@chrono-meta/fh-gate 1.4.95 → 1.4.96

package/plugins/fh-meta/skills/hub-cc-pr-reviewer/SKILL.md

@@ -73,18 +73,48 @@ Self-precision catch areas after first cc review (following previous PR self-cat
 - Check explicit statement that audience-specific guides are limited to original developer environment
 - Check explicit statement of organization-specific areas
 
-Self-catch areas 0 items = skip this entire catch matrix (no token-filling / following `feedback_simplification_evidence`).
+Self-catch areas 0 items = skip this entire catch matrix — do not pad with token-filling to make the section look populated.
 
 ### Step 4. Review Comment Attachment
 
-Attach the review comment (8-matrix results + self-catch + refinement suggestions + merge recommendation) via `gh pr comment`. Within this skill's execution authority (automatic).
+**Mandatory before any `gh pr comment`: run `/public-surface-audit` over the composed comment text.**
+A PR comment is a **paste on a public surface**, and the repo's mechanical privacy floor does not
+reach it — the pre-commit confidentiality guard scans *staged tracked content* and has **no view of
+PR-body text** (`.claude/rules/fh_4axis_gate.md §Reviewer-visible evidence` says so explicitly).
+This step's own inputs make that acute: Step 2 matrix #2 greps the operator's **local memory files**,
+so an unfiltered paste can carry absolute home paths and private memory prose onto a public PR.
+
+```
+verdict CLEAN                     → attach (automatic, within this skill's authority)
+verdict REVIEW / LEAK             → do NOT attach. Redact the flagged spans, re-scan, then attach
+verdict NOT_CONFIGURED, or the
+  skill is unavailable            → do NOT attach automatically. This is an irreversible surface
+                                    (a posted comment is public the instant it lands and may be
+                                    mirrored before deletion) → **fail-closed**: hand the composed
+                                    text to the operator, or take an explicit logged override
+```
+
+**Never paste raw Step 2 grep output.** Write a *sanitized capsule* — what was checked, what it
+returned, what was found — never the matched lines themselves. Same rule as the marker: the file is
+a local artifact, the capsule is what crosses the boundary.
+
+Then attach the review comment (8-matrix results + self-catch + refinement suggestions + merge
+recommendation) via `gh pr comment`.
 
 > **Detail**: See `SKILL_detail.md §Step 4 Comment Template` — `gh pr comment` heredoc template — read when attaching the comment.
 
 ### Step 5. Admin Override Merge Recommendation
 
 **User decision delegation** (this skill = review/recording automation / no merge authority):
-- Beta stage policy (`enforce_admins: false`) adherence → admin override possible
+- **Read the branch-protection state at run time — never from this line.** This repo moved to
+  `enforce_admins: true` + `required_approving_review_count: 0` on 2026-07-20, and an earlier version
+  of this bullet still claimed `false`: a gate skill was recommending an override on a **field that
+  had already flipped**. Protection is also two independent layers (legacy + rulesets, strictest
+  wins), so one object is never the effective answer — check both:
+  `gh api repos/{owner}/{repo}/branches/main/protection` **and**
+  `gh api repos/{owner}/{repo}/rules/branches/main`
+- Self-approve is impossible when this cc authored the PR → after a completed review, `--admin` is
+  the normal route, not a shortcut
 - Self-approve blocked (GHE policy) → admin override path adherence
 - When this cc authored the change, admin override path is mandatory
 - N+1th operation proof = baseline stabilization acceleration path
@@ -96,39 +126,118 @@ Attach the review comment (8-matrix results + self-catch + refinement suggestion
 | Stage | Approval |
 |---|---|
 | Step 1~3 check auto-activation | **Automatic** (editable afterward) |
-| Step 4 review comment attachment | **Automatic** (gh pr comment within this skill's execution authority) |
+| Step 4 review comment attachment | **Automatic only after `/public-surface-audit` on the comment text returns CLEAN.** REVIEW/LEAK → redact and re-scan; NOT_CONFIGURED or audit unavailable → **fail-closed**, hand to the operator (a posted comment is public on landing) |
 | Step 5 admin override merge execution | **User decision** (this skill = recommendation only / no merge authority) |
 
 ## Constraints
 
 - **This skill = review/recording automation / no merge authority** — user admin override or other reviewer merge decision
 - **No single-person decision application** — following `fact-checker` rule (narrow 1 / broad N+1 / this cc self-catch joins fact-checker count)
-- **Simplification guard consistency** (`feedback_simplification_evidence`) — when creating/modifying this skill, update SKILL.md only. No new auxiliary files
-- **Markdown editing discipline mandatory** (`feedback_markdown_edit_discipline`) — Edit first. No Write
-- **Frontmatter description plain text only baseline** (`feedback_skill_frontmatter_description_plain_text`) — avoid markdown bold
+- **Simplification guard consistency** — when creating/modifying this skill, update SKILL.md only. No new auxiliary files
+- **Markdown editing discipline mandatory** — Edit first. No Write
+- **Frontmatter description plain text only baseline** — avoid markdown bold
+
+> The three rules above were previously each attributed to a `memory feedback_*.md` file. Those files
+> do not exist (verified 2026-08-11 against the operator's memory root, with a known-positive control
+> in the same run). The **rules stand on their own**; only the pointers were dead, and citing a
+> non-resolving file as the authority is the phantom-reference class this skill is supposed to catch.
+> Do not re-attach a memory citation here unless `ls` resolves it **in the same run that cites it**.
 
 > **Detail**: See `SKILL_detail.md §Sister Asset Utilization Path`, `§External User Environment Adaptation Path`, `§Disable Path`, `§Persona Synergy Catch` — cross-ecosystem utilization, external-environment fallback, own-PRS disable resolution, and deep-insight simultaneous-activation handling — read when operating in an external user environment, resolving own-PRS conflict, or coordinating with deep-insight.
 
 ## Done When
 
+This is a **gate/routing skill** — its output is a merge verdict — so every judged condition below
+names its adversarial pairing. No judge-only path.
+
 ```
 All 5 Steps completed
-+ Baseline consistency check 8-matrix results output (✅/⚠️/❌ each item)
+  — mandatory-pass: each step produced its output or is marked N/A with a reason
+
++ Baseline consistency check 8-matrix results output (OK/WARN/BLOCK each item)
+  — measured: count items REPORTED vs items ACTUALLY CHECKED; the two must
+    match. Matrix #2 (memory baseline) reports SKIPPED when no memory file
+    resolves — it is never folded into the pass count (see §References)
+
++ Axis 1 run in --pr mode with a typed verdict read from
+  REGRESSION_GUARD_RESULT_FILE
+  — mandatory-pass: result is `pass` or `block`. `skip` and exit 3 are NOT
+    passes; they mean Axis 1 did not examine this PR and the recommendation
+    may not cite it as green
+
++ /public-surface-audit run over the composed comment text BEFORE any
+  gh pr comment
+  — mandatory-pass, fail-closed: CLEAN attaches; REVIEW/LEAK redact-and-rescan;
+    NOT_CONFIGURED or audit unavailable hands to the operator. A posted comment
+    is irreversible, so tooling-down is a block, never a free skip
+
 + Review comment attached via gh pr comment command
-+ Admin override merge recommendation output (merge execution is user's decision)
-+ External verification path: harvest-loop Step 3.75 Critic isolation Agent can independently judge based on above criteria (skill_quality_rubric.md verifiable criteria)
+  — mandatory-pass: the comment URL is returned by the command
+
++ Admin override merge recommendation output (merge execution is user's
+  decision)
+  — judged; adversarial pairing: the branch-protection state is re-read at run
+    time from BOTH layers (`.../branches/main/protection` and
+    `.../rules/branches/main`, strictest wins) in the same run that recommends.
+    A recommendation citing this file's prose instead of a live read is
+    unfounded — that exact defect already shipped once here, on a field that
+    had flipped
+
++ External verification path: an isolated Critic agent can reach the same
+  verdict from the artifacts alone
+  — judged; adversarial pairing: the reviewer-visible evidence must be
+    reproducible WITHOUT the author's local files. Any verdict resting on a
+    gitignored local artifact ships labelled LOCAL-ONLY ATTESTATION -
+    UNVERIFIED, which leaves the condition UNMET rather than met
+    (`.claude/rules/fh_4axis_gate.md` §Reviewer-visible evidence)
 ```
 
-**→ Mandatory when PR contains SKILL.md / rules / templates changes: `bash templates/regression_guard.sh`** — run Axis 1 (backward check) before merge recommendation is issued. If regression_guard exits with M-tier block, merge recommendation must change to ❌ regardless of other checks.
+**→ Mandatory when PR contains SKILL.md / rules / templates changes: run Axis 1 (backward check) in
+`--pr` mode, against the PR's head branch** — before the merge recommendation is issued. If
+regression_guard reports an M-tier block, the merge recommendation must change to ❌ regardless of
+other checks.
+
+```bash
+# Precondition: the PR head branch must exist locally. This skill reads the PR via `gh pr diff`
+# without checking anything out, so fetch the head ref first or --pr has nothing to resolve.
+PR_BRANCH="$(gh pr view "$PR" --json headRefName -q .headRefName)"
+git fetch origin "$PR_BRANCH":"refs/remotes/origin/$PR_BRANCH"   # skip if already present
+bash templates/regression_guard.sh --pr "origin/$PR_BRANCH"
+```
+
+⚠️ **Do not run it with no arguments.** Bare `bash templates/regression_guard.sh` diffs the **working
+tree**, and this skill's own workflow leaves the reviewer standing on a clean `main` — so the bare
+form returns `REGRESSION_GUARD_RESULT=skip` with `exit 0` **100% of the time**, and the mandatory
+Axis-1 gate never examines the PR at all. Measured 2026-08-11 on a clean checkout: bare form →
+`rc=0 / result=skip`; `--pr <branch>` on the same commit → `rc=0 / result=pass` having actually read
+the changed SKILL.md. Canonical form is `--pr {BRANCH}` (`.claude/rules/fh_4axis_gate.md`).
+
 **Read the verdict from the typed channel, not the exit code** — `exit 0` means pass **or** skip
 (not-checked). Run with `REGRESSION_GUARD_RESULT_FILE=/tmp/rg.$$` and read `result=` from that file:
-`skip` means Axis 1 **did not examine** this PR (no matching file) — record it as "Axis 1 N/A", never
-as a green check. A merge recommendation that cites an unexamined Axis 1 as PASS is the 2026-07-22
-fail-open class.
+`skip` means Axis 1 **did not examine** this PR (no matching file, or the wrong invocation form) —
+record it as "Axis 1 N/A", never as a green check. `exit 3` means the invocation itself failed
+(unresolvable branch) — also not a pass; fetch the ref and re-run. A merge recommendation that cites
+an unexamined Axis 1 as PASS is the 2026-07-22 fail-open class.
 
 ## References
 
-- Rule body: `memory feedback_command_tower_gate.md` (hub gate accumulated naming baseline) + `memory feedback_field_to_hub_sync_protocol.md` (Option C Hybrid sync policy)
-- Consistency rules: `feedback_simplification_evidence` · `feedback_markdown_edit_discipline` · `feedback_skill_frontmatter_description_plain_text` · `feedback_bidirectional_self_validation` · `feedback_reference_own_hub_assets_first`
+> ⚠️ **The memory filenames below were audited 2026-08-11 and **none of them exist** — 8/8 absent in
+> the operator's own memory root, i.e. they were never reachable, not merely absent externally. They
+> are kept, struck, as the record of a phantom-reference class: a gate skill citing rule bodies that
+> resolve nowhere, while matrix #2 silently "skips" and the run still reports an 8-matrix pass.
+> **Matrix #2 is therefore a 7-matrix in practice** — report it as `matrix 2: SKIPPED (no resolvable
+> memory baseline)` rather than folding it into the pass count (`not found ≠ 0`).
+> Re-populate this list only with paths verified by `ls` **in the same run that cites them**.
+>
+> **Arithmetic reconciled 2026-08-11**: the "8/8" above is now true of the list below — all 8 cited
+> filenames are struck (re-verified in one run: 8 cited / 8 absent, with a known-positive and a
+> known-negative control). Previously only 7 were struck while the 8th
+> (`feedback_autonomous_commit_proposal`) was still cited live, and three more were cited as live
+> authority up in §Constraints and §Step 3 — where an executor actually reads, since References is
+> not on the execution path. **Those live citations are removed; the rules they carried are stated
+> directly.** A struck entry in References is not a fix if the same name is still load-bearing above.
+
+- ~~Rule body: `memory feedback_command_tower_gate.md` + `memory feedback_field_to_hub_sync_protocol.md`~~ — **absent (verified 2026-08-11)**
+- ~~Consistency rules: `feedback_simplification_evidence` · `feedback_markdown_edit_discipline` · `feedback_skill_frontmatter_description_plain_text` · `feedback_bidirectional_self_validation` · `feedback_reference_own_hub_assets_first`~~ — **absent (verified 2026-08-11)**
 - Sister skills: `cross-ecosystem-synergy-detection` (sister asset cluster baseline) · `verify-bidirectional` (bidirectional self-validation automation / self-catch auxiliary axis) · `harvest-loop` (weekly audit automation / operation proof accumulation cross-link)
-- Autonomous commit proposal §2.19 baseline: `memory feedback_autonomous_commit_proposal.md` (① development source automation + PR proposal under human approval)
+- ~~Autonomous commit proposal §2.19 baseline: `memory feedback_autonomous_commit_proposal.md`~~ — **absent (verified 2026-08-11)**. The rule it stood for is live and lives in `CLAUDE.md §AI Contribution Model`: development-source automation is allowed, PR submission requires explicit human approval. Cite that, not this filename.

package/plugins/fh-meta/skills/install-doctor/SKILL.md

@@ -221,20 +221,38 @@ If existing retrospective/audit files exist → `harvest-loop` will create files
 # Check MCP server transport settings
 grep -r "\"transport\"" .mcp.json 2>/dev/null | grep -i "http\|sse"
 
-# List MCP servers using HTTP transport
-python3 -c "
-import json, sys
+# List MCP servers using HTTP transport.
+# `except: pass` made this exit 0 on ANY failure, so the `|| echo` fallback was dead code and a
+# corrupt .mcp.json rendered identically to "no risky servers" — a silent pass on a security check.
+# Four states, four distinct exits: absent(0) · unparseable(2) · risky(1) · all-stdio(0).
+python3 - <<'PY'
+import json, os, sys
+p = '.mcp.json'
+if not os.path.exists(p):
+    print('  MCP-CHECK: NOT-APPLICABLE — .mcp.json absent (no MCP servers configured)')
+    sys.exit(0)
 try:
-    d = json.load(open('.mcp.json'))
-    servers = d.get('mcpServers', {})
-    for name, cfg in servers.items():
-        t = cfg.get('transport', 'stdio')
-        if t != 'stdio':
-            print(f'  ⚠️  {name}: transport={t}')
-except: pass
-" 2>/dev/null || echo "  .mcp.json absent or unparseable"
+    d = json.load(open(p))
+except Exception as e:
+    print(f'  MCP-CHECK: UNPARSEABLE — {p}: {e}')
+    print('  Transport risk UNMEASURED — this is NOT a pass. Fix the file and re-run.')
+    sys.exit(2)
+servers = (d.get('mcpServers') or {})
+risky = [(n, (c or {}).get('transport', 'stdio')) for n, c in servers.items()
+         if (c or {}).get('transport', 'stdio') != 'stdio']
+if risky:
+    for n, t in risky:
+        print(f'  WARNING  {n}: transport={t} — verify localhost binding + auth')
+    sys.exit(1)
+print(f'  MCP-CHECK: PASS — {len(servers)} server(s), all stdio')
+PY
 ```
 
+> **Read the exit code, not just the text.** `2` (unparseable) is an *unmeasured* check and must be
+> reported 🟧 in Step 3, never folded into 🟩. Known-pair calibration for this block: a deliberately
+> truncated `.mcp.json` must yield `2`, and a config with one `transport: http` server must yield `1`.
+> If both print nothing, the check is dead.
+
 **Known MCP HTTP transport vulnerability patterns** (based on HTTP port exposure security principles): When MCP servers using HTTP/SSE transport expose ports without authentication, remote access risk within local networks may occur. stdio transport is not affected.
 
 | Transport | Risk |
@@ -283,11 +301,29 @@ If you installed only the plugin in a different project cwd:
 ## Done When
 
 ```
-All Steps 1~4 completed
-+ Step 3 diagnosis report output (🟥 immediate action / 🟧 check recommended / 🟩 no conflicts)
-+ "Plugin install is safe in current environment" confirmed when 0 conflicts
+Steps 0~4 completed                                              (mandatory-pass)
++ Step 0 node-floor results recorded per check, each as one of
+  PASS / FAIL / UNMEASURED — never blank                          (measured: 2 floors —
+                                                                   hook exec-bit, SessionStart
+                                                                   registration)
++ Step 2-6 MCP transport check exited 0/1/2 and the exit code is
+  carried into the Step 3 tier (2 = UNMEASURED → 🟧, never 🟩)     (mandatory-pass)
++ Step 3 diagnosis report emitted with a tier per area
+  (🟥 immediate action / 🟧 check recommended / 🟩 no conflicts)   (mandatory-pass)
++ Verdict is derived from the recorded per-area tiers: 🟩 only if
+  every area is 🟩 AND none is UNMEASURED                          (measured: count of
+                                                                   non-🟩 areas == 0)
 ```
 
+**Why `Steps 0~4`, not `1~4`**: Step 0 holds the only *mechanical floor* checks in this skill (hook
+exec-bit, SessionStart registration, Node floor). Leaving it outside the completion condition let a
+run report "done" having never touched the one part that is not judgement.
+
+**Why the verdict is counted, not stated**: the previous condition was `"Plugin install is safe in
+current environment" confirmed` — that measures whether a *sentence was printed*, which a run
+satisfies by printing it. An unmeasured area (e.g. an unparseable `.mcp.json`) must not be
+absorbed into 🟩; absence of a finding is not a finding of absence.
+
 ## Simplification Guard
 
 - 0 existing assets (new environment) → output "New environment. No conflicts." and exit immediately in Step 1

package/plugins/fh-meta/skills/install-wizard/SKILL.md

@@ -301,13 +301,32 @@ On Claude API / MCP failure → refer to [`references/fallback-guide.md`](../../
 ## Done When
 
 ```
-☐ Environment detection complete: shell, CC version, OS, project type identified
-☐ Gap diagnosis output: present vs missing items listed
-☐ User approval/decline recorded for each suggested item
-☐ All approved items installed with no failure state
-  (failed installs surfaced to user — not silently skipped)
-☐ Acceleration baseline confirmed: zshrc alias + sentinels active (or user declined)
-☐ Summary output: "N items installed, M items skipped — setup complete"
+☐ Environment detection complete: shell, CC version, OS, project type
+  identified — each field carries a value or the literal "unknown",
+  never blank                                                    (measured: 4 fields resolved)
+☐ Settings probe distinguished ABSENT / UNPARSEABLE / OK — an
+  unparseable config is never treated as absent                  (mandatory-pass)
+☐ Gap diagnosis output: present vs missing items listed          (measured: count of items
+                                                                  present + missing == items
+                                                                  scanned)
+☐ User approval/decline recorded for each suggested item —
+  a missing answer is a decline, never an assumed yes            (measured: recorded answers
+                                                                  == suggested items)
+☐ All approved items installed with no failure state; every
+  failure surfaced to the user, not silently skipped             (mandatory-pass)
+☐ Acceleration baseline: zshrc block either appended with
+  SUBSTITUTED values (no literal "{FH_DIR}" in the target file)
+  or explicitly declined and the decline recorded                (mandatory-pass)
+☐ Step 3-D dispatch consent recorded in the three-part form
+  (quoted words · dated lease · scope) or a recorded decline —
+  a two-part record is invalid and counts as absent              (mandatory-pass)
+☐ Summary output: "N items installed, M items skipped" where
+  N + M equals the number of items offered                       (measured: N + M == offered)
+☐ Nothing was overwritten that the user did not approve          (judged — adversarial pairing:
+                                                                  re-run the wizard on a
+                                                                  populated .claude/ and diff
+                                                                  the tree before/after; any
+                                                                  unapproved delta is a FAIL)
 ```
 
 `--dry-run` mode Done When: gap diagnosis report written, no installation executed.

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -222,13 +222,23 @@ echo "CC_HUB_DIR=${CC_HUB_DIR:-not set}"
 basename "$(pwd)"
 ls .claude/ 2>/dev/null
 
-# CC settings (handle both dict and list for plugins)
-cat .claude/settings.json 2>/dev/null | python3 -c "
-import json,sys
-d=json.load(sys.stdin)
-p=d.get('plugins',{})
-print('plugins:', list(p.keys()) if isinstance(p,dict) else p)
-" 2>/dev/null || echo "settings.json not found"
+# CC settings (handle both dict and list for plugins).
+# Split existence from parseability FIRST. The old `cat file | python3 … || echo "not found"` read
+# $? from python, so a CORRUPT settings.json printed "settings.json not found" — the wizard would
+# then happily create a fresh one and silently clobber the user's real (broken) config.
+if [ ! -f .claude/settings.json ]; then
+  echo "settings.json: ABSENT"
+else
+  python3 - <<'PY' || echo "settings.json: UNPARSEABLE (present but unreadable — NOT the same as absent; do NOT overwrite, ask the user)"
+import json, sys
+try:
+    d = json.load(open('.claude/settings.json'))
+except Exception as e:
+    print(f'  parse error: {e}', file=sys.stderr); sys.exit(2)
+p = d.get('plugins', {})
+print('settings.json: OK — plugins:', list(p.keys()) if isinstance(p, dict) else p)
+PY
+fi
 
 # MCP plugin connection status
 python3 -c "import json,os; d=json.load(open(os.path.expanduser('~/.claude.json'))); print('MCP:', list(d.get('mcpServers',{}).keys()))" 2>/dev/null || echo "MCP config not found"
@@ -319,9 +329,18 @@ Reduction targets are only meta operation rules (PR procedures, commit guides, F
 **Detection bash:**
 
 ```bash
-# Detect existing harness scale
-CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || echo 0)
-RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || echo 0)
+# Detect existing harness scale.
+# `| wc -l || echo 0` is a conditional disarm, not a harmless idiom: with `set -o pipefail` active
+# (which the caller's shell may well have) a failing upstream stage makes the pipeline exit non-zero
+# AFTER wc has already printed its count, so the fallback appends a SECOND line, the value becomes
+# "0\n0", and the `-ge 3` test below dies with "integer expression expected" — on stderr only —
+# leaving the guard silent. Measured both directions 2026-08-12: single line without pipefail,
+# two lines with it. Sanitize instead of falling back.
+CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || true)
+RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || true)
+# head -n1 FIRST, then strip: `tr -dc '0-9'` alone would fuse a two-line "12\n0" into "120".
+CLAUDE_MD_LINES=$(printf '%s\n' "$CLAUDE_MD_LINES" | head -n1 | tr -dc '0-9'); CLAUDE_MD_LINES=${CLAUDE_MD_LINES:-0}
+RULES_COUNT=$(printf '%s\n' "$RULES_COUNT" | head -n1 | tr -dc '0-9');         RULES_COUNT=${RULES_COUNT:-0}
 
 echo "CLAUDE.md: ${CLAUDE_MD_LINES} lines"
 echo ".claude/rules/: ${RULES_COUNT} files"
@@ -493,6 +512,15 @@ propose adding rows to `agent-composer/SKILL.md` Step 1 mapping table in this fo
 | {skill name} related task | {skill name} (S) | — |
 ```
 
+> **Verify this block against a temp file, never against `~/.zshrc`.** Set `ZSHRC_TARGET` to a
+> scratch path and run the five arms: FH_DIR unset → rc=1, nothing written · CC_HUB_DIR unset →
+> rc=1, nothing written · `$FH_DIR` without the script → ABORT, nothing written · consent absent →
+> SKIPPED, nothing written · consent Y with both vars → block appended with values **substituted**
+> and `$HOME`/`$FH_DIR` left literal, then `zsh -c 'source <temp>'` exits 0. Re-running must not
+> duplicate the block. **Beware a contaminated control**: if your own shell already exports
+> `FH_DIR`, the "unset" arm is not actually negative — isolate with `env -u FH_DIR`. That mistake
+> made the first pass of this very verification report a false PASS.
+
 Output preview before execution:
 ```
 ▶ agent-composer mapping update
@@ -507,18 +535,37 @@ Output preview before execution:
 
 ```bash
 # zshrc hook — preview then confirm. The wizard is AI-mediated: SHOW the user the exact block
-# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append. An earlier
-# revision's comment promised preview-then-confirm while the bash appended unconditionally —
-# the decline-integrity sim (2026-08-10) caught the mismatch; the gate is the instruction, the
-# bash below runs ONLY on Y.
-if ! grep -q "fh_audit_check.zsh" ~/.zshrc 2>/dev/null; then
-  # (run only after an explicit in-chat Y)
-  cat >> ~/.zshrc << 'EOF'
-export FH_DIR="{FH_DIR}"
-export CC_HUB_DIR="{CC_HUB_DIR}"
-export CC_SENTINELS_DIR="$HOME/.cc_sentinels"
-source "$FH_DIR/templates/fh_audit_check.zsh"
+# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append.
+#
+# TWO defects were fixed here (2026-08-12), both of which corrupt every future shell:
+#  (1) The heredoc was QUOTED (<< 'EOF'), so the literal text `{FH_DIR}` was written to ~/.zshrc.
+#      The resulting `source "$FH_DIR/templates/fh_audit_check.zsh"` then resolved to
+#      `{FH_DIR}/templates/...` and every subsequent shell start failed with
+#      `no such file or directory` (rc=127, reproduced in a sandbox against a temp file).
+#      Fix: unquoted heredoc so FH_DIR/CC_HUB_DIR expand AT WRITE TIME, with `\$HOME` and
+#      `\$FH_DIR` escaped so THOSE stay literal and resolve at shell-start.
+#  (2) The consent gate was a COMMENT ("run only after an explicit in-chat Y"). A comment does
+#      not gate anything — pasted or scripted, the block appended unconditionally. It is now a
+#      real conditional on FH_WIZARD_ZSHRC_CONSENT, default N (fail-closed).
+#
+# Set FH_WIZARD_ZSHRC_CONSENT=Y only after the user answers Y in chat.
+ZSHRC="${ZSHRC_TARGET:-$HOME/.zshrc}"
+: "${FH_DIR:?FH_DIR is unset — refusing to write a broken source line into $ZSHRC}"
+: "${CC_HUB_DIR:?CC_HUB_DIR is unset — refusing to write an incomplete block into $ZSHRC}"
+if [ ! -f "$FH_DIR/templates/fh_audit_check.zsh" ]; then
+  echo "ABORT: \$FH_DIR/templates/fh_audit_check.zsh does not exist — would wire a dead source line"
+elif [ "${FH_WIZARD_ZSHRC_CONSENT:-N}" != "Y" ]; then
+  echo "zshrc hook: SKIPPED (no explicit Y) — nothing written"
+elif grep -q "fh_audit_check.zsh" "$ZSHRC" 2>/dev/null; then
+  echo "zshrc hook: already present — no change"
+else
+  cat >> "$ZSHRC" <<EOF
+export FH_DIR="$FH_DIR"
+export CC_HUB_DIR="$CC_HUB_DIR"
+export CC_SENTINELS_DIR="\$HOME/.cc_sentinels"
+source "\$FH_DIR/templates/fh_audit_check.zsh"
 EOF
+  echo "zshrc hook: appended"
 fi
 # On N: do NOT append; record the decline and state its consequence in one line —
 #   echo "zshrc_hook" >> "$HOME/.cc_sentinels/{project}_wizard_declined"

package/plugins/fh-meta/skills/memory-hygiene/SKILL.md

@@ -56,15 +56,31 @@ re-verification is possible).
 
 ### Step 1 — Scan memory/*.md
 
+Enumerate **every** root with a per-root state — an absent root and an empty root are different
+facts, and the Step-4 snapshot scope is bound to this enumeration:
+
 ```bash
-ls ~/.claude/projects/*/memory/*.md 2>/dev/null
-# or hub-local:
-ls memory/*.md 2>/dev/null
+for ROOT in "$HOME"/.claude/projects/*/memory "$PWD/memory"; do
+  if [ -d "$ROOT" ]; then
+    n=$(ls "$ROOT"/*.md 2>/dev/null | wc -l | tr -d ' ')
+    echo "EXISTS(n=$n) $ROOT"
+  else
+    echo "ABSENT       $ROOT"
+  fi
+done
 ```
 
+**`ABSENT` is never counted as 0 entries.** Swallowing both into `2>/dev/null` makes "this root does
+not exist here" indistinguishable from "this root is empty" — and the snapshot in Constraints below
+must cover every root reported `EXISTS`, so a root mis-rendered as empty silently narrows the
+snapshot scope.
+
 For each file, extract:
 - `metadata.type` from frontmatter
-- `date:` or any date-like field in frontmatter or body
+- **Age source, in this order** (measured over the live corpus, n=267): `metadata.modified`
+  (ISO8601, present on 77/267) → else the file's filesystem mtime → else **`AGE-UNKNOWN`**.
+  There is **no top-level `date:` field in this corpus** (measured 0/267) — do not look for one,
+  and never treat `AGE-UNKNOWN` as fresh.
 - Key factual claims (GitHub URLs, status strings, version numbers, dates)
 
 ### Step 2 — Classify by Staleness
@@ -89,7 +105,9 @@ For each stale entry, run the appropriate re-verification:
 **Reference type** (URLs, DOIs, GitHub):
 - Use `gh api` for GitHub resources
 - Use `WebFetch` for DOIs and arXiv records
-- Mark `verified_at: YYYY-MM-DD` in frontmatter if still valid
+- Mark `metadata.verified_at: YYYY-MM-DD` — **nested under `metadata:`**, the layer this corpus
+  actually uses (`metadata:` present on 265/267; a top-level `verified_at` measured 0/267 and would
+  be invisible to the Step-1 extractor)
 - Flag `⚠ DRIFTED` if content has changed materially
 
 **Project type** (status, milestones):
@@ -121,19 +139,47 @@ Apply updates? [y / N per item]
 
 ### Step 5 — Record Run
 
+Use `printf`, never `echo "…\n…"` — `echo` expands `\n` in zsh but writes it **literally** in bash
+(measured: 6 lines vs 1), which silently produces a one-line file with a broken frontmatter.
+
 ```bash
-# Create hygiene log
-echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n---" \
-  > tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md
+mkdir -p tracks/_meta
+printf '%s\n' \
+  '---' \
+  "date: $(date +%Y-%m-%d)" \
+  "entries_checked: ${ENTRIES_CHECKED}" \
+  "demoted_to_archive: ${DEMOTED}" \
+  "orphans_indexed: ${ORPHANS}" \
+  "merged: ${MERGED}" \
+  "drifted: ${DRIFTED}" \
+  "hard_deleted: ${HARD_DELETED}" \
+  '---' \
+  > "tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md"
 ```
 
+**Every count is a measured value from Steps 1–4.** A log still containing a literal `N` (or an
+unexpanded `${…}`) is **an invalid log** — treat that run as not-recorded, because the log's
+existence is what arms the 7-day cadence guard, so a placeholder log suppresses the *next* real run.
+
 ## Constraints
 
 - **No auto-deletion**: Archive candidates are proposed, not deleted. Human confirmation required.
 - **Snapshot before archive (Destructive-Op Gate for memory)**: before applying any confirmed
   archive/removal in Step 4, snapshot **every memory root the entry could live in** first — tar **all**
   roots Step 1 enumerated (`~/.claude/projects/*/memory/` AND hub-local `memory/`), not just one:
-  `tar czf tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz <each Step-1 root that exists>` — so
+  the snapshot **must be gated on its own exit status** — an unwritable or missing `tracks/_meta`
+  makes `tar` exit 1 and produce no tarball (measured), and without a gate the irreversible archive
+  proceeds anyway:
+
+  ```bash
+  SNAP="tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz"
+  mkdir -p tracks/_meta || { echo "SNAPSHOT FAILED (mkdir) — abort archive"; exit 1; }
+  tar czf "$SNAP" <each Step-1 root reported EXISTS> || { echo "SNAPSHOT FAILED (tar) — abort archive"; exit 1; }
+  [ -s "$SNAP" ] || { echo "SNAPSHOT FAILED (empty tarball) — abort archive"; exit 1; }
+  echo "SNAPSHOT OK: $SNAP"
+  ```
+
+  Only on `SNAPSHOT OK` may the archive proceed — so
   a wrong archive in any scanned root is one-command recoverable (a single-root snapshot can pass while
   the archived entry lived in the other root — bind the scope to the entry, not to "a tarball exists").
   Archive moves entries to a `.archive/` sibling, never hard-deletes (mirrors the Curator's
@@ -147,14 +193,15 @@ echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n
 
 ## Done When
 
-```
-Step 1~5 complete
-+ Staleness roster output (Step 2 = mechanical no-LLM pre-pass)
-+ Re-verification run for all STALE entries
-+ User gate presented and responded to (y/N per item)
-+ If any archive confirmed: snapshot covering the archived entry's root written before the move (tracks/_meta/memory_snapshot_*.tgz, spanning all existing Step-1 roots) — check class: mandatory-pass (snapshot covers the entry's dir, not merely "a tarball exists")
-+ Hygiene log written to tracks/_meta/memory_hygiene_{date}.md
-```
+| Condition | Check class |
+|---|---|
+| Step 1~5 complete, every memory root reported `EXISTS(n=…)` or `ABSENT` | **mandatory-pass** |
+| Staleness roster output (Step 2 = mechanical no-LLM pre-pass), with `AGE-UNKNOWN` entries listed separately and not as FRESH | **measured** (age from `metadata.modified` / mtime, not recall) |
+| Re-verification run for all STALE entries | **mandatory-pass** |
+| Each re-verified entry's verdict (VERIFIED / DRIFTED) is correct | **judged** — adversarial pairing: `fh-meta:fact-checker` re-greps the hub for the same claim; any disagreement downgrades the entry to DRIFTED (no judge-only PASS) |
+| User gate presented and responded to (y/N per item) | **mandatory-pass** |
+| If any archive confirmed: snapshot written **and its exit status checked** before the move (`tracks/_meta/memory_snapshot_*.tgz`, spanning every root reported `EXISTS`) | **mandatory-pass** — snapshot must cover the archived entry's dir; `SNAPSHOT OK` printed, not merely "a tarball exists" |
+| Hygiene log written to `tracks/_meta/memory_hygiene_{date}.md` with real counts (no literal `N`, no unexpanded `${…}`) | **measured** |
 
 ## References
 

package/plugins/fh-meta/skills/meta-prompt-builder/SKILL.md

@@ -153,11 +153,45 @@ Acceptable form examples:
 
 ## Done When
 
+This skill's own Done When must satisfy the 3-part completeness check it imposes on others
+(**measurement subject · measurement timing · version/baseline**). The previous version —
+`All steps 0–3 completed` — met 0 of 3 and matched its own `Unconditioned completion` WARN pattern.
+
 ```
-All steps 0–3 completed
-+ Per-agent prompt drafts output per Wave (Goal/Context/Constraints/Done When 4-field included)
-+ Step 3 quality self-validation complete ([WARN] items delegated to user if present)
-+ Generated prompts awaiting user review
+Measurement subject: this skill's own output — the prompt draft set
+                     produced in this invocation (not the dispatched
+                     agents' results, which this skill never sees)
+Measurement timing:  absolute, at end of this run — no comparison to a
+                     previous run is implied or required
+Version / baseline:  the Step 3 checklist and the WARN-trigger table in
+                     THIS file; note the SKILL.md revision used if the
+                     table has changed since the draft was written
+
+☐ Steps 0–3 each produced their named artifact — a step with no
+  artifact is incomplete, not "completed"                        (measured: 4 steps, 4 artifacts)
+☐ One prompt draft exists per agent named in the dispatch plan   (measured: drafts == agents
+                                                                  in plan)
+☐ Every draft carries all four fields (Goal / Context /
+  Constraints / Done When), none empty                           (measured: 4 fields × N drafts,
+                                                                  0 empty)
+☐ Each draft's own Done When was run through the 3-part
+  completeness check and the WARN-trigger table, with the
+  result recorded per draft                                      (mandatory-pass)
+☐ Every Goal was checked against the target agent's declared
+  allowed-tools by READING that agent's SKILL.md — not from
+  recall                                                          (mandatory-pass)
+☐ [WARN] items are surfaced to the user with the reason, and
+  the decision is the user's                                     (mandatory-pass)
+☐ Drafts are handed over for review, not dispatched              (mandatory-pass)
+☐ The drafts are usable by the target agent as written           (judged — adversarial pairing:
+                                                                  generator and validator are the
+                                                                  same model, so self-validation
+                                                                  repeats its own bias. Have the
+                                                                  target agent, or a different
+                                                                  model, read one draft cold and
+                                                                  state what it would do; a
+                                                                  divergence from the intended
+                                                                  task is a FAIL)
 ```
 
 ## Simplification Guard