@chrono-meta/fh-gate 2.3.0 → 2.4.0

package/templates/.git-hooks/pre-commit

@@ -717,6 +717,217 @@ validate_crossfamily_leg() { # $1 = marker path
   return 0
 }
 
+# ── standpoint: typed value lane (2026-08-17) ────────────────────────────────
+# Grammar:  standpoint: <VALUE>[ — <reason>]
+#
+# WHY NOW. This field shipped 2026-08-14 with its value DELIBERATELY unvalidated — the doctrine
+# said "mechanize on the first recorded false value, not before". That value is now on record:
+# a `release_2.3.0` marker wrote `not-applicable` on a delta whose OWN grounds line concedes
+# "소비자 install 의 게이트 수용은 바뀐다 (BREAKING 2건)", and two 2026-08-14 deltas that changed
+# shipped gate scripts / a shipped SKILL.md carried no line at all. The threshold this field set
+# for itself is met.
+#
+# SCOPE — channel, not judgment (CLAUDE.md §Mechanization Boundary). This asserts properties of the
+# RECORD: present · single · a member of the closed enum · non-vacuous · not wearing the OTHER
+# axis's tokens. It never asserts the value is CORRECT — that stays with the reader, by design.
+#
+# 🟥 NAMED RESIDUAL — the EXECUTION claim warns, it does not block. tier2/tier2b/tier3 assert that
+# something was RUN in the target, which §7 calls "the load-bearing half". Blocking on that needs a
+# vocabulary grep, and on first contact with the real corpus that grep over-blocked a legitimate
+# marker whose grounds read "그 레포에서 실제로 호출해 양·음 arm 을 확인했다" — it did not know 「호출」.
+# Over-blocking trains `--no-verify`, which would disarm the Destructive-Op gate in this same hook.
+# So the cost is stated instead of hidden: a fabricated tier2 with a fluent reason PASSES this lane.
+# Closing that is §4-b's job (cross-family reads the marker), not this lane's.
+#
+# 🟥 DOGFOOD RESULT, STATED SO NOBODY READS THIS AS MORE THAN IT IS — the very marker whose false
+# value MET this field's mechanization threshold (`release_2.3.0`, which wrote `not-applicable` on a
+# release delta) **PASSES this lane**, because its grounds sentence is long and specific. That is not
+# a bug in the lane; it is the Mechanization Boundary holding: the channel is checked, the judgment
+# is not. Anyone reporting that this wiring "closed the self-report axis" is wrong. What closed is
+# the shape of the record; what remains open is whether the recorded answer is true.
+#
+# Calibration before wiring (2026-08-17): known-pair 12/12 both directions; run against all 24
+# corpus markers carrying the field → 7 blocked, every one a real defect (6 bare `not-applicable`,
+# independently matching a hand count, + 1 marker carrying TWO contradictory standpoint lines),
+# and 0 over-blocks. Anchor: scripts/test_marker_standpoint_lanes.sh
+validate_standpoint_leg() { # $1 = marker path
+  local m="$1" line val reason n quoted=""
+  n=$(grep -cE '^[[:space:]]*standpoint:' "$m" 2>/dev/null); n=${n:-0}
+  if [ "$n" -eq 0 ]; then
+    echo "  ❌ FAIL — load-bearing file staged with no 'standpoint:' line in the Axes 2-3 marker."
+    echo "     State the answer, whatever it is — the gate blocks silence, not a modest value."
+    echo "     Settle the TARGET CLASS first (§7 Q0), then the tier:"
+    echo "       standpoint: not-applicable — <what you checked to conclude no target exists>"
+    echo "       standpoint: tier1b(pmh-dev) — read the target's own files, executed nothing"
+    echo "       standpoint: tier2(qasp-dev) — ran <command> there, saw <output>"
+    echo "       standpoint: DEGRADED_NOT_RUN — target reachable, not run (<why>)"
+    echo "     Append one line to: $m"
+    return 1
+  fi
+  # Duplicate guard — same defect class the crossfamily lane closes: a marker is append-only in
+  # practice and readers take the FIRST match, so an appended correction is silently shadowed.
+  # Measured in this corpus: one marker carries `tier1` at :32 and `not-applicable` at :89.
+  if [ "$n" -gt 1 ]; then
+    echo "  ❌ FAIL — marker carries MORE THAN ONE 'standpoint:' line."
+    grep -nE '^[[:space:]]*standpoint:' "$m" | sed 's/^/       /'
+    echo "     A later line does not supersede an earlier one — the reader takes the first."
+    echo "     Delete the stale line and leave exactly one."
+    return 1
+  fi
+  line=$(grep -m1 -E '^[[:space:]]*standpoint:' "$m" | sed -E 's/^[[:space:]]*standpoint:[[:space:]]*//')
+  case "$line" in '"'*|"'"*) quoted=" [format: value wrapped in quotes — an auditor's grep for
+       'standpoint: tier2' misses it; drop the quotes next time]";; esac
+  line=$(printf '%s' "$line" | sed -E 's/^["'"'"']//; s/["'"'"']$//')
+  val=$(printf '%s' "$line" | sed -E 's/[[:space:]]*(—|--).*$//' | sed -E 's/[[:space:]]+$//')
+  reason=$(printf '%s' "$line" | sed -E 's/^[^—-]*((—|--)[[:space:]]*)?//')
+  # Cross-axis contamination. `crossfamily:` and `standpoint:` each carry a three-way degrade
+  # triad and the doctrine says the literals are DISTINCT ON PURPOSE. Borrowing the other axis's
+  # token records the wrong axis while looking well-formed.
+  case "$val" in
+    DEGRADED_SINGLE_FAMILY*|DEGRADED_PANEL_UNUSED*|panel\(*|declined)
+      echo "  ❌ FAIL — '$val' belongs to the crossfamily: axis, not standpoint:."
+      echo "     crossfamily = WHICH MODEL FAMILY reviewed. standpoint = WHOSE REPO was ground truth."
+      echo "     standpoint's own triad: DEGRADED_NO_TARGET_ACCESS (could not) /"
+      echo "     DEGRADED_NOT_RUN (did not) / UNKNOWN (did not look)."
+      return 1 ;;
+  esac
+  case "$val" in
+    tier1)
+      echo "  ✅ standpoint leg: tier1 (content-only — a scoping fact, not a failure)$quoted" ;;
+    tier1b\(*\)|tier2\(*\)|tier2b\(*\)|tier3\(*\))
+      case "$val" in
+        tier2\(*\)|tier2b\(*\)|tier3\(*\))
+          if [ "${#reason}" -lt 20 ] || ! printf '%s' "$reason" \
+              | grep -qiE 'ran |run |실행|돌렸|호출|invok|call|rc=|exit |output|출력|suite|스위트|test|bash |grep |npm |pytest|command|커맨드|arm'; then
+            echo "  ⚠️  standpoint leg: $val — recorded, but the grounds do not NAME an execution."
+            echo "     ${val%%(*} asserts code RAN in the target. The discriminator is mechanical:"
+            echo "     name the command you ran and the output you saw. If you only read files,"
+            echo "     the honest rung is tier1b — weaker on purpose, so the owed arm stays visible."
+            echo "     Advisory by design (see the named residual above this function)."
+          else
+            echo "  ✅ standpoint leg: $val$quoted"
+          fi ;;
+        *) echo "  ✅ standpoint leg: $val$quoted" ;;
+      esac ;;
+    not-applicable)
+      # §7: asserting non-applicability without naming what was checked is indistinguishable from
+      # UNKNOWN wearing a permissive label. Measured: 6 bare instances in this corpus.
+      if [ "${#reason}" -lt 20 ]; then
+        echo "  ❌ FAIL — bare 'not-applicable' with no grounds on the same line."
+        echo "     That is UNKNOWN wearing a permissive label. Name what you checked:"
+        echo "     no named peer carries this surface AND it changes no consumer-visible behavior."
+        return 1
+      fi
+      echo "  ✅ standpoint leg: not-applicable$quoted" ;;
+    DEGRADED_NO_TARGET_ACCESS*|DEGRADED_NOT_RUN*|UNKNOWN*)
+      if [ "${#reason}" -lt 20 ]; then
+        echo "  ❌ FAIL — $val without substantive grounds on the same line."
+        echo "     could-not / did-not / did-not-look are separate values on purpose; collapsing"
+        echo "     them renders an unrun probe as a zero finding. Name what you probed."
+        return 1
+      fi
+      echo "  ⚠️  standpoint leg: $val — recorded, not silent" ;;
+    *)
+      echo "  ❌ FAIL — '$val' is not a member of the standpoint: enum."
+      echo "     Closed enum: tier1 · tier1b(<h>) · tier2(<h>) · tier2b(<h>) · tier3(<h>) ·"
+      echo "     not-applicable · DEGRADED_NO_TARGET_ACCESS · DEGRADED_NOT_RUN · UNKNOWN"
+      echo "     Default-deny: an unrecognised value is UNDECIDABLE, never assumed benign."
+      return 1 ;;
+  esac
+  return 0
+}
+
+# ── thirdparty: typed value lane (2026-08-17) ────────────────────────────────
+# Grammar:  thirdparty: <VALUE>(<grounds>)      ·  UNKNOWN takes no parenthetical
+#
+# WHAT THIS AXIS IS — and it has TWO halves, which is what made getting it wrong so easy.
+# The 6-axis canon (fh_three_layer_canon.md:243) defines ⓓ by what it RECEIVES: «문제 + 남의
+# 코드베이스», and it asks two questions:
+#   ① prior art        — has this claimed-new thing already been solved outside?   checked/none-found
+#   ② harness-level     — how does my change look from ANOTHER HARNESS's repo and   peer-review
+#      adversarial        persona? (operator: put Sonnet in gstack, wear the gstack
+#                         persona, review the qasp change — a cross-FAMILY, harness-scoped
+#                         adversarial review. FH is the GOVERNOR: it creates the situation,
+#                         observes, and judges. What the 4-axis gate verifies is the OPINION
+#                         that third harness produced, judged LOCALLY — it does not put a gate
+#                         on someone else's repo.)
+# It is NOT "I talked to another session". The canonical spec
+# (`.claude/rules/fh_4axis_gate.md`) has said so since the field shipped, and the evidence that
+# created it was 6 presentation claims that turned out to have prior art (mutation testing,
+# promptfoo/DeepEval, an official cross-family plugin, …).
+#
+# WHY NOW — the first recorded false values exist, and they are the author's own. Measured across
+# the marker corpus 2026-08-17: 4 markers used the enum correctly; **2 wrote free prose about
+# peer-session contact** and matched no enum member at all. That is the field-canon failure this
+# repo already names — normalizing a harness term into a general concept ("third party" → "another
+# session"). Presence was checked; the value was not; nothing caught it.
+#
+# SCOPE — channel, not judgment (CLAUDE.md §Mechanization Boundary). This asserts the RECORD is a
+# member of the closed enum and names non-vacuous grounds. It never asserts the prior-art search
+# was thorough, nor that what a third party told you is TRUE — 🟥 that second one is deliberate and
+# load-bearing: the axis exists to surface information you could not predict, and the truth of what
+# comes back is adjudicated by the OTHER axes (adversarial · grounding · first-real-use), which is
+# what the 4-axis gate is for. A wrong answer from a third party is that party's defect, possibly
+# one to go fix; it is not something this field should be asked to certify.
+#
+# TRIGGER — validate IF PRESENT. Presence stays pointer-driven (`ⓓ=→thirdparty`), deliberately:
+# requiring the field on every load-bearing change would force a prior-art search per commit, and
+# over-blocking trains the override that disarms the Destructive-Op gate in this same hook.
+#
+# Calibration before wiring: the corpus supplied BOTH arms — peer-authored markers 4/4 PASS,
+# author's own malformed 2/2 BLOCK, plus 6 synthetic shapes, 0 over-blocks. An earlier draft DID
+# over-block 3 legitimate markers by looking for the closing paren on the first line when the
+# grounds wrap across lines; the corpus caught it. Anchor: scripts/test_marker_thirdparty_lanes.sh
+validate_thirdparty_leg() { # $1 = marker path
+  local m="$1" line val reason n
+  n=$(grep -cE '^[[:space:]]*thirdparty:' "$m" 2>/dev/null); n=${n:-0}
+  [ "$n" -eq 0 ] && return 0   # absent is governed by the ⓓ pointer check above, not here
+  if [ "$n" -gt 1 ]; then
+    echo "  ❌ FAIL — marker carries MORE THAN ONE 'thirdparty:' line."
+    grep -nE '^[[:space:]]*thirdparty:' "$m" | sed 's/^/       /'
+    echo "     Readers take the first, so an appended correction is silently shadowed."
+    return 1
+  fi
+  line=$(grep -m1 -E '^[[:space:]]*thirdparty:' "$m" | sed -E 's/^[[:space:]]*thirdparty:[[:space:]]*//')
+  val=$(printf '%s' "$line" | sed -E 's/\(.*$//' | sed -E 's/[[:space:]]*(—|--).*$//' | sed -E 's/[[:space:]]+$//')
+  # Cross-axis contamination — standpoint's tiers and crossfamily's tokens are different axes.
+  case "$val" in
+    tier1|tier1b|tier2|tier2b|tier3|panel|declined|DEGRADED_SINGLE_FAMILY|DEGRADED_PANEL_UNUSED|DEGRADED_NO_TARGET_ACCESS)
+      echo "  ❌ FAIL — '$val' belongs to another axis, not thirdparty:."
+      echo "     standpoint = whose repo was ground truth · crossfamily = which model family reviewed"
+      echo "     thirdparty = was this claimed-new thing already done OUTSIDE this repo."
+      return 1 ;;
+  esac
+  case "$val" in
+    UNKNOWN)
+      echo "  ⚠️  thirdparty leg: UNKNOWN — 안 봤다. Recorded, not silent." ;;
+    peer-review|checked|none-found|not-applicable|DEGRADED_NO_ACCESS|DEGRADED_NOT_RUN)
+      # The parenthetical may wrap across lines; only require that it OPENS with content after it.
+      case "$line" in *\(*) ;; *)
+        echo "  ❌ FAIL — '$val' without a (<grounds>) parenthetical."
+        echo "     none-found without naming WHAT you searched is indistinguishable from not looking."
+        return 1 ;;
+      esac
+      reason=$(printf '%s' "$line" | sed -E 's/^[^(]*\(//')
+      if [ "${#reason}" -lt 12 ]; then
+        echo "  ❌ FAIL — '$val(...)' grounds are vacuous. Name what was searched and what came back."
+        return 1
+      fi
+      echo "  ✅ thirdparty leg: $val" ;;
+    *)
+      echo "  ❌ FAIL — '$val' is not a member of the thirdparty: enum."
+      echo "     Closed enum: peer-review(<harness>/<persona> -> <target>, <what came back>) ·"
+      echo "     checked(<searched/found>) · none-found(<searched>) ·"
+      echo "     DEGRADED_NO_ACCESS(<why>) · DEGRADED_NOT_RUN(<why>) · UNKNOWN · not-applicable(<why>)"
+      echo "     🟥 ⓓ3자대면 = third-party PRIOR ART, not 'I talked to another session'. The two"
+      echo "     markers that made this lane necessary both made exactly that substitution."
+      return 1 ;;
+  esac
+  return 0
+}
+
+
+
 # ── 4축 자기 대조 — «어느 축을 돌렸고 어느 축을 안 돌렸나» 형식 검사 ────────────
 # CLAUDE.md §3층 자기 대조가 마커에 3줄을 요구한다. 그중 **기계로 볼 수 있는 두 줄**만 여기서
 # 강제한다. 나머지(①영혼을 «설계 전에» 썼는가)는 **원리적으로 확인 불가**라 안 넣는다 —
@@ -1303,6 +1514,8 @@ if [ -n "$LOADBEARING" ]; then
   fi
   MARKER_LB="$REPO_ROOT/tracks/_meta/.axes_23_passed_${BRANCH_SLUG}_${TODAY}.marker"
   if validate_crossfamily_leg "$MARKER_LB"; then :; else FAILED=1; fi
+  if validate_standpoint_leg "$MARKER_LB"; then :; else FAILED=1; fi
+  if validate_thirdparty_leg "$MARKER_LB"; then :; else FAILED=1; fi
 fi
 
 # ── staged-blob materializer (advisory linters) ───────────────────────────────
@@ -1411,6 +1624,35 @@ if [ -f "$PL_LINT" ]; then
   fi
 fi
 
+# ── Pre-ship read reminder (advisory) ─────────────────────────────────────────
+# WHY (2026-08-17, ⓓ3자대면 첫 실사용의 답습분). A third harness (gstack), wearing its own
+# `/plan-devex-review` persona, reviewed a peer harness's change and asked a question neither FH
+# nor that harness asks: **who opens this file, and what do they see in the first eight lines?**
+# Its finding: a human-facing report had been shipped to three surfaces where the body was 3 lines
+# under 21 lines of fixed template, the answer to "did it pass?" was buried in the 4th bullet, and
+# the last impression was "readers may skip this". The delta that shipped it was correct code.
+#
+# FH reached the same place independently the same day from a different axis — "readability is
+# measured only by rendering it or by a person; a static scan catches what is ABSENT, never what is
+# UNREADABLE", with 12 findings and 0 caught by static scanners. **Two independent arrivals** is
+# why this was the one item the internalization filter accepted out of four
+# (`harness_incubator_doctrine.md` §4-c).
+#
+# 🟥 WHAT THIS IS NOT. It does not judge readability, and it never blocks. Judging "is this
+# readable" is exactly the frozen-judgment class §Mechanization Boundary reserves for people, and a
+# vocabulary test for "human-facing document" over-blocked a legitimate case the same day it was
+# first tried. The trigger is therefore a PATH SET (what actually ships to readers), not a
+# vocabulary guess, and its whole output is one line of salience.
+_PRESHIP=$(printf '%s\n' "$STAGED" | grep -E '^(README([._a-z]*)?\.md|CHEATSHEET\.md|CATALOG\.md|docs/[^/]*\.md|templates/[^/]*\.md)$' || true)
+if [ -n "$_PRESHIP" ]; then
+  echo "[Gate] reader-facing surface staged — pre-ship read reminder (advisory)..."
+  printf '%s\n' "$_PRESHIP" | sed 's/^/       /'
+  echo "  ⚠️  이 파일들은 «사람이 연다». 나가기 전에 한 번 «독자로서» 읽었나?"
+  echo "     첫 8줄에 결론이 있나 · 본문이 템플릿에 안 덮이나 · 마지막 인상이 무엇인가"
+  echo "     렌즈가 이미 있다: /sim-conductor A-1 (beginner cold-read) 또는 직접 렌더해서 읽기"
+  echo "  (advisory — 막지 않는다. 「읽었는가」는 이 훅이 보증할 수 없고 보증하려 들지도 않는다.)"
+fi
+
 # ── Novelty-claim ledger (advisory) ───────────────────────────────────────────
 # "Ask the world before asserting novelty" is an INTENT trigger — un-hookable, like the
 # repo-go-public surface. So this does not force the asking; it makes NOT having asked visible

package/templates/PRE-PUBLISH-CHECKLIST.md

@@ -83,3 +83,25 @@ A pre-publish catch is a process win worth logging:
 
 **Done when**: Step 0 pre-flags clean (or escalated to full scan) · Step 1 both gates non-LEAK ·
 publish executed *after* the gates passed, never before.
+
+## Read it as a reader, once, before it goes out
+
+Not a correctness check — the code can be right and this still fails. Open the thing a **reader**
+opens and look at what they see:
+
+- [ ] Is the **conclusion in the first ~8 lines**, or is it buried under banners, metadata and
+      "how to read this table"?
+- [ ] Does the **body survive the template**? (measured case: 3 lines of content under 21 lines of
+      fixed boilerplate)
+- [ ] What is the **last impression**? (measured case: the final line told the reader they could
+      skip it)
+- [ ] Does it say **what the reader should do next**?
+
+A lens already exists — `/sim-conductor` A-1 (`beginner` cold-read) — or just render it and read it.
+
+🟥 **Why this is a human step and not a scan**: a static check catches what is ABSENT, never what is
+UNREADABLE. Two independent measurements arrived here the same day (2026-08-17): one harness axis
+found 12 readability defects with **0** caught by static scanners; a third-harness review
+(`harness_incubator_doctrine.md` §4-c) found a shipped report whose answer to "did it pass?" sat in
+the fourth bullet. The pre-commit hook prints an advisory reminder when a reader-facing surface is
+staged — it reminds, it does not certify.

package/templates/regression_guard.sh

@@ -64,13 +64,41 @@ if [ "${1:-}" = "--pr" ]; then
   fi
   PR_BRANCH="$2"
   BASE_BRANCH="${3:-main}"
-  BASE_REF=$(git merge-base "$BASE_BRANCH" "$PR_BRANCH" 2>/dev/null)
+  # Resolve each side to a ref that actually EXISTS in this checkout.
+  #
+  # WHY (measured 2026-08-17, 5 of 5 SAMPLED CI runs — not an exhaustive audit): a bare branch
+  # NAME does not resolve in a GitHub Actions PR checkout. actions/checkout lands on a DETACHED
+  # HEAD and creates refs/remotes/origin/*, not local branches — so `git merge-base main <branch>`
+  # found neither side, returned empty, and this block exited 3. `fetch-depth: 0` was already set
+  # and is NOT the cause; the history was present, the NAMES were not. The workflow then rendered
+  # that instrument error as a green PASS (fixed in the same commit).
+  #
+  # 🟥 THE FIRST FIX FOR THIS INTRODUCED A WORSE HOLE, caught by cross-family review before it
+  # shipped. It resolved `ref -> origin/ref -> refs/remotes/origin/ref` and fell back to HEAD.
+  # `github.head_ref` is only a branch NAME, not owner-qualified, so a **fork PR whose branch is
+  # named `main`** resolved the PR side to the BASE repo's `main` — merge-base(main, main) = main,
+  # empty diff, SKIP, green. A guard silently comparing a branch to itself is worse than one that
+  # errors. So: NO name-guessing and NO silent HEAD fallback. Callers pass something
+  # unambiguous (a SHA, or an explicit `origin/<ref>`); anything that does not resolve EXACTLY
+  # is an instrument error, and the workflow now fails closed on that.
+  _rg_resolve_ref() { # $1 = ref-ish; echoes it iff it resolves EXACTLY as given (rc=1 otherwise)
+    git rev-parse --verify --quiet "${1}^{commit}" >/dev/null 2>&1 && printf '%s' "$1"
+  }
+  _BASE_RESOLVED=$(_rg_resolve_ref "$BASE_BRANCH") || _BASE_RESOLVED=""
+  _HEAD_RESOLVED=$(_rg_resolve_ref "$PR_BRANCH")  || _HEAD_RESOLVED=""
+  if [ -z "$_BASE_RESOLVED" ] || [ -z "$_HEAD_RESOLVED" ]; then
+    echo "ERROR: ref does not resolve — base='$BASE_BRANCH'->'${_BASE_RESOLVED:-<none>}' head='$PR_BRANCH'->'${_HEAD_RESOLVED:-<none>}'" >&2
+    echo "       Pass an unambiguous ref (a SHA, or origin/<branch>). Guessing is how a fork PR" >&2
+    echo "       branch named 'main' silently compared the base repo's main to itself." >&2
+    exit 3
+  fi
+  BASE_REF=$(git merge-base "$_BASE_RESOLVED" "$_HEAD_RESOLVED" 2>/dev/null)
   if [ -z "$BASE_REF" ]; then
-    echo "ERROR: cannot compute merge-base for $PR_BRANCH vs $BASE_BRANCH" >&2
+    echo "ERROR: cannot compute merge-base for $_HEAD_RESOLVED vs $_BASE_RESOLVED" >&2
     exit 3
   fi
-  HEAD_REF="$PR_BRANCH"
-  echo "PR MODE: merge-base=$(git rev-parse --short "$BASE_REF") branch=$PR_BRANCH"
+  HEAD_REF="$_HEAD_RESOLVED"
+  echo "PR MODE: merge-base=$(git rev-parse --short "$BASE_REF") base=$_BASE_RESOLVED head=$_HEAD_RESOLVED"
 elif [ "${1:-}" = "--staged" ]; then
   # Pre-commit context: evaluate the staged index against HEAD. On a direct-to-main
   # workflow, --pr's merge-base(main,main)=HEAD yields an empty diff, so staged changes