@chrono-meta/fh-gate 1.4.97 → 1.4.99

package/scripts/fh_node_check.sh

@@ -151,6 +151,132 @@ IDENTITY=""
 if [ -z "$PREV_ID" ]; then IDENTITY="first session for this clone"
 elif [ "$PREV_ID" != "$NODE_ID" ]; then IDENTITY="machine changed ($PREV_ID → $NODE_ID)"; fi
 
+# ── git-remote freshness (origin) — distinct axis from the infra-delta check above ─
+# INFRA (above) compares against PREV_HEAD, the commit THIS CLONE last saw — it cannot detect
+# "origin has commits I never pulled" because it never talks to the remote. Measured 2026-08-15:
+# a machine idle for two weeks sat 145 commits behind origin/main with zero signal from this hook
+# (companion-store sync covers only the gitignored half; the FH repo itself is a separate git
+# transport with no freshness check of its own). Condition, not event — reported every session
+# while true, same as MISS above.
+#
+# WHY THE TARGET REF IS THE LOCAL main BRANCH, NOT `git symbolic-ref --short HEAD`: an earlier
+# revision compared `HEAD..origin/<current-branch>`. Two bugs, one catch (fh-meta:challenger
+# 2026-08-15 [HIGH]): (a) on a detached HEAD, `symbolic-ref` fails and silently fell back to the
+# literal string "main" — not empty — so the "not measurable, stay silent" case never triggered
+# and it happily compared against the wrong ref; (b) on a feature branch — this repo's own normal
+# workflow (CLAUDE.md §PR Direction: never commit main directly) — it compared against
+# origin/<feature-branch>, never origin/main, so the exact incident this check exists to catch
+# (idle main sitting behind) would NOT have been caught while checked out on a feature branch.
+# Fix: always measure the LOCAL main branch REF directly (refs/heads/<default>), independent of
+# what is currently checked out. Default branch name is read from origin/HEAD, falling back to
+# "main" only if that symref is absent (e.g. never fetched before).
+GIT_BEHIND_NOTE=""
+if git -C "$FH" rev-parse --git-dir >/dev/null 2>&1 && git -C "$FH" remote get-url origin >/dev/null 2>&1; then
+  export GIT_TERMINAL_PROMPT=0
+  # GIT_SSH_COMMAND: fh_session_load.sh's companion-store fetch sets this (BatchMode + accept-new
+  # host keys) so an SSH remote with an unrecognized host key fails fast instead of hanging on an
+  # interactive prompt that GIT_TERMINAL_PROMPT=0 alone does not suppress (ssh, not git, owns that
+  # prompt). This block had copied the timeout half of that pattern but not the SSH half — same
+  # challenger round caught the drift live, not hypothetically.
+  export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
+  # Same bounded-fetch pattern as fh_session_load.sh's companion-store pull: a SessionStart hook
+  # must never hang the first turn on a slow/stalled network step. perl-alarm is the portable
+  # watchdog; no perl → run unbounded rather than silently never fetch (same tradeoff as there).
+  # Deliberately a DISTINCT env var from that script's FH_FETCH_DEADLINE (this fetch targets a
+  # different remote — the FH repo's own origin, not the companion store's) — sharing the name
+  # would let tuning one fetch's timeout silently retune the other (challenger 2026-08-15).
+  if command -v perl >/dev/null 2>&1; then
+    _fh_gitcheck_deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
+  else
+    _fh_gitcheck_deadline() { shift; "$@"; }
+  fi
+  if _fh_gitcheck_deadline "${FH_NODE_GIT_FETCH_DEADLINE:-8}" git -C "$FH" fetch --quiet origin >/dev/null 2>&1; then
+    _DEFAULT_BRANCH="$(git -C "$FH" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+    [ -n "$_DEFAULT_BRANCH" ] || _DEFAULT_BRANCH=main
+    if git -C "$FH" show-ref --verify --quiet "refs/heads/$_DEFAULT_BRANCH" \
+       && git -C "$FH" show-ref --verify --quiet "refs/remotes/origin/$_DEFAULT_BRANCH"; then
+      _BEHIND="$(git -C "$FH" rev-list --count "refs/heads/$_DEFAULT_BRANCH..refs/remotes/origin/$_DEFAULT_BRANCH" 2>/dev/null || echo "")"
+      case "$_BEHIND" in
+        ''|*[!0-9]*) : ;;   # not measurable — silent, not a claim
+        0) : ;;
+        *)
+          # ── auto-apply, consent-gated, inside a deliberately narrow envelope ───────────────
+          # Operator request 2026-08-15, verbatim: "사람이 일일이 수동으로 깃풀해서 최신화해야하는지를
+          # 판단하지않고 … 세션 시작 시 레포체크를 클로드가 알아서 하고 최신화 제안하는 기능이 있으면
+          # 좋을것같아. 그리고 앞으로도 자동으로 이렇게 동기화할지 물어보는 것도."
+          #
+          # 🟥 IT NEVER SWITCHES BRANCHES, and that is the whole safety envelope — not a nicety.
+          # The recommendation this line used to print told the reader to `git checkout
+          # $_DEFAULT_BRANCH && git pull`. In a SHARED CHECKOUT a checkout yanks the ground out from
+          # under a peer session: measured on this repo 2026-08-09 (two sessions, one worktree, one
+          # committed onto the other's branch), which is why scripts/branch_claim.sh exists at all.
+          # As prose advice a human weighed that; automated, nobody would. So the apply arm fires
+          # ONLY when the default branch is ALREADY checked out, and `--ff-only` means it can
+          # neither rewrite history nor absorb a divergence — it refuses instead.
+          #
+          # Consent is a LEASE, joined mechanically, never inferred: the class must be registered
+          # promotion_eligible in tracks/_meta/consent_classes.yaml AND granted unexpired in the
+          # UAP frontmatter. scripts/consent_registry_check.sh is the single decider (exit 0 = a
+          # real grant was joined; 3 = nothing granted; 1 = broken). Absent, expired, unreadable, or
+          # unknown all take the same branch as "no": surface, do not apply. absent ≠ granted.
+          # 🟥 The two conditions this replaced did NOT ask whether THIS class was granted, and a
+          # security pass before the 1.4.99 publish caught it with a live control (2026-08-15).
+          #   · a bare run of consent_registry_check.sh returns 0 for a FILE-WIDE property — "the
+          #     registry and the grants are well-formed and the floor join holds". One validly
+          #     granted UNRELATED class produces that 0.
+          #   · the second condition was `grep -q '^\s*repo-freshness-autopull:'` over the WHOLE UAP,
+          #     which does not distinguish `granted` from `revoked` and does not care whether the
+          #     hit is inside the machine-read frontmatter or in a prose paragraph.
+          # Reproduced: one unrelated class granted + the line `  repo-freshness-autopull: 안 쓰기로
+          # 했다` in prose → both conditions passed, the merge ran, and the banner told the operator
+          # it was acting on a standing consent that had never existed. The revoke path was the one
+          # that broke, which is the exact floor `absent ≠ granted` exists to hold.
+          # `--require-class` joins the ONE class: 0 only if it is an active, registered, unexpired
+          # grant; 3 otherwise. Same known pair now separates 0 from 3.
+          _AUTOPULL=""
+          if [ -x "$FH/scripts/consent_registry_check.sh" ] \
+             && bash "$FH/scripts/consent_registry_check.sh" --require-class repo-freshness-autopull >/dev/null 2>&1; then
+            _AUTOPULL=1
+          fi
+          _ON_DEFAULT=""
+          [ "$(git -C "$FH" symbolic-ref --short -q HEAD 2>/dev/null)" = "$_DEFAULT_BRANCH" ] && _ON_DEFAULT=1
+          # 🟥 NO DEADLINE HERE, AND THAT IS A DECISION — read before adding one back.
+          # A deadline was added here and then REMOVED the same session, because a cross-family
+          # review measured that the watchdog does not do what its name says: wrapping
+          # `git merge --ff-only` in `perl -e 'alarm N; exec @ARGV'` with N=2, against an upstream
+          # adding 20 files behind a slow smudge filter, took ~7.9s and returned 0. The alarm did
+          # not bound git. Shipping it would have added the appearance of a bound with none of the
+          # behaviour — the same false-green shape this release exists to fix.
+          # ⚠️ The consequence reaches further than this line: `_fh_gitcheck_deadline` guards the
+          # FETCH above too, and that guard predates this change. Whether it actually bounds a
+          # stalled fetch is now UNVERIFIED rather than assumed — a network stall may differ from a
+          # CPU-bound checkout, and neither was measured. Recorded as a residual instead of being
+          # quietly relied on.
+          # The exposure that motivated the attempt is real but unmeasured: the fetch may spend its
+          # full 8s inside a SessionStart hook budgeted at 10s, leaving ~2s for a merge whose true
+          # duration nobody has timed. Fixing it properly means measuring that duration and then
+          # bounding with something that actually bounds — not re-adding this line.
+          if [ -n "$_AUTOPULL" ] && [ -n "$_ON_DEFAULT" ] \
+             && git -C "$FH" merge --ff-only "refs/remotes/origin/$_DEFAULT_BRANCH" >/dev/null 2>&1; then
+            # Announce every unprompted run — §Operational Adaptation Loop requires it of a standing
+            # grant, and a sync the reader never saw is indistinguishable from one that never ran.
+            GIT_BEHIND_NOTE="local $_DEFAULT_BRANCH was ${_BEHIND} commit(s) behind — fast-forwarded automatically (standing consent: repo-freshness-autopull). Nothing else was touched; your gitignored state is out of git's reach by construction."
+          else
+            # Every not-applied path lands here and says the same thing: what to run. It does NOT
+            # say why it did not apply, on purpose — "no grant" and "wrong branch" and "ff refused"
+            # would each need their own true sentence, and a wrong reason printed confidently is
+            # worse than none (this file's own §absent-subject rule).
+            GIT_BEHIND_NOTE="local $_DEFAULT_BRANCH is ${_BEHIND} commit(s) behind origin/$_DEFAULT_BRANCH — while ON that branch run: git merge --ff-only origin/$_DEFAULT_BRANCH"
+          fi ;;
+      esac
+    fi
+    # no local branch named $_DEFAULT_BRANCH at all (e.g. a fork never checked it out) → silent,
+    # not measurable by this method.
+  fi
+  # fetch failure (offline / deadline hit) → silent. Detector-not-gate: absence of signal here
+  # must never be misread as "up to date" by a caller, so it prints nothing rather than a claim.
+fi
+
 # ── state write — unconditional, and a failure is reported, never swallowed ────
 # Writing only when the check speaks would make the recorded timestamp mean "last time it spoke",
 # and a write failure would make this banner repeat forever with no explanation.
@@ -161,7 +287,7 @@ if ! { mkdir -p "$(dirname "$STATE")" 2>/dev/null \
 fi
 
 # ── emit: condition (every session) OR event (once) ───────────────────────────
-[ -n "$MISS$COMPANION_NOTE$INFRA$INFRA_NOTE$IDENTITY$STATE_WARN" ] || exit 0
+[ -n "$MISS$COMPANION_NOTE$INFRA$INFRA_NOTE$IDENTITY$STATE_WARN$GIT_BEHIND_NOTE" ] || exit 0
 
 if [ -n "$MISS" ]; then
   echo "🖥️  [node] Missing mechanical floor on this machine (node: $NODE_ID): ${MISS% · }"
@@ -171,6 +297,7 @@ elif [ -n "$IDENTITY" ]; then
   echo "🖥️  [node] $IDENTITY (node: $NODE_ID) — floors present."
 fi
 [ -n "$STATE_WARN" ] && echo "    ⚠️  $STATE_WARN"
+[ -n "$GIT_BEHIND_NOTE" ] && echo "🔽 [git] $GIT_BEHIND_NOTE"
 [ -n "$COMPANION_NOTE" ] && echo "    ℹ️  $COMPANION_NOTE"
 if [ -n "$INFRA_NOTE" ]; then
   echo "    ⚠️  $INFRA_NOTE"

package/scripts/fh_session_load.sh

@@ -41,6 +41,20 @@ BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook re
                    # Resolved HERE (not at the Mode-D block below) because the frontier-digest check
                    # needs it: on a multi-node setup the digest producer may be a DIFFERENT machine.
 
+# TM = this hub's tracks-meta namespace under $BE (pmh-dev#68 PR #368 review): this reader used to
+# hardcode "tracks-meta" unconditionally, so a sibling hub reading it after sync-to-be.sh's
+# namespace fix would load FH's own session card/freshness data as if it were its own. Resolution
+# is shared with sync-to-be.sh/sync-from-be.sh via fh_hub_identity.sh. This hook's own contract is
+# "never block the first turn" (see header), so an unresolved identity degrades to the historical
+# unsuffixed "tracks-meta" rather than erroring — that is the pre-fix behavior, not a new failure
+# mode, and it only matters for a hub this file cannot even identify in the first place.
+if [ -n "$BE" ]; then
+  _FH_IDLIB="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fh_hub_identity.sh"
+  # shellcheck source=scripts/fh_hub_identity.sh
+  [ -f "$_FH_IDLIB" ] && . "$_FH_IDLIB" && fh_resolve_hub_identity 2>/dev/null
+fi
+TM="${TM:-tracks-meta}"
+
 # ── node re-entry floor check ────────────────────────────────────────────────
 # 이 검사는 scripts/fh_node_check.sh 로 분리했다. 이유: 이 파일(fh_session_load.sh)은 gitignored
 # settings.local.json 에 등록되므로 새 클론/새 기계에선 애초에 안 돈다 — 검사가 존재 이유가 되는
@@ -112,7 +126,7 @@ _fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md"
 # (2026-07-30 실측: 프로가 07-24~30 매일 정상 생산 중인데 에어는 7일 연속 FAILED 를 띄웠다.
 # 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
 # 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
-_fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
+_fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/$TM"; }; }
 # THE SECOND HALF OF THE SAME SCOPE BUG (2026-07-31). The comment above got the principle right —
 # "대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다" — and then widened the predicate by
 # exactly ONE surface (the companion store), leaving it file-only. There are TWO live producers:
@@ -226,8 +240,11 @@ CARD_EPOCH=0
 # 3) Companion files NEWER than the card, in the surfaces that carry landed results/handoffs.
 #    (paper-signals = completed experiments; handoff = cross-session/cross-machine; tracks-meta
 #    = synced session meta.) These are exactly what a stale card fails to point at.
+# ★ "$TM" (not the literal "tracks-meta") — paper-signals/handoff/digests are FH-exclusive areas
+# sync-to-be.sh never namespaces (it does not write them for any hub), only tracks-meta needs the
+# suffix here (pmh-dev#68 PR #368 review).
 NEWER=""
-for sub in paper-signals handoff tracks-meta digests; do
+for sub in paper-signals handoff "$TM" digests; do
   d="$BE/$sub"
   [ -d "$d" ] || continue
   while IFS= read -r f; do
@@ -271,6 +288,9 @@ EOF
 done
 
 # 4) INDEX.md live pointers (the operator's wiki TOC — read-first per CLAUDE.local.md).
+# Deliberately UNSUFFIXED: this is a single shared companion-store index, not a per-hub write
+# target — sync-to-be.sh never writes a $TM-namespaced copy of it, so there is nothing to namespace
+# here either (unlike tracks-meta above, which pmh-dev#68 PR #368 review flagged for exactly this).
 INDEX_HEAD=""
 if [ -f "$BE/INDEX.md" ]; then
   INDEX_HEAD="$(grep -iE 'live pointer|Live pointers' -A 8 "$BE/INDEX.md" 2>/dev/null | head -10)"

package/scripts/frontier_digest_autopilot.sh

@@ -0,0 +1,229 @@
+#!/bin/bash
+# frontier_digest_autopilot.sh — daily digest + autonomous improvement pipeline, PR-only.
+#
+# WHY: frontier-digest itself has run unattended (launchd) since 2026-06 — collecting signal
+# needs no approval. Turning a signal into an actual FH change was, until now, always a session
+# the operator had to start by hand. Operator decision (2026-08-15): push automation one stage
+# further — digest → persona-innovator → harvest-loop → 4-axis gate → PR, entirely unattended —
+# but stop at the PR. Merge stays a human decision, per CLAUDE.md §AI Contribution Model ("AI does
+# not commit directly to shared repositories") and §PR-Only Policy on main. This script is the
+# proposal-only half of that split, not an exception to it.
+#
+# THIS IS STAGE 2 OF THE EXISTING DAILY JOB, NOT A SEPARATE CRON:
+#   Stage 1 (unchanged) = frontier_digest_daily.sh — collects the digest, hardened with its own
+#   retry/watchdog/lock (see that file's header). This script calls it first, then only proceeds
+#   to Stage 2 if Stage 1 actually produced today's digest.
+#   Stage 2 (new) = a single headless `claude -p` invocation that reads the digest and, ONLY IF a
+#   concrete change survives harvest-loop's own 4-axis gate, opens a PR. No gate-passing candidate
+#   → no PR, no forced busywork (operator's explicit threshold choice: "harvest-loop이 실제 게이트를
+#   통과한 때만"). This mirrors the digest's own honesty rule (absence ≠ zero, but also: a thin
+#   signal is not manufactured into a change just to have shipped something today).
+#
+#   BACK-END SHIPPING DOCTRINE (operator, 2026-08-15): "개발의 앞단-영혼심기, 중간단-탈상관 가속화,
+#   뒷단 출하전-4단검증 및 하네스오너 리뷰" — the back end of shipping is 4-axis verification AND a
+#   standpoint-axis review, not 4-axis alone. CORRECTED same session (an earlier draft of this
+#   header named fh-meta:hub-cc-pr-reviewer here — wrong skill, caught by the operator: "내가 말한건
+#   하네스오너(너) 아니라 그 하네스에 에이전트가 들어가서 그 입장에서 리뷰한다는거야"). "하네스오너
+#   리뷰" is NOT the human operator (that gate is merge, unconditionally human, unchanged) NOR
+#   hub-cc-pr-reviewer (which checks FH's diff against FH's OWN conventions — same-repo
+#   self-consistency, a different question). It is the STANDPOINT AXIS
+#   (`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7`, the mechanism behind the
+#   if(kakao)26 keynote's p15 "(c) 탈상관의 확장" slide — "계열을 늘려도 못 잡는 결함이 있습니다,
+#   입장을 바꾸면 보입니다"): an agent actually running the diff's effect from ANOTHER harness's own
+#   repo/standpoint, which is orthogonal to family diversity and catches a documented, distinct class
+#   of defect family diversity alone does not. Wired into the Stage-2 prompt as two back-end
+#   checkpoints beyond the ordinary 4-axis gate: (1) an irreversible/load-bearing-surface diff holds —
+#   no PR, branch+signal only, operator decides whether a PR should even exist; (2) a diff that meets
+#   §7's own BEHAVIORAL trigger (alters another harness's actual behavior/gate-outcome/interaction
+#   contract — not merely a file-class match) gets a standpoint-axis pass, recorded on the closed
+#   tier1/tier2/tier2b/tier3/not-applicable/DEGRADED_* enum, before a PR opens (or folded into the
+#   held signal, if both checkpoints fire). Most ordinary digest-driven self-improvement will
+#   correctly land on `not-applicable` — that is the expected common case, not a shortfall.
+# SAFETY RAILS (why each exists) — hardened by fh-meta:challenger 2026-08-15 [S×2 fixed]:
+#   ① git status must be clean before Stage 2 starts. A shared checkout may have another session's
+#      in-progress uncommitted work — Stage 2 must never commit, stash, or otherwise touch state
+#      it did not create. Dirty tree → skip, log why, leave everything untouched.
+#   ② skip if a LIVE PEER SESSION CLAIM exists at all (branch_claim.sh show), not just if the tree
+#      is dirty. FIXED 2026-08-15: an earlier revision's header claimed branch_claim.sh protection
+#      but never actually called it — a human could have a clean-but-mid-thought tree (branch
+#      switched, nothing edited yet) and this script would have force-checked-out their branch out
+#      from under them in the EXIT trap with zero warning (challenger [S], confirmed real: the
+#      45-min Stage 2 window has no lock held the whole time — this check narrows, does not close,
+#      that TOCTOU; a peer session starting mid-run is a named residual, not fully closed). Any
+#      live peer at entry → skip Stage 2 entirely, log it, touch nothing.
+#   ③ skip if an autopilot PR is already open (branch prefix `auto/digest-improve-`) — one at a
+#      time, so a quiet week of "nothing concrete" backlog does not pile into an open-PR queue the
+#      operator has to triage. FIXED 2026-08-15: an earlier revision used
+#      `gh pr list --search 'head:auto/digest-improve-'` — GitHub's `head:` search qualifier is an
+#      EXACT branch-name match, not a prefix match, against branches that are actually named
+#      `auto/digest-improve-<full-date>` — the check would almost always find nothing and silently
+#      let PRs pile up unbounded (challenger [S], confirmed: verified via a live gh pr list --json
+#      call against this repo, see verify_next in edit_manifest.yaml). Fixed to filter headRefName
+#      client-side with jq's startswith(), which cannot have this exact-vs-prefix mismatch.
+#   ④ working tree is restored to the pre-run branch on exit (trap) ONLY IF still no live peer
+#      claim differs from where we started — re-checked at exit, not just at entry, because rail ②
+#      only guards the START of the window. If a peer claim appeared during the run, the trap logs
+#      a warning and leaves the tree where Stage 2 left it rather than yanking a now-live session's
+#      ground (mirrors branch_claim.sh's own printed guidance: "먼저 한 줄 알려라" — an unattended
+#      script cannot tell them first, so the fail-safe direction is: don't act, not: act anyway).
+#   ⑤ Stage 2 runs with --permission-mode bypassPermissions (no human present to answer a Bash
+#      approval prompt — acceptEdits, used by Stage 1, only covers Write/Edit, not git/gh). The
+#      actual floor is NOT this permission mode — it is the git hooks (pre-commit 4-axis gate,
+#      pre-push main-block, pre-push force-push block), which fire regardless of CC's own
+#      permission layer, plus merge being structurally impossible (this script and its prompt never
+#      invoke `gh pr merge`). NAMED RESIDUAL (challenger [S], not mitigated in v1 — accepted, not
+#      silently assumed covered): bypassPermissions removes CC's own approval layer for
+#      EVERYTHING, not just git in this repo — nothing here technically stops the subprocess from
+#      touching files elsewhere under this OS user (~/.ssh, other repos, arbitrary rm) or making
+#      outbound network calls beyond the git hooks' scope. The prompt instructs it not to; that is
+#      an instruction, not an enforcement boundary. Accepted for v1 because Stage 2 only fires after
+#      rails ①–③ pass and the blast radius is bounded by what a headless single-purpose prompt
+#      would plausibly do, not by a technical sandbox — revisit if this is ever wired to a more
+#      capability-rich prompt.
+#   ⑥ NAMED RESIDUAL — prompt injection via digest content (challenger [S], unmitigated): the
+#      digest ingests HN/arXiv content verbatim, and Stage 2 reads that digest under
+#      bypassPermissions with git-push/PR-create ability. Adversarial text embedded in fetched
+#      content could in principle steer the unattended session toward a misleading PR. No
+#      sanitization pass exists. Mitigant in practice: the PR is proposal-only (never merges
+#      itself) and still has to pass a real 4-axis gate with real challenger evidence — but that
+#      gate is text-based judgment, not a hard technical filter against this class.
+#   ⑦ NAMED RESIDUAL — log/secret exposure (challenger [A]): stdout+stderr of the Stage 2 claude
+#      process is captured verbatim into tracks/_meta/logs/, which a Stop hook may sync to a private
+#      companion store unattended, if one is configured. Any secret the agent happens to touch
+#      during the run propagates into a second store with no redaction pass. Accepted for v1 (same
+#      log-capture pattern as
+#      Stage 1's frontier_digest_daily.sh, already running this way since 2026-06) — revisit if
+#      Stage 2 is ever given credentials Stage 1 never touched.
+#
+# WHAT THIS DOES NOT DO: pick a "topic of the day" to force a contribution, retry on a NOT-CONVERGED
+# outcome, touch anything if Stage 1 (digest) itself failed today, or act while any live peer
+# session is claimed in this checkout.
+
+FH_DIR="${FD_FH_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+CLAUDE_BIN="${FD_CLAUDE_BIN:-$(command -v claude || echo "${HOME}/.local/bin/claude")}"
+TODAY=$(date +%Y_%m_%d)
+HUMAN_DATE=$(date +%Y-%m-%d)
+LOG_DIR="${FH_DIR}/tracks/_meta/logs"
+LOG_FILE="${LOG_DIR}/frontier_digest_autopilot_${TODAY}.log"
+mkdir -p "$LOG_DIR"
+_log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$LOG_FILE"; }
+
+# ── Stage 1: unchanged digest run ───────────────────────────────────────────
+bash "${FH_DIR}/scripts/frontier_digest_daily.sh"
+DIGEST_EXIT=$?
+if [ "$DIGEST_EXIT" -ne 0 ]; then
+  _log "Stage 1 (digest) failed (exit ${DIGEST_EXIT}) — Stage 2 skipped, nothing to act on."
+  exit "$DIGEST_EXIT"
+fi
+_log "Stage 1 (digest) OK for ${HUMAN_DATE}."
+
+cd "$FH_DIR" || { _log "cannot cd to \$FH_DIR ($FH_DIR)"; exit 1; }
+
+# ── Stage 2 preconditions (rails ① ② ③) ─────────────────────────────────────
+if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+  _log "Stage 2 SKIPPED: working tree is dirty (another session's uncommitted work may be live) — never touching it unattended."
+  exit 0
+fi
+
+# rail ②: any LIVE peer claim at all → skip. branch_claim.sh's own "show" lists each recorded
+# claim with a live/dead tag (dead = the recording session's PID no longer exists). We do not try
+# to be clever about "does the peer's branch differ from ours" here — any live peer means a human
+# is plausibly mid-thought in this exact checkout right now, full stop.
+if [ -x "${FH_DIR}/scripts/branch_claim.sh" ]; then
+  if bash "${FH_DIR}/scripts/branch_claim.sh" show 2>/dev/null | grep -q '(live)'; then
+    _log "Stage 2 SKIPPED: a live peer session claim exists in this checkout — not touching HEAD/committing while a human may be mid-thought here. Will try again on the next scheduled run."
+    exit 0
+  fi
+else
+  _log "Stage 2 SKIPPED: scripts/branch_claim.sh not found or not executable — cannot verify no live peer session, so refusing to touch the shared checkout unattended."
+  exit 0
+fi
+
+# rail ③: fixed 2026-08-15 — `gh pr list --search 'head:...'` is an EXACT-match qualifier, not a
+# prefix match, so it silently never matched our date-suffixed branch names (challenger [S]).
+# Filter client-side instead: list open PRs' head branch names, test the prefix ourselves.
+if ! command -v gh >/dev/null 2>&1; then
+  _log "Stage 2 SKIPPED: gh CLI not found — cannot check for an existing open autopilot PR, and cannot open one."
+  exit 0
+fi
+OPEN_AUTO_COUNT="$(gh pr list --state open --json headRefName \
+  -q '[.[] | select(.headRefName | startswith("auto/digest-improve-"))] | length' 2>/dev/null)"
+case "$OPEN_AUTO_COUNT" in
+  ''|*[!0-9]*)
+    _log "Stage 2 SKIPPED: could not measure open-autopilot-PR count (gh call failed/unparseable) — not measurable is not the same as zero, refusing to risk piling up a PR unseen."
+    exit 0
+    ;;
+  0) ;; # clear to proceed
+  *)
+    _log "Stage 2 SKIPPED: ${OPEN_AUTO_COUNT} autopilot PR(s) already open (branch prefix auto/digest-improve-) — one at a time, operator has not triaged it yet."
+    exit 0
+    ;;
+esac
+
+ORIG_BRANCH="$(git symbolic-ref --short HEAD 2>/dev/null || echo main)"
+# rail ④: re-check for a live peer at exit time too — a peer starting mid-run must not get its
+# ground yanked by our restorative checkout. This narrows, not closes, the TOCTOU window (see
+# header rail ② note) — a peer appearing in the few seconds between this check and the actual
+# `git checkout` call below is a residual, not claimed as fully closed.
+_fh_autopilot_exit_trap() {
+  if [ -x "${FH_DIR}/scripts/branch_claim.sh" ] \
+     && bash "${FH_DIR}/scripts/branch_claim.sh" show 2>/dev/null | grep -q '(live)'; then
+    _log "EXIT: a live peer session claim appeared during this run — leaving the tree as Stage 2 left it, NOT force-checking-out ${ORIG_BRANCH} (would yank a now-live session's ground)."
+  else
+    _log "EXIT: restoring working tree to ${ORIG_BRANCH}"
+    git checkout --quiet "$ORIG_BRANCH" 2>/dev/null
+  fi
+}
+trap _fh_autopilot_exit_trap EXIT
+
+ATTEMPT_TIMEOUT_SECS="${FD_AUTOPILOT_TIMEOUT_SECS:-2700}"
+
+# bash 3.2 (macOS default, confirmed this machine) has a known parser bug: a heredoc directly
+# inside a `$(...)` command substitution mis-tracks quote balance once the heredoc BODY contains an
+# unescaped apostrophe (e.g. "Today's") — `bash -n` fails with "unexpected EOF while looking for
+# matching `'". Writing the heredoc to a plain file first, then capturing that file's content via
+# `$(cat ...)` (a command substitution with NO heredoc inside it), sidesteps the bug entirely.
+PROMPT_FILE="${LOG_DIR}/.autopilot_prompt_${TODAY}.txt"
+cat > "$PROMPT_FILE" <<PROMPT_EOF
+[automated-run: launchd, unattended — no human present to answer prompts] Today's frontier digest just landed at tracks/_meta/frontier_digest_${TODAY}.md (or the companion-store mirror if this node is not the digest runner). Run the digest -> persona-innovator (Mode F, full: internal gap scan + external frontier) -> harvest-loop pipeline against it, exactly as documented in CLAUDE.md and the relevant SKILL.md files - do not shortcut the 4-axis gate (edit-manifest entry, a real fh-meta:challenger adversarial pass with actual evidence, not a fabricated marker).
+
+Threshold (operator's explicit choice, 2026-08-15): only act if a CONCRETE, well-scoped candidate survives harvest-loop and actually passes the 4-axis gate as a real committable diff. If nothing concrete surfaces today, do nothing further - do not manufacture a change to have shipped something. A quiet day is a correct outcome, not a failure.
+
+BACK-END CHECKPOINTS (operator instruction, 2026-08-15 - required steps on this pipeline's shipping stage, not suggestions; this is the "뒷단 출하전 = 4축검증 + 하네스오너 리뷰" doctrine, applied to an unattended run):
+
+1. IRREVERSIBILITY CHECK: does the gate-passing diff touch an IRREVERSIBLE surface per CLAUDE.md's Irreversibility Gates section (a publish/delete/history-rewrite path) OR a load-bearing surface per the Field-Harness Load-Bearing Change Gate (a verdict/gate enum or exit code, an irreversible-op path, or a safety invariant such as a floor, verdict-binding, or a pre-push/pre-commit hook)? This includes changes to the git hooks themselves (templates/.git-hooks/*), scripts a hook calls, or anything in the Irreversibility Gates / Destructive-Op Gate / Pre-Publish Gate sections of CLAUDE.md.
+   - If YES: do NOT run gh pr create at all. Create the branch, commit, push it (so the work is not lost), write a signal file at tracks/_meta/fh_signal_${HUMAN_DATE}_autopilot-irreversible-hold.md with frontmatter 'status: NEEDS-OWNER-REVIEW' naming the branch, exactly which surface it touches and why, and what the change does - then stop. No PR exists yet; the operator decides whether one should even be opened.
+
+2. STANDPOINT AXIS (knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7 - read it before applying this step, this summary is not the full spec): does the diff alter ANOTHER harness's actual behavior, gate outcome, or interaction contract (not merely touch a path that happens to be synced elsewhere - the trigger is behavioral, not file-class)? Most ordinary FH self-improvement from a digest signal will correctly land on standpoint: not-applicable - that is a correct, expected answer, not a shortfall to fix. This is a genuinely different axis from "harness-owner reviewing FH's own conventions" - it means an agent actually running the diff's effect FROM the standpoint of the OTHER harness's own repo (family diversity alone does not catch this: the mechanism behind the if(kakao)26 keynote's p15 slide "(c) 탈상관의 확장" - "계열을 늘려도 못 잡는 결함이 있습니다, 입장을 바꾸면 보입니다" - §7 is built on three field incidents where full cross-family review missed a defect that only one execution-from-the-target's-own-repo caught).
+   - If NOT applicable (the common case): record standpoint: not-applicable in the marker/signal, state briefly what was checked (per the spec's own discipline - asserting non-applicability without naming what was checked is indistinguishable from not having looked at all), and move on.
+   - If applicable: check whether a local clone of the target harness exists on this machine (e.g. under the parent of ${FH_DIR} - sibling directories like pmh-dev, qasp-dev, or similar). If one exists, run the change against THAT repo's own content/rules from its own standpoint (tier2) - this must happen BEFORE any push or gh pr create for THIS diff, same non-negotiable pre-push timing as the irreversibility check above and for the identical reason (PR #370, 2026-08-14: a post-PR standpoint review still caught 2 residency leaks that had already sat in public view before the fix - public exposure is effectively irreversible, so this cannot run after the diff is visible). If it finds anything, fix it in the local diff and re-run until clean - only then push and open the PR (or, if step 1 already routed to hold, fold the finding into that signal file instead). If no local clone of the target harness is reachable, record standpoint: DEGRADED_NO_TARGET_ACCESS (could not, not did not) and proceed - do not block indefinitely on a target you structurally cannot reach, but do not silently claim not-applicable either when it actually is applicable and merely unreachable.
+   Do NOT conflate this with fh-meta:challenger (family/adversarial-correctness axis, already required by the 4-axis gate above) or with fh-meta:hub-cc-pr-reviewer (checks FH's own diff against FH's OWN baseline conventions - a same-repo self-consistency check, not a standpoint-axis review at all). All three are different lenses; running one is not a substitute for another.
+
+3. If the diff is neither irreversible/load-bearing (step 1: NO) nor standpoint-applicable (step 2: NO or DEGRADED) - the common case, ordinary small reversible self-improvement: skip straight to branch/commit/push/PR below.
+
+In every case that reaches a PR: create branch auto/digest-improve-${HUMAN_DATE}, commit there, push it, open with gh pr create --fill, noting in the PR body which digest item motivated it. Never commit to main (the pre-push hook enforces this regardless). Do NOT run gh pr merge under any circumstances - merge is always the operator's decision. Do NOT push to main directly. Do NOT force-push. Do NOT touch any file outside what this specific candidate change requires.
+
+If you are blocked (git status was unexpectedly dirty, gh auth failed, the gate genuinely cannot converge in one pass), stop and log why - do not retry, do not fall back to a weaker gate, do not touch main.
+PROMPT_EOF
+
+PROMPT="$(cat "$PROMPT_FILE")"
+rm -f "$PROMPT_FILE"
+
+_log "Stage 2 starting (timeout ${ATTEMPT_TIMEOUT_SECS}s)"
+"$CLAUDE_BIN" -p --permission-mode bypassPermissions "$PROMPT" >> "$LOG_FILE" 2>&1 &
+CLAUDE_PID=$!
+DEADLINE=$((SECONDS + ATTEMPT_TIMEOUT_SECS))
+while kill -0 "$CLAUDE_PID" 2>/dev/null && [ "$SECONDS" -lt "$DEADLINE" ]; do
+  sleep 30 & wait $!
+done
+if kill -0 "$CLAUDE_PID" 2>/dev/null; then
+  pkill -P "$CLAUDE_PID" 2>/dev/null
+  kill "$CLAUDE_PID" 2>/dev/null
+  wait "$CLAUDE_PID" 2>/dev/null
+  _log "Stage 2 killed by watchdog (${ATTEMPT_TIMEOUT_SECS}s) — no retry (this is not the digest's hard-realtime path)."
+else
+  wait "$CLAUDE_PID"
+  _log "Stage 2 finished (exit $?)."
+fi
+
+exit 0