@chrono-meta/fh-gate 1.4.93 → 1.4.95

package/scripts/psa_scan_lib.sh

@@ -48,11 +48,62 @@
 # would let a real token pass by merely CONTAINING a placeholder word.
 PSA_PLACEHOLDER='^(<[a-z0-9_-]+>|\{[a-z_]+\}|EXAMPLE|dummy|changeme|REDACTED|xxxx|/Users/(EXAMPLE|yourname|\{[a-z_]+\}|<[a-z0-9_-]+>)/|AKIAIOSFODNN7EXAMPLE)$'
 
+# ── file::token allowlist (ALL severities) — the SKILL's Step 2, finally implemented ────────────
+#
+# public-surface-audit SKILL.md §Step 2 has always specified a `file path :: token` allowlist whose
+# rule is severity-agnostic ("a hit on file F matching token T is suppressed iff a row exists with
+# file == F and T in that row's allowed tokens"). The library implemented only the LOW subset below,
+# so spec and implementation disagreed: a HIGH hit that the operator had deliberately published had
+# **no expressible disposition at all** — the only ways out were weakening a severity class or
+# editing the artifact. That is the divergent-normalizer shape, and it surfaced for real on
+# 2026-08-11 (a published paper's author-contact line and a rename changelog entry).
+#
+# Why this does not weaken the floor:
+#   · rows live in a **gitignored** source (`.claude/rules/.public-surface-allowlist`), so writing one
+#     never puts an operator token on the public surface — the same two-layer discipline as patterns.
+#   · a row is `path<TAB>literal-token`. **Both sides are literal, whole-value comparisons** — the
+#     path with `=`, the token with `grep -qxF`. Neither is a pattern, so one row suppresses exactly
+#     one token on exactly one file.
+#     ⚠️ Two versions of this got it wrong, and the second is the instructive one. v1 claimed a row
+#     "cannot become a blanket mute" while the code used an UNANCHORED `grep -qE`: a `path<TAB>.*`
+#     row muted every hit in that file, silently, at every severity (pre-publish security pass proved
+#     it with a known pair). v2 force-anchored to `^(…)$` — and `^(.*)$` still matches everything, so
+#     the blanket mute survived the "fix". Only making the field a **literal** actually closes it.
+#     The lesson is the file's own doctrine: a claim is not a control, and neither is a repair that
+#     was not re-measured against the same known pair.
+#   · every suppression **prints a line**. A mute that leaves no trace is indistinguishable from a
+#     clean scan — the same `not found ≠ 0` shape the verdict enum exists to prevent.
+#   · absent file → no rows → behaviour is exactly as before (fail-closed by default).
+# Each row is an operator decision, recorded where it can be audited, instead of an undocumented
+# exception living in someone's head.
+psa_pair_allowlisted() {   # $1=path $2=matched token
+  local root="${PSA_REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || printf '.')}"
+  local src="${PSA_ALLOWLIST:-$root/.claude/rules/.public-surface-allowlist}"
+  [ -r "$src" ] || return 1
+  local apath atok
+  while IFS=$'\t' read -r apath atok || [ -n "$apath" ]; do
+    case "$apath" in ''|'#'*) continue ;; esac
+    [ -z "$atok" ] && continue
+    [ "$apath" = "$1" ] || continue
+    # LITERAL, whole-token (`-x -F`). Not a regex — anchoring alone was not enough: `^(.*)$` still
+    # matches everything, so an anchored `.*` row remained a blanket mute. Treating the field as a
+    # literal is what makes "one row = one token" true rather than merely asserted.
+    if printf '%s' "$2" | grep -qxF "$atok" 2>/dev/null; then
+      echo "  ⚪ allowlisted — ${1}: '${2}' (row: ${apath} :: ${atok})"
+      return 0
+    fi
+  done < "$src"
+  return 1
+}
+
 # Files that name wiring/companion tokens as part of doing their job. LOW severity only — HIGH/MED
 # block everywhere, including here. Kept as a function so the list has exactly one definition.
 psa_low_allowlisted() {
   case "$1" in
-    .gitignore|scripts/sync-to-be.sh|.claude/rules/local_fh_context.md|templates/local_fh_context.md|templates/.claude/rules/*|templates/.git-hooks/*) return 0 ;;
+    # sync-from-be.sh 는 sync-to-be.sh 와 **같은 일의 반대 방향**인데 목록에 없어서
+    # LOW 를 계속 냈다(2026-08-11, 두 렌즈 relay 런 첫 실사용에서 발화). 짝을 빠뜨린
+    # 목록은 그 짝만 상시 오탐이 된다.
+    .gitignore|scripts/sync-to-be.sh|scripts/sync-from-be.sh|.claude/rules/local_fh_context.md|templates/local_fh_context.md|templates/.claude/rules/*|templates/.git-hooks/*) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -174,6 +225,7 @@ psa_scan_tagged() {
         [ -z "$tok" ] && continue
         printf '%s' "$tok" | grep -qiE "$PSA_PLACEHOLDER" && continue
         if [ "$sev" = "LOW" ] && psa_low_allowlisted "$path"; then continue; fi
+        if psa_pair_allowlisted "$path" "$tok"; then continue; fi
         echo "  ❌ $sev leak — ${path}: '$tok'"
         hit=1
       done <<PSA_TOK

package/scripts/relay_channel.sh

@@ -92,7 +92,12 @@ ORDER_judge="mechanical model"
 # 집합 축
 AXES_SET="verdict_binding"
 # 선언 파일이 쓸 수 있는 비-축 키 (메타데이터)
-META_KEYS="id entry requires_cwd verdict_channel verdict_enum verdict_stdout_key upstream_argv echoes_upstream"
+# 스펙 §ⓑ.2 의 `calibration:` 블록(known_positive/known_negative)은 등록 시점 필드다.
+# 여기는 call moment 라 그 값을 **쓰지 않지만**, CLOSED 목록에서 빠뜨리면 스펙대로 쓴
+# 선언이 VIOLATION 으로 거부된다 — 2026-08-11 실측: registry_check 를 통과한 capfile 2개가
+# relay 에서 8건 VIOLATION. 같은 스펙에 대해 두 계기가 서로 다른 스키마를 든
+# divergent-normalizer 이고, 관대함이 갈리면 한쪽만 통과하는 입력이 생긴다.
+META_KEYS="id entry requires_cwd verdict_channel verdict_enum verdict_stdout_key upstream_argv echoes_upstream calibration_positive_args calibration_positive_expect calibration_negative_args calibration_negative_expect"
 
 _die() { printf '❌ %s\n' "$*" >&2; exit "$RC_HARNESS"; }
 _violation() { printf '⛔ COMPOSITION_VIOLATION — %s\n' "$*" >&2; VIOLATED=1; }