@chrono-meta/fh-gate 1.4.78 → 1.4.80

package/scripts/consent_registry_check.sh

@@ -0,0 +1,472 @@
+#!/usr/bin/env bash
+# consent_registry_check.sh — mechanical floor for accept-side consent promotion.
+#
+# WHY (cross-family review round 2, 2026-07-29)
+#   Round 1 verdict on the prose rule was REJECT; the revision moved it to NARROW-IT, and the
+#   reviewer's sharpest remaining point was that the revision "reads mechanical" while several of its
+#   predicates — sink tainting, promotion eligibility, effect-subset, expiry — were still semantic.
+#   A rule that reads as a control but cannot be checked is worse than an absent one: it buys the
+#   confidence without the enforcement. This script is the missing half. It does not judge; it joins
+#   `standing_consent` against the declared registry and fails closed on anything it cannot decide.
+#
+# WHAT IT ENFORCES (all mechanical — no model, no judgment)
+#   R1  registry schema — every class carries all required fields
+#   R2  eligibility soundness — promotion_eligible:true is FORBIDDEN when sinks/feeds are non-empty
+#       or contain `unknown` (the taint + unknown-is-not-reversible rules)
+#   R3  join     — every standing_consent key resolves to a registered class
+#   R4  floor    — every standing_consent key resolves to a promotion_eligible class
+#   R5  lease    — every grant carries `expires` and is not past it
+#   R6  scope    — every grant records `effects` AND `target`, so the subset check has something to
+#                  compare against (a grant whose scope was never recorded cannot be re-validated)
+#
+# WHAT IT DOES *NOT* CHECK (named, so the prose above it cannot over-claim)
+#   - the effect-SUBSET comparison itself. R6 proves a baseline was recorded; it does not compare a
+#     live action's fingerprint against it, because this script never sees the live action. That
+#     comparison is still a runtime obligation of the rule, i.e. still salience-dependent.
+#   - the 3-consecutive count, retry dedupe, and same-operation identity — those live in the UAP
+#     logger, not here.
+#   - `excludes` / adversarial examples / independent review on a registry entry — required by the
+#     rule, not yet mechanized. Do not read a PASS here as "the registry was reviewed."
+#   - the existence or contents of `consent_runs.log`.
+#   A PASS from this script means the registry and the grants are WELL-FORMED and the floor join
+#   holds. It does not mean the promotion mechanism as a whole was verified.
+#
+# EXIT CONTRACT (typed — three states, three codes; do NOT grep the prose)
+#   0 = VERIFIED   the registry and the grants are well-formed and the floor join holds
+#   3 = UNMEASURED there was nothing to join (no registry / zero classes / no UAP)
+#   1 = BROKEN     unparseable or invalid input; cannot decide == not allowed
+#
+#   A caller may skip an approval prompt ONLY on 0. On 3 it must KEEP ASKING.
+#
+# WHY 3 EXISTS (added 2026-07-31, cross-family round 9 finding F4)
+#   Three states were encoded in two codes and disambiguated only in PROSE. The exit code is the
+#   only machine-readable channel, so the conventional caller —
+#       if scripts/consent_registry_check.sh; then run_unprompted; fi
+#   — read "there is nothing to measure" as "verified, go ahead". Printing "(not a PASS)" disables
+#   nothing. `not found` is not `0` (CLAUDE.md §Instrument-Calibration), and this file's own line
+#   below already said so in words while returning the PASS code.
+#
+# WHY NOT 1 — a missing registry is the state of every fresh clone. Failing there would paint the
+#   gate red on first run and train the override reflex, a failure this file's comments already
+#   record twice (the merge-key over-block, and the reverted parser fix). 1 stays BROKEN.
+#
+# WHY 3 IS THE SAFE DIRECTION — the fallback here is not "block", it is "ask the human". Consent
+#   promotion exists only to SKIP an approval prompt, so degrading to asking restores the system's
+#   original behaviour and WIDENS human-in-the-loop authority. Degrading to 0 narrows it, removing
+#   a human decision nobody granted.
+#
+# DEGRADE DIRECTION
+#   No registry file        -> exit 3, prints "N/A: promotion DISABLED" (unmeasured, keep asking)
+#   No UAP file             -> exit 3, same
+#   Unparseable either file -> exit 1 (fail-closed: cannot decide == not allowed)
+#   Any R1-R6 violation     -> exit 1
+#
+#   "N/A" is printed as N/A, never as PASS — an unmeasured surface is not a clean one.
+#
+# Usage: bash scripts/consent_registry_check.sh [registry.yaml] [uap.md-or-yaml]
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REG="${1:-$ROOT/tracks/_meta/consent_classes.yaml}"
+UAP="${2:-$ROOT/tracks/_meta/user_adaptation_profile.md}"
+
+python3 - "$REG" "$UAP" <<'PY'
+import sys, os, re, datetime
+reg_path, uap_path = sys.argv[1], sys.argv[2]
+
+def out(sym, msg): print(f"  {sym} {msg}")
+
+if not os.path.exists(reg_path):
+    print(f"consent-registry: N/A — no registry at {reg_path}; promotion DISABLED (not a PASS)")
+    sys.exit(3)   # UNMEASURED, not verified — see EXIT CONTRACT
+
+try:
+    import yaml
+except ImportError:
+    print("consent-registry: FAIL — pyyaml unavailable, cannot validate; fail-closed")
+    sys.exit(1)
+
+# H9 DUPLICATE YAML KEYS. yaml.safe_load is last-wins on duplicate mapping keys, so
+# `expires: 2020-01-01` followed by `expires: 2099-01-01` silently keeps the future one, and a
+# duplicated grant key keeps whichever was written last. A consent record whose meaning depends on
+# which duplicate a parser happens to keep is not a record. Reject duplicates at load time.
+class NoDupLoader(yaml.SafeLoader):
+    pass
+
+def _no_dup(loader, node, deep=False):
+    # Resolve `<<: *anchor` merge keys FIRST. Without this the merge key survives as a literal `<<`
+    # entry and a perfectly ordinary DRY registry was refused (measured: a valid grant written via
+    # a merge key exited 1 as an unregistered class). Over-blocking is not a safety win — it trains
+    # the override reflex and turns the gate into decoration, so it counts as a defect like any
+    # fail-open.
+    loader.flatten_mapping(node)
+    seen = set()
+    for k, _ in node.value:
+        key = loader.construct_object(k, deep=deep)
+        try:
+            if key in seen:
+                raise ValueError(f"duplicate key {key!r}")
+        except TypeError:
+            pass
+        seen.add(key)
+    return yaml.SafeLoader.construct_mapping(loader, node, deep)
+
+NoDupLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, _no_dup)
+
+def load(text_or_stream, what):
+    global fails
+    try:
+        return yaml.load(text_or_stream, Loader=NoDupLoader)
+    except Exception as e:
+        print(f"consent-registry: FAIL — {what} unparseable ({e}); fail-closed")
+        sys.exit(1)
+
+fails = 0
+reg = load(open(reg_path), "registry")
+
+REQUIRED = ["name", "owner", "mode", "target", "capabilities", "sinks", "feeds", "promotion_eligible"]
+STR_FIELDS = ["name", "owner", "mode", "target"]
+IRREVERSIBLE = {"go-public", "publish", "delete", "history-rewrite", "unknown"}
+NON_GRANT = {"declined", "unset", "revoked"}
+MAX_LEASE_DAYS = 365
+
+# The single normalizer for every scope comparison. Case-SENSITIVE by choice (a capability name is
+# an identifier, not prose) and whitespace-insensitive; the point is that one function decides, so
+# the two sides of a comparison can never drift apart.
+def _norm(s):
+    return str(s).strip()
+
+# H1 FALSY CONTAINERS. `reg or {}` / `classes or []` laundered `false`, `0`, `[]` and a bare
+# `classes:` into a valid-empty registry that exited 0 — the same falsy-collapse defect already
+# fixed on the GRANT side, left unfixed here. Half a fix propagated is a hole. Sentinel, then type,
+# then default — and an empty registry is stated as N/A, never as a clean pass.
+if not isinstance(reg, dict):
+    print(f"consent-registry: FAIL — registry root is {type(reg).__name__}, not a mapping; fail-closed")
+    sys.exit(1)
+if "classes" not in reg:
+    print("consent-registry: FAIL — registry has no `classes` key; fail-closed")
+    sys.exit(1)
+classes = reg["classes"]
+if classes is None:
+    classes = []
+if not isinstance(classes, list):
+    print(f"consent-registry: FAIL — `classes` is {type(classes).__name__}, not a list; fail-closed")
+    sys.exit(1)
+if not classes:
+    print("consent-registry: N/A — registry declares zero classes; promotion DISABLED (not a PASS)")
+    sys.exit(3)   # UNMEASURED, not verified — see EXIT CONTRACT
+
+by_name = {}
+for i, c in enumerate(classes):
+    if not isinstance(c, dict):
+        out("❌", f"R1 class #{i} is not a mapping"); fails += 1; continue
+    nm = c.get("name", f"<unnamed #{i}>")
+    missing = [f for f in REQUIRED if f not in c]
+    if missing:
+        out("❌", f"R1 `{nm}` missing required field(s): {', '.join(missing)}"); fails += 1
+        continue
+    # R1-b STRICT TYPES. `promotion_eligible: "false"` (quoted) is a truthy STRING, so every
+    # eligibility test below silently inverts and an intended-ineligible class becomes promotable.
+    # Measured 2026-07-29 against a control: quoted "false" PASSed a grant that real `false` blocked.
+    # One quote character disarmed the floor — so the type is checked, not coerced.
+    if not isinstance(c["promotion_eligible"], bool):
+        out("❌", f"R1-b `{nm}` promotion_eligible must be a YAML boolean, got "
+                  f"{type(c['promotion_eligible']).__name__} {c['promotion_eligible']!r} "
+                  f"(a quoted \"false\" is truthy and would invert the floor)")
+        fails += 1; continue
+    # H2 scalar fields: a `mode: 123` or `target: ""` described nothing, so the entry a human was
+    # asked to review as a grant-of-future-autonomy was unreadable. H3 list ITEMS were never typed,
+    # only their container — `sinks: [123]` counted as a declared sink.
+    bad_field = False
+    for fld in STR_FIELDS:
+        if not isinstance(c[fld], str) or not c[fld].strip():
+            out("❌", f"R1-b `{nm}` `{fld}` must be a non-blank string, got "
+                      f"{type(c[fld]).__name__} {c[fld]!r}")
+            fails += 1; bad_field = True
+    for fld in ("capabilities", "sinks", "feeds"):
+        if not isinstance(c[fld], list):
+            out("❌", f"R1-b `{nm}` `{fld}` must be a list, got {type(c[fld]).__name__}")
+            fails += 1; bad_field = True
+        elif not all(isinstance(x, str) and x.strip() for x in c[fld]):
+            out("❌", f"R1-b `{nm}` `{fld}` must contain only non-blank strings, got {c[fld]!r} "
+                      f"— an unreadable sink is an UNDECLARED sink, and undeclared is unknown")
+            fails += 1; bad_field = True
+    if bad_field:
+        continue
+    # R1-c UNIQUE NAMES. Consent is keyed by class name; a duplicate silently shadowed the earlier
+    # entry, so appending an eligible twin below an ineligible one granted the ineligible class.
+    if nm in by_name:
+        out("❌", f"R1-c duplicate class name `{nm}` — consent is keyed by name, so a duplicate "
+                  f"shadows the earlier entry and can launder an ineligible class")
+        fails += 1; continue
+    by_name[nm] = c
+    # R2 — eligibility must be SOUND, not merely asserted. This is the line that stops a class from
+    # declaring itself promotable while naming an irreversible sink two fields above.
+    taint = set(map(str, c["sinks"] or [])) | set(map(str, c["feeds"] or []))
+    bad = taint & IRREVERSIBLE
+    # R2-b — the CAPABILITY field is part of the floor too. Until 2026-07-31 IRREVERSIBLE was
+    # intersected ONLY with sinks|feeds, so a class could DECLARE `capabilities: [history-rewrite]`
+    # outright and stay promotable as long as it named no sink: R2 saw an empty taint and R7's
+    # effect-subset rule then CONFIRMED the grant, because the effect really was a subset of the
+    # declared capabilities. The gate agreed with itself all the way to exit 0.
+    # R2's own comment above says "naming an irreversible SINK two fields above" — the guard was
+    # written against the sink field and the capability field was never in its scope. Sinks are
+    # where an effect LEAKS; capabilities are what the class is allowed to DO, and the floor cares
+    # about both. Checked separately from `bad` so the message names which field carried it.
+    # Found by codex/gpt-5.6-sol in round 9; the local canary returned CONVERGED on the same diff.
+    # `_norm`, not raw str(): R7 reads this SAME field through _norm, and the first cut of R2-b
+    # compared raw strings, so ` history-rewrite ` evaded R2-b while R7 still recognised it. One
+    # field with two spellings is the divergent-normalizer class, and it is the shape that turns a
+    # floor into decoration. Residual, named rather than fixed here: _norm strips whitespace but
+    # does NOT case-fold, so `History-Rewrite` still evades BOTH R2-b and R7 — case-folding would
+    # change R7's semantics too and belongs in its own change with its own lanes.
+    cap_bad = {_norm(x) for x in (c["capabilities"] or [])} & IRREVERSIBLE
+    if c["promotion_eligible"] and bad:
+        out("❌", f"R2 `{nm}` claims promotion_eligible:true but sinks/feeds include {sorted(bad)}")
+        fails += 1
+    elif c["promotion_eligible"] and cap_bad:
+        out("❌", f"R2-b `{nm}` claims promotion_eligible:true but declares irreversible "
+                  f"capabilities {sorted(cap_bad)} — an irreversible act is not made reversible by "
+                  f"having no declared sink")
+        fails += 1
+    elif c["promotion_eligible"] and taint:
+        out("❌", f"R2 `{nm}` claims promotion_eligible:true with non-empty sinks/feeds {sorted(taint)} "
+                  f"— unlisted sinks are UNKNOWN, and unknown is not reversible")
+        fails += 1
+
+if fails == 0:
+    out("✅", f"R1/R2 registry schema + eligibility soundness ({len(by_name)} class(es))")
+
+# ---- standing_consent side --------------------------------------------------------
+if not os.path.exists(uap_path):
+    print(f"consent-registry: N/A — no UAP at {uap_path}; nothing granted (not a PASS)")
+    # A registry failure still outranks: BROKEN beats UNMEASURED, because a broken registry is a
+    # decided negative while an absent UAP is merely nothing to join.
+    sys.exit(1 if fails else 3)
+
+raw = open(uap_path, errors="replace").read()
+# ---- the ONE machine-read region: YAML frontmatter ---------------------------------
+# STORAGE-FORM CHANGE, operator decision 2026-07-31. What stood here was a line-slicer that scraped a
+# `standing_consent:` key out of markdown prose. It was not under-engineered — it had absorbed
+# first-match shadowing, key-spacing equivalence, inline-vs-block forms, falsy-sentinel laundering,
+# duplicate keys, and explicit-key form. It still lost, and the shape of the losing was the tell:
+# every special case it closed opened the next one — loader-identity → nested key → explicit-key →
+# comment-vs-heading, THREE of them in a single day (2026-07-31), one of which the fixing session
+# introduced itself while fixing the previous.
+#
+# The root was never slicer quality. It was that a machine field lived in markdown, where `#` and
+# indentation carry different meaning to YAML than to markdown, so every disambiguation rule had to
+# guess which language a line was written in. Frontmatter deletes the DECISION, not merely this
+# implementation: "the first `---` block at the top of the file" has exactly one referent, so there
+# is no next special case to lose to. The region is handed to the canonical loader whole.
+#
+# What this also retires: the measured merge-key OVER-BLOCK (`defaults: &d` + `<<: *d` was refused
+# because the anchor lived outside the extracted fragment). Anchors now resolve normally — the
+# fragment IS the document. Over-blocking was a real defect here, not a safety win: it trains the
+# override reflex and turns a gate into decoration.
+#
+# Fail-closed direction is UNCHANGED, and one net is deliberately kept and generalized: a grant that
+# exists where nothing reads it must never report as "nothing granted". That is a false clean, the
+# worst outcome for a floor.
+grants = {}
+# The opening/closing fence must accept every shape the CANONICAL loader accepts, or this regex
+# quietly becomes a second, stricter grammar sitting in front of the loader — the exact defect the
+# storage-form change was made to retire. Cross-family review 2026-07-31 measured five valid YAML
+# stream forms this pattern rejected: a `...` document terminator, a `#` comment on the opening or
+# closing fence, a `%YAML` directive, and — worst, because a lane claimed to cover it — the EMPTY
+# block `---\n---`, which the first version could not match at all (it consumed the opening newline
+# and then demanded another before the closing fence). All four rejections failed CLOSED, so no
+# grant leaked; but each was an OVER-BLOCK whose message blamed a missing frontmatter that was in
+# fact present, and a gate that misdirects the fix gets overridden.
+#   %YAML directives -> allowed before the opening fence
+#   opening/closing fence -> may carry trailing spaces and a # comment
+#   closing fence -> `---` OR `...` (both end a YAML document)
+#   body -> may be empty
+# BOM-tolerant too: a leading  would otherwise make the region look absent — safe, but for a
+# misleading reason.
+_FM = re.compile(
+    r"\A?(?:%[^\n]*\r?\n)*"           # optional %YAML / %TAG directives
+    r"---[ \t]*(?:\#[^\n]*)?\r?\n"       # opening fence (+ optional comment)
+    r"(.*?)"                             # body (possibly empty)
+    r"(?:\r?\n)?"                        # the body's own trailing newline, if it has one
+    r"^(?:---|\.\.\.)[ \t]*(?:\#[^\n]*)?(?:\r?\n|\Z)",   # closing fence: --- or ...
+    re.S | re.M)
+_fm_match = _FM.match(raw)
+if _fm_match is None:
+    # No machine region at all. A UAP predating this format legitimately has none, so absence alone
+    # is "nothing granted" — but if the prose MENTIONS standing_consent, someone wrote a grant into a
+    # region no parser reads. Fail closed: that is the false-clean case, not an absence.
+    if re.search(r"standing_consent", raw):
+        out("❌", "R3 `standing_consent` appears in the UAP but the file has no YAML frontmatter — "
+                  "a grant written outside the machine region is never read; fail-closed")
+        fails += 1; grants = None
+else:
+    try:
+        # NoDupLoader, same as the registry side: yaml.safe_load is last-wins on duplicate keys, so
+        # `expires: 2020-01-01` followed by `expires: 2099-01-01` would silently keep the future one.
+        _fm = yaml.load(_fm_match.group(1), Loader=NoDupLoader)
+    except Exception as e:
+        out("❌", f"R3 UAP frontmatter unparseable ({e}); fail-closed"); fails += 1; grants = None
+    else:
+        if _fm is None:
+            _fm = {}                # an empty frontmatter block is a real empty mapping
+        if not isinstance(_fm, dict):
+            out("❌", f"R3 UAP frontmatter is not a mapping ({type(_fm).__name__}); fail-closed")
+            fails += 1; grants = None
+        elif "standing_consent" not in _fm and \
+                re.search(r"""^[ \t]*(?:["']?)standing_consent(?:["']?)[ \t]*:""",
+                          raw[_fm_match.end():], re.M):
+                # Quoted spellings included: YAML reads `"standing_consent":` as the identical key,
+                # so a bare-key-only net would miss a grant written that way in prose and report
+                # "nothing granted" — the false clean this net exists to prevent (cross-family
+                # 2026-07-31). The F1 net above already matched quoted forms via substring search;
+                # this one was anchored and did not, so the two nets disagreed on the same input.
+            # Frontmatter exists but the grant was written BELOW it, in prose. Same false-clean as
+            # above: the machine region is authoritative, so an unread grant is not an absent one.
+            # RESIDUAL — MEASURED OVER-BLOCK RISK (named, not silently accepted): this net is a
+            # regex over the prose region, so a DOCUMENTATION EXAMPLE of `standing_consent:` in the
+            # body — including inside a fenced code block — trips it and fails the file closed. The
+            # trade was taken deliberately: the false-clean it prevents is silent, while this
+            # over-block is loud and its message names the fix. But over-blocking is a defect of the
+            # same weight as a fail-open (it trains the override reflex), so if a real UAP ever needs
+            # to document the key, exclude fenced regions here rather than deleting the net.
+            out("❌", "R3 `standing_consent` is written in the UAP prose region but absent from the "
+                      "frontmatter — the frontmatter is authoritative; fail-closed")
+            fails += 1; grants = None
+        else:
+            # NO `or {}` here. `[] or {}` / `False or {}` / `0 or {}` all evaluate to `{}`, which
+            # would reach the type check already laundered into a valid-empty mapping — so a
+            # `standing_consent: []` would report "nothing recorded" while the truthy `[a, b]` was
+            # caught (measured with that control, cross-family round 5). Sentinel first, type check
+            # second, defaulting last.
+            grants = _fm.get("standing_consent", {})
+            if grants is None:
+                grants = {}         # an explicitly empty `standing_consent:` key is a real empty set
+            if not isinstance(grants, dict):
+                out("❌", f"R3 standing_consent is not a mapping ({type(grants).__name__}); fail-closed")
+                fails += 1; grants = None
+
+if grants is None:
+    pass
+elif not grants:
+    out("✅", "R3-R6 no standing consent recorded (nothing to validate)")
+else:
+    today = datetime.date.today()
+    validated = 0
+    for name, g in grants.items():
+        # H4 grant key: registry `name: 123` + UAP `123:` used to join fine because neither side was
+        # typed. Both sides are strings or the join is meaningless.
+        if not isinstance(name, str) or not name.strip():
+            out("❌", f"R3 grant key {name!r} must be a non-blank string"); fails += 1; continue
+        # `declined` / `unset` / `revoked` are first-class states in this storage model, not grants.
+        # Coercing them into `{"granted": ...}` turned a legitimate refusal into a malformed grant
+        # and reported violations against a user who said no.
+        if isinstance(g, str) and g.strip().lower() in NON_GRANT:
+            continue
+        if not isinstance(g, dict):
+            out("❌", f"R3 `{name}` has value {g!r} — not a grant mapping and not one of "
+                      f"{sorted(NON_GRANT)}; fail-closed")
+            fails += 1; continue
+        # Normalize identically to the scalar branch above. Without .strip() a `state: "revoked "`
+        # fell through and was validated as an ACTIVE grant (cross-family round 4) — two spellings of
+        # the same state judged by two different normalizers is the divergent-normalizer class.
+        # H6 UNKNOWN STATE. Only the three canonical states were recognized; anything else — a typo
+        # like `revokedd`, or a state a future version adds — fell through and was validated as an
+        # ACTIVE grant. A record whose state we cannot read is not a grant we may honour.
+        if "state" in g:
+            st = g["state"]
+            if not isinstance(st, str) or st.strip().lower() not in (NON_GRANT | {"granted"}):
+                out("❌", f"R3 `{name}` has unrecognized state {st!r} — expected one of "
+                          f"{sorted(NON_GRANT | {'granted'})}; fail-closed")
+                fails += 1; continue
+            if st.strip().lower() in NON_GRANT:
+                continue
+        validated += 1
+        c = by_name.get(name)
+        if c is None:
+            out("❌", f"R3 `{name}` granted but NOT in the registry (unregistered == unknown)"); fails += 1; continue
+        if not c.get("promotion_eligible"):
+            out("❌", f"R4 `{name}` granted but registry says promotion_eligible:false"); fails += 1; continue
+        # H5 `granted` was never checked at all — a grant with no grant date cannot be audited
+        # against the three approvals that were supposed to produce it.
+        def _date(v, fld):
+            if isinstance(v, datetime.date):
+                return v
+            if isinstance(v, str) and re.fullmatch(r"\d{4}-\d{2}-\d{2}", v.strip()):
+                try:
+                    return datetime.date.fromisoformat(v.strip())
+                except ValueError:
+                    return None
+            return None   # ints like 29991231 are NOT dates; basic-format parsing accepted them
+        gd = _date(g.get("granted"), "granted")
+        if gd is None:
+            out("❌", f"R5 `{name}` has missing or non-ISO `granted` ({g.get('granted')!r}) — "
+                      f"expected YYYY-MM-DD"); fails += 1
+        elif gd > today:
+            # A consent dated in the future has not been given. `granted: 2099-01-01` passed.
+            out("❌", f"R5 `{name}` is `granted` {gd}, in the FUTURE — a consent that has not "
+                      f"happened yet cannot authorize anything"); fails += 1
+        exp = g.get("expires")
+        if exp is None:
+            out("❌", f"R5 `{name}` granted with no `expires` — standing consent is a lease, not a transfer"); fails += 1
+        else:
+            d = _date(exp, "expires")
+            if d is None:
+                out("❌", f"R5 `{name}` has non-ISO expires={exp!r} — expected YYYY-MM-DD "
+                          f"(`29991231` parsed as a date under basic-format rules and slipped through)")
+                fails += 1
+            elif d < today:
+                out("❌", f"R5 `{name}` expired {d} — must lapse to unset, not keep running"); fails += 1
+            # H7 LEASE BOUND. `expires: 9999-12-31` satisfied "has an expiry" while defeating the
+            # entire point of one. A lease longer than the maximum is a transfer wearing a lease's
+            # clothes.
+            elif gd is not None and (d - gd).days > MAX_LEASE_DAYS:
+                out("❌", f"R5 `{name}` lease is {(d - gd).days} days (max {MAX_LEASE_DAYS}) — "
+                          f"an unbounded expiry is a transfer, not a lease"); fails += 1
+        # R6 — a grant with no recorded scope can never be re-validated against a drifted action.
+        # R6 — presence AND type. The registry side got strict types at R1-b; the grant side did not,
+        # so `effects: true` / `target: 123` were "recorded" and passed while a MISSING field was
+        # caught (measured with that control, cross-family round 7). Half a fix propagated is a hole:
+        # a baseline that is not a list-of-effects and a real target string cannot be compared against
+        # anything later, which is the entire purpose of recording it.
+        eff, tgt = g.get("effects"), g.get("target")
+        if eff is None or tgt is None:
+            out("❌", f"R6 `{name}` grant records no `effects`+`target` — the subset check has no baseline")
+            fails += 1
+        else:
+            if not isinstance(eff, list) or not eff or not all(isinstance(e, str) and e.strip() for e in eff):
+                out("❌", f"R6 `{name}` `effects` must be a non-empty list of strings, got "
+                          f"{type(eff).__name__} {eff!r} — an uncomparable baseline is not a baseline")
+                fails += 1
+            if not isinstance(tgt, str) or not tgt.strip():
+                out("❌", f"R6 `{name}` `target` must be a non-empty string, got "
+                          f"{type(tgt).__name__} {tgt!r}")
+                fails += 1
+            # R7 STORED-SCOPE SUBSET. The grant recorded its own scope and nothing compared it to
+            # what the registry actually authorizes, so `effects: [repo-mutation]` sat happily under
+            # a `capabilities: [read]` class. This is the mechanizable HALF of the subset rule: it
+            # cannot see a LIVE action (still a runtime obligation, still named as residual), but a
+            # STORED grant wider than its own class is checkable right here — and was not checked.
+            if isinstance(eff, list) and all(isinstance(e, str) for e in eff):
+                # One normalizer, both sides. Before this the grant side was stripped and the
+                # registry side was not, so `[" read "]` matched while `[READ]` did not — whitespace
+                # forgiving, case strict, for no stated reason. Divergent normalizers on the two
+                # sides of a comparison is the same defect class this file already fixed twice.
+                over = sorted({_norm(e) for e in eff} - {_norm(x) for x in c["capabilities"]})
+                if over:
+                    out("❌", f"R7 `{name}` grant claims effect(s) {over} outside its registered "
+                              f"capabilities {c['capabilities']} — the grant is wider than the class")
+                    fails += 1
+            if isinstance(tgt, str) and _norm(tgt) != _norm(str(c["target"])):
+                out("❌", f"R7 `{name}` grant target {tgt!r} does not match the registered target "
+                          f"{c['target']!r} — scope drift between grant and class")
+                fails += 1
+    if fails == 0:
+        skipped = len(grants) - validated
+        note = f" ({skipped} non-grant state(s) skipped)" if skipped else ""
+        out("✅", f"R3-R6 all {validated} active grant(s) registered, eligible, unexpired, "
+                  f"scope-recorded{note}")
+
+print("----")
+print(f"consent-registry: {'PASS' if fails == 0 else f'{fails} violation(s)'}")
+sys.exit(0 if fails == 0 else 1)
+PY

package/scripts/fh_session_load.sh

@@ -103,6 +103,22 @@ _fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md"
 # 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
 # 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
 _fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
+# THE SECOND HALF OF THE SAME SCOPE BUG (2026-07-31). The comment above got the principle right —
+# "대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다" — and then widened the predicate by
+# exactly ONE surface (the companion store), leaving it file-only. There are TWO live producers:
+# the launchd file runner AND an app routine that posts the digest as a comment on GitHub issue
+# #102 (measured 2026-07-31: 47 comments, one per day, including today's at 09:09 KST). So on a day
+# when the file runner fails, today's digest EXISTS and the hook said "부재가 아니라 실패다" — a
+# true statement about this disk stated as a claim about the digest.
+# The fix is NOT to call the network from a SessionStart hook (it must never block turn 0 and must
+# never fail on an offline node). It is to stop over-claiming: report the scope actually measured
+# ("this node's file output failed") and NAME the surface not measured, so the reader checks it in
+# one step instead of re-running a job whose output already exists elsewhere.
+_fd_issue_note() {
+  echo "    ⓘ 파일만 본 판정이다 — 오늘치는 **GH issue #102**(앱 routine, 매일 ~09:09 KST)에 이미 있을 수 있다."
+  echo "      확인: gh issue view 102 --repo chrono-meta/forge-harness --comments | tail -40"
+  echo "      → 파일 재생성이 필요한지는 그걸 보고 판단하라. '오늘은 뉴스 없음'으로 읽지 말 것."
+}
 if _fd_ready; then
   # 로컬엔 없고 컴패니언에만 있으면 = 이 노드는 러너가 아니다. 침묵하면 토폴로지가 안 보이므로 한 줄 알린다.
   if ! _fd_hit "$FH/tracks/_meta"; then
@@ -125,15 +141,38 @@ elif [ -f "$_FD_LOG" ]; then
   if [ -n "$_FD_ALIVE" ]; then
     echo "ℹ️  [frontier-digest] 잡이 아직 돌고 있는 중일 수 있다($_FD_STAMP, $_FD_ALIVE) — 실패 판정 보류, 나중에 재확인."
   else
-    echo "⚠️  [frontier-digest] 오늘 잡은 돌았는데 **산출물이 없다**($_FD_STAMP) — 부재가 아니라 실패다."
+    echo "⚠️  [frontier-digest] **이 노드의 파일 산출**이 실패했다($_FD_STAMP) — 부재가 아니라 실패다."
     echo "    마지막 로그: $(tail -1 "$_FD_LOG" 2>/dev/null | cut -c1-90)"
-    echo "    → 수동 재실행하거나 실패 원인을 보라. '오늘은 뉴스 없음'으로 읽지 말 것."
+    _fd_issue_note
   fi
 else
-  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 파일 산출물도 없다($_FD_STAMP) — 이 노드에서 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  _fd_issue_note
 fi
 # (BE is resolved at the top of this script — the frontier-digest block above needs it too.)
 
+# 1-b) Weekly-audit cadence — mechanical, for the same reason the frontier-digest block above is.
+# MEASURED 2026-07-31: operations.md §Session start auto-detection (L1) promises "propose the audit
+# if 7+ days elapsed", and the audit had not run for FIFTY days. The frontier-digest cadence, which
+# is instrumented, never went a day unnoticed over the same window. The difference is not
+# importance; it is that one cadence is a hook and the other is prose, and this repo's own N=3
+# escalation rule says to instrument rather than to add a habit. One line in a hook that already
+# runs, not a new mechanism. Advisory by design: an overdue audit is not an irreversible surface,
+# so it surfaces and never blocks. Silent when current, and silent when the dir does not exist
+# (a fresh clone has no audit history and must not be nagged about one).
+_AUDIT_DIR="$FH/tracks/_audit"
+if [ -d "$_AUDIT_DIR" ]; then
+  _LATEST_AUDIT="$(find "$_AUDIT_DIR" -maxdepth 1 -name 'weekly_audit_*.md' -print 2>/dev/null \
+                   | sort | tail -1)"
+  if [ -n "$_LATEST_AUDIT" ]; then
+    _AUDIT_AGE_D=$(( ( $(date +%s) - $(_mtime "$_LATEST_AUDIT") ) / 86400 ))
+    if [ "$_AUDIT_AGE_D" -ge 7 ]; then
+      echo "🗓️  [weekly-audit] 마지막 감사가 ${_AUDIT_AGE_D}일 전이다($(basename "$_LATEST_AUDIT")) — 캐던스는 7일."
+      echo "    → /harvest-loop (lightweight) 또는 operations.md §Weekly Improvement Cycle 수동 절차."
+    fi
+  fi
+fi
+
 # Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
 [ -d "$BE/.git" ] || exit 0