@chrono-meta/fh-gate 3.0.0 → 3.1.0

package/plugins/fh-meta/skills/frontier-digest/SKILL.md

@@ -69,7 +69,7 @@ Collect from five sources (bash per source in §Collection-Bash):
 
 | Source | Method | Cap |
 |---|---|---|
-| HackerNews | Algolia API, score > 10, keyword-relevant | 15 items |
+| HackerNews | Algolia API `search_by_date` (date-sorted, never `/search`), score > 30, keyword-relevant | 15 items |
 | arxiv | export API, latest by submittedDate | 6 items |
 | TLDR AI | RSS, title + link | 5 items |
 | The Batch (deeplearning.ai) | HTML scraping, title + issue slug | 5 items |
@@ -215,7 +215,7 @@ Present Step 4 menu options [1]–[5]. Do not skip to [5] silently — surface t
 ## Simplification Guards
 
 - Video Tier-3 probe fails (any of `yt-dlp` / `curl_cffi` / `ffmpeg` missing, or timedtext returns 429) → fall through to operator summary; never assume `yt-dlp` works
-- If 3+ arxiv queries fail, proceed with HN only (do not abort)
+- If 3+ arxiv queries fail (HTTP 429): back off once → WebFetch the date-sorted `arxiv.org/list/cs.SE/recent` listing → only then HN-only. Never substitute WebSearch (recall channel, 5/5 REPEATs measured 2026-09-04); report `arxiv FAILED (429)`, never `0 items`. Detail: `SKILL_detail.md §Execution form`
 - On curl timeout, skip that item and continue with the rest
 - If synthesis result exceeds 400 characters, retain top 3 items and truncate the rest
 - Without `--save`, do not create files (conversation output only)

package/plugins/fh-meta/skills/frontier-digest/SKILL_detail.md

@@ -21,20 +21,40 @@ load: on-demand
 > through WebFetch on the same URLs. If an environment *does* allow the curl form, it is equivalent —
 > the transport is not the contract, the endpoints and criteria are.
 >
-> **arXiv HTTP 429 is a separate item, not part of this revision**: it is a remote rate limit
-> (N=11 consecutive, transport-independent). On 429: back off once, then fall back to per-item
-> `https://arxiv.org/abs/{id}` reads; record `FAILED (429)`, never 0 items.
+> **arXiv HTTP 429 — fallback is a TRANSPORT change, never a channel change (revised 2026-09-04).**
+> The export API rate-limits this runner (N=11 consecutive by 08-10; 3 consecutive days 09-02·03·04
+> = past the `N≥3` mechanization bar). The 08-10 prescription («fall back to per-item `abs/{id}`
+> reads») was unrunnable in practice — a 429 on the *query* leaves you with no IDs to read — so runs
+> fell back to **WebSearch**, and the 09-04 run measured what that does: 5/5 papers it returned were
+> REPEATs. Search sorts by *canonicity*, the export API by *submission date* — a search fallback is
+> a **recall channel, not a discovery channel**, and swapping it in silently converts «unrun» into
+> «nothing new» (`not found ≠ 0`). Order on 429:
+> 1. back off once (≥30s), retry the same query;
+> 2. still 429 → WebFetch the **date-sorted HTML listing** `https://arxiv.org/list/cs.SE/recent`
+>    (and `https://arxiv.org/list/cs.AI/recent` if the first is empty of agent/harness items), keep
+>    items whose title/abstract match the three query phrases, cap 6 — same sort axis as the API;
+> 3. only if that also fails → HN-only, and the progress line says `arxiv FAILED (429)`, never `0 items`.
+> 🟥 WebSearch is **not** on this ladder. If a run used it anyway, the arxiv leg is reported as
+> `RECALL-ONLY (WebSearch)` and its items are excluded from the NEW/REPEAT count.
 
 ### HackerNews (Algolia API)
 
 ```bash
 for KW in "AI agent" "LLM harness" "Claude" "multi-agent" "context engineering"; do
   curl -s --max-time 8 \
-    "https://hn.algolia.com/api/v1/search?query=$(echo $KW | tr ' ' '+')&tags=story&hitsPerPage=5&numericFilters=points>10"
+    "https://hn.algolia.com/api/v1/search_by_date?query=$(echo $KW | tr ' ' '+')&tags=story&hitsPerPage=5&numericFilters=points>30"
 done
 ```
 
-Collection criteria: score > 10, keyword-relevant items only. Max 15 items.
+Collection criteria: score > 30, keyword-relevant items only. Max 15 items.
+
+> **`/search_by_date`, not `/search` (revised 2026-09-04; prescribed 2026-09-01, unapplied for 3 runs).**
+> `/search` ranks by relevance and returned items dated 2025-11→2026-06 on 2026-09-01 — a *relevant-but-stale*
+> leg, the mirror image of the 2026-07-26 arXiv *fresh-but-off-axis* failure, and the HN leg carried neither
+> refresh trigger. `/search_by_date` sorts by submission time; the points floor rises 10→30 to keep the
+> date-sorted window from filling with noise (measured 2026-09-01: `points>30` gave a clean 08-27→08-31
+> window). Same rule as the arXiv leg: a leg that silently falls back to a relevance/recall channel converts
+> «unrun» into «nothing new».
 
 ### arxiv
 

package/plugins/fh-meta/skills/hub-cc-pr-reviewer/SKILL.md

@@ -98,6 +98,17 @@ verdict NOT_CONFIGURED, or the
 returned, what was found — never the matched lines themselves. Same rule as the marker: the file is
 a local artifact, the capsule is what crosses the boundary.
 
+**Noise control — two rules that decide what reaches the comment (absorbed 2026-09-04 from the
+AI-Native SDLC playbook's `REVIEW.md`; FH already tiers findings M/S/R, but had no cap and no
+exclusion list, so a long PR produced a long comment that buried the one finding that mattered):**
+- **Nit cap = 5.** A nit is any finding that would not change behavior, leak data, or breach a
+  baseline rule (style · naming · wording · ordering). Report at most five nits, then one line:
+  `+N more nits (not listed)`. M-tier and S-tier findings are never capped.
+- **Do-not-report list.** Skip anything a mechanical gate already enforces on this repo (the
+  pre-commit 4-axis gate, `validate` CI, `regression_guard`, public-surface scan) and generated or
+  vendored files. Reporting what a gate already blocks is double coverage that reads as noise; if
+  a gate *should* have caught it and did not, that is an S-tier finding about the gate, not a nit.
+
 Then attach the review comment (8-matrix results + self-catch + refinement suggestions + merge
 recommendation) via `gh pr comment`.
 

package/plugins/fh-meta/skills/hub-cc-pr-reviewer/SKILL_detail.md

@@ -28,6 +28,9 @@ gh pr comment "$PR_NUMBER" --body "$(cat <<'EOF'
 ### Refinement Suggestions (following simplification guard / areas for subsequent rounds outside this PR)
 {Subsequent round areas / omit if 0 items}
 
+### Nits (max 5; +N more not listed)
+{At most five style/naming/wording items; omit the section if 0. Never list what a gate already enforces.}
+
 ### Admin Override Merge Recommendation
 {User decision delegation / beta stage policy adherence}
 EOF

package/plugins/fh-qp/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "fh-qp",
+  "version": "3.1.0",
+  "engines": {
+    "claudeCode": ">=1.0.0"
+  },
+  "description": "QP (Quality Platform) — 4 skills (qp · qp-plan · qp-run · qp-regress). Plan→Automation→Regression loop for web and desktop apps with zero domain constants. Calls a registered qasp typed capability when one is present (strictest-wins); otherwise drives the target through the session's Playwright MCP (web) or computer-use MCP (desktop). Mobile deferred.",
+  "author": {
+    "name": "chrono-meta",
+    "email": "chrono-meta@users.noreply.github.com"
+  },
+  "keywords": [
+    "qa",
+    "quality-platform",
+    "test-planning",
+    "e2e",
+    "regression",
+    "surface-reach",
+    "mtm",
+    "domain-agnostic"
+  ]
+}

package/plugins/fh-qp/README.md

@@ -0,0 +1,71 @@
+# fh-qp — QP (Quality Platform)
+
+QP(Quality Platform) — qasp 의 PAR 를 도메인 상수 0 으로 옮긴 FH 동봉 플러그인.
+
+> Namespace note: in the field harness's own documents «QP» has meant *QA-Prism* (a roadmap label). This plugin's QP is **Quality Platform** — a different name space; nothing here refers to that roadmap.
+
+**What it is for**: you are inside Claude Code, you have a web page or a desktop app in front of you, and you want a repeatable **plan → run → regress** loop with a QA lens — not a one-off "click around for me".
+
+## Install / prerequisites (read this first — the first run fails without them)
+
+| you test | you need connected in this session | how QP detects it |
+|---|---|---|
+| a **web** page | Playwright MCP (`mcp__playwright__*`) — or the Claude-in-Chrome extension | `qp_tools.sh adapter-probe --need web` |
+| a **desktop** app | computer-use MCP (`mcp__computer-use__*`) | `qp_tools.sh adapter-probe --need desktop` |
+| a **mobile** app | — deferred; not supported | — |
+
+No adapter → every stage stops with `HARNESS_ERROR` (exit 10, plus a `qp/HARNESS_ERROR.txt`). That is a typed non-pass, never a skip.
+Nothing else to install: the plugin is four skills + one bash script; no Python, no npm packages.
+
+## First command
+
+```
+/qp https://app.example.com/          # plan → run → regress, stops at the first HARNESS_ERROR
+/qp plan https://app.example.com/     # one stage
+/qp app:"Example App"                 # desktop (needs a profile — see below)
+```
+You get files under `qp/`: `plan/inventory.md` · `plan/tcs.tsv` · `run/<ts>/verdicts.tsv` + masked evidence · `regress/<ts>/surface_reach.txt` + `delta.tsv` + `report.md`. You succeeded when `report.md` exists and its first 8 lines name the engine, the MTM state and a surface_reach line.
+
+## Public vs profile-required targets (zero domain constants)
+
+The plugin ships **no** host names, app names, credentials or organisation words. A target that is not public (private IP, `localhost`, `*.internal`/`*.lan`/`*.local`, a bare hostname, or any desktop app) is `PROFILE_REQUIRED` (exit 4) until you supply a profile:
+
+```
+cp plugins/fh-qp/qp_profile.example.yaml <a gitignored path>/qp_profile.yaml   # fill hosts/apps, reference env vars for secrets
+/qp https://private.example.internal/ --profile <that path>
+```
+The profile is the only place a target-specific constant may live, and it is yours, never the plugin's.
+
+## Engine — form C (skills are canonical; machinery is pluggable)
+
+1. **Typed capability** — if a QA harness registers a capability whose id ends in `:par`, QP calls its entry and merges constraints strictest-wins (`knowledge/shared/harness-core/capability_composition_contract.md`). **Status 2026-09-05: no such capability is registered anywhere** (FH registry and the field harness both checked — zero cap files). Registration is the field harness's move; until then this bridge is a declared slot. Asking for it explicitly (`--engine capability`) returns `HARNESS_ERROR reason=capability-not-registered`, not a silent fallback.
+2. **MCP fallback** — the path that exists today. Every artifact header says `engine=mcp-fallback adapter=<name> evidence=dom|pixel`, so a reader can tell which edition produced the report.
+3. Desktop through computer-use is the **weaker edition** (pixel evidence, no DOM): `verify` steps close by readable screenshot text only, surface_reach hashes screenshots. The report header says so.
+
+## What is mechanical vs what is prose (honest boundary)
+
+| check | where | closed by |
+|---|---|---|
+| target public / profile-required | `scripts/qp_tools.sh target-class` | exit enum 0/4/10 |
+| adapter present | `adapter-probe` | exit 0/10 (unknown ≠ present) |
+| evidence masking, residue 0 | `mask` | exit 0/5 |
+| surface_reach (TCs beyond entry / all TCs) | `surface-reach` | REACHED · PARTIAL · NOT_REACHED · UNMEASURED |
+| verdict record shape — status/branch/closure/verb enums, `MACHINE` needs an assertion, branch↔`expected_source` binding | `mtm-check` | exit 0/10 |
+| ≥1 state-changing verb executed | `run-verbs` | exit 0/5 |
+| **whether a label is TRUE** (is this really *code differs*?) | prose in `qp-run` | judgment — paired, not mechanised (a frozen rule would be tomorrow's ceiling) |
+
+The last row is the honest residual: QP types *that* a verdict is attributable and non-vacuous, not *that* it is correct.
+
+## Skills
+| skill | stage | Done When (summary) |
+|---|---|---|
+| `qp` | router | target classified · adapter probed · every artifact carries `engine=`/`evidence=` |
+| `qp-plan` | Prepare | inventory ≥1 observed surface · `tcs.tsv` 8 fields with `expected_source` · ≥1 click/input TC |
+| `qp-run` | Automation | `verdicts.tsv` passes `mtm-check` + `run-verbs` · evidence masked, residue 0 |
+| `qp-regress` | Regression | `surface_reach.txt` from the tool · one delta row per TC · NOT_REACHED sentence present |
+
+## Lane
+`bash scripts/test_fh_qp_lanes.sh` — known pairs for the three negatives (profile-required → refuse · no adapter → HARNESS_ERROR · dirty evidence → masked, residue 0), surface_reach four states, mtm-check good/bad, run-verbs, and a residency scan of the whole plugin (fail-closed if the scanner cannot run).
+
+## Prior art this is built on (curated, not reinvented)
+Playwright Test Agents (planner / generator / healer) and Playwright MCP do the exploring and the driving; Cypress UI Coverage and mabl cover page-level coverage; `page.screenshot({mask})` covers web masking. QP adds only the judgment layer on top: the verdict record contract (`mtm-check`), first-step BLOCKED attribution, surface_reach as a ratio over all TCs, and profile-gated targets.

package/plugins/fh-qp/fixtures/evidence_known_clean.txt

@@ -0,0 +1,3 @@
+step 1 open home
+step 2 click About
+plain text stays

package/plugins/fh-qp/fixtures/evidence_known_dirty.txt

@@ -0,0 +1,6 @@
+step 1 login as qa.tester@example.com
+Authorization: Bearer abcdefghijklmnopqrstuvwxyz0123456789
+token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJVadQssw5c
+password: hunter2hunter2
+sha=0123456789abcdef0123456789abcdef01234567
+plain text stays

package/plugins/fh-qp/fixtures/reach_known_partial.tsv

@@ -0,0 +1,4 @@
+TC-1	1	h_entry
+TC-1	2	h_entry
+TC-2	1	h_entry
+TC-2	2	h_about

package/plugins/fh-qp/fixtures/reach_known_reached.tsv

@@ -0,0 +1,4 @@
+TC-1	1	h_entry
+TC-1	2	h_about
+TC-2	1	h_entry
+TC-2	2	h_docs

package/plugins/fh-qp/fixtures/reach_known_wall.tsv

@@ -0,0 +1,3 @@
+TC-1	1	h_entry
+TC-2	1	h_entry
+TC-3	2	h_entry

package/plugins/fh-qp/fixtures/verdicts_known_bad_branch.tsv

@@ -0,0 +1,2 @@
+#mtm: UNAVAILABLE
+TC-1	FAIL	DIFFERS_FROM_PLAN	JUDGMENT	verify		NONE

package/plugins/fh-qp/fixtures/verdicts_known_bad_vacuous_machine.tsv

@@ -0,0 +1,2 @@
+#mtm: ACTIVE
+TC-1	FAIL	CODE_DIFFERS	MACHINE	verify		CODE

package/plugins/fh-qp/fixtures/verdicts_known_good.tsv

@@ -0,0 +1,4 @@
+#mtm: UNAVAILABLE
+TC-1	PASS	AS_PLANNED	MACHINE	navigate	url==https://example.com/	INVENTORY
+TC-2	PASS	AS_PLANNED	MACHINE	click	text-visible:About	INVENTORY
+TC-3	BLOCKED	NONE	JUDGMENT	input		NONE

package/plugins/fh-qp/fixtures/verdicts_verify_only.tsv

@@ -0,0 +1,3 @@
+#mtm: UNAVAILABLE
+TC-1	PASS	AS_PLANNED	MACHINE	verify	text-visible:x	INVENTORY
+TC-2	PASS	AS_PLANNED	MACHINE	verify	text-visible:y	INVENTORY

package/plugins/fh-qp/qp_profile.example.yaml

@@ -0,0 +1,29 @@
+# qp_profile.example.yaml — the ONLY place a target-specific constant may live.
+# Copy to a gitignored path (e.g. tracks/_meta/qp_profile.yaml) and pass it with --profile.
+# The plugin itself ships ZERO domain constants; without a profile, only public targets run.
+#
+# Every value below is a placeholder. Nothing in this file names a real organisation.
+profile_name: example
+targets:
+  web:
+    - id: example-web
+      base_url: https://app.example.com        # non-public hosts (10.x, *.internal, *.lan, bare names) REQUIRE this file
+      route_prefix: ""                          # e.g. "#/" for hash routers
+      entry_route: /
+  desktop:
+    - id: example-desktop
+      app_name: Example App                     # window title / bundle name as the OS shows it
+credentials:
+  # Never put secrets here. Reference an env var; qp-run reads it at type-time and masks it in evidence.
+  example-web:
+    username_env: QP_EXAMPLE_USER
+    password_env: QP_EXAMPLE_PASS
+tc_vocabulary:
+  # Optional overrides for the step-verb keywords qp-run recognises (defaults are English + Korean).
+  click: []
+  input: []
+  navigate: []
+  verify: []
+masking:
+  # Extra evidence-masking regexes (appended to the built-in email/token/password set).
+  extra_patterns: []

package/plugins/fh-qp/scripts/qp_tools.sh

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+# qp_tools.sh — the MECHANICAL half of fh-qp (QP · Quality Platform).
+#
+# The four qp-* skills are prose; a prose rule is muscle (a strong model carrying it), not skeleton.
+# Everything a floor-tier session must NOT be trusted to "just do" lives here as a typed check with a
+# closed exit enum, so a report can be read without trusting the narrator:
+#
+#   target-class   <url|app:NAME> [--profile FILE]      → PUBLIC | PROFILE_REQUIRED | PROFILE_OK | UNKNOWN
+#   adapter-probe  --need web|desktop --tools "a,b,c"    → ADAPTER=<name> | HARNESS_ERROR
+#   mask           <in> <out>                            → MASKED (residue 0) | RESIDUE
+#   surface-reach  <evidence.tsv>                        → REACHED | PARTIAL | NOT_REACHED | UNMEASURED
+#   mtm-check      <verdicts.tsv>                        → OK | INVALID
+#   run-verbs      <verdicts.tsv>                        → OK (≥1 state-changing verb) | VERIFY_ONLY
+#   screen-id      <snapshot-file>                       → 12-hex stable id of a DOM/pixel observation
+#
+# Exit enum (shared):  0 = pass/positive · 4 = PROFILE_REQUIRED · 5 = negative-but-typed (RESIDUE ·
+#   NOT_REACHED · PARTIAL · VERIFY_ONLY · INVALID) · 10 = HARNESS_ERROR / UNMEASURED (fail-closed:
+#   never read 10 as "clean" or "reached").
+#
+# Domain constants: ZERO. Every host/app name comes from the caller or the profile file.
+# bash 3.2 compatible (macOS default). No python required.
+set -uo pipefail
+
+usage() { sed -n '2,20p' "$0" >&2; exit 10; }
+[ $# -ge 1 ] || usage
+CMD="$1"; shift
+
+# ── helpers ────────────────────────────────────────────────────────────────────
+_host_of() { # strip scheme, path, port, creds
+  printf '%s' "$1" | sed -E 's#^[a-zA-Z][a-zA-Z0-9+.-]*://##; s#^[^/@]*@##; s#[/?].*$##; s#:[0-9]+$##' | tr 'A-Z' 'a-z'
+}
+_is_private_host() { # RFC1918 / loopback / link-local / non-public suffix / bare name
+  local h="$1"
+  case "$h" in
+    localhost|127.*|10.*|192.168.*|169.254.*|0.0.0.0|::1) return 0 ;;
+    172.1[6-9].*|172.2[0-9].*|172.3[01].*) return 0 ;;
+    *.local|*.internal|*.lan|*.intra|*.home|*.test|*.localhost|*.private) return 0 ;;
+  esac
+  case "$h" in *.*) return 1 ;; *) return 0 ;; esac   # bare hostname (no dot) → not public
+}
+_profile_lists() { # $1 = profile file, $2 = needle (host or app name). YAML-lite: grep the value.
+  [ -f "$1" ] || return 1
+  /usr/bin/grep -qiF -- "$2" "$1"
+}
+
+# ── target-class ───────────────────────────────────────────────────────────────
+cmd_target_class() {
+  local target="" profile=""
+  while [ $# -gt 0 ]; do case "$1" in --profile) profile="${2:-}"; shift 2 ;; *) target="$1"; shift ;; esac; done
+  [ -n "$target" ] || { echo "target-class: missing target" >&2; exit 10; }
+  case "$target" in
+    app:*)
+      local app="${target#app:}"
+      if [ -n "$profile" ] && _profile_lists "$profile" "$app"; then echo "PROFILE_OK kind=desktop app=$app"; exit 0; fi
+      echo "PROFILE_REQUIRED kind=desktop app=$app reason=desktop-targets-always-need-a-profile"; exit 4 ;;
+    http://*|https://*)
+      local h; h="$(_host_of "$target")"
+      [ -n "$h" ] || { echo "UNKNOWN reason=no-host"; exit 10; }
+      if _is_private_host "$h"; then
+        if [ -n "$profile" ] && _profile_lists "$profile" "$h"; then echo "PROFILE_OK kind=web host=$h"; exit 0; fi
+        echo "PROFILE_REQUIRED kind=web host=$h reason=non-public-host"; exit 4
+      fi
+      echo "PUBLIC kind=web host=$h"; exit 0 ;;
+    *) echo "UNKNOWN reason=unrecognised-target-form (want http(s)://… or app:NAME)"; exit 10 ;;
+  esac
+}
+
+# ── adapter-probe ──────────────────────────────────────────────────────────────
+# bash cannot introspect the session's MCP servers; the SESSION passes the tool names it actually has.
+# Omitting --tools is HARNESS_ERROR: unknown is not present.
+cmd_adapter_probe() {
+  local need="" tools=""
+  while [ $# -gt 0 ]; do case "$1" in --need) need="${2:-}"; shift 2 ;; --tools) tools="${2:-}"; shift 2 ;; *) shift ;; esac; done
+  [ "$need" = web ] || [ "$need" = desktop ] || { echo "HARNESS_ERROR reason=--need must be web|desktop"; exit 10; }
+  [ -n "$tools" ] || { echo "HARNESS_ERROR reason=tool-list-not-supplied (unknown ≠ present)"; exit 10; }
+  local t; for t in $(printf '%s' "$tools" | tr ',' ' '); do
+    case "$need:$t" in
+      web:mcp__playwright__browser_navigate)        echo "ADAPTER=playwright-mcp evidence=dom"; exit 0 ;;
+      web:mcp__claude-in-chrome__navigate)          echo "ADAPTER=claude-in-chrome evidence=dom"; exit 0 ;;
+      desktop:mcp__computer-use__screenshot)        echo "ADAPTER=computer-use-mcp evidence=pixel"; exit 0 ;;
+    esac
+  done
+  echo "HARNESS_ERROR reason=no-$need-adapter-among-supplied-tools"; exit 10
+}
+
+# ── mask ───────────────────────────────────────────────────────────────────────
+# Record-layer masking (the typing path still sends the real value). Residue 0 is asserted AFTER writing.
+_MASK_EMAIL='[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}'
+_MASK_JWT='eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}'
+_MASK_BEARER='[Bb]earer[[:space:]]+[A-Za-z0-9._~+/=-]{16,}'
+_MASK_KEYLIKE='(sk|pk|ghp|gho|xox[abp]|AKIA)[-_][A-Za-z0-9_-]{12,}'
+_MASK_HEX='[A-Fa-f0-9]{40,}'
+_MASK_PWKV='([Pp]ass(word|wd)?|[Ss]ecret|[Tt]oken)[[:space:]]*[:=][[:space:]]*"?[^"[:space:],}]{4,}'
+cmd_mask() {
+  local in="${1:-}" out="${2:-}"
+  [ -f "$in" ] || { echo "HARNESS_ERROR reason=input-missing"; exit 10; }
+  [ -n "$out" ] || { echo "HARNESS_ERROR reason=output-missing"; exit 10; }
+  sed -E \
+    -e "s/$_MASK_JWT/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_BEARER/Bearer __REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_KEYLIKE/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_HEX/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_PWKV/\1=__REDACTED_SECRET__/g" \
+    -e "s/$_MASK_EMAIL/__REDACTED_EMAIL__/g" \
+    "$in" > "$out" || { echo "HARNESS_ERROR reason=sed-failed"; exit 10; }
+  local residue
+  # Strip our own markers before re-scanning — the Bearer pattern matches "__REDACTED_TOKEN__" itself
+  # (18 word-chars). Known-pair caught this on first run: an instrument matching its own output is
+  # [[feedback_lane_vocabulary_blind_to_its_own_fix]] in miniature.
+  residue=$(sed -E 's/__REDACTED_[A-Z]+__//g' "$out" | /usr/bin/grep -cE "$_MASK_EMAIL|$_MASK_JWT|$_MASK_BEARER|$_MASK_HEX" 2>/dev/null); residue="${residue:-0}"
+  if [ "$residue" -eq 0 ]; then echo "MASKED residue=0 out=$out"; exit 0; fi
+  echo "RESIDUE residue=$residue out=$out"; exit 5
+}
+
+# ── surface-reach ──────────────────────────────────────────────────────────────
+# evidence.tsv: tc_id <TAB> step <TAB> screen_hash   (one row per observed screen; hash = any stable id)
+# Entry screen = the modal hash across the batch. A TC is "beyond entry" iff any of its hashes ≠ entry.
+# Denominator = ALL tc_ids in the file. An empty file is UNMEASURED (10), never NOT_REACHED.
+cmd_surface_reach() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "UNMEASURED reason=evidence-missing"; exit 10; }
+  [ -s "$f" ] || { echo "UNMEASURED reason=evidence-empty (empty set is not reached)"; exit 10; }
+  LC_ALL=C awk -F'\t' '
+    NF < 3 || $1 ~ /^#/ { next }
+    { tc[$1]=1; n_rows++; cnt[$3]++; seen[$1 SUBSEP $3]=1 }
+    END {
+      if (n_rows == 0) { print "UNMEASURED reason=no-rows"; exit 10 }
+      best=""; bestc=-1
+      for (h in cnt) if (cnt[h] > bestc) { bestc=cnt[h]; best=h }
+      total=0; beyond=0
+      for (t in tc) { total++; b=0; for (k in seen) { split(k, p, SUBSEP); if (p[1]==t && p[2]!=best) b=1 } beyond+=b }
+      st = (beyond==total) ? "REACHED" : (beyond==0 ? "NOT_REACHED" : "PARTIAL")
+      printf "%s tcs_beyond_entry=%d tcs_total=%d entry_screen=%s\n", st, beyond, total, best
+      exit (st=="REACHED") ? 0 : 5
+    }' "$f"
+}
+
+# ── mtm-check ──────────────────────────────────────────────────────────────────
+# verdicts.tsv: first non-comment line MUST be  #mtm: ACTIVE|UNAVAILABLE|FAILED|DISABLED
+# rows: tc_id <TAB> status <TAB> branch <TAB> closure <TAB> verb <TAB> assertion <TAB> expected_source
+#   status          ∈ PASS FAIL BLOCKED AMBIGUOUS
+#   branch          ∈ AS_PLANNED DIFFERS_FROM_PLAN CODE_DIFFERS NONE
+#   closure         ∈ MACHINE JUDGMENT   (MACHINE requires a non-empty assertion — the record that closed it)
+#   verb            ∈ navigate click input verify
+#   expected_source ∈ PLAN_DOC INVENTORY CODE HUMAN NONE   — WHERE the expected value came from.
+# The branch→source binding is the mechanical discriminator (challenger #9, governor 2026-09-05):
+#   DIFFERS_FROM_PLAN  ⇒ expected_source = PLAN_DOC  and #mtm: ACTIVE   (no plan doc → this branch is unreachable)
+#   CODE_DIFFERS       ⇒ expected_source ∈ {CODE, PLAN_DOC}
+#   AS_PLANNED         ⇒ expected_source ≠ NONE
+#   NONE               ⇒ status ∈ {BLOCKED, AMBIGUOUS}  (a verdict with no branch is a non-verdict)
+# Any violation → INVALID (10). The check asserts the RECORD's properties (typed · attributable ·
+# non-vacuous), never whether the label is TRUE — that stays judgment (CLAUDE.md §Mechanization Boundary).
+cmd_mtm_check() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "INVALID reason=file-missing"; exit 10; }
+  local mtm; mtm=$(/usr/bin/grep -m1 -E '^#mtm:' "$f" | sed -E 's/^#mtm:[[:space:]]*//' | tr -d '[:space:]')
+  case "$mtm" in ACTIVE|UNAVAILABLE|FAILED|DISABLED) ;; *) echo "INVALID reason=mtm-state-missing-or-bad (#mtm: ACTIVE|UNAVAILABLE|FAILED|DISABLED)"; exit 10 ;; esac
+  LC_ALL=C awk -F'\t' -v mtm="$mtm" '
+    /^#/ || NF==0 { next }
+    { rows++
+      if (NF < 7) { bad++; why="row-has-" NF "-fields-need-7"; next }
+      if ($2 !~ /^(PASS|FAIL|BLOCKED|AMBIGUOUS)$/) { bad++; why="status:" $2; next }
+      if ($3 !~ /^(AS_PLANNED|DIFFERS_FROM_PLAN|CODE_DIFFERS|NONE)$/) { bad++; why="branch:" $3; next }
+      if ($3 == "DIFFERS_FROM_PLAN" && mtm != "ACTIVE") { bad++; why="DIFFERS_FROM_PLAN-needs-mtm-ACTIVE"; next }
+      if ($4 !~ /^(MACHINE|JUDGMENT)$/) { bad++; why="closure:" $4; next }
+      if ($4 == "MACHINE" && $6 == "") { bad++; why="MACHINE-closure-without-assertion"; next }
+      if ($5 !~ /^(navigate|click|input|verify)$/) { bad++; why="verb:" $5; next }
+      if ($7 !~ /^(PLAN_DOC|INVENTORY|CODE|HUMAN|NONE)$/) { bad++; why="expected_source:" $7; next }
+      if ($3 == "DIFFERS_FROM_PLAN" && $7 != "PLAN_DOC") { bad++; why="DIFFERS_FROM_PLAN-needs-expected_source=PLAN_DOC"; next }
+      if ($3 == "CODE_DIFFERS" && $7 !~ /^(CODE|PLAN_DOC)$/) { bad++; why="CODE_DIFFERS-needs-expected_source=CODE|PLAN_DOC"; next }
+      if ($3 == "AS_PLANNED" && $7 == "NONE") { bad++; why="AS_PLANNED-with-expected_source=NONE"; next }
+      if ($3 == "NONE" && $2 !~ /^(BLOCKED|AMBIGUOUS)$/) { bad++; why="branch=NONE-only-for-BLOCKED|AMBIGUOUS"; next }
+      if ($4=="MACHINE") m++; else j++
+    }
+    END {
+      if (rows == 0) { print "INVALID reason=no-rows"; exit 10 }
+      if (bad > 0) { printf "INVALID rows=%d bad=%d first=%s\n", rows, bad, why; exit 10 }
+      printf "OK mtm=%s rows=%d machine_closed=%d judgment_left=%d\n", mtm, rows, m+0, j+0; exit 0
+    }' "$f"
+}
+
+# ── screen-id ──────────────────────────────────────────────────────────────────
+# First-use finding (2026-09-05, gh-pages target): Playwright MCP accessibility snapshots carry per-navigation
+# ref tokens (`[ref=e12]`, then `[ref=f2e12]`, `[ref=f3e12]` …) — the SAME page hashed to three different ids
+# across three visits, so surface_reach credited two TCs for "leaving the entry screen" before they clicked.
+# The screen id must be a CONTENT hash: strip ref/active tokens and whitespace runs before hashing.
+# Binary files (screenshots) are hashed as-is.
+cmd_screen_id() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "HARNESS_ERROR reason=file-missing"; exit 10; }
+  if LC_ALL=C /usr/bin/grep -qI . "$f"; then
+    sed -E 's/\[ref=[A-Za-z0-9]+\]//g; s/\[active\]//g; s/[[:space:]]+/ /g' "$f" | shasum -a 256 | cut -c1-12
+  else
+    shasum -a 256 "$f" | cut -c1-12
+  fi
+}
+
+# ── run-verbs (challenger #13: verify-only evidence never exercised the runner) ─
+cmd_run_verbs() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "HARNESS_ERROR reason=file-missing"; exit 10; }
+  local n; n=$(LC_ALL=C awk -F'\t' '!/^#/ && NF>=5 && ($5=="click" || $5=="input"){c++} END{print c+0}' "$f")
+  if [ "$n" -ge 1 ]; then echo "OK state_changing_verbs=$n"; exit 0; fi
+  echo "VERIFY_ONLY state_changing_verbs=0 (runner not exercised)"; exit 5
+}
+
+case "$CMD" in
+  target-class)  cmd_target_class "$@" ;;
+  adapter-probe) cmd_adapter_probe "$@" ;;
+  mask)          cmd_mask "$@" ;;
+  surface-reach) cmd_surface_reach "$@" ;;
+  mtm-check)     cmd_mtm_check "$@" ;;
+  run-verbs)     cmd_run_verbs "$@" ;;
+  screen-id)     cmd_screen_id "$@" ;;
+  *) usage ;;
+esac

package/plugins/fh-qp/skills/qp/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: qp
+description: QP (Quality Platform) router — takes a web URL or a desktop app name and runs the plan → run → regress loop (qp-plan, qp-run, qp-regress) end to end, or routes to one stage. Classifies the target (public vs profile-required), probes which adapter the session has (Playwright MCP for web, computer-use MCP for desktop), and writes every artifact with a typed engine/adapter marker. Triggers on "test this website for me", "run a QA pass on this app", "check the app end to end", "이 사이트 QA 돌려줘", "이 앱 테스트해줘", "회귀 돌려줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05) — generic edition of a field QA harness's P·A·R loop; zero domain constants
+---
+
+# qp — Quality Platform router
+
+One entry point for people who want to **dynamically test a web or desktop app with a QA lens from inside Claude Code**.
+Three stages, each its own skill, each leaving files:
+
+| stage | skill | you get |
+|---|---|---|
+| **P**lan | `qp-plan` | `qp/plan/inventory.md` (surfaces the app exposes) + `qp/plan/tcs.tsv` (test cases) |
+| **A**utomation (run) | `qp-run` | `qp/run/<ts>/verdicts.tsv` + masked evidence (DOM snapshots or screenshots) |
+| **R**egression | `qp-regress` | `qp/regress/<ts>/surface_reach.txt` + per-TC delta vs the previous run |
+
+Glossary (one line each, because a first-time reader asked): **TC** = test case · **inventory** = the list of screens/routes/menus the app exposes · **MTM** = each finding is labeled *as planned* / *differs from the plan document* / *code differs* · **precondition** = what must already be true before a step runs (logged in, page loaded), checked not assumed — a failure before it is met is `BLOCKED`, not `FAIL` · **surface_reach** = how many TCs actually left the entry screen · **engine** = which machinery drove the run (see §Engine).
+
+## Step 0 — classify the target (mechanical, never by eye)
+
+```
+bash plugins/fh-qp/scripts/qp_tools.sh target-class <https://… | app:NAME> [--profile <file>]
+```
+| result | rc | what you do |
+|---|---|---|
+| `PUBLIC` | 0 | proceed |
+| `PROFILE_OK` | 0 | proceed with the profile |
+| `PROFILE_REQUIRED` | 4 | **stop.** Say: *"this target is not public; QP needs a profile file — copy `plugins/fh-qp/qp_profile.example.yaml` to a gitignored path, fill the host/app, and re-run with `--profile`."* Do not improvise a run against a private host. |
+| `UNKNOWN` | 10 | stop, report the target form QP accepts |
+
+## Step 1 — probe the adapter (mechanical; unknown ≠ present)
+
+List the MCP tool names this session actually has (from your tool list — do not guess), then:
+```
+bash plugins/fh-qp/scripts/qp_tools.sh adapter-probe --need web|desktop --tools "<comma-separated tool names>"
+```
+`ADAPTER=… evidence=dom|pixel` → proceed and **write that line into every artifact header**.
+`HARNESS_ERROR` (rc 10) → **stop.** Write `qp/HARNESS_ERROR.txt` with the reason and tell the user which MCP to connect (Playwright MCP for web · computer-use MCP for desktop). This is not a pass and not a skip.
+
+## Engine — typed capability vs MCP fallback (form C)
+
+- If a QA harness has **registered** a typed capability whose id ends in `:par` (check `.claude/capabilities/**/*.cap` and `bash scripts/cluster_capability_scan.sh` when in an FH hub), call its `entry` and merge constraints **strictest-wins** (`capability_composition_contract.md`). Engine marker: `engine=capability:<id>`.
+- Otherwise drive the target yourself through the adapter from Step 1. Engine marker: `engine=mcp-fallback adapter=<name> evidence=dom|pixel`.
+- **As of 2026-09-05 no such capability is registered anywhere** — the fallback is the only path that exists. If the user explicitly asks for the capability engine (`--engine capability`) and none is registered → `HARNESS_ERROR reason=capability-not-registered`, never a silent fallback.
+- Desktop (`evidence=pixel`) is the **weaker edition**: no DOM, so `verify` closes only by screenshot text you can read, and surface_reach hashes screenshots, not DOM. Say so in the report header.
+
+## Step 2 — run the stages
+
+`qp <target>` = plan → run → regress in order, stopping at the first `HARNESS_ERROR`. `qp plan|run|regress <target>` = one stage. Each stage skill carries its own Done When.
+
+## Done When
+1. Target classified with a `target-class` line recorded in `qp/plan/inventory.md` header · **[mandatory-pass]** — rc is the check.
+2. Adapter probed and `ADAPTER=` or `HARNESS_ERROR` written to a file · **[mandatory-pass]** — file exists and matches the probe output.
+3. Every artifact header carries `engine=` and `evidence=` · **[measured]** — `grep -L 'engine=' qp/**/*.md qp/**/*.tsv` is empty.
+4. Stages chained in P→A→R order with no stage skipped silently · **[judged — pairing: the lane `scripts/test_fh_qp_lanes.sh` and the per-stage Done When files]**.
+
+## Independently executable
+Needs only `bash` + the session's MCP adapter. No other FH skill is required. Inside an FH hub the capability scan is optional.
+
+## Not this skill
+Mobile (deferred). Verifying FH itself (use FH's own gates). Fixing the app.

package/plugins/fh-qp/skills/qp-plan/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: qp-plan
+description: Prepare stage of QP — builds a surface inventory of a web page or desktop app (routes, menus, forms, dialogs), checks it is MECE (no overlap, nothing missing that is visible), and designs test cases as a TSV with preconditions and expected values whose SOURCE is named. Works without a spec document (then expected values come from the inventory, not a plan). Triggers on "what should I test on this page", "make a test plan for this app", "list the screens of this app", "테스트 케이스 뽑아줘", "이 화면 인벤토리 만들어줘".
+user-invocable: true
+allowed-tools: ["Read", "Bash", "Write", "Glob", "Grep"]
+model: sonnet
+origin: chamber run fh-qa-generic (2026-09-05)
+---
+
+# qp-plan — Prepare (inventory → MECE → TCs)
+
+Input: a target that passed `qp_tools.sh target-class` (PUBLIC or PROFILE_OK) and an adapter line from `adapter-probe`. Optional: a plan/spec document path (`--plan <file>`). Optional profile.
+
+## 1. Surface inventory — observe, do not guess
+Open the entry route with the adapter (web: navigate + accessibility snapshot; desktop: screenshot). Record every **navigable surface** you can see: links/routes, menu items, buttons that open a dialog, forms, tabs. One row each:
+
+```
+| id | kind (route·menu·dialog·form·tab) | label as shown | how reached (from which surface, which action) | observed? (yes/no) |
+```
+Rules: ⓐ **do not invent routes** — a surface is listed only if you saw its trigger; ⓑ parameterised routes (`/item/:id`) are listed as `ROUTE_PARAMETERIZED`, not filled with a made-up id; ⓒ if the entry route did not load → stop with `HARNESS_ERROR reason=entry-unreachable`. Write `qp/plan/inventory.md` with the header lines `target-class: …` (the tool's literal output), `ADAPTER=… evidence=dom|pixel` (the probe's literal output), `engine=mcp-fallback` (or `engine=capability:<id>` only if the `qp` router found a registered capability — never a browser name; a floor-tier sim wrote `engine=chromium` when this line did not say so, 2026-09-05), `plan_doc: <path|NONE>`.
+
+## 2. MECE check
+Walk the inventory once more against the snapshot: any visible navigable element not in the list → add it (**missing**); any two rows reaching the same surface → merge (**overlap**). Write the count of each fix under `## MECE` in inventory.md. Zero fixes is a legitimate value; an unstated count is not.
+
+## 3. Test-case design — `qp/plan/tcs.tsv`
+Tab-separated, header row:
+```
+tc_id	surface_id	precondition	step_verb	step_target	expected	expected_source	priority
+```
+- `step_verb` ∈ `navigate click input verify` (one verb per row; a multi-step TC is several rows sharing `tc_id`).
+- `expected_source` ∈ `PLAN_DOC INVENTORY CODE HUMAN` — **where the expected value came from**. With no plan document every row is `INVENTORY` (or `HUMAN` if the user told you). This field is what lets `qp-run` label a finding *differs from plan* vs *code differs*; a TC without it cannot be run.
+- `precondition` is what must be true before step 1 (e.g. `at:/`, `logged-in`). Write `none` explicitly when there is none.
+- **At least one TC must carry a state-changing verb (`click` or `input`)** — a verify-only plan never exercises the runner (`qp_tools.sh run-verbs` enforces this on the run output).
+- Minimum: inventory ≥ 5 surfaces, TCs ≥ 3 for a first pass; say when the target is too small to reach that (a one-page site can be).
+
+## Done When
+1. `qp/plan/inventory.md` exists with the four header lines and ≥1 observed surface · **[mandatory-pass]**.
+2. `qp/plan/tcs.tsv` parses: every row has 8 fields, `step_verb` and `expected_source` in their enums, ≥1 click/input row · **[measured]** — `awk -F'\t' 'NF!=8' tcs.tsv` prints nothing; `run-verbs` on the later verdicts is OK.
+3. No surface in the inventory was invented (each has `observed? yes` or a `ROUTE_PARAMETERIZED` mark) · **[judged — pairing: a second session re-opens the entry route and diffs the inventory; the lane's residency/zero-constant grep on the plan files]**.
+
+## Independently executable
+Yes — bash + adapter. Does not need `qp-run`.