@chrono-meta/fh-gate 1.4.77 → 1.4.78

package/.claude/rules/fh_4axis_gate.md

@@ -114,6 +114,69 @@ no runnable path exists (run-first, ask-last — sonnet_floor_doctrine.md §Auto
 
 Record sim results in the Axes 2–3 marker + sub-agent invocation log.
 
+### Reviewer-visible evidence — the marker is not readable from the other side
+
+**Rule**: a PR touching FH assets carries a **sanitized evidence capsule** in its body — what was
+run, what it returned, what was found and closed — plus, for any verdict reported as a **grade, tier
+or code**, both the **inline expansion** and the **canonical definition's location**
+(`sim grade F = Functional/PASS — scale: sim-conductor SKILL.md §Area-D`). A bare letter is not a
+verdict to anyone outside the author's vocabulary, and a decoded letter is still only *semantics* —
+it says what the grade means, never that the run produced it. Keep those two separate.
+
+**Never paste the raw marker.** Write the capsule; do not copy the file. The marker is a local
+artifact that may quote paths, hostnames, internal asset names, or unredacted findings, and
+**§Company residency forbids those reaching a log, comment, or paste** (`CLAUDE.md` — "not into a
+log, comment, or paste"). A PR body is a paste on a public surface. This matters mechanically, not
+just in principle: the pre-commit confidentiality guard scans **staged tracked content** and has no
+view of PR-body text, so a body is *outside* the repo's mechanical privacy floor. Run the
+public-surface scan over the capsule text before creating or editing the body. (Cross-family review
+2026-07-30 caught this: the first draft of this rule said "inline the evidence itself", which pointed
+authors straight through that gap — the residency floor and the reviewer-visibility goal were pulling
+in opposite directions and only one of them had a hook.)
+
+**Why this is structural, not politeness**: the marker file itself is **gitignored by design**
+(`.gitignore` `tracks/**` — verify per file with `git check-ignore -v <marker>`; a couple of
+force-added files elsewhere under `tracks/_meta/` do not change it for markers). So the
+machine-checkable evidence for a change exists only on the author's machine — a reviewer on another
+session, another worktree, or another runtime **cannot reach it**.
+The gate is satisfied and the reviewer still has nothing but prose. This is the same shape as the
+gate-locality defect (a gate placed where the actor that needs it cannot read it), one layer over:
+**evidence placed where the reviewer cannot read it**.
+
+**Measured 2026-07-30 (PR #205, a Codex-authored change reviewed by Claude)**: the PR body reported
+`salience cold-start simulation: grade F`. The reviewer could not resolve it — the marker was in a
+gitignored path inside the author's worktree — and recorded it as UNVERIFIED. `F` in fact meant
+**Functional**, the PASS grade of sim-conductor's Area-D consumer scale
+(`plugins/fh-meta/skills/sim-conductor/SKILL.md` §Area-D — `F` functional / `P` partial / `B` broken),
+i.e. the sim had *passed*. Two failures, one on each side, and the rule addresses both: the author
+reported a coded verdict without its scale, and the reviewer's own grep surfaced the defining file
+and the reviewer did not open it. **A pointer your instrument hands you is not optional reading.**
+
+**Degrade direction — and it does NOT satisfy the rule.** Evidence that cannot be sanitized into a
+capsule is declared, never dropped, and never silently counted as met:
+
+```
+LOCAL-ONLY ATTESTATION — UNVERIFIED: <one-line result> (record: local marker <name>)
+```
+
+That line is **an author's claim, not reviewer-visible evidence**. It leaves the requirement
+*unmet*, and the PR proceeds only by one of: a sanitized reproducible capsule · an authorized
+independent review on a machine that can read the record · explicit operator acceptance of the
+unverified state. Silence reads as verified, which is why the label is mandatory — but the label is
+an honest gap, not a way to close one. **Never restate a local-only result as though the reviewer
+confirmed it**, and note that inlining a marker field proves nothing about provenance either: the
+marker's own scope is form + non-vacuity + auditability, **not** that the run happened (see the
+marker-scope note above).
+
+**Enforcement boundary — say which half is mechanical.** An earlier draft of this rule claimed no
+hook could enforce any of it. That was overbroad: **presence and syntax are mechanizable** — a
+`pull_request` CI status can check that an applicable PR carries a capsule, that graded verdicts are
+expanded, and that a local-only attestation is labelled; a local `gh pr create/edit` wrapper can run
+the private-pattern scan that public CI cannot (public CI must never hold the private patterns).
+What stays un-mechanizable is **truth and provenance** — whether the capsule describes a run that
+actually happened. Neither anchor is built today; that is a named residual, and a rule that
+over-claims its own floor is the defect this file exists to prevent.
+
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Sim-Dispatch-Fallback` — the
 > headless `claude -p --model` fallback when in-session model-pin is unavailable, the saturation-disguise
 > retry (compact-then-retry once), and the credit-pool caveat — read when a model-pinned dispatch fails.

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.77",
+      "version": "1.4.78",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.77",
+      "version": "1.4.78",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -1,283 +1,119 @@
-# AGENTS.md — forge-harness Sub-Agent Specs
+# AGENTS.md — forge-harness Runtime Entry Point
 
-> **This file is the runtime agent specification registry for forge-harness.**
-> For session rules and orchestration protocol, see `CLAUDE.md`.
-> For skill descriptions and natural language triggers, see `plugins/fh-meta/` and `plugins/fh-commons/`.
-
----
+> **Always-loaded layer.** Keep agent selection and rules that must govern every runtime here.
+> Load execution examples, compatibility history, and conditional procedures only through the
+> imperative pointers below.
 
 ## Relationship to CLAUDE.md
 
 | File | Scope | Audience |
 |---|---|---|
-| `CLAUDE.md` | Session rules, protocols, orchestration flow | AI (Claude Code) — operational ruleset |
-| `AGENTS.md` | Runtime agent specs — roles, tools, invocation | AI + humans — agent registry |
-
-CLAUDE.md governs *how* the session runs. AGENTS.md defines *what each agent does* when dispatched.
+| `CLAUDE.md` | Session rules, protocols, orchestration flow | Claude Code |
+| `AGENTS.md` | Portable runtime rules, agent roles, dispatch boundaries | AI runtimes + humans |
 
----
+`CLAUDE.md` governs Claude-native automation. This file is the portable entry point for Codex and
+other non-Claude runtimes, which do not auto-load `.claude/rules/*.md`.
 
 ## Agent Registry
 
-forge-harness ships 8 tracked agents across plugin `agents/` directories. The **user-mastery spectrum** (`beginner` · `main-player` · `expert`) plus `challenger` (adversarial axis) supply multi-persona review; `fact-checker`, `hub-persona-auditor`, and `persona-innovator` serve general harness operations; `quench-challenger` is steel-quench-dedicated.
+forge-harness ships 8 tracked agents. The user-mastery spectrum (`beginner` · `main-player` ·
+`expert`) plus `challenger` supplies multi-persona review; the remaining agents serve harness
+operations or steel-quench.
 
 | Agent | File | Role | Invoked by |
 |---|---|---|---|
-| `beginner` | `plugins/fh-meta/agents/beginner.md` | First-contact cold-read standpoint (spectrum entry tier) — onboarding friction a fluent author cannot feel; constructive, not adversarial | `sim-conductor` Area A, `marketplace-gate`, `install-wizard`, or direct dispatch |
-| `main-player` | `plugins/fh-meta/agents/main-player.md` | Engaged-user standpoint (spectrum core tier) — intelligently scopes Light/Midcore/Heavy; Heavy = classic power-user edge/limit lens | `sim-conductor` Area A/D-code, or direct dispatch |
-| `expert` | `plugins/fh-meta/agents/expert.md` | Domain-authority standpoint (spectrum frontier tier) — web-grounded accuracy + SOTA currency, citation-enforced | `sim-conductor` Area E/D, paper review, or direct dispatch |
-| `challenger` | `plugins/fh-meta/agents/challenger.md` | Frontier-grade adversarial evaluator — adapts attack vectors to artifact type, enforces evidence citation, models its own information asymmetry; U1 absorbs the skeptic "why not just X?" lens | `steel-quench`, `harvest-loop`, `sim-conductor`, or direct dispatch |
-| `fact-checker` | `plugins/fh-meta/agents/fact-checker.md` | Pre-recommendation deduplication — greps hub assets for existing skills/agents/patterns before main agent commits to a new recommendation; catches stale facts and duplicate work | Main agent before any new asset creation or recommendation |
-| `hub-persona-auditor` | `plugins/fh-meta/agents/hub-persona-auditor.md` | Pre-publication audit of external-facing assets — 3+ persona simulation, 4-axis review (resonance/confusion/resistance/supplement), 3-tier revision proposals | `hub-cc-pr-reviewer`, `sim-conductor`, or direct dispatch |
-| `quench-challenger` | `plugins/fh-commons/agents/quench-challenger.md` | Steel-quench dedicated adversary — 3-DNA synthesis of Devil + Innovator + Prescriber; every attack paired with a concrete fix direction | `steel-quench` Wave 1 (primary), `install-doctor`, `marketplace-gate` |
-| `persona-innovator` | `plugins/fh-meta/agents/persona-innovator.md` | Naming gap detection + frame proposals + external frontier absorption signals | `sim-conductor` Area A, `harvest-loop`, or direct dispatch |
-
-> Machine-readable mirror: `.claude/registry/agent_cards.json` (canonical capability cards, count-synced to tracked agent files — A2A Agent Card pattern).
-
-### Tool restrictions per agent
-
-| Agent | Allowed tools | Rationale |
-|---|---|---|
-| `challenger` | Read, Grep, Glob, WebSearch, WebFetch | Needs external evidence; no writes |
-| `fact-checker` | Read, Grep, Glob | Deduplication grep only — no modification |
-| `hub-persona-auditor` | Read, Grep, Glob | Audit only — no modification |
-| `quench-challenger` | Read, Grep, Glob | Attack+prescription only — no modification |
-| `persona-innovator` | Read, Grep, Glob, WebSearch, WebFetch | Frontier scanning requires web access |
-
----
-
-## 2-Layer Architecture Context
-
-forge-harness is structured as two distinct layers:
-
-| Layer | Contents | AI compatibility |
-|---|---|---|
-| **Methodology layer** (model-agnostic) | `tracks/`, `knowledge/`, `SKILL.md` documents, session protocols | Any AI model |
-| **Automation layer** (Claude-native) | `plugins/*/agents/` (plugin channel — FH's own agents, auto-loaded when the plugin is enabled), hooks, slash commands, `CLAUDE.md` rules; `.claude/agents/` is the field-project local/override slot, unused by FH itself | Claude Code only |
-
-Agents in this registry belong to the **Automation layer**. Skills (in `plugins/`) straddle both layers — their methodology is model-agnostic, but their invocation mechanism is Claude Code-native.
-
-> **Codex-compatible beta**: The Methodology layer (`tracks/`, `knowledge/`, skill documentation) is designated Codex-compatible beta. Gemini, Codex, and other AI users can apply FH methodology without the Automation layer — manual invocation replaces hook/agent dispatch.
-
-> **Directory → destination routing (where your outputs belong)**: not everything in the methodology layer is public-shareable. `knowledge/` and `SKILL.md` docs are the **public, reusable** methodology. `tracks/` is **local / private by convention** — work history, session records, `fh_signal_*`, audit logs — and is gitignored on the public mirror. An AI working in a local workspace that pairs the public mirror with a private companion store (the `*-be` pattern) must **not** infer "same folder ⇒ same repository"; route by content type:
->
-> | Content | Default destination |
-> |---|---|
-> | reusable methodology · docs · skills · public guidance · polished external-facing conclusions | public mirror (`knowledge/`, `plugins/`, `docs/`) |
-> | raw signal · operator observation · private validation · handoff · paper draft · PR-background reasoning log | private companion store (`*-be` pattern) — or keep local; do **not** commit to the public mirror |
->
-> When unsure, treat raw / observational / operator-specific material as **private-first** and promote only the polished result to public. (Concrete per-operator bindings — exact companion-store path, sync mechanism — live in the operator's local config, not here.)
-
-> **Multi-model sidecar (validated)**: Any FH user can delegate to other models via sidecar — Gemini CLI, OpenAI/Codex CLI, or Copilot CLI's model catalog — invoked with `Bash` from within the Claude Code session. FH is the orchestrating harness; the sidecar is a routing/access layer (not a second harness — different layer entirely). Validated empirically: `echo "prompt" | gemini` works inside a CC session and produces usable output. Sidecar calls are Bash invocations, not agent dispatches — they bypass this registry and are coordinated inline by the skill. Capability routing matters too: Gemini/Antigravity is the natural breadth/multimodal sidecar, while Codex's primary cast is the **repo-grounded audit** sidecar (file reads · grep/source-close · diff & patch · gate execution · phantom/backtrace) — **not** discovery/design-depth; a Codex session with Browser/Chrome connectors mounted can additionally take live web-flow automation as a capability-routed handoff. In a local FH workspace that pairs the public methodology mirror with a private companion store (the `*-be` pattern), route by workspace capability while preserving each repository's ownership boundary. See `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority` for the authority model and the full pattern.
-
-> **Waiting on a sidecar — mechanical, not by eye (2026-07-29).** A sidecar you dispatched is judged
-> ONLY by the typed verdict line from `scripts/sidecar_wait.sh`:
->
-> ```bash
-> printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 900 -- codex exec -m gpt-5.5 -
-> #   SIDECAR_VERDICT=COMPLETE exit=0 bytes=48489   → read out.txt
-> #   SIDECAR_VERDICT=TIMEOUT  waited=900s bytes=0  → STILL ALIVE, not a result
-> #   SIDECAR_VERDICT=EMPTY    exit=0               → the only state meaning "it said nothing"
-> ```
->
-> **Never judge a sidecar by looking at its output file.** A live process and a dead one produce the
-> same zero bytes, and only process state separates them. Measured here: a session backgrounded two
-> sidecars, read their files after 1 s and 30 s, recorded *"both returned 0-output"* into five
-> records — and both had answered, with four real findings, one of which showed the change under
-> review was over-applied. The mis-read nearly retired a working mechanism. This rule is repeated in
-> this file because line 71 tells you to invoke sidecars with `Bash`; a runtime reading only that
-> would dispatch with no waiting discipline at all. Canonical: `auto-decorrelation` SKILL.md §S-1b.
-
-> **Runtime authority — hard stop line (Codex / non-Claude runtimes):** your findings are **evidence candidates, not terminal verdicts**. They are not final until the governor source-closes them against a **mechanical anchor** (a local file hit · a literal source span · a passing check) — **never governor agreement alone**. You are a capability-routed **sidecar**, not a co-governor: there is one explicit governor per context. Full doctrine: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
-
----
-
-## Invocation patterns
-
-### Single agent dispatch
-
-```
-Analyze this SKILL.md for structural flaws before I commit it.
-```
-
-→ Claude dispatches `quench-challenger` automatically (description-triggered).
-
-### Parallel dispatch (2+ independent tasks)
-
-```
-Run fact-checker and persona-innovator in parallel.
-  First: check [asset path] for duplicates
-  Second: scan for naming gaps in the current harness
-```
-
-→ Both agents run concurrently in Agent View; results are integrated by the orchestrator.
-
-### Wave-based composition (via agent-composer)
-
-For complex multi-step tasks, run `/agent-composer` first to plan which agents to dispatch in which order (Wave 0 reconnaissance → Wave 1 execution → Wave 2 synthesis).
-
----
-
-## Codex Compatibility (beta)
+| `beginner` | `plugins/fh-meta/agents/beginner.md` | First-contact cold read; finds onboarding friction | `sim-conductor` Area A, `marketplace-gate`, `install-wizard`, direct |
+| `main-player` | `plugins/fh-meta/agents/main-player.md` | Engaged-user view; scopes Light/Midcore/Heavy usage | `sim-conductor` Area A/D-code, direct |
+| `expert` | `plugins/fh-meta/agents/expert.md` | Web-grounded domain accuracy and current practice | `sim-conductor` Area E/D, paper review, direct |
+| `challenger` | `plugins/fh-meta/agents/challenger.md` | Evidence-cited adversarial evaluation | `steel-quench`, `harvest-loop`, `sim-conductor`, direct |
+| `fact-checker` | `plugins/fh-meta/agents/fact-checker.md` | Pre-recommendation duplicate and stale-fact search | Before new asset creation or recommendation |
+| `hub-persona-auditor` | `plugins/fh-meta/agents/hub-persona-auditor.md` | External-facing pre-publication persona audit | `hub-cc-pr-reviewer`, `sim-conductor`, direct |
+| `quench-challenger` | `plugins/fh-commons/agents/quench-challenger.md` | Steel-quench attack plus concrete fix direction | `steel-quench` Wave 1, `install-doctor`, `marketplace-gate` |
+| `persona-innovator` | `plugins/fh-meta/agents/persona-innovator.md` | Naming gaps, frame proposals, frontier signals | `sim-conductor` Area A, `harvest-loop`, direct |
 
-The methodology layer (`tracks/`, `knowledge/`, `SKILL.md` docs) is Codex-compatible beta. Any AI model can follow skill workflows by reading SKILL.md files directly; the automation layer (hooks, plugin-channel agents under `plugins/*/agents/`, `/model`) is Claude Code-native and requires manual adaptation. FH's own agents are auto-loaded via the plugin channel when the plugin is enabled — `.claude/agents/` is the field-project override slot, not where FH ships its agents. Non-Claude runtimes use this `AGENTS.md`, `plugins/*/agents/*.md`, and `scripts/fh-run.sh` to apply the same methodology via adapter.
+Machine-readable mirror: `.claude/registry/agent_cards.json`.
 
-### Non-Claude runtimes: five things CLAUDE.md holds that you will not auto-load
+### Tool restrictions
 
-`.claude/rules/*.md` with `paths:` frontmatter is a **Claude Code platform feature** — those files are
-auto-loaded into a Claude Code session when it reads a matching file, and **your runtime has no equivalent**.
-So five things that govern behavior are not going to reach you on their own. Read them explicitly:
-
-1. **FH asset changes run a mandatory 4-axis verification chain before the session's first commit.**
-   Detail (axis definitions · marker required fields · lightweight exception · substantive carve-out):
-   `.claude/rules/fh_4axis_gate.md` — **open it directly**; nothing will load it for you. The commit is
-   hard-blocked by `templates/.git-hooks/pre-commit` regardless of runtime, so skipping the read does not
-   skip the gate — it just means you meet the block without knowing what it wants.
-   ⚠️ If you run `templates/regression_guard.sh` (Axis 1) yourself, **`exit 0` means PASS *or* SKIP** —
-   SKIP being "no staged file matched the gate's pathspec", which is *not checked*, not *checked and
-   clean*. Prefer the typed file channel — set `REGRESSION_GUARD_RESULT_FILE=<path>` and read
-   `result=pass|review|block|skip|error` from that file (stdout's `REGRESSION_GUARD_RESULT=` line is
-   the no-env fallback). Judging by exit code
-   alone lets an unexamined change report as a pass (measured 2026-07-22: that is exactly what the
-   commit hook did until it was fixed).
-2. **Company residency is absolute** (CLAUDE.md §Field-Harness Diagnostic): raw company source, secrets,
-   hostnames, internal repo/asset names, stack traces, and unredacted findings **never leave the local
-   machine** — not to an external *or same-family* cloud model, not through a browser/API tool, not into a
-   log, comment, or paste. Outbound gets a **sanitized summary only**; exceptions need explicit operator
-   approval plus a gitignored audit note. This binds every runtime, not just Claude Code — a leak does not
-   un-happen, and the guard is worth nothing if it only lives where one runtime reads.
-
-3. **Before calling a material work product done, name what you are blind to.** CLAUDE.md routes the
-   everyday "commit and merge this" moment to `agent-composer` **§Author-Exposure Table** — a review
-   pass keyed on *what the author cannot self-detect* (cold entry → `beginner` · everyday friction →
-   `main-player` · outside currency → `expert` · optimistic self-verification → `challenger` +
-   cross-family · rebuilding what exists → `fact-checker` · ungrounded numbers → `phantom-quench`),
-   with a materiality gate and an `Exposure-unclear → challenger` default so "no row applies" is not
-   an exit. **This row exists because the triggering utterance names no agent** — nothing will fire it
-   for you. Your runtime *can* run these lenses: substitute `Agent(subagent_type=...)` per §M2 above
-   (`fh-run`, or `codex exec` reading the agent spec). The lens returns evidence, never the verdict.
-
-4. **General work is in scope here, and the mechanism for serving it is to marshal installed
-   capability.** CLAUDE.md §Intent Marshaling makes this the runtime default. It settles a *category*
-   question only — whether non-harness work belongs in this environment at all. Every ordinary check
-   about a specific request (is it safe, sensible, well-formed, worth doing) is yours and is unaffected.
-
-   The category answer is yes, for a concrete reason: the skill registry, the mapped field harnesses,
-   and the memory store exist **only** in this environment. So when the operator states a work intent in
-   plain language (write this doc, build this wiki page, organize this material — **any work-shaped ask,
-   not only harness building**), the scan below is what tells you whether capability for it is actually
-   present. An empty scan, reported with the scan cited, is a correct answer — see the third bullet.
-
-   Three constraints carry over unchanged to your runtime:
-   - **Enumerate rather than recall.** List the available skills, `LOCAL_SKILL_REGISTRY`, and the mapped
-     project assets. Recall under-reports what is installed, which is why the scan is a listing step.
-   - **Marshaling never upgrades a trust tier.** Run-first autonomy covers **FH-native capability whose
-     steps are per-action reversible**. A non-FH sibling capability stays at its registry `ask-tier`
-     (propose only), and an outward-mutating action (send · post · deploy · delete) keeps its own gate.
-   - **A capability gap is declared by citing the scan result**, not as a bare "nothing fits" — then
-     route at request scale (internal scan → external search → in-session synthesis). *Persist* routes
-     to the New-Skill gate; *install* routes to plugin-recommender's HITL. No new gates.
-
-   **This item exists because the triggering utterance is ordinary work language that names no skill and
-   no agent** — like item 3, no automatic trigger covers it; read it explicitly.
-
-> **Detail**: See `knowledge/shared/harness-core/intent_marshaling_general_work.md` — the 5-step loop,
-> the gate-routing table, the Sonnet-floor boundaries, and the origin defect — **open it directly**
-> before applying the ladder or when a gap appears.
-
-5. **A scan, checker, or metric in this repo is not evidence until it has been shown to work on the
-   target you are pointing it at.** This one is easy to skip because the tooling looks finished, so it
-   is worth two cheap steps before you rely on a number it produces:
-
-   - **Run it against one case you already know the answer to, and one you know is clean.** A tool that
-     cannot separate those two has not been shown to measure anything, so its output cannot ground a
-     claim about the target — it may still be right, you just have no way to tell. This
-     repo has produced that exact result more than once — an ASCII-token scanner run over a Korean
-     corpus scored ~96% false positives, and a shell-shape scanner reported a fail-open script as
-     "clean" because every one of its probes was written for Python syntax.
-   - **Open one hit by hand before you state a count anywhere** — including in chat, not only in a file.
-     An unverified figure is anchored the moment it is said, and then has to be corrected everywhere it
-     travelled.
-
-   Two conventions that follow from this, and that the rest of the repo assumes you are using:
-   *an empty result is not a zero* — a scan that found no target files, or died mid-run, reports
-   `UNMEASURED`, never `0` — and *an extreme result (everything passed, everything failed) is a reason
-   to suspect the instrument before the target.*
-
-   Nothing enforces this mechanically; the trigger is your own intent to trust an output, which no hook
-   can see. Detail, including the known-pair procedure and the failure catalogue:
-   `knowledge/shared/harness-core/measurement-integrity-checklist.md` — **open it directly** before
-   running a scan whose count you will report.
-
-The irreversible-surface gates (Pre-Publish · Destructive-Op) likewise live in CLAUDE.md and fire on
-**intent**, not on a file — read them before any publish, delete, or history-rewrite. `pre-push` enforces
-the git-side destructive surface mechanically for every runtime.
-
-### Entry point for Codex users
-
-AGENTS.md is your starting point. Navigate from here to skill workflows:
-
-```bash
-# Read a skill's full workflow
-cat plugins/fh-meta/skills/steel-quench/SKILL.md
-
-# Apply via codex exec (validated pattern — codex-cli ≥ 0.135.0)
-cat plugins/fh-meta/skills/steel-quench/SKILL.md path/to/artifact.md \
-  | codex exec -m gpt-5.5 -
-
-# Or use FH's runtime adapter (preferred for Codex-primary workflows)
-FH_BACKEND=codex npx --package @chrono-meta/fh-gate fh-run \
-  --skill steel-quench \
-  --file path/to/artifact.md
-
-# Agent substitution for Claude Code Agent(...) calls
-FH_BACKEND=codex npx --package @chrono-meta/fh-gate fh-run \
-  --agent fh-commons:quench-challenger \
-  --file path/to/artifact.md
-
-# Or pipe explicitly
-echo "Apply the following skill to the artifact below." | \
-  cat - plugins/fh-meta/skills/{skill}/SKILL.md target.md \
-  | codex exec -m gpt-5.5 -
-```
-
-`codex exec -m gpt-5.5 -` reads from stdin in headless mode. `npx @openai/codex` (interactive) is not suitable — it requires TTY.
-
-### Skill compatibility tiers
-
-| Tier | Definition | Examples |
-|---|---|---|
-| **M1 — Full** | All phases run without CC-native dependencies — no Stop hook, no `.claude/agents/` dispatch, no `/model` | `token-budget-gate`, `asset-placement-gate`, `phantom-quench`, `deep-clarify`, `convergence-loop` |
-| **M2 — Partial** | Core workflow runs; CC-native phases require manual adaptation or skip | `deliberation` (Mediator/Jury Agent steps = manual), `steel-quench` (Wave 1–3 ✅; quench-challenger agent = manual), `harness-doctor`, `context-doctor`, `sim-conductor`, `harvest-loop` (git scan phase ✅; PR auto-proposal = manual) |
-| **M3 — CC-only** | Requires CC Stop hook or session-scoped agent dispatch; methodology reference only | `goal-quench` (Phase 3 Stop hook), `hub-cc-pr-reviewer` (CC session context), `install-wizard` (settings.json write) |
-
-**M2 adaptation pattern**: when a step references `Agent(subagent_type=...)` or a slash command, substitute with `fh-run` (preferred) or a direct `codex exec` call reading the sub-agent's SKILL.md — same workflow, different runtime.
-
-**Goal handling under Codex**: use Codex's native goal/session feature when available. FH's portable role is the quality gate after the goal completes: `FH_BACKEND=codex npx --package @chrono-meta/fh-gate fh-gate ...`. `fh-goal` exists only for non-interactive one-shot runs that should be followed automatically by `fh-gate`; it is not a replacement for Codex-native goal control.
-
-### Beta removal conditions
-
-| Condition | Status |
+| Agent | Allowed tools |
 |---|---|
-| Known limitation list published (`docs/codex-compat.md`) | ✅ done (2026-06-04) |
-| 5+ externally validated M1 skill runs (not FH author) | ⬜ pending — needs external users |
-| At least 1 external Codex user confirms methodology reproduces | ⬜ pending — needs external users |
-| README badge updated (`Codex-compatible` without `beta`) | ⬜ blocked on above |
-
-**Author M1 validation (2026-06-04, internal — does not satisfy the external conditions above):** `phantom-quench` (4/4 on a phantom-seeded fixture) and `asset-placement-gate` (correct Drop routing on a duplicate-skill proposal) ran end-to-end via `codex exec -m gpt-5.5 -` with no CC-native dependency, confirming the M1 tier assignments. Limitations observed (CC-native hook noise, no token accounting, etc.) are documented in `docs/codex-compat.md`.
+| `challenger` | Read, Grep, Glob, WebSearch, WebFetch |
+| `fact-checker` | Read, Grep, Glob |
+| `hub-persona-auditor` | Read, Grep, Glob |
+| `quench-challenger` | Read, Grep, Glob |
+| `persona-innovator` | Read, Grep, Glob, WebSearch, WebFetch |
+
+## Runtime Boundaries
+
+- **Two layers:** `tracks/`, `knowledge/`, and skill methodology are model-agnostic. Plugin agents,
+  hooks, slash commands, and `.claude/rules/` automation are Claude-native.
+- **Output residency:** reusable methodology and polished public guidance belong in `knowledge/`,
+  `plugins/`, or `docs/`. Raw signals, operator observations, handoffs, audit logs, and private
+  reasoning are private-first; do not infer that colocated directories share a repository.
+- **Runtime authority:** a non-Claude sidecar returns evidence candidates, never the terminal verdict.
+  The governor must source-close each finding against a local file hit, literal source span, or
+  passing check. Governor agreement alone is not an anchor.
+- **Sidecar completion:** judge a sidecar only by the typed verdict from `scripts/sidecar_wait.sh`.
+  Never infer completion or emptiness by looking at its output file.
+
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Architecture-and-output-routing`
+> — layer ownership and destination routing — read before routing work across a public/private workspace pair.
+
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Sidecar-routing-and-waiting`
+> — capability routing, the required wait command, and typed verdict meanings — read before dispatching a sidecar.
+
+## Mandatory Non-Claude Checklist
+
+Because non-Claude runtimes do not auto-load Claude path rules, apply these rules explicitly:
+
+1. **FH asset change:** before editing, read `.claude/rules/fh_4axis_gate.md`; before the first commit,
+   run its required axes. Treat `templates/regression_guard.sh` exit 0 as PASS or SKIP; use its typed
+   result channel and never report SKIP as checked.
+2. **Company residency:** raw company source, secrets, hostnames, internal names, stack traces, and
+   unredacted findings never leave the local machine, including to same-family cloud models. Only a
+   sanitized summary may leave; exceptions require explicit operator approval and a gitignored note.
+3. **Author exposure:** before calling a material work product done, identify the author's blind spot
+   and run the matching `agent-composer` Author-Exposure lens. The lens supplies evidence, not a verdict;
+   unclear exposure defaults to `challenger`.
+4. **Intent marshaling:** general work is in scope. Enumerate installed skills, `LOCAL_SKILL_REGISTRY`,
+   and mapped project assets before composing capability. Preserve each trust tier and each outward
+   action gate. Declare a gap only with the scan cited, then route through internal registry search,
+   external search, and in-session synthesis. Persist and install retain their existing gates.
+5. **Measurement integrity:** before trusting a scan or count, run a known-positive and known-clean
+   pair, then open one hit manually. An empty or failed scan is `UNMEASURED`, not zero; extreme results
+   require instrument suspicion.
+6. **Irreversible intent:** before publish, delete, or history rewrite, read and apply the
+   Pre-Publish or Destructive-Op gate in `CLAUDE.md`. `pre-push` is only the git-side backstop.
+
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Mandatory-checklist-procedures`
+> — exact supporting procedures and canonical doctrine links — read when any checklist trigger fires.
+
+## Invocation
+
+Non-Claude runtimes apply methodology manually. Prefer `FH_BACKEND=codex ... fh-run` for skills and
+agents. When a workflow references `Agent(subagent_type=...)` or a slash command, replace that step
+with `fh-run` or a direct `codex exec` call that reads the relevant spec. Use Codex native goal/session
+control; FH supplies the quality gate after goal completion.
+
+| Tier | Definition | Skills |
+|---|---|---|
+| **M1 — Full** | No Claude-native dependency | `token-budget-gate`, `asset-placement-gate`, `phantom-quench`, `deep-clarify`, `convergence-loop` |
+| **M2 — Partial** | Core works; native agent or slash-command steps need adaptation | `deliberation`, `steel-quench`, `harness-doctor`, `context-doctor`, `sim-conductor`, `harvest-loop` |
+| **M3 — Claude-only** | Requires a Claude hook or session-scoped dispatch | `goal-quench`, `hub-cc-pr-reviewer`, `install-wizard` |
 
-Tracking: open an issue at `chrono-meta/forge-harness` with label `codex-validation` to report a validated run.
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Invocation-patterns`
+> — single, parallel, and wave composition examples — read when choosing a dispatch shape.
 
----
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Codex-entry-points`
+> — runnable `fh-run` and `codex exec` forms — read before invoking FH from Codex.
 
-## Adding new agents
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Compatibility-tiers`
+> — tier constraints and goal-handling limits — read before adapting an M2/M3 workflow.
 
-New agents must pass the **New Skill Creation Pre-Commit Gate** defined in `CLAUDE.md` before committing. Key requirements:
+## Conditional Procedures
 
-1. Role duplication check via `/asset-placement-gate`
-2. Plain description — no self-marketing language
-3. At least 1 explicit `Done When` condition
-4. At least 3 natural language trigger examples
-5. Independently executable (or dependencies explicitly documented)
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Beta-removal`
+> — external-validation conditions and reporting route — read when evaluating or changing beta status.
 
-After 2+ weeks of use: if `accepted ≥ 60%` of invocations → strengthen; if `rejected ≥ 40%` → redefine scope or deprecate. See `CLAUDE.md > Sub-agent Operations`.
+> **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Adding-agents`
+> — creation gate, registry synchronization, and post-use thresholds — read before adding an agent.

package/CLAUDE.md

@@ -531,7 +531,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | **"진단해줘", "개선해줘", "diagnose this", "improve this harness", "check this project", "audit this project"** — said while working **in a mapped project** (not a single-file ask) | **Field-Harness Diagnostic** (see §Field-Harness Diagnostic above → compose existing checks into one ranked M/S/R list → HITL approval per item, nothing auto-fixed) |
 | **"새 프로젝트", "하네스 작성해줘", "이 프로젝트 가속화", "harness-ify this", "accelerate this project"** — an onboarding/acceleration door (returning-menu ①②③) | **Onboarding / Acceleration Autopilot** (see §Onboarding / Acceleration Autopilot above → Phase 0 auto-discover + branch → innovator-centered recommend → ranked install plan → HITL per item, non-overwriting; "끝까지 자율로" → full-autonomy under /goal-quench gate) |
 
-**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed — and, symmetrically, a class **accepted 3× consecutively** earns a one-time "stop asking?" offer (§Consent promotion; never on irreversible surfaces).
+**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed.
 For per-skill utterance patterns, see the relevant `SKILL.md §Trigger Phrases` section.
 
 ### Cadence Rules — Check at Session Start
@@ -564,8 +564,7 @@ Some proposals are not *time*-overdue — they fire **once when a specific work
 Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidirectional`). A **standing, per-user operational loop** tunes FH behavior to the individual during normal field use, and escalates **only generalizable** learnings to the `field-harvest` → FH-origin PR funnel — idiosyncratic taste stays local (drift guard).
 
 - **User Adaptation Profile (UAP)** — `tracks/_meta/user_adaptation_profile.md` (local/gitignored; **behavioral prefs only, never domain content**). Records skill-proposal outcomes (`accepted`/`rejected`/`sustained` — same vocabulary as `operations.md`), preferred tier/language/cadence, recurring friction, muted nags.
-- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, **offer standing consent on a 3×-accepted class**, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
-- **Consent promotion (accept-side)** — repeated approval must offer to stop asking, not bill the same prompt forever: 3 consecutive `accepted` on a **registered** class (`tracks/_meta/consent_classes.yaml` — classes are declared, never minted mid-run) → **offer once, quoting the three approvals and the exact scope** → granted = a **time-limited lease**, revocable, and every unprompted run announces itself. **Not symmetric with suppression**: a bad suppression costs a re-ask, a bad grant has side effects. **Floor, decided mechanically from the registry — never by the session's own judgment**: a class never promotes if its sinks are irreversible (publish · delete · history-rewrite), if it *feeds* such a sink (**taint propagates through reversible steps**), or if that is **unknown** — unknown is not reversible. No UAP / no registry entry / expired → keep asking (absent ≠ granted). **Named residual: the ledger is self-attested** — mitigated (append-only, quoted evidence), not closed.
+- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
 - **Generalization gate** — idiosyncratic → UAP local; generalizable (any user benefits; `≥40%` reject = redefine candidate / `≥60%` accept = reinforce, per `operations.md` gate) → `field-harvest` Mode A → FH PR (HITL).
 - **Ephemeral guard** — UAP is gitignored, wiped on cloud reclaim; in ephemeral sessions operate from defaults, do not fabricate it.
 
@@ -700,10 +699,6 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to
        `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`
        is CLOSED — a later append re-opens the violation ⑤ exists to prevent.
-       **Late finding (named case)**: a finding that surfaces AFTER (b) — including while writing
-       the final message to the operator — means ⑤ is **not done**. Re-run ⑤ **whole**: append,
-       then **rewrite the card**. Appending alone is the violation; the card must never be older
-       than `fh_completed`.
   → ⑥ Commit card + push
 ```
 

package/docs/codex-compat.md

@@ -1,6 +1,9 @@
 # Codex Compatibility — Known Limitations & Validated Patterns
 
-> Status: **beta**. This document is beta-removal condition #2 (see `AGENTS.md` → Codex Compatibility → Beta removal conditions). It lists what works, what breaks, and what to expect when applying forge-harness (FH) methodology through OpenAI Codex (`codex exec`) instead of Claude Code.
+> Status: **beta**. This document is a beta-removal condition (see
+> `knowledge/shared/harness-core/agents_md_runtime_details.md §Beta-removal`). It lists what works,
+> what breaks, and what to expect when applying forge-harness (FH) methodology through OpenAI Codex
+> (`codex exec`) instead of Claude Code.
 
 FH is a 2-layer system: a **methodology layer** (`tracks/`, `knowledge/`, `SKILL.md` docs) that is model-agnostic, and an **automation layer** (Claude Code hooks, plugin-channel agents under `plugins/*/agents/`, field-project overrides under `.claude/agents/`, `/model`, settings.json) that is Claude-native. Codex users run the methodology layer by reading `SKILL.md` files directly; automation steps either run through runtime adapters (`fh-gate`, `fh-run`) or require manual substitution.