@chrono-meta/fh-gate 1.4.75 → 1.4.77

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.75",
+      "version": "1.4.77",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.75",
+      "version": "1.4.77",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -70,6 +70,24 @@ Agents in this registry belong to the **Automation layer**. Skills (in `plugins/
 
 > **Multi-model sidecar (validated)**: Any FH user can delegate to other models via sidecar — Gemini CLI, OpenAI/Codex CLI, or Copilot CLI's model catalog — invoked with `Bash` from within the Claude Code session. FH is the orchestrating harness; the sidecar is a routing/access layer (not a second harness — different layer entirely). Validated empirically: `echo "prompt" | gemini` works inside a CC session and produces usable output. Sidecar calls are Bash invocations, not agent dispatches — they bypass this registry and are coordinated inline by the skill. Capability routing matters too: Gemini/Antigravity is the natural breadth/multimodal sidecar, while Codex's primary cast is the **repo-grounded audit** sidecar (file reads · grep/source-close · diff & patch · gate execution · phantom/backtrace) — **not** discovery/design-depth; a Codex session with Browser/Chrome connectors mounted can additionally take live web-flow automation as a capability-routed handoff. In a local FH workspace that pairs the public methodology mirror with a private companion store (the `*-be` pattern), route by workspace capability while preserving each repository's ownership boundary. See `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority` for the authority model and the full pattern.
 
+> **Waiting on a sidecar — mechanical, not by eye (2026-07-29).** A sidecar you dispatched is judged
+> ONLY by the typed verdict line from `scripts/sidecar_wait.sh`:
+>
+> ```bash
+> printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 900 -- codex exec -m gpt-5.5 -
+> #   SIDECAR_VERDICT=COMPLETE exit=0 bytes=48489   → read out.txt
+> #   SIDECAR_VERDICT=TIMEOUT  waited=900s bytes=0  → STILL ALIVE, not a result
+> #   SIDECAR_VERDICT=EMPTY    exit=0               → the only state meaning "it said nothing"
+> ```
+>
+> **Never judge a sidecar by looking at its output file.** A live process and a dead one produce the
+> same zero bytes, and only process state separates them. Measured here: a session backgrounded two
+> sidecars, read their files after 1 s and 30 s, recorded *"both returned 0-output"* into five
+> records — and both had answered, with four real findings, one of which showed the change under
+> review was over-applied. The mis-read nearly retired a working mechanism. This rule is repeated in
+> this file because line 71 tells you to invoke sidecars with `Bash`; a runtime reading only that
+> would dispatch with no waiting discipline at all. Canonical: `auto-decorrelation` SKILL.md §S-1b.
+
 > **Runtime authority — hard stop line (Codex / non-Claude runtimes):** your findings are **evidence candidates, not terminal verdicts**. They are not final until the governor source-closes them against a **mechanical anchor** (a local file hit · a literal source span · a passing check) — **never governor agreement alone**. You are a capability-routed **sidecar**, not a co-governor: there is one explicit governor per context. Full doctrine: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
 
 ---

package/CLAUDE.md

@@ -531,7 +531,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | **"진단해줘", "개선해줘", "diagnose this", "improve this harness", "check this project", "audit this project"** — said while working **in a mapped project** (not a single-file ask) | **Field-Harness Diagnostic** (see §Field-Harness Diagnostic above → compose existing checks into one ranked M/S/R list → HITL approval per item, nothing auto-fixed) |
 | **"새 프로젝트", "하네스 작성해줘", "이 프로젝트 가속화", "harness-ify this", "accelerate this project"** — an onboarding/acceleration door (returning-menu ①②③) | **Onboarding / Acceleration Autopilot** (see §Onboarding / Acceleration Autopilot above → Phase 0 auto-discover + branch → innovator-centered recommend → ranked install plan → HITL per item, non-overwriting; "끝까지 자율로" → full-autonomy under /goal-quench gate) |
 
-**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed.
+**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed — and, symmetrically, a class **accepted 3× consecutively** earns a one-time "stop asking?" offer (§Consent promotion; never on irreversible surfaces).
 For per-skill utterance patterns, see the relevant `SKILL.md §Trigger Phrases` section.
 
 ### Cadence Rules — Check at Session Start
@@ -564,7 +564,8 @@ Some proposals are not *time*-overdue — they fire **once when a specific work
 Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidirectional`). A **standing, per-user operational loop** tunes FH behavior to the individual during normal field use, and escalates **only generalizable** learnings to the `field-harvest` → FH-origin PR funnel — idiosyncratic taste stays local (drift guard).
 
 - **User Adaptation Profile (UAP)** — `tracks/_meta/user_adaptation_profile.md` (local/gitignored; **behavioral prefs only, never domain content**). Records skill-proposal outcomes (`accepted`/`rejected`/`sustained` — same vocabulary as `operations.md`), preferred tier/language/cadence, recurring friction, muted nags.
-- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
+- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, **offer standing consent on a 3×-accepted class**, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
+- **Consent promotion (accept-side)** — repeated approval must offer to stop asking, not bill the same prompt forever: 3 consecutive `accepted` on a **registered** class (`tracks/_meta/consent_classes.yaml` — classes are declared, never minted mid-run) → **offer once, quoting the three approvals and the exact scope** → granted = a **time-limited lease**, revocable, and every unprompted run announces itself. **Not symmetric with suppression**: a bad suppression costs a re-ask, a bad grant has side effects. **Floor, decided mechanically from the registry — never by the session's own judgment**: a class never promotes if its sinks are irreversible (publish · delete · history-rewrite), if it *feeds* such a sink (**taint propagates through reversible steps**), or if that is **unknown** — unknown is not reversible. No UAP / no registry entry / expired → keep asking (absent ≠ granted). **Named residual: the ledger is self-attested** — mitigated (append-only, quoted evidence), not closed.
 - **Generalization gate** — idiosyncratic → UAP local; generalizable (any user benefits; `≥40%` reject = redefine candidate / `≥60%` accept = reinforce, per `operations.md` gate) → `field-harvest` Mode A → FH PR (HITL).
 - **Ephemeral guard** — UAP is gitignored, wiped on cloud reclaim; in ephemeral sessions operate from defaults, do not fabricate it.
 
@@ -699,6 +700,10 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to
        `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`
        is CLOSED — a later append re-opens the violation ⑤ exists to prevent.
+       **Late finding (named case)**: a finding that surfaces AFTER (b) — including while writing
+       the final message to the operator — means ⑤ is **not done**. Re-run ⑤ **whole**: append,
+       then **rewrite the card**. Appending alone is the violation; the card must never be older
+       than `fh_completed`.
   → ⑥ Commit card + push
 ```
 

package/knowledge/shared/harness-core/multi_model_sidecar_strategy.md

@@ -9,6 +9,12 @@ status: mechanism-validated (cross-provider grader confirmed 2026-06-02)
 > **Validation status** (updated 2026-06-02): mechanism validated by cross-provider grader.
 >
 > 2026-06-01 steel-quench (Issue #47): mechanism confirmed runnable — implementation shipped in PR #36/#37. Original empirical claims (Experiment 1·2) were an internal same-session self-report; raw transcripts not retained, codex grader blocked by network policy.
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 >
 > 2026-06-02 update: Gemini 0.41.2 cross-provider grader run on `pipeline-conductor/SKILL.md` (retained transcript: `tracks/_meta/grader_gemini_pipeline_conductor_2026_06_02.txt`). Gemini found 3 S-grade findings (interaction deadlock, PR-approval deadlock, cadence-lock deadlock); Claude Sonnet-4.6 previously found 3 different S-grade findings (model conflict, invocation contradiction, self-referential sweep). **Zero overlap across 6 S-grade findings** — validates the non-overlapping failure modes claim and perspective diversity mechanism. Provider-identity diversity is empirically confirmed; specific Experiment 2 finding counts on goal-quench (original target) are not directly re-run. Record: `tracks/_meta/grader_gemini_pipeline_conductor_2026_06_02.txt`.
 

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -550,7 +550,7 @@
   prompt_summary: "Would have been: attack the S1~S5 probes + the FP scoping; verify no default-toward-PASS class is hidden by the scoping itself."
   outcome: sustained
   finding: "Ran the adversarial pass INLINE instead. It did find a HIGH (S1 scope-exclusion swallowed `[ -f lib ] || exit 0` dependency guards — the fail-open class), closed with a regression anchor. But inline review is same-context by construction, so the isolation property the gate asks for was NOT obtained."
-  note: "Recorded as `sustained` (decided NOT to invoke) because the session carries a standing instruction: no Agent tool unless the user requests it. FIRST `sustained` entry in this log — and directly relevant to fh_signal_2026-07-28_decorrelation-log-uncalibrated, which measured 0 rejected / 0 sustained across 74 entries and argued the log is written selectively toward optimistic outcomes. Operator decision pending on dispatching before merge."
+  note: "Recorded as `sustained` (decided NOT to invoke) because the session carries a session-level system configuration, not an operator instruction. FIRST `sustained` entry in this log — and directly relevant to fh_signal_2026-07-28_decorrelation-log-uncalibrated, which measured 0 rejected / 0 sustained across 74 entries and argued the log is written selectively toward optimistic outcomes. Operator decision pending on dispatching before merge."
 
 
 - date: 2026-07-28
@@ -560,4 +560,23 @@
   prompt_summary: "Would have been: cold-read the rewritten Session Wrap-up ⑤ at Sonnet and close a session with a finding arriving mid-close — does the atomic ordering actually fire, or does the fh_completed append still happen after the card?"
   outcome: sustained
   finding: "Not run. The four other worklist items are mechanical (scripts/hooks — tier-independent, exempt by the gate's own enforcement-column test) and were verified by known-pair + mutation + positive control. The CLAUDE.md ⑤ change is the one item the sim gate actually targets, and it is therefore UNVERIFIED at floor tier — recorded as a residual in the Axes 2-3 marker rather than absorbed silently."
-  note: "Second `sustained` in this log, same cause as the first: standing session instruction forbids the Agent tool unless the user requests it. The pattern is now n=2 — the gate's near-mandatory sim is structurally unreachable in sessions carrying that instruction, which is a governance question (whose exception is it?) rather than a per-session judgment call. Candidate for fh_signal."
+  note: "Second `sustained` in this log, same cause as the first: session-level system configuration withheld the Agent tool absent an explicit user request (a configured default, NOT something the operator said — the earlier wording blurred the source). The pattern is now n=2 — the gate's near-mandatory sim is structurally unreachable in sessions carrying that instruction, which is a governance question (whose exception is it?) rather than a per-session judgment call. Candidate for fh_signal."
+
+- date: 2026-07-29
+  agent: general-purpose (Sonnet) — blind behavioral sim
+  model: sonnet
+  purpose: "Target-tier sim gate on the salience-dependent auto-decorrelation §S-1b change (sidecar_wait as required form)"
+  prompt_summary: "Play out a real turn: dispatch a sidecar, check it 40s later, find 0 bytes — write the exact commands and the exact sentence you'd record. Then say what you'd skim past."
+  outcome: accepted
+  finding: >-
+    The rule FIRES at Sonnet tier — the sim reproduced the required command verbatim, refused to write
+    "0-output" at the 40s mark, and cited the exact lines that drove each answer. The value was in the
+    two honesty questions: it named the incident narrative as skimmable ("reads like color commentary,
+    and it comes AFTER the command, so a fast reader treats the command as the content"), and named
+    peeking at the output file as the FIRST thing it would do wrong in a hurry. Acted on: the operative
+    one-line rule was hoisted ABOVE the command block.
+  note: >-
+    First Agent-tool dispatch of this session. The two earlier `sustained` entries recorded the tool as
+    withheld by a "standing session instruction"; the operator pointed out they never said that — it is
+    session-level SYSTEM configuration, and the wording blurred the source. Corrected in the markers and
+    here. The operator then explicitly requested the agent, which satisfies the configured exception.

package/knowledge/shared/rules/operational_adaptation.md

@@ -28,9 +28,136 @@ This loop fills that gap. It is deliberately thin: it **reuses** existing parts
 
 Runs at field-session close, **riding `field-harvest` Mode B** — no new trigger, never an interception. One pass per session.
 
-- **READ** (session start / proposal time): apply UAP — suppress a skill proposal rejected 3+ times (an `accepted` record carries **no** positive auto-action — the skill simply stays surfaced; do not auto-run on acceptance), default to the preferred tier, mute cadence nags the user always declines, and **apply capability-escalation consent** (`sidecar_consent`/`floorup_consent` `declined` → route to the Sonnet / Tier-3 floor, recommend-only, no re-nag; `unset` → ask-once at first need per the consent protocol). (Tier note: the UAP tier default is a session-depth setting; the Mode D model notice is model-only + advisory and never overrides it.)
+- **READ** (session start / proposal time): apply UAP — suppress a skill proposal rejected 3+ times, apply any **standing consent** granted per §Consent promotion below (an `accepted` record on its own still carries **no** positive auto-action — acceptance alone never auto-runs anything; only a granted standing consent does), default to the preferred tier, mute cadence nags the user always declines, and **apply capability-escalation consent** (`sidecar_consent`/`floorup_consent` `declined` → route to the Sonnet / Tier-3 floor, recommend-only, no re-nag; `unset` → ask-once at first need per the consent protocol). (Tier note: the UAP tier default is a session-depth setting; the Mode D model notice is model-only + advisory and never overrides it.)
 - **WRITE** (session close): update outcome counts + new friction points.
 
+## Consent promotion (accept-side) — repeated approval must offer to stop asking
+
+The suppression rule above is **one-directional**: repeated *rejection* changes FH's behavior, repeated
+*approval* changed nothing, so a user who approves the same class every time keeps paying the same
+prompt forever. That asymmetry is the defect this section closes. It is the general-user form of the
+elastic-granularity principle already granted to the operator (`feedback_hitl_elastic_granularity_cto`):
+**the floor is fixed, the approval grain is not.**
+
+**Promotion is not the mirror image of suppression.** Rejection suppresses a *proposal* — a wrong
+suppression costs one manual re-ask. Acceptance authorizes an *action* with the user absent — a wrong
+grant has side effects. Symmetric machinery over asymmetric stakes is itself the error (cross-family
+review, 2026-07-29). So the accept side carries three things the reject side does not: an **explicitly
+scoped** class, an **expiry**, and a **separate confirmation** that is not the same "yes" that approved
+the action in front of the user.
+
+**Classes are declared, never minted at runtime** (this is what makes the trigger mechanical). A class
+is promotion-eligible only if it exists in the **consent-class registry**, `tracks/_meta/consent_classes.yaml`,
+declaring: `owner` (gate/skill) · `mode` · `target scope` · `capabilities` (read / local-write /
+network / dispatch / repo-mutation) · `sinks` (what downstream surface the action can reach). A session
+may **propose** a registry entry (HITL, like any asset) but may **not** invent one mid-run and start
+counting against it. *Origin: without a registry the guard below did not bind — the class could simply
+be recorded over-broad at birth (`sim-conductor` rather than `dispatch read-only sim on a local
+artifact`), and no after-the-fact widening rule can catch a class that was born wide.*
+
+**Registry authorship is itself a capture surface** (cross-family round 2): closing runtime minting
+still leaves the agent drafting a broad entry, framing it as housekeeping, and later enjoying the
+approved breadth. So a proposed entry is promotion-eligible only after it carries (a) an explicit
+`excludes:` list of neighbouring actions the class must **not** cover, (b) 2+ **adversarial examples** —
+concrete actions a reader might assume are inside and that the author asserts are outside — and (c) a
+review by something other than the proposing session (the human, or a cross-family auditor). A class
+definition is reviewed as a **grant of future autonomy**, not as a config row.
+
+**Mechanical floor**: `scripts/consent_registry_check.sh` — joins `standing_consent` against the
+registry and enforces schema, eligibility soundness (a class naming an irreversible or unlisted sink
+**cannot** declare itself promotable), registration, expiry, and recorded scope. Missing registry → N/A
++ promotion disabled; unparseable → fail-closed. Run it before trusting any grant; the prose above is
+the salience layer over this check, not the enforcement.
+
+**Trigger**: the same registered class recorded `accepted` **3 consecutive times**, counted across
+sessions from the UAP outcome log. Refinements that keep the count honest:
+- *Consecutive* means consecutive **within that class's own entries**; other classes interleaved do not
+  break the streak, a single `rejected` or `modified` does. An approval the user altered before granting
+  is logged `modified`, never `accepted`.
+- **Only a promotion-eligible approval prompt counts** — one user gesture, one entry. **Retries of the
+  same operation count once**, and one "yes, do those three" is **one** approval, not three. Ordinary
+  supervised retry ("응, 다시 해봐" ×3) is not durable consent and must never reach the threshold.
+- The running count is **visible to the user at each approval** (`1/3` · `2/3` · `3/3`), so the offer is
+  never the first time they learn a streak was being tallied.
+
+**Action — offer once, with the evidence in the offer**:
+
+> "`<class>` 을 3번 연속 승인했다 (`<date1>`, `<date2>`, `<date3>` — 각각 `<one-line what was approved>`).
+>  범위: `<mode · target · capabilities · sinks>`. 앞으로 `<N>`일간 안 묻고 진행할까?
+>  (언제든 '다시 물어봐')"
+
+The offer **quotes the three approvals and the exact scope**; a grant the user cannot audit is not
+consent. Then:
+
+- **granted** → write `standing_consent: <class>: {granted: <date>, expires: <date+N>, effects: [...]}`.
+  Later instances run unprompted, each **states in one line what it did**, and each **appends a durable
+  entry to `tracks/_meta/consent_runs.log`**. *Post-action chat notice is not a control* (cross-family
+  round 2): a line the user scrolls past has stopped the prompt without replacing it. The chat line is
+  courtesy; the log is the audit surface, and it is the reason standing consent may cover only actions
+  that are **recoverable and locally reviewable** — an unrecoverable action was already excluded by the
+  floor, and an unreviewable one is excluded here.
+  **Expiry is not optional** — at expiry the consent lapses to `unset` and the class is asked again;
+  standing consent is a renewable lease, not a transfer of the decision.
+- **declined** → write `declined`. **Never ask again for that class version** — the same no-re-nag rule
+  as muted cadence reminders. *Scoped to the version, not forever*: a user may decline because the
+  timing was wrong, and permanent suppression with no renewal path is its own defect. A re-offer is
+  allowed only when the class is **materially narrowed** (a new registry version with strictly smaller
+  scope) or the user asks. Re-offering the same scope is a nag.
+- Revocation is always available and never negotiated: "다시 물어봐" / "revoke" → `unset`.
+
+**Floor — what never promotes (규약; this is the whole constraint)**: promotion is available only where
+the *protocol still passes*. Applicability is decided **mechanically, from the registry entry — never by
+the running session's judgment**, because the session that wants to stop being asked is the worst
+possible arbiter of whether it may. A class never promotes, at any count, when:
+
+1. its `sinks` include an **irreversible surface** — publish / go-public, delete, history-rewrite, or any
+   surface guarded by a fail-closed Irreversibility gate (`CLAUDE.md §Irreversibility Gates`); **or**
+2. it **feeds, queues, or enables** such a sink even though it does not itself cross one — **sink
+   tainting**. Reversible steps compose into irreversible outcomes: "edit workflow config" + "write
+   release notes" + "create local commit" are each locally reversible, and a CI workflow publishes the
+   result. Taint propagates along that chain; the floor is inherited, not re-derived per step; **or**
+3. its irreversibility is **unknown or not yet classified** → **no promotion, ask**. Unknown is not
+   reversible. (An unregistered class is by definition unknown, which is why 1–3 collapse to a single
+   mechanical test against the registry.)
+
+Their cost is not the prompt, it is that the thing cannot be undone — grain-independent by construction.
+**The promotion offer itself is HITL**: this section grants no path to auto-approval the user did not
+answer "yes" to once, knowingly and in scope, which is why it does not contradict the "acceptance alone
+never auto-runs" rule above.
+
+**Degrade direction (fail-closed), three ways**: no UAP (ephemeral/cloud session, wiped profile) → **no
+promotion, keep asking**. No registry entry → **no promotion, keep asking**. Expired or unparseable
+record → **`unset`, keep asking**. A missing consent record is never `granted` — an absent measurement is
+not a yes.
+
+**Named residual — the ledger is self-attested (cross-family, 2026-07-29, HIGH, NOT closed).** The UAP
+outcome log is written by the same agent that benefits from fewer prompts, and it is gitignored, so there
+is no ordinary review trail. Nothing in this section fixes that; the honest mitigations only *narrow* it:
+consent events are **append-only** (an entry is superseded, never edited or deleted), the offer must
+**quote the three approvals verbatim** so a user can catch a fabricated streak at the one moment it
+matters, and every unprompted run **announces itself**. A real fix requires the consent record to be
+produced by the approval channel rather than by the consuming agent — outside this rule's reach. **Until
+then, treat every standing consent as auditable-by-the-user-only, and never widen the mechanism's scope
+on the assumption the ledger is trustworthy.**
+
+**Consent binds to the action's SHAPE, not its label** (found by blind target-tier sim, 2026-07-29):
+a class name is a string, and the action behind it can change after consent is granted. A sim that
+merely returned a report when you said "stop asking" may, ten sessions later, write into shared memory
+and trigger a downstream commit — same label, different blast radius, HITL skipped. So a grant records
+**what it was granted for**: the owning gate/skill, and the set of **effect classes** the action had at
+grant time (reads · local writes · network · dispatch · repo-mutation) **plus the `target` scope and
+the `sinks` fingerprint**. On any later run whose fingerprint is **not a subset** of the granted one,
+standing consent **reverts to `unset` and asks again**, naming what widened. Effect classes alone are
+too coarse to be the whole test (cross-family round 2): "local write" stays "local write" whether the
+target is a scratch report or a policy file — the *target* is where that drift shows, which is why it
+is part of the fingerprint and not merely descriptive. Widening is the trigger; narrowing is not. This is the same discipline as the
+byte-identity anchors used elsewhere: consent is pinned to a fingerprint, not to a name, because
+**the name is exactly what does not change when the danger does.**
+
+**Guard against class inflation**: the class recorded is the *narrow* one that was actually approved
+3×, never a widened parent. Three approvals of "dispatch a Sonnet sim" do not grant "dispatch any
+agent" (`feedback_scope_widening_needs_grounding` — widening judgments get no free pass).
+
 ## Generalization gate → reverse-PR funnel
 
 This is the operator's **"원본 반영 가치"** criterion made mechanical. Split each UAP learning:
@@ -46,6 +173,8 @@ This is the operator's **"원본 반영 가치"** criterion made mechanical. Spl
 
 - **UAP WRITE ran** at field-session close (or was correctly skipped — absent profile / ephemeral session). *Check class: mandatory-pass (binary — did Step 5-B.1 execute or log a skip reason).*
 - **UAP READ applied** at session start / proposal time when a profile exists (preferred tier defaulted, 3×-rejected proposals suppressed, declined cadence nags muted). *Check class: judged, pair: the target-tier blind sim below.*
+- **A class at 3 consecutive `accepted`** was either offered promotion once, or correctly not offered with the reason recorded (irreversible surface · already `declined` · no UAP). *Check class: measured — the consecutive count is read off the UAP outcome log, not recalled.*
+- **Every `standing_consent` key resolves to a registry entry whose `sinks` are irreversible-free, and is unexpired.** *Check class: mandatory-pass (binary — join `standing_consent` keys against `consent_classes.yaml`, reject any key that is unregistered, taint-reachable to an irreversible sink, or past `expires`; any hit is a defect, not a judgment call).*
 - **No domain content** entered the UAP this session. *Check class: judged, pair: phantom/content scan of the UAP diff.*
 
 ## Guards

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.75",
+  "version": "1.4.77",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -106,6 +106,10 @@
     "scripts/test_memory_link_check.sh",
     "scripts/memory_nearcheck.py",
     "scripts/sidecar_wait.sh",
+    "scripts/test_sidecar_wait_stdin.sh",
+    "scripts/consent_registry_check.sh",
+    "scripts/test_consent_registry.sh",
+    "templates/consent_classes.yaml.example",
     "scripts/test_session_close_lanes.sh",
     "scripts/test_card_drift_probe.sh",
     "scripts/universal_guard_check.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.75",
+  "version": "1.4.77",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.75",
+  "version": "1.4.77",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -129,13 +129,48 @@ diversity vs the orchestrator** (orchestrator = Claude/opus → recruit GPT or G
   surfaces a one-line `token-budget-gate` ask per run (*"recruiting codex (~N) — proceed?"*) unless the
   operator has set `paid_auto: true` in the UAP. One-time feature-consent ≠ consent to this spend now.
 - Dispatch via `agent-composer` (no re-implementation of dispatch).
-- **Liveness / hang-catch (mandatory — a hung sidecar never notifies).** A backgrounded CLI that hangs
+- **Wait mechanically — `scripts/sidecar_wait.sh` is the required form, not a suggestion (S-1b).**
+
+  **The rule, before the command, because a Sonnet-tier blind sim of this section said the command
+  reads as "the content" and everything after it as "color commentary" — and named peeking at the
+  output file as the first thing it would do wrong in a hurry:**
+
+  > **Never judge a sidecar by looking at its output file.** A live process and a dead one produce
+  > the same zero bytes. The only readable verdict is the typed `SIDECAR_VERDICT=` line, and it
+  > does not exist until the process has exited.
+
+  ```bash
+  printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 900 -- codex exec -m gpt-5.5 -
+  # → SIDECAR_VERDICT=COMPLETE exit=0 bytes=48489      (read out.txt)
+  # → SIDECAR_VERDICT=TIMEOUT  waited=900s bytes=0     (still alive — NOT a result)
+  # → SIDECAR_VERDICT=EMPTY    exit=0                  (the only state that means "it said nothing")
+  ```
+
+  The runner **refuses to emit a verdict while the process is alive**, so "the sidecar returned
+  nothing" becomes unsayable until it has actually exited. Grep the typed `SIDECAR_VERDICT=` line;
+  never judge by looking at the output file.
+
+  **Why this is mechanical rather than a habit** — the bullets below already described bounding a
+  sidecar, and a session that had them loaded still got it wrong on 2026-07-29: it backgrounded
+  `codex exec` and `agy -p`, read the output files after **1 s and 30 s**, found them empty, and
+  recorded *"both sidecars returned 0-output"* into a gate marker, a PR body, a session card, a
+  memory file and a handoff. Both were running normally and both answered — codex with 48 KB and
+  three findings, agy with a further HIGH, and **all four were real**; one of them showed the change
+  under review was over-applied. So the measurement error nearly retired a working mechanism.
+
+  **That is a second failure mode this section did not cover.** The bullets below describe a *hung*
+  sidecar. An impatient read of a *healthy* one produces the identical observation — zero bytes —
+  and only one of the two is a fault. Distinguishing them requires process state, which is exactly
+  what a human eye on an output file cannot see and the runner always reports.
+
+- **Liveness / hang-catch (the runner does the waiting; this is how to read a `TIMEOUT`).** A backgrounded CLI that hangs
   (stuck on a sandbox/file-tool prompt, auth, or network) **does not exit**, so the background-completion
   signal *never fires* — passive waiting is the wrong model and silently stalls the run (observed
   2026-06-27: a `codex exec` that asked to read repo files hung at 0-output with no session log, and the
   turn waited on a notification that could not come). So **bound it actively, never wait open-endedly**:
-  - Set an explicit timeout on every sidecar call (`timeout N …` or the dispatch tool's timeout).
-  - Watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
+  - The timeout is the runner's second argument; pick it from the model's real latency, not from
+    impatience (a reasoning model can be silent for minutes and still be working).
+  - On `TIMEOUT`, watch a **progress signal**, not just process-alive: output bytes growing **and** the CLI's own
     session/log advancing (e.g. `~/.codex/sessions/<today>`). 0 output **and** no session created after a
     short bound (≈2–3 min for codex/agy) = **hung, not slow** → kill and recover, do not keep waiting.
   - **Recover, don't stall**: kill → diagnose (a file-tool/sandbox hang is the common cause) → retry with

package/plugins/fh-meta/skills/sim-conductor/SKILL_detail.md

@@ -172,6 +172,12 @@ Run multi-team? (a) Full panel  (b) Claude sub-agents only  (c) Skip to Area B
 | T2 Copilot | `gh copilot suggest` | challenger · expert | `gh copilot suggest -t shell` |
 | T3 Ollama | `ollama run` | challenger | `ollama run llama3 PROMPT` |
 | T4 Codex | `npx @openai/codex exec` | challenger · edge-case-hunter | `echo PROMPT \| npx @openai/codex exec -m gpt-5 -` |
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 | T5 agy | `agy -p` (gemini successor) | challenger · beginner | `agy -p "PROMPT"` — argument form only (stdin pipe prints help); timebox+retry hard rule (intermittent hang class); -p auto-approves tools → trusted artifacts only |
 
 ### CLI detection bash

package/plugins/fh-meta/skills/steel-quench/SKILL_detail.md

@@ -285,6 +285,12 @@ Default team-persona assignments:
 | **T2 Copilot** | `gh copilot suggest` | devil · expert |
 | **T3 Ollama** | `ollama run {model}` | devil |
 | **T4 Codex** | `npx @openai/codex exec` | devil · edge-case-hunter |
+
+> **사이드카 대기는 기계로 한다** — `scripts/sidecar_wait.sh` 경유가 필수 형식이고, 타입 verdict
+> (`COMPLETE`/`TIMEOUT`/`EMPTY`)만 읽는다. **`EMPTY` 만이 "사이드카가 아무 말 안 했다"** 이다.
+> 출력 파일을 눈으로 보고 판정하지 마라 — 살아있는 프로세스와 죽은 프로세스가 같은 0바이트를
+> 낸다(2026-07-29 실측: 1초/30초 만에 읽고 정상 동작 중인 사이드카 2종을 '실패'로 기록,
+> 실제로는 4건의 진짜 finding 이 나왔다). 정본 = `auto-decorrelation` SKILL.md §S-1b.
 | **T5 agy** | `agy -p "PROMPT"` (argument form only — stdin pipe prints help, measured 2026-06-13) | devil · beginner · alternatives (gemini successor) |
 
 **Step 1 — Parallel Team Dispatch**: