@chrono-meta/fh-gate 1.4.95 → 1.4.97

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -222,13 +222,23 @@ echo "CC_HUB_DIR=${CC_HUB_DIR:-not set}"
 basename "$(pwd)"
 ls .claude/ 2>/dev/null
 
-# CC settings (handle both dict and list for plugins)
-cat .claude/settings.json 2>/dev/null | python3 -c "
-import json,sys
-d=json.load(sys.stdin)
-p=d.get('plugins',{})
-print('plugins:', list(p.keys()) if isinstance(p,dict) else p)
-" 2>/dev/null || echo "settings.json not found"
+# CC settings (handle both dict and list for plugins).
+# Split existence from parseability FIRST. The old `cat file | python3 … || echo "not found"` read
+# $? from python, so a CORRUPT settings.json printed "settings.json not found" — the wizard would
+# then happily create a fresh one and silently clobber the user's real (broken) config.
+if [ ! -f .claude/settings.json ]; then
+  echo "settings.json: ABSENT"
+else
+  python3 - <<'PY' || echo "settings.json: UNPARSEABLE (present but unreadable — NOT the same as absent; do NOT overwrite, ask the user)"
+import json, sys
+try:
+    d = json.load(open('.claude/settings.json'))
+except Exception as e:
+    print(f'  parse error: {e}', file=sys.stderr); sys.exit(2)
+p = d.get('plugins', {})
+print('settings.json: OK — plugins:', list(p.keys()) if isinstance(p, dict) else p)
+PY
+fi
 
 # MCP plugin connection status
 python3 -c "import json,os; d=json.load(open(os.path.expanduser('~/.claude.json'))); print('MCP:', list(d.get('mcpServers',{}).keys()))" 2>/dev/null || echo "MCP config not found"
@@ -319,9 +329,18 @@ Reduction targets are only meta operation rules (PR procedures, commit guides, F
 **Detection bash:**
 
 ```bash
-# Detect existing harness scale
-CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || echo 0)
-RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || echo 0)
+# Detect existing harness scale.
+# `| wc -l || echo 0` is a conditional disarm, not a harmless idiom: with `set -o pipefail` active
+# (which the caller's shell may well have) a failing upstream stage makes the pipeline exit non-zero
+# AFTER wc has already printed its count, so the fallback appends a SECOND line, the value becomes
+# "0\n0", and the `-ge 3` test below dies with "integer expression expected" — on stderr only —
+# leaving the guard silent. Measured both directions 2026-08-12: single line without pipefail,
+# two lines with it. Sanitize instead of falling back.
+CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || true)
+RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || true)
+# head -n1 FIRST, then strip: `tr -dc '0-9'` alone would fuse a two-line "12\n0" into "120".
+CLAUDE_MD_LINES=$(printf '%s\n' "$CLAUDE_MD_LINES" | head -n1 | tr -dc '0-9'); CLAUDE_MD_LINES=${CLAUDE_MD_LINES:-0}
+RULES_COUNT=$(printf '%s\n' "$RULES_COUNT" | head -n1 | tr -dc '0-9');         RULES_COUNT=${RULES_COUNT:-0}
 
 echo "CLAUDE.md: ${CLAUDE_MD_LINES} lines"
 echo ".claude/rules/: ${RULES_COUNT} files"
@@ -493,6 +512,15 @@ propose adding rows to `agent-composer/SKILL.md` Step 1 mapping table in this fo
 | {skill name} related task | {skill name} (S) | — |
 ```
 
+> **Verify this block against a temp file, never against `~/.zshrc`.** Set `ZSHRC_TARGET` to a
+> scratch path and run the five arms: FH_DIR unset → rc=1, nothing written · CC_HUB_DIR unset →
+> rc=1, nothing written · `$FH_DIR` without the script → ABORT, nothing written · consent absent →
+> SKIPPED, nothing written · consent Y with both vars → block appended with values **substituted**
+> and `$HOME`/`$FH_DIR` left literal, then `zsh -c 'source <temp>'` exits 0. Re-running must not
+> duplicate the block. **Beware a contaminated control**: if your own shell already exports
+> `FH_DIR`, the "unset" arm is not actually negative — isolate with `env -u FH_DIR`. That mistake
+> made the first pass of this very verification report a false PASS.
+
 Output preview before execution:
 ```
 ▶ agent-composer mapping update
@@ -507,18 +535,37 @@ Output preview before execution:
 
 ```bash
 # zshrc hook — preview then confirm. The wizard is AI-mediated: SHOW the user the exact block
-# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append. An earlier
-# revision's comment promised preview-then-confirm while the bash appended unconditionally —
-# the decline-integrity sim (2026-08-10) caught the mismatch; the gate is the instruction, the
-# bash below runs ONLY on Y.
-if ! grep -q "fh_audit_check.zsh" ~/.zshrc 2>/dev/null; then
-  # (run only after an explicit in-chat Y)
-  cat >> ~/.zshrc << 'EOF'
-export FH_DIR="{FH_DIR}"
-export CC_HUB_DIR="{CC_HUB_DIR}"
-export CC_SENTINELS_DIR="$HOME/.cc_sentinels"
-source "$FH_DIR/templates/fh_audit_check.zsh"
+# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append.
+#
+# TWO defects were fixed here (2026-08-12), both of which corrupt every future shell:
+#  (1) The heredoc was QUOTED (<< 'EOF'), so the literal text `{FH_DIR}` was written to ~/.zshrc.
+#      The resulting `source "$FH_DIR/templates/fh_audit_check.zsh"` then resolved to
+#      `{FH_DIR}/templates/...` and every subsequent shell start failed with
+#      `no such file or directory` (rc=127, reproduced in a sandbox against a temp file).
+#      Fix: unquoted heredoc so FH_DIR/CC_HUB_DIR expand AT WRITE TIME, with `\$HOME` and
+#      `\$FH_DIR` escaped so THOSE stay literal and resolve at shell-start.
+#  (2) The consent gate was a COMMENT ("run only after an explicit in-chat Y"). A comment does
+#      not gate anything — pasted or scripted, the block appended unconditionally. It is now a
+#      real conditional on FH_WIZARD_ZSHRC_CONSENT, default N (fail-closed).
+#
+# Set FH_WIZARD_ZSHRC_CONSENT=Y only after the user answers Y in chat.
+ZSHRC="${ZSHRC_TARGET:-$HOME/.zshrc}"
+: "${FH_DIR:?FH_DIR is unset — refusing to write a broken source line into $ZSHRC}"
+: "${CC_HUB_DIR:?CC_HUB_DIR is unset — refusing to write an incomplete block into $ZSHRC}"
+if [ ! -f "$FH_DIR/templates/fh_audit_check.zsh" ]; then
+  echo "ABORT: \$FH_DIR/templates/fh_audit_check.zsh does not exist — would wire a dead source line"
+elif [ "${FH_WIZARD_ZSHRC_CONSENT:-N}" != "Y" ]; then
+  echo "zshrc hook: SKIPPED (no explicit Y) — nothing written"
+elif grep -q "fh_audit_check.zsh" "$ZSHRC" 2>/dev/null; then
+  echo "zshrc hook: already present — no change"
+else
+  cat >> "$ZSHRC" <<EOF
+export FH_DIR="$FH_DIR"
+export CC_HUB_DIR="$CC_HUB_DIR"
+export CC_SENTINELS_DIR="\$HOME/.cc_sentinels"
+source "\$FH_DIR/templates/fh_audit_check.zsh"
 EOF
+  echo "zshrc hook: appended"
 fi
 # On N: do NOT append; record the decline and state its consequence in one line —
 #   echo "zshrc_hook" >> "$HOME/.cc_sentinels/{project}_wizard_declined"

package/plugins/fh-meta/skills/memory-hygiene/SKILL.md

@@ -56,15 +56,31 @@ re-verification is possible).
 
 ### Step 1 — Scan memory/*.md
 
+Enumerate **every** root with a per-root state — an absent root and an empty root are different
+facts, and the Step-4 snapshot scope is bound to this enumeration:
+
 ```bash
-ls ~/.claude/projects/*/memory/*.md 2>/dev/null
-# or hub-local:
-ls memory/*.md 2>/dev/null
+for ROOT in "$HOME"/.claude/projects/*/memory "$PWD/memory"; do
+  if [ -d "$ROOT" ]; then
+    n=$(ls "$ROOT"/*.md 2>/dev/null | wc -l | tr -d ' ')
+    echo "EXISTS(n=$n) $ROOT"
+  else
+    echo "ABSENT       $ROOT"
+  fi
+done
 ```
 
+**`ABSENT` is never counted as 0 entries.** Swallowing both into `2>/dev/null` makes "this root does
+not exist here" indistinguishable from "this root is empty" — and the snapshot in Constraints below
+must cover every root reported `EXISTS`, so a root mis-rendered as empty silently narrows the
+snapshot scope.
+
 For each file, extract:
 - `metadata.type` from frontmatter
-- `date:` or any date-like field in frontmatter or body
+- **Age source, in this order** (measured over the live corpus, n=267): `metadata.modified`
+  (ISO8601, present on 77/267) → else the file's filesystem mtime → else **`AGE-UNKNOWN`**.
+  There is **no top-level `date:` field in this corpus** (measured 0/267) — do not look for one,
+  and never treat `AGE-UNKNOWN` as fresh.
 - Key factual claims (GitHub URLs, status strings, version numbers, dates)
 
 ### Step 2 — Classify by Staleness
@@ -89,7 +105,9 @@ For each stale entry, run the appropriate re-verification:
 **Reference type** (URLs, DOIs, GitHub):
 - Use `gh api` for GitHub resources
 - Use `WebFetch` for DOIs and arXiv records
-- Mark `verified_at: YYYY-MM-DD` in frontmatter if still valid
+- Mark `metadata.verified_at: YYYY-MM-DD` — **nested under `metadata:`**, the layer this corpus
+  actually uses (`metadata:` present on 265/267; a top-level `verified_at` measured 0/267 and would
+  be invisible to the Step-1 extractor)
 - Flag `⚠ DRIFTED` if content has changed materially
 
 **Project type** (status, milestones):
@@ -121,19 +139,47 @@ Apply updates? [y / N per item]
 
 ### Step 5 — Record Run
 
+Use `printf`, never `echo "…\n…"` — `echo` expands `\n` in zsh but writes it **literally** in bash
+(measured: 6 lines vs 1), which silently produces a one-line file with a broken frontmatter.
+
 ```bash
-# Create hygiene log
-echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n---" \
-  > tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md
+mkdir -p tracks/_meta
+printf '%s\n' \
+  '---' \
+  "date: $(date +%Y-%m-%d)" \
+  "entries_checked: ${ENTRIES_CHECKED}" \
+  "demoted_to_archive: ${DEMOTED}" \
+  "orphans_indexed: ${ORPHANS}" \
+  "merged: ${MERGED}" \
+  "drifted: ${DRIFTED}" \
+  "hard_deleted: ${HARD_DELETED}" \
+  '---' \
+  > "tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md"
 ```
 
+**Every count is a measured value from Steps 1–4.** A log still containing a literal `N` (or an
+unexpanded `${…}`) is **an invalid log** — treat that run as not-recorded, because the log's
+existence is what arms the 7-day cadence guard, so a placeholder log suppresses the *next* real run.
+
 ## Constraints
 
 - **No auto-deletion**: Archive candidates are proposed, not deleted. Human confirmation required.
 - **Snapshot before archive (Destructive-Op Gate for memory)**: before applying any confirmed
   archive/removal in Step 4, snapshot **every memory root the entry could live in** first — tar **all**
   roots Step 1 enumerated (`~/.claude/projects/*/memory/` AND hub-local `memory/`), not just one:
-  `tar czf tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz <each Step-1 root that exists>` — so
+  the snapshot **must be gated on its own exit status** — an unwritable or missing `tracks/_meta`
+  makes `tar` exit 1 and produce no tarball (measured), and without a gate the irreversible archive
+  proceeds anyway:
+
+  ```bash
+  SNAP="tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz"
+  mkdir -p tracks/_meta || { echo "SNAPSHOT FAILED (mkdir) — abort archive"; exit 1; }
+  tar czf "$SNAP" <each Step-1 root reported EXISTS> || { echo "SNAPSHOT FAILED (tar) — abort archive"; exit 1; }
+  [ -s "$SNAP" ] || { echo "SNAPSHOT FAILED (empty tarball) — abort archive"; exit 1; }
+  echo "SNAPSHOT OK: $SNAP"
+  ```
+
+  Only on `SNAPSHOT OK` may the archive proceed — so
   a wrong archive in any scanned root is one-command recoverable (a single-root snapshot can pass while
   the archived entry lived in the other root — bind the scope to the entry, not to "a tarball exists").
   Archive moves entries to a `.archive/` sibling, never hard-deletes (mirrors the Curator's
@@ -147,14 +193,15 @@ echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n
 
 ## Done When
 
-```
-Step 1~5 complete
-+ Staleness roster output (Step 2 = mechanical no-LLM pre-pass)
-+ Re-verification run for all STALE entries
-+ User gate presented and responded to (y/N per item)
-+ If any archive confirmed: snapshot covering the archived entry's root written before the move (tracks/_meta/memory_snapshot_*.tgz, spanning all existing Step-1 roots) — check class: mandatory-pass (snapshot covers the entry's dir, not merely "a tarball exists")
-+ Hygiene log written to tracks/_meta/memory_hygiene_{date}.md
-```
+| Condition | Check class |
+|---|---|
+| Step 1~5 complete, every memory root reported `EXISTS(n=…)` or `ABSENT` | **mandatory-pass** |
+| Staleness roster output (Step 2 = mechanical no-LLM pre-pass), with `AGE-UNKNOWN` entries listed separately and not as FRESH | **measured** (age from `metadata.modified` / mtime, not recall) |
+| Re-verification run for all STALE entries | **mandatory-pass** |
+| Each re-verified entry's verdict (VERIFIED / DRIFTED) is correct | **judged** — adversarial pairing: `fh-meta:fact-checker` re-greps the hub for the same claim; any disagreement downgrades the entry to DRIFTED (no judge-only PASS) |
+| User gate presented and responded to (y/N per item) | **mandatory-pass** |
+| If any archive confirmed: snapshot written **and its exit status checked** before the move (`tracks/_meta/memory_snapshot_*.tgz`, spanning every root reported `EXISTS`) | **mandatory-pass** — snapshot must cover the archived entry's dir; `SNAPSHOT OK` printed, not merely "a tarball exists" |
+| Hygiene log written to `tracks/_meta/memory_hygiene_{date}.md` with real counts (no literal `N`, no unexpanded `${…}`) | **measured** |
 
 ## References
 

package/plugins/fh-meta/skills/meta-prompt-builder/SKILL.md

@@ -153,11 +153,45 @@ Acceptable form examples:
 
 ## Done When
 
+This skill's own Done When must satisfy the 3-part completeness check it imposes on others
+(**measurement subject · measurement timing · version/baseline**). The previous version —
+`All steps 0–3 completed` — met 0 of 3 and matched its own `Unconditioned completion` WARN pattern.
+
 ```
-All steps 0–3 completed
-+ Per-agent prompt drafts output per Wave (Goal/Context/Constraints/Done When 4-field included)
-+ Step 3 quality self-validation complete ([WARN] items delegated to user if present)
-+ Generated prompts awaiting user review
+Measurement subject: this skill's own output — the prompt draft set
+                     produced in this invocation (not the dispatched
+                     agents' results, which this skill never sees)
+Measurement timing:  absolute, at end of this run — no comparison to a
+                     previous run is implied or required
+Version / baseline:  the Step 3 checklist and the WARN-trigger table in
+                     THIS file; note the SKILL.md revision used if the
+                     table has changed since the draft was written
+
+☐ Steps 0–3 each produced their named artifact — a step with no
+  artifact is incomplete, not "completed"                        (measured: 4 steps, 4 artifacts)
+☐ One prompt draft exists per agent named in the dispatch plan   (measured: drafts == agents
+                                                                  in plan)
+☐ Every draft carries all four fields (Goal / Context /
+  Constraints / Done When), none empty                           (measured: 4 fields × N drafts,
+                                                                  0 empty)
+☐ Each draft's own Done When was run through the 3-part
+  completeness check and the WARN-trigger table, with the
+  result recorded per draft                                      (mandatory-pass)
+☐ Every Goal was checked against the target agent's declared
+  allowed-tools by READING that agent's SKILL.md — not from
+  recall                                                          (mandatory-pass)
+☐ [WARN] items are surfaced to the user with the reason, and
+  the decision is the user's                                     (mandatory-pass)
+☐ Drafts are handed over for review, not dispatched              (mandatory-pass)
+☐ The drafts are usable by the target agent as written           (judged — adversarial pairing:
+                                                                  generator and validator are the
+                                                                  same model, so self-validation
+                                                                  repeats its own bias. Have the
+                                                                  target agent, or a different
+                                                                  model, read one draft cold and
+                                                                  state what it would do; a
+                                                                  divergence from the intended
+                                                                  task is a FAIL)
 ```
 
 ## Simplification Guard

package/plugins/fh-meta/skills/persona-roster-expander/SKILL.md

@@ -2,7 +2,7 @@
 name: persona-roster-expander
 description: Expands a named persona seed into a tiered, judgment-mapped cast — tiering each persona by a domain safety rule, mapping each to a decision-lens in the user's vocabulary, then proposing additional voices with sourced anchors.
 user-invocable: true
-allowed-tools: ["Read", "Grep", "WebSearch", "WebFetch"]
+allowed-tools: ["Read", "Grep", "WebSearch", "WebFetch", "Write", "Agent"]
 model: sonnet
 ---
 
@@ -15,7 +15,12 @@ caller-supplied safety rule so the expansion stays faithful to the domain's cons
 
 > Origin: harvested from the-bible (2026-06-20) — an operator persona seed (priest/nun/angel/devil/
 > God/Jesus/Holy-Spirit/apostles) tiered relay-vs-lens by a relay-safety rule and mapped to
-> engineering-judgment lenses, +4 sourced proposals. See
+> engineering-judgment lenses, +4 sourced proposals. **The grounds, inline, because the harvest
+> record does not ship**: an ungated persona cast drifts into inventing its own authority — a voice
+> given a lens will speak past what the domain lets it assert — so tiering by a *caller-supplied*
+> rule is what keeps the expansion faithful, and the lens mapping is what makes a named voice
+> usable as a decision instrument instead of flavor. Full harvest record — **hub-local, not
+> distributed in the npm package**:
 > `tracks/_contrib/field_harvest_2026-06-20_gate-locality-and-grounding-capabilities.md`.
 
 ## Triggers
@@ -41,14 +46,17 @@ caller-supplied safety rule so the expansion stays faithful to the domain's cons
 4. **Propose 2–4 additions** filling lenses the seed doesn't cover (delegate net-new *name*
    generation to the `persona-innovator` agent — this skill's distinct value is the tiering +
    lens-mapping, not naming). For the strongest 2–3, find a real anchor (a sourced
-   example/reference), not a shallow stub.
-5. **Emit the tiered, lens-mapped cast** (named + proposed) as a structured artifact the system can
-   load (e.g. `personas.json`).
+   example/reference); **any remaining proposal ships with a literal `stub:` prefix** — unanchored
+   and unlabeled is not an allowed output (see Done When).
+5. **Emit the tiered, lens-mapped cast** (named + proposed) by **writing it to a structured file**
+   the system can load (e.g. `personas.json`), then confirm the written file parses. Leaving the
+   cast in the response text only does not complete this step.
 
 ## Done When
 - **Every persona has a tier + lens label + invoke-condition.** *Check class: mandatory-pass (binary — all three fields present per persona).*
-- **Each net-new proposal names a real anchor** (not a stub). *Check class: judged, pair: an anchor-existence check (the cited source/reference resolves).*
-- **The tiering respects the caller's safety rule** (no persona exceeds its tier's allowed emission). *Check class: judged, pair: an adversarial read — find a persona whose mapping lets it act beyond its tier.*
+- **Every proposal is either anchored or explicitly labeled a stub.** An anchored proposal names a source/reference that resolves; a proposal without one is emitted with a literal `stub:` prefix and is **not counted as a candidate**. *Check class: mandatory-pass (binary — each proposal carries either a resolving anchor or a `stub:` label; an unanchored, unlabeled proposal is FAIL). Anchor resolution is checked mechanically (fetch/look up the cited reference), not by judgment.* (This is the Done-When floor; Step 4's "strongest 2–3" is the effort target that sits above it — a 4th proposal may ship as `stub:` without violating either.)
+- **The cast is materialized as a loadable artifact** (e.g. `personas.json`) that a consumer can parse — the file exists on disk and a parse of it succeeds against the declared schema (per persona: tier / lens / invoke-condition; per proposal additionally `anchor` or `stub:`). *Check class: mandatory-pass (binary — file exists and parses; a cast that exists only in the response text is UNMET).*
+- **The tiering respects the caller's safety rule** (no persona exceeds its tier's allowed emission). *Check class: judged, pair: dispatch `fh-meta:challenger` at the tier-escalation angle — "find a persona whose lens mapping lets it emit beyond its tier". The pairing is a **different-agent** read; the author's own re-read does not satisfy it. If that agent is unreachable, record `pair: unavailable (<reason>)` — the condition stays UNMET and is **reported as a named residual**, never self-scored closed. It does **not** block delivery: a roster is a reversible artifact, so the degrade direction here is declare-and-ship, not fail-closed (that direction is reserved for irreversible surfaces — publish, delete, history-rewrite). Shipping with an UNMET pairing is honest; silently marking it met is the defect.*
 
 ## Guards
 - **Caller-supplied safety rule is mandatory** — the skill tiers by the domain's rule, it does not

package/plugins/fh-meta/skills/plugin-recommender/SKILL.md

@@ -2,7 +2,7 @@
 name: plugin-recommender
 description: Given a task description, searches internal and external open-source ecosystems (including Codex marketplace and Claude Code marketplace) to find and recommend suitable plugins with installation guidance. Recommendation is quality-validation based (marketplace-listed + performance-validated), not source-origin based. Activates on "recommend a plugin", "what tool should I use?", "is there a plugin for this?", "recommend a tool". Also checks for duplicate installations.
 user-invocable: true
-allowed-tools: ["Grep", "GoogleWebSearch", "Bash"]
+allowed-tools: ["Read", "Grep", "Bash", "WebSearch", "WebFetch"]
 model: sonnet
 ---
 
@@ -59,7 +59,9 @@ Tier is **independent of platform origin** (Anthropic / OpenAI / community). A w
 
 2. **[Priority 1.5] Internal GHE Sister Assets (partially completed work — Tier 2)**: Check if user's task domain already exists in internal sister asset clusters. Prioritize direct use or adoption of sister assets if the user's task falls within these cluster domains.
 
-3. **[Priority 2.5] Project Reference/Contribution Path**:
+3. **[Priority 2] Organization's Internal GHE (Tier 1–4)**: Search internal GHE with keywords like `claude-plugin`, `gemini-plugin` + user keywords / API search. Replace with your organization's internal GHE orgs.
+
+4. **[Priority 2.5] Project Reference/Contribution Path**:
 
     For cases where referencing or contributing to the project itself is more appropriate than installing a plugin. Provide guidance when there's intent for medium-term contribution rather than immediate use.
 
@@ -71,9 +73,7 @@ Tier is **independent of platform origin** (Anthropic / OpenAI / community). A w
     - `plugin-recommender` [Priority 2.5]: When no immediately usable plugin is available → guide to project-level reference/contribution path (alternative to installing)
     - `cross-ecosystem-synergy-detection`: Discover hidden synergies among already-installed skills (post-install utilization optimization)
 
-    Activation condition: Automatically entered when Step 2 [Priority 1]~[Priority 2] search yields no suitable plugin.
-
-4. **[Priority 2] Organization's Internal GHE (Tier 1–4)**: Search internal GHE with keywords like `claude-plugin`, `gemini-plugin` + user keywords / API search. Replace with your organization's internal GHE orgs.
+    Activation condition: Automatically entered when Step 2 [Priority 1]~[Priority 2] search yields no suitable plugin. **This block therefore runs only after [Priority 2] has actually been executed** — the list above is in execution order (1 → 1.5 → 2 → 2.5 → 3), and the priority labels are names, not the run sequence.
 
 5. **[Priority 3] External Open-Source Ecosystem**: WebSearch / WebFetch — "best github actions for X", "claude plugin for Y", etc. Simplification guard: defer external install if internal assets suffice.
 
@@ -91,16 +91,18 @@ When queried for a specific capability (e.g., "adversarial reviewer for bash cod
 0. **Platform built-ins (Tier 0)** — does a built-in skill/command already cover the capability? Check the live session's available-skills list before any plugin search. A built-in that covers ~80% beats installing a plugin for the rest
 1. **Installed locally** — `.claude/agents/`, `plugins/` in current cwd
 2. **FH native skills** — always-loaded knowledge in `plugins/fh-meta/` and `plugins/fh-commons/`
-3. **Claude Code marketplace** — `claude mcp search [capability]` or known CC registry (see verified targets above)
-4. **Codex marketplace** — `npx @openai/codex list-agents [capability]` or known Codex registry
+3. **Claude Code marketplace** — `claude plugin list --available --json` (marketplace plugins; `--available` **requires** `--json`) + `claude plugin marketplace list` to see which marketplaces are even configured. There is **no** CLI keyword-search subcommand — filter the JSON yourself, and fall back to the known CC registry (see verified targets above) for anything not in a configured marketplace
+4. **Codex marketplace** — `npx --yes @openai/codex plugin list --available --json` (optionally `-m <marketplace>`) + `npx --yes @openai/codex plugin marketplace list`. Same limitation: no keyword search, filter the JSON
 5. **npm ecosystem** — `@chrono-meta/`, `@anthropic/`, and other known-quality scoped packages
 
+⚠️ **A failed or empty discovery lane is NOT "no candidates".** Both CLIs above list only *configured* marketplaces, and a non-zero exit / empty array means the lane did not answer — not that nothing exists. Report each lane's state explicitly (`EXECUTED` / `EMPTY` / `FAILED: <stderr>`) and never render a `FAILED` lane as a zero result; a lane that could not run must be re-run or replaced by the web-search fallback (Priority 3) before you tell the user nothing was found.
+
 **Discovery priority**: built-in (Tier 0) > installed > FH native > Tier 1 (any platform) > Tier 2 > Tier 3 > Tier 4
 **Tier 0 guard**: FH native wins over a built-in only when the FH skill adds governance the built-in lacks (e.g. `/goal` → `goal-quench` adds budget+quality gates; code diff review stays with built-in `/code-review`, FH-asset coherence with `hub-cc-pr-reviewer`)
 
 **When sim-conductor chains here for persona discovery**: apply the same platform-aware search scoped to persona/simulation/review capability tags. Return discovered agents with their Tier rating so sim-conductor can decide whether to install or use a built-in brief.
 
-For discovery bash commands (`claude mcp search`, `npx @openai/codex list-agents`, npm scoped search), see `SKILL_detail.md §Discovery-Bash`.
+For discovery bash commands (`claude plugin list --available --json`, `npx --yes @openai/codex plugin list --available --json`, npm scoped search), see `SKILL_detail.md §Discovery-Bash`.
 
 ### Step 2.6: Quality Validation Signals
 
@@ -149,7 +151,8 @@ When user selects desired plugin from recommendation list, help with installatio
 ## Constraints
 
 - **Recommendations, not guarantees**: Does not guarantee plugin performance, stability, or security.
-- **Inbound supply-chain risk (Tier 3/4)**: a Tier 3/4 candidate (§Tier Classification Table) has no marketplace vetting — public skill registries have shipped malicious skills at scale (pointers: [HN 47370624](https://news.ycombinator.com/item?id=47370624) — 824 malicious skills reported on ClawHub; [HN 48678603](https://news.ycombinator.com/item?id=48678603) — Snyk ToxicSkills study. Secondary sources — verify before quoting figures). Flag this explicitly to the user before recommending a Tier 3/4 candidate.
+- **Inbound supply-chain risk — EVERY tier, not just 3/4**: public skill registries have shipped malicious skills at scale (pointers: [HN 47370624](https://news.ycombinator.com/item?id=47370624) — 824 malicious skills reported on ClawHub; [HN 48678603](https://news.ycombinator.com/item?id=48678603) — Snyk ToxicSkills study. Secondary sources — verify before quoting figures). ⚠️ **The channel in both incidents was the marketplace listing itself — i.e. Tier 1/2.** An earlier version of this bullet scoped the warning to Tier 3/4, which inverted its own evidence: it warned loudest exactly where vetting exists and stayed silent where the cited attacks landed. Flag the risk before recommending **any** candidate; a high Tier means *listed and maintained*, never *audited for intent*.
+- **Install string must be resolved, not relayed**: the `<name>` in an install command frequently comes from a web-search result. Before surfacing it, confirm the name resolves to the intended repository (owner/repo matches the source you are citing) — a plausible near-name is the cheapest form of this attack, and installation is irreversible on the machine that runs it.
 - **User consent required**: Does not auto-install without explicit consent.
 - **Search scope limitations**: Only searches within configured search space.
 
@@ -213,9 +216,34 @@ sim-conductor needs persona X (no installed/built-in match)
 
 ```
 All Steps 0~5 completed
-+ Recommendation list table output (top 2~3 items, Tier + Platform + synergy grade included)
-+ Install completed after user selection (or install skipped / 5-B migration path guided)
+  — mandatory-pass: each step produced its stated output, or is
+    explicitly marked N/A with the reason
+
++ Recommendation list table output (top 2~3 items, Tier + Platform + synergy
+  grade included)
+  — mandatory-pass: the table exists with all three columns populated
+
++ Every discovery lane reported with an explicit state
+  (EXECUTED / EMPTY / FAILED: <stderr>)
+  — measured: count lanes attempted vs lanes reporting a state; the two
+    numbers must match. A FAILED lane rendered as "no candidates" is a FAIL
+    of this condition, not a pass — the CLI lanes have no keyword search and
+    see only configured marketplaces, so an empty result is routinely a
+    non-answer rather than an absence (`not found` != `0`)
+
++ Install completed after user selection (or install skipped / 5-B migration
+  path guided)
+  — mandatory-pass: explicit user consent recorded before any install ran
+
 + Duplicate detection results reported
+  — mandatory-pass: `claude plugin list` output consulted in this run
+
++ Every install string surfaced to the user resolves to the repository it is
+  cited from (§Constraints — resolved, not relayed)
+  — judged; adversarial pairing: in the same run, resolve one candidate name
+    you already know is correct AND check one near-name variant. If the
+    procedure cannot separate that pair, the resolution check is
+    UNCALIBRATED and no install string may be presented as verified
 ```
 
 ## Failure Response

package/plugins/fh-meta/skills/plugin-recommender/SKILL_detail.md

@@ -57,16 +57,24 @@ gh auth status  # default host (github.com) only
 # Unauthenticated → guide github.com PAT generation above
 ```
 
-**Claude Code marketplace search:**
+**Claude Code marketplace discovery** (there is **no** `search` subcommand — `claude mcp search` does not
+exist and exits 1 with `unknown command 'search'`; list, then filter yourself):
 ```bash
-claude mcp search [capability-keyword]
+claude plugin marketplace list --json      # which marketplaces are configured at all
+claude plugin list --available --json      # installed + available marketplace plugins (--available REQUIRES --json)
 ```
 
-**Codex marketplace search:**
+**Codex marketplace discovery** (`list-agents` does not exist either — the real noun is `plugin`):
 ```bash
-npx @openai/codex list-agents [capability-keyword]
+npx --yes @openai/codex plugin marketplace list
+npx --yes @openai/codex plugin list --available --json      # add -m <marketplace> to scope
 ```
 
+> **Lane-state reporting (mandatory).** Neither CLI supports a keyword query, and both see only
+> *configured* marketplaces. Record each lane as `EXECUTED` / `EMPTY` / `FAILED: <stderr>` and carry
+> that state into the recommendation. **A `FAILED` lane must never be rendered as "no candidates"** —
+> re-run it or fall back to Priority 3 web search before reporting an empty result.
+
 **npm ecosystem search (scoped packages):**
 ```bash
 npm search @chrono-meta [keyword]
@@ -113,11 +121,20 @@ If either duplicate condition met → skip install → report "Already active"
 #### 5-1 through 5-3. Install Steps
 
 1. Confirm intent: "Would you like to install the `[plugin-name]` plugin?"
-2. On agreement:
+2. On agreement — **the two commands take different arguments**: `marketplace add` takes a *source*
+   (`<owner/repo>`, a URL, or a local path), never a plugin name; only `install` takes the plugin name.
    ```bash
-   claude plugin marketplace add [plugin-name]
-   claude plugin install [plugin-name]
+   # Usage: claude plugin marketplace add [options] SOURCE
+   #   SOURCE = owner/repo, a URL, or a local path — NEVER a plugin name
+   SOURCE="owner/repo"
+   PLUGIN="plugin-name"        # optionally "plugin-name@marketplace" to disambiguate
+
+   claude plugin marketplace add "$SOURCE"
+   # Usage: claude plugin install|i [options] PLUGIN
+   claude plugin install "$PLUGIN"
    ```
+   Skip the `marketplace add` line when the plugin already resolves from a configured marketplace
+   (check `claude plugin marketplace list`).
 3. Post-install initial configuration guidance:
    - **API token input**: Guide token generation path for external service APIs (Jira/Confluence/Slack — specify each service's token page URL + env var or plugin config storage location)
    - **MCP connection**: If plugin uses MCP server, guide auto-update of `.mcp.json` or `claude mcp add` command

package/plugins/fh-meta/skills/prompt-regression/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: prompt-regression
-description: Detects harness regressions by running standard prompt probes after rule/skill changes and comparing outputs against saved baselines. Triggers on "prompt regression", "did my changes break anything", "regression check", "test harness changes".
+description: Statically checks harness assets against a known-answer probe set after rule/skill changes — inspects the changed source for the trigger phrases, chain links and gate conditions each probe expects, and reports PASS/FAIL/SKIP per probe. Source inspection only; it does not run live sessions, so it catches assets that no longer SAY the right thing, not models that stop DOING it. Triggers on "prompt regression", "did my changes break anything", "regression check", "test harness changes".
 user-invocable: true
-allowed-tools: ["Read", "Bash", "Glob", "Grep"]
+allowed-tools: ["Read", "Write", "Bash", "Glob", "Grep"]
 model: sonnet
 complexity_routing:
   base: sonnet
@@ -58,8 +58,15 @@ ls .claude/regression/probes.md 2>/dev/null || echo "NO_CUSTOM_PROBES"
 ```
 
 **If custom probes exist**: load and use them. The hub repo ships its golden probe set
-(known-answer offline eval, 32 probes with check classes) at exactly this path — when
-present it is canonical and supersedes the default matrix below.
+(known-answer offline eval, **33 probes** with check classes — 27 mandatory-pass · 1 measured ·
+5 judged, of which 2 rows are inert deletion anchors, so live coverage is 31) at exactly this path
+— when present it is canonical and supersedes the default matrix below.
+
+> Count from the file, not from this line: `grep -cE '^\| *`[A-Z][A-Z0-9-]*-[0-9]+` *\|'
+> .claude/regression/probes.md`. Both this number and the tally inside `probes.md` read `32` until
+> 2026-08-12, when the actual count was 33 — a probe had been added to section A without touching
+> either summary. A count duplicated in two files rots independently; if the two disagree, the file
+> wins and both get corrected.
 
 **If no custom probes** (e.g. Mode C install without the hub repo): use the default
 probe matrix below.
@@ -93,7 +100,23 @@ If change scope is `CLAUDE.md` core (10+ lines changed): run **full suite** (all
 
 ---
 
-### Step 4. Run Affected Probes
+### Step 4. Evaluate Affected Probes (static source inspection)
+
+**What this step is, stated plainly.** Every check below reads the changed *source* and asks whether
+the text a probe expects is still there. No live session is started, no model is prompted, no output
+is compared against a recorded transcript. The description said "running standard prompt probes …
+comparing outputs against saved baselines", which reads as live execution; the honest label is a
+**known-answer static check**.
+
+**What it therefore cannot catch** — say this in the report, do not leave it implied:
+- a rule that is still present but has stopped *firing* (salience loss, ordering, competition
+  from another rule)
+- a trigger phrase present in the file but shadowed by a higher-priority route
+- any behavior change that leaves the source text identical
+
+Those need a dispatched blind sim at the target tier (`sim-conductor`, or the target-tier sim gate in
+`.claude/rules/fh_4axis_gate.md`). A green report here means *the assets still say the right thing*.
+Treating it as behavioral evidence is the misread this section exists to prevent.
 
 For each affected probe, evaluate:
 
@@ -150,24 +173,44 @@ If all probes pass:
 
 After a deliberate behavior change (not a regression — an intentional improvement), update the baseline:
 
+Prompt user first: *"Probe `G-GATE-03` now expects the new gate format. Update baseline? (y/n)"*
+Only update on explicit `y` — never auto-update.
+
+On `y`, actually perform the write. The previous version of this step was three lines of which two
+were comments — it created the directory and stopped, so "baseline updated" was reported by a step
+that had written nothing.
+
 ```bash
-# Baseline stored as markdown in .claude/regression/
 mkdir -p .claude/regression
-# Write updated probe expectations
 ```
 
-Prompt user: *"Probe P-CHAIN-01 now expects the new gate format. Update baseline? (y/n)"*
+Then **use the `Write` tool** on `.claude/regression/probes.md` (create it from the SKILL.md default
+matrix if absent) to apply the approved edit. Each approved change edits the probe's row in place —
+Expected Behavior, Scope, and Class — and:
 
-Only update on explicit `y` — never auto-update.
+- update the `**Count**:` tally line **in the same edit** if a row was added or removed, including
+  the per-section breakdown and the class counts (a stale tally is exactly how the `32`/`33`
+  mismatch was introduced)
+- append a one-line note under `**Baseline**:` recording the date and the reason for the change
+- never rewrite rows the user did not approve
+
+Confirm afterwards by re-reading the file and reporting the row's new content plus the recount —
+`grep -cE '^\| *`[A-Z][A-Z0-9-]*-[0-9]+` *\|' .claude/regression/probes.md`. Do not report a
+baseline update whose result you have not read back.
 
 ---
 
 ## Done When
 
-- All affected probes are evaluated (PASS / FAIL / SKIP) — class: mandatory-pass
+- All affected probes are evaluated (PASS / FAIL / SKIP) and the three counts sum to the number of
+  probes selected in Step 3 — class: measured (`PASS + FAIL + SKIP == selected`)
 - Regression report is output with clear PASS/FAIL verdict — class: mandatory-pass
+- The report states its own scope: **static source inspection, no live session run** — a green
+  verdict is never presented as behavioral evidence — class: mandatory-pass
 - If FAIL: specific file + line fix is recommended — class: judged, paired with verify-bidirectional (the fix recommendation is re-checked, not trusted as-is)
-- Baseline updated only on explicit user approval — class: mandatory-pass (HITL)
+- Baseline updated only on explicit user approval, and the written file is **read back** and its
+  probe count reported — class: mandatory-pass (HITL). Approval alone does not close this: a step
+  that prompts, gets `y`, and writes nothing satisfied the old wording.
 
 ---