@chrono-meta/fh-gate 1.4.73 → 1.4.74

package/scripts/below_floor_scan.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# below_floor_scan.sh — standing consumer for below-floor adversarial markers
+#
+# The pre-commit hook accepts a below-floor Axis-2 pass when an operator ack is
+# present, on the promise that "the weekly audit re-queues below-floor markers
+# for floor-tier re-run" (§Floor governance, multi_model_sidecar_strategy.md).
+# This script IS that consumer: it enumerates below-floor markers and reports
+# which ones still await floor-tier re-validation. Read-only, zero side effects.
+#
+# Resolution protocol (append to the marker after acting — machine-greppable):
+#   floor-rerun: <YYYY-MM-DD> <model> PASS|FAIL   ← Axis 2 re-run at >= floor
+#   floor-writeoff: <YYYY-MM-DD> <one-line reason> ← operator writes the ack off
+#
+# Usage: bash scripts/below_floor_scan.sh [repo_root]
+# Exit:  0 = no pending below-floor markers; 1 = pending re-runs found
+#        (manual weekly-audit step — Phase 1.5; exit 1 = raise the pending
+#        items as S-tier. No automated caller is wired yet.)
+
+set -uo pipefail
+
+REPO_ROOT="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+MARKER_DIR="$REPO_ROOT/tracks/_meta"
+PENDING=0
+TOTAL=0
+
+echo "── below-floor marker scan: $MARKER_DIR ──"
+
+if [ ! -d "$MARKER_DIR" ]; then
+  echo "   (no tracks/_meta directory — nothing to scan)"
+  exit 0
+fi
+
+SONNET_PENDING=0
+for m in "$MARKER_DIR"/.axes_23_passed_*.marker; do
+  [ -e "$m" ] || continue
+  # sonnet-floor lane (Sonnet-Floor Doctrine 2026-07-10): anchored Sonnet passes are
+  # first-class at commit time but provisional for judged depth — queued here as
+  # R-tier (advisory re-validation), distinct from below-floor's S-tier hard queue.
+  if grep -qE '^[[:space:]]*floor-status:[[:space:]]*sonnet-floor' "$m"; then
+    name=$(basename "$m")
+    rerun=$(grep -m1 -E '^[[:space:]]*floor-rerun:' "$m" \
+            | sed -E 's/^[[:space:]]*floor-rerun:[[:space:]]*//' || true)
+    writeoff=$(grep -m1 -E '^[[:space:]]*floor-writeoff:' "$m" \
+               | sed -E 's/^[[:space:]]*floor-writeoff:[[:space:]]*//' || true)
+    if [ -n "$rerun" ]; then
+      echo "✅ RESOLVED (re-run)   $name — floor-rerun: $rerun"
+    elif [ -n "$writeoff" ]; then
+      echo "✅ RESOLVED (writeoff) $name — floor-writeoff: $writeoff"
+    else
+      SONNET_PENDING=$((SONNET_PENDING + 1))
+      anchor=$(grep -m1 -E '^[[:space:]]*axis2-anchor:' "$m" \
+               | sed -E 's/^[[:space:]]*axis2-anchor:[[:space:]]*//' || true)
+      echo "🟨 R-tier re-validate  $name (sonnet-floor)"
+      echo "     axis2-anchor: ${anchor:-<missing>}"
+      echo "     action: re-run judged depth at >= opus or via sidecar dispatch when"
+      echo "             available, append 'floor-rerun: ...' — or 'floor-writeoff: ...'"
+    fi
+    continue
+  fi
+  grep -qE '^[[:space:]]*floor-status:[[:space:]]*below-floor' "$m" || continue
+  TOTAL=$((TOTAL + 1))
+  name=$(basename "$m")
+  model=$(grep -m1 -E '^[[:space:]]*axis2-model:' "$m" \
+          | sed -E 's/^[[:space:]]*axis2-model:[[:space:]]*//' || true)
+  ack=$(grep -m1 -E '^[[:space:]]*below-floor-ack:' "$m" \
+        | sed -E 's/^[[:space:]]*below-floor-ack:[[:space:]]*//' || true)
+  rerun=$(grep -m1 -E '^[[:space:]]*floor-rerun:' "$m" \
+          | sed -E 's/^[[:space:]]*floor-rerun:[[:space:]]*//' || true)
+  writeoff=$(grep -m1 -E '^[[:space:]]*floor-writeoff:' "$m" \
+             | sed -E 's/^[[:space:]]*floor-writeoff:[[:space:]]*//' || true)
+
+  if [ -n "$rerun" ]; then
+    echo "✅ RESOLVED (re-run)   $name — floor-rerun: $rerun"
+  elif [ -n "$writeoff" ]; then
+    echo "✅ RESOLVED (writeoff) $name — floor-writeoff: $writeoff"
+  else
+    PENDING=$((PENDING + 1))
+    echo "🟥 PENDING re-run      $name"
+    echo "     axis2-model: ${model:-<missing>} | ack: ${ack:-<missing>}"
+    echo "     action: re-run Axis 2 at >= floor (opus), append 'floor-rerun: ...'"
+    echo "             or operator writes off: append 'floor-writeoff: ...'"
+  fi
+done
+
+echo "── below-floor markers: $TOTAL total, $PENDING pending (S-tier) ──"
+echo "── sonnet-floor markers pending re-validation: $SONNET_PENDING (R-tier, advisory) ──"
+# Exit semantics unchanged: only below-floor (S-tier) hard-fails the scan.
+# sonnet-floor pendings are advisory — reported, never exit-blocking (doctrine:
+# Sonnet base is first-class; the queue exists so residuals terminate, not decorate).
+[ "$PENDING" -gt 0 ] && exit 1
+exit 0

package/scripts/chamber_run.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# chamber_run.sh — chamber run orchestrator (the runner the skeleton's gaps G1-forcing/G2/G4/STATUS all
+# hung on). GLUE ONLY: it wires the pieces that already exist (workspace convention · budget gate notion ·
+# the isolated persona agents · the Emission Gate · the G4 ledger) into one intent-driven, resumable flow
+# so a chamber run can be *completed by intent* rather than hand-followed from the skeleton doc.
+#
+# What it MECHANIZES: workspace + INTENT/BUDGET templates · STATUS stamping (resumable — re-run to advance) ·
+# the budget-entry gate (G2: blocks step 4 until an ESTIMATE is recorded — no uncapped run) · the step-4
+# isolation gate (G1-forcing: blocks step 5 until SIM_NOTES has ≥3 blind persona sections) · the Emission
+# Gate verdict capture · actual-cost record · and the G4 ledger auto-append (idempotent).
+#
+# What it CANNOT mechanize (honest muscle boundary, documented in CHAMBER_RUN_SKELETON.md): bash cannot
+# spawn the isolated Agents itself. Step 4 PRINTS the exact dispatch and GATES on the ≥3 persona artifact —
+# the human/Claude does the actual `fh-meta:{beginner,challenger,main-player}` dispatch. Isolation stays a
+# salience+artifact gate, not a spawn. Budget/cost numbers calibrate only across real runs (muscle, not wiring).
+#
+# Usage:  bash scripts/chamber_run.sh <candidate-slug>          # create/advance the run (idempotent)
+#         bash scripts/chamber_run.sh <candidate-slug> status    # show where the run is
+#   exit 0 = advanced or already complete · exit 1 = blocked on a missing artifact (message says which)
+#   exit 2 = harness error (FH root / bad slug)
+
+set -uo pipefail
+
+FH="$(cd "$(dirname "$0")/.." && pwd)"
+if [ ! -d "$FH/tracks" ] || [ ! -d "$FH/plugins" ]; then
+  echo "❌ FH root not found at '$FH' — run from the FH repo." >&2; exit 2
+fi
+
+SLUG="${1:-}"
+[ -z "$SLUG" ] && { echo "usage: chamber_run.sh <candidate-slug> [status]" >&2; exit 2; }
+# slug charset: [A-Za-z0-9-] only, no leading dash. Rejecting regex metachars (`.` `+` `[` `*`) is
+# load-bearing — $SLUG is interpolated raw into an ERE idempotency grep below; `a.b` would let `.` match
+# any char (idempotency mismatch → duplicate ledger row), `a+b` would break the ERE (Axis-2 LOW-5).
+case "$SLUG" in -*) echo "❌ bad slug '$SLUG' (no leading dash)" >&2; exit 2 ;; esac
+case "$SLUG" in *[!A-Za-z0-9-]*) echo "❌ bad slug '$SLUG' (allowed: letters, digits, hyphen)" >&2; exit 2 ;; esac
+CMD="${2:-advance}"
+
+WS="$FH/tracks/_chamber/$SLUG"
+LEDGER="$FH/tracks/_chamber/INDEX.md"
+STATUS_F="$WS/STATUS"
+TODAY="$(date +%Y-%m-%d)"
+
+_status() { [ -f "$STATUS_F" ] && cat "$STATUS_F" || echo "step-0"; }
+_stamp()  { printf '%s\n' "$1" > "$STATUS_F"; }
+
+if [ "$CMD" = "status" ]; then
+  echo "chamber run '$SLUG' → STATUS: $(_status)"
+  [ -d "$WS" ] && ls -1 "$WS" 2>/dev/null | sed 's/^/    /'
+  exit 0
+fi
+
+echo "── chamber run: $SLUG (STATUS: $(_status)) ──"
+
+# STEP 1 — workspace
+if [ ! -d "$WS" ]; then
+  mkdir -p "$WS" 2>/dev/null || { echo "❌ cannot create workspace $WS" >&2; exit 2; }
+  echo "  ✓ step 1: workspace created ($WS)"
+fi
+_stamp "step-1-done"
+
+# STEP 2 — INTENT.md (template if absent; block until it has real content)
+if [ ! -f "$WS/INTENT.md" ]; then
+  cat > "$WS/INTENT.md" <<EOF
+# INTENT — $SLUG (chamber run)
+
+## Candidate intent
+<one line: the capability/project to incubate>
+
+## Success conditions (each with a check class: mandatory-pass / measured / judged)
+1.
+2.
+
+## Failure cost (blast radius AND reinvention risk)
+-
+
+## Chamber metadata
+- entry reason: <uncertain | exploratory | failure-expensive | high-reinvention-risk>
+- date: $TODAY
+EOF
+  echo "  ⛔ step 2 BLOCKED: fill in $WS/INTENT.md (template written), then re-run."; exit 1
+fi
+if grep -q '<one line: the capability' "$WS/INTENT.md"; then
+  echo "  ⛔ step 2 BLOCKED: $WS/INTENT.md still has the placeholder — fill it, then re-run."; exit 1
+fi
+# gate (a) is "artifact exists WITH real content", not just "placeholder removed" (Axis-2 LOW-6): require
+# at least one non-empty numbered success condition so a gutted INTENT.md doesn't pass.
+if ! awk '/^## Success conditions/{f=1;next} /^## /{f=0} f && /^[0-9]+\.[[:space:]]*[^[:space:]]/{print; exit}' "$WS/INTENT.md" | grep -q .; then
+  echo "  ⛔ step 2 BLOCKED: $WS/INTENT.md has no filled success condition (need a numbered line with content), re-run."; exit 1
+fi
+_stamp "step-2-done"; echo "  ✓ step 2: INTENT.md present"
+
+# STEP 3 — budget-entry gate (G2). Cannot invoke goal-quench from bash; MECHANICALLY require a recorded
+# estimate before any (expensive) simulation runs. No ESTIMATE = no run — that IS the entry cap.
+if [ ! -f "$WS/BUDGET.md" ]; then
+  cat > "$WS/BUDGET.md" <<EOF
+# BUDGET — $SLUG (chamber run)
+
+# Route through goal-quench's budget gate for an expensive run, then record here.
+# Demo-scale runs may self-cap — but an ESTIMATE line is mandatory (this is the entry cap).
+ESTIMATE: <e.g. ~3 persona dispatches, demo-scale, self-capped  |  or a token budget>
+ACTUAL:   <filled at step 6>
+EOF
+  echo "  ⛔ step 3 BLOCKED: record an ESTIMATE in $WS/BUDGET.md (budget-entry gate G2), then re-run."; exit 1
+fi
+if grep -qE '^ESTIMATE:[[:space:]]*<' "$WS/BUDGET.md" || ! grep -qE '^ESTIMATE:[[:space:]]*\S' "$WS/BUDGET.md"; then
+  echo "  ⛔ step 3 BLOCKED: $WS/BUDGET.md ESTIMATE is empty/placeholder (G2 entry cap), then re-run."; exit 1
+fi
+_stamp "step-3-done"; echo "  ✓ step 3: budget ESTIMATE recorded (entry cap satisfied)"
+
+# STEP 4 — persona simulation (G1-forcing gate). Dispatch is human/Claude-side (bash can't spawn Agents);
+# gate on the ≥3 blind persona artifact. Isolation is the mechanism — the runner enforces the artifact, not the spawn.
+if [ ! -f "$WS/SIM_NOTES.md" ]; then
+  echo "  ⛔ step 4 BLOCKED: dispatch 3 BLIND ISOLATED Agents and record each in $WS/SIM_NOTES.md:"
+  echo "        Agent fh-meta:beginner      → first-contact friction"
+  echo "        Agent fh-meta:main-player   → daily-use / target-user value"
+  echo "        Agent fh-meta:challenger    → skeptic: emit value? failure cost? what's invisible?"
+  echo "     Each as '## <persona> ...' section. (sim-conductor fills persona_container_schema's 6 slots.)"
+  exit 1
+fi
+# count DISTINCT personas (not raw lines — 3×"## beginner" must NOT satisfy the 3-blind-persona gate).
+NPERS=0
+for _p in beginner main-player challenger; do
+  grep -iqE "^##[[:space:]].*$_p" "$WS/SIM_NOTES.md" 2>/dev/null && NPERS=$((NPERS+1))
+done
+if [ "$NPERS" -lt 3 ]; then
+  echo "  ⛔ step 4 BLOCKED: SIM_NOTES.md has $NPERS/3 DISTINCT blind persona sections (need all of beginner + main-player + challenger)."; exit 1
+fi
+_stamp "step-4-done"; echo "  ✓ step 4: $NPERS blind persona sections present (isolation-gate satisfied)"
+
+# STEP 5 — Emission Gate. Require a VERDICT: EMIT | PARTIAL-EMIT | KILL.
+if [ ! -f "$WS/EMISSION_VERDICT.md" ]; then
+  cat > "$WS/EMISSION_VERDICT.md" <<EOF
+# Emission Gate Verdict — $SLUG (chamber run)
+
+VERDICT: <EMIT | PARTIAL-EMIT | KILL>
+
+## Judged: does the simulation hold?  (+ mechanical anchor: overlap grep / gate verdicts / reproduced flows)
+
+## Carry-forward (what compounds into the next run)
+-
+EOF
+  echo "  ⛔ step 5 BLOCKED: decide WITH the operator (HITL), record VERDICT in $WS/EMISSION_VERDICT.md, re-run."; exit 1
+fi
+# PARTIAL-EMIT listed FIRST in every alternation so it is never mis-extracted as its EMIT substring.
+VERDICT=$(grep -ioE '^VERDICT:[[:space:]]*(PARTIAL-EMIT|EMIT|KILL)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | head -1 | grep -ioE 'PARTIAL-EMIT|EMIT|KILL' | head -1 | tr 'a-z' 'A-Z')
+# a bare "## Verdict:" prose line (run #3 style) also counts if it names KILL/EMIT
+[ -z "$VERDICT" ] && VERDICT=$(grep -ioE 'VERDICT[: *]+\**(PARTIAL-EMIT|EMIT|KILL)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | grep -ioE 'PARTIAL-EMIT|EMIT|KILL' | head -1 | tr 'a-z' 'A-Z')
+if [ -z "$VERDICT" ]; then
+  echo "  ⛔ step 5 BLOCKED: no VERDICT (EMIT|PARTIAL-EMIT|KILL) found in $WS/EMISSION_VERDICT.md, re-run."; exit 1
+fi
+_stamp "step-5-done"; echo "  ✓ step 5: Emission Gate verdict = $VERDICT"
+
+# STEP 6 — actual cost / carry-forward record.
+if grep -qE '^ACTUAL:[[:space:]]*<' "$WS/BUDGET.md" || ! grep -qE '^ACTUAL:[[:space:]]*\S' "$WS/BUDGET.md"; then
+  echo "  ⛔ step 6 BLOCKED: record ACTUAL cost in $WS/BUDGET.md (actual-vs-estimate calibration), re-run."; exit 1
+fi
+_stamp "step-6-done"; echo "  ✓ step 6: actual cost recorded"
+
+# STEP 7 — terminus + G4 ledger auto-append (idempotent).
+if [ ! -f "$LEDGER" ]; then
+  echo "  ⚠ step 7: no ledger at $LEDGER — skipping auto-append (fail-visible)."
+elif grep -qE "^\|[^|]*\|[^|]*\|[^|]*\`$SLUG\`" "$LEDGER"; then
+  echo "  ✓ step 7: ledger already has a row for '$SLUG' (idempotent — no duplicate append)."
+else
+  NEXT=$(grep -oE '^\|[[:space:]]*#([0-9]+)' "$LEDGER" | grep -oE '[0-9]+' | sort -n | tail -1)
+  NEXT=$(( ${NEXT:-0} + 1 ))
+  CARRY=$(grep -A2 -iE '^##[[:space:]]*Carry-forward' "$WS/EMISSION_VERDICT.md" 2>/dev/null | grep -E '^-[[:space:]]*\S' | head -1 | sed 's/^-[[:space:]]*//; s/|/·/g')
+  [ -z "$CARRY" ] && CARRY="see $SLUG/EMISSION_VERDICT.md"
+  printf '| #%s | %s | `%s` | **%s** | %s | `%s/` |\n' "$NEXT" "$TODAY" "$SLUG" "$VERDICT" "$CARRY" "$SLUG" >> "$LEDGER"
+  echo "  ✓ step 7: appended run #$NEXT ($VERDICT) to the G4 ledger."
+fi
+_stamp "step-7-done"
+
+echo ""
+case "$VERDICT" in
+  EMIT) echo "TERMINUS (EMIT): route by class — field harness → Full-Harness Mode (auto_project_mapping.md §6);"
+        echo "                 FH-internal utility → New-Skill Pre-Commit gate + asset-placement-gate." ;;
+  PARTIAL-EMIT) echo "TERMINUS (PARTIAL-EMIT): the standing candidate is killed; fold the surviving sliver into an"
+                echo "                 existing asset / the skeleton (no new asset). Workspace stays as evidence." ;;
+  KILL) echo "TERMINUS (KILL): first-class success — a cheap run prevented a speculative/reinvention build."
+        echo "                 No emit. Workspace stays as the evidence record; seen-filter will skip re-listing it." ;;
+esac
+echo "chamber run '$SLUG' COMPLETE (STATUS: step-7-done, verdict $VERDICT)."
+exit 0

package/scripts/fh_env_delta_scan.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# fh_env_delta_scan.sh — Mode D SessionStart ENVIRONMENT-DELTA detector (mechanical).
+#
+# WHY: FH's "undeployed-asset discovery + auto-mapping" (CLAUDE.md claim ②) works ONLY when a skill
+# is explicitly invoked. The AUTONOMOUS half — "the environment changed (a new sibling repo pulled,
+# a task-first session opened in an unmapped project) → detect it and propose setup" — did NOT exist
+# in code. It was suppressed by the onboarding guards (metadata-is-not-intent, task-first skip), which
+# are correct (they stop FALSE onboarding from branch-name metadata) but also silence GENUINE
+# env-change setup. (Measured miss 2026-07-06: pulling pmh in the company env was not self-detected.
+# Cross-family confirmed 2026-07-06: Claude workflow + codex both rated ② PARTIAL/THEATER, biggest 허풍.)
+#
+# WHAT: this is the SIBLING of scripts/fh_session_load.sh. That hook closes the companion-store
+# FRESHNESS gap ("did the store change?"); THIS hook closes the CAPABILITY-SURFACE gap ("did the
+# environment change?"). It scans the projects root for git repos that are neither mapped
+# (tracks/{name}/ — the is-mapped signal, feedback_tracks_dir_is_mapped_signal) nor wizard-done
+# (~/.cc_sentinels/{name}_wizard_done), and emits a ONE-LINE proposal into turn-0 context. It fires
+# BEFORE the first user turn regardless of what the user types — so it closes the task-first salience
+# gap mechanically, exactly as fh_session_load.sh does for freshness.
+#
+# INVARIANTS:
+#  - PROPOSE, never auto-act. Detection is mechanical; mapping/install stays approval-gated (HITL).
+#    The hook emits a proposal line; the agent decides whether to surface/act. (metadata-is-not-intent:
+#    a mechanical fs delta is a proposal input, not an executed mapping.)
+#  - ONE-LINE proposal, NOT the onboarding menu. The guards suppress menus for a reason; this is a
+#    targeted delta, not a door skeleton.
+#  - Silent no-op when nothing is new (no repos, or all mapped/wizard-done). Majority path = quiet.
+#  - Offline-safe / fast: pure local filesystem, no network, maxdepth-1 scan.
+#  - Non-Mode-D public users: harmless — it only ever PROPOSES /install-wizard --dry-run, which is
+#    itself read-only. Still, gate on the hub being present so a bare plugin install stays silent.
+
+set -u
+
+# FH = the HUB, derived from THIS script's location ($FH/scripts/fh_env_delta_scan.sh → ../ = hub) —
+# NOT from CLAUDE_PROJECT_DIR. (codex cross-family review 2026-07-06 [HIGH]: defaulting FH to
+# CLAUDE_PROJECT_DIR made a hook run inside a new FIELD repo resolve FH to that field repo → the
+# `tracks` guard failed → the hook silently did NOT fire in exactly the new-project scenario it exists
+# for. Deriving from $0 makes FH correct wherever invoked.) HUB_DIR override still wins for tests.
+FH="${HUB_DIR:-$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)}"
+FH="${FH:-$HOME/projects/forge-harness}"
+ROOT="${FH_PROJECTS_ROOT:-$(dirname "$FH")}"
+BE="${BE_DIR:-}"                          # companion store — never a mapping candidate
+SENT="${CC_SENTINEL_DIR:-$HOME/.cc_sentinels}"
+
+# Only operate where the hub actually exists (keeps bare-plugin installs silent).
+[ -d "$FH/tracks" ] || exit 0
+[ -d "$ROOT" ] || exit 0
+
+_abspath() { CDPATH= cd -- "$1" 2>/dev/null && pwd; }
+FH_ABS="$(_abspath "$FH")"
+BE_ABS=""; [ -n "$BE" ] && BE_ABS="$(_abspath "$BE")"
+
+# _candidate DIR → echoes basename if DIR is an unmapped mapping candidate, else nothing + returns 1.
+# ONE predicate for BOTH sibling-scan and current-cwd (codex [MED]×2: cwd previously had weaker
+# exclusions + ignored the skip sentinel → could propose the hub/companion/hidden repo and re-nag a
+# skipped repo). [LOW]: `-e .git` (not `-d`) so git worktrees/submodules (`.git` is a file) count.
+_candidate() {
+  local d abs name
+  abs="$(_abspath "$1")" || return 1
+  [ -n "$abs" ] || return 1
+  [ -e "$abs/.git" ] || return 1                       # real repo (dir OR file .git = worktree)
+  name="$(basename "$abs")"
+  [ "$abs" = "$FH_ABS" ] && return 1                   # not the hub
+  [ -n "$BE_ABS" ] && [ "$abs" = "$BE_ABS" ] && return 1   # not the companion store
+  case "$name" in _*|.*) return 1 ;; esac              # not underscore/hidden
+  [ -d "$FH/tracks/$name" ] && return 1                # mapped (is-mapped signal)
+  [ -f "$SENT/${name}_wizard_done" ] && return 1       # wizard already run
+  [ -f "$SENT/${name}_mapping_skipped" ] && return 1   # operator skipped → mechanical no-re-nag
+  printf '%s' "$name"
+}
+
+CANDIDATES=""
+COUNT=0
+for d in "$ROOT"/*/; do
+  [ -d "$d" ] || continue
+  name="$(_candidate "$d")" || continue
+  [ -n "$name" ] || continue
+  COUNT=$((COUNT + 1))
+  [ "$COUNT" -le 6 ] && CANDIDATES="${CANDIDATES}${name}, "
+done
+
+# Current cwd itself an unmapped project? (the pmh-pull / task-first-in-new-project case) — SAME
+# predicate, so identical exclusions + skip-sentinel apply.
+CWD_UNMAPPED="$(_candidate "${CLAUDE_PROJECT_DIR:-$PWD}")" || CWD_UNMAPPED=""
+
+# Nothing new → silent no-op (majority path).
+[ "$COUNT" -eq 0 ] && [ -z "$CWD_UNMAPPED" ] && exit 0
+
+# Emit the delta proposal (one block, imperative). Trim trailing ", ".
+LIST="${CANDIDATES%, }"
+# Emit: keep it LOW-NOISE (target-tier sim 2026-07-06 [noise finding]: naming irrelevant repos on a
+# task-first entry reads as a nag). The current-cwd case is the high-signal one (the pmh-pull scenario
+# = you are working IN an unmapped project right now); siblings collapse to a count + a single
+# actionable (/install-wizard --dry-run), not a named list.
+{
+  echo "⚙️ [FH env-delta] capability-surface change detected (mechanically, even on task-first entry):"
+  if [ -n "$CWD_UNMAPPED" ]; then
+    echo "  • ★ current cwd '$CWD_UNMAPPED' is an UNMAPPED project — you are working in it now; propose mapping it (auto_project_mapping, HITL)."
+  fi
+  if [ "$COUNT" -gt 0 ]; then
+    echo "  • $COUNT unmapped sibling repo(s) under $ROOT — run \`/install-wizard --dry-run\` to review + map (HITL); skip via touch \"$SENT/<name>_mapping_skipped\" (mechanical, no re-nag)."
+  fi
+  # Honest scope (target-tier sim [surfacing residual]): this hook mechanizes the CONTEXT-INJECTION
+  # half of claim ② — the env-change now reliably REACHES turn-0 context. It does NOT mechanize the
+  # SURFACING half (whether the model mentions it to the operator), which stays salience-dependent —
+  # a model cannot be mechanically forced to emit. Surface this in ONE line if the cwd is unmapped;
+  # for siblings-only, mention at most once and never derail an explicit task.
+}
+exit 0

package/scripts/package_coverage_check.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# package_coverage_check.sh — a shipped document must not point at a file the package omits.
+#
+# WHY (measured 2026-07-28): the npm tarball shipped CLAUDE.md, README, CATALOG and the knowledge/
+# base while omitting much of what they instruct the reader to open — 35 distinct paths existed in
+# the repo, were named by a shipped document, and were absent from the tarball. `CLAUDE.md` told
+# consumers to run `templates/predelete_check.sh` before a destructive op; that file did not ship.
+# A gate you are told to run and cannot run is worse than one you were never told about.
+#
+# This is the ANTI-REGROWTH instrument for that class. Closing the 35 once is worth little: the set
+# regrows every time a doc gains a reference or files[] gains an entry. So the check is mechanical
+# and the exceptions are ENUMERATED, never implicit.
+#
+# SOURCE-TREE ONLY. Inside an installed package the un-shipped files are legitimately absent and
+# package.json's files[] may not even be present in a comparable form, so the check self-skips.
+#
+# Usage:  bash scripts/package_coverage_check.sh
+# Exit:   0 = every referenced path is either shipped or explicitly accepted; 1 = a new phantom.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT" || exit 1
+
+if [ ! -d .git ] || [ ! -f package.json ]; then
+  echo "SKIP  package-coverage (not a source checkout)"
+  exit 0
+fi
+
+# ── Accepted-absent, with the reason each one is NOT a defect ────────────────────────────────
+# Adding a line here is a decision, not a silencer: each entry states why shipping it would be
+# wrong. If you cannot write that sentence, the file probably belongs in files[].
+#
+#   .claude/registry/LOCAL_SKILL_REGISTRY.md — per-environment, generated by the registry scan.
+#       Its consumers probe it with `ls … 2>/dev/null` and handle absence; shipping one machine's
+#       registry would hand every consumer a false map of skills they do not have.
+#   .claude/regression/probes.md            — per-environment prompt-regression baselines. The
+#       skill explicitly prints NO_CUSTOM_PROBES when absent. Shipping FH's baselines would make
+#       a consumer's regression run compare against someone else's harness.
+#   scripts/sync-to-be.sh                   — operator-private companion-store sync. Never ships.
+#       (The reference that flags it is a TEST FIXTURE in prepush_guard_check.sh which *creates*
+#        a file of that name to exercise the LOW allowlist — not a pointer to this file at all.)
+#   scripts/sync_guard_check.sh             — anchor for that same operator-private mirror sync;
+#       no shipped hook invokes it.
+ACCEPTED_ABSENT=(
+  ".claude/registry/LOCAL_SKILL_REGISTRY.md"
+  ".claude/regression/probes.md"
+  "scripts/sync-to-be.sh"
+  "scripts/sync_guard_check.sh"
+)
+
+out=$(python3 - "${ACCEPTED_ABSENT[@]}" <<'PY'
+import re, os, json, sys
+accepted = set(sys.argv[1:])
+files = json.load(open('package.json'))['files']
+
+def covered(p):
+    return any(p == f or p.startswith(f.rstrip('/') + '/') for f in files)
+
+shipped = []
+for f in files:
+    if os.path.isfile(f):
+        shipped.append(f)
+    elif os.path.isdir(f):
+        for root, _, names in os.walk(f):
+            shipped.extend(os.path.join(root, n) for n in names)
+
+# Only text surfaces can carry a reference a human or agent would follow.
+shipped = [s for s in shipped if s.endswith(('.md', '.sh', '.js', '.json', '.yaml', '.yml'))]
+
+pat = re.compile(
+    r'(?<![\w/.-])((?:scripts|templates|bin|docs|knowledge|plugins|\.claude)'
+    r'/[A-Za-z0-9_./-]+\.(?:sh|py|js|md|yaml|yml|json|defaults))'
+)
+
+phantom = {}
+for s in shipped:
+    try:
+        text = open(s, encoding='utf-8', errors='ignore').read()
+    except OSError:
+        continue
+    for m in set(pat.findall(text)):
+        # Only a path that REALLY EXISTS here but is left out of the tarball is this defect.
+        # A path that exists nowhere is the ordinary phantom-reference class the ref-path
+        # check above already owns; a path outside files[] that is also absent is nothing.
+        if os.path.exists(m) and not covered(m) and m not in accepted:
+            phantom.setdefault(m, set()).add(s)
+
+# Impossible-zero guard: this repo always has shipped docs. Zero scanned means the extractor
+# broke — report that as a failure rather than letting a dead check print a pass
+# (same rule as count_check.sh and the ref-path extractor).
+if not shipped:
+    print("EXTRACTOR_BROKE")
+    raise SystemExit(2)
+
+for p, srcs in sorted(phantom.items(), key=lambda kv: (-len(kv[1]), kv[0])):
+    print(f"{p}\t{len(srcs)}\t{sorted(srcs)[0]}")
+raise SystemExit(1 if phantom else 0)
+PY
+)
+rc=$?
+
+if [ "$rc" -eq 2 ] || [ "$out" = "EXTRACTOR_BROKE" ]; then
+  echo "FAIL  package-coverage: extractor scanned 0 shipped docs — the check broke, it did not pass"
+  exit 1
+fi
+
+if [ "$rc" -ne 0 ]; then
+  echo "FAIL  package-coverage: shipped document(s) point at file(s) the package omits:"
+  printf '%s\n' "$out" | while IFS=$'\t' read -r path n src; do
+    [ -z "$path" ] && continue
+    printf '        %s  (named by %s shipped doc(s), e.g. %s)\n' "$path" "$n" "$src"
+  done
+  echo "      Fix: add the path to package.json files[], OR list it in ACCEPTED_ABSENT here"
+  echo "      with a one-sentence reason why shipping it would be wrong."
+  exit 1
+fi
+
+echo "PASS  package-coverage: every referenced path is shipped or explicitly accepted (${#ACCEPTED_ABSENT[@]} accepted)"
+exit 0

package/scripts/selfcheck.sh

@@ -99,6 +99,18 @@ else
   fail=1
 fi
 
+# package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
+# ref-path check below: that one asks "does this path exist at all", this one asks "does the
+# CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were
+# absent from the tarball — including templates/predelete_check.sh, which CLAUDE.md instructs you
+# to run before a destructive op. Wired here in the same commit that created it, because the two
+# previous anchors this session shipped with zero callers.
+if [ -f scripts/package_coverage_check.sh ]; then
+  if ! bash scripts/package_coverage_check.sh; then
+    fail=1
+  fi
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 if [ -d ".claude/rules" ]; then

package/scripts/substrate_jump_detector.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# substrate_jump_detector.sh — detect substrate-version jumps (the trigger that was a phantom).
+#
+# WHY: the substrate self-adaptation loop's initiate leg cited a "substrate-version jump trigger"
+# that had NO detector (codex census 2026-07-10 refuted the self-assessment — the trigger existed
+# only as inventory text). This is STRUCTURE-ENFORCING mechanization per the durable-mechanization
+# criterion (sonnet_floor_doctrine.md): version drift lives OUTSIDE the session's context boundary —
+# an infinitely strong model still cannot know what changed on the machine between sessions.
+#
+# WHAT: snapshots substrate versions to a gitignored state file; on the next run, diffs and emits
+# a jump notice naming the doctrine's shed/advance pass. Silent when nothing changed.
+# Wire: one line in the SessionStart hook (fh_session_load.sh) or run standalone.
+#
+# Exit: always 0 (detector, not gate). State: tracks/_meta/.substrate_versions (gitignored).
+
+set -uo pipefail
+
+FH="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+STATE="$FH/tracks/_meta/.substrate_versions"
+
+snapshot() {
+  # one line per component: name=version (unavailable components recorded as absent — an
+  # appearing/disappearing component is itself a jump)
+  echo "claude=$(claude --version 2>/dev/null | head -1 || echo absent)"
+  echo "codex=$(codex --version 2>/dev/null | head -1 || echo absent)"
+  echo "agy=$(agy --version 2>/dev/null | head -1 || echo absent)"
+  echo "node=$(node --version 2>/dev/null || echo absent)"
+  echo "git=$(git --version 2>/dev/null || echo absent)"
+  echo "os=$(uname -sr 2>/dev/null || echo absent)"
+}
+
+CURRENT="$(snapshot)"
+
+if [ ! -f "$STATE" ]; then
+  printf '%s\n' "$CURRENT" > "$STATE"
+  echo "🧭 [substrate] baseline snapshot recorded ($(echo "$CURRENT" | wc -l | tr -d ' ') components)"
+  exit 0
+fi
+
+PREV="$(cat "$STATE")"
+if [ "$CURRENT" = "$PREV" ]; then
+  # silent no-op — a detector that talks every session trains the reader to skip it
+  exit 0
+fi
+
+echo "🧭 [substrate] VERSION JUMP detected — substrate loop initiate leg fires:"
+# show only changed lines (name-keyed diff, bash-3.2 safe)
+while IFS= read -r cur; do
+  name="${cur%%=*}"
+  old=$(printf '%s\n' "$PREV" | grep -m1 "^$name=" || echo "$name=<new>")
+  [ "$cur" != "$old" ] && echo "   $old  →  $cur"
+done <<EOF
+$CURRENT
+EOF
+echo "   → run the shed/advance pass: re-check capability-compensating scaffolding against the new"
+echo "     substrate (sonnet_floor_doctrine.md §durable-mechanization — shed what the model no longer"
+echo "     needs, advance what the new substrate enables). Removals go through the 4-axis gate."
+
+printf '%s\n' "$CURRENT" > "$STATE"
+exit 0

package/scripts/test_marker_floor_lanes.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# test_marker_floor_lanes.sh — regression fixtures for pre-commit validate_marker_floor lanes.
+#
+# Ships with the 2026-07-10 sonnet-floor lane (Sonnet-Floor Doctrine): each closed hole gets a
+# mechanical regression test (Field-Harness Load-Bearing Change Gate convergence condition).
+# Fixtures assert BOTH directions: the new lane admits exactly its intended shape, and every
+# pre-existing guard still blocks (no degrade-toward-permissive regression).
+#
+# Usage: bash scripts/test_marker_floor_lanes.sh   Exit: 0 = all fixtures behave; 1 = regression.
+
+set -uo pipefail
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+
+sed -n '/^marker_recreate_hint()/,/^}/p;/^validate_marker_floor()/,/^}/p' "$HOOK" > "$T/fn.sh"
+
+run() { bash -c "source '$T/fn.sh'; validate_marker_floor '$1'" >/dev/null 2>&1; }
+
+FAIL=0
+check() { # $1=fixture $2=expected(PASS|BLOCK) $3=label
+  if run "$1"; then got=PASS; else got=BLOCK; fi
+  if [ "$got" = "$2" ]; then echo "✅ $3 → $got"; else echo "❌ $3 → $got (expected $2)"; FAIL=1; fi
+}
+
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: sonnet-floor\naxis2-anchor: regression test 5/5 pass\naxis2-evidence: PASS no-S, 2B applied\n' > "$T/m1"
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: sonnet-floor\naxis2-evidence: PASS no-S\n' > "$T/m2"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: sonnet-floor\naxis2-anchor: probe 3/3\naxis2-evidence: PASS no-S\n' > "$T/m3"
+printf 'axis2-engine: inline\naxis2-model: sonnet\nfloor-status: at-floor\naxis2-evidence: PASS no-S\n' > "$T/m4"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: below-floor\naxis2-evidence: PASS no-S\n' > "$T/m5"
+printf 'axis2-engine: quench-challenger\naxis2-model: opus\nfloor-status: at-floor\naxis2-evidence: 1S/4A fixed\n' > "$T/m6"
+printf 'axis2-engine: inline\naxis2-model: haiku\nfloor-status: below-floor\nbelow-floor-ack: "approved, proceed" — canary-only change\naxis2-evidence: PASS no-S\n' > "$T/m7"
+printf 'axis2-engine: inline\naxis2-model: opus\nfloor-status: bogus-status\naxis2-evidence: PASS\n' > "$T/m8"
+
+check "$T/m1" PASS  "sonnet-floor + anchor + sonnet model (new lane, intended shape)"
+check "$T/m2" BLOCK "sonnet-floor WITHOUT anchor (anchor is the compensating requirement)"
+check "$T/m3" BLOCK "haiku claiming sonnet-floor (lane mislabel)"
+check "$T/m4" BLOCK "sonnet claiming at-floor (2026-06-10 mislabel class — guard intact)"
+check "$T/m5" BLOCK "below-floor without ack (guard intact)"
+check "$T/m6" PASS  "opus at-floor (legacy lane intact)"
+check "$T/m7" PASS  "below-floor with quoted ack (legacy lane intact)"
+check "$T/m8" BLOCK "invalid floor-status (fail-closed on unknown value)"
+
+[ "$FAIL" -eq 0 ] && echo "── all marker-floor lane fixtures behave ──"
+exit "$FAIL"