@chrono-meta/fh-gate 1.4.97 → 1.4.98

package/scripts/frontier_digest_autopilot.sh

@@ -0,0 +1,229 @@
+#!/bin/bash
+# frontier_digest_autopilot.sh — daily digest + autonomous improvement pipeline, PR-only.
+#
+# WHY: frontier-digest itself has run unattended (launchd) since 2026-06 — collecting signal
+# needs no approval. Turning a signal into an actual FH change was, until now, always a session
+# the operator had to start by hand. Operator decision (2026-08-15): push automation one stage
+# further — digest → persona-innovator → harvest-loop → 4-axis gate → PR, entirely unattended —
+# but stop at the PR. Merge stays a human decision, per CLAUDE.md §AI Contribution Model ("AI does
+# not commit directly to shared repositories") and §PR-Only Policy on main. This script is the
+# proposal-only half of that split, not an exception to it.
+#
+# THIS IS STAGE 2 OF THE EXISTING DAILY JOB, NOT A SEPARATE CRON:
+#   Stage 1 (unchanged) = frontier_digest_daily.sh — collects the digest, hardened with its own
+#   retry/watchdog/lock (see that file's header). This script calls it first, then only proceeds
+#   to Stage 2 if Stage 1 actually produced today's digest.
+#   Stage 2 (new) = a single headless `claude -p` invocation that reads the digest and, ONLY IF a
+#   concrete change survives harvest-loop's own 4-axis gate, opens a PR. No gate-passing candidate
+#   → no PR, no forced busywork (operator's explicit threshold choice: "harvest-loop이 실제 게이트를
+#   통과한 때만"). This mirrors the digest's own honesty rule (absence ≠ zero, but also: a thin
+#   signal is not manufactured into a change just to have shipped something today).
+#
+#   BACK-END SHIPPING DOCTRINE (operator, 2026-08-15): "개발의 앞단-영혼심기, 중간단-탈상관 가속화,
+#   뒷단 출하전-4단검증 및 하네스오너 리뷰" — the back end of shipping is 4-axis verification AND a
+#   standpoint-axis review, not 4-axis alone. CORRECTED same session (an earlier draft of this
+#   header named fh-meta:hub-cc-pr-reviewer here — wrong skill, caught by the operator: "내가 말한건
+#   하네스오너(너) 아니라 그 하네스에 에이전트가 들어가서 그 입장에서 리뷰한다는거야"). "하네스오너
+#   리뷰" is NOT the human operator (that gate is merge, unconditionally human, unchanged) NOR
+#   hub-cc-pr-reviewer (which checks FH's diff against FH's OWN conventions — same-repo
+#   self-consistency, a different question). It is the STANDPOINT AXIS
+#   (`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7`, the mechanism behind the
+#   if(kakao)26 keynote's p15 "(c) 탈상관의 확장" slide — "계열을 늘려도 못 잡는 결함이 있습니다,
+#   입장을 바꾸면 보입니다"): an agent actually running the diff's effect from ANOTHER harness's own
+#   repo/standpoint, which is orthogonal to family diversity and catches a documented, distinct class
+#   of defect family diversity alone does not. Wired into the Stage-2 prompt as two back-end
+#   checkpoints beyond the ordinary 4-axis gate: (1) an irreversible/load-bearing-surface diff holds —
+#   no PR, branch+signal only, operator decides whether a PR should even exist; (2) a diff that meets
+#   §7's own BEHAVIORAL trigger (alters another harness's actual behavior/gate-outcome/interaction
+#   contract — not merely a file-class match) gets a standpoint-axis pass, recorded on the closed
+#   tier1/tier2/tier2b/tier3/not-applicable/DEGRADED_* enum, before a PR opens (or folded into the
+#   held signal, if both checkpoints fire). Most ordinary digest-driven self-improvement will
+#   correctly land on `not-applicable` — that is the expected common case, not a shortfall.
+# SAFETY RAILS (why each exists) — hardened by fh-meta:challenger 2026-08-15 [S×2 fixed]:
+#   ① git status must be clean before Stage 2 starts. A shared checkout may have another session's
+#      in-progress uncommitted work — Stage 2 must never commit, stash, or otherwise touch state
+#      it did not create. Dirty tree → skip, log why, leave everything untouched.
+#   ② skip if a LIVE PEER SESSION CLAIM exists at all (branch_claim.sh show), not just if the tree
+#      is dirty. FIXED 2026-08-15: an earlier revision's header claimed branch_claim.sh protection
+#      but never actually called it — a human could have a clean-but-mid-thought tree (branch
+#      switched, nothing edited yet) and this script would have force-checked-out their branch out
+#      from under them in the EXIT trap with zero warning (challenger [S], confirmed real: the
+#      45-min Stage 2 window has no lock held the whole time — this check narrows, does not close,
+#      that TOCTOU; a peer session starting mid-run is a named residual, not fully closed). Any
+#      live peer at entry → skip Stage 2 entirely, log it, touch nothing.
+#   ③ skip if an autopilot PR is already open (branch prefix `auto/digest-improve-`) — one at a
+#      time, so a quiet week of "nothing concrete" backlog does not pile into an open-PR queue the
+#      operator has to triage. FIXED 2026-08-15: an earlier revision used
+#      `gh pr list --search 'head:auto/digest-improve-'` — GitHub's `head:` search qualifier is an
+#      EXACT branch-name match, not a prefix match, against branches that are actually named
+#      `auto/digest-improve-<full-date>` — the check would almost always find nothing and silently
+#      let PRs pile up unbounded (challenger [S], confirmed: verified via a live gh pr list --json
+#      call against this repo, see verify_next in edit_manifest.yaml). Fixed to filter headRefName
+#      client-side with jq's startswith(), which cannot have this exact-vs-prefix mismatch.
+#   ④ working tree is restored to the pre-run branch on exit (trap) ONLY IF still no live peer
+#      claim differs from where we started — re-checked at exit, not just at entry, because rail ②
+#      only guards the START of the window. If a peer claim appeared during the run, the trap logs
+#      a warning and leaves the tree where Stage 2 left it rather than yanking a now-live session's
+#      ground (mirrors branch_claim.sh's own printed guidance: "먼저 한 줄 알려라" — an unattended
+#      script cannot tell them first, so the fail-safe direction is: don't act, not: act anyway).
+#   ⑤ Stage 2 runs with --permission-mode bypassPermissions (no human present to answer a Bash
+#      approval prompt — acceptEdits, used by Stage 1, only covers Write/Edit, not git/gh). The
+#      actual floor is NOT this permission mode — it is the git hooks (pre-commit 4-axis gate,
+#      pre-push main-block, pre-push force-push block), which fire regardless of CC's own
+#      permission layer, plus merge being structurally impossible (this script and its prompt never
+#      invoke `gh pr merge`). NAMED RESIDUAL (challenger [S], not mitigated in v1 — accepted, not
+#      silently assumed covered): bypassPermissions removes CC's own approval layer for
+#      EVERYTHING, not just git in this repo — nothing here technically stops the subprocess from
+#      touching files elsewhere under this OS user (~/.ssh, other repos, arbitrary rm) or making
+#      outbound network calls beyond the git hooks' scope. The prompt instructs it not to; that is
+#      an instruction, not an enforcement boundary. Accepted for v1 because Stage 2 only fires after
+#      rails ①–③ pass and the blast radius is bounded by what a headless single-purpose prompt
+#      would plausibly do, not by a technical sandbox — revisit if this is ever wired to a more
+#      capability-rich prompt.
+#   ⑥ NAMED RESIDUAL — prompt injection via digest content (challenger [S], unmitigated): the
+#      digest ingests HN/arXiv content verbatim, and Stage 2 reads that digest under
+#      bypassPermissions with git-push/PR-create ability. Adversarial text embedded in fetched
+#      content could in principle steer the unattended session toward a misleading PR. No
+#      sanitization pass exists. Mitigant in practice: the PR is proposal-only (never merges
+#      itself) and still has to pass a real 4-axis gate with real challenger evidence — but that
+#      gate is text-based judgment, not a hard technical filter against this class.
+#   ⑦ NAMED RESIDUAL — log/secret exposure (challenger [A]): stdout+stderr of the Stage 2 claude
+#      process is captured verbatim into tracks/_meta/logs/, which a Stop hook may sync to a private
+#      companion store unattended, if one is configured. Any secret the agent happens to touch
+#      during the run propagates into a second store with no redaction pass. Accepted for v1 (same
+#      log-capture pattern as
+#      Stage 1's frontier_digest_daily.sh, already running this way since 2026-06) — revisit if
+#      Stage 2 is ever given credentials Stage 1 never touched.
+#
+# WHAT THIS DOES NOT DO: pick a "topic of the day" to force a contribution, retry on a NOT-CONVERGED
+# outcome, touch anything if Stage 1 (digest) itself failed today, or act while any live peer
+# session is claimed in this checkout.
+
+FH_DIR="${FD_FH_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+CLAUDE_BIN="${FD_CLAUDE_BIN:-$(command -v claude || echo "${HOME}/.local/bin/claude")}"
+TODAY=$(date +%Y_%m_%d)
+HUMAN_DATE=$(date +%Y-%m-%d)
+LOG_DIR="${FH_DIR}/tracks/_meta/logs"
+LOG_FILE="${LOG_DIR}/frontier_digest_autopilot_${TODAY}.log"
+mkdir -p "$LOG_DIR"
+_log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$LOG_FILE"; }
+
+# ── Stage 1: unchanged digest run ───────────────────────────────────────────
+bash "${FH_DIR}/scripts/frontier_digest_daily.sh"
+DIGEST_EXIT=$?
+if [ "$DIGEST_EXIT" -ne 0 ]; then
+  _log "Stage 1 (digest) failed (exit ${DIGEST_EXIT}) — Stage 2 skipped, nothing to act on."
+  exit "$DIGEST_EXIT"
+fi
+_log "Stage 1 (digest) OK for ${HUMAN_DATE}."
+
+cd "$FH_DIR" || { _log "cannot cd to \$FH_DIR ($FH_DIR)"; exit 1; }
+
+# ── Stage 2 preconditions (rails ① ② ③) ─────────────────────────────────────
+if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+  _log "Stage 2 SKIPPED: working tree is dirty (another session's uncommitted work may be live) — never touching it unattended."
+  exit 0
+fi
+
+# rail ②: any LIVE peer claim at all → skip. branch_claim.sh's own "show" lists each recorded
+# claim with a live/dead tag (dead = the recording session's PID no longer exists). We do not try
+# to be clever about "does the peer's branch differ from ours" here — any live peer means a human
+# is plausibly mid-thought in this exact checkout right now, full stop.
+if [ -x "${FH_DIR}/scripts/branch_claim.sh" ]; then
+  if bash "${FH_DIR}/scripts/branch_claim.sh" show 2>/dev/null | grep -q '(live)'; then
+    _log "Stage 2 SKIPPED: a live peer session claim exists in this checkout — not touching HEAD/committing while a human may be mid-thought here. Will try again on the next scheduled run."
+    exit 0
+  fi
+else
+  _log "Stage 2 SKIPPED: scripts/branch_claim.sh not found or not executable — cannot verify no live peer session, so refusing to touch the shared checkout unattended."
+  exit 0
+fi
+
+# rail ③: fixed 2026-08-15 — `gh pr list --search 'head:...'` is an EXACT-match qualifier, not a
+# prefix match, so it silently never matched our date-suffixed branch names (challenger [S]).
+# Filter client-side instead: list open PRs' head branch names, test the prefix ourselves.
+if ! command -v gh >/dev/null 2>&1; then
+  _log "Stage 2 SKIPPED: gh CLI not found — cannot check for an existing open autopilot PR, and cannot open one."
+  exit 0
+fi
+OPEN_AUTO_COUNT="$(gh pr list --state open --json headRefName \
+  -q '[.[] | select(.headRefName | startswith("auto/digest-improve-"))] | length' 2>/dev/null)"
+case "$OPEN_AUTO_COUNT" in
+  ''|*[!0-9]*)
+    _log "Stage 2 SKIPPED: could not measure open-autopilot-PR count (gh call failed/unparseable) — not measurable is not the same as zero, refusing to risk piling up a PR unseen."
+    exit 0
+    ;;
+  0) ;; # clear to proceed
+  *)
+    _log "Stage 2 SKIPPED: ${OPEN_AUTO_COUNT} autopilot PR(s) already open (branch prefix auto/digest-improve-) — one at a time, operator has not triaged it yet."
+    exit 0
+    ;;
+esac
+
+ORIG_BRANCH="$(git symbolic-ref --short HEAD 2>/dev/null || echo main)"
+# rail ④: re-check for a live peer at exit time too — a peer starting mid-run must not get its
+# ground yanked by our restorative checkout. This narrows, not closes, the TOCTOU window (see
+# header rail ② note) — a peer appearing in the few seconds between this check and the actual
+# `git checkout` call below is a residual, not claimed as fully closed.
+_fh_autopilot_exit_trap() {
+  if [ -x "${FH_DIR}/scripts/branch_claim.sh" ] \
+     && bash "${FH_DIR}/scripts/branch_claim.sh" show 2>/dev/null | grep -q '(live)'; then
+    _log "EXIT: a live peer session claim appeared during this run — leaving the tree as Stage 2 left it, NOT force-checking-out ${ORIG_BRANCH} (would yank a now-live session's ground)."
+  else
+    _log "EXIT: restoring working tree to ${ORIG_BRANCH}"
+    git checkout --quiet "$ORIG_BRANCH" 2>/dev/null
+  fi
+}
+trap _fh_autopilot_exit_trap EXIT
+
+ATTEMPT_TIMEOUT_SECS="${FD_AUTOPILOT_TIMEOUT_SECS:-2700}"
+
+# bash 3.2 (macOS default, confirmed this machine) has a known parser bug: a heredoc directly
+# inside a `$(...)` command substitution mis-tracks quote balance once the heredoc BODY contains an
+# unescaped apostrophe (e.g. "Today's") — `bash -n` fails with "unexpected EOF while looking for
+# matching `'". Writing the heredoc to a plain file first, then capturing that file's content via
+# `$(cat ...)` (a command substitution with NO heredoc inside it), sidesteps the bug entirely.
+PROMPT_FILE="${LOG_DIR}/.autopilot_prompt_${TODAY}.txt"
+cat > "$PROMPT_FILE" <<PROMPT_EOF
+[automated-run: launchd, unattended — no human present to answer prompts] Today's frontier digest just landed at tracks/_meta/frontier_digest_${TODAY}.md (or the companion-store mirror if this node is not the digest runner). Run the digest -> persona-innovator (Mode F, full: internal gap scan + external frontier) -> harvest-loop pipeline against it, exactly as documented in CLAUDE.md and the relevant SKILL.md files - do not shortcut the 4-axis gate (edit-manifest entry, a real fh-meta:challenger adversarial pass with actual evidence, not a fabricated marker).
+
+Threshold (operator's explicit choice, 2026-08-15): only act if a CONCRETE, well-scoped candidate survives harvest-loop and actually passes the 4-axis gate as a real committable diff. If nothing concrete surfaces today, do nothing further - do not manufacture a change to have shipped something. A quiet day is a correct outcome, not a failure.
+
+BACK-END CHECKPOINTS (operator instruction, 2026-08-15 - required steps on this pipeline's shipping stage, not suggestions; this is the "뒷단 출하전 = 4축검증 + 하네스오너 리뷰" doctrine, applied to an unattended run):
+
+1. IRREVERSIBILITY CHECK: does the gate-passing diff touch an IRREVERSIBLE surface per CLAUDE.md's Irreversibility Gates section (a publish/delete/history-rewrite path) OR a load-bearing surface per the Field-Harness Load-Bearing Change Gate (a verdict/gate enum or exit code, an irreversible-op path, or a safety invariant such as a floor, verdict-binding, or a pre-push/pre-commit hook)? This includes changes to the git hooks themselves (templates/.git-hooks/*), scripts a hook calls, or anything in the Irreversibility Gates / Destructive-Op Gate / Pre-Publish Gate sections of CLAUDE.md.
+   - If YES: do NOT run gh pr create at all. Create the branch, commit, push it (so the work is not lost), write a signal file at tracks/_meta/fh_signal_${HUMAN_DATE}_autopilot-irreversible-hold.md with frontmatter 'status: NEEDS-OWNER-REVIEW' naming the branch, exactly which surface it touches and why, and what the change does - then stop. No PR exists yet; the operator decides whether one should even be opened.
+
+2. STANDPOINT AXIS (knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7 - read it before applying this step, this summary is not the full spec): does the diff alter ANOTHER harness's actual behavior, gate outcome, or interaction contract (not merely touch a path that happens to be synced elsewhere - the trigger is behavioral, not file-class)? Most ordinary FH self-improvement from a digest signal will correctly land on standpoint: not-applicable - that is a correct, expected answer, not a shortfall to fix. This is a genuinely different axis from "harness-owner reviewing FH's own conventions" - it means an agent actually running the diff's effect FROM the standpoint of the OTHER harness's own repo (family diversity alone does not catch this: the mechanism behind the if(kakao)26 keynote's p15 slide "(c) 탈상관의 확장" - "계열을 늘려도 못 잡는 결함이 있습니다, 입장을 바꾸면 보입니다" - §7 is built on three field incidents where full cross-family review missed a defect that only one execution-from-the-target's-own-repo caught).
+   - If NOT applicable (the common case): record standpoint: not-applicable in the marker/signal, state briefly what was checked (per the spec's own discipline - asserting non-applicability without naming what was checked is indistinguishable from not having looked at all), and move on.
+   - If applicable: check whether a local clone of the target harness exists on this machine (e.g. under the parent of ${FH_DIR} - sibling directories like pmh-dev, qasp-dev, or similar). If one exists, run the change against THAT repo's own content/rules from its own standpoint (tier2) - this must happen BEFORE any push or gh pr create for THIS diff, same non-negotiable pre-push timing as the irreversibility check above and for the identical reason (PR #370, 2026-08-14: a post-PR standpoint review still caught 2 residency leaks that had already sat in public view before the fix - public exposure is effectively irreversible, so this cannot run after the diff is visible). If it finds anything, fix it in the local diff and re-run until clean - only then push and open the PR (or, if step 1 already routed to hold, fold the finding into that signal file instead). If no local clone of the target harness is reachable, record standpoint: DEGRADED_NO_TARGET_ACCESS (could not, not did not) and proceed - do not block indefinitely on a target you structurally cannot reach, but do not silently claim not-applicable either when it actually is applicable and merely unreachable.
+   Do NOT conflate this with fh-meta:challenger (family/adversarial-correctness axis, already required by the 4-axis gate above) or with fh-meta:hub-cc-pr-reviewer (checks FH's own diff against FH's OWN baseline conventions - a same-repo self-consistency check, not a standpoint-axis review at all). All three are different lenses; running one is not a substitute for another.
+
+3. If the diff is neither irreversible/load-bearing (step 1: NO) nor standpoint-applicable (step 2: NO or DEGRADED) - the common case, ordinary small reversible self-improvement: skip straight to branch/commit/push/PR below.
+
+In every case that reaches a PR: create branch auto/digest-improve-${HUMAN_DATE}, commit there, push it, open with gh pr create --fill, noting in the PR body which digest item motivated it. Never commit to main (the pre-push hook enforces this regardless). Do NOT run gh pr merge under any circumstances - merge is always the operator's decision. Do NOT push to main directly. Do NOT force-push. Do NOT touch any file outside what this specific candidate change requires.
+
+If you are blocked (git status was unexpectedly dirty, gh auth failed, the gate genuinely cannot converge in one pass), stop and log why - do not retry, do not fall back to a weaker gate, do not touch main.
+PROMPT_EOF
+
+PROMPT="$(cat "$PROMPT_FILE")"
+rm -f "$PROMPT_FILE"
+
+_log "Stage 2 starting (timeout ${ATTEMPT_TIMEOUT_SECS}s)"
+"$CLAUDE_BIN" -p --permission-mode bypassPermissions "$PROMPT" >> "$LOG_FILE" 2>&1 &
+CLAUDE_PID=$!
+DEADLINE=$((SECONDS + ATTEMPT_TIMEOUT_SECS))
+while kill -0 "$CLAUDE_PID" 2>/dev/null && [ "$SECONDS" -lt "$DEADLINE" ]; do
+  sleep 30 & wait $!
+done
+if kill -0 "$CLAUDE_PID" 2>/dev/null; then
+  pkill -P "$CLAUDE_PID" 2>/dev/null
+  kill "$CLAUDE_PID" 2>/dev/null
+  wait "$CLAUDE_PID" 2>/dev/null
+  _log "Stage 2 killed by watchdog (${ATTEMPT_TIMEOUT_SECS}s) — no retry (this is not the digest's hard-realtime path)."
+else
+  wait "$CLAUDE_PID"
+  _log "Stage 2 finished (exit $?)."
+fi
+
+exit 0

package/scripts/lane_runner_check.sh

@@ -121,30 +121,37 @@ EXEMPT=(
 # 11 not 12), and test_marker_floor_lanes.sh calibrates pre-commit's live validate_marker_floor().
 # Both are wired now.
 #
-# 🟥 THE TWO BELOW WERE WIRED, MEASURED RED IN CI, AND DELIBERATELY MOVED BACK. Making them green
-# was available and is the wrong move: their failures are TRUE — the suites really do depend on
-# things a CI runner does not have — so forcing a pass would be routing a real failure to green in
-# the same delta that spent nine repairs closing exactly that. A suite whose preconditions are
-# undeclared belongs in the todo list, not in the mandatory path.
-DEBT=(
-  # PASS 19 · FAIL 0 locally; PASS 12 · FAIL 7 in CI. Reproduced locally by pointing HOME at an
-  # empty directory — 12/7, the same split — so the dependency is exact and not a guess:
-  # field_canon_preload.sh resolves `${HOME}/projects` and seven lanes assume the operator's
-  # mapped-project layout is there. Nothing in the suite declares that precondition, so on a
-  # machine without it the suite reports a REGRESSION rather than "not exercised here".
-  # Fix before re-wiring: the suite must detect the missing layout and exit NOT-EXERCISED (the
-  # shape test_sessionstart_multihook_lanes.sh already uses for its CLI dependency), or build its
-  # own fixture HOME for those seven the way it already does for the no-HOME lane.
-  "test_field_canon_lanes.sh"
-  # 17/17 locally; 2/17 in CI. And this one was PREDICTED: the adversarial review of this very
-  # delta flagged `elapsed < 10` as a wall-clock assertion that would go falsely red on a loaded CI
-  # runner, naming this file and that line. It was filed as a low-severity residual and not acted
-  # on; CI then produced exactly it. ★ The finding named a MECHANISM (a wall-clock assertion is now
-  # on a mandatory path), and a mechanism does not become less true for being labelled R.
-  # Fix before re-wiring: give the timing assertions headroom or gate them behind an explicit
-  # opt-in, so the default run measures logic and not the runner's load.
-  "test_stale_clone_guard_lanes.sh"
-)
+# 🟢 THE TWO THAT WERE HERE ARE RE-WIRED (2026-08-14) — DEBT 2 → 0. Both entries below are
+# HISTORICAL: they record why the suites were pulled out and what the fix had to be, kept because
+# the reasoning (and the exact CI-reproduction numbers) are load-bearing evidence for the next
+# person who touches either suite, not because either is still debt.
+#
+# test_field_canon_lanes.sh — was: PASS 19 · FAIL 0 locally; PASS 12 · FAIL 7 in CI. Reproduced
+# locally by pointing HOME at an empty directory — 12/7, the same split — so the dependency was
+# exact and not a guess: field_canon_preload.sh resolves `${HOME}/projects` and seven lanes assumed
+# the operator's mapped-project layout was there. Nothing in the suite declared that precondition,
+# so on a machine without it the suite reported a REGRESSION rather than "not exercised here". Fix
+# (built the second option this entry named, not the first): the suite now carries its own fixture
+# hub+project-root (mirroring the shape lane ⑭ already used) instead of depending on the operator's
+# real filesystem — `run()`/`runD()` inject `CLAUDE_PROJECT_DIR`/`FIELD_CANON_PROJECT_ROOT` at a
+# fixed fixture path. Verified both directions: PASS 19/19 under an empty HOME (the exact CI
+# reproduction) AND a known-negative check — breaking the `-dev`-suffix repo-resolution fallback in
+# field_canon_preload.sh reproduces the identical PASS 12 / FAIL 7 split, so the fixture measures
+# real behavior, not a vacuously-green rewrite.
+#
+# test_stale_clone_guard_lanes.sh — was: 17/17 locally; 2/17 in CI. Predicted by an adversarial
+# review of the delta that introduced `elapsed < 10` as a wall-clock assertion on a mandatory path;
+# CI then produced exactly it. Fix (the first option this entry named): the wedge sleep widened
+# 30s→60s and the assertion changed from a fixed `elapsed < 10` to a relative `elapsed <
+# (wedge/2)=30s` — proving the guard's internal 0.5s budget bounded it (60x headroom) rather than an
+# absolute constant tuned to one machine's speed. Known-negative check: neutering the budget's kill
+# condition in stale_clone_guard.sh (so it waits out the full wedge instead of self-bounding)
+# correctly fails exactly this one lane, confirming the widened threshold still discriminates.
+#
+# Re-wired into scripts/selfcheck.sh's pair-loop alongside the other ten (found→extend, same shape:
+# "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" and
+# "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh").
+DEBT=()
 
 if [ "${1:-}" = "--list-debt" ]; then
   # Same bash-3.2 empty-array guard as the scan call below. This site was MISSED when that one was
@@ -169,6 +176,96 @@ if [ -f scripts/selfcheck.sh ] && ! grep -qE '^[[:space:]]*(if !? ?)?bash script
   exit 1
 fi
 
+# ── ORG SEAM — a downstream org declares ITS OWN suites in ITS OWN file ───────────────────────
+# Why this exists (requested 2026-08-13 by a downstream org fork of this harness, with evidence):
+# EXEMPT and DEBT above are hardcoded arrays in a SHARED-LAYER file. A downstream fork carries
+# suites this repo has never heard of (`test_rest_push_lanes.sh`, `test_company_delta_lanes.sh` …),
+# and all three remedies this check offers land in files that fork does not own:
+#     wire into selfcheck.sh   → shared layer   · EXEMPT array → this file, shared layer
+#     DEBT array               → this file, shared layer
+# So the fork's only choices were "violate the sync boundary" or "live at rc=1 forever". Measured:
+# 5 such suites on their first run of this check. That is not a preference — a permanently red
+# check stops being read, and one of those five suites had just caught a real regression when it
+# was run by hand.
+#
+# Shape: OPTIONAL file, absent by default. This repo ships none, so the no-op arm is the arm that
+# runs here — verified by the known-pair in scripts/test_lane_runner_lanes.sh.
+#
+# 🟥 A MALFORMED FILE IS FAIL-CLOSED, a stale entry is advisory. Those are different failures:
+#   · cannot parse   → the instrument did not look. Reporting "no declarations" would render
+#                      UNMEASURED as ZERO, which is the exact family this repo keeps closing.
+#   · names a suite that no longer exists → hygiene, same as a stale DEBT entry above, so it warns
+#                      with the same voice. Making the downstream rule STRICTER than the upstream
+#                      one it mirrors would just train people to delete the file.
+ORG_DECL="company/lane_declarations.yaml"
+ORG_EXEMPT=(); ORG_DEBT=()
+if [ -f "$ORG_DECL" ]; then
+  _org_out=$(python3 - "$ORG_DECL" <<'ORGPY'
+import re, sys
+path = sys.argv[1]
+try:
+    txt = open(path, encoding='utf-8').read()
+except OSError as e:
+    print(f"ERR\tcannot read {path}: {e}"); sys.exit(0)
+sect = None; seen = {}
+for i, ln in enumerate(txt.splitlines(), 1):
+    s = ln.split('#', 1)[0].rstrip()
+    if not s.strip():
+        continue
+    m = re.match(r'^([A-Za-z_]+):\s*$', s)
+    if m:
+        sect = m.group(1)
+        if sect not in ('exempt', 'debt'):
+            print(f"ERR\t{path}:{i}: unknown section '{sect}' (expected 'exempt' or 'debt')")
+            sys.exit(0)
+        continue
+    m = re.match(r'^\s+-\s+(\S+)\s*$', s)
+    if m:
+        if sect is None:
+            print(f"ERR\t{path}:{i}: entry before any section header"); sys.exit(0)
+        name = m.group(1)
+        if name in seen and seen[name] != sect:
+            print(f"ERR\t{path}:{i}: '{name}' declared both exempt and debt — ambiguous")
+            sys.exit(0)
+        seen[name] = sect
+        print(f"{sect}\t{name}")
+        continue
+    print(f"ERR\t{path}:{i}: unparseable line: {s.strip()[:60]}")
+    sys.exit(0)
+ORGPY
+)
+  # `grep -q '^ERR'` — NOT `'^ERR\t'`. In a POSIX BRE, GNU grep reads `\t` as a literal `t`
+  # (so the pattern becomes `^ERRt` and matches nothing) while BSD grep on macOS takes it as a tab.
+  # Measured 2026-08-13: this exact line passed all 11 lanes locally and failed L6/L7/L8 in CI —
+  # the fail-closed arm was silently dead on Linux, which is the platform that gates merges.
+  # Same family as the `"$DDSCAN" "` anchor divergence a sibling harness measured the same day:
+  # a regex that means different things on the two greps is an instrument, and an instrument that
+  # answers differently per platform has not measured anything.
+  if printf '%s' "$_org_out" | grep -q '^ERR'; then
+    echo "FAIL  lane-runner: $ORG_DECL exists but could not be read as declarations —"
+    printf '%s' "$_org_out" | sed 's/^ERR[[:space:]]*/        /'
+    echo "      An unreadable declaration file is UNMEASURED, not empty. Fix the file or delete it."
+    exit 2
+  fi
+  while IFS=$'\t' read -r _k _v; do
+    [ -z "${_v:-}" ] && continue
+    case "$_k" in
+      exempt) ORG_EXEMPT+=("$_v") ;;
+      debt)   ORG_DEBT+=("$_v") ;;
+    esac
+  done <<< "$_org_out"
+  # Stale-entry warning, same voice as the DEBT hygiene warnings below.
+  for _n in "${ORG_EXEMPT[@]+"${ORG_EXEMPT[@]}"}" "${ORG_DEBT[@]+"${ORG_DEBT[@]}"}"; do
+    [ -f "scripts/$_n" ] || echo "⚠️  lane-runner: $ORG_DECL declares '$_n' but scripts/$_n does not exist (renamed/deleted?)"
+  done
+  # Visibility: an org-declared suite must never be indistinguishable from an upstream one. A
+  # reader who sees "0 debt" has to be able to tell whether that is this repo's zero or a fork's
+  # declaration absorbing its own list.
+  echo "      lane-runner: $ORG_DECL — ${#ORG_EXEMPT[@]} exempt · ${#ORG_DEBT[@]} debt (org-declared)"
+  EXEMPT+=("${ORG_EXEMPT[@]+"${ORG_EXEMPT[@]}"}")
+  DEBT+=("${ORG_DEBT[@]+"${ORG_DEBT[@]}"}")
+fi
+
 # `"${ARR[@]+"${ARR[@]}"}"` and not the plain `"${ARR[@]}"`: on bash 3.2 (stock macOS) `set -u`
 # treats an EMPTY array's expansion as an unbound variable and aborts. DEBT is now empty by design,
 # which is exactly the state the plain form cannot survive — measured here 2026-08-13, and it
@@ -256,6 +353,99 @@ def runner_dispatches(suite, txt):
 
 wired = {s for s in suites if has_runner(s)}
 
+# ── Embedded --self-test dispatchers — a class the name-pattern `suites` glob cannot see ──────
+# Measured 2026-08-13, the header of this file, §WHAT DEBT:0 DOES NOT MEAN: a lane suite that
+# lives INSIDE its subject as a `--self-test` flag — not a separate `test_*.sh`/`*_lanes.sh` file
+# — is structurally invisible to the glob above. 4 scripts carry one — chamber_witness.sh ·
+# capability_registry_check.sh · digest_landing_check.sh · directional_diff_gate.sh — and none
+# showed up as WIRED or UNWIRED anywhere in this report; the wiring line for the 3 that ARE wired,
+# the `for _subj in ...` loop at scripts/selfcheck.sh:478, could be deleted and nothing here would
+# go red. found→extend, not a new file: same idiom as `suites`/`has_runner` above — discover
+# subjects, detect dispatch, report undeclared — new predicates for the shape this pattern uses.
+#
+# 🟥 A PARENTHESIS TRAP LIVES IN THIS SPECIFIC HEREDOC, READ BEFORE ADDING A LINE HERE.
+# Measured 2026-08-14: a single heredoc-body line whose own paren count was unbalanced — one more
+# close-paren than open-paren, from a regex needing a literal close-paren character — broke bash's
+# parse of every line after it, on THIS file only. The reason is that the heredoc below sits inside
+# a command-substitution wrapper, and that wrapper's own close-paren-matching scan turned out not
+# to be fully heredoc-blind in the bash build this repo has tested. `bash -n` then failed dozens of
+# lines later with an unrelated-looking error, because by then the parser believed the heredoc had
+# already closed. Reproduced in isolation: a bare regex assignment needing a literal close-paren,
+# spliced into this file at this exact position, alone, with nothing else added. The fix is
+# structural, not "be careful" — every line added inside this heredoc must carry a matched
+# open-paren and close-paren count on that same line, and a matched pair spanning two lines is
+# exactly the shape that tripped this the first time. Collapse it back to one line, or spell the
+# literal paren out as an escape sequence instead of a bare character, rather than splitting it
+# across lines.
+# A bare substring match on --self-test would also catch prose that only DISCUSSES the flag
+# (measured: scripts/selfcheck.sh:482 has a comment naming it as an example of what NOT to grep
+# for, which is exactly the false positive this narrower check exists to avoid). Require one of
+# the two real dispatcher shapes instead: `"--self-test"` in a quoted comparison, or `--self-test)`
+# as a bare case-pattern. The close-paren is built via chr — see the paren-trap note above; a
+# literal `)` character on this line, however it is spelled, throws this file's parser off.
+_CP = chr(41)
+SELFTEST_DISPATCH_FORMS = ('"--self-test"', '--self-test' + _CP)
+
+def _read(path):
+    try:
+        return open(path, encoding='utf-8', errors='replace').read()
+    except OSError:
+        return ''
+
+# One line on purpose — see the paren-trap note above the SELFTEST_PAT definition.
+_st_candidates = [f for f in glob.glob('scripts/*.sh') if os.path.basename(f) not in suites and os.path.basename(f) != 'lane_runner_check.sh']
+_st_names = [os.path.basename(f)[:-3] for f in _st_candidates if any(_form in _read(f) for _form in SELFTEST_DISPATCH_FORMS)]
+selftest_subjects = sorted(set(_st_names))
+
+def selftest_dispatched(bare_name, txt):
+    """Two shapes, both real in this repo. Cross-family review (2026-08-14) caught the first draft
+    shipping only the second — it read scripts/selfcheck.sh:478's `_subj` for-loop but missed
+    :898/:933's direct `bash scripts/probe_scope_check.sh --self-test` / `bash scripts/
+    utterance_landing_check.sh --self-test`, so those two subjects were reported UNDECLARED while
+    selfcheck.sh runs them every time. This is the exact failure the header above names by cite —
+    a reader trusting the count over the source would have been told a false thing with confidence.
+
+    Shape 1 (direct): `bash scripts/<name>.sh ... --self-test` on one line — mirrors
+    runner_dispatches' direct branch, structurally simpler than the indirect case below.
+    Shape 2 (indirect): bare_name sits in a `for VAR in ... bare_name ...; do` loop whose body
+    dispatches $VAR with --self-test — mirrors the indirect-branch reasoning of runner_dispatches:
+    the literal name is in a list construct, the invocation runs through the loop variable, so a
+    direct-dispatch grep alone structurally cannot see it (scripts/selfcheck.sh:478)."""
+    if re.search(rf'\bbash\s+scripts/{re.escape(bare_name)}\.sh\b[^\n]*--self-test', txt):
+        return True
+    in_loop = False; loop_var = None; has_name = False
+    for ln in txt.split('\n'):
+        s = ln.strip()
+        m = re.match(r'for\s+(\w+)\s+in\b(.*)', s)
+        if m:
+            loop_var = m.group(1)
+            has_name = bool(re.search(rf'\b{re.escape(bare_name)}\b', m.group(2)))
+            in_loop = True
+            continue
+        if in_loop:
+            if has_name and '--self-test' in ln and re.search(rf'\${{?{re.escape(loop_var)}\b', ln):
+                return True
+            if s == 'done':
+                in_loop = False; loop_var = None; has_name = False
+    return False
+
+def has_selftest_runner(bare_name):
+    return any(selftest_dispatched(bare_name, _read(r)) for r in runners)
+
+selftest_wired = {s for s in selftest_subjects if has_selftest_runner(s)}
+selftest_undeclared = sorted(s for s in selftest_subjects if s not in selftest_wired)
+
+# Minimal known-pair — proportionate to the size of this addition, not the full CTL apparatus
+# below, but a dead predicate must still be caught rather than trusted on read-through alone.
+_ST_POS_FIXTURE = 'for _subj in alpha beta; do\n  bash "scripts/$_subj.sh" --self-test\ndone\n'
+_ST_NEG_FIXTURE = 'for _subj in alpha beta; do\n  bash "scripts/$_subj.sh" --normal-run\ndone\n'
+if not selftest_dispatched('alpha', _ST_POS_FIXTURE):
+    print("CONTROL_FAILED\tself-test known-positive fixture read as undispatched — detector is blind")
+    raise SystemExit(2)
+if selftest_dispatched('alpha', _ST_NEG_FIXTURE):
+    print("CONTROL_FAILED\tself-test known-negative fixture with no --self-test flag read as dispatched")
+    raise SystemExit(2)
+
 # ── CONTROL: the instrument must be able to see a suite known to be wired, and must NOT see one
 # known to be dead. Without both arms a broken detector reports "all clean" or "all broken" and
 # either reads as a verdict. [[feedback_absence_measurement_needs_control]]
@@ -360,6 +550,9 @@ for s in resolved:
     print(f"RESOLVED\t{s}")
 for s in gone:
     print(f"GONE\t{s}")
+print(f"SELFTEST_COUNTS\t{len(selftest_subjects)}\t{len(selftest_wired)}")
+for s in selftest_undeclared:
+    print(f"SELFTEST_UNDECLARED\t{s}")
 PY
 )
 rc=$?
@@ -421,5 +614,24 @@ if [ "$N_DEBT" -gt 0 ]; then
   echo "    only go down; a new one fails the check rather than joining the list silently."
 fi
 
-echo "PASS  lane-runner: ${TOTAL} suites — ${WIRED} wired · ${N_EXEMPT} exempt · ${N_DEBT} declared debt"
+SELFTEST_COUNTS=$(printf '%s\n' "$out" | awk -F'\t' '$1=="SELFTEST_COUNTS"{print $2" "$3}')
+set -- $SELFTEST_COUNTS
+ST_TOTAL="${1:-0}"; ST_WIRED="${2:-0}"
+SELFTEST_UNDECLARED=$(printf '%s\n' "$out" | awk -F'\t' '$1=="SELFTEST_UNDECLARED"{print $2}')
+ST_UNDECLARED_N=0
+if [ -n "$SELFTEST_UNDECLARED" ]; then
+  ST_UNDECLARED_N=$(printf '%s\n' "$SELFTEST_UNDECLARED" | wc -l | tr -d ' ')
+  # Advisory, not blocking — these are pre-existing (measured 2026-08-13, before this check saw
+  # them at all), not something introduced by whatever change is running this check right now.
+  # Same DEBT philosophy as above: loudly counted, never silent, must only go down from here.
+  echo "⚠️  lane-runner: ${ST_UNDECLARED_N} embedded --self-test subject(s) with no --self-test"
+  echo "    dispatcher anywhere (self-test code exists, nothing calls it — see this file's own"
+  echo "    §Embedded --self-test comment for why the suites glob above cannot see this class):"
+  printf '%s\n' "$SELFTEST_UNDECLARED" | sed 's/^/        /'
+  echo "    Fix by wiring \`bash scripts/<name>.sh --self-test\` into scripts/selfcheck.sh's"
+  echo "    _subj for-loop (scripts/selfcheck.sh:478), same shape as the 3 already there."
+fi
+
+echo "PASS  lane-runner: ${TOTAL} suites — ${WIRED} wired · ${N_EXEMPT} exempt · ${N_DEBT} declared debt" \
+     "· self-test: ${ST_WIRED}/${ST_TOTAL} wired"
 exit 0

package/scripts/package_coverage_check.sh

@@ -36,6 +36,8 @@ cd "$REPO_ROOT" || exit 1
 #        a file of that name to exercise the LOW allowlist — not a pointer to this file at all.)
 #   scripts/sync_guard_check.sh             — anchor for that same operator-private mirror sync;
 #       no shipped hook invokes it.
+#   scripts/sync_to_be_lanes.sh             — forward-path lane suite for sync-to-be.sh, itself
+#       ACCEPTED_ABSENT above; added 2026-08-14, pmh-dev#69.
 ACCEPTED_ABSENT=(
   ".claude/registry/LOCAL_SKILL_REGISTRY.md"
   # An INSTALL DESTINATION the user creates (`cp templates/local_fh_context.md
@@ -57,6 +59,21 @@ ACCEPTED_ABSENT=(
   # anchor but guards on the subject's presence, so package mode SKIPs rather than falling through.
   "scripts/sync-from-be.sh"
   "scripts/sync_from_be_lanes.sh"
+  # Forward path's own lane suite (added 2026-08-14, pmh-dev#69). Same reason as its return-path
+  # sibling directly above: it exercises scripts/sync-to-be.sh, itself ACCEPTED_ABSENT — a lane
+  # suite for a script that never ships has nothing to verify on a consumer's machine either.
+  "scripts/sync_to_be_lanes.sh"
+  # Shared identity resolver for the two transports directly above (added to files[] by #368,
+  # REMOVED from it 2026-08-15). It was the odd one out: its own callers — sync-to-be.sh and
+  # sync-from-be.sh — are ACCEPTED_ABSENT here for a reason that applies to it verbatim (the
+  # namespacing it computes only means anything on a machine that HAS the operator's companion
+  # store), yet it alone was listed for shipping. The pre-publish confidentiality scan is what
+  # surfaced the misclassification: it carries the companion store's own directory vocabulary,
+  # which would have reached the registry for the first time in 1.4.98. The one shipped caller,
+  # fh_session_load.sh, sources it behind `[ -f ]` and documents its own degrade ("an unresolved
+  # identity degrades to the historical unsuffixed tracks-meta rather than erroring — that is the
+  # pre-fix behavior, not a new failure mode"), so a consumer loses nothing that consumer ever had.
+  "scripts/fh_hub_identity.sh"
   # ── The three lane suites selfcheck.sh's DEBT-12 pair-loop names but does not ship ────────────
   # Added 2026-08-13, and the way they got here is the point: this check CAUGHT them. Before that
   # loop existed, these names lived in lane_runner_check.sh's DEBT array as bare basenames

package/scripts/postinstall_notice.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+'use strict';
+// postinstall_notice.js — one-line, stderr-only, CI-silent install notice.
+//
+// WHY: 16k+ npm downloads (measured live, 2026-08-15) vs 7 GitHub stars on the same day —
+// people are using fh-gate and have no reason to ever see the GitHub repo, since `npx
+// @chrono-meta/fh-gate` never surfaces it. This closes that gap at the one moment every
+// installer passes through, without touching fh-gate.js's own stdout (that IS the CI
+// contract per its own header comment — this notice must never risk polluting it).
+//
+// WHY stderr, not stdout: npm's own install-time output already goes to stderr by
+// convention (npm's progress/warnings), and more importantly this keeps it structurally
+// impossible for the notice to ever be mistaken for gate output — a script piping
+// `npx @chrono-meta/fh-gate`'s stdout for FH_GATE_VERDICT: parsing never sees this line,
+// even if this file were somehow invoked in the same process (it isn't — separate
+// lifecycle script, separate process).
+//
+// WHY CI-silent: postinstall banners are a known source of npm-ecosystem noise complaints,
+// and this package explicitly markets itself for CI use (CHEATSHEET.md §9.5). A line that
+// reprints on every CI run install is exactly the annoyance that gets a package reported,
+// not starred. Skip whenever a CI environment is plausible OR the operator opts out.
+if (process.env.CI || process.env.FH_NO_BANNER || process.env.CONTINUOUS_INTEGRATION) {
+  process.exit(0);
+}
+try {
+  process.stderr.write(
+    '\n⭐ forge-harness (fh-gate) — if this is useful, a star helps others find it:\n' +
+    '   https://github.com/chrono-meta/forge-harness\n' +
+    '   (set FH_NO_BANNER=1 to silence this message)\n\n'
+  );
+} catch (_) {
+  // Never fail an install over a courtesy message.
+}
+process.exit(0);