@chrono-meta/fh-gate 1.4.72 → 1.4.73

package/scripts/public_surface_scan_files.sh

@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+# public_surface_scan_files.sh — Pre-Publish confidentiality floor for `npm publish`.
+#
+# Mechanizes the npm-publish half of the Pre-Publish Surface Gate (CLAUDE.md). The pre-commit
+# confidentiality scan sees only the ADDED LINES of this repo's commits; a token committed before
+# that scan existed, or carried in a files[] entry, would otherwise reach the registry unscanned.
+# This scans the FULL CONTENT of the exact npm-published file set (npm pack --dry-run) against the
+# same operator-private patterns, and blocks `npm publish` on a HIGH/MED hit.
+#
+# Honest scope: covers `npm publish` only (wired via package.json prepublishOnly). The separate-repo
+# go-public surface (gh repo create --public / visibility flip / first push to a new public remote) is
+# not an npm or git op against this repo, so no hook here sees it — it stays prose + PRE-PUBLISH-CHECKLIST.md
+# (genuinely un-hookable). Same shape as the Destructive-Op story: git/npm surface mechanized, the
+# separate-repo go-public surface stays prose.
+#
+# Degrade direction: irreversible surface (publish) → fail-CLOSED. Patterns absent, or the published
+# file set unresolved → BLOCK (proceed only on an explicit, logged PUBLIC_SURFACE_OK=1). Never silent-allow.
+#
+# Override (explicit, logged — mirrors the pre-commit PUBLIC_SURFACE_OK channel):
+#   PUBLIC_SURFACE_OK=1 npm publish …   ← after conscious review of the flagged hit(s).
+#
+# Patterns are single-source (shared with the pre-commit scan): .claude/rules/.public-surface-patterns.defaults
+# (committed, universal) + .claude/rules/.public-surface-patterns (gitignored, operator literals).
+
+set -uo pipefail
+
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+PSA_DEFAULTS="$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults"
+PSA_OVERRIDE="${PSA_PATTERNS:-$REPO_ROOT/.claude/rules/.public-surface-patterns}"
+# PSA_PLACEHOLDER and the default psa_low_allowlisted now come from scripts/psa_scan_lib.sh.
+# A second copy here is exactly the divergence this refactor removed; do not reintroduce one.
+
+# LOW-severity allowlist by file (HIGH/MED still block). For the PUBLISH scan this is nearly vacuous:
+# a published file should carry NO operator-private token at all. Deliberately names no operator-private
+# file literal here (the pre-commit copy of this list does, but it lives in a git-hooks-allowlisted path;
+# THIS script is public-tracked, so hardcoding e.g. a companion-script name would itself be a LOW leak —
+# caught by the pre-commit confidentiality scan, 2026-06-27). Generic template paths only.
+
+echo "[Pre-Publish] public-surface scan (npm-published file content)..."
+
+# ── Load patterns via the shared library (scripts/psa_scan_lib.sh) ──
+# One implementation of loading + row validation + exemption decisions, shared with pre-commit and
+# pre-push. What this file KEEPS for itself, deliberately:
+#   • the file-level `grep -a` scan. It forces every published file to be read as TEXT; the library's
+#     line-stream interface would drop back to text-only handling and re-open the hole a challenger
+#     found earlier — a token inside an SVG / null-byte file (docs/pillars.svg ships) scanning clean.
+#   • a STRICTER LOW allowlist (below). A published artifact should carry no operator-private token
+#     at all, so the commit-time list of files that legitimately name wiring tokens does not apply.
+#     Sourcing the library and then redefining the function is how that difference stays visible
+#     instead of being buried as a divergence.
+PSA_LIB="$REPO_ROOT/scripts/psa_scan_lib.sh"
+if [ ! -r "$PSA_LIB" ]; then
+  echo "  ❌ scripts/psa_scan_lib.sh missing — the confidentiality scanner cannot run."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] || { echo "     Fail-closed on the publish boundary."; exit 1; }
+else
+  . "$PSA_LIB"
+fi
+
+# Stricter than the library default — see the note above. Named here so the difference is legible.
+psa_low_allowlisted() {
+  case "$1" in
+    templates/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+psa_load "$PSA_DEFAULTS" "$PSA_OVERRIDE"
+
+# Publish is an irreversible surface: EVERY incomplete-instrument state blocks, including the merely
+# absent operator override (which only warns at commit time — see the library header for why the two
+# surfaces degrade differently).
+_psa_why=""
+[ "$PSA_DEFAULTS_OK" -eq 0 ]      && _psa_why="committed pattern defaults missing/unreadable/empty"
+[ "$PSA_BAD_ROWS" -gt 0 ]         && _psa_why="${_psa_why:+$_psa_why; }$PSA_BAD_ROWS unusable pattern row(s)"
+[ "$PSA_OVERRIDE_PRESENT" -eq 0 ] && _psa_why="${_psa_why:+$_psa_why; }operator-literal override absent/empty (HIGH company/companion literals NOT scanned)"
+if [ -n "$_psa_why" ]; then
+  echo "  ❌ incomplete confidentiality instrument — $_psa_why"
+  if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+    echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1 (conscious — the scan is incomplete)"
+    echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override (npm publish, incomplete instrument)" \
+      >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+  else
+    echo "     Fail-closed on an irreversible surface: an incomplete instrument cannot certify clean."
+    exit 1
+  fi
+fi
+
+
+# Named residual (cross-family audit 2026-06-27, deferred): this scans the WORKING-TREE content of the
+# packed file list, not the final tarball bytes. A content-generating publish lifecycle (prepack/prepare
+# that writes files AFTER this prepublishOnly scan) could ship bytes this never saw, and a path containing
+# a newline would mis-split the list. The robust fix is to scan the actual `npm pack` tarball; deferred
+# because THIS package's lifecycle is content-neutral (prepare = chmod only, no prepack). Re-open if a
+# content-generating lifecycle is ever added.
+# ── Resolve the exact npm-published file set (fail-closed if unresolved OR partial) ──
+FILES=$(npm pack --dry-run --json 2>/dev/null \
+  | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{JSON.parse(s)[0].files.forEach(f=>console.log(f.path))}catch(e){process.exit(3)}})' 2>/dev/null || true)
+if [ -z "$FILES" ]; then
+  echo "  ❌ could not resolve the npm-published file set (npm pack --dry-run failed)."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] && { echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1"; exit 0; }
+  echo "     Fail-closed on an irreversible surface. Fix npm pack or override with PUBLIC_SURFACE_OK=1."
+  exit 1
+fi
+
+# Wrong-set guard (challenger M6): a future npm --json shape change could yield a NON-empty but PARTIAL
+# file list (forEach iterates a renamed/nested structure without throwing) → files silently unscanned.
+# npm always ships package.json in the tarball; its absence means the parse got a wrong set → fail-closed.
+if ! printf '%s\n' "$FILES" | grep -qx "package.json"; then
+  echo "  ❌ published file set looks wrong — 'package.json' (always shipped) is absent from the parse."
+  [ "${PUBLIC_SURFACE_OK:-0}" = "1" ] && { echo "  ⚠️  proceeding by PUBLIC_SURFACE_OK=1"; exit 0; }
+  echo "     Fail-closed (possible npm --json shape change). Verify npm pack output or PUBLIC_SURFACE_OK=1."
+  exit 1
+fi
+
+# ── Scan full content of each published file ──
+LEAK=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  path="$REPO_ROOT/$f"
+  [ -f "$path" ] || continue
+  while IFS=$'\t' read -r sev regex; do
+    [ -z "$regex" ] && continue
+    case "$sev" in \#*) continue;; esac
+    while IFS= read -r tok; do
+      [ -z "$tok" ] && continue
+      printf '%s' "$tok" | grep -qiE "$PSA_PLACEHOLDER" && continue
+      if [ "$sev" = "LOW" ] && psa_low_allowlisted "$f"; then continue; fi
+      echo "  ❌ $sev leak — $f: '$tok' would ship to the registry"
+      LEAK=1
+      # -a forces every published file to scan as TEXT (challenger S1): -I skipped binary-classified
+      # files, so a token in an SVG / null-byte file (docs/pillars.svg ships) would slip unscanned.
+    done <<< "$(grep -aoiE "$regex" "$path" 2>/dev/null | sort -u || true)"
+  done <<< "$PSA_STREAM"
+done <<< "$FILES"
+
+if [ "$LEAK" -eq 1 ]; then
+  if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+    echo "  ⚠️  public-surface hit(s) allowed by PUBLIC_SURFACE_OK=1 (conscious, reviewed intent)"
+    echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override (npm publish) — suppressed hit(s) above" \
+      >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+    exit 0
+  fi
+  echo "  An operator-private token would ship in the npm package. Generalize it (real home path → '~'"
+  echo "  or '{project}'; companion/corp name → a generic phrase), or PUBLIC_SURFACE_OK=1 npm publish …"
+  exit 1
+fi
+
+# Renamed with the refactor: the flag is PSA_OVERRIDE_PRESENT, set by psa_load. The bare name was a
+# leftover that referenced nothing under `set -u` and aborted the scan at its final line.
+if [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
+  echo "  ⚠️  PASS (DEFAULTS-ONLY) — no home-path leak, but HIGH operator literals were NOT scanned (override absent)."
+else
+  echo "  ✅ PASS — no operator-private token in the published file set (full pattern set)."
+fi
+# Residual (named, not closed): the scan is a DENYLIST against loaded patterns — an un-patterned secret
+# shape (an API key the patterns don't describe) still ships. This gate is not a general secret-detector.
+exit 0

package/scripts/selfcheck.sh

@@ -83,6 +83,22 @@ else
   fail=1
 fi
 
+# degrade-scan shell probes — the anchor was written 2026-07-28 and shipped with ZERO callers,
+# reproducing [[feedback_built_but_not_wired]] in the same session that cited it. The subject
+# (scripts/degrade_direction_scan.sh) and the anchor both ship, so this runs in package mode too;
+# only a missing SUBJECT is a legitimate skip.
+if [ ! -f scripts/degrade_direction_scan.sh ]; then
+  echo "SKIP  degrade-scan shell probes (subject scripts/degrade_direction_scan.sh absent)"
+elif [ -f scripts/test_degrade_scan_shell_probes.sh ]; then
+  if ! bash scripts/test_degrade_scan_shell_probes.sh; then
+    fail=1
+  fi
+else
+  # subject present, anchor gone => the calibration was deleted. Real failure, not a skip.
+  echo "FAIL  degrade-scan shell probes: scan present but scripts/test_degrade_scan_shell_probes.sh missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 if [ -d ".claude/rules" ]; then

package/scripts/session_close_check.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# session_close_check.sh — mechanical checklist for the session close chain (CLAUDE.md §Session Wrap-up ①–⑥).
+#
+# WHY (loop_engineering.md census, 2026-07-10): the close chain's complete/persist legs were PROSE —
+# card-last ordering and step coverage lived on salience alone, and the measured misses (card
+# staleness class) all landed on exactly these legs. This script is the MECH floor: it VERIFIES
+# state, it does not perform the steps (the session still runs them; the script catches skips).
+# Built on operator instruction 2026-07-10 (strengthen-the-weak pass; evidence-threshold override
+# recorded — the miss class was already measured, only the build trigger was overridden).
+#
+# READ-ONLY. Exit 0 = close state consistent · exit 1 = a close invariant is violated (card-last
+# broken, or a required artifact missing). Advisory lines are prefixed ⚠️ , violations ❌ .
+#
+# Usage: bash scripts/session_close_check.sh [repo_root]   (run at close time, before ⑥ push)
+
+set -uo pipefail
+
+FH="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+TODAY=$(date +%Y-%m-%d)
+CARD="$FH/tracks/_meta/reference_next_session_starter.md"
+FAIL=0
+
+_mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0; }
+
+echo "── session close check: $FH ($TODAY) ──"
+
+# ① status snapshot — uncommitted / unpushed work must be known, not forgotten
+DIRTY=$(git -C "$FH" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
+UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
+[ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
+[ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
+[ "$DIRTY" -eq 0 ] && [ "$UNPUSHED" -eq 0 ] && echo "✅ ① working tree clean, nothing unpushed"
+
+# ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
+if command -v gh >/dev/null 2>&1; then
+  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -c '"number"' || true)
+  [ "${PRS:-0}" -gt 0 ] && echo "⚠️  ①-b $PRS open PR(s) by you — classify: self-mergeable vs awaiting-external"
+fi
+
+# ② FH assets changed today → harvest-loop owed
+# NOTE: no `grep -q` here — under `set -o pipefail`, -q's early exit SIGPIPEs git log (141),
+# masking a real match as pipeline failure so the warning NEVER fired on true positives
+# (caught by a Sonnet blind probe 2026-07-10, 5/5 deterministic repro). `grep -c` reads the
+# whole stream; `|| true` guards its exit-1-on-zero.
+FH_CHANGED=$(git -C "$FH" log --since="today 00:00" --name-only --pretty=format: 2>/dev/null \
+     | grep -cE '^(plugins/.*SKILL\.md|\.claude/rules/|templates/|CLAUDE\.md|knowledge/)' || true)
+if [ "${FH_CHANGED:-0}" -gt 0 ]; then
+  echo "⚠️  ② FH assets changed today ($FH_CHANGED path-touch(es)) — harvest-loop (or an explicit skip note) is owed"
+fi
+
+# ④ real-time completion log — required whenever any commit landed today
+COMMITS_TODAY=$(git -C "$FH" log --since="today 00:00" --oneline 2>/dev/null | wc -l | tr -d ' ')
+FC="$FH/tracks/_meta/fh_completed_${TODAY}.md"
+if [ "$COMMITS_TODAY" -gt 0 ] && [ ! -f "$FC" ]; then
+  echo "❌ ④ commits landed today but tracks/_meta/fh_completed_${TODAY}.md is missing"
+  FAIL=1
+fi
+
+# ④-b npm freshness — files[] assets changed since last version tag → republish owed.
+# Patterns are NARROWED to the actually-shipped subpaths (package.json files[]): knowledge/ ships only
+# shared/{harness-core,dialogue,rules}; docs/ ships only {codex-compat,CONTRIBUTING,pillars}. A broad
+# ^knowledge/ / ^docs/ over-matched git-tracked-but-UNshipped files (e.g. knowledge/shared/learnings/
+# subagent_invocations_log.yaml, which changes almost every self-dev session) → guaranteed per-session
+# false positive that trains the runner to ignore the line (Axis-2 challenger catch 2026-07-13).
+SHIP_RE='^(plugins/|knowledge/shared/(harness-core|dialogue|rules)/|docs/(codex-compat|CONTRIBUTING|pillars)|README|AGENTS\.md|CLAUDE\.md|CHEATSHEET|CATALOG\.md)'
+LAST_TAG=$(git -C "$FH" describe --tags --abbrev=0 2>/dev/null || true)
+if [ -n "$LAST_TAG" ] && [ -f "$FH/package.json" ]; then
+  CHANGED_SINCE_TAG=$(git -C "$FH" diff --name-only "$LAST_TAG"..HEAD 2>/dev/null)
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$SHIP_RE"; then
+    echo "⚠️  ④-b npm-shipped assets changed since $LAST_TAG — propose lockstep republish (never auto)"
+  fi
+  # ④-b-drift: auto-FIRE a drift-CANDIDATE reminder (not a parity verdict) — **in BOTH directions**.
+  # The two entry points are read by DIFFERENT runtimes (CLAUDE.md → Claude Code · AGENTS.md/codex-compat
+  # → Codex/OpenCode and other non-CC runtimes). A rule that lands in only one is INVISIBLE to the other,
+  # so either file changing alone is a candidate — not just the CC→Codex direction.
+  # HONEST SCOPE: this tests file co-occurrence, not topical parity — false-positive (a genuinely
+  # runtime-specific change needs no mirror) and false-negative (file touched for an unrelated reason)
+  # are both possible. The reminder is mechanized; the drift DETERMINATION stays judged (sync, or record
+  # drift:none).
+  # Origin (2026-07-19): the REVERSE direction was unwired and a real miss slipped through — a field
+  # harness's boundary-crossing behavior rules landed in AGENTS.md only, leaving Claude Code sessions
+  # unaware of a rule whose violation destroys a downstream harness's identity. Half a check caught none
+  # of it, because the miss happened to travel the unwired way.
+  _ENTRY_CC='^(CLAUDE\.md|knowledge/shared/(harness-core|dialogue|rules)/)'
+  _ENTRY_CX='^(AGENTS\.md|docs/codex-compat)'
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CC" \
+     && ! printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CX"; then
+    echo "⚠️  ④-b drift candidate (CC→Codex): shipped CLAUDE.md/knowledge changed but AGENTS.md/docs/codex-compat did not — JUDGE entry-point parity (sync, or record drift:none if genuinely unaffected)"
+  fi
+  if printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CX" \
+     && ! printf '%s\n' "$CHANGED_SINCE_TAG" | grep -qE "$_ENTRY_CC"; then
+    echo "⚠️  ④-b drift candidate (Codex→CC): AGENTS.md/docs/codex-compat changed but CLAUDE.md/knowledge did not — JUDGE entry-point parity (a rule living only in AGENTS.md is invisible to Claude Code sessions)"
+  fi
+fi
+
+# ⑤ CARD-LAST invariant — the card must be the NEWEST close artifact. A card older than
+# fh_completed / signal files written this session = ⑤ ran before ①–④ finished (the bug class).
+if [ -f "$CARD" ]; then
+  CARD_E=$(_mtime "$CARD")
+  NEWER=$(find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) -newer "$CARD" 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$NEWER" -gt 0 ]; then
+    echo "❌ ⑤ card-last violated — $NEWER close artifact(s) newer than the session card; re-run ⑤ (delta update)"
+    FAIL=1
+  else
+    echo "✅ ⑤ card is the newest close artifact (card-last holds)"
+  fi
+else
+  echo "❌ ⑤ session card missing: $CARD"
+  FAIL=1
+fi
+
+# ⑤-b card-drift probe — 카드의 "부재 주장"을 실물과 대조 (advisory, never FAIL).
+# WHY (N=3, 2026-07-22 주간감사 🟥1): 카드 🔴 "frontier-digest 미가동 — 로그도 산출물도 0"이
+# 오판정이었다(실측 launchd 14/14 발화·산출 12/14). 07-20 S-4 재발에 이어 3회째 →
+# operations.md §Recurrence escalation: 습관 규칙이 아니라 기계 프로브.
+# HONEST SCOPE: 카드 🔴/🟡 줄에서 부재-주장 키워드를 잡고, 그 줄의 이름/경로 토큰으로
+# 실물을 글롭 검색한다. 어휘가 안 겹치면 못 잡는다(무음 FN) — 앵커지 floor 가 아니다.
+# 방향은 advisory: 가역 표면에서 하드 블록은 --no-verify 를 학습시킨다(#165 HIGH-1 동일 원리).
+_ABSENCE_RE='미가동|산출물[^가-힣]*0|로그[^가-힣]*0|0건|부재|안 돌|미생성|not running|no output|zero output'
+# 부정/정정 문맥 가드 — 부재-주장을 **인용하며** 정정하는 줄만 건너뛴다. 판별자는 debunk
+# 어휘 단독이 아니라 **부재-키워드가 인용부호 안에 있는가** — challenger A-1 실측: 살아있는
+# 주장 + 무관한 '정정 필요' 가 같은 줄이면 debunk-단독 가드가 진짜 경고를 무음 삼켰다(FN).
+_DEBUNK_RE='오판정|정정|거짓|아니었|반증'
+_QUOTED_ABSENCE_RE='["“”'"'"'『][^"“”'"'"'』]*(미가동|부재|미생성)'
+if [ -f "$CARD" ]; then
+  DRIFT_HITS=0
+  while IFS= read -r line; do
+    # 부재-주장 줄에서 검증 가능한 토큰 2계층 추출:
+    #  (a) 명시 경로/글롭 (슬래시나 * 포함) — 그대로 글롭 확장
+    #  (b) 이름 토큰 (하이픈/언더스코어 포함 ≥6자, e.g. frontier-digest) — -/_ 정규화 후
+    #      tracks/_meta{,/logs} 파일명 부분일치 검색
+    # `*` 는 추출 클래스에서 제외 — 마크다운 강조(**tok**)가 토큰에 붙어 글롭 분기로
+    # 오폭한다(known-pair P 픽스처가 잡은 계기 불량, 2026-07-23). 경로 판정은 슬래시로만.
+    tokens=$(printf '%s\n' "$line" | grep -oE '[A-Za-z0-9_./-]+' \
+             | sed 's/^[.-]*//; s/[.-]*$//' \
+             | grep -E '(/|[A-Za-z0-9]+[-_][A-Za-z0-9]+)' | grep -E '.{6,}' \
+             | grep -vE '^[0-9._-]+$' | sort -u)   # 날짜/숫자 토큰 제외 (실카드 FP)
+    [ -z "$tokens" ] && continue
+    while IFS= read -r tok; do
+      found=0
+      case "$tok" in
+        */*)  # (a) 경로 — **파일만** 인정(-f). 디렉토리를 세면 카드의 위치-언급
+              # (tracks/_meta/ 등)이 "실물"로 잡힌다(challenger A-2 FP). 인프라 루트 제외.
+          case "$tok" in tracks/_meta|tracks/_meta/|tracks/_meta/logs|tracks/_meta/logs/) continue ;; esac
+          # shellcheck disable=SC2086
+          for f in $FH/$tok $FH/${tok}*; do [ -f "$f" ] && found=$((found+1)); done ;;
+        *)         # (b) 이름 토큰 — 양쪽 구분자 변형으로 검색
+          norm_u=$(printf '%s' "$tok" | tr '-' '_'); norm_h=$(printf '%s' "$tok" | tr '_' '-')
+          found=$(find "$FH/tracks/_meta" -maxdepth 2 -type f ! -name "$(basename "$CARD")" \( -name "*${norm_u}*" -o -name "*${norm_h}*" \) 2>/dev/null | wc -l | tr -d ' ') ;;
+      esac
+      if [ "${found:-0}" -gt 0 ]; then
+        echo "⚠️  ⑤-b card-drift: 카드가 부재를 주장하는데 실물이 있다 — 토큰 '$tok' 매치 ${found}건. 줄: $(printf '%s' "$line" | cut -c1-80)…"
+        echo "     → 주장을 손검증하라 (미가동≠산출누락 — 07-22 오판정 클래스). advisory, 차단 아님."
+        DRIFT_HITS=$((DRIFT_HITS+1)); break
+      fi
+    done <<CARD_TOK_EOF
+$tokens
+CARD_TOK_EOF
+  done <<CARD_LINE_EOF
+$(grep -E '(🔴|🟡)' "$CARD" 2>/dev/null | grep -E "$_ABSENCE_RE" | grep -v '^description:' \
+   | while IFS= read -r _l; do
+       if printf '%s\n' "$_l" | grep -qE "$_DEBUNK_RE" \
+          && printf '%s\n' "$_l" | grep -qE "$_QUOTED_ABSENCE_RE"; then continue; fi
+       printf '%s\n' "$_l"
+     done || true)
+CARD_LINE_EOF
+  [ "$DRIFT_HITS" -eq 0 ] && echo "✅ ⑤-b no card absence-claim contradicted by on-disk artifacts"
+fi
+
+echo "── close check: $([ "$FAIL" -eq 0 ] && echo CONSISTENT || echo VIOLATIONS) ──"
+exit "$FAIL"

package/scripts/test_degrade_scan_shell_probes.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# test_degrade_scan_shell_probes.sh — regression anchor for the shell (S*) probes of
+# scripts/degrade_direction_scan.sh.
+#
+# WHY THIS EXISTS (measured 2026-07-28, known-pair calibration):
+#   The scan COLLECTED `.sh` files but every probe was Python-shaped (`except:` / `.get(k, True)` /
+#   `if not x:` / `.split()`). A known-positive bash file carrying four distinct default-toward-PASS
+#   shapes scored 0/4 and the scan printed "no default-toward-PASS smells in 1 scanned py/sh file".
+#   That is a FALSE CLEAN — strictly worse than honest non-coverage, because a caller keying on the
+#   message or exit code reads it as verified.
+#   A second, larger hole surfaced in the same run: git hooks are named `pre-push` / `pre-commit`
+#   (no extension) and live under a DOTTED directory, so `templates/.git-hooks` — FH's own mechanical
+#   floor — reported "no scannable (py/sh) target files", exit 0.
+#
+# The assertions below pin: (1) the S-probes separate a known pair, (2) extensionless shell files
+# under a dotted directory are collected, (3) the Python probes did not regress, and (4) two
+# deliberate NON-detections stay non-detections — flagging them would push an author to delete a
+# remedy or to silence a legitimate precondition guard.
+#
+# Usage:  bash scripts/test_degrade_scan_shell_probes.sh
+# Exit:   0 = all assertions pass; 1 = a regression.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCAN="$REPO_ROOT/scripts/degrade_direction_scan.sh"
+[ -f "$SCAN" ] || { echo "FAIL: $SCAN not found"; exit 1; }
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+pass=0; fail=0
+ok()   { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad()  { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+# Count S-probe hit lines. Deliberately counts the probe TAG, not the summary line: a summary can say
+# "clean" for reasons unrelated to detection, and this anchor must not be satisfiable by prose.
+s_hits() { bash "$SCAN" "$@" 2>&1 | grep -cE '\[S[0-9]:'; }
+p_hits() { bash "$SCAN" "$@" 2>&1 | grep -cE '\[[A-F][0-9]?:'; }
+rc_of()  { bash "$SCAN" "$@" >/dev/null 2>&1; echo $?; }
+
+# ── Fixtures ────────────────────────────────────────────────────────────────────────
+# Known POSITIVE: four distinct shell-shaped default-toward-PASS constructs, one per probe.
+cat > "$TMP/known_positive.sh" <<'EOF'
+#!/usr/bin/env bash
+check_secret() {
+  scan_output=$(run_scanner "$1") || return 0        # S1: the check errored -> report success
+  if [ -z "$scan_output" ]; then
+    return 0                                          # S4: empty == errored == "clean"
+  fi
+  return 1
+}
+verdict=$(get_verdict) || verdict="PASS"              # S3: unresolved -> permissive verdict
+if [ "$verdict" = "BLOCK" ]; then
+  exit 1
+else
+  exit 0                                              # S2: unenumerated case -> allow
+fi
+EOF
+
+# Known NEGATIVE: the same logic written fail-closed. Must stay silent, or the probes are noise.
+cat > "$TMP/known_negative.sh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+check_secret() {
+  if ! scan_output=$(run_scanner "$1"); then
+    echo "scanner failed - fail closed" >&2; return 1
+  fi
+  [ -n "$scan_output" ] && return 1
+  return 0
+}
+EOF
+
+# Extensionless hook under a DOTTED directory — the collection bug's exact shape.
+mkdir -p "$TMP/.git-hooks"
+cat > "$TMP/.git-hooks/pre-push" <<'EOF'
+#!/usr/bin/env bash
+verdict=$(classify_refs) || verdict="ALLOW"
+EOF
+
+# Deliberate NON-detections.
+cat > "$TMP/non_detections.sh" <<'EOF'
+#!/usr/bin/env bash
+# (a) integer sanitization — the PRESCRIBED remedy for the pipefail-fallback class, not the defect.
+count=$(grep -c pattern file)
+if [ "${count:-0}" -gt 0 ]; then echo "found"; fi
+# (b) SCOPE guards — "this run does not apply here" is not a claim that a check passed.
+[ -d "$HOME/projects" ] || exit 0
+[[ "$1" =~ ^[0-9]{4}$ ]] || return 0
+EOF
+
+# DEPENDENCY guards must NOT be swept up by the scope-guard exclusion above. `[ -f lib ] || exit 0`
+# says "my guard library is missing, therefore allow" — the fail-open shape measured on qasp
+# 2026-07-28. An earlier draft of the scoping hid it; this fixture pins the distinction.
+cat > "$TMP/dependency_guards.sh" <<'EOF'
+#!/usr/bin/env bash
+[ -f "$GUARD_LIB" ] || exit 0
+[ -x "$SCANNER" ] || exit 0
+EOF
+
+# Python known-pair — the pre-existing probes must not have regressed.
+printf 'def f(x):\n    try:\n        return g(x)\n    except Exception:\n        return True\n' > "$TMP/kp.py"
+printf 'def f(x):\n    try:\n        return g(x)\n    except Exception:\n        raise\n' > "$TMP/kn.py"
+
+# ── Assertions ──────────────────────────────────────────────────────────────────────
+echo "degrade-scan shell-probe regression anchor"
+
+n=$(s_hits "$TMP/known_positive.sh")
+[ "$n" -eq 4 ] && ok "known-positive .sh: 4/4 shell smells detected" \
+                || bad "known-positive .sh: expected 4 S-hits, got $n (probes blind to bash again)"
+
+rc=$(rc_of "$TMP/known_positive.sh")
+[ "$rc" -eq 2 ] && ok "known-positive .sh: advisory exit 2" \
+                || bad "known-positive .sh: expected exit 2, got $rc"
+
+n=$(s_hits "$TMP/known_negative.sh")
+[ "$n" -eq 0 ] && ok "known-negative .sh: silent (probes discriminate, not just fire)" \
+                || bad "known-negative .sh: expected 0 S-hits, got $n"
+
+rc=$(rc_of "$TMP/known_negative.sh")
+[ "$rc" -eq 0 ] && ok "known-negative .sh: exit 0" \
+                || bad "known-negative .sh: expected exit 0, got $rc"
+
+# Directory walk must reach an extensionless shell file inside a dotted directory.
+n=$(s_hits "$TMP/.git-hooks")
+[ "$n" -ge 1 ] && ok "extensionless hook under a dotted dir: collected and scanned" \
+                || bad "extensionless hook under a dotted dir: not scanned ($n hits) — the git-hook floor is invisible again"
+
+# ...and so must an explicit file argument naming it.
+n=$(s_hits "$TMP/.git-hooks/pre-push")
+[ "$n" -ge 1 ] && ok "extensionless hook as a direct file argument: scanned" \
+                || bad "extensionless hook as a direct file argument: not scanned ($n hits)"
+
+n=$(s_hits "$TMP/non_detections.sh")
+[ "$n" -eq 0 ] && ok "non-detections stay silent (\${v:-0} sanitization + precondition guards)" \
+                || bad "non-detections fired $n time(s) — flagging the remedy trains authors to delete it"
+
+# A DOTTED shell filename (`helper.bash`) must not be silently dropped from a directory walk.
+# Cross-family finding (gpt-5.5, 2026-07-28), reproduced before acceptance: the directory path
+# dropped it in silence while the explicit-file path reported the same file as UNSCANNABLE.
+# Silent on one path, honest on the other, is the fail-open half.
+mkdir -p "$TMP/dotted"
+cat > "$TMP/dotted/helper.bash" <<'EOF'
+#!/usr/bin/env bash
+scan=$(run_scanner "$1") || return 0
+EOF
+cat > "$TMP/dotted/gate.sh" <<'EOF'
+#!/usr/bin/env bash
+scan=$(run_scanner "$1") || return 0
+EOF
+n=$(s_hits "$TMP/dotted")
+[ "$n" -eq 2 ] && ok "dotted shell filename (helper.bash) scanned alongside gate.sh in a directory walk" \
+                || bad "dotted shell filename: expected 2 S-hits, got $n — a .bash/.zsh gate is silently dropped again"
+
+n=$(s_hits "$TMP/dependency_guards.sh")
+[ "$n" -eq 2 ] && ok "dependency guards (\`[ -f lib ] || exit 0\`) still detected — scope exclusion did not swallow them" \
+                || bad "dependency guards: expected 2 S-hits, got $n — 'guard library missing → allow' is hidden again"
+
+n=$(p_hits "$TMP/kp.py")
+[ "$n" -ge 1 ] && ok "python known-positive: pre-existing probes still fire" \
+                || bad "python known-positive: no hits — the Python probes regressed"
+
+n=$(p_hits "$TMP/kn.py")
+[ "$n" -eq 0 ] && ok "python known-negative: still silent" \
+                || bad "python known-negative: $n hit(s) — Python probes became noisy"
+
+# The field-propagated copy must not drift from the canonical one. Two copies of the same
+# normalizer diverge, and the lenient half silently drops what the strict half catches — measured
+# 2026-07-28: `templates/` was 2 lines behind BEFORE this session's fix and then a full 8 KB behind
+# after it, so field harnesses (the ones the cross-family gate doc actually points at) were running
+# the version that scored 0/4 on the known-positive while `scripts/` scored 4/4.
+TPL="$REPO_ROOT/templates/degrade_direction_scan.sh"
+if [ ! -d "$REPO_ROOT/templates" ]; then
+  # Package mode: the npm tarball may ship a narrower surface. Absent templates/ is not drift.
+  printf '  \u2013 field-copy drift check SKIPPED (no templates/ — package mode)\n'
+elif [ ! -f "$TPL" ]; then
+  bad "templates/ exists but degrade_direction_scan.sh is MISSING there — field harnesses get no scan"
+elif cmp -s "$TPL" "$SCAN"; then
+  ok "field-propagated copy is byte-identical to scripts/ (no divergent-normalizer drift)"
+else
+  bad "templates/degrade_direction_scan.sh has DRIFTED from scripts/ — the field copy is what qasp/pmh run; sync it (cp scripts/degrade_direction_scan.sh templates/)"
+fi
+
+echo "----"
+echo "degrade-scan shell probes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1