@chrono-meta/fh-gate 3.0.0 → 3.1.1

package/scripts/test_push_zone_lanes.sh

@@ -0,0 +1,304 @@
+#!/usr/bin/env bash
+# test_push_zone_lanes.sh — known-pair anchor for the pre-push hook's Push-Zone verdict, and for
+# the session-close ①-f advisory that mirrors it.
+#
+# ── WHY THIS FILE EXISTS ───────────────────────────────────────────────────────────────────────
+# 2026-09-05: templates/.git-hooks/pre-push gained a new verdict path and scripts/session_close_
+# check.sh gained a new ①-f advisory, both implementing CLAUDE.local.md §REST API push 계정규칙
+# mechanically — a push to a github.com remote whose owner is NOT on the operator's owner-account
+# list needs the REST Contents API channel, not plain git push. Before this suite the new code had
+# no known-pair anchor at all. Per CLAUDE.md §Instrument Calibration, a gate is not trusted until
+# calibrated on at least one known-positive and one known-negative, hand-verified.
+#
+# ── DISCIPLINE INHERITED FROM THE SIBLING SUITE (test_prepush_destructive_lanes.sh) ────────────
+#  (a) Run the hook FOR REAL — `bash -n` is not an instrument (a runtime fault can parse clean,
+#      abort the hook, and still exit 0).
+#  (b) A runtime fault is checked BEFORE the verdict, else an aborted hook scores as a clean pass.
+#  (c) "It blocked" is NOT "it blocked correctly" — a block must be ATTRIBUTED to a named FH gate.
+#  (d) NEVER read or assert on the operator's real owner-account list
+#      (.claude/rules/.push-zone-owners). Every lane below builds its own throwaway fixture list
+#      via the PUSH_ZONE_OWNERS override, with fictitious account names. The real file, if present
+#      on this machine, is never opened by this suite in either direction.
+#
+# Runs entirely in mktemp throwaway repos: never touches this repo's index, worktree, refs, or its
+# real .claude/rules/.push-zone-owners.
+#
+# Usage: bash scripts/test_push_zone_lanes.sh
+#   FH_PUSH_ZONE_HOOK_SRC=<path>  → test a DIFFERENT copy of the pre-push hook (fail-before proof).
+#   FH_PUSH_ZONE_SCC_SRC=<path>   → same, for session_close_check.sh.
+set -uo pipefail
+. "$(dirname "${BASH_SOURCE[0]}")/fixture_guard_lib.sh"
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+HOOK_SRC="${FH_PUSH_ZONE_HOOK_SRC:-$REPO_ROOT/templates/.git-hooks/pre-push}"
+SCC_SRC="${FH_PUSH_ZONE_SCC_SRC:-$REPO_ROOT/scripts/session_close_check.sh}"
+DEF_SRC="$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults"
+ZERO="0000000000000000000000000000000000000000"
+
+if [ ! -f "$HOOK_SRC" ]; then
+  echo "HARNESS_ERROR — pre-push hook not found at $HOOK_SRC (subject absent; NOT a pass)"; exit 1
+fi
+
+WORK="$(fh_fixture_root "$(mktemp -d)")" || exit 1
+: "${WORK:?fixture root unset — refusing to run git in cwd}"
+trap 'rm -rf "$WORK"' EXIT
+cp "$HOOK_SRC" "$WORK/hook" || exit 1
+HOOK="$WORK/hook"
+
+# Fictitious owner-account fixture — NEVER the operator's real list. The second entry
+# (acme-shared-org) is asserted to never appear in any captured output — it is a decoy for the
+# "list content is never printed" requirement, not used by any URL in this suite.
+OWNERS_OK="$WORK/owners-ok.txt"
+printf '# fixture owner list — test only, not the operator real list\nknown-owner\nacme-shared-org\n' > "$OWNERS_OK"
+
+PASSED=0; FAILED=0; ALL_OUT=""
+
+# ── fixture: same shape as test_prepush_destructive_lanes.sh's newrepo() ───────────────────────
+newrepo() {
+  local d; d="$(fh_fixture_root "$(mktemp -d)")" || return 1
+  : "${d:?fixture root unset — refusing to run git in cwd}"
+  mkdir -p "$d/.claude/rules" "$d/templates/.git-hooks" "$d/tracks/_meta" "$d/scripts" || return 1
+  [ -f "$DEF_SRC" ] && cp "$DEF_SRC" "$d/.claude/rules/.public-surface-patterns.defaults"
+  [ -f "$REPO_ROOT/scripts/psa_scan_lib.sh" ] && cp "$REPO_ROOT/scripts/psa_scan_lib.sh" "$d/scripts/psa_scan_lib.sh"
+  printf '.claude/rules/.public-surface-patterns\n' > "$d/.gitignore"
+  cp "$HOOK" "$d/templates/.git-hooks/pre-push" || return 1
+  printf 'base\n' > "$d/a.txt"
+  (
+    cd "$d" || exit 1
+    git init -q                                  || exit 1
+    git symbolic-ref HEAD refs/heads/main        || exit 1
+    git config user.email t@example.com          || exit 1
+    git config user.name t                       || exit 1
+    git add -A >/dev/null 2>&1                   || exit 1
+    git commit -qm base >/dev/null 2>&1          || exit 1
+    git update-ref refs/remotes/origin/main HEAD || exit 1
+  ) || return 1
+  printf '%s' "$d"
+}
+
+require_repo() {   # $1 = candidate repo path, $2 = lane name
+  if [ -z "${1:-}" ] || [ ! -d "$1/.git" ]; then
+    echo "HARNESS_ERROR — fixture repo not built for $2 (setup failed; NOT a pass)"
+    exit 1
+  fi
+}
+
+# check_zone <name> <repo> <owners-file|""> <url> <push_zone_ok:0|1> <expect:block|pass> <cause-regex|""> <refline>
+check_zone() {
+  local name="$1" repo="$2" owners="$3" url="$4" pzok="$5" expect="$6" cause="$7"; shift 7
+  local out rc got _pzsrc
+  require_repo "$repo" "$name"
+  _pzsrc="${owners:-$WORK/nonexistent-owners-file-for-zone-test}"
+  out=$(printf '%s\n' "$@" | ( cd "$repo" && PUSH_ZONE_OWNERS="$_pzsrc" PUSH_ZONE_OK="$pzok" \
+        bash templates/.git-hooks/pre-push origin "$url" 2>&1 )); rc=$?
+  ALL_OUT="$ALL_OUT
+$out"
+
+  if printf '%s' "$out" | grep -qiE 'bad substitution|unbound variable|syntax error|command not found'; then
+    echo "  ❌ $name — RUNTIME FAULT in the hook (aborted, not passed)"
+    printf '%s\n' "$out" | grep -iE 'bad substitution|unbound|syntax error|command not found' | sed 's/^/       /' | head -3
+    FAILED=$((FAILED+1)); return
+  fi
+
+  if [ "$rc" -ne 0 ]; then
+    if printf '%s' "$out" | grep -qE 'FH (Push-Zone Gate|Destructive-Op Gate)'; then
+      got=block
+    else
+      echo "  ❌ $name — blocked, but NOT by a named FH gate (harness reason ≠ finding)"
+      printf '%s\n' "$out" | sed 's/^/       | /' | head -8
+      FAILED=$((FAILED+1)); return
+    fi
+  else
+    got=pass
+  fi
+
+  if [ "$got" != "$expect" ]; then
+    echo "  ❌ $name — expected $expect, got $got"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -10
+    FAILED=$((FAILED+1)); return
+  fi
+
+  if [ -n "$cause" ] && ! printf '%s' "$out" | grep -qE "$cause"; then
+    echo "  ❌ $name — verdict $got is correct but UNATTRIBUTED (missing: $cause)"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -10
+    FAILED=$((FAILED+1)); return
+  fi
+
+  echo "  ✅ $name (expected $expect)"
+  PASSED=$((PASSED+1))
+}
+
+echo "[push-zone] known-pair anchor for the pre-push Push-Zone verdict (hook: $HOOK_SRC)"
+echo ""
+
+# Z0 — no owner-account list at all → UNCALIBRATED, plain push allowed.
+R=$(newrepo); require_repo "$R" "Z0"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z0 no owner-account list         → PASS " "$R" "" \
+  "https://github.com/known-owner/repo.git" 0 pass 'push-zone: UNCALIBRATED' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z1 — owner IN the list, https → silent pass; the rest of the hook (confidentiality) still runs.
+R=$(newrepo); require_repo "$R" "Z1"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z1 owner IN list, https          → PASS " "$R" "$OWNERS_OK" \
+  "https://github.com/known-owner/repo.git" 0 pass 'FH Pre-Publish' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z2 — owner OUT of the list, https → BLOCK, attributed, names the URL's (fictitious) owner.
+R=$(newrepo); require_repo "$R" "Z2"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z2 owner OUT of list, https      → BLOCK" "$R" "$OWNERS_OK" \
+  "https://github.com/someone-else/repo.git" 0 block 'FH Push-Zone Gate' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+if printf '%s' "$ALL_OUT" | grep -qF 'github.com/someone-else'; then
+  echo "  ✅ Z2b block message names the URL's owner"; PASSED=$((PASSED+1))
+else
+  echo "  ❌ Z2b — block message did not name the URL's owner (someone-else)"; FAILED=$((FAILED+1))
+fi
+rm -rf "$R"
+
+# Z3 — owner OUT of the list, scp-like ssh (git@github.com:owner/repo) → BLOCK.
+R=$(newrepo); require_repo "$R" "Z3"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z3 owner OUT of list, ssh scp    → BLOCK" "$R" "$OWNERS_OK" \
+  "git@github.com:someone-else/repo.git" 0 block 'FH Push-Zone Gate' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z4 — remote host is not github.com → out of scope for this axis, pass allowed, says so.
+R=$(newrepo); require_repo "$R" "Z4"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z4 non-github host              → PASS " "$R" "$OWNERS_OK" \
+  "https://ghe.example.com/x/y" 0 pass 'not github.com' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z5 — PUSH_ZONE_OK=1 override on an out-of-list push → allowed, conscious, LOGGED.
+R=$(newrepo); require_repo "$R" "Z5"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z5 PUSH_ZONE_OK=1 override       → PASS " "$R" "$OWNERS_OK" \
+  "https://github.com/someone-else/repo.git" 1 pass 'PUSH_ZONE_OK=1' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+LOG="$R/tracks/_meta/.push_zone_override_log"
+if [ -f "$LOG" ] && grep -qF 'owner:someone-else' "$LOG"; then
+  echo "  ✅ Z5b override logged to tracks/_meta/.push_zone_override_log"; PASSED=$((PASSED+1))
+else
+  echo "  ❌ Z5b override NOT logged (wanted a line inside $LOG)"; FAILED=$((FAILED+1))
+fi
+rm -rf "$R"
+
+# Z6 — existing destructive verdict (branch DELETE, unique paths → REVIEW → BLOCK) still stands
+#      AFTER a silent zone PASS. Same shape as the sibling suite's P2, through an owner-matching
+#      github.com URL — proves the zone block, inserted near the TOP of the hook, does not shadow
+#      or reorder the destructive checks further down.
+R=$(newrepo); require_repo "$R" "Z6"
+( cd "$R" && git checkout -q -b unique-work && printf 'only here\n' > unique.txt \
+   && git add unique.txt && git commit -qm unique >/dev/null && git checkout -q main )
+TIP=$(cd "$R" && git rev-parse unique-work)
+check_zone "Z6 zone PASS, then BRANCH DELETE → BLOCK" "$R" "$OWNERS_OK" \
+  "https://github.com/known-owner/repo.git" 0 block 'REVIEW: .* unique path' \
+  "(delete) $ZERO refs/heads/unique-work $TIP"
+rm -rf "$R"
+
+# ── Residency: the owner-list's OTHER entries must never appear in any captured output ─────────
+if printf '%s' "$ALL_OUT" | grep -qF 'acme-shared-org'; then
+  echo "  ❌ RESIDENCY — the fixture owner-list's second entry leaked into hook output"
+  FAILED=$((FAILED+1))
+else
+  echo "  ✅ RESIDENCY — owner-list content never appears in any captured hook output"
+  PASSED=$((PASSED+1))
+fi
+
+echo ""
+# ── Z7–Z14 (cross-family codex gpt-5.5, 2026-09-05): the first draft accepted three literal URL
+# prefixes and read every other github.com shape as "unrecognized → allow" — four real shapes were
+# failing OPEN; an inline comment in the owner list authorised pushes; CRLF / trailing slash blocked
+# the operator's own remotes. Each lane below is one of those exact inputs.
+OWNERS_CRLF="$WORK/owners-crlf.txt";   printf 'known-owner\r\nacme-shared-org\r\n' > "$OWNERS_CRLF"
+OWNERS_COMMENT="$WORK/owners-comment.txt"; printf 'known-owner   # someone-else is NOT allowed\nacme-shared-org\n' > "$OWNERS_COMMENT"
+OWNERS_SLASH="$WORK/owners-slash.txt"; printf 'known-owner/\nacme-shared-org\n' > "$OWNERS_SLASH"
+
+_zone_ff_lane() {  # $1=id $2=desc $3=owners $4=url $5=expect $6=cause
+  local R BASESHA NEWSHA
+  R=$(newrepo); require_repo "$R" "$1"
+  BASESHA=$(cd "$R" && git rev-parse HEAD)
+  NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+  check_zone "$1 $2" "$R" "$3" "$4" 0 "$5" "$6" "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+  rm -rf "$R"
+}
+_zone_ff_lane Z7  "userinfo https (user@github.com), owner OUT → BLOCK" "$OWNERS_OK" "https://user@github.com/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z8  "https with :443 port, owner OUT → BLOCK"           "$OWNERS_OK" "https://github.com:443/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z9  "ssh:// with :22 port, owner OUT → BLOCK"           "$OWNERS_OK" "ssh://git@github.com:22/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z10 "scp form with leading slash (git@github.com:/o/r), owner OUT → BLOCK" "$OWNERS_OK" "git@github.com:/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z11 "inline comment in owner list must NOT authorise the commented name → BLOCK" "$OWNERS_COMMENT" "https://github.com/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z12 "CRLF owner list, owner IN → pass (no over-block)"  "$OWNERS_CRLF" "https://github.com/known-owner/repo.git" pass ''
+_zone_ff_lane Z13 "trailing-slash owner entry, owner IN → pass"       "$OWNERS_SLASH" "https://github.com/known-owner/repo.git" pass ''
+_zone_ff_lane Z13b "uppercase host/owner in URL, owner IN → pass (case-insensitive)" "$OWNERS_OK" "https://GitHub.com/Known-Owner/repo.git" pass ''
+# Z14 — $2 is a bare remote NAME (alias/insteadOf edge): the hook must resolve it, not read it as a host.
+R=$(newrepo); require_repo "$R" "Z14"
+( cd "$R" && git remote add origin https://github.com/someone-else/repo.git ) 2>/dev/null
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z14 \$2 is the remote NAME → resolved via git remote get-url → BLOCK" "$R" "$OWNERS_OK" \
+  "origin" 0 block 'FH Push-Zone Gate' "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+echo "── session-close ①-f wiring (scripts/session_close_check.sh) ──"
+if [ ! -f "$SCC_SRC" ]; then
+  echo "HARNESS_ERROR — session_close_check.sh not found at $SCC_SRC"; FAILED=$((FAILED+1))
+else
+  SR="$(fh_fixture_root "$(mktemp -d)")" || exit 1
+  mkdir -p "$SR/tracks/_meta" "$SR/scripts" "$SR/.claude/rules"
+  cp "$REPO_ROOT/scripts/push_zone_check.sh" "$SR/scripts/push_zone_check.sh" 2>/dev/null
+  chmod +x "$SR/scripts/push_zone_check.sh" 2>/dev/null
+  ( cd "$SR" && git init -q && git symbolic-ref HEAD refs/heads/main \
+      && git config user.email t@example.com && git config user.name t \
+      && git commit -q --allow-empty -m base >/dev/null ) >/dev/null 2>&1
+
+  if [ -x "$SR/scripts/push_zone_check.sh" ]; then
+    SC_OUT=$(PUSH_ZONE_OWNERS="$OWNERS_OK" bash "$SCC_SRC" "$SR" 2>&1)
+    if printf '%s' "$SC_OUT" | grep -qE '①-f push-zone: '; then
+      echo "  ✅ ①-f prints advisory-prefixed push_zone_check.sh output when both files exist"
+      PASSED=$((PASSED+1))
+    else
+      echo "  ❌ ①-f did not print the expected advisory prefix"; FAILED=$((FAILED+1))
+    fi
+    # RESIDENCY (codex #9, 2026-09-05): the enumerator prints owner-account names, and a close's
+    # output lands in transcripts and session cards. ①-f therefore prints COUNTS only — the decoy
+    # list entry must never appear, and the summary line must.
+    if printf '%s' "$SC_OUT" | grep -qF 'acme-shared-org'; then
+      echo "  ❌ ①-f leaked an owner-account list entry into the close output"; FAILED=$((FAILED+1))
+    else
+      echo "  ✅ ①-f withholds owner-account names (counts only)"; PASSED=$((PASSED+1))
+    fi
+    if printf '%s' "$SC_OUT" | grep -qE '①-f push-zone: [0-9]+ repo\(s\) enumerated'; then
+      echo "  ✅ ①-f prints the enumeration summary (repo count · outside-list count)"; PASSED=$((PASSED+1))
+    else
+      echo "  ❌ ①-f summary line missing"; FAILED=$((FAILED+1))
+    fi
+  else
+    echo "  ❌ Z-SC setup — fixture push_zone_check.sh not executable"; FAILED=$((FAILED+1))
+  fi
+
+  # Owner-account list absent → UNCALIBRATED, one line, never silent.
+  SC_OUT2=$(PUSH_ZONE_OWNERS="$SR/no-such-owners-file" bash "$SCC_SRC" "$SR" 2>&1)
+  if printf '%s' "$SC_OUT2" | grep -qE '①-f push-zone UNCALIBRATED'; then
+    echo "  ✅ ①-f UNCALIBRATED when the owner-account list is absent"; PASSED=$((PASSED+1))
+  else
+    echo "  ❌ ①-f did not report UNCALIBRATED with no owner-account list"; FAILED=$((FAILED+1))
+  fi
+  rm -rf "$SR"
+fi
+
+echo ""
+echo "[push-zone] $PASSED passed, $FAILED failed"
+[ "$FAILED" -eq 0 ]

package/scripts/test_residency_closure_lanes.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# residency_closure_scan.py 레인 테스트 — known-pair 교정.
+#
+# 이 파일이 있는 이유: 초판이 cross-family 적대검증(gpt-5.5, 2026-08-09)에서 **false-CLEAN
+# 다수**로 반증됐다. 아래 L1~L3 은 그때 재현한 실제 우회 경로이고, 되돌리면 이 레인들이
+# 적색이 된다. 「고쳤다」를 주장으로 두지 않고 실행으로 남긴다.
+#
+# 각 레인 = (입력, 기대 rc). rc 계약: 0=CLEAN(스크리닝) · 1=TAINTED · 10=HARNESS(fail-closed)
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SCAN="$HERE/residency_closure_scan.py"
+TMP=$(mktemp -d) || exit 10
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+lane() { # lane <이름> <기대rc> <모듈> [패턴파일]
+  local name=$1 want=$2 mod=$3 pat=${4:-$TMP/pat}
+  RESIDENCY_PATTERNS="$pat" python3 "$SCAN" --repo "$TMP/repo" "$mod" >/dev/null 2>&1
+  local got=$?
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); printf '  ✅ %-42s rc=%s\n' "$name" "$got"
+  else FAIL=$((FAIL+1)); printf '  ❌ %-42s rc=%s (기대 %s)\n' "$name" "$got" "$want"; fi
+}
+
+R="$TMP/repo"
+mkdir -p "$R"/{src/pkg,myapp,app,clean,deep/sub}
+: > "$R/src/pkg/__init__.py"; : > "$R/app/__init__.py"; : > "$R/deep/__init__.py"
+: > "$R/deep/sub/__init__.py"
+
+# L1 상대 임포트 — 초판이 `level == 0` 으로 통째로 버렸다
+printf 'from .secrets import HOST\n' > "$R/src/pkg/main.py"
+printf 'HOST = "api.acme.corp"\n'    > "$R/src/pkg/secrets.py"
+# L2 루트 화이트리스트 밖 레이아웃 — 초판은 ("src","scripts",…) 만 따라갔다
+printf 'import myapp.config\n'    > "$R/myapp/main.py"
+printf 'HOST = "api.acme.corp"\n' > "$R/myapp/config.py"
+# L3 `from pkg import sub` — 초판은 pkg/__init__.py 만 훑었다
+printf 'from app import secrets\n' > "$R/app/main.py"
+printf 'HOST = "api.acme.corp"\n'  > "$R/app/secrets.py"
+# L4 부모 패키지 __init__.py 오염 — payload 에 같이 나간다
+printf 'HOST = "api.acme.corp"\n' > "$R/deep/__init__.py"
+printf 'X = 1\n'                  > "$R/deep/sub/leaf.py"
+# 과교정 컨트롤 — 진짜 깨끗한 모듈
+printf 'X = 1\n' > "$R/clean/ok.py"
+
+printf 'acme\n' > "$TMP/pat"
+: > "$TMP/pat_empty"
+printf '# 주석뿐\n' > "$TMP/pat_comment"
+
+echo "== residency 폐포 스캔 레인 =="
+lane "L1 상대 임포트 → TAINTED"          1  src.pkg.main
+lane "L2 루트 화이트리스트 밖 → TAINTED"  1  myapp.main
+lane "L3 from pkg import sub → TAINTED"  1  app.main
+lane "L4 부모 __init__ 오염 → TAINTED"    1  deep.sub.leaf
+lane "★컨트롤: 깨끗한 모듈 → CLEAN"       0  clean.ok
+lane "빈 운영자 패턴 → HARNESS"           10 clean.ok "$TMP/pat_empty"
+lane "주석뿐 운영자 패턴 → HARNESS"        10 clean.ok "$TMP/pat_comment"
+lane "운영자 패턴 부재 → HARNESS"          10 clean.ok "$TMP/nonexistent"
+lane "모듈 부재 → HARNESS"                10 no.such.module
+
+# --files 모드: 실제 송신 목록만 잰다
+RESIDENCY_PATTERNS="$TMP/pat" python3 "$SCAN" --repo "$R" --files src/pkg/secrets.py >/dev/null 2>&1
+[ $? = 1 ] && { PASS=$((PASS+1)); echo "  ✅ --files 오염 파일 → TAINTED             rc=1"; } \
+           || { FAIL=$((FAIL+1)); echo "  ❌ --files 오염 파일"; }
+RESIDENCY_PATTERNS="$TMP/pat" python3 "$SCAN" --repo "$R" --files clean/ok.py >/dev/null 2>&1
+[ $? = 0 ] && { PASS=$((PASS+1)); echo "  ✅ --files 깨끗한 파일 → CLEAN             rc=0"; } \
+           || { FAIL=$((FAIL+1)); echo "  ❌ --files 깨끗한 파일"; }
+
+echo "── PASS $PASS · FAIL $FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_sim_isolated_run_lanes.sh

@@ -56,6 +56,10 @@ case "${FH_STUB_MODE:-say}" in
   # 🟥 stdin 을 그대로 받아 적는다 — 실물 `claude -p` 가 하는 짓을 재현한다.
   #    진짜 CLI 는 stdin 이 TTY 가 아니면 그것을 «읽어 프롬프트 뒤에 붙인다».
   stdin)    echo "stub answer"; cat >> "${FH_STUB_STDIN_LOG:-/dev/null}" ;;
+  # L26 (2026-09-05) — a command that runs long past any sane --timeout, default SIGTERM
+  # disposition (no trap): dies as soon as the watchdog signals it, so a lane can tell "the
+  # deadline was enforced" from "we just waited for it to finish on its own".
+  hang)     sleep 30 ;;
 esac
 exit 0
 STUB
@@ -278,5 +282,120 @@ else
   no "L25 meta.tsv not written at all ($META)"
 fi
 
+# ── L26 timeout(1) resolution (2026-09-05) — the launchd-PATH incident this exists for ──────────
+#    WHY: launchd's PATH ($HOME/.local/bin:/usr/local/bin:/usr/bin:/bin, per this repo's own plist
+#    templates prior to this patch) has neither `timeout` nor `gtimeout` on it — both live under
+#    Homebrew's prefix. The first real launchd live-eval run (2026-09-05 02:30) hit exactly this:
+#    every rep of every arm died at `timeout: command not found` and the run scored 12/12
+#    FAILED-TO-RUN with no clue why. This lane shadows whichever CURRENT PATH dir(s) actually hold
+#    `timeout`/`gtimeout` (symlinks to everything else in them) — computed, not hardcoded to
+#    /opt/homebrew/bin, so the same lane works on Intel, Homebrew or a Linux /usr/bin — and proves
+#    two things a prose comment cannot: the bash-native fallback
+#    actually answers (not just "doesn't crash"), and it actually enforces the deadline rather than
+#    silently never firing.
+_shadow_timeout_dirs() {  # prints $PATH with every dir holding timeout/gtimeout replaced by a symlink shadow of it MINUS those two
+  # 🟥 Measured 2026-09-05 on CI (ubuntu): `timeout` lives in /usr/bin next to bash and git, so
+  # DROPPING that directory (the previous form of this fixture) also dropped bash/git, and the
+  # potency check below scored the lane red on every Linux box while macOS (Homebrew prefix,
+  # separate dir) stayed green. A shadow directory keeps every other name resolvable and removes
+  # only the two — the same fixture on both layouts.
+  local IFS=':' d out="" shadow n=0 f b
+  for d in $PATH; do
+    if [ -x "$d/timeout" ] || [ -x "$d/gtimeout" ]; then
+      n=$((n+1)); shadow="$WORKROOT/notimeout_shadow_$n"; rm -rf "$shadow"; mkdir -p "$shadow"
+      for f in "$d"/*; do
+        [ -x "$f" ] && [ ! -d "$f" ] || continue
+        b="${f##*/}"
+        case "$b" in timeout|gtimeout) continue ;; esac
+        ln -s "$f" "$shadow/$b"
+      done
+      d="$shadow"
+    fi
+    out="${out:+$out:}$d"
+  done
+  printf '%s' "$out"
+}
+NOTIMEOUT_PATH="$(_shadow_timeout_dirs)"
+
+echo ""
+echo "── L26 timeout(1) resolution ───────────────────────────────────────"
+
+# Fixture-potency check FIRST — a stripped PATH that still resolves timeout/gtimeout proves
+# nothing ([[feedback_fixture_must_use_the_breaking_spelling]]), and a strip that ALSO removed
+# bash/git would confound every assertion below with an unrelated clone failure. Both are named
+# distinctly rather than let a downstream lane fail for the wrong reason. Per this file's own
+# convention (see L24's "검사 못 함(스킵 아님)"), an unusable fixture on this machine is scored
+# as a failure, not silently skipped — it is loud precisely because CI does not gate this file
+# (verified: no .github/workflows/*.yml references it), so a quiet skip would never be noticed.
+if PATH="$NOTIMEOUT_PATH" command -v timeout >/dev/null 2>&1 || PATH="$NOTIMEOUT_PATH" command -v gtimeout >/dev/null 2>&1; then
+  no "L26-FIXTURE stripped PATH still resolves timeout/gtimeout — cannot run L26 on this machine"
+elif ! PATH="$NOTIMEOUT_PATH" command -v bash >/dev/null 2>&1 || ! PATH="$NOTIMEOUT_PATH" command -v git >/dev/null 2>&1; then
+  no "L26-FIXTURE stripping timeout/gtimeout also removed bash or git — cannot run L26 on this machine"
+else
+  ok "L26-FIXTURE stripped PATH lacks timeout+gtimeout; bash/git still resolve"
+
+  # L26a — no timeout/gtimeout at all: the runner must still answer (via the bash fallback) and
+  # must NAME which control it used in its own header, rather than leaving that to be inferred.
+  OUTDIR="$WORKROOT/o26a"
+  OUT=$( cd "$SRC" && PATH="$STUBBIN:$NOTIMEOUT_PATH" HOME="$FAKEHOME" FH_STUB_MODE=say \
+     bash "$SUT" --arm a --reps 1 --prompt p --out "$OUTDIR" 2>&1 )
+  if printf '%s' "$OUT" | grep -q "timeout_tool=bash-fallback" && printf '%s' "$OUT" | grep -q "captured"; then
+    ok "L26a no timeout/gtimeout on PATH -> bash-fallback answers and names itself in the header"
+  else
+    no "L26a bash-fallback did not fire/name itself: $(printf '%s' "$OUT" | grep -E 'timeout_tool|captured|UNMEASURED|EMPTY' | head -3 | tr '\n' ';')"
+  fi
+
+  # L26b — the fallback must actually ENFORCE the deadline, not just silently never fire. A stub
+  # that would otherwise run 30s under --timeout 2 must come back UNMEASURED well under 30s.
+  OUTDIR="$WORKROOT/o26b"
+  _t0=$(date +%s)
+  OUT=$( cd "$SRC" && PATH="$STUBBIN:$NOTIMEOUT_PATH" HOME="$FAKEHOME" FH_STUB_MODE=hang \
+     bash "$SUT" --arm a --reps 1 --prompt p --timeout 2 --out "$OUTDIR" 2>&1 )
+  _t1=$(date +%s); _elapsed=$(( _t1 - _t0 ))
+  if printf '%s' "$OUT" | grep -q "UNMEASURED" && [ "$_elapsed" -le 10 ]; then
+    ok "L26b bash-fallback enforces the deadline (UNMEASURED in ${_elapsed}s of a 30s hang, timeout=2s)"
+  else
+    no "L26b fallback did not enforce the timeout (elapsed=${_elapsed}s): $(printf '%s' "$OUT" | grep -E 'UNMEASURED|captured' | head -1)"
+  fi
+
+  # L26c control — SAME hang stub, DEFAULT (unstripped) PATH: real timeout/gtimeout must still be
+  # preferred over the fallback (header says gnu/gtimeout, not bash-fallback), AND must enforce
+  # the same deadline. Without this, L26a/L26b could be passing because the fallback is used
+  # unconditionally, not because resolution correctly prefers the real tool when it is present
+  # ([[feedback_control_presence_is_not_discrimination]]).
+  OUTDIR="$WORKROOT/o26c"
+  OUT=$( cd "$SRC" && PATH="$STUBBIN:$PATH" HOME="$FAKEHOME" FH_STUB_MODE=hang \
+     bash "$SUT" --arm a --reps 1 --prompt p --timeout 2 --out "$OUTDIR" 2>&1 )
+  case "$OUT" in
+    *"timeout_tool=bash-fallback"*)
+      no "L26c control — default PATH used bash-fallback instead of a real timeout/gtimeout" ;;
+    *"timeout_tool=gnu"*|*"timeout_tool=gtimeout"*)
+      printf '%s' "$OUT" | grep -q "UNMEASURED" \
+        && ok "L26c control — default PATH prefers the real timeout tool and still enforces the deadline" \
+        || no "L26c control — real timeout tool resolved but did not enforce the deadline"
+      ;;
+    *) no "L26c control — no timeout_tool= line in header at all: $(printf '%s' "$OUT" | grep timeout_tool)" ;;
+  esac
+fi
+
+# ── L27 MCP isolation (2026-09-05) — the QP chamber floor sim saw the operator's user-scope MCP servers ─
+#    in a headless arm's tool list. The runner must pass --strict-mcp-config ALWAYS (no --mcp-config ⇒
+#    no servers), and pass through --mcp-config only when the caller names a file. Both directions.
+OUTDIR="$WORKROOT/o27"; LOG="$WORKROOT/argv27.log"; : > "$LOG"
+( cd "$SRC" && PATH="$STUBBIN:$PATH" HOME="$FAKEHOME" FH_STUB_MODE=say FH_STUB_ARGV_LOG="$LOG" \
+   bash "$SUT" --arm a --reps 1 --prompt p --out "$OUTDIR" ) >/dev/null 2>&1
+grep -q -- "--strict-mcp-config" "$LOG" \
+  && ok "L27a default passes --strict-mcp-config (user-scope MCP cannot reach a blind arm)" \
+  || no "L27a default did NOT pass --strict-mcp-config — operator MCP servers leak into headless arms"
+grep -q -- "--mcp-config" "$LOG" \
+  && no "L27b default passed --mcp-config without a file (would point at nothing)" \
+  || ok "L27b default passes no --mcp-config (strict + none = no servers)"
+OUTDIR="$WORKROOT/o27c"; LOG2="$WORKROOT/argv27c.log"; : > "$LOG2"; printf '{"mcpServers":{}}\n' > "$WORKROOT/mcp27.json"
+( cd "$SRC" && PATH="$STUBBIN:$PATH" HOME="$FAKEHOME" FH_STUB_MODE=say FH_STUB_ARGV_LOG="$LOG2" \
+   bash "$SUT" --arm a --reps 1 --prompt p --mcp-config "$WORKROOT/mcp27.json" --out "$OUTDIR" ) >/dev/null 2>&1
+grep -q -- "--mcp-config $WORKROOT/mcp27.json" "$LOG2" && grep -q -- "--strict-mcp-config" "$LOG2" \
+  && ok "L27c --mcp-config <file> reaches the CLI together with --strict-mcp-config (explicit allow, still strict)" \
+  || no "L27c --mcp-config not plumbed (or strict dropped when a file is given)"
+
 echo "sim_isolated_run lanes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1