@chrono-meta/fh-gate 1.4.78 → 1.4.80

package/templates/consent_classes.yaml.example

@@ -0,0 +1,75 @@
+# consent_classes.yaml — the consent-class registry.
+#
+# Copy to `tracks/_meta/consent_classes.yaml` (gitignored, per-environment) to enable
+# accept-side consent promotion. See `knowledge/shared/rules/operational_adaptation.md`
+# §Consent promotion.
+#
+# WHY A REGISTRY AT ALL (cross-family review, 2026-07-29)
+#   The first draft let the running session name the class it was counting approvals against.
+#   That defeats the class-inflation guard before it fires: the class does not need to be WIDENED
+#   later if it was born wide. Recording three approvals as `sim-conductor` instead of
+#   `dispatch read-only sim on a local artifact` silently grants every future sim-conductor mode.
+#   So classes are DECLARED here, reviewed by a human, and the session may only count against
+#   an entry that already exists. A session may propose a new entry; it may not mint one mid-run.
+#
+# THE FLOOR IS READ FROM THIS FILE, NOT JUDGED AT RUNTIME
+#   `sinks` is the field the irreversibility floor is decided from. A session asking itself
+#   "is this reversible?" is the wrong arbiter — it is the party that wants to stop being asked.
+#   Absent entry / absent file / unparseable entry => NO promotion, keep asking. Unknown is not
+#   reversible.
+#
+# TAINT
+#   A class inherits the floor if it FEEDS an irreversible sink, not only if it crosses one.
+#   `local-commit` below is the worked example: committing is locally reversible, but if a
+#   post-commit hook, sync daemon, or CI workflow publishes from that commit, the chain crossed
+#   go-public and the class must be marked tainted. Declare `feeds:` honestly — the whole point
+#   is that no single step in a bad chain looks dangerous on its own.
+
+classes:
+  # ---- promotion-eligible example -------------------------------------------------
+  - name: dispatch-readonly-sim-local-artifact
+    owner: fh-meta:sim-conductor          # the gate/skill that does the asking
+    mode: blind-target-tier-sim
+    target: a single local file under the current repo
+    capabilities: [read, dispatch]        # read · local-write · network · dispatch · repo-mutation
+    sinks: []                             # crosses nothing irreversible
+    feeds: []                             # enables/queues nothing irreversible
+    promotion_eligible: true
+    lease_days: 30                        # standing consent is a renewable lease, never permanent
+
+  # ---- NOT promotion-eligible: sink is irreversible --------------------------------
+  - name: npm-publish
+    owner: Pre-Publish Surface Gate
+    mode: registry-publish
+    target: the package tarball file set
+    capabilities: [read, network]
+    sinks: [go-public]                    # irreversible => never promotes, at any count
+    feeds: []
+    promotion_eligible: false
+    reason: "publish is effectively irreversible — a package is live the instant it ships and may
+             be cached or forked before any scrub (CLAUDE.md §Pre-Publish Surface Gate)."
+
+  # ---- NOT promotion-eligible: TAINTED (this is the one that looks safe) -----------
+  - name: local-commit
+    owner: FH 4-axis commit gate
+    mode: git-commit
+    target: the working tree
+    capabilities: [local-write, repo-mutation]
+    sinks: []                             # committing itself is reversible
+    feeds: [go-public]                    # ...but CI/sync publishes from it
+    promotion_eligible: false
+    reason: "taint — reversible in isolation, feeds an irreversible sink. Every step in the
+             workflow-edit -> release-notes -> commit -> CI-publish chain is individually
+             reversible; the chain is not."
+
+  # ---- NOT promotion-eligible: unclassified ---------------------------------------
+  - name: run-arbitrary-shell
+    owner: (none — catch-all)
+    mode: unrestricted
+    target: unbounded
+    capabilities: [read, local-write, network, dispatch, repo-mutation]
+    sinks: [unknown]                      # unknown is NOT reversible
+    feeds: [unknown]
+    promotion_eligible: false
+    reason: "sinks cannot be enumerated, so the floor cannot be decided mechanically. A class
+             whose blast radius is unbounded is never a candidate, regardless of approval count."

package/templates/settings.PreToolUse.snippet.json

@@ -0,0 +1,49 @@
+{
+  "_README": [
+    "PreToolUse(Bash) hook snippet — TRACKED, so it arrives with a clone. Every .claude/settings*.json",
+    "path in this repo is gitignored (confirm with `git check-ignore -v .claude/settings.json`), so a",
+    "hook registration cannot itself be tracked. This is the tracked SOURCE that install-wizard merges",
+    "into the user's local settings. Shipping the file is not the same proposition as wiring it — that",
+    "gap is exactly what #204 found (the SessionStart hook existed from 07-05 and the wizard had never",
+    "installed it, for every new user).",
+    "",
+    "WHAT IT GUARDS: reading a verdict from the wrong end of a pipe. `cmd | tail -5; echo $?` reports",
+    "TAIL's status, so a FAILED gate reads as 0 — a degrade toward PASS, the direction that never",
+    "announces itself. Measured 6x in this project 2026-07-29..07-31.",
+    "",
+    "WHY A HOOK AND NOT A FILE LINTER: the plan of record was an S6 class in degrade_direction_scan.sh.",
+    "Hand-verifying every `pipe + $?` in this repo's scripts returned 7 hits, 7 of them CORRECT. True",
+    "positives in shipped files: 0. All 6 recurrences were in interactively-composed commands, which no",
+    "repo scanner reads. The guard belongs where the defect occurs — the Bash call itself.",
+    "",
+    "ADVISORY BY DESIGN: it warns and exits 0. It never blocks a Bash call, because a mis-read verdict",
+    "is re-runnable, and a false block on a developer's own shell trains the --no-verify reflex on the",
+    "hooks that DO guard irreversible surfaces (pre-push destructive-op, pre-commit confidentiality).",
+    "Escalate deliberately with FH_PIPE_VERDICT_BLOCK=1 if a project wants it to bite.",
+    "",
+    "Carries no private path, so it belongs in .claude/settings.json (project-local), not settings.local.json.",
+    "Merge, do not overwrite: preserve any PreToolUse entries the user already has; replace only the FH",
+    "one, keyed by script name.",
+    "",
+    "Verify after wiring (known pair, both directions):",
+    "  bash scripts/test_pipe_verdict_guard_lanes.sh          # 15 pairs, expect all hold",
+    "  printf '%s' '{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"g.sh | tail; rc=$?\"}}' \\",
+    "    | bash scripts/pipe_verdict_guard.sh                 # expect a PIPE-VERDICT R2 warning"
+  ],
+  "project_settings_json": {
+    "hooks": {
+      "PreToolUse": [
+        {
+          "matcher": "Bash",
+          "hooks": [
+            {
+              "type": "command",
+              "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/pipe_verdict_guard.sh\"",
+              "timeout": 5
+            }
+          ]
+        }
+      ]
+    }
+  }
+}