@chrono-meta/fh-gate 3.0.0 → 3.1.1

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -193,6 +193,63 @@ diversity vs the orchestrator** (orchestrator = Claude/opus → recruit GPT or G
     succeeded where reading-files-itself hung) — or degrade to single-session with a recorded note.
   This is the sidecar twin of `mcp-circuit-breaker` (stop a stuck external call instead of hanging on it).
 
+## Step 4.5 — Residency screen (mandatory, immediately before ANY external-family send)
+
+**Every** payload this skill sends outward — the diff, the marker (Step 5's payload), the prompt
+text itself — crosses a family boundary the moment a codex/agy/gemini sidecar is recruited.
+"Sanitize before external-family dispatch" used to be a prose reminder with no consumer reading it
+back (`[[feedback_half_externalization_slot_without_consumer]]` shape — a slot that exists but
+nothing downstream checks). This step makes it mechanical:
+
+```bash
+python3 scripts/residency_closure_scan.py --files src/a.py docs/b.md   # every file you are about to send, as separate args (zsh: ${=var}, never an unquoted "$var")
+```
+
+`--files` (not the default closure-walk) because what matters is **what you are actually
+sending**, not this skill's own dependency graph. Read the exit code, not the words:
+
+| Exit | Meaning | What to do |
+|---|---|---|
+| 0 | CLEAN — no organizational identifier found **within the scanner's own stated limits** (see its header — this is a screening result, not a safety guarantee) | Send. Record `residency=CLEAN(files=N)` in the crossfamily grounds (Step 6). |
+| 1 | TAINTED — at least one payload file matched a residency pattern | Do not send as-is. Either strip/redact the tainted file(s) from the payload and re-scan, or route to an in-boundary panel member. If it truly cannot be cleaned, record `residency=TAINTED(N files, stripped=no)` and do NOT dispatch — the crossfamily value becomes a `DEGRADED_*` rung, never `panel(...)`. |
+| 10 | HARNESS_ERROR — the scan itself could not run (commonly: no operator-private `.claude/rules/.residency-patterns` override on this machine — the shipped `.defaults` file alone is deliberately insufficient to claim CLEAN, per the scanner's own header) | Do not send. Record `residency=NOT_SCANNED(<reason>)` — same as exit 1's outcome (no dispatch), different reason (*could not screen* vs *screened and found something*). |
+
+🟥 **On a fresh install with no operator pattern file, this WILL be exit 10 every time** — that is
+the scanner's own documented fail-closed default (`residency_closure_scan.py`'s header: "오버라이드
+파일이 없으면 exit 10 이다"), not a bug introduced here. It means: until an operator configures
+their own residency patterns, this skill cannot claim a panel dispatch was screened, so it honestly
+degrades to a `DEGRADED_*` rung with `residency=NOT_SCANNED(...)` instead of silently sending. That
+is not a new block on fresh installs — the crossfamily field already tolerates `DEGRADED_*` without
+hard-failing the commit; it is one more honest reason to be in that state, not a novel one.
+
+**Where the result lands**: `templates/.git-hooks/pre-commit`'s `validate_crossfamily_leg` now
+requires a `residency=CLEAN(...)` token inside the grounds of any `panel(...)` value (grace date
+`RESIDENCY_TOKEN_GRACE_DATE`, no retroactivity on markers dated earlier), and accepts an optional,
+format-checked `residency=(CLEAN|TAINTED|NOT_SCANNED)(...)` token on `DEGRADED_*`/`UNKNOWN`/
+`declined`. Fixtures: `scripts/test_marker_crossfamily_lanes.sh` (`r1`–`r13`). This is the SAME
+typed field Step 6 already emits into — one channel, not a second marker line.
+
+🟥 **A stripped file is invisible to the reviewer, and a reviewer's default read of invisible is
+"absent," not "redacted"** (governor dogfood, 2026-09-05, same-day live use of this Step): two
+TAINTED files were stripped from a real payload and the CLEAN remainder sent cross-family — the
+reviewer came back with a false-positive S-finding, *"runner wiring is missing,"* because the
+wiring actually lived in one of the two files that had just been stripped. Stripping fixes
+residency; it does nothing about the reviewer's next inference, and silence there reads as a hole.
+**So**: whenever a payload is sent with `stripped > 0`, the review PROMPT itself must name the
+omission explicitly — the list of what was left out, and one line per file on what it is
+responsible for (not its content, just its role) — so the reviewer can discount that surface
+instead of flagging it as missing. Record whether this was done: when the token carries
+`stripped=M` with `M > 0`, the same grounds line adds one phrase on whether the omission list
+reached the review prompt, e.g. `residency=CLEAN(files=3, stripped=2) · omission-list: given to
+reviewer`. This is evidence-of-doing, not proof — same shape as Step 5's "quote one marker line it
+checked," and it does not become a new hard-blocking hook check (channel discipline stays a
+grounds phrase here, per the same Mechanization Boundary this whole field already respects).
+
+⚠️ **Scope, same as everywhere else in this file**: CLEAN is a screening result, not a safety
+guarantee (dynamic imports, non-Python artifacts, encoding tricks, and TOCTOU are named, unclosed
+gaps in the scanner's own header). Recording `residency=CLEAN(...)` asserts the scan ran and found
+nothing **within those limits** — it does not assert the payload is safe in some absolute sense.
+
 ## Step 5 — Role split + source-grounded acceptance (S-2)
 
 CC = **governor**, terminal verdict, source-closes. Sidecars = decorrelated **challengers** feeding
@@ -202,6 +259,11 @@ re-checks** it against the artifact (phantom-quench back-trace) before accepting
 source-grounded is **dropped, not judged**. No sidecar-only verdict (no weak-local-judge regression).
 Local 4090 = **canary tier** (evidence-of, never terminal verdict).
 
+**Report shape (2026-09-05)**: when the findings are written up (PR body · marker `crossfamily:` expansion · chamber record),
+use `templates/RED_TEAM_REPORT.md` — the five sections mirror ISO/IEC AWI TS 42119-7 (risk identification · objectives & attack
+vectors · method · findings with reproducing input · life-cycle integration). It is a name tag on what this skill already
+produces, not a new check; crosswalk: `knowledge/shared/harness-core/iso_ai_standards_crosswalk.md §2`.
+
 🟥 **What you SEND decides which axis you get — put the MARKER in the payload, not just the diff**
 (2026-08-19). Sidecars have been receiving the *diff* only. That buys a review of the **code** and
 buys nothing on the **record**: the Axes 2+3 marker is self-attested, and this repo has already
@@ -238,8 +300,10 @@ floor-tier sims), which is why it is stated here instead of left to the reader t
 
 ⚠️ **Prose, not a check** — measured recurrence is 2, below this repo's own N≥3 bar
 (`[[feedback_mechanize_at_repetition_prose_before]]`). On the third occurrence, mechanize it here.
-⚠️ **Residency still governs**: a marker can name company assets. Sanitize before any external-family
-dispatch, exactly as with the diff — the marker is not exempt because it is metadata.
+⚠️ **Residency still governs**: a marker can name company assets. Run Step 4.5's screen against the
+marker file too, not just the diff — the marker is not exempt because it is metadata. (This line was
+pure prose until 2026-09-05; Step 4.5 above is what closes it — the scan itself still carries the
+named, unclosed gaps in its own header, so "screened" is not "guaranteed safe".)
 
 *Origin*: sister-asset read of `raphaelchristi/harness-evolver`'s `harness-critic` agent, whose whole
 role is auditing the **evaluator** rather than the artifact. Its detection signatures (score jumps,
@@ -290,6 +354,22 @@ rejected at commit time.
 | — | change is not load-bearing — decorrelation not required | `single-family` | — |
 | — | **panel never probed** | `UNKNOWN` | **required** |
 
+🟥 **Rungs 1–2's `panel(<families>)` additionally require a `residency=CLEAN(...)` token inside the
+same grounds string, since 2026-09-05** (Step 4.5 above; `pre-commit`'s `validate_crossfamily_leg`
+blocks a bare `panel(...)` with no such token on a marker dated on/after
+`RESIDENCY_TOKEN_GRACE_DATE`). Full grammar:
+
+```
+crossfamily: panel(codex) — residency=CLEAN(files=7) · R1..R2, 4 findings
+crossfamily: DEGRADED_SINGLE_FAMILY — residency=TAINTED(2 files, stripped=no) → not sent, probed codex/agy, 0 reachable
+crossfamily: DEGRADED_SINGLE_FAMILY — residency=NOT_SCANNED(no operator pattern file) → not sent, probed codex/agy, 0 reachable
+```
+
+The token is **optional** on `DEGRADED_*`/`UNKNOWN`/`declined` (format-checked only when present —
+those rungs never claimed anything left the boundary, so nothing to require) and **rejected as a
+contradiction** if `panel(...)` carries `residency=TAINTED(` or `residency=NOT_SCANNED(` on the same
+line — a sent payload and an unscreened/tainted one cannot both be true.
+
 **The three degrade values are the load-bearing split**: *could not* (`DEGRADED_SINGLE_FAMILY`) ·
 *did not* (`DEGRADED_PANEL_UNUSED`) · *did not look* (`UNKNOWN`). Free prose merges all three, and
 each merge hides a different thing — an unrun probe renders as a zero finding
@@ -388,6 +468,11 @@ at N per run (no loop).
   is NOT accepted on a load-bearing change — that block only runs there, so "decorrelation not
   required" is a contradiction, and as a no-ack pass it was a free bypass of the lane.
   *[mandatory-pass — enforced by pre-commit, fixtures `scripts/test_marker_crossfamily_lanes.sh`]*
+- Step 4.5's residency screen ran against the actual send list before any `panel(...)` claim, and
+  its result is recorded as a `residency=CLEAN|TAINTED|NOT_SCANNED(...)` token inside the same
+  `crossfamily:` grounds — required when the value is `panel(...)`, format-checked when present on
+  a degrade value. *[mandatory-pass — enforced by pre-commit since RESIDENCY_TOKEN_GRACE_DATE,
+  fixtures `scripts/test_marker_crossfamily_lanes.sh` `r1`–`r13`]*
 - Panel members are review-capable: embedding/reranker/OCR/safeguard classes are excluded **before**
   family-diversity is counted, never after. *[mandatory-pass — same fixtures, ordering anchor c4/c5]*
 - Paid recruit was per-run spend-gated (or `paid_auto` set); free local tier may auto-fire. *[mandatory-pass]*

package/plugins/fh-meta/skills/frontier-digest/SKILL.md

@@ -69,7 +69,7 @@ Collect from five sources (bash per source in §Collection-Bash):
 
 | Source | Method | Cap |
 |---|---|---|
-| HackerNews | Algolia API, score > 10, keyword-relevant | 15 items |
+| HackerNews | Algolia API `search_by_date` (date-sorted, never `/search`), score > 30, keyword-relevant | 15 items |
 | arxiv | export API, latest by submittedDate | 6 items |
 | TLDR AI | RSS, title + link | 5 items |
 | The Batch (deeplearning.ai) | HTML scraping, title + issue slug | 5 items |
@@ -215,7 +215,7 @@ Present Step 4 menu options [1]–[5]. Do not skip to [5] silently — surface t
 ## Simplification Guards
 
 - Video Tier-3 probe fails (any of `yt-dlp` / `curl_cffi` / `ffmpeg` missing, or timedtext returns 429) → fall through to operator summary; never assume `yt-dlp` works
-- If 3+ arxiv queries fail, proceed with HN only (do not abort)
+- If 3+ arxiv queries fail (HTTP 429): back off once → WebFetch the date-sorted `arxiv.org/list/cs.SE/recent` listing → only then HN-only. Never substitute WebSearch (recall channel, 5/5 REPEATs measured 2026-09-04); report `arxiv FAILED (429)`, never `0 items`. Detail: `SKILL_detail.md §Execution form`
 - On curl timeout, skip that item and continue with the rest
 - If synthesis result exceeds 400 characters, retain top 3 items and truncate the rest
 - Without `--save`, do not create files (conversation output only)

package/plugins/fh-meta/skills/frontier-digest/SKILL_detail.md

@@ -21,20 +21,40 @@ load: on-demand
 > through WebFetch on the same URLs. If an environment *does* allow the curl form, it is equivalent —
 > the transport is not the contract, the endpoints and criteria are.
 >
-> **arXiv HTTP 429 is a separate item, not part of this revision**: it is a remote rate limit
-> (N=11 consecutive, transport-independent). On 429: back off once, then fall back to per-item
-> `https://arxiv.org/abs/{id}` reads; record `FAILED (429)`, never 0 items.
+> **arXiv HTTP 429 — fallback is a TRANSPORT change, never a channel change (revised 2026-09-04).**
+> The export API rate-limits this runner (N=11 consecutive by 08-10; 3 consecutive days 09-02·03·04
+> = past the `N≥3` mechanization bar). The 08-10 prescription («fall back to per-item `abs/{id}`
+> reads») was unrunnable in practice — a 429 on the *query* leaves you with no IDs to read — so runs
+> fell back to **WebSearch**, and the 09-04 run measured what that does: 5/5 papers it returned were
+> REPEATs. Search sorts by *canonicity*, the export API by *submission date* — a search fallback is
+> a **recall channel, not a discovery channel**, and swapping it in silently converts «unrun» into
+> «nothing new» (`not found ≠ 0`). Order on 429:
+> 1. back off once (≥30s), retry the same query;
+> 2. still 429 → WebFetch the **date-sorted HTML listing** `https://arxiv.org/list/cs.SE/recent`
+>    (and `https://arxiv.org/list/cs.AI/recent` if the first is empty of agent/harness items), keep
+>    items whose title/abstract match the three query phrases, cap 6 — same sort axis as the API;
+> 3. only if that also fails → HN-only, and the progress line says `arxiv FAILED (429)`, never `0 items`.
+> 🟥 WebSearch is **not** on this ladder. If a run used it anyway, the arxiv leg is reported as
+> `RECALL-ONLY (WebSearch)` and its items are excluded from the NEW/REPEAT count.
 
 ### HackerNews (Algolia API)
 
 ```bash
 for KW in "AI agent" "LLM harness" "Claude" "multi-agent" "context engineering"; do
   curl -s --max-time 8 \
-    "https://hn.algolia.com/api/v1/search?query=$(echo $KW | tr ' ' '+')&tags=story&hitsPerPage=5&numericFilters=points>10"
+    "https://hn.algolia.com/api/v1/search_by_date?query=$(echo $KW | tr ' ' '+')&tags=story&hitsPerPage=5&numericFilters=points>30"
 done
 ```
 
-Collection criteria: score > 10, keyword-relevant items only. Max 15 items.
+Collection criteria: score > 30, keyword-relevant items only. Max 15 items.
+
+> **`/search_by_date`, not `/search` (revised 2026-09-04; prescribed 2026-09-01, unapplied for 3 runs).**
+> `/search` ranks by relevance and returned items dated 2025-11→2026-06 on 2026-09-01 — a *relevant-but-stale*
+> leg, the mirror image of the 2026-07-26 arXiv *fresh-but-off-axis* failure, and the HN leg carried neither
+> refresh trigger. `/search_by_date` sorts by submission time; the points floor rises 10→30 to keep the
+> date-sorted window from filling with noise (measured 2026-09-01: `points>30` gave a clean 08-27→08-31
+> window). Same rule as the arXiv leg: a leg that silently falls back to a relevance/recall channel converts
+> «unrun» into «nothing new».
 
 ### arxiv
 

package/plugins/fh-meta/skills/hub-cc-pr-reviewer/SKILL.md

@@ -98,6 +98,17 @@ verdict NOT_CONFIGURED, or the
 returned, what was found — never the matched lines themselves. Same rule as the marker: the file is
 a local artifact, the capsule is what crosses the boundary.
 
+**Noise control — two rules that decide what reaches the comment (absorbed 2026-09-04 from the
+AI-Native SDLC playbook's `REVIEW.md`; FH already tiers findings M/S/R, but had no cap and no
+exclusion list, so a long PR produced a long comment that buried the one finding that mattered):**
+- **Nit cap = 5.** A nit is any finding that would not change behavior, leak data, or breach a
+  baseline rule (style · naming · wording · ordering). Report at most five nits, then one line:
+  `+N more nits (not listed)`. M-tier and S-tier findings are never capped.
+- **Do-not-report list.** Skip anything a mechanical gate already enforces on this repo (the
+  pre-commit 4-axis gate, `validate` CI, `regression_guard`, public-surface scan) and generated or
+  vendored files. Reporting what a gate already blocks is double coverage that reads as noise; if
+  a gate *should* have caught it and did not, that is an S-tier finding about the gate, not a nit.
+
 Then attach the review comment (8-matrix results + self-catch + refinement suggestions + merge
 recommendation) via `gh pr comment`.
 

package/plugins/fh-meta/skills/hub-cc-pr-reviewer/SKILL_detail.md

@@ -28,6 +28,9 @@ gh pr comment "$PR_NUMBER" --body "$(cat <<'EOF'
 ### Refinement Suggestions (following simplification guard / areas for subsequent rounds outside this PR)
 {Subsequent round areas / omit if 0 items}
 
+### Nits (max 5; +N more not listed)
+{At most five style/naming/wording items; omit the section if 0. Never list what a gate already enforces.}
+
 ### Admin Override Merge Recommendation
 {User decision delegation / beta stage policy adherence}
 EOF

package/plugins/fh-qp/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "fh-qp",
+  "version": "3.1.1",
+  "engines": {
+    "claudeCode": ">=1.0.0"
+  },
+  "description": "QP (Quality Platform) — 4 skills (qp · qp-plan · qp-run · qp-regress). Plan→Automation→Regression loop for web and desktop apps with zero domain constants. Calls a registered qasp typed capability when one is present (strictest-wins); otherwise drives the target through the session's Playwright MCP (web) or computer-use MCP (desktop). Mobile deferred.",
+  "author": {
+    "name": "chrono-meta",
+    "email": "chrono-meta@users.noreply.github.com"
+  },
+  "keywords": [
+    "qa",
+    "quality-platform",
+    "test-planning",
+    "e2e",
+    "regression",
+    "surface-reach",
+    "mtm",
+    "domain-agnostic"
+  ]
+}

package/plugins/fh-qp/README.md

@@ -0,0 +1,71 @@
+# fh-qp — QP (Quality Platform)
+
+QP(Quality Platform) — qasp 의 PAR 를 도메인 상수 0 으로 옮긴 FH 동봉 플러그인.
+
+> Namespace note: in the field harness's own documents «QP» has meant *QA-Prism* (a roadmap label). This plugin's QP is **Quality Platform** — a different name space; nothing here refers to that roadmap.
+
+**What it is for**: you are inside Claude Code, you have a web page or a desktop app in front of you, and you want a repeatable **plan → run → regress** loop with a QA lens — not a one-off "click around for me".
+
+## Install / prerequisites (read this first — the first run fails without them)
+
+| you test | you need connected in this session | how QP detects it |
+|---|---|---|
+| a **web** page | Playwright MCP (`mcp__playwright__*`) — or the Claude-in-Chrome extension | `qp_tools.sh adapter-probe --need web` |
+| a **desktop** app | computer-use MCP (`mcp__computer-use__*`) | `qp_tools.sh adapter-probe --need desktop` |
+| a **mobile** app | — deferred; not supported | — |
+
+No adapter → every stage stops with `HARNESS_ERROR` (exit 10, plus a `qp/HARNESS_ERROR.txt`). That is a typed non-pass, never a skip.
+Nothing else to install: the plugin is four skills + one bash script; no Python, no npm packages.
+
+## First command
+
+```
+/qp https://app.example.com/          # plan → run → regress, stops at the first HARNESS_ERROR
+/qp plan https://app.example.com/     # one stage
+/qp app:"Example App"                 # desktop (needs a profile — see below)
+```
+You get files under `qp/`: `plan/inventory.md` · `plan/tcs.tsv` · `run/<ts>/verdicts.tsv` + masked evidence · `regress/<ts>/surface_reach.txt` + `delta.tsv` + `report.md`. You succeeded when `report.md` exists and its first 8 lines name the engine, the MTM state and a surface_reach line.
+
+## Public vs profile-required targets (zero domain constants)
+
+The plugin ships **no** host names, app names, credentials or organisation words. A target that is not public (private IP, `localhost`, `*.internal`/`*.lan`/`*.local`, a bare hostname, or any desktop app) is `PROFILE_REQUIRED` (exit 4) until you supply a profile:
+
+```
+cp plugins/fh-qp/qp_profile.example.yaml <a gitignored path>/qp_profile.yaml   # fill hosts/apps, reference env vars for secrets
+/qp https://private.example.internal/ --profile <that path>
+```
+The profile is the only place a target-specific constant may live, and it is yours, never the plugin's.
+
+## Engine — form C (skills are canonical; machinery is pluggable)
+
+1. **Typed capability** — if a QA harness registers a capability whose id ends in `:par`, QP calls its entry and merges constraints strictest-wins (`knowledge/shared/harness-core/capability_composition_contract.md`). **Status 2026-09-05: no such capability is registered anywhere** (FH registry and the field harness both checked — zero cap files). Registration is the field harness's move; until then this bridge is a declared slot. Asking for it explicitly (`--engine capability`) returns `HARNESS_ERROR reason=capability-not-registered`, not a silent fallback.
+2. **MCP fallback** — the path that exists today. Every artifact header says `engine=mcp-fallback adapter=<name> evidence=dom|pixel`, so a reader can tell which edition produced the report.
+3. Desktop through computer-use is the **weaker edition** (pixel evidence, no DOM): `verify` steps close by readable screenshot text only, surface_reach hashes screenshots. The report header says so.
+
+## What is mechanical vs what is prose (honest boundary)
+
+| check | where | closed by |
+|---|---|---|
+| target public / profile-required | `scripts/qp_tools.sh target-class` | exit enum 0/4/10 |
+| adapter present | `adapter-probe` | exit 0/10 (unknown ≠ present) |
+| evidence masking, residue 0 | `mask` | exit 0/5 |
+| surface_reach (TCs beyond entry / all TCs) | `surface-reach` | REACHED · PARTIAL · NOT_REACHED · UNMEASURED |
+| verdict record shape — status/branch/closure/verb enums, `MACHINE` needs an assertion, branch↔`expected_source` binding | `mtm-check` | exit 0/10 |
+| ≥1 state-changing verb executed | `run-verbs` | exit 0/5 |
+| **whether a label is TRUE** (is this really *code differs*?) | prose in `qp-run` | judgment — paired, not mechanised (a frozen rule would be tomorrow's ceiling) |
+
+The last row is the honest residual: QP types *that* a verdict is attributable and non-vacuous, not *that* it is correct.
+
+## Skills
+| skill | stage | Done When (summary) |
+|---|---|---|
+| `qp` | router | target classified · adapter probed · every artifact carries `engine=`/`evidence=` |
+| `qp-plan` | Prepare | inventory ≥1 observed surface · `tcs.tsv` 8 fields with `expected_source` · ≥1 click/input TC |
+| `qp-run` | Automation | `verdicts.tsv` passes `mtm-check` + `run-verbs` · evidence masked, residue 0 |
+| `qp-regress` | Regression | `surface_reach.txt` from the tool · one delta row per TC · NOT_REACHED sentence present |
+
+## Lane
+`bash scripts/test_fh_qp_lanes.sh` — known pairs for the three negatives (profile-required → refuse · no adapter → HARNESS_ERROR · dirty evidence → masked, residue 0), surface_reach four states, mtm-check good/bad, run-verbs, and a residency scan of the whole plugin (fail-closed if the scanner cannot run).
+
+## Prior art this is built on (curated, not reinvented)
+Playwright Test Agents (planner / generator / healer) and Playwright MCP do the exploring and the driving; Cypress UI Coverage and mabl cover page-level coverage; `page.screenshot({mask})` covers web masking. QP adds only the judgment layer on top: the verdict record contract (`mtm-check`), first-step BLOCKED attribution, surface_reach as a ratio over all TCs, and profile-gated targets.

package/plugins/fh-qp/fixtures/evidence_known_clean.txt

@@ -0,0 +1,3 @@
+step 1 open home
+step 2 click About
+plain text stays

package/plugins/fh-qp/fixtures/evidence_known_dirty.txt

@@ -0,0 +1,6 @@
+step 1 login as qa.tester@example.com
+Authorization: Bearer abcdefghijklmnopqrstuvwxyz0123456789
+token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJVadQssw5c
+password: hunter2hunter2
+sha=0123456789abcdef0123456789abcdef01234567
+plain text stays

package/plugins/fh-qp/fixtures/reach_known_partial.tsv

@@ -0,0 +1,4 @@
+TC-1	1	h_entry
+TC-1	2	h_entry
+TC-2	1	h_entry
+TC-2	2	h_about

package/plugins/fh-qp/fixtures/reach_known_reached.tsv

@@ -0,0 +1,4 @@
+TC-1	1	h_entry
+TC-1	2	h_about
+TC-2	1	h_entry
+TC-2	2	h_docs

package/plugins/fh-qp/fixtures/reach_known_wall.tsv

@@ -0,0 +1,3 @@
+TC-1	1	h_entry
+TC-2	1	h_entry
+TC-3	2	h_entry

package/plugins/fh-qp/fixtures/verdicts_known_bad_branch.tsv

@@ -0,0 +1,2 @@
+#mtm: UNAVAILABLE
+TC-1	FAIL	DIFFERS_FROM_PLAN	JUDGMENT	verify		NONE

package/plugins/fh-qp/fixtures/verdicts_known_bad_vacuous_machine.tsv

@@ -0,0 +1,2 @@
+#mtm: ACTIVE
+TC-1	FAIL	CODE_DIFFERS	MACHINE	verify		CODE

package/plugins/fh-qp/fixtures/verdicts_known_good.tsv

@@ -0,0 +1,4 @@
+#mtm: UNAVAILABLE
+TC-1	PASS	AS_PLANNED	MACHINE	navigate	url==https://example.com/	INVENTORY
+TC-2	PASS	AS_PLANNED	MACHINE	click	text-visible:About	INVENTORY
+TC-3	BLOCKED	NONE	JUDGMENT	input		NONE

package/plugins/fh-qp/fixtures/verdicts_verify_only.tsv

@@ -0,0 +1,3 @@
+#mtm: UNAVAILABLE
+TC-1	PASS	AS_PLANNED	MACHINE	verify	text-visible:x	INVENTORY
+TC-2	PASS	AS_PLANNED	MACHINE	verify	text-visible:y	INVENTORY

package/plugins/fh-qp/qp_profile.example.yaml

@@ -0,0 +1,29 @@
+# qp_profile.example.yaml — the ONLY place a target-specific constant may live.
+# Copy to a gitignored path (e.g. tracks/_meta/qp_profile.yaml) and pass it with --profile.
+# The plugin itself ships ZERO domain constants; without a profile, only public targets run.
+#
+# Every value below is a placeholder. Nothing in this file names a real organisation.
+profile_name: example
+targets:
+  web:
+    - id: example-web
+      base_url: https://app.example.com        # non-public hosts (10.x, *.internal, *.lan, bare names) REQUIRE this file
+      route_prefix: ""                          # e.g. "#/" for hash routers
+      entry_route: /
+  desktop:
+    - id: example-desktop
+      app_name: Example App                     # window title / bundle name as the OS shows it
+credentials:
+  # Never put secrets here. Reference an env var; qp-run reads it at type-time and masks it in evidence.
+  example-web:
+    username_env: QP_EXAMPLE_USER
+    password_env: QP_EXAMPLE_PASS
+tc_vocabulary:
+  # Optional overrides for the step-verb keywords qp-run recognises (defaults are English + Korean).
+  click: []
+  input: []
+  navigate: []
+  verify: []
+masking:
+  # Extra evidence-masking regexes (appended to the built-in email/token/password set).
+  extra_patterns: []

package/plugins/fh-qp/scripts/qp_tools.sh

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+# qp_tools.sh — the MECHANICAL half of fh-qp (QP · Quality Platform).
+#
+# The four qp-* skills are prose; a prose rule is muscle (a strong model carrying it), not skeleton.
+# Everything a floor-tier session must NOT be trusted to "just do" lives here as a typed check with a
+# closed exit enum, so a report can be read without trusting the narrator:
+#
+#   target-class   <url|app:NAME> [--profile FILE]      → PUBLIC | PROFILE_REQUIRED | PROFILE_OK | UNKNOWN
+#   adapter-probe  --need web|desktop --tools "a,b,c"    → ADAPTER=<name> | HARNESS_ERROR
+#   mask           <in> <out>                            → MASKED (residue 0) | RESIDUE
+#   surface-reach  <evidence.tsv>                        → REACHED | PARTIAL | NOT_REACHED | UNMEASURED
+#   mtm-check      <verdicts.tsv>                        → OK | INVALID
+#   run-verbs      <verdicts.tsv>                        → OK (≥1 state-changing verb) | VERIFY_ONLY
+#   screen-id      <snapshot-file>                       → 12-hex stable id of a DOM/pixel observation
+#
+# Exit enum (shared):  0 = pass/positive · 4 = PROFILE_REQUIRED · 5 = negative-but-typed (RESIDUE ·
+#   NOT_REACHED · PARTIAL · VERIFY_ONLY · INVALID) · 10 = HARNESS_ERROR / UNMEASURED (fail-closed:
+#   never read 10 as "clean" or "reached").
+#
+# Domain constants: ZERO. Every host/app name comes from the caller or the profile file.
+# bash 3.2 compatible (macOS default). No python required.
+set -uo pipefail
+
+usage() { sed -n '2,20p' "$0" >&2; exit 10; }
+[ $# -ge 1 ] || usage
+CMD="$1"; shift
+
+# ── helpers ────────────────────────────────────────────────────────────────────
+_host_of() { # strip scheme, path, port, creds
+  printf '%s' "$1" | sed -E 's#^[a-zA-Z][a-zA-Z0-9+.-]*://##; s#^[^/@]*@##; s#[/?].*$##; s#:[0-9]+$##' | tr 'A-Z' 'a-z'
+}
+_is_private_host() { # RFC1918 / loopback / link-local / non-public suffix / bare name
+  local h="$1"
+  case "$h" in
+    localhost|127.*|10.*|192.168.*|169.254.*|0.0.0.0|::1) return 0 ;;
+    172.1[6-9].*|172.2[0-9].*|172.3[01].*) return 0 ;;
+    *.local|*.internal|*.lan|*.intra|*.home|*.test|*.localhost|*.private) return 0 ;;
+  esac
+  case "$h" in *.*) return 1 ;; *) return 0 ;; esac   # bare hostname (no dot) → not public
+}
+_profile_lists() { # $1 = profile file, $2 = needle (host or app name). YAML-lite: grep the value.
+  [ -f "$1" ] || return 1
+  /usr/bin/grep -qiF -- "$2" "$1"
+}
+
+# ── target-class ───────────────────────────────────────────────────────────────
+cmd_target_class() {
+  local target="" profile=""
+  while [ $# -gt 0 ]; do case "$1" in --profile) profile="${2:-}"; shift 2 ;; *) target="$1"; shift ;; esac; done
+  [ -n "$target" ] || { echo "target-class: missing target" >&2; exit 10; }
+  case "$target" in
+    app:*)
+      local app="${target#app:}"
+      if [ -n "$profile" ] && _profile_lists "$profile" "$app"; then echo "PROFILE_OK kind=desktop app=$app"; exit 0; fi
+      echo "PROFILE_REQUIRED kind=desktop app=$app reason=desktop-targets-always-need-a-profile"; exit 4 ;;
+    http://*|https://*)
+      local h; h="$(_host_of "$target")"
+      [ -n "$h" ] || { echo "UNKNOWN reason=no-host"; exit 10; }
+      if _is_private_host "$h"; then
+        if [ -n "$profile" ] && _profile_lists "$profile" "$h"; then echo "PROFILE_OK kind=web host=$h"; exit 0; fi
+        echo "PROFILE_REQUIRED kind=web host=$h reason=non-public-host"; exit 4
+      fi
+      echo "PUBLIC kind=web host=$h"; exit 0 ;;
+    *) echo "UNKNOWN reason=unrecognised-target-form (want http(s)://… or app:NAME)"; exit 10 ;;
+  esac
+}
+
+# ── adapter-probe ──────────────────────────────────────────────────────────────
+# bash cannot introspect the session's MCP servers; the SESSION passes the tool names it actually has.
+# Omitting --tools is HARNESS_ERROR: unknown is not present.
+cmd_adapter_probe() {
+  local need="" tools=""
+  while [ $# -gt 0 ]; do case "$1" in --need) need="${2:-}"; shift 2 ;; --tools) tools="${2:-}"; shift 2 ;; *) shift ;; esac; done
+  [ "$need" = web ] || [ "$need" = desktop ] || { echo "HARNESS_ERROR reason=--need must be web|desktop"; exit 10; }
+  [ -n "$tools" ] || { echo "HARNESS_ERROR reason=tool-list-not-supplied (unknown ≠ present)"; exit 10; }
+  local t; for t in $(printf '%s' "$tools" | tr ',' ' '); do
+    case "$need:$t" in
+      web:mcp__playwright__browser_navigate)        echo "ADAPTER=playwright-mcp evidence=dom"; exit 0 ;;
+      web:mcp__claude-in-chrome__navigate)          echo "ADAPTER=claude-in-chrome evidence=dom"; exit 0 ;;
+      desktop:mcp__computer-use__screenshot)        echo "ADAPTER=computer-use-mcp evidence=pixel"; exit 0 ;;
+    esac
+  done
+  echo "HARNESS_ERROR reason=no-$need-adapter-among-supplied-tools"; exit 10
+}
+
+# ── mask ───────────────────────────────────────────────────────────────────────
+# Record-layer masking (the typing path still sends the real value). Residue 0 is asserted AFTER writing.
+_MASK_EMAIL='[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}'
+_MASK_JWT='eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}'
+_MASK_BEARER='[Bb]earer[[:space:]]+[A-Za-z0-9._~+/=-]{16,}'
+_MASK_KEYLIKE='(sk|pk|ghp|gho|xox[abp]|AKIA)[-_][A-Za-z0-9_-]{12,}'
+_MASK_HEX='[A-Fa-f0-9]{40,}'
+_MASK_PWKV='([Pp]ass(word|wd)?|[Ss]ecret|[Tt]oken)[[:space:]]*[:=][[:space:]]*"?[^"[:space:],}]{4,}'
+cmd_mask() {
+  local in="${1:-}" out="${2:-}"
+  [ -f "$in" ] || { echo "HARNESS_ERROR reason=input-missing"; exit 10; }
+  [ -n "$out" ] || { echo "HARNESS_ERROR reason=output-missing"; exit 10; }
+  sed -E \
+    -e "s/$_MASK_JWT/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_BEARER/Bearer __REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_KEYLIKE/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_HEX/__REDACTED_TOKEN__/g" \
+    -e "s/$_MASK_PWKV/\1=__REDACTED_SECRET__/g" \
+    -e "s/$_MASK_EMAIL/__REDACTED_EMAIL__/g" \
+    "$in" > "$out" || { echo "HARNESS_ERROR reason=sed-failed"; exit 10; }
+  local residue
+  # Strip our own markers before re-scanning — the Bearer pattern matches "__REDACTED_TOKEN__" itself
+  # (18 word-chars). Known-pair caught this on first run: an instrument matching its own output is
+  # [[feedback_lane_vocabulary_blind_to_its_own_fix]] in miniature.
+  residue=$(sed -E 's/__REDACTED_[A-Z]+__//g' "$out" | /usr/bin/grep -cE "$_MASK_EMAIL|$_MASK_JWT|$_MASK_BEARER|$_MASK_HEX" 2>/dev/null); residue="${residue:-0}"
+  if [ "$residue" -eq 0 ]; then echo "MASKED residue=0 out=$out"; exit 0; fi
+  echo "RESIDUE residue=$residue out=$out"; exit 5
+}
+
+# ── surface-reach ──────────────────────────────────────────────────────────────
+# evidence.tsv: tc_id <TAB> step <TAB> screen_hash   (one row per observed screen; hash = any stable id)
+# Entry screen = the modal hash across the batch. A TC is "beyond entry" iff any of its hashes ≠ entry.
+# Denominator = ALL tc_ids in the file. An empty file is UNMEASURED (10), never NOT_REACHED.
+cmd_surface_reach() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "UNMEASURED reason=evidence-missing"; exit 10; }
+  [ -s "$f" ] || { echo "UNMEASURED reason=evidence-empty (empty set is not reached)"; exit 10; }
+  LC_ALL=C awk -F'\t' '
+    NF < 3 || $1 ~ /^#/ { next }
+    { tc[$1]=1; n_rows++; cnt[$3]++; seen[$1 SUBSEP $3]=1 }
+    END {
+      if (n_rows == 0) { print "UNMEASURED reason=no-rows"; exit 10 }
+      best=""; bestc=-1
+      for (h in cnt) if (cnt[h] > bestc) { bestc=cnt[h]; best=h }
+      total=0; beyond=0
+      for (t in tc) { total++; b=0; for (k in seen) { split(k, p, SUBSEP); if (p[1]==t && p[2]!=best) b=1 } beyond+=b }
+      st = (beyond==total) ? "REACHED" : (beyond==0 ? "NOT_REACHED" : "PARTIAL")
+      printf "%s tcs_beyond_entry=%d tcs_total=%d entry_screen=%s\n", st, beyond, total, best
+      exit (st=="REACHED") ? 0 : 5
+    }' "$f"
+}
+
+# ── mtm-check ──────────────────────────────────────────────────────────────────
+# verdicts.tsv: first non-comment line MUST be  #mtm: ACTIVE|UNAVAILABLE|FAILED|DISABLED
+# rows: tc_id <TAB> status <TAB> branch <TAB> closure <TAB> verb <TAB> assertion <TAB> expected_source
+#   status          ∈ PASS FAIL BLOCKED AMBIGUOUS
+#   branch          ∈ AS_PLANNED DIFFERS_FROM_PLAN CODE_DIFFERS NONE
+#   closure         ∈ MACHINE JUDGMENT   (MACHINE requires a non-empty assertion — the record that closed it)
+#   verb            ∈ navigate click input verify
+#   expected_source ∈ PLAN_DOC INVENTORY CODE HUMAN NONE   — WHERE the expected value came from.
+# The branch→source binding is the mechanical discriminator (challenger #9, governor 2026-09-05):
+#   DIFFERS_FROM_PLAN  ⇒ expected_source = PLAN_DOC  and #mtm: ACTIVE   (no plan doc → this branch is unreachable)
+#   CODE_DIFFERS       ⇒ expected_source ∈ {CODE, PLAN_DOC}
+#   AS_PLANNED         ⇒ expected_source ≠ NONE
+#   NONE               ⇒ status ∈ {BLOCKED, AMBIGUOUS}  (a verdict with no branch is a non-verdict)
+# Any violation → INVALID (10). The check asserts the RECORD's properties (typed · attributable ·
+# non-vacuous), never whether the label is TRUE — that stays judgment (CLAUDE.md §Mechanization Boundary).
+cmd_mtm_check() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "INVALID reason=file-missing"; exit 10; }
+  local mtm; mtm=$(/usr/bin/grep -m1 -E '^#mtm:' "$f" | sed -E 's/^#mtm:[[:space:]]*//' | tr -d '[:space:]')
+  case "$mtm" in ACTIVE|UNAVAILABLE|FAILED|DISABLED) ;; *) echo "INVALID reason=mtm-state-missing-or-bad (#mtm: ACTIVE|UNAVAILABLE|FAILED|DISABLED)"; exit 10 ;; esac
+  LC_ALL=C awk -F'\t' -v mtm="$mtm" '
+    /^#/ || NF==0 { next }
+    { rows++
+      if (NF < 7) { bad++; why="row-has-" NF "-fields-need-7"; next }
+      if ($2 !~ /^(PASS|FAIL|BLOCKED|AMBIGUOUS)$/) { bad++; why="status:" $2; next }
+      if ($3 !~ /^(AS_PLANNED|DIFFERS_FROM_PLAN|CODE_DIFFERS|NONE)$/) { bad++; why="branch:" $3; next }
+      if ($3 == "DIFFERS_FROM_PLAN" && mtm != "ACTIVE") { bad++; why="DIFFERS_FROM_PLAN-needs-mtm-ACTIVE"; next }
+      if ($4 !~ /^(MACHINE|JUDGMENT)$/) { bad++; why="closure:" $4; next }
+      if ($4 == "MACHINE" && $6 == "") { bad++; why="MACHINE-closure-without-assertion"; next }
+      if ($5 !~ /^(navigate|click|input|verify)$/) { bad++; why="verb:" $5; next }
+      if ($7 !~ /^(PLAN_DOC|INVENTORY|CODE|HUMAN|NONE)$/) { bad++; why="expected_source:" $7; next }
+      if ($3 == "DIFFERS_FROM_PLAN" && $7 != "PLAN_DOC") { bad++; why="DIFFERS_FROM_PLAN-needs-expected_source=PLAN_DOC"; next }
+      if ($3 == "CODE_DIFFERS" && $7 !~ /^(CODE|PLAN_DOC)$/) { bad++; why="CODE_DIFFERS-needs-expected_source=CODE|PLAN_DOC"; next }
+      if ($3 == "AS_PLANNED" && $7 == "NONE") { bad++; why="AS_PLANNED-with-expected_source=NONE"; next }
+      if ($3 == "NONE" && $2 !~ /^(BLOCKED|AMBIGUOUS)$/) { bad++; why="branch=NONE-only-for-BLOCKED|AMBIGUOUS"; next }
+      if ($4=="MACHINE") m++; else j++
+    }
+    END {
+      if (rows == 0) { print "INVALID reason=no-rows"; exit 10 }
+      if (bad > 0) { printf "INVALID rows=%d bad=%d first=%s\n", rows, bad, why; exit 10 }
+      printf "OK mtm=%s rows=%d machine_closed=%d judgment_left=%d\n", mtm, rows, m+0, j+0; exit 0
+    }' "$f"
+}
+
+# ── screen-id ──────────────────────────────────────────────────────────────────
+# First-use finding (2026-09-05, gh-pages target): Playwright MCP accessibility snapshots carry per-navigation
+# ref tokens (`[ref=e12]`, then `[ref=f2e12]`, `[ref=f3e12]` …) — the SAME page hashed to three different ids
+# across three visits, so surface_reach credited two TCs for "leaving the entry screen" before they clicked.
+# The screen id must be a CONTENT hash: strip ref/active tokens and whitespace runs before hashing.
+# Binary files (screenshots) are hashed as-is.
+cmd_screen_id() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "HARNESS_ERROR reason=file-missing"; exit 10; }
+  if LC_ALL=C /usr/bin/grep -qI . "$f"; then
+    sed -E 's/\[ref=[A-Za-z0-9]+\]//g; s/\[active\]//g; s/[[:space:]]+/ /g' "$f" | shasum -a 256 | cut -c1-12
+  else
+    shasum -a 256 "$f" | cut -c1-12
+  fi
+}
+
+# ── run-verbs (challenger #13: verify-only evidence never exercised the runner) ─
+cmd_run_verbs() {
+  local f="${1:-}"
+  [ -f "$f" ] || { echo "HARNESS_ERROR reason=file-missing"; exit 10; }
+  local n; n=$(LC_ALL=C awk -F'\t' '!/^#/ && NF>=5 && ($5=="click" || $5=="input"){c++} END{print c+0}' "$f")
+  if [ "$n" -ge 1 ]; then echo "OK state_changing_verbs=$n"; exit 0; fi
+  echo "VERIFY_ONLY state_changing_verbs=0 (runner not exercised)"; exit 5
+}
+
+case "$CMD" in
+  target-class)  cmd_target_class "$@" ;;
+  adapter-probe) cmd_adapter_probe "$@" ;;
+  mask)          cmd_mask "$@" ;;
+  surface-reach) cmd_surface_reach "$@" ;;
+  mtm-check)     cmd_mtm_check "$@" ;;
+  run-verbs)     cmd_run_verbs "$@" ;;
+  screen-id)     cmd_screen_id "$@" ;;
+  *) usage ;;
+esac