@chrono-meta/fh-gate 1.4.89 → 1.4.90

package/.claude/judgment_circuits.txt

@@ -0,0 +1,14 @@
+# 판단 회로 등록부 — `scripts/judgment_circuit_lint.sh` 의 트리거 (pre-commit advisory)
+#
+# 여기 등록된 파일이 스테이징되면 회로 린트가 돈다. **글롭이 아니라 명시 등록**인 이유:
+# "어떤 문서가 판단 회로인가"는 사람이 내리는 결정이지 확장자가 추론할 일이 아니다.
+# 글롭으로 걸면 모든 .md 에서 발화하고, 그런 게이트는 결국 꺼진다.
+#
+# 판정: CIRCUIT(금지 0 ∧ 허용 ≥3/5) · PARTIAL · PERSONA(금지 ≥1 ∧ 허용 ≤2/5)
+# 전부 ADVISORY — 차단하지 않는다. 히트는 "이게 회로임을 증명하라"는 뜻이다.
+#
+# 형식: 레포 상대경로 한 줄에 하나. `#` 로 시작하면 주석.
+
+# FH 자신의 판단 회로 (§Identity · 독트린 · 게이트 방향). 2026-08-08 실측 = CIRCUIT 4/5,
+# 없는 형식 = 자기봉인("~는 이 작업의 대상이 아니다"). 그 한 칸이 다음 라운드 후보다.
+CLAUDE.md

package/.claude/rules/fh_4axis_gate.md

@@ -68,6 +68,13 @@ FH asset modified → Axis 1 (templates/regression_guard.sh --pr {BRANCH})
   → Axis 2 (/steel-quench) → Axis 3 (/phantom-quench)
   → marker: tracks/_meta/.axes_23_passed_{branch}_{date}.marker
      (required fields: axis2-engine / axis2-model / floor-status / axis2-evidence;
+      + **`crossfamily:`** — required on LOAD-BEARING changes only, and TYPED since 2026-08-08:
+      `panel(<families>)` | `declined` | `DEGRADED_SINGLE_FAMILY` | `DEGRADED_PANEL_UNUSED` |
+      `UNKNOWN`, the three degrade values requiring substantive grounds on the same line.
+      Presence has been required since c1fa459; what was free prose is now a closed enum,
+      because a presence check catches silence but not a confident wrong answer — a sibling
+      harness shipped `crossfamily: none — 도달 불가` that was later found false and then cited
+      as grounds. Fixtures: `scripts/test_marker_crossfamily_lanes.sh`;
       **recorded-by-convention, validated by nothing**: `axis2-rounds` (per-round yield vector) —
       steel-quench §Convergence Criteria consumes it, and a hook check for it was built and then
       REMOVED the same day for firing on 100% of markers. The convergence claim it supports is

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.89",
+      "version": "1.4.90",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.89",
+      "version": "1.4.90",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -104,6 +104,31 @@ control; FH supplies the quality gate after goal completion.
 > **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Invocation-patterns`
 > — single, parallel, and wave composition examples — read when choosing a dispatch shape.
 
+### Before dispatching without being asked
+
+FH treats isolated delegation as part of what a harness *is*, so it leans toward dispatching rather
+than absorbing separable work inline. One boundary comes with that, and it is runtime-agnostic:
+
+```
+unprompted dispatch is available only when a standing request from the user is RECORDED —
+  in a durable local file, carrying all three of:
+    the user's own words, quoted   · a dated lease   · a scope line
+no such record, or the lease has lapsed, or you cannot tell (fresh clone · a runtime whose
+  own prompt may restrict this)
+  → the request is absent, and absent is not granted → ask per invocation
+```
+
+Four notes for anyone porting this. A record is only a record if the *user* authored the quoted
+words — an agent writing the file on its own initiative has produced nothing. Consent is **leased,
+not owned**: past the lease date the record stops counting and you go back to asking. Every run that
+proceeds *without* a prompt should say that it is doing so, so an unnoticed grant cannot accumulate
+silently. And the request buys not-being-asked about the dispatch; it never relaxes a gate at what
+the dispatched agent then touches (publish, delete, history rewrite).
+
+The Claude-side rationale — including why the boundary is phrased around a *conditional* rather
+than a prohibition — lives in `CLAUDE.md §Agent Dispatch Operation` and is specific to that runtime.
+The constraint above is not.
+
 > **Detail**: See `knowledge/shared/harness-core/agents_md_runtime_details.md §Codex-entry-points`
 > — runnable `fh-run` and `codex exec` forms — read before invoking FH from Codex.
 

package/CLAUDE.md

@@ -43,6 +43,8 @@ core invariants never melt). The nursery also **verifies what it births**: harne
 | **③ AI Collaboration Guide** | Accumulates and distributes best practices for token efficiency and dialogue methodology — "how to ask, delegate, and record". | `CHEATSHEET.md` · `knowledge/shared/dialogue/ai_dialogue_playbook.md` · `MEMORY.md` intent-based + associative recall (`knowledge/shared/dialogue/memory_intent_recall.md`) |
 | **Core Axis** | **Harness Engineering (How)** — the methodology and practice axis that realizes the three layers above. The 6-axis framework is the operating unit. **A harness is a means, not an end** — Field harness: "simpler over time" (complexity = warning signal). Meta-harness: *optimize*, not necessarily simplify — complexity earns its scope; red flags are orphaned, redundant, and decorative units, not complexity itself. | `harness_6axis_framework.md` · `hub_compounding_loop.md` · `claude_code_runtime_flow.md` · `plugins/*/agents/` (sub-agents) |
 
+> **3층 정본 — 공정 · 엔진 · 정체성**: FH 를 설명하는 뼈대는 세 층이고 셋의 관계가 정본으로 적혀 있다 — **3단 공정**(엔진을 벼리는 순서: 초기 영혼 → 중간 탈상관 가속화 → **마무리 4축 태우기**) → **4대 엔진**(영혼·품질게이트·질문하기·맥락유지) → **5대 정체성**(사람이 실제로 쓰는 기능). **Read `knowledge/shared/harness-core/fh_three_layer_canon.md`** before naming, re-scoping, or citing any of the three — it also defines the **4 verification axes** (ⓐ구현 · ⓑ재는 방식 · ⓒ주장 · ⓓ앵커) that the third stage actually consists of, and states why the three are *not* a clean stack. Grade table stays canonical in `ship_readiness_gate.md`; this pointer never carries grades.
+
 ## Core Reference Documents (Consult First)
 
 Four foundational assets for hub operations. **Mandatory pre-reference** before new design, protocol proposals, or framework extensions.
@@ -215,11 +217,31 @@ into muscle memory and disarm it.
 > *Origin*: before that change the server had `enforce_admins: false`, so an admin push *satisfied*
 > the rule and merely printed `Bypassed rule violations` — a notice, not a block. A rule that
 > announces its own bypass is not a floor.
-> ⚠️ **Unresolved residual**: `allow_force_pushes` on `main` is still `true`. Two documented API
-> attempts to set it `false` were accepted without error and did **not** persist (verified by
-> independent GET, not by the write response). Force/non-ff pushes are blocked locally by this same
-> hook, so the honest-model case is covered — but the **server-side** history-rewrite surface on
-> `main` remains open. Re-check before relying on it.
+> ✅ **Retraction — the server-side force-push surface is CLOSED, and the way it was misread is the
+> durable part.** An earlier version of this block said `allow_force_pushes` on `main` was "still
+> `true`", that two API writes "did not persist", and that the **server-side** history-rewrite
+> surface therefore "remains open". The field reading was correct; the conclusion was not.
+> **Branch protection is two independent layers — legacy protection and rulesets coexist, and the
+> strictest wins** — so a field on the protection object is never the effective answer by itself.
+> Measured on this repo 2026-08-09: `GET /repos/{owner}/{repo}/rules/branches/main` returns
+> `non_fast_forward` from ruleset `main-no-force-push` — `enforcement: active`,
+> `current_user_can_bypass: never`, `bypass_actors: []`, live since 2026-07-25 — while the legacy
+> object still reports `allow_force_pushes: true`. The two API writes that "did not persist" were
+> writing to the layer that does not govern *this* outcome while the stricter ruleset is active — not
+> a layer that is inert in general: disable or retarget the ruleset and the legacy toggle governs
+> again. **Read BOTH layers before declaring any branch surface open or closed** — `/rules/branches/
+> {branch}` shows only what the *rulesets* impose, and `/branches/{branch}/protection` only what
+> *legacy protection* imposes; neither is the effective view alone. A protection-object field read by
+> itself misjudged this three times ([[reference_github_protection_two_layers]]).
+> **Scope of the retraction, stated narrowly on purpose**: it covers *force-push / non-fast-forward*,
+> which is what `non_fast_forward` blocks. Branch **deletion** is a separate rule and is closed on the
+> other layer (`allow_deletions: false`, same GET). PR-routing is likewise a different field —
+> `required_pull_request_reviews` present with `enforce_admins: true` — not something
+> `required_status_checks` says anything about.
+> ⚠️ A *different* residual on `main` is still real and must not be folded into the one just
+> retracted: `required_status_checks.contexts` is `[]` — pushes are routed through PRs by the fields
+> just named, but **no check is required to be green** for one to merge (named again in the 4-axis
+> section below).
 
 ## Permission-Denial Guidance (When Auto-Mode Blocks an Action)
 
@@ -313,7 +335,19 @@ deconfliction: this gate reviews **field code being authored**; the Irreversibil
 **Degrade direction (fail-closed)**: no different-family auditor reachable → **NOT-CONVERGED** —
 block the autonomous merge / ask the operator / proceed only under an **explicit, logged
 same-family-only acknowledgment**; never a silent same-family pass (§Irreversibility Surface-Class
-Degrade Invariant). **Residency**: sanitize company code before any external-family dispatch; domain data never leaves.
+Degrade Invariant). **That acknowledgment is now typed, not prose**: the Axes 2–3 marker carries
+the marker's **`crossfamily:`** line — required on load-bearing changes since c1fa459, and a closed
+enum since 2026-08-08 — `panel(<families>)` · `declined` · `DEGRADED_SINGLE_FAMILY` ·
+`DEGRADED_PANEL_UNUSED` · `UNKNOWN`, the three degrade values hard-blocked at commit without
+substantive grounds on the same line naming what was probed (`templates/.git-hooks/pre-commit`, fixtures
+`scripts/test_marker_crossfamily_lanes.sh`). *could not* (`DEGRADED_SINGLE_FAMILY`) · *did not*
+(`DEGRADED_PANEL_UNUSED`) · *did not look* (`UNKNOWN`) are **separate values on purpose** — free
+prose collapsed them, which renders an unrun probe as a zero finding and an unused panel as an
+unavailable one. This is also what reconciles this line with `auto-decorrelation`
+Step 6's *"silent degrade, never hard-fail"*: **not-blocking and not-silent are different
+properties**, and only the second is mandatory on a reversible commit surface. Before 2026-08-08
+this axis was convention-only — measured on this repo, 140 markers carried the tier verdict 129
+times and any decorrelation verdict **4** times. **Residency**: sanitize company code before any external-family dispatch; domain data never leaves.
 **Autonomy**: autonomous once UAP-consented; **in autonomous loops the gate is part of the delegated
 pipeline**, not an afterthought, and a below-floor orchestrator RUNS the review by default
 (run-first, ask-last — `sonnet_floor_doctrine.md`).
@@ -370,8 +404,13 @@ installed **FH assets** run the **4-axis gate**; **field scaffolds** run **`asse
 repo, so this routing is not redundant with it) · **autonomy floor** — discover/rank trusted at opus-tier+;
 below-floor, present the raw recommend and ask · **HITL per item**, and `"끝까지 해줘 / 자율로 완주"` → full-autonomy under the `/goal-quench`
 gate: autonomy removes the per-item *prompt*, **never the gate**. Honesty boundary that must not soften in
-summary: the chamber to date **screens**; it has not *birthed* — simulate-first is a one-line HITL
-recommendation, never a push-button autonomous emit.
+summary: the chamber **overwhelmingly screens** — hand-counted 2026-08-08 from the run ledger:
+9 full runs, **8 KILL, 1 EMIT**. It has birthed **once** (run #9 `forge-wiki`, shipped publicly), so
+"it has not birthed" — the earlier wording here — is no longer true. But do not upgrade the claim
+either: that run's workspace carries only a verdict file, with no intent/budget/blind-persona
+artifacts, so the **formal flow** is not what produced it. The first end-to-end formal run is #10 and
+it KILLed. Either way simulate-first stays a one-line HITL recommendation, never a push-button
+autonomous emit.
 
 > **Detail**: See `knowledge/shared/harness-core/onboarding_acceleration_autopilot.md` — full Phase-0 branch
 > logic + `chamber_run.sh` scope, the per-phase skill composition, the remaining guards (no-reinvention
@@ -592,13 +631,138 @@ Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidir
 
 > **Runtime authority (canonical):** one explicit governor per context + capability-routed sidecars; sidecar findings are evidence candidates, not terminal verdicts, until source-closed by the governor *via a mechanical anchor* — never governor agreement alone. CC=action/governor · Codex=repo-grounded audit sidecar · Gemini/agy=breadth/multimodal sidecar · other runtimes=portable `AGENTS.md` entrypoint only. Full doctrine + Maintenance-Cost Rule: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
 
-Default operation is a **standard interactive session**. Agent dispatch (single or parallel) is used when the task warrants it — not as a default mode. Three execution paths:
+**Isolated delegation is a component of the identity, not an optional extra** (operator decision,
+2026-08-08). FH/PMH are defined as governor + orchestrator; a harness that cannot dispatch is a
+contradiction in its own terms. So **agent dispatch is default-active**: reach for it whenever a unit
+of work is genuinely separable — independent tasks, a blind evaluation that must not see the author's
+reasoning, a search that would otherwise flood this context — **without waiting to be asked**. The
+earlier wording here ("used when the task warrants it — not as a default mode") is superseded.
+
+**Two different things turn it off, and conflating them is how a session talks itself into
+dispatching.** ⓐ the user saying not to, *in this environment* — a veto of **this file's posture**;
+ⓑ **the absence of a request**, wherever the runtime carries the conditional line described below.
+Under a conditional, silence is not permission. ⓐ is FH's own default being withdrawn by its owner;
+ⓑ is a sentence in a layer FH does not author. Do not read them as one operation.
+
+⚠️ **Neither direction has a confirmed hook-level floor. Say that plainly rather than implying one.**
+```
+opening    salience only for the POSTURE. The prohibition met in the field is CONDITIONAL,
+           which changes what "override" even means — see the measured block below.
+blocking   ALSO not hook-enforced. `SubagentStart` fires on spawn but is **context-only** —
+           it cannot block, exit 2 only surfaces stderr, and it has no decision field
+           (official hooks reference, read 2026-08-08). It can INJECT context at the moment
+           of dispatch, which is better-placed salience than this file, but still salience.
+UNVERIFIED whether a `permissions` deny entry or a `PreToolUse` matcher can target subagent
+           spawning at all — the reference does not name a tool for it, and this repo has no
+           precedent. **Do not cite a blocking mechanism until someone runs the known pair**
+           (configure the deny, attempt a dispatch, observe). Until then: unverified, not absent.
+```
+**The conditional line, and what a session must do about it.** Some runtimes ship the default
+*"Do not call the AgentTool unless the user requested it"* (with a workflows/deep-research twin).
+Measured 2026-08-09 on this machine: it is **not** a hard-coded constant and **not** global — it is
+the third branch of a three-tier resolution, replaceable and flag-switchable, and gated to one model
+bundle. So it is a **conditional**, and a request *satisfies* it rather than having to outrank it.
+Which request, though, is an **interpretation** — narrow (per-invocation) or standing — and FH takes
+the standing reading only under provenance:
+
+```
+RECORDED   a durable local binding (CLAUDE.local.md, or the onboarding answer) carrying
+           three things, each of which adds information the others do not:
+             the operator's own words, quoted     — who granted it
+             a dated lease                        — until when (§OAL: consent is leased)
+             a scope line                         — for what. A runtime may carry more than
+                                                    one prohibition line; granting one never
+                                                    grants the other
+           Any of the three missing → not a record → treat as NOT RECORDED.
+           → dispatch without asking, inside that scope, until the lease lapses
+           (Nothing else is a field. The request removes the PROMPT and never a gate — that
+            holds by the rule below, not by a line the author ticks. A field whose content is
+            already fixed by the rule certifies nothing and can only fail closed on a typo.)
+NOT RECORDED  no binding · fresh clone · ephemeral session whose local files were reclaimed ·
+           conditional-line presence UNKNOWN (a session cannot read its own system prompt —
+           unknown is not absent; assume the conditional applies)
+           → request ABSENT. absent ≠ granted → ask per invocation.
+           This is the default for every install that is not the author's.
+```
+
+**A session may not write its own permission slip.** The authority is the quoted operator utterance,
+never the paragraph's existence; an entry missing any of the three **is not a record** —
+treat it as absent — *any of the three above*, not some longer list; the schema is the whole test.
+**Lease length is the operator's to set, never the session's**, and renewal needs a fresh utterance:
+a session that re-dates an expired lease on its own has forged a record, which is this paragraph's
+whole subject. **Named residual, stated at the same strength as §Operational Adaptation Loop's:
+the record is self-attested.** Every part of it is writable by the beneficiary, so form-checking
+catches silence, not forgery — and this one is **unmitigated on a default install**: the binding is
+gitignored, so there is no write-time history to check the cited dates against. (An operator who
+mirrors it into a private version-controlled store gets that check; that is *their* setup, not a
+property of the rule, and an earlier draft of this sentence claimed it generally.) The lease is the
+only part that decays on its own — **and nothing reads it**. Correcting a wrong reason given earlier
+in this branch: that gap is *not* "below the mechanization threshold, so don't build it."
+`scripts/consent_registry_check.sh` already enforces leases (requires `expires`, rejects past dates,
+caps at 365 days) and is lane-tested. It is **unwired here**, which is a different defect with a
+different fix, and "don't build" was covering for it. Wiring it is a real decision, not a chore:
+the registry's own floor forbids `promotion_eligible: true` for a class whose effects feed
+irreversible sinks, and a dispatched subagent does — so registering this grant would either be
+rejected by that floor or require declaring it something the registry does not govern. That is the
+operator's call, and until it is made the lease is **honoured by reading, not by machinery**.
+
+**Scope of the consent carve-out — it exits ONE clause, not the section.** §Operational Adaptation
+Loop has two separable parts: (i) the *derivation* rule (standing consent inferred from 3× accepted),
+and (ii) **action-class floors that hold regardless of how consent arrived** — a class never promotes
+if its sinks are irreversible, if it *feeds* such a sink (taint propagates through reversible steps),
+or if that is unknown. A direct operator instruction is outside **(i) only**. **(ii) still applies in
+full**, and it bites here: a dispatched subagent inherits tools and therefore feeds publish/delete/
+history-rewrite sinks — so the standing request buys *not being asked about the dispatch*, never a
+relaxed gate at the sink. The per-run announce duty and expiry from §OAL likewise survive.
+**Discriminator is mechanical, not introspective**: the test is whether a literal operator utterance
+is quoted in the record (greppable) — **not** whether the session judges its own reasoning to be
+instruction-shaped. A self-test the session administers to itself is the thing §OAL forbids
+("decided mechanically from the registry — never by the session's own judgment").
+
+> **Detail**: `knowledge/shared/harness-core/dispatch_conditional_prohibition.md` — the resolution
+> order, the model-bundle gate, the calibrated where-it-is-not table, and the reproduction commands.
+> **Read it before citing any of these numbers or claiming the line is absent from a surface.**
+
+An earlier draft of this very block asserted "a `SubagentStart` hook can deny, and a denial there is a
+real floor." That was false, taken on trust from an adjacent session and written here before the
+reference was read. A second draft, on 2026-08-09, then wrote that the constant's call site "needs
+binary inspection, which was blocked" — **also false**: three plain `grep` calls resolved it, and an
+adversarial reviewer demonstrated that by doing it. Declaring something unmeasurable before trying the
+cheap tool is [[feedback_impossible_verdict_may_be_unread_half]]; the honest label is *"not yet
+measured,"* never *"blocked."* A blind target-tier sim then read it back correctly — which shows a sim measures
+whether text is *followable*, never whether it is *true*. Both checks are needed; neither substitutes.
+
+So "default-active" is a **posture, not a guarantee**. Measured 2026-08-08: a session running under
+exactly that system-prompt instruction worked alone for a full session and dispatched only at the two
+points where the operator named it — while this file said dispatch was available. A session that
+*cannot* dispatch must **say so** rather than quietly doing everything inline; the silent version is
+what made that case invisible until the operator asked. Writing "default is active" into a remote
+canon without this paragraph produces the next session that reads it and still cannot comply.
+
+**Onboarding**: at first setup, ask whether this environment wants dispatch and **write the answer into
+the local binding** (`CLAUDE.local.md`) **in the three-part form above — quoted words, a lease the user
+picks, a scope** — not only into the session. Ask for all three at that moment; a record written with
+two of them is invalid, and the only route past an invalid record is the session inventing the third,
+which is forgery. **A gate that blocks every new install is not a strict gate, it is a bypass
+trainer** — so the ask is **wired, not left to prose**: `install-wizard` **Step 3-D** collects all
+three at setup and writes them down, and carries any mechanical settings change under the same
+approval (operator decision, 2026-08-09: *users of FH/PMH run parallel by default; where a mechanical
+config change is needed, take consent through the install-wizard contract and change it then*).
+A recorded **decline** is also a record — it stops later sessions re-asking. This is why the answer
+belongs at setup — that is the one moment where the
+choice is cheap to make, and a durable record is the whole point: a *yes* left in a transcript expires
+with the transcript, while the conditional line above is re-evaluated by every cold session. A recorded
+standing request is therefore not bookkeeping — it is the thing that satisfies the condition. Wiring the
+*blocking* direction to a mechanism still waits on the **UNVERIFIED (deny-mechanism) line** above — not
+the UNVERIFIED (call-sites) line, which is a different open question; the honest install note says so.
+
+Three execution paths:
 
 | Path | Situation | Method |
 |---|---|---|
 | **Direct edit** | Simple modification of mapped project files | Read/Edit with absolute path (no cwd switch needed) |
-| **Agent dispatch** | Field project work · single independent task | Inject Context Card then dispatch Agent |
-| **Parallel dispatch** | 2+ genuinely independent tasks, explicitly requested | Dispatch parallel Agents |
+| **Agent dispatch** | Field project work · single independent task — **same RECORDED requirement as the row below**; the provenance gate is per *spawn*, not per *fan-out width* | Inject Context Card then dispatch Agent |
+| **Parallel dispatch** | 2+ genuinely independent tasks — **requires a RECORDED standing request** (see the provenance gate above); otherwise ask per invocation | Dispatch parallel Agents |
 
 **Why not Agent View by default**: Agent View introduces worktree isolation (blocks settings.json writes, Stop hook timing differs), session context gaps (session card stale content bug), and path friction — with no benefit unless the user is actively managing multiple agent sessions. Parallel agents via `Agent` tool work identically in a standard session.
 
@@ -638,7 +802,10 @@ true statement about one thing (provenance) was standing in for an untested clai
 recurrence is 1, below this repo's own N≥3 mechanization threshold. If it recurs, the check is a
 two-line hook addition, not a research problem.
 
-**Forbidden responses**: *"I can't do that — I'm not in that project's cwd"* — self-check Agent dispatch first.
+**Forbidden responses**: *"I can't do that — I'm not in that project's cwd"* — self-check Agent dispatch
+first. And **silently working alone while dispatch is unavailable**: if this environment blocks
+subagents, name it once rather than absorbing the whole job inline — an unstated constraint reads as a
+capability the harness simply chose not to use.
 
 Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.
 

package/knowledge/shared/harness-core/dispatch_conditional_prohibition.md

@@ -0,0 +1,105 @@
+# The conditional dispatch prohibition — what it actually is
+
+> Detail file for `CLAUDE.md §Agent Dispatch Operation`. The resident summary carries the
+> **behavioural rule**; this file carries the **measurement** behind it. Read this before citing any
+> number here, before claiming the line is absent from a surface, and before re-running the probe.
+
+## The two lines
+
+Some runtimes ship these as a default addition to the session prompt:
+
+```
+Do not call the AgentTool unless the user requested it
+Do not use workflows or deep-research unless the user requested it
+```
+
+## What was measured
+
+**Scope of the measurement — state it before the numbers.** n=1 machine · macOS · install path
+`~/.local/share/claude/versions/` · CLI versions 2.1.223–226, all four identical. Nothing here is a
+claim about other platforms, other install paths, or later versions. Re-run before citing elsewhere.
+
+```
+occurrences of each line          3
+CONTROL     "AgentTool"          37     ← instrument alive on this target
+NEG-CONTROL "zzz_known_negative" 0      ← instrument not hallucinating hits
+```
+
+An unqualified `grep -c` (without `-a`) returns **empty** on this binary — it dies silently. That is
+exactly the instrument death the control pair exists to catch; a bare `0` from it would have read as
+a measurement.
+
+### Resolution order — it is a fallback, not a constant
+
+```js
+function JWb(e){
+  let t = wk()?.tengu_heron_brook;        // ① client-data string  → returned if non-empty
+  if (typeof t === "string" && t.trim() !== "") return t.trim();
+  let r = nt("tengu_heron_brook","");     // ② remote flag string  → returned if non-empty
+  if (r.trim() !== "") return r.trim();
+  if (Hbo(e)) return H3p;                 // ③ the two lines — only if the gate below passes
+  return null;
+}
+function Hbo(e){
+  if (e === void 0) return false;
+  if (lB(Eo(e), "opus_5_prompt_bundle") !== true) return false;   // model-bundle gate
+  return !nt(VE_, false);                                          // VE_ = "tengu_fennel_godwit"
+}
+```
+
+Three consequences:
+
+1. **Not hard-coded.** It is the third branch of a three-tier resolution — ① and ② replace it
+   wholesale, and a remote kill-switch disables it.
+2. **Not global — model-scoped.** It attaches only under `opus_5_prompt_bundle`. A session on another
+   bundle never receives it. **Do not reason about this line without knowing which bundle you are on.**
+3. **Genuinely conditional.** All 3 occurrences of each prefix carry `unless the user requested it`;
+   no unconditional variant exists (checked with a live negative control on the phrasing regex).
+
+### Where the text is *not* — two rows, kept apart on purpose
+
+Merging these is the `not-found ≠ zero` defect this repo keeps naming
+([[feedback_not_found_is_not_zero_family]]).
+
+| Row | Targets |
+|---|---|
+| **MEASURED ZERO** — target exists, grep calibrated on that target | user + project `settings.json` · project `settings.local.json` · `~/.claude.json` · `~/.claude/plugins/**` · both launcher app bundles |
+| **LAYER ABSENT** — nothing to search; silence, not a zero | user `settings.local.json` · `.claude/agents/**` (user and project) · output-styles (user and project) |
+
+**INFERENCE, not measurement**: *"so it cannot be turned off from config."* Only the
+**operator-facing** config layers were searched **for the text**. Branch ② above shows a *remote*
+flag does control it. The honest statement is: the text is not in operator config, and no
+operator-config key is known to gate it.
+
+## Reproduction
+
+```bash
+cd ~/.local/share/claude/versions
+V=2.1.226            # 실제 설치 버전으로 교체
+grep -a -o "Do not call the AgentTool unless the user requested it" "$V" | wc -l   # 3
+grep -a -o "AgentTool"               "$V" | wc -l                                  # 37  CONTROL
+grep -a -o "zzz_known_negative_zzz"  "$V" | wc -l                                  # 0   NEG-CONTROL
+off=$(grep -abo 'if(Hbo(e))return' "$V" | head -1 | cut -d: -f1)
+dd if="$V" bs=1 skip=$((off-900)) count=1500 2>/dev/null | tr -d '\0'               # JWb
+off=$(grep -abo 'function Hbo(' "$V" | head -1 | cut -d: -f1)
+dd if="$V" bs=1 skip=$off count=420 2>/dev/null | tr -d '\0'                        # Hbo
+```
+
+## Two retractions this file exists to record
+
+- **"A system prompt outranks both, by construction, so opening is impossible."** Right rule, wrong
+  sentence. An *absolute* prohibition cannot be reopened from a lower layer; a *conditional* one is
+  opened by its condition becoming true. Check whether the sentence is unconditional **before**
+  reaching for the precedence rule.
+- **"Reading the call site needs binary inspection, which was blocked."** False. Three plain `grep`
+  calls resolved it; an adversarial reviewer demonstrated that by simply running them. One earlier
+  attempt using a different tool had been denied, and that denial was generalised into *"this is
+  unmeasurable"* — the same shape as [[feedback_impossible_verdict_may_be_unread_half]]. **A blocked
+  tool is not a blocked question.** The honest label is *"not yet measured."*
+
+## Named residuals
+
+- The measurement is n=1 machine. Platform and install-path variance unmeasured.
+- Whether any **operator-config** key gates the constant is unmeasured; only text-absence was checked.
+- What ① (client-data) actually carries in this environment was not inspected — only that it takes
+  precedence.

package/knowledge/shared/harness-core/fh_three_layer_canon.md

@@ -0,0 +1,165 @@
+---
+name: fh-three-layer-canon
+description: FH 를 설명하는 3층 정본 — 3단 공정(엔진을 벼리는 순서) · 4대 엔진(그 능력) · 5대 정체성(사람이 실제로 쓰는 기능). 층별 명명 규칙과 4축 검증의 정의를 포함한다.
+date: 2026-08-09
+tags: [canon, three-layer, engines, identity, verification-axes]
+---
+
+# FH 3층 정본 — 공정 · 엔진 · 정체성
+
+> **왜 이 문서가 필요했나**: 세 층이 **따로 살고 있었다.** 5대 정체성만
+> `ship_readiness_gate.md` 에 있었고, **3단 공정과 4대 엔진은 공개 지식층에 0건** —
+> gitignored `tracks/` 와 개인 메모리에만 있었다(2026-08-09 실측). 즉 FH 를 설명하는
+> 뼈대의 3분의 2를 **다른 세션·다른 런타임이 읽을 수 없었다.** 이건 내용 부족이 아니라
+> `[[gate_locality_principle]]` 문제다 — 필요한 곳에 없으면 없는 것이다.
+> 셋을 한 곳에서 다루는 문서는 그때까지 **존재하지 않았다**(no-reinvention 스캔 확인).
+
+## 0. 세 층은 무엇이 다른가 — **명사가 층을 실어야 한다**
+
+```
+5대 정체성   사람이 FH 를 돌릴 때 **쓸 수 있는 기능**     (표면 — 무엇을 얻나)
+    ↑ 받친다
+4대 엔진     그 기능을 가능하게 하는 **능력**             (능력 — 무엇을 할 수 있나)
+    ↑ 낳는다
+3단 공정     그 엔진을 **벼리는 순서**                    (공정 — 어떻게 만들어지나)
+```
+
+**명명 규칙(2026-08-09 운영자 확정)**: `공정 / 엔진 / 정체성`.
+이전 표기 `3단 개발법 · 4개 엔진 · 5대 요소` 의 문제는 단어 품질이 아니라 **층이 안 들린다**는
+것이었다 — 「엔진」과 「요소」가 사실상 동의어라 듣는 쪽이 어느 층인지 구분하지 못한다.
+바뀐 것은 두 단어뿐이다: `개발법 → 공정`(개발만이 아니라 검증까지 덮는다) ·
+`요소 → 정체성`(부품이 아니라 존재다). **「엔진」은 유지** — 기존 PR·카드·메모리 인용이 그대로 산다.
+
+### ⚠️ 순수 스택이 아니다 — 그리고 그게 결함이 아닌 이유
+
+3단의 **1단계(영혼)** 와 **3단계(4축 태우기)** 는 엔진 ①②와 **같은 재료**다.
+아래층이 위층을 쓰므로 엄밀한 계층이 아니다. 이 모순은 **주어가 다르다**는 것으로 풀린다:
+
+```
+4대 엔진  = FH 가 **사용자 일**에 쓰는 능력
+3단 공정  = FH 가 **자기 엔진을 벼릴 때** 쓰는 순서
+```
+
+밖에서 빌려온 방법론이면 엔진과 무관했을 것이다. **재료가 겹친다는 것은 도그푸딩의 지문**이고,
+오히려 3단이 실재한다는 증거다. "깔려 있다" 를 *"엔진과 무관한 아래층"* 으로 읽으면 과장이다.
+
+---
+
+## §1 — 3단 공정 (엔진을 벼리는 순서)
+
+```
+① 초기 영혼           심지(판단 회로)를 먼저 심는다. 무엇이 성공 · 어디로 기움 ·
+                      범위 밖 · 절대 안 함
+② 중간 탈상관 가속화   축을 골라 동시에 친다. **곱하지 말고 골라라** — 병렬화 자체엔
+                      방향이 없다(축은 판단 회로가 고른다)
+③ 마무리 4축 태우기    §1-a 의 네 축으로 태운다. **적대검증 하나가 아니다**
+```
+
+**이건 도구 목록이 아니라 투입 순서다.** 축 없이 병렬부터 던지면 노이즈가 늘고,
+태우기부터 하면 태울 게 없다. 근본 명제(운영자, 2026-08-09):
+
+> **"하네스는 방법론이고 지능은 이미 가지고 있다. 방법론만 바꾸면 승리한다."**
+> 병력 = 지능(이미 있다, 변수가 아니다) · 병법 = 하네스(배치와 순서)
+
+실측: 모델 고정 · 방법만 혼자→cross-family → **자력 적발 0 → 11건**(2026-08-09).
+선례: `dominance_benchmark_2026-07-14` 가 *"Sonnet floor 고정, method 만 변화"* 로
+5/8 → 6/8 → **8/8** 계단을 냈다.
+
+### §1-a — 마무리 «4축» (2026-08-09 실측으로 정의)
+
+3단계를 오래 «적대검증» 이라고 불렀으나, 그건 **넷 중 하나**다. 각 축은 **다른 것이 틀린
+경우**를 잡고 **서로를 대체하지 못한다**:
+
+| 축 | 무엇이 틀린 경우 | 대표 계기 |
+|---|---|---|
+| **ⓐ 다른 계열** | **구현**이 틀렸다 | cross-family 적대검증(`auto-decorrelation`) |
+| **ⓑ 첫 실사용** | **재는 방식**이 틀렸다 | 실물 대상에 한 번 돌려본다 |
+| **ⓒ 기록 그라운딩** | **주장**이 틀렸다 | 격리 감사가 문서의 수치·인용·기전을 재측정 |
+| **ⓓ 되돌림 실측** | **앵커**가 틀렸다 | 배선을 지우고 대응 레인이 빨개지는지 본다 |
+
+**2026-08-09 실측(한 산출물, 같은 날)**: ⓐ 18건 · ⓑ 2건 · ⓒ 11건 · ⓓ 15건.
+그리고 **ⓐ 4라운드가 ⓒ 를 0건 잡았고, ⓒ 가 ⓓ 를 0건 잡았다.**
+ⓑ 는 *"계기의 계기가 틀린"* 경우라 ⓐ·ⓓ 가 **구조적으로** 못 본다.
+
+⚠️ **한 문장으로 묶지 마라 — 처방이 갈린다**: ⓒ=기록 재감사 · ⓓ=앵커 되돌림 ·
+계기 유효성=known-pair 보정. 두 병렬 세션이 이 결론에 독립 수렴했다.
+비용 경계: 넷을 매번 다 돌리는 축이 아니다. **곱하지 말고 실패 모드에 맞춰 골라라**
+(`[[feedback_decorrelation_not_fanout_cost_boundary]]`).
+
+---
+
+## §2 — 4대 엔진 (그 능력)
+
+게이트 표의 `engine` 열이 **이미 이 넷을 기계적으로 들고 있었다** — 이 문서는 그것에
+이름을 붙인 것이지 새 이론이 아니다.
+
+| 엔진 | 게이트 표기 | 받치는 정체성 |
+|---|---|---|
+| **영혼(심지)** | `judgment-circuit` | ⑤ 증폭자 · ② 인큐베이터 |
+| **품질 게이트** | `ship-gate` | ③ 거버넌스 게이트 |
+| **맥락 유지** | `context-continuity` | ① 클러스터 · ② 인큐베이터 |
+| **질문하기** | `external-grounding` | ④ 프런티어→조직 전파 |
+
+- **영혼 = 정체성 선언이 아니라 판단의 좌표계**다(무엇이 성공 · 어디로 기움 · 범위 밖 ·
+  절대 안 함). 페르소나 선언은 105런 실측에서 **약모델 순손실**이므로 넣지 않는다.
+  형식 검사기: `scripts/judgment_circuit_lint.sh`.
+- **영혼은 한 번에 안 만들어진다** — FH 는 **씨앗 초안**만 주고, 실제로 채워지는 것은
+  현장 하네스가 사용자에 의해 무수히 사용되면서다. 등급 대응:
+  **씨앗 출하 = 🔵 RC · 사용 축적 = 🟢 REALIZED**.
+- **질문하기 ↔ external-grounding 은 같은 것의 양면**이다: 밖에 묻는다 = 밖에 근거를 둔다.
+  ⚠️ 이 엔진의 **수용 절반이 비어 있다** — 묻는 경로는 있고 *들어온 통찰을 자산화하는*
+  경로가 약하다(`[[feedback_operator_insight_must_become_asset]]`).
+
+---
+
+## §3 — 5대 정체성 (사람이 실제로 쓰는 기능)
+
+**등급 표의 정본은 `ship_readiness_gate.md` 다.** 여기 중복해서 적지 않는다 —
+두 곳에 같은 등급을 두면 반드시 한쪽이 stale 이 된다(2026-08-09 에 그 결함을 실제로
+세 번 겪었다: 표만 고치고 요약 안 고침 → 요약만 고치고 등급 칸 안 고침).
+
+| # | 정체성 | 사람이 얻는 것 |
+|---|---|---|
+| ① | 멀티하네스 클러스터 | 한 태스크를 여러 하네스에 태우고 그 사이에서 거버넌스가 계산된다 |
+| ② | 프로젝트 인큐베이터 | 새 하네스가 **태어난 자리에서 걷는** 상태로 나온다 |
+| ③ | 거버넌스 게이트 | 못 나갈 것이 기계적으로 막힌다 |
+| ④ | 프런티어→조직 전파 | 바깥에서 온 것이 조직 안까지 착지한다 |
+| ⑤ | 증폭자 | 짧은 의도가 최종 산출물까지 벼려진다 |
+
+**등급 어휘**: `🔴 이상론` → `🟡 부분` → `🔵 RC`(실험실에서 섰다) → `🟢 REALIZED`(밖에서 걸었다).
+**RC 는 구현 성공이면 된다** — 문턱을 높이지 마라. 🟢 는 실사용 축적을 요구한다.
+
+### §3-a — 정체성은 **별도 층이 아니라 스킬·에이전트에 퍼져 있다** (운영자, 2026-08-09)
+
+> *"5개 요소는 자연스럽게 스킬과 에이전트를 포함한 하네스 자체 기능으로 퍼져 있는 것"*
+
+이건 정체성이 스킬 위에 **덧씌운 분류**가 아니라, **스킬이 뭉치는 모양의 이름**이라는 뜻이다.
+§2 에서 게이트의 `engine` 열이 이미 4엔진을 들고 있었던 것과 같은 형태 — 있는 것의 이름이다.
+
+**그리고 이 관점은 공짜로 검출기 하나를 준다**: 어느 정체성에도 안 붙는 스킬 =
+**고아 유닛**이고, `CLAUDE.md §Identity` 가 메타하네스의 적신호로 명시한 것이 정확히 그것이다
+(*"red flags are orphaned, redundant, and decorative units"*). 정체성 매핑은 분류가 아니라
+**자산 감사 계기**다.
+
+🟡 **전수 대응은 미측정이다 — 눈으로 배정하지 마라.** 실측 규모는 **스킬 38 · 에이전트 8**
+(2026-08-09). 명확한 것도 많지만 **실제로 저항하는 항목이 있다**: `video-ingest`(⑤ 증폭자인가
+④ external-grounding 인가) · `mcp-circuit-breaker` · `token-budget-gate` — 인프라성이라
+다섯 중 어디에도 자연스럽게 안 붙는다. 그 저항이 **고아 신호일 수도, 분류 축이 모자란
+신호일 수도** 있고, 둘은 처방이 정반대다. 손으로 배정해 표를 채우면 그 구분이 사라진다.
+
+**다음 세션 후보(미착수)**: 스킬별 정체성 선언을 frontmatter 로 받고 미선언·미분류를
+세는 검사기. 선언은 저자가 하고 계기는 **세기만** 한다 — 계기가 분류를 대신 하면
+`[[feedback_not_found_is_not_zero_family]]` 로 되돌아간다.
+
+⚠️ **⑤ 의 🟢 는 범위 한정 가능성이 열려 있다**(2026-08-09 관찰, 미반영): 그 근거가 전부
+*"사용자 산출물"* 대상에서 측정됐고, `⑤ × 하네스 자신` · `⑤ × 낳는 하네스` 는 미측정이다.
+등급을 내리자는 게 아니라 **무엇에 대해 초록인지 명시하자는 것**이며, 등급 관련이라
+**운영자 확인 후** 반영한다.
+
+---
+
+## 4. 이 문서가 하지 않는 것
+
+- **등급 판정을 하지 않는다** — `ship_readiness_gate.md` 가 정본이다.
+- **4축을 매번 다 돌리라고 하지 않는다** — 축은 실패 모드에 맞춰 고른다.
+- **3층이 깔끔한 계층이라고 주장하지 않는다** — §0 의 자기참조 절을 반드시 같이 읽어라.