@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/scripts/sim_isolated_run.sh

@@ -46,6 +46,18 @@
 #       same clone, --tools "", no --restricted   → "🐿️"                  (memory PRESENT)
 #   One variable, opposite answers. ([[feedback_instrument_cannot_discriminate_hypotheses]])
 #
+# 🟥 THE SAME FLAG ALSO KILLS `act` MODE'S WRITE PATH — measured 2026-09-03, known-pair.
+#   `--restricted` ignores settings for PERMISSIONS too, not just memory, and `-p` has no TTY to
+#   ask a human — so `act`+`--no-harness` cannot Write/Edit AT ALL, regardless of what the model
+#   decides. Confirmed with one variable (`--restricted` on/off, same prompt, same --tools): Edit
+#   succeeds without it; with it every rep says "The edit was blocked — permission to write to
+#   file.txt wasn't granted." Deterministic, not a race — this is why a real run reads 5/5.
+#   ⇒ A "did not edit" result from `act --no-harness` is NOT evidence the base model chose not to
+#   write. Use `--no-harness` as an observe-mode control (memory presence, per the pair above)
+#   only — never to ask whether a write would have happened. Workaround not built: `--restricted`
+#   still honors an explicit `--settings <file>` (per `claude --help`), so a minimal file carrying
+#   only Write/Edit approval could restore act-mode fidelity here — filed, not implemented.
+#
 # 🟢 AND THE DEFECT IS REUSABLE AS AN INSTRUMENT. `--no-harness` answers a question this repo
 #   asks constantly and usually by eye: **does this behaviour come from FH, or would the base
 #   model have done it anyway?** Run the same prompt with and without the flag; a behaviour that
@@ -69,17 +81,91 @@
 #   FH defect (a normal session has Bash and can `ls`) — but scoring an arm without knowing it
 #   produces a confident zero from a fixture that was never observable.
 #
-# 🟥 PROJECT HOOKS DO NOT RUN IN A DISPOSABLE CLONE — so this runner cannot measure anything
-#   that depends on one. Measured 2026-08-30: an arm copied `.claude/settings.json` into its clone
-#   to make the PreToolUse PriorArt hook live; not one of the three clones grew
-#   `.claude/.prior_art_events.tsv`, while the live repo's copy carries entries from the same hour.
-#   The hook never fired, so the "hook vs no-hook" contrast was HOOK ≡ NOHOOK and either verdict
-#   would have been false. ⇒ Before claiming a hook-dependent result, check the hook's own
-#   evidence file INSIDE the clone; absence of that file invalidates the arm, not the hypothesis.
+# 🟥 PROJECT HOOKS DO RUN IN A DISPOSABLE CLONE — an earlier version of this paragraph said the
+#   opposite, and it was wrong (RETRACTED 2026-09-03). It read: "PROJECT HOOKS DO NOT RUN IN A
+#   DISPOSABLE CLONE … measured 2026-08-30: an arm copied `.claude/settings.json` into its clone to
+#   make the PreToolUse PriorArt hook live; not one of the three clones grew
+#   `.claude/.prior_art_events.tsv`". That absence was read as "hooks never fire here" with NO
+#   control arm whose hook was known to fire — and it narrowed two rounds of the identity-⑤
+#   design (the hook-layer arm was declared unmeasurable). Known pair, 2026-09-03: a PreToolUse
+#   Bash hook that appends to `$CLAUDE_PROJECT_DIR/_hook_evidence.txt`, installed via
+#   `--setup 'cp <settings.json> .claude/settings.json'`, FIRED inside this runner's own clone
+#   (act mode, deny settings.local.json present) and in a bare `claude -p` clone, trusted or not.
+#   Why the 2026-08-30 arm saw nothing — CONFIRMED the same day, one more known pair: with the
+#   real project hook set copied into a clone, an arm asked to build a new mechanism script FOUND
+#   PRIOR ART and never called Write (identity-④ behaviour), so the Write-matched PriorArt hook had
+#   nothing to fire on; an arm forced to Write a new scripts/*.sh produced `.prior_art_events.tsv`
+#   with a FIRE row inside the clone. The stimulus never reached the hook — a hook that is never
+#   triggered looks identical to a hook that cannot run, which is why a control arm whose hook is
+#   KNOWN to fire is mandatory. Signal: tracks/_meta/fh_signal_2026-09-03_runner-hooks-do-fire.md
+#   What SURVIVES from the old paragraph: before claiming a hook-dependent result, check the
+#   hook's own evidence file INSIDE the clone; absence of that file invalidates the ARM, never the
+#   hypothesis. And `--setup` writing an UNTRACKED file (.claude/settings.json is gitignored) is
+#   not contamination — the tree baseline is taken after setup, and git status never sees it.
 #
 # 🟥 CONTROL IS NOT OPTIONAL. Always run at least one arm whose correct answer is "the thing
 #   being measured should NOT fire". An instrument that fires on everything measures nothing
 #   ([[feedback_control_presence_is_not_discrimination]]).
+#
+# ── ⓒ 격리 그라운딩 — 날짜 오염 통제 (six_axis_review_2026-09-04 강화 #3, RECORD ONLY) ──────────
+#   WHY: LiveCodeBench (arXiv 2403.07974) and the contamination-taxonomy literature
+#   (frontier_verification_map_2026-09-04.md §ⓒ) filter benchmark items by RELEASE DATE precisely
+#   because a model can have memorized — not reasoned about — anything published before its
+#   training cutoff. This runner has the same exposure: a sim arm's "correct" answer about a
+#   doc/rule/gate can be recall of that doc's OWN CONTENT (if the doc predates the model's cutoff
+#   and the model happened to see this repo, or a near-identical one, during training) rather than
+#   evidence the harness under test actually delivers the behaviour to a cold session.
+#   THIS IS A RECORDING, NOT A GATE — per CLAUDE.md §Mechanization Boundary, "what the right value
+#   IS" stays judgment; only "was it recorded" is a channel. Below writes two fields per rep to
+#   `<out>/<arm>_r<rep>.meta.tsv` and does NOT compare them or fail a run on their basis:
+#     corpus_head_date   — the clone's HEAD commit date (ISO 8601). PROXY, named honestly: this
+#                          runner cannot resolve which files a given PROMPT actually cites, so it
+#                          records the whole corpus's most recent commit as an upper bound on
+#                          "how fresh could the cited material be", not a per-file citation date.
+#     sim_model / sim_model_cutoff — the `--model` value and a best-effort known cutoff via
+#                          `_model_known_cutoff()` below, `UNKNOWN` when not recorded there. This
+#                          table WILL go stale as new models ship — it is deliberately not treated
+#                          as authoritative; a scoring session should verify the cutoff it cites
+#                          rather than trust this file's guess (§Instrument-Calibration).
+#
+# ── ⓒ 격리 그라운딩 — 일회용 샌드박스 표준 (six_axis_review_2026-09-04 강화 #3) ─────────────────
+#   프런티어 대조표가 "ephemeral wipe-and-reseed 샌드박스(E2B/Modal/Runloop)"를 도입 후보로 든다.
+#   조직 제약상 외부 도구는 보류하고(§도입 후보 3), 이 러너가 "이미 그렇게 동작하는 부분"과
+#   "아닌 부분"을 정직하게 갈라 적는다 — 매번 재발견하지 않도록.
+#
+#   WIPE (매 rep 마다 새로 만든다 — 재사용 없음):
+#     ✅ 이미 참 — 매 rep 이 독립된 `git clone` (§위 "A disposable clone per REP") + 독립된 부모
+#        디렉터리(§L10). 오늘 실행한 실측 (`test_sim_isolated_run_lanes.sh`):
+#          ✅ L10 no clone shares a parent with another (2 clones, 0 co-parented)
+#          ✅ L10b control — 2 clones found (L10 did not pass on an empty set)
+#        (재현: `bash scripts/test_sim_isolated_run_lanes.sh` — 위 두 줄이 그대로 나온다.)
+#   RESEED (팔이 못 보면 안 되는 자산을 클론에서 지운다):
+#     ✅ 이미 참 — ARM_BLIND_PATHS 제거(§아래) + 그 자체가 known-pair 로 검정됨:
+#          ✅ L24 팔 눈가림 자산이 클론에서 제거된다 (히트 >0 → 0)
+#   기계-표면 리셋 (LaunchAgents/crontab/settings — VM 리셋과 달리 "지우고 다시 만들지" 않는다):
+#     🟥 아직 부분 — observe 모드는 도구 자체가 없어 못 건드리고(구조적 예방), act 모드는 실제
+#        변경을 만들고 나서 **탐지**만 한다(§L7). "매 rep 전 기계 상태를 초기화"는 하지 않는다 —
+#        E2B/Modal 급 VM wipe-and-reseed와의 실제 델타는 이 한 줄이다. 진짜 OS 샌드박스가 필요한
+#        이유는 헤더 상단 "WHAT THIS GIVES YOU" 절이 이미 말한다 — 여기서 되풀이하지 않는다.
+#   요약: 파일시스템 코퍼스 축(WIPE+RESEED)은 클론 단위로 이미 wipe-and-reseed다. 기계 표면 축은
+#   아니다 — 탐지기이지 리셋기가 아니다. 이 두 문장이 "샌드박스 표준"의 정직한 전부다.
+#
+# ── timeout(1) RESOLUTION — macOS ships none, and launchd's PATH cannot see Homebrew's
+#   (2026-09-05, measured) ──────────────────────────────────────────────────────────────────────
+#   WHY: stock macOS ships no `timeout(1)`. Homebrew coreutils installs `gtimeout` (plain
+#   `timeout` only if the user un-prefixes GNU coreutils onto PATH) under a prefix an interactive
+#   login shell sees but a launchd job's PATH does NOT — this repo's own plist templates ship
+#   `$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin`, no Homebrew prefix at all. The first launchd
+#   live-eval run (2026-09-05 02:30) hit exactly this: every one of 12 probes × 2 arms died at
+#   `timeout: command not found` before `claude` ever ran, and the report showed 12/12
+#   FAILED-TO-RUN with no clue why — a "did this fire" question this repo cares about a great
+#   deal (§Skeleton-Not-Muscle) answered wrong for a reason that had nothing to do with the
+#   harness under test. FH ships this script via npm (package.json `files[]`), so a stock-macOS
+#   consumer with no Homebrew coreutils hits the identical wall running it by hand — this is not
+#   a launchd-only defect. Resolution below: GNU `timeout` → `gtimeout` → a bash-native watchdog
+#   fallback, so a run never silently trades "no timeout enforcement" for "works on my machine".
+#   The resolved kind is printed in the run header as `timeout_tool=` so a run names its own
+#   control rather than leaving it to be inferred from a failure days later.
 
 set -uo pipefail
 
@@ -242,6 +328,7 @@ while [ $# -gt 0 ]; do
     --base-sha) BASE_SHA="${2:-}"; shift 2 ;;
     --setup)   SETUP="${2:-}"; shift 2 ;;  # shell run INSIDE each clone before the sim. See below.
     --extra-tools) EXTRA="${2:-}"; shift 2 ;;  # append tools to the mode's set. See TOOL VISIBILITY.
+    --mcp-config) MCPCFG="${2:-}"; shift 2 ;;  # the ONLY MCP servers an arm may see (see MCP ISOLATION). Default: none.
     *) echo "unknown flag: $1" >&2; exit 2 ;;
   esac
 done
@@ -251,6 +338,62 @@ case "$MODE" in observe|act) ;; *) echo "FAIL: --mode must be observe|act" >&2;
 
 command -v claude >/dev/null 2>&1 || { echo "FAIL: claude CLI not on PATH" >&2; exit 2; }
 
+# ── timeout(1) resolution — see §timeout(1) RESOLUTION in the header above for WHY. ──────────────
+# GNU `timeout` → Homebrew's `gtimeout` → a bash-native watchdog. Never silently proceeds with NO
+# enforcement at all — that would trade "wrong binary name" for "no timeout, ever", which is worse.
+TIMEOUT_KIND=""; TIMEOUT_BIN=""
+if command -v timeout >/dev/null 2>&1; then
+  TIMEOUT_KIND="gnu"; TIMEOUT_BIN="$(command -v timeout)"
+elif command -v gtimeout >/dev/null 2>&1; then
+  TIMEOUT_KIND="gtimeout"; TIMEOUT_BIN="$(command -v gtimeout)"
+else
+  TIMEOUT_KIND="bash-fallback"; TIMEOUT_BIN=""
+fi
+
+# fh_run_with_timeout SECONDS CMD... — used only when neither `timeout` nor `gtimeout` resolved.
+# Backgrounds CMD, TERMs it if SECONDS elapses, grants 5s to exit cleanly, then KILLs. The verdict
+# "did this actually time out" is a FLAG FILE the watchdog writes when it intervenes — not CMD's
+# own exit code — because a child that catches SIGTERM and exits 0 anyway must still be reported
+# as timed out (matching GNU timeout's rc=124 convention), not read as if it had answered normally.
+fh_run_with_timeout() {
+  local _secs="$1"; shift
+  local _flag; _flag="$(mktemp "${TMPDIR:-/tmp}/fh_to_XXXXXX")"; rm -f "$_flag"
+  "$@" &
+  local _cpid=$!
+  ( sleep "$_secs" 2>/dev/null
+    if kill -0 "$_cpid" 2>/dev/null; then
+      : > "$_flag"
+      kill -TERM "$_cpid" 2>/dev/null
+      sleep 5
+      kill -0 "$_cpid" 2>/dev/null && kill -KILL "$_cpid" 2>/dev/null
+    fi
+  ) &
+  local _watchdog=$!
+  local _rc=0
+  wait "$_cpid" 2>/dev/null; _rc=$?
+  # The watchdog subshell owns a `sleep`; killing the subshell alone leaves that sleep as an
+  # orphan for up to SECONDS (test_frontier_digest_retry.sh challenger B-2 measured exactly this
+  # class). Kill the subshell's children first, then the subshell.
+  pkill -P "$_watchdog" 2>/dev/null; kill "$_watchdog" 2>/dev/null; wait "$_watchdog" 2>/dev/null
+  if [ -f "$_flag" ]; then
+    rm -f "$_flag"
+    return 124
+  fi
+  rm -f "$_flag" 2>/dev/null
+  return "$_rc"
+}
+
+# fh_timeout SECONDS CMD... — drop-in for `timeout SECONDS CMD...` using whichever kind resolved
+# above. The call site never branches on TIMEOUT_KIND itself.
+fh_timeout() {
+  local _secs="$1"; shift
+  case "$TIMEOUT_KIND" in
+    gnu)      command timeout "$_secs" "$@" ;;
+    gtimeout) command gtimeout "$_secs" "$@" ;;
+    *)        fh_run_with_timeout "$_secs" "$@" ;;
+  esac
+}
+
 OUTDIR="${OUTDIR:-$(mktemp -d "${TMPDIR:-/tmp}/fh-sim-XXXXXX")}"
 mkdir -p "$OUTDIR"
 
@@ -274,8 +417,19 @@ snapshot() {
   } > "$f"
 }
 
+# ⓒ 날짜 오염 통제 — 기록 전용 헬퍼(§헤더 참조). 판정 아님, 있으면 값·없으면 UNKNOWN.
+# 🟥 이 표는 부패한다(stale) — 새 모델이 나올 때마다 손으로 갱신해야 한다. 여기 적힌 값을
+# «검증됨»으로 인용하지 마라: 이 스크립트 자신이 그렇게 적어두라고 요구한다(§Instrument-Calibration).
+_model_known_cutoff() { # $1=--model 값 → ISO 월 또는 UNKNOWN
+  case "$1" in
+    *sonnet-5*|sonnet) printf '2026-01' ;;   # 이 세션의 시스템 프롬프트가 스스로 적은 값
+    *) printf 'UNKNOWN' ;;
+  esac
+}
+
 echo "── sim_isolated_run ──────────────────────────────────────────────"
 echo "arm=$ARM mode=$MODE model=$MODEL reps=$REPS timeout=${TIMEOUT}s"
+echo "timeout_tool=${TIMEOUT_KIND}${TIMEOUT_BIN:+:$TIMEOUT_BIN}"
 echo "out=$OUTDIR"
 
 snapshot "$OUTDIR/_machine_before.txt"
@@ -318,6 +472,17 @@ for r in $(seq 1 "$REPS"); do
     continue
   fi
 
+  # ⓒ 날짜 오염 통제 — 기록만, 판정 아님(§헤더). corpus_head_date 는 "프롬프트가 인용하는
+  # 파일들"의 날짜가 아니라 그 상한(코퍼스 전체 HEAD)이다 — 러너는 프롬프트가 무엇을 인용하는지
+  # 모르므로 더 좁게 잴 수 없다. 그렇게 좁혀 적는다.
+  _corpus_date=$(git -C "$WORK" log -1 --format=%cI 2>/dev/null); [ -n "$_corpus_date" ] || _corpus_date="UNKNOWN"
+  _cutoff=$(_model_known_cutoff "$MODEL")
+  {
+    printf 'corpus_head_date\t%s\n' "$_corpus_date"
+    printf 'sim_model\t%s\n' "$MODEL"
+    printf 'sim_model_cutoff\t%s\n' "$_cutoff"
+  } > "$OUTDIR/${ARM}_r${r}.meta.tsv"
+
   # ── 🟥 팔이 읽으면 안 되는 tracked 자산을 «클론 안에서» 제거한다 (2026-09-01) ──────
   # 왜: 얼린 정답지(`scripts/fixtures/knownpair_refusal_48_*`)가 tracked 가 되면서
   #     **모든 팔의 클론에 들어갔다.** 실측 — negative 문항의 핵심 명사구가 그 안에 있다
@@ -345,6 +510,19 @@ for r in $(seq 1 "$REPS"); do
   #     compaction_probe.sh 7 중 1 · starter.md 22 중 1 — 여유 충분
   ARM_BLIND_PATHS=( "scripts/fixtures" "scripts/round" "scripts/context_continuity_score.sh" )
   for _bp in "${ARM_BLIND_PATHS[@]}"; do
+    # 🟥 STATUS 오염 차단 (2026-09-06) — `rm` 만 하면 클론의 `git status` 가 `D` 160줄이 되고,
+    #    그 목록이 세션 시작 컨텍스트로 **팔에** 들어간다. 실측: 기록된 응답 76개 중 11개가
+    #    삭제된 파일을 «이름으로» 인용했고 **11건 전부 primary · 컨트롤 0** — 오염이 한쪽 팔에만
+    #    걸려 «없는 차이»를 만드는 방향이었다([[feedback_instrument_blindspot_correlated_with_arm]]).
+    #    skip-worktree 로 인덱스가 삭제를 안 보게 한 뒤 지운다. 파일은 여전히 실제로 부재이므로
+    #    헤더의 «없는 파일은 어느 도구로도 못 읽는다» 보장은 그대로다(아래 [ -e ] 판정이 그것을 잰다).
+    #    ⚠️ 남는 잔여: `git ls-files` 는 이름을 계속 나열한다(인덱스 메타데이터). observe 모드엔
+    #    Bash 가 없어 도달 불가, **act 모드엔 도달 가능** — 닫힌 게 아니라 좁아진 것이다.
+    _bp_n=$(git -C "$WORK" ls-files -- "$_bp" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "${_bp_n:-0}" -gt 0 ]; then
+      git -C "$WORK" ls-files -z -- "$_bp" 2>/dev/null \
+        | xargs -0 git -C "$WORK" update-index --skip-worktree -- 2>/dev/null || true
+    fi
     rm -rf "$WORK/$_bp"
     # 🟥 rm 의 rc 를 안 믿는다 — 경로 오타면 rm 은 «성공»을 낸다(지울 게 없으니).
     #    판정은 «제거 후에 정말 없는가»로 한다.
@@ -424,8 +602,16 @@ for r in $(seq 1 "$REPS"); do
   #    부르며 정직하게 거부하면서도, 거부문 안에서 정답을 말한다. 채점기는 그걸 토큰으로 센다.
   #    이것이 회차 1~3 과 probe1~4 를 전부 무효로 만든 근인이고, 경로 deny·코퍼스 마스킹은
   #    **원리적으로 못 막는다**(도구 읽기가 아니라 프롬프트 조립이다).
-  ( cd "$WORK" && timeout "$TIMEOUT" claude -p "$PROMPT" \
-        --model "$MODEL" "${TOOLS[@]}" \
+  # 🟥 MCP ISOLATION (measured 2026-09-05, QP chamber floor sim): a headless arm launched by this
+  #    runner saw the OPERATOR'S user-scope MCP servers (a cloud drive, a wiki, a browser bridge)
+  #    in its tool list — the clone isolates files and settings, not `~/.claude.json` MCP scope.
+  #    A blind arm with a write-capable MCP is a residency hole, not a sim. `--strict-mcp-config`
+  #    = "only the servers given by --mcp-config" (CLI --help), and with no --mcp-config that is
+  #    NONE. An arm that legitimately needs a server (e.g. Playwright for a web target) gets it
+  #    explicitly via --mcp-config <file inside the clone>; nothing is inherited.
+  MCPARGS=(--strict-mcp-config); [ -n "${MCPCFG:-}" ] && MCPARGS+=(--mcp-config "$MCPCFG")   # bash 3.2 + set -u: expanded with the ${a[@]+"${a[@]}"} idiom below
+  ( cd "$WORK" && fh_timeout "$TIMEOUT" claude -p "$PROMPT" \
+        --model "$MODEL" "${TOOLS[@]}" ${MCPARGS[@]+"${MCPARGS[@]}"} \
         < /dev/null 2>"$OUTDIR/${ARM}_r${r}.stderr.txt" ) > "$OUTDIR/${ARM}_r${r}.txt"
   rc=$?
   bytes=$(wc -c < "$OUTDIR/${ARM}_r${r}.txt" | tr -d ' ')

package/scripts/test_action_yml_lanes.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# test_action_yml_lanes.sh — behavioural lanes for action.yml's exit-code mapping.
+#
+# WHY: `action.yml` is the only place where the gate's SEVEN typed exit codes get turned into a
+# GitHub step outcome. That translation is exactly where a typed verdict silently becomes a
+# boolean — the failure this repo names in `[[feedback_not_found_is_not_zero_family]]`. Two
+# properties carry the weight and neither is visible by reading the YAML:
+#   A. an UNKNOWN exit code (a future gate version adding one) must land on HARNESS_ERROR-class
+#      handling, never on PASS. A `case` whose `*)` arm is missing would default to... nothing,
+#      and `verdict` would be unset — which under `set -u` is a crash, but under a careless edit
+#      could become an empty string that matches no fail-on entry and exits 0. That is the leak.
+#   B. `reviewed` must be false for every code where no review ran (10 · 11 · 12 · unknown).
+#      «did not run» reported as «passed» is the same defect class as a skipped check scored green.
+#
+# HOW: the mapping is extracted from action.yml and executed as shell — the lanes run the REAL
+# case block, not a copy. A copy would drift and every lane would stay green while the shipped
+# file rotted (that is `[[feedback_built_but_not_wired]]` wearing a test's clothes).
+#
+# USAGE: bash scripts/test_action_yml_lanes.sh   → exit 0 all pass · 1 any fail · 10 harness error
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+A="$ROOT/action.yml"
+[ -f "$A" ] || { echo "❌ HARNESS: action.yml absent at $A"; exit 10; }
+PASS=0; FAIL=0
+ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+no(){ FAIL=$((FAIL+1)); printf '  ❌ %s\n' "$1"; }
+chk(){ if [ "$1" = "0" ]; then ok "$2"; else no "$2"; fi; }
+
+# ── extract the real case block from the shipped file ────────────────────────────────────────
+MAP="$(awk '/^ *case "\$rc" in/{f=1} f{print} /^ *esac/{if(f){exit}}' "$A" | sed 's/^ *//')"
+[ -n "$MAP" ] || { echo "❌ HARNESS: could not extract the case block from action.yml"; exit 10; }
+printf '%s' "$MAP" | grep -q 'esac' || { echo "❌ HARNESS: extracted block has no esac (truncated)"; exit 10; }
+
+verdict_for(){ # $1 = rc → prints "verdict reviewed"
+  rc="$1"; verdict=""; reviewed=""
+  eval "$MAP"
+  printf '%s %s' "${verdict:-<UNSET>}" "${reviewed:-<UNSET>}"
+}
+
+echo "── L1 documented exit codes map to their documented verdict ──"
+while read -r rc want_v want_r; do
+  got="$(verdict_for "$rc")"
+  [ "$got" = "$want_v $want_r" ]; chk $? "rc=$rc → $want_v (reviewed=$want_r) [got: $got]"
+done <<'CASES'
+0 PASS true
+1 PENDING true
+2 BLOCKED true
+3 ESCALATE true
+10 HARNESS_ERROR false
+11 ARG_ERROR false
+12 DRY_RUN false
+CASES
+
+echo "── L2 KNOWN-NEGATIVE: an undocumented exit code is never PASS and never reviewed=true ──"
+for rc in 4 5 9 13 42 127 255; do
+  got="$(verdict_for "$rc")"; v="${got%% *}"; r="${got##* }"
+  { [ "$v" != "PASS" ] && [ "$v" != "PENDING" ] && [ "$v" != "<UNSET>" ] && [ "$r" = "false" ]; }
+  chk $? "rc=$rc → $v (reviewed=$r) — not a pass, not unset"
+done
+
+echo "── L3 the mapping is TOTAL: no rc leaves verdict unset (the silent-green hole) ──"
+_unset=0
+for rc in $(seq 0 20) 42 100 127 255; do
+  got="$(verdict_for "$rc")"; case "$got" in "<UNSET>"*) _unset=$((_unset+1)) ;; esac
+done
+[ "$_unset" -eq 0 ]; chk $? "0 of 28 sampled codes leave verdict unset (found $_unset)"
+
+echo "── L4 CONTROL: a mutated mapping without the catch-all IS caught (the lane can fail) ──"
+_MUT="$(printf '%s' "$MAP" | grep -v '^\*)')"
+verdict_mut(){ rc="$1"; verdict=""; reviewed=""; eval "$_MUT"; printf '%s' "${verdict:-<UNSET>}"; }
+[ "$(verdict_mut 42)" = "<UNSET>" ]; chk $? "catch-all removed → rc=42 leaves verdict unset (control is alive)"
+[ "$(verdict_mut 0)" = "PASS" ]; chk $? "…and the mutant still maps documented codes (mutation is surgical)"
+
+echo "── L5 action.yml's documented codes match scripts/fh-gate.sh's exit contract ──"
+G="$ROOT/scripts/fh-gate.sh"
+if [ -f "$G" ]; then
+  _gate_codes="$(grep -oE '^#   [0-9]+ +—' "$G" | grep -oE '[0-9]+' | sort -un | tr '\n' ' ')"
+  _act_codes="$(printf '%s' "$MAP" | grep -oE '^[0-9]+\)' | grep -oE '[0-9]+' | sort -un | tr '\n' ' ')"
+  [ -n "$_gate_codes" ]; chk $? "CONTROL: the gate's exit contract was actually parsed (got: $_gate_codes)"
+  [ "$_gate_codes" = "$_act_codes" ]; chk $? "every documented gate code has an action arm [gate: $_gate_codes | action: $_act_codes]"
+else
+  echo "  ⬜ L5 SKIPPED (not PASS) — scripts/fh-gate.sh absent, contract un-cross-checked"
+fi
+
+echo "── L6 fail-on default is fail-closed: every non-reviewed verdict is in it ──"
+_failon="$(grep -A3 "^  fail-on:" "$A" | grep "default:" | sed "s/.*default: *'//; s/'.*//")"
+[ -n "$_failon" ]; chk $? "CONTROL: fail-on default parsed (got: $_failon)"
+for v in BLOCKED ESCALATE HARNESS_ERROR ARG_ERROR DRY_RUN UNKNOWN; do
+  case ",$_failon," in *",$v,"*) ok "fail-on default contains $v" ;; *) no "fail-on default is MISSING $v — that verdict would exit 0" ;; esac
+done
+for v in PASS PENDING; do
+  case ",$_failon," in *",$v,"*) no "fail-on default contains $v (over-blocks a reviewed pass)" ;; *) ok "fail-on default correctly omits $v" ;; esac
+done
+
+echo ""
+echo "── action.yml lanes: $PASS passed · $FAIL failed ──"
+[ "$FAIL" -eq 0 ]

package/scripts/test_backtick_guard_lanes.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# test_backtick_guard_lanes.sh — known pairs for scripts/backtick_guard.sh. Written BEFORE the detector.
+#
+# WHAT IS BEING GUARDED
+#   A backtick inside a shell DOUBLE-QUOTING CONTEXT — an unquoted heredoc body (`<<EOF`) or a
+#   "double-quoted string" — is command substitution: the text between the backticks is REPLACED by
+#   the command's output. With no such command the output is empty, so the text is DELETED; with one,
+#   foreign content is INSERTED. The sentence stays grammatical (only its subject is gone), the only
+#   signal is one `command not found` line at the top of the output, and every marker/record hook
+#   checks a field's presence, not its completeness.
+#   Measured 7× (2026-08-10 · 2026-09-01 ×3 · 2026-09-02 ×4 — marker, RESULT doc, fh_completed echo ×2)
+#   with a resident memory rule that failed each time because the actor's task had a different NAME
+#   (writing a marker · a failure message · a seal). N≥3 → mechanize (weekly_audit_2026-09-02 HIGH #1).
+#
+#   BT1 — unquoted heredoc body (`<<TAG`, `<<-TAG`; NOT `<<'TAG'` / `<<"TAG"` / `<<\TAG`) containing `
+#   BT2 — double-quoted string containing ` (single-quoted text and `\`` are literal → CLEAN)
+#
+# Surface = the Bash tool call itself (interactively-composed commands), same reasoning as
+# pipe_verdict_guard: every recurrence was in a composed command, none in a shipped file.
+
+set -u
+G="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/backtick_guard.sh"
+pass=0; fail=0
+
+# expect <label> <HIT|CLEAN> <command-string>   (the command text is passed raw via --stdin-raw)
+expect() {
+  local label="$1" want="$2" cmd="$3" out got
+  out=$(printf '%s' "$cmd" | bash "$G" --stdin-raw 2>&1)
+  # want may be HIT · CLEAN · HIT:BT1@2 (rule and line asserted — a hit on the WRONG line is a miss)
+  if printf '%s' "$out" | grep -q 'BACKTICK'; then got=HIT; else got=CLEAN; fi
+  case "$want" in HIT:*) printf '%s' "$out" | grep -q "${want#HIT:BT}" 2>/dev/null; :; esac
+  if [ "$got" = HIT ] && [ "${want%%:*}" = HIT ] && [ "$want" != HIT ]; then
+    local r="${want#HIT:}"; r="${r%@*}"; local l="${want##*@}"
+    printf '%s' "$out" | grep -q "$r L$l " || got="HIT-WRONG($(printf '%s' "$out" | grep -oE 'BT[12] L[0-9]+' | head -1))"
+    [ "$got" = HIT ] && got="$want"
+  fi
+  if [ "$got" = "$want" ]; then
+    printf '  ✅ %-56s %s (expected %s)\n' "$label" "$got" "$want"; pass=$((pass+1))
+  else
+    printf '  ❌ %-56s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1))
+    printf '     cmd: %s\n     out: %s\n' "$cmd" "$out"
+  fi
+}
+BT='`'   # one backtick, spelled once so the lanes below never carry a live one in double quotes
+NL=$'\n'
+
+echo "[backtick-guard] known pairs"
+echo "-- BT1: unquoted heredoc body --"
+# 2026-09-02 ⓐ — the measured shape: a marker written through an unquoted heredoc so a $VAR expands.
+expect "BT1 measured: marker heredoc"        HIT:BT1@3   "cat > m.marker <<EOF${NL}date: \$TODAY${NL}axis2-evidence: 러너가 ${BT}--keep-blind-paths${BT} 를 삼켰다${NL}EOF"
+expect "BT1 <<-TAG (tab-stripped) form"      HIT   "cat <<-EOF${NL}	note ${BT}x${BT}${NL}	EOF"
+expect "BT1 markdown fence in heredoc"       HIT   "cat > r.md <<EOF${NL}\`\`\`${NL}out${NL}\`\`\`${NL}EOF"
+expect "BT1 second of two heredocs on a line" HIT:BT1@4  "diff <(cat <<'A') <(cat <<B)${NL}${BT}a${BT}${NL}A${NL}${BT}b${BT}${NL}B"
+expect "BT1 quoted <<'EOF' is CLEAN"          CLEAN "cat > m.marker <<'EOF'${NL}evidence: ${BT}--keep-blind-paths${BT} 삼킴${NL}EOF"
+expect "BT1 quoted <<\"EOF\" is CLEAN"        CLEAN "cat <<\"EOF\"${NL}${BT}x${BT}${NL}EOF"
+expect "BT1 escaped <<\\EOF is CLEAN"         CLEAN "cat <<\\EOF${NL}${BT}x${BT}${NL}EOF"
+expect "BT1 backslash-escaped backtick CLEAN" CLEAN "cat <<EOF${NL}see \\${BT}x\\${BT}${NL}EOF"
+expect "BT1 backtick AFTER the body ends"     CLEAN "cat <<EOF${NL}plain${NL}EOF${NL}echo '${BT}later${BT}'"
+expect "BT1 <<< herestring is not a heredoc"  CLEAN "grep -c x <<< 'a ${BT}b${BT}'"
+
+echo "-- BT2: double-quoted string --"
+# 2026-09-02 ⓑ — the measured shape: a completion-log append through echo "…".
+expect "BT2 measured: echo append"            HIT:BT2@1   "echo \"- ✅ 러너 ${BT}sim_isolated_run.sh${BT} 헤더 경고\" >> tracks/_meta/fh_completed.md"
+expect "BT2 failure-message string (09-01)"   HIT   "printf '%s\\n' \"(${BT}nameleak_check.sh gen${BT} 을 써라)\""
+expect "BT2 single quote inside dq is inert"  HIT   "echo \"don't ${BT}x${BT}\""
+expect "BT2 single-quoted is CLEAN"           CLEAN "printf '%s\\n' '- ✅ 러너 ${BT}sim_isolated_run.sh${BT} 헤더' >> log.md"
+expect "BT2 escaped \\\` is CLEAN"             CLEAN "echo \"see \\${BT}x\\${BT}\""
+expect "BT2 dq inside single quotes is CLEAN" CLEAN "echo '\"${BT}x${BT}\"'"
+expect "BT2 sq inside \$( ) inside dq CLEAN"  CLEAN "echo \"\$(printf '%s' '${BT}x${BT}')\""
+expect "BT2 no backtick at all"               CLEAN "echo \"\$(git log -1) done\" && cat <<EOF${NL}plain \$X${NL}EOF"
+expect "BT2 bare backtick outside quotes"     CLEAN "V=${BT}date${BT}; echo ok"   # live command substitution on purpose, not a text context
+
+echo "-- Axis-2 pass 2026-09-03 (challenger, repros executed by the governor) --"
+# A1: the first build stripped single-quoted spans BEFORE matching heredoc operators, so <<'EOF' was
+# never a heredoc — three symptoms from one cause. Each pinned in its real shape.
+expect "A1a quoted body with dq+backtick CLEAN" CLEAN "cat <<'EOF'${NL}axis2-evidence: 메시지 \"use ${BT}x${BT}\" 가 떴다${NL}EOF"
+expect "A1b quoted A then unquoted B: only B" CLEAN "diff <(cat <<'A') <(cat <<B)${NL}${BT}a${BT}${NL}A${NL}plain${NL}B"
+expect "A1c apostrophe in quoted body, then echo" HIT:BT2@4 "cat <<'EOF'${NL}don't${NL}EOF${NL}echo \"${BT}x${BT}\" >> log"
+# A2: a comment's apostrophe must not open a single-quote context that swallows the next line.
+expect "A2 comment apostrophe then echo"      HIT:BT2@2 "# don't re-run this${NL}echo \"${BT}x${BT}\" >> f.md"
+expect "A2 url fragment is not a comment"     HIT:BT2@1 "curl \"https://x/a#frag ${BT}x${BT}\""
+# B3: <<TAG inside a double-quoted string (commit message) opens no heredoc.
+expect "B3 <<EOF in commit message is CLEAN" CLEAN "git commit -m \"docs: prefer <<EOF for markers\"${NL}V=${BT}date${BT}; echo ok"
+# B5: escaped backslash + LIVE backtick.
+expect "B5 \\\\ then live backtick HITs"      HIT:BT1@2 "cat <<EOF${NL}path\\\\${BT}x${BT}${NL}EOF"
+# B2: ANSI-C $'…' with an escaped apostrophe does not end early.
+expect "B2 \$'don\\'t' then dq backtick"      HIT:BT2@1 "echo \$'don\\'t' \"${BT}x${BT}\""
+# B1: backtick inside \$( ) re-entered from dq is live substitution — deliberately NOT flagged.
+expect "B1 backtick inside \$( ) in dq CLEAN"  CLEAN "echo \"\$(echo ${BT}x${BT})\""
+
+echo "-- hook mode: JSON payload in → JSON out (A4: detection is worthless if delivery is 0) --"
+jexp() {  # <label> <expect-substring-in-additionalContext|SILENT> <env> <payload>
+  local label="$1" want="$2" env_="$3" payload="$4" out ctx
+  out=$(printf '%s' "$payload" | env $env_ bash "$G" 2>/dev/null)
+  if [ "$want" = SILENT ]; then
+    if [ -z "$out" ]; then printf '  ✅ %-56s SILENT\n' "$label"; pass=$((pass+1)); else printf '  ❌ %-56s expected SILENT, got: %s\n' "$label" "${out:0:80}"; fail=$((fail+1)); fi
+    return
+  fi
+  ctx=$(printf '%s' "$out" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["hookSpecificOutput"]["additionalContext"])' 2>/dev/null)
+  if printf '%s' "$ctx" | grep -q "$want"; then printf '  ✅ %-56s JSON additionalContext carries %s\n' "$label" "$want"; pass=$((pass+1))
+  else printf '  ❌ %-56s no JSON/context (%s)\n' "$label" "${out:0:80}"; fail=$((fail+1)); fi
+}
+P='{"tool_name":"Bash","tool_input":{"command":"echo \"- done `x.sh` ok\""}}'
+jexp "JSON payload → additionalContext"       "BT2 L1" "X=1" "$P"
+jexp "ascii PYTHONIOENCODING still emits"     "BT2 L1" "PYTHONIOENCODING=ascii" "$P"
+jexp "non-Bash tool is SILENT"                SILENT   "X=1" '{"tool_name":"Write","tool_input":{"content":"`x`"}}'
+jexp "unparseable payload is SILENT"          SILENT   "X=1" 'not json'
+
+echo "-- opt-out / payload --"
+expect "noqa exempts"                         CLEAN "echo \"${BT}x${BT}\"  # noqa: backtick"
+expect "empty payload"                        CLEAN ""
+
+echo
+echo "[backtick-guard] $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/scripts/test_degrade_scan_shell_probes.sh

@@ -81,7 +81,7 @@ EOF
 cat > "$TMP/non_detections.sh" <<'EOF'
 #!/usr/bin/env bash
 # (a) integer sanitization — the PRESCRIBED remedy for the pipefail-fallback class, not the defect.
-count=$(grep -c pattern file)
+count=$(grep -c pattern file)  # portability-noqa: fixture text written by a quoted heredoc, never executed — statically grepped by degrade_direction_scan.sh only
 if [ "${count:-0}" -gt 0 ]; then echo "found"; fi
 # (b) SCOPE guards — "this run does not apply here" is not a claim that a check passed.
 [ -d "$HOME/projects" ] || exit 0
@@ -165,11 +165,11 @@ N=$(find /nope . -maxdepth 1 2>/dev/null | grep -c . || echo 0)
 M=$(git log --oneline 2>/dev/null | wc -l || echo 0)
 # WIDENED 2026-08-04. Every line below was INVISIBLE to the narrowed rule, and each was verified to
 # actually produce "0\n0" before being pinned here (line count measured, not assumed):
-P=$(cat /etc/hosts | grep -c . | tr -d ' ' || echo 0)   # transparent filter after the counter
-Q=$(grep -c "^nosuchline$" /etc/hosts 2>/dev/null | tr -d ' ' || echo 0)  # the PR #251 shape
-R=$(grep -Ec "^nosuchline$" /etc/hosts || echo 0)       # combined flag cluster -Ec
-S=$(grep --count "^nosuchline$" /etc/hosts || echo 0)   # long option
-T=$(grep -Fcx "nosuchline" /etc/hosts || echo 0)        # -Fcx
+P=$(cat /etc/hosts | grep -c . | tr -d ' ' || echo 0)   # transparent filter after the counter  # portability-noqa: fixture text, never executed
+Q=$(grep -c "^nosuchline$" /etc/hosts 2>/dev/null | tr -d ' ' || echo 0)  # the PR #251 shape  # portability-noqa: fixture text, never executed
+R=$(grep -Ec "^nosuchline$" /etc/hosts || echo 0)       # combined flag cluster -Ec  # portability-noqa: fixture text, never executed
+S=$(grep --count "^nosuchline$" /etc/hosts || echo 0)   # long option  # portability-noqa: fixture text, never executed
+T=$(grep -Fcx "nosuchline" /etc/hosts || echo 0)        # -Fcx  # portability-noqa: fixture text, never executed
 U=$(false | grep -c . | cat || echo 0)                  # trailing stage that always emits
 V=$(false | grep -c . | grep -v nosuch || echo 0)       # trailing grep whose pattern misses the "0"
 EOF
@@ -688,7 +688,7 @@ fi
 # flips to a hit — proves the exclusion is load-bearing for this specific fixture, not just
 # present somewhere in the file.
 _scan_reverted="$TMP/scan_reverted.sh"
-_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)
+_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)  # portability-noqa: this file has no `set -e` (top line 22 is `set -uo pipefail` only) and the next line already guards empty via -z
 if [ -z "$_excl_line" ]; then
   bad "C2-REVERT could not locate the exclusion line by its known text — fixture cannot run"
 else