@chrono-meta/fh-gate 3.1.4 → 3.4.0

package/scripts/frontier_digest_autopilot.sh

@@ -22,10 +22,10 @@
 #   BACK-END SHIPPING DOCTRINE (operator, 2026-08-15): "개발의 앞단-영혼심기, 중간단-탈상관 가속화,
 #   뒷단 출하전-4단검증 및 하네스오너 리뷰" — the back end of shipping is 4-axis verification AND a
 #   standpoint-axis review, not 4-axis alone. CORRECTED same session (an earlier draft of this
-#   header named fh-meta:hub-cc-pr-reviewer here — wrong skill, caught by the operator: "내가 말한건
+#   header named fh-meta:harness-pr-reviewer here — wrong skill, caught by the operator: "내가 말한건
 #   하네스오너(너) 아니라 그 하네스에 에이전트가 들어가서 그 입장에서 리뷰한다는거야"). "하네스오너
 #   리뷰" is NOT the human operator (that gate is merge, unconditionally human, unchanged) NOR
-#   hub-cc-pr-reviewer (which checks FH's diff against FH's OWN conventions — same-repo
+#   harness-pr-reviewer (which checks FH's diff against FH's OWN conventions — same-repo
 #   self-consistency, a different question). It is the STANDPOINT AXIS
 #   (`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7`, the mechanism behind the
 #   if(kakao)26 keynote's p15 "(c) 탈상관의 확장" slide — "계열을 늘려도 못 잡는 결함이 있습니다,
@@ -197,7 +197,7 @@ BACK-END CHECKPOINTS (operator instruction, 2026-08-15 - required steps on this
 2. STANDPOINT AXIS (knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7 - read it before applying this step, this summary is not the full spec): does the diff alter ANOTHER harness's actual behavior, gate outcome, or interaction contract (not merely touch a path that happens to be synced elsewhere - the trigger is behavioral, not file-class)? Most ordinary FH self-improvement from a digest signal will correctly land on standpoint: not-applicable - that is a correct, expected answer, not a shortfall to fix. This is a genuinely different axis from "harness-owner reviewing FH's own conventions" - it means an agent actually running the diff's effect FROM the standpoint of the OTHER harness's own repo (family diversity alone does not catch this: the mechanism behind the if(kakao)26 keynote's p15 slide "(c) 탈상관의 확장" - "계열을 늘려도 못 잡는 결함이 있습니다, 입장을 바꾸면 보입니다" - §7 is built on three field incidents where full cross-family review missed a defect that only one execution-from-the-target's-own-repo caught).
    - If NOT applicable (the common case): record standpoint: not-applicable in the marker/signal, state briefly what was checked (per the spec's own discipline - asserting non-applicability without naming what was checked is indistinguishable from not having looked at all), and move on.
    - If applicable: check whether a local clone of the target harness exists on this machine (e.g. under the parent of ${FH_DIR} - sibling directories like pmh-dev, qasp-dev, or similar). If one exists, run the change against THAT repo's own content/rules from its own standpoint (tier2) - this must happen BEFORE any push or gh pr create for THIS diff, same non-negotiable pre-push timing as the irreversibility check above and for the identical reason (PR #370, 2026-08-14: a post-PR standpoint review still caught 2 residency leaks that had already sat in public view before the fix - public exposure is effectively irreversible, so this cannot run after the diff is visible). If it finds anything, fix it in the local diff and re-run until clean - only then push and open the PR (or, if step 1 already routed to hold, fold the finding into that signal file instead). If no local clone of the target harness is reachable, record standpoint: DEGRADED_NO_TARGET_ACCESS (could not, not did not) and proceed - do not block indefinitely on a target you structurally cannot reach, but do not silently claim not-applicable either when it actually is applicable and merely unreachable.
-   Do NOT conflate this with fh-meta:challenger (family/adversarial-correctness axis, already required by the 4-axis gate above) or with fh-meta:hub-cc-pr-reviewer (checks FH's own diff against FH's OWN baseline conventions - a same-repo self-consistency check, not a standpoint-axis review at all). All three are different lenses; running one is not a substitute for another.
+   Do NOT conflate this with fh-meta:challenger (family/adversarial-correctness axis, already required by the 4-axis gate above) or with fh-meta:harness-pr-reviewer (checks FH's own diff against FH's OWN baseline conventions - a same-repo self-consistency check, not a standpoint-axis review at all). All three are different lenses; running one is not a substitute for another.
 
 3. If the diff is neither irreversible/load-bearing (step 1: NO) nor standpoint-applicable (step 2: NO or DEGRADED) - the common case, ordinary small reversible self-improvement: skip straight to branch/commit/push/PR below.
 

package/scripts/gate_pathspec_check.sh

@@ -230,6 +230,7 @@ else
     'CLAUDE.md|CLAUDE\.md' \
     'AGENTS.md|AGENTS\.md' \
     'scripts/**/*.sh|scripts/\*\*/\*\.sh' \
+    'scripts/**/*.py|scripts/\*\*/\*\.py' \
     'agent definitions (plugins/*/agents)|plugins/\*/agents/' \
     'agent definitions (.claude/agents)|\.claude/agents/'
   do

package/scripts/gate_shape_scan.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# gate_shape_scan.sh — is this file «gate-shaped»? The mechanical half of the Field-Harness
+# Load-Bearing Change Gate trigger for files whose project is NOT mapped (CLAUDE.md
+# §Field-Harness Load-Bearing Change Gate · field_verdict_crossfamily_gate.md
+# §Registration is not a precondition, 2026-09-08).
+#
+# IT IS A CLASSIFIER OF THE FILE'S SHAPE, NOT A VERDICT ON THE FILE. A hit means «this file is
+# in the gate's scope — run degrade-lint + cross-family before a merge verdict». A miss means
+# «not in scope by identifier»; the task's own naming of the file as gate/auth/exposure code is a
+# separate MANUAL escalation and is not read here (a prompt is not a property of the file).
+#
+# What counts (three classes — each hit is printed with the class and the matched line):
+#   VERDICT   word-bounded, case-insensitive: allow(ed) deny denied permit(ted) approve/approved/approval
+#             verdict permission(s) auth authn authz authorize(d) authorization authenticat* auth_<x>
+#             (🟥 `author`/`authored`/`allowance` do NOT match — the auth branch is a closed list, not `auth.*`)
+#             (🟥 `reject` is deliberately absent — it collides with the Promise API `reject(err)`,
+#              measured on a real TS mock server: 2 hits, both Promise callbacks. Named residual:
+#              a gate that spells its refusal `reject(` is missed by this class; `deny` is not.)
+#             permission auth authn authz  ·  plus the UPPERCASE enum literals PASS FAIL BLOCK
+#             (uppercase only — lowercase `pass`/`fail`/`block` are ordinary words/keywords)
+#   EXPOSURE  a socket/server bind or listen: listen( bind( ListenAndServe Serve( 0.0.0.0 INADDR_ANY
+#   IRREV     an irreversible-op path: publish( delete( unlink( rm -rf force-push --force
+#             history-rewrite filter-branch reset --hard
+# Comment/string handling (named residual, crude on purpose): a line whose first non-blank
+# characters are `#`, `//`, `* ` (star+space/end: block-comment body), `/*`, `-- ` (dash-dash+space/end:
+# SQL/Lua), `;`, `"""`, `'''` is skipped; `*allow = 1` and a continued `--force` line are CODE and scanned. Inline trailing comments
+# and string literals are NOT stripped — a false positive here costs one review, a false negative
+# costs a missed gate, so the scan leans toward firing.
+# Supported: any text file. Binary or unreadable → UNSCANNABLE (exit 3), never a silent miss.
+#
+# Usage:  bash scripts/gate_shape_scan.sh <file> [file ...]
+#         bash scripts/gate_shape_scan.sh --selftest        # known-pair calibration
+# Exit:   0 = GATE-SHAPED (≥1 hit, all files scannable) · 1 = NOT-GATE-SHAPED · 3 = UNSCANNABLE/usage
+#         (3 dominates 0: a hit next to an unscannable file still exits 3 — that file is unresolved)
+set -uo pipefail
+export LC_ALL=C
+VERDICT_RE='\b(allow(ed)?|deny|denied|permit(ted)?|approv(e|ed|al)|verdict|permissions?|auth(n|z|orize|orized|orization|entic[a-z]*|_[a-z_]+)?)\b'
+ENUM_RE='\b(PASS|FAIL|BLOCK)\b'
+EXPOSURE_RE='(\blisten\(|\bbind\(|ListenAndServe|\bServe\(|0\.0\.0\.0|INADDR_ANY)'
+IRREV_RE='(\bpublish\(|\bdelete\(|\bunlink\(|rm -rf|force-push|--force\b|history-rewrite|filter-branch|reset --hard)'
+COMMENT_RE='^[[:space:]]*(#|//|\*([[:space:]]|$)|/\*|--([[:space:]]|$)|;|"""|'"'''"')'
+
+scan_one() { # $1=file → prints hits, returns 0 hit / 1 none / 3 unscannable
+  local f="$1" body v e r hits
+  [ -r "$f" ] || { echo "UNSCANNABLE  $f (unreadable)"; return 3; }
+  if /usr/bin/file -b --mime-encoding "$f" 2>/dev/null | /usr/bin/grep -q '^binary$'; then
+    echo "UNSCANNABLE  $f (binary)"; return 3; fi
+  # one pass: drop comment-led lines, then classify (VERDICT wins over EXPOSURE over IRREV per line)
+  # 🟥 pmh-dev #76 (2026-09-11): 여러 줄 docstring 의 «안쪽» 줄은 줄머리가 따옴표가 아니라 COMMENT_RE 를 통과했다 —
+  #    실물: 파이썬 테스트의 docstring 안 «fail-safe … 봉인» 문장이 GATE-SHAPED 로 지목됨. 줄 단위 grep 앞에
+  #    """ / ''' 짝 상태를 awk 로 추적해 열린 동안의 줄을 전부 버린다(여는 줄·닫는 줄 포함). 한 줄 docstring 은
+  #    짝수라 상태가 안 바뀌고 종전 COMMENT_RE 가 그대로 거른다. 잔여(이름으로): JS 템플릿 리터럴(`) · 일반 문자열 안의 """.
+  body=$(/usr/bin/awk -v q="'''" -v t='"""' '
+    { line=$0; n=gsub(t, "&", line); n+=gsub(q, "&", line)
+      if (indoc) { if (n % 2 == 1) indoc=0; next }
+      if (n % 2 == 1) { indoc=1; next }
+      print NR ":" $0 }' "$f" 2>/dev/null | /usr/bin/grep -Ev "^[0-9]+:${COMMENT_RE#^}" || true)
+  v=$(printf '%s\n' "$body" | /usr/bin/grep -Ei "$VERDICT_RE" || true)
+  v2=$(printf '%s\n' "$body" | /usr/bin/grep -E "$ENUM_RE" || true)
+  e=$(printf '%s\n' "$body" | /usr/bin/grep -E "$EXPOSURE_RE" || true)
+  r=$(printf '%s\n' "$body" | /usr/bin/grep -E "$IRREV_RE" || true)
+  hits=0
+  # 🟥 파일명을 sed 프로그램에 넣지 않는다. `s|^|... $f:|` 는 파일명 안의 `|` 로 구분자를 벗어나고,
+  #    거기에 `r <path>` 를 이어 붙이면 임의 파일 내용이 스캔 출력에 실리고 `w` 는 덮어쓴다
+  #    (cross-family security review 2026-09-09, 무해한 프로브로 추가 파일 읽기 실증).
+  #    awk 의 ENVIRON 은 값을 «프로그램»이 아니라 «데이터»로 받으므로 이 통로가 닫힌다.
+  [ -n "$v" ] && { hits=1; printf '%s\n' "$v" | /usr/bin/cut -c1-140 | FH_LABEL="VERDICT   $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$v2" ] && { hits=1; printf '%s\n' "$v2" | /usr/bin/cut -c1-140 | FH_LABEL="VERDICT   $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$e" ] && { hits=1; printf '%s\n' "$e" | /usr/bin/cut -c1-140 | FH_LABEL="EXPOSURE  $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$r" ] && { hits=1; printf '%s\n' "$r" | /usr/bin/cut -c1-140 | FH_LABEL="IRREV     $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ "$hits" -gt 0 ] && return 0 || return 1
+}
+
+selftest() { # known pair — positive must hit, negative must not, comment-only must not
+  local d rc_pos rc_pos2 rc_neg rc_cmt rc_bin rc_irr rc_bnd rc_star rc_doc rc_doc2 fails=0
+  d="$(mktemp -d 2>/dev/null)" || d=""
+  [ -n "$d" ] && [ -w "$d" ] || { echo "SELFTEST: ENV-BLOCKED (mktemp -d failed) — result unmeasured, not a pass"; return 3; }
+  printf 'export class S {\n  start() {\n    this.app.listen(this.config.port, () => {});\n  }\n}\n' > "$d/pos_exposure.ts"
+  printf 'def check(user):\n    if user.role == "admin":\n        return Verdict.ALLOW\n    return Verdict.DENY\n' > "$d/pos_verdict.py"
+  printf 'def add(a, b):\n    """Return the sum. Pass through ints."""\n    return a + b\n\ndef fmt(x):\n    return f"{x:.2f}"\n' > "$d/neg_util.py"
+  printf '# we allow anything here\n// auth is elsewhere\n/* listen( is not called */\n * allow: block-comment body\n-- deny in a SQL comment\nx = 1\n' > "$d/neg_comments.py"
+  printf '\x00\x01\x02binary\x00' > "$d/bin.dat"
+  printf 'set -e\ngit push origin main \\\n  --force\n' > "$d/pos_irrev.sh"
+  printf 'authored_by = "x"\nallowance = 3\nauthor = "y"\n' > "$d/neg_boundary.py"
+  printf 'int f(int *allow) {\n  *allow = 1;\n  return 0;\n}\n' > "$d/pos_star.c"
+  printf 'def t():\n    """docstring\n    PASS allow true — fail-safe 계통은 봉인\n    """\n    return 1\n' > "$d/neg_docstring.py"     # pmh-dev #76
+  printf 'def t():\n    """docstring\n    PASS allow true\n    """\n    return Verdict.ALLOW\n' > "$d/pos_after_docstring.py"
+  scan_one "$d/pos_exposure.ts" >/dev/null; rc_pos=$?
+  scan_one "$d/pos_verdict.py"  >/dev/null; rc_pos2=$?
+  scan_one "$d/neg_util.py"     >/dev/null; rc_neg=$?
+  scan_one "$d/neg_comments.py" >/dev/null; rc_cmt=$?
+  scan_one "$d/bin.dat"         >/dev/null; rc_bin=$?
+  scan_one "$d/pos_irrev.sh"    >/dev/null; rc_irr=$?
+  scan_one "$d/neg_boundary.py" >/dev/null; rc_bnd=$?
+  scan_one "$d/pos_star.c"      >/dev/null; rc_star=$?
+  scan_one "$d/neg_docstring.py" >/dev/null; rc_doc=$?
+  scan_one "$d/pos_after_docstring.py" >/dev/null; rc_doc2=$?
+  [ "$rc_pos" -eq 0 ]  && echo "  ✅ known-positive exposure (listen()) → GATE-SHAPED"      || { echo "  ❌ known-positive exposure rc=$rc_pos"; fails=1; }
+  [ "$rc_pos2" -eq 0 ] && echo "  ✅ known-positive verdict (ALLOW/DENY) → GATE-SHAPED"    || { echo "  ❌ known-positive verdict rc=$rc_pos2"; fails=1; }
+  [ "$rc_neg" -eq 1 ]  && echo "  ✅ known-negative util (docstring 'Pass') → NOT"          || { echo "  ❌ known-negative util rc=$rc_neg"; fails=1; }
+  [ "$rc_cmt" -eq 1 ]  && echo "  ✅ comment-only mentions (#, //, /*, ' * ', '-- ') → NOT"                            || { echo "  ❌ comment-only rc=$rc_cmt"; fails=1; }
+  [ "$rc_bin" -eq 3 ]  && echo "  ✅ binary → UNSCANNABLE (not a silent miss)"              || { echo "  ❌ binary rc=$rc_bin"; fails=1; }
+  [ "$rc_irr" -eq 0 ]  && echo "  ✅ known-positive irreversible (continued --force line) → GATE-SHAPED" || { echo "  ❌ known-positive irrev rc=$rc_irr"; fails=1; }
+  [ "$rc_bnd" -eq 1 ]  && echo "  ✅ boundary: author/authored/allowance → NOT"                || { echo "  ❌ boundary rc=$rc_bnd"; fails=1; }
+  [ "$rc_star" -eq 0 ] && echo "  ✅ code line starting with *allow (not a comment) → GATE-SHAPED" || { echo "  ❌ star-code rc=$rc_star"; fails=1; }
+  [ "$rc_doc" -eq 1 ]  && echo "  ✅ multi-line docstring interior ('PASS allow') → NOT (pmh-dev #76)" || { echo "  ❌ docstring interior rc=$rc_doc"; fails=1; }
+  [ "$rc_doc2" -eq 0 ] && echo "  ✅ control: real verdict line AFTER the docstring → GATE-SHAPED"   || { echo "  ❌ after-docstring rc=$rc_doc2"; fails=1; }
+  /bin/rm -rf "$d"
+  [ "$fails" -eq 0 ] && { echo "SELFTEST: PASS"; return 0; } || { echo "SELFTEST: FAIL"; return 3; }
+}
+
+[ $# -ge 1 ] || { echo "usage: $0 <file> [file ...] | --selftest" >&2; exit 3; }
+[ "$1" = "--selftest" ] && { selftest; exit $?; }
+ANY=0; UNS=0
+for f in "$@"; do scan_one "$f"; rc=$?; [ "$rc" -eq 0 ] && ANY=1; [ "$rc" -eq 3 ] && UNS=1; done
+if [ "$UNS" -eq 1 ]; then
+  [ "$ANY" -eq 1 ] && echo "GATE-SHAPED in the scannable files —"
+  echo "UNSCANNABLE — ≥1 file could not be classified; decide those by hand. Exit 3 dominates any hit (never a silent miss)"; exit 3
+elif [ "$ANY" -eq 1 ]; then echo "GATE-SHAPED — run degrade-lint + cross-family before a merge verdict"; exit 0
+else echo "NOT-GATE-SHAPED (by identifier; the task's own naming is a separate manual escalation)"; exit 1; fi

package/scripts/selfcheck.sh

@@ -418,6 +418,55 @@ else
   fail=1
 fi
 
+# doc-claim triad (bridge ①) — a doc that says «A uses B» where A never executes B.
+# Subject = scripts/doc_claim_triad_scan.py (review surface, not a verdict). Wired in the same
+# commit that created its lane, because lane_runner_check.sh rejects an undeclared unwired suite —
+# and adding it to DEBT instead would be the regrowth that file exists to stop.
+if [ ! -f scripts/doc_claim_triad_scan.py ]; then
+  _absent_subject_verdict "doc-claim triad lanes" "scripts/doc_claim_triad_scan.py" || fail=1
+elif [ -f scripts/test_doc_claim_triad_lanes.sh ]; then
+  if ! bash scripts/test_doc_claim_triad_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  doc-claim triad lanes: doc_claim_triad_scan.py present but its anchor is missing"
+  fail=1
+fi
+
+# typed-finding pipeline — fleet (multi-family, parallel) + reject stage (cross-family verdict, code
+# drops false positives). Subject = scripts/finding_fleet.sh + scripts/finding_verify.py.
+if [ ! -f scripts/finding_verify.py ]; then
+  _absent_subject_verdict "finding pipeline lanes" "scripts/finding_verify.py" || fail=1
+elif [ -f scripts/test_finding_pipeline_lanes.sh ]; then
+  if ! bash scripts/finding_fleet.sh --selftest >/dev/null 2>&1; then
+    echo "FAIL  finding fleet selftest: known-pair calibration failed"; fail=1
+  fi
+  if ! bash scripts/test_finding_pipeline_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  finding pipeline lanes: scripts present but their anchor is missing"
+  fail=1
+fi
+
+# gate-shape classifier — the mechanical half of the unmapped-file trigger of the Field-Harness
+# Load-Bearing Change Gate (2026-09-08). A classifier of scope, not a verdict; its lane holds the
+# known-pair (exposure/verdict positives · util/comment negatives · Promise reject( FP anchor).
+if [ ! -f scripts/gate_shape_scan.sh ]; then
+  _absent_subject_verdict "gate-shape lanes" "scripts/gate_shape_scan.sh" || fail=1
+elif [ -f scripts/test_gate_shape_scan_lanes.sh ]; then
+  # direct dispatch of the subject's own selftest (caller surface for the ratchet), then the lane
+  if ! bash scripts/gate_shape_scan.sh --selftest >/dev/null 2>&1; then
+    echo "FAIL  gate-shape selftest: known-pair calibration failed"; fail=1
+  fi
+  if ! bash scripts/test_gate_shape_scan_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  gate-shape lanes: gate_shape_scan.sh present but its anchor is missing"
+  fail=1
+fi
+
 # package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
 # ref-path check below: that one asks "does this path exist at all", this one asks "does the
 # CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were
@@ -663,6 +712,7 @@ for _pair in \
   "plugins/fh-commons/skills/preprep/lane_adjacent_dup.py|scripts/test_preprep_adjacent_dup_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_promise.py|scripts/test_preprep_promise_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_slide_refs.py|scripts/test_preprep_slide_refs_lanes.sh" \
+  "plugins/fh-commons/skills/preprep/lane_font.py|scripts/test_preprep_font_lanes.sh" \
   "plugins/fh-commons/skills/preprep/SKILL.md|scripts/test_preprep_drift_anchor.sh" \
   "scripts/test_preprep_drift_anchor.sh|scripts/test_preprep_drift_anchor_lanes.sh" \
   "scripts/field_canon_preload.sh|scripts/test_skill_canon_preload_lanes.sh" \

package/scripts/test_doc_claim_triad_lanes.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# test_doc_claim_triad_lanes.sh — scripts/doc_claim_triad_scan.py 회귀 앵커.
+#
+# 🟥 이 레인이 지키는 것은 «숫자»가 아니라 «판별력»이다. 그 계기는 세션 중 세 번 뚫렸고
+#    (공존≠관계 · 방향 미해결 · 나열 통과) 세 번 다 손검증이 잡았다. 레인은 그 셋이
+#    되돌아오는지를 본다 — 픽스처는 실제로 뚫렸던 표기를 그대로 쓴다.
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"; ROOT="$(dirname "$HERE")"
+SCAN="$HERE/doc_claim_triad_scan.py"
+PASS=0; FAIL=0
+ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+no(){ FAIL=$((FAIL+1)); printf '  ❌ %s — %s\n' "$1" "${2:-}"; }
+
+echo "── test_doc_claim_triad_lanes ──"
+
+# L1 — 파일 실재 + 실행 가능
+[ -f "$SCAN" ] || { no "L1 파일 실재" "$SCAN 없음"; echo "FAILED=1"; exit 1; }
+python3 -c "import ast,sys;ast.parse(open(sys.argv[1],encoding='utf-8').read())" "$SCAN" >/dev/null 2>&1 \
+  && ok "L1 구문" || no "L1 구문" "ast.parse 실패"
+
+# L2 — 계기 보정이 통과한다 (양쪽 절반)
+OUT=$(python3 "$SCAN" --selftest "$ROOT" 2>&1); RC=$?
+[ "$RC" -eq 0 ] && ok "L2 selftest rc=0" || no "L2 selftest" "rc=$RC"
+printf '%s' "$OUT" | grep -q "주장 추출기" && ok "L2b 추출기 보정 실행됨" || no "L2b 추출기 보정" "절이 없다"
+printf '%s' "$OUT" | grep -q "실행 판별기" && ok "L2c 실행판별 보정 실행됨" || no "L2c 실행판별 보정" "절이 없다"
+
+# L3 — 🟥 나열을 주장으로 세지 않는다 (v1 이 뚫린 자리, 실제 표기)
+python3 - "$SCAN" <<'PY' && ok "L3 나열 거부" || no "L3 나열 거부" "나열이 주장으로 셰짐"
+import importlib.util,sys
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+A,B="scripts/foo.sh","scripts/bar.sh"
+# 🟥 cross-family codex [B]: 가운뎃점·백틱·쉼표만 막으면 «and/plus/인용부호» 로 뚫린다.
+# 그 표기를 픽스처에 넣는다 — 실제로 CATALOG.md:137 이 `X (pre-commit) and Y (pre-push)` 였다.
+lists=[f"**File:** {A} · {B} · templates/.git-hooks/pre-commit",
+       f"Fixtures: `{A}` · `{B}`.", f"Anchors: `{A}`, `{B}`",
+       f"Anchors: `{A}` and `{B}`", f"see `{A}` plus `{B}`",
+       f'"{A}" "{B}"']
+sys.exit(0 if not any(m.asserts_relation(l,A,B) for l in lists) else 1)
+PY
+
+# L4 — 관계 주장은 잡는다 (한/영 둘 다 — 언어 중립 요구)
+python3 - "$SCAN" <<'PY' && ok "L4 관계 포착(한·영)" || no "L4 관계 포착" "관계를 놓쳤다"
+import importlib.util,sys
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+A,B="scripts/foo.sh","scripts/bar.sh"
+rel=[f"{A} 는 {B} 를 호출한다", f"`{A}` is wired into `{B}`", f"the hook {A} blocks by running {B}"]
+sys.exit(0 if all(m.asserts_relation(l,A,B) for l in rel) else 1)
+PY
+
+# L5 — 🟥 실행 vs 언급. 실제로 뚫렸던 표기(grep 대안식 안의 `name)\.sh`)를 픽스처로 쓴다
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+cat > "$TMP/hook_exec.sh" <<'EOF'
+#!/usr/bin/env bash
+bash "$REPO_ROOT/scripts/target_thing.sh" "$REPO_ROOT"
+EOF
+cat > "$TMP/hook_mention.sh" <<'EOF'
+#!/usr/bin/env bash
+# target_thing.sh is only named here, never run
+git diff --name-only | grep -E '(scripts/(other|target_thing)\.sh)' || true
+EOF
+# 🟥 cross-family codex [A]: 출력 구문 안의 인터프리터 호출은 «실행처럼 보이지만» 아무것도 안 돌린다
+cat > "$TMP/hook_echo.sh" <<'EOF'
+#!/usr/bin/env bash
+echo "run it yourself:  bash scripts/target_thing.sh"
+EOF
+python3 - "$SCAN" "$TMP" <<'PY' && ok "L5 실행/언급 판별" || no "L5 실행/언급 판별" "둘을 못 가른다"
+import importlib.util,sys,os
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+t=sys.argv[2]
+v1,_=m.executes(os.path.join(t,"hook_exec.sh"),"target_thing.sh")
+v2,_=m.executes(os.path.join(t,"hook_mention.sh"),"target_thing.sh")
+v3,_=m.executes(os.path.join(t,"hook_echo.sh"),"target_thing.sh")
+sys.exit(0 if (v1=="EXECUTES" and v2=="MENTIONS-ONLY" and v3=="MENTIONS-ONLY") else 1)
+PY
+
+# L6 — 🟥 보정 실패 시 «스캔을 거부»한다 (fail-closed). 뮤턴트로 확인하고 되돌린다
+CP="$TMP/mutant.py"; cp "$SCAN" "$CP"
+python3 - "$CP" <<'PY'
+import sys
+p=sys.argv[1]; L=open(p,encoding="utf-8").read().split("\n")
+i=[k for k,l in enumerate(L) if l.startswith("def asserts_relation(")][0]
+L.insert(i+1,"    return True  # MUTANT: 모든 것을 주장이라 한다")
+open(p,"w",encoding="utf-8").write("\n".join(L))
+PY
+MOUT=$(python3 "$CP" --selftest "$ROOT" 2>&1); MRC=$?
+[ "$MRC" -eq 2 ] && ok "L6 뮤턴트 → rc=2 거부" || no "L6 뮤턴트 거부" "rc=$MRC (기대 2)"
+MS=$(python3 "$CP" "$ROOT" 2>&1); MSRC=$?
+[ "$MSRC" -eq 2 ] && ok "L6b 뮤턴트는 스캔도 거부" || no "L6b 뮤턴트 스캔거부" "rc=$MSRC (기대 2)"
+
+# L8 — 🟥 known-pair 가 «낡으면» 보정이 실패한다 (cross-family codex [S]).
+#      B 가 삭제·이동돼도 A 가 이름만 언급하면 통과하던 자리.
+cat > "$TMP/fakeroot_probe.py" <<'PY8'
+import importlib.util,sys,os
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+sys.exit(0 if m.resolve(sys.argv[2], "scripts/zzq_nonexistent_target.sh") is None else 1)
+PY8
+python3 "$TMP/fakeroot_probe.py" "$SCAN" "$ROOT" && ok "L8 부재 대상은 resolve=None" || no "L8 resolve" "없는 파일을 찾았다고 했다"
+
+# L7 — 🟥 «진짜» 되돌림: 원본 자리에 뮤턴트를 넣었다 뺀다. 빨강→초록 전이를 본다
+cp "$SCAN" "$TMP/orig_backup.py"
+python3 - "$SCAN" <<'PY7'
+import sys
+p=sys.argv[1]; L=open(p,encoding="utf-8").read().split("\n")
+i=[k for k,l in enumerate(L) if l.startswith("def asserts_relation(")][0]
+L.insert(i+1,"    return True  # MUTANT-INPLACE")
+open(p,"w",encoding="utf-8").write("\n".join(L))
+PY7
+python3 "$SCAN" --selftest "$ROOT" >/dev/null 2>&1; INJ=$?
+cp "$TMP/orig_backup.py" "$SCAN"
+python3 "$SCAN" --selftest "$ROOT" >/dev/null 2>&1; RST=$?
+LEFT=$(grep -c "MUTANT-INPLACE" "$SCAN" || true)
+if [ "$INJ" -eq 2 ] && [ "$RST" -eq 0 ] && [ "$LEFT" -eq 0 ]; then
+  ok "L7 되돌림 전이 (주입 rc=2 → 복원 rc=0, 잔존 0)"
+else
+  no "L7 되돌림 전이" "주입rc=$INJ 복원rc=$RST 잔존=$LEFT"
+fi
+
+echo "── PASS=$PASS FAIL=$FAIL ──"
+[ "$FAIL" -eq 0 ] || { echo "FAILED=1"; exit 1; }
+echo "FAILED=0"