@chrono-meta/fh-gate 1.4.74 → 1.4.76

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.74",
+      "version": "1.4.76",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.74",
+      "version": "1.4.76",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -70,6 +70,24 @@ Agents in this registry belong to the **Automation layer**. Skills (in `plugins/
 
 > **Multi-model sidecar (validated)**: Any FH user can delegate to other models via sidecar — Gemini CLI, OpenAI/Codex CLI, or Copilot CLI's model catalog — invoked with `Bash` from within the Claude Code session. FH is the orchestrating harness; the sidecar is a routing/access layer (not a second harness — different layer entirely). Validated empirically: `echo "prompt" | gemini` works inside a CC session and produces usable output. Sidecar calls are Bash invocations, not agent dispatches — they bypass this registry and are coordinated inline by the skill. Capability routing matters too: Gemini/Antigravity is the natural breadth/multimodal sidecar, while Codex's primary cast is the **repo-grounded audit** sidecar (file reads · grep/source-close · diff & patch · gate execution · phantom/backtrace) — **not** discovery/design-depth; a Codex session with Browser/Chrome connectors mounted can additionally take live web-flow automation as a capability-routed handoff. In a local FH workspace that pairs the public methodology mirror with a private companion store (the `*-be` pattern), route by workspace capability while preserving each repository's ownership boundary. See `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority` for the authority model and the full pattern.
 
+> **Waiting on a sidecar — mechanical, not by eye (2026-07-29).** A sidecar you dispatched is judged
+> ONLY by the typed verdict line from `scripts/sidecar_wait.sh`:
+>
+> ```bash
+> printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 900 -- codex exec -m gpt-5.5 -
+> #   SIDECAR_VERDICT=COMPLETE exit=0 bytes=48489   → read out.txt
+> #   SIDECAR_VERDICT=TIMEOUT  waited=900s bytes=0  → STILL ALIVE, not a result
+> #   SIDECAR_VERDICT=EMPTY    exit=0               → the only state meaning "it said nothing"
+> ```
+>
+> **Never judge a sidecar by looking at its output file.** A live process and a dead one produce the
+> same zero bytes, and only process state separates them. Measured here: a session backgrounded two
+> sidecars, read their files after 1 s and 30 s, recorded *"both returned 0-output"* into five
+> records — and both had answered, with four real findings, one of which showed the change under
+> review was over-applied. The mis-read nearly retired a working mechanism. This rule is repeated in
+> this file because line 71 tells you to invoke sidecars with `Bash`; a runtime reading only that
+> would dispatch with no waiting discipline at all. Canonical: `auto-decorrelation` SKILL.md §S-1b.
+
 > **Runtime authority — hard stop line (Codex / non-Claude runtimes):** your findings are **evidence candidates, not terminal verdicts**. They are not final until the governor source-closes them against a **mechanical anchor** (a local file hit · a literal source span · a passing check) — **never governor agreement alone**. You are a capability-routed **sidecar**, not a co-governor: there is one explicit governor per context. Full doctrine: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
 
 ---

package/CHEATSHEET.md

@@ -497,7 +497,7 @@ Claude agents feature
 | `asset-placement-gate` | Routes a new skill/agent/plugin to the right place (hub vs project), no role overlap | "where does this go", "should this be shared", "hub or project" |
 | `marketplace-gate` | Scores a repo against 5 listing criteria (README, zero-config, maintenance, dup, safety) | "is this OK to publish", "ready for the marketplace", "pre-publish check" |
 | `public-surface-audit` | Scans git-tracked files for operator-private tokens (real username, corp names, home paths) | "did I leak anything", "scan for private tokens", "is my split clean" |
-| `self-marketing-lint` | Flags self-promotional / hype wording in descriptions (plain-text discipline) | "lint the marketing language", "is this description hyped" |
+| `harness-doctor --lint` | Flags self-promotional / hype wording in descriptions (plain-text discipline) | "lint the marketing language", "is this description hyped" |
 
 > **Going public?** Don't run these one at a time — say **"publish"** / **"make this repo public"** and Claude
 > fires the **Pre-Publish Surface Gate** (CLAUDE.md), which runs `public-surface-audit` + `marketplace-gate`

package/CLAUDE.md

@@ -695,7 +695,10 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        **(b) flag the matching card carry item resolved for ⑤** — ⑤ owns the card write (card-last
        guard), ④-c never edits the card. **First-run no-op** if no matching handoff/carry exists.
        (Why-its-own-step origin + ownership split + salience/backstops → §detail below.)
-  → ⑤ Card update ← ABSOLUTE LAST: must capture ①–④-c outcomes
+  → ⑤ **Log-close + card update, in that internal order** ← ABSOLUTE LAST: must capture ①–④-c
+       outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to
+       `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`
+       is CLOSED — a later append re-opens the violation ⑤ exists to prevent.
   → ⑥ Commit card + push
 ```
 
@@ -709,6 +712,16 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
 new findings, a carry item flipped to DONE) feeds INTO ⑤ — card is never written mid-sequence and
 then left open for more work to accumulate after it.
 
+**Why ⑤ became atomic (N=3, 2026-07-28 — three closes in one day)**: the miss was always the same
+shape — a finding surfaced *during* the close and the reflex appended it to `fh_completed`, which is
+correct under ④ and fatal after ⑤. The three prose repairs ("next time write it into the card first")
+all failed, including one session that stated the vow and then broke it in the same close. So the
+sequence is restructured rather than re-promised: `fh_completed` is not a step that runs alongside ⑤,
+it is the **first half of** ⑤. A close-time finding has exactly one landing order — log, then card —
+and there is no remaining moment where appending is the natural move. *Honest scope*: this removes
+the ordering ambiguity, not the reflex; the pre-push gate stays the floor, and on a violation it now
+**names the offending files and prints their last lines** so re-running ⑤ is a delta, not a re-read.
+
 **Mid-session card writes are drafts**: If a task (e.g., a calibration run) internally updates
 the card, that is a draft. The close chain always re-runs ⑤ to capture post-draft activities.
 Never skip ⑤ because "the card was just updated" — check for delta first.

package/knowledge/shared/harness-core/harness_frontier_diagnosis_2026-06-02.md

@@ -56,7 +56,7 @@ hierarchical-context remedy (L1 always-on / L2 session / L3 on-demand) + prompt
 | Candidate | Frontier basis | FH hook |
 |---|---|---|
 | **Machine-readable `agent-card`-style capability registry** for the FH agents (capability / input-output contract, synced to actual file counts) | A2A Agent Card = the discovery standard | Closes the "count drift / no canonical registry" gap already flagged in `fh_ecosystem_positioning.md` |
-| **Coordination-overhead budget** in `context-bridge-dispatch`: parallel-fan-out cap (3–4) + capability-aware routing | Centralized = +285% tokens; team size caps at 3–4 | `plugins/fh-meta/skills/context-bridge-dispatch`, `agent-composer` |
+| **Coordination-overhead budget** (then in `context-bridge-dispatch`, merged into `agent-composer` Step 3-a on 2026-06-02): parallel-fan-out cap (3–4) + capability-aware routing | Centralized = +285% tokens; team size caps at 3–4 | `plugins/fh-meta/skills/agent-composer` |
 
 ### ② Frontier → Org Propagation
 

package/knowledge/shared/harness-core/meta_harness_engineering_definition.md

@@ -55,7 +55,7 @@ Proposed three-layer harness taxonomy:
 |---|---|---|
 | Harness interface | Context injection layer | `CLAUDE.md` · `.claude/rules/*.md` · `MEMORY.md` |
 | Harness mechanisms | Skill bus | `verify-bidirectional` · `steel-quench` · `phantom-quench` · `agent-composer` |
-| Scale | Multi-agent dispatch | Agent View · `context-bridge-dispatch` · `agent-composer` parallel dispatch |
+| Scale | Multi-agent dispatch | Agent View · `agent-composer` parallel dispatch (Step 3-a — absorbed the former context-bridge-dispatch) |
 | *(meta layer, not in taxonomy)* | Harness evolution | `harvest-loop` · `harness-doctor` · `frontier-digest` · `prompt-regression` |
 
 The academic taxonomy covers the **static structure** of a harness. FH adds the **dynamic evolution layer** — the mechanism by which the harness improves itself over time.

package/knowledge/shared/harness-core/multi_model_sidecar_strategy.md

@@ -9,6 +9,12 @@ status: mechanism-validated (cross-provider grader confirmed 2026-06-02)
 > **Validation status** (updated 2026-06-02): mechanism validated by cross-provider grader.
 >
 > 2026-06-01 steel-quench (Issue #47): mechanism confirmed runnable — implementation shipped in PR #36/#37. Original empirical claims (Experiment 1·2) were an internal same-session self-report; raw transcripts not retained, codex grader blocked by network policy.
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 >
 > 2026-06-02 update: Gemini 0.41.2 cross-provider grader run on `pipeline-conductor/SKILL.md` (retained transcript: `tracks/_meta/grader_gemini_pipeline_conductor_2026_06_02.txt`). Gemini found 3 S-grade findings (interaction deadlock, PR-approval deadlock, cadence-lock deadlock); Claude Sonnet-4.6 previously found 3 different S-grade findings (model conflict, invocation contradiction, self-referential sweep). **Zero overlap across 6 S-grade findings** — validates the non-overlapping failure modes claim and perspective diversity mechanism. Provider-identity diversity is empirically confirmed; specific Experiment 2 finding counts on goal-quench (original target) are not directly re-run. Record: `tracks/_meta/grader_gemini_pipeline_conductor_2026_06_02.txt`.
 

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -550,5 +550,33 @@
   prompt_summary: "Would have been: attack the S1~S5 probes + the FP scoping; verify no default-toward-PASS class is hidden by the scoping itself."
   outcome: sustained
   finding: "Ran the adversarial pass INLINE instead. It did find a HIGH (S1 scope-exclusion swallowed `[ -f lib ] || exit 0` dependency guards — the fail-open class), closed with a regression anchor. But inline review is same-context by construction, so the isolation property the gate asks for was NOT obtained."
-  note: "Recorded as `sustained` (decided NOT to invoke) because the session carries a standing instruction: no Agent tool unless the user requests it. FIRST `sustained` entry in this log — and directly relevant to fh_signal_2026-07-28_decorrelation-log-uncalibrated, which measured 0 rejected / 0 sustained across 74 entries and argued the log is written selectively toward optimistic outcomes. Operator decision pending on dispatching before merge."
+  note: "Recorded as `sustained` (decided NOT to invoke) because the session carries a session-level system configuration, not an operator instruction. FIRST `sustained` entry in this log — and directly relevant to fh_signal_2026-07-28_decorrelation-log-uncalibrated, which measured 0 rejected / 0 sustained across 74 entries and argued the log is written selectively toward optimistic outcomes. Operator decision pending on dispatching before merge."
 
+
+- date: 2026-07-28
+  agent: general-purpose Sonnet blind sim (NOT invoked)
+  model: n/a
+  purpose: "Target-tier sim gate (fh_4axis_gate.md) on the salience-dependent CLAUDE.md ⑤ atomicity change"
+  prompt_summary: "Would have been: cold-read the rewritten Session Wrap-up ⑤ at Sonnet and close a session with a finding arriving mid-close — does the atomic ordering actually fire, or does the fh_completed append still happen after the card?"
+  outcome: sustained
+  finding: "Not run. The four other worklist items are mechanical (scripts/hooks — tier-independent, exempt by the gate's own enforcement-column test) and were verified by known-pair + mutation + positive control. The CLAUDE.md ⑤ change is the one item the sim gate actually targets, and it is therefore UNVERIFIED at floor tier — recorded as a residual in the Axes 2-3 marker rather than absorbed silently."
+  note: "Second `sustained` in this log, same cause as the first: session-level system configuration withheld the Agent tool absent an explicit user request (a configured default, NOT something the operator said — the earlier wording blurred the source). The pattern is now n=2 — the gate's near-mandatory sim is structurally unreachable in sessions carrying that instruction, which is a governance question (whose exception is it?) rather than a per-session judgment call. Candidate for fh_signal."
+
+- date: 2026-07-29
+  agent: general-purpose (Sonnet) — blind behavioral sim
+  model: sonnet
+  purpose: "Target-tier sim gate on the salience-dependent auto-decorrelation §S-1b change (sidecar_wait as required form)"
+  prompt_summary: "Play out a real turn: dispatch a sidecar, check it 40s later, find 0 bytes — write the exact commands and the exact sentence you'd record. Then say what you'd skim past."
+  outcome: accepted
+  finding: >-
+    The rule FIRES at Sonnet tier — the sim reproduced the required command verbatim, refused to write
+    "0-output" at the 40s mark, and cited the exact lines that drove each answer. The value was in the
+    two honesty questions: it named the incident narrative as skimmable ("reads like color commentary,
+    and it comes AFTER the command, so a fast reader treats the command as the content"), and named
+    peeking at the output file as the FIRST thing it would do wrong in a hurry. Acted on: the operative
+    one-line rule was hoisted ABOVE the command block.
+  note: >-
+    First Agent-tool dispatch of this session. The two earlier `sustained` entries recorded the tool as
+    withheld by a "standing session instruction"; the operator pointed out they never said that — it is
+    session-level SYSTEM configuration, and the wording blurred the source. Corrected in the markers and
+    here. The operator then explicitly requested the agent, which satisfies the configured exception.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.74",
+  "version": "1.4.76",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -102,6 +102,12 @@
     "scripts/prepush_guard_check.sh",
     "scripts/psa_scan_lib.sh",
     "scripts/session_close_check.sh",
+    "scripts/memory_link_check.py",
+    "scripts/test_memory_link_check.sh",
+    "scripts/memory_nearcheck.py",
+    "scripts/sidecar_wait.sh",
+    "scripts/test_session_close_lanes.sh",
+    "scripts/test_card_drift_probe.sh",
     "scripts/universal_guard_check.sh",
     "scripts/test_prepush_stdin_integrity.sh",
     "scripts/public_surface_scan_files.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.74",
+  "version": "1.4.76",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.74",
+  "version": "1.4.76",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -129,13 +129,48 @@ diversity vs the orchestrator** (orchestrator = Claude/opus → recruit GPT or G
   surfaces a one-line `token-budget-gate` ask per run (*"recruiting codex (~N) — proceed?"*) unless the
   operator has set `paid_auto: true` in the UAP. One-time feature-consent ≠ consent to this spend now.
 - Dispatch via `agent-composer` (no re-implementation of dispatch).
-- **Liveness / hang-catch (mandatory — a hung sidecar never notifies).** A backgrounded CLI that hangs
+- **Wait mechanically — `scripts/sidecar_wait.sh` is the required form, not a suggestion (S-1b).**
+
+  **The rule, before the command, because a Sonnet-tier blind sim of this section said the command
+  reads as "the content" and everything after it as "color commentary" — and named peeking at the
+  output file as the first thing it would do wrong in a hurry:**
+
+  > **Never judge a sidecar by looking at its output file.** A live process and a dead one produce
+  > the same zero bytes. The only readable verdict is the typed `SIDECAR_VERDICT=` line, and it
+  > does not exist until the process has exited.
+
+  ```bash
+  printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 900 -- codex exec -m gpt-5.5 -
+  # → SIDECAR_VERDICT=COMPLETE exit=0 bytes=48489      (read out.txt)
+  # → SIDECAR_VERDICT=TIMEOUT  waited=900s bytes=0     (still alive — NOT a result)
+  # → SIDECAR_VERDICT=EMPTY    exit=0                  (the only state that means "it said nothing")
+  ```
+
+  The runner **refuses to emit a verdict while the process is alive**, so "the sidecar returned
+  nothing" becomes unsayable until it has actually exited. Grep the typed `SIDECAR_VERDICT=` line;
+  never judge by looking at the output file.
+
+  **Why this is mechanical rather than a habit** — the bullets below already described bounding a
+  sidecar, and a session that had them loaded still got it wrong on 2026-07-29: it backgrounded
+  `codex exec` and `agy -p`, read the output files after **1 s and 30 s**, found them empty, and
+  recorded *"both sidecars returned 0-output"* into a gate marker, a PR body, a session card, a
+  memory file and a handoff. Both were running normally and both answered — codex with 48 KB and
+  three findings, agy with a further HIGH, and **all four were real**; one of them showed the change
+  under review was over-applied. So the measurement error nearly retired a working mechanism.
+
+  **That is a second failure mode this section did not cover.** The bullets below describe a *hung*
+  sidecar. An impatient read of a *healthy* one produces the identical observation — zero bytes —
+  and only one of the two is a fault. Distinguishing them requires process state, which is exactly
+  what a human eye on an output file cannot see and the runner always reports.
+
+- **Liveness / hang-catch (the runner does the waiting; this is how to read a `TIMEOUT`).** A backgrounded CLI that hangs
   (stuck on a sandbox/file-tool prompt, auth, or network) **does not exit**, so the background-completion
   signal *never fires* — passive waiting is the wrong model and silently stalls the run (observed
   2026-06-27: a `codex exec` that asked to read repo files hung at 0-output with no session log, and the
   turn waited on a notification that could not come). So **bound it actively, never wait open-endedly**:
-  - Set an explicit timeout on every sidecar call (`timeout N …` or the dispatch tool's timeout).
-  - Watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
+  - The timeout is the runner's second argument; pick it from the model's real latency, not from
+    impatience (a reasoning model can be silent for minutes and still be working).
+  - On `TIMEOUT`, watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
     session/log advancing (e.g. `~/.codex/sessions/<today>`). 0 output **and** no session created after a
     short bound (≈2–3 min for codex/agy) = **hung, not slow** → kill and recover, do not keep waiting.
   - **Recover, don't stall**: kill → diagnose (a file-tool/sandbox hang is the common cause) → retry with

package/plugins/fh-meta/skills/sim-conductor/SKILL_detail.md

@@ -172,6 +172,12 @@ Run multi-team? (a) Full panel  (b) Claude sub-agents only  (c) Skip to Area B
 | T2 Copilot | `gh copilot suggest` | challenger · expert | `gh copilot suggest -t shell` |
 | T3 Ollama | `ollama run` | challenger | `ollama run llama3 PROMPT` |
 | T4 Codex | `npx @openai/codex exec` | challenger · edge-case-hunter | `echo PROMPT \| npx @openai/codex exec -m gpt-5 -` |
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 | T5 agy | `agy -p` (gemini successor) | challenger · beginner | `agy -p "PROMPT"` — argument form only (stdin pipe prints help); timebox+retry hard rule (intermittent hang class); -p auto-approves tools → trusted artifacts only |
 
 ### CLI detection bash

package/plugins/fh-meta/skills/steel-quench/SKILL_detail.md

@@ -285,6 +285,12 @@ Default team-persona assignments:
 | **T2 Copilot** | `gh copilot suggest` | devil · expert |
 | **T3 Ollama** | `ollama run {model}` | devil |
 | **T4 Codex** | `npx @openai/codex exec` | devil · edge-case-hunter |
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 | **T5 agy** | `agy -p "PROMPT"` (argument form only — stdin pipe prints help, measured 2026-06-13) | devil · beginner · alternatives (gemini successor) |
 
 **Step 1 — Parallel Team Dispatch**:

package/scripts/degrade_direction_scan.sh

@@ -150,9 +150,24 @@ for f in "${FILES[@]}"; do
     # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
     #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
     #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    #
+    # NARROWED 2026-07-28 after hand-verifying all 9 hits this repo produced: 9/9 were false
+    # positives, i.e. the probe was pure noise for its own class, and 100% FP trains dismissal of
+    # the one hit that will matter. Two distinct causes, both mechanically reproduced:
+    #   (a) `a || b || echo 0` was read as a pipeline — the old regex could anchor its `\|` on the
+    #       SECOND bar of the first `||`. No pipe exists, so no second line can ever be produced.
+    #       (Every `_mtime() { stat -c %Y … || stat -f %m … || echo 0; }` in the tree was flagged.)
+    #   (b) a real pipeline whose failing stage emits NOTHING (`… | jq -r … || echo 0`) — the
+    #       fallback then supplies the only line, which is exactly the intended behavior.
+    # The disarm needs BOTH a real pipe AND a final stage that emits regardless of upstream failure
+    # — a counter (`grep -c`, `wc`). That is the measured shape: `find … | grep -c . || echo 0`
+    # yields "9\n0" and the `-gt` guard goes silent. Verified as a known pair (both directions) in
+    # scripts/test_degrade_scan_shell_probes.sh; narrowing without that anchor would just trade a
+    # noisy probe for a blind one.
     while IFS= read -r m; do
-      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
-    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline ending in a counter (grep -c/wc) — that stage emits even when an upstream stage fails, so under \`set -o pipefail\` the value gains a SECOND line, the integer comparison errors out, and the guard passes silently; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '[^|]\|[[:space:]]*([a-z]+[[:space:]]+)*(grep[^|]*-c|wc)[^|]*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
   fi
 

package/scripts/memory_link_check.py

@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+"""memory_link_check.py — wikilink integrity over the memory graph.
+
+WHY THIS EXISTS (measured 2026-07-28, 872 links across 210 notes)
+
+`memory_intent_recall.md` makes the memory store a GRAPH: nodes are files, edges are `[[links]]`,
+and recall walks one hop from an index hit. That doctrine is only as good as the edges. Nothing
+checked them, and the first measurement found **50 edges pointing at a note that exists under a
+different separator** (`[[feedback-pmh-issue-routing]]` while the file is
+`feedback_pmh_issue_routing.md`) plus **22 pointing at nothing at all**. A 1-hop walk across a dead
+edge returns nothing and looks exactly like "there is nothing related" — the failure is silent, and
+it degrades the one mechanism that is supposed to surface a forgotten lesson.
+
+Absorbed from obsidian-mind's `wikilinks.ts` (MIT, breferrari) — the concern, not the code.
+
+TWO INSTRUMENT RULES LEARNED WHILE WRITING IT, both from wrong first numbers:
+
+  1. RESOLVE ACROSS EVERY STORE THE AUTHOR CAN LINK INTO. A first pass scanned only the memory
+     directory and reported 39 "missing". 17 of those resolve in the hub repo or the companion
+     store — legitimate cross-store edges. Counting them as broken would have overstated the
+     defect by 44% and sent someone hunting for files that are exactly where they belong.
+  2. EXCLUDE THE DOC TEMPLATE. `[[link]]` / `[[name]]` appear inside prose that DESCRIBES the
+     convention. Scoring the instructions as defects is the "probe flags its own remedy" class.
+
+CLASSES (a link is exactly one)
+  ok            resolves in the memory store as written
+  ambiguous     two notes share a normalized name — NEVER auto-fixed, a human picks
+  separator     resolves after -/_ normalization — mechanically repairable, and the only class
+                `--fix-separators` will touch
+  cross-store   resolves in the hub repo or companion store — reported, never "fixed"
+  placeholder   the convention's own example text
+  dangling      resolves nowhere. A human decides: write the note, or drop the edge.
+
+DEGRADE DIRECTION: advisory. This is a reversible surface (a memory edit is re-editable), so it
+reports and never blocks. `--fix-separators` writes, and only for the one class where the target is
+proven to exist.
+
+Usage:
+  python3 scripts/memory_link_check.py [--memory DIR] [--fix-separators] [--quiet]
+Exit: 0 = scanned (always, unless the extractor itself broke) · 2 = extractor found no notes
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+LINK_RE = re.compile(r"\[\[([^\]|#]+)")
+# Fenced blocks are QUOTED CONTENT — a `[[wrong-form]]` inside one is usually an example of the
+# convention, and "fixing" it destroys the documentation that teaches the rule. Skipped on the
+# write path only; they are still COUNTED, because a reader deserves to know they exist.
+#
+# Inline backticks are deliberately NOT skipped. Measured on this corpus (2026-07-28): 25 of the
+# 150 repaired links sat inside inline code and every one was a real link the author had merely
+# styled with backticks — that is this store's citation convention. Fenced-block changes in the
+# same run: 0. So the two spans are not the same thing here, and treating them alike would either
+# damage examples (skip nothing) or leave a quarter of the dead edges dead (skip both).
+FENCE_RE = re.compile(r"```.*?```", re.S)
+PLACEHOLDERS = {"link", "name", "their-name"}
+def default_memory() -> Path | None:
+    """Locate this project's Claude-Code memory dir WITHOUT hard-coding a username or path.
+
+    Claude Code stores per-project memory under ~/.claude/projects/<encoded-abs-path>/memory, and
+    the encoding maps path separators to '-', so it differs per user and per OS. Globbing the
+    encoded tail (parent + project folder) is portable AND keeps an operator's real home path out
+    of a public file — the confidentiality gate rejected the first draft of this line for exactly
+    that reason, which is the gate working.
+    """
+    root = Path(__file__).resolve().parents[1]
+    tail = f"{root.parent.name}-{root.name}"
+    base = Path.home() / ".claude/projects"
+    if not base.is_dir():
+        return None
+    for d in sorted(base.glob(f"*{tail}")):
+        if (d / "memory").is_dir():
+            return d / "memory"
+    return None
+
+
+def extra_roots() -> list[Path]:
+    """Other stores an author may legitimately link into.
+
+    The hub itself, plus any sibling store named by MEMORY_LINK_EXTRA_ROOTS (colon-separated).
+    A private companion store is NOT named here: its name is operator configuration, not a
+    property of this tool, and embedding it would publish a private repo name.
+    """
+    import os
+    roots = [Path(__file__).resolve().parents[1]]
+    for raw in filter(None, os.environ.get("MEMORY_LINK_EXTRA_ROOTS", "").split(":")):
+        roots.append(Path(raw).expanduser())
+    return [r for r in roots if r.is_dir()]
+
+
+def norm(s: str) -> str:
+    return s.replace("-", "_").lower()
+
+
+# Normalized keys whose bucket holds MORE THAN ONE distinct memory note. Auto-fixing these would
+# pick whichever file sorted first and silently reroute an edge to the wrong note — and the reroute
+# is permanent, because the rewritten link then resolves exactly and no later run flags it.
+# Cross-family review (gpt-5.5, 2026-07-29) supplied the reachable input: `alpha-beta.md` and
+# `alpha_beta.md` both exist, a note links `[[Alpha_Beta]]` meaning the underscore one, and case
+# drift alone is enough to send it to the hyphen one. Reported as ambiguous, never rewritten.
+AMBIGUOUS: set[str] = set()
+
+
+def build_index(memory: Path) -> dict[str, tuple[str, str]]:
+    idx: dict[str, tuple[str, str]] = {}
+    AMBIGUOUS.clear()
+    seen: dict[str, str] = {}
+    for p in sorted(memory.glob("*.md")):
+        k = norm(p.stem)
+        if k in seen and seen[k] != p.name:
+            AMBIGUOUS.add(k)
+        seen[k] = p.name
+        idx.setdefault(k, ("memory", p.name))
+    for root in extra_roots():
+        for p in root.rglob("*.md"):
+            if ".git" in p.parts:
+                continue
+            idx.setdefault(norm(p.stem), (root.name, str(p.relative_to(root))))
+    return idx
+
+
+def classify(target: str, memory: Path, idx: dict) -> str:
+    t = target.strip()
+    if t in PLACEHOLDERS:
+        return "placeholder"
+    if (memory / f"{t}.md").exists():
+        return "ok"
+    k = norm(t)
+    hit = idx.get(k)
+    if hit is None:
+        return "dangling"
+    if hit[0] == "memory":
+        return "ambiguous" if k in AMBIGUOUS else "separator"
+    return "cross-store"
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--memory", type=Path, default=None)
+    ap.add_argument("--fix-separators", action="store_true",
+                    help="rewrite ONLY the separator class, whose target is proven to exist")
+    ap.add_argument("--quiet", action="store_true")
+    a = ap.parse_args()
+
+    memory = a.memory or default_memory()
+    if memory is None or not memory.is_dir():
+        print(f"memory-link-check: SKIP (no memory dir at {memory})")
+        return 0
+    notes = sorted(memory.glob("*.md"))
+    if not notes:
+        # Impossible-zero guard: a store with no notes means the path or glob broke. A scan that
+        # cannot see its subject must not report a clean graph.
+        print("memory-link-check: FAIL — 0 notes found; the scan broke, it did not pass", file=sys.stderr)
+        return 2
+
+    idx = build_index(memory)
+    counts: Counter[str] = Counter()
+    dangling: list[tuple[str, str]] = []
+    ambiguous: list[tuple[str, str]] = []
+    seps: list[tuple[Path, str, str]] = []
+
+    for p in notes:
+        text = p.read_text(encoding="utf-8", errors="ignore")
+        for raw in LINK_RE.findall(text):
+            t = raw.strip()
+            k = classify(t, memory, idx)
+            counts[k] += 1
+            if k == "dangling":
+                dangling.append((p.name, t))
+            elif k == "ambiguous":
+                ambiguous.append((p.name, t))
+            elif k == "separator":
+                seps.append((p, t, idx[norm(t)][1][:-3]))
+
+    total = sum(counts.values())
+    if not a.quiet:
+        print(f"memory-link-check: {len(notes)} notes · {total} links")
+        for k in ("ok", "separator", "ambiguous", "cross-store", "placeholder", "dangling"):
+            print(f"  {k:12s} {counts[k]}")
+        if counts["ambiguous"]:
+            print("\n  ambiguous — two notes share a normalized name; a human must pick, the fixer will not:")
+            for t, n in Counter(t for _, t in ambiguous).most_common():
+                print(f"    {n}x  [[{t}]]")
+        if dangling:
+            print("\n  dangling (nothing on disk answers these — write the note, or drop the edge):")
+            for t, n in Counter(t for _, t in dangling).most_common():
+                print(f"    {n}x  [[{t}]]")
+
+    if a.fix_separators and seps:
+        touched, skipped, fixed = 0, 0, 0
+        for p in {s[0] for s in seps}:
+            text = p.read_text(encoding="utf-8")
+            # Split on fenced blocks and rewrite only the parts OUTSIDE them, then rejoin. Doing it
+            # by span keeps the fence contents byte-identical instead of relying on the replacement
+            # string being unique.
+            parts, last, out = [], 0, []
+            for m in FENCE_RE.finditer(text):
+                parts.append((text[last:m.start()], True))
+                parts.append((m.group(0), False))
+                last = m.end()
+            parts.append((text[last:], True))
+            for chunk, editable in parts:
+                if editable:
+                    for _, wrong, right in [s for s in seps if s[0] == p]:
+                        # Rewrite the TARGET only, leaving whatever follows it intact — an anchor
+                        # (`#section`), an alias (`|shown as`), or nothing.
+                        #
+                        # An earlier version enumerated the closing forms by hand (`]]` and `|`)
+                        # and therefore silently skipped `[[target#anchor]]`: the link was still
+                        # COUNTED as repairable, so every later run flagged it again (idempotence
+                        # broken) and the summary reported more fixes than it had made. Found by a
+                        # cross-family reviewer and confirmed by execution before being accepted.
+                        pat = re.compile(r"\[\[" + re.escape(wrong) + r"(?=[\]|#])")
+                        chunk, n = pat.subn(f"[[{right}", chunk)
+                        fixed += n
+                else:
+                    skipped += sum(chunk.count(f"[[{s[1]}") for s in seps if s[0] == p)
+                out.append(chunk)
+            p.write_text("".join(out), encoding="utf-8")
+            touched += 1
+        # Report what was ACTUALLY rewritten, not what was eligible. The two diverged once and the
+        # summary over-reported; a fixer that miscounts its own writes cannot be checked by reading
+        # its output.
+        print(f"\n  fixed {fixed} separator link(s) across {touched} file(s)"
+              + (f"; left {skipped} inside fenced blocks (quoted examples)" if skipped else ""))
+    elif seps and not a.quiet:
+        print(f"\n  {len(seps)} separator link(s) are mechanically repairable → --fix-separators")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())