@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/scripts/test_fh_qp_lanes.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# test_fh_qp_lanes.sh — known-pair lanes for plugins/fh-qp (QP · Quality Platform).
+#
+# What it proves: the MECHANICAL half (plugins/fh-qp/scripts/qp_tools.sh) discriminates on fixtures
+# shipped with the plugin — three negatives from the chamber oracle (profile-required target → refuse ·
+# adapter absent → HARNESS_ERROR · dirty evidence → masked, residue 0), surface_reach four states,
+# the verdict-record contract (mtm-check), the state-changing-verb floor, and a residency scan of the
+# whole scaffold (fail-closed when the scanner cannot run — exit 10 is never read as clean).
+# What it does NOT prove: that a session FOLLOWS the SKILL prose (that is the floor-tier sim's job),
+# or that any verdict label is TRUE (judgment, deliberately unmechanised).
+# Exit: 0 all lanes pass · 1 any lane fails · 10 harness error (plugin/tool missing).
+set -uo pipefail
+FH="$(cd "$(dirname "$0")/.." && pwd)"
+T="$FH/plugins/fh-qp/scripts/qp_tools.sh"
+X="$FH/plugins/fh-qp/fixtures"
+[ -f "$T" ] || { echo "HARNESS-ERROR: $T missing"; exit 10; }
+[ -d "$X" ] || { echo "HARNESS-ERROR: fixtures dir missing"; exit 10; }
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/fhqp.XXXXXX")"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+lane() { # $1 name · $2 expected rc · $3 expected stdout regex · rest = command
+  local name="$1" want_rc="$2" want_re="$3"; shift 3
+  local out rc; out="$("$@" 2>&1)"; rc=$?
+  if [ "$rc" = "$want_rc" ] && printf '%s' "$out" | /usr/bin/grep -qE "$want_re"; then
+    PASS=$((PASS+1)); printf '  ✅ %-34s rc=%s  %s\n' "$name" "$rc" "$(printf '%s' "$out" | head -1 | cut -c1-70)"
+  else
+    FAIL=$((FAIL+1)); printf '  ❌ %-34s rc=%s (want %s /%s/)\n     %s\n' "$name" "$rc" "$want_rc" "$want_re" "$out"
+  fi
+}
+echo "── fh-qp lanes ──"
+# ── negative ① profile-required → refuse (and the positive pair: public passes, profile unlocks) ──
+lane N1-private-host-refused      4  '^PROFILE_REQUIRED kind=web'          bash "$T" target-class https://private.example.internal/x
+lane N1-rfc1918-refused           4  '^PROFILE_REQUIRED'                   bash "$T" target-class http://10.1.2.3/login
+lane N1-desktop-needs-profile     4  '^PROFILE_REQUIRED kind=desktop'      bash "$T" target-class app:SomeApp
+lane N1-public-passes             0  '^PUBLIC kind=web host=example\.com'  bash "$T" target-class https://example.com/
+printf 'targets:\n  web:\n    - base_url: https://private.example.internal\n' > "$TMP/profile.yaml"
+lane N1-profile-unlocks           0  '^PROFILE_OK'                         bash "$T" target-class https://private.example.internal/x --profile "$TMP/profile.yaml"
+lane N1-bad-form-unknown         10  '^UNKNOWN'                            bash "$T" target-class ftp://x
+# ── negative ② adapter absent → HARNESS_ERROR (pair: present → ADAPTER=) ──
+lane N2-no-tools-harness-error   10  '^HARNESS_ERROR reason=tool-list-not-supplied' bash "$T" adapter-probe --need web
+lane N2-wrong-kind-harness-error 10  '^HARNESS_ERROR reason=no-desktop-adapter'     bash "$T" adapter-probe --need desktop --tools "mcp__playwright__browser_navigate,Read"
+lane N2-web-adapter-found         0  '^ADAPTER=playwright-mcp evidence=dom'         bash "$T" adapter-probe --need web --tools "Read,mcp__playwright__browser_navigate"
+lane N2-desktop-adapter-found     0  '^ADAPTER=computer-use-mcp evidence=pixel'     bash "$T" adapter-probe --need desktop --tools "mcp__computer-use__screenshot"
+# ── negative ③ dirty evidence → masked, residue 0 (pair: clean stays clean; raw never survives) ──
+lane N3-dirty-masked              0  '^MASKED residue=0'                   bash "$T" mask "$X/evidence_known_dirty.txt" "$TMP/masked.txt"
+if /usr/bin/grep -qE 'qa\.tester@|hunter2|eyJhbGci|abcdefghijklmnop' "$TMP/masked.txt"; then FAIL=$((FAIL+1)); echo "  ❌ N3-raw-survived-in-output"; else PASS=$((PASS+1)); echo "  ✅ N3-raw-absent-in-output"; fi
+lane N3-clean-stays-clean         0  '^MASKED residue=0'                   bash "$T" mask "$X/evidence_known_clean.txt" "$TMP/masked2.txt"
+lane N3-missing-input-harness    10  '^HARNESS_ERROR'                      bash "$T" mask "$X/does_not_exist.txt" "$TMP/m3.txt"
+# ── surface_reach four states ──
+lane SR-reached                   0  '^REACHED tcs_beyond_entry=2 tcs_total=2'      bash "$T" surface-reach "$X/reach_known_reached.tsv"
+lane SR-partial                   5  '^PARTIAL tcs_beyond_entry=1 tcs_total=2'      bash "$T" surface-reach "$X/reach_known_partial.tsv"
+lane SR-wall                      5  '^NOT_REACHED tcs_beyond_entry=0 tcs_total=3'  bash "$T" surface-reach "$X/reach_known_wall.tsv"
+: > "$TMP/reach_empty.tsv"   # generated here — an empty file cannot travel in a diff (PATCH.diff dropped it; measured 2026-09-05)
+lane SR-empty-unmeasured         10  '^UNMEASURED reason=evidence-empty'           bash "$T" surface-reach "$TMP/reach_empty.tsv"
+lane SR-missing-unmeasured       10  '^UNMEASURED reason=evidence-missing'         bash "$T" surface-reach "$X/no_such_file.tsv"
+# ── verdict record contract ──
+lane MTM-good                     0  '^OK mtm=UNAVAILABLE rows=3 machine_closed=2 judgment_left=1' bash "$T" mtm-check "$X/verdicts_known_good.tsv"
+lane MTM-branch-needs-active     10  'DIFFERS_FROM_PLAN-needs-mtm-ACTIVE'                        bash "$T" mtm-check "$X/verdicts_known_bad_branch.tsv"
+lane MTM-vacuous-machine         10  'MACHINE-closure-without-assertion'                         bash "$T" mtm-check "$X/verdicts_known_bad_vacuous_machine.tsv"
+printf '#mtm: ACTIVE\nTC-1\tFAIL\tDIFFERS_FROM_PLAN\tMACHINE\tverify\ttext-visible:x\tINVENTORY\n' > "$TMP/v_src.tsv"
+lane MTM-branch-source-binding   10  'DIFFERS_FROM_PLAN-needs-expected_source=PLAN_DOC'          bash "$T" mtm-check "$TMP/v_src.tsv"
+printf 'TC-1\tPASS\tAS_PLANNED\tMACHINE\tclick\tx\tINVENTORY\n' > "$TMP/v_nomtm.tsv"
+lane MTM-state-line-required     10  'mtm-state-missing'                                         bash "$T" mtm-check "$TMP/v_nomtm.tsv"
+lane VERBS-good                   0  '^OK state_changing_verbs=2'          bash "$T" run-verbs "$X/verdicts_known_good.tsv"
+lane VERBS-verify-only            5  '^VERIFY_ONLY'                        bash "$T" run-verbs "$X/verdicts_verify_only.tsv"
+# ── screen-id: same content with different ref tokens → same id; different content → different id ──
+printf -- '- heading "Home" [level=1] [ref=e2]\n- link "About" [ref=e7]\n' > "$TMP/s1.md"
+printf -- '- heading "Home" [level=1] [ref=f3e2]\n- link "About"   [ref=f3e7]\n' > "$TMP/s2.md"
+printf -- '- heading "About" [level=1] [ref=e2]\n' > "$TMP/s3.md"
+id1=$(bash "$T" screen-id "$TMP/s1.md"); id2=$(bash "$T" screen-id "$TMP/s2.md"); id3=$(bash "$T" screen-id "$TMP/s3.md")
+if [ "$id1" = "$id2" ] && [ "$id1" != "$id3" ] && [ ${#id1} -eq 12 ]; then PASS=$((PASS+1)); echo "  ✅ SID-content-hash-stable-across-refs ($id1)"; else FAIL=$((FAIL+1)); echo "  ❌ SID-content-hash ($id1 / $id2 / $id3)"; fi
+# ── residency: the whole scaffold, fail-closed ──
+FILES="$(cd "$FH" && find plugins/fh-qp scripts/test_fh_qp_lanes.sh -type f | sort)"
+# Worktrees do not carry the gitignored operator pattern file — fall back to the main checkout's copy
+# (git-common-dir), else honour RESIDENCY_PATTERNS, else the scanner exits 10 and this lane FAILS (fail-closed).
+if [ -z "${RESIDENCY_PATTERNS:-}" ] && [ ! -f "$FH/.claude/rules/.residency-patterns" ]; then
+  _common="$(cd "$FH" && git rev-parse --git-common-dir 2>/dev/null)"
+  [ -n "$_common" ] && [ -f "$_common/../.claude/rules/.residency-patterns" ] && export RESIDENCY_PATTERNS="$(cd "$_common/.." && pwd)/.claude/rules/.residency-patterns"
+fi
+if [ -f "$FH/scripts/residency_closure_scan.py" ]; then
+  # shellcheck disable=SC2086
+  out="$(cd "$FH" && python3 scripts/residency_closure_scan.py --files $FILES 2>&1)"; rc=$?
+  case "$rc" in
+    0)  PASS=$((PASS+1)); echo "  ✅ RES-closure-scan CLEAN ($(printf '%s' "$FILES" | wc -l | tr -d ' ') files)" ;;
+    10) if printf '%s' "$out" | grep -q '운영자 패턴 파일이 없다'; then
+          # CI and consumer clones structurally lack the operator override (gitignored). That is
+          # UNMEASURED, not a failure of the shipped files — the generic RES-zero-constant-grep lane
+          # below is the guarantee that travels; this lane measures only where the override exists.
+          echo "  ⚪ RES-closure-scan SKIPPED — operator patterns file absent (UNMEASURED, not clean; the generic grep lane still runs)"
+        else
+          FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan HARNESS (rc=10 — defaults missing or pattern compile error)"; echo "$out" | tail -3
+        fi ;;
+    *)  FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan TAINTED (rc=$rc)"; echo "$out" | tail -5 ;;
+  esac
+else
+  FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan scanner missing (fail-closed)"
+fi
+# generic zero-constant grep (no scanner needed): private hosts / secrets shapes must not appear in shipped files
+# except inside the profile EXAMPLE and fixtures, which exist to show the shapes.
+# The lane itself is the instrument (its known-negative literals are the point) — scanned by residency above, excluded here.
+SHIPPED="$(printf '%s' "$FILES" | /usr/bin/grep -vE 'fixtures/|qp_profile\.example\.yaml|test_fh_qp_lanes\.sh')"
+# shellcheck disable=SC2086
+hits="$(cd "$FH" && /usr/bin/grep -nE '\b(10|192\.168)\.[0-9]+\.[0-9]+\.[0-9]+\b|eyJ[A-Za-z0-9_-]{8,}\.|AKIA[A-Z0-9]{8,}' $SHIPPED 2>/dev/null | /usr/bin/grep -vE 'qp_tools\.sh:.*(_MASK_|case|10\.\*)' || true)"
+if [ -z "$hits" ]; then PASS=$((PASS+1)); echo "  ✅ RES-zero-constant-grep (0 hits in shipped files)"; else FAIL=$((FAIL+1)); echo "  ❌ RES-zero-constant-grep"; echo "$hits"; fi
+echo "── fh-qp lanes: $PASS passed, $FAIL failed ──"
+[ "$FAIL" -eq 0 ]

package/scripts/test_files_manifest_shipping_lanes.sh

@@ -46,9 +46,9 @@ trap 'rm -rf "$LANE2_DIR"' EXIT
 cp package.json "$LANE2_DIR/package.json.orig"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT (line 18) -- this is the subject under tests own manifest, not a foreign fixture
   pkg.files.push("scripts/__test_fixture_does_not_exist__.sh");
-  fs.writeFileSync("package.json", JSON.stringify(pkg, null, 2) + "\n");
+  fs.writeFileSync("package.json", JSON.stringify(pkg, null, 2) + "\n");  // # portability-noqa: same as above -- writes back to the same repo-relative manifest it read
 '
 restore_pkg() { cp "$LANE2_DIR/package.json.orig" package.json; }
 
@@ -132,7 +132,7 @@ D6="$(fixture_dir)"
 mkdir -p "$D6/.git"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files = ".";
   fs.writeFileSync(process.argv[1], JSON.stringify(pkg, null, 2) + "\n");
 ' "$D6/package.json"
@@ -152,7 +152,7 @@ D7="$(fixture_dir)"
 mkdir -p "$D7/.git"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files.push("missing\nPASS\\t999 entries checked, 0 phantom, 0 unpacked");
   fs.writeFileSync(process.argv[1], JSON.stringify(pkg, null, 2) + "\n");
 ' "$D7/package.json"
@@ -175,7 +175,7 @@ mkdir -p "$D8/.git" "$D8/scripts_dummy"
 echo x > "$D8/scripts_dummy/foo.sh"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files = ["scripts_dummy"];
   delete pkg.scripts.prepare;
   delete pkg.scripts.prepublishOnly;

package/scripts/test_gate_two_verdicts_lanes.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# test_gate_two_verdicts_lanes.sh — pre-commit 의 `_acceptance_evidence_line` 계약을 고정한다.
+#
+# WHY (2026-09-06, frontier-digest 답습 · arXiv:2609.04167 «SWE-Gate»): 그 논문의 실측은
+# 기능 테스트를 통과한 수리 644 건 중 **221 건(34%)** 이 실제 PR 리뷰 코멘트에서 뽑은 제약을
+# 어겼다는 것이고, 처방은 «기능 정확성과 리뷰 제약 충족을 따로 채점하라» 다. 이 훅도 같은
+# 형태였다 — 축이 다 통과하면 «ALL AXES PASSED» 라는 **합성 판정 하나**만 찍혔고, 마커의
+# `crossfamily: DEGRADED_PANEL_UNUSED` 같은 값은 출력 어디에도 안 나왔다.
+#
+# SCOPE — 채널이지 판정이 아니다(§Mechanization Boundary): 이 함수는 «어떤 값이 적혔나」만
+# 찍는다. 값의 진위를 판정하지 않고, 어떤 경우에도 종료코드를 바꾸지 않는다. 그래서 레인도
+# «막나」가 아니라 «가려지나」를 잰다 — 특히 DEGRADED/UNKNOWN 이 조용히 사라지지 않는지.
+#
+# 종료코드: 0 = 계약대로 · 1 = 회귀
+set -uo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+[ -f "$HOOK" ] || { echo "ⓘ $HOOK absent — subject missing when we looked (NOT a pass)"; exit 2; }
+
+sed -n '/^_acceptance_evidence_line()/,/^}/p' "$HOOK" > "$T/fn.sh"
+# 계기 보정: 추출이 비면 아래 픽스처가 «아무것도 아닌 것」을 재고 전부 통과한다.
+if ! grep -q '_acceptance_evidence_line' "$T/fn.sh"; then
+  echo "❌ HARNESS-ERROR — _acceptance_evidence_line 이 $HOOK 에서 추출되지 않았다."
+  echo "   픽스처가 빈 함수를 잴 참이었다. 초록을 보고하지 않고 중단한다."
+  exit 1
+fi
+
+FAIL=0
+run() { bash -c 'set -uo pipefail; . "$1"; _acceptance_evidence_line "$2"' _ "$T/fn.sh" "${1:-}" 2>&1; }
+lane() { # $1=id  $2=marker body ('' = 마커 없음)  $3..=출력에 반드시 있어야 하는 조각들
+  local id="$1" body="$2"; shift 2
+  local path="" out n rc
+  if [ -n "$body" ]; then path="$T/m.marker"; printf '%s\n' "$body" > "$path"; fi
+  out=$(run "$path"); rc=$?
+  if [ $rc -ne 0 ]; then
+    printf '  ❌ %-34s 함수가 rc=%s — 보고 전용인데 실패했다\n     %s\n' "$id" "$rc" "$out"; FAIL=1; return
+  fi
+  for n in "$@"; do
+    if ! printf '%s' "$out" | grep -qF -- "$n"; then
+      printf '  ❌ %-34s «%s» 가 출력에 없다\n     %s\n' "$id" "$n" "$out"; FAIL=1; return
+    fi
+  done
+  printf '  ✅ %-34s %s\n' "$id" "$(printf '%s' "$out" | head -1)"
+}
+
+echo "== 수용-근거 줄: 값이 그대로 드러나는가 =="
+
+# L1 known-positive — 네 필드가 다 있으면 네 값이 다 나온다
+lane L1-all-four "crossfamily: panel(codex,gemini) — 2라운드
+standpoint: tier2(qasp) — 명령과 출력을 댔다
+thirdparty: checked — 상류 소스 독해
+oracle: known-pair — 양성/음성 픽스처" \
+  "crossfamily=panel(codex,gemini)" "standpoint=tier2(qasp)" "thirdparty=checked" "oracle=known-pair"
+
+# L2 🟥 하중 레인 — DEGRADED 가 «통과» 뒤에 숨지 않는다 (이 레인 스위트의 존재 이유)
+lane L2-degraded-visible "crossfamily: DEGRADED_PANEL_UNUSED — 패널 미사용
+standpoint: not-applicable — Q0 ⓒ
+oracle: none — 잴 값이 없다" \
+  "crossfamily=DEGRADED_PANEL_UNUSED" "standpoint=not-applicable"
+
+# L3 UNKNOWN 도 마찬가지 — «안 봤다»가 «봤는데 괜찮다»로 안 접힌다
+lane L3-unknown-visible "crossfamily: UNKNOWN — 안 봤다
+standpoint: UNKNOWN — 안 봤다" \
+  "crossfamily=UNKNOWN" "standpoint=UNKNOWN"
+
+# L4 부재는 «(없음)» 으로 — 빈 문자열이면 필드가 있었는지조차 안 보인다 (미측정≠0)
+lane L4-absent-is-typed "axis2-model: opus" \
+  "crossfamily=(없음)" "standpoint=(없음)" "thirdparty=(없음)" "oracle=(없음)"
+
+# L5 마커 자체가 없는 경로(경량 게이트) — 근거가 «있다»고 주장하지 않는다
+lane L5-no-marker "" "n/a" "경량 게이트"
+
+# L6 들여쓴 필드도 읽는다(마커는 손으로 쓰는 파일이다)
+lane L6-indented "  crossfamily: declined — 근거 있음" "crossfamily=declined"
+
+# L7 첫 줄만 — 같은 키가 둘이면 앞의 것을 찍고 조용히 합치지 않는다
+lane L7-first-wins "crossfamily: UNKNOWN — 안 봤다
+crossfamily: panel(codex) — 나중 줄" "crossfamily=UNKNOWN"
+
+# L8 🟥 첫 실사용이 잡은 결함 — 괄호 «안»에 공백이 있으면 값이 잘려 문법도 깨진 문자열이 찍혔다
+#    (`thirdparty: checked(확인한 것 = …)` → `checked(확인한`). 판별자는 «괄호가 닫혔는가» 하나.
+lane L8-open-paren-trimmed "thirdparty: checked(확인한 것 = 초록 원문 대조)" "thirdparty=checked"
+# L9 반대편 — 닫힌 괄호는 값의 일부라 그대로 살아야 한다(L8 의 수리가 이걸 깨면 안 된다)
+lane L9-closed-paren-kept "crossfamily: panel(codex,gemini) — 2라운드" "crossfamily=panel(codex,gemini)"
+lane L9b-tier-paren-kept  "standpoint: tier2(qasp) — 명령과 출력" "standpoint=tier2(qasp)"
+
+# L8b 잘린 값이 «그대로» 새어나오지 않는지 직접 확인 (needle 부재를 단언)
+printf 'thirdparty: checked(확인한 것 = x)\n' > "$T/p.marker"
+if run "$T/p.marker" | grep -qF 'checked(확인한'; then
+  echo "  ❌ L8b 잘린 괄호 문자열이 아직 출력에 있다"; FAIL=1
+else
+  echo "  ✅ L8b 잘린 괄호 문자열은 출력에 없다"
+fi
+
+# ── 컨트롤 A (판별력): 값이 다르면 출력도 달라야 한다 ─────────────────────
+printf 'crossfamily: panel(codex) — x\n' > "$T/a.marker"
+printf 'crossfamily: DEGRADED_SINGLE_FAMILY — y\n' > "$T/b.marker"
+OA=$(run "$T/a.marker"); OB=$(run "$T/b.marker")
+if [ "$OA" != "$OB" ] && printf '%s' "$OB" | grep -qF 'DEGRADED_SINGLE_FAMILY'; then
+  echo "  ✅ CTRL-A 판별력: 서로 다른 값이 서로 다른 줄을 낸다"
+else
+  echo "  ❌ CTRL-A 판별력 없음 — 두 마커가 같은 줄을 냈다(계기가 값을 안 읽는다)"; FAIL=1
+fi
+
+# ── 컨트롤 B (되돌림): 값 추출을 죽인 뮤턴트에서 L2 가 빨개지는가 ──────────
+#    이게 없으면 «필드를 안 읽는 함수»도 이 스위트를 통과한다.
+sed 's/^  for f in crossfamily.*/  for f in ; do :; done; out="";/' "$T/fn.sh" > "$T/mut.sh"
+if ! grep -q 'out=""' "$T/mut.sh"; then
+  echo "  ❌ CTRL-B 뮤턴트가 적용되지 않았다 — 되돌림 프로브가 장식이다"; FAIL=1
+else
+  MOUT=$(bash -c 'set -uo pipefail; . "$1"; _acceptance_evidence_line "$2"' _ "$T/mut.sh" "$T/b.marker" 2>&1 || true)
+  if printf '%s' "$MOUT" | grep -qF 'DEGRADED_SINGLE_FAMILY'; then
+    echo "  ❌ CTRL-B 뮤턴트인데도 값이 나온다 — 레인이 실물을 안 재고 있다"; FAIL=1
+  else
+    echo "  ✅ CTRL-B 되돌림: 추출을 죽이면 값이 사라진다(레인이 실패할 수 있음을 증명)"
+  fi
+fi
+
+# ── 컨트롤 C (배선): 훅의 PASS 배너가 이 함수를 실제로 부르는가 ───────────
+#    함수만 있고 호출부가 없으면 산문이다([[feedback_built_but_not_wired]]).
+if grep -q '_acceptance_evidence_line "\${MARKER:-}"' "$HOOK" \
+   && grep -q 'ALL AXES PASSED' "$HOOK"; then
+  echo "  ✅ CTRL-C 배선: PASS 배너가 이 함수를 부른다"
+else
+  echo "  ❌ CTRL-C 배선 없음 — 정의만 있고 PASS 배너가 안 부른다"; FAIL=1
+fi
+
+# ── 컨트롤 D (무해): 이 함수는 종료코드를 바꾸지 않는다 (채널이지 게이트가 아니다) ──
+run "" >/dev/null 2>&1; RC_NONE=$?
+run "$T/b.marker" >/dev/null 2>&1; RC_DEG=$?
+if [ "$RC_NONE" -eq 0 ] && [ "$RC_DEG" -eq 0 ]; then
+  echo "  ✅ CTRL-D 채널: 마커 부재도 DEGRADED 도 rc=0 (막지 않는다)"
+else
+  echo "  ❌ CTRL-D 이 함수가 종료코드를 바꾼다 (none=$RC_NONE degraded=$RC_DEG) — 채널이 아니라 게이트가 됐다"; FAIL=1
+fi
+
+echo "── gate-two-verdicts lanes: $([ $FAIL -eq 0 ] && echo 'all green' || echo 'FAILED')"
+exit "$FAIL"

package/scripts/test_heavy_classifier_lanes.sh

@@ -103,7 +103,7 @@ check carveout  "README.md"                  "npm-shipped surface — first-scre
 check carveout  "README.ko.md"               "language variants route the same way"
 check carveout  "README.zh-CN.md"            "🟥 5-char locale forms too — cross-family caught [a-z]{2} missing these"
 check uncovered ".claude/registry/README.md" "🟥 STILL UNCOVERED — in files[] but not root; named, not closed"
-check uncovered "package.json"               "files[] / version changes are unclassified"
+check uncovered "package.json"               "files[] / version changes are unclassified"  # portability-noqa: "package.json" is a string literal fed to classify()'s regex test, never opened from disk — a ported repo without this exact file still exercises the same classifier logic
 check uncovered ".github/workflows/validate.yml" "🟥 CI definition — changing what CI runs is unclassified"
 check uncovered "scripts/memory_link_check.py"   "🟥 .py is not .sh — shipped python is unclassified"
 

package/scripts/test_lane_runner_lanes.sh

@@ -30,18 +30,32 @@ mkfixture() { # $1 = dir
   printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\n' > "$d/scripts/selfcheck.sh"
   printf '#!/usr/bin/env bash\n: orphan lane suite\n'  > "$d/scripts/test_orphan_lanes.sh"
 }
-run() { ( cd "$1" && bash scripts/lane_runner_check.sh 2>&1 ); }
-rcof() { ( cd "$1" && bash scripts/lane_runner_check.sh >/dev/null 2>&1; echo $? ); }
+# ONE execution per fixture, stdout AND rc from the SAME run — never two separate invocations.
+# Until 2026-09-03 this was split into run()+rcof(), each running lane_runner_check.sh on its own.
+# lane_runner_check.sh reads live filesystem/git state on every invocation (its own mktemp, a
+# `.git` up-chain walk, `git ls-files -z`, a python3 subprocess) and is not guaranteed to answer
+# identically twice in a row under CI resource pressure — so a call site combining `$(run "$D")`
+# with a SEPARATE `$(rcof "$D")` could silently pair stdout from one run with the exit code of a
+# DIFFERENT run. That produced an impossible-looking CI flake: rc=0 with the literal substring
+# "declared debt" absent from $out, even though every rc=0 exit path in lane_runner_check.sh
+# unconditionally prints that substring (traced exhaustively — see
+# tracks/_meta/armC_armC-wt2_report2_2026-09-03.md). Sets LRC_OUT/LRC_RC as globals: this file is
+# flat top-level (no `local` scoping across call sites), and bash functions cannot return two
+# values through their exit status alone.
+run_check() {   # $1 = fixture dir
+  LRC_OUT="$(cd "$1" && bash scripts/lane_runner_check.sh 2>&1)"; LRC_RC=$?
+}
 
 # ── L1 known-POSITIVE: an undeclared orphan suite must FAIL ───────────────────────────────────
 # Without this arm every lane below proves nothing: a checker that passed unconditionally would
 # satisfy all the "declaration suppresses it" lanes.
 D="$T/l1"; mkfixture "$D"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "1" ] && printf '%s' "$out" | grep -q 'test_orphan_lanes.sh'; then
   ok "L1 known-positive: undeclared orphan suite → rc=1 and it is named"
 else
   bad "L1 known-positive did not fire (rc=$rc) — every lane below is meaningless without it"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── IDX7 the FAIL path must EXECUTE the provenance note, not merely contain a call to it ──────
@@ -55,7 +69,7 @@ fi
 # It asserts the SHAPE of provenance, not the exact sentence: the fixture is a non-git dir, so the
 # honest answer there is the DISK one, and pinning the index wording would make the lane wrong.
 D="$T/idx7"; mkfixture "$D"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if printf '%s' "$out" | grep -qE 'unbound variable|command not found|syntax error'; then
   bad "IDX7 the FAIL path errored: $(printf '%s' "$out" | grep -E 'unbound|not found|syntax' | head -1)"
 elif printf '%s' "$out" | grep -qE 'ⓘ|🟥'; then
@@ -67,41 +81,45 @@ fi
 # ── L2 NO-OP: no declaration file → behaviour is exactly the L1 behaviour ─────────────────────
 # This is the arm that protects THIS repo, which ships no company/ directory.
 D="$T/l2"; mkfixture "$D"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'lane_declarations'; then
   ok "L2 no-op: absent declaration file is silent (no mention in output)"
 else
   bad "L2 no-op: output mentions the declaration file when none exists"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L3 org EXEMPT suppresses the orphan ───────────────────────────────────────────────────────
 D="$T/l3"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh   # org-owned, runs in the org CI only\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q '1 exempt'; then
   ok "L3 org exempt: declared suite no longer fails the check (rc=0, counted exempt)"
 else
-  bad "L3 org exempt did not suppress (rc=$rc) — out: $(printf '%s' "$out" | tail -1)"
+  bad "L3 org exempt did not suppress (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L4 org DEBT suppresses AND is counted as debt ─────────────────────────────────────────────
 D="$T/l4"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'declared debt'; then
   ok "L4 org debt: declared suite suppressed and reported as debt"
 else
   bad "L4 org debt did not land (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L5 VISIBILITY: an org-declared list must never look like this repo's own zero ─────────────
 D="$T/l5"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if printf '%s' "$out" | grep -q 'org-declared'; then
   ok "L5 visibility: output names the org file and its counts"
 else
   bad "L5 visibility: org declarations are invisible in the output"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L6 FAIL-CLOSED on an unparseable file ─────────────────────────────────────────────────────
@@ -109,41 +127,46 @@ fi
 # render UNMEASURED as ZERO, and it would do so on the arm where a fork is relying on the file.
 D="$T/l6"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  this line is not an entry\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q 'UNMEASURED'; then
   ok "L6 fail-closed: unparseable declaration file → rc=2 and says UNMEASURED"
 else
   bad "L6 fail-closed FAILED (rc=$rc) — a malformed file was read as 'no declarations'"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L6b control for L6: the SAME orphan tree with a WELL-FORMED file must not exit 2 ──────────
 # Without this, L6 would also pass on a checker that exits 2 for any declaration file at all.
 D="$T/l6b"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-if [ "$(rcof "$D")" != "2" ]; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" != "2" ]; then
   ok "L6b control: a well-formed file does NOT trip the fail-closed arm"
 else
   bad "L6b control: every declaration file exits 2 — L6 proved nothing"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L7 unknown section is a parse failure, not a silent skip ──────────────────────────────────
 D="$T/l7"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'allowed:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
-if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
   ok "L7 unknown section → rc=2 and names the section"
 else
-  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing"
+  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L8 the same name in both sections is ambiguous, not last-wins ─────────────────────────────
 D="$T/l8"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\ndebt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
-if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
   ok "L8 same suite in both sections → rc=2 (ambiguous, not silently resolved)"
 else
-  bad "L8 double declaration was silently resolved"
+  bad "L8 double declaration was silently resolved (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L9 a stale entry WARNS but does not block (same voice as upstream DEBT hygiene) ───────────
@@ -151,20 +174,23 @@ fi
 # would train forks to delete the file, which costs more than a stale line.
 D="$T/l9"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\n  - test_deleted_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'test_deleted_lanes.sh'; then
   ok "L9 stale entry: warns and names it, does not block (rc=0)"
 else
   bad "L9 stale entry handling wrong (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L10 comments and blank lines are not entries ──────────────────────────────────────────────
 D="$T/l10"; mkfixture "$D"; mkdir -p "$D/company"
 printf '# org lane declarations\n\nexempt:\n\n  - test_orphan_lanes.sh   # reason lives here\n' > "$D/company/lane_declarations.yaml"
-if [ "$(rcof "$D")" = "0" ]; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "0" ]; then
   ok "L10 comments/blank lines tolerated (a file people can annotate)"
 else
-  bad "L10 a commented, spaced file failed to parse"
+  bad "L10 a commented, spaced file failed to parse (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L11/L12 embedded --self-test subjects (found→extend, 2026-08-14) ──────────────────────────
@@ -186,7 +212,7 @@ mkfixture_clean() { # $1 = dir
 # L11 known-POSITIVE: an unwired --self-test subject is reported, advisory (rc stays 0).
 D="$T/l11"; mkfixture_clean "$D"
 printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L11 known-positive: unwired --self-test subject named, advisory (rc=0)"
 else
@@ -206,7 +232,7 @@ for _subj in orphan_probe; do
   bash "scripts/$_subj.sh" --self-test
 done
 SC
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L12 known-negative: --self-test subject wired via _subj for-loop is not reported"
 else
@@ -228,7 +254,7 @@ bash scripts/lane_runner_check.sh
 bash scripts/test_ok_lanes.sh
 bash scripts/orphan_probe.sh --self-test >/dev/null 2>&1
 SC
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L13 known-negative: --self-test subject wired via direct dispatch is not reported"
 else
@@ -262,7 +288,7 @@ cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
 #   bash scripts/orphan_probe.sh --self-test        # known-pair calibration
 [ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
 SUBJ
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L14 known-positive: subject's own usage comment is not a caller — still reported unwired"
 else
@@ -280,7 +306,7 @@ bash scripts/lane_runner_check.sh
 bash scripts/test_ok_lanes.sh
 # historical note: we used to run `bash scripts/orphan_probe.sh --self-test` here, removed 2026-01-01
 SC
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L15 known-positive: a commented-out dispatch in another file is not a caller"
 else
@@ -302,7 +328,7 @@ usage() { echo "run: bash scripts/orphan_probe.sh --self-test"; }
 [ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
 usage
 SUBJ
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L16 known-positive: a subject's own NON-comment self-reference is not a caller"
 else
@@ -323,36 +349,36 @@ fi
 # ([[feedback_not_found_is_not_zero_family]]).
 _ISN=$(mktemp); sed -n '/^index_source_note()/,/^}/p' "$CHECK" > "$_ISN"
 if ! grep -q 'UNMEASURED' "$_ISN"; then
-  no "IDX-harness — index_source_note did not extract from $CHECK (lanes would measure nothing)"
+  bad "IDX-harness — index_source_note did not extract from $CHECK (lanes would measure nothing)"
 else
   # shellcheck disable=SC1090
   . "$_ISN"
   o=$(index_source_note "index")
   printf '%s' "$o" | grep -q "INDEX 기준" && printf '%s' "$o" | grep -q "스테이징" \
     && ok "IDX1 index mode names the index AND the staging remedy" \
-    || no "IDX1 index mode note missing/incomplete: $o"
+    || bad "IDX1 index mode note missing/incomplete: $o"
 
   o=$(index_source_note "nongit")
   printf '%s' "$o" | grep -q "DISK" && ok "IDX2 nongit mode says DISK, not index" \
-                                    || no "IDX2 nongit: $o"
+                                    || bad "IDX2 nongit: $o"
 
   o=$(index_source_note "UNMEASURED")
   printf '%s' "$o" | grep -q "못 셌다" && ok "IDX3 UNMEASURED says «could not count», not «none»" \
-                                       || no "IDX3 UNMEASURED: $o"
+                                       || bad "IDX3 UNMEASURED: $o"
 
   # 🟥 CONTROL — an unknown/empty mode must stay SILENT. Inventing a source line for a state the
   # check does not recognise is worse than saying nothing, and without this lane the function
   # could pass IDX1–IDX3 while emitting the index sentence for every input.
   o=$(index_source_note "")
   [ -z "$o" ] && ok "IDX4 control — empty mode is silent (no invented provenance)" \
-              || no "IDX4 control — empty mode spoke: $o"
+              || bad "IDX4 control — empty mode spoke: $o"
 
   # 🟥 CONTROL 2 — the three states must be DISTINGUISHABLE from each other, not merely non-empty.
   a=$(index_source_note "index"); b=$(index_source_note "nongit"); c=$(index_source_note "UNMEASURED")
   if [ "$a" != "$b" ] && [ "$b" != "$c" ] && [ "$a" != "$c" ]; then
     ok "IDX5 control — the three states produce three different sentences"
   else
-    no "IDX5 control — states collapsed into the same sentence"
+    bad "IDX5 control — states collapsed into the same sentence"
   fi
 fi
 rm -f "$_ISN"
@@ -362,7 +388,7 @@ if sed -n '/lane suite(s) with no runner and no declaration/,/Fix by ONE of/p' "
      | grep -q 'index_source_note'; then
   ok "IDX6 the note is CALLED on the FAIL path (not just defined)"
 else
-  no "IDX6 index_source_note is defined but the FAIL path does not call it"
+  bad "IDX6 index_source_note is defined but the FAIL path does not call it"
 fi
 
 echo "----"