@chrono-meta/fh-gate 1.4.71 → 1.4.73

package/scripts/psa_scan_lib.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# psa_scan_lib.sh — the ONE implementation of public-surface pattern loading and matching.
+#
+# WHY THIS FILE EXISTS
+#   Three copies of this logic existed (pre-commit, pre-push, public_surface_scan_files.sh). Across a
+#   single 2026-07-26 cross-family audit, EVERY confidentiality defect found was a divergence between
+#   them, not a flaw in the idea:
+#     • the publish copy checked that the override was readable and non-empty; the commit copy did not
+#     • the commit copy failed closed when no patterns loaded; the publish copy did too; the push copy
+#       had to be told separately
+#     • a row with a SPACE instead of a TAB failed closed in two copies and was silently skipped in the third
+#     • `head -1` per line (a placeholder shielding a real token) was fixed in one copy and not the others
+#     • the LOW-severity file allowlist existed in one copy only — which is how the push gate blocked
+#       its own first real push
+#   Each was repaired where it was found. The prescription this repo already had recorded for that
+#   pattern — [[feedback_divergent_leniency_duplicate_normalizers]]: single source, visible drops,
+#   fail-closed — was quoted during that session and then not applied; the duplication was repaired
+#   three times instead of removed. This file removes it.
+#
+# WHAT IS SHARED vs WHAT STAYS WITH THE CALLER — the split is deliberate, do not "unify" further:
+#   SHARED (here): loading the two pattern layers, validating rows, and deciding whether a given
+#                  token on a given path is a reportable hit.
+#   CALLER'S:      WHICH content is scanned (staged diff / pushed range / packed file set), and the
+#                  DEGRADE DIRECTION when the instrument is incomplete. Those genuinely differ:
+#                  a commit is local and re-committable, so an absent operator override warns; a push
+#                  and a publish are the acts that make content public, so the same state blocks.
+#                  Collapsing that would either block every fresh clone's first commit (training the
+#                  override into reflex) or let a real leak reach a public remote. This library
+#                  therefore REPORTS state and never exits.
+#
+# Usage:
+#   . "$REPO_ROOT/scripts/psa_scan_lib.sh"
+#   psa_load "$defaults_path" "$override_path"     # sets PSA_STREAM + the three state flags below
+#   psa_scan_tagged <<< "$path<TAB>line"…          # prints hits, returns 1 if any hit was reported
+#
+# State set by psa_load (read-only for callers):
+#   PSA_STREAM            validated rows only (invalid/malformed rows are dropped AND counted)
+#   PSA_DEFAULTS_OK       1 = committed defaults present, readable, non-empty
+#   PSA_OVERRIDE_PRESENT  1 = operator override present, readable, non-empty
+#   PSA_BAD_ROWS          count of rows dropped as unusable (uncompilable regex, or no TAB)
+# A caller that treats PSA_BAD_ROWS>0 or PSA_DEFAULTS_OK=0 as "clean" has a hole: those states mean
+# the instrument is incomplete, and an incomplete instrument cannot certify anything.
+
+# Placeholder shapes that must never count as a leak. Anchored whole-token: a substring match here
+# would let a real token pass by merely CONTAINING a placeholder word.
+PSA_PLACEHOLDER='^(<[a-z0-9_-]+>|\{[a-z_]+\}|EXAMPLE|dummy|changeme|REDACTED|xxxx|/Users/(EXAMPLE|yourname|\{[a-z_]+\}|<[a-z0-9_-]+>)/|AKIAIOSFODNN7EXAMPLE)$'
+
+# Files that name wiring/companion tokens as part of doing their job. LOW severity only — HIGH/MED
+# block everywhere, including here. Kept as a function so the list has exactly one definition.
+psa_low_allowlisted() {
+  case "$1" in
+    .gitignore|scripts/sync-to-be.sh|.claude/rules/local_fh_context.md|templates/local_fh_context.md|templates/.claude/rules/*|templates/.git-hooks/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# psa_load <defaults_path> <override_path>
+# Prints diagnostics for every degraded state; sets the flags above. NEVER exits — the caller owns
+# the degrade direction, because it differs by surface (see the header).
+psa_load() {
+  local defaults="$1" override="$2" raw ov
+  PSA_STREAM=""; PSA_DEFAULTS_OK=0; PSA_OVERRIDE_PRESENT=0; PSA_BAD_ROWS=0
+
+  # Layer 1 — committed defaults. This file ships with the repo, so missing/unreadable/empty is a
+  # BROKEN INSTRUMENT, not a configuration choice. A valid override used to mask its absence, and the
+  # scan then reported a clean "full pattern set" with every universal pattern silently gone.
+  if [ -f "$defaults" ] && [ -r "$defaults" ]; then
+    raw=$(cat "$defaults" 2>/dev/null || true)
+    if [ -n "$(printf '%s' "$raw" | grep -vE '^[[:space:]]*(#|$)' || true)" ]; then
+      PSA_STREAM="$raw"; PSA_DEFAULTS_OK=1
+    fi
+  fi
+  [ "$PSA_DEFAULTS_OK" -eq 0 ] && \
+    echo "  ❌ committed pattern defaults missing/unreadable/empty — universal patterns NOT loaded ($defaults)"
+
+  # Layer 2 — the gitignored operator literals. Present ONLY when a readable, non-empty read actually
+  # contributed patterns: an empty file must not masquerade as a configured gate.
+  if [ -f "$override" ]; then
+    if [ -r "$override" ]; then
+      ov=$(cat "$override" 2>/dev/null || true)
+      if [ -n "$(printf '%s' "$ov" | grep -vE '^[[:space:]]*(#|$)' || true)" ]; then
+        PSA_STREAM="$PSA_STREAM
+$ov"; PSA_OVERRIDE_PRESENT=1
+      else
+        echo "  ⚠️  operator pattern override is EMPTY — treated as absent."
+      fi
+    else
+      echo "  ⚠️  operator pattern override exists but is UNREADABLE — treated as absent."
+    fi
+  fi
+
+  # Row validation. Two ways a row can be present and still protect nothing, both previously silent:
+  #   • no TAB  → the whole line lands in the severity field and no detector is defined
+  #   • bad ERE → grep exits >=2 and the error is swallowed downstream as a no-match
+  # Both are DROPPED and COUNTED here so the caller can fail closed on an incomplete instrument.
+  local valid="" line re rc
+  while IFS= read -r line; do
+    line="${line%$'\r'}"                 # CRLF: a trailing CR welds onto the regex and it matches nothing
+    case "$line" in ''|\#*) continue;; esac
+    re="${line#*$'\t'}"
+    if [ "$re" = "$line" ]; then
+      echo "  ❌ unusable pattern row (no TAB between severity and regex): ${line%%$'\t'*}"
+      PSA_BAD_ROWS=$((PSA_BAD_ROWS+1)); continue
+    fi
+    printf '' | grep -E "$re" >/dev/null 2>&1; rc=$?    # 0/1 = compiled; >=2 = regex error
+    if [ "$rc" -ge 2 ]; then
+      echo "  ❌ unusable pattern (invalid regex) — this detector would match nothing: [${line%%$'\t'*}]"
+      PSA_BAD_ROWS=$((PSA_BAD_ROWS+1)); continue
+    fi
+    valid="$valid
+$line"
+  done <<PSA_ROWS
+$PSA_STREAM
+PSA_ROWS
+  PSA_STREAM="$valid"
+}
+
+# psa_scan_tagged  — reads "path<TAB>content" lines on stdin, prints one line per reportable hit.
+# Returns 0 = nothing reportable, 1 = at least one hit.
+#
+# Why path-tagged input: the LOW allowlist is per FILE, so a scanner that flattens content loses the
+# only information needed to apply it. The push copy did exactly that and blocked its own first real
+# push on a companion-store name inside the script whose job is to sync to the companion store.
+psa_scan_tagged() {
+  local input hit=0 row sev re path body tok
+  input=$(cat)
+  [ -n "$input" ] || return 0
+  while IFS= read -r row; do
+    case "$row" in ''|\#*) continue;; esac
+    re="${row#*$'\t'}"; [ "$re" = "$row" ] && continue
+    sev="${row%%$'\t'*}"
+    while IFS= read -r line; do
+      [ -z "$line" ] && continue
+      path="${line%%$'\t'*}"; body="${line#*$'\t'}"
+      # EVERY match on the line. Taking only the first let a documented placeholder earlier on the
+      # line shield a real token later on it.
+      while IFS= read -r tok; do
+        [ -z "$tok" ] && continue
+        printf '%s' "$tok" | grep -qiE "$PSA_PLACEHOLDER" && continue
+        if [ "$sev" = "LOW" ] && psa_low_allowlisted "$path"; then continue; fi
+        echo "  ❌ $sev leak — ${path}: '$tok'"
+        hit=1
+      done <<PSA_TOK
+$(printf '%s' "$body" | grep -oiE "$re" 2>/dev/null || true)
+PSA_TOK
+    done <<PSA_LINES
+$(printf '%s\n' "$input" | grep -iE "$re" 2>/dev/null || true)
+PSA_LINES
+  done <<PSA_PAT
+$PSA_STREAM
+PSA_PAT
+  return $hit
+}

package/scripts/public_surface_scan_files.sh

@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+# public_surface_scan_files.sh — Pre-Publish confidentiality floor for `npm publish`.
+#
+# Mechanizes the npm-publish half of the Pre-Publish Surface Gate (CLAUDE.md). The pre-commit
+# confidentiality scan sees only the ADDED LINES of this repo's commits; a token committed before
+# that scan existed, or carried in a files[] entry, would otherwise reach the registry unscanned.
+# This scans the FULL CONTENT of the exact npm-published file set (npm pack --dry-run) against the
+# same operator-private patterns, and blocks `npm publish` on a HIGH/MED hit.
+#
+# Honest scope: covers `npm publish` only (wired via package.json prepublishOnly). The separate-repo
+# go-public surface (gh repo create --public / visibility flip / first push to a new public remote) is
+# not an npm or git op against this repo, so no hook here sees it — it stays prose + PRE-PUBLISH-CHECKLIST.md
+# (genuinely un-hookable). Same shape as the Destructive-Op story: git/npm surface mechanized, the
+# separate-repo go-public surface stays prose.
+#
+# Degrade direction: irreversible surface (publish) → fail-CLOSED. Patterns absent, or the published
+# file set unresolved → BLOCK (proceed only on an explicit, logged PUBLIC_SURFACE_OK=1). Never silent-allow.
+#
+# Override (explicit, logged — mirrors the pre-commit PUBLIC_SURFACE_OK channel):
+#   PUBLIC_SURFACE_OK=1 npm publish …   ← after conscious review of the flagged hit(s).
+#
+# Patterns are single-source (shared with the pre-commit scan): .claude/rules/.public-surface-patterns.defaults
+# (committed, universal) + .claude/rules/.public-surface-patterns (gitignored, operator literals).
+
+set -uo pipefail
+
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+PSA_DEFAULTS="$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults"
+PSA_OVERRIDE="${PSA_PATTERNS:-$REPO_ROOT/.claude/rules/.public-surface-patterns}"
+# PSA_PLACEHOLDER and the default psa_low_allowlisted now come from scripts/psa_scan_lib.sh.
+# A second copy here is exactly the divergence this refactor removed; do not reintroduce one.
+
+# LOW-severity allowlist by file (HIGH/MED still block). For the PUBLISH scan this is nearly vacuous:
+# a published file should carry NO operator-private token at all. Deliberately names no operator-private
+# file literal here (the pre-commit copy of this list does, but it lives in a git-hooks-allowlisted path;
+# THIS script is public-tracked, so hardcoding e.g. a companion-script name would itself be a LOW leak —
+# caught by the pre-commit confidentiality scan, 2026-06-27). Generic template paths only.
+
+echo "[Pre-Publish] public-surface scan (npm-published file content)..."
+
+# ── Load patterns via the shared library (scripts/psa_scan_lib.sh) ──
+# One implementation of loading + row validation + exemption decisions, shared with pre-commit and
+# pre-push. What this file KEEPS for itself, deliberately:
+#   • the file-level `grep -a` scan. It forces every published file to be read as TEXT; the library's
+#     line-stream interface would drop back to text-only handling and re-open the hole a challenger
+#     found earlier — a token inside an SVG / null-byte file (docs/pillars.svg ships) scanning clean.
+#   • a STRICTER LOW allowlist (below). A published artifact should carry no operator-private token
+#     at all, so the commit-time list of files that legitimately name wiring tokens does not apply.
+#     Sourcing the library and then redefining the function is how that difference stays visible
+#     instead of being buried as a divergence.
+PSA_LIB="$REPO_ROOT/scripts/psa_scan_lib.sh"
+if [ ! -r "$PSA_LIB" ]; then
+  echo "  ❌ scripts/psa_scan_lib.sh missing — the confidentiality scanner cannot run."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] || { echo "     Fail-closed on the publish boundary."; exit 1; }
+else
+  . "$PSA_LIB"
+fi
+
+# Stricter than the library default — see the note above. Named here so the difference is legible.
+psa_low_allowlisted() {
+  case "$1" in
+    templates/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+psa_load "$PSA_DEFAULTS" "$PSA_OVERRIDE"
+
+# Publish is an irreversible surface: EVERY incomplete-instrument state blocks, including the merely
+# absent operator override (which only warns at commit time — see the library header for why the two
+# surfaces degrade differently).
+_psa_why=""
+[ "$PSA_DEFAULTS_OK" -eq 0 ]      && _psa_why="committed pattern defaults missing/unreadable/empty"
+[ "$PSA_BAD_ROWS" -gt 0 ]         && _psa_why="${_psa_why:+$_psa_why; }$PSA_BAD_ROWS unusable pattern row(s)"
+[ "$PSA_OVERRIDE_PRESENT" -eq 0 ] && _psa_why="${_psa_why:+$_psa_why; }operator-literal override absent/empty (HIGH company/companion literals NOT scanned)"
+if [ -n "$_psa_why" ]; then
+  echo "  ❌ incomplete confidentiality instrument — $_psa_why"
+  if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+    echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1 (conscious — the scan is incomplete)"
+    echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override (npm publish, incomplete instrument)" \
+      >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+  else
+    echo "     Fail-closed on an irreversible surface: an incomplete instrument cannot certify clean."
+    exit 1
+  fi
+fi
+
+
+# Named residual (cross-family audit 2026-06-27, deferred): this scans the WORKING-TREE content of the
+# packed file list, not the final tarball bytes. A content-generating publish lifecycle (prepack/prepare
+# that writes files AFTER this prepublishOnly scan) could ship bytes this never saw, and a path containing
+# a newline would mis-split the list. The robust fix is to scan the actual `npm pack` tarball; deferred
+# because THIS package's lifecycle is content-neutral (prepare = chmod only, no prepack). Re-open if a
+# content-generating lifecycle is ever added.
+# ── Resolve the exact npm-published file set (fail-closed if unresolved OR partial) ──
+FILES=$(npm pack --dry-run --json 2>/dev/null \
+  | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{JSON.parse(s)[0].files.forEach(f=>console.log(f.path))}catch(e){process.exit(3)}})' 2>/dev/null || true)
+if [ -z "$FILES" ]; then
+  echo "  ❌ could not resolve the npm-published file set (npm pack --dry-run failed)."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] && { echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1"; exit 0; }
+  echo "     Fail-closed on an irreversible surface. Fix npm pack or override with PUBLIC_SURFACE_OK=1."
+  exit 1
+fi
+
+# Wrong-set guard (challenger M6): a future npm --json shape change could yield a NON-empty but PARTIAL
+# file list (forEach iterates a renamed/nested structure without throwing) → files silently unscanned.
+# npm always ships package.json in the tarball; its absence means the parse got a wrong set → fail-closed.
+if ! printf '%s\n' "$FILES" | grep -qx "package.json"; then
+  echo "  ❌ published file set looks wrong — 'package.json' (always shipped) is absent from the parse."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] && { echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1"; exit 0; }
+  echo "     Fail-closed (possible npm --json shape change). Verify npm pack output or PUBLIC_SURFACE_OK=1."
+  exit 1
+fi
+
+# ── Scan full content of each published file ──
+LEAK=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  path="$REPO_ROOT/$f"
+  [ -f "$path" ] || continue
+  while IFS=$'\t' read -r sev regex; do
+    [ -z "$regex" ] && continue
+    case "$sev" in \#*) continue;; esac
+    while IFS= read -r tok; do
+      [ -z "$tok" ] && continue
+      printf '%s' "$tok" | grep -qiE "$PSA_PLACEHOLDER" && continue
+      if [ "$sev" = "LOW" ] && psa_low_allowlisted "$f"; then continue; fi
+      echo "  ❌ $sev leak — $f: '$tok' would ship to the registry"
+      LEAK=1
+      # -a forces every published file to scan as TEXT (challenger S1): -I skipped binary-classified
+      # files, so a token in an SVG / null-byte file (docs/pillars.svg ships) would slip unscanned.
+    done <<< "$(grep -aoiE "$regex" "$path" 2>/dev/null | sort -u || true)"
+  done <<< "$PSA_STREAM"
+done <<< "$FILES"
+
+if [ "$LEAK" -eq 1 ]; then
+  if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+    echo "  ⚠️  public-surface hit(s) allowed by PUBLIC_SURFACE_OK=1 (conscious, reviewed intent)"
+    echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override (npm publish) — suppressed hit(s) above" \
+      >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+    exit 0
+  fi
+  echo "  An operator-private token would ship in the npm package. Generalize it (real home path → '~'"
+  echo "  or '{project}'; companion/corp name → a generic phrase), or PUBLIC_SURFACE_OK=1 npm publish …"
+  exit 1
+fi
+
+# Renamed with the refactor: the flag is PSA_OVERRIDE_PRESENT, set by psa_load. The bare name was a
+# leftover that referenced nothing under `set -u` and aborted the scan at its final line.
+if [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
+  echo "  ⚠️  PASS (DEFAULTS-ONLY) — no home-path leak, but HIGH operator literals were NOT scanned (override absent)."
+else
+  echo "  ✅ PASS — no operator-private token in the published file set (full pattern set)."
+fi
+# Residual (named, not closed): the scan is a DENYLIST against loaded patterns — an un-patterned secret
+# shape (an API key the patterns don't describe) still ships. This gate is not a general secret-detector.
+exit 0

package/scripts/selfcheck.sh

@@ -83,6 +83,22 @@ else
   fail=1
 fi
 
+# degrade-scan shell probes — the anchor was written 2026-07-28 and shipped with ZERO callers,
+# reproducing [[feedback_built_but_not_wired]] in the same session that cited it. The subject
+# (scripts/degrade_direction_scan.sh) and the anchor both ship, so this runs in package mode too;
+# only a missing SUBJECT is a legitimate skip.
+if [ ! -f scripts/degrade_direction_scan.sh ]; then
+  echo "SKIP  degrade-scan shell probes (subject scripts/degrade_direction_scan.sh absent)"
+elif [ -f scripts/test_degrade_scan_shell_probes.sh ]; then
+  if ! bash scripts/test_degrade_scan_shell_probes.sh; then
+    fail=1
+  fi
+else
+  # subject present, anchor gone => the calibration was deleted. Real failure, not a skip.
+  echo "FAIL  degrade-scan shell probes: scan present but scripts/test_degrade_scan_shell_probes.sh missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 if [ -d ".claude/rules" ]; then

package/scripts/session_close_check.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# session_close_check.sh — mechanical checklist for the session close chain (CLAUDE.md §Session Wrap-up ①–⑥).
+#
+# WHY (loop_engineering.md census, 2026-07-10): the close chain's complete/persist legs were PROSE —
+# card-last ordering and step coverage lived on salience alone, and the measured misses (card
+# staleness class) all landed on exactly these legs. This script is the MECH floor: it VERIFIES
+# state, it does not perform the steps (the session still runs them; the script catches skips).
+# Built on operator instruction 2026-07-10 (strengthen-the-weak pass; evidence-threshold override
+# recorded — the miss class was already measured, only the build trigger was overridden).
+#
+# READ-ONLY. Exit 0 = close state consistent · exit 1 = a close invariant is violated (card-last
+# broken, or a required artifact missing). Advisory lines are prefixed ⚠️ , violations ❌ .
+#
+# Usage: bash scripts/session_close_check.sh [repo_root]   (run at close time, before ⑥ push)
+
+set -uo pipefail
+
+FH="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+TODAY=$(date +%Y-%m-%d)
+CARD="$FH/tracks/_meta/reference_next_session_starter.md"
+FAIL=0
+
+_mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0; }
+
+echo "── session close check: $FH ($TODAY) ──"
+
+# ① status snapshot — uncommitted / unpushed work must be known, not forgotten
+DIRTY=$(git -C "$FH" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
+UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
+[ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
+[ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
+[ "$DIRTY" -eq 0 ] && [ "$UNPUSHED" -eq 0 ] && echo "✅ ① working tree clean, nothing unpushed"
+
+# ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
+if command -v gh >/dev/null 2>&1; then
+  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -c '"number"' || true)
+  [ "${PRS:-0}" -gt 0 ] && echo "⚠️  ①-b $PRS open PR(s) by you — classify: self-mergeable vs awaiting-external"
+fi
+
+# ② FH assets changed today → harvest-loop owed
+# NOTE: no `grep -q` here — under `set -o pipefail`, -q's early exit SIGPIPEs git log (141),
+# masking a real match as pipeline failure so the warning NEVER fired on true positives
+# (caught by a Sonnet blind probe 2026-07-10, 5/5 deterministic repro). `grep -c` reads the
+# whole stream; `|| true` guards its exit-1-on-zero.
+FH_CHANGED=$(git -C "$FH" log --since="today 00:00" --name-only --pretty=format: 2>/dev/null \
+     | grep -cE '^(plugins/.*SKILL\.md|\.claude/rules/|templates/|CLAUDE\.md|knowledge/)' || true)
+if [ "${FH_CHANGED:-0}" -gt 0 ]; then
+  echo "⚠️  ② FH assets changed today ($FH_CHANGED path-touch(es)) — harvest-loop (or an explicit skip note) is owed"
+fi
+
+# ④ real-time completion log — required whenever any commit landed today
+COMMITS_TODAY=$(git -C "$FH" log --since="today 00:00" --oneline 2>/dev/null | wc -l | tr -d ' ')
+FC="$FH/tracks/_meta/fh_completed_${TODAY}.md"
+if [ "$COMMITS_TODAY" -gt 0 ] && [ ! -f "$FC" ]; then
+  echo "❌ ④ commits landed today but tracks/_meta/fh_completed_${TODAY}.md is missing"
+  FAIL=1
+fi
+
+# ④-b npm freshness — files[] assets changed since last version tag → republish owed.
+# Patterns are NARROWED to the actually-shipped subpaths (package.json files[]): knowledge/ ships only
+# shared/{harness-core,dialogue,rules}; docs/ ships only {codex-compat,CONTRIBUTING,pillars}. A broad
+# ^knowledge/ / ^docs/ over-matched git-tracked-but-UNshipped files (e.g. knowledge/shared/learnings/
+# subagent_invocations_log.yaml, which changes almost every self-dev session) → guaranteed per-session
+# false positive that trains the runner to ignore the line (Axis-2 challenger catch 2026-07-13).
+SHIP_RE='^(plugins/|knowledge/shared/(harness-core|dialogue|rules)/|docs/(codex-compat|CONTRIBUTING|pillars)|README|AGENTS\.md|CLAUDE\.md|CHEATSHEET|CATALOG\.md)'
+LAST_TAG=$(git -C "$FH" describe --tags --abbrev=0 2>/dev/null || true)
+if [ -n "$LAST_TAG" ] && [ -f "$FH/package.json" ]; then
+  CHANGED_SINCE_TAG=$(git -C "$FH" diff --name-only "$LAST_TAG"..HEAD 2>/dev/null)
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$SHIP_RE"; then
+    echo "⚠️  ④-b npm-shipped assets changed since $LAST_TAG — propose lockstep republish (never auto)"
+  fi
+  # ④-b-drift: auto-FIRE a drift-CANDIDATE reminder (not a parity verdict) — **in BOTH directions**.
+  # The two entry points are read by DIFFERENT runtimes (CLAUDE.md → Claude Code · AGENTS.md/codex-compat
+  # → Codex/OpenCode and other non-CC runtimes). A rule that lands in only one is INVISIBLE to the other,
+  # so either file changing alone is a candidate — not just the CC→Codex direction.
+  # HONEST SCOPE: this tests file co-occurrence, not topical parity — false-positive (a genuinely
+  # runtime-specific change needs no mirror) and false-negative (file touched for an unrelated reason)
+  # are both possible. The reminder is mechanized; the drift DETERMINATION stays judged (sync, or record
+  # drift:none).
+  # Origin (2026-07-19): the REVERSE direction was unwired and a real miss slipped through — a field
+  # harness's boundary-crossing behavior rules landed in AGENTS.md only, leaving Claude Code sessions
+  # unaware of a rule whose violation destroys a downstream harness's identity. Half a check caught none
+  # of it, because the miss happened to travel the unwired way.
+  _ENTRY_CC='^(CLAUDE\.md|knowledge/shared/(harness-core|dialogue|rules)/)'
+  _ENTRY_CX='^(AGENTS\.md|docs/codex-compat)'
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CC" \
+     && ! printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CX"; then
+    echo "⚠️  ④-b drift candidate (CC→Codex): shipped CLAUDE.md/knowledge changed but AGENTS.md/docs/codex-compat did not — JUDGE entry-point parity (sync, or record drift:none if genuinely unaffected)"
+  fi
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CX" \
+     && ! printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CC"; then
+    echo "⚠️  ④-b drift candidate (Codex→CC): AGENTS.md/docs/codex-compat changed but CLAUDE.md/knowledge did not — JUDGE entry-point parity (a rule living only in AGENTS.md is invisible to Claude Code sessions)"
+  fi
+fi
+
+# ⑤ CARD-LAST invariant — the card must be the NEWEST close artifact. A card older than
+# fh_completed / signal files written this session = ⑤ ran before ①–④ finished (the bug class).
+if [ -f "$CARD" ]; then
+  CARD_E=$(_mtime "$CARD")
+  NEWER=$(find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) -newer "$CARD" 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$NEWER" -gt 0 ]; then
+    echo "❌ ⑤ card-last violated — $NEWER close artifact(s) newer than the session card; re-run ⑤ (delta update)"
+    FAIL=1
+  else
+    echo "✅ ⑤ card is the newest close artifact (card-last holds)"
+  fi
+else
+  echo "❌ ⑤ session card missing: $CARD"
+  FAIL=1
+fi
+
+# ⑤-b card-drift probe — 카드의 "부재 주장"을 실물과 대조 (advisory, never FAIL).
+# WHY (N=3, 2026-07-22 주간감사 🟥1): 카드 🔴 "frontier-digest 미가동 — 로그도 산출물도 0"이
+# 오판정이었다(실측 launchd 14/14 발화·산출 12/14). 07-20 S-4 재발에 이어 3회째 →
+# operations.md §Recurrence escalation: 습관 규칙이 아니라 기계 프로브.
+# HONEST SCOPE: 카드 🔴/🟡 줄에서 부재-주장 키워드를 잡고, 그 줄의 이름/경로 토큰으로
+# 실물을 글롭 검색한다. 어휘가 안 겹치면 못 잡는다(무음 FN) — 앵커지 floor 가 아니다.
+# 방향은 advisory: 가역 표면에서 하드 블록은 --no-verify 를 학습시킨다(#165 HIGH-1 동일 원리).
+_ABSENCE_RE='미가동|산출물[^가-힣]*0|로그[^가-힣]*0|0건|부재|안 돌|미생성|not running|no output|zero output'
+# 부정/정정 문맥 가드 — 부재-주장을 **인용하며** 정정하는 줄만 건너뛴다. 판별자는 debunk
+# 어휘 단독이 아니라 **부재-키워드가 인용부호 안에 있는가** — challenger A-1 실측: 살아있는
+# 주장 + 무관한 '정정 필요' 가 같은 줄이면 debunk-단독 가드가 진짜 경고를 무음 삼켰다(FN).
+_DEBUNK_RE='오판정|정정|거짓|아니었|반증'
+_QUOTED_ABSENCE_RE='["“”'"'"'『][^"“”'"'"'』]*(미가동|부재|미생성)'
+if [ -f "$CARD" ]; then
+  DRIFT_HITS=0
+  while IFS= read -r line; do
+    # 부재-주장 줄에서 검증 가능한 토큰 2계층 추출:
+    #  (a) 명시 경로/글롭 (슬래시나 * 포함) — 그대로 글롭 확장
+    #  (b) 이름 토큰 (하이픈/언더스코어 포함 ≥6자, e.g. frontier-digest) — -/_ 정규화 후
+    #      tracks/_meta{,/logs} 파일명 부분일치 검색
+    # `*` 는 추출 클래스에서 제외 — 마크다운 강조(**tok**)가 토큰에 붙어 글롭 분기로
+    # 오폭한다(known-pair P 픽스처가 잡은 계기 불량, 2026-07-23). 경로 판정은 슬래시로만.
+    tokens=$(printf '%s\n' "$line" | grep -oE '[A-Za-z0-9_./-]+' \
+             | sed 's/^[.-]*//; s/[.-]*$//' \
+             | grep -E '(/|[A-Za-z0-9]+[-_][A-Za-z0-9]+)' | grep -E '.{6,}' \
+             | grep -vE '^[0-9._-]+$' | sort -u)   # 날짜/숫자 토큰 제외 (실카드 FP)
+    [ -z "$tokens" ] && continue
+    while IFS= read -r tok; do
+      found=0
+      case "$tok" in
+        */*)  # (a) 경로 — **파일만** 인정(-f). 디렉토리를 세면 카드의 위치-언급
+              # (tracks/_meta/ 등)이 "실물"로 잡힌다(challenger A-2 FP). 인프라 루트 제외.
+          case "$tok" in tracks/_meta|tracks/_meta/|tracks/_meta/logs|tracks/_meta/logs/) continue ;; esac
+          # shellcheck disable=SC2086
+          for f in $FH/$tok $FH/${tok}*; do [ -f "$f" ] && found=$((found+1)); done ;;
+        *)         # (b) 이름 토큰 — 양쪽 구분자 변형으로 검색
+          norm_u=$(printf '%s' "$tok" | tr '-' '_'); norm_h=$(printf '%s' "$tok" | tr '_' '-')
+          found=$(find "$FH/tracks/_meta" -maxdepth 2 -type f ! -name "$(basename "$CARD")" \( -name "*${norm_u}*" -o -name "*${norm_h}*" \) 2>/dev/null | wc -l | tr -d ' ') ;;
+      esac
+      if [ "${found:-0}" -gt 0 ]; then
+        echo "⚠️  ⑤-b card-drift: 카드가 부재를 주장하는데 실물이 있다 — 토큰 '$tok' 매치 ${found}건. 줄: $(printf '%s' "$line" | cut -c1-80)…"
+        echo "     → 주장을 손검증하라 (미가동≠산출누락 — 07-22 오판정 클래스). advisory, 차단 아님."
+        DRIFT_HITS=$((DRIFT_HITS+1)); break
+      fi
+    done <<CARD_TOK_EOF
+$tokens
+CARD_TOK_EOF
+  done <<CARD_LINE_EOF
+$(grep -E '(🔴|🟡)' "$CARD" 2>/dev/null | grep -E "$_ABSENCE_RE" | grep -v '^description:' \
+   | while IFS= read -r _l; do
+       if printf '%s\n' "$_l" | grep -qE "$_DEBUNK_RE" \
+          && printf '%s\n' "$_l" | grep -qE "$_QUOTED_ABSENCE_RE"; then continue; fi
+       printf '%s\n' "$_l"
+     done || true)
+CARD_LINE_EOF
+  [ "$DRIFT_HITS" -eq 0 ] && echo "✅ ⑤-b no card absence-claim contradicted by on-disk artifacts"
+fi
+
+echo "── close check: $([ "$FAIL" -eq 0 ] && echo CONSISTENT || echo VIOLATIONS) ──"
+exit "$FAIL"