@chrono-meta/fh-gate 1.4.78 → 1.4.79

package/scripts/test_pipe_verdict_guard_lanes.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# test_pipe_verdict_guard_lanes.sh — known pairs for scripts/pipe_verdict_guard.sh
+#
+# WHY THIS FILE EXISTS, AND WHY IT IS WRITTEN BEFORE THE DETECTOR
+#   2026-07-30 harvest #1: across a 5-round challenger run, three rounds contained a fix that
+#   reverted an earlier fix — and the rounds that wrote the lane BEFORE touching the code had
+#   zero such regressions. Convergence came from the ORDER, not the patch. So: lanes first.
+#
+# WHAT IS BEING GUARDED
+#   Reading a verdict from `$?`/`${PIPESTATUS[…]}` after a pipeline, which yields the status of
+#   the LAST stage. When the last stage is a display filter (`tail`, `head`, `cat`), that status
+#   is the filter's — a FAILING gate reads as exit 0. Degrade direction: toward PASS.
+#
+#   R1 (deterministic, zero-FP): `${PIPESTATUS[...]}` under zsh. zsh spells it `$pipestatus[1]`
+#       and 1-indexes it; the bash array expands to the EMPTY STRING. Any verdict read from it is
+#       not merely wrong, it is absent. Measured 6× in this project's ad-hoc invocations.
+#   R2 (heuristic, narrowed): pipeline whose FINAL stage is a display filter, followed by a read
+#       of `$?`. Narrowed to display filters on purpose — see the FP lanes below.
+#
+# WHY A REPO-FILE LINTER IS THE WRONG SURFACE (measured 2026-07-31)
+#   The prescription on the session card was "add an S6 class to degrade_direction_scan.sh".
+#   Hand-verifying every `pipe + $?` hit in this repo's scripts returned 7 hits, 7 of them correct
+#   (the last stage WAS the command under test in all 7). True positives in shipped files: 0.
+#   All 6 measured recurrences were in interactively-composed commands, which no file scanner
+#   reads. Shipping S6 would have been a 0-true-positive probe — exactly the failure S5's own
+#   comment records ("100% FP trains dismissal of the one hit that will matter").
+
+set -u
+G="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/pipe_verdict_guard.sh"
+pass=0; fail=0
+
+# expect <label> <expected: HIT|CLEAN> <command-string>
+expect() {
+  local label="$1" want="$2" cmd="$3" out got
+  out=$(printf '%s' "$cmd" | bash "$G" --stdin-raw 2>&1)
+  if printf '%s' "$out" | grep -q 'PIPE-VERDICT'; then got=HIT; else got=CLEAN; fi
+  if [ "$got" = "$want" ]; then
+    printf '  ✅ %-52s %s (expected %s)\n' "$label" "$got" "$want"; pass=$((pass+1))
+  else
+    printf '  ❌ %-52s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1))
+    printf '     cmd: %s\n     out: %s\n' "$cmd" "$out"
+  fi
+}
+
+echo "[pipe-verdict-guard] known pairs"
+echo "-- R1: PIPESTATUS under zsh (deterministic) --"
+# The exact shape emitted 6× in this project, including twice on 2026-07-31.
+expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
+expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'
+expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'
+# zsh's own spelling is correct here and must never be flagged.
+expect "R1 zsh spelling is CLEAN"         CLEAN 'a | b; rc=$pipestatus[1]'
+
+echo "-- R2: display-filter final stage, then \$? --"
+expect "R2 tail then \$?"                  HIT   'bash gate.sh | tail -20; echo "exit=$?"'
+expect "R2 head then \$?"                  HIT   'make test | head -40; rc=$?'
+expect "R2 cat then \$?"                   HIT   'run.sh | cat; if [ $? -ne 0 ]; then echo bad; fi'
+
+echo "-- R2 false-positive lanes: the 7 shapes this repo actually ships --"
+# Every one of these was hand-verified on 2026-07-31 as CORRECT: the final stage IS the command
+# whose status is wanted. A detector that flags these is noise, and noise trains dismissal.
+expect "FP grep -q is the test itself"    CLEAN 'echo "$pos" | grep -qE "$re"; rc=$?'
+expect "FP grep compiles the regex"       CLEAN "printf '' | grep -E \"\$re\" >/dev/null 2>&1; rc=\$?"
+# Path deliberately generic: naming a real unshipped script here would make this lane a shipped
+# doc pointing at a file the package omits (caught by selfcheck's package-coverage rule).
+expect "FP last stage is the script"      CLEAN "printf '%s' \"\$S\" | bash some-filter.sh - ; echo EXIT:\$?"
+expect "FP command substitution assign"   CLEAN 'out=$(printf x | ( cd "$r" && bash hook 2>&1 )); rc=$?'
+expect "FP no pipe at all"                CLEAN 'bash gate.sh; echo "exit=$?"'
+expect "FP || fallback, not a pipe"       CLEAN 'stat -c %Y f || stat -f %m f || echo 0'
+expect "FP pipefail set, explicit"        CLEAN 'set -o pipefail; bash gate.sh | tail -5; rc=$?'
+
+echo "-- adversarial (found by the Axis-2 pass on this guard, 2026-07-31) --"
+# A: grep is line-oriented, so `.*` never spanned a newline and every MULTI-LINE command missed.
+#    This mattered more than the single-line case: the invocations that actually recur in this
+#    project are multi-line. Caught by attacking the guard, not by the happy-path lanes.
+expect "A multi-line pipe then \$?"        HIT   'bash gate.sh | tail -20
+echo "exit=$?"'
+expect "A multi-line, three statements"   HIT   'cd /r
+make test | head -40
+rc=$?'
+expect "A multi-line stays CLEAN if legit" CLEAN 'cd /r
+echo x | grep -q y
+rc=$?'
+# B: zsh accepts `$PIPESTATUS[0]` without braces; the brace-anchored regex missed it.
+expect "B PIPESTATUS without braces"      HIT   'a | b; rc=$PIPESTATUS[0]'
+expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'
+
+echo "-- opt-out --"
+expect "noqa suppresses"                  CLEAN 'bash g.sh | tail; rc=$?  # noqa: pipe-verdict'
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[pipe-verdict-guard] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[pipe-verdict-guard] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_sidecar_wait_stdin.sh

@@ -143,7 +143,19 @@ if command -v script >/dev/null 2>&1; then
   # The inner shell writes its rc to a FILE. Parsing `script`'s own stdout fails: it emits ^D and
   # CRLF, and the first version of this lane read rc as empty and reported a defect that did not
   # exist — the target was fine, the instrument was not.
-  script -q /dev/null bash -c "SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'" >/dev/null 2>&1 < /dev/null
+  # `script(1)` HAS TWO INCOMPATIBLE CLIs and this lane only ever spoke one of them. BSD/macOS takes
+  # `script -q <file> <cmd> [args...]`; util-linux (every Linux runner) takes `script -q -c "<cmd>"
+  # <file>`. Given the BSD form, util-linux treats `bash` and `-c` as stray operands, never runs the
+  # inner command, and writes no rc file — so the lane read rc='<unread>' and reported a defect in
+  # sidecar_wait that did not exist. Measured on the first CI run, 2026-07-31; it had been invisible
+  # because this suite had only ever executed on macOS. Same shape as the Hangul-range collation bug
+  # found in the same run: a TOOL INTERFACE that differs by platform, silently.
+  _P9CMD="SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'"
+  if script --version 2>&1 | grep -qi util-linux; then
+    script -q -c "$_P9CMD" /dev/null >/dev/null 2>&1 < /dev/null
+  else
+    script -q /dev/null bash -c "$_P9CMD" >/dev/null 2>&1 < /dev/null
+  fi
   rc9=$(tr -dc '0-9' < "$TD/p9rc" 2>/dev/null)
   if [ -n "$rc9" ] && [ "$rc9" != "124" ] && grep -q 'SIDECAR_VERDICT=' "$TD/p9.txt" 2>/dev/null; then
     ok "P9 the tty path runs and emits a verdict (UNCALIBRATED — see note; does NOT bind the branch)"

package/templates/.git-hooks/pre-commit

@@ -362,6 +362,15 @@ if [ -n "$EXEC_STAGED" ] && [ -z "$DOC_STAGED" ]; then
   echo ""
 fi
 
+# ── Half-fix propagation (advisory — MARK, never block) ──────────────────────
+# The operator's spec for this debt is explicit: 표시(차단 아님 — 정당한 복제도 있다).
+# templates/ ships deliberate copies of scripts/, so blocking on duplication would block correct
+# work; and a gate that fires when the author did the right thing is a gate that gets disabled.
+# Failing to RUN is likewise never a finding: a missing/erroring scan is silent here, because this
+# surface is a commit (reversible) — the fail-closed direction belongs to publish and delete.
+HALFFIX="$REPO_ROOT/scripts/halffix_propagation_scan.sh"
+[ -f "$HALFFIX" ] && bash "$HALFFIX" 2>&1 || true
+
 # ── Axis 1 — Regression Guard (always required) ──────────────────────────────
 echo "[Axis 1] Regression Guard..."
 GUARD="$REPO_ROOT/templates/regression_guard.sh"

package/templates/settings.PreToolUse.snippet.json

@@ -0,0 +1,49 @@
+{
+  "_README": [
+    "PreToolUse(Bash) hook snippet — TRACKED, so it arrives with a clone. Every .claude/settings*.json",
+    "path in this repo is gitignored (confirm with `git check-ignore -v .claude/settings.json`), so a",
+    "hook registration cannot itself be tracked. This is the tracked SOURCE that install-wizard merges",
+    "into the user's local settings. Shipping the file is not the same proposition as wiring it — that",
+    "gap is exactly what #204 found (the SessionStart hook existed from 07-05 and the wizard had never",
+    "installed it, for every new user).",
+    "",
+    "WHAT IT GUARDS: reading a verdict from the wrong end of a pipe. `cmd | tail -5; echo $?` reports",
+    "TAIL's status, so a FAILED gate reads as 0 — a degrade toward PASS, the direction that never",
+    "announces itself. Measured 6x in this project 2026-07-29..07-31.",
+    "",
+    "WHY A HOOK AND NOT A FILE LINTER: the plan of record was an S6 class in degrade_direction_scan.sh.",
+    "Hand-verifying every `pipe + $?` in this repo's scripts returned 7 hits, 7 of them CORRECT. True",
+    "positives in shipped files: 0. All 6 recurrences were in interactively-composed commands, which no",
+    "repo scanner reads. The guard belongs where the defect occurs — the Bash call itself.",
+    "",
+    "ADVISORY BY DESIGN: it warns and exits 0. It never blocks a Bash call, because a mis-read verdict",
+    "is re-runnable, and a false block on a developer's own shell trains the --no-verify reflex on the",
+    "hooks that DO guard irreversible surfaces (pre-push destructive-op, pre-commit confidentiality).",
+    "Escalate deliberately with FH_PIPE_VERDICT_BLOCK=1 if a project wants it to bite.",
+    "",
+    "Carries no private path, so it belongs in .claude/settings.json (project-local), not settings.local.json.",
+    "Merge, do not overwrite: preserve any PreToolUse entries the user already has; replace only the FH",
+    "one, keyed by script name.",
+    "",
+    "Verify after wiring (known pair, both directions):",
+    "  bash scripts/test_pipe_verdict_guard_lanes.sh          # 15 pairs, expect all hold",
+    "  printf '%s' '{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"g.sh | tail; rc=$?\"}}' \\",
+    "    | bash scripts/pipe_verdict_guard.sh                 # expect a PIPE-VERDICT R2 warning"
+  ],
+  "project_settings_json": {
+    "hooks": {
+      "PreToolUse": [
+        {
+          "matcher": "Bash",
+          "hooks": [
+            {
+              "type": "command",
+              "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/pipe_verdict_guard.sh\"",
+              "timeout": 5
+            }
+          ]
+        }
+      ]
+    }
+  }
+}