@chrono-meta/fh-gate 2.6.0 → 2.8.0

package/knowledge/shared/dialogue/ai_dialogue_playbook.md

@@ -91,6 +91,109 @@ API 키 대화창 기록 방지 — Write 툴로 `.env` 직접 생성 (대화창
 
 **Forbidden response**: "I can't do that — I'm not in that project's cwd." Always check if Agent dispatch covers it first.
 
+🟥 **A live peer session is a different thing from a subagent — and the default reading is wrong.**
+Operator, 2026-08-21, correcting exactly that: *"이작업을 분할하라는게 아니라 논의를 해보라는
+뜻이었어 작업은 니가하고"* → *"주위피어에는 **두뇌를빌려서 네 수행에 대한 판단**을 도움받아보라는
+거였으니"*.
+
+| | you dispatch it | you ask a peer |
+|---|---|---|
+| what moves | **the work** | **the judgment** |
+| what comes back | a completed unit | a verdict on *your* execution |
+| the peer's own work | — | keeps running; you did not take it |
+
+The reflex is to read "talk to the peers" as "split the task across the peers", because a peer
+looks like a bigger subagent. It is not. The operator's own framing, same day:
+
+> *"예열되어 다른갈래로 뻗어있는 자신의 다른 면모들은 하나의 **별개하네스(동일맥락을 공유하는)**
+> 로도 동작도가능하므로 인사이트를 얻을수있다"*
+
+A peer is **pre-warmed on its own branch of the same context** — a separate harness that shares
+your origin but not your recent path. The operator's sharper form, same day:
+
+> *"동일 하네스에서 분화한 세션이라도 **그 세션으로 뜨거워진 지점에서는 다른 양상과 관점을
+> 지니게 된다. 그 세션만큼은 두 얼굴이 생기는거다.**"*
+>
+> *"**자신에 대해서는 뜨겁게, 남에 대해서는 그만큼 차갑게** (동일 하네스라도)"*
+
+The divergence is not in how context is *delivered* — the peer genuinely **holds a different
+aspect** at the point it got hot. The second line names the mechanism, and it is the half that
+is easy to miss: the same heat that makes a session sharp on **its own** thread makes it
+correspondingly **cold on yours**. Both halves are load-bearing and they buy different things:
+
+| | what it buys |
+|---|---|
+| **hot on its axis** | it sees what you structurally cannot — it did that work |
+| **cold on yours** | it does not carry your optimism, your sunk cost, or your reading of your own claim |
+
+The second is why "read it again, more carefully" never substitutes: **you cannot make yourself
+cold about your own output.** Dividing the work destroys both properties at once — a peer given
+part of your task becomes hot on it, and is then judging its own output.
+
+🟥 **Two operating consequences, which follow from the mechanism rather than from etiquette:**
+- **Ask the peer about the axis it got hot on.** Off that axis a peer wears *your* face — asking
+  buys nothing and costs a round trip.
+- **A subagent or your own re-read cannot substitute.** The second face comes from that session
+  having actually done the work; a prompt cannot manufacture heat, and nothing manufactures
+  coldness toward your own output.
+
+**Measured, and it is not one good day.** Scanned this hub's own records for peer-attributed
+catches: **119 mentions across 35 files spanning 13 distinct dates (2026-08-08 → 08-21)**;
+cross-family sidecar catches count separately at **113** — comparable in size, a *different*
+axis. Eight sampled hits were hand-verified as genuine peer attribution, and at least two run
+the **other way** (a peer's misdiagnosis reversed by measurement here) — so the shape is mutual
+contention, not one-way review.
+⚠️ Named residuals: these are *mentions*, not deduplicated incidents (one event can be described
+in several files); attribution is self-reported in this hub's own records; the window is the
+~2-week parallel-session era only.
+
+🟥 **Whether this is a verification axis in its own right is an OPEN OPERATOR DECISION, not
+settled here.** The operator also said *"이것도 6축검증법에 속한다"*, which places peer discussion
+inside the canonical six axes — but which axis, or whether it is a seventh, is unresolved: it is
+closest to ⓒ isolated-grounding (someone re-verifies *your record*), yet a peer is precisely
+**not** isolated. Do not cite this paragraph as if the axis question were closed.
+See `tracks/_meta/fh_signal_2026-08-21_peer-axis-canon-claim.md`.
+
+**So the ask to a peer is a question, not a work item.** The operator's own modelling of the
+boundary, same day, on a branch belonging to another session: *"그 브랜치는 08d6fe75 갈래
+것이고 **여기서 손댈 게 아니다. 판단만 낸다.**"* — when the artifact belongs to another
+session, produce a verdict, never an edit. This is about **scope of authority** and is separate
+from the shared-checkout rules (which are about not clobbering); both apply at once.
+
+### The effect that needs 2+ concurrent — and why it is not a preference
+
+Operator, 2026-08-21, arriving at it against their own habit:
+
+> *"내가 두개이상을 동시에 잘 쓰려고는 안하는데 아이러니하게도 **두개이상을 동시에 써야 얻을수
+> 있는 효과**도있어보이네"* → *"**2명~3명이 하네스를 굴려서 경합시키는 모양새**가 나오니까"*
+
+The shape is not "parallel work". It is **contention** — two or three sessions *driving the same
+harness* and colliding. What that produces cannot be reached serially, because both halves of the
+hot/cold table must exist **at the same time**: one session hot on a thread while another is cold
+on it. Run them in sequence and you get one face twice.
+
+Same day, in both directions: the wiring-hot session found a defect in this session's delta; this
+session found a drift defect inside *that* session's delta — and the check that caught it fires on
+*"did main change today"*, not *"did I change it"*, which is a contention-shaped trigger by
+construction. Neither finding was self-caught by its author.
+
+⚠️ **An observed effect, not a promotion to default.** Concurrency costs coordination, and it is
+where the same day's two shared-checkout accidents came from. The claim is narrow: *some* effects
+are unobtainable without it.
+
+**So how to hold it** (operator, 2026-08-21): *"디폴트 승격은 안 해도 되. 다만 병렬세션 띄워서
+운영자가 작업할 때 얻게 되는 **반사이익**이라고 보면 되지. 아니면 **네가 권유해도 괜찮음**.
+「병렬세션으로 나눠서 작업해도 좋을 것 같습니다」 이런 식으로"*.
+
+Two things follow, and the second is a permission most sessions will not assume they have:
+- **It is a by-product, not a reason.** The operator opens parallel sessions for their own reasons;
+  contention is what they *also* get. Do not argue for concurrency on the strength of this effect
+  alone.
+- 🟥 **You may propose it.** When work has separable threads and a second face would help — a
+  decision you would otherwise ratify alone, a claim only its author has read — say so plainly:
+  *"병렬세션으로 나눠서 작업해도 좋을 것 같습니다."* Proposing is invited; deciding is not yours,
+  and the standing preference remains delegation-in-conversation over standing parallelism.
+
 **Context Card** (required for non-trivial dispatch):
 ```
 [Session Context Card]
@@ -120,6 +223,34 @@ Note: {constraints the agent must know}
 
 ---
 
+## Approval Must Be Evaluable — never hand over a blind stamp
+
+Operator, 2026-08-21: *"내가 판단해야하는건 내가 알아볼수있게 쉽게 브리핑해줘 **승인하더라도
+블라인드 도장은 찍고싶지않아**."*
+
+An approval request is not done when it is *complete*; it is done when the approver can **reach
+the verdict themselves**. A dump of everything measured technically discloses more and decides
+less — the approver ends up ratifying your conclusion rather than forming one.
+
+**What a decision-ready item carries:**
+```
+the decision       stated as a choice, not as a status report
+what it costs      what becomes irreversible, what stays open
+the evidence       the number AND how it was measured (an uncalibrated number is not evidence)
+your recommendation  named as yours, so it can be rejected without re-deriving everything
+what you did NOT check  the residual, by name — this is the half that makes the rest trustworthy
+```
+
+🟥 **The failure mode is not withholding — it is volume.** Burying the one load-bearing fact in a
+complete record is the same defect as omitting it: either way the approver cannot separate what
+matters. If it takes the approver a re-derivation to decide, the briefing has handed them a blind
+stamp with extra steps.
+
+**Applies to every approval surface**, not only long briefs: a one-line "merge this?" still owes
+the choice, the cost, and the residual.
+
+---
+
 ## Counter-Argument Protocol
 
 When the user pushes back on an AI recommendation ("is that right?", "something seems off"):

package/knowledge/shared/harness-core/claude_md_gate_details.md

@@ -370,3 +370,93 @@ sessions (no FH asset modification) never see this notice — the Sonnet default
 > `knowledge/shared/harness-core/capability_escalation_consent.md` — the negotiated-consent protocol
 > (UAP `sidecar_consent`/`floorup_consent`) that decides ask-once vs. no-surprise floor-up/sidecar use.
 > This notice is the passive advisory; that doc is the active escalation gate.
+
+---
+
+## §Version-Digit-Policy — 어느 자릿수를 올리나 (CLAUDE.md §Session-Close ④-b 상세)
+
+> **왜 여기 있나**: 이 판단은 **버전을 올릴 때만** 필요하다 — 매 세션 마감이 아니다.
+> CLAUDE.md 는 규칙(3값 + 판별자 + `BREAKING (gate):` 의무)만 상주로 갖고, 아래 근거·판례를
+> 여기서 읽는다. salience-split 2026-08-21.
+
+🟥 **WHICH DIGIT — operator decision 2026-08-17, and it is deliberately NOT strict semver.**
+There was no policy before this line, which is why one session proposed three different bumps
+for the same delta on three different (and each individually defensible) grounds. Decide by
+**what the number tells a reader**, not by whether anything technically broke:
+
+| Bump | Reserved for (operator's own wording, 2026-08-17) |
+|---|---|
+| **major** `+1.0.0` | **any one of three**: ⓐ **완전히 새로 지음** — rebuilt from scratch, not extended · ⓑ **정체성이 확립됨** — 🟥 **다섯이 «전부» 🟢** 인 순간이지 하나가 🟢 로 올라선 순간이 아니다(운영자 결정 2026-08-21). 초판은 *"an identity of the five … actually standing 🟢"* 였고 **「하나만 초록이어도 major」로 읽혔다** — 실제로 그날 ②가 🟢 로 판정되면서 3.0.0 후보로 올라왔고, 그 애매함이 그때 닫혔다. 🟥 그리고 **정체성 등급은 npm 이 나르는 신호가 아니다** — 그건 `identity-v*` 계보의 사건이고, npm 이 또 나르면 같은 날 고친 「두 계보 한 이름」 결함을 번호에서 재생산한다. ⇒ major-ⓑ 는 **`identity-v1.0.0` 과 같은 사건**을 가리킨다 · ⓒ **기능이 혁신적으로 변경되거나 늘어남** — a capability *class* appears or is replaced, not a capability instance. 🟥 **Never** for tightening a gate that already existed |
+| **minor** `+0.1.0` | 미들급 — new assets, new gate lanes, doctrine that changes behavior; **including changes that break a consumer's gate acceptance**, which then carry a mandatory `BREAKING (gate):` line |
+| **patch** `+0.0.1` | 트리비아급 — fixes, wiring, docs that change no behavior |
+
+**The discriminator between major-ⓒ and minor**: *class* vs *instance*. A sixth Wave-1 attack
+angle is an instance → minor. An attack-angle **registry** where none existed is a class → major.
+Today's delta is instances and tightenings throughout, which is why it is 2.1.0 and not 3.0.0
+even though it breaks a gate acceptance.
+
+**Why gate-tightenings are minor here, stated so it is not mistaken for hiding a break**: what
+breaks is the **record format of a gitignored local marker**, not an API or the consumer's code;
+the hook prints exactly what to write instead; and the blast radius needs the consumer to have
+installed the hook AND be making a load-bearing change AND have used the specific old form.
+Against that, strict semver would burn a major on every gate we tighten — this repo took 2.0.0
+for a publish-freshness gate one day and would have taken 3.0.0 for a commit gate the next.
+**A major number that arrives monthly stops meaning anything**, and the milestone it should be
+reserved for would have no word left.
+
+⚠️ **The condition that makes this honest, and it is not optional**: a minor that breaks gate
+acceptance MUST carry `BREAKING (gate): <what now blocks> — <the one-line remedy>` in the
+release description AND the CHANGELOG. Without it this policy is just burying breaks in minors.
+**Applies from 2026-08-17 forward, not retroactively** (2.0.0 was the same class and is left
+as-is rather than rewritten).
+
+---
+
+## §Branch-Protection-Two-Layers — 서버측 보호의 2층 구조와 세 번의 오판
+
+> CLAUDE.md 는 결론만 상주로 갖는다: **통합 브랜치는 PR 전용 · 하드 플로어는 서버측 ·
+> 브랜치 표면을 판정하려면 두 API 를 **모두** 읽어라.** 아래는 그 근거와, 한쪽만 읽어서
+> 세 번 오판한 기록이다. salience-split 2026-08-21.
+
+> **Two layers, and which one is the floor**: the **hard floor is server-side** — this repo now runs
+> `enforce_admins: true` with `required_approving_review_count: 0` (set 2026-07-20; the count must be
+> `0`, because enabling `enforce_admins` while it is `1` locks a solo operator out of merging their
+> own PRs — self-approval is impossible). The hook is the **shift-left layer**: it fails at push time
+> and prints the actual remedy, and it keeps holding if the server setting is ever relaxed. It is
+> deliberately not the floor — a client-side hook is bypassable with `--no-verify`.
+> *Origin*: before that change the server had `enforce_admins: false`, so an admin push *satisfied*
+> the rule and merely printed `Bypassed rule violations` — a notice, not a block. A rule that
+> announces its own bypass is not a floor.
+> ✅ **Retraction — the server-side force-push surface is CLOSED, and the way it was misread is the
+> durable part.** An earlier version of this block said `allow_force_pushes` on `main` was "still
+> `true`", that two API writes "did not persist", and that the **server-side** history-rewrite
+> surface therefore "remains open". The field reading was correct; the conclusion was not.
+> **Branch protection is two independent layers — legacy protection and rulesets coexist, and the
+> strictest wins** — so a field on the protection object is never the effective answer by itself.
+> Measured on this repo 2026-08-09: `GET /repos/{owner}/{repo}/rules/branches/main` returns
+> `non_fast_forward` from ruleset `main-no-force-push` — `enforcement: active`,
+> `current_user_can_bypass: never`, `bypass_actors: []`, live since 2026-07-25 — while the legacy
+> object still reports `allow_force_pushes: true`. The two API writes that "did not persist" were
+> writing to the layer that does not govern *this* outcome while the stricter ruleset is active — not
+> a layer that is inert in general: disable or retarget the ruleset and the legacy toggle governs
+> again. **Read BOTH layers before declaring any branch surface open or closed** — `/rules/branches/
+> {branch}` shows only what the *rulesets* impose, and `/branches/{branch}/protection` only what
+> *legacy protection* imposes; neither is the effective view alone. A protection-object field read by
+> itself misjudged this three times ([[reference_github_protection_two_layers]]).
+> **Scope of the retraction, stated narrowly on purpose**: it covers *force-push / non-fast-forward*,
+> which is what `non_fast_forward` blocks. Branch **deletion** is a separate rule and is closed on the
+> other layer (`allow_deletions: false`, same GET). PR-routing is likewise a different field —
+> `required_pull_request_reviews` present with `enforce_admins: true` — not something
+> `required_status_checks` says anything about.
+> ⚠️ A *different* residual on `main` is still real and must not be folded into the one just
+> retracted — but the residual's own description was itself stale and needed correction on
+> 2026-08-12 (live re-check, `[[reference_github_protection_two_layers]]`): legacy
+> `required_status_checks.contexts` is **`["validate"]`**, not `[]` — a green `validate` check IS
+> required before a PR can merge, and `GET /rules/branches/main` carries no competing
+> `required_status_checks` rule, so the legacy field is the effective one here. `validate`
+> (`.github/workflows/validate.yml`) is a **separate job from Axis 1** (`regression-guard.yml`) —
+> Axis 1 is still not required, see the 4-axis section below. The gap on `validate` is
+> `strict: false`: that check re-runs on every push to the PR branch, but nothing re-forces it
+> against a **moving** main after it last ran — so a check that passed can still land behind
+> concurrent merges it never saw.
+

package/knowledge/shared/harness-core/dispatch_conditional_prohibition.md

@@ -103,3 +103,78 @@ dd if="$V" bs=1 skip=$off count=420 2>/dev/null | tr -d '\0'
 - Whether any **operator-config** key gates the constant is unmeasured; only text-absence was checked.
 - What ① (client-data) actually carries in this environment was not inspected — only that it takes
   precedence.
+
+---
+
+## §Hook-Floor-Unverified — 「어느 방향도 훅으로 안 막힌다」의 실측 근거
+
+> CLAUDE.md §Agent Dispatch 는 결론 한 줄만 상주로 갖는다. 아래가 그 근거·미검증 항목이다.
+> salience-split 2026-08-21.
+
+⚠️ **Neither direction has a confirmed hook-level floor. Say that plainly rather than implying one.**
+```
+opening    salience only for the POSTURE. The prohibition met in the field is CONDITIONAL,
+           which changes what "override" even means — see the measured block below.
+blocking   ALSO not hook-enforced. `SubagentStart` fires on spawn but is **context-only** —
+           it cannot block, exit 2 only surfaces stderr, and it has no decision field
+           (official hooks reference, read 2026-08-08). It can INJECT context at the moment
+           of dispatch, which is better-placed salience than this file, but still salience.
+UNVERIFIED whether a `permissions` deny entry or a `PreToolUse` matcher can target subagent
+           spawning at all — the reference does not name a tool for it, and this repo has no
+           precedent. **Do not cite a blocking mechanism until someone runs the known pair**
+           (configure the deny, attempt a dispatch, observe). Until then: unverified, not absent.
+```
+
+## §Retraction-SubagentStart — 이 블록이 두 번 틀렸던 기록
+
+An earlier draft of this very block asserted "a `SubagentStart` hook can deny, and a denial there is a
+real floor." That was false, taken on trust from an adjacent session and written here before the
+reference was read. A second draft, on 2026-08-09, then wrote that the constant's call site "needs
+binary inspection, which was blocked" — **also false**: three plain `grep` calls resolved it, and an
+adversarial reviewer demonstrated that by doing it. Declaring something unmeasurable before trying the
+cheap tool is [[feedback_impossible_verdict_may_be_unread_half]]; the honest label is *"not yet
+measured,"* never *"blocked."* A blind target-tier sim then read it back correctly — which shows a sim measures
+whether text is *followable*, never whether it is *true*. Both checks are needed; neither substitutes.
+
+
+## §Worktree-Gate-Integrity — `core.hooksPath` 양팔 실측 (2026-08-05)
+
+> 🟥 **운영 규칙은 CLAUDE.md 에 있다**: *워크트리에서 FH 자산을 커밋하지 않는다.*
+> 아래는 그 규칙이 왜 조건부 사실 위에 서 있는지의 근거이고, **규칙을 실행하는 데는 필요 없다** —
+> 「내 설치가 어느 팔인가」를 따져야 할 때만 읽어라. salience-split 2026-08-21.
+
+**Fourth reason — gate-integrity in a worktree, and the answer is CONDITIONAL on how `core.hooksPath`
+was set (measured 2026-08-05, both arms).** Do not carry a single verdict here; the two installs
+behave differently:
+
+| `core.hooksPath` | Which hook actually runs in a worktree | Consequence |
+|---|---|---|
+| **relative** — `templates/.git-hooks`, the form every FH doc installs (`CHEATSHEET.md`, `.claude/rules/fh_4axis_gate.md`, `install-wizard`, `self_evolution_routine.md`) | the **worktree's own copy** | Editing that copy *inside the worktree* disables the gate for that worktree — measured: neutralized hook → FH-asset commit with no marker succeeded (`rc=0`). The verifier becomes the verified, and the edit is invisible to `git status` in the main tree. |
+| **absolute** — a hand-set full path (this operator's machine; **not** what any doc tells you to run) | the **main tree's copy** | A worktree-local edit has no effect; a known-positive is blocked there exactly as in the main tree (`rc=1`). |
+
+An earlier draft of this section reported only the absolute-path arm and declared the
+"worktree bypasses the gates" hypothesis *refuted* — from **n=1 on a non-canonical setting**, with a
+do-not-revisit label attached. The relative-path arm, which is what everyone else runs, reproduces
+the bypass. Freezing a conclusion is a defect when the measurement did not cover the shipped
+configuration.
+
+🟥 **RETRACTED 2026-08-22.** This said the marker and manifest are *structurally absent* in a
+worktree. They are not: `templates/.git-hooks/pre-commit` resolves evidence through
+`git rev-parse --git-common-dir`, which returns the **main tree's** `.git` from inside a worktree.
+Measured in a clean worktree with the known-negative established first (its own `tracks/` = skeleton
+only; `$REPO_ROOT/tracks/_meta/edit_manifest.yaml` NOT FOUND, `$EVIDENCE_ROOT/...` FOUND — the two
+roots disagree, so the probe discriminates).
+**The operating rule is UNCHANGED: do not commit FH assets from a worktree.** Its remaining **open risk areas** — not
+established grounds — are marker provenance, concurrent manifest append, and a copy of `tracks/` that
+appears in a worktree from an unattributed source. They are **deliberately not enumerated as reasons
+here**; an earlier draft enumerated
+them and adversarial review found a defect in nearly every added claim. ⚠️ **Reachable is not automatic**: the hook *reads* `$EVIDENCE_ROOT`, but a
+worktree session writing by relative path lands in the worktree's own `tracks/`, not the main tree's.
+The gate is satisfiable — its failure message prints the absolute `MARKER_DIR` to write to — but the
+routing is the author's job, not the tool's.
+⚠️ The `core.hooksPath` two-arm table above is a separate axis (hook substitution) and is untouched.
+One observation from the retracted paragraph survives on its own: note the
+hook itself prints `mkdir -p …/tracks/_meta` on that failure, i.e. the actor's own error message
+teaches the marker-creation path — so "just don't fabricate it" is prose sitting under a machine
+instruction pointing the other way.
+

package/knowledge/shared/harness-core/fh_three_layer_canon.md

@@ -50,8 +50,12 @@ tags: [canon, three-layer, engines, identity, verification-axes]
 ```
 ① 초기 영혼           심지(판단 회로)를 먼저 심는다. 무엇이 성공 · 어디로 기움 ·
                       범위 밖 · 절대 안 함
-② 중간 탈상관 가속화   축을 골라 동시에 친다. **곱하지 말고 골라라** — 병렬화 자체엔
-                      방향이 없다(축은 판단 회로가 고른다)
+② 중간 **병렬 탈상관** 가속화
+                      두 다이얼을 **각각** 돌린다 — 곱하지 말고 골라라.
+                        **탈상관** ← 사각 위험에 반응. **모델 탈상관**(ⓐ 계열) +
+                                     **입장 탈상관**(ⓑ 대상 하네스의 정본·레포)
+                        **병렬**   ← 표면 크기에 반응(한 컨텍스트에 담기나). fan-out
+                      병렬화 자체엔 방향이 없다 — 축은 판단 회로(①)가 고른다
 ③ 마무리 6축 태우기    §1-a-2 의 여섯 축으로 태운다. **적대검증 하나가 아니다**
 ```
 
@@ -176,6 +180,21 @@ measurement_needs_control]])에 있다. 표본이 지지하는 건 "바깥 하
 `fh_signal_2026-08-07_shift-left-governance` §④ 의 *"뒷단 부하는 앞단 부재의 함수다"* 와
 같은 명제이고, 이 괄호가 그것을 ②의 정의 안으로 넣는다.
 
+🟥 **이름이 손실 압축돼 있었다 — 2026-08-21 에 운영자가 잡아 복원했다.** 바로 위 원발화는
+**「병렬 탈상관 가속화」**인데, 요약줄(§0)과 `CLAUDE.md` 는 **「병렬」을 떨어뜨린 채** 8월 내내
+「탈상관 가속화」로 실려 있었다. 그러자 이름이 다이얼 **하나만** 부르게 되고, 읽는 쪽에서
+*"이거 그냥 서브에이전트 병렬 아니냐"* 가 나온다 — 실제로 운영자가 그 질문을 던져서 발견됐다.
+**자력 적발 0.**
+
+🟥 **그리고 「다양성」으로 부르지 않는다 — 검토했고 기각했다(운영자 결정 2026-08-21).**
+다양성은 **리뷰어 집합**의 성질이고 탈상관은 **입력**의 성질이다. 같은 diff 를 세 계열에 주면
+*다양하되 상관돼 있고* 사각은 그대로 남는다 — §1-a-2 의 판별 명제(«무엇을 받았는가»)가 정확히
+그것을 막는 문장이다. 「다양성」으로 부르면 *"모델 세 개 썼으니 됐다"* 가 통과한다. 실측:
+**이 문단을 쓰기 전** 기준으로 이 파일 · `field_verdict_crossfamily_gate.md` · `CLAUDE.md` 에서
+「다양성」 **0건**이었고, 그건 우연이 아니라 이 구분을 지키느라 안 쓴 것으로 보인다.
+🟥 **스코프를 명시하는 이유**: 지금은 이 문단 자신이 그 단어를 쓰므로 같은 grep 이 히트한다.
+스코프 없는 부재 주장은 자기 자신이 반례가 된다(cross-family 지목, 자력 적발 0).
+
 ⚠️ **가속화 ≠ shift-left.** 앞당기는 것과 탈상관하는 것은 다른 축이다. 오늘은 둘이 같이
 갔을 뿐이고, 한 문장으로 묶으면 *"병렬로 돌렸으니 앞당긴 것"* 이라는 오독이 나온다.
 
@@ -251,11 +270,27 @@ measurement_needs_control]])에 있다. 표본이 지지하는 건 "바깥 하
 |---|---|---|
 | ⓐ 다른 계열 | diff + 저자의 프레이밍 | 구현 |
 | **ⓑ 입장** (신규) | diff + **대상 하네스의 정본** | **인용한 규약이 정말 그런가** |
-| ⓒ 격리 그라운딩 | 저자가 쓴 문장 + 지금의 트리 | 주장 |
+| ⓒ 격리 그라운딩 | 저자가 쓴 문장(**사후 주장 및 사전 선언**) + 지금의 트리 | 주장 · **델타가 선언한 것과 안 맞음** |
 | **ⓓ 3자 대면** (신규) | 문제 + **남의 코드베이스** | **이미 풀린 문제 아닌가** · 내 변경이 남의 레포를 어디서 만지나 |
 | ⓔ 첫 실사용 | 실물 대상 한 건 | 재는 방식(계기의 계기) |
 | ⓕ 되돌림 실측 | 배선을 지운 트리 | 앵커 |
 
+🟥 **ⓒ 행은 2026-08-21 에 넓어졌고, 이 정본은 그날 안 따라왔다.**
+⚠️ **초판은 여기 「8일간」이라고 적었는데 그건 지어낸 숫자다** — `db8e72a` 는 **같은 날
+15:45:09 +0900** 이라 실제 지연은 몇 시간이고, 자력 적발 0(cross-family 가 커밋 날짜를 대조해
+반증했다). 짧다고 덜 나쁜 것은 아니다 — **길이가 아니라 「기계가 갱신될 때 정본이 같은 PR 에
+안 들어갔다」가 결함**이고, 그 성질은 지연이 1시간이든 8일이든 같다. 숫자를 크게 잡아 심각성을
+빌려온 형태라 그대로 남긴다. `templates/.git-hooks/pre-commit:1186` 이 이미 *"⇒ ⓒ's 「받는 것」 widens to «저자가 쓴
+문장(사후 주장 및 **사전 선언**)»"* 라고 선언하고 `soul-check:` 레인까지 돌고 있는데(PR #481,
+`db8e72a`), 그 PR 이 바꾼 파일 셋(`selfcheck.sh` · `test_marker_soul_check_lanes.sh` ·
+`pre-commit`)에 **이 파일이 없었다.** 그래서 이 절 전체에서 `사전 선언` grep 이 **0건**이었다 — 🟥 **이 문단을 쓰기 전 기준이다.**
+지금은 이 문단 자신이 그 문자열을 여러 번 쓰므로 같은 grep 이 히트한다. 스코프를 안 적으면
+자기무효 측정이 된다(cross-family 지목).
+`[[feedback_half_fix_propagation_boundary]]` 이고, 방향이 뒤집힌
+`[[feedback_rule_misdescribes_its_own_machine]]` 이다 — 보통은 규칙이 없는 기계를 주장하는데
+여기서는 **규칙이 있는 기계를 안 적었다.** 발견자는 병렬 피어 세션(하네스닥터)이고 **자력 적발
+0** 이다 — 위 §피어 절이 말한 ⓑ∪ⓓ 가 실제로 낸 첫 수확이다.
+
 **저자 자평을 걷어낸 자리**: 발견 16건을 **출처를 지운 채** 봉인된 정답키와 함께 **레포 밖 cwd·
 헤드리스**로 다른 계열 분류자 **둘**에게 독립 판정시켰다. 채점 11/15 · 12/15, 상호 일치 13/15(87%),
 사전 등록한 반증 조건(일치율 50% 미만) 미발동.
@@ -271,6 +306,45 @@ measurement_needs_control]])에 있다. 표본이 지지하는 건 "바깥 하
 다른 축으로 넘어갔다). 반대로 「남의 레포가 과거에 폐기한 규칙」은 **도구로도 못 가져온다** —
 그 프로젝트의 리뷰 이력에 접근할 이유가 없기 때문이다. 거기가 ⓓ가 남는 자리다.
 
+#### 피어 세션은 새 축이 아니라 ⓑ∪ⓓ 의 변형이다 (2026-08-21, 운영자 결정)
+
+> **운영자**: *"피어논의는 입장리뷰+3자대면의 변형이지않을까"*
+
+같은 하네스에서 갈라져 나온 **병렬 세션**의 판정을 어디에 적을지가 열려 있었다(신호:
+`tracks/_meta/fh_signal_2026-08-21_peer-axis-canon-claim.md`). 결정은 **7번째 축 아님** —
+⇒ **마커 `axes-run` 배열 변경 없음**(기존 마커 전량 무효화라는 가장 비싼 결과를 피했다).
+
+위 표의 판별자(«무엇을 받았는가»)로 대조하면 둘 다 맞는다:
+- **ⓑ 입장** — 피어가 낸 S-1 이 정확히 *"인용한 규약이 정말 그런가"* 였다(rc 계약을 인용해
+  놓고 주 진입점이 그 계약을 안 썼다).
+- **ⓓ 3자 대면** — 같은 날 사고 둘이 문자 그대로 *"내 변경이 남의 레포를 어디서 만지나"* 였다.
+
+🟥 **«변형»은 전달 방식이 아니라 «관점 자체»다 — 이 절의 초판이 그걸 틀렸고 운영자가 정정했다.**
+
+> **운영자**: *"동일 하네스에서 분화한 세션이라도 **그 세션으로 뜨거워진 지점에서는 다른 양상과
+> 관점을 지니게 된다. 그 세션만큼은 두 얼굴이 생기는거다.**"*
+
+초판은 *"받는 «것»은 같고 받는 «방식»이 다르다"* 라고 적었는데 그건 열화다. **뜨거워진 지점에서
+그 세션은 진짜로 다른 입장이고 진짜로 남의 코드베이스 자리다.** 그래서 ⓑ∪ⓓ 로 갈리는 것이지
+«내용은 같은데 배달이 다른» 것이 아니다.
+
+**그리고 이 정정이 운용 규칙을 바꾼다** — 초판대로면 안 나왔을 규칙이다:
+```
+✅  피어에게 물을 때는 그 피어가 «뜨거워진 축»을 물어라 — 거기서만 두 번째 얼굴이 있다
+🟥  뜨겁지 않은 축에서 피어는 나와 같은 얼굴이다 — 물어도 탈상관이 안 된다(같은 사각)
+🟥  서브에이전트·내 재독으로 대체 불가다. 두 번째 얼굴은 «그 세션이 실제로 그 일을 한 것»
+    에서만 나오지, 프롬프트로 만들어지지 않는다
+```
+`[[feedback_decorrelation_axis_matches_failure_mode]]` 의 피어 판본이다 — 축은 계열만이 아니라
+**«그 세션이 무엇으로 뜨거워졌나»**로도 갈린다.
+
+**기록 규약**: 피어 판정을 근거로 쓸 때 `axes-run` 은 `ⓑ=` 와 `ⓓ=` 에 적는다. 새 기호는 안
+만든다. 단 **`ⓑ=→standpoint`** 규약이 이미 있으므로(값은 `standpoint:` 필드가 가진다),
+피어-유래 ⓑ 는 그 필드에 «peer 세션이 자기 갈래에서 판정» 임을 명시한다.
+
+⚠️ **표본 한계**: 근거는 하루·두 세션이고 **대조군이 없다**(같은 일을 피어 없이 했을 때와
+비교하지 않았다). 결정은 운영자 판단이고, 판별력 실측은 미실시다.
+
 ✅ **기계층이 6축으로 확장됐다 (2026-08-17, 운영자 승인).** 아래는 그 상태와 **남은 잔여 하나**다.
 ```
 axes-run: ⓐ~ⓕ         마커 날짜 ≥ 2026-08-17 이면 pre-commit 이 **기호 여섯 글자를 요구**한다

package/knowledge/shared/harness-core/field_verdict_crossfamily_gate.md

@@ -469,11 +469,25 @@ own. `tier2b` is the honest reachable rung for that pairing; do not inflate a `t
 `tier3`, and do not undersell it to `tier2` either — it is a distinct, real, if operator-correlated,
 data point.
 
-**Mechanization status — `standpoint:` is prose-only today, and this must not be read as more than
-that.** `crossfamily:`'s degrade triad is hard-blocked at commit (`templates/.git-hooks/pre-commit`,
-`scripts/test_marker_crossfamily_lanes.sh` — grep-verified: ~20 crossfamily references in the hook,
-validated fixtures). `standpoint:` has **no value-enum validation and no fixture suite** — nothing stops an author from
-writing `not-applicable` with a thin justification, and no marker-shape check catches a wrong value.
+**Mechanization status — 🟥 CORRECTED 2026-08-20.** This paragraph used to say `standpoint:` was
+"prose-only today" with "**no value-enum validation and no fixture suite**". **Both halves are false**
+and had been for a while: `validate_standpoint_leg()` lives in `templates/.git-hooks/pre-commit` and
+`scripts/test_marker_standpoint_lanes.sh` is wired through `scripts/selfcheck.sh`. Measured by varying
+one variable at a time — `banana(qasp)` → **blocked (enum)** · `tier2` without parens → **blocked
+(enum)** · `tier2(qasp)` with no execution grounds → **passes with a warning** · with grounds →
+**passes**.
+
+**What is actually true, stated at the right width**: the enum IS closed and enforced; the `tier2`+
+execution grounds are **advisory** (a thin `tier2` records and warns, it does not block); and nothing
+checks whether the recorded value is *true*. The old sentence collapsed all three into "no validation",
+which suppresses use of a control that exists — the quietest kind of drift, because it reads as
+honest modesty.
+
+🟥 **This same false claim stood in FIVE places** (`CLAUDE.md` ×2, `.claude/rules/fh_4axis_gate.md`,
+`AGENTS.md`, here). The first repair fixed one; the second fixed three and still missed this file and
+over-stated the fix. Both misses were surfaced by a **different-family reviewer**, not by a lane and
+not by the author — there is still no check that compares a rule's self-description against the
+machinery it describes.
 
 🟥 **Two sentences that stood here were STALE and are corrected (2026-08-17, re-measured — a
 cross-family reviewer flagged the second, the first fell out of checking it).** They read
@@ -757,3 +771,76 @@ standpoint.
   third-party axis's *exclusive* yield at **2 of 15** findings. Both were boundary-crossing
   (a rule the other project had already abandoned; another repo importing the changed file) —
   which is why it earns its place on large-and-irreversible surfaces and nowhere else.
+
+---
+
+## §Q0-Evidence — 「shipped 여부는 판별자가 아니다」의 실측과 인용 경고
+
+> CLAUDE.md 는 Q0 의 **규칙(ⓐⓑⓒ + pre-push 결박)**만 상주로 갖는다. 아래는 그 근거·경고다.
+> salience-split 2026-08-21.
+
+🟥 **Settle the TARGET CLASS(es) before the tier — §7's `Q0`, added 2026-08-17 (operator decision).**
+A consumer install **is** another harness; what the enum scopes is not who *receives* the change but
+where it has to be **executed**. Q0 is **not first-match — it can return more than one target, and
+each owes its own tier**: ⓐ a **named peer** whose local repo carries the changed surface, or which
+the cluster registry / a `scripts/adapters/` entry names (decide by that test, not from a name list)
+→ the enum as written · ⓑ the delta changes **consumer-visible behavior** (what a consumer's gate
+blocks or passes, what their session is told to do, what an install receives) → target = a *clean
+install of the packed artifact*, and it binds **now, pre-push — never deferred to the eventual
+release** · ⓒ neither → `not-applicable`. 🟥 Do **not** read «no cross-repo consumer contract» as
+«this file is not shipped» — measured, **194/200 recent non-merge commits touch a shipped path (97%,
+all 6 exceptions hand-verified)**, so shipped-ness cannot be the discriminator; the behavior clause
+is. Pricing the axis at that rate is the **over-triggering** §7's own Trigger paragraph rejects.
+⚠️ 97% measures **the reach of the discarded shipped-path argument**, not the applicability rate —
+how often ⓑ actually fires is **unmeasured in both tails** (it could also land near-universal, which
+would be a rubber stamp — watch the next 20 markers). 🟥 Do **not** cite
+`[[feedback_unreachable_done_when_trains_evasion]]` here: that memory concerns an unreachable *pass
+condition*, and `not-applicable` is an *exemption* — the direction inverts. Three marker-audit legs all failed at that reading;
+they were **not** decorrelated (same family · same prompt · same canon) so that is one observation,
+not three. ⚠️ The consumer-install arm's *presence* half is mechanized at ship time; its
+**execution** half (extract the tarball, run the gate, record command + output) has **no lane** —
+do it by hand, and do not cite that arm as mechanized.
+
+## §Standpoint-Execution-Evidence — 실행 하중 · 철회 · 명명 충돌 · 2026-08-20 정정
+
+> CLAUDE.md 는 판별 규칙(**명령과 출력을 댈 수 있나 → tier2, 못 대면 tier1b**)만 상주로 갖는다.
+> 아래는 그 근거와 이 문단이 두 번 틀렸던 기록이다. salience-split 2026-08-21.
+
+🟥 **The execution is the load-bearing half** (operator decision 2026-08-16): a static standpoint
+read competes with cross-family review for the same defect classes and mostly loses — *running the
+target harness locally, to completion*, is the part with no substitute. Measured on one delta the
+same day: static read found 1, running the target's own suite found 2 more, one of which printed
+neither `FAIL` nor `❌` and was unreachable by any read. So **`tier2`+ asserts something was RUN** —
+if the review only read, it is `tier1b`, and `tier1b` is deliberately the weak rung so that
+recording it honestly surfaces that the execution arm is still owed. (Broken on the day it was
+written — a static read was recorded as `tier2` because `tier1b` did not yet exist; a missing rung
+gets filled by the next one up rather than staying empty.) Naming note: this collides in
+English with FH's own persona/viewpoint sense of "standpoint" (`fh-meta:beginner`/`main-player`/
+`expert`) — a different axis (which persona reviews, not whose repo is ground truth); kept as-is,
+not renamed, but do not conflate the two. 🟥 **CORRECTED 2026-08-20 — this paragraph used to say
+`standpoint:` was "Prose-only today — no pre-commit hook or fixture suite validates this field yet".
+That is FALSE and was false in this same file**: `validate_standpoint_leg()` lives in
+`templates/.git-hooks/pre-commit` and is called from the marker block, and its fixture suite
+`scripts/test_marker_standpoint_lanes.sh` is wired through `scripts/selfcheck.sh`. (🟥 **Grep the
+names, do not trust line numbers** — the first version of this correction cited `:798`/`:1575` and a
+commit landed the same hour that moved them to `:878`/`:1665`. A hardcoded anchor in prose is a
+phantom waiting for the next edit.) §자기 대조
+above already said so (PR #429), so **one file carried both claims at once** and a reader landed on
+whichever they reached first. Found by the residency-ledger pass, not by a lane — no check compares
+a rule's self-description against the machinery it describes, which is why a stale "we have not
+built this yet" is the quietest form of drift: it reads as honest modesty and it suppresses use of a
+control that already exists. **What is validated is the ENUM** — measured by varying ONE variable at a
+time, because the first version of this correction varied two and mis-attributed the result:
+`banana(qasp)` → blocked (enum) · `tier2` without parens → blocked (enum) · `tier2(qasp)` with **no**
+execution grounds → **passes with a warning** · with grounds → passes. 🟥 So the first fix's claim
+that "grounds are non-empty" are checked **over-shot, and a different-family reviewer caught it**:
+the `tier2`+ execution grounds are **advisory**. Two residuals remain and both are real — grounds are
+not enforced, and whether `tier2` is *true* is still self-attested. What was wrong was only the claim
+that nothing validated the field at all. Three artifacts, one carrying two
+independent trials (forge-harness PR #368, a sibling field harness's PR #8 reps=3 and its
+known-answer trial, qasp-dev PR #161 as adjacent corroboration) crossed this repo's own evidence
+bar the same day this was formalized — including one caught by this session's own qasp PR #161
+review, not fed in externally, and a second live demonstration the same day when a cross-harness
+standpoint review of this very section caught real residency and citation defects in the first
+draft (fixed in the same commit that added this line).
+

package/knowledge/shared/harness-core/harness_incubator_doctrine.md

@@ -331,8 +331,18 @@ by design. ~~**Therefore a meta-harness candidate is not a chamber candidate.**~
 day-one walk 의 정의는 *"on the first run, with the user adding nothing, the thing produces
 something useful"* 이고 반대말이 `built-but-not-wired`, 그리고 *"**wiring is part of the birth**"*
 다. **md 규율은 구조적으로 호출부가 없다**(살리언스). 실제 반례:
-`.claude/rules/fh_4axis_gate.md` 의 `standpoint:` 필드 — *"Still validated by nothing — zero hook
-lines, no fixture suite"* 였고, `tier1b` 등급이 **없어서 정적 리뷰가 tier2 로 기록**됐다.
+`.claude/rules/fh_4axis_gate.md` 의 `standpoint:` 필드 — 그 규율이 *"Still validated by nothing —
+zero hook lines, no fixture suite"* 라고 **자기 자신에 대해** 적고 있었다.
+🟥 **2026-08-20 정정 — 이 예시는 인용한 문장이 틀렸다는 것이 밝혀져 방향이 바뀐다.** 실측: 그 시점에
+`validate_standpoint_leg()` 는 훅에 **있었고** 픽스처도 `selfcheck.sh` 로 배선돼 있었다
+(`banana(qasp)` → 차단 · `tier2` 괄호 없음 → 차단). 즉 이건 «태어났는데 안 걸은 규율»이 아니라
+**«걷고 있는데 자기가 못 걷는다고 적어둔 규율»**이다 — 그리고 그게 더 조용한 결함이다: 정직한
+겸손처럼 읽히면서 **이미 있는 컨트롤의 사용을 억제**하고, 실제로 그 문장은 **여섯 개 문서로
+전파돼** 있었다(`CLAUDE.md` ×2 · 그 규칙 파일 · `AGENTS.md` · `field_verdict_crossfamily_gate.md` ·
+여기). ⇒ md 규율의 실패 모드는 **하나가 아니라 둘**이다:
+① 태어나고 안 걷는다(호출부 부재) ② **걷는데 자기 상태를 틀리게 적는다**(자기서술 드리프트).
+②는 ①의 판정자(«블라인드 sim 이 발화하는가»)로는 안 잡힌다 — 규율은 정상 발화하고, 틀린 것은
+그 규율이 자기에 대해 하는 **진술**이기 때문이다. 그걸 잡는 검사는 아직 없다.
 `axes-run` 기호 키도 53건 중 2건이 옛 의미로 쓰였다. **태어났고 안 걸은 md 규율들**이다.
 
 ⇒ **유닛 클래스별 day-one walk 판정자를 따로 건다**:

package/knowledge/shared/harness-core/multi_model_sidecar_strategy.md

@@ -149,6 +149,38 @@ human-review floor is structural, not a transitional patch. (Its Faros AI number
 the author's own caveat travels with any citation.)
 "Aggressive" Codex/Gemini use is bounded by the fit task-class above, never a blanket main-seat swap.
 
+### Write authority — a sidecar audits, it does not edit (measured 2026-08-21)
+
+The doctrine above governs **verdicts**: a sidecar's finding is an evidence candidate until the governor
+source-closes it. That is the *judgment* axis. It says nothing about the **write** axis, and the gap is
+not academic — a sidecar with tool access will start editing the target tree unless told not to.
+
+> **A sidecar returns findings and, at most, a proposed patch as TEXT. It does not write to the target
+> tree.** The governor applies, or does not apply, each change. Same shape as the verdict rule: the
+> sidecar supplies material, the governor is the only writer.
+
+🟥 **The reason is not overreach. It is that the fixer and the checker become the same party.**
+Measured this day: `codex/gpt-5.5` was dispatched as an adversarial auditor over a hook delta and began
+editing the working tree directly (caught by `mtime`, not by any gate). Its *finding* was real and sharp
+— two detectors in the same file had divergent leniency. Its *fix* widened one detector's pattern, and
+the widened pattern then matched **the claim line's own text** as its own evidence — a self-referential
+false positive that flipped a BLOCK lane to PASS. **41 lanes stayed green.** A human reading the diff
+sees "leniency aligned", which is correct as far as it goes. What caught it was the first real use in an
+isolated clone. This is [[feedback_blind_separation_is_a_defect_generator]] arriving through a door the
+verdict rule left open: the sidecar was, for those minutes, both author and reviewer of the same lines.
+
+**Operationally**: dispatch sidecars with the target tree read-only where the runtime supports it; when it
+does not, state the constraint in the prompt AND verify afterwards (`git status` / `mtime` on the files you
+handed over). A sidecar edit discovered after the fact is treated as a **finding to re-derive**, never as a
+patch to keep — re-decide it in the governor's seat, because a patch you did not author is a patch you did
+not review.
+
+⚠️ **Process safety, same surface**: terminating a runaway sidecar needs a discriminator for *your own*
+process — pin the model, capture the PID, or `pgrep` first. A bare `pkill -f codex` on a shared machine
+reaches other sessions' sidecars; measured the same day (nothing was actually killed — exit codes
+separated the cases afterwards — but the command could not have known that in advance). **Confirm what
+died after killing**, not before.
+
 ### Decorrelation axes — model family AND authoring context (measured 2026-08-01)
 
 Decorrelation has been treated as one axis (model family). A codex-outage session measured a second,