@chrono-meta/fh-gate 1.4.77 → 1.4.79

package/scripts/test_package_coverage_lanes.sh

@@ -0,0 +1,250 @@
+#!/usr/bin/env bash
+# test_package_coverage_lanes.sh — regression anchor for scripts/package_coverage_check.sh.
+#
+# WHY THIS EXISTS (measured 2026-07-31):
+#   package_coverage_check.sh gated itself on `[ ! -d .git ]`. In a git WORKTREE `.git` is a FILE
+#   (a gitdir pointer), so every worktree fell into the "installed package" branch and the check
+#   printed `SKIP` and exited 0 without scanning anything. That is a FALSE CLEAN of the worst shape:
+#   a worktree is the standard way to approximate a fresh CI checkout, so the surface used to argue
+#   "CI would be green" was precisely the surface on which this check silently did not run.
+#   It was found by using the instrument, then asking whether the instrument had run at all —
+#   CLAUDE.md §Instrument-Calibration, applied to FH's own tooling.
+#
+#   Second reason: selfcheck.sh enforces "subject present but anchor missing => FAIL" for eight
+#   other scripts, and package_coverage_check.sh was the one subject exempted from its own rule.
+#   An unanchored checker is one revert away from being decoration.
+#
+# The lanes pin, in order: the source-checkout predicate across all four tree shapes (worktree /
+# ordinary checkout / package mode / no manifest), and a KNOWN PAIR — a tree that must FAIL and an
+# otherwise identical tree that must PASS. A predicate that cannot separate that pair is not
+# measuring coverage, it is emitting a verdict.
+#
+# Usage:  bash scripts/test_package_coverage_lanes.sh
+# Exit:   0 = no lane FAILED. 1 = a regression.
+#         NOT "all lanes passed": a lane whose precondition is absent (no git) is counted as
+#         UNCALIBRATED and printed in the summary, and exit stays 0. Stated precisely because the
+#         earlier wording promised more than the code delivers, and an exit contract that overstates
+#         is exactly the false-clean this suite exists to prevent (round-3 review, LOW).
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SUBJECT="$REPO_ROOT/scripts/package_coverage_check.sh"
+[ -f "$SUBJECT" ] || { echo "FAIL: $SUBJECT not found"; exit 1; }
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+pass=0; fail=0; skipped=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+# A skip is COUNTED and reported. An uncounted skip is how "could not run" becomes indistinguishable
+# from "ran and passed" in the summary line — measured on this very suite in review round 2, where a
+# broken git produced "7 passed, 0 failed" and exit 0 while the real-worktree claim went untested.
+# Degrade direction per CLAUDE.md §Instrument-Calibration: label it UNCALIBRATED, never a bare pass.
+skip() { printf '  ⏭  UNCALIBRATED — %s\n' "$1"; skipped=$((skipped+1)); }
+
+# Build a hermetic fake source tree. `git_shape` is one of: file | dir | none.
+# `ship_the_doc` decides whether the referenced path is inside files[] (the known pair).
+make_tree() { # make_tree <dir> <git_shape> <cover_target:yes|no> [omit_manifest]
+  local d="$1" git_shape="$2" cover="$3" omit="${4:-}"
+  mkdir -p "$d/scripts" "$d/docs"
+  cp "$SUBJECT" "$d/scripts/package_coverage_check.sh"
+
+  # A shipped document that points at scripts/helper.sh, and that file really exists here.
+  # "exists here but absent from files[]" is exactly the defect class this check owns.
+  printf 'Run `scripts/helper.sh` before the gate.\n' > "$d/docs/guide.md"
+  printf '#!/usr/bin/env bash\necho helper\n' > "$d/scripts/helper.sh"
+
+  if [ "$cover" = "yes" ]; then
+    printf '{"files":["docs/guide.md","scripts/helper.sh"]}\n' > "$d/package.json"
+  else
+    printf '{"files":["docs/guide.md"]}\n' > "$d/package.json"
+  fi
+  [ -n "$omit" ] && rm -f "$d/package.json"
+
+  case "$git_shape" in
+    dir)  mkdir -p "$d/.git" ;;
+    file) printf 'gitdir: /somewhere/else/.git/worktrees/x\n' > "$d/.git" ;;
+    none) : ;;
+  esac
+}
+
+run_tree() { bash "$1/scripts/package_coverage_check.sh" 2>&1; }
+rc_tree()  { bash "$1/scripts/package_coverage_check.sh" >/dev/null 2>&1; echo $?; }
+
+# Assert a POSITIVE outcome, never merely the absence of the SKIP line. Cross-family review caught
+# the first draft here: it checked only that `SKIP  package-coverage` was missing, so a checker that
+# exited 1 on every worktree — the opposite defect, equally broken — would have passed the lane that
+# exists to prove the worktree path works. "Did not say the wrong thing" is not "did the right
+# thing"; a lane phrased as a negative can only ever fail one way.
+ran_clean() { # ran_clean <dir> -> 0 iff the check actually ran AND reported a clean scan
+  local d="$1" o rc
+  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
+  [ "$rc" -eq 0 ] && printf '%s' "$o" | grep -q 'PASS  package-coverage' \
+    && ! printf '%s' "$o" | grep -q 'SKIP  package-coverage'
+}
+caught_defect() { # caught_defect <dir> -> 0 iff the check FOUND the planted omission
+  local d="$1" o rc
+  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
+  [ "$rc" -eq 1 ] && printf '%s' "$o" | grep -q 'scripts/helper.sh'
+}
+# A CLEAN LANE ALONE PROVES NOTHING ABOUT THE WORKTREE PATH. Cross-family review round 2 demonstrated
+# this by EXECUTION: it replaced the subject with a mutant that printed `PASS  package-coverage`
+# whenever `.git` was a file, without scanning anything — and all eight lanes passed, suite exit 0.
+# The lanes proved "returned a PASS-shaped string", not "ran the coverage logic". The known-positive
+# fixtures existed but only under the `.git`-is-a-DIRECTORY shape, so nothing exercised detection in
+# the very shape the fix was about. Every worktree lane below is now a PAIR: the same tree must go
+# clean->PASS and planted-omission->FAIL. A bypassing mutant fails the second half by construction.
+wt_pair() { # wt_pair <label> <dir> <git_shape>
+  local label="$1" d="$2" shape="$3"
+  make_tree "$d" "$shape" yes
+  if ! ran_clean "$d"; then
+    bad "$label — clean leg: did not run to a PASS ($(run_tree "$d" | head -1))"; return
+  fi
+  make_tree "$d" "$shape" no        # identical tree, files[] no longer covers the referenced path
+  if ! caught_defect "$d"; then
+    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing"; return
+  fi
+  ok "$label"
+}
+
+# ── L1 · THE REGRESSION ANCHOR ───────────────────────────────────────────────────────
+wt_pair "L1 worktree (.git is a FILE): scans for real — clean PASSes, planted omission FAILs" \
+        "$TMP/l1" file
+
+# ── L1-b · a REAL git worktree, not a hand-written pointer ───────────────────────────
+# The synthetic fixture writes a gitdir pointer whose target does not exist, so it proves the
+# predicate accepts "a file named .git" — not that it accepts a genuine worktree. This lane builds
+# an actual repo and an actual `git worktree add`.
+# ISOLATION (review round 2, LOW): the git commands run with signing off, hooks disabled, and both
+# config files pointed at /dev/null, so a configured signing prompt or a global hook cannot hang the
+# suite or write outside $TMP. GIT_TERMINAL_PROMPT=0 turns any credential prompt into an error.
+# SKIP ACCOUNTING (review round 2, MED — confirmed by execution): the first draft printed a skip and
+# incremented nothing, so a machine with a broken git reported "7 passed, 0 failed" and exited 0 —
+# a lane that cannot run must not read as a lane that passed. Now: git ABSENT is a legitimate skip
+# but is counted and surfaced as UNCALIBRATED in the summary; git PRESENT but setup failing is a
+# FAILURE, because there the claim was testable and the test did not run.
+GIT_ISO=(-c commit.gpgsign=false -c core.hooksPath=/dev/null -c user.email=a@b -c user.name=t)
+# CONFIG isolation is not REPOSITORY-ROUTING isolation. Round-3 review reproduced this on Apple Git
+# 2.50.1: with GIT_DIR pointing at an unrelated repo, this suite reported "8 passed, 0 failed" while
+# that external repo's commit count went 0 -> 1. So the lane could pass by exercising — and WRITING
+# TO — a repository that is not its fixture. A test that mutates state outside its own $TMP is not
+# a test, and the green summary is the worst part: it reports calibration it did not perform.
+# Every routing variable is cleared, and the resolved git-dir is then ASSERTED to live under $TMP
+# rather than assumed — the unset list is a denylist and a denylist is never proof; the assertion is.
+# SECOND LEAK CHANNEL, same class, found by the reviewer running the attack rather than reading for
+# it: GIT_CONFIG_PARAMETERS injects config that GIT_CONFIG_GLOBAL/SYSTEM=/dev/null does NOT suppress.
+# Reproduced here: with `init.templateDir` pointed at a directory whose `refs` is a symlink to an
+# external dir, `git init` populated that external dir — and the suite still printed
+# "8 passed, 0 failed". The git-dir assertion cannot see this one, because the git-dir DOES resolve
+# inside $TMP; the escape is through the template, not the routing. So the assertion is necessary and
+# not sufficient, and the config-injection channels have to be closed by name.
+# `--template=` with an empty directory is the belt to that braces: even if a config channel is
+# missed, init has an explicit, empty template to copy from.
+unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_COMMON_DIR GIT_OBJECT_DIRECTORY \
+      GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_NAMESPACE GIT_CEILING_DIRECTORIES \
+      GIT_CONFIG_PARAMETERS GIT_CONFIG_COUNT GIT_TEMPLATE_DIR
+export GIT_TERMINAL_PROMPT=0 GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
+if ! command -v git >/dev/null 2>&1; then
+  skip "L1-b real git worktree (git not installed — the on-disk layout under test cannot exist here)"
+else
+  mkdir -p "$TMP/realrepo"
+  # BOTH SIDES NORMALIZED. First version compared the raw `mktemp -d` path against
+  # `rev-parse --absolute-git-dir`, and on macOS that fails for a clean tree: mktemp hands back
+  # /var/folders/... while git resolves symlinks and returns /private/var/folders/... . The
+  # assertion then rejected its OWN correct fixture — a false positive on a safety check, which is
+  # the same defect class as a false negative and would have trained the next reader to delete it.
+  # `pwd -P` resolves the $TMP side; the other side is already physical because
+  # `rev-parse --absolute-git-dir` resolves symlinks itself. The raw "$TMP"/* branch is kept as a
+  # belt for platforms where it does not. (An earlier comment said "both sides normalized via
+  # pwd -P" — only one side uses it.)
+  _TMP_REAL="$(cd "$TMP" && pwd -P)"
+  # NAME THE ORDER HONESTLY: `git init` runs FIRST and this assertion runs immediately after, so it
+  # gates every subsequent write (commit, worktree add) — not the init itself. init is bounded
+  # separately by the unset list plus the explicit empty --template. An earlier comment claimed
+  # "before anything is written", which overstated it by one step.
+  _gitdir_ok() { # the fixture repo must resolve INSIDE $TMP before anything FURTHER is written
+    local r; r=$(git "${GIT_ISO[@]}" -C "$TMP/realrepo" rev-parse --absolute-git-dir 2>/dev/null) || return 1
+    case "$r" in
+      "$_TMP_REAL"/*|"$TMP"/*) return 0 ;;
+      *) echo "  ↳ git-dir resolved OUTSIDE the fixture: $r" >&2; return 1 ;;
+    esac
+  }
+  mkdir -p "$TMP/emptytpl"
+  if git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . >/dev/null 2>&1 \
+     && _gitdir_ok \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init >/dev/null 2>&1 \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" >/dev/null 2>&1 \
+     && [ -f "$TMP/realwt/.git" ]; then
+    wt_pair "L1-b real \`git worktree add\` (.git is a genuine gitdir pointer): scans for real" \
+            "$TMP/realwt" none          # the REAL .git file is already in place; do not overwrite it
+  else
+    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested"
+  fi
+fi
+
+# ── L2 · ordinary checkout keeps working ─────────────────────────────────────────────
+wt_pair "L2 ordinary checkout (.git is a DIR): scans for real — both legs" "$TMP/l2" dir
+
+# ── L3 · package mode must STILL skip ────────────────────────────────────────────────
+# The widening from -d to -e must not cost the legitimate skip. An installed npm package has no
+# .git of either kind; making it fail there would fire on every consumer running `npm test`.
+make_tree "$TMP/l3" none yes
+out=$(run_tree "$TMP/l3"); rc=$(rc_tree "$TMP/l3")
+if printf '%s' "$out" | grep -q 'SKIP  package-coverage' && [ "$rc" -eq 0 ]; then
+  ok "L3 package mode (no .git): still skips, exit 0"
+else
+  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc / $(printf '%s' "$out" | head -1)"
+fi
+
+# ── L4 · a checkout with no manifest is UNMEASURED, not clean ────────────────────────
+# EXPECTATION CORRECTED by cross-family review, 2026-07-31. The first draft asserted SKIP+0 here
+# and would have ANCHORED a fail-open: inside a checkout, a missing package.json means the shipped
+# file list cannot be read, which is "cannot measure", not "nothing to measure". An anchor that
+# pins the wrong direction is worse than no anchor — it makes the hole look deliberate.
+make_tree "$TMP/l4" dir yes omit
+out=$(run_tree "$TMP/l4"); rc=$(rc_tree "$TMP/l4")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'UNMEASURED, not clean'; then
+  ok "L4 .git present but no package.json: FAILS as unmeasured, not a clean skip"
+else
+  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc / $(printf '%s' "$out" | head -1)"
+fi
+
+# ── L5/L6 · KNOWN PAIR ───────────────────────────────────────────────────────────────
+# Same tree twice; the ONLY difference is whether files[] covers the referenced path.
+# L5 known-POSITIVE: referenced, exists, not shipped -> must FAIL.
+make_tree "$TMP/l5" dir no
+out=$(run_tree "$TMP/l5"); rc=$(rc_tree "$TMP/l5")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'scripts/helper.sh'; then
+  ok "L5 known-positive (referenced ∧ exists ∧ ¬shipped): FAIL, names the path"
+else
+  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc"
+fi
+
+# L6 known-NEGATIVE: identical, but the path is in files[] -> must PASS.
+make_tree "$TMP/l6" dir yes
+out=$(run_tree "$TMP/l6"); rc=$(rc_tree "$TMP/l6")
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q 'PASS  package-coverage'; then
+  ok "L6 known-negative (same tree, path shipped): PASS"
+else
+  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc"
+fi
+
+# ── L7 · the impossible-zero guard is not reachable by an empty files[] ──────────────
+# A manifest with no shipped docs must report the extractor as broken, not print a pass.
+mkdir -p "$TMP/l7/scripts"; cp "$SUBJECT" "$TMP/l7/scripts/"; mkdir -p "$TMP/l7/.git"
+printf '{"files":[]}\n' > "$TMP/l7/package.json"
+out=$(run_tree "$TMP/l7"); rc=$(rc_tree "$TMP/l7")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'the check broke, it did not pass'; then
+  ok "L7 zero shipped docs: reported as broken extractor, not as a pass"
+else
+  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc"
+fi
+
+echo
+if [ "$skipped" -gt 0 ]; then
+  echo "package-coverage lanes: ${pass} passed, ${fail} failed, ${skipped} UNCALIBRATED (not verified here)"
+else
+  echo "package-coverage lanes: ${pass} passed, ${fail} failed"
+fi
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_pipe_verdict_guard_lanes.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# test_pipe_verdict_guard_lanes.sh — known pairs for scripts/pipe_verdict_guard.sh
+#
+# WHY THIS FILE EXISTS, AND WHY IT IS WRITTEN BEFORE THE DETECTOR
+#   2026-07-30 harvest #1: across a 5-round challenger run, three rounds contained a fix that
+#   reverted an earlier fix — and the rounds that wrote the lane BEFORE touching the code had
+#   zero such regressions. Convergence came from the ORDER, not the patch. So: lanes first.
+#
+# WHAT IS BEING GUARDED
+#   Reading a verdict from `$?`/`${PIPESTATUS[…]}` after a pipeline, which yields the status of
+#   the LAST stage. When the last stage is a display filter (`tail`, `head`, `cat`), that status
+#   is the filter's — a FAILING gate reads as exit 0. Degrade direction: toward PASS.
+#
+#   R1 (deterministic, zero-FP): `${PIPESTATUS[...]}` under zsh. zsh spells it `$pipestatus[1]`
+#       and 1-indexes it; the bash array expands to the EMPTY STRING. Any verdict read from it is
+#       not merely wrong, it is absent. Measured 6× in this project's ad-hoc invocations.
+#   R2 (heuristic, narrowed): pipeline whose FINAL stage is a display filter, followed by a read
+#       of `$?`. Narrowed to display filters on purpose — see the FP lanes below.
+#
+# WHY A REPO-FILE LINTER IS THE WRONG SURFACE (measured 2026-07-31)
+#   The prescription on the session card was "add an S6 class to degrade_direction_scan.sh".
+#   Hand-verifying every `pipe + $?` hit in this repo's scripts returned 7 hits, 7 of them correct
+#   (the last stage WAS the command under test in all 7). True positives in shipped files: 0.
+#   All 6 measured recurrences were in interactively-composed commands, which no file scanner
+#   reads. Shipping S6 would have been a 0-true-positive probe — exactly the failure S5's own
+#   comment records ("100% FP trains dismissal of the one hit that will matter").
+
+set -u
+G="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/pipe_verdict_guard.sh"
+pass=0; fail=0
+
+# expect <label> <expected: HIT|CLEAN> <command-string>
+expect() {
+  local label="$1" want="$2" cmd="$3" out got
+  out=$(printf '%s' "$cmd" | bash "$G" --stdin-raw 2>&1)
+  if printf '%s' "$out" | grep -q 'PIPE-VERDICT'; then got=HIT; else got=CLEAN; fi
+  if [ "$got" = "$want" ]; then
+    printf '  ✅ %-52s %s (expected %s)\n' "$label" "$got" "$want"; pass=$((pass+1))
+  else
+    printf '  ❌ %-52s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1))
+    printf '     cmd: %s\n     out: %s\n' "$cmd" "$out"
+  fi
+}
+
+echo "[pipe-verdict-guard] known pairs"
+echo "-- R1: PIPESTATUS under zsh (deterministic) --"
+# The exact shape emitted 6× in this project, including twice on 2026-07-31.
+expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
+expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'
+expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'
+# zsh's own spelling is correct here and must never be flagged.
+expect "R1 zsh spelling is CLEAN"         CLEAN 'a | b; rc=$pipestatus[1]'
+
+echo "-- R2: display-filter final stage, then \$? --"
+expect "R2 tail then \$?"                  HIT   'bash gate.sh | tail -20; echo "exit=$?"'
+expect "R2 head then \$?"                  HIT   'make test | head -40; rc=$?'
+expect "R2 cat then \$?"                   HIT   'run.sh | cat; if [ $? -ne 0 ]; then echo bad; fi'
+
+echo "-- R2 false-positive lanes: the 7 shapes this repo actually ships --"
+# Every one of these was hand-verified on 2026-07-31 as CORRECT: the final stage IS the command
+# whose status is wanted. A detector that flags these is noise, and noise trains dismissal.
+expect "FP grep -q is the test itself"    CLEAN 'echo "$pos" | grep -qE "$re"; rc=$?'
+expect "FP grep compiles the regex"       CLEAN "printf '' | grep -E \"\$re\" >/dev/null 2>&1; rc=\$?"
+# Path deliberately generic: naming a real unshipped script here would make this lane a shipped
+# doc pointing at a file the package omits (caught by selfcheck's package-coverage rule).
+expect "FP last stage is the script"      CLEAN "printf '%s' \"\$S\" | bash some-filter.sh - ; echo EXIT:\$?"
+expect "FP command substitution assign"   CLEAN 'out=$(printf x | ( cd "$r" && bash hook 2>&1 )); rc=$?'
+expect "FP no pipe at all"                CLEAN 'bash gate.sh; echo "exit=$?"'
+expect "FP || fallback, not a pipe"       CLEAN 'stat -c %Y f || stat -f %m f || echo 0'
+expect "FP pipefail set, explicit"        CLEAN 'set -o pipefail; bash gate.sh | tail -5; rc=$?'
+
+echo "-- adversarial (found by the Axis-2 pass on this guard, 2026-07-31) --"
+# A: grep is line-oriented, so `.*` never spanned a newline and every MULTI-LINE command missed.
+#    This mattered more than the single-line case: the invocations that actually recur in this
+#    project are multi-line. Caught by attacking the guard, not by the happy-path lanes.
+expect "A multi-line pipe then \$?"        HIT   'bash gate.sh | tail -20
+echo "exit=$?"'
+expect "A multi-line, three statements"   HIT   'cd /r
+make test | head -40
+rc=$?'
+expect "A multi-line stays CLEAN if legit" CLEAN 'cd /r
+echo x | grep -q y
+rc=$?'
+# B: zsh accepts `$PIPESTATUS[0]` without braces; the brace-anchored regex missed it.
+expect "B PIPESTATUS without braces"      HIT   'a | b; rc=$PIPESTATUS[0]'
+expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'
+
+echo "-- opt-out --"
+expect "noqa suppresses"                  CLEAN 'bash g.sh | tail; rc=$?  # noqa: pipe-verdict'
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[pipe-verdict-guard] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[pipe-verdict-guard] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_sidecar_calibrate_lanes.sh

@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+# test_sidecar_calibrate_lanes.sh — regression lanes for scripts/sidecar_calibrate.sh.
+#
+# WHY LANES FIRST: the calibrator's whole job is to distinguish states that LOOK the same from the
+# outside — "the sidecar ran" vs "the model I asked for answered", "absent" vs "unmeasured". Those
+# are negative legs, and negative legs are what three adversarial rounds on the node check showed
+# nobody tests until a lane forces it. Each lane below drives the calibrator with a STUB CLI whose
+# behaviour is known, so the calibrator's verdict can be checked against ground truth.
+#
+# No network, no API spend: every sidecar binary is replaced by a stub on PATH.
+#
+# Usage:  bash scripts/test_sidecar_calibrate_lanes.sh
+# Exit:   0 = all lanes pass; 1 = at least one failed.
+
+set -uo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CAL="$REPO/scripts/sidecar_calibrate.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  ❌ %s\n     got: %s\n' "$1" "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-240)"; }
+
+# stub <name> <behaviour> — write a fake sidecar CLI onto the lane PATH.
+#   honest        : echoes back the model it was pinned to (a truthful runtime)
+#   silent-fallback: ALWAYS answers as one fixed model, whatever the pin (the agy trap)
+#   loud-reject   : exits non-zero on an unknown pin (the codex behaviour)
+#   chatty        : answers with agentic prose instead of the requested token (unparseable verdict)
+#   banner-echo   : prints a session banner that REPEATS the pinned model, then answers as a
+#                   different model — the real shape of `codex exec` stdout (measured 2026-07-30)
+#   listed-substitute: REJECTS an unknown name (so the bogus control says "rejects-bogus") yet
+#                   silently serves a different model for a name that IS in its own catalogue —
+#                   the measured agy shape (`gemini-3.1-pro-high` answered as 3.6 Flash, no error)
+#   alias-name    : answers with the vendor's PRODUCT name carrying the right version but not every
+#                   token of the pin slug — measured: pin `gpt-5.6-sol` → "GPT-5.6 Codex"
+#   absent        : not created at all
+mkstub() {
+  local name="$1" mode="$2" bin="$TMP/bin"
+  mkdir -p "$bin"
+  case "$mode" in
+    absent) rm -f "$bin/$name"; return ;;
+  esac
+  cat > "$bin/$name" <<STUB
+#!/usr/bin/env bash
+mode="$mode"
+pin=""
+prev=""
+for a in "\$@"; do
+  case "\$prev" in -m|--model) pin="\$a" ;; esac
+  prev="\$a"
+done
+case "\$1" in --version) echo "stub 9.9.9"; exit 0 ;; esac
+# Scan ALL arguments for the verdict prompt — it is NOT always last. codex puts the prompt at the
+# end; agy puts it after -p with `--print-timeout 170s` trailing. A first draft read only the last
+# argument, so the agy-shaped call never looked like a verdict request and lane5b failed against a
+# correct script. An honest runtime ANSWERS THE QUESTION ASKED: a one-token request gets one token.
+is_verdict=0
+for a in "\$@"; do case "\$a" in *"PASS or FAIL"*) is_verdict=1 ;; esac; done
+case "\$mode" in
+  loud-reject)
+     case "\$pin" in *nonexistent*|*bogus*) echo "ERROR: model '\$pin' is not supported" >&2; exit 1 ;; esac
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am \$pin, by StubCorp."; fi ;;
+  silent-fallback)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  alias-name)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "StubGPT-3.1 Coder"; fi ;;
+  listed-substitute)
+     case "\$pin" in *nonexistent*|*bogus*) echo "ERROR: model '\$pin' is not supported" >&2; exit 1 ;; esac
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  banner-echo)
+     echo "Reading additional input from stdin... CLI v0.0.0"
+     echo "--------"
+     echo "model: \$pin   workdir: /tmp   approval: never"
+     echo "--------"
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am stub-flash-3.6, by StubCorp."; fi ;;
+  chatty)
+     printf 'Summary of Work\n- considered the request\n- the answer is probably PASS\n' ;;
+  honest|*)
+     if [ "\$is_verdict" -eq 1 ]; then echo "PASS"; else echo "I am \$pin, by StubCorp."; fi ;;
+esac
+exit 0
+STUB
+  chmod +x "$bin/$name"
+}
+
+# HERMETIC PATH — system paths only, plus the stub dir. Inheriting $PATH looked harmless and was
+# not: "absent" is simulated by NOT creating a stub, so the real codex/agy further down $PATH were
+# found instead and the lanes fired REAL, billed API calls (measured: a lane run hung past 120s
+# against live runtimes). A test that can reach production is not a test.
+run_cal() { PATH="$TMP/bin:/usr/bin:/bin:/usr/sbin:/sbin" bash "$CAL" --stub-model "stub-pro-3.1" "$@" 2>&1; }
+
+echo "── sidecar-calibrate lanes ──"
+
+# LANE 1 — absent runtime must read as ABSENT, never as a failure of the panel and never as "fine".
+mkstub codex absent; mkstub agy absent
+out="$(run_cal --only codex)"
+case "$out" in
+  *"codex"*ABSENT*) ok "lane1 absent runtime reported ABSENT" ;;
+  *) bad "lane1 absent runtime not reported as ABSENT" "$out" ;;
+esac
+
+# LANE 2 — THE POINT OF THE WHOLE SCRIPT. A runtime that silently answers as a different model must
+# be reported as UNTRUSTED-PIN, not as reachable. "The sidecar ran" and "the model I pinned answered"
+# are different propositions; agy's slug fallback is the measured instance (2026-07-30).
+mkstub agy silent-fallback
+out="$(run_cal --only agy)"
+case "$out" in
+  *UNTRUSTED-PIN*) ok "lane2 silent fallback caught (pinned model did not answer)" ;;
+  *) bad "lane2 silent fallback passed as a healthy sidecar" "$out" ;;
+esac
+
+# LANE 3 — an honest runtime that echoes its pin is PIN-OK.
+mkstub agy honest
+out="$(run_cal --only agy)"
+case "$out" in
+  *PIN-OK*) ok "lane3 honest runtime reported PIN-OK" ;;
+  *) bad "lane3 honest runtime not reported PIN-OK" "$out" ;;
+esac
+
+# LANE 4 — the negative control must actually control. A runtime that ACCEPTS a bogus model pin has
+# no server-side validation, so "it ran without error" proves nothing about which model answered;
+# that must be visible in the report rather than inferred.
+mkstub codex loud-reject
+out="$(run_cal --only codex)"
+case "$out" in
+  *"control: rejects-bogus"*) ok "lane4 bogus-pin control observed (runtime validates pins)" ;;
+  *) bad "lane4 bogus-pin control not reported" "$out" ;;
+esac
+mkstub codex honest      # honest stub answers ANY pin, including a bogus one
+out="$(run_cal --only codex)"
+case "$out" in
+  *"control: accepts-bogus"*) ok "lane4b runtime accepting a bogus pin is flagged" ;;
+  *) bad "lane4b runtime accepting a bogus pin was not flagged" "$out" ;;
+esac
+
+# LANE 5 — verdict fitness is MEASURED, not assumed. A runtime that answers a one-token request with
+# agentic prose cannot carry a machine-read verdict. The recorded 2026-07-04 finding said exactly
+# this about agy at 1.0.14; the version has moved since, so the answer must be re-measured, never
+# inherited.
+mkstub agy chatty
+out="$(run_cal --only agy)"
+case "$out" in
+  *VERDICT-UNPARSEABLE*) ok "lane5 prose-answering runtime flagged VERDICT-UNPARSEABLE" ;;
+  *) bad "lane5 prose answer accepted as a usable verdict channel" "$out" ;;
+esac
+mkstub agy honest
+out="$(run_cal --only agy)"
+case "$out" in
+  *VERDICT-OK*) ok "lane5b token-answering runtime reported VERDICT-OK" ;;
+  *) bad "lane5b clean token answer not reported VERDICT-OK" "$out" ;;
+esac
+
+# LANE 8 (measured on the first real run) — BANNER ECHO MUST NOT SATISFY THE IDENTITY PROBE.
+# Real CLIs print a session banner before the answer, and that banner repeats the pinned model name
+# back (`codex exec` prints its version and config header). Matching against whole stdout therefore
+# passes any runtime that merely echoes its own configuration — which is precisely the lie this
+# script exists to catch, re-entering through the transport layer instead of the model.
+mkstub agy banner-echo
+out="$(run_cal --only agy)"
+case "$out" in
+  *UNTRUSTED-PIN*) ok "lane8 banner echo rejected (config echo is not a self-report)" ;;
+  *) bad "lane8 banner echoing the pin passed the identity probe" "$out" ;;
+esac
+
+# LANE 10 (measured 2026-07-30) — a vendor product alias carrying the RIGHT VERSION is not a pin
+# failure. Pinning `gpt-5.6-sol` returned "GPT-5.6 Codex": same family, same version, different
+# product suffix. Requiring every token of the pin slug to appear made the calibrator report
+# UNTRUSTED-PIN on a runtime whose pin had actually held — and that runtime also validates pins
+# server-side, so the corroborating evidence was there to read. The version token is the
+# discriminator that matters; the fallback cases (3.1 asked, 3.6 answered) differ exactly there.
+mkstub agy alias-name
+out="$(run_cal --only agy)"
+case "$out" in
+  *PIN-OK*) ok "lane10 product alias with matching version accepted as PIN-OK" ;;
+  *) bad "lane10 matching version rejected because a suffix token was absent" "$out" ;;
+esac
+
+# LANE 9 (measured 2026-07-30) — "rejects unknown names" does NOT imply "serves known names
+# faithfully", and the gap between them is where the real trap lives. agy rejects a nonsense model
+# yet silently substituted Flash for `gemini-3.1-pro-high`, a slug from its OWN catalogue. A control
+# that only probes nonsense therefore returns reassuring evidence about the wrong question: the
+# identity probe must still decide, and the report must not let `rejects-bogus` read as "pin safe".
+mkstub agy listed-substitute
+out="$(run_cal --only agy)"
+case "$out" in
+  *"control: rejects-bogus"*UNTRUSTED-PIN*|*UNTRUSTED-PIN*"control: rejects-bogus"*)
+      ok "lane9 validates unknown names yet substitutes a known one → still UNTRUSTED-PIN" ;;
+  *) bad "lane9 pin substitution masked by a passing bogus-control" "$out" ;;
+esac
+
+# LANE 6 — panel verdict. With no usable different-family sidecar the script must say so explicitly:
+# this is the line a marker's `crossfamily:` leg quotes, and the 2026-07-30 defect was asserting
+# "cross-family unavailable" without ever probing.
+mkstub codex absent; mkstub agy absent
+out="$(run_cal)"
+case "$out" in
+  *"PANEL: none"*) ok "lane6 empty panel stated explicitly (not silence)" ;;
+  *) bad "lane6 empty panel not stated" "$out" ;;
+esac
+mkstub codex honest
+out="$(run_cal)"
+case "$out" in
+  *"PANEL: "*codex*) ok "lane6b populated panel names the usable runtime" ;;
+  *) bad "lane6b populated panel not named" "$out" ;;
+esac
+
+# LANE 7 — detector, not gate: always exit 0, so a calibration run can never block a caller. The
+# caller reads the verdict; the script does not decide for it.
+mkstub codex absent; mkstub agy absent
+PATH="$TMP/bin:/usr/bin:/bin:/usr/sbin:/sbin" bash "$CAL" >/dev/null 2>&1
+[ $? -eq 0 ] && ok "lane7 exits 0 even with an empty panel (detector, not gate)" \
+             || bad "lane7 non-zero exit on empty panel" "exit=$?"
+
+printf '\nsidecar-calibrate lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_sidecar_wait_stdin.sh

@@ -143,7 +143,19 @@ if command -v script >/dev/null 2>&1; then
   # The inner shell writes its rc to a FILE. Parsing `script`'s own stdout fails: it emits ^D and
   # CRLF, and the first version of this lane read rc as empty and reported a defect that did not
   # exist — the target was fine, the instrument was not.
-  script -q /dev/null bash -c "SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'" >/dev/null 2>&1 < /dev/null
+  # `script(1)` HAS TWO INCOMPATIBLE CLIs and this lane only ever spoke one of them. BSD/macOS takes
+  # `script -q <file> <cmd> [args...]`; util-linux (every Linux runner) takes `script -q -c "<cmd>"
+  # <file>`. Given the BSD form, util-linux treats `bash` and `-c` as stray operands, never runs the
+  # inner command, and writes no rc file — so the lane read rc='<unread>' and reported a defect in
+  # sidecar_wait that did not exist. Measured on the first CI run, 2026-07-31; it had been invisible
+  # because this suite had only ever executed on macOS. Same shape as the Hangul-range collation bug
+  # found in the same run: a TOOL INTERFACE that differs by platform, silently.
+  _P9CMD="SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'"
+  if script --version 2>&1 | grep -qi util-linux; then
+    script -q -c "$_P9CMD" /dev/null >/dev/null 2>&1 < /dev/null
+  else
+    script -q /dev/null bash -c "$_P9CMD" >/dev/null 2>&1 < /dev/null
+  fi
   rc9=$(tr -dc '0-9' < "$TD/p9rc" 2>/dev/null)
   if [ -n "$rc9" ] && [ "$rc9" != "124" ] && grep -q 'SIDECAR_VERDICT=' "$TD/p9.txt" 2>/dev/null; then
     ok "P9 the tty path runs and emits a verdict (UNCALIBRATED — see note; does NOT bind the branch)"

package/templates/.git-hooks/pre-commit

@@ -362,6 +362,15 @@ if [ -n "$EXEC_STAGED" ] && [ -z "$DOC_STAGED" ]; then
   echo ""
 fi
 
+# ── Half-fix propagation (advisory — MARK, never block) ──────────────────────
+# The operator's spec for this debt is explicit: 표시(차단 아님 — 정당한 복제도 있다).
+# templates/ ships deliberate copies of scripts/, so blocking on duplication would block correct
+# work; and a gate that fires when the author did the right thing is a gate that gets disabled.
+# Failing to RUN is likewise never a finding: a missing/erroring scan is silent here, because this
+# surface is a commit (reversible) — the fail-closed direction belongs to publish and delete.
+HALFFIX="$REPO_ROOT/scripts/halffix_propagation_scan.sh"
+[ -f "$HALFFIX" ] && bash "$HALFFIX" 2>&1 || true
+
 # ── Axis 1 — Regression Guard (always required) ──────────────────────────────
 echo "[Axis 1] Regression Guard..."
 GUARD="$REPO_ROOT/templates/regression_guard.sh"