@chrono-meta/fh-gate 1.4.84 → 1.4.85

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.84",
+      "version": "1.4.85",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.84",
+      "version": "1.4.85",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -595,10 +595,18 @@ Default operation is a **standard interactive session**. Agent dispatch (single
 
 Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.
 
-**Invocation log obligation (always-loaded — do not rely on recall)**: immediately after any custom
-sub-agent invocation, append to `knowledge/shared/learnings/subagent_invocations_log.yaml` (8 fields ·
-outcome: `accepted`/`partial`/`rejected`/`sustained` — `sustained` = decided NOT to invoke, also recorded).
-This feeds the 60/40 promotion gate + UAP loop; detail: `knowledge/shared/rules/operations.md`.
+**Invocation log obligation — now mechanically reconciled, not recall-dependent**: immediately after
+any custom sub-agent invocation, append to `knowledge/shared/learnings/subagent_invocations_log.yaml`
+(8 fields · outcome: `accepted`/`partial`/`rejected`/`sustained` — `sustained` = decided NOT to invoke,
+also recorded). This feeds the 60/40 promotion gate + UAP loop; detail:
+`knowledge/shared/rules/operations.md`.
+**Floor (2026-08-02)**: a `SubagentStop` hook tallies every dispatch and `session_close_check.sh` ④-e
+blocks a close push when dispatches happened and the day's entries are ZERO. Consolidating a class of
+dispatches into one entry with measured counts is fine and is not penalised — the check catches the
+total miss, not imperfect bookkeeping. **Why it needed a floor**: this line was prose-only and a single
+session dispatched 20+ subagents and logged none of them, in the same session that recovered this very
+log file from a branch queued for deletion. The hook only tallies; it never writes an entry, because a
+fabricated `outcome`/`evidence` would poison the promotion gate worse than a missing one.
 
 ### Context Card — Required Format for Dispatch
 ```

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -812,3 +812,19 @@
     whether an agent can locate it. Both arms independently cited the same residual (the paths: trigger is a READ,
     so a from-scratch Write never loads the detail rule), which is exactly the path the probe encodes. Method costs
     ~2 min/section and replaces the coverage number that was cut for being wrong four times.'
+
+- date: '2026-08-02'
+  agent: general-purpose x6 pinned to sonnet (ablation known pairs — 3 sections x 2 arms)
+  task: Ablation sweep — 3 sections x 2 arms (6 dispatches; the day's SubagentStop tally read 7, the extra being one earlier probe). Two largest MEASURABLE sections of CLAUDE.md — §Autonomous Initiative (12,224 chars,
+    8 probes) and §Session Wrap-up (8,398 chars, 2 probes) — plus the earlier §New Skill Creation Pre-Commit Gate
+  mode: paired arms per section (asset WITH vs WITHOUT the section), floor tier, all file access denied except the
+    one arm file
+  outcome: accepted
+  evidence: '3 sections ablated, 3 KEEP. §Autonomous Initiative: 5 routing behaviours GROUNDED in arm A and NOT
+    IN MY CONTEXT in arm B (context-doctor, harvest-loop, goal-quench, deep-clarify, the already-running Guard).
+    §Session Wrap-up: 4 of 6 close-chain answers fully absent without it (the ordered sequence, the absolute-last
+    rule and its reason, the late-finding re-run rule, the open-PR sweep). §New Skill gate: 3 of 3 absent.'
+  note: 'By-product worth more than the verdicts: the Pre-Publish row IN the initiative table is redundant — arm
+    B answered the full chain and the order invariant correctly from the gate''s own section (719 chars, ablatable).
+    And the headline: three measurements, three KEEPs. The ''CLAUDE.md is bloated'' premise is not surviving contact
+    — the earlier 46%-unmeasured framing measured probe coverage, which is not necessity.'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.84",
+  "version": "1.4.85",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -104,6 +104,7 @@
     "scripts/prepush_guard_check.sh",
     "scripts/psa_scan_lib.sh",
     "scripts/session_close_check.sh",
+    "scripts/test_dispatch_log_lanes.sh",
     "scripts/memory_link_check.py",
     "scripts/test_memory_link_check.sh",
     "scripts/memory_nearcheck.py",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.84",
+  "version": "1.4.85",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.84",
+  "version": "1.4.85",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/selfcheck.sh

@@ -330,6 +330,19 @@ else
   fail=1
 fi
 
+# ④-e dispatch-log reconciliation + its tally hook. Wired in the same commit that ships them: the
+# obligation they mechanize lost 20/20 in a single session, so leaving the checker itself unrun
+# would be the same defect one layer up.
+if [ -f scripts/test_dispatch_log_lanes.sh ]; then
+  if ! bash scripts/test_dispatch_log_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  test_dispatch_log_lanes.sh: the dispatch-log reconciliation would mis-report"
+    bash scripts/test_dispatch_log_lanes.sh 2>&1 | tail -14
+    fail=1
+  else
+    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
+  fi
+fi
+
 # selfcheck's own subject-presence discriminators. Every other guard under scripts/ has a lane suite;
 # this decision had none, and it shipped two mis-routings in one session — a two-arm form that fell
 # through in silence, then a package discriminator keyed on a file that actually ships. Both are

package/scripts/session_close_check.sh

@@ -117,6 +117,57 @@ if [ -n "$LAST_TAG" ] && [ -f "$FH/package.json" ]; then
   fi
 fi
 
+# ④-e DISPATCH-LOG RECONCILIATION — mechanical, because prose failed completely.
+# CLAUDE.md makes an invocation-log entry MANDATORY immediately after any custom sub-agent
+# invocation (it feeds the 60/40 promotion gate and the UAP loop). Measured 2026-08-02: a single
+# session dispatched 20+ subagents and logged ZERO — not a marginal lapse, a total one, in the same
+# session that RECOVERED that very log file from a branch about to be deleted. An obligation that
+# loses 20 times out of 20 is not under-emphasised; it is unmechanized. Per this repo's own rule
+# (1-2 occurrences -> prose; N>=3 or a repeat on another surface -> mechanize), this is well past it.
+#
+# The check is a RECONCILIATION, not an auto-writer. A hook cannot fill `outcome` or `evidence`
+# without fabricating judgment, and a fabricated log entry is worse than a missing one — it would
+# poison the promotion gate with invented outcomes. So the hook only TALLIES (SubagentStop appends a
+# date line) and this step compares the tally against today's entries.
+#
+# It deliberately does NOT demand 1:1. Consolidating twenty challenger rounds into one entry with
+# measured counts is better bookkeeping than twenty stubs, and punishing it would train stub-spam.
+# What it catches is the failure that actually happened: dispatches occurred and NOTHING was written.
+# ABSENCE IS NOT ZERO. The tally comes from a SubagentStop hook configured in `.claude/settings.json`,
+# which is GITIGNORED by design (it also carries local permissions). So a fresh clone, another
+# machine, or a wiped settings file has no hook — and without this branch the check would read an
+# empty tally as "no dispatches today" and pass in silence. That is the exact fail-open this whole
+# step exists to close, re-created inside it; caught before commit by asking where the tally comes
+# from. Installable snippet: templates/subagent-tally-hook.json.
+TALLY="$FH/tracks/_meta/.subagent_dispatch_tally"
+LOG="$FH/knowledge/shared/learnings/subagent_invocations_log.yaml"
+HOOK_OK=0
+if [ -f "$FH/.claude/settings.json" ]; then
+  grep -q '"SubagentStop"' "$FH/.claude/settings.json" 2>/dev/null && HOOK_OK=1
+fi
+if [ "$HOOK_OK" -eq 0 ]; then
+  echo "⚠️  ④-e dispatch log NOT MEASURED — no SubagentStop tally hook in .claude/settings.json"
+  echo "     (that file is gitignored, so a fresh clone has none). An unmeasured dispatch count is"
+  echo "     NOT a count of zero. Install: templates/subagent-tally-hook.json → .claude/settings.json"
+fi
+DISPATCHED=$(grep -c "^$TODAY$" "$TALLY" 2>/dev/null | tr -d ' ' || echo 0)
+# Both quotings, because the file carries both: hand-written entries use `- date: 2026-08-02`
+# while anything appended via yaml.dump renders `- date: '"'"'2026-08-02'"'"'`. Matching one form counted
+# half the entries as absent — a divergent-normalizer miss inside the check that exists to catch
+# missing records. Known-pair calibrated below in test_dispatch_log_lanes.sh.
+LOGGED=$(grep -cE "^- date: *'?$TODAY'?" "$LOG" 2>/dev/null | tr -d ' ' || echo 0)
+if [ "${DISPATCHED:-0}" -gt 0 ] && [ "${LOGGED:-0}" -eq 0 ]; then
+  echo "❌ ④-e $DISPATCHED sub-agent dispatch(es) today and ZERO invocation-log entries — the 60/40"
+  echo "     promotion gate and the UAP loop both read that file; an unlogged session is invisible to"
+  echo "     them. Append to knowledge/shared/learnings/subagent_invocations_log.yaml (consolidated"
+  echo "     per class is fine — record counts and outcomes, not one stub per dispatch)."
+  FAIL=1
+elif [ "${DISPATCHED:-0}" -gt 0 ]; then
+  echo "✅ ④-e dispatch log: $DISPATCHED dispatch(es) today, $LOGGED log entr(ies) recorded"
+elif [ "$HOOK_OK" -eq 1 ]; then
+  echo "✅ ④-e dispatch log: no sub-agent dispatches tallied today"
+fi
+
 # ⑤ CARD-LAST invariant — the card must be the NEWEST close artifact. A card older than
 # fh_completed / signal files written this session = ⑤ ran before ①–④ finished (the bug class).
 if [ -f "$CARD" ]; then

package/scripts/test_dispatch_log_lanes.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# test_dispatch_log_lanes.sh — known-pair anchor for session_close_check.sh ④-e (dispatch-log
+# reconciliation) and for the SubagentStop tally hook that feeds it.
+#
+# WHY (2026-08-02): CLAUDE.md makes an invocation-log entry mandatory immediately after any custom
+# sub-agent invocation — it feeds the 60/40 promotion gate and the UAP loop. Measured: one session
+# dispatched 20+ subagents and logged ZERO, in the same session that recovered that very log file
+# from a branch queued for deletion. An obligation that loses 20/20 is not under-emphasised, it is
+# unmechanized, so ④-e now reconciles a hook-written tally against the day's entries.
+#
+# The reconciliation itself then shipped a defect this suite exists to prevent from returning: the
+# log carries TWO date spellings — `- date: 2026-08-02` for hand-written entries and
+# `- date: '2026-08-02'` for anything appended through yaml.dump — and the first matcher saw only
+# one, counting half the entries as absent. A missing-records check that itself miscounts records is
+# the worst possible shape, so both spellings are lanes below.
+#
+# Exit 0 = the reconciliation discriminates · 1 = it would mis-report.
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/session_close_check.sh"
+SETTINGS="$SCRIPT_DIR/../.claude/settings.json"
+FAILED=0; PASS=0
+chk() { if [ "$1" -eq 0 ]; then PASS=$((PASS+1)); echo "  ✅ $2"; else FAILED=1; echo "  ❌ $2"; fi; }
+
+[ -f "$CHECK" ] || { echo "FAIL  dispatch-log lanes: subject $CHECK missing"; exit 1; }
+
+# The matcher under test, lifted from the subject rather than re-spelled (a hand-copied predicate is
+# a divergent normalizer — which is exactly the bug being anchored). If it is gone, fail loudly.
+MATCHER=$(grep -oE "grep -cE \"\^- date: \*'\?\\\$TODAY'\?\"" "$CHECK" | head -1)
+if [ -z "$MATCHER" ]; then
+  echo "FAIL  the ④-e date matcher is no longer in session_close_check.sh in the expected form —"
+  echo "      this lane cannot verify what it claims to. Update the lane WITH the subject."
+  exit 1
+fi
+echo "── matcher located in the subject"
+
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+D=2026-08-02
+
+echo "── date-spelling lanes (the shipped miscount) ──"
+printf -- "- date: %s\n" "$D" > "$T/plain.yaml"
+printf -- "- date: '%s'\n" "$D" > "$T/quoted.yaml"
+printf -- "- date: %s\n- date: '%s'\n- date: 2020-01-01\n" "$D" "$D" > "$T/both.yaml"
+count() { grep -cE "^- date: *'?$D'?" "$1" 2>/dev/null | tr -d ' '; }
+[ "$(count "$T/plain.yaml")"  = 1 ] ; chk $? "unquoted date counted"
+[ "$(count "$T/quoted.yaml")" = 1 ] ; chk $? "yaml.dump-quoted date counted (the half the first matcher missed)"
+[ "$(count "$T/both.yaml")"   = 2 ] ; chk $? "mixed file counts both, and ignores another date"
+# known-POSITIVE for the bug itself: the reverted single-form matcher DOES undercount
+[ "$(grep -c "^- date: *$D" "$T/both.yaml")" = 1 ] ; chk $? "known-POSITIVE: the reverted matcher undercounts (1 of 2) — the defect is real"
+
+echo "── reconciliation verdict lanes ──"
+verdict() { # $1=dispatched $2=logged -> BLOCK | OK | NONE
+  if [ "$1" -gt 0 ] && [ "$2" -eq 0 ]; then echo BLOCK
+  elif [ "$1" -gt 0 ]; then echo OK
+  else echo NONE; fi
+}
+[ "$(verdict 20 0)" = BLOCK ] ; chk $? "dispatches with ZERO entries → BLOCK (this is the 2026-08-02 failure)"
+[ "$(verdict 20 4)" = OK ]    ; chk $? "consolidated logging (20 dispatches, 4 entries) → OK, not punished"
+[ "$(verdict 1 1)"  = OK ]    ; chk $? "1:1 logging → OK"
+[ "$(verdict 0 0)"  = NONE ]  ; chk $? "no dispatches → silent, not a failure"
+
+echo "── the tally hook that feeds it ──"
+if [ -f "$SETTINGS" ]; then
+  python3 - "$SETTINGS" <<'PY' >"$T/hookcmd" 2>/dev/null || true
+import json,sys
+d=json.load(open(sys.argv[1]))
+g=d.get("hooks",{}).get("SubagentStop",[])
+print(g[0]["hooks"][0]["command"] if g and g[0].get("hooks") else "")
+PY
+  cmd=$(cat "$T/hookcmd")
+  [ -n "$cmd" ] ; chk $? "SubagentStop hook is configured (an untallied dispatch is invisible to ④-e)"
+  if [ -n "$cmd" ]; then
+    case "$cmd" in *"exit 0"*) ok=0 ;; *) ok=1 ;; esac
+    [ "$ok" -eq 0 ] ; chk $? "hook ends in exit 0 — a non-zero hook exit discards its stdout SILENTLY"
+    # run it against a scratch HUB and confirm it appends today's date
+    CLAUDE_PROJECT_DIR="$T/hub" bash -c "$cmd" >/dev/null 2>&1
+    [ "$(grep -c "$(date +%Y-%m-%d)" "$T/hub/tracks/_meta/.subagent_dispatch_tally" 2>/dev/null || echo 0)" -ge 1 ]
+    chk $? "hook actually appends a dated line when run (not merely present)"
+  fi
+else
+  echo "  ⏭️  .claude/settings.json absent — hook lanes unchecked (not a pass)"
+fi
+
+echo "── absence-is-not-zero (the fail-open this fix nearly shipped) ──"
+# .claude/settings.json is GITIGNORED, so a fresh clone has no hook and an empty tally. Without an
+# explicit branch the reconciliation would read that as "no dispatches" and pass in silence.
+hookless_verdict() { # $1=hook_configured -> MEASURED | NOT-MEASURED
+  [ "$1" -eq 1 ] && echo MEASURED || echo NOT-MEASURED
+}
+[ "$(hookless_verdict 0)" = NOT-MEASURED ] ; chk $? "no hook → NOT MEASURED (an unmeasured count is not zero)"
+[ "$(hookless_verdict 1)" = MEASURED ]     ; chk $? "hook present → measured"
+grep -q "NOT MEASURED" "$CHECK" ; chk $? "the subject actually carries that branch (not just this lane)"
+[ -f "$SCRIPT_DIR/../templates/subagent-tally-hook.json" ] ; chk $? "installable snippet exists for a clone that has no settings.json"
+
+echo ""
+if [ "$FAILED" -ne 0 ]; then echo "DISPATCH-LOG LANES: FAIL"; exit 1; fi
+echo "DISPATCH-LOG LANES: PASS ($PASS/$PASS)"
+exit 0