@chrono-meta/fh-gate 3.0.0 → 3.1.1

package/templates/.git-hooks/pre-push

@@ -42,6 +42,97 @@ REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
 [ -z "$REPO_ROOT" ] && { echo "  ❌ pre-push: not in a git repo — fail-closed (block)"; exit 1; }
 ZERO="0000000000000000000000000000000000000000"
 PUSH_REMOTE="${1:-origin}"   # git passes the remote NAME as $1; ranges are scoped to it (see below)
+
+# ── Push zone: a non-owner github.com remote is not a plain-push channel ─────────────────────
+# CLAUDE.local.md §REST API push 계정규칙: a push under a non-owner account goes through the REST
+# Contents API (new files only, never overwrite/delete) — plain `git push` is not that channel.
+# That rule was correctly applied to ONE org repo and missed on ANOTHER org repo in the SAME round
+# (2026-07-26) — not from ignorance, but because it was applied at the point of discovery instead
+# of enumerated across every remote in play (the half-fix / propagation-boundary class).
+# `scripts/push_zone_check.sh` closes the ENUMERATE half by hand, before a push round, and it
+# explicitly does not block. This block closes the other half mechanically: it cannot see the whole
+# round, but it CAN refuse the one push in front of it when THIS push's own remote sits outside the
+# owner list — exactly the "forgot on this one" shape of the 2026-07-26 miss.
+#
+# Degrade direction (Surface-Class Degrade Invariant): applicability is mechanical, never guessed.
+#   • no owner-account list         → UNCALIBRATED, plain push allowed (a guessed verdict could
+#     authorise the wrong channel, which is worse than no verdict at all)
+#   • remote host is not github.com → out of scope for this axis (the account rule is a github.com
+#     personal-account axis; a GHE / other host remote says so and is allowed, not silently risky)
+#   • remote URL does not parse into a known shape → UNMEASURED, allowed (a harness gap, not a
+#     policy decision — NOT the destructive-branch UNCLASSIFIABLE case below, which fails closed
+#     because a delete is irreversible; blocking every unfamiliar remote-URL shape here would just
+#     train --no-verify on this same hook's real, irreversible guards)
+#   • owner ∈ list → silent (the common, expected case)
+#   • owner ∉ list → BLOCK. Never prints the owner list itself — only the single non-matching
+#     owner already public in the URL being pushed to.
+#
+# Override (explicit, logged — same shape as DESTRUCTIVE_OP_OK / PUBLIC_SURFACE_OK):
+#   PUSH_ZONE_OK=1 git push …
+PUSH_ZONE_SRC="${PUSH_ZONE_OWNERS:-$REPO_ROOT/.claude/rules/.push-zone-owners}"
+if [ ! -f "$PUSH_ZONE_SRC" ]; then
+  echo "  ⏭️  push-zone: UNCALIBRATED — no owner-account list at $PUSH_ZONE_SRC, plain push allowed"
+else
+  # One owner per line. Inline comments (`owner # note`), CR line endings, surrounding whitespace and a
+  # trailing slash are stripped BEFORE tokenizing — cross-family (codex gpt-5.5, 2026-09-05) showed an
+  # inline-comment word being read as an ALLOWED owner (fail-open) and a CRLF list blocking its own owner.
+  _pz_owners="$(sed -e 's/#.*$//' -e 's/\r$//' -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' -e 's#/*$##' "$PUSH_ZONE_SRC" 2>/dev/null | grep -v '^$' | tr '[:upper:]' '[:lower:]')"
+  _pz_url="${2:-}"
+  # git passes the destination's URL as $2. A bare remote NAME (no ':' and no '/') means the URL was
+  # not resolved for us (alias / insteadOf edge) — resolve it here rather than reading a name as a host
+  # and quietly landing in the "not github.com" allow branch (codex #5).
+  case "$_pz_url" in
+    *:*|*/*|"") ;;
+    *) _pz_url="$(git remote get-url --push "$_pz_url" 2>/dev/null || printf '%s' "$_pz_url")" ;;
+  esac
+  if [ -z "$_pz_url" ]; then
+    echo "  ⏭️  push-zone: UNMEASURED — remote URL not supplied to the hook (\$2 empty), plain push allowed"
+  else
+    # Normalise before parsing: lowercase, trim, drop the scheme, drop userinfo (`user@`). The HOST is then
+    # everything up to the first ':' or '/'. This accepts every github.com shape git itself accepts —
+    # `https://user@github.com/o/r`, `https://github.com:443/o/r`, `git@github.com:o/r`, `git@github.com:/o/r`,
+    # `ssh://git@github.com:22/o/r` — instead of an allowlist of three literal prefixes that read the rest as
+    # "unrecognized → allow" (codex #1–#4: four real github.com shapes were failing OPEN).
+    _pz_url_lc="$(printf '%s' "$_pz_url" | tr '[:upper:]' '[:lower:]' | sed -e 's/[[:space:]]*$//' -e 's/^[[:space:]]*//')"
+    _pz_norm="$(printf '%s' "$_pz_url_lc" | sed -E 's#^[a-z][a-z0-9+.-]*://##; s#^[^@/]*@##')"
+    _pz_host="$(printf '%s' "$_pz_norm" | sed -E 's#[:/].*$##')"
+    if [ "$_pz_host" = "github.com" ]; then
+      _pz_path="$(printf '%s' "$_pz_norm" | sed -E 's#^github\.com(:[0-9]+)?[:/]+##')"
+      _pz_owner="${_pz_path%%/*}"
+      if [ -z "$_pz_owner" ] || [ "$_pz_path" = "$_pz_norm" ]; then
+        echo "  ⏭️  push-zone: UNMEASURED — github.com remote in an unrecognized URL shape, plain push allowed"
+      else
+        _pz_hit=0
+        for _pz_o in $_pz_owners; do
+          [ "$_pz_owner" = "$_pz_o" ] && { _pz_hit=1; break; }
+        done
+        if [ "$_pz_hit" -eq 0 ]; then
+          echo ""
+          echo "══════════════════════════════════════════════"
+          echo " ⛔ FH Push-Zone Gate — remote is outside the owner-account list"
+          echo "══════════════════════════════════════════════"
+          echo "  remote '$PUSH_REMOTE' → github.com/$_pz_owner"
+          echo "  Plain git push is not this remote's channel — CLAUDE.local.md §REST API push"
+          echo "  계정규칙 (a non-owner account pushes via the REST Contents API instead)."
+          echo "  Deliberate exception (explicit, logged):  PUSH_ZONE_OK=1 git push …"
+          echo "══════════════════════════════════════════════"
+          if [ "${PUSH_ZONE_OK:-0}" = "1" ]; then
+            echo "  ⚠️  FH Push-Zone: allowed by PUSH_ZONE_OK=1 (conscious, gated intent)"
+            mkdir -p "$REPO_ROOT/tracks/_meta" 2>/dev/null || true
+            printf '%s PUSH_ZONE_OK override — remote:%s owner:%s\n' \
+              "$(date +%Y-%m-%dT%H:%M:%S)" "$PUSH_REMOTE" "$_pz_owner" \
+              >> "$REPO_ROOT/tracks/_meta/.push_zone_override_log" 2>/dev/null || true
+          else
+            exit 1
+          fi
+        fi
+      fi
+    else
+      echo "  ⏭️  push-zone: remote host is not github.com — outside this axis's scope, plain push allowed"
+    fi
+  fi
+fi
+
 BASE="${FH_DESTRUCTIVE_BASE:-origin/main}"
 # All ancestry/reachability checks below must ignore local `git replace`/graft objects — a graft can
 # falsify merge-base/rev-list/ls-tree to make a divergent force look fast-forward or an unmerged branch

package/templates/RED_TEAM_REPORT.md

@@ -0,0 +1,49 @@
+# Red-team report — ISO/IEC 42119-7 형 (템플릿, 2026-09-05)
+
+> **쓰는 자리**: cross-family 적대 리뷰(`auto-decorrelation` Step 4~6) · `/steel-quench` Wave-1 · challenger 디스패치의 **산출을 담는 형식**.
+> 새 검사가 아니라 **이미 하는 것의 보고 형식**이다 — 개발 중인 ISO/IEC AWI TS 42119-7(AI 레드티밍)의 **공개 스코프가 다루는 주제**
+> (용어 · 위험 식별 · 적용 범위 · 목표/공격 벡터 · 계획/실행 방법 · 문서/보고 · 수명주기 통합 — 🟥 규범 «요구사항」은 미공개, 이건 «다루는 주제」다)
+> 를 우리 산출이 이미 갖고 있으니 **이름표만 맞춘다**. §4 의 «처분」은 이 레포의 로컬 프로세스이지 표준 스코프 항목이 아니다.
+> 정본 crosswalk: `knowledge/shared/harness-core/iso_ai_standards_crosswalk.md §2` (42119-7 행).
+>
+> 🟥 이 형식은 «잘 했다」를 증명하지 않는다. 채널이다 — 칸이 비어 있으면 안 돌린 것이고, 채워져 있어도 진위는 마커/PR 의 그라운딩이 진다.
+
+```
+# RED-TEAM REPORT — <대상 한 줄>            date: YYYY-MM-DD   trigger: <4축 마커 트리거 / load-bearing gate / chamber / 요청>
+
+## 0. 적용 범위와 용어 (applicability · terms)
+대상      : <어느 AI 시스템/하네스의 어느 표면 — 코드·프롬프트·게이트·설정>
+적용 범위 : <이 평가가 «보는」 것과 «안 보는」 것 한 줄씩>
+용어      : <이 보고에서 S/A/B 가 뜻하는 것 · «fail-open」 등 국소 용어의 정의>
+
+## 1. 위험 식별 (what could go wrong — 42119-7 "identification of risks")
+표면      : <가역 / 비가역(publish·delete·history) / 소비자 가시>
+실패 모드 : <이 변경이 틀렸다면 관측될 것 — 마커 defeater: 와 같은 문장>
+AI 특성   : <비결정성 · 데이터 의존 · 적응성 · 불투명성 · 자율성 중 해당 — 없으면 «없음»>
+
+## 2. 목표와 공격 벡터 (objectives & attack vectors)
+목표      : S = <fail-open / 유출 / 차단 회피 … 이 대상에서 S 의 정의>  A = <과차단 / 오탐 / …>  B = 유지보수
+공격 벡터 : <레지스트리 인용 — steel-quench Wave-1 각도 #n · 또는 프롬프트의 "attack specifically (1)…(n)" 목록 그대로>
+
+## 3. 방법 (methodology — 29119 프로세스 정렬)
+리뷰어    : <계열(codex/gemini/…) · 입장(cold / target-repo tier1b·tier2·tier2b·tier3) · 받은 것(diff만 / diff+주장 / 실행 출력)>
+격리      : <리뷰어가 저자 추론을 봤나 — 안 봤다 / 봤다(사유)>
+실행      : <리뷰어가 무엇을 실행했나 — 명령과 출력, 없으면 «정적»>
+residency : <residency=CLEAN(files=n, stripped=m) — 스트립한 파일은 리뷰어에게 이름으로 알렸나>
+
+## 4. 발견 (findings — 재현 입력을 반드시 함께) + 처분(로컬 프로세스)
+| # | 심각도 | 위치(file:line) | 재현 입력 | 왜 | 처분(수리 / 반박 / 잔여) | 앵커(레인 id · fail-before) |
+|---|---|---|---|---|---|---|
+
+수리 n · 반박 n(각각 근거 한 줄) · 잔여 n(이름으로)
+
+## 5. 수명주기 통합 (integration into the AI system life cycle)
+어느 게이트에서 돌았나 : <pre-commit 4축 / Field-Harness Load-Bearing Change Gate / chamber SCREEN / 릴리스 전>
+재실행 조건            : <이 표면이 다시 바뀌면 / 모델·계열이 바뀌면 / N 세션 뒤>
+기록 위치              : <마커 crossfamily: · PR 본문 · fh_signal_*>
+```
+
+**채우는 규칙**
+- §4 의 «재현 입력」 이 빈 발견은 발견이 아니라 의견이다 — 그 행은 처분 «반박」으로 가거나 지운다.
+- «반박」은 근거 한 줄이 있어야 한다(실측이면 실측을, 계약이면 계약 문장을).
+- 이 보고는 **마커를 대체하지 않는다**. 마커 `crossfamily:` 한 줄이 이 보고의 요약이고, 보고는 그 줄의 전개다.

package/templates/settings.PreToolUse.snippet.json

@@ -71,7 +71,61 @@
     "strings does not fire. Bash path (sed -i / > / tee into a .sh) covered with a weaker rule (named",
     "residual in the script header). Evidence row in .claude/.proposal_hook_events.tsv. Relaying an",
     "injected instruction is not initiative — see the r4 RESULT for what this does and does not claim.",
-    "  bash scripts/test_proposal_hook_lanes.sh                # expect: all known pairs hold (count self-reported)"
+    "  bash scripts/test_proposal_hook_lanes.sh                # expect: all known pairs hold (count self-reported)",
+    "",
+    "SIXTH GUARD, WebSearch|WebFetch matcher — outbound_query_hook.sh (added 2026-09-05):",
+    "the FIRST hook here that can emit permissionDecision:\"deny\", so read its degrade direction before",
+    "wiring it. WHAT IT GUARDS: a WebSearch/WebFetch query is an OUTBOUND, IRREVERSIBLE act — if the",
+    "string names an internal asset, the query IS the leak (CLAUDE.md §Field-Harness Diagnostic: internal",
+    "names never reach a log, a comment or a paste). scripts/outbound_query_guard.sh has owned that lint",
+    "since 2026-08-21 with ZERO callers, and its own header says so; this is its wiring. A repo scanner",
+    "cannot see an interactively-composed query, so the guard belongs on the call — same reasoning as",
+    "pipe_verdict_guard's.",
+    "",
+    "TWO LAYERS, AND ONLY ONE OF THEM DENIES. The CLI guard fail-closes when the operator's gitignored",
+    "override layer is absent. Correct for a CLI you type; wrong for a hook, because in a consumer",
+    "install that layer is absent BY CONSTRUCTION — importing that contract would deny every consumer's",
+    "WebSearch, and the bypass it would train is turning hooks off, disarming the destructive-op and",
+    "confidentiality guards riding the same channel. So:",
+    "    override-layer hit   -> deny      (the operator's own internal literals)",
+    "    defaults-layer hit   -> advisory  (universal shapes; FP-prone, and all a consumer has)",
+    "    no override present  -> advisory + a once-per-session UNCALIBRATED notice (a defaults-only scan",
+    "                           cannot say \"no internal tokens\", only \"no universal shapes\")",
+    "    instrument incomplete-> deny      (NOT SCANNED is not clean; irreversible surface fails CLOSED)",
+    "    not an FH checkout   -> silent    (mechanical test: is the tracked defaults file here?)",
+    "    hook command absent  -> the tool RUNS. A PreToolUse command that cannot be found is a non-blocking",
+    "                           error, so on a consumer install where scripts/outbound_query_hook.sh is not at",
+    "                           $CLAUDE_PROJECT_DIR/scripts/ the deny you think you wired is fail-OPEN (cross-family",
+    "                           review, 2026-09-05). Same contract as the five guards above, but this one denies,",
+    "                           so VERIFY after wiring:  echo '{}' | bash \"$CLAUDE_PROJECT_DIR/scripts/outbound_query_hook.sh\"; echo rc=$?",
+    "                           rc=0 and no output = resolved and silent on an empty payload; 'No such file' = not wired.",
+    "The layer is decided by comparing hit COUNTS across two scans (full set, then defaults-only). A",
+    "boolean would collapse \"both layers hit\" into \"defaults hit\" and silently downgrade a real deny.",
+    "",
+    "🟥 THE OUTPUT NEVER CARRIES THE TOKEN VALUE — only the count and the severity label. A leak guard",
+    "that echoes the token into its own deny reason or log is the leak channel. Lane H10 asserts the",
+    "fixture token appears on no output surface (stdout, stderr, event log).",
+    "",
+    "Opt out on one call by putting `# noqa: outbound` in the query. That channel is gameable, which is",
+    "exactly why it writes a log row — an invisible bypass is worse than a recorded one. Evidence rows in",
+    ".claude/.outbound_hook_events.tsv: ts, tool, verdict(deny|advisory|clean|noqa|na), layer, and the",
+    "tool_input KEY NAMES (schema, never content) — the official hooks reference does not document",
+    "WebSearch/WebFetch tool_input keys, so the hook scans every string value rather than hardcoding a",
+    "key name that would fail SILENTLY OPEN, and logs the observed shape so it becomes measured.",
+    "",
+    "🟥 ADD THESE TWO TO YOUR .gitignore WHEN YOU WIRE THIS — the hook writes them on every matched",
+    "call and they are not tracked content:",
+    "    .claude/.outbound_hook_events.tsv",
+    "    .claude/.outbound_hook_uncalibrated_notice",
+    "Missed on the first build; a clean-clone run flagged both as tree contamination, which is also",
+    "what a consumer's `git status` would have shown after their first WebSearch.",
+    "",
+    "Verify after wiring (known pair, both directions):",
+    "  bash scripts/test_outbound_query_hook_lanes.sh       # expect: all known pairs hold (count self-reported)",
+    "  printf '%s' '{\"tool_name\":\"WebSearch\",\"tool_input\":{\"query\":\"bash printf portability\"}}' \\",
+    "    | bash scripts/outbound_query_hook.sh              # expect: NO output (a clean query is silent)",
+    "  bash scripts/test_outbound_query_lanes.sh            # the CLI twin, for outbound paths this hook",
+    "                                                       # does NOT cover (curl / external CLIs via Bash)"
   ],
   "project_settings_json": {
     "hooks": {
@@ -115,6 +169,16 @@
               "timeout": 5
             }
           ]
+        },
+        {
+          "matcher": "WebSearch|WebFetch",
+          "hooks": [
+            {
+              "type": "command",
+              "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/outbound_query_hook.sh\"",
+              "timeout": 5
+            }
+          ]
         }
       ]
     }