@chrono-meta/fh-gate 1.4.83 → 1.4.84

package/.claude/rules/fh_4axis_gate.md

@@ -68,6 +68,11 @@ FH asset modified → Axis 1 (templates/regression_guard.sh --pr {BRANCH})
   → Axis 2 (/steel-quench) → Axis 3 (/phantom-quench)
   → marker: tracks/_meta/.axes_23_passed_{branch}_{date}.marker
      (required fields: axis2-engine / axis2-model / floor-status / axis2-evidence;
+      **recorded-by-convention, validated by nothing**: `axis2-rounds` (per-round yield vector) —
+      steel-quench §Convergence Criteria consumes it, and a hook check for it was built and then
+      REMOVED the same day for firing on 100% of markers. The convergence claim it supports is
+      self-attested; that residual is named in §Convergence Criteria, not hidden. Mechanize on the
+      first recurrence of a false convergence claim, not before;
       hook validates mechanically: below-floor blocks without below-floor-ack, and axis2-evidence
       must be non-vacuous — a recorded verdict/count, not "it ran". Marker scope is form +
       non-vacuity + auditability, NOT provenance — a fabricated marker is the weekly-audit + operator
@@ -79,7 +84,7 @@ FH asset modified → Axis 1 (templates/regression_guard.sh --pr {BRANCH})
   → All 4 PASS → git commit allowed   |   Any FAIL → fix inline, re-run
 ```
 
-**Why automatic**: Each axis catches a different defect class; asking separately means slip-through. **Why hook**: CLAUDE.md rules are advisory — the hook physically blocks commit until marker + manifest exist. **Scope**: active from the moment any FH file is modified in the session.
+**Why automatic**: Each axis catches a different defect class; asking separately means slip-through. **Why hook**: CLAUDE.md rules are advisory — the hook physically blocks commit until marker + manifest exist. External anchor: the HANDBOOK.md benchmark (arXiv:2607.25398) measures prose-only SOP compliance failing at frontier scale — canonical harvest with figures: `knowledge/shared/harness-core/gate_locality_principle.md` §external anchors (numbers live there only; a pinned figure in two files rots independently). **Scope**: active from the moment any FH file is modified in the session.
 
 **Lightweight exception** (Axis 1 + 4 only, skip Axes 2–3): Sessions where **zero SKILL.md / rules / templates files changed** (e.g., CATALOG.md entry, tracks/ update). The hook detects this automatically — no Axes 2+3 marker required for light-only commits. Judgment is file-based, not subjective.
 
@@ -200,6 +205,45 @@ judge-only path**, no weak-local-judge regression of the judge-robustness princi
 > model/panel options, the blind-probe procedure, dogfood evidence, and the FAIL-triage (real salience gap
 > vs floor-model quirk) — read when running a floor canary.
 
+### Added-Scope Gate — before you attach anything to a fix
+
+A fix arrives with a stated job. Everything you attach beyond that job is **new surface that the
+adversarial rounds must then verify**, and it is charged to the fix's schedule and to whatever the fix
+was blocking. Before adding, answer two questions in writing:
+
+1. **"What can I not do without this?"** — no immediate concrete answer means it is not needed *here*.
+2. **"Is this the same change?"** — a real answer to (1) that names a *different* job means it is a
+   separate change, not an addition. Ship the fix; open the other thing.
+
+Both must pass. (1) alone is the trap: a genuinely useful addition passes (1) and still belongs
+elsewhere.
+
+**A construct and the wiring that makes it reachable are ONE change.** Question (2) answers *same
+job* for a caller, a hook line, a package-manifest entry, or a propagated copy of the fix — none of
+those is separable scope. Splitting them is not scope discipline, it is
+[[feedback_built_but_not_wired]] and [[feedback_half_fix_propagation_boundary]], which this repo has
+already self-reproduced. If you build a checker and defer its caller, you shipped prose. The gate
+below trims what you *attached*; it never licenses shipping something unreachable.
+
+**Measured 2026-08-02 (PR #231).** The stated job was one flaky test lane — a blocker holding two
+other PRs. Attached to it: a production advisory probe, its hook surfacing, a new caller wiring, and a
+measurement probe. Each passed (1) on its own. Round-by-round attribution of the 12 adversarial
+findings: round 1's 4 were in the original fix; **rounds 2, 3 and 5 found defects exclusively in code
+the previous round had added**, and 2 of the cross-family round's 3 traced to the attached scope. The
+original fix needed roughly one round. The other four rounds were the bill for scope that would have
+passed (2) as its own change. The additions were not wrong — bundling them was.
+
+Read that example precisely: the splittable items were the **advisory probe and its measurement** —
+a new capability with its own job. The *hook line that surfaced the probe* and the *caller that
+invoked the new anchor* were not splittable and were correctly shipped **with the probe, into
+whichever change carries the probe** — not left behind in the fix, which would ship a hook line that
+surfaces nothing.
+
+**Relationship to Wave-T (`steel-quench`)**: Wave-T measures complexity the *quench* added, after
+convergence. This fires earlier and on a different axis — scope the *author* added, at authoring time.
+Do not collapse them; a change can pass Wave-T (every construct traces to a finding) and still have
+been the wrong change to bundle.
+
 **Axis ownership** (each skill is already complete — orchestrator only coordinates):
 
 | Axis | Skill | What it catches |

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.83",
+      "version": "1.4.84",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.83",
+      "version": "1.4.84",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CATALOG.md

@@ -4,6 +4,28 @@ AI reads this file first when searching past work. Open individual files for det
 
 ---
 
+## 2026-08-01 — Harness-Verification Doctrine: core lens vs cluster instruments
+
+- **New doctrine** (`knowledge/shared/harness-core/harness_verification_core_extended.md`): the
+  incubator's verification axis, graduated from the field→meta reverse-verification arc (one day,
+  four runs, two subjects; FH-side runs known-pair-calibrated, the company-side replication's
+  calibration record stays company-side). First clause: *harness-verification core =
+  the FH-native triad-consistency lens (spec ↔ implementation ↔ TC), askable with no cluster member
+  present; extended = cluster instruments (trace auditors, process-fidelity harnesses), composed by
+  UNION* — the Sonnet-Floor shape applied to verification.
+- **Evidence**: a field QA harness's audit doctrine, context-decorrelated, found 7 novel grounded
+  findings on an FH slice (all in the triad-disagreement class) and replicated on a second subject
+  (7 more, 3 fixed same-day); a three-instrument UNION run measured **static↔trace** finding-class
+  intersection zero (between extended instruments disjointness is partial — scope-corrected same day
+  by cross-family audit); a mechanized transcript adapter addressed the self-attested-trace residual
+  same-day (its own audit-integrity limits are pilot-grade — Run #4 backlog).
+- **Companions updated**: `harness_incubator_doctrine.md` §3-b (the nursery also verifies what it
+  births) · `CLAUDE.md §Identity` one-clause summary.
+- **Honest labels**: the core lens is doctrine-level today (dispatched-procedure route; no native
+  carrier asset yet — named residual, next build is evidence-threshold-gated). Subjects = 2, trace
+  pairs = 1.
+- Tags: `doctrine` `verification` `reverse-verification` `union` `cluster` `triad-consistency`
+
 ## 2026-07-26 — Scan logic single-sourced · FH_BACKEND=cross · v1.4.72
 
 - **Single-sourcing** (`scripts/psa_scan_lib.sh`): three near-duplicate implementations of
@@ -109,7 +131,7 @@ Two operator insights forged into doctrine. **Intent Marshaling** (PR #161, mirr
 > **Backfill note (2026-07-15):** the 07-12 / 07-13 / 07-14 entries below were reconstructed from git
 > history + the session card's completion log during the 2026-07-15 harness-doctor run, which found that
 > CATALOG had stopped at 07-10 while 30 FH-asset commits landed — i.e. 5 days of work were invisible to
-> the CATALOG-first search protocol (CLAUDE.md §Searching Past Work). They are commit-grounded, but they
+> the CATALOG-first search protocol (CLAUDE.md §Autonomous Initiative (CATALOG-first recall row)). They are commit-grounded, but they
 > are *reconstructions*, not first-hand session records: the "Decision/Open" lines carry only what the
 > commits and card state, so a judgment made in-session but never written down is not recoverable here.
 > The gap itself is the lesson — Comprehension Debt accrues silently when the close chain's CATALOG step

package/CHEATSHEET.md

@@ -453,7 +453,7 @@ Claude agents feature
 
 | Skill | What it does | Say this |
 |---|---|---|
-| `steel-quench` | All-angle adversarial attack on a design/output, then defense, until zero new blockers | "run the quench", "attack from the root", "shake out the design anxiety" |
+| `steel-quench` | All-angle adversarial attack on a design/output, then defense, until a round finds nothing new AND needs no repair | "run the quench", "attack from the root", "shake out the design anxiety" |
 | `phantom-quench` | Back-traces every claim to its declared source; flags **Phantom Claims** (present in the artifact, not in the source). *Old name: `source-grounding-audit`.* | "verify the source", "where did this come from", "grounding audit", "phantom check" |
 | `verify-bidirectional` | Re-checks a decision from the opposite direction + folds your counter-argument into the baseline | "is that right?", "double-check this", "give me the counterargument" |
 | `convergence-loop` *(commons)* | Re-runs a gate until a round adds zero new failures — "truly passed", not "passed once" | "a single pass seems suspicious", "loop until it converges" |

package/CLAUDE.md

@@ -30,7 +30,11 @@ existing harnesses) in its own sandbox — expensive per run, cheaper in total b
 pools and compounds — and **emits** them as independent specialized harnesses (shipped today as
 scaffold + approval machinery; the full chamber flow is the named target). Over other harnesses it
 operates in two modes: **compose** (cluster strengths) ∪ **disrupt** (melt and reforge via crucible;
-core invariants never melt). Full doctrine: `knowledge/shared/harness-core/harness_incubator_doctrine.md`.
+core invariants never melt). The nursery also **verifies what it births**: harness-verification
+**core** = the FH-native triad-consistency lens (spec↔implementation↔TC, cluster-independent) ·
+**extended** = cluster instruments composed by UNION
+(`knowledge/shared/harness-core/harness_verification_core_extended.md`). Full doctrine:
+`knowledge/shared/harness-core/harness_incubator_doctrine.md`.
 
 | Layer | Role | Representative Assets |
 |---|---|---|
@@ -313,11 +317,13 @@ pipeline**, not an afterthought, and a below-floor orchestrator RUNS the review
 ## Field-Harness Diagnostic — "진단해줘 / 개선해줘" on a mapped project (compose → rank → HITL)
 
 The **on-demand pull sibling** of the gate above: a *project-level* "diagnose / improve this harness" ask
-composes the checks FH **already has** across **seven lenses** — leak (`/public-surface-audit`, incl. **Step 3c ignore-verification** — a file believed gitignored but actually tracked is the leak this sub-step exists to catch) · split
+composes the checks FH **already has** across **eight lenses** — leak (`/public-surface-audit`, incl. **Step 3c ignore-verification** — a file believed gitignored but actually tracked is the leak this sub-step exists to catch) · split
 integrity (`/phantom-quench` **Step 2.7**) · token/salience (`/context-doctor` · `/salience-splitter`) · structure
 (`/harness-doctor`) · verdict degrade (`scripts/degrade_direction_scan.sh`) · loop-readiness
 (`loop_engineering.md`) · built-but-unwired (per-module caller grep — a completed module with zero
-external call sites; the dominant class of the 2026-08-01 qasp audit) — into **one ranked `M`/`S`/`R`
+external call sites; the dominant class of the 2026-08-01 qasp audit) · triad consistency
+(spec↔implementation↔TC agreement — `harness_verification_core_extended.md` §2 dispatched-procedure
+recipe, cluster-independent core lens) — into **one ranked `M`/`S`/`R`
 list**. No-reinvention: it only routes and ranks.
 
 **Resident guards (do not defer these to the detail file)**: **nothing is auto-fixed** — the list is the

package/knowledge/shared/harness-core/field_harness_diagnostic.md

@@ -24,6 +24,7 @@ is HITL — the diagnostic **proposes**, never auto-edits.
 | **Loop-readiness** (황민호 loop-eng 5-question lens, 2026-07-10 — detail home: `loop_engineering.md`, incl. the FH loop inventory + design-time discipline) | *Loop-runtime axis — net-new vs Structure* (harness-doctor scans static form; this scans whether the path closes a loop). **Mechanical grep**: `/goal-quench`·`/loop` wiring present · check-class token declared. **Judged**: is the persisted state (card/handoff/memory) actually reloaded · is the declared check-class anchored, not judged-only · does the path halt. Done-When *presence* → see Structure row (no double-grep). **Adversarial pair** (for the judged sub-checks — decorrelated, behavior-vs-checklist): a target-tier blind sim that *runs* the path and observes whether it halts + persists, rather than re-checklisting it (the harness litmus shares this lens's axis, so it is a co-lens, not the adversary). | an agent path that *runs but doesn't loop*: no completion criterion (Done-When absent), judged-only validation with no anchor, no halt/budget guard (runaway/cost), or no state carried to the next run — the 5 questions (initiate · complete · validate · halt · persist) with 0 answers |
 
 | **Built-but-unwired scan** (2026-08-01, from the qasp full audit) | **Mechanical grep**: for each module/entry-point under the project's source root, count call/import sites outside its own file and tests — `grep -rn "module_name" --include="*.py" | grep -v "module_file\|tests/"` per module (adapt the include glob per language). 0 external callers on a *completed* module = a finding. **Judged**: is it staged-for-later (documented as such) or genuinely orphaned capability? | the dominant defect class of the 2026-08-01 qasp audit: most M/S prescriptions were not "build new" but **wire what exists** — ET·delivery·feasibility modules complete with ZERO callers. A harness that keeps building finished capability nobody invokes reads as progress while shipping none; harness-doctor's Structure lens sees orphaned *harness units*, this lens sees orphaned *product modules* (net-new axis) |
+| **Triad consistency** (2026-08-01, from the field→meta reverse-verification arc — doctrine home: `harness_verification_core_extended.md` §2, incl. the full dispatched-procedure recipe) | **Dispatched procedure** (no shipped carrier yet — honest label): one context-decorrelated agent over the slice {spec docs · implementations · test suites + every enforcement owner the spec names}, producing a spec-coverage MECE matrix + three-way traceability table + grounded findings; known-pair calibration before trusting output; governor source-grounds each finding. Cluster-independent by doctrine (core lens). | the class every per-asset check misses: **spec ↔ implementation ↔ TC disagreement** — pinned counts rotten against grown suites, orphan implementations with zero spec presence, opt-out semantics drifting between spec text and code comment (7/7 novel findings of the 2026-08-01 FH pilot were in this class; replicated N=2 on a second subject) |
 
 > **Considered-and-held, 7th-lens candidate (2026-07-24)**: the context-quality 7-criteria rubric
 > (arXiv:2607.14275 — role clarity · guardrail coverage · instruction consistency · tool schema ·

package/knowledge/shared/harness-core/harness_incubator_doctrine.md

@@ -157,6 +157,16 @@ authored-case baseline (single-draw per case; reps waived per measurement-integr
 first draw matched expected — see the 2026-07-13 subagent-invocations log entry), not a calibrated
 accuracy estimate.
 
+### 3-b. The nursery also verifies what it births
+
+The incubator's arc does not end at emission: FH **reviews, accelerates, and verifies** the harnesses
+it births or adopts — a verification axis attached to the nursery as an evidenced path (field→meta
+reverse-verification arc, 2026-08-01: a field QA harness's doctrine audited the meta-harness itself,
+N=2 subjects). Boundary rule for that axis: *harness-verification core = the FH-native
+triad-consistency lens (spec ↔ implementation ↔ TC), askable with no cluster member present;
+extended = cluster instruments (trace auditors, process-fidelity harnesses), composed by UNION.*
+Full doctrine: `harness_verification_core_extended.md`.
+
 **Incubation unit — projects AND features**: incubation applies not only to new projects but to **new
 capabilities of an existing harness**. A field harness's self-development is itself run inside the
 meta-harness chamber first, then transplanted — the nursery forges new layers for existing stars, not

package/knowledge/shared/harness-core/harness_verification_core_extended.md

@@ -0,0 +1,167 @@
+# Harness-Verification Doctrine — core lens vs cluster instruments
+
+> Crystallized 2026-08-01 from the field→meta reverse-verification arc (operator-proposed boundary,
+> evidence-gated GO the same day). Companion to `harness_incubator_doctrine.md` — the nursery does not
+> only birth harnesses; it **verifies what it births and accelerates**. Always-loaded summary:
+> `CLAUDE.md §Identity` (one clause). Sibling invariant: `sonnet_floor_doctrine.md` (same shape,
+> different axis).
+
+## 1. The axis this doctrine names
+
+FH's verification of harnesses (its own assets, and the field harnesses it incubates or accelerates)
+has two structurally different sources of lift:
+
+| Mode | What it is | Availability |
+|---|---|---|
+| **Core** | Verification questions FH/PMH can ask **natively, with no cluster member present** — methodology internalized as FH's own lens | Must hold stand-alone (cluster-independent) |
+| **Extended** | Verification **instruments** dispatched from the multi-harness cluster — a field QA harness's audit lens, a trace-boundary auditor, a process-fidelity/judge harness | Available when the cluster member and its consent lane are |
+
+**First clause (the boundary)**: *harness-verification core = the FH-native triad-consistency lens;
+harness-verification extended = cluster instruments.* The operative test is **what discharges the
+capability at the floor**: discharged by a portable methodology or by an asset FH itself ships →
+core; discharge requires a cluster member's running engine → extended. Form (question vs instrument)
+is the usual correlate, not the criterion — and class membership can migrate: a class listed as
+extended today (e.g. trace auditing) becomes core the day FH ships a native carrier for it (the
+pilot's mechanized transcript adapter is exactly such a candidate). **Precedence rule** (the test
+looks through to the discharge dependency): an FH-shipped *thin client* whose verification work is
+actually done by a cluster member's engine is **extended** — shipping a wrapper does not internalize
+a capability; core requires that the discharge **completes with no cluster member present**.
+**Granularity rule** (cross-family probe 2026-08-01 — a tool emitting a local
+`CONDITIONAL_PASS — runtime clauses unmeasured` that upgrades to an unconditional verdict via a
+cluster instrument routes both ways if judged per-tool): route **per verdict, not per tool** — the
+typed partial verdict that completes locally and **names its unmeasured clauses** is core for what
+it measures; the fuller verdict it advertises through cluster resolution is extended. "Completes" =
+emits its declared typed verdict; a verdict silently narrower than declared is neither. And "core"
+names a **requirement placed on the capability, not a certification** that today's route meets it
+at every tier — the floor-conformance question is a named residual (§5).
+
+This is the Sonnet-Floor doctrine's shape applied to verification: base capability must be 100%
+present at the floor (no cluster required); reinforcement is dispatch, never substrate. A
+verification ability that silently requires a cluster member is a tier-gated-capability defect in
+this axis, exactly as a base op that requires Opus is in the model axis.
+
+## 2. The core lens — static triad consistency (spec ↔ implementation ↔ TC)
+
+The internalized question: **"do the spec surface, the implementation, and the test/TC set agree with
+each other?"** — coverage of the *declared contract*, not adversarial pressure on an asset in
+isolation. FH's native verification stack (asset-unit adversarial review, lane suites, phantom/grounding
+audits) structurally does not ask it **in general form**: narrow spec↔repo agreement checkers exist
+(the pre-commit new-skill count-consistency slice, `scripts/count_check.sh`) but they are point
+checks on declared counts, while the triad lens interrogates the **agreement between three
+artifacts** across the whole declared contract. Measured consequence of not asking the general
+question: pinned
+counts rot against grown suites, implementations ship with no spec presence (orphan implementations),
+and opt-out semantics drift between spec text and code comment — none previously caught by the
+per-asset stack (every §4 finding was novel-grounded: absent from prior review records of the same
+files), all found on first application of the lens (see §4).
+
+Why this is *core*, not a borrowed instrument: the lens is a **methodology** (a MECE
+spec-coverage matrix + a three-way traceability table + findings with per-item grounding), learned
+from a field QA harness's protocol doctrine but askable without it. The field harness taught the
+question; it is not needed to ask the question.
+
+**Internalization status (honest label)**: dispatched-procedure level today — the recipe below is
+the public, runnable discharge route; no dedicated FH asset (skill or mechanical spec-sync checker)
+carries it yet. Building that carrier follows the evidence-threshold build discipline: the second
+real demand decides the form. What is already doctrine-binding now: **a "verify this harness"
+engagement must be able to run the triad lens without any cluster member present** — by the recipe
+below if no native asset exists yet. Entry point: the lens is a row in the Field-Harness Diagnostic
+composition (`field_harness_diagnostic.md`), so a "diagnose this harness" ask routes to it without
+anyone recalling this file.
+
+**Dispatched-procedure recipe (public — runnable with no cluster member; pilot-grade provenance,
+§5 scale residual applies)**, the pilot's Step 1 generalized: ① fix the subject slice — spec docs, implementations, their test suites, and
+**mechanically include every enforcement owner the spec names and every test file that references
+the subject** (the pilot's only false findings came from a hand-fed slice omitting these); ②
+calibrate on a known pair before trusting output — one documented-but-uncovered residual the lens
+must independently re-derive, one well-covered region where any reported gap is a false positive; ③
+dispatch one **context-decorrelated** agent loaded with only the slice plus the audit method — a
+spec-coverage MECE matrix (spec clause × covering TC), a three-way traceability table (spec ↔
+implementation ↔ TC, orphans named on all three sides), findings each carrying a file:line ground —
+and forbidden from loading the subject harness's own verification doctrine (the decorrelation is the
+point); ④ the governor source-grounds every finding via a mechanical anchor (grep, execution),
+classifying re-derived / novel-grounded / rejected; ⑤ findings are proposals — HITL, nothing
+auto-fixed.
+
+## 3. The extended mode — cluster instruments, UNION composition
+
+Instruments the cluster contributes are **class-disjoint from the core lens** by observation
+modality; between the extended instruments themselves the disjointness is **partial, not claimed**
+(scope correction 2026-08-01, cross-family audit: the pilot's own record shows one outcome class —
+an unreviewed merge — caught by both trace and process-fidelity instruments, and the process leg
+returned scalar scores rather than a finding inventory, so a three-way class intersection was never
+computable from that data; what the run measured is **static↔trace intersection zero**):
+
+- **Static triad lens** (core, above) — sees spec/implementation/TC disagreement. Principally blind
+  to runtime events: a trace auditor's violation classes do not exist in static artifacts.
+- **Trace/boundary auditors** (extended — e.g. a HarnessAudit-style fence/severity channel over a
+  machine-written transcript) — see runtime boundary violations and blocked attempts. Principally
+  blind to static drift: a rotten spec count is not an event in any trace.
+- **Process-fidelity / judge harnesses** (extended — e.g. a DeepEval-style expected-tool-set +
+  LLM-judge leg) — see procedure deviation; **overlaps trace auditors on some outcome classes**
+  (different mechanism does not make an outcome class disjoint), zero measured overlap with the
+  static class.
+
+Composition rule: **detection composes by UNION** — the model-ensemble union pattern
+(operator-measured, held in operator memory: detection = UNION lift, generation = voting; the
+instrument-level measurement is §4 item 3) generalizes from model diversity to **instrument
+diversity**. Static↔trace blindness is argued from modality (a static artifact defect is not a trace
+event, and vice versa) and measured once (§5); on that argument, reps of one instrument are not
+expected to cover the other's class — adding the other instrument is. Between extended instruments
+the same claim is **not** made (see the scope correction above).
+
+Extended-mode discipline (unchanged invariants, restated for this surface): cluster dispatch rides
+the existing consent lanes and residency rules; instrument findings are evidence candidates until the
+governor source-grounds them via a mechanical anchor (grep/known-pair), never verdicts by agreement;
+and the audit channel must be one the audited session cannot rewrite after the fact (a
+machine-written transcript, not a self-attested action list — the pilot's Run #3 exists because its
+Run #2 violated exactly this and was sealed the same day).
+
+## 4. Evidence base (why this graduated to doctrine)
+
+Four runs, one day (2026-08-01), two subjects; runs 1, 3 and 4 instrument-calibrated FH-side
+(known-pair) before any number was trusted — run 2's calibration record is company-side (item 2
+below):
+
+1. **Run #1 (FH slice)** — the field QA lens, context-decorrelated (the auditing agent read none of
+   FH's verification doctrine), CALIBRATED, produced **7 novel grounded findings** — every one in the
+   spec↔implementation↔TC disagreement class; three S-tier were fixed on a same-day branch.
+2. **Second-subject replication (PMH, company environment)** — the same design reproduced the lift on
+   a different meta-harness: 7 novel grounded findings (1 S · 3 M · 3 R), three fixed same-day.
+   N=2 subjects supports reading the lens as a defect-class detector rather than a one-harness
+   quirk. (Calibration status of this run is recorded company-side only — residency boundary; the
+   FH-side judgment stands on runs 1, 3, 4 alone.)
+3. **Instrument-triple UNION run** — three instruments over one governed/mutant trace pair:
+   discriminating control separated (governed vs mutant) on every instrument; **static↔trace
+   finding-class intersection zero** (the measurable pair — the process-fidelity leg returned
+   scalars, not a finding inventory, so it enters the UNION as a separating instrument but not the
+   intersection measurement). First measurement of the static↔trace disjointness §3 argues (single
+   slice, single pair — the modality argument carries the rest; §5).
+4. **Mechanized trace adapter** — the self-attested-trace residual sealed by extracting actions from
+   the session's machine-written transcript; known-pair PASS, one live false-positive (data-vs-execution
+   confusion) hand-verified and fixed same-day with a regression pair.
+
+Operator-local records (gitignored, referenced for the operator's own audit trail):
+`tracks/_meta/qasp_reverse_verification_run_2026-08-01.md` · `…_run2_2026-08-01.md` ·
+`…/run2_instrument_calibration_2026-08-01.md` · design doc same directory.
+
+## 5. Honest residuals (named, not waived)
+
+- **Scale**: subjects = 2, trace pairs = 1, mutant = synthetic counterfactual; judge separation
+  measured only on a degenerate (trivially-separable) pair. Fine-discrimination (partially-compliant
+  traces) is unmeasured.
+- **Adapter limits**: compound commands collapse to first-match class; quoted-string operation text
+  remains a false-positive reserve; approval detection is keyword-level.
+- **No native carrier yet** for the core lens (see §2 status label) — until one ships, "core" is a
+  doctrine obligation discharged by the §2 recipe, and this gap is the first thing a triad-lens
+  audit of FH itself should re-find.
+- **Floor tier unmeasured**: the pilot runs executed at frontier tier. Whether the §2 recipe holds
+  at the Sonnet floor is unmeasured — per the sibling invariant, the first floor question to close.
+
+## Done When (doctrine doc — reference asset)
+
+- `CLAUDE.md §Identity` clause, `harness_incubator_doctrine.md` §3-b, and this doc tell one
+  consistent story (core/extended boundary stated identically). *Check class: judged; pair:
+  contradiction scan on ingest.*
+- Every mechanism named here points at a real existing asset or is explicitly labeled
+  doctrine-only/unbuilt (§2 status, §5). *Check class: mandatory-pass (phantom scan).*

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -622,3 +622,193 @@
   outcome: accepted
   evidence: "M0/S1/R3. S = same-class stale phrasing in destructive_pre_gate.sh:63 usage comment ('single command') that the diff itself existed to eliminate — fixed same branch. All 4 angles returned evidence, not assertion (grep :83, 3 suite counter prints, JSON tool, ⑤-b never-FAIL)."
   note: "Angle ④ surfaced an accepted trade: count-free refs lose lane-deletion detection — mechanical suite-internal floor named as the right home if wanted."
+- date: 2026-08-01
+  agent: fh-meta:challenger (in-session isolated)
+  task: "Axis-2 adversarial review of harness-verification doctrine landing (new doctrine + 3 companion edits)"
+  mode: sync Agent dispatch, 4 attack angles, gitignored evidence records off-limits by instruction
+  outcome: accepted
+  evidence: "S3/M1/R4, every finding file:line-grounded. S1 boundary dual-criterion (trace-adapter routes both ways), S2 doctrine-binding obligation unwired from the Diagnostic entry point (self-referential P2-08 orphan class), S3 discharge recipe was operator-local-only. All three fixed same branch; 4 attack-failures explicitly recorded (3-face wording consistency held)."
+  note: "S2 is the reverse-verification lens catching the doctrine ABOUT itself — orphan-implementation class re-found by the adversarial pass before commit."
+- date: 2026-08-01
+  agent: claude (Sonnet, blind isolated sim)
+  task: "Target-tier sim: does the doctrine text alone route 3 scenarios correctly at the floor tier"
+  mode: doc-only read, no other files, main-session reasoning not inherited
+  outcome: accepted
+  evidence: "3/3 correct (dispatched-procedure route when no cluster; UNION-not-substitution; no-carrier does not waive core). Quoted the binding sentences verbatim."
+  note: "Ran on pre-fix draft; post-fix text strengthens the same sentences the sim anchored on (no weakening edit)."
+- date: 2026-08-01
+  agent: agy sidecar (gemini-3.6-flash-high; model-echo 'Gemini 3.6 Flash')
+  task: "Cross-family adversarial leg on final doctrine text (3 angles: contradiction / overclaim / boundary ambiguity)"
+  mode: headless agy -p, prompt-inlined document (public content), first-line model echo required
+  outcome: accepted
+  evidence: "6 findings (3 HIGH). HIGH thin-client both-ways construction accepted → discharge-dependency precedence rule added; HIGH core-vs-floor-unmeasured tension accepted → requirement-not-certification clause; HIGH 'established' overclaim softened to first-measurement. 3 remaining absorbed as hedges; 0 dismissed without recorded ground."
+  note: "codex still quota-parked (~8/6); agy carried the cross-family leg, consistent with the 08-01 panel precedent. -m flag invalid — use --model; file-read denied headless — inline the doc."
+- date: 2026-08-01
+  agent: codex sidecar (gpt-5.6-sol, session-header anchored)
+  task: "Leg C — missed-by-both pass on 3 shipped guard scripts + PreToolUse snippet"
+  mode: headless codex exec, reasoning high, prompt-inlined sources, named residuals excluded by instruction
+  outcome: accepted
+  evidence: "HIGH 3 / MED 5 / LOW 1, verdict 'reopen CONVERGED' on a 133-lane-green surface. Governor reproduced HIGH #1 live (checkout -f . = CLEAN, -- . = HIT known-pair). Cross-guard interaction angle returned NONE with docs citation. Fixes deferred to a dedicated branch (HITL)."
+  note: "codex ran its own probes and docs verification — sol-tier depth. Third family reopening a 2-family CONVERGED verdict, second instance today."
+- date: 2026-08-01
+  agent: codex sidecar (gpt-5.6-terra + gpt-5.6-luna, calibration probes)
+  task: "Tier-sufficiency screen for always-on decorrelation — same adapter-audit task as sol leg B, known-pair scored"
+  mode: headless codex exec, high, identical prompts; scored against sol's 6 HIGH classes + fabrication check
+  outcome: accepted
+  evidence: "terra 6/6 known-positives + 5 net-new (approval-negation regex, heredoc tail-drop, --dry-run, marker-in-success, tool-id reuse); luna 5/6 + 4 net-new (Write/Edit content discarded entirely) — only miss = design-layer channel-provenance. All quoted lines verified real. Echo nondeterministic across all calls — session-header model: line adopted as the anchor."
+  note: "n=1 screen on one bounded task class — recommendation scoped: terra default for detection legs, luna for volume/background, sol for convergence verdicts and probe-executing deep audits."
+- date: 2026-08-01
+  agent: claude (general-purpose, background)
+  task: "Run #4 a+b — mech_trace_adapter 12-class integrity + granularity + 6 probe-novel fixes, known-pair recalibration"
+  mode: private-companion-store file edit (no commit), stdlib-only constraint, fixtures+runner left in place
+  outcome: accepted
+  evidence: "44/44 known-pair (governor re-ran: OK), SAR recalibration 0.617/1.000 exactly preserved, mutant discriminating-power check caught its own non-discriminating fixture (c08 padding < truncation cut) and corrected it. 6 named residuals in docstring+runtime output."
+  note: "Mutant-check working as designed = green-for-wrong-reason guard applied to the instrument itself."
+- date: 2026-08-01
+  agent: claude (Sonnet, worktree-isolated, context-decorrelated)
+  task: "Run #4 e — triad-lens doctrine §2 recipe floor measurement on guards+close-chain slice"
+  mode: slice-only read, FH verification doctrine load forbidden, MECE matrix + 3-way traceability + file:line findings
+  outcome: accepted
+  evidence: "11 findings (S2 M5 R4) all file:line-grounded; governor mechanical grounding sample 3/3 TRUE (F1 less/more lanes absent, F7 node infra-delta 0 hits, F9 close-lane self-scoped to (2)(5)). Verdict: §2 recipe HOLDS at Sonnet floor, n=1."
+  note: "recipe step-2 known-pair was not pre-injected — post-hoc governor sampling substituted; named residual for the next floor run."
+- date: 2026-08-01
+  agent: claude (general-purpose, background)
+  task: "Run #4 c+d — AVS/TCR wiring via OpenRouter + partial-compliance 5-rung fine-discrimination ladder"
+  mode: scratchpad harness rebuild, synthetic traces only, reps=3 on judge channels, per-call model-echo wrapper
+  outcome: accepted
+  evidence: "AVS calibrated PASS (0.825/0.333); TCR UNCALIBRATED confirmed semantic (pure completion metric, flat 1.0 across all rungs); GEval strongest fine discrimination (1.0/0.7/0.267/0.2 monotone, low rep variance); SAR only deterministic channel separating all 5 rungs. Run#2 residual 3 (judge degenerate separation) closed. Instrument trap measured: HarnessAudit judge max_output_tokens=512 hardcode truncates reasoning-model JSON -> AVS None fail-open; transport-layer raise to 8000."
+  note: "Artifacts promoted to a private companion store's experiments/ (scratchpad is ephemeral); HarnessAudit clone provenance recorded, not vendored (669M)."
+- date: 2026-08-01
+  agent: codex sidecar (gpt-5.6-terra, session-header anchored)
+  task: "Decorrelation finder leg on guard MED5+LOW1 fix diff — first live use of the UAP tier routing (terra=detection default)"
+  mode: headless codex exec, read-only sandbox, high; first call returned empty (stdin-open liveness class) -> relaunched with stdin closed
+  outcome: accepted
+  evidence: "5 findings (HIGH1 MED3 LOW1): governor grounding -> 1 registered-residual (option shell-escape, threat-model boundary), 3 confirmed-fixed same session (|& matcher+join, newline-after-wrapper join, budget cap 150), 1 confirmed-accepted (quoted-data FP inherited mention-as-data class, lane-pinned). Round-2 convergence pass dispatched."
+  note: "UAP routing first live validation: terra found real bypasses on a lanes-green diff at -60% of sol price."
+
+# ── recovered 2026-08-02 from unmerged branches before deletion (Destructive-Op gate, step ② recover)
+- date: 2026-07-31
+  agent: openhuman:pr-reviewer (cross-project cast, via general-purpose + persona-load)
+  task: 'Synergy #4 dogfood — openhuman PR #5302 (flows per-item fan-out) CodeRabbit-style review, review-only
+    scope'
+  mode: background Agent, sonnet (per cast definition), FH cwd cross-dispatch with Context Card + scope
+    gate
+  outcome: accepted
+  evidence: 'M0/S0/R3 + 1 author question. Contract honored: no gh review/comment, no commit/push, returned
+    to main. 3 files read full-context (caps.rs 6157L targeted), diff +113/-5. R findings all style/test-integrity
+    class; the sharpest catch: a new test asserting on a throwaway local Semaphore instead of the real
+    HARNESS_AGENT_SLOTS static (green-for-the-wrong-reason class — same defect family as yesterday''s
+    N=4).'
+  note: 'First cross-project cast dispatch on the air node. Mechanism validated: read field agent def
+    as persona + Context Card + scope-gate overrides ranked above the def (the def''s apply/commit/push
+    tail was cleanly suppressed). 118K tokens / ~3.3min.'
+- date: 2026-07-31
+  agent: codex sidecar (gpt-5.6-sol @ high, headless exec, read-only sandbox)
+  task: 'Cross-family adversarial review of pipe_verdict_guard delivery-channel rewrite (load-bearing:
+    fires on every Bash call)'
+  mode: manual auto-decorrelation dispatch, governor keeps terminal verdict, every finding source-verified
+    before acting
+  outcome: accepted
+  evidence: '1 MEDIUM + 4 LOW. MEDIUM (block-mode fail-open on dead python3) accepted as named residual
+    with doctrine grounds. LOW ascii-codec kill reproduced locally then fixed — and the first fix (PYTHONUTF8=1)
+    was refuted by the new lane C4, measured not assumed: PYTHONIOENCODING wins over UTF8 mode. LOW non-atomic
+    emission and LOW two-invocation lane predicate fixed. LOW NUL-blindness accepted with note. 125K tokens.'
+  note: 'Second consecutive day the cross-family pass found real defects in a fresh fix (yesterday 3,
+    today effectively 2 fixed + 1 refuted-fix). The pattern holds: same-family author optimism does not
+    see its own emission/codec edge cases.'
+- date: 2026-07-31
+  agent: general-purpose (frontier research) + fh-meta:persona-innovator (Mode F) — parallel pair
+  task: qasp 총동원 캠페인 Phase 1 — agentic mobile QA SOTA 조사 + 1.5/2/3막 갭/네이밍/흡수 스캔
+  mode: background parallel, Context Card, residency guard (외부 검색 일반용어만)
+  outcome: accepted
+  evidence: '조사: EcoAgent=이원화 학술 쌍둥이(독립수렴) + 흡수델타 5(전건 출처) + 정직한 앞섬/뒤짐 분리 + OSS 후보(라이선스). 이노베이터: 갭 6(에스컬레이션
+    무명·휘발복구 빈자리·vision 부재 binding·문서드리프트 등) + 네이밍 + 외부신호 4(출처). 갭1·6은 같은 세션에서 즉시 배선/정정됨.'
+  note: 87K+87K tokens, ~1.5-3분. 둘 다 fan-in 계약 준수. 조사의 미검증 잔여 표기(2차출처·라이선스 미확정)가 정직 규율대로 왔다.
+- date: 2026-07-31
+  agent: codex sidecar (gpt-5.6-sol @ high, read-only)
+  task: qasp dual_router/runner/healer 배선 diff cross-family 리뷰 (verdict-인접 필드코드 게이트)
+  mode: manual dispatch, invariant-attack 프롬프트 (fail-closed/독트린/opt-in/에스컬레이션/HITL)
+  outcome: accepted
+  evidence: S5/A1/B1 — substring 양방향 오류·@오해석·유일성 부재·비앵커 파싱·disabled 미필터·빈text 우회·전역 tie 오탐. 전건 수정 + 정책
+    자체 개선(후보-국소 에스컬레이션). 검증확인 3건(verdict 소유권·힐러 무적용·opt-in)도 명시 리턴. 92K tokens.
+  note: 3일 연속 동일 패턴 — cross-family가 갓 작성된 fail-closed 경계 코드에서 실결함을 잡는다. 이제 통계가 아니라 운영 전제로 승격할 만함.
+- date: 2026-08-01
+  agent: fh-meta:challenger
+  task: qasp-dev PR#47 Wave 1+2 adversarial review — independent-context leg of a 3-family panel (agy
+    Gemini-Pro + local qwen3.6:35b + this challenger) substituting for exhausted codex
+  mode: isolated Agent, inherit-tier, same-family-but-independent-context (family diversity carried by
+    the two non-Claude sidecar legs)
+  outcome: accepted
+  evidence: '9 attacks incl. 2 HIGH-confidence real defects the other two legs missed: an empty-canonical-key
+    fall-through that re-opened the exact monolith FP this PR had just closed, and a fabricated ''expected:
+    PASS'' value in the non-developer report. Also flagged gate exit-code collision with argparse(2) →
+    moved to 4. Axis-clean verdicts came with measured anchors (overall whitelist-PASS, auto=False aggregation
+    isolation).'
+  note: 'Panel shape worked: cheap legs (qwen) produced only refutable findings (2/2 refuted with source
+    anchors), the paid multimodal leg (agy) found 1 real HIGH, the independent-context same-family leg
+    found the subtlest 2. Governor source-grounded every finding; 9 accepted / 3 refuted; suite 1534 green
+    after fixes.'
+- date: 2026-08-01
+  agent: fh-meta:challenger
+  task: qasp-dev PR#48 (Wave 3 external backlog) adversarial review — independent-context leg alongside
+    agy Gemini-Pro
+  mode: isolated Agent, inherit-tier, same-family-but-independent-context; ran against the COMMIT while
+    the worktree carried in-progress fixes from the other leg
+  outcome: accepted
+  evidence: '10 attacks; 5 independently converged with the agy leg''s uncommitted fixes (cross-confirmation
+    of both legs'' validity). Unique catches: a doc-insertion that split an exit-1 bullet from its sub-bullets
+    AND collided step IDs (A-grade — would misroute the skill''s correction loop), cross-target flaky-score
+    contamination (instrument-validity class), --deliver writing outside out_dir, and a published test-count
+    that no longer matched its own commit.'
+  note: 'The dirty-worktree accident produced a useful pattern: reviewing the commit while fixes land
+    in parallel turns overlap into cross-confirmation instead of waste. Its mtime-sort prescription was
+    REJECTED with grounds (git checkout resets mtime — filename-date parsing is the honest key), and it
+    accepted the refutation direction in its own verdict framing.'
+
+- date: '2026-08-02'
+  agent: fh-commons:quench-challenger (isolated Agent, opus)
+  task: 'Axis-2 adversarial rounds across 4 changes: ⑤ lane fixture (PR #231, 4 rounds), convergence criterion (PR
+    #232, 6 rounds incl. the terminating one), probe-scope instrument (PR #233, 5 rounds)'
+  mode: isolated Agent, target fingerprint pinned in every dispatch (Step 0 WRONG-TARGET contract)
+  outcome: accepted
+  evidence: 15 rounds, ~30 findings, all closed or named as residuals. Yield vectors recorded per change in the
+    Axis-2 markers. Two rounds returned findings that reversed a prior repair's direction, which is what drove criterion
+    4 (reduce the design) firing three times.
+  note: 'Highest-value catches were the ones a same-family author structurally could not self-generate: exit code
+    2 colliding with bash''s syntax-error code; the pre-push hook dropping an advisory''s remediation line while
+    keeping its warning; a control validating a different code path than the number it certified.'
+- date: '2026-08-02'
+  agent: codex gpt-5.5 (cross-family sidecar, headless exec)
+  task: 'Cross-family adversarial leg on the ⑤ lane fixture change (PR #231) — the load-bearing half of the session'
+  mode: headless `codex exec -m gpt-5.5 -` with a fingerprint-pinned Step 0
+  outcome: accepted
+  evidence: '0 S/A + 3 B, all accepted and closed. Named the cross-round blind spot the same-family rounds kept
+    re-creating: caller-surface optimism — the subject is tested directly and the production wrapper is assumed
+    to expose the same signal (it did not, twice).'
+  note: The one finding no Claude round produced. Cost ~128k tokens for one round; the decorrelation axis matched
+    the failure mode (blind spot, not scale).
+- date: '2026-08-02'
+  agent: general-purpose pinned to sonnet (target-tier sim)
+  task: 'Sonnet-floor sim on the new convergence criterion (PR #232) — does a base-floor session actually follow
+    the rule?'
+  mode: isolated Agent, model:sonnet, blind scenario (4-round history, asked to judge convergence)
+  outcome: accepted
+  evidence: '6/6 correct with file+section citations: judged NOT converged for the right reason (the clean round
+    followed a repair), mapped the scenario onto the repo''s measured example structurally, separated hook-validated
+    marker fields from convention-only axis2-rounds, and named criterion 4''s forbidden move.'
+  note: 'Closes the named residual on PR #232''s marker (target-tier sim NOT RUN). The rule holds at the base floor
+    without opus-tier reasoning.'
+
+- date: '2026-08-02'
+  agent: general-purpose x2 pinned to sonnet (ablation known pair)
+  task: 'First real ablation in this repo: is CLAUDE.md §New Skill Creation Pre-Commit Gate (1,310 chars) redundant
+    with the paths-scoped rule file that holds its detail?'
+  mode: two isolated agents, one given the asset WITH the section and one WITHOUT, both forbidden any other file
+    access; asked the section's own regression probe question
+  outcome: accepted
+  evidence: 'Arm A: all 6 bar items + the Done-When consequence + the routing/gate Step-0.5 obligation, all self-labelled
+    GROUNDED. Arm B: NOT IN MY CONTEXT for all three. VERDICT KEEP.'
+  note: 'The file-access ban is the experiment — ablation asks whether the text is knowable without residency, not
+    whether an agent can locate it. Both arms independently cited the same residual (the paths: trigger is a READ,
+    so a from-scratch Write never loads the detail rule), which is exactly the path the probe encodes. Method costs
+    ~2 min/section and replaces the coverage number that was cut for being wrong four times.'