@chrono-meta/fh-gate 1.4.72 → 1.4.73

package/templates/.git-hooks/pre-commit

@@ -0,0 +1,848 @@
+#!/usr/bin/env bash
+# FH 4-Axis Gate Pre-Commit Hook
+#
+# Blocks git commit when FH assets are staged unless all required axes have passed.
+# Full gate (all 4 axes): SKILL.md · .claude/rules/ · knowledge/shared/rules/ · templates/ · CLAUDE.md
+#                         + substantive knowledge/ · docs/*.md · AGENTS.md
+# Lightweight gate (Axis 1+4 only): CATALOG.md · tracks/ · prose-only carve-out docs
+#
+# Carve-out (knowledge/ · docs/*.md · AGENTS.md): these are FULL gate only when the
+# staged diff is *substantive* — adds a fenced code block (```) or a factual claim
+# token (arXiv: / DOI / http / a versioned dependency like x.y.z). Prose-only edits
+# (typos, rewording, link text) stay lightweight. Mirrors CLAUDE.md §Substantive carve-out.
+#
+# Install (one-time, from repo root):
+#   git config core.hooksPath templates/.git-hooks
+#   chmod +x templates/.git-hooks/pre-commit
+
+set -uo pipefail
+
+REPO_ROOT=$(git rev-parse --show-toplevel)
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+TODAY=$(date +%Y-%m-%d)
+BRANCH_SLUG="${BRANCH//\//_}"
+FAILED=0
+
+# ── Is a path inside the gated (carve-out) namespace? ─────────────────────────
+# Mirror of the CARVEOUT classifier below. Used to tell a rename WITHIN the gated
+# namespace (already-reviewed content relocating) from a rename INTO it from outside
+# (content gated for the first time → must be scanned in full).
+is_carveout_path() {
+  echo "$1" | grep -qE '(^knowledge/.*\.md$|^docs/.*\.md$|(^|/)AGENTS\.md$)'
+}
+
+# ── Helper: is a carve-out file's staged change substantive? ──────────────────
+# Substantive ⇔ the content this commit puts into the gated file introduces a code
+# fence (``` / ~~~, possibly indented) or a citation/version token. Mechanical.
+#
+# "What content is new to the gate" differs by change shape:
+#  - plain edit/add (no rename): the staged DIFF additions — spec "diff adds …",
+#    so a prose/typo fix to a doc that already contains a fence stays light.
+#  - rename WITHIN the gated namespace (docs/→docs/, knowledge/→…): the rename-paired
+#    diff — a pure move adds nothing (light); a move+edit shows only the real delta.
+#  - rename INTO the gated namespace from outside (root→docs/, scratch→docs/): the
+#    file is gated for the FIRST time, so its ENTIRE staged content is new to the gate
+#    and is scanned whole. Otherwise content authored in an ungated path could be
+#    `git mv`'d into docs/ to evade review (fh_signal_2026-06-08_hook-rename-false-positive,
+#    challenger S1). Filtering by the new path alone also breaks rename pairing, which
+#    was the original false positive on pure within-scope moves.
+# Fails CLOSED (returns substantive) on any git error — a gate must not fail open.
+diff_is_substantive() {
+  local file="$1" body rc oldpath mode
+  oldpath=$(git diff --cached -M --name-status 2>/dev/null \
+            | awk -F'\t' -v f="$file" '$1 ~ /^R/ && $3 == f { print $2; exit }')
+  if [ -n "$oldpath" ] && ! is_carveout_path "$oldpath"; then
+    body=$(git show ":$file" 2>/dev/null); rc=$?; mode=whole   # into-scope: whole file
+  elif [ -n "$oldpath" ]; then
+    body=$(git diff --cached -M -- "$oldpath" "$file" 2>/dev/null); rc=$?; mode=diff
+  else
+    body=$(git diff --cached -- "$file" 2>/dev/null); rc=$?; mode=diff
+  fi
+  [ "$rc" -ne 0 ] && return 0   # git error → fail closed (demand review)
+
+  # In diff mode only ADDED lines count (removed/context lines near a fence must not
+  # false-match); in whole mode the raw file content is the body. Strip exactly ONE
+  # leading '+' rather than excluding '^+++' — an added content line beginning with
+  # '++' renders as '+++…' and a pattern-exclude would silently drop it (challenger
+  # A-grade). The diff file-header '+++ b/path' degrades to a harmless '++ b/path'.
+  if [ "$mode" = diff ]; then
+    body=$(printf '%s\n' "$body" | grep -E '^\+' | sed 's/^\+//' || true)
+  fi
+  # Fenced code block (leading indentation allowed), OR a citation/version token.
+  if printf '%s\n' "$body" | grep -qE '^[[:space:]]*(```|~~~)'; then
+    return 0
+  fi
+  if printf '%s\n' "$body" | grep -qE 'arXiv:|DOI|https?://|[0-9]+\.[0-9]+\.[0-9]+'; then
+    return 0
+  fi
+  return 1
+}
+
+# ── Classify staged changes ──────────────────────────────────────────────────
+# `-c core.quotePath=false` — git QUOTES non-ASCII paths by default ("\354\234\240...md"), and a
+# quoted name matches no real file downstream, so a staged Korean-named file scanned CLEAN
+# (cross-family audit R2, 2026-07-26). `--no-renames` — with rename detection ON, `git mv`-ing this
+# hook out of templates/ reported ONLY the destination, so HEAVY and UGUARD_IMPL came up empty and a
+# commit could DELETE the gate while the gate said PASS. Disabling rename detection lists both the
+# old path (deletion) and the new one, so moving a protected file out is still a protected-path edit.
+# NUL-delimited here too (R4, 2026-07-26): quotePath=false stops NON-ASCII quoting, but git still
+# C-quotes a path containing a backslash, and the quoted spelling matches none of the classifier's
+# path terms — so `scripts/back\slash.sh` (a governance script by every rule FH has) dropped clean
+# through to "no FH assets staged". Fixing only the confidentiality loop left this half open: same
+# defect class, second location, which is the propagation-boundary failure this repo keeps hitting.
+STAGED=$(git -c core.quotePath=false diff --cached --name-only --no-renames -z 2>/dev/null | tr '\0' '\n' || true)
+# A literal NEWLINE inside a tracked filename cannot be represented in a line-oriented classifier at
+# all, so it is not silently mis-classified — it fails closed.
+# The first version of this check compared a NUL count to a line count. That was wrong in exactly one
+# direction: `$(...)` strips TRAILING newlines, so a path ending in a newline lost its extra line and
+# the two counts agreed — a middle newline blocked, a trailing one sailed through (R5 audit,
+# 2026-07-26). Counting is the wrong instrument here; inspect each record instead, which cannot be
+# fooled by where in the name the newline sits.
+# NL must come from $'\n', NOT from $(printf '\n'): command substitution strips trailing newlines,
+# so $(printf '\n') is the EMPTY string and `case $p in *""*` matches EVERY path — the detector for
+# trailing-newline paths, defeated by trailing-newline stripping, firing on all 10 staged files of an
+# ordinary commit. Caught by running it on this repo (self-dogfood), not by reading it. Known-pair
+# calibrated after the fix: an ordinary path passes, a path containing a newline blocks.
+_NL=$'\n'
+_badpath=0
+while IFS= read -r -d '' _p; do
+  case "$_p" in *"$_NL"*) _badpath=1 ;; esac
+done < <(git -c core.quotePath=false diff --cached --name-only --no-renames -z 2>/dev/null || true)
+if [ "$_badpath" -eq 1 ]; then
+  echo "❌ BLOCKED — a staged path contains a newline; this gate's path classifier cannot represent it."
+  echo "   Rename the file. (Fail-closed: an unclassifiable path must not be read as 'not an FH asset'.)"
+  exit 1
+fi
+
+# Always-heavy by path (any change is a full gate).
+# scripts/*.sh included (2026-06-26, fh_signal fh-gate-structured-verdict): FH's scripts/
+# dir holds the governance/enforcement engines (fh-gate.sh, below_floor_scan.sh,
+# dlp-filter.sh, …) — the gate's OWN tooling. Leaving it ungated was a gate-locality
+# seam: the engine that enforces the 4-axis could itself ship unverified. Gated broadly,
+# not by an allowlist, so a NEW gate script cannot silently slip in ungated (the drift
+# that would re-open the seam). Scope is `scripts/*.sh` BY CONVENTION (all current gate
+# engines are .sh under scripts/): a governance script with another extension (.py) or
+# placed elsewhere (bin/) is NOT auto-caught and must be hand-gated — broaden this term
+# if that changes. Axis 1 (regression_guard) skips non-markdown, so the live effect on a
+# script is Axes 2-3 (adversarial design + phantom), NOT behavioral regression — that is
+# covered downstream (selfcheck.sh / count_check.sh at publish), not by this commit gate.
+# seam #3 (2026-06-27): agent definitions (plugins/*/agents/*.md, .claude/agents/*.md) are
+# salience-dependent FH assets — a sub-agent follows its prose prompt, the exact class the gate +
+# target-tier-sim discipline targets — yet matched NONE of the HEAVY terms above, so a behavioral
+# change to an agent could ship with only Axis 1+4. Gated broadly (whole file, not substantive-only):
+# an agent .md IS a behavioral spec, so even "prose" edits change behavior (unlike knowledge/ docs,
+# which carve out pure-prose edits). N=3 of the gate-locality class (scripts/ 06-26, AGENTS.md
+# inheritance #111/#117). If pure-doc agent .md edits over-friction in practice, add a substantive
+# carve-out like CARVEOUT below.
+# seam #4 (2026-07-26): SKILL_detail.md. The term above was `SKILL\.md`, and the string
+# "SKILL_detail.md" does NOT contain "SKILL.md" — the underscore breaks it — so every detail file
+# matched NOTHING here and nothing in regression_guard's pathspec either. Measured: 17 files /
+# 208,710 B = 27.7% of the skill-spec surface, 16 of 17 carrying fenced code blocks. It LEAKED
+# twice for real (371c04f, e661931 — both single-file edits to phantom-quench/SKILL_detail.md,
+# i.e. a gate skill's own behavioral spec changed with zero 4-axis coverage). N=4 of the
+# gate-locality class. Worst property: salience-splitter WIDENS this hole every time it moves
+# content out of SKILL.md to lean the resident layer — coverage shrank as the diet progressed.
+# Over-firing measured before shipping: of the last 60 commits, 28 touched a detail file and 26
+# already tripped HEAVY via a companion file, so this adds a heavy path to ~7% of them.
+HEAVY=$(echo "$STAGED" \
+  | grep -E "(SKILL(_detail)?\.md|^plugins/[^/]+/skills/[^/]+/.*\.md$|\.claude/rules/|^knowledge/shared/rules/|templates/|CLAUDE\.md|^scripts/.*\.sh$|^plugins/[^/]+/agents/.*\.md$|^\.claude/agents/.*\.md$)" || true)
+
+# Carve-out candidates: knowledge/ docs, docs/*.md, AGENTS.md. Heavy only if substantive.
+CARVEOUT=$(echo "$STAGED" \
+  | grep -E "(^knowledge/.*\.md$|^docs/.*\.md$|(^|/)AGENTS\.md$)" | grep -v "^knowledge/shared/rules/" || true)
+
+# Always-light by path.
+LIGHT=$(echo "$STAGED" \
+  | grep -E "(CATALOG\.md|^tracks/)" || true)
+
+# Evaluate carve-out files: substantive ones promote to HEAVY, the rest are LIGHT.
+if [ -n "$CARVEOUT" ]; then
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    if diff_is_substantive "$f"; then
+      HEAVY="$HEAVY"$'\n'"$f (substantive: code/claim added)"
+    else
+      LIGHT="$LIGHT"$'\n'"$f (prose-only)"
+    fi
+  done <<< "$CARVEOUT"
+fi
+
+# Trim leading blank lines that the appends may introduce.
+HEAVY=$(echo "$HEAVY" | grep -vE '^\s*$' || true)
+LIGHT=$(echo "$LIGHT" | grep -vE '^\s*$' || true)
+
+# ── Universal guards (surface-scoped, NOT 4-axis-scoped) ─────────────────────
+# WHY A FUNCTION, AND WHY IT RUNS BEFORE THE "no FH assets" EXIT (2026-07-26, N=5 of the
+# gate-locality class): these two guards protect the CONFIDENTIALITY BOUNDARY of a public repo,
+# not the STRUCTURAL integrity of FH assets. They were authored inline BELOW the 4-axis
+# classifier, so their scope silently inherited the classifier's asset pathspec — a commit
+# staging only NON-asset paths hit `exit 0  # No FH assets staged` and skipped the
+# confidentiality scan entirely. Measured 2026-07-26: 46/241 tracked files (19.1%) were
+# unscannable that way; 32 of those are also outside npm files[], so they had no publish-time
+# backstop either — including the .gitignore whose leaked comment is the very incident cited in
+# the Privacy guard below, and .github/scripts/*.py. Known-pair verified: the same leak line
+# BLOCKS when staged in CATALOG.md and passes UNSEEN when staged in README.md alone.
+# CI had also delegated this role here (.github/workflows/validate.yml §internal-vocab) without
+# anyone measuring the receiving layer's coverage — half-fix propagation, not a new defect.
+# The 4 axes are a reversible surface (a commit is re-committable); THESE guard the publish
+# boundary, so they run on EVERY commit regardless of what is staged.
+# Body is intentionally NOT indented: it contains heredocs whose terminators must sit at column 0.
+run_universal_guards() {
+# ── Privacy guard — tracks/ staged-path allowlist (structural, name-free) ─────
+# tracks/** is local-by-default (frozen-seed policy); the only public lanes are
+# tracks/_contrib/** (consent lane) and ALREADY-TRACKED .gitkeep skeleton files.
+# A newly staged path outside those lanes is treated as a potential private-name
+# leak and blocks fail-closed. No deny-list of names exists here on purpose: a
+# tracked deny-list would itself publish the names it protects (measured origin:
+# tracked .gitignore carried a private track name + company domain in its comment,
+# fixed 2026-06-11). Intentional public mapping (a new track's .gitkeep) passes
+# with explicit per-commit consent: TRACKS_PUBLIC_OK=1 git commit ...
+echo "[Privacy] tracks/ staged-path allowlist..."
+TRACKS_LEAK=0
+while IFS= read -r p; do
+  [ -z "$p" ] && continue
+  case "$p" in
+    tracks/_contrib/*) ;;
+    tracks/*)
+      if [ "$(basename "$p")" = ".gitkeep" ]; then
+        if git ls-files --error-unmatch "$p" >/dev/null 2>&1; then
+          continue  # already-tracked skeleton
+        elif [ "${TRACKS_PUBLIC_OK:-0}" = "1" ]; then
+          echo "  ⚠️  new public track skeleton allowed by TRACKS_PUBLIC_OK=1: $p"
+          continue
+        fi
+      fi
+      echo "  ❌ FAIL — staged tracks/ path outside public lanes: $p"
+      TRACKS_LEAK=1; FAILED=1 ;;
+  esac
+done <<TRACKS_EOF
+$(git -c core.quotePath=false diff --cached --name-only --no-renames --diff-filter=ACR)
+TRACKS_EOF
+if [ "$TRACKS_LEAK" -eq 1 ]; then
+  echo "  tracks/** is local-only. Public lanes: tracks/_contrib/** · tracked .gitkeep."
+  echo "  Consent-lane content → move under tracks/_contrib/. New public track skeleton"
+  echo "  → re-run with TRACKS_PUBLIC_OK=1. Private content → unstage (git restore --staged)."
+else
+  echo "  ✅ PASS"
+fi
+
+# ── Confidentiality guard — public-surface scan on staged tracked content ─────
+# A commit to a PUBLIC repo is an effective PUBLISH of its content, so the confidentiality boundary is
+# checked here as well as at push/publish. Pattern loading and matching come from
+# scripts/psa_scan_lib.sh — the single implementation shared with pre-push and the publish scanner.
+# (Three near-duplicate copies used to exist; every confidentiality defect found in the 2026-07-26
+# cross-family audit was a divergence between them, so the duplication was removed rather than
+# repaired a fourth time.)
+#
+# DEGRADE DIRECTION HERE IS DELIBERATELY GENTLER THAN AT PUSH — do not "unify" it:
+#   • no usable patterns at all, or unusable rows → FAIL (an instrument that cannot run cannot certify)
+#   • operator override merely ABSENT            → WARN only. It is gitignored, so it is absent on
+#     every fresh clone and CI runner by construction; blocking each of their first commits would
+#     train PUBLIC_SURFACE_OK into a reflex and disarm the same channel the publish gate depends on.
+#     The push-time gate blocks that state instead, which is the boundary that actually publishes.
+echo "[Confidentiality] public-surface scan (staged tracked content)..."
+PSA_LIB="$REPO_ROOT/scripts/psa_scan_lib.sh"
+if [ ! -r "$PSA_LIB" ]; then
+  echo "  ❌ FAIL — scripts/psa_scan_lib.sh missing; the confidentiality scanner cannot run."
+  FAILED=1
+else
+  . "$PSA_LIB"
+  psa_load "$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults" \
+           "${PSA_PATTERNS:-$REPO_ROOT/.claude/rules/.public-surface-patterns}"
+  if [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
+    echo "  ⚠️  operator pattern override absent — only committed defaults active (home paths)."
+    echo "     Populate .claude/rules/.public-surface-patterns (gitignored) for company-specific tokens."
+  fi
+  if [ "$PSA_DEFAULTS_OK" -eq 0 ] || [ "$PSA_BAD_ROWS" -gt 0 ] \
+     || [ -z "$(printf '%s' "$PSA_STREAM" | grep -vE '^[[:space:]]*(#|$)' || true)" ]; then
+    echo "  ❌ confidentiality gate INACTIVE/INCOMPLETE — cannot certify a clean surface."
+    if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+      echo "  ⚠️  proceeding with an incomplete gate by PUBLIC_SURFACE_OK=1 (conscious)"
+      echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override — branch $BRANCH — gate inactive/incomplete" \
+        >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+    else
+      FAILED=1
+    fi
+  else
+    PSA_LEAK=0
+    # NUL-delimited (regression caught by the refactor's own cross-family review): the pre-refactor
+    # loop read this list with `read -r -d ''`, and the rewrite dropped back to a line-oriented read.
+    # `core.quotePath=false` stops git quoting NON-ASCII names, but a path holding a backslash or a
+    # newline is still C-quoted or unsplittable, and the quoted spelling matches no real file — so the
+    # file scanned clean. Exactly the hole R5 closed, reopened by a refactor that claimed to change no
+    # behavior. This is why the refactor got its own adversarial pass instead of riding the earlier one.
+    while IFS= read -r -d '' f; do
+      [ -z "$f" ] && continue
+      added=$(git diff --cached -- "$f" 2>/dev/null | grep -E '^\+' | sed 's/^\+//' || true)
+      [ -z "$added" ] && continue
+      # Per-line pass, path-tagged so the LOW file allowlist applies.
+      if ! printf '%s\n' "$added" | sed "s|^|$f	|" | psa_scan_tagged; then PSA_LEAK=1; fi
+      # Split-token backstop (pre-commit ONLY — this surface is a DIFF, so a literal can be wrapped
+      # mid-word across two added lines and neither line matches). TIGHT-join, no separator, so
+      # "fh-\nbe" becomes "fh-be". Accepted residual, verified not a missed fix: two whitespace-
+      # separated words can RARELY fuse into a spurious match — safe direction (over-block) with the
+      # PUBLIC_SURFACE_OK escape. A sentinel separator would close the fusion but RE-OPEN the split
+      # catch, which is the more important case since real literals have no internal whitespace.
+      joined=$(printf '%s' "$added" | tr -d '\n\r')
+      if ! printf '%s\t%s\n' "$f" "$joined" | psa_scan_tagged >/dev/null 2>&1; then
+        # Only report if the per-line pass did not already flag this file, to avoid double-reporting.
+        if ! printf '%s\n' "$added" | sed "s|^|$f	|" | psa_scan_tagged >/dev/null 2>&1; then :; else
+          printf '%s\t%s\n' "$f" "$joined" | psa_scan_tagged | sed 's/leak —/leak (line-split) —/'
+          PSA_LEAK=1
+        fi
+      fi
+    done < <(git -c core.quotePath=false diff --cached --name-only --no-renames --diff-filter=ACMR -z 2>/dev/null || true)
+    if [ "$PSA_LEAK" -eq 1 ]; then
+      if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then
+        echo "  ⚠️  public-surface hit(s) allowed by PUBLIC_SURFACE_OK=1 (conscious, reviewed intent)"
+        echo "$(date +%Y-%m-%dT%H:%M:%S) PUBLIC_SURFACE_OK override — branch $BRANCH — review suppressed hit(s) above" \
+          >> "$REPO_ROOT/tracks/_meta/.psa_override_log" 2>/dev/null || true
+      else
+        echo "  Operator-private token reached the public surface. Generalize it (companion-store name"
+        echo "  → 'a private companion store'; corp-context → 'restricted/corp env'; absolute home path"
+        echo "  → '~' or '{project}'), or PUBLIC_SURFACE_OK=1 git commit … for a reviewed mention."
+        FAILED=1
+      fi
+    else
+      echo "  ✅ PASS"
+    fi
+  fi
+fi
+}
+
+if [ -z "$HEAVY" ] && [ -z "$LIGHT" ]; then
+  # No FH asset staged → the 4-AXIS gate does not apply. The universal guards still do:
+  # their trigger is "content is being committed to a public repo", not "an FH asset changed".
+  run_universal_guards
+  if [ "$FAILED" -eq 1 ]; then
+    echo
+    echo "══════════════════════════════════════════════"
+    echo " 🚫 BLOCKED — universal guard failed (no FH asset staged; 4-axis gate not applicable)"
+    echo "══════════════════════════════════════════════"
+    exit 1
+  fi
+  exit 0
+fi
+
+if [ -n "$HEAVY" ]; then
+  GATE_MODE="full"
+else
+  GATE_MODE="lightweight"
+fi
+
+echo ""
+echo "══════════════════════════════════════════════"
+echo " FH 4-Axis Gate — ${GATE_MODE} mode"
+echo "══════════════════════════════════════════════"
+if [ -n "$HEAVY" ]; then
+  echo " Heavy assets staged:"
+  echo "$HEAVY" | sed 's/^/   /'
+fi
+if [ -n "$LIGHT" ]; then
+  echo " Light assets staged:"
+  echo "$LIGHT" | sed 's/^/   /'
+fi
+echo ""
+
+# ── Doc-code coupling check (measured class — WARN, never blocks) ─────────────
+# Stale docs poison AI accuracy: when executable code changes but the docs that
+# describe it do not, the manuals drift (import: Anthropic 4-layer L4 practice —
+# "code change forces skill-doc update"). FH applies it as a WARN because many
+# script changes are doc-neutral; the warning makes the *decision* conscious.
+EXEC_STAGED=$(echo "$STAGED" | grep -E '^(bin/|scripts/).*' || true)
+DOC_STAGED=$(echo "$STAGED" \
+  | grep -E '(README\.md|CHEATSHEET\.md|CLAUDE\.md|AGENTS\.md|^docs/|^knowledge/|SKILL(_detail)?\.md|^\.claude/regression/)' || true)
+if [ -n "$EXEC_STAGED" ] && [ -z "$DOC_STAGED" ]; then
+  echo ""
+  echo "⚠️  DOC-CODE COUPLING (measured — commit allowed)"
+  echo "   Executable changes staged with no doc asset staged:"
+  echo "$EXEC_STAGED" | sed 's/^/     /'
+  echo "   If behavior/usage changed: update README/CHEATSHEET/SKILL.md or probes"
+  echo "   (.claude/regression/probes.md) in this commit. If doc-neutral, proceed."
+  echo ""
+fi
+
+# ── Axis 1 — Regression Guard (always required) ──────────────────────────────
+echo "[Axis 1] Regression Guard..."
+GUARD="$REPO_ROOT/templates/regression_guard.sh"
+if [ ! -f "$GUARD" ]; then
+  echo "  ⚠️  SKIP — templates/regression_guard.sh not found"
+else
+  GUARD_EXIT=0
+  # Pre-commit must evaluate the STAGED index, not --pr merge-base: on a direct-to-main
+  # workflow merge-base(main,main)=HEAD makes staged changes invisible (fh_signal 2026-06-04).
+  # typed 파일 채널로 verdict 수신 — stdout grep(prose-grep) 대체 (2026-07-23, #165 잔여 폐쇄).
+  GUARD_RESULT_FILE=$(mktemp "${TMPDIR:-/tmp}/fh_guard_result.XXXXXX")
+  GUARD_OUT="$(REGRESSION_GUARD_RESULT_FILE="$GUARD_RESULT_FILE" bash "$GUARD" --staged 2>&1)" || GUARD_EXIT=$?
+  printf '%s\n' "$GUARD_OUT"
+  GUARD_VERDICT=$(sed -n 's/^result=//p' "$GUARD_RESULT_FILE" 2>/dev/null | head -1)
+  rm -f "$GUARD_RESULT_FILE"
+  # 일관성 검사 (challenger C-1): exit 코드와 typed verdict 가 어긋나면 게이트 계기 오류다 —
+  # 특히 중도 crash(exit 1, 파일 미작성)가 "S-tier 경고, 커밋 허용"으로 렌더되던 구멍.
+  # fh-gate.sh 의 exit-10 harness-error 선례: 계기 오류는 통과도 경고도 아닌 fail-closed.
+  if { [ "$GUARD_EXIT" -eq 1 ] && [ "$GUARD_VERDICT" != "review" ]; } \
+     || { [ "$GUARD_EXIT" -eq 0 ] && [ "$GUARD_VERDICT" != "pass" ] && [ "$GUARD_VERDICT" != "skip" ]; }; then
+    echo "  ❌ HARNESS-ERROR — guard exit=$GUARD_EXIT but typed verdict='$GUARD_VERDICT' (crash or instrument fault; not a pass, not a warning)"
+    FAILED=1
+  elif [ "$GUARD_EXIT" -eq 0 ] && [ "$GUARD_VERDICT" = "skip" ]; then
+    # ★ 미검사를 통과로 렌더하지 않는다. 가역 표면이라 커밋은 막지 않지만,
+    #   "PASS" 라고 쓰면 게이트가 자산을 봤다는 잘못된 신호가 된다(2026-07-22 수리).
+    echo "  ⏭️  SKIP — 게이트 pathspec 에 걸린 파일이 없다 (검사 안 함 ≠ 통과)"
+  elif [ "$GUARD_EXIT" -eq 0 ]; then
+    echo "  ✅ PASS"
+  elif [ "$GUARD_EXIT" -eq 1 ]; then
+    echo "  ⚠️  S-tier warnings present — review before merge (commit allowed)"
+    # Exit 1 = S-tier: guard itself says "merge allowed but verify intent" — not a commit blocker
+  else
+    echo "  ❌ FAIL — M-tier blockers or usage error (exit $GUARD_EXIT)"
+    FAILED=1
+  fi
+fi
+
+# ── Marker floor validation (mechanical below-floor detector) ─────────────────
+# Adversarial (Axis 2) floor compliance was advisory-only — it depended on the
+# orchestrator self-flagging in prose, which fails on rule salience, not tier
+# (fh_signal_2026-06-10_adversarial-floor-enforcement: blind A/B showed both Opus
+# and Sonnet self-flag when the rule is in active context; the live slip happened
+# because it wasn't). So the marker now REQUIRES machine-greppable floor fields,
+# and the hook validates them — compliance no longer depends on recall.
+#
+# Required marker fields (free prose may follow them):
+#   axis2-engine: quench-challenger | inline | <external cli>
+#   axis2-model:  <tier that produced the adversarial pass, e.g. opus>
+#   axis2-evidence: <what the pass actually found — finding count + verdict, or
+#                    "clean — 0 findings"; e.g. "PASS no-S, 4B applied" / "1S/4A fixed">
+#                    ← Honest scope (judge-robustness swarm, 2026-06-13): the hook enforces
+#                      this field's PRESENCE + NON-VACUITY (a real result was recorded), not
+#                      PROVENANCE. The marker is a trusted-runner attestation — a session that
+#                      fabricates a pass it never ran is the residual the WEEKLY AUDIT + OPERATOR
+#                      cover, not mechanism (cryptographic provenance is unachievable when the
+#                      runner controls everything the hook can see). This field makes the marker
+#                      auditable (the audit can check the recorded verdict against reality) and
+#                      catches the realistic failure: a vacuous "trust me, it ran" marker.
+#   floor-status: at-floor | above-floor | sonnet-floor | below-floor
+#                     (judged-depth floor = opus, PR #86; BASE floor = sonnet —
+#                      Sonnet-Floor Doctrine 2026-07-10: a Sonnet inline pass is
+#                      first-class for base commits when it carries a mechanical
+#                      anchor line (axis2-anchor:) and it auto-enters the weekly
+#                      re-validation queue; sub-Sonnet stays below-floor + ack)
+#   axis2-anchor: <mechanical evidence grounding the Sonnet judged verdict — a
+#                  regression test, lint/scan output, probe count; required iff
+#                  floor-status: sonnet-floor (judged depth at Sonnet is weaker,
+#                  so the anchor leg is the compensating requirement)>
+#   below-floor-ack: "<verbatim operator approval utterance>" — <reason>
+#                     ← required iff floor-status: below-floor; the quoted span is
+#                       mandatory (rubber-stamp hardening, 2026-06-13). This narrows
+#                       rubber-stamping to two residual classes — quote fabrication
+#                       (active-fabrication, honesty-layer-blocked) and OUT-OF-CONTEXT
+#                       quoting (a real but non-approval utterance) — both of which
+#                       are weekly-audit targets: the audit re-queues below-floor
+#                       markers and checks the quote against the session record.
+#                       The hook enforces the form, not genuineness.
+#
+# Opus-inline is at-floor (capability met even though dispatch was skipped) — the
+# gate must not block legitimate at/above-floor inline passes by the orchestrator.
+# A below-floor judged verdict is PROVISIONAL (not gate-PASS evidence) per
+# §Floor governance, so it blocks unless the operator explicitly accepts it; the
+# weekly audit remains the standing consumer that re-runs or writes off acks.
+# Single-line recreate command — indentation-immune on paste (a displayed heredoc
+# pastes with leading indent: the anchored grep misses and an indented EOF never
+# terminates <<'EOF' — non-converging fix loop, challenger Axis-5 A-finding).
+marker_recreate_hint() {
+  echo "     printf 'axis2-engine: quench-challenger\\naxis2-model: opus\\nfloor-status: at-floor\\naxis2-evidence: PASS no-S\\n' > \"$1\""
+}
+
+validate_marker_floor() {
+  local m="$1" fs model
+  # Leading whitespace tolerated on field lines (defense-in-depth vs indented writes).
+  fs=$(grep -m1 -E '^[[:space:]]*floor-status:' "$m" 2>/dev/null \
+       | sed -E 's/^[[:space:]]*floor-status:[[:space:]]*//; s/[[:space:]].*$//')
+  if [ -z "$fs" ]; then
+    echo "  ❌ MARKER FORMAT — missing floor-status: line (legacy/empty marker)"
+    echo "     The marker must carry machine-readable floor fields. Recreate it:"
+    marker_recreate_hint "$m"
+    return 1
+  fi
+  case "$fs" in
+    at-floor|above-floor)
+      : ;;
+    sonnet-floor)
+      # Sonnet-Floor Doctrine (2026-07-10): Sonnet inline is first-class for BASE
+      # commits — no operator ack — but the judged verdict is weaker at Sonnet, so
+      # a mechanical anchor line is the compensating requirement, and the marker
+      # auto-enters the weekly re-validation queue (below_floor_scan.sh, R-tier).
+      if ! grep -qE '^[[:space:]]*axis2-anchor:[[:space:]]*[^[:space:]]' "$m"; then
+        echo "  ❌ SONNET-FLOOR pass without mechanical anchor"
+        echo "     floor-status: sonnet-floor requires an axis2-anchor: line naming the"
+        echo "     mechanical evidence that grounds the judged verdict (regression test,"
+        echo "     scan output, probe count). Judged-only at Sonnet is not gate-PASS."
+        echo "     Alternatives: dispatch the audit (sidecar / opus agent → at-floor),"
+        echo "     or record the anchor you ran."
+        return 1
+      fi
+      echo "  ⚠️  sonnet-floor pass accepted (base floor met; anchored — provisional"
+      echo "     for judged depth: weekly audit re-queues sonnet-floor markers, R-tier)"
+      ;;
+    below-floor)
+      if ! grep -qE '^[[:space:]]*below-floor-ack:[[:space:]]*[^[:space:]]' "$m"; then
+        echo "  ❌ BELOW-FLOOR adversarial pass without operator ack"
+        echo "     A judged verdict produced below the opus floor is provisional —"
+        echo "     it is not gate-PASS evidence (§Floor governance). Either:"
+        echo "       (1) re-run Axis 2 at ≥ floor: dispatch quench-challenger at opus,"
+        echo "           then set floor-status: at-floor; or"
+        echo "       (2) record explicit operator acceptance in the marker:"
+        echo "           below-floor-ack: \"<verbatim operator utterance>\" — <reason>"
+        return 1
+      fi
+      # Rubber-stamp guard: the ack must contain a QUOTED operator utterance
+      # ("..." or “…”, ≥2 chars). A bare reason is agent-self-writable; a quote
+      # ties the ack to a conversational event auditable in the session record.
+      if ! grep -m1 -E '^[[:space:]]*below-floor-ack:' "$m" \
+           | grep -qE '"[^"]{2,}"|“[^”]{2,}”'; then
+        echo "  ❌ BELOW-FLOOR ack without quoted operator utterance (rubber-stamp guard)"
+        echo "     The ack line must quote the operator's approval verbatim:"
+        echo "       below-floor-ack: \"<what the operator actually said>\" — <reason>"
+        return 1
+      fi
+      echo "  ⚠️  below-floor pass accepted via operator ack (provisional —"
+      echo "     weekly audit re-queues below-floor markers for floor-tier re-run)"
+      ;;
+    *)
+      echo "  ❌ MARKER FORMAT — invalid floor-status: '$fs'"
+      echo "     Allowed: at-floor | above-floor | sonnet-floor | below-floor"
+      return 1
+      ;;
+  esac
+  if ! grep -qE '^[[:space:]]*axis2-engine:[[:space:]]*[^[:space:]]' "$m"; then
+    echo "  ❌ MARKER FORMAT — missing axis2-engine: line"
+    echo "     Record what ran the adversarial pass (quench-challenger | inline | <cli>)."
+    return 1
+  fi
+  model=$(grep -m1 -E '^[[:space:]]*axis2-model:' "$m" 2>/dev/null \
+          | sed -E 's/^[[:space:]]*axis2-model:[[:space:]]*//; s/[[:space:]].*$//')
+  if [ -z "$model" ]; then
+    echo "  ❌ MARKER FORMAT — missing axis2-model: line"
+    echo "     Record the tier that actually produced the adversarial pass"
+    echo "     (e.g. axis2-model: opus). This is what makes the floor auditable."
+    return 1
+  fi
+  # axis2-evidence — presence + non-vacuity (NOT provenance; see header note + the
+  # 2026-06-13 judge-robustness swarm). Catches the realistic failure: a marker that
+  # asserts a pass with no recorded result. The hook cannot verify the pass ran — that
+  # residual is the weekly audit's + operator's, by design (documented, not silent).
+  ev=$(grep -m1 -E '^[[:space:]]*axis2-evidence:' "$m" 2>/dev/null \
+       | sed -E 's/^[[:space:]]*axis2-evidence:[[:space:]]*//')
+  if [ -z "$ev" ]; then
+    echo "  ❌ MARKER FORMAT — missing axis2-evidence: line"
+    echo "     Record what the adversarial pass actually found, so the marker is auditable:"
+    echo "       axis2-evidence: PASS no-S   |   1S/4A fixed   |   clean — 0 findings"
+    echo "     (The hook enforces form + non-vacuity, not provenance — a fabricated pass is"
+    echo "      the weekly audit's + operator's residual, not the hook's. See header note.)"
+    return 1
+  fi
+  # Non-vacuity: must carry a finding count/severity OR an explicit verdict token —
+  # blocks an empty-substance "it ran, trust me" line.
+  if ! echo "$ev" | grep -qiE '[0-9]|clean|pass|fail|no-s|none|finding|converg'; then
+    echo "  ❌ MARKER — axis2-evidence too vacuous (no count or verdict token)"
+    echo "     Cite the actual result: 'PASS no-S' / '1S/4A fixed' / 'clean — 0 findings'."
+    return 1
+  fi
+  # Model/floor cross-check — a known below-floor tier cannot claim at/above-floor.
+  # This catches the literal 2026-06-10 incident pattern (Sonnet pass labeled
+  # "Opus floor") mechanically. Floor = opus; tiers known to sit below it are
+  # enumerated here — above-floor models are NOT enumerated (no name baked in).
+  case "$fs" in
+    at-floor|above-floor)
+      if echo "$model" | grep -qiE 'sonnet|haiku'; then
+        echo "  ❌ MODEL/FLOOR MISMATCH — axis2-model: $model cannot be $fs (judged-depth floor=opus)"
+        echo "     Sonnet inline → floor-status: sonnet-floor (+ axis2-anchor:); sub-Sonnet →"
+        echo "     below-floor (+ below-floor-ack:); or dispatch Axis 2 at ≥ floor."
+        return 1
+      fi
+      ;;
+    sonnet-floor)
+      # sonnet-floor is Sonnet's own lane — a sub-Sonnet tier claiming it is the
+      # same mislabel class the at-floor check catches (haiku cannot ride the lane).
+      if ! echo "$model" | grep -qiE 'sonnet'; then
+        echo "  ❌ MODEL/FLOOR MISMATCH — axis2-model: $model cannot be sonnet-floor"
+        echo "     sonnet-floor is for Sonnet-tier passes only; sub-Sonnet → below-floor + ack."
+        return 1
+      fi
+      ;;
+  esac
+  return 0
+}
+
+# ── Axes 2+3 — steel-quench + phantom-quench (full gate only) ─────────
+if [ "$GATE_MODE" = "full" ]; then
+  echo "[Axis 2+3] Adversarial + Source-Grounding..."
+  MARKER_DIR="$REPO_ROOT/tracks/_meta"
+  MARKER="$MARKER_DIR/.axes_23_passed_${BRANCH_SLUG}_${TODAY}.marker"
+
+  if [ -f "$MARKER" ]; then
+    if validate_marker_floor "$MARKER"; then
+      echo "  ✅ PASS (marker confirmed + floor fields valid:"
+      echo "     .axes_23_passed_${BRANCH_SLUG}_${TODAY}.marker)"
+    else
+      FAILED=1
+    fi
+  else
+    echo "  ❌ NOT CONFIRMED"
+    echo ""
+    echo "  Run /steel-quench and /phantom-quench in your Claude session."
+    echo "  After both PASS, Claude creates the marker automatically. Or manually:"
+    echo ""
+    echo "     mkdir -p \"$MARKER_DIR\""
+    marker_recreate_hint "$MARKER"
+    echo ""
+    FAILED=1
+  fi
+else
+  echo "[Axis 2+3] SKIP (lightweight mode — CATALOG.md / tracks/ only)"
+fi
+
+# ── Axis 4 — Edit Manifest entry (always required) ────────────────────────────
+echo "[Axis 4] Edit Manifest..."
+MANIFEST="$REPO_ROOT/tracks/_meta/edit_manifest.yaml"
+if [ ! -f "$MANIFEST" ]; then
+  echo "  ❌ FAIL — tracks/_meta/edit_manifest.yaml not found"
+  echo "  Run /edit-manifest RECORD or create the file manually."
+  FAILED=1
+elif grep -q "date: $TODAY" "$MANIFEST" 2>/dev/null; then
+  echo "  ✅ PASS (entry for $TODAY found in edit_manifest.yaml)"
+else
+  echo "  ❌ FAIL — no entry dated $TODAY in edit_manifest.yaml"
+  echo "  Run /edit-manifest RECORD to log predicted impact for today's changes."
+  FAILED=1
+fi
+
+# Universal guards (defined above) — confidentiality/privacy boundary, every commit.
+run_universal_guards
+
+# ── Count-consistency shift-left (gated on a skills-dir add/remove) ───────────
+# The skill/agent count-consistency check historically lived ONLY at the publish
+# boundary (scripts/selfcheck.sh via prepublishOnly). But the actor that BREAKS it —
+# a commit that adds/removes a skill dir — acts here, at commit time. So a skill-adding
+# PR could merge with stale counts undetected until the next publish (fh_signal_2026-06-21:
+# the gate-locality gap that PR #111 itself tripped — it added 2 skills without updating
+# the 4 count declarations and merged green). Shift the check left: run the
+# count-consistency slice WHEN a SKILL.md is added/removed/renamed under plugins/*/skills/.
+# Gated so ordinary commits stay cheap; reuses scripts/count_check.sh (same logic selfcheck
+# uses — single source, no reinvention). NOT the whole of selfcheck (that is a broad
+# publish-readiness check; keep the hook light).
+# ── Gate path-coverage anchor (mandatory-pass — blocks) ───────────────────────
+# Runs when a gate implementation or its canonical rule is staged. The gate-locality class has
+# recurred 4x; each time a path term silently stopped covering a declared asset class, and the miss
+# rendered as PASS. This anchor is calibrated on known pairs (reopening the 07-26 hole makes it FAIL,
+# verified) so the fix cannot be un-done unnoticed. Blocks, because a gate that no longer gates is
+# not a reversible-surface concern — it disables the commit gate itself.
+GATE_IMPL=$(echo "$STAGED" \
+  | grep -E '(templates/\.git-hooks/pre-commit|templates/regression_guard\.sh|\.claude/rules/fh_4axis_gate\.md|scripts/gate_pathspec_check\.sh)' || true)
+if [ -n "$GATE_IMPL" ]; then
+  echo "[Gate] gate implementation staged — path-coverage known-pair anchor..."
+  PSCHECK="$REPO_ROOT/scripts/gate_pathspec_check.sh"
+  if [ ! -f "$PSCHECK" ]; then
+    echo "  ❌ FAIL — scripts/gate_pathspec_check.sh missing while a gate file is being changed."
+    echo "     The anchor is the only mechanical guard on gate path coverage; its absence during a"
+    echo "     gate edit is fail-closed, not a skip."
+    FAILED=1
+  elif bash "$PSCHECK" >/dev/null 2>&1; then
+    echo "  ✅ PASS (all known pairs hold)"
+  else
+    echo "  ❌ FAIL — a gate path term stopped covering a declared asset class:"
+    bash "$PSCHECK" 2>&1 | grep -E '^\s+❌' | sed 's/^/    /'
+    echo "     (run: bash scripts/gate_pathspec_check.sh)"
+    FAILED=1
+  fi
+fi
+
+# ── Universal-guard scope anchor (mandatory-pass — blocks) ────────────────────
+# Sibling of the path-coverage anchor above, guarding the OTHER half of the gate-locality class:
+# not "does the pathspec still cover the declared assets?" but "do the surface-scoped guards still
+# run on surfaces the 4-axis classifier does not claim?" (the 2026-07-26 hole: the confidentiality
+# scan sat below `exit 0  # No FH assets staged`, so a commit staging only non-asset paths skipped
+# it). Also pins the credential-shape patterns and their one measured false positive, so a pattern
+# edit cannot silently over- or under-block. Triggers on the hook itself or the pattern source.
+# Blocks: a confidentiality gate that stops covering the public surface is not a reversible-surface
+# concern — it is the publish boundary.
+UGUARD_IMPL=$(echo "$STAGED" \
+  | grep -E '(templates/\.git-hooks/pre-commit|\.claude/rules/\.public-surface-patterns\.defaults|scripts/universal_guard_check\.sh|scripts/public_surface_scan_files\.sh)' || true)
+# The PUSH-side publish guards get the same treatment (2026-07-26). Their anchor is a separate script
+# because it drives a different hook, but the wiring rule is identical: a check nobody calls is prose.
+PPGUARD_IMPL=$(echo "$STAGED" \
+  | grep -E '(templates/\.git-hooks/pre-push|\.claude/rules/\.public-surface-patterns\.defaults|scripts/prepush_guard_check\.sh)' || true)
+if [ -n "$PPGUARD_IMPL" ]; then
+  echo "[Gate] pre-push publish surface staged — known-pair anchor..."
+  PPCHECK="$REPO_ROOT/scripts/prepush_guard_check.sh"
+  if [ ! -f "$PPCHECK" ]; then
+    echo "  ❌ FAIL — scripts/prepush_guard_check.sh missing while the publish guard is being changed."
+    echo "     Fail-closed: the anchor is the only mechanical guard on that guard's behavior."
+    FAILED=1
+  elif bash "$PPCHECK" >/dev/null 2>&1; then
+    echo "  ✅ PASS (all known pairs hold)"
+  else
+    echo "  ❌ FAIL — a pre-push known pair broke:"
+    bash "$PPCHECK" 2>&1 | grep -E '^\s+❌' | sed 's/^/    /'
+    echo "     (run: bash scripts/prepush_guard_check.sh)"
+    FAILED=1
+  fi
+fi
+if [ -n "$UGUARD_IMPL" ]; then
+  echo "[Gate] universal-guard surface staged — scope known-pair anchor..."
+  UGCHECK="$REPO_ROOT/scripts/universal_guard_check.sh"
+  if [ ! -f "$UGCHECK" ]; then
+    echo "  ❌ FAIL — scripts/universal_guard_check.sh missing while the confidentiality guard is"
+    echo "     being changed. The anchor is the only mechanical guard on that guard's SCOPE; its"
+    echo "     absence during such an edit is fail-closed, not a skip."
+    FAILED=1
+  elif bash "$UGCHECK" >/dev/null 2>&1; then
+    echo "  ✅ PASS (all known pairs hold)"
+  else
+    echo "  ❌ FAIL — a universal-guard known pair broke:"
+    bash "$UGCHECK" 2>&1 | grep -E '^\s+❌' | sed 's/^/    /'
+    echo "     (run: bash scripts/universal_guard_check.sh)"
+    FAILED=1
+  fi
+fi
+
+# ── Load-bearing change gate — mechanical anchor for a rule that was PROSE ONLY ───────────────
+# CLAUDE.md §Field-Harness Load-Bearing Change Gate specifies degrade-lint → cross-family adversarial
+# review → converge, for changes to verdict/gate/irreversible-surface code. Measured 2026-07-26:
+# `auto-decorrelation` had ZERO callers anywhere in scripts/ or the hooks (its only appearance outside
+# prose was a string inside degrade_direction_scan.sh's own closing echo), and degrade_direction_scan.sh
+# was likewise called by nothing. The gate fired that day only because a session chose to read CLAUDE.md
+# and run it — exactly the salience-only floor the gate exists to replace elsewhere.
+#
+# WHAT THIS DOES AND DOES NOT DO — the distinction matters:
+#   It does NOT require that a cross-family review happened. A commit is a REVERSIBLE surface, and per
+#   the Surface-Class Degrade Invariant the fail-closed leg of this gate belongs at the MERGE boundary,
+#   not here; forcing a sidecar dispatch per commit would over-block and train the escape into reflex.
+#   It DOES forbid being SILENT about it. The marker must carry a `crossfamily:` line — either naming
+#   the engine and its verdict, or explicitly recording `none` with a reason. Same shape as the existing
+#   below-floor-ack: the gate blocks on an unstated answer, never on the answer itself. Non-vacuity is
+#   the marker's job; provenance is not (a fabricated line is the weekly-audit residual, as elsewhere).
+# The degrade lint runs as an ADVISORY pre-screen, per its own doctrine (FP-tolerant, never a solo block).
+LOADBEARING=$(printf '%s\n%s\n' "$GATE_IMPL" "$UGUARD_IMPL" | grep -v '^[[:space:]]*$' | sort -u || true)
+if [ -n "$LOADBEARING" ]; then
+  echo "[Gate] load-bearing change — degrade lint (advisory) + cross-family acknowledgment..."
+  DDSCAN="$REPO_ROOT/scripts/degrade_direction_scan.sh"
+  if [ -f "$DDSCAN" ]; then
+    _dd=$(bash "$DDSCAN" 2>/dev/null \
+          | grep -Ff <(printf '%s\n' "$LOADBEARING") 2>/dev/null | head -5 || true)
+    if [ -n "$_dd" ]; then
+      echo "  ⚠️  degrade-direction smell(s) in the staged load-bearing files (advisory):"
+      printf '%s\n' "$_dd" | sed 's/^/       /'
+      echo "       Each = 'prove this is not default-toward-PASS'. Advisory: does not block."
+    else
+      echo "  ✅ degrade lint: no smell in the staged load-bearing files"
+    fi
+  else
+    echo "  ⚠️  degrade lint unavailable (scripts/degrade_direction_scan.sh missing) — advisory leg skipped"
+  fi
+  MARKER_LB="$REPO_ROOT/tracks/_meta/.axes_23_passed_${BRANCH_SLUG}_${TODAY}.marker"
+  if [ -f "$MARKER_LB" ] && grep -qE '^[[:space:]]*crossfamily:[[:space:]]*[^[:space:]]' "$MARKER_LB"; then
+    echo "  ✅ cross-family leg recorded: $(grep -m1 -E '^[[:space:]]*crossfamily:' "$MARKER_LB" | cut -c1-90)"
+  else
+    echo "  ❌ FAIL — load-bearing file staged with no 'crossfamily:' line in the Axes 2-3 marker."
+    echo "     Verdict/gate/irreversible-surface code shares the author's blind spot with a same-family"
+    echo "     reviewer. State the answer, whatever it is — the gate blocks silence, not a 'none':"
+    echo "       crossfamily: codex/gpt-5.5 — R1..R4, 16 findings, 15 fixed 1 refuted, CONVERGED"
+    echo "       crossfamily: none — <why no different-family auditor was reachable/needed>"
+    echo "     Append one line to: $MARKER_LB"
+    FAILED=1
+  fi
+fi
+
+# SKILL.md ONLY here, deliberately (2026-07-26): the 07-26 sweep widened `SKILL\.md` →
+# `SKILL(_detail)?\.md` in the HEAVY and doc-coupling terms above, but NOT here. This slice asks
+# "did the number of SKILLS change?" — a detail file is a referenced companion, not a skill, so
+# adding one must not trip a skill-count check. Do not "fix" this for consistency with the others.
+SKILL_CHANGE=$(git diff --cached --name-status --diff-filter=ADR 2>/dev/null \
+  | grep -E 'plugins/[^/]+/skills/[^/]+/SKILL\.md' || true)
+if [ -n "$SKILL_CHANGE" ]; then
+  echo "[Count] skills-dir add/remove staged — count-consistency check..."
+  CCHECK="$REPO_ROOT/scripts/count_check.sh"
+  CCOUT="$(mktemp 2>/dev/null || echo /tmp/fh_count_check.$$)"
+  if [ ! -f "$CCHECK" ]; then
+    echo "  ⚠️  SKIP — scripts/count_check.sh not found"
+  elif bash "$CCHECK" --staged >"$CCOUT" 2>&1; then
+    echo "  ✅ PASS (declared counts match the staged index)"
+  else
+    echo "  ❌ FAIL — declared skill/agent counts drift from the filesystem:"
+    grep -E '^(FAIL|COUNT-CHECK)' "$CCOUT" | sed 's/^/     /'
+    echo "     A skill was added/removed without updating every count declaration."
+    echo "     Update: plugin.json · marketplace.json · README header · local_fh_context.md"
+    echo "     (run: bash scripts/count_check.sh — same check selfcheck/publish runs)"
+    FAILED=1
+  fi
+  rm -f "$CCOUT"
+fi
+
+# ── Detail-pointer resolution (staged markdown) ──────────────────────────────
+# skill-splitter governance-semantic split relocates execution-detail to on-demand files,
+# linked by imperative `**Detail**: See `<path> §Section`` pointers. phantom-quench (Axis 3)
+# verifies these only WHEN RUN — the marker merely ATTESTS it ran, so a §header rename or file
+# move silently breaks a pointer between manual runs (B#3, fh_signal 2026-06-23 CLAUDE.md split).
+# Make the pointer-resolution slice MECHANICAL at commit: every Detail pointer in a staged .md
+# must resolve to a `## §Section` header in a referenced *.md (sibling- or repo-relative). Bound
+# to `**Detail**: See` blocks → no false-positive on general §cross-refs.
+MD_STAGED=$(git -c core.quotePath=false diff --cached --name-only --no-renames --diff-filter=ACMR 2>/dev/null | grep -E '\.md$' || true)
+if [ -n "$MD_STAGED" ]; then
+  echo "[Pointers] Detail-pointer resolution (staged markdown)..."
+  PTR_FAIL=0; PTR_CHECKED=0
+  for f in $MD_STAGED; do
+    [ -f "$REPO_ROOT/$f" ] || continue
+    fdir="$(cd "$REPO_ROOT/$(dirname "$f")" && pwd)"
+    blocks="$(awk '
+      inblk && /^>/ { blk=blk" "$0; next }
+      inblk { print blk; inblk=0; blk="" }
+      /\*\*Detail\*\*: See/ { blk=$0; inblk=1; next }
+      END { if(inblk) print blk }
+    ' "$REPO_ROOT/$f")"
+    [ -z "$blocks" ] && continue
+    while IFS= read -r block; do
+      [ -z "$block" ] && continue
+      bpaths="$(printf '%s\n' "$block" | grep -oE '[A-Za-z0-9_./-]+\.md' | sort -u)"
+      bsecs="$(printf '%s\n' "$block" | grep -oE '§[A-Za-z0-9_-]+' | sed 's/§//' | sort -u)"
+      [ -z "$bsecs" ] && continue
+      for s in $bsecs; do
+        PTR_CHECKED=$((PTR_CHECKED+1)); hit=0
+        for p in $bpaths; do
+          for cand in "$fdir/$p" "$REPO_ROOT/$p" "$p"; do
+            if [ -f "$cand" ] && grep -qE "^## §${s}([[:space:]]|\$)" "$cand"; then hit=1; break; fi
+          done
+          [ "$hit" = 1 ] && break
+        done
+        if [ "$hit" = 0 ]; then
+          echo "  ❌ $f: Detail pointer §$s has no '## §$s' header in [$(echo $bpaths)]"
+          PTR_FAIL=1
+        fi
+      done
+    done <<PTR_EOF
+$blocks
+PTR_EOF
+  done
+  if [ "$PTR_FAIL" -eq 1 ]; then
+    echo "     A relocated detail section was renamed/moved without updating its pointer."
+    echo "     Fix the §header or the pointer so every '**Detail**: See ... §X' resolves."
+    FAILED=1
+  else
+    echo "  ✅ PASS ($PTR_CHECKED pointer(s) resolve)"
+  fi
+fi
+
+# ── Verdict ───────────────────────────────────────────────────────────────────
+echo ""
+echo "══════════════════════════════════════════════"
+if [ "$FAILED" -eq 1 ]; then
+  echo " 🚫 BLOCKED — resolve failing axes, then retry"
+  echo " See CLAUDE.md §FH Improvement 4-Axis Auto-Gate"
+  echo "══════════════════════════════════════════════"
+  echo ""
+  exit 1
+fi
+
+echo " ✅ ALL AXES PASSED — commit allowed"
+echo "══════════════════════════════════════════════"
+echo ""
+exit 0