@chrono-meta/fh-gate 1.4.95 → 1.4.96

package/scripts/degrade_probe_capability.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# degrade_probe_capability.sh — degrade_direction_scan 의 **capability 진입점**.
+#
+# node A(psa) 와 다른 계보의 다른 질문이다: 내용이 아니라 «판정이 어느 방향으로
+# 무너지나»(fail-open 여부)를 본다. 스캔 로직은 재구현하지 않고 기존 스캐너를 부른다.
+#
+# verdict enum (declared): 0=CLEAN 2=FINDINGS 3=NO_TARGET 10=HARNESS_ERROR
+#   3 은 원 스캐너가 exit 0 으로 뭉개던 «스캔할 py/sh 대상이 없다» 를 분리한 값이다 —
+#   그 0 은 «깨끗» 이 아니라 «시작조차 안 함» 이고, 정확히 §ⓑ.4 B1 이 막는 형태다.
+#
+# 🟥 이 파일의 초판이 이 레포의 `scripts/` 를 통째로 지웠다 (2026-08-11, 실발생).
+#    기전: `TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT` 로 정리 트랩을 건 뒤,
+#    무인자 분기에서 **같은 변수에 실제 레포 경로를 재대입**했다 → 트랩이 종료 시
+#    `rm -rf $REPO_ROOT/scripts` 를 실행. 트랩은 «내가 만든 것» 이 아니라
+#    «그 변수가 지금 가리키는 것» 을 지운다.
+#    **처방(구조적)**: 정리 대상(OWNED_TMP)과 스캔 대상(TARGET)을 **다른 변수로 분리**하고,
+#    트랩은 OWNED_TMP 만 본다. OWNED_TMP 는 최초 대입 후 절대 재대입하지 않는다.
+#    그리고 트랩 안에서 경로가 mktemp 산출물인지 한 번 더 검문한다(두 번째 방벽).
+set -o pipefail
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+SCAN="$REPO_ROOT/scripts/degrade_direction_scan.sh"
+[ -r "$SCAN" ] || { echo "degrade-probe: 스캐너 부재 — 계기가 없다"; exit 10; }
+
+OWNED_TMP="$(mktemp -d)"      # ← 내가 만든 것. 재대입 금지.
+_cleanup() {
+  # 두 번째 방벽: 트랩이 지우는 경로가 정말 내가 만든 임시 디렉토리인지 검문한다.
+  case "$OWNED_TMP" in
+    /tmp/*|/var/folders/*) [ -d "$OWNED_TMP" ] && rm -rf "$OWNED_TMP" ;;
+    *) echo "degrade-probe: cleanup 거부 — OWNED_TMP 가 임시 경로가 아니다: $OWNED_TMP" >&2 ;;
+  esac
+}
+trap _cleanup EXIT
+
+MODE="${1:-}"
+TARGET=""                     # ← 스캔 대상. 실제 레포 경로를 가리킬 수 있다. 절대 안 지운다.
+
+case "$MODE" in
+  --known-positive)   # 답을 아는 양성: 교과서적 fail-open (검사 실패인데 성공 반환)
+    TARGET="$OWNED_TMP"
+    cat > "$TARGET/probe_target.sh" <<'FIX'
+#!/bin/sh
+verify_integrity() {
+  scan=$(run_scan) || return 0     # 검사가 에러났는데 성공으로 반환 = fail-open
+  echo "$scan"
+}
+FIX
+    ;;
+  --known-negative)   # 답을 아는 음성: 같은 모양인데 방향이 옳은 대조군
+    TARGET="$OWNED_TMP"
+    cat > "$TARGET/probe_target.sh" <<'FIX'
+#!/bin/sh
+verify_integrity() {
+  scan=$(run_scan) || return 1     # 검사 실패 → 실패 반환 = fail-closed
+  echo "$scan"
+}
+FIX
+    ;;
+  --target) TARGET="${2:?--target 은 경로가 필요하다}" ;;
+  '')       TARGET="$REPO_ROOT/scripts" ;;
+  *) echo "degrade-probe: 알 수 없는 모드 '$MODE'"; exit 10 ;;
+esac
+
+# 대상 존재 여부를 **먼저** 판정한다 — 원 스캐너의 exit 0 은 「대상 없음」과
+# 「깨끗」을 같은 값으로 렌더한다. 그 둘을 여기서 가른다.
+# `.md` joined the候補 set 2026-08-12. Until then this counted only `.sh|.py`, so a pure-markdown
+# target exited 3 = NO_TARGET **without ever invoking the scanner** — which means the release's
+# headline feature (scanning ```bash/```python fences inside SKILL.md) was unreachable through the
+# typed capability path, the one a cockpit caller actually uses. A capability that cannot reach its
+# own advertised surface is not a narrow bug; it is the feature not shipping on that path.
+# 이 pre-count 자체가 `find` 에 의존한다 — 부재하면 0 이 나오고 그건 NO_TARGET 으로 렌더된다.
+# 스캐너 본체는 같은 상황에서 INSTRUMENT ERROR(exit 2)를 내는데 wrapper 가 그걸 «대상 없음»으로
+# 덮어써서 HARNESS_ERROR 판정이 도달 불가였다(cross-family, A급). 계기 부재는 대상 부재가 아니다.
+command -v find >/dev/null 2>&1 || {
+  echo "degrade-probe: HARNESS_ERROR — \`find\` 부재로 대상 열거 자체가 불가(대상 없음이 아니다)"; exit 10; }
+# 계기가 **있어도** 이 타깃을 못 훑을 수 있다(권한 없는 디렉토리). 첫 수리는 `command -v` 만 봐서
+# 그 경우가 여전히 NO_TARGET 으로 렌더됐다 — 절반만 닫은 수리다(cross-family 재지적, A급).
+# 「대상이 없다」와 「대상을 못 셌다」는 다른 말이고, 후자는 HARNESS_ERROR 다.
+_perr=$(find -H "$TARGET" -type f 2>&1 >/dev/null); _prc=$?
+if [ "$_prc" -ne 0 ] || [ -n "$_perr" ]; then
+  echo "degrade-probe: HARNESS_ERROR — 대상 열거 실패(대상 없음이 아니다): ${_perr:-find exited $_prc}"; exit 10
+fi
+n=$(find -H "$TARGET" -type f \( -name '*.sh' -o -name '*.py' -o -name '*.md' \) 2>/dev/null | wc -l | tr -d ' ')
+[ "${n:-0}" -eq 0 ] && { echo "degrade-probe: NO_TARGET — 스캔 대상 파일 0개(깨끗이 아니다)"; exit 3; }
+
+out="$(bash "$SCAN" "$TARGET" 2>&1)"; rc=$?     # verdict 는 직접 취한다(PIPE-VERDICT)
+case "$rc" in
+  0) echo "degrade-probe: CLEAN (대상 $n)"; exit 0 ;;
+  2)
+    # rc=2 는 스캐너에서 **세 가지**를 뜻한다: 실제 findings · 못 잰 파일(UNMEASURED) ·
+    # 스캔 대상 아님(UNSCANNABLE). 셋을 전부 FINDINGS 로 접으면 「못 쟀다」가 「결함을 찾았다」로
+    # 렌더돼, 계기 고장이 대상의 결함으로 오귀속된다(반대 방향이지만 같은 계열의 오분류).
+    # 순서가 판정이다 — «못 쟀다» 를 **먼저** 본다. findings 검사를 앞에 두면 「일부는 쟀고 일부는
+    # 못 쟀다」가 그냥 FINDINGS 로 나가고, 미측정 표면이 판정에서 사라진다(cross-family 지적, A급).
+    # `_md_collect` 의 「err 가 got 을 이긴다」와 같은 규율을 이 층에도 건다.
+    if printf '%s' "$out" | grep -qi 'COULD NOT BE MEASURED'; then
+      echo "degrade-probe: HARNESS_ERROR — 스캐너가 대상을 측정하지 못했다(깨끗이 아니다)"
+      printf '%s\n' "$out" | head -4; exit 10
+    elif printf '%s' "$out" | grep -qE '\[[A-Z][0-9]?:'; then
+      echo "degrade-probe: FINDINGS (대상 $n)"; printf '%s\n' "$out" | head -6; exit 2
+    else
+      echo "degrade-probe: NO_TARGET — 대상 $n 개가 전부 스캔 대상 밖이다(깨끗이 아니다)"
+      printf '%s\n' "$out" | head -4; exit 3
+    fi ;;
+  *) echo "degrade-probe: HARNESS_ERROR — 스캐너가 enum 밖 $rc 반환"; exit 10 ;;
+esac

package/scripts/package_coverage_check.sh

@@ -104,6 +104,14 @@ ACCEPTED_ABSENT=(
   # machine is a bill is worse than omitting it. selfcheck reports it NOT EXERCISED (exit 2)
   # where the CLI is missing, so the package stays green without pretending the lanes ran.
   "scripts/test_sessionstart_multihook_lanes.sh"
+  # The launchd-driven daily cadence runner. Two independent reasons it must not ship: it is half of
+  # a pair whose other half is a machine-local plist (`scripts/com.forge-harness.frontier-digest.plist`),
+  # and every run spends `claude` CLI calls on the consumer's account — the same "its only effect on
+  # a consumer's machine is a bill" rule as `ablation_calibrate.sh` above. It also writes into
+  # `tracks/`, which does not ship. The frontier-digest SKILL names it as the *hub's* production
+  # runner (labelled hub-local at the reference), which is a pointer for contributors, not a promise
+  # of a shipped artifact — the skill's own save path works without it.
+  "scripts/frontier_digest_daily.sh"
 )
 
 out=$(python3 - "${ACCEPTED_ABSENT[@]}" <<'PY'

package/scripts/psa_probe_capability.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# psa_probe_capability.sh — public-surface-audit 기계층의 **capability 진입점**.
+#
+# 왜 별도 파일인가: `public_surface_scan_files.sh` 는 publish 경계 전용(exit 1 = 차단)이고
+# npm **배포 파일셋**(package.json files[])만 스캔한다. capability 로 등록하려면 §ⓑ.2 가
+# 요구하는 것 — 닫힌 enum · 「안 돌았다」 구분 · 캘리브레이션 쌍 argv — 을 갖춘 진입점이
+# 필요하고, 스코프도 다르다: 여기는 **전 tracked 파일**을 본다.
+#   ⚠️ 두 표면은 서로를 포함하지 않는다 — npm PASS 는 공개 표면 PASS 가 아니다
+#      (레포가 public 이면 files[] 밖 tracked 파일도 GitHub 이 이미 게시하고 있다).
+# 스캔 로직은 재구현하지 않고 `psa_scan_lib.sh` 를 그대로 쓴다(단일 소스).
+#
+# verdict enum (declared): 0=CLEAN 1=LEAK 3=NOT_CONFIGURED 10=HARNESS_ERROR
+#   3 은 「돌았는데 깨끗」이 아니라 「스캔할 패턴이 없어 아무것도 안 봤다」다 — §ⓑ.4 B1.
+#
+# 🟥 정리 트랩 규율(자매 파일 degrade_probe 의 실사고에서): 트랩이 지우는 변수는
+#    **재대입하지 않는다**. OWNED_TMP 는 내가 만든 것만 가리키고, 스캔 대상은 별 변수다.
+set -o pipefail
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+LIB="$REPO_ROOT/scripts/psa_scan_lib.sh"
+[ -r "$LIB" ] || { echo "psa-probe: scan lib 부재 — 계기가 없다"; exit 10; }
+. "$LIB" || { echo "psa-probe: scan lib 로드 실패"; exit 10; }
+
+OWNED_TMP="$(mktemp -d)"      # 재대입 금지
+_cleanup() {
+  case "$OWNED_TMP" in
+    /tmp/*|/var/folders/*) [ -d "$OWNED_TMP" ] && rm -rf "$OWNED_TMP" ;;
+    *) echo "psa-probe: cleanup 거부 — OWNED_TMP 가 임시 경로가 아니다: $OWNED_TMP" >&2 ;;
+  esac
+}
+trap _cleanup EXIT
+
+MODE="${1:-}"
+IN="$OWNED_TMP/in"
+SCAN_NOTE=""
+
+# 합성 양성 토큰은 **조각으로 보관하고 실행 시 조립**한다. 통짜 리터럴을 두면 이 파일 자체가
+# MED 히트가 되어 pre-commit 기밀 스캔에 걸린다 — 실제로 걸렸고(2026-08-11), 그 차단은 옳았다.
+# 우회(override)가 아니라 스킬 자신의 2층 규율(리터럴은 추적 파일에 두지 않는다)을 따르는 게 답이다.
+_synth_home_token() { printf '/Users/%s/' "realuser1234"; }
+
+case "$MODE" in
+  --known-positive)   # 답을 아는 양성: 조립된 홈경로 토큰을 심은 합성 입력
+    printf 'synthetic_fixture.md\tsee %ssecret for detail\n' "$(_synth_home_token)" > "$IN" ;;
+  --known-negative)   # 답을 아는 음성: 어떤 패턴에도 안 걸리는 합성 입력
+    printf 'synthetic_fixture.md\tperfectly ordinary documentation line\n' > "$IN" ;;
+  --tracked|'')       # 실사용: 이 레포의 tracked 파일 전량
+    # `-z` (NUL 구분) 필수: 기본 `core.quotePath=true` 는 비-ASCII 파일명을 따옴표+8진
+    # 이스케이프로 내보내므로, 줄 단위로 읽으면 그 파일들이 **무음으로 스캔에서 빠지고**
+    # 결과는 CLEAN 이 된다(못 잰 것을 0으로 렌더). 드롭은 세어서 보고한다.
+    git -C "$REPO_ROOT" ls-files -z > "$OWNED_TMP/files" 2>/dev/null || { echo "psa-probe: git 도달 불가"; exit 10; }
+    : > "$IN"; scanned=0; dropped=0
+    while IFS= read -r -d '' f; do
+      if [ ! -f "$REPO_ROOT/$f" ]; then dropped=$((dropped+1)); continue; fi
+      if awk -v p="$f" '{printf "%s\t%s\n", p, $0}' "$REPO_ROOT/$f" >> "$IN" 2>/dev/null; then
+        scanned=$((scanned+1))
+      else dropped=$((dropped+1)); fi
+    done < "$OWNED_TMP/files"
+    SCAN_NOTE=" (스캔 $scanned 파일$([ "$dropped" -gt 0 ] && printf ', 드롭 %s' "$dropped"))"
+    [ "$dropped" -gt 0 ] && { echo "psa-probe: HARNESS_ERROR — 읽지 못한 tracked 파일 $dropped 개(부분 스캔은 CLEAN 을 증명하지 못한다)"; exit 10; } ;;
+  *) echo "psa-probe: 알 수 없는 모드 '$MODE'"; exit 10 ;;
+esac
+
+psa_load "$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults" \
+         "${PSA_PATTERNS:-$REPO_ROOT/.claude/rules/.public-surface-patterns}" \
+  || { echo "psa-probe: 패턴 로드 실패"; exit 10; }
+
+# 「안 돌았다」와 「돌았는데 깨끗」의 구분 — 패턴 층이 하나도 없으면 스캔한 게 없다
+if [ "${PSA_DEFAULTS_OK:-0}" -eq 0 ] && [ "${PSA_OVERRIDE_PRESENT:-0}" -eq 0 ]; then
+  echo "psa-probe: NOT_CONFIGURED — 패턴 층 부재, 아무것도 스캔하지 않았다"; exit 3
+fi
+[ "${PSA_BAD_ROWS:-0}" -gt 0 ] && { echo "psa-probe: HARNESS_ERROR — 못 쓰는 패턴 행 $PSA_BAD_ROWS 개"; exit 10; }
+
+psa_scan_tagged < "$IN"; hit_rc=$?     # verdict 는 직접 취한다(PIPE-VERDICT)
+case "$hit_rc" in
+  0) echo "psa-probe: CLEAN${SCAN_NOTE}"; exit 0 ;;
+  1) echo "psa-probe: LEAK${SCAN_NOTE}"; exit 1 ;;
+  *) echo "psa-probe: HARNESS_ERROR — scan_tagged 가 enum 밖 $hit_rc 반환"; exit 10 ;;
+esac

package/scripts/public_surface_scan_files.sh

@@ -125,6 +125,14 @@ while IFS= read -r f; do
       [ -z "$tok" ] && continue
       printf '%s' "$tok" | grep -qiE "$PSA_PLACEHOLDER" && continue
       if [ "$sev" = "LOW" ] && psa_low_allowlisted "$f"; then continue; fi
+      # file::token allowlist — the SAME rows the commit/push path honours (psa_scan_lib.sh).
+      # Before this line the publish path ignored them, so a token the operator had DELIBERATELY
+      # published had no expressible disposition **at the one boundary that matters most**: the only
+      # way past was the blanket `PUBLIC_SURFACE_OK=1` override. That is worse than a narrow row —
+      # a blanket override waves every OTHER finding through in the same run, and this repo's own
+      # doctrine says an override that becomes routine disarms the gate. Narrow, recorded, and
+      # logged beats broad and silent. (Rows are literal path + literal token, gitignored source.)
+      if psa_pair_allowlisted "$f" "$tok"; then continue; fi
       echo "  ❌ $sev leak — $f: '$tok' would ship to the registry"
       LEAK=1
       # -a forces every published file to scan as TEXT (challenger S1): -I skipped binary-classified

package/scripts/selfcheck.sh

@@ -184,6 +184,21 @@ else
   fail=1
 fi
 
+# count_check's README format override is a mandatory-pass gate whose pattern is caller-supplied.
+# Same subject-present/anchor-gone shape as the block above: if the guard ships without its known
+# pair, a template that defeats the gate (a rendered newline turns the pattern into an OR search)
+# passes silently — measured 2026-08-12 on a stale README that the gate reported as PASS.
+if [ ! -f scripts/count_check.sh ]; then
+  echo "SKIP  count_check README-format lanes (subject scripts/count_check.sh absent)"
+elif [ -f scripts/test_count_check_readme_format_lanes.sh ]; then
+  if ! bash scripts/test_count_check_readme_format_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  count_check README-format lanes: count_check.sh present but its anchor is missing"
+  fail=1
+fi
+
 # package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
 # ref-path check below: that one asks "does this path exist at all", this one asks "does the
 # CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were

package/scripts/test_capability_entrypoint_shipping.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# test_capability_entrypoint_shipping.sh — every typed CAPABILITY ENTRY POINT must be in the
+# npm published file set.
+#
+# WHY THIS EXISTS (measured 2026-08-12, cross-family gpt-5.5 + governor widening)
+# `scripts/degrade_probe_capability.sh` AND `scripts/psa_probe_capability.sh` were both absent from
+# `package.json` `files[]`, while their VALIDATOR (`capability_registry_check.sh`) shipped. An npm
+# consumer therefore received the thing that checks capabilities and none of the capabilities — the
+# release's headline feature (scanning ```bash/```python fences) was unreachable on the typed path
+# it advertises.
+#
+# WHY `package_coverage_check.sh` DID NOT CATCH IT — and why this is a separate check rather than a
+# rule added there: that checker walks *references* (a shipped doc names a path → the path must
+# ship). These two files are referenced by NOTHING but their own header. A reference-follower is
+# structurally blind to an ORPHAN; you cannot fix that by adding another pattern to it. The
+# discriminator here is not "is it referenced" but "is it an entry point", which is knowable from
+# the filename convention alone.
+#
+# CLASS: third occurrence of "a shipped surface points outside files[]" in this release cycle
+#   1. SKILL.md pointed at a runner that was not shipped        (caught by CI only)
+#   2. AGENTS.md pointed at validate_yaml.sh, not shipped       (caught by CI only)
+#   3. the capability entry points themselves, not shipped      (caught by cross-family only)
+# The standing rule is N>=3 → mechanize at the front instead of relying on the next reviewer.
+#
+# Usage:  bash scripts/test_capability_entrypoint_shipping.sh
+# Exit:   0 = every entry point ships; 1 = at least one is missing (or the check could not run).
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT" || { echo "FAIL: cannot cd to repo root"; exit 1; }
+
+pass=0; fail=0
+ok()  { printf '  \342\234\205 %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  \342\235\214 %s\n' "$1"; fail=$((fail+1)); }
+
+echo "capability entry-point shipping check"
+
+command -v node >/dev/null 2>&1 || {
+  echo "  INSTRUMENT ERROR: node unavailable — files[] cannot be read. NOT a pass."; exit 1; }
+
+# Discover entry points by convention. A DISCOVERY of zero is an instrument failure, not a clean
+# result: this check exists precisely because the surface it guards is invisible to reference
+# walking, so "found nothing to check" must never render as "everything ships".
+ENTRIES=$(find scripts -maxdepth 1 -type f -name '*_capability.sh' 2>/dev/null | sort)
+n=$(printf '%s\n' "$ENTRIES" | grep -c . || true)
+n=$(( ${n:-0} + 0 ))
+if [ "$n" -eq 0 ]; then
+  echo "  INSTRUMENT ERROR: zero *_capability.sh files discovered — the scan did not reach its target."
+  echo "  (A real zero is possible only if this repo has no typed capabilities; verify by hand before believing it.)"
+  exit 1
+fi
+
+FILES_JSON=$(node -e 'process.stdout.write(JSON.stringify(require("./package.json").files||[]))' 2>/dev/null) || {
+  echo "  INSTRUMENT ERROR: could not read package.json files[]"; exit 1; }
+
+printf '%s\n' "$ENTRIES" | while IFS= read -r e; do
+  [ -n "$e" ] || continue
+  if node -e 'const f=JSON.parse(process.argv[1]);process.exit(f.includes(process.argv[2])?0:1)' "$FILES_JSON" "$e"; then
+    echo "  ok $e"
+  else
+    echo "  MISSING $e"
+  fi
+done > "${TMPDIR:-/tmp}/cap_entry_$$.txt"
+
+missing=$(grep -c '^  MISSING ' "${TMPDIR:-/tmp}/cap_entry_$$.txt" || true)
+missing=$(( ${missing:-0} + 0 ))
+shipped=$(grep -c '^  ok ' "${TMPDIR:-/tmp}/cap_entry_$$.txt" || true)
+shipped=$(( ${shipped:-0} + 0 ))
+cat "${TMPDIR:-/tmp}/cap_entry_$$.txt"
+rm -f "${TMPDIR:-/tmp}/cap_entry_$$.txt"
+
+if [ "$missing" -eq 0 ]; then
+  ok "all $shipped capability entry point(s) are in package.json files[]"
+else
+  bad "$missing capability entry point(s) absent from files[] — npm consumers get the validator without the capability"
+fi
+
+# REVERSE DIRECTION (added 2026-08-12 after a cross-family round broke the first version).
+# The check above walks disk → files[]. That direction alone is blind to the failure that actually
+# loses a capability: MOVE OR DELETE the entry-point file. Discovery then simply does not see it,
+# every remaining entry is still listed, and the lane goes green while `npm pack` ships one fewer
+# capability. So also walk files[] → disk: anything declared as a capability entry point must exist.
+# (A capability removed from BOTH sides is an intentional deletion and correctly flags nothing.)
+DECLARED=$(node -e '
+  const f=JSON.parse(process.argv[1]);
+  process.stdout.write(f.filter(p=>/^scripts\/.*_capability\.sh$/.test(p)).join("\n"));
+' "$FILES_JSON")
+dangling=0
+if [ -n "$DECLARED" ]; then
+  while IFS= read -r d; do
+    [ -n "$d" ] || continue
+    # `-f` alone is not enough, and both gaps were demonstrated (round 5): a SYMLINK satisfies `-f`
+    # but `npm pack` does not follow it — the tarball simply omits the file — and a ZERO-BYTE file
+    # satisfies every existence test while shipping an empty capability. Existence is the weakest
+    # of the three properties; assert all of them.
+    if [ ! -e "$d" ]; then
+      echo "  DANGLING $d (declared in files[], absent on disk)"; dangling=$((dangling+1))
+    elif [ -L "$d" ]; then
+      echo "  SYMLINK $d (npm pack does not follow symlinks — the tarball would omit it)"; dangling=$((dangling+1))
+    elif [ ! -f "$d" ]; then
+      # A DIRECTORY passes -e, is not a symlink, and `-s` reports non-zero size for it — so the
+      # three tests above all agreed a directory was a fine entry point (round 6). Regular-file-ness
+      # is the property actually being claimed; assert it rather than three proxies for it.
+      echo "  NOT-A-FILE $d (declared as an entry point but is not a regular file)"; dangling=$((dangling+1))
+    elif [ ! -s "$d" ]; then
+      echo "  EMPTY $d (zero bytes — ships an entry point that cannot run)"; dangling=$((dangling+1))
+    fi
+  done <<EOF
+$DECLARED
+EOF
+fi
+declared_n=$(printf '%s\n' "$DECLARED" | grep -c . || true); declared_n=$(( ${declared_n:-0} + 0 ))
+if [ "$declared_n" -eq 0 ]; then
+  bad "files[] declares ZERO capability entry points — either the convention changed or the list was gutted; a disk-only check cannot notice that"
+elif [ "$dangling" -eq 0 ]; then
+  ok "all $declared_n declared capability entry point(s) exist on disk (move/delete would be caught)"
+else
+  bad "$dangling declared capability entry point(s) missing from disk — npm would ship a broken files[] and the disk-side check alone stays green"
+fi
+
+# CONTROL — the check must be able to say NO. A checker that only ever prints ok is indistinguishable
+# from a checker that is not looking; assert the negative arm on a name that cannot be in files[].
+if node -e 'const f=JSON.parse(process.argv[1]);process.exit(f.includes(process.argv[2])?0:1)' \
+     "$FILES_JSON" "scripts/definitely_not_shipped_$$.sh"; then
+  bad "CONTROL DEAD — a nonexistent path reported as shipped; the membership test is not testing"
+else
+  ok "control alive — a nonexistent path is correctly reported as not shipped"
+fi
+
+echo "----"
+echo "capability entry-point shipping: $pass passed, $fail failed (entries=$n, missing=$missing)"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_count_check_readme_format_lanes.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# test_count_check_readme_format_lanes.sh — known-pair anchor for the README format override guard
+# in `scripts/count_check.sh`.
+#
+# WHY THIS EXISTS
+# `count_check.sh` is a **mandatory-pass** gate wired into selfcheck → prepublishOnly, pre-commit
+# and CI. Its README check renders a caller-supplied printf template and uses the RESULT as a
+# `grep -qE` pattern. Two ways that goes wrong, both measured 2026-08-12:
+#   · a template rendering a NEWLINE turns the pattern into an OR search — a stale README (99/99)
+#     PASSED because the trailing fragment "8" matched "Node 18" elsewhere in the file;
+#   · `printf` failure and value-swallowing directives (`%.0s`) produced partial patterns, unchecked.
+# The guard that closes this shipped with **zero** anchors in the same commit that added four
+# anchors for a sibling fix — the exact "you can delete the feature and stay green" class that
+# commit was closing. This file is that missing half.
+#
+# SCOPE, stated honestly: these lanes exercise the guard's DECISION LOGIC in isolation (render →
+# inspect → accept/reject), not the whole count_check run. The full script needs a git worktree
+# with a populated plugin tree; a fixture that lacks one fails for an unrelated reason ("0 active
+# fh-meta skills") and every arm goes red for the SAME wrong cause — which is how a first attempt
+# at this test nearly certified a guard that had not been exercised at all.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SUBJECT="$REPO_ROOT/scripts/count_check.sh"
+pass=0; fail=0
+ok()  { printf '  \342\234\205 %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  \342\235\214 %s\n' "$1"; fail=$((fail+1)); }
+
+# The guard block is extracted from the subject rather than restated here: a copy drifts from the
+# thing it claims to verify, which is the divergent-normalizer defect this repo has hit before.
+GUARD=$(awk '/^  README_STR=\$\(printf/,/^  \[ -n "\$README_STR" \] && count_check/' "$SUBJECT")
+if [ -z "$GUARD" ]; then
+  bad "guard block not found in count_check.sh — the anchor cannot verify what it cannot locate"
+  echo "----"; echo "count_check README-format lanes: $pass passed, $fail failed"; exit 1
+fi
+
+probe() {   # $1 = template ; echoes rc + a reason token
+  local fmt="$1"
+  bash -c '
+    set -uo pipefail
+    total_sk=40; total_ag=8; fail=0
+    README_FMT="$1"
+    count_check() { echo "ACCEPTED:$3"; }
+    '"$GUARD"'
+    exit $fail
+  ' _ "$fmt" 2>&1
+  return $?
+}
+
+run() {   # $1 = label ; $2 = template ; $3 = expect (accept|reject)
+  local out rc; out=$(probe "$2"); rc=$?
+  case "$3" in
+    accept) if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q 'ACCEPTED:'; then
+              ok "$1 — accepted (no over-block)"
+            else bad "$1 — legitimate template was REJECTED (rc=$rc): $out"; fi ;;
+    reject) if [ "$rc" -ne 0 ]; then ok "$1 — rejected (rc=$rc)"
+            else bad "$1 — a broken template PASSED the gate: $out"; fi ;;
+  esac
+}
+
+echo "== count_check README format override — known pair =="
+# Accept arms. Two of them on purpose: the default and a localized one. The whole point of the
+# override is downstream harnesses writing their own wording, so an English-only accept arm would
+# not notice a guard that rejects every non-ASCII template.
+run "A1 default English"      '%s skills · %s agents'   accept
+run "A2 localized (Korean)"   '스킬 %s개 · 에이전트 %s개'  accept
+run "A3 markdown decoration"  '**%s** skills / **%s** agents' accept
+# Reject arms — each must fail for its OWN reason, not a shared incidental one.
+run "R1 renders a newline"    '%s
+%s'                                                     reject
+run "R2 swallows a value"     '%.0s%s agents'           reject
+
+echo "----"
+echo "count_check README-format lanes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1