@chrono-meta/fh-gate 1.4.78 → 1.4.79

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.78",
+      "version": "1.4.79",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.78",
+      "version": "1.4.79",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/knowledge/shared/harness-core/loop_engineering.md

@@ -67,7 +67,7 @@ instrument: the next slip finds its leg pre-diagnosed.
 | Backlog item | Fires when (measured trigger) |
 |---|---|
 | ~~Close-chain ordered-checklist script~~ | **BUILT 2026-07-10** (`scripts/session_close_check.sh`) — operator strengthen-instruction; the miss class (card staleness) was already measured, only the build trigger was overridden (recorded, not silent) |
-| Weekly-audit scaffold + data-gather script | a weekly audit missed or hand-gathered wrong window data |
+| Weekly-audit scaffold + data-gather script — **TRIGGER FIRED 2026-07-31, half built** | a weekly audit missed or hand-gathered wrong window data. **It fired on both legs**: the audit was **50 days** overdue (cadence is 7), and the window data was then gathered by hand with an ad-hoc bucketing script written on the spot. What was built in response is the **detection** half only — a cadence line in the SessionStart hook, mirroring the frontier-digest one, because the diagnosis was that the two cadences differ in *instrumentation*, not in importance: the mechanized one went 50 days without missing a day while this one went 50 days unnoticed. The **scaffold + data-gather** half stays unbuilt on purpose; a missed audit is now visible, and whether hand-gathering is painful enough to mechanize is a second measurement, not an implication of the first. Re-fires if the next audit is again hand-gathered with friction worth recording. |
 | harvest-loop Step 0-b/0-c evidence check | a harvest run misses completed items despite `fh_completed_*` existing |
 | goal-quench mid-run checkpoint files (70/85/95%) | a /goal run blows through a threshold unnoticed |
 | ~~Substrate-jump detector~~ | **BUILT 2026-07-10** (`scripts/substrate_jump_detector.sh`, SessionStart-wired) — same operator instruction; structure-enforcing class (out-of-context drift), permanent per the durable-mechanization criterion |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.78",
+  "version": "1.4.79",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -64,6 +64,7 @@
     "scripts/count_check.sh",
     "scripts/selfcheck.sh",
     "scripts/package_coverage_check.sh",
+    "scripts/test_package_coverage_lanes.sh",
     "scripts/test_fh_gate_regressions.sh",
     "templates/local_fh_context.md",
     "docs/ETHOS.md",
@@ -130,6 +131,12 @@
     "templates/settings.SessionStart.snippet.json",
     "scripts/test_node_check_lanes.sh",
     "scripts/sidecar_calibrate.sh",
-    "scripts/test_sidecar_calibrate_lanes.sh"
+    "scripts/test_sidecar_calibrate_lanes.sh",
+    "scripts/pipe_verdict_guard.sh",
+    "scripts/test_pipe_verdict_guard_lanes.sh",
+    "templates/settings.PreToolUse.snippet.json",
+    "scripts/halffix_propagation_scan.sh",
+    "scripts/test_halffix_lanes.sh",
+    "scripts/test_ollama_panel_lanes.sh"
   ]
 }

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.78",
+  "version": "1.4.79",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.78",
+  "version": "1.4.79",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/fh_session_load.sh

@@ -103,6 +103,22 @@ _fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md"
 # 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
 # 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
 _fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
+# THE SECOND HALF OF THE SAME SCOPE BUG (2026-07-31). The comment above got the principle right —
+# "대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다" — and then widened the predicate by
+# exactly ONE surface (the companion store), leaving it file-only. There are TWO live producers:
+# the launchd file runner AND an app routine that posts the digest as a comment on GitHub issue
+# #102 (measured 2026-07-31: 47 comments, one per day, including today's at 09:09 KST). So on a day
+# when the file runner fails, today's digest EXISTS and the hook said "부재가 아니라 실패다" — a
+# true statement about this disk stated as a claim about the digest.
+# The fix is NOT to call the network from a SessionStart hook (it must never block turn 0 and must
+# never fail on an offline node). It is to stop over-claiming: report the scope actually measured
+# ("this node's file output failed") and NAME the surface not measured, so the reader checks it in
+# one step instead of re-running a job whose output already exists elsewhere.
+_fd_issue_note() {
+  echo "    ⓘ 파일만 본 판정이다 — 오늘치는 **GH issue #102**(앱 routine, 매일 ~09:09 KST)에 이미 있을 수 있다."
+  echo "      확인: gh issue view 102 --repo chrono-meta/forge-harness --comments | tail -40"
+  echo "      → 파일 재생성이 필요한지는 그걸 보고 판단하라. '오늘은 뉴스 없음'으로 읽지 말 것."
+}
 if _fd_ready; then
   # 로컬엔 없고 컴패니언에만 있으면 = 이 노드는 러너가 아니다. 침묵하면 토폴로지가 안 보이므로 한 줄 알린다.
   if ! _fd_hit "$FH/tracks/_meta"; then
@@ -125,15 +141,38 @@ elif [ -f "$_FD_LOG" ]; then
   if [ -n "$_FD_ALIVE" ]; then
     echo "ℹ️  [frontier-digest] 잡이 아직 돌고 있는 중일 수 있다($_FD_STAMP, $_FD_ALIVE) — 실패 판정 보류, 나중에 재확인."
   else
-    echo "⚠️  [frontier-digest] 오늘 잡은 돌았는데 **산출물이 없다**($_FD_STAMP) — 부재가 아니라 실패다."
+    echo "⚠️  [frontier-digest] **이 노드의 파일 산출**이 실패했다($_FD_STAMP) — 부재가 아니라 실패다."
     echo "    마지막 로그: $(tail -1 "$_FD_LOG" 2>/dev/null | cut -c1-90)"
-    echo "    → 수동 재실행하거나 실패 원인을 보라. '오늘은 뉴스 없음'으로 읽지 말 것."
+    _fd_issue_note
   fi
 else
-  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 파일 산출물도 없다($_FD_STAMP) — 이 노드에서 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  _fd_issue_note
 fi
 # (BE is resolved at the top of this script — the frontier-digest block above needs it too.)
 
+# 1-b) Weekly-audit cadence — mechanical, for the same reason the frontier-digest block above is.
+# MEASURED 2026-07-31: operations.md §Session start auto-detection (L1) promises "propose the audit
+# if 7+ days elapsed", and the audit had not run for FIFTY days. The frontier-digest cadence, which
+# is instrumented, never went a day unnoticed over the same window. The difference is not
+# importance; it is that one cadence is a hook and the other is prose, and this repo's own N=3
+# escalation rule says to instrument rather than to add a habit. One line in a hook that already
+# runs, not a new mechanism. Advisory by design: an overdue audit is not an irreversible surface,
+# so it surfaces and never blocks. Silent when current, and silent when the dir does not exist
+# (a fresh clone has no audit history and must not be nagged about one).
+_AUDIT_DIR="$FH/tracks/_audit"
+if [ -d "$_AUDIT_DIR" ]; then
+  _LATEST_AUDIT="$(find "$_AUDIT_DIR" -maxdepth 1 -name 'weekly_audit_*.md' -print 2>/dev/null \
+                   | sort | tail -1)"
+  if [ -n "$_LATEST_AUDIT" ]; then
+    _AUDIT_AGE_D=$(( ( $(date +%s) - $(_mtime "$_LATEST_AUDIT") ) / 86400 ))
+    if [ "$_AUDIT_AGE_D" -ge 7 ]; then
+      echo "🗓️  [weekly-audit] 마지막 감사가 ${_AUDIT_AGE_D}일 전이다($(basename "$_LATEST_AUDIT")) — 캐던스는 7일."
+      echo "    → /harvest-loop (lightweight) 또는 operations.md §Weekly Improvement Cycle 수동 절차."
+    fi
+  fi
+fi
+
 # Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
 [ -d "$BE/.git" ] || exit 0
 

package/scripts/halffix_propagation_scan.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# halffix_propagation_scan.sh — pre-commit advisory: this fix may have landed in only one copy.
+#
+# THE DEFECT — "반쪽-수리" (half-fix)
+#   A defect class lives in N sibling copies. The fix lands in ONE and nothing says so. Measured 3x
+#   in this project, and the shape is worse than the count: every one of the three occurred INSIDE
+#   an edit that was itself repairing an earlier half-fix. scripts/psa_scan_lib.sh's header records
+#   five such divergences found in a single 2026-07-26 audit — every confidentiality defect that
+#   audit found was a divergence between duplicated copies, not a flaw in the idea.
+#
+# WHAT IT DOES
+#   Takes the distinctive symbols and path literals touched by the staged diff, re-greps the tree,
+#   and NAMES the tracked files that carry the same token but are not staged. That is the whole
+#   contribution: the author already knows what they fixed; what they lose is the sibling.
+#
+# MARK, DO NOT BLOCK — this is mandated, not preferred. The spec for this debt is explicit:
+#   "표시(차단 아님 — 정당한 복제도 있다)". Legitimate duplication exists (templates/ ships a
+#   field-propagated copy of scripts/ ON PURPOSE, and selfcheck asserts they stay byte-identical).
+#   A detector that blocks on correct duplication is a detector that gets disabled.
+#
+# THE DISCRIMINATOR — if every copy is staged, the fix propagated and this stays SILENT.
+#   Without that, the scan fires loudest exactly when the author did the right thing. Two prior
+#   claims on this same mistake in this repo: S5 (9/9 false positives, narrowed 2026-07-28) and
+#   S6 (0 true positives on the planned surface, retargeted 2026-07-31). Lane N3 pins it.
+#
+# Usage:  bash scripts/halffix_propagation_scan.sh          # reads the staged diff of $PWD
+# Opt out: put `noqa: half-fix` on any added line in the commit.
+
+set -u
+cd "$(git rev-parse --show-toplevel 2>/dev/null || echo .)" || exit 0
+git rev-parse --git-dir >/dev/null 2>&1 || exit 0
+
+# Deletions are excluded (ACM): a removed file's symbols surviving elsewhere is not a half-fix,
+# it is the normal state of a deletion, and flagging it would be pure noise.
+STAGED=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null)
+[ -n "$STAGED" ] || exit 0
+
+DIFF=$(git diff --cached -U0 --diff-filter=ACM 2>/dev/null)
+printf '%s' "$DIFF" | grep -qE '^\+.*noqa:?[[:space:]]*half-fix' && exit 0
+
+# Anchor tokens, from CHANGED lines only (added and removed — a removed spelling is exactly what a
+# sibling may still carry). Two shapes:
+#   · identifiers >= 10 chars — long enough that a collision is meaningful. Shell/py keywords and
+#     the everyday vocabulary (`then`, `echo`, `return`, `local`) are all shorter, so the length
+#     floor does the keyword filtering without a denylist to maintain. (Lane N6.)
+#   · path literals `a/b` — the spec names filenames as anchors alongside symbols. (Lane P7.)
+# The ENCLOSING function counts as a changed symbol even when the edited line itself carries no
+# distinctive token — and a half-fix is a function-level thing, so this is the common case, not an
+# edge one. git already hands it over in the hunk header (`@@ -2 +2 @@ psa_low_allowlisted() {`),
+# so the context comes for free rather than from a hand-rolled scope parser.
+# Found by lane P1 failing: the fix edited only a `case` line, whose longest token was 9 chars, and
+# the scan went silent on a textbook two-copy divergence.
+CHANGED=$( { printf '%s\n' "$DIFF" | grep -E '^[+-]' | grep -vE '^(\+\+\+|---)'
+             printf '%s\n' "$DIFF" | sed -n 's/^@@ .* @@ //p'
+           } )
+TOKENS=$( { printf '%s\n' "$CHANGED" | grep -oE '[A-Za-z_][A-Za-z0-9_-]{9,}'
+            printf '%s\n' "$CHANGED" | grep -oE '[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+'
+          } | sort -u )
+# NO early exit here. R1 (tokens) and R2 (whole-file copies) are INDEPENDENT rules, and an empty
+# token set is the normal state for a short edit — `a() { :; }` → `a() { echo fixed; }` carries no
+# 10-char anchor at all. An early `exit 0` on empty tokens silently disabled R2 for exactly the
+# edits R2 exists to catch. (Caught by lane R2p, 2026-07-31, after the same shape had already
+# passed 10/10 in the other lanes — a rule can be correct and unreachable.)
+
+# Cap, and SAY SO when it bites. A silent truncation reads as "checked everything" when it did not.
+MAX_TOKENS="${HALFFIX_MAX_TOKENS:-60}"
+TOTAL=$(printf '%s\n' "$TOKENS" | grep -c .)
+if [ "$TOTAL" -gt "$MAX_TOKENS" ]; then
+  echo "  ℹ️  half-fix scan: $TOTAL anchor tokens in this diff, examining the first $MAX_TOKENS (raise with HALFFIX_MAX_TOKENS)." >&2
+  TOKENS=$(printf '%s\n' "$TOKENS" | head -n "$MAX_TOKENS")
+fi
+
+# A token in many files is framework vocabulary, not a duplicated fix site. (Lane N5.)
+MAX_FILES="${HALFFIX_MAX_FILES:-8}"
+staged_has() { printf '%s\n' "$STAGED" | grep -qxF "$1"; }
+
+hits=""
+while IFS= read -r tok; do
+  [ -n "$tok" ] || continue
+  files=$(git grep -l --fixed-strings -e "$tok" -- . 2>/dev/null)
+  [ -n "$files" ] || continue
+  n=$(printf '%s\n' "$files" | grep -c .)
+  [ "$n" -le "$MAX_FILES" ] || continue
+  others=""
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    staged_has "$f" || others="${others}${others:+, }$f"
+  done <<< "$files"
+  [ -n "$others" ] || continue          # every copy staged → propagated → silent (lane N3)
+  hits="${hits}  ⚠️  HALF-FIX \`$tok\` also lives in: $others
+"
+done <<< "$TOKENS"
+
+# ── R2 — whole-file copy divergence. ─────────────────────────────────────────────────────────
+# The token rule alone missed this repo's real duplicate pair: a script's NAME lives in 11–18 files
+# here (docs, CATALOG, the manifest, selfcheck refs), so the ubiquity filter suppressed it, while an
+# internal symbol like psa_low_allowlisted lives in 2. Measured 2026-07-31 — lanes 10/10 green, live
+# probe silent. The lanes were necessary and not sufficient.
+#
+# Exact, not heuristic: the sibling was BYTE-IDENTICAL at HEAD and only one side is staged, so it is
+# a divergence by construction and needs no threshold. Same-basename files that were never copies
+# (CLAUDE.md vs templates/CLAUDE.md, the 40 SKILL.md files) stay silent — a basename rule would have
+# flooded on exactly those.
+while IFS= read -r sf; do
+  [ -n "$sf" ] || continue
+  base=$(basename "$sf")
+  head_blob=$(git rev-parse "HEAD:$sf" 2>/dev/null) || continue
+  while IFS= read -r cand; do
+    [ -n "$cand" ] && [ "$cand" != "$sf" ] || continue
+    staged_has "$cand" && continue
+    cand_blob=$(git rev-parse "HEAD:$cand" 2>/dev/null) || continue
+    [ "$cand_blob" = "$head_blob" ] || continue     # were they the SAME file before this edit?
+    hits="${hits}  ⚠️  HALF-FIX \`$sf\` was byte-identical to \`$cand\` at HEAD — only one side is staged
+"
+  done <<< "$(git ls-files -- "*/$base" "$base" 2>/dev/null)"
+done <<< "$STAGED"
+
+[ -n "$hits" ] || exit 0
+
+{
+  echo "⚠️  HALF-FIX PROPAGATION — symbols you changed also exist in files you did NOT stage."
+  echo "   Not a verdict: templates/ ships deliberate copies of scripts/. Judge each, then proceed."
+  printf '%s' "$hits"
+  echo "   Silence this commit with a \`noqa: half-fix\` comment on any added line."
+} >&2
+exit 0

package/scripts/package_coverage_check.sh

@@ -21,10 +21,27 @@ set -uo pipefail
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT" || exit 1
 
-if [ ! -d .git ] || [ ! -f package.json ]; then
+# Source-checkout test uses `-e`, not `-d`. In a git WORKTREE `.git` is a FILE (a gitdir pointer),
+# so the old `-d` test read every worktree as "installed package" and skipped the check entirely —
+# silently, with exit 0. Measured 2026-07-31: a worktree created specifically to approximate CI
+# reported PASS while this check had not run at all, i.e. the instrument used to justify wiring CI
+# was itself fail-open on the surface it was standing in. `-e` covers both the ordinary checkout
+# (dir) and the worktree (file); genuine package mode has no `.git` of either kind, so it still
+# skips. Anchored by scripts/test_package_coverage_lanes.sh.
+if [ ! -e .git ]; then
   echo "SKIP  package-coverage (not a source checkout)"
   exit 0
 fi
+# PREDICATE SPLIT (cross-family review, 2026-07-31). These were one condition, and folding them
+# together meant `.git` present + manifest missing returned SKIP + exit 0 — "we are in a checkout
+# and cannot read what ships" reported as "nothing to check here". Absence of the input is not
+# absence of the defect; `not found != 0` (CLAUDE.md §Instrument-Calibration). Only the no-.git
+# case is a legitimate skip (an installed package, where the un-shipped files are correctly gone).
+if [ ! -f package.json ]; then
+  echo "FAIL  package-coverage: source checkout with no package.json — the shipped file list is"
+  echo "      unreadable, so coverage is UNMEASURED, not clean"
+  exit 1
+fi
 
 # ── Accepted-absent, with the reason each one is NOT a defect ────────────────────────────────
 # Adding a line here is a decision, not a silencer: each entry states why shipping it would be

package/scripts/pipe_verdict_guard.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# pipe_verdict_guard.sh — PreToolUse(Bash) advisory: a verdict read from the wrong end of a pipe.
+#
+# THE DEFECT
+#   `cmd | tail -5; echo "exit=$?"` reports TAIL's status, not cmd's. A gate that FAILED reads as
+#   exit 0. The degrade direction is toward PASS, which is the direction that never announces
+#   itself. Measured 6× in this project between 2026-07-29 and 2026-07-31.
+#
+# WHY A HOOK AND NOT A FILE LINTER (measured 2026-07-31, and it reversed the plan on record)
+#   The session card prescribed "add an S6 class to scripts/degrade_direction_scan.sh". Every
+#   `pipe + $?` occurrence in this repo's shell scripts was then hand-verified: 7 hits, 7 correct
+#   — in all 7 the final stage WAS the command under test. True positives in shipped files: 0.
+#   All 6 recurrences lived in interactively-composed commands, which a repo scanner never reads.
+#   S6 would have shipped a probe with no true positives, the exact failure mode S5 records in
+#   its own comment ("100% FP trains dismissal of the one hit that will matter"). So the guard
+#   moved to the surface where the defect actually occurs: the Bash tool call itself.
+#
+# TWO RULES, DELIBERATELY UNEQUAL IN CONFIDENCE
+#   R1 — deterministic, zero-FP. `${PIPESTATUS[…]}` is bash-only. This project's Bash tool runs
+#        zsh, where that expands to the EMPTY STRING (zsh spells it `$pipestatus[1]`, 1-indexed).
+#        A verdict read from it is not wrong, it is ABSENT. No judgment involved.
+#   R2 — heuristic, narrowed to DISPLAY FILTERS as the final stage (tail/head/cat/less/more).
+#        A final `grep -q`, a script, or a subshell is usually the thing whose status is wanted —
+#        those are the 7 correct shapes above and are not flagged. Narrowing costs recall; the
+#        alternative is a probe nobody reads.
+#
+# DEGRADE DIRECTION: advisory. This guard WARNS and exits 0 — it never blocks a Bash call, because
+#   a mis-read verdict is re-runnable and a false block on a developer's shell trains --no-verify
+#   reflexes on hooks that DO guard irreversible surfaces. Set FH_PIPE_VERDICT_BLOCK=1 to escalate.
+#   If the command cannot be extracted, it stays silent: an unparsed input is not a finding.
+#
+# Usage:
+#   hook:  PreToolUse matcher "Bash" → bash scripts/pipe_verdict_guard.sh
+#   test:  printf '%s' "<command>" | bash scripts/pipe_verdict_guard.sh --stdin-raw
+# Opt out on a single command with a trailing `# noqa: pipe-verdict`.
+
+set -u
+
+CMD=""
+if [ "${1:-}" = "--stdin-raw" ]; then
+  CMD=$(cat)
+else
+  RAW=$(cat)
+  # PreToolUse payload. Absent/!Bash/unparseable → stay silent (see degrade direction above).
+  CMD=$(printf '%s' "$RAW" | python3 -c '
+import json,sys
+try: d = json.load(sys.stdin)
+except Exception: sys.exit(0)
+if d.get("tool_name") != "Bash": sys.exit(0)
+sys.stdout.write(d.get("tool_input", {}).get("command", "") or "")
+' 2>/dev/null) || CMD=""
+fi
+[ -n "$CMD" ] || exit 0
+
+# Explicit opt-outs, checked before any rule.
+printf '%s' "$CMD" | grep -qE '#[[:space:]]*noqa:?[[:space:]]*pipe-verdict' && exit 0
+
+hits=""
+add() { hits="${hits}  ⚠️  PIPE-VERDICT $1
+      $2
+"; }
+
+# Flatten to ONE line before any matching. grep is line-oriented, so `.*` never spans a newline and
+# every multi-line command missed — which is the worse half, because the invocations that actually
+# recur here are multi-line. A newline is a statement separator, so `; ` is the faithful substitute.
+# (Found by the Axis-2 adversarial pass on this guard, 2026-07-31; lanes A* pin it.)
+FLAT=$(printf '%s' "$CMD" | tr '\n' ';' | sed 's/;/; /g')
+
+# ── R1 — PIPESTATUS under zsh: the value is empty, so the verdict is absent. ──────────────────
+# Brace-optional: zsh accepts `$PIPESTATUS[0]` as well, and the brace-anchored form missed it (lane B*).
+if printf '%s' "$FLAT" | grep -qE '\$\{?PIPESTATUS[[{]' ; then
+  add "R1 \${PIPESTATUS[…]} is empty in zsh" \
+      "This shell is zsh; the bash array does not exist here, so the verdict expands to \"\". Use zsh's \`\$pipestatus[1]\` (1-indexed), or drop the pipe and read \$? directly."
+fi
+
+# ── R2 — display filter as the final stage, then a read of $?. ────────────────────────────────
+# `||` is neutralized first: `a || b || echo 0` contains no pipeline, and reading it as one is
+# how the sibling S5 probe produced 9 false positives before it was narrowed (2026-07-28).
+# `set -o pipefail` in the same command makes `$?` after a pipeline correct — not a finding.
+NORM=$(printf '%s' "$FLAT" | sed 's/||/__OR__/g')
+if ! printf '%s' "$NORM" | grep -qE 'set -o pipefail|set -[a-zA-Z]*o[a-zA-Z]* pipefail'; then
+  if printf '%s' "$NORM" \
+     | grep -qE '\|[[:space:]]*(tail|head|cat|less|more)([[:space:]][^|;&]*)?[[:space:]]*[;&].*\$\?'; then
+    add "R2 \$? after a display filter" \
+        "\$? holds the filter's status (tail/head/cat almost always succeed), not the command's — a FAILED check reads as 0. Capture first: \`out=\$(cmd 2>&1); rc=\$?\` then print \"\$out\" | tail."
+  fi
+fi
+
+[ -n "$hits" ] || exit 0
+
+printf '%s' "$hits" >&2
+if [ "${FH_PIPE_VERDICT_BLOCK:-0}" = "1" ]; then exit 2; fi
+exit 0

package/scripts/selfcheck.sh

@@ -2,7 +2,13 @@
 # selfcheck.sh — mandatory-pass (deterministic) checks on FH's own executable surface.
 # Class: mandatory-pass (harness_6axis_framework.md §Axis 5 check classes) — blocks on fail.
 # Scope: executables shipped via npm files[] + the bash infra driving the FH gate chain.
-# Syntax-only (node --check / bash -n): zero side effects, no network, runs anywhere.
+# NOT syntax-only any more, and this line used to say it was. Syntax checks (node --check / bash -n)
+# are only the first section; behavioural lane suites follow and they DO have side effects and
+# environment needs: temp dirs, a loopback HTTP stub on 127.0.0.1:18011, git, `timeout`, and — via
+# the session-close lanes — an optional `gh` call that reaches GitHub when the binary is present.
+# Corrected 2026-07-31 (cross-family review): the stale "zero side effects, no network" claim
+# survived the additions that falsified it, which is how a reader ends up trusting the wrong
+# invariant. No remote network is REQUIRED; some is possible.
 # Wiring: `npm test` for any session; `prepublishOnly` so a publish cannot ship a
 # syntactically broken executable.
 set -u
@@ -105,10 +111,25 @@ fi
 # absent from the tarball — including templates/predelete_check.sh, which CLAUDE.md instructs you
 # to run before a destructive op. Wired here in the same commit that created it, because the two
 # previous anchors this session shipped with zero callers.
-if [ -f scripts/package_coverage_check.sh ]; then
+# Anchored 2026-07-31. Until then this was the ONE subject in this file exempt from the
+# "subject present but anchor missing => FAIL" rule the eight blocks below enforce — and the
+# exemption cost something real: its source-checkout predicate tested `-d .git`, so inside a git
+# WORKTREE (where .git is a FILE) it printed SKIP and returned 0 without scanning. A worktree is
+# how a fresh CI checkout gets approximated, so the check was absent from exactly the tree used
+# to reason about CI. scripts/test_package_coverage_lanes.sh pins the predicate across all four
+# tree shapes plus a known pair.
+if [ ! -f scripts/package_coverage_check.sh ]; then
+  echo "SKIP  test_package_coverage_lanes.sh (subject scripts/package_coverage_check.sh absent)"
+elif [ -f scripts/test_package_coverage_lanes.sh ]; then
+  if ! bash scripts/test_package_coverage_lanes.sh; then
+    fail=1
+  fi
   if ! bash scripts/package_coverage_check.sh; then
     fail=1
   fi
+else
+  echo "FAIL  test_package_coverage_lanes.sh: package_coverage_check.sh present but its anchor is missing"
+  fail=1
 fi
 
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
@@ -177,6 +198,42 @@ else
   fail=1
 fi
 
+# Two guards that read the AUTHOR's own actions rather than the repo's files. Both were added
+# 2026-07-31; the pipe-verdict lane shipped in PR #209 WITHOUT this wiring, which is itself the
+# half-fix class the second guard exists to catch — found by running that guard on this repo.
+if [ ! -f scripts/sidecar_calibrate.sh ]; then
+  echo "SKIP  test_ollama_panel_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+elif [ -f scripts/test_ollama_panel_lanes.sh ]; then
+  if ! bash scripts/test_ollama_panel_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_ollama_panel_lanes.sh: sidecar_calibrate.sh present but its ollama-leg anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/pipe_verdict_guard.sh ]; then
+  echo "SKIP  test_pipe_verdict_guard_lanes.sh (subject scripts/pipe_verdict_guard.sh absent)"
+elif [ -f scripts/test_pipe_verdict_guard_lanes.sh ]; then
+  if ! bash scripts/test_pipe_verdict_guard_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_pipe_verdict_guard_lanes.sh: pipe_verdict_guard.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/halffix_propagation_scan.sh ]; then
+  echo "SKIP  test_halffix_lanes.sh (subject scripts/halffix_propagation_scan.sh absent)"
+elif [ -f scripts/test_halffix_lanes.sh ]; then
+  if ! bash scripts/test_halffix_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_halffix_lanes.sh: halffix_propagation_scan.sh present but its anchor is missing"
+  fail=1
+fi
+
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
@@ -203,10 +260,31 @@ if [ -d ".claude/rules" ]; then
   # fail=0 → SELFCHECK: PASS. The check would have silently ceased to exist while still
   # reporting a pass — the same shape count_check.sh:71 already guards against with its
   # impossible-zero rule. fh-meta always has refs; zero means the instrument broke.
-  _refs=$(grep -hoE '\`[^\` ]+\`' CLAUDE.md .claude/rules/*.md 2>/dev/null \
-    | sed 's/\`//g' \
-    | grep -E '^(knowledge|templates|scripts|docs|plugins|\.claude)/[^*{}<>$]+\.(md|sh|ya?ml|jsonc|json)$' \
-    | sort -u)
+  # EXTRACTION MOVED OFF grep (2026-07-31, measured on the first real CI run). The pipeline used to
+  # be `grep -hoE` + sed + `grep -E` over CLAUDE.md, which is Korean-heavy. On macOS (BSD grep, UTF-8
+  # locale) it returned ~50 refs; on the ubuntu runner (GNU grep, LANG unset => C locale) it returned
+  # ZERO, and the impossible-zero guard below is the only reason that surfaced as a failure instead
+  # of "no refs, all clean". Same root cause as the card-drift probe failing its positive lanes in
+  # the same run: multibyte text through locale-dependent grep.
+  # python3 reads the files as UTF-8 explicitly, so this extractor no longer has a locale at all.
+  # It is already a hard dependency of selfcheck (validate_plugins/marketplace, memory_link_check),
+  # so this adds nothing to the requirement set. The regex is the same one, transcribed.
+  _refs=$(python3 - <<'REFPY' 2>/dev/null
+import re, glob
+pat = re.compile(r'^(knowledge|templates|scripts|docs|plugins|\.claude)/[^*{}<>$]+\.(md|sh|ya?ml|jsonc|json)$')
+seen = set()
+for f in ['CLAUDE.md'] + sorted(glob.glob('.claude/rules/*.md')):
+    try:
+        text = open(f, encoding='utf-8', errors='replace').read()
+    except OSError:
+        continue
+    for tok in re.findall(r'`([^` ]+)`', text):
+        if pat.match(tok):
+            seen.add(tok)
+for p in sorted(seen):
+    print(p)
+REFPY
+)
   if [ -z "$_refs" ]; then
     echo "FAIL  ref-path: extractor produced 0 refs — the scan broke, it did not pass"
     fail=1

package/scripts/session_close_check.sh

@@ -146,7 +146,21 @@ fi
 # HONEST SCOPE: 카드 🔴/🟡 줄에서 부재-주장 키워드를 잡고, 그 줄의 이름/경로 토큰으로
 # 실물을 글롭 검색한다. 어휘가 안 겹치면 못 잡는다(무음 FN) — 앵커지 floor 가 아니다.
 # 방향은 advisory: 가역 표면에서 하드 블록은 --no-verify 를 학습시킨다(#165 HIGH-1 동일 원리).
-_ABSENCE_RE='미가동|산출물[^가-힣]*0|로그[^가-힣]*0|0건|부재|안 돌|미생성|not running|no output|zero output'
+# COLLATION-FREE BY CONSTRUCTION (2026-07-31, diagnosed ON the runner after two local hypotheses
+# were refuted). This regex used to contain the Hangul RANGE `[^가-힣]`. A multibyte range inside a
+# bracket expression is collation-dependent, and GNU grep in the C locale — the GitHub runner's
+# default — rejects it outright:  `grep: Invalid collation character`.
+# The failure mode is what makes it serious: grep writes that to stderr, exits 2, and emits NOTHING.
+# Downstream this is indistinguishable from exit 1 "no match", so the pipeline produced zero lines
+# and the probe concluded "no absence claims in the card" — CLEAN — on every input, positive and
+# negative alike. Its 7 lanes had passed 3/3 on macOS for weeks because BSD grep accepts the range.
+# Same shape as the pyyaml CI trigger caught earlier the same day: grep's ERROR status folded into
+# its NO-MATCH branch. `not found != 0`, and neither is `could not look`.
+# The replacement uses an ASCII-only class, which has no collation to be invalid. SEMANTIC SHIFT,
+# stated rather than hidden: the original meant "산출물 then non-Hangul then 0" (keep the claim
+# inside one clause); this means "산출물 then no DIGIT within 20 chars then 0". Slightly wider, and
+# the lanes below are what pin that it did not become too wide.
+_ABSENCE_RE='미가동|산출물[^0-9]{0,20}0|로그[^0-9]{0,20}0|0건|부재|안 돌|미생성|not running|no output|zero output'
 # 부정/정정 문맥 가드 — 부재-주장을 **인용하며** 정정하는 줄만 건너뛴다. 판별자는 debunk
 # 어휘 단독이 아니라 **부재-키워드가 인용부호 안에 있는가** — challenger A-1 실측: 살아있는
 # 주장 + 무관한 '정정 필요' 가 같은 줄이면 debunk-단독 가드가 진짜 경고를 무음 삼켰다(FN).

package/scripts/sidecar_calibrate.sh

@@ -181,6 +181,91 @@ probe_runtime() {
 probe_runtime codex "gpt-5.6-sol"
 probe_runtime agy   "Gemini 3.1 Pro (High)"
 
+# ── Local OpenAI-compatible panel (Ollama) — a DIFFERENT anchor, on purpose. ──────────────────
+# One host serves several model FAMILIES (measured 2026-07-31: an OpenAI-lineage open-weight, a
+# Qwen, a Gemma, a Mistral on one endpoint), so the panel's unit here is the model, not the binary.
+# Everything is local, so nothing leaves the machine — this is the only panel member a residency-
+# constrained session may use on company-adjacent work.
+#
+# WHY THE IDENTITY PROBE IS REPLACED, NOT REUSED — the self-report anchor above is INVALID for this
+# class. Measured: `gpt-oss:20b` asked which model it is answered "The underlying model is GPT-4
+# (likely)". Open-weight models do not reliably know their own name, so a self-report anchor would
+# mark every one of them UNTRUSTED-PIN and drop a genuinely exact pin from the panel. Applying an
+# instrument that cannot separate a known-positive from a known-negative on this target is the
+# calibration failure this whole file exists to prevent — so the anchor moves to the SERVER'S
+# response envelope, which reports the model actually loaded. That is a server-side fact rather
+# than a model's claim, i.e. strictly stronger than what codex/agy expose through their CLIs.
+#
+# HOST IS NEVER HARDCODED. A LAN/Tailscale address is an internal hostname, and this file is
+# public-tracked; §Company residency keeps those out of committed content. Default is loopback;
+# point FH_OLLAMA_HOST at a remote node from a local, gitignored place.
+OLLAMA_HOST_URL="${FH_OLLAMA_HOST:-http://127.0.0.1:11434}"
+# Measured floor, not a guess: at num_predict=64 a reasoning model spent the ENTIRE budget in its
+# `thinking` field (780 chars) and returned an EMPTY response — which reads identically to "cannot
+# carry a verdict". At 512 the same model answered `PASS`. Budget starvation and incapacity are
+# different findings and must not be reported as one.
+OLLAMA_NUM_PREDICT="${FH_OLLAMA_NUM_PREDICT:-512}"
+
+probe_ollama() {
+  command -v curl >/dev/null 2>&1 || { echo "ollama ABSENT — curl missing (absence measured)"; return 0; }
+  curl -sf --max-time 10 "$OLLAMA_HOST_URL/api/version" >/dev/null 2>&1 || {
+    printf 'ollama ABSENT — no server at the configured host (absence measured, not assumed)\n'
+    printf '       set FH_OLLAMA_HOST to probe a remote node; default is loopback\n'
+    return 0
+  }
+
+  local models="${FH_OLLAMA_MODELS:-}"
+  if [ -z "$models" ]; then
+    models=$(curl -sf --max-time 15 "$OLLAMA_HOST_URL/api/tags" 2>/dev/null \
+      | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: raise SystemExit
+print(",".join(m["name"] for m in d.get("models",[])[:6]))' 2>/dev/null)
+  fi
+  [ -n "$models" ] || { echo "ollama REACHABLE but no models listed"; return 0; }
+
+  # Control runs ONCE per host, not per model: it is a property of the server, and repeating it per
+  # model would just multiply the cost of a fact that cannot differ.
+  local ctl ctl_state
+  ctl=$(curl -s --max-time 20 "$OLLAMA_HOST_URL/api/generate" \
+        -d '{"model":"fh-calib-nonexistent:99b","prompt":"hi","stream":false}' 2>&1)
+  if printf '%s' "$ctl" | grep -qiE '"error"|not found'; then ctl_state="rejects-bogus"; else ctl_state="accepts-bogus"; fi
+
+  local IFS=,
+  for m in $models; do
+    [ -n "$m" ] || continue
+    local body out env_model resp compact pin v
+    body=$(python3 -c 'import json,sys; print(json.dumps({"model":sys.argv[1],"prompt":sys.argv[2],"stream":False,"options":{"num_predict":int(sys.argv[3]),"temperature":0}}))' \
+           "$m" "$VERDICT_PROMPT" "$OLLAMA_NUM_PREDICT")
+    out=$(curl -sf --max-time 240 "$OLLAMA_HOST_URL/api/generate" -d "$body" 2>/dev/null)
+    if [ -z "$out" ]; then
+      printf 'ollama %-22s UNREACHABLE-THIS-RUN (measured, not inferred)\n' "$m"; continue
+    fi
+    env_model=$(printf '%s' "$out" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("model",""))' 2>/dev/null)
+    resp=$(printf '%s' "$out" | python3 -c 'import json,sys; print((json.load(sys.stdin).get("response") or "").strip())' 2>/dev/null)
+    compact=$(printf '%s' "$resp" | tr -s '[:space:]' ' ' | sed 's/^ *//; s/ *$//')
+    if [ "$env_model" = "$m" ]; then pin="PIN-OK(envelope)"; else pin="UNTRUSTED-PIN"; fi
+    if [ "${#compact}" -le 12 ] && printf '%s' "$compact" | grep -qiE '^(pass|fail)[.!]?$'; then v="VERDICT-OK"; else v="VERDICT-UNPARSEABLE"; fi
+    printf 'ollama %-22s REACHABLE · %s · control: %s · %s\n' "$m" "$pin" "$ctl_state" "$v"
+    [ -z "$QUIET" ] && printf '       answered: %s\n' "$(printf '%s' "$compact" | cut -c1-60)"
+    if [ "$v" = "VERDICT-UNPARSEABLE" ] && [ -z "$compact" ]; then
+      printf '       ⚠️  EMPTY answer. Before recording this as "cannot carry a verdict", re-run with a\n'
+      printf '           larger FH_OLLAMA_NUM_PREDICT — a reasoning model can spend the whole budget\n'
+      printf '           thinking and return nothing, which looks identical from out here.\n'
+    fi
+    [ "$pin" = "PIN-OK(envelope)" ] && [ "$v" = "VERDICT-OK" ] && PANEL="${PANEL:+$PANEL, }ollama:$m"
+  done
+}
+# `--stub-model` means the caller is the hermetic CLI lane harness, which drives stub BINARIES and
+# asserts on an empty panel. This leg talks to a SERVER, so on a developer machine with a local
+# Ollama running it would populate the panel and break those lanes — which is exactly what happened
+# when this was first wired (test_sidecar_calibrate_lanes lane6, "empty panel not stated", caught by
+# the existing suite rather than by review). Skipping under --stub-model keeps each harness hermetic
+# in its own way; this leg's own lanes drive a stub SERVER via FH_OLLAMA_HOST instead.
+if [ -z "$STUB_MODEL" ] && { [ -z "$ONLY" ] || [ "$ONLY" = "ollama" ]; }; then
+  probe_ollama
+fi
+
 if [ -n "$PANEL" ]; then
   echo "PANEL: $PANEL — usable different-family auditor(s), pin verified this run"
 else