@chrono-meta/fh-gate 1.4.87 → 1.4.89

package/scripts/test_version_lockstep_lanes.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Known pairs for scripts/version_lockstep_check.sh.
+#
+# The lane this suite exists to prevent: on 2026-08-06 a 1.4.88 → 1.4.89 bump edited the FIRST
+# marketplace plugin entry and left the SECOND at the old version. `test_tag_version_lanes.sh`
+# reported 8/8 PASS through it — that lane compares the git tag to package.json and never opens
+# marketplace.json. The drift was caught by an ad-hoc `sort | uniq -c`. Luck is not a floor.
+#
+# Every lane runs against a THROWAWAY fixture tree, never against this repo, so the suite is
+# hermetic: a real bump in progress can neither turn it green nor turn it red.
+
+set -uo pipefail
+CHECK="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/version_lockstep_check.sh"
+TMPROOT=$(mktemp -d "${TMPDIR:-/tmp}/fh_lockstep.XXXXXX")
+trap 'rm -rf "$TMPROOT"' EXIT
+PASS=0; FAIL=0
+
+_fixture() {  # $1=name $2=pkg_ver $3=meta_ver $4=commons_ver $5=mk_entry0 $6=mk_entry1
+  local T="$TMPROOT/$1"
+  mkdir -p "$T/.claude-plugin" "$T/plugins/fh-meta/.claude-plugin" "$T/plugins/fh-commons/.claude-plugin"
+  printf '{"name":"fh","version":"%s"}\n' "$2" > "$T/package.json"
+  printf '{"name":"fh-meta","version":"%s"}\n' "$3" > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+  printf '{"name":"fh-commons","version":"%s"}\n' "$4" > "$T/plugins/fh-commons/.claude-plugin/plugin.json"
+  printf '{"plugins":[{"name":"fh-meta","version":"%s"},{"name":"fh-commons","version":"%s"}]}\n' \
+    "$5" "$6" > "$T/.claude-plugin/marketplace.json"
+  printf '%s' "$T"
+}
+
+_expect() {  # $1=label $2=expected_rc $3=repo ; also captures OUT
+  OUT=$(bash "$CHECK" "$3" 2>&1); local rc=$?
+  if [ "$rc" = "$2" ]; then echo "  ✅ $1 (rc=$rc)"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — rc=$rc, expected=$2"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+_says() {  # $1=label $2=pattern $3=expected_hit(1|0)
+  local h=0; printf '%s\n' "$OUT" | grep -q -- "$2" && h=1
+  if [ "$h" = "$3" ]; then echo "  ✅ $1"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — hit=$h, expected=$3"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+
+echo "══ version lockstep known pairs ══"
+
+# KN — everything aligned. The control: without it, a checker that always reported DRIFT would
+# still pass every positive lane below.
+_expect "KN  all five strings aligned → exit 0" 0 "$(_fixture kn 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KN  → names the count it actually checked" "4 shipped version string" 1
+
+# KP-1 — the measured miss, byte for byte: second marketplace entry left behind.
+_expect "KP-1 second marketplace entry stale → exit 1" 1 "$(_fixture kp1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.88)"
+_says   "KP-1 → names the offending entry by index+name" "plugins\[1\] fh-commons" 1
+_says   "KP-1 → reports both versions, not just 'mismatch'" "1.4.88  (package.json = 1.4.89)" 1
+
+# KP-2 — a plugin.json left behind. This is the shape the tag lane also cannot see.
+_expect "KP-2 plugin.json stale → exit 1" 1 "$(_fixture kp2 1.4.89 1.4.88 1.4.89 1.4.89 1.4.89)"
+_says   "KP-2 → names the file" "plugins/fh-meta/.claude-plugin/plugin.json" 1
+
+# KP-3 — the reverse direction: package.json bumped alone. Same defect, opposite author error.
+_expect "KP-3 only package.json bumped → exit 1" 1 "$(_fixture kp3 1.5.0 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KP-3 → all four downstream strings flagged" "4 of 4" 1
+
+# HARNESS-ERROR — an instrument that could not look has not looked. These must be a THIRD state,
+# never folded into PASS: this gate guards `npm publish`, an irreversible surface.
+T=$(_fixture he1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/.claude-plugin/marketplace.json" "$T"/plugins/*/.claude-plugin/plugin.json
+_expect "HE-1 no manifests at all → exit 2, NOT 0" 2 "$T"
+_says   "HE-1 → says alignment is UNKNOWN, not aligned" "UNKNOWN, not aligned" 1
+
+T=$(_fixture he2 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{ broken' > "$T/.claude-plugin/marketplace.json"
+_expect "HE-2 unparseable manifest → exit 2, NOT 0" 2 "$T"
+
+T=$(_fixture he3 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/package.json"
+_expect "HE-3 missing package.json → exit 2, NOT 0" 2 "$T"
+
+# A manifest present but carrying no version at all is absence, not agreement.
+T=$(_fixture he4 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{"name":"fh-meta"}\n' > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+_expect "HE-4 manifest with no version → exit 2, NOT 0" 2 "$T"
+_says   "HE-4 → says which file carries none" "carries no version string" 1
+
+echo
+echo "──────────────────────────────────────────────"
+if [ "$FAIL" -gt 0 ]; then
+  echo "VERSION-LOCKSTEP LANES: FAIL ($PASS pass · $FAIL fail)"; exit 1
+fi
+echo "VERSION-LOCKSTEP LANES: PASS ($PASS/$PASS)"

package/scripts/universal_guard_check.sh

@@ -196,8 +196,12 @@ run_case "placeholder BEFORE real, one line → BLOCK" \
 # Each of these previously passed at commit time while BLOCKING at publish time — the two copies
 # of this logic had diverged in leniency. run_state_case swaps the pattern source rather than the
 # staged content, so it needs its own runner.
-run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <expect-exit: block|pass>
-  local name="$1" ovc="$2" defmode="$3" expect="$4" out rc got
+run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <expect-exit: block|pass> [expect-verdict-substring]
+  # The 5th arg exists because exit code alone cannot see this defect class: a scan whose
+  # operator-literal layer never ran exits 0 and used to print the same `✅ PASS` as a scan where
+  # every layer ran. Identical verdicts for different amounts of measurement is the fail-open —
+  # so the anchor has to read the verdict LINE, not just the status.
+  local name="$1" ovc="$2" defmode="$3" expect="$4" want="${5:-}" out rc got
   printf 'operator literal zzsynthoperator\n' > "$SANDBOX/README.md"
   git -C "$SANDBOX" add -- README.md >/dev/null 2>&1
   local ov="$SANDBOX/.psa_state_override"
@@ -208,17 +212,26 @@ run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <e
   if [ "$defmode" = drop ]; then mv "$defbak" "$SANDBOX/.claude/rules/.public-surface-patterns.defaults" 2>/dev/null; fi
   git -C "$SANDBOX" rm -q --cached -- README.md >/dev/null 2>&1; rm -f "$SANDBOX/README.md" "$ov"
   if [ "$rc" -ne 0 ]; then got=block; else got=pass; fi
-  if [ "$got" = "$expect" ]; then
-    echo "  ✅ $name (expected $expect)"
-  else
+  if [ "$got" != "$expect" ]; then
     echo "  ❌ $name — expected $expect, got $got (exit $rc)"
     printf '%s\n' "$out" | sed 's/^/       | /' | head -10
     FAILED=1
+  elif [ -n "$want" ] && ! printf '%s' "$out" | grep -qF "$want"; then
+    echo "  ❌ $name — exit was $got but the verdict line did not say: $want"
+    printf '%s\n' "$out" | grep -E 'PASS|PARTIAL|Confidentiality' | sed 's/^/       | /' | head -5
+    FAILED=1
+  else
+    echo "  ✅ $name (expected $expect${want:+, verdict names \"$want\"})"
   fi
 }
 run_state_case "no patterns at all (instrument down) → BLOCK" "__NONE__" drop  block
 run_state_case "malformed regex in override          → BLOCK" "HIGH	zzsynth[" keep block
-run_state_case "empty override + defaults present    → PASS " ""              keep pass
+# 2026-08-06 — this state still PASSES (a commit is reversible; blocking every fresh clone's first
+# commit is what trains the override into a reflex), but it may no longer CLAIM a clean scan. Pinned
+# as a pair so the label cannot drift back to a bare PASS, and so an unconditional PARTIAL — which
+# would be just as wrong — is caught by the control below it.
+run_state_case "empty override + defaults present    → PASS " ""              keep pass "PARTIAL"
+run_state_case "control: override PRESENT, no hit    → PASS " "HIGH	zzunrelatedliteral" keep pass "✅ PASS"
 
 # ── Pair 7: pattern-ROW malformations that are not invalid regex. Each of these used to be skipped
 # in silence, i.e. a detector the author believed in that never existed, and a scan that certified

package/scripts/version_lockstep_check.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# version_lockstep_check.sh — every shipped manifest must carry package.json's version.
+#
+# Why this exists (measured 2026-08-06, while republishing 1.4.88 → 1.4.89):
+# CLAUDE.md §④-b says to bump "package.json + every .claude-plugin/plugin.json + marketplace.json".
+# That instruction reads as four files, but `.claude-plugin/marketplace.json` carries **one version
+# per plugin entry** — five strings across four files. A bump that edited the first entry left the
+# second at the old version, and `test_tag_version_lanes.sh` passed 8/8 anyway: that lane compares
+# the git TAG to package.json and never opens marketplace.json. The stale entry was caught by an
+# ad-hoc `sort | uniq -c`, i.e. by luck, not by an instrument.
+#
+# Codex caches plugins on the plugin.json version, so a stale entry ships a plugin that the other
+# runtime believes it already has — the drift is silent on exactly the surface that cannot report it.
+#
+# Exit 0 = all aligned · exit 1 = drift (names every offending file:line) · exit 2 = harness error
+# (a manifest is missing or unparseable — NOT a pass; an instrument that could not look has not
+# looked, and this gate guards an irreversible surface).
+
+set -uo pipefail
+ROOT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+
+command -v python3 >/dev/null 2>&1 || { echo "LOCKSTEP: HARNESS-ERROR — python3 unavailable"; exit 2; }
+
+python3 - "$ROOT" <<'PY'
+import json, sys, glob, os
+root = sys.argv[1]
+pkg_path = os.path.join(root, 'package.json')
+try:
+    want = json.load(open(pkg_path))['version']
+except Exception as e:
+    print(f"LOCKSTEP: HARNESS-ERROR — cannot read {pkg_path}: {e}")
+    sys.exit(2)
+
+# (path, list-of-(label, version)) — every manifest that ships a version string.
+targets = []
+for p in sorted(glob.glob(os.path.join(root, 'plugins', '*', '.claude-plugin', 'plugin.json'))):
+    targets.append(p)
+mk = os.path.join(root, '.claude-plugin', 'marketplace.json')
+if os.path.exists(mk):
+    targets.append(mk)
+
+if not targets:
+    # Absence is not alignment. If the manifests vanished, say so rather than reporting a clean run.
+    print("LOCKSTEP: HARNESS-ERROR — no plugin/marketplace manifest found; alignment is UNKNOWN, not aligned")
+    sys.exit(2)
+
+drift, checked = [], 0
+for p in targets:
+    try:
+        d = json.load(open(p))
+    except Exception as e:
+        print(f"LOCKSTEP: HARNESS-ERROR — cannot parse {p}: {e}")
+        sys.exit(2)
+    rel = os.path.relpath(p, root)
+    # A manifest carries a version either at the top level (plugin.json) or once per plugin entry
+    # (marketplace.json). Walk both shapes so a new entry cannot be silently uncovered.
+    found = []
+    if isinstance(d.get('version'), str):
+        found.append(('(top-level)', d['version']))
+    for key in ('plugins', 'entries'):
+        for i, ent in enumerate(d.get(key) or []):
+            if isinstance(ent, dict) and isinstance(ent.get('version'), str):
+                found.append((f"{key}[{i}] {ent.get('name', '?')}", ent['version']))
+    if not found:
+        print(f"LOCKSTEP: HARNESS-ERROR — {rel} carries no version string; expected at least one")
+        sys.exit(2)
+    for label, got in found:
+        checked += 1
+        if got != want:
+            drift.append(f"  {rel} :: {label} = {got}  (package.json = {want})")
+
+if drift:
+    print(f"LOCKSTEP: DRIFT — {len(drift)} of {checked} shipped version string(s) do not match package.json")
+    print("\n".join(drift))
+    print("Bump every string above in the same commit — Codex caches plugins on this version,")
+    print("so a stale entry ships as 'already installed' on the runtime that cannot report it.")
+    sys.exit(1)
+
+print(f"LOCKSTEP: PASS — {checked} shipped version string(s) all at {want}")
+PY

package/templates/.git-hooks/pre-commit

@@ -303,6 +303,14 @@ else
         echo "  → '~' or '{project}'), or PUBLIC_SURFACE_OK=1 git commit … for a reviewed mention."
         FAILED=1
       fi
+    elif [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
+      # NOT `✅ PASS`. The scan found nothing, but one whole layer of it — the operator/company
+      # literals — never ran. A missing measurement is not a zero (CLAUDE.md §Instrument
+      # Calibration), and a verdict that reads identically whether a layer ran or not is the
+      # fail-open this repo names. The commit is still allowed: a commit is reversible, so the
+      # degrade here is advisory by the Surface-Class Degrade Invariant. Push and publish, which
+      # are the acts that make content public, block this same state.
+      echo "  ⚠️  PARTIAL — no hit in the committed defaults; company/companion literals UNMEASURED."
     else
       echo "  ✅ PASS"
     fi

package/templates/.git-hooks/pre-push

@@ -298,9 +298,21 @@ else
   _pp_why=""
   [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_DEFAULTS_OK" -eq 0 ] && _pp_why="committed pattern defaults unreadable/empty"
   [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_BAD_ROWS" -gt 0 ]    && _pp_why="${_pp_why:+$_pp_why; }$PSA_BAD_ROWS unusable pattern row(s)"
+  # 2026-08-06 — the 07-26 warn stays for the case it was right about, and is SCOPED, not reverted.
+  # An absent override is a legitimate configuration gap in a fresh clone / CI runner / worktree (the
+  # file is gitignored, so it is absent there by construction) → WARN, exactly as 07-26 concluded.
+  # In an operator-configured checkout the same state is missing evidence, not a missing config, and
+  # this is an irreversible surface → BLOCK, matching what `public_surface_scan_files.sh` already does
+  # at `npm publish`. Two irreversible surfaces degrading in opposite directions on the same state was
+  # the actual defect; git push was the lenient one.
+  psa_detect_operator_context "$REPO_ROOT"
   if [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
-    echo "  ⚠️  operator-literal override absent — only the committed defaults (home paths + credential"
-    echo "     shapes) are active. Populate .claude/rules/.public-surface-patterns for company literals."
+    if [ "$PSA_OPERATOR_CONTEXT" -eq 1 ]; then
+      _pp_why="${_pp_why:+$_pp_why; }operator-literal override absent in an operator-configured checkout (company/companion literals NOT scanned)"
+    else
+      echo "  ⚠️  operator-literal override absent — only the committed defaults (home paths + credential"
+      echo "     shapes) are active. Populate .claude/rules/.public-surface-patterns for company literals."
+    fi
   fi
   if [ -n "$_pp_why" ]; then
     if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then

package/templates/degrade_direction_scan.sh

@@ -164,9 +164,41 @@ for f in "${FILES[@]}"; do
     # yields "9\n0" and the `-gt` guard goes silent. Verified as a known pair (both directions) in
     # scripts/test_degrade_scan_shell_probes.sh; narrowing without that anchor would just trade a
     # noisy probe for a blind one.
+    #
+    # WIDENED 2026-08-04 — the narrowing had gone one step too far, and the proof is that this
+    # probe was BLIND to the live instance that bit us the day before. PR #251 fixed
+    # `grep -c … | tr -d ' ' || echo 0` in session_close_check.sh ④-e; running this scanner over
+    # the pre-#251 file produced ZERO hits (re-measured: fixed rule = 2, old rule = 0).
+    #
+    # THE ANCHOR WAS ON THE WRONG PROPERTY. The old regex asked "is there an upstream pipe" and
+    # required the counter to be the LAST stage. Neither is the discriminator. The discriminator
+    # is: **does the failing side still EMIT?** `grep -c` prints "0" and exits 1 on no-match, so it
+    # disarms with no upstream pipe at all, and any trailing stage that passes that "0" through
+    # keeps the "0\n0" intact.
+    #
+    # A first fix widened to a NAMED filter list (tr|head|sed|…). Cross-family review (gpt-5.5,
+    # 2026-08-04) refuted it with reproduced counter-examples, and the refutation held on
+    # measurement in BOTH directions:
+    #   · still missed, all verified to yield "0\n0": `grep -Ec …`, `grep --count …`, `grep -Fcx …`
+    #     (combined/long flag forms the `-c` literal never matched) and `| cat`.
+    #   · newly over-matched: `| tail -n +2` after the counter yields ONE line — not a disarm.
+    # Name-based approximation produced under-match and over-match simultaneously. So the trailing
+    # chain is no longer enumerated: the rule keys on the COUNTER (grep with a `c` in any flag
+    # cluster or `--count`; or `wc` behind a real pipe) plus the `|| echo 0` fallback, and accepts
+    # any chain between them.
+    #
+    # PRESERVED from the 2026-07-28 narrowing, still pinned as known-negatives: (a) `a || b ||
+    # echo 0` has no pipeline, and (b) a stage that emits NOTHING on failure (`| jq -r … ||
+    # echo 0`) — there the fallback supplies the only line, as intended.
+    # KNOWN RESIDUAL, stated not hidden: a trailing stage that can swallow the counter's output
+    # (`| tail -n +2`, `| sed -n '/[1-9]/p'`) is now flagged though it is not a disarm. That is a
+    # deliberate recall-over-precision trade on an ADVISORY probe, taken because the measured cost
+    # of the other direction was a real defect shipping. Revisit if non-fixture FPs appear.
+    # Known pair: scripts/test_degrade_scan_shell_probes.sh (9 positives / negatives silent).
+    # Reverting this line turns the positive lane red — checked by applying the revert.
     while IFS= read -r m; do
-      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline ending in a counter (grep -c/wc) — that stage emits even when an upstream stage fails, so under \`set -o pipefail\` the value gains a SECOND line, the integer comparison errors out, and the guard passes silently; split the pipeline and sanitize to an integer"
-    done < <(grep -nE '[^|]\|[[:space:]]*([a-z]+[[:space:]]+)*(grep[^|]*-c|wc)[^|]*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback after a COUNTER (grep with -c / --count, or wc) — the counter PRINTS \"0\" and exits non-zero on no-match, so the fallback appends a SECOND line, the value becomes \"0\\n0\", the integer test dies with 'integer expression expected' (stderr only) and the guard goes silent; split it and sanitize: n=\$(...); n=\${n:-0}; case \$n in *[!0-9]*) n=0;; esac. VERIFY the trailing stage can actually emit — if it swallows the count (| tail -n +2), this is a known false positive"
+    done < <(grep -nE '(([^|]\|[[:space:]]*([a-z]+[[:space:]]+)*wc[^|]*)|(grep([[:space:]]+-[A-Za-z]*c[A-Za-z]*|[[:space:]]+--count)[^|]*))([^|]*\|[^|]*)*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
              | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
   fi

package/templates/regression_guard.sh

@@ -117,6 +117,31 @@ GUARD_PATHSPEC=(
   'AGENTS.md'
   'docs/*.md'
   'templates/*.md'
+  # ── Added 2026-08-04 — the pathspec had drifted from the 4-axis ASSET LIST it exists to gate.
+  # Measured that day by mechanically walking every asset class in CLAUDE.md §FH Improvement
+  # 4-Axis against this array: four classes had NO covering pattern, and two of them are this
+  # repo's own mechanical floor — `templates/.git-hooks/*` (the hook that hard-blocks commits)
+  # and `templates/*.sh` (THIS FILE — the guard could not guard itself). The pre-commit HEAVY
+  # classifier already listed `^scripts/.*\.sh$`, so a scripts-only change entered the heavy
+  # path and then met Axis 1 returning `SKIP (not-checked, NOT a pass)`. Observed three times
+  # on 2026-08-04 alone, the third being the S5 fix (PR #253) — a change to a verdict-surface
+  # scanner that shipped with zero Axis-1 coverage.
+  #
+  # Calibrated before shipping, both directions (a widened copy, run against real history):
+  #   · 12 consecutive historical commits touching scripts/*.sh → M=0 S=0 (no FP storm), and a
+  #     control confirmed the files were actually SELECTED (4 files checked) rather than the
+  #     zero coming from an inert pathspec — the unwired-instrument reading of a clean 0.
+  #   · known-positive: truncating a shipped .sh by 60% → M-TIER BLOCK (`BLOCK` token dropped
+  #     100%, 60% line reduction). The md-shaped checks (F1 frontmatter, F2 sections, F3 fences)
+  #     are inert on shell files; F4 keyword / F5 xref / F6 line-loss / F7 syntax are the ones
+  #     that carry, and they are exactly the regressions that matter in a gate script.
+  # NOTE on globbing: git pathspec `*` crosses `/` (verified here — `templates/*.md` matches
+  # `templates/.claude/rules/session.md`), so these single-star forms are recursive.
+  'scripts/*.sh'
+  'templates/*.sh'
+  'templates/.git-hooks/*'
+  'plugins/*/agents/*.md'
+  '.claude/agents/*.md'
 )
 
 # 계기 무결: base ref 가 안 풀리면 diff 실패가 2>/dev/null 로 삼켜져 CHANGED 공백 →