mtime "$CARD")"
+
+# 3) Companion files NEWER than the card, in the surfaces that carry landed results/handoffs.
+#    (paper-signals = completed experiments; handoff = cross-session/cross-machine; tracks-meta
+#    = synced session meta.) These are exactly what a stale card fails to point at.
+NEWER=""
+for sub in paper-signals handoff tracks-meta digests; do
+  d="$BE/$sub"
+  [ -d "$d" ] || continue
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    fe="$(_mtime "$f")"
+    if [ "${fe:-0}" -gt "${CARD_EPOCH:-0}" ]; then
+      NEWER="${NEWER}  - ${f#$BE/}\n"
+    fi
+  done <<EOF
+$(find "$d" -type f -name '*.md' -maxdepth 2 2>/dev/null)
+EOF
+done
+
+# 3b) Handoff/signal STATUS map — mtime-INDEPENDENT (patched 2026-07-10).
+#     WHY: the NEWER-than-card list (step 3) has a permanent blind spot — a status stamp
+#     (DONE/SUPERSEDED/RESOLVED) can land in the companion store, then the card gets rewritten
+#     WITHOUT reconciling that item; from then on the stamped file is "older than the card"
+#     forever and step 3 never surfaces it again. (Measured miss 2026-07-10: a Qwen heavy
+#     handoff stamped DONE 07-09 stayed listed as "awaiting RUN" in the card through a later
+#     card rewrite — company sessions push results to the companion store but never run the
+#     local close chain, so the card's ⑤ update is the ONLY reconcile point and it was prose.)
+#     FIX: emit ALL frontmatter status lines from handoff/ + paper-signals/ every session,
+#     regardless of mtime, so the turn-0 agent can mechanically cross-check card carry items.
+STATUS_MAP=""
+for sub in handoff paper-signals; do
+  d="$BE/$sub"
+  [ -d "$d" ] || continue
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    s="$(head -15 "$f" 2>/dev/null | grep -iE '^ *status:' | head -1 | sed 's/^ *//')"
+    [ -n "$s" ] || continue
+    # Match on the status VALUE's leading word only — a substring match anywhere in the line
+    # false-positives on prose like "Remaining for DONE:" inside a PARTIAL status.
+    v="$(printf '%s' "$s" | sed -E 's/^[Ss][Tt][Aa][Tt][Uu][Ss]: *//')"
+    case "$v" in
+      DONE*|SUPERSEDED*|RESOLVED*|CLOSED*) STATUS_MAP="${STATUS_MAP}  - ${f#$BE/} → ${s}\n" ;;
+    esac
+  done <<EOF
+$(find "$d" -type f -name '*.md' -maxdepth 2 2>/dev/null)
+EOF
+done
+
+# 4) INDEX.md live pointers (the operator's wiki TOC — read-first per CLAUDE.local.md).
+INDEX_HEAD=""
+if [ -f "$BE/INDEX.md" ]; then
+  INDEX_HEAD="$(grep -iE 'live pointer|Live pointers' -A 8 "$BE/INDEX.md" 2>/dev/null | head -10)"
+fi
+
+# 5) Emit the freshness block (short + imperative). Only speak if there is something to say.
+{
+  echo "🔄 [FH SessionStart] companion-store freshness — $PULL_NOTE."
+  if [ -n "$NEWER" ]; then
+    echo "⚠️ NEWER THAN SESSION CARD — READ THESE BEFORE ACTING (card may be stale):"
+    printf "%b" "$NEWER"
+  else
+    echo "   (no companion files newer than the session card)"
+  fi
+  if [ -n "$STATUS_MAP" ]; then
+    echo "── handoff/signal STATUS map (mtime-independent — closed items) ──"
+    printf "%b" "$STATUS_MAP"
+    echo "→ CROSS-CHECK: any item above that the session card still lists as open/awaiting = stale card line. Fix it in this session's card update (⑤)."
+  fi
+  if [ -n "$INDEX_HEAD" ]; then
+    echo "── INDEX.md live pointers ──"
+    echo "$INDEX_HEAD"
+  fi
+  echo "Reminder: this is the Mode D auto-read (CLAUDE.local.md §Session-start companion load) —"
+  echo "it fires even when the first user message is a task. Do not treat 'pulled' as 'read'."
+} 2>/dev/null
+
+# 6) Substrate-jump detection (structure-enforcing — version drift lives outside any session's
+#    context boundary; silent when nothing changed). Detector, never a gate.
+[ -x "$FH/scripts/substrate_jump_detector.sh" ] && bash "$FH/scripts/substrate_jump_detector.sh" "$FH" 2>/dev/null
+
+exit 0