@chrono-meta/fh-gate 1.4.76 → 1.4.78

package/scripts/sidecar_wait.sh

@@ -41,12 +41,59 @@ shift 2
 [ "${1:-}" = "--" ] && shift
 [ $# -gt 0 ] || { echo "sidecar_wait: no command given" >&2; exit 2; }
 
-: > "$OUT"
-"$@" > "$OUT" 2>&1 &
+# Forward stdin to the child with an explicit fd dup.
+#
+# The hole (measured 2026-07-29, known-pair): `"$@" > "$OUT" 2>&1 &` gave the child /dev/null for
+# stdin in a non-interactive shell, so the documented pipe form reached codex with NO prompt, codex
+# answered "No prompt provided via stdin", and this wrapper reported COMPLETE — the exact 0-output
+# misjudgment it exists to prevent, produced by itself.
+#
+# `<&0` is the whole fix: POSIX substitutes /dev/null ONLY when stdin is not explicitly redirected.
+# The first repair spooled stdin to a tempfile instead, and adversarial review (Axis 2) showed that
+# mechanism was both unnecessary AND strictly worse than the bug — reproduced, not argued:
+#   - the unbounded `cat` ran BEFORE the child, so an inherited never-EOF stdin hung the wrapper
+#     forever and the timeout budget never applied (`-- true` with inherited stdin → rc=124);
+#   - it CONSUMED the caller's stdin, so a caller reading 3 lines after the call read 0.
+# A bounded-wait wrapper with an unbounded pre-step, and an input-preserving tool that eats input.
+# The lesson is kept in the file: the simplest correct fix was one token, and the machinery built
+# around it introduced two S-grade defects the original bug did not have.
+: > "$OUT" || { echo "SIDECAR_VERDICT=OUTFILE_UNWRITABLE path=$OUT" >&2; exit 2; }
+set -m   # own process group per child, so the TIMEOUT kill can reach grandchildren
+if [ -t 0 ]; then
+  # On a controlling tty, a child that READS stdin raises SIGTTIN and stops the whole process
+  # group — the wrapper with it — so the budget never fires and no verdict is emitted (measured:
+  # `cat` under a tty gave rc=124 and zero verdict lines, while `sleep 30` correctly TIMEOUTed).
+  # Interactive callers have no prompt to pipe anyway; the documented pipe form is never a tty.
+  "$@" < /dev/null > "$OUT" 2>&1 &
+else
+  "$@" <&0 > "$OUT" 2>&1 &
+fi
 PID=$!
 
 waited=0
 last_size=0
+# Poll interval is overridable so the regression anchor is not charged the 5s floor per
+# invocation (a 25s anchor is an anchor people skip).
+POLL="${SIDECAR_POLL:-5}"
+# Validate it. Caller-controlled and unvalidated, this knob RESTORED the very failure the wrapper
+# exists to prevent (measured 2026-07-29, budget 3s under an external timeout 10):
+#   SIDECAR_POLL=0    -> rc=124, `waited` never advances, TIMEOUT never fires, zero typed verdicts
+#   SIDECAR_POLL=0.5  -> rc=124, arithmetic error each iteration, assignment never lands
+#   SIDECAR_POLL=abc  -> exits 1 (the documented TIMEOUT code) with NO verdict line and a live child
+# The file's own "a 25s anchor is an anchor people skip" comment invites tuning this, and `0.5` is
+# the obvious next step for someone doing that. An unbounded wait must not be reachable by typo.
+# `10#` forces base 10: `test` reads 08 as decimal-8 and PASSES it, then $((waited + 08)) dies with
+# "value too great for base" every iteration, waited never advances, and the wait is unbounded again
+# — the first guard did not close its own finding (measured: 08/09 -> rc=124, zero verdicts).
+# The ceiling matters just as much: the budget is checked at the TOP of the loop, so any POLL above
+# it makes the effective wait POLL, not BUDGET (SIDECAR_POLL=600 -> rc=124). 600 is exactly what
+# someone copying the budget argument into the knob writes.
+_poll_raw="$POLL"
+case "$POLL" in ''|*[!0-9]*) POLL=5 ;; *) POLL=$((10#$POLL)) 2>/dev/null || POLL=5 ;; esac
+{ [ "$POLL" -ge 1 ] && [ "$POLL" -le 60 ]; } 2>/dev/null || POLL=5
+# Never coerce silently on a script whose whole thesis is a typed channel.
+[ "$POLL" = "$_poll_raw" ] || [ -z "${SIDECAR_POLL:-}" ] || \
+  echo "sidecar_wait: ignoring SIDECAR_POLL='$_poll_raw' (not an integer in 1..60); using $POLL" >&2
 # Poll rather than `wait`, so a live-but-quiet process is distinguishable from a dead one and the
 # caller can SEE progress. A silent minute on a reasoning model is normal; the earlier misreading
 # happened precisely because silence was treated as termination.
@@ -54,11 +101,14 @@ while kill -0 "$PID" 2>/dev/null; do
   if [ "$waited" -ge "$BUDGET" ]; then
     size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
     echo "SIDECAR_VERDICT=TIMEOUT waited=${BUDGET}s bytes=${size:-0} pid=$PID"
-    echo "  the process is STILL RUNNING — this is not 'no output'. Raise the budget, or kill $PID" >&2
+    echo "  the process is STILL RUNNING — this is not 'no output'. Raise the budget if it needs longer." >&2
+    # Kill the GROUP. `kill "$PID"` reaches only the direct child, so `sh -c 'sleep N & wait'`
+    # left a live grandchild behind while the lane stayed green (measured wave 4).
+    kill -- -"$PID" 2>/dev/null || kill "$PID" 2>/dev/null
     exit 1
   fi
-  sleep 5
-  waited=$((waited + 5))
+  sleep "$POLL"
+  waited=$((waited + POLL))
   size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
   if [ "${size:-0}" -ne "$last_size" ]; then
     echo "  … ${waited}s elapsed, ${size} bytes so far (alive)" >&2

package/scripts/test_node_check_lanes.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# test_node_check_lanes.sh — regression lanes for scripts/fh_node_check.sh.
+#
+# WHY THIS FILE EXISTS: across three adversarial rounds on the node check, every surviving defect
+# was a NEGATIVE leg nobody was testing — "the floor does not apply here", "those are someone
+# else's hooks", "that file is absent on a fresh clone". Each round's fix reverted a previous
+# round's fix because no lane pinned it. The lanes below are that pin: they encode the *shape* of
+# each defect, not just its instance.
+#
+# Usage:  bash scripts/test_node_check_lanes.sh
+# Exit:   0 = all lanes pass; 1 = at least one lane failed (prints which and why).
+
+set -uo pipefail
+
+FH_REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHECK="$FH_REPO/scripts/fh_node_check.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+bad()  { FAIL=$((FAIL+1)); printf '  ❌ %s\n     got: %s\n' "$1" "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-220)"; }
+
+# run <hubdir> <statefile> [env assignments...] → stdout of one check run
+run() { local hub="$1" st="$2"; shift 2; env "$@" HUB_DIR="$hub" FH_NODE_STATE="$st" bash "$CHECK" 2>&1; }
+
+mk_git_hub() {   # a git repo with FH-style hooks installed and executable
+  local d="$1" fh_sentinel="${2:-yes}"
+  mkdir -p "$d" && git -C "$d" init -q && git -C "$d" config user.email t@t && git -C "$d" config user.name t
+  echo x > "$d/f" && git -C "$d" add f && git -C "$d" -c commit.gpgsign=false commit -qm init
+  mkdir -p "$d/.git/hooks"
+  local body='#!/bin/sh\nexit 0\n'
+  [ "$fh_sentinel" = "yes" ] && body='#!/bin/sh\n# FH 4-Axis Gate Pre-Commit Hook\nfh-gate\nexit 0\n'
+  printf "$body" > "$d/.git/hooks/pre-commit"; printf "$body" > "$d/.git/hooks/pre-push"
+  chmod +x "$d/.git/hooks/pre-commit" "$d/.git/hooks/pre-push"
+}
+
+echo "── node-check lanes ──"
+
+# LANE 1 (S3-1) — NOT a git repo. The git-hook floor cannot be installed here at all, so it is
+# N/A, not missing. Reporting it would be an unfixable notice repeating every session forever.
+mkdir -p "$TMP/nogit"
+out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"
+# POSITIVE CONTROL: assert what MUST appear alongside what must not. Absence-only lanes are
+# satisfied by a script that prints nothing at all — an `exit 0` stub passed lanes 1, 4 and 7
+# (cross-family mutation 2026-07-30), so each now pins an expected utterance too.
+case "$out" in
+  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "$out" ;;
+  *"first session for this clone"*) ok "lane1 non-git: N/A on the git floor, but still reports the node event" ;;
+  *) bad "lane1 non-git: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 2 (S3-2) — hooks exist but belong to another framework (husky/pre-commit). Executable ≠ FH's
+# gate. Silence here is the exact accident this check was built for: FH gates absent, machine quiet.
+mk_git_hub "$TMP/husky" no
+out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"
+case "$out" in
+  *"Missing mechanical floor"*) ok "lane2 foreign hooks: FH gate absence reported" ;;
+  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "$out" ;;
+esac
+
+# LANE 3 (S3-3) — Mode D user on a FRESH clone: companion store present, settings.local.json absent
+# (it is gitignored, so a clone never has it). This is the MEASURED 2026-07-30 incident. Must speak.
+mk_git_hub "$TMP/moded" yes
+mkdir -p "$TMP/companion/.git"
+out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"
+case "$out" in
+  *companion-load*) ok "lane3 fresh Mode D clone: companion-load absence surfaced" ;;
+  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "$out" ;;
+esac
+
+# LANE 4 (M2-4) — public non-Mode-D user: no companion store anywhere. The companion item must not
+# appear, or the majority path gets a false positive for a feature it does not use.
+mk_git_hub "$TMP/public" yes
+out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"
+case "$out" in
+  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "$out" ;;
+  *"first session for this clone"*) ok "lane4a non-Mode-D: companion absent, node event still reported" ;;
+  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 4b (S4-1) — CLAUDE.local.md is Claude Code's STANDARD local-override file; anyone may keep
+# one for any reason. Its mere EXISTENCE must not classify a user as Mode D, or the majority path
+# gets a companion notice every session forever (state-based emission makes it permanent, not
+# one-shot). Only the binding INSIDE the file counts.
+printf '# my local notes\nuse tabs not spaces\n' > "$TMP/public/CLAUDE.local.md"
+out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"
+case "$out" in
+  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "$out" ;;
+  *) ok "lane4b plain CLAUDE.local.md: not treated as a Mode D signal" ;;
+esac
+
+# LANE 4c — the same file WITH a companion binding must classify as Mode D and speak. Without this
+# leg, "never classify as Mode D" would also pass 4b.
+# One fixture PER alternative: a single fixture like `BE_DIR=/some/companion-store` satisfies two
+# alternatives at once, so either could be deleted and the lane would still pass. The store is a
+# ROLE, not a repo layout (install-wizard SKILL.md: Obsidian vault / gbrain ingest target / *-be
+# repo all qualify) — so the vocabulary variants are the documented user base, not hypotheticals.
+i=0
+# `backend: obsidian` carries no other keyword on purpose — with a `vault:` fixture only, the
+# `obsidian` alternative is never exercised and could be deleted with the suite staying green
+# (verified: removing it left 16/16). An untested alternative is an untested branch.
+for binding in 'BE_DIR=/x/store' 'companion store: ~/notes' '컴패니언 스토어: ~/notes' \
+               'vault: ~/vaults/notes' 'gbrain ingest target: ~/gbrain' 'backend: obsidian'; do
+  i=$((i+1))
+  printf '# local\n%s\n' "$binding" > "$TMP/public/CLAUDE.local.md"
+  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"
+  case "$out" in
+    *companion-load*) ok "lane4c.$i Mode D detected via: $binding" ;;
+    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "$out" ;;
+  esac
+done
+rm -f "$TMP/public/CLAUDE.local.md"
+
+# LANE 5 — emission model: a healthy machine speaks once (event) then goes silent.
+mk_git_hub "$TMP/healthy" yes
+r1="$(run "$TMP/healthy" "$TMP/s5" FH_MACHINE_ID=healthybox)"
+r2="$(run "$TMP/healthy" "$TMP/s5" FH_MACHINE_ID=healthybox)"
+if [ -n "$r1" ] && [ -z "$r2" ]; then ok "lane5 healthy: event once, then silent"
+else bad "lane5 healthy: expected run1 non-empty and run2 empty" "r1=[$r1] r2=[$r2]"; fi
+
+# LANE 6 (S2-4) — a missing floor is a CONDITION: it must be reported on every run, not once.
+mk_git_hub "$TMP/broken" yes
+rm -f "$TMP/broken/.git/hooks/pre-commit"
+n=0
+for i in 1 2 3; do
+  o="$(run "$TMP/broken" "$TMP/s6" FH_MACHINE_ID=brokenbox)"
+  case "$o" in *"Missing mechanical floor"*) n=$((n+1)) ;; esac
+done
+[ "$n" -eq 3 ] && ok "lane6 broken: reported on all 3 runs (condition, not event)" \
+               || bad "lane6 broken: reported $n/3 runs — a broken machine went quiet" "n=$n"
+
+# LANE 7 (M2-2) — linked worktree: .git is a FILE there, so a hand-built "$FH/.git/hooks" does not
+# exist and working hooks read as missing.
+mk_git_hub "$TMP/wt" yes
+git -C "$TMP/wt" worktree add -q "$TMP/wt_linked" -b lane7 2>/dev/null
+out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"
+case "$out" in
+  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "$out" ;;
+  *"first session for this clone"*) ok "lane7 worktree: hooks resolved correctly, node event reported" ;;
+  *) bad "lane7 worktree: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 8 (M3-3) — python3 unavailable: the companion verdict is UNMEASURED, never silently "fine".
+# Simulated by a PATH with no python3, for a Mode D hub (so the check is applicable).
+mk_git_hub "$TMP/nopy" yes
+mkdir -p "$TMP/emptybin" "$TMP/companion2/.git"
+out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"
+if command -v python3 >/dev/null 2>&1 && [ -x /usr/bin/python3 ]; then
+  ok "lane8 skipped: /usr/bin/python3 exists so absence cannot be simulated via PATH"
+else
+  case "$out" in
+    *UNMEASURED*|*unmeasured*) ok "lane8 no python3: reported UNMEASURED, not silence" ;;
+    *) bad "lane8 no python3: absence read as pass" "$out" ;;
+  esac
+fi
+
+# LANE 9 (S4-2) — the sentinel regex is coupled to PROSE THAT LIVES IN ANOTHER FILE. Every other
+# lane hands it a fixture containing the string it expects, so the suite would stay fully green
+# while a purely cosmetic edit to the real hook headers (which no gate checks) made every FH machine
+# report "not FH's gate" every session. Calibrate the instrument against the shipped article.
+# DERIVE the regex from the script — never retype it. A hardcoded copy is the divergent-copy class
+# this repo already paid for once (SYNC_EXCLUDES in three places, which needed its own parity
+# checker): tighten the script's regex and a duplicated lane keeps validating the SHIPPED hooks
+# against the OLD pattern, staying green while the real check drifts.
+SENT="$(sed -n "s/.*grep -qE '\([^']*\)'.*/\1/p" "$FH_REPO/scripts/fh_node_check.sh" | head -1)"
+if [ -z "$SENT" ]; then
+  bad "lane9 sentinel: could not derive the regex from fh_node_check.sh (extraction broke — not a pass)" "empty"
+  SENT='__never_matches__'
+fi
+for h in "$FH_REPO"/templates/.git-hooks/pre-commit "$FH_REPO"/templates/.git-hooks/pre-push; do
+  if [ ! -f "$h" ]; then bad "lane9 sentinel: shipped hook missing: $h" "absent"; continue; fi
+  if grep -qE "$SENT" "$h"; then ok "lane9 sentinel matches shipped $(basename "$h")"
+  else bad "lane9 sentinel does NOT match shipped $(basename "$h") — every FH machine would report 'not FH gate'" "$(head -3 "$h")"; fi
+done
+
+printf '\nnode-check lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_sidecar_calibrate_lanes.sh

@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+# test_sidecar_calibrate_lanes.sh — regression lanes for scripts/sidecar_calibrate.sh.
+#
+# WHY LANES FIRST: the calibrator's whole job is to distinguish states that LOOK the same from the
+# outside — "the sidecar ran" vs "the model I asked for answered", "absent" vs "unmeasured". Those
+# are negative legs, and negative legs are what three adversarial rounds on the node check showed
+# nobody tests until a lane forces it. Each lane below drives the calibrator with a STUB CLI whose
+# behaviour is known, so the calibrator's verdict can be checked against ground truth.
+#
+# No network, no API spend: every sidecar binary is replaced by a stub on PATH.
+#
+# Usage:  bash scripts/test_sidecar_calibrate_lanes.sh
+# Exit:   0 = all lanes pass; 1 = at least one failed.
+
+set -uo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CAL="$REPO/scripts/sidecar_calibrate.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  ❌ %s\n     got: %s\n' "$1" "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-240)"; }
+
+# stub <name> <behaviour> — write a fake sidecar CLI onto the lane PATH.
+#   honest        : echoes back the model it was pinned to (a truthful runtime)
+#   silent-fallback: ALWAYS answers as one fixed model, whatever the pin (the agy trap)
+#   loud-reject   : exits non-zero on an unknown pin (the codex behaviour)
+#   chatty        : answers with agentic prose instead of the requested token (unparseable verdict)
+#   banner-echo   : prints a session banner that REPEATS the pinned model, then answers as a
+#                   different model — the real shape of `codex exec` stdout (measured 2026-07-30)
+#   listed-substitute: REJECTS an unknown name (so the bogus control says "rejects-bogus") yet
+#                   silently serves a different model for a name that IS in its own catalogue —
+#                   the measured agy shape (`gemini-3.1-pro-high` answered as 3.6 Flash, no error)
+#   alias-name    : answers with the vendor's PRODUCT name carrying the right version but not every
+#                   token of the pin slug — measured: pin `gpt-5.6-sol` → "GPT-5.6 Codex"
+#   absent        : not created at all
+mkstub() {
+  local name="$1" mode="$2" bin="$TMP/bin"
+  mkdir -p "$bin"
+  case "$mode" in
+    absent) rm -f "$bin/$name"; return ;;
+  esac
+  cat > "$bin/$name" <<STUB
+#!/usr/bin/env bash
+mode="$mode"
+pin=""
+prev=""
+for a in "\$@"; do
+  case "\$prev" in -m|--model) pin="\$a" ;; esac
+  prev="\$a"
+done
+case "\$1" in --version) echo "stub 9.9.9"; exit 0 ;; esac
+# Scan ALL arguments for the verdict prompt — it is NOT always last. codex puts the prompt at the
+# end; agy puts it after -p with `--print-timeout 170s` trailing. A first draft read only the last
+# argument, so the agy-shaped call never looked like a verdict request and lane5b failed against a
+# correct script. An honest runtime ANSWERS THE QUESTION ASKED: a one-token request gets one token.
+is_verdict=0
+for a in "\$@"; do case "\$a" in *"PASS or FAIL"*) is_verdict=1 ;; esac; done
+case "\$mode" in
+  loud-reject)
+     case "\$pin" in *nonexistent*|*bogus*) echo "ERROR: model '\$pin' is not supported" >&2; exit 1 ;; esac
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am \$pin, by StubCorp."; fi ;;
+  silent-fallback)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  alias-name)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "StubGPT-3.1 Coder"; fi ;;
+  listed-substitute)
+     case "\$pin" in *nonexistent*|*bogus*) echo "ERROR: model '\$pin' is not supported" >&2; exit 1 ;; esac
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  banner-echo)
+     echo "Reading additional input from stdin... CLI v0.0.0"
+     echo "--------"
+     echo "model: \$pin   workdir: /tmp   approval: never"
+     echo "--------"
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  chatty)
+     printf 'Summary of Work\n- considered the request\n- the answer is probably PASS\n' ;;
+  honest|*)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am \$pin, by StubCorp."; fi ;;
+esac
+exit 0
+STUB
+  chmod +x "$bin/$name"
+}
+
+# HERMETIC PATH — system paths only, plus the stub dir. Inheriting $PATH looked harmless and was
+# not: "absent" is simulated by NOT creating a stub, so the real codex/agy further down $PATH were
+# found instead and the lanes fired REAL, billed API calls (measured: a lane run hung past 120s
+# against live runtimes). A test that can reach production is not a test.
+run_cal() { PATH="$TMP/bin:/usr/bin:/bin:/usr/sbin:/sbin" bash "$CAL" --stub-model "stub-pro-3.1" "$@" 2>&1; }
+
+echo "── sidecar-calibrate lanes ──"
+
+# LANE 1 — absent runtime must read as ABSENT, never as a failure of the panel and never as "fine".
+mkstub codex absent; mkstub agy absent
+out="$(run_cal --only codex)"
+case "$out" in
+  *"codex"*ABSENT*) ok "lane1 absent runtime reported ABSENT" ;;
+  *) bad "lane1 absent runtime not reported as ABSENT" "$out" ;;
+esac
+
+# LANE 2 — THE POINT OF THE WHOLE SCRIPT. A runtime that silently answers as a different model must
+# be reported as UNTRUSTED-PIN, not as reachable. "The sidecar ran" and "the model I pinned answered"
+# are different propositions; agy's slug fallback is the measured instance (2026-07-30).
+mkstub agy silent-fallback
+out="$(run_cal --only agy)"
+case "$out" in
+  *UNTRUSTED-PIN*) ok "lane2 silent fallback caught (pinned model did not answer)" ;;
+  *) bad "lane2 silent fallback passed as a healthy sidecar" "$out" ;;
+esac
+
+# LANE 3 — an honest runtime that echoes its pin is PIN-OK.
+mkstub agy honest
+out="$(run_cal --only agy)"
+case "$out" in
+  *PIN-OK*) ok "lane3 honest runtime reported PIN-OK" ;;
+  *) bad "lane3 honest runtime not reported PIN-OK" "$out" ;;
+esac
+
+# LANE 4 — the negative control must actually control. A runtime that ACCEPTS a bogus model pin has
+# no server-side validation, so "it ran without error" proves nothing about which model answered;
+# that must be visible in the report rather than inferred.
+mkstub codex loud-reject
+out="$(run_cal --only codex)"
+case "$out" in
+  *"control: rejects-bogus"*) ok "lane4 bogus-pin control observed (runtime validates pins)" ;;
+  *) bad "lane4 bogus-pin control not reported" "$out" ;;
+esac
+mkstub codex honest      # honest stub answers ANY pin, including a bogus one
+out="$(run_cal --only codex)"
+case "$out" in
+  *"control: accepts-bogus"*) ok "lane4b runtime accepting a bogus pin is flagged" ;;
+  *) bad "lane4b runtime accepting a bogus pin was not flagged" "$out" ;;
+esac
+
+# LANE 5 — verdict fitness is MEASURED, not assumed. A runtime that answers a one-token request with
+# agentic prose cannot carry a machine-read verdict. The recorded 2026-07-04 finding said exactly
+# this about agy at 1.0.14; the version has moved since, so the answer must be re-measured, never
+# inherited.
+mkstub agy chatty
+out="$(run_cal --only agy)"
+case "$out" in
+  *VERDICT-UNPARSEABLE*) ok "lane5 prose-answering runtime flagged VERDICT-UNPARSEABLE" ;;
+  *) bad "lane5 prose answer accepted as a usable verdict channel" "$out" ;;
+esac
+mkstub agy honest
+out="$(run_cal --only agy)"
+case "$out" in
+  *VERDICT-OK*) ok "lane5b token-answering runtime reported VERDICT-OK" ;;
+  *) bad "lane5b clean token answer not reported VERDICT-OK" "$out" ;;
+esac
+
+# LANE 8 (measured on the first real run) — BANNER ECHO MUST NOT SATISFY THE IDENTITY PROBE.
+# Real CLIs print a session banner before the answer, and that banner repeats the pinned model name
+# back (`codex exec` prints its version and config header). Matching against whole stdout therefore
+# passes any runtime that merely echoes its own configuration — which is precisely the lie this
+# script exists to catch, re-entering through the transport layer instead of the model.
+mkstub agy banner-echo
+out="$(run_cal --only agy)"
+case "$out" in
+  *UNTRUSTED-PIN*) ok "lane8 banner echo rejected (config echo is not a self-report)" ;;
+  *) bad "lane8 banner echoing the pin passed the identity probe" "$out" ;;
+esac
+
+# LANE 10 (measured 2026-07-30) — a vendor product alias carrying the RIGHT VERSION is not a pin
+# failure. Pinning `gpt-5.6-sol` returned "GPT-5.6 Codex": same family, same version, different
+# product suffix. Requiring every token of the pin slug to appear made the calibrator report
+# UNTRUSTED-PIN on a runtime whose pin had actually held — and that runtime also validates pins
+# server-side, so the corroborating evidence was there to read. The version token is the
+# discriminator that matters; the fallback cases (3.1 asked, 3.6 answered) differ exactly there.
+mkstub agy alias-name
+out="$(run_cal --only agy)"
+case "$out" in
+  *PIN-OK*) ok "lane10 product alias with matching version accepted as PIN-OK" ;;
+  *) bad "lane10 matching version rejected because a suffix token was absent" "$out" ;;
+esac
+
+# LANE 9 (measured 2026-07-30) — "rejects unknown names" does NOT imply "serves known names
+# faithfully", and the gap between them is where the real trap lives. agy rejects a nonsense model
+# yet silently substituted Flash for `gemini-3.1-pro-high`, a slug from its OWN catalogue. A control
+# that only probes nonsense therefore returns reassuring evidence about the wrong question: the
+# identity probe must still decide, and the report must not let `rejects-bogus` read as "pin safe".
+mkstub agy listed-substitute
+out="$(run_cal --only agy)"
+case "$out" in
+  *"control: rejects-bogus"*UNTRUSTED-PIN*|*UNTRUSTED-PIN*"control: rejects-bogus"*)
+      ok "lane9 validates unknown names yet substitutes a known one → still UNTRUSTED-PIN" ;;
+  *) bad "lane9 pin substitution masked by a passing bogus-control" "$out" ;;
+esac
+
+# LANE 6 — panel verdict. With no usable different-family sidecar the script must say so explicitly:
+# this is the line a marker's `crossfamily:` leg quotes, and the 2026-07-30 defect was asserting
+# "cross-family unavailable" without ever probing.
+mkstub codex absent; mkstub agy absent
+out="$(run_cal)"
+case "$out" in
+  *"PANEL: none"*) ok "lane6 empty panel stated explicitly (not silence)" ;;
+  *) bad "lane6 empty panel not stated" "$out" ;;
+esac
+mkstub codex honest
+out="$(run_cal)"
+case "$out" in
+  *"PANEL: "*codex*) ok "lane6b populated panel names the usable runtime" ;;
+  *) bad "lane6b populated panel not named" "$out" ;;
+esac
+
+# LANE 7 — detector, not gate: always exit 0, so a calibration run can never block a caller. The
+# caller reads the verdict; the script does not decide for it.
+mkstub codex absent; mkstub agy absent
+PATH="$TMP/bin:/usr/bin:/bin:/usr/sbin:/sbin" bash "$CAL" >/dev/null 2>&1
+[ $? -eq 0 ] && ok "lane7 exits 0 even with an empty panel (detector, not gate)" \
+             || bad "lane7 non-zero exit on empty panel" "exit=$?"
+
+printf '\nsidecar-calibrate lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_sidecar_wait_stdin.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# test_sidecar_wait_stdin.sh — known-pair anchor for scripts/sidecar_wait.sh's stdin plumbing.
+#
+# WHY (measured 2026-07-29)
+#   `sidecar_wait.sh` shipped in v1.4.76 documenting this invocation in its own header:
+#       printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 600 -- codex exec -m gpt-5.5 -
+#   It did not work. `"$@" > "$OUT" 2>&1 &` gives the child /dev/null for stdin in a
+#   non-interactive shell, so codex received no prompt, answered "No prompt provided via stdin",
+#   and the wrapper reported SIDECAR_VERDICT=COMPLETE — a sidecar that never ran, reported as
+#   complete. That is the exact misjudgment the script exists to prevent, produced by the script.
+#
+#   The FIRST repair was worse than the bug, and adversarial review caught it before it shipped.
+#   It spooled stdin to a tempfile; reproduced consequences:
+#     - the unbounded `cat` ran BEFORE the child, so an inherited never-EOF stdin hung the wrapper
+#       forever and the timeout budget never applied (`-- true` with inherited stdin → rc=124);
+#     - it CONSUMED the caller's stdin (a caller reading 3 lines afterwards read 0).
+#   The correct fix is one token: `<&0`. POSIX substitutes /dev/null only when stdin is NOT
+#   explicitly redirected. Lanes P2/P3 exist because the anchor's first version reported 4/4 green
+#   in the same shell where the argv form returned rc=124 — it bound only P1.
+#
+# Lanes
+#   P1  piped stdin REACHES the child                        (the original hole)
+#   P2  argv-form with an inherited never-EOF stdin does NOT hang   (spool regression)
+#   P3  the caller's own stdin is NOT consumed by the wrapper       (spool regression)
+#   P4  verdict codes: TIMEOUT=1 · EMPTY=0 · COMPLETE=0, and EMPTY/COMPLETE are distinguished
+#   P5  an unwritable outfile is exit 2, not "EMPTY" (a false clean on the typed channel)
+#
+# Verdicts are read by running the wrapper DIRECTLY — piping it into `tail` and reading `$?`
+# answers with tail's status and turns a real exit 1 green.
+#
+# Exit 0 = all lanes correct. Exit 1 = the plumbing regressed.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SW="$ROOT/scripts/sidecar_wait.sh"
+[ -f "$SW" ] || { echo "FAIL: $SW not found"; exit 1; }
+# NOTE: SIDECAR_POLL is set PER LANE, never exported globally. A global export pinned the knob for
+# every lane and thereby MASKED a bad default — a regression to `SIDECAR_POLL:-0` passed 5/5.
+FAST="SIDECAR_POLL=1"
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+
+# P1 — `cat` echoes whatever it receives; an empty outfile means stdin was swallowed, which is
+# exactly what the shipped version did.
+printf 'MARKER_STDIN_ARRIVED' | SIDECAR_POLL=1 bash "$SW" "$TD/p1.out" 20 -- cat >/dev/null 2>&1
+if grep -q 'MARKER_STDIN_ARRIVED' "$TD/p1.out" 2>/dev/null; then
+  ok "P1 piped stdin reaches the child process"
+else
+  bad "P1 STDIN HOLE IS BACK — child saw no stdin (got: '$(head -c 60 "$TD/p1.out" 2>/dev/null)')"
+fi
+
+# P2 — the lane the first anchor lacked. A never-EOF stdin must not block the wrapper: the child is
+# launched immediately and the budget governs. `sleep 20 |` keeps the pipe open with no data.
+( sleep 6 | SIDECAR_POLL=1 timeout 5 bash "$SW" "$TD/p2.out" 3 -- echo ARGV_OK ) >/dev/null 2>&1
+rc_hang=$?
+if [ "$rc_hang" -ne 124 ] && grep -q 'ARGV_OK' "$TD/p2.out" 2>/dev/null; then
+  ok "P2 an inherited never-EOF stdin does not hang the wrapper (child still runs)"
+else
+  bad "P2 the wrapper HUNG or never ran the child on inherited stdin (rc=$rc_hang, out='$(head -c 40 "$TD/p2.out" 2>/dev/null)')"
+fi
+
+# P3 — the wrapper must not eat the caller's stream. `echo` reads nothing, so all three lines must
+# remain readable afterwards. The spool version left zero.
+n=$(printf 'l1\nl2\nl3\n' | { SIDECAR_POLL=1 bash "$SW" "$TD/p3.out" 20 -- echo x >/dev/null 2>&1
+                              c=0; while read -r _; do c=$((c+1)); done; echo "$c"; })
+if [ "$n" = "3" ]; then
+  ok "P3 the caller's own stdin survives the call (3/3 lines still readable)"
+else
+  bad "P3 the wrapper consumed the caller's stdin ($n of 3 lines left)"
+fi
+
+# P4 — verdict channel. `-- true` writes nothing and is EMPTY, NOT COMPLETE; the first anchor
+# labelled that lane "COMPLETE" and so never exercised COMPLETE at all.
+SIDECAR_POLL=1 bash "$SW" "$TD/p4t.out" 2 -- sleep 30 >"$TD/p4t.txt" 2>&1 </dev/null; rc_t=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4e.out" 20 -- true      >"$TD/p4e.txt" 2>&1 </dev/null; rc_e=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4c.out" 20 -- echo hi   >"$TD/p4c.txt" 2>&1 </dev/null; rc_c=$?
+if [ "$rc_t" -eq 1 ] && [ "$rc_e" -eq 0 ] && [ "$rc_c" -eq 0 ] \
+   && grep -q 'SIDECAR_VERDICT=TIMEOUT'  "$TD/p4t.txt" \
+   && grep -q 'SIDECAR_VERDICT=EMPTY'    "$TD/p4e.txt" \
+   && grep -q 'SIDECAR_VERDICT=COMPLETE' "$TD/p4c.txt"; then
+  ok "P4 verdicts intact and distinguished (TIMEOUT=1 · EMPTY=0 · COMPLETE=0)"
+else
+  bad "P4 verdict channel drifted (timeout rc=$rc_t, empty rc=$rc_e, complete rc=$rc_c)"
+  head -1 "$TD/p4t.txt" "$TD/p4e.txt" "$TD/p4c.txt" 2>/dev/null | sed 's/^/     /'
+fi
+
+# P5 — an outfile that cannot be written made `wc -c` fail, `${size:-0}` read 0, and the wrapper
+# announce EMPTY with exit 0. The sidecar had in fact produced output. Same false-clean class as
+# the bug this file anchors, on the typed channel itself.
+SIDECAR_POLL=1 bash "$SW" "$TD/nodir/x.out" 10 -- echo hi >/dev/null 2>&1 </dev/null
+rc_w=$?
+if [ "$rc_w" -eq 2 ]; then
+  ok "P5 an unwritable outfile fails closed (exit 2), never 'EMPTY'"
+else
+  bad "P5 an unwritable outfile returned rc=$rc_w — a sidecar that ran reported as saying nothing"
+fi
+
+# P6 — the knob added while making this anchor cheap re-opened the unbounded wait. Each bad value
+# must still produce a bounded TIMEOUT. Deliberately NOT using $FAST: the point is a bad POLL.
+p6=0
+for badpoll in 0 0.5 abc 08 09 600; do
+  SIDECAR_POLL="$badpoll" timeout 12 bash "$SW" "$TD/p6.out" 2 -- sleep 30 >"$TD/p6.txt" 2>&1
+  rc6=$?
+  if [ "$rc6" -eq 1 ] && grep -q 'SIDECAR_VERDICT=TIMEOUT' "$TD/p6.txt"; then p6=$((p6+1)); fi
+done
+if [ "$p6" -eq 6 ]; then
+  ok "P6 a malformed SIDECAR_POLL (0·0.5·abc·08·09·600) still times out — the budget is not disarmable"
+else
+  bad "P6 only $p6/6 malformed poll values produced a bounded TIMEOUT (unbounded wait is reachable)"
+fi
+
+# P7 — TIMEOUT must not orphan the sidecar, INCLUDING grandchildren: `kill "$PID"` reached only the
+# direct child, so `sh -c 'sleep N & wait'` survived while this lane stayed green. The marker is
+# per-run: a machine-global `pgrep -f 'sleep 25'` false-FAILs on any concurrent sleep and its
+# failure branch would kill unrelated host processes.
+MARK="p7_$$_$(date +%s 2>/dev/null || echo x)"
+SIDECAR_POLL=1 bash "$SW" "$TD/p7.out" 2 -- sh -c "sleep 25 & wait # $MARK" >"$TD/p7.txt" 2>&1 </dev/null
+sleep 1
+if ! pgrep -f "$MARK" >/dev/null 2>&1; then
+  ok "P7 a timed-out sidecar is killed with its grandchildren, not orphaned past our exit"
+else
+  bad "P7 a grandchild survived TIMEOUT (orphan restored)"; pkill -f "$MARK" 2>/dev/null
+fi
+
+# P9 — the tty path. HONEST SCOPE, do not read this lane as more than it is.
+#
+# It asserts that a stdin-reading child under an allocated pty still produces a bounded verdict. It
+# does NOT bind the `if [ -t 0 ]` branch: removing that branch entirely leaves this lane GREEN
+# (measured 2026-07-29). Cross-family review reproduced a SIGTTIN stop (rc=124, no verdict) under a
+# pty before `set -m` was added for the group-kill; this harness cannot reproduce that condition,
+# so whether the branch is still load-bearing is UNMEASURED — the branch is kept as defensive, not
+# as something this anchor proves.
+#
+# A lane that cannot separate a known-positive from a known-negative is not measuring; it is
+# generating. Shipping it as a plain green would manufacture exactly the false confidence this
+# file exists to prevent, so it is labelled instead of silently counted.
+if command -v script >/dev/null 2>&1; then
+  # `< /dev/null` on `script` itself: with the harness's inherited stdin it could not allocate a pty
+  # at all and wrote no rc file, so the lane failed identically with AND without the fix under test
+  # — it discriminated nothing. The pty it allocates for the inner command is what matters.
+  # The inner shell writes its rc to a FILE. Parsing `script`'s own stdout fails: it emits ^D and
+  # CRLF, and the first version of this lane read rc as empty and reported a defect that did not
+  # exist — the target was fine, the instrument was not.
+  script -q /dev/null bash -c "SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'" >/dev/null 2>&1 < /dev/null
+  rc9=$(tr -dc '0-9' < "$TD/p9rc" 2>/dev/null)
+  if [ -n "$rc9" ] && [ "$rc9" != "124" ] && grep -q 'SIDECAR_VERDICT=' "$TD/p9.txt" 2>/dev/null; then
+    ok "P9 the tty path runs and emits a verdict (UNCALIBRATED — see note; does NOT bind the branch)"
+  else
+    bad "P9 tty case rc='${rc9:-<unread>}' verdict='$(head -1 "$TD/p9.txt" 2>/dev/null)'"
+  fi
+else
+  bad "P9 UNCALIBRATED — \`script\` unavailable, the tty branch cannot be exercised here"
+fi
+
+# P8 — the child's stderr AND its exit code must reach the typed channel. Dropping `2>&1` or
+# hardcoding rc=0 both passed the earlier anchor: it grepped the verdict WORD and the wrapper's
+# own rc, never the child's.
+SIDECAR_POLL=1 bash "$SW" "$TD/p8.out" 20 -- sh -c 'echo STDERR_MARK >&2; exit 3' >"$TD/p8.txt" 2>&1 </dev/null
+if grep -q 'STDERR_MARK' "$TD/p8.out" 2>/dev/null && grep -q 'exit=3' "$TD/p8.txt"; then
+  ok "P8 child stderr is captured and its exit code reaches the verdict line"
+else
+  bad "P8 stderr or child exit code lost (out='$(head -c 40 "$TD/p8.out" 2>/dev/null)' verdict='$(head -1 "$TD/p8.txt")')"
+fi
+
+echo "----"
+echo "sidecar_wait stdin anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1