@chrono-meta/fh-gate 1.4.75 → 1.4.77

package/scripts/test_consent_registry.sh

@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# test_consent_registry.sh — known-pair anchor for scripts/consent_registry_check.sh.
+#
+# WHY (cross-family review rounds 1-3, 2026-07-29)
+#   The accept-side consent-promotion rule went REJECT -> NARROW-IT -> NARROW-IT across three
+#   adversarial rounds. Round 3 stopped attacking the prose and attacked the validator, and found
+#   four ways the FLOOR ITSELF was fail-open. Three were confirmed against controls:
+#
+#     - `promotion_eligible: "false"` (quoted) is a truthy STRING. Every eligibility test inverted,
+#       so an intended-ineligible class was granted. One quote character disarmed the floor.
+#     - a duplicate class name silently shadowed the earlier entry, so appending an eligible twin
+#       below an ineligible one laundered the ineligible class into a grant.
+#     - `standing_consent: {inline: ...}` matched no pattern, so an EXPIRED inline grant was read as
+#       "no standing consent recorded" and reported PASS — a grant the checker cannot see is not an
+#       absent grant, it is a false clean.
+#
+#   Each of those is a check that reported green while doing nothing, which is worse than an absent
+#   check: it buys confidence without enforcement. Hence this anchor.
+#
+# Lanes: N* = known-negative (must pass) · P* = known-positive (must be caught) · D* = degrade.
+# Exit 0 = all lanes correct. Exit 1 = the validator regressed toward permissiveness.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHK="$ROOT/scripts/consent_registry_check.sh"
+[ -f "$CHK" ] || { echo "FAIL: $CHK not found"; exit 1; }
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+
+# want_rc: expected exit. want_rule: a rule id that must appear in the output ("" = don't care).
+lane() {
+  local desc="$1" want_rc="$2" want_rule="$3"
+  bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+  local rc=$?
+  if [ "$rc" -ne "$want_rc" ]; then
+    bad "$desc — exit $rc, expected $want_rc"; sed 's/^/     /' "$TD/o"; return
+  fi
+  if [ -n "$want_rule" ] && ! grep -q "❌ $want_rule" "$TD/o"; then
+    bad "$desc — exit was right but rule $want_rule was not the reason"; sed 's/^/     /' "$TD/o"; return
+  fi
+  ok "$desc"
+}
+
+OKCLASS='  - {name: ok, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+mkreg() { printf 'classes:\n%s\n' "$1" > "$TD/r.yaml"; }
+mkuap() { printf '%s\n' "$1" > "$TD/u.md"; }
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "N1 a well-formed registry + eligible unexpired scoped grant passes" 0 ""
+
+mkuap 'standing_consent:
+  ok: declined'
+lane "N2 a declined record is a valid non-grant state, not a malformed grant" 0 ""
+
+mkreg '  - {name: s, owner: o, mode: m, target: t, capabilities: [read], sinks: [go-public], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent: {}'
+lane "P1 a class naming an irreversible SINK cannot declare itself promotable" 1 "R2"
+
+mkreg '  - {name: f, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [go-public], promotion_eligible: true}'
+lane "P2 taint — a class that FEEDS an irreversible sink cannot be promotable" 1 "R2"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ghost: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P3 a grant on an unregistered class is refused (unregistered == unknown)" 1 "R3"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-01-01, expires: 2026-06-30, effects: [read], target: t}'
+lane "P4 an expired lease does not keep running" 1 "R5"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31}'
+lane "P5 a grant with no recorded scope has no re-validation baseline" 1 "R6"
+
+# P6-P8 are the round-3 fail-opens. Each of these PASSED before the fix.
+mkreg '  - {name: q, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: "false"}'
+mkuap 'standing_consent:
+  q: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P6 quoted \"false\" is rejected as a type error, not read as truthy" 1 "R1-b"
+
+mkreg '  - {name: d, owner: o, mode: m, target: t, capabilities: [read], sinks: [go-public], feeds: [], promotion_eligible: false}
+  - {name: d, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent:
+  d: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P7 a duplicate class name cannot launder an ineligible class" 1 "R1-c"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}}'
+lane "P8 an INLINE grant is parsed, not silently read as 'nothing granted'" 1 "R5"
+
+# P10-P11 are the round-4 fail-opens. Both PASSED before the fix, and both were confirmed against a
+# control: the SAME expired grant was caught when it stood alone.
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {}
+
+notes in between
+
+standing_consent:
+  ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}'
+lane "P10 an early empty consent block cannot shadow a later grant (first-match)" 1 "R3"
+
+mkuap 'standing_consent:
+  ok: {state: "revoked ", granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+if bash "$CHK" "$TD/r.yaml" "$TD/u.md" 2>&1 | grep -q "0 active grant"; then
+  ok "P11 a mapping non-grant state is normalized like the scalar one (no divergent normalizer)"
+else
+  bad "P11 \`state: \"revoked \"\` was validated as an ACTIVE grant"
+  bash "$CHK" "$TD/r.yaml" "$TD/u.md" 2>&1 | sed 's/^/     /'
+fi
+
+# P12 is the round-5 fail-open: `or {}` collapsed FALSY non-mappings into a valid-empty mapping
+# before the type check, so `[]`, `false` and `0` all reported "no standing consent" and exit 0 —
+# while the truthy `[a, b]` was caught. The falsy branch is the one an accident actually produces.
+for badval in '  []' '  false' '  0'; do
+  mkreg "$OKCLASS"
+  printf 'standing_consent:\n%s\n' "$badval" > "$TD/u.md"
+  lane "P12 a falsy non-mapping standing_consent ($badval) is a type error, not 'none granted'" 1 "R3"
+done
+
+# P13/N3 — round-6 fail-open: `standing_consent :` (space or tab before the colon) is the SAME YAML
+# key but matched none of the patterns. Standalone it still failed closed via the no-known-form net;
+# paired with a normal empty block it was invisible to both the count and the extraction, so the
+# empty block parsed and the real grant vanished. Confirmed against a control (the identical expired
+# grant in canonical form was caught).
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {}
+
+standing_consent : {ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}}'
+lane "P13 a space-before-colon key cannot hide behind a canonical block" 1 "R3"
+
+mkuap 'standing_consent :
+  ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}'
+lane "P13-b a space-before-colon BLOCK form is parsed and its grant validated" 1 "R5"
+
+mkuap "$(printf 'standing_consent\t: {ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}}')"
+lane "N3 a tab-before-colon key with a VALID grant passes (no over-block)" 0 ""
+
+# P14 — round-7 fail-open: R6 presence-checked `effects`/`target` but never typed them, while the
+# registry side had strict types since R1-b. A fix propagated to one side only is a hole. Control:
+# a MISSING field was caught; a type-wrong one passed.
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: true, target: 123}'
+lane "P14 a type-wrong grant scope is rejected, not counted as recorded" 1 "R6"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: "read", target: "  "}'
+lane "P14-b a scalar effects / whitespace-only target is rejected" 1 "R6"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [], target: t}'
+lane "P14-c an EMPTY effects list is not a baseline" 1 "R6"
+
+# H1-H9 — round-8 exhaustive field audit found NINE remaining holes in one pass, after four rounds
+# of one-per-round trickle. The reframe ("audit every field, don't hand me the most important one")
+# is what surfaced them; the per-round drip was a slow enumeration, not convergence.
+mkuap 'standing_consent: {}'
+printf 'classes: false\n' > "$TD/r.yaml"
+lane "H1 a falsy \`classes\` is not laundered into an empty registry" 1 ""
+printf 'classes:\n' > "$TD/r.yaml"
+lane "H1-b a null \`classes\` is N/A, not a clean PASS" 0 ""
+if grep -q 'N/A' "$TD/o"; then ok "H1-c the empty registry is LABELLED N/A"; else bad "H1-c empty registry read as clean"; fi
+
+mkreg '  - {name: n, owner: o, mode: 123, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+lane "H2 a non-string scalar registry field is a type error" 1 "R1-b"
+mkreg '  - {name: n, owner: o, mode: m, target: "", capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+lane "H2-b a blank registry target is a type error" 1 "R1-b"
+mkreg '  - {name: n, owner: o, mode: m, target: t, capabilities: [read], sinks: [123], feeds: [], promotion_eligible: false}'
+lane "H3 an unreadable sink item is UNDECLARED, not an empty sink list" 1 "R1-b"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {expires: 2026-12-31, effects: [read], target: t}'
+lane "H5 a grant with no \`granted\` date cannot be audited" 1 "R5"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 29991231, effects: [read], target: t}'
+lane "H7 a non-ISO integer expiry is not a date" 1 "R5"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 9999-12-31, effects: [read], target: t}'
+lane "H7-b an unbounded lease is a transfer wearing a lease's clothes" 1 "R5"
+mkuap 'standing_consent:
+  ok: {state: revokedd, granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "H6 a typo'\''d state fails closed instead of passing as active" 1 "R3"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [repo-mutation], target: t}'
+lane "H8 a grant wider than its registered capabilities is refused" 1 "R7"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: everything}'
+lane "H8-b grant/class target drift is refused" 1 "R7"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2020-01-01, effects: [read], target: t}
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "H9 duplicate YAML keys are rejected, not resolved last-wins" 1 ""
+
+# H4 had a fix but NO lane — the mutation sweep caught that (disabling it failed zero lanes).
+# An uncovered check is a check that gets deleted quietly later.
+# NOTE the assertion is on the MESSAGE, not the rule id: with the type check disabled a numeric key
+# still exits 1 via "not in the registry", so a rule-id assertion passed either way and the mutation
+# sweep caught zero lanes. A lane that cannot separate two paths is not measuring the one it names.
+mkuap 'standing_consent:
+  123: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if [ $? -eq 1 ] && grep -q 'grant key 123 must be a non-blank string' "$TD/o"; then
+  ok "H4 a non-string grant key is refused AS A TYPE ERROR (not merely as unregistered)"
+else
+  bad "H4 numeric grant key was not refused by the type check"
+  sed 's/^/     /' "$TD/o"
+fi
+
+mkreg '  - {name: c, owner: o, mode: m, target: t, capabilities: "read", sinks: [], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent: {}'
+lane "P9 a scalar where a list is required is a type error" 1 "R1-b"
+
+# N4 — PINS A KNOWN OVER-BLOCK, it does not endorse it. A grant written with a YAML merge key is
+# currently REFUSED because the anchor lives outside the extracted fragment (see the residual note
+# in consent_registry_check.sh). This lane asserts the CURRENT behaviour so that a future fix shows
+# up as a lane change rather than being rediscovered from scratch — and so nobody reads the 40/40
+# as "no known over-block".
+mkreg "$OKCLASS"
+mkuap 'defaults: &d {ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}}
+standing_consent:
+  <<: *d'
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if [ $? -eq 1 ]; then
+  ok "N4 merge-key grant is refused — KNOWN OVER-BLOCK, pinned not endorsed (see residual note)"
+else
+  ok "N4 merge-key grant now PASSES — the over-block was fixed; update this lane and the residual note"
+fi
+
+rm -f "$TD/r.yaml"
+lane "D1 a missing registry is N/A with promotion disabled (never a silent PASS)" 0 ""
+if grep -q 'N/A' "$TD/o"; then
+  ok "D1-b the missing-registry result is LABELLED N/A, not reported as clean"
+else
+  bad "D1-b a missing registry produced exit 0 without an N/A label — that reads as PASS"
+fi
+
+printf 'classes: [ {name: broken\n' > "$TD/r.yaml"
+lane "D2 an unparseable registry fails closed (cannot decide == not allowed)" 1 ""
+
+# The shipped example must satisfy the validator — otherwise the artifact FH hands users is the
+# first counter-example. (Hand-verify-one-sample discipline, applied to our own template.)
+if bash "$CHK" "$ROOT/templates/consent_classes.yaml.example" /dev/null >/dev/null 2>&1; then
+  ok "S1 the shipped templates/consent_classes.yaml.example validates"
+else
+  bad "S1 the shipped example registry does NOT validate"
+fi
+
+echo "----"
+echo "consent-registry anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_sidecar_wait_stdin.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# test_sidecar_wait_stdin.sh — known-pair anchor for scripts/sidecar_wait.sh's stdin plumbing.
+#
+# WHY (measured 2026-07-29)
+#   `sidecar_wait.sh` shipped in v1.4.76 documenting this invocation in its own header:
+#       printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 600 -- codex exec -m gpt-5.5 -
+#   It did not work. `"$@" > "$OUT" 2>&1 &` gives the child /dev/null for stdin in a
+#   non-interactive shell, so codex received no prompt, answered "No prompt provided via stdin",
+#   and the wrapper reported SIDECAR_VERDICT=COMPLETE — a sidecar that never ran, reported as
+#   complete. That is the exact misjudgment the script exists to prevent, produced by the script.
+#
+#   The FIRST repair was worse than the bug, and adversarial review caught it before it shipped.
+#   It spooled stdin to a tempfile; reproduced consequences:
+#     - the unbounded `cat` ran BEFORE the child, so an inherited never-EOF stdin hung the wrapper
+#       forever and the timeout budget never applied (`-- true` with inherited stdin → rc=124);
+#     - it CONSUMED the caller's stdin (a caller reading 3 lines afterwards read 0).
+#   The correct fix is one token: `<&0`. POSIX substitutes /dev/null only when stdin is NOT
+#   explicitly redirected. Lanes P2/P3 exist because the anchor's first version reported 4/4 green
+#   in the same shell where the argv form returned rc=124 — it bound only P1.
+#
+# Lanes
+#   P1  piped stdin REACHES the child                        (the original hole)
+#   P2  argv-form with an inherited never-EOF stdin does NOT hang   (spool regression)
+#   P3  the caller's own stdin is NOT consumed by the wrapper       (spool regression)
+#   P4  verdict codes: TIMEOUT=1 · EMPTY=0 · COMPLETE=0, and EMPTY/COMPLETE are distinguished
+#   P5  an unwritable outfile is exit 2, not "EMPTY" (a false clean on the typed channel)
+#
+# Verdicts are read by running the wrapper DIRECTLY — piping it into `tail` and reading `$?`
+# answers with tail's status and turns a real exit 1 green.
+#
+# Exit 0 = all lanes correct. Exit 1 = the plumbing regressed.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SW="$ROOT/scripts/sidecar_wait.sh"
+[ -f "$SW" ] || { echo "FAIL: $SW not found"; exit 1; }
+# NOTE: SIDECAR_POLL is set PER LANE, never exported globally. A global export pinned the knob for
+# every lane and thereby MASKED a bad default — a regression to `SIDECAR_POLL:-0` passed 5/5.
+FAST="SIDECAR_POLL=1"
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+
+# P1 — `cat` echoes whatever it receives; an empty outfile means stdin was swallowed, which is
+# exactly what the shipped version did.
+printf 'MARKER_STDIN_ARRIVED' | SIDECAR_POLL=1 bash "$SW" "$TD/p1.out" 20 -- cat >/dev/null 2>&1
+if grep -q 'MARKER_STDIN_ARRIVED' "$TD/p1.out" 2>/dev/null; then
+  ok "P1 piped stdin reaches the child process"
+else
+  bad "P1 STDIN HOLE IS BACK — child saw no stdin (got: '$(head -c 60 "$TD/p1.out" 2>/dev/null)')"
+fi
+
+# P2 — the lane the first anchor lacked. A never-EOF stdin must not block the wrapper: the child is
+# launched immediately and the budget governs. `sleep 20 |` keeps the pipe open with no data.
+( sleep 6 | SIDECAR_POLL=1 timeout 5 bash "$SW" "$TD/p2.out" 3 -- echo ARGV_OK ) >/dev/null 2>&1
+rc_hang=$?
+if [ "$rc_hang" -ne 124 ] && grep -q 'ARGV_OK' "$TD/p2.out" 2>/dev/null; then
+  ok "P2 an inherited never-EOF stdin does not hang the wrapper (child still runs)"
+else
+  bad "P2 the wrapper HUNG or never ran the child on inherited stdin (rc=$rc_hang, out='$(head -c 40 "$TD/p2.out" 2>/dev/null)')"
+fi
+
+# P3 — the wrapper must not eat the caller's stream. `echo` reads nothing, so all three lines must
+# remain readable afterwards. The spool version left zero.
+n=$(printf 'l1\nl2\nl3\n' | { SIDECAR_POLL=1 bash "$SW" "$TD/p3.out" 20 -- echo x >/dev/null 2>&1
+                              c=0; while read -r _; do c=$((c+1)); done; echo "$c"; })
+if [ "$n" = "3" ]; then
+  ok "P3 the caller's own stdin survives the call (3/3 lines still readable)"
+else
+  bad "P3 the wrapper consumed the caller's stdin ($n of 3 lines left)"
+fi
+
+# P4 — verdict channel. `-- true` writes nothing and is EMPTY, NOT COMPLETE; the first anchor
+# labelled that lane "COMPLETE" and so never exercised COMPLETE at all.
+SIDECAR_POLL=1 bash "$SW" "$TD/p4t.out" 2 -- sleep 30 >"$TD/p4t.txt" 2>&1 </dev/null; rc_t=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4e.out" 20 -- true      >"$TD/p4e.txt" 2>&1 </dev/null; rc_e=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4c.out" 20 -- echo hi   >"$TD/p4c.txt" 2>&1 </dev/null; rc_c=$?
+if [ "$rc_t" -eq 1 ] && [ "$rc_e" -eq 0 ] && [ "$rc_c" -eq 0 ] \
+   && grep -q 'SIDECAR_VERDICT=TIMEOUT'  "$TD/p4t.txt" \
+   && grep -q 'SIDECAR_VERDICT=EMPTY'    "$TD/p4e.txt" \
+   && grep -q 'SIDECAR_VERDICT=COMPLETE' "$TD/p4c.txt"; then
+  ok "P4 verdicts intact and distinguished (TIMEOUT=1 · EMPTY=0 · COMPLETE=0)"
+else
+  bad "P4 verdict channel drifted (timeout rc=$rc_t, empty rc=$rc_e, complete rc=$rc_c)"
+  head -1 "$TD/p4t.txt" "$TD/p4e.txt" "$TD/p4c.txt" 2>/dev/null | sed 's/^/     /'
+fi
+
+# P5 — an outfile that cannot be written made `wc -c` fail, `${size:-0}` read 0, and the wrapper
+# announce EMPTY with exit 0. The sidecar had in fact produced output. Same false-clean class as
+# the bug this file anchors, on the typed channel itself.
+SIDECAR_POLL=1 bash "$SW" "$TD/nodir/x.out" 10 -- echo hi >/dev/null 2>&1 </dev/null
+rc_w=$?
+if [ "$rc_w" -eq 2 ]; then
+  ok "P5 an unwritable outfile fails closed (exit 2), never 'EMPTY'"
+else
+  bad "P5 an unwritable outfile returned rc=$rc_w — a sidecar that ran reported as saying nothing"
+fi
+
+# P6 — the knob added while making this anchor cheap re-opened the unbounded wait. Each bad value
+# must still produce a bounded TIMEOUT. Deliberately NOT using $FAST: the point is a bad POLL.
+p6=0
+for badpoll in 0 0.5 abc 08 09 600; do
+  SIDECAR_POLL="$badpoll" timeout 12 bash "$SW" "$TD/p6.out" 2 -- sleep 30 >"$TD/p6.txt" 2>&1
+  rc6=$?
+  if [ "$rc6" -eq 1 ] && grep -q 'SIDECAR_VERDICT=TIMEOUT' "$TD/p6.txt"; then p6=$((p6+1)); fi
+done
+if [ "$p6" -eq 6 ]; then
+  ok "P6 a malformed SIDECAR_POLL (0·0.5·abc·08·09·600) still times out — the budget is not disarmable"
+else
+  bad "P6 only $p6/6 malformed poll values produced a bounded TIMEOUT (unbounded wait is reachable)"
+fi
+
+# P7 — TIMEOUT must not orphan the sidecar, INCLUDING grandchildren: `kill "$PID"` reached only the
+# direct child, so `sh -c 'sleep N & wait'` survived while this lane stayed green. The marker is
+# per-run: a machine-global `pgrep -f 'sleep 25'` false-FAILs on any concurrent sleep and its
+# failure branch would kill unrelated host processes.
+MARK="p7_$$_$(date +%s 2>/dev/null || echo x)"
+SIDECAR_POLL=1 bash "$SW" "$TD/p7.out" 2 -- sh -c "sleep 25 & wait # $MARK" >"$TD/p7.txt" 2>&1 </dev/null
+sleep 1
+if ! pgrep -f "$MARK" >/dev/null 2>&1; then
+  ok "P7 a timed-out sidecar is killed with its grandchildren, not orphaned past our exit"
+else
+  bad "P7 a grandchild survived TIMEOUT (orphan restored)"; pkill -f "$MARK" 2>/dev/null
+fi
+
+# P9 — the tty path. HONEST SCOPE, do not read this lane as more than it is.
+#
+# It asserts that a stdin-reading child under an allocated pty still produces a bounded verdict. It
+# does NOT bind the `if [ -t 0 ]` branch: removing that branch entirely leaves this lane GREEN
+# (measured 2026-07-29). Cross-family review reproduced a SIGTTIN stop (rc=124, no verdict) under a
+# pty before `set -m` was added for the group-kill; this harness cannot reproduce that condition,
+# so whether the branch is still load-bearing is UNMEASURED — the branch is kept as defensive, not
+# as something this anchor proves.
+#
+# A lane that cannot separate a known-positive from a known-negative is not measuring; it is
+# generating. Shipping it as a plain green would manufacture exactly the false confidence this
+# file exists to prevent, so it is labelled instead of silently counted.
+if command -v script >/dev/null 2>&1; then
+  # `< /dev/null` on `script` itself: with the harness's inherited stdin it could not allocate a pty
+  # at all and wrote no rc file, so the lane failed identically with AND without the fix under test
+  # — it discriminated nothing. The pty it allocates for the inner command is what matters.
+  # The inner shell writes its rc to a FILE. Parsing `script`'s own stdout fails: it emits ^D and
+  # CRLF, and the first version of this lane read rc as empty and reported a defect that did not
+  # exist — the target was fine, the instrument was not.
+  script -q /dev/null bash -c "SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'" >/dev/null 2>&1 < /dev/null
+  rc9=$(tr -dc '0-9' < "$TD/p9rc" 2>/dev/null)
+  if [ -n "$rc9" ] && [ "$rc9" != "124" ] && grep -q 'SIDECAR_VERDICT=' "$TD/p9.txt" 2>/dev/null; then
+    ok "P9 the tty path runs and emits a verdict (UNCALIBRATED — see note; does NOT bind the branch)"
+  else
+    bad "P9 tty case rc='${rc9:-<unread>}' verdict='$(head -1 "$TD/p9.txt" 2>/dev/null)'"
+  fi
+else
+  bad "P9 UNCALIBRATED — \`script\` unavailable, the tty branch cannot be exercised here"
+fi
+
+# P8 — the child's stderr AND its exit code must reach the typed channel. Dropping `2>&1` or
+# hardcoding rc=0 both passed the earlier anchor: it grepped the verdict WORD and the wrapper's
+# own rc, never the child's.
+SIDECAR_POLL=1 bash "$SW" "$TD/p8.out" 20 -- sh -c 'echo STDERR_MARK >&2; exit 3' >"$TD/p8.txt" 2>&1 </dev/null
+if grep -q 'STDERR_MARK' "$TD/p8.out" 2>/dev/null && grep -q 'exit=3' "$TD/p8.txt"; then
+  ok "P8 child stderr is captured and its exit code reaches the verdict line"
+else
+  bad "P8 stderr or child exit code lost (out='$(head -c 40 "$TD/p8.out" 2>/dev/null)' verdict='$(head -1 "$TD/p8.txt")')"
+fi
+
+echo "----"
+echo "sidecar_wait stdin anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/templates/consent_classes.yaml.example

@@ -0,0 +1,75 @@
+# consent_classes.yaml — the consent-class registry.
+#
+# Copy to `tracks/_meta/consent_classes.yaml` (gitignored, per-environment) to enable
+# accept-side consent promotion. See `knowledge/shared/rules/operational_adaptation.md`
+# §Consent promotion.
+#
+# WHY A REGISTRY AT ALL (cross-family review, 2026-07-29)
+#   The first draft let the running session name the class it was counting approvals against.
+#   That defeats the class-inflation guard before it fires: the class does not need to be WIDENED
+#   later if it was born wide. Recording three approvals as `sim-conductor` instead of
+#   `dispatch read-only sim on a local artifact` silently grants every future sim-conductor mode.
+#   So classes are DECLARED here, reviewed by a human, and the session may only count against
+#   an entry that already exists. A session may propose a new entry; it may not mint one mid-run.
+#
+# THE FLOOR IS READ FROM THIS FILE, NOT JUDGED AT RUNTIME
+#   `sinks` is the field the irreversibility floor is decided from. A session asking itself
+#   "is this reversible?" is the wrong arbiter — it is the party that wants to stop being asked.
+#   Absent entry / absent file / unparseable entry => NO promotion, keep asking. Unknown is not
+#   reversible.
+#
+# TAINT
+#   A class inherits the floor if it FEEDS an irreversible sink, not only if it crosses one.
+#   `local-commit` below is the worked example: committing is locally reversible, but if a
+#   post-commit hook, sync daemon, or CI workflow publishes from that commit, the chain crossed
+#   go-public and the class must be marked tainted. Declare `feeds:` honestly — the whole point
+#   is that no single step in a bad chain looks dangerous on its own.
+
+classes:
+  # ---- promotion-eligible example -------------------------------------------------
+  - name: dispatch-readonly-sim-local-artifact
+    owner: fh-meta:sim-conductor          # the gate/skill that does the asking
+    mode: blind-target-tier-sim
+    target: a single local file under the current repo
+    capabilities: [read, dispatch]        # read · local-write · network · dispatch · repo-mutation
+    sinks: []                             # crosses nothing irreversible
+    feeds: []                             # enables/queues nothing irreversible
+    promotion_eligible: true
+    lease_days: 30                        # standing consent is a renewable lease, never permanent
+
+  # ---- NOT promotion-eligible: sink is irreversible --------------------------------
+  - name: npm-publish
+    owner: Pre-Publish Surface Gate
+    mode: registry-publish
+    target: the package tarball file set
+    capabilities: [read, network]
+    sinks: [go-public]                    # irreversible => never promotes, at any count
+    feeds: []
+    promotion_eligible: false
+    reason: "publish is effectively irreversible — a package is live the instant it ships and may
+             be cached or forked before any scrub (CLAUDE.md §Pre-Publish Surface Gate)."
+
+  # ---- NOT promotion-eligible: TAINTED (this is the one that looks safe) -----------
+  - name: local-commit
+    owner: FH 4-axis commit gate
+    mode: git-commit
+    target: the working tree
+    capabilities: [local-write, repo-mutation]
+    sinks: []                             # committing itself is reversible
+    feeds: [go-public]                    # ...but CI/sync publishes from it
+    promotion_eligible: false
+    reason: "taint — reversible in isolation, feeds an irreversible sink. Every step in the
+             workflow-edit -> release-notes -> commit -> CI-publish chain is individually
+             reversible; the chain is not."
+
+  # ---- NOT promotion-eligible: unclassified ---------------------------------------
+  - name: run-arbitrary-shell
+    owner: (none — catch-all)
+    mode: unrestricted
+    target: unbounded
+    capabilities: [read, local-write, network, dispatch, repo-mutation]
+    sinks: [unknown]                      # unknown is NOT reversible
+    feeds: [unknown]
+    promotion_eligible: false
+    reason: "sinks cannot be enumerated, so the floor cannot be decided mechanically. A class
+             whose blast radius is unbounded is never a candidate, regardless of approval count."