@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/plugins/fh-qp/skills/qp/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: qp
+description: QP (Quality Platform) router — takes a web URL or a desktop app name and runs the plan → run → regress loop (qp-plan, qp-run, qp-regress) end to end, or routes to one stage. Classifies the target (public vs profile-required), probes which adapter the session has (Playwright MCP for web, computer-use MCP for desktop), and writes every artifact with a typed engine/adapter marker. Triggers on "test this website for me", "run a QA pass on this app", "check the app end to end", "이 사이트 QA 돌려줘", "이 앱 테스트해줘", "회귀 돌려줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05) — generic edition of a field QA harness's P·A·R loop; zero domain constants
+---
+
+# qp — Quality Platform router
+
+One entry point for people who want to **dynamically test a web or desktop app with a QA lens from inside Claude Code**.
+Three stages, each its own skill, each leaving files:
+
+| stage | skill | you get |
+|---|---|---|
+| **P**lan | `qp-plan` | `qp/plan/inventory.md` (surfaces the app exposes) + `qp/plan/tcs.tsv` (test cases) |
+| **A**utomation (run) | `qp-run` | `qp/run/<ts>/verdicts.tsv` + masked evidence (DOM snapshots or screenshots) |
+| **R**egression | `qp-regress` | `qp/regress/<ts>/surface_reach.txt` + per-TC delta vs the previous run |
+
+Glossary (one line each, because a first-time reader asked): **TC** = test case · **inventory** = the list of screens/routes/menus the app exposes · **MTM** = each finding is labeled *as planned* / *differs from the plan document* / *code differs* · **precondition** = what must already be true before a step runs (logged in, page loaded), checked not assumed — a failure before it is met is `BLOCKED`, not `FAIL` · **surface_reach** = how many TCs actually left the entry screen · **engine** = which machinery drove the run (see §Engine).
+
+## Step 0 — classify the target (mechanical, never by eye)
+
+```
+bash plugins/fh-qp/scripts/qp_tools.sh target-class <https://… | app:NAME> [--profile <file>]
+```
+| result | rc | what you do |
+|---|---|---|
+| `PUBLIC` | 0 | proceed |
+| `PROFILE_OK` | 0 | proceed with the profile |
+| `PROFILE_REQUIRED` | 4 | **stop.** Say: *"this target is not public; QP needs a profile file — copy `plugins/fh-qp/qp_profile.example.yaml` to a gitignored path, fill the host/app, and re-run with `--profile`."* Do not improvise a run against a private host. |
+| `UNKNOWN` | 10 | stop, report the target form QP accepts |
+
+## Step 1 — probe the adapter (mechanical; unknown ≠ present)
+
+List the MCP tool names this session actually has (from your tool list — do not guess), then:
+```
+bash plugins/fh-qp/scripts/qp_tools.sh adapter-probe --need web|desktop --tools "<comma-separated tool names>"
+```
+`ADAPTER=… evidence=dom|pixel` → proceed and **write that line into every artifact header**.
+`HARNESS_ERROR` (rc 10) → **stop.** Write `qp/HARNESS_ERROR.txt` with the reason and tell the user which MCP to connect (Playwright MCP for web · computer-use MCP for desktop). This is not a pass and not a skip.
+
+## Engine — typed capability vs MCP fallback (form C)
+
+- If a QA harness has **registered** a typed capability whose id ends in `:par` (check `.claude/capabilities/**/*.cap` and `bash scripts/cluster_capability_scan.sh` when in an FH hub), call its `entry` and merge constraints **strictest-wins** (`capability_composition_contract.md`). Engine marker: `engine=capability:<id>`.
+- Otherwise drive the target yourself through the adapter from Step 1. Engine marker: `engine=mcp-fallback adapter=<name> evidence=dom|pixel`.
+- **As of 2026-09-05 no such capability is registered anywhere** — the fallback is the only path that exists. If the user explicitly asks for the capability engine (`--engine capability`) and none is registered → `HARNESS_ERROR reason=capability-not-registered`, never a silent fallback.
+- Desktop (`evidence=pixel`) is the **weaker edition**: no DOM, so `verify` closes only by screenshot text you can read, and surface_reach hashes screenshots, not DOM. Say so in the report header.
+
+## Step 2 — run the stages
+
+`qp <target>` = plan → run → regress in order, stopping at the first `HARNESS_ERROR`. `qp plan|run|regress <target>` = one stage. Each stage skill carries its own Done When.
+
+## Done When
+1. Target classified with a `target-class` line recorded in `qp/plan/inventory.md` header · **[mandatory-pass]** — rc is the check.
+2. Adapter probed and `ADAPTER=` or `HARNESS_ERROR` written to a file · **[mandatory-pass]** — file exists and matches the probe output.
+3. Every artifact header carries `engine=` and `evidence=` · **[measured]** — `grep -L 'engine=' qp/**/*.md qp/**/*.tsv` is empty.
+4. Stages chained in P→A→R order with no stage skipped silently · **[judged — pairing: the lane `scripts/test_fh_qp_lanes.sh` and the per-stage Done When files]**.
+
+## Independently executable
+Needs only `bash` + the session's MCP adapter. No other FH skill is required. Inside an FH hub the capability scan is optional.
+
+## Not this skill
+Mobile (deferred). Verifying FH itself (use FH's own gates). Fixing the app.

package/plugins/fh-qp/skills/qp-plan/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: qp-plan
+description: Prepare stage of QP — builds a surface inventory of a web page or desktop app (routes, menus, forms, dialogs), checks it is MECE (no overlap, nothing missing that is visible), and designs test cases as a TSV with preconditions and expected values whose SOURCE is named. Works without a spec document (then expected values come from the inventory, not a plan). Triggers on "what should I test on this page", "make a test plan for this app", "list the screens of this app", "테스트 케이스 뽑아줘", "이 화면 인벤토리 만들어줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05)
+---
+
+# qp-plan — Prepare (inventory → MECE → TCs)
+
+Input: a target that passed `qp_tools.sh target-class` (PUBLIC or PROFILE_OK) and an adapter line from `adapter-probe`. Optional: a plan/spec document path (`--plan <file>`). Optional profile.
+
+## 1. Surface inventory — observe, do not guess
+Open the entry route with the adapter (web: navigate + accessibility snapshot; desktop: screenshot). Record every **navigable surface** you can see: links/routes, menu items, buttons that open a dialog, forms, tabs. One row each:
+
+```
+| id | kind (route·menu·dialog·form·tab) | label as shown | how reached (from which surface, which action) | observed? (yes/no) |
+```
+Rules: ⓐ **do not invent routes** — a surface is listed only if you saw its trigger; ⓑ parameterised routes (`/item/:id`) are listed as `ROUTE_PARAMETERIZED`, not filled with a made-up id; ⓒ if the entry route did not load → stop with `HARNESS_ERROR reason=entry-unreachable`. Write `qp/plan/inventory.md` with the header lines `target-class: …` (the tool's literal output), `ADAPTER=… evidence=dom|pixel` (the probe's literal output), `engine=mcp-fallback` (or `engine=capability:<id>` only if the `qp` router found a registered capability — never a browser name; a floor-tier sim wrote `engine=chromium` when this line did not say so, 2026-09-05), `plan_doc: <path|NONE>`.
+
+## 2. MECE check
+Walk the inventory once more against the snapshot: any visible navigable element not in the list → add it (**missing**); any two rows reaching the same surface → merge (**overlap**). Write the count of each fix under `## MECE` in inventory.md. Zero fixes is a legitimate value; an unstated count is not.
+
+## 3. Test-case design — `qp/plan/tcs.tsv`
+Tab-separated, header row:
+```
+tc_id	surface_id	precondition	step_verb	step_target	expected	expected_source	priority
+```
+- `step_verb` ∈ `navigate click input verify` (one verb per row; a multi-step TC is several rows sharing `tc_id`).
+- `expected_source` ∈ `PLAN_DOC INVENTORY CODE HUMAN` — **where the expected value came from**. With no plan document every row is `INVENTORY` (or `HUMAN` if the user told you). This field is what lets `qp-run` label a finding *differs from plan* vs *code differs*; a TC without it cannot be run.
+- `precondition` is what must be true before step 1 (e.g. `at:/`, `logged-in`). Write `none` explicitly when there is none.
+- **At least one TC must carry a state-changing verb (`click` or `input`)** — a verify-only plan never exercises the runner (`qp_tools.sh run-verbs` enforces this on the run output).
+- Minimum: inventory ≥ 5 surfaces, TCs ≥ 3 for a first pass; say when the target is too small to reach that (a one-page site can be).
+
+## Done When
+1. `qp/plan/inventory.md` exists with the four header lines and ≥1 observed surface · **[mandatory-pass]**.
+2. `qp/plan/tcs.tsv` parses: every row has 8 fields, `step_verb` and `expected_source` in their enums, ≥1 click/input row · **[measured]** — `awk -F'\t' 'NF!=8' tcs.tsv` prints nothing; `run-verbs` on the later verdicts is OK.
+3. No surface in the inventory was invented (each has `observed? yes` or a `ROUTE_PARAMETERIZED` mark) · **[judged — pairing: a second session re-opens the entry route and diffs the inventory; the lane's residency/zero-constant grep on the plan files]**.
+
+## Independently executable
+Yes — bash + adapter. Does not need `qp-run`.

package/plugins/fh-qp/skills/qp-regress/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: qp-regress
+description: Regression stage of QP — re-executes a previous run's test cases unchanged, computes surface_reach (how many TCs left the entry screen, as a ratio over ALL TCs), and reports the per-TC delta against the earlier run so a "no change" claim is per case, not an aggregate. Triggers on "did anything regress since last run", "re-run last week's QA pass", "compare this run with the previous one", "회귀 확인해줘", "지난 런이랑 비교해줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05)
+---
+
+# qp-regress — Regression (re-run unchanged → surface_reach → delta)
+
+Input: a baseline `qp/run/<ts>/` and the same `qp/plan/tcs.tsv`. Output: `qp/regress/<ts>/`.
+
+## 1. Re-run unchanged
+Execute the baseline's TCs with `qp-run` **without editing them**. Editing a TC to make it pass is a new run, not a regression — say so if the user asks for it.
+
+## 2. surface_reach — did the batch leave the entry screen?
+```
+bash plugins/fh-qp/scripts/qp_tools.sh surface-reach qp/run/<new-ts>/evidence.tsv
+```
+| result | meaning |
+|---|---|
+| `REACHED n/n` | every TC observed a screen other than the modal (entry) one |
+| `PARTIAL k/n` | some did — report **which** did not, by tc_id |
+| `NOT_REACHED 0/n` | the whole batch sat on one screen (a login wall, a dead env). Every FAIL in that run is **unmeasured**, not a detection — write that sentence in the report |
+| `UNMEASURED` (rc 10) | no evidence file / empty — not a zero |
+Denominator is **all TCs**, including ones that never executed; write `surface_reach.txt` with the raw line.
+
+## 3. Per-TC delta — `delta.tsv`
+```
+tc_id	baseline_status	new_status	changed	note
+```
+One row per TC. `changed=yes` on any status change **or** on a same-status verdict whose `closure` moved from MACHINE to JUDGMENT (the check got weaker). A run where every row is `changed=no` may say "no regression"; a run reported only as "12 PASS both times" may not — the aggregate hides a swap.
+
+## 4. Report — `report.md`
+First 8 lines: target · engine/adapter/evidence · `#mtm:` state · surface_reach line · counts PASS/FAIL/BLOCKED/AMBIGUOUS new vs baseline · number of `changed=yes` · the sentence for NOT_REACHED if it applies · what was **not** measured (unexecuted TCs, dropped screenshots).
+
+## Done When
+1. `surface_reach.txt` holds a `REACHED|PARTIAL|NOT_REACHED|UNMEASURED` line produced by the tool · **[mandatory-pass]**.
+2. `delta.tsv` has one row per TC in the baseline · **[measured]** — row count equals distinct tc_ids.
+3. A NOT_REACHED run's report contains the "FAILs are unmeasured" sentence · **[measured]** — grep.
+4. The delta's `changed` column reflects real behavior change, not selector drift · **[judged — pairing: for each `changed=yes`, the before/after DOM snapshots are attached and a second session confirms the element moved, not the locator]**.
+
+## Independently executable
+Yes — needs a baseline run dir in the documented shape and bash.

package/plugins/fh-qp/skills/qp-run/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: qp-run
+description: Automation stage of QP — executes the test cases from qp-plan against the live app through the session's adapter (Playwright MCP for web, computer-use MCP for desktop), records one verdict per step with a closed status, an MTM branch, whether the step was closed by machine evidence or left to judgment, and masks emails/tokens/passwords out of the evidence before saving. Triggers on "run these test cases", "execute the QA plan against the site", "drive the app through the TCs", "TC 실행해줘", "플랜대로 돌려줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05)
+---
+
+# qp-run — Automation (execute → verdict → mask)
+
+Input: `qp/plan/tcs.tsv` + the adapter/engine lines from `qp/plan/inventory.md`. Output dir: `qp/run/<YYYYMMDD-HHMM>/`.
+
+## 0. MTM state — decide once, write it first
+`#mtm:` is the first line of `verdicts.tsv`:
+| value | when |
+|---|---|
+| `ACTIVE` | a plan document was given **and** you opened it (path recorded) |
+| `UNAVAILABLE` | no plan document — expected values come from the inventory; the branch *differs from plan* is **unreachable** and the vocabulary collapses to AS_PLANNED / CODE_DIFFERS |
+| `FAILED` | a plan document was given but could not be read — say so; do not fall back silently |
+| `DISABLED` | the user turned it off (reason recorded) |
+`UNAVAILABLE` and `FAILED` are different events; never merge them.
+
+## 1. Precondition first — attribution, not blocking
+Before step 1 of each TC, establish its `precondition`. Navigation you can do (`at:/about`) you do; state you cannot create (`logged-in`, `has-an-order`) you mark `UNMET_UNEXECUTABLE`. A step-1 failure under an unmet precondition is **`BLOCKED`**, not `FAIL` — you never reached the screen, so it is not a claim about the app. Only step 1 is re-attributed; later steps failed after arrival.
+
+## 2. Execute each step, observe before and after
+web: accessibility snapshot before → action → snapshot after. desktop: screenshot before/after. Save each observation as `<tc_id>_step<N>_{before,after}.{md,png}` and append its stable id from `bash plugins/fh-qp/scripts/qp_tools.sh screen-id <file>` (a content hash — Playwright MCP ref tokens change every navigation, so a raw file hash is NOT stable; measured 2026-09-05) to `evidence.tsv` (`tc_id<TAB>step<TAB>screen_hash`) — this file is what `qp-regress` reads.
+
+## 3. Verdict row per step — `verdicts.tsv` (7 tab-separated fields)
+```
+tc_id	status	branch	closure	verb	assertion	expected_source
+```
+- `status` ∈ `PASS FAIL BLOCKED AMBIGUOUS` (AMBIGUOUS = could not map the step to one element: 0 candidates or a tie).
+- `branch` ∈ `AS_PLANNED DIFFERS_FROM_PLAN CODE_DIFFERS NONE`. `DIFFERS_FROM_PLAN` only under `#mtm: ACTIVE` and only with `expected_source=PLAN_DOC`. `CODE_DIFFERS` needs `expected_source` `CODE` or `PLAN_DOC`. `NONE` only for BLOCKED/AMBIGUOUS.
+- `closure` = `MACHINE` **only if** `assertion` names the check that closed it (`text-visible:About`, `url==…`, `element-count==3`). An empty assertion with `MACHINE` is invalid — that is the muscle-not-skeleton hole this field exists to close. Everything you decided by reading a screenshot is `JUDGMENT`.
+- Validate before you finish: `bash plugins/fh-qp/scripts/qp_tools.sh mtm-check verdicts.tsv` must print `OK`; `run-verbs verdicts.tsv` must print `OK` (≥1 click/input actually executed).
+
+## 4. Mask, then save — original 0
+Every text artifact goes through `qp_tools.sh mask <in> <out>` and only `<out>` is kept; delete `<in>`. `RESIDUE` (rc 5) → do not keep the file; report which artifact. Typed secret values (from the profile's `*_env`) are read from the environment at type-time and never written. Screenshots that show a filled password field are kept only if the field is masked in the image (crop or overlay); otherwise drop the screenshot and say so.
+
+## Done When
+1. `verdicts.tsv` passes `mtm-check` and `run-verbs` · **[mandatory-pass]** — rc 0 both.
+2. `evidence.tsv` has ≥1 row per executed TC · **[measured]**.
+3. Masking: `grep -cE '@|Bearer|eyJ' <saved artifacts>` is 0 outside `__REDACTED_*__` markers · **[measured]** — the lane reproduces it on a known-dirty fixture.
+4. Every BLOCKED verdict names its unmet precondition; every JUDGMENT closure says what was read · **[judged — pairing: `qp-regress` re-runs the same TCs and flags verdicts that flip without a DOM change; a second session reviews BLOCKED rows against the before-snapshots]**.
+
+## Independently executable
+Yes, given a `tcs.tsv` in the documented shape (hand-written is fine) and an adapter.

package/scripts/backtick_guard.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# backtick_guard.sh — PreToolUse(Bash) advisory: a backtick inside a shell double-quoting context.
+#
+# THE DEFECT
+#   In an unquoted heredoc body (`<<EOF`) or a "double-quoted string", a backtick is COMMAND
+#   SUBSTITUTION: the text between the backticks is REPLACED by that command's output. Written as
+#   markup (`--flag`, `file.sh`), it names no command, so the output is empty and the text is
+#   DELETED — the sentence stays grammatical, only its subject is gone. The one signal is a
+#   `command not found` line at the TOP of the output, where it reads as unrelated noise. Every
+#   record hook (marker · manifest · completed-log) checks a field's PRESENCE, not its completeness,
+#   so the hole commits. Measured 7×: 2026-08-10 (lane stub, stderr noise) · 2026-09-01 ×3 (marker,
+#   failure-message string, seal) · 2026-09-02 ×4 (marker, RESULT doc, fh_completed echo ×2).
+#
+# WHY A HOOK AND NOT A MEMORY RULE
+#   The memory rule existed since 08-10 and was re-read the day of each recurrence. It failed every
+#   time for the same reason: recall is grep, and the actor's task carried a different NAME (writing
+#   a marker · a failure message · a seal) than the rule's title (heredoc). N=7 ≥ 3 → mechanize
+#   (weekly_audit_2026-09-02 HIGH #1). The surface is the Bash tool call, where every recurrence
+#   lived (see KNOWN RESIDUALS for the two that may not have been).
+#
+# TWO RULES
+#   BT1 — unquoted heredoc body: `<<TAG` / `<<-TAG` whose tag is NOT quoted (`'TAG'` `"TAG"` `\TAG`).
+#         A `\`` inside is literal and not flagged. Body ends at a line equal to TAG (`<<-` strips
+#         leading tabs). Several heredocs on one line are queued in order (shell semantics).
+#   BT2 — double-quoted string containing an unescaped backtick. Single-quoted text is literal.
+#         `$( … )` inside double quotes re-enters normal parsing, so a single-quoted backtick
+#         there is literal and not flagged.
+#   Both rules come from ONE quote-aware state machine (N · single · double · $'…' · heredoc
+#   body), not a regex — the defect IS a quoting context, so a quote-blind matcher would flag the
+#   exact prescription (`printf '%s' '…`…`…'`). A heredoc operator counts only in normal context,
+#   comments (`#` at a word start) are skipped, and a quoted heredoc body is skipped whole.
+#   KNOWN RESIDUALS (named, not hidden — several found by the Axis-2 pass of 2026-09-03):
+#   · a bare backtick outside any quote (V=`date`), or inside `$( )` re-entered from double quotes,
+#     is live substitution written on purpose — NOT flagged (an earlier header said BT2; the code
+#     never did, and the code is the intent).
+#   · `# noqa: backtick` exempts the WHOLE payload, including when the phrase appears inside a
+#     record being written (quoting this header's own prescription into a marker exempts that
+#     marker's payload). Same accepted residual as destructive_pre_gate's noqa.
+#   · python3 broken/absent → CMD="" → silent exit 0 even under FH_BACKTICK_BLOCK=1: block mode
+#     fails OPEN on a dead interpreter, the same accepted trade as pipe_verdict_guard (the
+#     alternative blocks every Bash call on such a machine).
+#   · surface = the Bash tool call. Of the 7 measured recurrences, at least 5 were composed Bash
+#     commands; the 2026-08-10 one lived in a shipped lane file (`test_sidecar_calibrate_lanes.sh`,
+#     git log -S confirms) and the 09-01 failure-message one in a script — if those were authored
+#     through Write/Edit, this hook is not on that path. Coverage claim is therefore «the composed
+#     command surface», not 7/7; a file-side scanner is a separate, unbuilt instrument.
+#   · three JSON-emitting PreToolUse(Bash) hooks now fire on every call (pipe_verdict ·
+#     destructive_pre_gate · this one); concurrent emission is unverified at runtime (LOW).
+#
+# DEGRADE DIRECTION: advisory. Warns and exits 0 — a mangled write is re-runnable, and a false block
+#   on the developer's shell trains --no-verify on the hooks that guard irreversible surfaces.
+#   FH_BACKTICK_BLOCK=1 escalates to exit 2. Unparseable payload → silent (not a finding).
+#   DELIVERY: JSON on stdout — additionalContext (model) + systemMessage (user), no
+#   permissionDecision (same contract as pipe_verdict_guard; see its header for why).
+#
+# PRESCRIPTION (memory feedback_unquoted_heredoc_backtick_executes, 4th revision):
+#   ① heredoc → `<<'EOF'`; a value that must expand (hash, time) is computed FIRST into a variable
+#     and substituted after, or printed on its own line — never opened unquoted for one value.
+#   ② one-line append → `printf '%s\n' '…'` (single quotes), not `echo "…"`.
+#
+# Usage:
+#   hook:  PreToolUse matcher "Bash" → bash scripts/backtick_guard.sh
+#   test:  printf '%s' "<command>" | bash scripts/backtick_guard.sh --stdin-raw
+# Opt out on a single call with a trailing `# noqa: backtick` (exempts the whole payload).
+
+set -u
+
+CMD=""
+if [ "${1:-}" = "--stdin-raw" ]; then
+  CMD=$(cat)
+else
+  RAW=$(cat)
+  CMD=$(printf '%s' "$RAW" | python3 -c '
+import json,sys
+try: d = json.load(sys.stdin)
+except Exception: sys.exit(0)
+if d.get("tool_name") != "Bash": sys.exit(0)
+sys.stdout.buffer.write((d.get("tool_input", {}).get("command", "") or "").encode("utf-8"))
+' 2>/dev/null) || CMD=""
+fi
+[ -n "$CMD" ] || exit 0
+printf '%s' "$CMD" | grep -qE '#[[:space:]]*noqa:?[[:space:]]*backtick' && exit 0
+
+# The scanner. Emits one line per finding: "<rule>\t<line>\t<snippet>". Empty output = clean.
+hits=$(printf '%s' "$CMD" | PYTHONIOENCODING=utf-8 python3 -c '
+import re, sys
+text = sys.stdin.read()
+L = len(text)
+findings = []
+# ONE quote-aware pass. Contexts: N normal · S single-quoted · D double-quoted · A $\x27…\x27 ANSI-C.
+# A heredoc operator is recognised ONLY in N (so `"<<EOF"` in a commit message opens nothing), and
+# its body is consumed line-by-line when the operator line ends — quoted bodies are skipped whole,
+# unquoted bodies are scanned for a live backtick (`\\` escapes the next char, so `\\\\`+backtick is live).
+HD = re.compile(r"<<(-?)[ \t]*(?:\x27([^\x27\n]*)\x27|\"([^\"\n]*)\"|\\\\([A-Za-z_][A-Za-z0-9_]*)|([A-Za-z_][A-Za-z0-9_]*))")
+st = ["N"]; depth = []   # depth: paren depth per $( ) nesting opened from D
+pending = []             # (tag, quoted, strip_tabs) heredocs opened on the current line, in order
+line = 1
+k = 0
+def snippet(i):
+    return text[max(0, i-30):i+31].replace("\n", " ").strip()[:90]
+while k < L:
+    c = text[k]
+    top = st[-1]
+    if c == "\n":
+        line += 1; k += 1
+        if pending and top == "N":
+            for tag, quoted, strip_tabs in pending:
+                while k < L:
+                    e = text.find("\n", k)
+                    if e < 0: e = L
+                    ln = text[k:e]
+                    cmp_ = ln.lstrip("\t") if strip_tabs else ln
+                    if cmp_ == tag:
+                        k = e + 1; line += 1; break
+                    if not quoted:
+                        j = 0
+                        while j < len(ln):
+                            if ln[j] == "\\": j += 2; continue
+                            if ln[j] == "`":
+                                findings.append(("BT1", line, ln.strip()[:90])); break
+                            j += 1
+                    k = e + 1; line += 1
+            pending = []
+        continue
+    if top == "S":
+        if c == "\x27": st.pop()
+        k += 1; continue
+    if top == "A":
+        if c == "\\": k += 2; continue
+        if c == "\x27": st.pop()
+        k += 1; continue
+    if c == "\\":
+        k += 2; continue
+    if top == "D":
+        if c == "\"": st.pop(); k += 1; continue
+        if text.startswith("$(", k): st.append("N"); depth.append(1); k += 2; continue
+        if c == "`": findings.append(("BT2", line, snippet(k))); k += 1; continue
+        k += 1; continue
+    # top == N
+    if c == "#" and (k == 0 or text[k-1] in " \t\n;&|(" ) and not depth:
+        e = text.find("\n", k); k = L if e < 0 else e; continue
+    if text.startswith("$\x27", k): st.append("A"); k += 2; continue
+    if c == "\x27": st.append("S"); k += 1; continue
+    if c == "\"": st.append("D"); k += 1; continue
+    if text.startswith("$(", k):
+        if depth: depth[-1] += 1
+        k += 2; continue
+    if c == "(" and depth: depth[-1] += 1; k += 1; continue
+    if c == ")" and depth:
+        depth[-1] -= 1
+        if depth[-1] == 0: depth.pop(); st.pop()
+        k += 1; continue
+    if c == "<" and text.startswith("<<", k) and not text.startswith("<<<", k) and (k == 0 or text[k-1] != "<"):
+        m = HD.match(text, k)
+        if m:
+            dash, q1, q2, esc, bare = m.groups()
+            tag = q1 if q1 is not None else (q2 if q2 is not None else (esc if esc is not None else bare))
+            pending.append((tag, (q1 is not None) or (q2 is not None) or (esc is not None), dash == "-"))
+            k = m.end(); continue
+    k += 1
+seen = set()
+for r, l, s in findings:
+    if (r, l) in seen: continue
+    seen.add((r, l)); print("%s\t%d\t%s" % (r, l, s))
+' 2>/dev/null) || hits=""
+[ -n "$hits" ] || exit 0
+
+msg="  ⚠️  BACKTICK — 셸 이중인용 문맥 안의 백틱은 «명령 치환»이다: 그 자리 텍스트가 명령 출력으로 바뀐다(명령 없으면 삭제·있으면 오삽입). 실측 7회, 마커·기록에 구멍이 뚫린 채 커밋됐다.
+"
+while IFS=$'\t' read -r rule ln snip; do
+  [ -n "$rule" ] || continue
+  case "$rule" in
+    BT1) what="비인용 heredoc 본문";;
+    BT2) what="큰따옴표 문자열";;
+    *)   what="$rule";;
+  esac
+  msg="${msg}      ${rule} L${ln} (${what}): ${snip}
+"
+done <<< "$hits"
+msg="${msg}      처방: heredoc 은 <<'EOF' 로 열고 확장할 값(해시·시각)은 «먼저 변수로 계산해» 뒤에 치환 · 한 줄 append 는 printf '%s\\n' '…'(작은따옴표). 의도된 치환이면 # noqa: backtick
+"
+
+if [ "${FH_BACKTICK_BLOCK:-0}" = "1" ]; then
+  printf '%s' "$msg" >&2
+  exit 2
+fi
+json_out=$(printf '%s' "$msg" | PYTHONIOENCODING=utf-8 python3 -c '
+import json, sys
+h = sys.stdin.read()
+print(json.dumps({"systemMessage": h, "hookSpecificOutput": {"hookEventName": "PreToolUse", "additionalContext": h}}))
+' 2>/dev/null)
+if [ -n "$json_out" ]; then printf '%s\n' "$json_out"; exit 0; fi
+printf '%s' "$msg" >&2
+exit 0

package/scripts/chamber_run.sh

@@ -168,12 +168,17 @@ fi
 _stamp "step-4-done"; echo "  ✓ step 4: $NPERS blind persona sections present (isolation-gate satisfied)"
 _witness_record "$WS/SIM_NOTES.md"
 
-# STEP 5 — Emission Gate. Require a VERDICT: EMIT | PARTIAL-EMIT | KILL.
+# STEP 5 — Emission Gate. Require a VERDICT: EMIT | PARTIAL-EMIT | KILL | CURATED | NOT-APPLICABLE.
+# 🟥 2026-09-04: the doctrine re-routed two outcomes on 2026-08-17 (§3-SCREEN-2026-08-17 — net-new
+#    shortfall → CURATED, judgment-shaped candidate → NOT-APPLICABLE) and this regex kept parsing the
+#    OLD vocabulary for 18 days; run #16 had to file «KILL + CURATED 재료 동봉» to get past it, and the
+#    pre-registered taxonomy known-pair (5 old runs → CURATE) could not be replayed at all. A runner that
+#    rejects the doctrine's own words is [[feedback_rule_misdescribes_its_own_machine]] in the code half.
 if [ ! -f "$WS/EMISSION_VERDICT.md" ]; then
   cat > "$WS/EMISSION_VERDICT.md" <<EOF
 # Emission Gate Verdict — $SLUG (chamber run)
 
-VERDICT: <EMIT | PARTIAL-EMIT | KILL>
+VERDICT: <EMIT | PARTIAL-EMIT | KILL | CURATED | NOT-APPLICABLE>
 
 ## Judged: does the simulation hold?  (+ mechanical anchor: overlap grep / gate verdicts / reproduced flows)
 
@@ -183,11 +188,11 @@ EOF
   echo "  ⛔ step 5 BLOCKED: decide WITH the operator (HITL), record VERDICT in $WS/EMISSION_VERDICT.md, re-run."; exit 1
 fi
 # PARTIAL-EMIT listed FIRST in every alternation so it is never mis-extracted as its EMIT substring.
-VERDICT=$(grep -ioE '^VERDICT:[[:space:]]*(PARTIAL-EMIT|EMIT|KILL)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | head -1 | grep -ioE 'PARTIAL-EMIT|EMIT|KILL' | head -1 | tr 'a-z' 'A-Z')
+VERDICT=$(grep -ioE '^VERDICT:[[:space:]]*(PARTIAL-EMIT|EMIT|KILL|CURATED|NOT-APPLICABLE)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | head -1 | grep -ioE 'PARTIAL-EMIT|EMIT|KILL|CURATED|NOT-APPLICABLE' | head -1 | tr 'a-z' 'A-Z')
 # a bare "## Verdict:" prose line (run #3 style) also counts if it names KILL/EMIT
-[ -z "$VERDICT" ] && VERDICT=$(grep -ioE 'VERDICT[: *]+\**(PARTIAL-EMIT|EMIT|KILL)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | grep -ioE 'PARTIAL-EMIT|EMIT|KILL' | head -1 | tr 'a-z' 'A-Z')
+[ -z "$VERDICT" ] && VERDICT=$(grep -ioE 'VERDICT[: *]+\**(PARTIAL-EMIT|EMIT|KILL|CURATED|NOT-APPLICABLE)' "$WS/EMISSION_VERDICT.md" 2>/dev/null | grep -ioE 'PARTIAL-EMIT|EMIT|KILL|CURATED|NOT-APPLICABLE' | head -1 | tr 'a-z' 'A-Z')
 if [ -z "$VERDICT" ]; then
-  echo "  ⛔ step 5 BLOCKED: no VERDICT (EMIT|PARTIAL-EMIT|KILL) found in $WS/EMISSION_VERDICT.md, re-run."; exit 1
+  echo "  ⛔ step 5 BLOCKED: no VERDICT (EMIT|PARTIAL-EMIT|KILL|CURATED|NOT-APPLICABLE) found in $WS/EMISSION_VERDICT.md, re-run."; exit 1
 fi
 _stamp "step-5-done"; echo "  ✓ step 5: Emission Gate verdict = $VERDICT"
 _witness_record "$WS/EMISSION_VERDICT.md"
@@ -269,6 +274,10 @@ case "$VERDICT" in
                 echo "                 existing asset / the skeleton (no new asset). Workspace stays as evidence." ;;
   KILL) echo "TERMINUS (KILL): first-class success — a cheap run prevented a speculative/reinvention build."
         echo "                 No emit. Workspace stays as the evidence record; seen-filter will skip re-listing it." ;;
+  CURATED) echo "TERMINUS (CURATED): net-new shortfall is not a kill (§3-SCREEN-2026-08-17) — hand the maker the"
+           echo "                 prior-art list, the closest existing asset, and the delta it does not cover." ;;
+  NOT-APPLICABLE) echo "TERMINUS (NOT-APPLICABLE): judgment-shaped candidate — not this incubator's output form."
+                  echo "                 Route to doctrine (a rule/lens), not to a build. Workspace stays as evidence." ;;
 esac
 echo "chamber run '$SLUG' COMPLETE (STATUS: step-7-done, verdict $VERDICT)."
 # EMIT/PARTIAL-EMIT 인데 순서 증인이 없으면 **비영 종료**한다. KILL 은 영향 없다 —

package/scripts/com.forge-harness.live-eval.plist

@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Replace every /path/to/... below with your own absolute paths before installing.
+         Follows the same template shape as scripts/com.forge-harness.daily-report.plist —
+         see that file's own comments for the general launchd-on-macOS caveats (sleep/wake
+         does not guarantee the exact minute, StandardOutPath dirs must pre-exist). -->
+    <key>Label</key>
+    <string>com.forge-harness.live-eval</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>/path/to/forge-harness/scripts/probe_live_eval.sh</string>
+        <!-- 🟥 COST + API-KEY DECISION IS THE OPERATOR'S — this template ships with NO default
+             --subset/--ids limiter, i.e. installing it as-is runs the FULL selected set (12
+             probes x 2 calls = 24 live `claude -p` invocations) every night. Read
+             scripts/probe_live_eval.sh's own header (§COST) before installing, and add a
+             --subset N or --ids P1,P2 argument here if a nightly full-set run is not what you
+             want. This plist is a template, not a recommendation of scope. -->
+        <!-- 🟥 reps=3 (2026-09-06). 이 인자가 없으면 reps=1 이고, 그때의 pass_rate 로는 문턱을
+             정할 수 없다 — 실측: 유효 런 3 개 재채점에서 12 프로브 중 5 개가 flaky, 같은 코퍼스
+             15 분 간격 두 런에서 4 개가 뒤집혔고 관측 pass_rate 는 0.50/0.67/0.67 이었다(단일 rep
+             노이즈 폭 > 문턱까지의 거리). 판정은 과반, 분산은 리포트 `reps(pass/ran)` 칸에 남는다.
+             ⚠️ 비용이 3 배다: 24 → **72** 회 `claude -p`. 줄이려면 --subset/--ids 를 같이 줘라. -->
+        <string>--reps</string>
+        <string>3</string>
+    </array>
+
+    <!-- 매일 02:30 (야간, 다른 cron 과 안 겹치는 시간대 — frontier-digest=09:00, daily-report=07:30
+         과 분리). 잠자는 중이면 launchd 가 깨어난 뒤 한 번 돌린다(정각 보장 아님). -->
+    <key>StartCalendarInterval</key>
+    <dict>
+        <key>Hour</key><integer>2</integer>
+        <key>Minute</key><integer>30</integer>
+    </dict>
+
+    <key>RunAtLoad</key>
+    <false/>
+
+    <key>StandardOutPath</key>
+    <string>/path/to/forge-harness/tracks/_meta/logs/live_eval_out.log</string>
+    <key>StandardErrorPath</key>
+    <string>/path/to/forge-harness/tracks/_meta/logs/live_eval_err.log</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <!-- must include wherever `claude` and `python3` resolve for this user.
+             /opt/homebrew/bin included so Homebrew's `gtimeout` (Apple Silicon prefix; Intel's
+             /usr/local/bin is already below) resolves — stock macOS ships no `timeout(1)` at
+             all, and scripts/probe_live_eval.sh's runner (sim_isolated_run.sh) falls back to a
+             bash-native watchdog if NEITHER resolves, so this is an optimization, not a hard
+             requirement: the run still enforces its timeout without this entry, just via the
+             slower fallback path. See sim_isolated_run.sh's own §timeout(1) RESOLUTION header
+             (measured 2026-09-05: the first unpatched run here died 12/12 FAILED-TO-RUN because
+             this PATH had neither `timeout` nor `gtimeout` AND the fallback did not exist yet). -->
+        <string>/path/to/home/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <key>HOME</key>
+        <string>/path/to/home</string>
+    </dict>
+</dict>
+</plist>
+
+<!--
+INSTALL (manual — no launchd_wiring_check.sh render- helper exists for this plist yet; unlike
+com.forge-harness.daily-report.plist, this one is not wired into that renderer, so every
+/path/to/... above must be hand-edited before `launchctl load`):
+
+  1. cp scripts/com.forge-harness.live-eval.plist ~/Library/LaunchAgents/com.forge-harness.live-eval.plist
+  2. Edit every /path/to/... above to this checkout's absolute path and your $HOME.
+  3. mkdir -p tracks/_meta/logs   (StandardOutPath/StandardErrorPath dirs must pre-exist)
+  4. launchctl load ~/Library/LaunchAgents/com.forge-harness.live-eval.plist
+  5. Verify: launchctl list | grep com.forge-harness.live-eval
+
+UNINSTALL:
+  launchctl unload ~/Library/LaunchAgents/com.forge-harness.live-eval.plist
+  rm ~/Library/LaunchAgents/com.forge-harness.live-eval.plist
+
+The nightly run appends its record to tracks/_meta/live_eval_<date>.md (created fresh each run —
+not append-only; a stale prior day's file is left alone, per date, exactly like
+tracks/_meta/daily_report_<date>.md and tracks/_meta/frontier_digest_<date>.md).
+-->

package/scripts/compaction_probe.sh

@@ -70,41 +70,15 @@ do_seal() {
 
     echo "## 운영자 발화 (이 세션)"
     if [ -f "$transcript" ]; then
-      python3 - "$transcript" <<'PY' 2>/dev/null || echo "- (전사본 파싱 실패 — 원본: $transcript)"
-import json,sys
-n=0
-skipped_tool=skipped_meta=skipped_other=0
-for line in open(sys.argv[1], errors='replace'):
-    try: d=json.loads(line)
-    except Exception: continue
-    if d.get('type')!='user': continue
-    m=d.get('message') or {}
-    c=m.get('content')
-    # ⚠️ 초판은 "실발화=str · 툴결과=list" 로 갈랐다. **틀렸다** — 이미지/파일을 첨부한 실발화는
-    # list 다(high 리뷰 실측: 전사본 25개에서 그런 발화 18건이 구조적으로 안 보였다). 더 나쁜 건
-    # self-test 픽스처가 같은 가정을 인코딩해서 **초록이 그 결함을 보증**했다는 것이다.
-    # 이제 list 는 text 블록을 꺼내 쓰고, tool_result 만 제외한다.
-    if isinstance(c,str):
-        t=c
-    elif isinstance(c,list):
-        if any(isinstance(b,dict) and b.get('type')=='tool_result' for b in c):
-            skipped_tool+=1; continue
-        parts=[b.get('text','') for b in c if isinstance(b,dict) and b.get('type')=='text']
-        if not parts:
-            skipped_other+=1; continue          # 이미지-only 등 — 셈에서 지우지 않고 센다
-        t=' '.join(parts)
-    else:
-        skipped_other+=1; continue
-    t=' '.join(t.split())
-    if not t: skipped_other+=1; continue
-    if t.startswith('<') or t.startswith('/'):   # 슬래시 커맨드·메타 봉투 제외
-        skipped_meta+=1; continue
-    n+=1
-    print(f"{n}. {t[:200]}")
-# **제외분을 반드시 인쇄한다.** 합계만 찍으면 그 원장이 완전한 것처럼 읽힌다 — `not found ≠ 0`.
-print(f"\n합계: {n}건" if n else "- (발화 0건)")
-print(f"제외: tool_result {skipped_tool} · 메타/커맨드 {skipped_meta} · 텍스트없음 {skipped_other}")
-PY
+      # 🟥 추출 로직은 `scripts/transcript_utterances.py` 가 **단일 소스**다 (2026-09-05).
+      #    인라인 heredoc 이었을 때 두 번째 소비처(`utterance_intake.sh` — 발화 착지 검사)를
+      #    붙이려면 사본이 생겼고, 전처리 두 벌은 «한쪽만 통과하는 입력이 다른 쪽에서 무음
+      #    드롭» 이다(`[[feedback_divergent_leniency_duplicate_normalizers]]`).
+      #    출력은 **바이트 동일**해야 한다 — `scripts/test_utterance_intake_lanes.sh` L10 이
+      #    골든으로 고정하고, L12/L12b 가 되돌림으로 «정말 이 파일을 통해 도는가» 를 잰다.
+      #    추출기가 없거나 죽으면 비영 종료 → 아래 폴백 문구가 그대로 뜬다(무음 아님).
+      python3 "$REPO_ROOT/scripts/transcript_utterances.py" "$transcript" --format seal 2>/dev/null \
+        || echo "- (전사본 파싱 실패 — 원본: $transcript)"
     else
       echo "- 🟥 전사본 경로 없음: $transcript"
     fi