@chrono-meta/fh-gate 1.4.83 → 1.4.85

package/knowledge/shared/rules/operational_adaptation.md

@@ -75,10 +75,20 @@ referent. Record the human-readable grounds in the body, the value in the frontm
 
 **Mechanical floor**: `scripts/consent_registry_check.sh` — joins `standing_consent` against the
 registry and enforces schema, eligibility soundness (a class naming an irreversible or unlisted sink
-**cannot** declare itself promotable), registration, expiry, and recorded scope. Missing registry → N/A
-+ promotion disabled; unparseable → fail-closed. Run it before trusting any grant; the prose above is
+**cannot** declare itself promotable), registration, expiry, and the full recorded scope
+(owner · mode · target · effects · sinks).
+
+**Read the exit code, never the printed words** — the code is the only machine-readable channel, and
+prose that says "DISABLED" disables nothing: **`0` = VERIFIED** (a real grant was joined; the ONLY code
+on which a prompt may be skipped) · **`3` = UNMEASURED** (nothing to join — no registry, zero classes,
+no UAP, **or a UAP recording no active grant**: keep asking) · **`1` = BROKEN** (unparseable or invalid;
+cannot decide == not allowed). `if scripts/consent_registry_check.sh; then run_unprompted; fi` is
+**wrong** — it reads 3 as success. Test `-eq 0` explicitly.
+
+Run it before trusting any grant; the prose above is
 the salience layer over this check, not the enforcement. Anchor: `scripts/test_consent_registry.sh`
-(64 lanes, incl. the `F*` storage-form lanes). Four mutants were run against it — each false-clean
+(75 lanes, incl. the `F*` storage-form lanes and the round-9 `P-F3*`/`D3*` fingerprint + exit-channel
+lanes; each `P`/`D` lane was measured returning the fail-open verdict against the pre-fix script). Four mutants were run against it — each false-clean
 net, the fence regex, and the falsy-laundering guard — and each turned its lanes red, so the green is
 measured rather than assumed. Cross-family review found the first draft's green was partly vacuous
 (one lane called `ok` in both branches; three others passed via a path other than the one they named).
@@ -103,7 +113,17 @@ sessions from the UAP outcome log. Refinements that keep the count honest:
 The offer **quotes the three approvals and the exact scope**; a grant the user cannot audit is not
 consent. Then:
 
-- **granted** → write `standing_consent: <class>: {granted: <date>, expires: <date+N>, effects: [...]}`.
+- **granted** → write `standing_consent: <class>: {granted: <date>, expires: <date+N>, owner: <gate/skill>,
+  mode: <mode>, target: <target scope>, effects: [...], sinks: [...]}`.
+  **All five scope fields are mandatory, not illustrative** — they are the fingerprint §Consent binds to
+  the action's SHAPE requires, and `scripts/consent_registry_check.sh` R6 refuses a grant missing any of
+  them (a fingerprint that omits a field cannot detect drift in that field). `sinks: []` is a real
+  recorded fingerprint, not an omission. *Origin (cross-family round 9, 2026-07-31)*: this line listed
+  only `effects`, so the shape a grant was told to write did not contain the fields the same document's
+  fingerprint rule binds to — and the checker, written from this line, read only what it listed. A
+  class's `owner` or `mode` could then be swapped underneath a live grant and the required re-ask never
+  fired. When the write-instruction and the invariant disagree, the write-instruction wins in practice,
+  because it is the one someone follows.
   Later instances run unprompted, each **states in one line what it did**, and each **appends a durable
   entry to `tracks/_meta/consent_runs.log`**. *Post-action chat notice is not a control* (cross-family
   round 2): a line the user scrolls past has stopped the prompt without replacing it. The chat line is
@@ -139,10 +159,13 @@ Their cost is not the prompt, it is that the thing cannot be undone — grain-in
 answer "yes" to once, knowingly and in scope, which is why it does not contradict the "acceptance alone
 never auto-runs" rule above.
 
-**Degrade direction (fail-closed), three ways**: no UAP (ephemeral/cloud session, wiped profile) → **no
-promotion, keep asking**. No registry entry → **no promotion, keep asking**. Expired or unparseable
+**Degrade direction (fail-closed), four ways**: no UAP (ephemeral/cloud session, wiped profile) → **no
+promotion, keep asking**. No registry entry → **no promotion, keep asking**. A UAP that exists but
+records **no active grant** — empty, or holding only `declined`/`revoked`/`unset` — → **no promotion,
+keep asking** (this is the same state as the two above and gets the same answer; it was the one branch
+that used to report success). Expired or unparseable
 record → **`unset`, keep asking**. A missing consent record is never `granted` — an absent measurement is
-not a yes.
+not a yes, and a refusal is never the reason a prompt is skipped.
 
 **Named residual — the ledger is self-attested (cross-family, 2026-07-29, HIGH, NOT closed).** The UAP
 outcome log is written by the same agent that benefits from fewer prompts, and it is gitignored, so there
@@ -158,9 +181,12 @@ on the assumption the ledger is trustworthy.**
 a class name is a string, and the action behind it can change after consent is granted. A sim that
 merely returned a report when you said "stop asking" may, ten sessions later, write into shared memory
 and trigger a downstream commit — same label, different blast radius, HITL skipped. So a grant records
-**what it was granted for**: the owning gate/skill, and the set of **effect classes** the action had at
+**what it was granted for**: the owning gate/skill (`owner`) **and its `mode`** — the two fields that say
+*who* acts and *what it does* when it acts — and the set of **effect classes** the action had at
 grant time (reads · local writes · network · dispatch · repo-mutation) **plus the `target` scope and
-the `sinks` fingerprint**. On any later run whose fingerprint is **not a subset** of the granted one,
+the `sinks` fingerprint**. That is the same five-field scope the offer above quotes to the user, and the
+same five `consent_registry_check.sh` R6/R7 enforce; the three lists must not drift apart. On any later
+run whose fingerprint is **not a subset** of the granted one,
 standing consent **reverts to `unset` and asks again**, naming what widened. Effect classes alone are
 too coarse to be the whole test (cross-family round 2): "local write" stays "local write" whether the
 target is a scratch report or a policy file — the *target* is where that drift shows, which is why it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.83",
+  "version": "1.4.85",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -63,6 +63,7 @@
     "scripts/fh-goal.sh",
     "scripts/count_check.sh",
     "scripts/selfcheck.sh",
+    "scripts/test_selfcheck_state_lanes.sh",
     "scripts/package_coverage_check.sh",
     "scripts/test_package_coverage_lanes.sh",
     "scripts/test_fh_gate_regressions.sh",
@@ -103,6 +104,7 @@
     "scripts/prepush_guard_check.sh",
     "scripts/psa_scan_lib.sh",
     "scripts/session_close_check.sh",
+    "scripts/test_dispatch_log_lanes.sh",
     "scripts/memory_link_check.py",
     "scripts/test_memory_link_check.sh",
     "scripts/memory_nearcheck.py",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.83",
+  "version": "1.4.85",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-commons/skills/convergence-loop/SKILL.md

@@ -54,15 +54,18 @@ Round 1
     │  → FAIL occurs: List FAIL items → Execute FIX → Round 2
     │
     ▼
-Round 2
+Round N (N ≥ 2)
     │  Re-execute same gate (with FIX applied + search for new FAILs)
-    │  → All items pass: ✅ Round 2 passed → Round 3 (final check)
-    │  → New FAIL: List → FIX → Round 3
+    │  → All items pass AND no FIX was applied in response to THIS round:
+    │        ✅ Declare truly passed  ← the only terminating exit
+    │  → All items pass BUT you fixed something this round (any severity):
+    │        the fix is unverified → Round N+1
+    │  → New FAIL: List → FIX → Round N+1
     │
     ▼
-Round 3 (final)
-    │  → All items pass: ✅ Declare truly passed
-    │  → FAILs remain: "Structural redesign required" → Escalate
+    │  → FAILs remain after N rounds: "Structural redesign required" → Escalate
+    │  → Rounds clean but each keeps producing fixes: the fixes are manufacturing the
+    │    findings → REDUCE THE DESIGN, then re-run (steel-quench §Convergence Criteria 4)
     │
     ▼ (if not converged within N rounds)
 Escalation
@@ -100,10 +103,18 @@ Escalation:      [who to escalate to / how, if not converged within N rounds]
 ### Convergence Judgment
 
 ```
-Convergence = 0 new FAILs across 2 consecutive rounds
+Convergence = a round returns 0 new FAILs AND no FIX was applied in response to it
 Conditions to declare truly passed:
   1. All items pass AND
-  2. At least 2 rounds executed (single-round pass treated as "provisionally passed" only)
+  2. Nothing was changed in response to THIS round, at any severity
+     (a FAIL you accept as residual is terminal; a FAIL you fix is not — the fix is unverified) AND
+  3. At least 2 rounds executed (a single clean round is "provisionally passed" only)
+     ← condition 3 is NOT redundant with 2 and was nearly lost when 2 replaced it: freezing answers
+       "did the artifact change under the audit", min-2 answers "is one look enough". Independent
+       questions, both still open. Done When and the pipeline diagram enforce min-2 as well.
+NOT "0 new FAILs across 2 consecutive rounds": while every round ships fixes that can never fire,
+so it reads as permanently not-converged and gets shipped past anyway. Stricter form for quench
+waves: steel-quench §Convergence Criteria.
 ```
 
 ### Escalation Root Cause Classification
@@ -141,7 +152,7 @@ Max rounds: N | Actual convergence round: M
 | Situation | Related Skill |
 |---|---|
 | Applied to skill diagnostic gate | `harness-doctor` → convergence-loop wrapper |
-| Applied to quench wave | `steel-quench` Wave 3+ convergence criteria (same principle) |
+| Applied to quench wave | `steel-quench` Wave 3+ — **stricter**: S/A grade + the no-repair clause. Defer to its §Convergence Criteria, do not re-derive |
 | Applied to session harvest loop | `harvest-loop` extract→attack→synthesize cycle |
 | When gate redesign is needed | `meta-prompt-builder` |
 
@@ -150,7 +161,11 @@ Max rounds: N | Actual convergence round: M
 ```
 Setup complete (gate name, pass criteria, max rounds confirmed)
 + Minimum 2 rounds executed
-+ Convergence declared (all items pass for 2 consecutive rounds) or escalation triggered
++ Convergence declared (a round returns zero new failures AND you make no repairs in response to
+  it, at any grade) or escalation triggered
+  ⚠️ NOT "2 consecutive rounds": while every round ships repairs that criterion can never fire, so
+  it reads as permanently not-converged and gets shipped past. Adjudicated with measured evidence in
+  `steel-quench` §Convergence Criteria (2026-08-02).
 + Per-round result table output
 ```
 

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.83",
+  "version": "1.4.85",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/agents/challenger.md

@@ -107,7 +107,7 @@ After completing all attack angles:
 ```
 New S-grade attacks this round: N
 Attack potency trend: [Increasing / Stable / Declining]
-Convergence signal: [Not yet / Approaching (LOW-confidence dominant) / Achieved (zero new S)]
+Convergence signal: [Not yet / Approaching (LOW-confidence dominant) / Achieved (zero new S/A, and no repairs made in response — B included)]
 Residual risk: [List A/B items that remain unresolved]
 ```
 

package/plugins/fh-meta/skills/phantom-quench/SKILL.md

@@ -117,7 +117,7 @@ Scan artifact quickly to classify claim distribution:
 | `risk_level` | external publish / arXiv citations → all claim types, max depth, **and Step 2-E (external fetch+support) is mandatory** |
 | `source_count` | 0 declared sources → S-grade blocker immediately (skip to Step 3 prescription) |
 | `quantitative_density` | > 3 numerical claims → focus numerical+range types first |
-| `external_citation` | artifact (or its diff) contains `arXiv:` / `DOI` / `http(s)://` / a version token (`x.y.z`) → **route those claims to Step 2-E** (governance binding: these are the load-bearing external claims FH's substantive carve-out already gates — `CLAUDE.md §Substantive carve-out`) |
+| `external_citation` | artifact (or its diff) contains `arXiv:` / `DOI` / `http(s)://` / a version token (`x.y.z`) → **route those claims to Step 2-E** (governance binding: these are the load-bearing external claims FH's substantive carve-out already gates — `.claude/rules/fh_4axis_gate.md §Substantive carve-out`) |
 
 Scope recommendation output:
 ```

package/plugins/fh-meta/skills/steel-quench/SKILL.md

@@ -46,10 +46,10 @@ A designer's anxiety is most dangerous when vague. steel-quench breaks that anxi
 | **Phase 0** (optional) | Counterexample calibration — extract patterns from external bad cases, merge into Wave 1 | No external case → skip |
 | **Wave 1** | Challenger attack (quench-challenger) — surface critical flaws, no defense | — |
 | **Wave 2** | Defense — defend or state as residual risk | — |
-| **Wave 3+** | Convergence — repeat until zero new S-grade | Zero new S-grade |
-| **Wave 4** (optional) | Meta-Aware Adversary — AI uses its own nature as attack vector | Zero new S-grade + AI-specific criteria |
+| **Wave 3+** | Convergence — repeat until a round is clean AND triggers no repair | Zero new S/A **and no repairs made in response, B included** (§Convergence Criteria) |
+| **Wave 4** (optional) | Meta-Aware Adversary — AI uses its own nature as attack vector | Wave 3+ criterion (clean + no-repair) + AI-specific criteria |
 | **Wave-P3** (optional) | Gate-passage re-attack — when an upstream gate declares PASS, re-attack the just-passed artifact on Coverage / Narrative / False-confidence | All 3 dimensions Attack Failed |
-| **Wave 5** (optional) | Multi-Team Adversarial Panel — external CLIs or cross-session Claude | Zero new S-grade cross-team |
+| **Wave 5** (optional) | Multi-Team Adversarial Panel — external CLIs or cross-session Claude | Wave 3+ criterion, cross-team |
 | **Wave-T** (after convergence) | Temper — measure complexity the quench *added*; flag over-hardening | τ-PASS or named τ-FAIL |
 
 ---
@@ -310,7 +310,7 @@ domain-coupled (a spec→test-case gate) form to a gate-agnostic boundary hook.
 ## Wave-T — Temper (post-convergence)
 
 Quench hardens, but quenched steel is brittle — no smith ships it un-tempered. steel-quench attacks
-until zero new S-grade; nothing in that loop asks whether the hardening itself **introduced complexity
+until a frozen-artifact round is clean; nothing in that loop asks whether the hardening itself **introduced complexity
 beyond what the fixes required** (defense scaffolding, decorative wiring). Wave-T is that inverse
 corrective. It runs **after Wave 3+ convergence, before Done When**. It does not attack; it measures
 the cost of the convergence just achieved.
@@ -381,21 +381,89 @@ Add new rows as new patterns are discovered.
 ## Done When
 
 ```
-Wave convergence criteria met: zero new S-grade blockers
+Wave convergence criteria met: zero new S/A-grade findings in a round that triggered NO repairs at
+  any grade (B included — a repaired B is an unverified change, and that is the measured way a
+  'clean' round has already leaked an A) — see §Convergence Criteria
 + Residual risk card output (A-grade · B-grade items)
 + "steel-quench Complete" declaration output
 ```
 
-Verdict: PASS (zero S-grade, convergence reached) | CONDITIONAL_PASS (A/B-grade remain) | FAIL (S-grade persist) | ESCALATE (structural ambiguity requiring human judgment)
+Verdict: PASS (zero new S/A **and no repairs made in response, at any grade** — §Convergence Criteria; repairing even a B and then declaring convergence is the measured round-4 failure) | CONDITIONAL_PASS (A/B-grade remain) | FAIL (S-grade persist) | ESCALATE (structural ambiguity requiring human judgment)
 
 ---
 
 ## Convergence Criteria + Downstream Chaining
 
 ### Convergence Criteria
-1. **Zero new S-grade blockers** → terminate
-2. A-grade or higher complex improvements → skill-ize with `/meta-prompt-builder`
-3. Full Wave results → recommend persisting to `tracks/_meta/steel_quench_YYYY_MM_DD_{slug}.md`
+
+**Convergence is measured over a FROZEN artifact.** A round that produced repairs did not verify the
+artifact you are shipping — it verified the previous one. So the terminating round must be a round
+over **unchanged** code:
+
+1. **Terminate** when a round returns **zero new S/A-grade** findings **AND you make no repairs in
+   response to it — at ANY grade, B included**. A round whose B findings you *accept as residual* is
+   terminal; a round whose B findings you *fix* is not, because the fix is unverified.
+   Why the B clause is the load-bearing half, not a formality: in the measured history below, round 4
+   returned `0A+3B` — clean by every S/A-based criterion, and the old rule would have stopped there.
+   The three B's were repaired, and round 5 found a genuine **A inside those repairs**. So "zero new
+   S/A" is not the discriminator; "nothing was changed in response" is. The loop ends when you stop
+   repairing, not when the challenger runs out of ideas.
+   **A post-convergence Wave-T de-brittling edit counts as a repair for this purpose.** Wave-T runs
+   after convergence and before Done When, so trimming a construct there is an unaudited edit that
+   the completion declaration would still describe truthfully ("no repairs were made in response to
+   this round") while the invariant it certifies — the shipped artifact is the audited one — is
+   false. Either ship the τ-FAIL as a **named** τ-FAIL (the pipeline table's own alternative, and
+   terminal) or run one more round over the trimmed artifact before declaring Done.
+2. **Record the per-round yield vector** in the Axis-2 marker — `axis2-rounds: 4A / 3A+1B / 2A /
+   0A+3B / 1A+2B`. It is what makes the stop decision auditable afterwards, and a flat or rising
+   vector is criterion 4's only input.
+
+   **PIN THE TARGET — mandatory on every dispatched Wave, and the reason criterion 1 can be trusted
+   at all.** The dispatch prompt carries a measured fingerprint and orders the agent to report
+   `WRONG-TARGET` and stop on mismatch:
+
+   ```bash
+   git rev-parse --short HEAD; git diff HEAD | wc -l; git status --porcelain | grep -c '^??'
+   ```
+
+   An audit that did not pin its target **cannot be counted as a terminating round** — it may have
+   read a tree that changed under it, which voids the verdict wholesale
+   ([[feedback_audit_target_must_be_frozen]]). This lives HERE, inline, next to the claim it holds
+   up: the first draft put it in `SKILL_detail.md §Wave5`, reachable only when `--sidecar` is
+   active — gate-locality on the very fix that was closing a gate-locality gap, caught by the round
+   that audited it.
+
+   > **Named residual — the freeze claim is currently SELF-ATTESTED, and deliberately not
+   > mechanized.** Criterion 1 turns on "unmodified since the previous audit", and nothing checks
+   > that. Two attempts to mechanize it on the day the rule was written were both wrong: a hook
+   > advisory that fired on 100% of markers (noise, and its convergence detector could not match the
+   > hook's own prescribed evidence vocabulary), and a `base-SHA + diff-line-count` fingerprint that
+   > is **invariant under an in-place edit** — the modal shape of a prose repair — and structurally
+   > blind to untracked files. Both were removed rather than patched. This repo mechanizes at
+   > **repetition**, not at first sight, and a one-day-old rule that has already produced two wrong
+   > machines is telling you which side of that line it is on. What holds the claim honest today is
+   > practice, not mechanism: a dispatched audit pins the target fingerprint in its Step 0 and
+   > reports `WRONG-TARGET` on mismatch ([[feedback_audit_target_must_be_frozen]]). **Mechanize on
+   > the first recurrence of a convergence claim that turns out to be false** — and when you do,
+   > content-address the full working state (tracked diff **and** untracked files), because that is
+   > the specific hole the discarded attempt fell into.
+3. A-grade or higher complex improvements → skill-ize with `/meta-prompt-builder`
+4. **If the yield does not fall across rounds, stop tightening and REDUCE THE DESIGN.** A vector that
+   stays flat is not telling you to review harder; it is telling you that each round's repairs are
+   manufacturing the next round's findings. Cut the scope that is generating them (see the
+   Added-Scope Gate in `.claude/rules/fh_4axis_gate.md`) and re-audit the smaller artifact.
+5. Full Wave results → recommend persisting to `tracks/_meta/steel_quench_YYYY_MM_DD_{slug}.md`
+
+> **Why this replaced "zero new S-grade → terminate" (measured 2026-08-02, PR #231).** A single
+> change ran 5 rounds with yields `4A / 3A+1B / 2A / 0A+3B(cross-family) / 1A+2B`. The old criterion
+> would have terminated at round 4 (zero S/A) — and round 5, run over round 4's repairs, found a
+> genuine A. Meanwhile the competing criterion carried in operator memory ("two consecutive rounds
+> with zero new") can never fire while every round ships repairs, so it read as permanently
+> not-converged and the change shipped with that stated instead. **Both criteria were wrong in the
+> same way: they counted rounds instead of asking whether anything had changed underneath.** Rounds
+> 2, 3 and 5 found defects exclusively in code the previous round had added. Freezing is the fix that
+> both were reaching for — the same discipline the single-audit rule already requires of its target,
+> applied to the convergence loop itself.
 
 ### Connected Skills
 
@@ -414,7 +482,7 @@ Verdict: PASS (zero S-grade, convergence reached) | CONDITIONAL_PASS (A/B-grade
 ### Required Pre-External-Deployment Sequence
 
 ```
-steel-quench convergence (zero new S-grade)
+steel-quench convergence (zero new S/A over a frozen artifact)
         ↓  pass residual risk list
 sim-conductor Area A (external user perspective)
         ↓  new items found that steel-quench missed?

package/plugins/fh-meta/skills/steel-quench/SKILL_detail.md

@@ -163,7 +163,7 @@ New S-grade blockers: N (from AI-specific vectors: N)
 | Hallucination cumulative contamination | Mandate citing original file, commit hash, measured value — "LLM-reconstructed" not accepted |
 | Tool Dependency Lock-in | Checklist for core function after tool removal (degraded mode possible?) |
 
-**Wave 4 Convergence Criteria** (additional, beyond Wave 3 zero new S-grade):
+**Wave 4 Convergence Criteria** (additional, beyond the Wave 3+ clean-and-no-repair criterion):
 1. At least 3 AI-specific vectors actually reviewed — not simply "no attacks"
 2. Hallucination defense arguments based on original file references
 3. Context Collapse scenario simulated at least once (waivable if session is short)
@@ -444,7 +444,7 @@ Running steel-quench in a meta-harness environment structurally lowers devil's a
 
 Devil attacks only static code in an isolated environment; the defender pulls evidence from the living system outside that isolated environment — this asymmetry is the basis for Wave 2 being structurally superior to Wave 1.
 
-As Wave N deepens, decreasing new S-grade blockers = evidence of the system genuinely becoming more robust. Zero new S-grade = fundamental flaws exhausted → termination condition.
+As Wave N deepens, decreasing new S-grade blockers = evidence of the system genuinely becoming more robust. Zero new S/A AND no repairs made in response (B included) = fundamental flaws exhausted → termination condition. Repairing a B and declaring convergence is the measured failure this replaced.
 
 **Wave Deepening Principle**:
 
@@ -460,7 +460,7 @@ As Wave N deepens, decreasing new S-grade blockers = evidence of the system genu
 ```
 ## steel-quench Complete
 
-Wave N converged. Zero new S-grade blockers confirmed.
+Wave N converged. Zero new S/A-grade findings, and NO repairs were made in response to this round at any grade.
 
 Residual Risk Card:
 - [List only A-grade · B-grade residual items]