@chrono-meta/fh-gate 1.4.72 → 1.4.74

package/scripts/test_marker_floor_lanes.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# test_marker_floor_lanes.sh — regression fixtures for pre-commit validate_marker_floor lanes.
+#
+# Ships with the 2026-07-10 sonnet-floor lane (Sonnet-Floor Doctrine): each closed hole gets a
+# mechanical regression test (Field-Harness Load-Bearing Change Gate convergence condition).
+# Fixtures assert BOTH directions: the new lane admits exactly its intended shape, and every
+# pre-existing guard still blocks (no degrade-toward-permissive regression).
+#
+# Usage: bash scripts/test_marker_floor_lanes.sh   Exit: 0 = all fixtures behave; 1 = regression.
+
+set -uo pipefail
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+
+sed -n '/^marker_recreate_hint()/,/^}/p;/^validate_marker_floor()/,/^}/p' "$HOOK" > "$T/fn.sh"
+
+run() { bash -c "source '$T/fn.sh'; validate_marker_floor '$1'" >/dev/null 2>&1; }
+
+FAIL=0
+check() { # $1=fixture $2=expected(PASS|BLOCK) $3=label
+  if run "$1"; then got=PASS; else got=BLOCK; fi
+  if [ "$got" = "$2" ]; then echo "✅ $3 → $got"; else echo "❌ $3 → $got (expected $2)"; FAIL=1; fi
+}
+
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: sonnet-floor\naxis2-anchor: regression test 5/5 pass\naxis2-evidence: PASS no-S, 2B applied\n' > "$T/m1"
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: sonnet-floor\naxis2-evidence: PASS no-S\n' > "$T/m2"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: sonnet-floor\naxis2-anchor: probe 3/3\naxis2-evidence: PASS no-S\n' > "$T/m3"
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: at-floor\naxis2-evidence: PASS no-S\n' > "$T/m4"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: below-floor\naxis2-evidence: PASS no-S\n' > "$T/m5"
+printf 'axis2-engine: quench-challenger\naxis2-model: opus\nfloor-status: at-floor\naxis2-evidence: 1S/4A fixed\n' > "$T/m6"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: below-floor\nbelow-floor-ack: "approved, proceed" — canary-only change\naxis2-evidence: PASS no-S\n' > "$T/m7"
+printf 'axis2-engine: inline\naxis2-model: opus\nfloor-status: bogus-status\naxis2-evidence: PASS\n' > "$T/m8"
+
+check "$T/m1" PASS  "sonnet-floor + anchor + sonnet model (new lane, intended shape)"
+check "$T/m2" BLOCK "sonnet-floor WITHOUT anchor (anchor is the compensating requirement)"
+check "$T/m3" BLOCK "haiku claiming sonnet-floor (lane mislabel)"
+check "$T/m4" BLOCK "sonnet claiming at-floor (2026-06-10 mislabel class — guard intact)"
+check "$T/m5" BLOCK "below-floor without ack (guard intact)"
+check "$T/m6" PASS  "opus at-floor (legacy lane intact)"
+check "$T/m7" PASS  "below-floor with quoted ack (legacy lane intact)"
+check "$T/m8" BLOCK "invalid floor-status (fail-closed on unknown value)"
+
+[ "$FAIL" -eq 0 ] && echo "── all marker-floor lane fixtures behave ──"
+exit "$FAIL"

package/scripts/test_prepush_stdin_integrity.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# test_prepush_stdin_integrity.sh — regression anchor for the 2026-07-20 fail-open hole.
+#
+# HOLE: the session-close block inserted at the TOP of templates/.git-hooks/pre-push starts a
+# subprocess. git delivers the pushed ref list on the hook's STDIN, and the ref-reading loop runs
+# AFTER that block. A stdin-inheriting subprocess drains the ref list → the loop sees zero refs →
+# every DEL_/FORCED_ variable stays empty → the hook takes "nothing destructive → exit 0",
+# silently disarming the Destructive-Op gate on a branch-delete / force push.
+#
+# This test reproduces the mechanism (not just greps for the fix), then asserts the fix is present.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK="$ROOT/templates/.git-hooks/pre-push"
+FAILED=0
+_ok(){ echo "PASS  $1"; }
+_no(){ echo "FAIL  $1"; FAILED=1; }
+
+# T1 — the mechanism is real: a stdin-inheriting subprocess eats the ref list.
+GOT=$(printf 'r1 a1 r2 b2\n' | { _=$(bash -c 'cat >/dev/null' 2>&1); while read -r a _b _c _d; do echo "$a"; done; })
+[ -z "$GOT" ] && _ok "T1 mechanism reproduces (inheriting subprocess drains stdin)" \
+              || _no "T1 mechanism did NOT reproduce — test is no longer meaningful, re-derive it"
+
+# T2 — the fix works: redirecting the subprocess from /dev/null preserves the ref list.
+GOT=$(printf 'r1 a1 r2 b2\n' | { _=$(bash -c 'cat >/dev/null' 2>&1 </dev/null); while read -r a _b _c _d; do echo "$a"; done; })
+[ "$GOT" = "r1" ] && _ok "T2 '< /dev/null' preserves the ref list" \
+                  || _no "T2 redirect did not preserve stdin (got: '$GOT')"
+
+# T3 — the shipped hook actually carries the guard on the close-check invocation.
+LINE=$(grep -n 'session_close_check\.sh' "$HOOK" | grep -v '^\s*#' | grep '_SC_OUT=' || true)
+case "$LINE" in
+  *"< /dev/null"*|*"</dev/null"*) _ok "T3 pre-push close-check invocation is stdin-guarded" ;;
+  "") _no "T3 could not find the _SC_OUT invocation in $HOOK — hole may have been reintroduced under a new name" ;;
+  *)  _no "T3 pre-push close-check invocation LACKS '< /dev/null' → Destructive-Op gate is fail-open: $LINE" ;;
+esac
+
+# T4 — STRUCTURAL FIX: ref classification must run BEFORE any helper subprocess.
+# (Inverted 2026-07-20: the first draft asserted the opposite, because the block originally sat
+#  above the loop. A cross-family audit called that a priority inversion — advisory check above a
+#  blocking safety gate — so the block moved below classification and this assertion flipped with it.
+#  Match CODE lines only; an earlier draft matched the hook's own explanatory COMMENT and
+#  self-inverted. Instrument defect caught by the instrument.)
+SC_LN=$(grep -n '_SC_OUT=' "$HOOK" | grep -v ':[[:space:]]*#' | head -1 | cut -d: -f1)
+LOOP_LN=$(grep -n 'while read -r local_ref' "$HOOK" | grep -v ':[[:space:]]*#' | head -1 | cut -d: -f1)
+if [ -n "$SC_LN" ] && [ -n "$LOOP_LN" ] && [ "$LOOP_LN" -lt "$SC_LN" ]; then
+  _ok "T4 ref classification (:$LOOP_LN) precedes the close-check helper (:$SC_LN)"
+else
+  _no "T4 PRIORITY INVERSION — helper(:${SC_LN:-?}) runs at/before ref classification(:${LOOP_LN:-?}); a stdin-reading helper can disarm the Destructive-Op gate"
+fi
+
+# T5 — END-TO-END (the anchor a cross-family audit required): a helper that ACTUALLY reads stdin,
+# plus a synthetic DESTRUCTIVE ref, must still BLOCK. This is what T1-T4 cannot prove on their own —
+# they test the mechanism and the source layout; this tests the shipped hook's real behavior.
+T5_TMP=$(mktemp -d 2>/dev/null || echo "/tmp/fh_t5_$$") ; mkdir -p "$T5_TMP"
+(
+  cd "$T5_TMP" || exit 1
+  git init -q . 2>/dev/null
+  mkdir -p scripts
+  # a DELIBERATELY hostile helper: it drains stdin, exactly the failure mode under test
+  printf '#!/usr/bin/env bash
+cat >/dev/null 2>&1 || true
+exit 0
+' > scripts/session_close_check.sh
+  chmod +x scripts/session_close_check.sh
+  cp "$HOOK" ./pre-push-under-test
+  # synthetic destructive ref: local sha all-zero => DELETE of refs/heads/victim
+  printf 'refs/heads/victim 0000000000000000000000000000000000000000 refs/heads/victim deadbeefdeadbeefdeadbeefdeadbeefdeadbeef
+'     | bash ./pre-push-under-test origin https://example.invalid/x.git >/dev/null 2>&1
+  echo "$?" > rc.txt
+)
+T5_RC=$(cat "$T5_TMP/rc.txt" 2>/dev/null || echo "")
+rm -rf "$T5_TMP" 2>/dev/null
+if [ "$T5_RC" = "0" ]; then
+  _no "T5 FAIL-OPEN REPRODUCED — a stdin-draining helper let a synthetic branch DELETE through (hook exited 0)"
+elif [ -n "$T5_RC" ]; then
+  _ok "T5 stdin-draining helper did NOT disarm the gate (synthetic delete still blocked, exit $T5_RC)"
+else
+  _no "T5 could not run end-to-end (no exit code captured) — treat as unverified, not as pass"
+fi
+
+# ── PR-only policy guard (2026-07-20 operator decision) ──────────────────────────
+# KNOWN-PAIR calibration per CLAUDE.md §Instrument Calibration: a known-POSITIVE that must block
+# and a known-NEGATIVE that must NOT. A guard that fires on everything is as broken as one that
+# never fires — over-blocking trains MAIN_PUSH_OK=1 into muscle memory, which disarms it.
+_pp_run() { # _pp_run <refline> [env...]  -> echoes exit code
+  local refline="$1"; shift
+  local d; d=$(mktemp -d 2>/dev/null || echo "/tmp/fh_pp_$$"); mkdir -p "$d/scripts"
+  ( cd "$d" && git init -q . 2>/dev/null
+    printf '#!/usr/bin/env bash\nexit 0\n' > scripts/session_close_check.sh
+    chmod +x scripts/session_close_check.sh
+    cp "$HOOK" ./h
+    printf '%s\n' "$refline" | env "$@" bash ./h origin https://example.invalid/x.git >/dev/null 2>&1
+    echo "$?" > rc )
+  cat "$d/rc" 2>/dev/null; rm -rf "$d"
+}
+_SHA_A=1111111111111111111111111111111111111111
+_ZERO=0000000000000000000000000000000000000000
+# remote_sha = ZERO (new ref) ISOLATES the PR-only guard from the destructive classifier.
+# First draft used two synthetic non-zero SHAs; the hook could not resolve remote_sha, marked the
+# ref UNCLASSIFIED and fail-closed — so T7/T8 "failed" on the classifier, not on the guard under
+# test. The instrument was measuring itself. (Calibration caught it: the known-NEGATIVE is what
+# exposed it — CLAUDE.md §Instrument Calibration.)
+
+# T6 known-POSITIVE: a non-delete push aimed at main MUST block
+rc=$(_pp_run "refs/heads/main $_SHA_A refs/heads/main $_ZERO")
+[ "$rc" = "1" ] && _ok "T6 direct push to main BLOCKED (known-positive)" \
+                || _no "T6 direct push to main was NOT blocked (rc=$rc) — PR-only policy is fail-open"
+
+# T7 known-NEGATIVE: a feature branch must pass untouched (no over-blocking)
+rc=$(_pp_run "refs/heads/feat/x $_SHA_A refs/heads/feat/x $_ZERO")
+[ "$rc" = "0" ] && _ok "T7 feature-branch push allowed (known-negative, no over-block)" \
+                || _no "T7 feature-branch push was blocked (rc=$rc) — guard over-fires; that trains the override"
+
+# T8 the override is honored and stays explicit
+rc=$(_pp_run "refs/heads/main $_SHA_A refs/heads/main $_ZERO" MAIN_PUSH_OK=1)
+[ "$rc" = "0" ] && _ok "T8 MAIN_PUSH_OK=1 override honored" \
+                || _no "T8 override did not work (rc=$rc) — an unusable escape hatch gets --no-verify instead"
+
+echo "── prepush stdin integrity: $([ "$FAILED" -eq 0 ] && echo PASS || echo FAIL) ──"
+exit "$FAILED"

package/scripts/tier_census_grep.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# tier_census_grep.sh — word-boundary tier-reference census helper (Sonnet-Floor Doctrine).
+#
+# WHY (origin: fh_signal_2026-07-10_session — Sonnet full-loop probe): the naive census pattern
+# `opus|sonnet|haiku|floor|tier|model:` false-positives heavily ("frontier" matches `tier`,
+# "floors" prose, method-sense "model"). The probe self-corrected, but per the doctrine's own
+# prescription ladder (step 1: mechanize) the discipline belongs in a script, not re-derived
+# per session. Built 2026-07-10 on operator instruction (evidence-threshold overridden by
+# explicit "complete it" — recorded, not silent).
+#
+# WHAT: emits candidate tier-reference hits with word-boundary patterns, one line per hit
+# (file:line:text), for the auditor to CLASSIFY per sonnet_floor_doctrine.md's table
+# (trust-floor / availability-gate / advisory / N-A). The script finds candidates; the
+# classification stays a judged step with the doctrine table as its anchor.
+#
+# Sense-filter hints (printed, not auto-applied — de-noising must never hide a real gate):
+#   - "frontier|multi-tier|C-tier|A/B-tier" → usually N/A (different axis: content/data tiers)
+#   - "hub model|mental model|data model"   → usually N/A (methodology sense of "model")
+#   - execution tier S/M/L/XL               → N/A (token budget, not model tier — fh_detail_protocols)
+#
+# Usage: bash scripts/tier_census_grep.sh <file> [file...]     Exit: 0 always (census, not gate)
+
+set -uo pipefail
+
+if [ $# -eq 0 ]; then
+  echo "usage: bash scripts/tier_census_grep.sh <file> [file...]" >&2
+  exit 0
+fi
+
+PATTERN='\b(opus|sonnet|haiku|fable)\b|\bfloor(-status|-tier|s)?\b|\btiers?\b|(^|[^a-zA-Z])model:'
+
+for f in "$@"; do
+  if [ ! -f "$f" ]; then
+    echo "── $f: NOT FOUND (phantom input — check the path) ──"
+    continue
+  fi
+  echo "── census candidates: $f ──"
+  # -P where available (GNU/pcre); BSD grep on macOS supports -E word boundaries via [[:<:]] —
+  # portable route: grep -nEi with \b works on GNU; on BSD use perl fallback.
+  if echo x | grep -P 'x' >/dev/null 2>&1; then
+    grep -nPi "$PATTERN" "$f" || echo "   (0 candidates)"
+  else
+    # 0-hit에도 "(0 candidates)"를 찍는다 — GNU 분기와 출력 대칭 (pmh-parity 포트가 잡은 갭, 역이식 2026-07-10)
+    hits=$(perl -ne 'print "$.:$_" if /\b(opus|sonnet|haiku|fable)\b|\bfloor(-status|-tier|s)?\b|\btiers?\b|(^|[^a-zA-Z])model:/i' "$f")
+    if [ -n "$hits" ]; then printf '%s\n' "$hits"; else echo "   (0 candidates)"; fi
+  fi
+done
+
+cat <<'HINTS'
+── classify each hit per sonnet_floor_doctrine.md (trust-floor / availability-gate / advisory / N-A) ──
+   N/A sense hints (verify, don't auto-drop): frontier·C-tier·A/B-tier (content-tier axis) ·
+   "hub/mental/data model" (methodology sense) · S/M/L/XL execution tier (token budget, not model).
+HINTS
+exit 0

package/scripts/universal_guard_check.sh

@@ -0,0 +1,280 @@
+#!/usr/bin/env bash
+# universal_guard_check.sh — known-pair anchor for the pre-commit UNIVERSAL guards.
+#
+# WHAT IT PINS (2026-07-26, N=5 of the gate-locality class):
+#   The confidentiality/privacy guards in templates/.git-hooks/pre-commit are SURFACE-scoped
+#   ("content is being committed to a public repo"), NOT 4-axis-scoped ("an FH asset changed").
+#   They used to be authored below the `exit 0  # No FH assets staged` line, so their scope
+#   silently inherited the 4-axis classifier's asset pathspec: a commit staging only non-asset
+#   paths skipped the confidentiality scan entirely. Measured then: 46/241 tracked files (19.1%)
+#   unscannable that way, 32 also outside npm files[] (no publish-time backstop either).
+#   This anchor fails if that coupling is ever reintroduced.
+#
+#   It also pins the credential-SHAPE patterns imported the same day from the cross-audited sister
+#   asset PromptPartner/agentsmith (tracks/_audit/session_2026_07_26_agentsmith-sister.md), and the
+#   single measured false positive they carry (the AWS documentation key), so a future pattern edit
+#   cannot silently re-open either direction.
+#
+# WHY BOTH DIRECTIONS ARE PINNED: a gate is only calibrated if it separates a known-positive from
+# a known-negative. Pinning blocks alone would let an over-broad pattern pass this check while
+# training PUBLIC_SURFACE_OK into muscle memory — an over-blocking gate is a disarmed gate.
+#
+# Runs in a THROWAWAY git repo (mktemp): it never touches this repo's index or worktree.
+# Usage: bash scripts/universal_guard_check.sh    → exit 0 all pairs hold, 1 otherwise.
+set -uo pipefail
+
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+DEFAULTS="$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults"
+
+[ -f "$HOOK" ]     || { echo "❌ FAIL — hook not found: $HOOK"; exit 1; }
+[ -f "$DEFAULTS" ] || { echo "❌ FAIL — pattern defaults not found: $DEFAULTS"; exit 1; }
+
+SANDBOX=$(mktemp -d) || { echo "❌ FAIL — mktemp"; exit 1; }
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# ── Test the STAGED blob, not the worktree copy (cross-family audit finding, 2026-07-26) ──
+# A pre-commit anchor that reads the worktree is bypassable: stage a regressed hook or pattern
+# file, restore the worktree copy, and the anchor validates content the commit will not contain.
+# When a path is staged, extract its staged blob and test THAT. Falls back to the worktree copy
+# when the path is not staged (the ordinary "just run the check" case). Fails CLOSED if a staged
+# blob exists but cannot be read — an unreadable subject is not a passing subject.
+#
+# `-c core.quotePath=false --no-renames` for the same two reasons the hook uses them: git quotes
+# non-ASCII paths (so a name-match silently fails), and with rename detection ON a `git mv` of a
+# protected file reports only the DESTINATION — the anchor then found the old path "not staged",
+# fell back to the intact worktree copy, and passed a commit that deletes the very hook it guards
+# (cross-family audit R2, 2026-07-26). With --no-renames the move shows up as a deletion of the
+# protected path, which is caught below and fails closed.
+stage_or_worktree() {  # <repo-relative path> <dest> ; echoes the source used
+  local rel="$1" dest="$2" status
+  status=$(git -C "$REPO_ROOT" -c core.quotePath=false diff --cached --name-status --no-renames 2>/dev/null \
+           | awk -F'\t' -v f="$rel" '$2 == f { print $1; exit }')
+  case "$status" in
+    D) echo deleted-from-index; return 1 ;;   # the protected file is being REMOVED — never a pass
+    '') : ;;                                  # not staged → worktree copy is what a commit keeps
+    *)
+      if git -C "$REPO_ROOT" show ":$rel" > "$dest" 2>/dev/null && [ -s "$dest" ]; then
+        echo staged; return 0
+      fi
+      echo unreadable-staged; return 1 ;;
+  esac
+  cp "$REPO_ROOT/$rel" "$dest" 2>/dev/null && { echo worktree; return 0; }
+  echo missing; return 1
+}
+
+HOOK_SRC=$(stage_or_worktree "templates/.git-hooks/pre-commit" "$SANDBOX/.hook-under-test") || {
+  echo "❌ FAIL — pre-commit blob unreadable ($HOOK_SRC) — fail-closed."; exit 1; }
+DEF_SRC=$(stage_or_worktree ".claude/rules/.public-surface-patterns.defaults" "$SANDBOX/.defaults-under-test") || {
+  echo "❌ FAIL — pattern defaults blob unreadable ($DEF_SRC) — fail-closed."; exit 1; }
+HOOK="$SANDBOX/.hook-under-test"
+DEFAULTS="$SANDBOX/.defaults-under-test"
+
+git -C "$SANDBOX" init -q 2>/dev/null
+git -C "$SANDBOX" config user.email "test@example.com"
+git -C "$SANDBOX" config user.name "test"
+mkdir -p "$SANDBOX/.claude/rules" "$SANDBOX/scripts"
+cp "$DEFAULTS" "$SANDBOX/.claude/rules/.public-surface-patterns.defaults"
+# The hook now sources the shared scan library, so the sandbox needs it too. When it was missing,
+# the gate correctly failed closed — and 3 of the "clean" pairs still scored PASS because the oracle
+# below did not recognise "scanner cannot run" as a not-armed state. Both were fixed together.
+cp "$REPO_ROOT/scripts/psa_scan_lib.sh" "$SANDBOX/scripts/psa_scan_lib.sh" 2>/dev/null \
+  || { echo "❌ FAIL — scripts/psa_scan_lib.sh missing — fail-closed."; exit 1; }
+# An initial commit so the hook's staged-vs-HEAD steps have a HEAD to diff against. Without it
+# they emit "fatal: ambiguous argument 'HEAD'" — harmless to the verdicts here, but noise in a
+# check whose whole job is to make a real signal legible.
+printf 'sandbox\n' > "$SANDBOX/.seed"
+git -C "$SANDBOX" add .seed >/dev/null 2>&1
+git -C "$SANDBOX" commit -qm seed >/dev/null 2>&1
+
+# Synthetic operator literal — this file is public, so the anchor must NOT name the real one.
+OVERRIDE="$SANDBOX/.psa_override"
+printf 'HIGH\tzzsynthoperator\n' > "$OVERRIDE"
+
+FAILED=0
+
+# run_case <name> <path> <content> <expect: leak|clean>
+run_case() {
+  local name="$1" path="$2" content="$3" expect="$4" out hasleak
+  mkdir -p "$SANDBOX/$(dirname "$path")" 2>/dev/null
+  printf '%s\n' "$content" > "$SANDBOX/$path"
+  git -C "$SANDBOX" add -- "$path" >/dev/null 2>&1
+  out=$(cd "$SANDBOX" && PSA_PATTERNS="$OVERRIDE" bash "$HOOK" 2>&1); local rc=$?
+  # ORACLE (hardened after a cross-family audit, 2026-07-26): "no leak line" alone is NOT a safe
+  # proxy for "verified clean" — it also describes a hook that errored, exited early, or never
+  # reached the scan. That conflation would score an un-run gate as a passing one, which is the
+  # exact failure mode this anchor exists to detect. So a `clean` verdict additionally REQUIRES
+  # proof that the confidentiality scan actually ran and reported a pass. Anything else is
+  # INCONCLUSIVE, and inconclusive fails.
+  if printf '%s' "$out" | grep -qE '❌ (HIGH|MED|LOW) leak'; then
+    # A printed finding that still exits 0 is a REPORT, not a gate (R3 audit, 2026-07-26). Dropping
+    # a FAILED=1 would keep every leak line intact while the commit sails through, and an oracle
+    # that reads only the text would call that a pass. The leak verdict therefore requires the
+    # hook to have actually blocked.
+    if [ "$rc" -ne 0 ]; then hasleak=leak; else hasleak=leak-printed-but-NOT-blocked; fi
+  elif printf '%s' "$out" | grep -qF '[Confidentiality] public-surface scan'; then
+    if printf '%s' "$out" | grep -qE '(INACTIVE|INCOMPLETE|unusable pattern|cannot run|scanner cannot)'; then
+      hasleak=inconclusive-gate-not-armed
+    else
+      hasleak=clean
+    fi
+  else
+    hasleak=inconclusive-scan-never-ran
+  fi
+  git -C "$SANDBOX" rm -q --cached -- "$path" >/dev/null 2>&1
+  rm -f "$SANDBOX/$path"
+  if [ "$hasleak" = "$expect" ]; then
+    echo "  ✅ $name (expected $expect)"
+  else
+    echo "  ❌ $name — expected $expect, got $hasleak"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -12
+    FAILED=1
+  fi
+}
+
+echo "[universal-guard] known-pair anchor (throwaway repo: $SANDBOX)"
+
+# ── Pair 1: the closed hole. Same private token, asset vs non-asset path. ──
+# README.md is NOT in the 4-axis classifier's pathspec; before the 2026-07-26 fix this case
+# produced zero output and exit 0. If the guards are ever moved back below the early exit,
+# THIS is the case that goes clean and fails the anchor.
+run_case "non-asset path, private token   → BLOCK" \
+         "README.md" "see zzsynthoperator/home" "leak"
+run_case "asset path,     private token   → BLOCK" \
+         "CATALOG.md" "see zzsynthoperator/home" "leak"
+
+# ── Pair 2: no over-blocking. Ordinary content on both path classes stays clean. ──
+run_case "non-asset path, clean content   → PASS " \
+         "README.md" "ordinary documentation, nothing private" "clean"
+run_case "asset path,     clean content   → PASS " \
+         "CATALOG.md" "ordinary catalog entry, nothing private" "clean"
+
+# ── Pair 3: credential shapes (imported 2026-07-26) vs the documentation key that must not fire. ──
+# The BLOCK fixtures are ASSEMBLED AT RUNTIME from split literals, so this file's own bytes never
+# contain a matching shape. Same trick the repo already uses to keep a scanner scannable (see
+# .public-surface-patterns.defaults §self-match, and agentsmith's leak-gate TERMS): a fixture file
+# excluded from the scan would be a hole a real secret could sit in, so it is not excluded — it is
+# written so there is nothing to find. Do not "simplify" these back into single literals.
+AWS_FIXTURE="AKIA""1234567890ABCDEF"
+PAT_FIXTURE="ghp""_abcdefghijklmnopqrstuvwxyz012345"
+run_case "AWS key shape                   → BLOCK" \
+         "README.md" "aws_key = $AWS_FIXTURE" "leak"
+# The documentation key is left as a plain literal on purpose: it MUST be exempted by
+# PSA_PLACEHOLDER, so its presence here is itself part of the test.
+run_case "AWS DOC example key             → PASS " \
+         "README.md" "example only: AKIAIOSFODNN7EXAMPLE" "clean"
+run_case "GitHub PAT shape                → BLOCK" \
+         "README.md" "token $PAT_FIXTURE" "leak"
+run_case "documented PAT placeholder      → PASS " \
+         "README.md" "export GH_TOKEN=ghp_xxxx" "clean"
+
+# ── Pair 4: MODERN token formats. Every one of these scanned CLEAN against the first import —
+# the borrowed pattern list predates them. Same runtime-assembly rule as above.
+FGPAT_FIXTURE="github""_pat_11ABCDEFGHIJKLMNOPQRST_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGH"
+XAPP_FIXTURE="xapp""-1-A1234567890-B1234567890-abcdefghijklmnop"
+SKPROJ_FIXTURE="sk""-proj-abcdefghijklmnopqrstuvwxyz1234567890"
+run_case "GitHub fine-grained PAT         → BLOCK" \
+         "README.md" "gh = $FGPAT_FIXTURE" "leak"
+run_case "Slack app-level token           → BLOCK" \
+         "README.md" "slack = $XAPP_FIXTURE" "leak"
+run_case "OpenAI project key              → BLOCK" \
+         "README.md" "openai = $SKPROJ_FIXTURE" "leak"
+
+# ── Pair 5: the exemption must be the EXACT documented key, not "anything ending in EXAMPLE".
+# A shape-shaped exemption let a validly-shaped key pass merely by ending in EXAMPLE.
+NEAR_MISS="AKIA""000000000EXAMPLE"
+run_case "AWS key merely ENDING 'EXAMPLE'  → BLOCK" \
+         "README.md" "aws = $NEAR_MISS" "leak"
+
+# ── Pair 5-b: a placeholder must not SHIELD a real token later on the same line. pre-commit took
+# only the first match per line, so `<doc key> then <real key>` scanned clean — fixed in the
+# pre-push copy first and not propagated here until an R7 sweep found it. Pinned in both anchors now.
+run_case "placeholder BEFORE real, one line → BLOCK" \
+         "README.md" "AKIAIOSFODNN7EXAMPLE then $AWS_FIXTURE" "leak"
+
+# ── Pair 6: instrument-fault states must FAIL CLOSED, not print a warning and pass. ──
+# Each of these previously passed at commit time while BLOCKING at publish time — the two copies
+# of this logic had diverged in leniency. run_state_case swaps the pattern source rather than the
+# staged content, so it needs its own runner.
+run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <expect-exit: block|pass>
+  local name="$1" ovc="$2" defmode="$3" expect="$4" out rc got
+  printf 'operator literal zzsynthoperator\n' > "$SANDBOX/README.md"
+  git -C "$SANDBOX" add -- README.md >/dev/null 2>&1
+  local ov="$SANDBOX/.psa_state_override"
+  if [ "$ovc" = "__NONE__" ]; then rm -f "$ov"; else printf '%s\n' "$ovc" > "$ov"; fi
+  local defbak="$SANDBOX/.defaults.bak"
+  if [ "$defmode" = drop ]; then mv "$SANDBOX/.claude/rules/.public-surface-patterns.defaults" "$defbak" 2>/dev/null; fi
+  out=$(cd "$SANDBOX" && PSA_PATTERNS="$ov" bash "$HOOK" 2>&1); rc=$?
+  if [ "$defmode" = drop ]; then mv "$defbak" "$SANDBOX/.claude/rules/.public-surface-patterns.defaults" 2>/dev/null; fi
+  git -C "$SANDBOX" rm -q --cached -- README.md >/dev/null 2>&1; rm -f "$SANDBOX/README.md" "$ov"
+  if [ "$rc" -ne 0 ]; then got=block; else got=pass; fi
+  if [ "$got" = "$expect" ]; then
+    echo "  ✅ $name (expected $expect)"
+  else
+    echo "  ❌ $name — expected $expect, got $got (exit $rc)"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -10
+    FAILED=1
+  fi
+}
+run_state_case "no patterns at all (instrument down) → BLOCK" "__NONE__" drop  block
+run_state_case "malformed regex in override          → BLOCK" "HIGH	zzsynth[" keep block
+run_state_case "empty override + defaults present    → PASS " ""              keep pass
+
+# ── Pair 7: pattern-ROW malformations that are not invalid regex. Each of these used to be skipped
+# in silence, i.e. a detector the author believed in that never existed, and a scan that certified
+# clean. Both forms are trivially produced by hand-editing the gitignored override.
+run_state_case "row with a SPACE instead of a TAB    → BLOCK" "HIGH zzsynthoperator" keep block
+run_state_case "row with a CRLF line ending          → BLOCK" "HIGH	zzsynth[$(printf '\r')" keep block
+
+# ── Pair 8: non-ASCII staged filename. git quotes it by default; a quoted name matches no real
+# file, so the scan skipped the file entirely. This repo's operator works in Korean — the class is
+# routine here, not exotic.
+run_case "non-ASCII filename, credential  → BLOCK" \
+         "유출.md" "aws = $AWS_FIXTURE" "leak"
+run_case "non-ASCII filename, clean       → PASS " \
+         "유출.md" "평범한 문서, 비밀 없음" "clean"
+
+# ── Pair 8-b: a C-QUOTED path (backslash in the name). `core.quotePath=false` handles non-ASCII,
+# but git still C-quotes a backslash, and a quoted spelling matches no real file — so the file was
+# never scanned. R5 closed this with NUL-delimited iteration; a later refactor silently reverted the
+# loop to a line-oriented read and reopened it, which its own cross-family pass caught. Pinned so the
+# next refactor cannot revert it quietly.
+run_case "backslash in filename, credential → BLOCK" \
+         'back\slash.md' "aws = $AWS_FIXTURE" "leak"
+
+# ── Pair 9: rename-AWAY of the protected file. `git mv`-ing the hook out of its gated path used to
+# report only the DESTINATION, so the classifier saw no gate edit and the anchor fell back to the
+# intact worktree copy — a commit could delete the gate while the gate reported PASS.
+echo "  … rename-away of the protected path:"
+RA=$(mktemp -d)
+mkdir -p "$RA/templates/.git-hooks" "$RA/.claude/rules" "$RA/scripts"
+cp "$HOOK" "$RA/templates/.git-hooks/pre-commit"
+cp "$DEFAULTS" "$RA/.claude/rules/.public-surface-patterns.defaults"
+cp "$0" "$RA/scripts/universal_guard_check.sh" 2>/dev/null || true
+( cd "$RA" && git init -q && git config user.email t@example.com && git config user.name t \
+  && git add -A >/dev/null 2>&1 && git commit -qm seed >/dev/null 2>&1 \
+  && git mv templates/.git-hooks/pre-commit pre-commit.disabled >/dev/null 2>&1 \
+  && git show HEAD:templates/.git-hooks/pre-commit > templates/.git-hooks/pre-commit 2>/dev/null \
+  && chmod +x templates/.git-hooks/pre-commit ) || true
+# The worktree copy is RESTORED after staging the move — that is the actual bypass being pinned
+# (index says "gate deleted", worktree says "gate intact"). Without the restore the nested anchor
+# aborts earlier on "hook not found" and the pair would pass for the wrong reason, leaving the
+# staged-blob rename logic unpinned (R3 audit, 2026-07-26).
+if ( cd "$RA" && bash scripts/universal_guard_check.sh >/dev/null 2>&1 ); then
+  echo "  ❌ rename-away of the gate                → expected BLOCK, anchor PASSED"
+  FAILED=1
+else
+  echo "  ✅ rename-away of the gate                (expected BLOCK)"
+fi
+rm -rf "$RA"
+
+echo
+if [ "$FAILED" -eq 0 ]; then
+  echo "[universal-guard] ✅ all known pairs hold"
+  exit 0
+fi
+echo "[universal-guard] ❌ BLOCKED — a known pair broke."
+echo "  A BLOCK→PASS flip means the guard stopped covering a surface it declares it covers."
+echo "  A PASS→BLOCK flip means a pattern got over-broad; over-blocking disarms the gate by"
+echo "  training the PUBLIC_SURFACE_OK override into routine use. Fix the cause, not the pair."
+exit 1