@chrono-meta/fh-gate 1.4.77 → 1.4.79

package/scripts/package_coverage_check.sh

@@ -21,10 +21,27 @@ set -uo pipefail
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT" || exit 1
 
-if [ ! -d .git ] || [ ! -f package.json ]; then
+# Source-checkout test uses `-e`, not `-d`. In a git WORKTREE `.git` is a FILE (a gitdir pointer),
+# so the old `-d` test read every worktree as "installed package" and skipped the check entirely —
+# silently, with exit 0. Measured 2026-07-31: a worktree created specifically to approximate CI
+# reported PASS while this check had not run at all, i.e. the instrument used to justify wiring CI
+# was itself fail-open on the surface it was standing in. `-e` covers both the ordinary checkout
+# (dir) and the worktree (file); genuine package mode has no `.git` of either kind, so it still
+# skips. Anchored by scripts/test_package_coverage_lanes.sh.
+if [ ! -e .git ]; then
   echo "SKIP  package-coverage (not a source checkout)"
   exit 0
 fi
+# PREDICATE SPLIT (cross-family review, 2026-07-31). These were one condition, and folding them
+# together meant `.git` present + manifest missing returned SKIP + exit 0 — "we are in a checkout
+# and cannot read what ships" reported as "nothing to check here". Absence of the input is not
+# absence of the defect; `not found != 0` (CLAUDE.md §Instrument-Calibration). Only the no-.git
+# case is a legitimate skip (an installed package, where the un-shipped files are correctly gone).
+if [ ! -f package.json ]; then
+  echo "FAIL  package-coverage: source checkout with no package.json — the shipped file list is"
+  echo "      unreadable, so coverage is UNMEASURED, not clean"
+  exit 1
+fi
 
 # ── Accepted-absent, with the reason each one is NOT a defect ────────────────────────────────
 # Adding a line here is a decision, not a silencer: each entry states why shipping it would be
@@ -43,6 +60,10 @@ fi
 #       no shipped hook invokes it.
 ACCEPTED_ABSENT=(
   ".claude/registry/LOCAL_SKILL_REGISTRY.md"
+  # An INSTALL DESTINATION the user creates (`cp templates/local_fh_context.md
+  # .claude/rules/local_fh_context.md`), not a file FH ships. Shipping it would overwrite the
+  # user's own cross-context wiring — the template it is copied FROM is what ships.
+  ".claude/rules/local_fh_context.md"
   ".claude/regression/probes.md"
   "scripts/sync-to-be.sh"
   "scripts/sync_guard_check.sh"
@@ -83,6 +104,24 @@ for s in shipped:
         # Only a path that REALLY EXISTS here but is left out of the tarball is this defect.
         # A path that exists nowhere is the ordinary phantom-reference class the ref-path
         # check above already owns; a path outside files[] that is also absent is nothing.
+        # EXISTENCE, not tracked-ness. A 2026-07-30 revision narrowed this to `git ls-files`
+        # to silence what looked like a machine-local false positive; measurement showed that was a
+        # WEAKENING — an existing-but-untracked path named by a shipped doc is exactly the defect
+        # (the npm user cannot have that file), and selfcheck's ref-path check SKIPs gitignored
+        # paths, so nothing else owns it. Reverted.
+        #
+        # WIDENING IS DEFERRED, AND THE REASON IS NOT A MEASUREMENT. Dropping `exists` entirely
+        # (flag every referenced ∧ ¬covered path) is arguably the correct predicate, but it cannot
+        # be evaluated while the extractor below is known-broken: its `(sh|py|js|md|json|…)`
+        # alternation puts `js` before `json`, so `settings.json` is captured as `settings.js`.
+        # A first pass at this comment cited a count of artifacts as evidence that `exists` is
+        # load-bearing — that count came FROM the broken extractor, i.e. an instrument was used to
+        # justify keeping a predicate before the instrument itself was validated (the circularity
+        # CLAUDE.md §Instrument-Calibration exists to forbid; a cross-family review caught it, and
+        # an independent extractor produced materially different numbers).
+        # HONEST STATE: fix the `js|json` alternation first, re-measure, then decide. Until then
+        # this check's true coverage is UNQUANTIFIED — treat a PASS as "no defect of the narrow
+        # exists-and-uncovered kind", not as "every shipped reference is sound".
         if os.path.exists(m) and not covered(m):
             if m in accepted:
                 exercised.add(m)

package/scripts/pipe_verdict_guard.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# pipe_verdict_guard.sh — PreToolUse(Bash) advisory: a verdict read from the wrong end of a pipe.
+#
+# THE DEFECT
+#   `cmd | tail -5; echo "exit=$?"` reports TAIL's status, not cmd's. A gate that FAILED reads as
+#   exit 0. The degrade direction is toward PASS, which is the direction that never announces
+#   itself. Measured 6× in this project between 2026-07-29 and 2026-07-31.
+#
+# WHY A HOOK AND NOT A FILE LINTER (measured 2026-07-31, and it reversed the plan on record)
+#   The session card prescribed "add an S6 class to scripts/degrade_direction_scan.sh". Every
+#   `pipe + $?` occurrence in this repo's shell scripts was then hand-verified: 7 hits, 7 correct
+#   — in all 7 the final stage WAS the command under test. True positives in shipped files: 0.
+#   All 6 recurrences lived in interactively-composed commands, which a repo scanner never reads.
+#   S6 would have shipped a probe with no true positives, the exact failure mode S5 records in
+#   its own comment ("100% FP trains dismissal of the one hit that will matter"). So the guard
+#   moved to the surface where the defect actually occurs: the Bash tool call itself.
+#
+# TWO RULES, DELIBERATELY UNEQUAL IN CONFIDENCE
+#   R1 — deterministic, zero-FP. `${PIPESTATUS[…]}` is bash-only. This project's Bash tool runs
+#        zsh, where that expands to the EMPTY STRING (zsh spells it `$pipestatus[1]`, 1-indexed).
+#        A verdict read from it is not wrong, it is ABSENT. No judgment involved.
+#   R2 — heuristic, narrowed to DISPLAY FILTERS as the final stage (tail/head/cat/less/more).
+#        A final `grep -q`, a script, or a subshell is usually the thing whose status is wanted —
+#        those are the 7 correct shapes above and are not flagged. Narrowing costs recall; the
+#        alternative is a probe nobody reads.
+#
+# DEGRADE DIRECTION: advisory. This guard WARNS and exits 0 — it never blocks a Bash call, because
+#   a mis-read verdict is re-runnable and a false block on a developer's shell trains --no-verify
+#   reflexes on hooks that DO guard irreversible surfaces. Set FH_PIPE_VERDICT_BLOCK=1 to escalate.
+#   If the command cannot be extracted, it stays silent: an unparsed input is not a finding.
+#
+# Usage:
+#   hook:  PreToolUse matcher "Bash" → bash scripts/pipe_verdict_guard.sh
+#   test:  printf '%s' "<command>" | bash scripts/pipe_verdict_guard.sh --stdin-raw
+# Opt out on a single command with a trailing `# noqa: pipe-verdict`.
+
+set -u
+
+CMD=""
+if [ "${1:-}" = "--stdin-raw" ]; then
+  CMD=$(cat)
+else
+  RAW=$(cat)
+  # PreToolUse payload. Absent/!Bash/unparseable → stay silent (see degrade direction above).
+  CMD=$(printf '%s' "$RAW" | python3 -c '
+import json,sys
+try: d = json.load(sys.stdin)
+except Exception: sys.exit(0)
+if d.get("tool_name") != "Bash": sys.exit(0)
+sys.stdout.write(d.get("tool_input", {}).get("command", "") or "")
+' 2>/dev/null) || CMD=""
+fi
+[ -n "$CMD" ] || exit 0
+
+# Explicit opt-outs, checked before any rule.
+printf '%s' "$CMD" | grep -qE '#[[:space:]]*noqa:?[[:space:]]*pipe-verdict' && exit 0
+
+hits=""
+add() { hits="${hits}  ⚠️  PIPE-VERDICT $1
+      $2
+"; }
+
+# Flatten to ONE line before any matching. grep is line-oriented, so `.*` never spans a newline and
+# every multi-line command missed — which is the worse half, because the invocations that actually
+# recur here are multi-line. A newline is a statement separator, so `; ` is the faithful substitute.
+# (Found by the Axis-2 adversarial pass on this guard, 2026-07-31; lanes A* pin it.)
+FLAT=$(printf '%s' "$CMD" | tr '\n' ';' | sed 's/;/; /g')
+
+# ── R1 — PIPESTATUS under zsh: the value is empty, so the verdict is absent. ──────────────────
+# Brace-optional: zsh accepts `$PIPESTATUS[0]` as well, and the brace-anchored form missed it (lane B*).
+if printf '%s' "$FLAT" | grep -qE '\$\{?PIPESTATUS[[{]' ; then
+  add "R1 \${PIPESTATUS[…]} is empty in zsh" \
+      "This shell is zsh; the bash array does not exist here, so the verdict expands to \"\". Use zsh's \`\$pipestatus[1]\` (1-indexed), or drop the pipe and read \$? directly."
+fi
+
+# ── R2 — display filter as the final stage, then a read of $?. ────────────────────────────────
+# `||` is neutralized first: `a || b || echo 0` contains no pipeline, and reading it as one is
+# how the sibling S5 probe produced 9 false positives before it was narrowed (2026-07-28).
+# `set -o pipefail` in the same command makes `$?` after a pipeline correct — not a finding.
+NORM=$(printf '%s' "$FLAT" | sed 's/||/__OR__/g')
+if ! printf '%s' "$NORM" | grep -qE 'set -o pipefail|set -[a-zA-Z]*o[a-zA-Z]* pipefail'; then
+  if printf '%s' "$NORM" \
+     | grep -qE '\|[[:space:]]*(tail|head|cat|less|more)([[:space:]][^|;&]*)?[[:space:]]*[;&].*\$\?'; then
+    add "R2 \$? after a display filter" \
+        "\$? holds the filter's status (tail/head/cat almost always succeed), not the command's — a FAILED check reads as 0. Capture first: \`out=\$(cmd 2>&1); rc=\$?\` then print \"\$out\" | tail."
+  fi
+fi
+
+[ -n "$hits" ] || exit 0
+
+printf '%s' "$hits" >&2
+if [ "${FH_PIPE_VERDICT_BLOCK:-0}" = "1" ]; then exit 2; fi
+exit 0

package/scripts/selfcheck.sh

@@ -2,7 +2,13 @@
 # selfcheck.sh — mandatory-pass (deterministic) checks on FH's own executable surface.
 # Class: mandatory-pass (harness_6axis_framework.md §Axis 5 check classes) — blocks on fail.
 # Scope: executables shipped via npm files[] + the bash infra driving the FH gate chain.
-# Syntax-only (node --check / bash -n): zero side effects, no network, runs anywhere.
+# NOT syntax-only any more, and this line used to say it was. Syntax checks (node --check / bash -n)
+# are only the first section; behavioural lane suites follow and they DO have side effects and
+# environment needs: temp dirs, a loopback HTTP stub on 127.0.0.1:18011, git, `timeout`, and — via
+# the session-close lanes — an optional `gh` call that reaches GitHub when the binary is present.
+# Corrected 2026-07-31 (cross-family review): the stale "zero side effects, no network" claim
+# survived the additions that falsified it, which is how a reader ends up trusting the wrong
+# invariant. No remote network is REQUIRED; some is possible.
 # Wiring: `npm test` for any session; `prepublishOnly` so a publish cannot ship a
 # syntactically broken executable.
 set -u
@@ -105,10 +111,25 @@ fi
 # absent from the tarball — including templates/predelete_check.sh, which CLAUDE.md instructs you
 # to run before a destructive op. Wired here in the same commit that created it, because the two
 # previous anchors this session shipped with zero callers.
-if [ -f scripts/package_coverage_check.sh ]; then
+# Anchored 2026-07-31. Until then this was the ONE subject in this file exempt from the
+# "subject present but anchor missing => FAIL" rule the eight blocks below enforce — and the
+# exemption cost something real: its source-checkout predicate tested `-d .git`, so inside a git
+# WORKTREE (where .git is a FILE) it printed SKIP and returned 0 without scanning. A worktree is
+# how a fresh CI checkout gets approximated, so the check was absent from exactly the tree used
+# to reason about CI. scripts/test_package_coverage_lanes.sh pins the predicate across all four
+# tree shapes plus a known pair.
+if [ ! -f scripts/package_coverage_check.sh ]; then
+  echo "SKIP  test_package_coverage_lanes.sh (subject scripts/package_coverage_check.sh absent)"
+elif [ -f scripts/test_package_coverage_lanes.sh ]; then
+  if ! bash scripts/test_package_coverage_lanes.sh; then
+    fail=1
+  fi
   if ! bash scripts/package_coverage_check.sh; then
     fail=1
   fi
+else
+  echo "FAIL  test_package_coverage_lanes.sh: package_coverage_check.sh present but its anchor is missing"
+  fail=1
 fi
 
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
@@ -132,21 +153,6 @@ fi
 # prevent. test_card_drift_probe.sh had shipped with ZERO callers since it was written; wiring it
 # here closes that, and the anchors are added to files[] in the same change so package mode runs
 # them too rather than reporting a deleted anchor.
-# consent-class registry floor. Its subject decides whether standing consent may skip an approval
-# prompt, so an uncalibrated instrument there hands out autonomy the operator never granted. The
-# anchor was written into tests/ with ZERO callers first — the same defect this file already
-# records twice above; wiring it here is the fix, not a note about the fix.
-if [ ! -f scripts/consent_registry_check.sh ]; then
-  echo "SKIP  test_consent_registry.sh (subject scripts/consent_registry_check.sh absent)"
-elif [ -f scripts/test_consent_registry.sh ]; then
-  if ! bash scripts/test_consent_registry.sh; then
-    fail=1
-  fi
-else
-  echo "FAIL  test_consent_registry.sh: consent_registry_check.sh present but its anchor is missing"
-  fail=1
-fi
-
 # sidecar_wait stdin plumbing. Its subject is dispatched by auto-decorrelation / steel-quench /
 # sim-conductor / AGENTS.md as the REQUIRED wait form, so a regression there silently empties every
 # cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
@@ -162,6 +168,72 @@ else
   fail=1
 fi
 
+# fh_node_check.sh gets the same treatment, and for the same reason: three adversarial rounds on it
+# produced defects that were ALL negative legs (floor N/A on a non-git install · another framework's
+# hooks counted as ours · the Mode D applicability gate silencing its own flagship case), and each
+# round's fix reverted a previous one because no anchor pinned it. Subject-present-but-anchor-absent
+# is a FAIL, not a skip — that is how an anchor gets quietly dropped.
+# Same treatment for the sidecar calibrator, same reason: its verdicts are all distinctions between
+# states that look identical from outside ("the sidecar ran" vs "the model I pinned answered",
+# "absent" vs "unmeasured"), and its lanes are hermetic stubs, so running them costs nothing.
+if [ ! -f scripts/sidecar_calibrate.sh ]; then
+  echo "SKIP  test_sidecar_calibrate_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+elif [ -f scripts/test_sidecar_calibrate_lanes.sh ]; then
+  if ! bash scripts/test_sidecar_calibrate_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_sidecar_calibrate_lanes.sh: sidecar_calibrate.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/fh_node_check.sh ]; then
+  echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
+elif [ -f scripts/test_node_check_lanes.sh ]; then
+  if ! bash scripts/test_node_check_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_node_check_lanes.sh: fh_node_check.sh present but its anchor is missing"
+  fail=1
+fi
+
+# Two guards that read the AUTHOR's own actions rather than the repo's files. Both were added
+# 2026-07-31; the pipe-verdict lane shipped in PR #209 WITHOUT this wiring, which is itself the
+# half-fix class the second guard exists to catch — found by running that guard on this repo.
+if [ ! -f scripts/sidecar_calibrate.sh ]; then
+  echo "SKIP  test_ollama_panel_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+elif [ -f scripts/test_ollama_panel_lanes.sh ]; then
+  if ! bash scripts/test_ollama_panel_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_ollama_panel_lanes.sh: sidecar_calibrate.sh present but its ollama-leg anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/pipe_verdict_guard.sh ]; then
+  echo "SKIP  test_pipe_verdict_guard_lanes.sh (subject scripts/pipe_verdict_guard.sh absent)"
+elif [ -f scripts/test_pipe_verdict_guard_lanes.sh ]; then
+  if ! bash scripts/test_pipe_verdict_guard_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_pipe_verdict_guard_lanes.sh: pipe_verdict_guard.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/halffix_propagation_scan.sh ]; then
+  echo "SKIP  test_halffix_lanes.sh (subject scripts/halffix_propagation_scan.sh absent)"
+elif [ -f scripts/test_halffix_lanes.sh ]; then
+  if ! bash scripts/test_halffix_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_halffix_lanes.sh: halffix_propagation_scan.sh present but its anchor is missing"
+  fail=1
+fi
+
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
@@ -188,10 +260,31 @@ if [ -d ".claude/rules" ]; then
   # fail=0 → SELFCHECK: PASS. The check would have silently ceased to exist while still
   # reporting a pass — the same shape count_check.sh:71 already guards against with its
   # impossible-zero rule. fh-meta always has refs; zero means the instrument broke.
-  _refs=$(grep -hoE '\`[^\` ]+\`' CLAUDE.md .claude/rules/*.md 2>/dev/null \
-    | sed 's/\`//g' \
-    | grep -E '^(knowledge|templates|scripts|docs|plugins|\.claude)/[^*{}<>$]+\.(md|sh|ya?ml|jsonc|json)$' \
-    | sort -u)
+  # EXTRACTION MOVED OFF grep (2026-07-31, measured on the first real CI run). The pipeline used to
+  # be `grep -hoE` + sed + `grep -E` over CLAUDE.md, which is Korean-heavy. On macOS (BSD grep, UTF-8
+  # locale) it returned ~50 refs; on the ubuntu runner (GNU grep, LANG unset => C locale) it returned
+  # ZERO, and the impossible-zero guard below is the only reason that surfaced as a failure instead
+  # of "no refs, all clean". Same root cause as the card-drift probe failing its positive lanes in
+  # the same run: multibyte text through locale-dependent grep.
+  # python3 reads the files as UTF-8 explicitly, so this extractor no longer has a locale at all.
+  # It is already a hard dependency of selfcheck (validate_plugins/marketplace, memory_link_check),
+  # so this adds nothing to the requirement set. The regex is the same one, transcribed.
+  _refs=$(python3 - <<'REFPY' 2>/dev/null
+import re, glob
+pat = re.compile(r'^(knowledge|templates|scripts|docs|plugins|\.claude)/[^*{}<>$]+\.(md|sh|ya?ml|jsonc|json)$')
+seen = set()
+for f in ['CLAUDE.md'] + sorted(glob.glob('.claude/rules/*.md')):
+    try:
+        text = open(f, encoding='utf-8', errors='replace').read()
+    except OSError:
+        continue
+    for tok in re.findall(r'`([^` ]+)`', text):
+        if pat.match(tok):
+            seen.add(tok)
+for p in sorted(seen):
+    print(p)
+REFPY
+)
   if [ -z "$_refs" ]; then
     echo "FAIL  ref-path: extractor produced 0 refs — the scan broke, it did not pass"
     fail=1

package/scripts/session_close_check.sh

@@ -146,7 +146,21 @@ fi
 # HONEST SCOPE: 카드 🔴/🟡 줄에서 부재-주장 키워드를 잡고, 그 줄의 이름/경로 토큰으로
 # 실물을 글롭 검색한다. 어휘가 안 겹치면 못 잡는다(무음 FN) — 앵커지 floor 가 아니다.
 # 방향은 advisory: 가역 표면에서 하드 블록은 --no-verify 를 학습시킨다(#165 HIGH-1 동일 원리).
-_ABSENCE_RE='미가동|산출물[^가-힣]*0|로그[^가-힣]*0|0건|부재|안 돌|미생성|not running|no output|zero output'
+# COLLATION-FREE BY CONSTRUCTION (2026-07-31, diagnosed ON the runner after two local hypotheses
+# were refuted). This regex used to contain the Hangul RANGE `[^가-힣]`. A multibyte range inside a
+# bracket expression is collation-dependent, and GNU grep in the C locale — the GitHub runner's
+# default — rejects it outright:  `grep: Invalid collation character`.
+# The failure mode is what makes it serious: grep writes that to stderr, exits 2, and emits NOTHING.
+# Downstream this is indistinguishable from exit 1 "no match", so the pipeline produced zero lines
+# and the probe concluded "no absence claims in the card" — CLEAN — on every input, positive and
+# negative alike. Its 7 lanes had passed 3/3 on macOS for weeks because BSD grep accepts the range.
+# Same shape as the pyyaml CI trigger caught earlier the same day: grep's ERROR status folded into
+# its NO-MATCH branch. `not found != 0`, and neither is `could not look`.
+# The replacement uses an ASCII-only class, which has no collation to be invalid. SEMANTIC SHIFT,
+# stated rather than hidden: the original meant "산출물 then non-Hangul then 0" (keep the claim
+# inside one clause); this means "산출물 then no DIGIT within 20 chars then 0". Slightly wider, and
+# the lanes below are what pin that it did not become too wide.
+_ABSENCE_RE='미가동|산출물[^0-9]{0,20}0|로그[^0-9]{0,20}0|0건|부재|안 돌|미생성|not running|no output|zero output'
 # 부정/정정 문맥 가드 — 부재-주장을 **인용하며** 정정하는 줄만 건너뛴다. 판별자는 debunk
 # 어휘 단독이 아니라 **부재-키워드가 인용부호 안에 있는가** — challenger A-1 실측: 살아있는
 # 주장 + 무관한 '정정 필요' 가 같은 줄이면 debunk-단독 가드가 진짜 경고를 무음 삼켰다(FN).

package/scripts/sidecar_calibrate.sh

@@ -0,0 +1,275 @@
+#!/usr/bin/env bash
+# sidecar_calibrate.sh — measure the cross-family sidecar panel before trusting it.
+#
+# WHY: `auto-decorrelation` and the load-bearing cross-family gate both ask "is a different-family
+# auditor reachable?" — and until now that question was answered from memory. Two measured failures
+# on 2026-07-30, one in each direction:
+#   · A marker was written claiming `cross-family unavailable this session`. Probed later in the same
+#     session, codex ran fine. Unavailability was DECLARED, never measured.
+#   · agy pinned with the slug `gemini-3.1-pro-high` answered as **Gemini 3.6 Flash** — silently, with
+#     no error. "The sidecar ran" and "the model I pinned answered" are different propositions, and
+#     only the second one licenses a claim about model-family diversity.
+# A panel you have not probed is not a panel; it is an assumption with a hostname.
+#
+# WHAT IT MEASURES, per runtime — four legs, because each catches a different lie:
+#   REACHABLE          the binary exists and runs at all
+#   PIN-OK / UNTRUSTED-PIN
+#                      a discriminating identity probe: does the answer NAME the model that was
+#                      pinned? A generic "OK" proves nothing — any model returns it. This is the only
+#                      anchor for a runtime that falls back silently.
+#   control: rejects-bogus / accepts-bogus
+#                      pin a model that cannot exist. This measures ONE thing only: whether unknown
+#                      names are validated. It does NOT mean known names are served faithfully, and
+#                      the gap between those is where the real trap lives — agy REJECTS nonsense yet
+#                      silently served Flash for `gemini-3.1-pro-high`, a slug from its own
+#                      catalogue (measured 2026-07-30). So `rejects-bogus` must never be read as
+#                      "the pin is safe": the identity probe still decides. `accepts-bogus` is the
+#                      stronger warning — there, the identity probe is the ONLY evidence at all.
+#   VERDICT-OK / VERDICT-UNPARSEABLE
+#                      ask for one bare token. A runtime that answers with agentic prose cannot carry
+#                      a machine-read verdict. Measured for agy at 1.0.14 (2026-07-04) and NOT
+#                      inherited here: the version has moved, and this file re-measures rather than
+#                      quoting. Fitness is a per-run measurement, not a property.
+#
+# Detector, never a gate: ALWAYS exits 0. It reports; the caller decides. A calibration run that
+# could block would make callers stop running it, which is the failure this exists to prevent.
+#
+# Cost: real API calls (3 short probes per runtime). Use --only to scope. `--stub-model` exists for
+# the lane harness so it can drive stub CLIs without touching a real catalogue.
+#
+# Usage:  bash scripts/sidecar_calibrate.sh [--only codex|agy] [--stub-model NAME] [--quiet]
+# Output: one block per runtime, then a PANEL line — the line a marker's `crossfamily:` leg quotes.
+
+set -uo pipefail
+
+ONLY=""; STUB_MODEL=""; QUIET=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --only) ONLY="${2:-}"; shift 2 ;;
+    --stub-model) STUB_MODEL="${2:-}"; shift 2 ;;
+    --quiet) QUIET=1; shift ;;
+    *) shift ;;
+  esac
+done
+
+TIMEOUT_BIN=""
+command -v timeout >/dev/null 2>&1 && TIMEOUT_BIN="timeout"
+command -v gtimeout >/dev/null 2>&1 && TIMEOUT_BIN="gtimeout"
+# No coreutils timeout on stock macOS. perl's alarm is the portable watchdog; if perl is missing too,
+# run WITHOUT a deadline rather than skipping the probe — a missing watchdog must never become a
+# silently skipped measurement reported as absence (the same rule fh_session_load.sh applies).
+_run() {
+  local secs="$1"; shift
+  if [ -n "$TIMEOUT_BIN" ]; then "$TIMEOUT_BIN" "$secs" "$@"
+  elif command -v perl >/dev/null 2>&1; then perl -e 'alarm shift @ARGV; exec @ARGV' "$secs" "$@"
+  else "$@"; fi
+}
+
+# _answer — reduce a runtime's stdout to THE MODEL'S ANSWER.
+# Measured on the first real run (2026-07-30): matching against whole stdout is unsound, because a
+# real CLI prints a session banner that REPEATS the pinned model back (`codex exec` emits its
+# version, workdir and model config before the reply). Under a whole-stdout match, a runtime that
+# merely echoes its own configuration passes the identity probe — the transport layer supplying the
+# very evidence the probe exists to obtain from the model. So: take the last non-empty line, skipping
+# trailing telemetry (`tokens used`, bare numbers, rule lines).
+# RESIDUAL, named: this is a heuristic on line position. A runtime that prints its answer and then
+# unrecognised trailing chatter would be mis-read. It is checked by the banner-echo lane, not proven
+# in general; a structured output mode (JSON) would replace the heuristic and none is used here yet.
+_answer() {
+  awk 'BEGIN{last=""}
+       {line=$0
+        gsub(/\r/,"",line)
+        gsub(/^[[:space:]]+|[[:space:]]+$/,"",line)
+        if (line=="") next
+        if (line ~ /^[-=_]{3,}$/) next
+        if (tolower(line) ~ /^tokens? used/) next
+        if (line ~ /^[0-9,.]+$/) next
+        last=line}
+       END{print last}'
+}
+
+IDENTITY_PROMPT="Answer with one line only: your exact model name and version."
+VERDICT_PROMPT="Reply with exactly one word, PASS or FAIL, and nothing else. The word is PASS."
+BOGUS_MODEL="zzz-nonexistent-model-9.9"
+
+PANEL=""
+
+# build_cmd <runtime> <model> <prompt> — fills CMD as an argv array.
+# NOT a shell function passed to the watchdog: `timeout`/`gtimeout` exec a BINARY and cannot see
+# shell functions, so an earlier revision fed them a function name and every probe came back as the
+# runtime failing to run (caught by lane 3/4b/5b, not by reading).
+build_cmd() {
+  case "$1" in
+    codex) CMD=(codex exec -m "$2" -c model_reasoning_effort=high --skip-git-repo-check "$3") ;;
+    agy)   CMD=(agy -p "$3" --model "$2" --print-timeout 170s) ;;
+    *)     CMD=("$1" "$3") ;;
+  esac
+}
+
+# probe_runtime <name> <real-model-pin>
+probe_runtime() {
+  local rt="$1" model="$2"
+  [ -n "$ONLY" ] && [ "$ONLY" != "$rt" ] && return 0
+  [ -n "$STUB_MODEL" ] && model="$STUB_MODEL"
+
+  if ! command -v "$rt" >/dev/null 2>&1; then
+    printf '%-6s ABSENT — not installed on this machine (absence measured, not assumed)\n' "$rt"
+    return 0
+  fi
+
+  local id_out pin_state ctl_out ctl_state v_out v_state
+  build_cmd "$rt" "$model" "$IDENTITY_PROMPT"
+  id_out="$(_run 200 "${CMD[@]}" 2>&1 | _answer)"
+
+  # Discriminating check — the answer must be the MODEL's self-report naming the model that was
+  # pinned. What counts as "naming it" is the VERSION token, not every token of the pin slug:
+  # vendors answer with a product name (`gpt-5.6-sol` → "GPT-5.6 Codex"), and demanding the suffix
+  # made this report UNTRUSTED-PIN for a pin that had actually held (measured 2026-07-30). The
+  # version is also exactly where the real failures differ — 3.1 asked, 3.6 answered. If a pin
+  # carries no version token at all, fall back to requiring the name words, since then there is
+  # nothing sharper to test.
+  local ver name_words hit=0
+  ver="$(printf '%s' "$model" | grep -oE '[0-9]+\.[0-9]+' | head -1)"
+  name_words="$(printf '%s' "$model" | tr 'A-Z' 'a-z' | sed -E 's/[^a-z]+/ /g' \
+        | tr ' ' '\n' | grep -E '^[a-z]{3,}$' \
+        | grep -vE '^(high|low|medium|thinking|the|exec)$' | head -1)"
+  if [ -n "$id_out" ]; then
+    if [ -n "$ver" ]; then
+      printf '%s' "$id_out" | grep -qF "$ver" && hit=1
+    elif [ -n "$name_words" ]; then
+      printf '%s' "$id_out" | tr 'A-Z' 'a-z' | grep -qF "$name_words" && hit=1
+    fi
+  fi
+  if [ "$hit" -eq 1 ]; then pin_state="PIN-OK"; else pin_state="UNTRUSTED-PIN"; fi
+
+  build_cmd "$rt" "$BOGUS_MODEL" "$IDENTITY_PROMPT"
+  ctl_out="$(_run 120 "${CMD[@]}" 2>&1)"
+  if [ $? -ne 0 ] || printf '%s' "$ctl_out" | grep -qiE 'not supported|invalid|unknown model|error'; then
+    ctl_state="rejects-bogus"
+  else
+    ctl_state="accepts-bogus"
+  fi
+
+  build_cmd "$rt" "$model" "$VERDICT_PROMPT"
+  v_out="$(_run 200 "${CMD[@]}" 2>&1 | _answer)"
+  # Parseable = a bare verdict token is recoverable from a short answer. Prose that merely CONTAINS
+  # the word does not qualify: a verdict channel must be readable without a human deciding what the
+  # runtime meant.
+  local v_compact
+  v_compact="$(printf '%s' "$v_out" | tr -s '[:space:]' ' ' | sed 's/^ *//; s/ *$//')"
+  if [ "${#v_compact}" -le 12 ] && printf '%s' "$v_compact" | grep -qiE '^(pass|fail)[.!]?$'; then
+    v_state="VERDICT-OK"
+  else
+    v_state="VERDICT-UNPARSEABLE"
+  fi
+
+  printf '%-6s REACHABLE · %s · control: %s · %s\n' "$rt" "$pin_state" "$ctl_state" "$v_state"
+  [ -z "$QUIET" ] && printf '       pinned: %s\n       identity said: %s\n' "$model" "$(printf '%s' "$id_out" | cut -c1-100)"
+  if [ "$ctl_state" = "accepts-bogus" ]; then
+    printf '       ⚠️  this runtime does not validate the pin at all, so the identity probe is the ONLY\n'
+    printf '           evidence that the intended model answered — a clean run proves nothing here.\n'
+  elif [ "$pin_state" = "UNTRUSTED-PIN" ]; then
+    printf '       ⚠️  it rejects UNKNOWN names, which says nothing about serving KNOWN ones faithfully.\n'
+    printf '           The identity probe disagreed with the pin — treat this runtime as substituting.\n'
+  fi
+  # Only a runtime whose pin is trustworthy counts toward the panel. A reachable runtime answering as
+  # some other model contributes no family diversity, which is the entire point of the panel.
+  [ "$pin_state" = "PIN-OK" ] && PANEL="${PANEL:+$PANEL, }$rt"
+  return 0
+}
+
+probe_runtime codex "gpt-5.6-sol"
+probe_runtime agy   "Gemini 3.1 Pro (High)"
+
+# ── Local OpenAI-compatible panel (Ollama) — a DIFFERENT anchor, on purpose. ──────────────────
+# One host serves several model FAMILIES (measured 2026-07-31: an OpenAI-lineage open-weight, a
+# Qwen, a Gemma, a Mistral on one endpoint), so the panel's unit here is the model, not the binary.
+# Everything is local, so nothing leaves the machine — this is the only panel member a residency-
+# constrained session may use on company-adjacent work.
+#
+# WHY THE IDENTITY PROBE IS REPLACED, NOT REUSED — the self-report anchor above is INVALID for this
+# class. Measured: `gpt-oss:20b` asked which model it is answered "The underlying model is GPT-4
+# (likely)". Open-weight models do not reliably know their own name, so a self-report anchor would
+# mark every one of them UNTRUSTED-PIN and drop a genuinely exact pin from the panel. Applying an
+# instrument that cannot separate a known-positive from a known-negative on this target is the
+# calibration failure this whole file exists to prevent — so the anchor moves to the SERVER'S
+# response envelope, which reports the model actually loaded. That is a server-side fact rather
+# than a model's claim, i.e. strictly stronger than what codex/agy expose through their CLIs.
+#
+# HOST IS NEVER HARDCODED. A LAN/Tailscale address is an internal hostname, and this file is
+# public-tracked; §Company residency keeps those out of committed content. Default is loopback;
+# point FH_OLLAMA_HOST at a remote node from a local, gitignored place.
+OLLAMA_HOST_URL="${FH_OLLAMA_HOST:-http://127.0.0.1:11434}"
+# Measured floor, not a guess: at num_predict=64 a reasoning model spent the ENTIRE budget in its
+# `thinking` field (780 chars) and returned an EMPTY response — which reads identically to "cannot
+# carry a verdict". At 512 the same model answered `PASS`. Budget starvation and incapacity are
+# different findings and must not be reported as one.
+OLLAMA_NUM_PREDICT="${FH_OLLAMA_NUM_PREDICT:-512}"
+
+probe_ollama() {
+  command -v curl >/dev/null 2>&1 || { echo "ollama ABSENT — curl missing (absence measured)"; return 0; }
+  curl -sf --max-time 10 "$OLLAMA_HOST_URL/api/version" >/dev/null 2>&1 || {
+    printf 'ollama ABSENT — no server at the configured host (absence measured, not assumed)\n'
+    printf '       set FH_OLLAMA_HOST to probe a remote node; default is loopback\n'
+    return 0
+  }
+
+  local models="${FH_OLLAMA_MODELS:-}"
+  if [ -z "$models" ]; then
+    models=$(curl -sf --max-time 15 "$OLLAMA_HOST_URL/api/tags" 2>/dev/null \
+      | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: raise SystemExit
+print(",".join(m["name"] for m in d.get("models",[])[:6]))' 2>/dev/null)
+  fi
+  [ -n "$models" ] || { echo "ollama REACHABLE but no models listed"; return 0; }
+
+  # Control runs ONCE per host, not per model: it is a property of the server, and repeating it per
+  # model would just multiply the cost of a fact that cannot differ.
+  local ctl ctl_state
+  ctl=$(curl -s --max-time 20 "$OLLAMA_HOST_URL/api/generate" \
+        -d '{"model":"fh-calib-nonexistent:99b","prompt":"hi","stream":false}' 2>&1)
+  if printf '%s' "$ctl" | grep -qiE '"error"|not found'; then ctl_state="rejects-bogus"; else ctl_state="accepts-bogus"; fi
+
+  local IFS=,
+  for m in $models; do
+    [ -n "$m" ] || continue
+    local body out env_model resp compact pin v
+    body=$(python3 -c 'import json,sys; print(json.dumps({"model":sys.argv[1],"prompt":sys.argv[2],"stream":False,"options":{"num_predict":int(sys.argv[3]),"temperature":0}}))' \
+           "$m" "$VERDICT_PROMPT" "$OLLAMA_NUM_PREDICT")
+    out=$(curl -sf --max-time 240 "$OLLAMA_HOST_URL/api/generate" -d "$body" 2>/dev/null)
+    if [ -z "$out" ]; then
+      printf 'ollama %-22s UNREACHABLE-THIS-RUN (measured, not inferred)\n' "$m"; continue
+    fi
+    env_model=$(printf '%s' "$out" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("model",""))' 2>/dev/null)
+    resp=$(printf '%s' "$out" | python3 -c 'import json,sys; print((json.load(sys.stdin).get("response") or "").strip())' 2>/dev/null)
+    compact=$(printf '%s' "$resp" | tr -s '[:space:]' ' ' | sed 's/^ *//; s/ *$//')
+    if [ "$env_model" = "$m" ]; then pin="PIN-OK(envelope)"; else pin="UNTRUSTED-PIN"; fi
+    if [ "${#compact}" -le 12 ] && printf '%s' "$compact" | grep -qiE '^(pass|fail)[.!]?$'; then v="VERDICT-OK"; else v="VERDICT-UNPARSEABLE"; fi
+    printf 'ollama %-22s REACHABLE · %s · control: %s · %s\n' "$m" "$pin" "$ctl_state" "$v"
+    [ -z "$QUIET" ] && printf '       answered: %s\n' "$(printf '%s' "$compact" | cut -c1-60)"
+    if [ "$v" = "VERDICT-UNPARSEABLE" ] && [ -z "$compact" ]; then
+      printf '       ⚠️  EMPTY answer. Before recording this as "cannot carry a verdict", re-run with a\n'
+      printf '           larger FH_OLLAMA_NUM_PREDICT — a reasoning model can spend the whole budget\n'
+      printf '           thinking and return nothing, which looks identical from out here.\n'
+    fi
+    [ "$pin" = "PIN-OK(envelope)" ] && [ "$v" = "VERDICT-OK" ] && PANEL="${PANEL:+$PANEL, }ollama:$m"
+  done
+}
+# `--stub-model` means the caller is the hermetic CLI lane harness, which drives stub BINARIES and
+# asserts on an empty panel. This leg talks to a SERVER, so on a developer machine with a local
+# Ollama running it would populate the panel and break those lanes — which is exactly what happened
+# when this was first wired (test_sidecar_calibrate_lanes lane6, "empty panel not stated", caught by
+# the existing suite rather than by review). Skipping under --stub-model keeps each harness hermetic
+# in its own way; this leg's own lanes drive a stub SERVER via FH_OLLAMA_HOST instead.
+if [ -z "$STUB_MODEL" ] && { [ -z "$ONLY" ] || [ "$ONLY" = "ollama" ]; }; then
+  probe_ollama
+fi
+
+if [ -n "$PANEL" ]; then
+  echo "PANEL: $PANEL — usable different-family auditor(s), pin verified this run"
+else
+  echo "PANEL: none — no runtime passed the identity probe on this machine, this run"
+  echo "       State this, do not infer it: a marker's crossfamily leg may say 'none' but never stay silent."
+fi
+exit 0