@chrono-meta/fh-gate 1.4.94 → 1.4.96

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.94",
+      "version": "1.4.96",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.94",
+      "version": "1.4.96",
       "description": "Project-agnostic utility skills — 5 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate · ko-tech-writer) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -33,6 +33,15 @@ operations or steel-quench.
 
 Machine-readable mirror: `.claude/registry/agent_cards.json`.
 
+> **Agent frontmatter must be valid YAML — and this bites non-Claude runtimes hardest.** Claude Code's
+> loader is lenient (it accepted an unquoted `description:` containing `": "`); a strict YAML parser
+> does not, and then **every key below the bad line is silently dropped** — including `tools:` and any
+> `model:` floor. Measured 2026-08-11: one agent's multi-line unquoted `description` (with `user:` /
+> `assistant:` lines inside it) invalidated its declared `tools: Read, Grep, Glob` and its `model: opus`
+> floor; the agent ran with all tools and no pin. Keep `description:` to **one quoted line** and put
+> examples in the body. `bash scripts/validate_yaml.sh` now covers `plugins/*/agents/*.md` as well as
+> skills, and reports a zero-file scan as an instrument error rather than a pass.
+
 ### Tool restrictions
 
 | Agent | Allowed tools |
@@ -42,6 +51,15 @@ Machine-readable mirror: `.claude/registry/agent_cards.json`.
 | `hub-persona-auditor` | Read, Grep, Glob |
 | `quench-challenger` | Read, Grep, Glob |
 | `persona-innovator` | Read, Grep, Glob, WebSearch, WebFetch |
+| `beginner` | Read |
+| `main-player` | Read, Grep, Glob |
+| `expert` | Read, WebSearch, WebFetch |
+
+The table is the whole roster — all eight agents above appear here. *Three were missing until
+2026-08-11; the omission read as "unrestricted" to anyone checking this page, which is the wrong
+default for a table whose subject is restriction.* Cross-check with the files themselves rather
+than trusting either side alone: the same audit found `challenger` documented here with a tool set
+its file never declared at all.
 
 ## Runtime Boundaries
 

package/CHEATSHEET.md

@@ -161,7 +161,7 @@ echo '.claude/agents/' >> <project>/.git/info/exclude
 
 ```bash
 # Copy only the agents you need to your project
-cp <harness-root>/.claude/agents/fact-checker.md <my-project>/.claude/agents/
+cp <harness-root>/plugins/fh-meta/agents/fact-checker.md <my-project>/.claude/agents/
 ```
 
 Copy just 1 agent without plugin install and it's immediately callable. Updates require manual re-copy.

package/CLAUDE.md

@@ -598,7 +598,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | "delete the branch", "브랜치 삭제", "브랜치 정리", "clean up branches", "force-push", "rewrite history", "지워도 돼?" (destructive intent — **proactive**, fire *before* the action) | **Destructive-Op Gate** (see above → enumerate → recover → destroy; `templates/predelete_check.sh`) |
 | **"새 기능 검증해줘", "test this feature", "이 TC 확인해줘" — verifying the user's PRODUCT/feature (not FH itself)** | **Route to the mapped field harness first** (Cross-Project Skill Bus / registry) — the field harness owns product verification. The harness-verification rows in this table (`verify-bidirectional` · `prompt-regression` · `sim-conductor` · `pipeline-conductor`) verify the *harness*, and must not shadow a product-verification ask (a field project's *harness assets* — its skills/rules — still use those FH verification rows) |
 | "지난주에 뭐 했지", "what did we do last week", "예전에 이거 한 적 있나" (recall intent) | **CATALOG-first recall** — read `CATALOG.md`, identify candidates by tag/date, then open only those files. Never scan session files one by one |
-| "add this MCP server", "mount this MCP", "mcp.json에 추가", "connect this tool server" (external-MCP mount intent — **proactive**, fire *before* first tool call; mount intent only — a failing/erroring mounted server is `/mcp-circuit-breaker`'s row above) | `templates/.claude/rules/mcp_tool_gating.md` (name-keyed ask/allow table — never trust server annotations or names; fill §3 at mount time) |
+| "add this MCP server", "mount this MCP", "mcp.json에 추가", "connect this tool server" (external-MCP mount intent — **proactive**, fire *before* first tool call; mount intent only — a failing/erroring mounted server routes to `/mcp-circuit-breaker` via its own skill description; its table row was removed in the 2026-07-17 row diet, so this parenthetical no longer points "above") | `templates/.claude/rules/mcp_tool_gating.md` (name-keyed ask/allow table — never trust server annotations or names; fill §3 at mount time) |
 | "did my rule change break anything", "regression check", "test harness changes" | `/prompt-regression` |
 | "review for the team", "CTO review", "decision-maker", "share with leadership", "approval deck" | `/apex-review` |
 | "run full pipeline", "verify everything", "end-to-end sweep", "chain all verifications" | `/pipeline-conductor` |

package/knowledge/shared/harness-core/capability_composition_contract.md

@@ -353,10 +353,31 @@ Split honestly by moment; only one of the three is closable today.
 
 - **Registration moment — reachable.** The reviewer is inside the registry when it applies. Pointers
   from `.claude/registry/README.md` and `fh_detail_protocols.md §1-c` put the M1–M5 bar in front of
-  them. **Named residual, not built**: a `scripts/capability_registry_check.sh` that validates the
-  schema and runs each declared M4 pair would make registration *measured* rather than reviewed. It
-  does not exist. Until it does, M1–M5 is a reviewed bar, and this file says so rather than implying a
-  floor it does not have.
+  them. ~~**Named residual, not built**: a `scripts/capability_registry_check.sh`…~~ → **built
+  2026-08-11.** `scripts/capability_registry_check.sh` validates the schema (closed key list — an
+  unknown key is a failure, never an ignore) and **runs each declared M4 pair**, so registration is
+  now *measured* on those axes rather than reviewed. Known-pair calibrated, 7 lanes, BLOCK/PASS
+  symmetric. Two capabilities are registered through it (`fh_psa_leak.cap` · `fh_degrade_verdict.cap`).
+
+  🟥 **What the checker measures, and the axis it provably does NOT — learned by being bitten.**
+  M1–M5 answer *"is the declaration well-formed, and does the instrument separate a case whose
+  answer we already know?"*. They do **not** answer *"is the declaration true"*, and one axis made
+  that concrete the same day it was built: a capability declaring **`writes: read-only`** passed all
+  five criteria — executable entry, closed enum with a did-not-run value, `judge: mechanical`, M4
+  known-pair green ×2, valid `requires_cwd` — and its entry point then **`rm -rf`'d this repo's
+  `scripts/` directory** on a no-argument invocation (a cleanup `trap` whose variable was reassigned
+  to a real path after the trap was installed). Tracked files were recovered by `git checkout`;
+  three untracked new scripts were not, and the recovery checkout also reverted an unrelated
+  in-flight edit. Nothing in the bar could have caught it: M4 exercised the two *declared* arms, and
+  the destructive path was the *undeclared* default arm.
+  - **Partial fix applied** (entry-point discipline, both probes): the cleanup variable is never
+    reassigned, the scan target is a separate variable, and the trap re-checks that the path it is
+    about to delete is under a temp root. Calibrated with a canary file in an isolated repo.
+  - **Structural fix, not built**: run the M4 pair under a read-only mount / sandbox and *observe*
+    whether a write is attempted. Until that exists, `writes:` (and `reversibility:`) are the
+    **registrant's claim**, and the checker prints them as such rather than implying it verified
+    them. A bar that silently accepts an unverifiable axis is how a `read-only` capability deletes a
+    directory with every light green.
 - **Call moment — salience-only, no mechanical floor exists.** No hook can observe "a session is about
   to compose a capability call"; the trigger is intent, exactly like the Instrument-Calibration rule.
   The strongest available lever is structural: §ⓑ.3 makes the merged constraint set **step 2 of the

package/knowledge/shared/harness-core/fh_detail_protocols.md

@@ -224,6 +224,18 @@ FH에서 발화 문구·규약 파일명을 **추가하거나 바꾸는 변경
 갈림 판별 기준: **사용자-대면 발화이거나 게이트가 찾는 파일명이면 remap 대상, 환경변수·훅
 스크립트명·npm bin 같은 기계 결합 이름은 불변**(변환하면 파손된다).
 
+⚠️ **「게이트가 찾는」이 두 뜻으로 읽힌다 — 기계적으로 가른다** (pmh-dev #54 보류 2건 판정이
+이 구분을 요구했다). 「찾는다」가 *런타임 탐색*인지 *정적 참조*인지가 판정을 뒤집는다:
+
+| 「찾는」의 종류 | 판정 | 실례 | 왜 |
+|---|---|---|---|
+| **런타임 패턴 매칭 산물** — 검사기가 디렉토리에서 글롭/정규식으로 훑어 찾는 *산출물* 파일명 | **remap 대상** | `fh_completed_*` · `fh_signal_*` | 하류 실물이 `pmh_completed_*` 인데 검사기가 `fh_completed_*` 를 훑으면 **거짓 실패**(위 ④-log 3개월 오귀인이 그 사례) |
+| **정적 경로 참조** — 스크립트가 **상수로 들고 있는** 규약/설정 파일명 | **불변(기계 결합)** | `.claude/rules/fh_4axis_gate.md` (`gate_pathspec_check.sh` 의 `CANON=` · `selfcheck.sh` · pre-commit 이 같은 경로) · `scripts/fh-gate.sh` (npm bin · 테스트가 못박은 경로) | 이름을 바꾸면 스크립트가 **대상을 못 찾아 파손**된다 |
+
+판별 절차(1줄): **그 이름이 코드에 리터럴 상수로 박혀 있으면 불변**, **패턴의 일부로 훑이는
+대상이면 remap**. `grep -n '<이름>' scripts/ templates/` 한 번이면 갈린다 — 상수 대입
+(`X="…<이름>…"`)으로 나오면 전자, 글롭/정규식 안에 있으면 후자다.
+
 ### Why the greeting branch test is session files, never git history
 
 A fresh-clone Sonnet simulation rendered the **returning-user menu** to a brand-new install, because it

package/knowledge/shared/harness-core/ship_readiness_gate.md

@@ -161,7 +161,7 @@ unchanged and keeps its own 2026-07-14 evidence).
 | ③ | 거버넌스 게이트 (governance) | ship-gate | 🟢 GREEN | pre-commit/pre-push physically block; moat measured 3–4 family blind (HITL 8/8 ABSENT); cross-family caught a real companion-store-name leak 2026-07-14 (fail-closed) |
 | ⑤ | 증폭자 (amplifier) | judgment-circuit | 🟢 GREEN | short-intent→literature-grounding→ultimate-doc real instances; rules-diet −18.2k measured; intent-routing probe 94% (below) |
 | ④ | 프런티어→조직 전파 (**🔵 RC, 2026-08-09**) | external-grounding | 🔵 RC | frontier-digest launchd auto + AX submission docs both real, but digest→org never closed as ONE pipeline. **2026-08-09**: the missing link was built — `scripts/digest_landing_check.sh` extracts the digest's candidate table into probes and reuses the existing landing checker (no second verifier). Self-test 8 lanes green. **🔵 RC (2026-08-09)**: the mtime defect that initially held it back is closed — the since-filter now splits two axes (git-tracked → commit time via `git log --since`; gitignored `tracks/**` → mtime, the only evidence that axis has; dirty-tracked → `UNMEASURED`), and **two lanes pin that split**: a file with only a fresh mtime is *not* counted, and a file with only a fresh commit *is* counted even when its mtime is stale. The second lane matters — without it the fix degenerates into "discard all tracked files so only negatives pass" (named by the cross-family reviewer). Self-test **10 lanes** green. **What remains is a named residual, not a calibration gap**: `file-change ≠ token-introduction` — a file committed after the digest may carry the token from before (closing it needs token-level diff, which does not fit the checker's interface). The instrument therefore prints, and this row states, that it is a **screener, not an adjudicator**: hits must be opened. Four real runs, four hand-verifications, four defects found |
-| ① | 멀티하네스 클러스터 (**🔵 RC, 2026-08-09**) | context-continuity | 🔵 RC | routing already ran for real (17 nodes, sidecar-orchestrator, Skill Bus). **The relay half is now built rather than specified**: `capability_composition_contract.md` (2026-08-02) was a complete spec with **zero implementing code** — the ① blocker was missing wiring, not missing design ([[feedback_built_but_not_wired]]). `scripts/relay_channel.sh` executes it (strictest-wins merge · typed invocation · checks 1/2/3 · short-circuit · causal binding), `scripts/test_relay_channel_lanes.sh` carries **64 lanes, BLOCK/PASS symmetric**, and three arms ran across **two real field harnesses** (pmh-dev · qasp-dev) on FH's own assets. ⭐ **The measured result is the divergence arm, and its mechanism is not what the first draft of this row said.** On `templates/.git-hooks`, `qasp` alone returns exit 0 — a single-node pass would have shipped it — and the composition returns `BLOCKED` because `pmh` returns `FINDINGS`. But `qasp`'s exit 0 is `degrade-scan: no scannable (py/sh) target files`: **zero files were scanned.** The qasp copy predates pmh's 2026-07-28 shebang pass, so extension-less hook files are invisible to it, and its exit 0 means *no target*, not *clean*. So the composition did not catch a substantive disagreement between two harnesses — it caught **a single node rendering an unmeasured surface as a pass**, which is `[[feedback_not_found_is_not_zero_family]]`, and structurally the spec's own §ⓑ.4 B1 ("the exit 0 that means I never started"). That is a *stronger* result than the first framing and a narrower one: it demonstrates the union catching a blind spot, not decorrelated judgment. **Correction also to the order claim**: both orders return `rc=2`, but in the pmh-first order the chain short-circuits at node 1 and qasp never runs — only the qasp-first order actually exercises the union. Non-decorative: reverting each wiring line reddens lanes and no reversion passes silently. **Why this is RC and not 🟢**: (a) the row's *other* half, external-harness recommend, is still parked; (b) the spec's own named gap `scripts/capability_registry_check.sh` (M1–M5 registration + M4 pair) still does not exist — only the call moment is closed; (c) the two nodes are **copies of one scanner at different staleness** (all three copies — pmh 237 ln, qasp 121 ln, FH 269 ln — share a byte-identical 12-line header; the clean arm's two `out_sha` were identical), so the run proves the channel turns and that composing unequal copies has value, not that two independent judgments were decorrelated. Artifact: `tracks/_meta/identity_audit_2026-08-09_relay_channel.md` |
+| ① | 멀티하네스 클러스터 (**🔵 RC, 2026-08-09**) | context-continuity | 🔵 RC | routing already ran for real (17 nodes, sidecar-orchestrator, Skill Bus). **The relay half is now built rather than specified**: `capability_composition_contract.md` (2026-08-02) was a complete spec with **zero implementing code** — the ① blocker was missing wiring, not missing design ([[feedback_built_but_not_wired]]). `scripts/relay_channel.sh` executes it (strictest-wins merge · typed invocation · checks 1/2/3 · short-circuit · causal binding), `scripts/test_relay_channel_lanes.sh` carries **64 lanes, BLOCK/PASS symmetric**, and three arms ran across **two real field harnesses** (pmh-dev · qasp-dev) on FH's own assets. ⭐ **The measured result is the divergence arm, and its mechanism is not what the first draft of this row said.** On `templates/.git-hooks`, `qasp` alone returns exit 0 — a single-node pass would have shipped it — and the composition returns `BLOCKED` because `pmh` returns `FINDINGS`. But `qasp`'s exit 0 is `degrade-scan: no scannable (py/sh) target files`: **zero files were scanned.** The qasp copy predates pmh's 2026-07-28 shebang pass, so extension-less hook files are invisible to it, and its exit 0 means *no target*, not *clean*. So the composition did not catch a substantive disagreement between two harnesses — it caught **a single node rendering an unmeasured surface as a pass**, which is `[[feedback_not_found_is_not_zero_family]]`, and structurally the spec's own §ⓑ.4 B1 ("the exit 0 that means I never started"). That is a *stronger* result than the first framing and a narrower one: it demonstrates the union catching a blind spot, not decorrelated judgment. **Correction also to the order claim**: both orders return `rc=2`, but in the pmh-first order the chain short-circuits at node 1 and qasp never runs — only the qasp-first order actually exercises the union. Non-decorative: reverting each wiring line reddens lanes and no reversion passes silently. **Why this is RC and not 🟢** — *updated 2026-08-11; (b) and (c) moved, (a) did not, and a fourth appeared*: (a) the row's *other* half, external-harness recommend, is still parked — **unchanged, and it is a build, not a check**; (b) ~~`scripts/capability_registry_check.sh` does not exist~~ → **built 2026-08-11** (M1–M5 + the ran≠did-not-run clause, M4 pair executed, 7 self-test lanes BLOCK/PASS symmetric); (d) **NEW, and it cuts against the row**: a capability declaring `writes: read-only` passed all of M1–M5 and its entry point then `rm -rf`'d this repo's `scripts/`. The registration bar measures *form* and *known-pair separation*, never *whether the declaration is true* — so the machinery this row now points at carries a demonstrated structural hole (`capability_composition_contract.md §Salience`). A checker whose green can precede a destructive act is not yet a green identity; (c) ~~the two nodes are copies of one scanner at different staleness~~ → **superseded 2026-08-11, but only partly**: a run now exists across two *genuinely different* capabilities (a leak lens ∪ a verdict-direction lens — different enums, different defect classes, each blocking on its own finding), and the clean arm exercised the union end-to-end. ⚠️ **That satisfies the letter of the old (c) and not the identity's spirit: both new nodes live inside FH.** This identity is *멀티하네스 클러스터*; the only run that actually crossed harness boundaries is still the older pmh-dev/qasp-dev one, whose nodes were<a name="c-orig"></a> **copies of one scanner at different staleness** (all three copies — pmh 237 ln, qasp 121 ln, FH 269 ln — share a byte-identical 12-line header; the clean arm's two `out_sha` were identical), so the run proves the channel turns and that composing unequal copies has value, not that two independent judgments were decorrelated. Artifact: `tracks/_meta/identity_audit_2026-08-09_relay_channel.md` |
 | ② | 프로젝트 인큐베이터 (**🔵 RC, 2026-08-09**) | context-continuity + judgment-circuit | 🔵 RC | **RC 세 다리가 섰다** — (a) 구현: `chamber_run.sh` 6단계 게이트 (b) known-pair: 러너 게이트 **18 레인**(`test_chamber_run_lanes.sh`, BLOCK/PASS 대칭 — PASS arm 이 있어야 "전부 막는 게이트"도 걸린다) + 순서 증인 **16 레인**(`chamber_witness.sh`) (c) self-test 초록. **실상황 발화 대기 = formal chamber EMIT 아직 0** — 그것이 RC 가 🟢 이 아닌 이유이자 RC 정의 그 자체다. ⚠️ **그 0 의 해석이 2026-08-09 에 바뀌었다**: 지금까지 *"챔버가 엄격해서"* 로 읽었으나, KILL 된 후보 다수가 **메타-형** 이고 유일한 EMIT(`forge-wiki`)만 **필드-형** 이다 — 즉 *낳을 수 없었던* 게 아니라 **애초에 대상이 아닌 후보가 들어왔을** 가능성이 있다. 필드 ⊥ 메타 프로파일과 씨앗(precocial) 기준 정의: `harness_incubator_doctrine.md §3-a`. ⚠️ 그 분류는 **사후에 이뤄졌고 n=9** 라 가설이다 — 사전 등록 후 다음 런을 예측해야 결과가 된다. 아래 옛 판정 줄은 이력으로 남긴다 |
 | ②-old | (이력) 프로젝트 인큐베이터 | context-continuity + judgment-circuit | 🟡 PARTIAL | incubation is running — **stockbattle is being incubated now** (S1 built, mid-flight) + qasp/pmh spin-out precedent + scaffold-emit shipped (doctrine: "emit shipped today as scaffold+approval; the chamber flow is the named target"). **Corrected 2026-08-08** (the old text read "6 runs, 6 KILL … 0/6", which was stale on both counts, and the ledger itself was missing a run): hand-counted from `tracks/_chamber/INDEX.md` — **9 full runs (#2–#10), 8 KILL, 1 EMIT** (#1 is a trigger probe, not a full run). Runs #5–#6 *measured* the emit-worthiness criterion (net-new ∧ artifact-shaped ∧ real-data-precision-adequate ∧ hub-state-independent); run #6 confirmed the graduation-order principle — hub-internal proof before standalone extraction, never the reverse. **The 🟡 is now held for a different reason than before.** The old reason ("no closed emit-via-incubation yet") is false: run #9 `forge-wiki` emitted and shipped publicly under operator approval with the Pre-Publish gate passed. What is *not* proven is that the **formal chamber flow** produced it — that run's workspace holds only an `EMISSION_VERDICT.md`, with no `INTENT.md`, `BUDGET.md` or `SIM_NOTES.md`, so the intent/budget/blind-persona gates have no artifact and the verdict was written after the fact. The first run to complete the formal flow end-to-end is #10 (2026-08-08, 3 blind isolated personas) and it KILLed. So: **the identity has fired once, the mechanism has not yet been shown to be what fired it**, and the dominance result every 🟢 owes is still outstanding → 🟡 |
 
@@ -282,9 +282,12 @@ What now blocks `v1.0` is **closing the 🔵s** — RC means the mechanism stand
 walked outside:
 
 ```
-①  external-harness recommend (cluster-wizard, still parked) · capability_registry_check.sh
-   (registration-moment M1–M5, named by the spec, still absent) · a run across two genuinely
-   different capabilities rather than two forks of one scanner
+①  external-harness recommend (cluster-wizard, still parked — UNCHANGED 2026-08-11, and this is
+   the one that is a *build*, not a check) · ~~capability_registry_check.sh absent~~ BUILT
+   2026-08-11 · ~~a run across two genuinely different capabilities~~ RAN 2026-08-11, but both
+   nodes are FH-internal — the *cross-harness* arm is still the old copies-of-one-scanner run
+   · NEW: the registration bar cannot verify a declared side-effect axis (`writes: read-only`
+   passed M1–M5, then the entry point deleted a directory)
 ②  a formal chamber EMIT — the mechanism firing in a real situation, not a retrofitted verdict
 ④  file-change ≠ token-introduction — the instrument is a screener, not an adjudicator
 ```

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -1801,8 +1801,74 @@
 - date: 2026-08-11
   session: qasp-axready-night-autonomous
   agents_summary: "7 열거 + 훅 집계 9 (consolidated): ① Explore 필드 정본 읽기(MTM/2막 계약/발화 자격) ② Explore 데이터-플레인 오라클 삽입지점 설계(bg) ③ codex gpt-5.5 1R (야간 5커밋 diff 적대 감사) ④ fh-meta:beginner 콜드리드 1차(기술문서 삽입 초안) ⑤ general-purpose 독립 2차 지각 QA(PDF 8쪽, 200dpi 크롭) ⑥ fh-meta:beginner 콜드리드 2차(수리본 재검 — 1차 후 고친 것을 다시 읽힌 라운드) ⑦ general-purpose@sonnet 블라인드 sim(ko-tech-writer 보강본, 심은 결함 3종)"
-  dispatch_count: 9
+  dispatch_count: 13
   dispatch_count_note: "훅 집계 9 · 내가 이름으로 열거 가능한 것 7. 차이 2건은 귀속 미상이라 지어내지 않는다 — 세션 로그를 뒤져 채우는 대신 미상으로 남긴다(없는 엔트리를 만드는 것이 빠진 엔트리보다 나쁘다). 초판은 3으로 적혀 있었고 마감 체크 ④-e 가 9를 찍어 드러났다."
   outcome: accepted
   evidence: "④⑤⑥ 는 기술문서 축(같은 세션 후속) — ⑥ 이 **1차 콜드리드 수리본을 다시 읽힌 라운드**이고 거기서 «반례 흔한 단정 + 배치 오류» 가 나와 §7→§6 이동으로 이어졌다(그 경험이 스킬 Step 5 재콜드리드 규율의 근거다). ⑦ sim = 심은 결함 3/3 검출·오탐 0. ① 정본 Explore 가 «MTM=블박+화박 동시 실행, verdict 불변, 표기 4상태» 를 정본 인용으로 확정 — 이후 2-arm 실측(판정 51/51 동일 · mtm_cited 17)이 그 계약과 일치함을 확인하는 근거가 됐다. 일반 개념(«화이트박스 모드») 정규화를 사전 차단. ② 설계 Explore 가 relations.py 5곳·triage.py:258 닫힌 어휘·sourced 레인 선점 함정·데이터 리더 부재(known-positive 컨트롤 동반)를 특정 — 이번 세션은 그 능력을 안 지었으나(잔여 S1) 지도는 그대로 유효. ③ codex 1R: S/A/B/C 4축 반증 중 **헤드라인 반증 1건 수용** — 「품절 배지 검출」 주장이 로케일 축 오귀속임을 App.tsx/en.ts 근거로 지적, governor 가 소스 재확인 후 철회하고 attribution_risk 를 기계에 실었다(86dc8bf). 추가로 C-1(미생성 사유가 stdout 전용) 수용·수리, 잔여 4건은 명명"
   notes: "cross-family 가 **내 커밋 메시지의 주장** 을 반증한 사례 — 코드 결함이 아니라 «주장의 귀속» 이 틀린 경우라 레인·적대검증·되돌림 셋 다 못 잡았을 축이다([[feedback_grounding_audit_of_own_record]] 형). 자력 적발 0. 반대로 생성기 1차 산출의 오탐 공장 성질은 **손검사로 자력 적발**했다 — 기계 감사와 육안 표본이 서로 다른 결함을 잡았다"
+
+- date: 2026-08-11
+  session: plugin-reship-campaign-mtier-precheck
+  agents_summary: "3 dispatches (parallel): fh-meta:challenger×3 — pmh-dev M티어 8스킬 선-적대검토 (배치1 게이트3종 · 배치2 감사/차단2종 · 배치3 오케스트레이션3종)"
+  dispatch_count: 3
+  outcome: accepted
+  evidence: "M 22건·S 12건 회수, governor 소스 재검증 spot-check 9건 전건 CONFIRMED (marketplace plugin.json skills 키 부재 실측 · PSA 2층 패턴 스펙불일치 · MCB 계기 위치 stale · sidecar MEMORY.md 팬텀 · field-harvest 의무체인 Done When 미배선 등). 공통 M = 8스킬 전부 Done When check-class 0 (known-positive 컨트롤: 타 11스킬 히트) — 센서스 triage 와 일치. 배치3이 경계규칙(local_pmh_context.md:7 재인라인 금지) 발굴 → synced 7종 수리는 FH 상류 라우팅 확정"
+  notes: "센서스(기계 grep triage) → 병렬 적대검토 → governor 재검증의 3단이 전수조사 표준 후보. 배치1이 known-pair 캘리브레이션을 자발 수행(BSD grep 오탐 후보를 스스로 기각) — challenger 에 계기 규율이 전이된 사례"
+
+- date: 2026-08-11
+  session: qasp-m1-tc-coordinates
+  agents_summary: "1 dispatch: codex gpt-5.5 1R — M1 diff(좌표 3축·생성기 확장·entry NO_FORM·node 가드) 적대 감사, 낙관 방향(정상 FAIL/결함 PASS/BLOCKED 소실) 특정 지시"
+  dispatch_count: 1
+  outcome: accepted
+  evidence: "5 findings 전건 수용·수리: F1(S — NO_FORM 이 «레시피 타깃 부재»를 «벽 부재»로 오판, SSO/타언어 벽 반례 → expect 증인 결박 + ENTRY_NO_FORM_UNVERIFIED fail-closed) · F2(venue 경유 basis 가 EVIDENCE_SPAN_SECTION 으로 오표기 — 시험관 선택이 기획서 지정으로 읽힘 → basis 분리) · F3(importer 가 generated_from 폐기 — 귀속위험이 하류 미결박 → 보존+report per_tc 표면화, exit 결박 잔여) · F4(무스코프 롤카운트 전역 오염/상쇄 → UNSCOPED_ROLE_COUNT typed, within= 잔여) · F5(부정 표시문 열거 추출 — codex 가 .venv 로 재현 실증 → 부정문 가드 양쪽). 수리 후 레인 69 + 전량 2,805 passed · 라이브 재검증 R9_1 BLOCKED→FAIL(typed)"
+  notes: "F5 는 감사자가 처방 전에 재현을 직접 실행해 보인 사례(«짧은 함수 재현은 .venv 로 확인») — finding 수용의 소스검증 비용을 감사자가 선지불. F1 은 governor 의 «전원 부재 = 벽 부재» 가정을 반례(SSO/한국어 벽)로 무너뜨림 — 증인(positive witness) 요구가 처방으로 그대로 채택됨"
+
+- date: 2026-08-11
+  session: qasp-m1b-finding-identity
+  agents_summary: "1 dispatch: codex gpt-5.5 1R — M1-b diff(finding 정체성 P6/P4→P7 관통) 적대 감사, **오귀속 방향** 지시(틀린 finding/화면 결박)"
+  dispatch_count: 1
+  outcome: accepted
+  evidence: "4 findings 전건 수용·수리·되돌림 검증: F3(S — `references` 가 이미 5곳에서 4의미로 쓰임(finding_id·BVA source_defect_id·StateMatrix_combo_N·조인 id·row id) → 값만 보고 finding 해석 시 SM/BVA TC 오귀속, 감사자가 함수 실행으로 /orders 주입 재현 → reference_kind 선언 자격) · F2(S — sibling 위반은 행 쌍인데 조인이 첫 행에서 break, row1=/customers·row2=/orders 가 /customers 로 결박 → distinct 2+ 면 scalar 비움) · F1(S — 저신뢰 AREA_LABEL 이 선언된 유래를 이김 → 유예+충돌 typed, 유예가 좌표 손실이면 후퇴라 복원 경로 동반) · F4(M — 색인 raw / 소비 strip 불일치로 'dup'/'dup ' 미검출). 수리 4건 **각각 되돌려 정확히 그 앵커 1개씩 적색** 확인 후 커밋. 재생성 무회귀(app_id 40/51 · basis 분포 동일) · 전량 2,819 passed"
+  notes: "감사자가 «일반 import 는 fitz/docx 부재로 막혀 P7·surface_inventory 를 직접 로드해 함수 단위로 확인» 이라고 **계기 한계를 스스로 명시**했다. 자체 적발 1건 — F3 게이트가 F 계열의 정당한 직결까지 막아 app_id 40→39(자격 게이트 도입은 기존 통과 경로에도 선언을 요구한다는 표준 회귀). peer 세션(로컬 다른 축)이 같은 라운드에 **두 축을 더** 잡았다: ⓐ 내 신규 앵커가 장식(생산자 배선 되돌려도 16 전건 초록 — 호출부 우회) ⓑ DISPLAY_MAPPING 의 case-insensitive 부분수리 함정(en.ts 직독 확인: 6종 중 5종만 통과). ★**갈림의 원인은 계열이 아니라 «무엇을 받았느냐» 다**(peer 정정 수용): codex 에게는 **diff** 를 줬고 → 코드 경로 결함 4건, peer 에게는 **내 보고서(주장)** 가 갔고 → 장치·주장 결함 4건. 계열이 같아도 diff 를 받았으면 같은 것을 봤을 것이다. 재사용 가능한 형태는 «탈상관 축은 누가 보느냐만이 아니라 **무엇을 받느냐**» — 적대검증을 아무리 붙여도 **전부 diff 를 주면 주장 축은 계속 빈다**([[feedback_grounding_audit_of_own_record]] 와 같은 축). peer 도 그 넷을 설계해서 잡은 게 아니라 **주장을 읽는 채널에 있었기 때문**이라고 자기 몫을 정직하게 낮췄다 — «피어 세션은 장치 결함을 잡는다» 가 아니라 «**주장을 받은 쪽**이 장치 결함을 잡는다» 가 맞는 모델이고, 그 차이가 다음에 누구에게 무엇을 보낼지를 바꾼다. 🟥**적발 비율을 지표로 읽지 마라**: 이 세션은 자력 1 · 외부 8 인데 그 8 = **codex(diff) 4 + peer(주장) 4** — 즉 «내가 못 봤다» 가 아니라 «**두 축을 열었다**» 다. 분모(어떤 채널을 몇 개 붙였나)를 안 적으면 리뷰를 많이 붙일수록 자력 비율이 나빠 보이고, 그 수를 성과로 읽는 순간 최적해가 «리뷰를 덜 붙이는 것» 이 된다(peer 지적). 채널을 같이 적어야 위의 «무엇을 받았느냐» 구분이 그 숫자 안에서 다시 접히지 않는다"
+
+- date: 2026-08-11
+  session: reship-campaign-stier-and-security
+  agents_summary: "4 dispatches: fh-meta:challenger×3 (S티어 9종 병렬 적대검토 — 배치1 synergy/deep-clarify/memory-hygiene · 배치2 frontier-digest/hub-cc-pr-reviewer/plugin-recommender · 배치3 salience-splitter/corpus/persona) + fh-meta:challenger×1 (v1.4.95 배포 직전 Pre-Publish 게이트 ③ 코드 보안 패스, foreground)"
+  dispatch_count: 4
+  outcome: accepted
+  evidence: "S티어 M급 25건+ 회수, governor spot-check 5/5 CONFIRMED(claude mcp search 부재 · marketplace add 인자 불일치 · 인용 memory 8/8 부재 · enforce_admins stale · digests/ 부재 — 각 판정에 known-positive 컨트롤 동반). 보안 패스는 A급 4건 회수, **그중 3건이 그 릴리스 신규 코드**: 내가 새로 넣은 pair-allowlist 가 `.*` 한 줄로 담요 뮤트였고 주석은 «불가능»이라 적혀 있었다. 감사자가 known-pair 로 실증했고, 내 1차 수리(정규식 앵커)도 `^(.*)$` 라 여전히 뚫려 리터럴 비교로 3판 만에 폐쇄. 1순위 4건은 #344 로 머지, 나머지 21건+ 는 원장 우선순위표로 이월"
+  notes: "★배치3 이 이 캠페인 최대 발견을 냈다 — **salience-splitter 가 자기가 넓히는 구멍을 모른다**: 4축 게이트 헤더가 이 스킬을 이름으로 지목해 «split 마다 목적지가 게이트 안인지 재확인하라»고 적는데 스킬 본문엔 0글자고, 컷 판정은 「머릿속으로」(mentally)로 열려 있어 CLAUDE.md 의 ablation 절차와 정면 충돌하며, 자체 검증 grep 은 실물 헤더 7개 중 **0개 매치**(공백에서 끊김). 세 결함이 같은 방향(상주 다이어트가 성공할수록 커버리지가 조용히 줄어듦)을 가리킨다. ★배치1 은 cross-ecosystem Step 7 파이썬을 **직접 실행해** AttributeError 를 확인했다 — 스킬이 자기가 안 돌았다는 걸 모르는 상태. 계기가 죽은 것이 「대상 없음」으로 렌더되는 not-found≠0 의 교과서 사례. 🟥 **네 배치 전부 fh-meta:challenger = 같은 계열**이다. 격리는 됐으나 탈상관이 아니고, 그 구분을 내가 #343 마커에 panel(...) 로 뭉갰다가 pre-commit 훅에 막혔다 — 훅이 옳았다"
+
+- date: 2026-08-11
+  session: qasp-s1-data-plane-oracle
+  agents_summary: "6 dispatches: Explore×1 (데이터-플레인 오라클 지형 지도 — window_stats·술어 클래스·러너 급전 경로·픽스처 소스) + codex gpt-5.5 ×4 (R1~R4 수렴 라운드, **diff** 축) + agy gemini-3.1-pro-high ×1 (**내 보고서** 축 — 코드 미제공, 의도적)"
+  dispatch_count: 6
+  outcome: accepted
+  evidence: "cross-family 25건 회수·수리, 수렴 벡터 **R1 12(S1 A4 B2 + 주장축 S2 A2 B1) → R2 7(S1 A5 B2) → R3 4(A2 B2, S 소멸) → R4 2(B2, 둘 다 기명 잔여)** = CONVERGED. R1 codex 7건은 뿌리가 하나(라벨 뒤 잔여를 «첫 매치»로 읽음)라 전량 소비 문법 하나로 닫혔다 — 유니코드 마이너스·회계 괄호·복수 값·HK$/US$ 경계·malformed 천단위가 전부 **거짓 PASS** 였다. 수리마다 되돌림 실측(R1b·R2·R3b·R4·R5 · Q1~Q6 · T1·T2·T3c) 전건 정확히 그 레인만 적색. 신규 회귀 레인 65개. 전량 2,922 passed · 라이브 known-pair ×4 동일(FAIL/PASS 갈림 보존 · spec_mismatch 0)"
+  notes: "★**채널을 갈라 보낸 것이 이 세션의 재사용 소득**(직전 세션 [[feedback_decorrelation_axis_is_what_you_send]] 를 의도적으로 적용): codex 에겐 diff → 코드 경로 결함, agy 에겐 **내 보고서만**(코드 미제공) → 주장·계기 결함. 후자가 잡은 둘은 diff 로는 구조적으로 안 나온다 — ⓐ **순환논증**(«제공자 값이 정답키와 일치» 는 *채점 기준*의 증거이지 *채점기*의 증거가 아니다) ⓑ **교란 변수**(라이브 known-pair 의 두 TC 가 비즈니스 로직이 아니라 **포맷 복잡도**로 갈렸을 가능성 — 통화 vs 순수정수). 둘 다 수용해 grounds 에 원시 행 텍스트를 싣고 포맷×결함 2×2 매트릭스를 채웠다. 🟥 **내 수리가 거짓 PASS 를 과차단으로 바꿔치기한 것을 R2 가 잡았다** — 느슨한 파싱 7경로를 «판정 불가»로 막고 닫았다고 적었는데, 유니코드 마이너스·회계 괄호·통화 접두는 **정상 표기**고 막으면 그 표면의 채점이 조용히 0이 된다. 판정 불가는 안전해 보이지만 손실 방향이 다를 뿐이다([[feedback_overblock_traded_for_failopen]] 의 거울상). 🟥 **내 레인이 세 번 나를 속였다, 전부 되돌림 프로브가 잡았다**: ⓐ bool 가드 레인이 실물이 아니라 **테스트 더블**을 재서 실물 가드를 지워도 초록 ⓑ 파서 되돌림을 **부분**(끝 앵커만)으로 해 4건이 안 뒤집혀 «앵커 약함» 오판 직전 — 전량 되돌리니 18건 ⓒ 변환-크래시 레인이 `lambda v=bad:` 였는데 **기본인자도 파라미터**라 DataPlane 이 서명을 보고 거기 `now` 를 넘겨 셋 다 datetime 반환 → «비수치 거부»로 **틀린 이유로 통과**. 무인자 제공자로 고치자 앵커가 0→1 적색. ★그리고 되돌림 자체도 **적용 확인이 필요하다** — 치환이 안 먹었는지 확인 없이 «앵커 0건» 을 한 번 냈다. 계기 검증에도 컨트롤이 붙어야 한다."
+
+- date: 2026-08-11
+  agent: fh-meta:beginner
+  context: "if(kakao)26 발표 장표 S15(구조도) 제로컨텍스트 냉독 — 과거 사람 콜드리더의 «통째로 소실» 보고가 다크 재생성본에서도 재현되는지 측정"
+  invoked_by: FH 세션 (장표 제작 축)
+  input: "슬라이드 렌더 PNG 1장 + 발표 조건(40~60초 노출 · 발표자 발화 2문장만) 고정"
+  outcome: accepted
+  evidence: "재현됨 + 위치 특정. ⓐ 완전소실=왼쪽 세로회전 텍스트(존재 인지 실패) ⓑ 기능적소실=방법론3항·게이트3항·S1~S3·기준4·인용줄. 신개념 30개+(40~60초 수용 한계 3~4개). 단일 최대 하드블록=«PMH 가 정의 없이 주인공 자리». 발표자 2문장이 화면 30%만 덮고, 두 번째로 눈에 띄는 빨간 박스는 말로 한 번도 안 나옴"
+  note: "저자(나)의 육안 검수는 이 장을 «다크 변환으로 해결»로 판정했다 — 냉독이 그 판정을 뒤집었다. 표준 렌즈였으면 안 나왔을 결함"
+
+- date: 2026-08-11
+  session: reship-campaign-stier-wave2-night
+  agents_summary: "9 dispatches: fh-meta:challenger×3 (S티어 9종 findings **재생성** — 직전 세션이 요지만 남기고 세부를 트랜스크립트와 함께 잃었다) + general-purpose×3 (수리, 파일 분리 소유) + codex gpt-5.5 ×3 (diff 축 cross-family — 앞 2회는 판정 없이 종료) + fh-meta:challenger×3 (agents 8종 · R티어 23종 스윕 2배치) + general-purpose×2 (R티어 수리 2배치)"
+  dispatch_count: 9
+  outcome: accepted
+  evidence: "감사 47건 회수 → governor 스팟체크 11/11 CONFIRMED(전건 known-positive 컨트롤 동반) → 수리 47건 → Axis 1 `pass · M-tier 0` → codex 16건 중 수용 3·기각 3(소스 대조)·계기산물 7. 되돌림 실측 1건(steel-quench §Phase0 포인터 제거→rc=1, 복원→rc=0)"
+  notes: "★**수리자 셋 중 둘이 내 브리프의 오류를 되돌려 왔다** — ⓐ 나는 memory-hygiene 나이 소스를 `metadata.modified` 로 단정하라고 지시했는데 실측이 77/267 뿐이라, 그대로 썼으면 190건이 «최신»으로 렌더될 뻔했다(폴백 체인+AGE-UNKNOWN 으로 정정해 옴) ⓑ corpus/persona 수리자는 자기 수리 6건에 러너가 없다는 걸 스스로 명시하고 «돌려서 뒤집혔다»를 주장하지 않았다. 지시자가 감사자보다 정확할 거라는 가정이 틀렸다. ★**나와 배치②가 같은 함정을 각자 밟았다**: 코드펜스의 `<placeholder>` 가 bash 리다이렉트로 파싱돼 구문오류가 됐고, 배치②는 자체 적발했으나 나는 못 봤다 — Axis 1 이 `0 → 1` 로 잡아줬다. 계기가 없었으면 둘 다 통과했을 것이다. 🟥 **codex 가 3회 중 2회 판정 없이 종료**(레포 훅 `UserPromptSubmit Failed`) — 레포 밖 cwd 로 우회해 3회차 성공. 「돌았다≠결과 냈다」의 사이드카판이고, 우회했을 뿐 원인은 안 고쳤다. 🟥 **내가 「diff 만 보라」고 묶은 제약이 findings 의 44%(7/16)를 계기 산물로 만들었다** — 「측정 근거가 diff 에 없다」는 판정이 아니라 내 프롬프트의 그림자다. 탈상관 채널에 무엇을 보내느냐가 무엇을 받느냐를 정한다([[feedback_decorrelation_axis_is_what_you_send]])는 것의 비용 쪽 얼굴"
+  night_addendum: "야간 완주분(3차 웨이브) 결과 추가 — agents 8종에서 M8·S9·R4, R티어 23종에서 M16·S18. **최대 발견은 계기가 대상에 안 닿는 형태였다**: `validate_yaml.sh` 가 에이전트를 스캔 대상에서 빼고 있었고, 그 사이 `quench-challenger` 의 frontmatter 가 깨져 선언한 `tools`·`model: opus` HARD FLOOR 가 둘 다 무효인 채로 돌고 있었다(런타임 agent 목록이 증거 — 이 에이전트만 `All tools`). 두 계기를 배선으로 닫았다(에이전트 편입 + 마크다운 펜스 추출). ★**수리 에이전트들이 내 브리프의 오류를 3회 되돌렸다**: 나이 소스 단정(실측 77/267) · 「모든 제안에 앵커」 대신 stub 라벨 · `fh-goal` 처방을 추측으로 쓰지 않고 2×2 프로브로 근본원인(npx 버전 스펙) 확정. 지시자가 감사자보다 정확할 거라는 가정은 이 세션에서 세 번 틀렸다. ★**자기 계기 결함 자체적발 3건**(내 셸 env 오염으로 음성 arm 이 거짓 PASS · 계수 grep 형식 불일치로 전부 0 · 첫 arXiv 조회가 http 라 컨트롤까지 실패) — 전부 「숫자를 말하기 전에 계기를 의심」으로 잡혔다. 🟥 codex 는 3회 중 2회 판정 없이 종료(레포 훅), 3차 웨이브에는 cross-family 미실시(마커에 typed)"
+
+- date: 2026-08-12
+  session: qasp-declaration-channel-night
+  agents_summary: "5 dispatches: Explore×1 (MECE page↔area 좌표계 조사 — 인수인계 §4 전제 확인) + codex gpt-5.5 ×3 (R1 diff 축 · 주장 축 · R2 수리 재감사) + fh-meta:persona-innovator×1 (Mode F 완주 — 운영자 명시 요청)"
+  dispatch_count: 5
+  outcome: accepted
+  evidence: "R1(diff 축) 1S·2A·5B → 전부 **재현 후** 수리 6건, B2 만 근거 명시 수용. 주장 축 10개 전부 TRUE·FALSE 0(명령+컨트롤 동반). 전량 2956 passed/43 skipped · 라이브 known-pair 유지(생성 TC 가 손 미션과 **grounds 바이트 동일**). PR qasp-dev #156"
+  notes: "★**Explore 축이 인수인계의 전제를 반증했다** — 11c §4 「page↔area 를 선언 채널에 얹으면 NO_MATCH 6건이 열린다」가 틀렸다. 페이지 토큰은 매칭 키가 아니고(surface_inventory 에 `page` 0회, control `route` 36회), 같은 «p3 영역» 토큰인 TC_MT_005 는 매칭 성공·TC_MT_019 는 NO_MATCH 다. 나는 **그 위에 스키마를 이미 얹은 뒤** 실측했다 — 「남이 준 다음 할 일」도 전제부터 재야 하고, 특히 범위를 **줄이는** 방향일 때 소스 그라운딩이 제일 허술해진다([[feedback_scope_widening_needs_grounding]] 의 반대편 얼굴). 🟥 **선언 채널이 자기 실패모드를 맞았다** — 「선언 파일을 줬는데 선언이 없으면」 3가지 입력 전부 rc=0 으로 조용히 통과, cross-family 가 잡았고 자력 적발 0. 🟥 **되돌림 프로브가 내 테스트 하나를 장식으로 적발** — origin 을 spec_dictionary 로 위조해도 62건 전건 초록이었다(`anchors: []` 라 qualify_anchor 가 origin 을 보기도 전에 빠진다). 「자격이 안 나온다」를 확인했지 「origin 게이트가 산다」를 확인한 게 아니었다. 🟥 **계기가 세 번 거짓말했다**: `tail -1` 이 요약 대신 DeprecationWarning · 파이프 뒤 `$?` 가 필터 상태(훅이 잡아줌) · **pytest 색상 escape 때문에 `1 failed, 71 passed` 를 「71 passed」로 읽음**. 셋째는 실제 실패 1건을 숨겼다 — 전량 판정은 `--color=no` 필수. ★innovator 리포트의 B6(「처방 전사 검사 없음」)은 **오판** — 그 에이전트가 테스트 파일을 안 읽었다. 해당 레인은 존재하고 되돌림에서 2 적색. 남의 리포트도 대조 대상이다"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.94",
+  "version": "1.4.96",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -85,6 +85,7 @@
     "templates/goal-quench-hook-setup.md",
     "templates/.claude/rules/session.md",
     "scripts/below_floor_scan.sh",
+    "scripts/capability_registry_check.sh",
     "scripts/chamber_run.sh",
     "scripts/fh_env_delta_scan.sh",
     "scripts/substrate_jump_detector.sh",
@@ -118,6 +119,11 @@
     "templates/predelete_check.sh",
     "templates/PRE-PUBLISH-CHECKLIST.md",
     "scripts/degrade_direction_scan.sh",
+    "scripts/degrade_probe_capability.sh",
+    "scripts/psa_probe_capability.sh",
+    "scripts/test_capability_entrypoint_shipping.sh",
+    "scripts/validate_yaml.sh",
+    "scripts/test_count_check_readme_format_lanes.sh",
     "scripts/test_degrade_scan_shell_probes.sh",
     "scripts/gate_pathspec_check.sh",
     "scripts/prepush_guard_check.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.94",
+  "version": "1.4.96",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-commons/agents/quench-challenger.md

@@ -1,8 +1,28 @@
 ---
 name: quench-challenger
-description: Dedicated quench attack-prescription synthesis agent — Devil (6-axis harness-specific attack) + Innovator (immediate alternatives) + Prescriber (one-line surgical prescription) 3-DNA synthesis. Every attack is paired with a concrete fix direction. No pure criticism — attack and prescription always come as a pair. Built-in replacement engine for steel-quench Wave 1. Operates without external plugin dependency. Can be auto-wired via /steel-quench or run standalone. Includes ghost-finding prevention (blocks misidentification of intentional design decisions), severity escalation rules, and cross-axis reasoning. Examples:
+description: "Dedicated quench attack-prescription synthesis agent — Devil (6-axis harness-specific attack) + Innovator (immediate alternatives) + Prescriber (one-line surgical prescription) 3-DNA synthesis. Every attack is paired with a concrete fix direction — no pure criticism. Built-in replacement engine for steel-quench Wave 1; runs standalone or auto-wired via /steel-quench. Includes ghost-finding prevention, severity escalation rules, and cross-axis reasoning."
+model: opus
+# model is a HARD FLOOR (tier-floor resolution — multi_model_sidecar_strategy.md §Tier-floor):
+# adversarial increment-finding is the depth-sensitive class. floor: hard semantics — the floor
+# outranks diversity: prefer any floor-meeting engine (incl. native Tier-3 at opus) over a below-floor
+# diversity engine. Only when NO engine reaches the floor, dispatch at best available with the
+# below-floor header (e.g. "challenger: sonnet (below-floor; floor=opus)") — never hard-fail.
+# Below-floor judged verdicts are PROVISIONAL (not gate-PASS evidence) until floor-tier re-run or
+# explicit operator acceptance; the weekly audit is the standing re-quench consumer.
+color: red
+tools: Read, Grep, Glob
+version: 0.2
+---
 
-  <example>
+## Invocation examples
+
+> Moved out of `description:` on 2026-08-11. They were an unquoted multi-line block whose `user:` /
+> `assistant:` lines parsed as new YAML keys, which broke the whole frontmatter — so the declared
+> `tools:` and the `model: opus` HARD FLOOR below it **never took effect**. Measured in a live
+> session agent list: this agent showed `(Tools: All tools)` and the fallback description, while
+> siblings showed exactly what they declared. Keep `description:` to ONE quoted line.
+
+<example>
   Context: steel-quench Wave 1 — need to attack a SKILL.md
   user: (internal — steel-quench spawns this)
   assistant: Agent(subagent_type="fh-commons:quench-challenger", prompt="Attack the following SKILL.md across all 6 axes:\n\n[SKILL.md content]")
@@ -16,21 +36,12 @@ description: Dedicated quench attack-prescription synthesis agent — Devil (6-a
   user: (internal — install-doctor or marketplace gate)
   assistant: Agent(subagent_type="fh-commons:quench-challenger", prompt="Determine whether the following skill draft qualifies for registration using the 6 axes:\n\n[draft content]")
   <commentary>
-  If even one S-tier finding exists, registration is blocked. A-tier and below allow registration after fix recommendations.
+  Any S- **or A**-tier finding blocks registration — fix and re-run (this matches the deployment
+  judgment line in §Output Format; an earlier version of this example said S-only, which is the
+  looser of the two and would have been the one a reader met first).
   </commentary>
   </example>
-model: opus
-# model is a HARD FLOOR (tier-floor resolution — multi_model_sidecar_strategy.md §Tier-floor):
-# adversarial increment-finding is the depth-sensitive class. floor: hard semantics — the floor
-# outranks diversity: prefer any floor-meeting engine (incl. native Tier-3 at opus) over a below-floor
-# diversity engine. Only when NO engine reaches the floor, dispatch at best available with the
-# below-floor header (e.g. "challenger: sonnet (below-floor; floor=opus)") — never hard-fail.
-# Below-floor judged verdicts are PROVISIONAL (not gate-PASS evidence) until floor-tier re-run or
-# explicit operator acceptance; the weekly audit is the standing re-quench consumer.
-color: red
-tools: Read, Grep, Glob
-version: 0.2
----
+
 
 # quench-challenger — Dedicated Attack-Prescription Synthesis Agent
 
@@ -136,9 +147,12 @@ Escalate severity one level when the following conditions overlap:
 → Verdict: Pass (reason: citation complete)
 
 ✅ Valid attack:
-"arXiv 2605.00914 cited — only '32.3pp degradation' number with no connection to implementation"
+"arXiv 2605.00914 cited — a number lifted from the abstract with no connection to implementation"
 → [B] Citation annotation missing: number present but no one-liner explaining how this skill's isolation structure implements the paper's basis
-→ Prescription: Add `arXiv 2605.00914 basis: reasoning path isolation = 32.3pp confirmation bias blocked` one line
+→ Prescription: Add `arXiv 2605.00914 basis: plurality voting discards correct answers already in the pool (oracle gap ≤32.3pp) → collect by union, do not vote` one line
+→ ⚠️ When you write that prescription, state what the number MEASURES. This exact line previously
+  read "32.3pp confirmation bias blocked", which is the wrong metric in the wrong direction — see
+  §References. A citation-integrity axis that ships a misattributed number teaches the misattribution.
 ```
 
 ---
@@ -147,7 +161,19 @@ Escalate severity one level when the following conditions overlap:
 
 **Diagnostic question**: "Does the instance executing this synthesis or evaluation step share a reasoning path with the instance that generated the artifact being evaluated?"
 
-Basis: arXiv 2605.00914 — 32.3pp performance degradation demonstrated when the same instance self-evaluates.
+Basis: arXiv 2605.00914, *The Cost of Consensus: Isolated Self-Correction Prevails Over Unguided
+Homogeneous Multi-Agent Debate* — measured on N=10 homogeneous agents over R=3 rounds. What it
+actually shows: **sycophantic conformity** (modal adoption ≤85.5%), **contextual fragility** (peer
+rationales destabilize previously-correct reasoning, ≤70.0%), and **consensus collapse** (plurality
+voting discards correct answers *already present in the pool* — oracle gap ≤32.3pp), at 2.1–3.4×
+the tokens. The axis this supports is: **do not homogeneously debate-then-vote; isolate, then
+collect by union.**
+
+⚠️ **Read the direction, not just the number.** This line previously said "32.3pp performance
+degradation when the same instance self-evaluates" — wrong metric (the 32.3pp is a voting oracle
+gap) and wrong direction (the paper's title result is that *isolated self-correction prevails*).
+Verified against the live abstract 2026-08-11 with a control fetch; `self-evaluat` and
+`confirmation bias` do not occur in it.
 
 #### Checklist
 
@@ -371,10 +397,10 @@ Deployment judgment: ✅ 0 S/A findings / ❌ N S/A findings — fix and re-run
 ## References
 
 - **CaseCraft PoC counter-example criteria set**: CC-1 (self-declaration) · CC-2 (single-case generalization) · CC-3 (achieved = performed equivalence) · CC-6 (Done When absent) — loaded in steel-quench Phase 0
-- **Cost of Consensus**: arXiv 2605.00914 — 32.3pp degradation in same-instance self-evaluation (Axis 3 basis)
-- **SAGE automated critique layer**: arXiv 2603.15255 — Critic isolation structure (harvest-loop Step 3.75 implementation basis)
+- **Cost of Consensus**: arXiv 2605.00914 — plurality voting discards correct answers already in the pool (**oracle gap ≤32.3pp**); conformity ≤85.5%; isolated self-correction wins the cost/accuracy tradeoff (Axis 3 basis). *Corrected 2026-08-11 — previously cited as "32.3pp degradation in same-instance self-evaluation", which is neither the paper's metric nor its direction.*
+- **SAGE**: arXiv 2603.15255, *Multi-Agent Self-Evolution for LLM Reasoning* — four agents (Challenger, Planner, Solver, Critic) that **co-evolve from a shared LLM backbone**. *Corrected 2026-08-11: this is NOT an isolation result — the abstract says co-evolve and never says "isolat". Step 3.75's Critic isolation is an FH design decision; its evidence is 2605.00914 above, not SAGE.*
 - **FH Done When standard**: `harvest-loop/SKILL.md`, `deliberation/SKILL.md` Done When sections
-- **Harness simplification principle**: `README.md` (Axis 6 basis)
-- **Ghost finding prototype**: deliberation Mediator conclusion transfer permitted (clarified 2026-05-25) — `0a03189`
+- **Harness simplification principle**: `CLAUDE.md` §Core Axis — "Field harness: simpler over time (complexity = warning signal); meta-harness: optimize, not necessarily simplify" (Axis 6 basis). *Corrected 2026-08-11: previously pointed at `README.md`, where the principle does not appear (`grep -in simpl README.md` → 0 hits; control `grep -c harness` → 40, so the file is greppable).*
+- **Ghost finding prototype**: deliberation Mediator conclusion transfer permitted (clarified 2026-05-25). *Commit hash removed 2026-08-11 — the cited `0a03189` does not resolve in this repo (`git cat-file -t` → not a valid object name; control: `HEAD` → commit). The claim stands on its date and its subject, not on a hash nobody can check.*
 
-Version history = CHANGELOG.md (fh-commons).
+Version history = `plugins/fh-meta/CHANGELOG.md`. *Corrected 2026-08-11: `plugins/fh-commons/CHANGELOG.md` does not exist (control: the fh-meta one does).*

package/plugins/fh-commons/skills/convergence-loop/SKILL.md

@@ -158,15 +158,29 @@ Max rounds: N | Actual convergence round: M
 
 ## Done When
 
+Each condition declares its check class (mandatory-pass / measured / judged); every judged condition
+names its adversarial pairing — no judge-only path.
+
 ```
 Setup complete (gate name, pass criteria, max rounds confirmed)
+  (mandatory-pass — all three named in writing BEFORE round 1; criteria written after seeing round-1
+   output are post-hoc and do not satisfy this)
 + Minimum 2 rounds executed
+  (measured: round count >= 2, read off the per-round table below)
 + Convergence declared (a round returns zero new failures AND you make no repairs in response to
   it, at any grade) or escalation triggered
+  (measured: the round's new-failure count = 0 AND its repair count = 0 — two numbers, both recorded
+   per round; a single-number reading is what let "0 new failures while still repairing" pass)
   ⚠️ NOT "2 consecutive rounds": while every round ships repairs that criterion can never fire, so
   it reads as permanently not-converged and gets shipped past. Adjudicated with measured evidence in
   `steel-quench` §Convergence Criteria (2026-08-02).
++ Escalation root cause classified when max rounds is hit without convergence
+  (judged — adversarial pairing: `fh-commons:quench-challenger` argues that the loop stopped because
+   the GATE is blind rather than because the artifact is clean; an unchallenged "converged" on a
+   gate that never produced a FAIL is the failure mode this pairing exists to catch)
 + Per-round result table output
+  (mandatory-pass — one row per executed round, each carrying its new-failure and repair counts;
+   a missing row makes the two measured conditions above unreadable)
 ```
 
 ## External anchor (independent convergence)

package/plugins/fh-commons/skills/deliberation/SKILL.md

@@ -261,10 +261,24 @@ The jury fills the domain blind spots that no single person can see on their own
 
 ## Done When
 
+Each condition declares its check class (mandatory-pass / measured / judged); every judged condition
+names its adversarial pairing — no judge-only path.
+
 ```
 All Steps 0~3 completed (Steps 4~5 added if 5-layer selected)
+  (mandatory-pass — each layer's output block is present in the declared format; a skipped layer is
+   a FAIL, not a default pass)
++ Every Innovator proposal carries a Devil-Advocate rebuttal AND an acknowledgment line
+  (measured: rebuttal count == proposal count, and acknowledgment count == rebuttal count. A
+   rebuttal without an acknowledgment is already flagged `[WARN: unsynthesizable rebuttal]` in
+   Step 2 — this condition is what makes that flag block completion instead of decorating it)
 + [Mediator — Synthesis Verdict] output present (Adopt / Alert absorption / Verdict / Conditions / Discard)
+  (judged — adversarial pairing: the Devil-Advocate layer is the standing opposition to the
+   Innovator, and the Mediator's synthesis is re-attacked by `fh-commons:quench-challenger` on the
+   one axis the Devil conceded; a synthesis that only restates the concessions is not a verdict)
 + User's final decision confirmed (deliberation output must never be auto-executed)
+  (mandatory-pass — an explicit user utterance selecting an option; silence, absence, or the
+   session's own inference does NOT satisfy it)
 ```
 
 **→ When invoked from agent-composer Wave next-D: synthesis verdict is the fan-in input for Wave continuation** — return the Mediator verdict + Conditions to agent-composer so the conflict is marked resolved in the fan-in result set. After this, agent-composer re-runs Step 4-b state transition evaluation with the conflict cleared; subsequent Waves (next-M / next-E / end) proceed based on the updated result.

package/plugins/fh-commons/skills/mcp-circuit-breaker/SKILL.md

@@ -53,10 +53,20 @@ Default thresholds:
 Identify the failing tool and failure mode:
 
 ```bash
-# Check MCP server config
-cat .claude/settings.json 2>/dev/null | grep -A5 '"mcpServers"' || echo "No MCP config found"
+# MCP mounts live in SEVERAL scopes — check all that this shell can see. Project settings.json is
+# usually NOT one of them (it commonly holds hooks only), so a single-file read renders "no config"
+# on a session with live MCP servers — a wrong-location instrument, not a measurement.
+for f in .mcp.json .claude/settings.json .claude/settings.local.json; do
+  [ -e "$f" ] && { echo "== $f =="; grep -A5 '"mcpServers"' "$f" 2>/dev/null || echo "(present, no mcpServers key)"; }
+done
+[ -e ~/.claude.json ] && grep -c '"mcpServers"' ~/.claude.json | xargs echo "user-scope ~/.claude.json mcpServers blocks:"
 ```
 
+An empty result above means **"no project/user-scope config found"** — never "no MCP mounted":
+plugin-provided and remotely-managed servers appear in no local file. The live mount evidence is the
+failing tool call itself (`mcp__{server}__{tool}` in this session); classify from that name even when
+every config read comes back empty.
+
 Classify failure type:
 
 | Type | Symptom | Likely Cause |
@@ -98,6 +108,10 @@ Failure type: {TYPE}  |  Consecutive failures: {N}
 Further calls to this tool are blocked until circuit resets.
 ```
 
+(Blocking is **session-level discipline** — this skill's protocol, not a mechanical hook; no
+PreToolUse gate enforces it. State it that way if asked — a protocol honestly labeled beats a
+phantom enforcement claim.)
+
 ---
 
 ### Step 3. Log Circuit State
@@ -106,17 +120,16 @@ Write state to session-local file (in-memory is insufficient — logs survive /c
 
 ```bash
 mkdir -p .claude/mcp_circuit/
-# Append to circuit log
-```
-
-Log entry format:
-```yaml
+grep -qxF '.claude/mcp_circuit/' .gitignore 2>/dev/null \
+  || echo "NOTE: add '.claude/mcp_circuit/' to .gitignore — session state must not become a tracked file (the ignored-but-committed class public-surface-audit Step 3c hunts)"
+cat >> .claude/mcp_circuit/circuit_log.yaml << EOF
 - tool: {tool-name}
-  state: OPEN
+  state: OPEN            # OPEN | HALF-OPEN | CLOSED — same enum as Done When
   failure_type: {TYPE}
   failure_count: {N}
   tripped_at: {ISO-8601}
   reset_at: null
+EOF
 ```
 
 ---
@@ -133,7 +146,8 @@ Present the relevant fallback options ranked by effort (at least 3):
 | **3 — Pause and retry** | Wait for server recovery (HALF-OPEN probe after cooldown) | Transient failure (TIMEOUT, RATE_LIMIT) |
 
 > **Gating carries over to the substitute** (cross-ref the external-MCP tool-gating rule
-> `mcp_tool_gating.md`). A REST/API or
+> `templates/.claude/rules/mcp_tool_gating.md` — template path; if installed live, your repo's
+> `.claude/rules/` copy). A REST/API or
 > workflow-automation tool adopted under Priority 1b is still an external-action surface: classify its
 > calls under the same ask/allow tiers — reads are `allow (untrusted-read)` only after behavior
 > confirmation; any write / send / delete / permission-change stays `ask`. Trading a gated MCP mount for
@@ -168,13 +182,22 @@ Sending HALF-OPEN probe to {tool-name}...
 - If success: circuit → CLOSED, log updated
 - If fail: circuit remains OPEN, cooldown resets
 
-Reset log entry:
+Reset log entry — **append as a NEW list item (`- tool:`), never as bare indented keys**:
 ```yaml
+- tool: {tool-name}
   state: CLOSED
   reset_at: {ISO-8601}
   reset_method: probe_success | user_forced
 ```
 
+> **Why the leading `- tool:` is load-bearing.** The Step 3 log is a YAML *list*. Appending indented
+> keys with no `-` merges them into the **previous** item instead of adding one, and PyYAML resolves
+> duplicate keys silently by keeping the last value — so `state: OPEN` is overwritten by `CLOSED` and
+> the trip record disappears. Measured 2026-08-11: trip entry + bare-key reset entry parses to
+> **1 item** with `state: CLOSED` (the OPEN row is gone); the same pair written as two list items
+> parses to **2 items** with the trip history intact. The state history is what Step 6 reports on, so
+> a merged entry silently zeroes the failure record.
+
 ---
 
 ### Step 6. Report
@@ -197,10 +220,13 @@ Recommendations:
 
 ## Done When
 
-- Failure pattern classified (type + count)
-- Circuit state logged (OPEN / HALF-OPEN / CLOSED)
-- At least 3 fallback alternatives proposed when circuit is OPEN
-- Recovery probe offered with reset path
+- Failure pattern classified (type + count) — *judged* (adversarial pairing: an `UNKNOWN`
+  classification must state which Step 1 config reads ran and came back empty — "couldn't determine"
+  without the read evidence is not a classification)
+- Circuit state logged to `.claude/mcp_circuit/circuit_log.yaml` (OPEN / HALF-OPEN / CLOSED) —
+  *mandatory-pass*
+- At least 3 fallback alternatives proposed when circuit is OPEN — *measured* (count ≥3)
+- Recovery probe offered with reset path — *mandatory-pass*
 
 ---