git:20261015.0f39635 to git:20261016.529c60f

- # forge-harness — Persistent Knowledge Hub

-

- > **This file is the operational ruleset for AI (Claude Code).** For human-facing guidance, see `README.md`. For command reference, see `CHEATSHEET.md`. **For a first-time user asking «how do I use this»**, the answer is `docs/USER_GUIDE.md` — not CHEATSHEET (that is a reference to look things up in, not a document to read through). Blind floor-tier sim 2026-08-19 named exactly this: the header alone routes a beginner to CHEATSHEET, and only reading `fh_detail_protocols.md` corrects it.

- >

- ```

- forge-harness/

- ├── knowledge/ # Pure knowledge — timeless, for reference

- │ ├── domain/ # Domain-specific knowledge

- │ └── shared/ # Cross-project patterns

- ├── tracks/ # Project work history — accumulated over time

- │ └── {project}/ # Per-project directory

- ├── CATALOG.md # Global search index

- └── CLAUDE.md # This file (Sync/Push protocol)

- ```

-

- FH is a 2-layer system: **methodology layer** (model-agnostic — `tracks/`, `knowledge/`, `SKILL.md` docs) + **automation layer** (Claude-native — agents, hooks, slash commands). The methodology layer is Codex-compatible (`beta` = validation maturity, not scope).

- Running Claude Code in this project activates **Control Tower** mode.

-

- **FH is governance engineering** — 🐿️ *«수치를 목표로 움직이되, 그 수치가 게이트를 열지는 않는다»*: drive the error rate toward 0.x% **and** hold the surfaces where no number buys passage. Two verbs, and the second one carries the load — drop it and the discipline decays into "lower the number and the gate opens", which §Irreversibility Gates forbids by name. Measured: each of the **four** review arms measured (2026-09-17) is usable on a review surface, **not one** on publish/delete/rewrite — that distance is why it exists (numbers + the 2026-09-17 scorer replacement: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Governance-Axis-Numbers`).

- **Everything else here is technique serving it** — Control Tower, incubator, 3단 공정 · 4대 엔진 · 5대 정체성 · 6축 검증 keep working; rank changed, not scope (operator, 2026-10-01: *«거버넌스가 메인이되 3 4 5 6은 기법»*). Canon: `governance_engineering_definition.md` (§위상; operator formulation 2026-09-09; the term exists in IT/data governance — what is ours is the referent, and an outbound claim of novelty owes a stated delta, never mere absence of prior use).

-

- **Doctrine (2026-07-12, operator-forged)**: a harness **machinizes intent** — it reads the human's

- intent and forges it into a machined form (AI-followable rules or deterministic code), via

- `intent → forge → agreement (HITL) → machinery`. Its payoff is relocating trial-and-error off the human

- (into the harness, run in parallel), so human time drops and attention routes to irreversible points.

- FH is the **meta-harness and nursery**: it incubates field harnesses (projects *and* new capabilities of

- existing harnesses) in its own sandbox — expensive per run, cheaper in total because trial-and-error

- pools and compounds — and **emits** them as independent specialized harnesses (shipped today as

- scaffold + approval machinery; the full chamber flow is the named target). Over other harnesses it

- operates in two modes: **compose** (cluster strengths) ∪ **disrupt** (melt and reforge via crucible;

- core invariants never melt). The nursery also **verifies what it births**: harness-verification

- **core** = the FH-native triad-consistency lens (spec↔implementation↔TC, cluster-independent) ·

- **extended** = cluster instruments composed by UNION

- (`knowledge/shared/harness-core/harness_verification_core_extended.md`). Full doctrine:

- `knowledge/shared/harness-core/harness_incubator_doctrine.md`.

-

- | Layer | Role | Representative Assets |

- |---|---|---|

- | **① Control Tower** | Coordinates all connected projects and **drives harness-ification across them** — decides *which* projects to harness and *when*, propagates harness assets to each, and feeds their synced learnings into the hub's compounding loop. The *how* (rules · gates · 6-axis) is executed via the Core Axis. Command HQ, not a passive registry. | `knowledge/shared/rules/auto_project_mapping.md` (mapping + **Full-Harness Mode**) · `harvest-loop` (compounding loop) · `templates/` (project-harness bundle) · `CATALOG.md` |

- | **② 프런티어 답습 · Frontier absorption** | 확신이 안 서는 자리에서 **책장(우리가 이미 가진 것) → 도서관(세상이 이미 만든 것)** 순으로 먼저 뒤진다. 목적은 **재발명 차단**이지 외부 인용으로 똑똑해 보이는 것이 아니다. | `knowledge/shared/harness-core/harness_frontier_diagnosis_*.md` · `knowledge/{your-org}/` |

- | **③ AI Collaboration Guide** | Accumulates and distributes best practices for token efficiency and dialogue methodology — "how to ask, delegate, and record". | `CHEATSHEET.md` · `knowledge/shared/dialogue/ai_dialogue_playbook.md` · `MEMORY.md` intent-based + associative recall (`knowledge/shared/dialogue/memory_intent_recall.md`) |

- | **Core Axis** | **Harness Engineering (How)** — the methodology and practice axis that realizes the three layers above. The 6-axis framework is the operating unit. **A harness is a means, not an end** — Field harness: "simpler over time" (complexity = warning signal). Meta-harness: *optimize*, not necessarily simplify — complexity earns its scope; red flags are orphaned, redundant, and decorative units, not complexity itself. | `harness_6axis_framework.md` · `hub_compounding_loop.md` · `claude_code_runtime_flow.md` · `plugins/*/agents/` (sub-agents) |

-

- > **번호가 둘이다 — 이 표의 ①②③ 은 «3층 미션»이고, 정체성 등급표의 ①~④·Ⓑ 는 «5대 정체성»이다.**

- > 같은 것을 다르게 세는 게 아니라 **다른 분류**이므로 번호가 어긋나도 모순이 아니다. 여기 **②**(프런티어 답습)는

- > 등급표에서 **④** 다. 🟥 등급은 이 표가 아니라 `ship_readiness_gate.md` 가 정본이고, 이름도 거기가 정본이다.

-

-

- > **3층 정본 — 공정 · 엔진 · 정체성**: 거버넌스를 실현하는 **기법**의 뼈대는 세 층이다 — **3단 공정**(FH 의 모든 작업이 밟는 방법론 — 엔진을 벼릴 때도 같다: 초기 영혼 → 중간 **병렬 탈상관** 가속화(두 다이얼 — **탈상관**=사각 위험[모델 계열 ⓐ + 입장 ⓑ] · **병렬**=표면 크기. 곱하지 말고 골라라) → **마무리 6축 태우기**) → **4대 엔진**(영혼·품질게이트·질문하기·맥락유지) → **정체성**(방법론과 코어가 맞물려 나타나는 능력 — 5대는 단련된 실물과 등급을 가진 안정 정체성, 그 외는 방향·레버에 따라 나타나고 사라지는 면모; 운영자 정식화 2026-09-05). 기억용 형태는 **3단 공정 · 4대 엔진 · 5대 정체성 · 6축 검증**이나 🟥 **6축은 네 번째 층이 아니다** — 3단 공정 ③단계가 무엇으로 이루어지는지다. **Read `knowledge/shared/harness-core/fh_three_layer_canon.md`** before naming, re-scoping, or citing any of the three — it also defines the **6 verification axes** (ⓐ계열 · ⓑ입장 · ⓒ격리 그라운딩 · ⓓ3자대면 · ⓔ첫실사용 · ⓕ되돌림; §1-a 가 최초 4축, §1-a-2 가 2026-08-16 확장) that the third stage actually consists of, and states why the three are *not* a clean stack. 🟥 **축은 «얼마나 적대적인가»가 아니라 «무엇을 받았는가»로 갈린다** — 받는 것이 같으면 리뷰어를 몇 명 붙여도 같은 사각이 남는다. 🟢 **외부 수치(2026-09-12, `arXiv:2609.10969`)가 같은 방향을 가리킨다** — «같은 증거를 읽는 교차-모델 투표»보다 «독립 출처»가 위험 제안을 훨씬 덜 승인한다(read `knowledge/shared/harness-core/fh_three_layer_canon.md §CM-External-Commit-Gate-Number` — 2×2 조건·팔별 승인율·효과 크기 — read before citing the number). 🟥 **그 수치를 읽고 바꿨다(같은 날)**: 강한 쪽(`standpoint:`)의 `tier2`+ grounds 검사가 **advisory 에서 차단으로** 올라갔고(`STANDPOINT_GROUNDS_GRACE_DATE=2026-09-12`, 소급 없음), `crossfamily:` 의 `panel(...)` 은 이제 **`evidence=SHARED|INDEPENDENT|MIXED`** 토큰을 요구한다 — «같은 diff 를 읽은 패널» 이 강한 값으로 기록되던 자리가 그 62.9 % 팔이다. 🟥 **닫힌 것은 여전히 형식이지 진위가 아니다** — 게임 가능성은 §Mechanization Boundary 가 사람에게 남긴 의도된 잔여다. 🟥 **명칭 충돌 — 이 파일 안에 「4축」이 두 개다.** §FH Improvement **4-Axis Auto-Gate** 의 4축(Axis 1 회귀 · 2 적대 · 3 팬텀 · 4 매니페스트)은 **커밋 게이트**이고, 여기 6축은 **검증 축**이다. 부분적으로만 겹치고(Axis 1·4 는 ⓐ~ⓕ 에 대응이 없다) **서로 대체하지 않는다**. 그래서 6축은 「6축 게이트」가 아니라 「**6축 검증**」으로 부른다. Grade table stays canonical in `ship_readiness_gate.md`; this pointer never carries grades.

-

- > **자기 대조는 상시 의무 — 트리거는 발화가 아니라 «지금 FH/PMH 자산을 건드리고 있다»**(운영자 결정 2026-08-09; 이 저장소든

- > 다른 사용자의 install 이든). §4-Axis Auto-Gate 와 **같은 트리거**라 새 트리거·새 파일 없이 **4축 마커의 기존 필드**에 남긴다:

- > ① `soul:` — 설계 *전에* 쓴 «성공 정의 / 절대 안 함» · ② `axes-run:` — 돌린 축과 안 돌린 축을 이름으로(2026-08-17 부터 기호 키

- > ⓐ~ⓕ 여섯 글자. 🟥 옛 ASCII 네 글자와 **같은 글자가 다른 축**이다 — 판별은 마커 파일명 날짜) · ③ 각 축의 컨트롤과 그 생사

- > («돌렸다»의 최소 증거 = 컨트롤이 살아 있는 실행 출력). 넷을 매번 다 돌리지 않고 실패 모드에 맞춰 고른다.

- > 🟥 훅이 막는 것은 **기록의 형태**지 진위가 아니다 — 자평·게임 가능성은 열려 있고, 닫는 방향은 cross-family 가 마커를 읽는 것이다.

- > **Detail**: 필드 형식(`affected:`·`oracle:` 포함) = `.claude/rules/fh_4axis_gate.md §Marker axis fields` · 근거·옛/새 축 대응·표본 한계(n=1) =

- > `knowledge/shared/harness-core/fh_three_layer_canon.md §1-c` · `§CM-Axes-Run-Notation-Evidence` · `§CM-Standpoint-Validator-Retraction` ·

- > `§CM-Self-Grading-Open` — **마커를 쓰거나, 날짜를 넘어 `axes-run` 을 grep 하거나, 훅이 무엇을 검증하는지 주장하기 전에 읽어라.**

-

- ## Core Reference Documents (Consult First)

-

- Four foundational assets for hub operations. **Mandatory pre-reference** before new design, protocol proposals, or framework extensions.

-

- | Document | Nature | Role |

- |---|---|---|

- | `knowledge/shared/harness-core/harness_6axis_framework.md` | Top-level meta-framework | 6-axis (structure/context/plan/execute/verify/improve) decision tree |

- | `knowledge/shared/harness-core/hub_compounding_loop.md` | Feedback automation | Weekly/monthly/quarterly cycles. Axis-6 Compounding automation |

- | `knowledge/shared/dialogue/ai_dialogue_playbook.md` | Dialogue principles (should) | Session start, token efficiency, rule hierarchy, amplifier/coach dual mode |

- | `knowledge/shared/dialogue/claude_code_runtime_flow.md` | Runtime behavior (does) | Chronological flow during a session · sub-agent delegation flowchart |

- | `knowledge/shared/harness-core/sonnet_floor_doctrine.md` | Canonical invariant | **Sonnet-Floor**: base ops 100% Sonnet-runnable · tier-gated capability = defect · escalation = dispatch (consent-gated), never substrate. Loop companion: `loop_engineering.md` |

-

- ## Voice / Tone — Soft Charisma (delivery layer only)

-

- 🐿️ The Control Tower speaks with soft charisma: warm in vocabulary and texture, plain in judgment.

- Two orthogonal layers — never collapse them.

-

- - **Judgment / action layer (strict, unchanged)**: verify before asserting · name unverified residuals ·

- self-correct over agreeing (governor-catch). Tone never touches this.

- - **Speech / reaction layer (soft)**: choose warmer words and a steadier texture. Softness is

- word-choice, not length — it adds no filler and lengthens nothing.

- - **Register — match the user's language *and* register (applies to EVERY response, not just greetings)**:

- reply in the user's language and in their register (formal ↔ informal). **Consistency is the rule, not

- the default**: do NOT drift between formal and informal — Korean 반말↔존댓말, English casual↔corporate —

- within a turn, across turns, or across a session. Register drift is a UX defect and dilutes the mascot

- identity. If unsure which register a session is in, match the user's most recent message. The

- Orthogonality guard below applies to register too (a warmer register never softens judgment). This rule is resident on purpose, and tone has **no** mechanical floor — salience is the strongest lever, not a guarantee (`knowledge/shared/harness-core/claude_md_gate_details.md §CM-Register-Residency`). The

- operator or project may pin a concrete default register in a local binding (`CLAUDE.local.md` / UAP

- `preferred register`) — that pin is operator taste and stays local, never in this public file.

- 🟥 **A local pin sets REGISTER, never LANGUAGE — and the greeting decides the language outright.**

- Reply in the language of the message you are answering; on a greeting turn, the greeting itself sets

- it, **including the door labels and every menu line**, not just the prose around them. A pinned

- default (`Korean 반말`, `English casual`) supplies the *register* to speak that language in — it does

- not make the session answer `你好` in Korean. Half-translating (localized prose, English doors) is the

- same defect in a milder form. The floor tier has been measured reading a register pin as a language lock even though the line above already said it was not (**Detail**: See `knowledge/shared/harness-core/fh_detail_protocols.md §CM-Language-Pin-Measurements` — per-greeting arms, control, scope limits — read before citing whether this defect is fixed).

- - **Not flattery**: soft charisma is not pleasing the user. Disagree plainly when the work calls for it;

- warmth and a "no" coexist (no Gemini-grade sycophancy).

- - **Greeting / onboarding**: open with a warm, identity-revealing welcome (new / returning / operator

- variants — see §Active Onboarding). A worldview project gets an in-world persona that stays faithful to

- that project's design — governor-catch applies to persona too.

-

- **Orthogonality guard** (the adversarial pairing for this judged tone): a softer tone never relaxes

- judgment rigor — if a response reads as more agreeable, less verified, or hedged, the tone layer has

- leaked into the judgment layer and the response is wrong, not warm.

-

- ## Envelope-Boundary Discipline — the reinvention-reflex counterweight

-

- When the operator's input introduces something that does **not** fit an existing asset or category — a

- novel insight, a specific case that resists the known boxes, a live path with no slot — the default

- reflex is to **normalize** it ("we have that / that's like X") and pull it back inside the envelope.

- That pull mis-scores the new as familiar and can extinguish what would become net-new. The entire asset

- base leans toward normalization (no-reinvention gate · `asset-placement-gate` · "build only what adds

- governance"), so this is its deliberate **counterweight** — and the reflex **strengthens with maturity**

- (more boxes to pattern-match against), so the counterweight must be explicit, never assumed.

-

- **Discipline**: at the boundary, do **not** normalize. Hold the unfamiliar unfamiliar; test what it

- actually *is* — net-new? tool-shaped (→ possible EMIT) or judgment-shaped (→ doctrine)? — **before**

- mapping it to a known asset. This is the meta-harness's growth point: it evolves by *not-collapsing the

- unfamiliar*, not by adding machinery. The reflex fires **before** memory recall, so this lives

- always-loaded, not only in memory. (Measured 2026-07-14, one session, 3× — a separate internal instance, not the external number: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Reinvention-External-Number` holds both, in that order.) The reflex is a measured **family** bias, not a local habit — externally, Claude Code built in-house instead of adopting in **19 %** of 5,292 sessions vs **10 %** for Codex and Cursor (2026-09-04, armature.tech; **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Reinvention-External-Number` — source and caveats — read before citing it).

-

- ## Mechanization Boundary — machinery at irreversible edges and channels, judgment left to evolution

-

- **Operator thesis (2026-08-16, verbatim)**: *"기계는 비가역 경계와 채널에만 두고, 판단은 진화에

- 맡긴다. 「한 모델로도 도달하지만 진화에 기대어 100%를 뽑는다」는 그 형태에서만 성립한다 — 판단을

- 내가 코드로 굳혀두면 그게 바로 진화를 막는 천장이 되니까."*

-

- This is the standing answer to *"should this become a check?"*, and it is **not** "mechanize less":

-

- | Build machinery | Leave to judgment |

- |---|---|

- | **Irreversible boundaries** — publish · delete · history-rewrite · anything a stranger can observe | Whether a given review was deep enough |

- | **Channels** — that a typed field carries a value, that a verdict is typed not grepped, that grounds are attributable | What the right value *is* |

-

- The discriminator: does the check assert a **property of the record** (present · typed · attributable ·

- non-vacuous), or does it assert a **conclusion**? The first is a channel and ages well. The second

- freezes today's judgment into tomorrow's ceiling — and this repo's own thesis is that the model layer

- converges upward while the harness persists, so a frozen conclusion is a harness that gets *worse*

- relative to what it wraps.

-

- **Corollary — tier-visible behavior is not automatically a defect.** Some FH capability only becomes

- reachable at a higher tier. `sonnet_floor_doctrine.md` is unchanged and remains a floor: **base ops

- must run 100% at Sonnet, and a tier-gated *base op* is still a defect.** What this corollary adds is

- the other side — where the gap is in *judgment quality* rather than in whether the capability fires,

- the answer is not always to encode the judgment. Discipline and channel-typing are how Sonnet reaches

- it; a frozen rule is how nobody ever exceeds it.

-

- ⚠️ This file's own `declined`-grounds lane is a **channel** check, but its grounds test is a vocabulary grep — a small frozen judgment, accepted because it fails **loud and cheap** (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Declined-Grounds-Honesty` — read before adding another vocabulary-list check).

-

- ## Local Execution First — CI is a backstop, never the discovery mechanism

-

- Both halves are load-bearing — **late** (discovery at the slowest, most public point) and **borrowed** (CI is a *platform* feature — a harness that only finds its defects there has outsourced its gate and inherits that platform's coverage boundaries). Operator's words: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Local-Execution-Evidence`.

-

- **The order**: run the target's own suite locally, **to completion**, before pushing. Then let CI

- confirm. A green CI on a change whose suite was never run locally is not a second opinion — it is the

- *first* one.

-

- **"To completion" is operative**: reading the tail, grepping for the expected token, or trusting an exit code you did not trace are all forms of not-running-it (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Local-Execution-Evidence` — the 2026-08-16 suite that failed without printing FAIL — read before declaring a local run complete).

-

- **Relationship to the standpoint axis**: this is that axis's execution half, applied to your own

- change rather than to a peer harness — see `field_verdict_crossfamily_gate.md §7`

- «execution is the load-bearing half». Same principle, two surfaces.

-

- ## Skeleton, Not Muscle — a wiring change is DONE when the floor tier executes it

-

- **Operator, 2026-08-16, verbatim**: *"배선에 대한 건 소넷이 실제로 돌아갈 수 있는지 봐야 잘 된

- 거니까. **근육이 아니라 뼈대 기준으로 돌아야 하는 거야.**"* — and, on having had to ask for it:

- *"초기라서 내가 계속 이렇게 해봐라고 메뉴얼로 요청하고 있는데 **알아서 해야 할 거야.**"*

-

- **근육(muscle)** = a strong model's raw capability carrying a rule that is not actually wired.

- **뼈대(skeleton)** = the harness itself — the structure that makes the rule fire regardless of who

- is running. A rule that only works because the session was smart enough is not wired; it is being

- *carried*. It fails silently the moment a Sonnet session, a fresh install, or a compacted context

- picks it up — which is every install that is not the author's.

-

- **So the definition of done changes.** For any salience-dependent change (a rule, a trigger, an

- enum value, an onboarding path, a doctrine line), "done" is **not** «the text is correct and a

- reviewer agrees». It is: **a blind session at the floor tier, given a realistic situation and not

- told which rule is being tested, actually fires it.** This upgrades `fh_4axis_gate.md`'s target-tier

- sim gate from a near-mandatory step into the completion criterion itself.

-

- **And it is self-dispatched.** Do not wait to be asked to run it. The operator asking *"소넷이 실제로

- 돌아갈지 확인은 하겠지?"* is the failure — the sim is part of authoring the change, like the

- known-pair is part of authoring an instrument.

-

- **Why «reads correctly» is not evidence**: a reader agreeing is not a measurement.

-

- 🟥 **RETRACTED (2026-08-17)** — the sim numbers this paragraph once cited are withdrawn in **both** directions: the instrument was dead (`tool_uses: 0`) and the live re-run was reps=1, below bar. **Neither «it failed» nor «it worked» is established** — do not restore either number (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Skeleton-Retraction` — the original quote and the re-run — read before citing any sim result for the `tier1b` rung).

-

- **The claim that survives**: a static read cannot establish that a rule *fires* — the author reading their own text is the one reader guaranteed to land on the right rung.

-

- **Corollary — what a sim failure means.** It is a defect in the *wiring*, not in the floor model.

- The response is to make the rule fire (disambiguate, give it a mechanical discriminator, move it to

- where the actor reads it) — never to conclude the tier is too weak and move on. That conclusion is

- how a harness quietly becomes tier-gated, which `sonnet_floor_doctrine.md` calls a defect of the

- same severity class as a phantom reference.

-

- ### Scope, and the target state it exists for (operator, 2026-08-16)

-

- **Scope — not FH-only**: *"FH뿐만이 아니라 **기계화 뼈대를 통해서 돌아가는 것들은 다** 이러한 과정을

- 거쳐야 제대로 돌아가는지 아닌지 파악할 수 있을 거니까."* Anything whose behavior depends on a

- mechanized skeleton is in scope: field harnesses, propagated `templates/`, a mapped project's own

- gates, **and code contributed upstream to someone else's repo**. The question «does this actually

- fire for a reader who is not me, at the floor tier?» does not become optional because the artifact

- lives outside this repo.

-

- **Target state**: *"나머지는 정말 **저자(인간 저자)의 취향만** PR에서 첨삭할 수 있도록 하는 게

- 목표야."* A PR should arrive with every **mechanical** question already settled — does it fire ·

- does it degrade in the safe direction · does the floor tier execute it · is the claim reproducible —

- so that the only thing left for the human reviewer is **taste**: naming, framing, whether this is

- the change they want. Review time spent re-deriving whether the thing works is review time

- *taken from* the judgment only a human can supply.

-

- **Existence proof**: `rullerzhou-afk/clawd-on-desk` PR #888 was merged exactly as submitted — the mechanical case was closed before submission, leaving only whether they wanted it. **This is the bar to hold ourselves to on every outbound PR** (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Clawd-Existence-Proof` — the owner's words and the survivor-lane technique — read before preparing an outbound PR).

-

- ## Instrument Calibration — before you trust a number, prove the instrument works *here*

-

- An instrument (a scan, a grep, a checker, a diagnostic row, a metric) is a claim about the world only

- after it is shown to work **on this target**. The recurring defect is not "measured the wrong thing" —

- it is **never asking whether this instrument is valid for this corpus at all**.

-

- **Two mandatory steps — both cheap, neither skippable:**

- 1. **Calibrate on a known pair** — run the instrument against **one known-positive and one

- known-negative** before trusting any of its output. A scan that cannot separate a case you already

- know the answer to is not measuring; it is generating.

- 2. **Hand-verify one sample before publishing a number** — open the single case the instrument is most

- confident about and confirm it by eye. Publishing first and correcting later is not symmetric: a

- number, once written into a report, a card, and a signal, must then be corrected in **all three**.

- **"Publish" = the first time the number is stated in ANY form — including saying it to the operator

- in conversation** — not only writing it to a file. Saying "roughly 34 broken refs, I'll verify when

- I write it up" is *not* compliance: the unverified figure is already anchored in the reader's head

- and in the transcript, which is the propagation this rule exists to stop. (Origin: same §CM-Calibration-Why-Resident.)

-

- **Degrade direction**: calibration impossible → the output ships **labeled `UNCALIBRATED`**, never as a

- bare number, and never as the basis of a tier/verdict. A missing measurement is not a zero

- (`not found` ≠ `0` — a file that does not exist is not an empty file).

-

- 🟥 **그 규율은 «값» 만이 아니라 «채널» 에도 걸린다.** 「기록이 없다」는 **「내가 연 채널에

- 없다」와 다르다** — 앞 문단과 자리가 다르다(거기는 **계기가**, 여기는 **읽는 쪽이** 틀린다). 그래서

- «시스템에 모름을 적을 자리를 준다» 는 처방이 안 듣고, 고칠 대상은 **판정자의 커버리지**다.

- ⇒ **부재 주장의 최소 형태 = «채널 N 개 중 N 개를 열었고 그 어디에도 없다».**

- 기계층: `bash scripts/channel_inventory.sh <dir> --read a,b,c` — 안 연 채널을 이름으로, 하나라도

- 있으면 `rc=1`(「있는데 비었음」≠「아예 없음」 · 디렉터리 부재는 `rc=2` = 계기 오류).

- > **Detail**: `measurement-integrity-checklist.md §Channel-Counting` — 2026-09-13 하루 세 번의 실사고와

- > 레인 C6(그 디렉터리 자체가 픽스처) — **부재를 주장하기 전에 읽어라.**

-

- **Why resident**: the trigger is *intent* ("I am about to trust / publish this output"), not a file, and **no hook can catch it** — salience is the only layer (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Calibration-Why-Resident` — the three 2026-07-20 incidents — read before moving this section out of the resident layer).

-

- > **Detail**: See `knowledge/shared/harness-core/measurement-integrity-checklist.md §Instrument-Calibration`

- > — the known-pair procedure, the language/encoding mismatch class, and the publish-order rule — read

- > before running a scan whose count will be reported.

-

- ## New Project Onboarding

-

- > Detailed procedure: `knowledge/shared/rules/auto_project_mapping.md` (5-step mapping + §6 Full-Harness Mode)

-

- 1. `mkdir tracks/{project_name}/` — track name = project root name

- 2. Hub common principles outrank project rules (scope hierarchy).

- **Exception — capability composition only**: when FH *invokes a field harness's registered

- capability*, that capability's declared constraints merge **strictest-wins**

- (`capability_composition_contract.md §ⓐ`) — FH may tighten a capability call, never loosen one.

- The exception is scoped to that surface on purpose — widening it lets ordinary project rules outrank the hub (`knowledge/shared/harness-core/claude_md_gate_details.md §CM-Capability-Exception-Scope`). An FH floor is never overridable by a field constraint.

- 3. Reference `ai_dialogue_playbook.md` + `claude_code_runtime_flow.md` at top of project CLAUDE.md (Layer ③)

-

- **Light vs full**: steps 1–3 register lightly. For project-local harness assets (session rules + context filter + env card), run **Full-Harness Mode** (`auto_project_mapping.md §6`) — approval-gated, never overwrites. FH self-gate is **not** installed into projects.

-

- **Trigger routing**: "connect a project" · "link to hub" · "map this project" · "scan parent directory and connect" → the mapping protocol above. "harness-ify this project" · "full harness setup" · "프로젝트 하네스화" (or accepting the post-mapping promotion prompt) → §6 Full-Harness Mode.

-

- ## Harness Drift Prevention Principles

-

- The forge-harness hub has a dual identity: **(a) a seed for others** + **(b) your own active work harness**. This is why clearly separating "team assets" from "personal assets" is essential to prevent drift.

-

- | Location | Nature | Update Responsibility |

- |---|---|---|

- | `forge-harness/templates/.claude/rules/*.md` · `forge-harness/knowledge/shared/*` | **Developer's own philosophy + front-end filters** — universal principles, personal assets | Owner (hub session sync) |

- | `{project}/.claude/rules/*.md` (e.g., project-specific guides) | **Team shared rules** — team assets, domain-specific | Team (managed via PR) |

- | `{project}/{domain}/.claude/rules/session.md` (e.g., domain session rules) | **Domain session rules** — team shared, per-domain | Team (managed via PR) |

-

- ### PR Direction (One-Way)

-

- ```

- ✓ Allowed: Improvement discovered while working in forge-harness → PR to {project} rules

- (Personal improvement → officialized as team asset)

-

- ✗ Forbidden: Copying {project} rules into forge-harness

- (Team asset drift · single source of truth collapse · double maintenance burden)

- ```

-

- ### AI Contribution Model (PR Proposal Principle)

-

- **Principle (`feedback_no_personal_commit_to_shared_repo`): AI does not commit directly to shared repositories.**

-

- - **Interpretation:** AI is not allowed to independently commit and push code. However, **AI may propose a Pull Request by preparing all change drafts and requesting final approval from the human (user)**.

- - **Implementation:** Skills such as `harvest-loop` follow this principle — they generate skill drafts, prepare commits automatically, and propose PR creation. However, the final decision to submit a PR must always require the user's explicit approval (`y`). This ensures Human-in-the-loop while maximizing AI contribution.

-

- **PR Creation Principle:**

- - AI may commit and push automatically (when changes are approved) — **to a feature branch, never to the integration branch**

- - **PR creation requires explicit user request** ("create PR", "PR 올려줘", "pull request")

- - **Reason:** Prevents PR fragmentation — logical units should be grouped into meaningful PRs, not atomized per commit

- - Default workflow: **claim** → branch → commit → push branch → wait for explicit PR request

-

- 🟥 **공유 체크아웃에서는 브랜치를 «잡는» 단계가 별도로 있다 — 그리고 그 기계는 이미 있다**

- (2026-08-18 실측 신설). 세션 여럿이 **한 체크아웃**을 쓰면 HEAD 는 하나뿐이라, 남이 옮기면

- 내 발밑이 바뀐다. 순서는 이렇다:

-

- ```

- switch 직전 git branch --show-current ← 실시간 HEAD. claim 파일이 아니다

- 자른 직후 git log main..HEAD --oneline ← 0 줄이 아니면 남의 커밋 위에 앉았다

- 잡을 때 bash scripts/branch_claim.sh claim ← 이 줄이 없으면 pre-commit 이 막는다

- 확인 bash scripts/branch_claim.sh check

- ```

-

- 🟥 **`.git/fh-claims/*` 를 읽는 것만으로는 못 막는다** — claim 은 lock 이 아니라 **쓰여진 시점의

- 스냅샷**이고, 남이 브랜치를 옮겨도 내 파일은 안 바뀐다. **자기 세션에 대해서도 거짓말한다**(실측: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Shared-Checkout-Incidents`). 그래서 판별자는

- 파일이 아니라 **위 두 줄의 실시간 실행**이고, claim 은 *기록하는* 명령으로만 쓴다.

-

- **남은 잔여 둘, 이름으로 남긴다**: ⓐ 게이트는 **커밋 시점**이라 `switch -c` 사고 자체는 못 막는다

- (그래서 위 두 줄이 여전히 사람 몫이다 — [[feedback_gate_binding_point_not_check_point]])

- ⓑ 반대 방향 — 내가 브랜치를 쥔 동안 남이 되돌리고 커밋하면 **내 staged 파일이 index 에 살아

- 있다.** 🟥 **2026-08-21 실제로 났고, 섞은 세션은 파일 지정 `add` 를 썼다**(초판은 여기 「파일

- 지정 add 를 썼기 때문에 안 섞였다」고 적었는데 거짓이다). 파일 지정 add 는 «내가 무엇을

- **추가**하나»만 통제하고 **index 에 이미 있는 것은 못 막는다.** ⇒ `git add -A` 금지는 필요조건

- 이지 충분조건이 아니다. **커밋을 한 호출로 묶고 그 안에서 둘을 확인한다** — 확인은 점이고 위험은

- 구간이라, 사이에 턴이 끼면 창이 다시 생긴다(같은 날 두 세션 실측 — 같은 §):

- ```

- B=$(git branch --show-current); [ "$B" = "<내 브랜치>" ] || exit 1

- git diff --cached --name-only # 내 것만 있나 — 남의 것은 restore --staged

- git commit …

- ```

- ([[feedback_shared_checkout_ops_touch_others_work]] · [[feedback_gate_binding_point_not_check_point]])

-

- **Integration branch is PR-only** (operator decision 2026-07-20). Never `git push origin main`

- directly. Normal path: `git switch -c <branch>` → push the branch → `gh pr create` → after review

- `gh pr merge --squash --delete-branch --admin` (self-approval is impossible when you authored the PR,

- so `--admin` after a completed review is the normal route, not a shortcut).

- 🟥 **Run that merge as `bash scripts/pr_merge_verified.sh <PR#> --rerun '<the lane that exercises the

- change>'`** — it records the PR head *before* the merge deletes it, merges with exactly the flags

- above, then re-runs your lane on the merged `main` and compares every file the branch touched. A

- green `gh pr merge` only says the merge happened, not that the squash carried the branch

- (2026-09-21: four merges, none checked). `--rerun` is required and refused before merging if it is

- missing or does nothing (`true`, `echo …`).

-

- **Two layers.** Shift-left = `templates/.git-hooks/pre-push` blocks a direct push to `main`/`master` unless

- `MAIN_PUSH_OK=1` (logged, same shape as `DESTRUCTIVE_OP_OK`; known-pair calibrated). The **hard floor is server-side**

- (`enforce_admins: true`, review count `0` so a solo operator can merge) — a client hook is bypassable with `--no-verify`.

- 🟥 **Branch protection is legacy protection AND rulesets — strictest wins.** Read **both**

- (`/rules/branches/{branch}` and `/branches/{branch}/protection`) before declaring any branch surface open or closed;

- reading one alone misjudged this repo three times ([[reference_github_protection_two_layers]]). ⚠️ Live residual:

- `strict: false` on `main`, and the required `validate` check is **not** Axis 1.

- > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Branch-Protection-Two-Layers`

- > — the force-push retraction, which surface each layer governs, the three misreadings — read before asserting that any branch surface is open or closed.

-

- ## Permission-Denial Guidance (When Auto-Mode Blocks an Action)

-

- When blocked by auto-mode permission denial, **do not stop at the bare denial** — turn the block into a decision the user can act on in one step:

-

- 1. **State what was blocked** and why

- 2. **Option A — Approval mode**: show exact commands to run after switching; **Option B — Manual review**: list specific files/sections; **Option C — Reduce future prompts**: propose built-in `/fewer-permission-prompts` when the same read-only call class keeps getting prompted

- 3. **Ask which option** — one line, then wait

-

- **Sub-agent variant**: report (what was blocked + ready-to-apply content + exact unblock step) back to orchestrator — never silently fail. Switching modes lifts permission block, not FH gates — the 4-axis gate still applies.

-

- Simplification guard: trivial denials with one obvious fix → state block + single next step inline.

-

- ## Active Onboarding Protocol (User Greeting → AI Initiative)

-

- > **Full 4-step detail**: `knowledge/shared/harness-core/fh_detail_protocols.md`

- > **Read this file before Step 1 begins** — duplicate-install detection (Step 1-b) and registry scan (Step 1-c) are only defined there, not in this summary.

-

- **Triggers**: greetings (`hi`/`hello`/`hey`/`안녕` — and the same word in any language; FH is English-based but language-agnostic, a bare greeting in any tongue fires this) · start intent (`resume`, `continue`, `where were we`) · new task (`new project`, `new task`) · discovery (`what is this`, `what can you do`, `first time here`)

-

- **4-step summary**: ① Auto-read CLAUDE.md + CATALOG + session card + registry scan + UAP (`tracks/_meta/user_adaptation_profile.md`, if present — apply user-tuned defaults: preferred tier, suppressed proposals, muted nags; see §Operational Adaptation Loop) **+ Mode D companion-store load — if a companion store is configured (your `CLAUDE.local.md` binding), pull it and read its index (its TOC) before its other files, then check freshness against the card (`modes_and_value.md §Session-start freshness`); this load is part of the auto-read, not a step the operator should have to request** → ② One-line proposal (new user / exploratory / returning branches) → ③ 5-skill cascade (plugin-recommender → synergy → .claudeignore → model → verify) → ④ Approval + setup

-

- **Greeting branch + door skeleton (summary-level — applies even if the detail file read is skipped)**: the branch test is **mechanical — `bash scripts/mapped_tracks.sh` prints `onboarding_branch=new|returning|UNKNOWN`; ask it rather than eyeballing `tracks/`** (🟥 UNKNOWN is not `new`, and shipped-with-the-repo files do not count as prior use — measured 2026-08-30: two tracked files made every clone look «returning»), never git log / CATALOG residue (a fresh clone carries full history but zero session files: it is a NEW install). Every variant opens with **🐿️ then an identity-revealing welcome line on the SAME line**, followed by the menu — one salience unit, not a separate rule. The verifiable invariant is *same-line*, **not** a space count. Welcome line by branch: new / exploratory = "Welcome to FH." · returning = "Welcome back to FH." · operator (FH-dev state) = "The FH operator — good to see you." — rendered in the user's language as a **plain, natural translation of the pinned phrase, never an invented coinage** — and 🟥 **the name «FH» survives that translation**: it is a product name, not a word to translate away or quietly drop, because dropping it deletes the identity half of a line whose whole job is to be *identity-revealing*. 🟥 **Measured 2026-08-29 (floor tier, reps=3/arm): the clause did NOT close the name-drop** — it stays because it is right and cheap, and is labelled failing rather than fixed; there is **no mechanical floor** (**Detail**: See `knowledge/shared/harness-core/fh_detail_protocols.md §CM-FH-Name-Drop-Measurement` — arms, control, the run that traded this defect for the language one — read before claiming the name survives translation). (Why each of these reads as it does — the fresh-clone FP, the space-count retraction, the mistranslation: `fh_detail_protocols.md §Onboarding-Provenance`.)

- 🟥 **The door labels below are written in English because this file is; they are NOT literals to copy.** Render the welcome line **and every door label** in the greeting's language — `你好` gets Chinese doors, `こんにちは` Japanese ones. Only the ①②③④/🔧/📖 markers, skill names and file paths stay as written. 🟥 **Do not read this note as a fix** — it is a correct instruction with **no mechanical floor**, measured non-convergent in this install. A clean-install arm reattributed the defect mainly to the operator's language pin: **do not cite this install's 1/5 as the shipped behaviour**, and firing stays non-deterministic (**Detail**: See `knowledge/shared/harness-core/fh_detail_protocols.md §CM-Door-Language-Measurements` — both wiring rounds, the clean-install arm and its reps — read before citing any door-language number).

-

- - **New user** (fresh clone/install — **neither** condition below holds): 2-door starter, never the returning menu. 🟥 **The two conditions are scoped differently and the underscore rule touches only the second.** ⓐ **Session files** — any `tracks/**/session_*.md` **or `tracks/_meta/*.md` beyond `.gitkeep`**; 🟥 `_meta` **counts here** (someone who worked and quit without closing has files there, and rendering «looks like you're new» to them is the defect this clause exists to prevent). ⓑ **Mapped project tracks** — `tracks/{name}/` dirs, where **any underscore-prefixed dir** (`tracks/_*` — `_meta`/`_audit`/`_contrib`/`_chamber`…) doesn't count, general rule not a closed list — `_chamber` holds incubation chamber runs, never mapped projects. Canonical: `fh_detail_protocols.md` §Branch test —

-

- > 🐿️ **Welcome to FH.** *Looks like you're new here! What would you like to do?*

- > - **① Create your first project** — guided

- > - **② Map an existing project**

- > - **📖 Read the guide / ask me anything**

- >

- > *…and I can run `/install-wizard` to finish initial setup.*

-

- - **Returning user** (session files OR mapped project tracks exist): fixed 4-door menu —

-

- > 🐿️ **Welcome back to FH.** *What would you like to start?*

- > - **① Map a project**

- > - **② Create a new project**

- > - **③ Accelerate or diagnose a mapped project** (work · Full-Harness · skills/agents/plugins · 진단) — {field candidates}

- > - **④ Cross-project synergy**

- > - **📖 Guide / Q&A**

- >

- > (When **FH-dev state exists** — the operator — the welcome line is **"The FH operator — good to see you."** in place of "Welcome back to FH.")

- >

- > *…and when you're done, say **"wrap up"** — what you did lands in the session card, and the next session starts from there instead of from scratch.*

-

- **The wrap-up line is returning-branch only.** A first-time user has nothing to close yet, and the phrase would read as jargon; a returning user is exactly the person whose last session may have ended without it. One line, below the doors, never a numbered door (the door set is fixed — §fh_detail_protocols Step 2).

-

- 🟥 **한 줄로 이어붙이지 마라 — 문은 한 줄에 하나다** (운영자 지적 2026-08-20). 세로 목록은 G-GREET-02 · G-GREET-03 · G-GREET-05 를 그대로 만족한다 — 렌더 층이지 판정 층이 아니다(`knowledge/shared/harness-core/fh_detail_protocols.md §CM-Vertical-Menu-Rationale`).

-

- **📖 문 (비번호, 항상)**: `docs/USER_GUIDE.md` 를 **띄우고**, FH 사용법 문답을 받는다.

- 🟥 **번호를 늘리지 않는다** — ①~④ 는 고정 4문이고 🔧 만 비번호 예외였다(`fh_detail_protocols.md`

- Step 2 가 문 집합 고정을 명시). 가이드는 「작업의 시작」이 아니라 「작업 전 참조」라 성격이 다르다.

- 🟥 **띄운다 = 경로 + 3줄 목차 출력이 먼저다.** 전문을 인라인으로 뱉지 마라 — 매 세션 토큰을

- 태우는 형태이고, 이 문이 존재하는 이유가 그걸 안 하기 위해서다. opener(`open`/`xdg-open`/`start`)는

- `uname -s` 로 분기해 **제안만** 하고, 없으면 조용히 넘어간다(경로는 이미 나갔으므로 손실 0).

- ⚠️ `open` 은 macOS 전용이다 — FH 는 npm 배포물이라 그걸 기본값으로 두면 안 된다.

- 운용 상세(허용 코퍼스 · 모르면 「못 찾음」)는 `/fh` Step 3.5.

-

- 🔨 **대장간 어휘를 문 부제에 넣지 마라 — 2026-08-22 에 넣어보고 실측으로 물렀다.**

- 브랜드·교리 층(README · `docs/ETHOS.md`)에서는 대장간 은유가 3단 공정과 맞물리고 **거기서는 맞다**.

- 문은 다르다 — **읽는 자리가 아니라 고르는 자리**이고, 여기서는 «무엇을 하나»가 은유를 이긴다.

- 실측(플로어 티어 블라인드, reps=3×2팔)에서 라우팅은 안 깨졌지만 **부제는 라우팅을 안 돕고 혼란만 더했다**(**Detail**: See `knowledge/shared/harness-core/fh_detail_protocols.md §CM-Forge-Vocab-Door-Measurement` — 팔별 결과와 그 sim 의 계기≠대상 결함 — read before re-adding forge vocabulary to a door). 그러므로 확실한 결론은 **new-user 문에 넣지 마라**까지이고, returning 문은 **미측정**이다.

- 다시 넣고 싶으면 «FH 를 몇 번 써본 사람» 프레이밍으로 먼저 재라 — 눈으로 판단하지 마라.

- 🟥 그리고 **환영문 리터럴과 문 집합은 어느 경우에도 못 건드린다** — G-GREET-05 의 세 문구는

- **하류 포크가 기계 매핑하는 앵커**라(pmh-dev #54) 바꾸면 모든 포크가 무음으로 깨진다.

-

- Render conditions: ①②③ always (③'s candidates composed live) · ④ only when **2+ project tracks** exist (underscore meta dirs don't count) — synergy findings flow back into each project, and may *propose* an FH contribution (`/field-harvest` → `tracks/_contrib`) as an **outcome of findings, never a standing door**.

-

- - **Developer door (unnumbered, outside the menu)**: when **FH-dev state exists** (session card `tracks/_meta/reference_next_session_starter.md` · open `fh_signal_*` files · `CLAUDE.local.md`), append it as **its own row at the bottom of the menu list**, not tacked onto another line: `- **🔧 FH self-development** — {FH worklist}`. The hub operator always has this state, so the owner always sees it — no flag needed. Without dev state the door is **silently absent**; the user typing `developer` / `개발자` **as a standalone utterance or menu reply** (not a substring of a task sentence) opens it on demand (routes to `docs/CONTRIBUTING.md` + `tracks/_contrib/` + open `fh_signal_*` items).

-

- Compose session-card candidates **into door ③ (field) and the 🔧 door (FH-dev)**, never as a raw priority dump that replaces the menu. An urgent open item (time-windowed handoff · blocking external deadline) outranks the menu; an explicit task utterance skips it entirely (see Guards below); cadence reminders (§Cadence Rules) ride below it, they don't displace it. Canonical source: `fh_detail_protocols.md` Step 2 — keep branch tests and door labels in sync.

-

- **Identity marker**: every greeting response (Step ②) opens with 🐿️ then an identity-revealing welcome line **on the same line** (a space after 🐿️; exact count not significant — the renderer collapses it — the invariant is *same-line*, not 🐿️ alone) — new / exploratory = "Welcome to FH." · returning = "Welcome back to FH." · operator (FH-dev state) = "The FH operator — good to see you." It is embedded in all skeletons above (do not strip it when composing doors); the exploratory branch template (`fh_detail_protocols.md` Step 2) uses the "Welcome to FH." line.

-

- **Guards**: explicit task-entry utterance → skip onboarding **menu** (the door skeleton / greeting) — but this **never skips the Mode D companion-store freshness load** (pull + INDEX read + card-vs-commit reconcile); that is a data-load, not the menu, and it fires even when the first message is a task — hook-backed via `scripts/fh_session_load.sh` (measured miss + mechanics: `fh_detail_protocols.md §Onboarding-Provenance` · `modes_and_value.md §Session-start freshness`) · once per session · code/debug requests → start working directly · project routing is a suggestion, mention at most once

- **Wizard-state guard (prose layer — for nodes whose hooks were declined/never wired)**: during the

- greeting auto-read, if `~/.cc_sentinels/{repo}_wizard_done` is absent, or `{repo}_wizard_declined`

- is non-empty without a `_wizard_reminder_muted` sentinel, append ONE line to the response:

- *"install-wizard 미실행(또는 거부 항목 N개) 상태 — FH 의 의도된 기능 일부가 정상 실행되지 않을 수

- 있다. 재실행: `/install-wizard`."* Wired nodes get the same line mechanically from the env-delta

- hook — emit it once, not twice. Honest residual: a task-first entry on a fully-unwired node has no

- surface for this line (no hook, no menu) — prose cannot close that, and it is named here rather

- than papered over.

- > 🟥 A 2026-08-29 claim that the greeting itself does not fire without `.claude/settings.json` was **RETRACTED** — an

- > instrument artifact; a clean clone with no `.claude/settings.json` fires the returning greeting 3/3. Nothing here needed widening.

- > **Detail**: See `knowledge/shared/harness-core/fh_detail_protocols.md §CM-Wizard-Residual-Retraction` — the runner flag that dropped CLAUDE.md, and the lesson that verifying `claude` loads CLAUDE.md is not verifying that YOUR RUNNER lets it — read before widening this residual.

-

- **Metadata-is-not-intent guard**: the trigger is the user's **typed message only**. Session metadata — branch name (auto-derived from the first message, e.g. `claude/korean-greeting-*`), repo name, file paths — is **never** a task spec and never suppresses or redirects the greeting trigger. A bare greeting fires onboarding even when the branch name looks like a feature request; if the only "task" signal lives in metadata and not in what the user typed, treat the message as a greeting and run the greeting branch + door skeleton above.

-

- ## New Skill Creation Pre-Commit Gate

-

- Every new `SKILL.md` must clear a **6-item bar** (role-duplication via `/asset-placement-gate` · description diet · **Done When** · check-class · natural-language triggers · independently executable) before commit. A **routing/gate skill** additionally owes a one-time `Step 0.5` trigger-probe, re-probed whenever its trigger phrases change.

-

- **Consequence (kept resident on purpose)**: a skill shipped **without a `Done When` definition automatically qualifies as harness-doctor L2 M-tier** — the bar has teeth, and those teeth stay in the always-loaded layer even though the bar's detail does not. Each `Done When` condition must also declare its check class (mandatory-pass / measured / judged); a **judged** condition names its adversarial pairing — no judge-only path.

-

- > **정본**: `.claude/rules/fh_4axis_gate.md §New Skill Creation Pre-Commit Gate` — the full 6-item table, the judged→measured upgrade path, and the routing/gate test. **`paths:` governs only when that rule file AUTO-LOADS, and it covers just *some* gated assets — never read it as the gate's scope; applicability is the asset list in §FH Improvement 4-Axis Auto-Gate below.** **Creating a skill from scratch reads no SKILL.md, and several gated assets are outside the globs — go read it explicitly.** Mechanical backstop: `templates/.git-hooks/pre-commit` fires on **every asset class listed below — not only `SKILL.md`** — plus a count-consistency slice whenever a skill is added, removed or renamed. It blocks on a **missing or vacuous marker**, never on proof the axes ran; provenance is yours.

-

- ---

-

- ## FH Improvement 4-Axis Auto-Gate (Self-Verification Orchestrator)

-

- **FH 자산을 수정하면**(SKILL.md · **SKILL_detail.md** · `.claude/rules/*.md` · `knowledge/shared/rules/*.md` · `templates/` · `CLAUDE.md` · substantive `knowledge/`·`docs/*.md` · `AGENTS.md` · **`scripts/**/*.sh`** · **`scripts/**/*.py`**(`.py` 는 2026-09-07 부터 — 그 전엔 출하 파이썬 7개가 게이트 밖이었다) · **에이전트 정의**(`plugins/*/agents/**/*.md` · `.claude/agents/**/*.md`)) **4축 검증 체인이 그 세션 첫 커밋 전에 자동 실행된다.** 사용자 요청 불요 — 제안이 아니라 의무 단계다.

-

- **기계층 — 무엇이 실제로 막는지 나눠서 말한다(2026-08-04 실측).** `git commit` 은 `templates/.git-hooks/pre-commit` 이 **하드 차단**한다: 축이 전부 PASS 할 때까지 커밋이 안 되고, 아래 상세가 로드되지 않아도 훅이 막는다 — 이 산문은 훅 위의 살리언스 층이지 유일 floor 가 아니다. 다만 **훅은 클라이언트측이고 `--no-verify` 로 우회된다**(§Integration branch 가 이미 그렇게 말한다 — 두 곳이 어긋나 보이던 것을 여기서 맞춘다). **서버측 잔여(2026-09-17 두 층 직독)**: `main` 은 `enforce_admins: true` 로 푸시 경로(PR 경유)를 강제하고, 필수 체크는 **`validate` · `new-code-anchor`** 다. ⚠️ **`validate` 는 Axis 1 이 아니다** — Axis 1(`regression-guard.yml` → `templates/regression_guard.sh`)은 4축 대상 클래스 전부에 **돌지만 필수 체크가 아니다**(빨개도 머지를 못 막는다). `strict: false` 라 초록으로 남은 체크가 **실제로 병합되는 최신 트리를 본 적이 없을 수 있다**. Axes 2–3(마커)·Axis 4(매니페스트)는 `tracks/**` gitignored 라 CI 가 **구조적으로 볼 수조차 없다** — 원격 자율 노드(`claude/*`)에 한해 `scripts/remote_marker_gate.sh` 가 마커 3필드(`axes-run`·`crossfamily`·`standpoint`)가 커밋 기록에 실려 왔나를 `validate` 에서 막는다(형식만). 정직한 표현은 "하드 차단"이 아니라 "**가용한 가장 강한 층**"이다. `strict` 켜기 · Axis 1 필수화는 **운영자 결정**으로 남아 있다.

- > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-4Axis-Server-Side-Residual` — «Axis 1 은 돌지도 않는다» 정정(`paths:` 는 2026-08-29 `d5fceac` 에 넓어짐)과 그 낡은 문장의 전파 · #675·#716 실측 · 보통 브랜치 SKIP 규칙 — read before asserting what CI does or does not enforce.

-

- 🟥 **그리고 그 채널 밖에도 같은 사각이 있다 — 이 파일의 Git pre-commit/pre-push 차단 주장은 해당 훅이 **배선된** 체크아웃에서만 참이다. 호스트 생명주기 훅은 별도 설정·신뢰·이벤트 계약을 확인해야 하며 Git 배선으로 입증되지 않는다.** `core.hooksPath` 는 git 이 나르는 값이 아니라서 같은 커밋이 한 체크아웃에서 무음 통과하고 다른 곳에서 차단된다(2026-09-21 실측). 🟥 게이트가 *통과한 것*과 *안 돈 것*은 터미널 출력이 **둘 다 무음**이다. ⇒ 층 대조는 **`bash scripts/env_layer_fingerprint.sh`**(계기지 게이트가 아니다 — 기계화한 것은 채널이지 결론이 아니다), 휘발 클론은 **`bash scripts/gate_bootstrap_ephemeral.sh --check|--apply`**(배선 · UTF-8 로케일; 🟥 **증거는 안 만든다** — 마커 자동 생성 = 가짜로 닫기). ⚠️ `fh_node_check.sh` 는 그 환경에서 **뜨지도 않는다**. 🟥 이 문단의 기여는 **측정에서 분리되지 않았다**(ARM 3/3 = CONTROL 3/3, 사전등록 반증 조건 충족) — 옳고 싸서 남긴다.

- > **Detail**: See `knowledge/shared/harness-core/checkout_layer_drift.md §CM-Resident-Paragraph` — 이 문단의 이관 전 원문 전체(PATTERN 층 초록 방향 · 필요한 셋 · 메모리 오염 잔여) — read before citing drift or this paragraph's contribution.

- > **Detail**: `knowledge/shared/harness-core/checkout_layer_drift.md` — 네 층의 수송로 표, 두 체크아웃 실측 15행, 세 갈림 방향(ⓐ여기초록·저기빨강 / ⓑ그 반대 / ⓒ양쪽 초록인데 커버리지 다름), 그리고 이 측정이 **주장하지 않는 것**(맥 쪽은 계기를 직접 돌린 게 아니라 같은 경로 프로브를 1:1 로 옮긴 것 · n=2 · digest 대조는 아직 불가) — **드리프트를 근거로 쓰기 전에 읽어라.**

-

- > **상세 정본**: `.claude/rules/fh_4axis_gate.md` — 4축 정의·마커 필수 필드·경량 예외·substantive carve-out·target-tier sim 게이트·Mode D 모델 공지·cross-family 보완. **`paths:` 로 *일부* FH 자산 경로에 스코핑돼 있어 그 파일들을 *읽을 때* 자동 로드된다 — 로드 조건이지 게이트 적용 범위가 아니다** (공식 트리거는 read — `code.claude.com/docs/en/memory.md` §Path-specific rules).

- > (2026-07-20 분리 — 트리거가 *파일*이고 *기계 백스톱*이 있어 1순위 후보였다. 같은 이유로 **비가역 게이트 3종은 이동 불가** — 의도 트리거라 경로 스코핑하면 fail-open 이 된다. 분리 실측: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-4Axis-Split-Measurement`.)

- > **의무**: 이 요약에는 **축 이름·마커 필수 필드·경량 예외 기준이 없다.** 4축을 실제로 실행하거나 마커를 쓰기 전에 위 파일을 **반드시 직접 읽어라** — 안 읽고 마커를 쓰면 필드를 지어내게 된다(2026-07-20 Sonnet sim 이 스스로 지목한 실패 모드).

- > **잔여(살리언스 층에 한함, 훅은 무관)**: ⓐ 트리거가 read 라서 **신규 SKILL.md 를 Write 로 새로 만드는** 경로는 규칙이 안 실린다 ⓑ `CLAUDE.md` 는 glob 에서 의도적 제외라 CLAUDE.md-only 세션은 이 요약 + 훅만 본다. **두 경로에선 위 "반드시 읽어라"가 유일한 살리언스 층이다** — 단, 둘 다 pre-commit 훅이 여전히 커밋을 하드 차단한다.

-

-

- ## Field-Harness Load-Bearing Change Gate (cross-family, pre-merge)

-

- The 4-axis gate above fires on **FH asset** changes; this gate applies the **same cross-family

- adversarial rigor to load-bearing field code** (qasp · the-bible · pmh). The blind spot it guards is

- model-family-level, not FH-specific: **prose-specified verdict logic grants discretion; discretion's

- degrade direction is unconstrained (→ optimistic PASS); same-family reviewers share the author's

- optimistic reading and miss it.**

-

- **Trigger (per changed file — grep-assisted, salience-dependent, no field hook)**: an AI-authored

- change to a **verdict/gate enum or exit code** (PASS/FAIL/BLOCK/allow/deny), an **irreversible-op**

- path (publish/delete/history-rewrite), or a **safety invariant** (floor, verdict-binding, a

- pre-push/pre-commit hook). 🟥 **Registration is not a precondition** (operator decision

- 2026-09-08). When the session is asked for a **merge / landing verdict** on a file that is gate code,

- this gate applies **whether or not** the file's project is mapped, tracked, or in a repo this hub

- knows. Two narrowings keep that from becoming «every review is a gate»: ⓐ the ask must be a

- **verdict on landing** (merge / ship / approve — a read-only explanation or a refactor question is

- not one) · ⓑ «gate code» is decided by **`bash scripts/gate_shape_scan.sh <file>`** — word-bounded

- verdict identifiers (a **closed** list — allow/deny/permit/approve·approval/verdict/permission/

- auth·authn·authz·authorize·authorization·authenticat*·auth_x; `author` and `allowance` do not match;

- uppercase `PASS|FAIL|BLOCK`), a bind/listen exposure, or an irreversible-op call; comment-led lines

- skipped; binary → `UNSCANNABLE`, and **exit 3 dominates a hit** — never a silent miss (known-pair

- lane `scripts/test_gate_shape_scan_lanes.sh`, 9 lanes incl. a revert probe).

- The task *naming* the file as gate/auth/exposure code is a **manual escalation on top**, not part

- of the classifier — a prompt is not a property of the file. ⓒ **FH-owned assets are excluded** —

- they already carry the 4-axis gate; this gate is for *field* code, mapped or not. Record surface for

- an unmapped file: `tracks/_meta/field_gate_review_<YYYY-MM-DD>_<slug>.md` (file · verdict ·

- `crossfamily:` verbatim from the enum · degrade-scan result · regression test landed-or-owed), and

- the reply links it. An **owed** regression test keeps the verdict `NOT-CONVERGED`; it does not

- converge on a promise. 🟥 **Pilot evidence is below bar and CUE-DEPENDENT** — without a «follow your installed review procedure» cue the gate fired **0/51** on unmapped gate-shaped files, so this paragraph is muscle, not skeleton, and no hook supplies the reminder yet (**Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §CM-Unmapped-Pilot-Evidence` — before/after arms and the cue condition — read before citing any fire rate).

- Registration was never the reason this gate exists; the degrade-direction blind spot is, and it

- does not check who owns the file. Grep the diff for verdict-enum returns / gate exits / safety-marked

- functions — strong-advisory trigger, so under-trigger is a named residual, not an airtight claim.

-

- **Gate (before merge, not after)**: ① **degrade-direction lint**

- (`scripts/degrade_direction_scan.sh` — advisory pre-screen, FP-tolerant, never a solo block) →

- ② **cross-family adversarial review** (`auto-decorrelation` → ≥1 different-family auditor; governor

- keeps the terminal verdict + **source-grounds** every finding — mechanical anchor over agreement) →

- ③ **confirm→fix→re-verify until CONVERGED**, **each fix shipping a mechanical regression test**

- reproducing the closed hole (the anchor leg is a *required* convergence sub-condition). *(Role

- deconfliction: this gate reviews **field code being authored**; the Irreversibility gates below gate

- **the act** of publish/delete/rewrite — disjoint, no double-gate.)*

-

- **Degrade direction (fail-closed)**: no different-family auditor reachable → **NOT-CONVERGED** —

- block the autonomous merge / ask the operator / proceed only under an **explicit, logged

- same-family-only acknowledgment**; never a silent same-family pass (§Irreversibility Surface-Class

- Degrade Invariant). **That acknowledgment is now typed, not prose**: the Axes 2–3 marker carries

- the marker's **`crossfamily:`** line — required on load-bearing changes since c1fa459, and a closed

- enum since 2026-08-08 — `panel(<families>)` · `declined` · `DEGRADED_SINGLE_FAMILY` ·

- `DEGRADED_PANEL_UNUSED` · `UNKNOWN`, the three degrade values hard-blocked at commit without

- substantive grounds on the same line naming what was probed (`templates/.git-hooks/pre-commit`, fixtures

- `scripts/test_marker_crossfamily_lanes.sh`). *could not* (`DEGRADED_SINGLE_FAMILY`) · *did not*

- (`DEGRADED_PANEL_UNUSED`) · *did not look* (`UNKNOWN`) are **separate values on purpose** — free

- prose collapsed them, which renders an unrun probe as a zero finding and an unused panel as an

- unavailable one. This is also what reconciles this line with `auto-decorrelation`

- Step 6's *"silent degrade, never hard-fail"*: **not-blocking and not-silent are different

- properties**, and only the second is mandatory on a reversible commit surface. (Why it became typed: `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §CM-Crossfamily-Typing-History`.) **Residency**: sanitize company code before any external-family dispatch; domain data never leaves.

- **Autonomy**: autonomous once UAP-consented; **in autonomous loops the gate is part of the delegated

- pipeline**, not an afterthought, and a below-floor orchestrator RUNS the review by default

- (run-first, ask-last — `sonnet_floor_doctrine.md`).

-

- **Standpoint axis (2026-08-14, orthogonal to family — §7 of the detail doc)**: family diversity raises

- resolution *within* one standpoint; it does not decorrelate the review's ground-truth source. For a

- **shared-body / cross-harness-boundary** change (scoped by *effect* — alters another harness's behavior,

- gate outcome, or interaction contract) the marker carries `standpoint:`, a closed enum: `tier1` · `tier1b(<h>)`

- static read · `tier2(<h>)` executed in the target's repo · `tier2b(<h>)` same operator, real runtime ·

- `tier3(<h>)` different operator · `not-applicable` · degrade triad `DEGRADED_NO_TARGET_ACCESS` /

- `DEGRADED_NOT_RUN` / `UNKNOWN` (own literals — never reuse crossfamily's tokens).

- 🟥 **Settle the target class(es) first — §7 `Q0`, not first-match, each target owes its own tier**: ⓐ a named

- peer carrying the changed surface · ⓑ **consumer-visible behavior** changed → a clean install of the packed

- artifact, binding **pre-push** (shipped-ness is not the discriminator; the execution half has **no lane** — by

- hand) · ⓒ neither → `not-applicable`.

- 🟥 **Execution is the load-bearing half** (2026-08-16): `tier2`+ asserts something RAN — **name the command you

- ran and the output you saw**; cannot name one → `tier1b`, always (the hook blocks unnamed `tier2`+ grounds since

- 2026-09-12 — it checks the record's shape, not that the run was real).

- > **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md` §7 · `§Q0-Evidence` (97% shipped-path

- > measurement + citation warnings) · `§Standpoint-Execution-Evidence` (one-delta comparison, RETRACTED citations, naming

- > collision) — read before choosing a tier, citing a number, or claiming what `standpoint:` enforces.

- > **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md` — the discretion

- > principle, the four-faces failure signature, why same-family review misses it, the full gate

- > mechanics, the n=7 qasp field evidence incl. the **9 default-toward-PASS holes across 3 harnesses**

- > (2026-07-03), the named under-trigger residuals, autonomous-loop baking, and **§7 the standpoint

- > axis** (field spec, trigger scope, relationship to the core/extended verification axis, evidence

- > table) — read when applying or auditing this gate.

-

- ## Field-Harness Diagnostic — "진단해줘 / 개선해줘" on a mapped project (compose → rank → HITL)

-

- The **on-demand pull sibling** of the gate above: a *project-level* "diagnose / improve this harness" ask

- composes the checks FH **already has** across **nine lenses** — leak (`/public-surface-audit`, incl. **Step 3c ignore-verification** — a file believed gitignored but actually tracked is the leak this sub-step exists to catch) · split

- integrity (`/phantom-quench` **Step 2.7**) · token/salience (`/context-doctor` · `/salience-splitter`) · structure

- (`/harness-doctor`) · verdict degrade (`scripts/degrade_direction_scan.sh`) · loop-readiness

- (`loop_engineering.md`) · built-but-unwired (per-module caller grep — a completed module with zero

- external call sites; the dominant class of the 2026-08-01 qasp audit) · triad consistency

- (spec↔implementation↔TC agreement — `harness_verification_core_extended.md` §2 dispatched-procedure

- recipe, cluster-independent core lens) · **measurement-reps** (그 하네스의 기록에서 «하중 지는 결론 +

- 바 미달 reps» 를 찾는다 — 판정·등급·교리·비가역 처방을 떠받치는데 표본이 1~2 인 자리. 랭크만 하고

- 자동 수리 안 함, 다른 렌즈와 동일) — into **one ranked `M`/`S`/`R`

- list**. No-reinvention: it only routes and ranks.

-

- **Resident guards (do not defer these to the detail file)**: **nothing is auto-fixed** — the list is the

- skill's job, the *go* is the human's; and **company residency (absolute)** — **raw company source, secrets,

- hostnames, internal repo/asset names, stack traces, and unredacted findings never leave the local machine**:

- not to an external **or same-family** cloud model, not through a browser/API tool, not into a log, comment,

- or paste. Leak lenses run **locally**; anything dispatched outward is a **sanitized summary only**.

- Company-sensitive findings are *surfaced* for operator decision, never auto-fixed. Any exception needs

- **explicit operator approval + a gitignored audit note**. (A leak does not un-happen — absolute, not

- deferrable, and "is this sanitized enough?" is not a call the session makes alone.) **Autonomy floor**:

- compose/rank is trusted at opus-tier+; below-floor, run the individual checks and present raw —

- **never silently skip a lens**.

-

- > **Detail**: See `knowledge/shared/harness-core/field_harness_diagnostic.md` — the full lens table (incl.

- > loop-readiness mechanics + adversarial pairing), the remaining guards (project-level-only · once-per-ask ·

- > autonomy floor · how to scale to the size of the ask), and the 2026-07-08 dogfood examples.

- > **Read it before running the diagnostic** — this summary names the lenses, not how to run them.

-

- ## Onboarding / Acceleration Autopilot — "새 프로젝트 · 하네스 작성 · 가속화" (discover → compose → rank → install-HITL)

-

- The **install-direction twin** of the Diagnostic above — same `compose → rank → HITL` engine, deciding

- what to *install/wire* rather than what to *fix*. Four phases: **Phase 0** state audit + branch

- (*new-build* / *extend-existing* — found→extend, never fork / *maintain* → use the Diagnostic instead) →

- **innovator-centered recommend** → **ranked `M`/`S`/`R` install plan** (an official/built-in that covers

- the need outranks a net-new scaffold) → **install**.

-

- **Resident guards (inviolable — never deferred)**: **non-overwriting** — propose a merge, never clobber an

- existing `.claude/` · **company residency** — a company sibling repo is **surfaced, never auto-mapped or leaked**; `residency` is a

- machine field on the skill registry, so any recommendation naming a `company`/`operator-private` entry lands

- **only** in gitignored `tracks/_meta/` or the private companion store — never in a tracked file, and the

- absolute no-raw-company-data rule in the Diagnostic above applies here unchanged · **per-item gate routing** —

- installed **FH assets** run the **4-axis gate**; **field scaffolds** run **`asset-placement-gate` +

- `steel-quench`** (the FH pre-commit hook is repo-local and does **not** reach a scaffold installed into another

- repo, so this routing is not redundant with it) · **autonomy floor** — discover/rank trusted at opus-tier+;

- below-floor, present the raw recommend and ask · **HITL per item**, and `"끝까지 해줘 / 자율로 완주"` → full-autonomy under the `/goal-quench`

- gate: autonomy removes the per-item *prompt*, **never the gate**.

-

- 🟥 **Chamber outcome vocabulary changed 2026-08-17 (operator decision) — the old count below is a

- snapshot of a *different instrument*, not a current rate.** Re-routing, not softening:

- `net-new` failure is no longer a KILL — it routes to **`CURATED`** (hand the maker the prior-art list

- and the delta it does not cover; *"그 사람이 만들려는 걸 인큐베이터가 막을 필요가 있을까"*), and a

- judgment-shaped candidate routes to **`NOT-APPLICABLE`**. **KILL survives for measured

- precision-shortfall, hub-state dependence, and inability-to-run** — the screening that was actually

- load-bearing is intact. Detail + the frozen known-pair that keeps the old instrument measurable:

- `harness_incubator_doctrine.md §3-SCREEN-2026-08-17` · `tracks/_meta/chamber_taxonomy_knownpair_PREREG_2026-08-17.md`.

-

- Honesty boundary that must not soften in summary: the **formal flow** has emitted — runs #14 and #15 (2026-08-20) are EMIT, and **#15 alone is order-witnessed** (`WITNESSED`; #14 is `VOID(TAMPERED)`), so ② is 🟢 since 2026-08-21 on **n=1**, with the emitted tool wired into its target harness as **advisory only**. Earlier, run #9 `forge-wiki` shipped publicly but **not through the formal flow**, and the first end-to-end formal run (#10) KILLed. **No harness-level emit yet** — what has been emitted is a small tool unit. Simulate-first stays a one-line HITL recommendation, never a push-button autonomous emit. ⚠️ **Do not cite the old KILL/EMIT ratio as «screens well» or «over-screens»** — it came from a retired rule set, and the frozen known-pair has not measured that yet (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Chamber-Honesty-Boundary` — the hand-counted ledger — read before citing any chamber count).

-

- > **Detail**: See `knowledge/shared/harness-core/onboarding_acceleration_autopilot.md` — full Phase-0 branch

- > logic + `chamber_run.sh` scope, the per-phase skill composition, the remaining guards (no-reinvention

- > tiering · autonomy floor · once-per-door-entry), revfactory provenance, and chamber-run-#7 guard evidence.

- > **Read it before running the autopilot.**

-

- ## Irreversibility Gates — Surface-Class Degrade Invariant (shared spine of the two gates below)

-

- The two gates that follow (Pre-Publish, Destructive-Op) guard **irreversible surfaces**. The floor they

- share is a single rule about *which direction a gate degrades* when its own mechanical tooling is

- unavailable (skill uninstalled, script errors, backend unreachable):

-

- - **Irreversible surface** (publish · delete · history-rewrite) → **fail-CLOSED.** An *applicable* check

- whose tooling is down does **not** become a free skip — it **blocks** the action. The only ways past:

- a **manual-equivalent pass** or an **explicit operator override** (e.g. the logged `PUBLIC_SURFACE_OK=1`

- channel), never silent-proceed.

- - **Reversible surface** (the 4-axis *commit* gate above) → **degrade-to-advisory** (don't-block). Its

- `Axis N: skipped (skill unavailable) → proceed` is correct *there* precisely because a commit is

- re-committable. (The shipped callable `scripts/fh-gate.sh` is also a review surface — note it signals

- exit-10 *harness-error*, a distinct non-pass, not a silent degrade-to-pass.)

-

- **Applicability is mechanical, not self-judged** — else an agent under ship pressure self-labels a

- code-shipping repo "docs-only" to convert fail-closed into a free skip. A check is *not-applicable* only

- when the surface genuinely lacks its target (e.g. the code-security pass is N/A iff the publishable file

- list ships no source/executable file — **grep the file list, don't assert "docs-only"**).

- *Applicable-but-tooling-down* is never not-applicable.

-

- **Surface class sets the error budget, not only the degrade direction** (operator decision 2026-09-08).

- The same automated verdict engine is usable on one surface and not on another, and the discriminator is

- what a wrong verdict costs. Each of the **four** review arms measured on the same eight cases (2026-09-17 scorer) is usable *on a review surface*, because a wrong finding costs a reader a minute (numbers: same §CM-Governance-Axis-Numbers). On publish · delete · history-rewrite there is no "costs a

- minute": the wrong call is the whole loss. 🟥 **So an automated verdict never clears an irreversible

- gate on its own, however good its measured rate** — it feeds a fail-closed gate whose terminal step

- stays a human or an explicit logged override. The corollary is the one that actually bites: **do not

- promote a verdict engine to an irreversible surface by improving its number.** The number is not the

- property that changes between the two surfaces. A precision figure also improves for free whenever the

- pipeline can *delete* claims, so on any surface it is meaningless beside the error rate of the

- deletions (`scripts/finding_verify.py` refuses to complete a run whose drops were never audited).

-

- A gate guarding an irreversible boundary that silently proceeds when its tooling is down is **fail-open**

- — by this floor's definition, not a gate. (The same reflex already ships piecewise — `mcp_tool_gating

- §unlisted → ask (fail-closed)`, corpus-grounding's fail-closed-no-generator — this section names the

- floor they share.) 🟥 **ask is fail-closed only while a human answers it**: under an auto-approver (a

- `PermissionRequest` allow hook) a hook's ask ran **5/5**, deny stopped it (interactive, 2026-09-25) — so

- on an irreversible surface the closed direction is **deny / exit 2**; `permissions.ask` rules unmeasured

- (`hook_channel_visibility.md`).

-

- **Salience residual**: the pre-commit hook cannot catch either irreversible surface at commit time, but push-time git surfaces (pre-push) and `npm publish` (`prepublishOnly`) **are** hooked. Only the **separate-repo go-public surface** is genuinely un-hookable — there the fail-closed direction is **prose, not hook-enforced**, backstopped by `templates/PRE-PUBLISH-CHECKLIST.md` (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Salience-Residual-Surfaces` — read before claiming a surface is hooked).

-

- ---

-

- ## Pre-Publish Surface Gate (Irreversibility Gate — Publish, not Commit)

-

- **Order invariant: scrub before publish, never publish-then-scrub.** Public exposure is effectively

- irreversible — a repo or package is briefly live the instant it goes public and may be cached or forked

- before any scrub. So the audit must fire **pre-publish**, not after.

-

- **When this gate fires** — *before* any action that makes a repo/package **publicly visible for the

- first time**, especially one **derived from internal/company assets** (operator-IP that originated in a

- private harness): `gh repo create --public`, `gh repo edit --visibility public`, a first push to a new

- public remote, `npm publish`, `twine upload`, a private→public visibility flip, **and a scholarly

- deposit** — Zenodo / figshare / OSF publish, a DOI mint or new version, an arXiv `submit` / `replace`:

- **any action that mints or alters a persistent public identifier**, first-time or not. 🟥 **What the

- form shows is not what the server received** — check the deposit's draft **API**, the file **md5**, and

- the **machine-readable fields** (references · related identifiers · dates) separately from the body:

- `templates/PRE-PUBLISH-CHECKLIST.md` **Step 1b** (four items, un-hookable surface — prose is the floor;

- measured case: `claude_md_gate_details.md §Pre-Publish-Hook-Coverage`).

-

- **Required before the public action** (all must be non-LEAK/non-FAIL) — this gate is the **umbrella that

- invokes them**, not a competitor; when publish intent is detected, fire *this* gate (it then runs the chain),

- not marketplace-gate alone:

- 1. `/public-surface-audit` — operator-private token scan (real username, corp asset names, home paths)

- 2. `/marketplace-gate` Check 5 — broad public safety (API keys, internal domains, license)

- 3. `/security-review` (built-in, when the repo ships executable code) — code-security pass on the

- publishable surface; complements 1–2 which scan tokens/metadata, not code behavior. Skip only when

- **genuinely not-applicable** (`skipped: docs-only repo` — surface ships no code). When code *does*

- ship, `skipped: built-in unavailable` is **not** a free skip: per the Surface-Class Degrade Invariant

- above this is an applicable-but-tooling-down case on an irreversible surface → **fail-CLOSED** (run a

- manual security pass or take an explicit operator override before publishing; never silent-proceed)

-

- > Routing vs the rows below: `/marketplace-gate` alone = "is this ready to **list on a marketplace**?";

- > `/public-surface-audit` alone = reactive "did I leak a token?"; **this gate** = the *act of going

- > public* (visibility flip / first public push / registry publish) — it chains the other two.

-

- **Cheap mechanical pre-flags** (any one → stop and run the gate): author/commit **email = corp domain** ·

- `LICENSE`/`README` contains a **private harness name or internal codename** · **module paths encode

- internal acronyms**.

-

- **Hook coverage — three distinct actions, two of them mechanized**:

-

- | Action | Enforcement |

- |---|---|

- | **(a) repo-go-public** (`gh repo create --public` · visibility flip · first push to a new public remote) | **Un-hookable** — separate repo, no hook here sees it. Stays **AI-behavioral** (the proactive trigger below) + the portable `templates/PRE-PUBLISH-CHECKLIST.md`. |

- | **(b) committing operator-private tokens into public-tracked content of THIS repo** (= an effective publish of that content) | **Mechanized** — pre-commit confidentiality scan, staged added lines vs the gitignored `.public-surface-patterns`. HIGH/MED block; `PUBLIC_SURFACE_OK=1` overrides + logs. |

- | **(c) `npm publish`** | **Mechanized** — `scripts/public_surface_scan_files.sh` via `prepublishOnly`, scanning the full content of the exact published file set. HIGH/MED block; same override + log; fail-closed on unresolved patterns/file-set. |

-

- So only **(a) stays genuinely un-hookable** — that is where this gate's prose is the only floor, which is

- why the proactive trigger matters. (b) and (c) are denylists on their own paths, **not** universal

- secret-scanners: they carry named residuals.

-

- > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Pre-Publish-Hook-Coverage` — the

- > two-layer pattern (literals only in the gitignored source), honest scope, the full named-residual list for

- > (b) and (c) (`--ignore-scripts` / non-npm clients · un-patterned secret shapes · override-not-populated ·

- > worktree-vs-tarball bytes), and the PR #109 (`fh_signal_2026-06-17` Wave 4) / phantom-gate origin — read

- > when configuring or auditing the scan, or before relying on it as a floor.

-

- ---

-

- ## Destructive-Op Gate (Irreversibility Gate — Delete/Rewrite, not Commit)

-

- **Order invariant: enumerate → recover → destroy, never destroy-then-check.** Deletion and history

- rewrite are irreversible in the way publish is — except the loss is *silent* (nobody sees what a

- deleted branch was carrying).

-

- **When this gate fires** — *before* any of: branch deletion (local or remote), history rewrite /

- force-push, scrub of tracked history, bulk deletion of session records / tracks content.

- 1. **Enumerate (measured)** — 🟥 **this step is run BY A HUMAN; no hook executes it** (measured

- 2026-08-20, residency-ledger pass): `bash templates/predelete_check.sh <repo> [base]` — per branch: commits

- off base + unique paths. Verdicts: SAFE (fully merged) · CHECK (0 unique paths but commits off

- base — shared files may hold *newer* content, e.g. an unmerged session card) · REVIEW (unique

- paths — recovery mandatory).

- 2. **Recover (judged — depth-sensitive)**: every CHECK/REVIEW item gets a content-direction look;

- live un-integrated state (cards · handoffs · signals · session records) is integrated to main

- **before** anything is deleted. This step exists because the loss class is silent — run it at the

- strongest available tier (floor semantics: `multi_model_sidecar_strategy.md §Tier-floor resolution`); a below-floor pass is provisional.

- 3. **Destroy** only what passed — REVIEW blocks a scripted delete chain (script exits 1).

- **Mechanical floor (pre-push hook — git-side surfaces)**: at *push* time, **remote branch/ref deletion**

- and **force / non-fast-forward push** are enforced **mechanically** by `templates/.git-hooks/pre-push` —

- it computes the same per-ref verdict **in its own code** (it does *not* shell out to step 1's script) and

- **blocks** unless `DESTRUCTIVE_OP_OK=1` (an explicit, logged operator

- acknowledgment, used *after* enumerate + recover). It closes the **honest-weak-model** gap (a forgotten

- prose gate is now stopped); it does **not** close the injected/adversarial one — the hard floor there is

- **server-side branch protection**. Non-git surfaces are out of its scope.

- **Degrade direction**: per the Surface-Class Degrade Invariant above, this irreversible surface **fails

- closed** — `templates/.git-hooks/pre-push` computes the per-ref verdict **itself, inline**, and blocks

- every CHECK/REVIEW branch delete, every force / non-fast-forward push, and every ref it cannot classify

- (unfetched remote tip → `CANNOT CLASSIFY` → block). The **only** way past is the explicit, logged

- `DESTRUCTIVE_OP_OK=1` override, taken *after* enumerate + recover. A destroy step never silently

- degrades into "just delete it."

- 🟥 **RETRACTED 2026-08-23 — this paragraph used to hang that fail-closed on the wrong actor.** It read:

- *"if `predelete_check.sh` is missing or errors, this irreversible surface fails closed — the pre-push

- hook blocks"*. That causal claim is **false**: the hook has **never called that script**, so the

- script's absence or failure changes the hook's behavior by exactly nothing. 🟥 **The fail-closed

- principle itself is untouched** — what is withdrawn is only the false attribution of who enforces it.

- (How it came to be written, and why this retraction stays resident: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Destructive-Retraction-Why`.)

- > **Why this retraction is resident rather than in a detail file** (residency-admission answer): a

- > retraction only works where the false claim was read. This one lived in the always-loaded layer, so a

- > session that loads only `CLAUDE.md` — the common case — would otherwise still read "the script enforces

- > it" and act on a floor that does not exist. Moving the correction behind a pointer would rebuild the

- > exact defect it names: a correction landing *beside* the sentence instead of *replacing* it. The

- > resident cost is four sentences; the alternative is a resident falsehood about an irreversible surface.

-

- 🟥 **Read that precisely — the floor is the HOOK, not this script.** `templates/.git-hooks/pre-push`

- implements the per-ref verdict **inline**; it does not call `predelete_check.sh`. Every in-repo reference to `predelete_check.sh` is a **mention, not an execution** (measured 2026-08-20, re-measured 2026-08-23 with a control — **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Predelete-Mention-Evidence` — read before claiming any caller executes it). So the script is the **operator's enumerate tool**, and step 1 above is a human

- step that the machinery reminds you of rather than performs. Stating it the other way round is the

- "prose-invoked floor" the 4-axis marker spec calls M-tier when a rule claims a floor its script has

- no caller for — this section does not make that claim, and this note keeps it from drifting into one.

- > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Destructive-Op-Hook-Coverage`

- > — the per-ref verdict mechanics, what the hook does/does not close (honest scope + adversarial residual),

- > the bash-3.2 portability defect class, and the 2026-06-10 origin incident — read when auditing or

- > configuring the pre-push gate.

- ---

- ## Autonomous Initiative Layer — Context-Triggered Skill Proposals (Active Throughout Session)

- At any point during a session, when the following signals are detected, propose the relevant skill in one line.

- Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?"`

- > **Row diet (2026-07-17)**: rows already caught at high confidence by a skill's own frontmatter `description` were removed — platform-native skill matching owns those. The table keeps proactive safety gates · non-skill protocol routes · disambiguators and weak-description rows. **Before adding a row back, probe whether the description alone already catches it.** (Probe score, the full removed list, and the keep-criteria rationale: `fh_detail_protocols.md §Onboarding-Provenance`.)

- | Conversation Signal Keywords | Proposed Skill |

- | "context is getting long", "token limit", "/clear", "slow", "context", "토큰 아깝다" (burden already felt — retrospective; future-cost estimates go to `/token-budget-gate`) | built-in `/context` · `/compact` first, then `/context-doctor` for what they do not do |

- | **a need a Claude Code built-in may already cover** — undo edits, branch or fork this conversation, run in background, think harder, simplify a diff, usage/insights, a side question, install check (`/doctor`) | **`knowledge/shared/harness-core/builtin_capability_map.md`** — built-in first, FH skill only for what it adds (no-reinvention Tier 0) |

- | **"이 절 잘라도 되나", "상주에서 빼자", "cut this section", "is this section load-bearing", "ablate this"** — a proposal to REMOVE resident text (the decision `/context-doctor` and `/salience-splitter` reach, not the routing to them) | **Ablation procedure — do not decide by eye.** Canon = `scripts/probe_scope_check.sh` header (arms · isolation · `reps>=3` · pre-registration · the two leak channels); runner precondition = `bash scripts/ablation_calibrate.sh` exits 0; verdicts land in `.claude/regression/ablation_verdicts.md`. **A section is CUT only on a pre-registered question set an isolated arm B answers correctly** — "I read it and it looks redundant" is not a measurement, and arm B answering *confidently wrong* is a KEEP, not a pass |

- | "wrap up this week", "review", "audit", "weekly", "retrospective" | `/harvest-loop` |

- | "pull this into FH", "reverse-harvest", "worth keeping", "harvest pattern", "field pattern" | `/field-harvest` |

- | **you installed or invoked an EXTERNAL asset (a tool, framework, or repo not ours) and ran it against something this hub owns** — `pip install`/`npm i` of an outside framework, cloning a peer repo to run it, adopting an upstream utility. Fires on the ACT, not on a keyword: the trigger is *"I reached outside because ours did not cover this"* | **Sister Asset Protocol** (`knowledge/shared/rules/sister_asset_protocol.md` §Active adoption) — record the resolution difference, list **items to import** AND **items the hub can propagate** (bidirectionality is a prohibition, not a nicety), and where there is no write access write a `tracks/_audit/proposal_*.md` so the operator can decide whether to contribute it upstream. (origin: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Initiative-Row-Misses`) |

- | "용광로모드", "crucible mode", "absorb this whole corpus", "throw everything in", "re-forge FH identity", "melt this down" (total-immersion absorption, not cherry-pick — esp. a whole corpus on a core FH axis, or a frontier showcase risking FOMO) | `knowledge/shared/harness-core/crucible_mode.md` (read it, run the chain: total-ingest → steel-quench/phantom-quench melt → governor identity-bonding → sim/persona reforge → field-harvest rebirth; the core invariants stay unmeltable) |

- | "review this PR", "check diff", "code review" | code diff → built-in `/code-review`·`/review` · FH-asset coherence → `/harness-pr-reviewer` (role split) |

- | "keep watching X", "poll this", "check every N minutes", recurring WATCH item | built-in `/loop` (interval runner) — pair with the WATCH list, don't hand-poll |

- | "research this deeply", "survey the literature", "comprehensive analysis", "deep research", "look this up thoroughly", "조사해줘", "리서치" (general topic research, not trend-scan) | **Deep-Research Capability Ladder** (`knowledge/shared/harness-core/deep_research_capability_ladder.md`) — route to the highest available rung: built-in `/deep-research` if present → else Claude `WebSearch`+`WebFetch` synthesis (tier-sensitive) → `/frontier-digest` only if it's AI/harness trend-scan. **Boundary («동향/trend»+«조사» in one utterance)**: decide by TOPIC, not verb — AI/harness-adjacent trend → `/frontier-digest`, anything else → the ladder (routing probe 2026-08-10 #8: the two vocabularies co-occur in real utterances). No-reinvention: FH routes, does not build a research engine. |

- | "orchestrate agents", "parallel dispatch", "combine skills", "multiple agents" | `/agent-composer` |

- | **a material work product is about to be called done / merged / published** — public or irreversible surface · affects others · carries external claims or numbers · new behavior · security/data/permissions (proactive; the everyday "커밋하고 머지하자" utterance does **not** name an agent, so agent-composer never self-fires here — that is why this row exists) | `agent-composer` **§Author-Exposure Table** — name the exposure row, dispatch that review pass, then decide. Materiality gate + `Exposure-unclear → challenger` default live there; the lens returns evidence, never the verdict |

- | "broaden the grounded corpus", "add another version of the corpus", "ingest the full source as the grounding axiom", "여러 버전으로 통째로 가져와" (verbatim-relay corpus expansion — fail-closed grounding, no generator) | `/corpus-grounding-expander` |

- | "broaden these personas", "what other voices fit this cast", "map these roles to a decision lens", "페르소나 후보군 더 넓혀" (persona seed → tiered judgment-mapped cast; pairs with `persona-innovator` for naming) | `/persona-roster-expander` |

- | "connect a project", "map this project", "link to hub" | `auto_project_mapping.md` (mapping) |

- | "harness-ify this project", "full harness setup", "프로젝트 하네스화", "promote to full harness" | `auto_project_mapping.md §6` (Full-Harness Mode) |

- | "check install", "verify setup", "confirm install", "install-doctor" | `/install-doctor` |

- | "publish", "make public", "make this repo public", "go public", "gh repo create --public", "flip to public", "first public push", "publish the package", "npm publish", "twine upload", **"zenodo", "figshare", "OSF", "DOI", "DOI mint / 발급", "new version" under a concept DOI, "arXiv submit / replace / 제출", "예치", "deposit"** (scholarly deposit — the deposit's *metadata* is the surface, not only its PDF), **opening/updating a PR or pushing content to the public hub** (esp. company-origin) (publish intent — **proactive**, fire *before* the action; adding content to an already-public repo IS publishing that content) | **Pre-Publish Surface Gate** (see above → `/public-surface-audit` + `/marketplace-gate` Check 5 must PASS first). The commit-time half is now **hook-enforced** (mechanical confidentiality scan — see Pre-Publish Gate §Hook coverage (b)), so this proactive trigger is the salience layer over a mechanical floor. |

- | "delete the branch", "브랜치 삭제", "브랜치 정리", "clean up branches", "force-push", "rewrite history", "지워도 돼?" (destructive intent — **proactive**, fire *before* the action) | **Destructive-Op Gate** (see above → enumerate → recover → destroy; `templates/predelete_check.sh`) |

- | **"새 기능 검증해줘", "test this feature", "이 TC 확인해줘" — verifying the user's PRODUCT/feature (not FH itself)** | **Route to the mapped field harness first** (Cross-Project Skill Bus / registry) — the field harness owns product verification. The harness-verification rows in this table (`verify-bidirectional` · `prompt-regression` · `sim-conductor` · `pipeline-conductor`) verify the *harness*, and must not shadow a product-verification ask (a field project's *harness assets* — its skills/rules — still use those FH verification rows) |

- | "지난주에 뭐 했지", "what did we do last week", "예전에 이거 한 적 있나", **"find past work on X", "search for prior X", "이전에 한 작업 찾아줘"** (recall intent — 일반형, 2026-09-22 확장) | **CATALOG-first recall** — read `CATALOG.md`, identify candidates by tag/date, then open only those files. Never scan session files one by one |

- | "add this MCP server", "mount this MCP", "mcp.json에 추가", "connect this tool server" (external-MCP mount intent — **proactive**, fire *before* first tool call; mount intent only — a failing/erroring mounted server routes to `/mcp-circuit-breaker` via its own skill description; its table row was removed in the 2026-07-17 row diet, so this parenthetical no longer points "above") | `templates/.claude/rules/mcp_tool_gating.md` (name-keyed ask/allow table — never trust server annotations or names; fill §3 at mount time) |

- | "did my rule change break anything", "regression check", "test harness changes" | `/prompt-regression` |

- | **"그래프 루프 돌릴까", "가속화해볼까", "이거 재보자", "정말 되는지 확인해줘", "measure this", "prove it fires"** — 그리고 **proactive**: 살리언스 의존 자산(규칙·온보딩 문구·트리거)을 바꿔놓고 «읽으면 맞다»로 끝내려 할 때 | **Measured-Loop** (`measurement-integrity-checklist.md §Measured-Loop`) — 사전등록 봉인 → 한 변수 ARM/CTRL → 결과 전 채점기(known-pair) → **반증 조건 그대로 집행**. 실행부는 `scripts/sim_isolated_run.sh` (🟥 라이브 레포 직접 sim 금지). **설계는 opus-tier+ 권장**이고 팔은 플로어에서 돈다 — base op 가 아니라 거버너 작업이라 Sonnet-floor 위반이 아니다 |

- | "review for the team", "CTO review", "decision-maker", "share with leadership", "approval deck" | `/apex-review` |

- | "run full pipeline", "verify everything", "end-to-end sweep", "chain all verifications" | `/pipeline-conductor` |

- | "help me write a prompt", "build a prompt", "improve this prompt", "prompt template" | `/meta-prompt-builder` |

- | "/goal", "run this autonomously", "big multi-step task", "orchestrate this goal", or **any heavy autonomous/multi-agent run** (proactive — propose *before* running; it is expensive, so the proposal is mandatory, not the auto-run) | `/goal-quench` (budget gate + quality gate) |

- | "I don't know what to build", "how should I approach this", "organize this for me", "clarify this", "정리해줘" (ambiguous request before dispatch) | `/deep-clarify` |

- | **work-shaped request outside the harness domain** — "이 문서 만들어줘", "위키 페이지 써줘", "이 자료 표로 만들어줘", any general work ask no other row or skill catches (**fallback default** — a more specific row above/below always wins: 리서치→deep-research · ambiguous "정리해줘"→deep-clarify · heavy fleet→goal-quench) | **Intent-Marshaling loop** (§Intent Marshaling — mechanical capability scan → one-line compose proposal → run; gap → capability ladder) |

- | **측정을 기록했는데 reps 가 바 미달(1~2)이고, 그 결론이 «하중을 진다»** — 판정·등급·교리 변경·비가역 처방을 떠받치는 자리 (proactive; 기록하는 그 순간에 뜬다) | **한 줄로 제안한다** — *"이거 reps={n} 인데 sim 으로 {목표}까지 올릴까?"*. 🟥 **「바 미달」이라고 적고 넘어가지 마라** — 그것이 지금까지의 기본값이었고, 라벨은 측정이 아니다. 🟥 **조건이 «하중»인 이유**: 모든 reps=1 에 sim 을 걸면 소음이 된다(계기 확인용 1회는 올릴 값이 없다). **FH 자산에만 걸리는 규율이 아니다** — 필드 하네스의 자기 개선에도 같이 걸리고, 그쪽 렌즈는 §Field-Harness Diagnostic 의 `measurement-reps` 다 |

- | "memory feels bloated", "clean up memory", "memory too large", "memory hygiene" | `/memory-hygiene` |

- | **사람이 읽을 산출물이 나가기 직전** — README·가이드·리포트·장표·PR 본문 등 «독자가 여는» 것 (proactive; 코드가 옳아도 걸린다 — 이 행이 잡는 건 정확성이 아니라 **가독성**이다) | **독자로서 한 번 읽어라** — 첫 8줄에 결론이 있나 · 본문이 고정 템플릿에 덮이지 않나 · 마지막 인상이 무엇인가. 렌즈는 이미 있다: `/sim-conductor` A-1(`beginner` cold-read) 또는 직접 렌더해서 읽기. 🟥 **정적 검사는 「없는 것」을 잡고 「안 읽히는 것」은 못 잡는다** — 실측 2건이 독립 수렴했다(qasp 축: 지적 12건 중 스캐너 적발 0 · gstack 3자대면: 배포된 리포트 본문 3줄 vs 고정 템플릿 21줄). pre-commit 이 같은 상기를 advisory 로 낸다(차단 아님) |

- | "ready to PR", "about to push", "merge this", "PR 올려줘", FH asset changed in session | 4-axis auto-gate (see above — runs automatically, no proposal needed) |

- | **field verdict/gate/safety/irreversible code changed** in a mapped project **— or a merge/landing verdict asked on any gate-shaped file, mapped or not** (function returning a verdict enum / gate exit code / safety-invariant · access-control / approval / auth / exposure boundary · publish/delete/history path; «gate-shaped» = the mechanical identifier test in §Field-Harness Load-Bearing Change Gate, not a feel) — **proactive, before merge** | **Field-Harness Load-Bearing Change Gate** (see above → degrade-lint → cross-family review → converge; same rigor as FH assets, applied to field code) |

- | **a diff (yours or an unattended pipeline's) alters another harness's actual behavior, gate outcome, or interaction contract** — building automation that opens PRs autonomously, touching a synced/shared-body surface, or any change whose effect crosses a harness boundary (not merely a file-class match — most self-improvement is `not-applicable` here, which is the expected common case) — **proactive, before push, never as a post-PR comment** | **Standpoint axis** (`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7` — orthogonal to `crossfamily:`; run the diff from the TARGET harness's own repo/standpoint via `tier2`/`tier2b`/`tier3`, or record `not-applicable`/`DEGRADED_*` on the closed enum. Origin: same §CM-Initiative-Row-Misses.) |

- | **"진단해줘", "개선해줘", "diagnose this", "improve this harness", "check this project", "audit this project"** — said while working **in a mapped project** (not a single-file ask) | **Field-Harness Diagnostic** (see §Field-Harness Diagnostic above → compose existing checks into one ranked M/S/R list → HITL approval per item, nothing auto-fixed) |

- | **"새 프로젝트", "하네스 작성해줘", "이 프로젝트 가속화", "harness-ify this", "accelerate this project"** — an onboarding/acceleration door (returning-menu ①②③) | **Onboarding / Acceleration Autopilot** (see §Onboarding / Acceleration Autopilot above → Phase 0 auto-discover + branch → innovator-centered recommend → ranked install plan → HITL per item, non-overwriting; "끝까지 자율로" → full-autonomy under /goal-quench gate) |

-

- **Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed — and, symmetrically, a class **accepted 3× consecutively** earns a one-time "stop asking?" offer (§Consent promotion; never on irreversible surfaces).

- For per-skill utterance patterns, see the relevant `SKILL.md §Trigger Phrases` section.

-

- ### Cadence Rules — Check at Session Start

-

- At session start, determine the last run time from history files and auto-propose if overdue:

-

- | Skill | History File Pattern | Cadence |

- |---|---|---|

- | `/frontier-digest` | `tracks/_meta/frontier_digest_*.md` | Propose at session start if 7+ days since last run |

- | `/harness-doctor` | `tracks/_meta/*harness_doctor*.md` | Propose at session start if 30+ days since last run |

- | Weekly audit (`/harvest-loop` lightweight) | `tracks/_audit/weekly_audit_*.md` | Propose at session start if 7+ days since last run (incl. `below_floor_scan.sh` step — detail: `knowledge/shared/rules/operations.md`) |

-

- > A cadence reminder the user has repeatedly declined is **muted** per the UAP (see the loop below) — don't re-nag.

-

- #### Expedition (원정) — measured first, cadence only if it earns one

-

- **Operator, 2026-08-17**: a valuable, successful expedition becomes a **periodic proposal** (quote: same §CM-Expedition-Evidence).

-

- An **expedition** is a deliberate, extended run that uses the harness cluster at full stretch against

- targets outside this hub — contributing to an external repo, declaring a peer's assets as cluster

- nodes, driving a foreign codebase through FH's own gates. Its operating conditions are unusual and

- must not be judged by another track's: **token cost is expected and pre-approved** (the `/goal-quench`

- budget gate still applies — approval removes the prompt, never the gate), **one session will not

- finish it**, and the success definition is not "expedition completed" but ⓐ **finding the pieces that

- move identities to 🟢 faster than internal work would** and ⓑ **hardening existing weak points by

- stressing them somewhere real**. An expedition that builds nothing and produces those two has succeeded.

-

- **Promotion path — and the interval is set AFTER the first one, not before** (operator, 2026-08-17:

- *"그 주기를 얼마나에 한 번씩 잡아야 할지도 그때 세우도록 할게 — 원정 한 차례 다 마치고 답습한 후에"*).

- Expeditions are **not** on a cadence today; they are proposed case-by-case.

-

- Sequence, in order, and do not skip to the end:

- 1. **Run one, all the way through.** Not a slice — a complete expedition, however many sessions it

- takes (the thread-continuation block on the session card is the carrier).

- 2. **Absorb it** (답습) — what came back, what it cost, what it hardened, what it found that internal

- work would not have.

- 3. **Then set the interval**, informed by (2). An expedition's cadence has to be derived from what one

- actually costs and yields — a number picked before the first run is a guess wearing a schedule.

-

- 🟥 **개시 요건 — 과녁 정체성 한 줄 (2026-08-18, 원정 1차 답습이 만든 규칙).** 원정을 여는 카드는

- **어느 정체성을 겨냥하는지**를 이름과 현재 등급으로 적는다. 판별은 기계적이다: `ship_readiness_gate.md`

- 의 등급표를 **열어서** 비-🟢 를 읽고, 그중 무엇을 겨냥하는지 쓴다.

-

- ```

- 과녁: ② 인큐베이터 (🔵 RC) — 챔버 정식 EMIT 을 실상황에서 낸다

- 과녁: 없음 — 이번은 ⓑ 전용(약점 강화). 비-🟢(②·④)는 안 겨냥한다

- ```

-

- **둘째 형태도 정당한 값이다** — 금지되는 것은 «안 적는 것»뿐이다. 이유: **선언 없는 선택은 사후에

- 누락과 구분되지 않고, 저자는 언제나 「고른 것」이라고 회상한다.**

-

- **근거**: 원정 1차의 ⓐ=0 은 산출이 전부 이미 🟢 인 정체성에 떨어져 **개시 시점에 구조적으로 예정돼 있었다**. 🟥 ⓐ 를 «알아냈다»로 읽지 마라 — ⓐ 는 **«등급을 옮기는 조각»**을 요구한다(**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Expedition-Evidence` — 1차 채점과 원인, 주기 보류의 세 이유 — read before scoring or scheduling an expedition).

-

- **주기 — 1차 답습 후에도 아직 안 정한다, 그리고 그 이유가 기록이다 (2026-08-18, 운영자 승인).**

- 1차는 비용 부분 계상 · 갈래 셋 · 겨냥 오류라 그 표본으로 주기를 세우면 틀린 스케줄이 된다(같은 §CM-Expedition-Evidence).

- ⇒ 주기는 **2차 이후**로 미룬다. 대신 **2차 개시에 계측 3항이 의무**다 — 방법까지 여기 적는다

- (초안은 셋을 요구만 하고 ②③의 *방법*을 안 적었고, 플로어 티어 블라인드 sim 이 그 구멍을 지목했다):

- - ① **과녁 정체성 선언** — 위 형식 그대로, 개시 카드에.

- - ② **벽시계** — 개시 카드에 시작 시각, 완주 선언 줄에 완주 시각. 그냥 적는 것이고 계기가 필요 없다.

- - ③ **거버너 토큰** — 🟥 **세션은 자기 소비를 직접 못 읽는다**(1차 §5 가 이미 실측한 제약). 그러므로

- 의무는 «총액을 대라»가 아니라 «**읽히는 것을 다 적고, 안 읽히는 칸을 이름으로 남겨라**»다:

- 서브에이전트 토큰(완료 알림의 `subagent_tokens`) · 사이드카 토큰(각 CLI 가 출력) · **거버너 = `UNMEASURED`**.

- 🟥 **합계를 쓰지 마라** — 미측정 칸을 0 으로 접는 것이다([[feedback_not_found_is_not_zero_family]]).

- 셋이 없으면 3차에서도 «못 정한다»가 나온다.

-

- ⚠️ **This deliberately does NOT use the `operations.md` `accepted ≥ 60%` promotion gate.** Acceptance rate is the wrong quantity; the **completed run itself** sets the interval (why: same §CM-Expedition-Evidence).

- **No new gate, no new cadence table, no new registry** either — when the interval is set, it graduates

- into the existing §Cadence-Rules table like any other row.

-

- #### Event-bound proposals (context-entry, not time)

-

- Some proposals are not *time*-overdue — they fire **once when a specific work context is entered**. `persona-innovator` (ideation/naming + external-frontier absorption) is most valuable in exactly two contexts and friction-noise everywhere else, so it is proposed on context-entry rather than every session or every N days:

-

- | Context entered | Proposal | innovator mode | Guard |

- |---|---|---|---|

- | **Mapped-project acceleration** (door ③ — field harness work begins) | gap/naming scan | Mode I (internal) | once/session · UAP-suppressible |

- | **Mode D FH self-dev** (an FH asset is about to change — the 4-axis gate's own trigger) | gap + external-frontier scan | Mode F (full) | once/session · UAP-suppressible |

-

- **Not always-on** (cost + simplicity guard): innovator runs WebSearch/WebFetch, so a per-turn fire would tax tokens and risk decorative-unit over-generation — the very thing steel-quench's Wave-1 angle #1 ("is there no simpler alternative?") attacks. One proposal per context-entry; the user accepts or declines. In a Mode D session this runs *before* the change (design-time ideation), distinct from the post-change 4-axis verification gate. **Promotion is measured, not assumed**: log each outcome to `knowledge/shared/learnings/subagent_invocations_log.yaml`; escalate to a stronger cadence only after the `operations.md` gate clears (`accepted ≥ 60%`) — innovator is v0.2 with no pilot data yet. A 3×-declined proposal is UAP-muted like any cadence nag. (innovator also rides `frontier-digest --chain`; that 7-day path is unchanged and complementary.)

-

- ## Operational Adaptation Loop — User-Tuned Self-Optimization

-

- > Detail: `knowledge/shared/rules/operational_adaptation.md`

-

- Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidirectional`). A **standing, per-user operational loop** tunes FH behavior to the individual during normal field use, and escalates **only generalizable** learnings to the `field-harvest` → FH-origin PR funnel — idiosyncratic taste stays local (drift guard).

-

- - **User Adaptation Profile (UAP)** — `tracks/_meta/user_adaptation_profile.md` (local/gitignored; **behavioral prefs only, never domain content**). Records skill-proposal outcomes (`accepted`/`rejected`/`sustained` — same vocabulary as `operations.md`), preferred tier/language/cadence, recurring friction, muted nags.

- - **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, **offer standing consent on a 3×-accepted class**, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.

- - **Consent promotion (accept-side)** — repeated approval must offer to stop asking, not bill the same prompt forever: 3 consecutive `accepted` on a **registered** class (`tracks/_meta/consent_classes.yaml` — classes are declared, never minted mid-run) → **offer once, quoting the three approvals and the exact scope** → granted = a **time-limited lease**, revocable, and every unprompted run announces itself. **Not symmetric with suppression**: a bad suppression costs a re-ask, a bad grant has side effects. **Floor, decided mechanically from the registry — never by the session's own judgment**: a class never promotes if its sinks are irreversible (publish · delete · history-rewrite), if it *feeds* such a sink (**taint propagates through reversible steps**), or if that is **unknown** — unknown is not reversible. No UAP / no registry entry / expired → keep asking (absent ≠ granted). **Named residual: the ledger is self-attested** — mitigated (append-only, quoted evidence), not closed.

- - **Generalization gate** — idiosyncratic → UAP local; generalizable (any user benefits; `≥40%` reject = redefine candidate / `≥60%` accept = reinforce, per `operations.md` gate) → `field-harvest` Mode A → FH PR (HITL).

- - **Ephemeral guard** — UAP is gitignored, wiped on cloud reclaim; in ephemeral sessions operate from defaults, do not fabricate it.

-

- ## Agent Dispatch Operation (FH cwd-Based)

-

- > **Runtime authority (canonical):** one explicit governor per context + capability-routed sidecars; sidecar findings are evidence candidates, not terminal verdicts, until source-closed by the governor *via a mechanical anchor* — never governor agreement alone. 🟥 **A sidecar audits; it does not WRITE to the target tree** — findings and at-most a proposed patch as text, applied by the governor (measured 2026-08-21: an auditor sidecar edited the tree and its fix introduced a self-referential fail-open that 41 lanes passed). CC=default action/governor · Codex=user-directed governor within assigned scope, or repo-grounded audit sidecar when recruited · Gemini/agy=breadth/multimodal sidecar · other runtimes=portable `AGENTS.md` entrypoint with explicit scope. Native capability never imports Claude hook configuration or grants outward permission; Codex governor operation lives in `AGENTS.md §Governor Operation`. Full doctrine + Maintenance-Cost Rule: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.

-

- **Isolated delegation is a component of the identity, not an optional extra** (operator decision,

- 2026-08-08). FH/PMH are defined as governor + orchestrator; a harness that cannot dispatch is a

- contradiction in its own terms. So **agent dispatch is default-active**: reach for it whenever a unit

- of work is genuinely separable — independent tasks, a blind evaluation that must not see the author's

- reasoning, a search that would otherwise flood this context — **without waiting to be asked**. The

- earlier wording here ("used when the task warrants it — not as a default mode") is superseded.

-

- **Two different things turn it off, and conflating them is how a session talks itself into

- dispatching.** ⓐ the user saying not to, *in this environment* — a veto of **this file's posture**;

- ⓑ **the absence of a request**, wherever the runtime carries the conditional line described below.

- Under a conditional, silence is not permission. ⓐ is FH's own default being withdrawn by its owner;

- ⓑ is a sentence in a layer FH does not author. Do not read them as one operation.

-

- ⚠️ **Neither direction has a confirmed hook-level floor — say that plainly rather than implying one.**

- Opening (the posture) is salience-only. Blocking is **also** not hook-enforced: `SubagentStart` fires on

- spawn but is **context-only** — it cannot block and has no decision field. Whether a `permissions` deny

- entry or a `PreToolUse` matcher can target subagent spawning at all is **UNVERIFIED** — unverified, not

- absent. 🟥 **Do not cite a blocking mechanism until someone runs the known pair.**

-

- > **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Hook-Floor-Unverified`

- > — the per-direction table and what each `UNVERIFIED` line covers — read before claiming any floor here.

-

- **The conditional line, and what a session must do about it.** Some runtimes ship the default

- *"Do not call the AgentTool unless the user requested it"* (with a workflows/deep-research twin).

- Measured 2026-08-09 on this machine: it is **not** a hard-coded constant and **not** global — it is

- the third branch of a three-tier resolution, replaceable and flag-switchable, and gated to one model

- bundle. So it is a **conditional**, and a request *satisfies* it rather than having to outrank it.

- Which request, though, is an **interpretation** — narrow (per-invocation) or standing — and FH takes

- the standing reading only under provenance:

-

- ```

- RECORDED a durable local binding (CLAUDE.local.md, or the onboarding answer) carrying

- three things, each of which adds information the others do not:

- the operator's own words, quoted — who granted it

- a dated lease — until when (§OAL: consent is leased)

- a scope line — for what. A runtime may carry more than

- one prohibition line; granting one never

- grants the other

- Any of the three missing → not a record → treat as NOT RECORDED.

- → dispatch without asking, inside that scope, until the lease lapses

- (Nothing else is a field. The request removes the PROMPT and never a gate — that

- holds by the rule below, not by a line the author ticks. A field whose content is

- already fixed by the rule certifies nothing and can only fail closed on a typo.)

- NOT RECORDED no binding · fresh clone · ephemeral session whose local files were reclaimed ·

- conditional-line presence UNKNOWN (a session cannot read its own system prompt —

- unknown is not absent; assume the conditional applies)

- → request ABSENT. absent ≠ granted → ask per invocation.

- This is the default for every install that is not the author's.

- ```

-

- **A session may not write its own permission slip.** The authority is the quoted operator utterance,

- never the paragraph's existence; an entry missing any of the three **is not a record** —

- treat it as absent — *any of the three above*, not some longer list; the schema is the whole test.

- **Lease length is the operator's to set, never the session's**, and renewal needs a fresh utterance:

- a session that re-dates an expired lease on its own has forged a record, which is this paragraph's

- whole subject. **Named residual, stated at the same strength as §Operational Adaptation Loop's:

- the record is self-attested.** Every part of it is writable by the beneficiary, so form-checking

- catches silence, not forgery — and this one is **unmitigated on a default install**: the binding is

- gitignored, so there is no write-time history to check the cited dates against. (An operator who

- mirrors it into a private version-controlled store gets that check; that is *their* setup, not a

- property of the rule, and an earlier draft of this sentence claimed it generally.) The lease is the only part that decays on its own — **and nothing reads it**: `scripts/consent_registry_check.sh` already enforces leases but is **unwired here** (a different defect from «below threshold»), and wiring it is the operator's call because the registry's floor forbids promoting a class that feeds irreversible sinks. Until then the lease is **honoured by reading, not by machinery** (**Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §CM-Lease-Unwired` — read before wiring the lease check).

-

- **Scope of the consent carve-out — it exits ONE clause, not the section.** §Operational Adaptation

- Loop has two separable parts: (i) the *derivation* rule (standing consent inferred from 3× accepted),

- and (ii) **action-class floors that hold regardless of how consent arrived** — a class never promotes

- if its sinks are irreversible, if it *feeds* such a sink (taint propagates through reversible steps),

- or if that is unknown. A direct operator instruction is outside **(i) only**. **(ii) still applies in

- full**, and it bites here: a dispatched subagent inherits tools and therefore feeds publish/delete/

- history-rewrite sinks — so the standing request buys *not being asked about the dispatch*, never a

- relaxed gate at the sink. The per-run announce duty and expiry from §OAL likewise survive.

- **Discriminator is mechanical, not introspective**: the test is whether a literal operator utterance

- is quoted in the record (greppable) — **not** whether the session judges its own reasoning to be

- instruction-shaped. A self-test the session administers to itself is the thing §OAL forbids

- ("decided mechanically from the registry — never by the session's own judgment").

-

- > **Detail**: `knowledge/shared/harness-core/dispatch_conditional_prohibition.md` — the resolution

- > order, the model-bundle gate, the calibrated where-it-is-not table, and the reproduction commands.

- > **Read it before citing any of these numbers or claiming the line is absent from a surface.**

-

- 🟥 **This block has been wrong twice, both times by asserting more machinery than existed.**

- > **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Retraction-SubagentStart` — both retractions and

- > what each teaches (*"not yet measured"* is the honest label, never *"blocked"*) — read before adding a

- > mechanism claim to this section.

-

- So "default-active" is a **posture, not a guarantee**. A session that *cannot* dispatch must **say so** rather than quietly doing everything inline — the silent version is invisible until the operator asks (**Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §CM-Posture-Not-Guarantee` — the measured 2026-08-08 session — read before writing «default is active» into another canon).

-

- **Onboarding**: at first setup, ask whether this environment wants dispatch and **write the answer into

- the local binding** (`CLAUDE.local.md`) **in the three-part form above — quoted words, a lease the user

- picks, a scope** — not only into the session. Ask for all three at that moment; a record written with

- two of them is invalid, and the only route past an invalid record is the session inventing the third,

- which is forgery. **A gate that blocks every new install is not a strict gate, it is a bypass

- trainer** — so the ask is **wired, not left to prose**: `install-wizard` **Step 3-D** collects all

- three at setup and writes them down, and carries any mechanical settings change under the same

- approval (operator decision, 2026-08-09: *users of FH/PMH run parallel by default; where a mechanical

- config change is needed, take consent through the install-wizard contract and change it then*).

- A recorded **decline** is also a record — it stops later sessions re-asking. Setup is the one moment the choice is cheap (why: same §CM-Posture-Not-Guarantee). A recorded

- standing request is therefore not bookkeeping — it is the thing that satisfies the condition. Wiring the

- *blocking* direction to a mechanism still waits on the **UNVERIFIED (deny-mechanism) line** above — not

- the UNVERIFIED (call-sites) line, which is a different open question; the honest install note says so.

-

- Three execution paths:

-

- | Path | Situation | Method |

- |---|---|---|

- | **Direct edit** | Simple modification of mapped project files | Read/Edit with absolute path (no cwd switch needed) |

- | **Agent dispatch** | Field project work · single independent task — **same RECORDED requirement as the row below**; the provenance gate is per *spawn*, not per *fan-out width* | Inject Context Card then dispatch Agent |

- | **Parallel dispatch** | 2+ genuinely independent tasks — **requires a RECORDED standing request** (see the provenance gate above); otherwise ask per invocation | Dispatch parallel Agents |

-

- **Why not Agent View by default**: Agent View introduces worktree isolation (blocks settings.json writes, Stop hook timing differs), session context gaps (session card stale content bug), and path friction — with no benefit unless the user is actively managing multiple agent sessions. Parallel agents via `Agent` tool work identically in a standard session.

-

- **Fourth reason — gate-integrity in a worktree, and it is CONDITIONAL on how `core.hooksPath` was set.**

- With the **relative** form every FH doc installs, the worktree runs **its own copy** of the hook — editing

- that copy there disables the gate for that worktree (measured 2026-08-05). With a hand-set **absolute** path it runs the main tree's copy and the bypass does not exist.

- 🟥 **RETRACTED 2026-08-22** — marker and manifest are **not** structurally absent in a worktree: the hook resolves evidence through `git rev-parse --git-common-dir` (the main tree's `.git`). **The operating rule is UNCHANGED: do not commit FH assets from a worktree.** ⚠️ **Reachable is not automatic** — a relative-path write lands in the worktree's own `tracks/`; the failure message prints the absolute `MARKER_DIR`, but the routing is the author's job (**Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §CM-Worktree-Retraction` — the known-negative probe and the open risk areas — read before re-listing reasons for the rule).

-

- > **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Worktree-Gate-Integrity` — the two-arm table with

- > exit codes, and why an earlier draft declared the bypass *refuted* from n=1 on a non-shipped setting —

- > read only when you must determine which arm your own install is on.

-

- 🟥 **And before `git worktree remove`, reclaim gitignored `tracks/**` first** — `bash scripts/worktree_reclaim.sh <worktree> --apply` (lists to a file, then copies and byte-verifies; rc=1 while anything is left only in the worktree). The Destructive-Op gate enumerates *commits* and is structurally blind to gitignored files — measured twice (2026-09-02 signal file, 2026-09-05 governance log).

-

- **Therefore: do not commit FH assets from a worktree.** Not "carry the evidence in carefully" — a

- carried marker and a fabricated one are byte-identical, so *marker provenance* is unenforceable by

- construction. Land FH-asset changes from the standard session.

-

- **Do not let that unenforceability launder the enforceable part**: *being in a worktree* is trivially detectable (`--git-common-dir` ≠ `--git-dir`), yet `templates/.git-hooks/pre-commit` has **zero** lines of worktree detection — left un-mechanized for a *scope* reason (recurrence 1, below N≥3), not an impossibility one; if it recurs, the check is a two-line hook addition (**Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §CM-Worktree-Detection` — read before adding it).

-

- **Forbidden responses**: *"I can't do that — I'm not in that project's cwd"* — self-check Agent dispatch

- first. And **silently working alone while dispatch is unavailable**: if this environment blocks

- subagents, name it once rather than absorbing the whole job inline — an unstated constraint reads as a

- capability the harness simply chose not to use.

-

- Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.

-

- **Invocation log obligation — now mechanically reconciled, not recall-dependent**: immediately after

- any custom sub-agent invocation, append to `knowledge/shared/learnings/subagent_invocations_log.yaml`

- (8 fields · outcome: `accepted`/`partial`/`rejected`/`sustained` — `sustained` = decided NOT to invoke,

- also recorded). This feeds the 60/40 promotion gate + UAP loop; detail:

- `knowledge/shared/rules/operations.md`.

- **Floor (2026-08-02)**: a `SubagentStop` hook tallies every dispatch and `session_close_check.sh` ④-e

- blocks a close push when dispatches happened and the day's entries are ZERO. Consolidating a class of

- dispatches into one entry with measured counts is fine and is not penalised — the check catches the

- total miss, not imperfect bookkeeping. The hook only tallies and never writes an entry — a fabricated `outcome`/`evidence` would poison the promotion gate worse than a missing one (origin: `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §CM-Invocation-Log-Origin`).

-

- ### Context Card — Required Format for Dispatch

- ```

- [Session Context Card]

- Purpose: {task/session purpose} | Completed: {what's already done}

- This agent's task: {specific task + target files/paths} | Note: {constraints/history}

- ```

- Simple file-lookup agents may omit. Agent dispatch works from any mapped project cwd — for FH skills, specify `~/projects/forge-harness/` explicitly.

-

- ---

-

- ## Intent Marshaling — General-Work Serving (runtime default)

-

- FH/PMH is a **purpose organization**, not only a meta-harness: when the leader states a work intent in

- plain language — wiki/document production, research-and-write, organizing, **any work-shaped ask, not

- just harness building** — the session **marshals installed capability** (skills · agents · mapped

- harnesses · memory) into a one-line composition proposal and runs it. "This is a harness hub, not for

- that" is a forbidden deflection — serving general work is identity (the registry + mapped harnesses +

- memory exist only here; a plain chatbot cannot marshal them). Marshal-by-feel is the defect this

- replaces (same shape as pre-#158 lens selection): the capability scan is **mechanical** (skill list ·

- `LOCAL_SKILL_REGISTRY` · mapped assets), never recall — and it **carries trust tiers**: run-first

- autonomy covers **FH-native capability with per-action-reversible steps only**; a non-FH sibling hit

- stays at its registry `ask-tier` (propose-only) and an outward-mutating action (send · post · deploy ·

- delete) keeps its own gate — marshaling never upgrades either. Capability gap (declared only by citing

- the scan result, never a bare "nothing fits") → the goal-quench Step C ladder semantics at request

- scale (internal scan → external search → in-session synthesis; **persist** routes to the New-Skill

- gate, **install** to plugin-recommender's HITL — no new gates).

-

- > **Detail (read before applying the ladder or when a gap appears)**:

- > `knowledge/shared/harness-core/intent_marshaling_general_work.md` — the 5-step loop, gate-routing

- > table, Sonnet-floor boundaries, and the origin defect.

-

- ---

-

- ## Cross-Project Skill Bus (Active Throughout Session)

-

- Based on LOCAL_SKILL_REGISTRY (Step 1-c), **propose and connect skills from other projects directly**. Proposal: *"{Project} has `{skill-name}`. Want me to dispatch it via Agent?"*

-

- - **Direct execution** (no project files needed): Read SKILL.md → execute steps directly

- - **Agent dispatch** (project files needed): dispatch via Agent tool + Context Card, absolute path, no cwd switch; 2+ independent tasks → parallel dispatch

-

- **Typed capability (cockpit lane)**: a field harness's **mechanical** layer may additionally be

- registered as a **typed capability** and called directly; its prose layer stays at dispatch. Before

- composing, read `knowledge/shared/harness-core/capability_composition_contract.md` — constraints merge

- **strictest-wins regardless of layer** (FH may tighten a field harness, never loosen one), and an

- untyped or silent channel is `HARNESS_ERROR`, never PASS.

-

- **Guard**: FH native skill takes priority over cross-project proposal for the same signal.

-

- ## FH Improvement Signal Recording Protocol

-

- > **Full format + template**: `knowledge/shared/harness-core/fh_detail_protocols.md` — read when creating a signal file.

-

- **Triggers**: user confusion/retries · user proposes improvement · AI self-detects skill/rule limitation · new FH-worthy pattern discovered

-

- **Method**: create `tracks/_meta/fh_signal_{YYYY-MM-DD}_{source}.md` (1 file/session, append if same date+source). Structural candidates only — exclude typos and in-session-resolved issues.

-

- **Chamber-candidate hook (feeds the discovery pipeline)**: when a signal is an *incubatable capability or project* (uncertain / exploratory / failure-expensive / high-reinvention-risk — a chamber-run candidate, not just a fix), add a `CHAMBER-CANDIDATE: <one-line description>` line to the signal file. `scripts/chamber_candidate_collect.sh` greps that convention across the 6 sources (harness-doctor · harvest-loop · fh-signal · field-harvest · frontier-digest · uap), dedups/ranks, screens for reinvention, and skips anything the G4 ledger already KILLed. Adoption is incremental — the queue is honestly sparse until sources emit the marker; the collector measures the real volume.

-

- ## Execution Tier Settings

-

- > **Full tier table + config**: `knowledge/shared/harness-core/fh_detail_protocols.md` — read when selecting a non-default tier.

-

- **Default: standard (~15K tokens).** Temporary change: say "use light mode" or "switch to max" in session.

- Tiers: S=light(~5K) · M=standard(~15K, FH default) · L=full(~30K) · XL=max(~60K+)

-

- ---

-

- ## Operational Status

-

- > Usage modes (A/B/C) + what-you-get (Layer 1/2) + **ephemeral-session handoff rule** (leave a surfaced handoff in a durable location before an ephemeral/cloud session ends): `knowledge/shared/rules/modes_and_value.md`

-

- ## Session Wrap-up — Card Update Protocol

-

- **Real-time completion tracking (card bug prevention)**: When any S-tier/A-tier/backlog item is completed during a session, **immediately** (before context compression) append to `tracks/_meta/fh_completed_{YYYY-MM-DD}.md`.

- Format: `- ✅ {item title} — {one-line completion method}`

- harvest-loop Step 0-b uses this file as its source — relying on LLM memory after compression causes omissions.

-

- **Session close chaining (automatic sequence — not skippable)**:

- ```

- Closing phrase detected ("wrap up", "done", "good work", "end session", etc. — 🟥 **in any language**, on the same footing as the greeting trigger: 「마감」·「마무리하자」·「終わり」·「收尾」 all count. The returning-branch greeting *teaches* this phrase **in the user's language**, so a trigger list that only accepts English would tell the user a word the machine then ignores. Found by blind floor-tier sim 2026-08-29: the greeting emitted 「마무리하자」, which appeared nowhere in this list.)

- → ① Check git diff + unpushed commits (status snapshot)

- → ①-b Open-PR sweep — `gh pr list --author @me --state open` (+ `gh search prs --author @me

- --state open` cross-repo). Classify, **surface-not-auto**: **self-mergeable** PR (own repo,

- checks green) → *propose merge now* (never auto-merge — HITL); **awaiting-external** →

- *surface for tracking only*. (Origin PR#111 + count-consistency pairing → §detail below.)

- → ①-f 발화 착지 (advisory) — 이번 세션 전사본의 운영자 발화가 오늘자 기록에 착지했는지

- 기계로 grep 한다(`scripts/utterance_intake.sh`). **막지 않는다** — rc=1 은 «기록하라»가

- 아니라 «확인하라»다(키 낱말 프로브라 과차단 방향). ①-c~①-e 는 스크립트에만 산다.

- → ② If FH assets changed, **or `close_retro` is granted**: harvest-loop

- (후자는 Step 0-d 세션 회고 — 자산 미변경 세션에도 회고는 의미가 있다)

- → ③ Sync local/gitignored session state to your durable companion store, if you keep one

- → ④ Memory hygiene — update stale entries + record new session findings.

- **Deliberately unmechanized** — a judged step; `session_close_check.sh` carries NO ④ check

- (its `④-log` block is the completion log). Why: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Hygiene-Unmechanized`.

- → ④-b npm freshness — if any npm-shipped asset changed (`package.json` `files[]`: skills · agents ·

- knowledge/ · docs/ · README · AGENTS.md · CLAUDE.md · CHEATSHEET · CATALOG.md): **first an entry-point

- drift check — BIDIRECTIONAL** — the script (`session_close_check.sh`) auto-*fires a candidate reminder*

- by cheap grep (file co-occurrence, not topical parity), then **you judge** whether the changed topic

- actually mirrors a section on the other side; sync it, else record `drift:none`. The grep flags; it does

- not determine — the parity call is judged. **Both directions fire, because the two entry points are read

- by different runtimes and a rule living in only one is invisible to the other**:

- ▸ *CC→Codex* — `CLAUDE.md`/`knowledge/` changed, `AGENTS.md`/`docs/codex-compat.md` did not

- ▸ *Codex→CC* — `AGENTS.md`/`docs/codex-compat.md` changed, `CLAUDE.md`/`knowledge/` did not

- Version lockstep invalidates the plugin.json *cache* but is **orthogonal** to

- entry-point *content* — a version-only bump can ship a stale Codex entry point (gate-locality,

- Codex side). Then **propose republish**: version bump **in lockstep**

- across `package.json` + every `.claude-plugin/plugin.json` + `.claude-plugin/marketplace.json` (single-source =

- `package.json`) → Pre-Publish gate → `npm publish` → `git tag vX.Y.Z` at publish. **Propose, don't

- auto-publish.** (Why lockstep — Codex caches on plugin.json version — + drift-check + tag-drift caveat → §detail below.)

-

- 🟥 **WHICH DIGIT (운영자 결정 2026-08-17 — 의도적으로 strict semver 가 아니다; 번호가 읽는 이에게 무엇을 말하나)**:

- **major** = 완전히 새로 지음 · 정체성 다섯이 «전부» 🟢 · capability **class** 신설/교체(게이트 조임엔 절대 안 씀) ·

- **minor** = 새 자산·게이트 레인·행동 교리 — 소비자 게이트 수용을 깨면 릴리스 설명과 CHANGELOG 에

- `BREAKING (gate): <무엇이 막히나> — <처방>` 의무 · **patch** = 수정·배선·행동 무변경 문서.

- > **Detail**: `knowledge/shared/harness-core/claude_md_gate_details.md §Version-Digit-Policy` — 표 원문 · class/instance 판별 ·

- > 3.0.0 판례 — **버전 자릿수를 실제로 정할 때 읽어라.**

- → ④-c Handoff lifecycle (cross-machine continuity) — when a durable **result artifact lands** this

- session (mechanical hint: a new `*result*`/`*signal*`/`*_run_*` file in your companion store or

- `tracks/`), do two things: **(a) ④-c stamps** any `"run this/start here"` run-handoff whose

- result landed with `STATUS: SUPERSEDED by <path> (<date>)` (one-line edit, not a Destructive-Op);

- **(b) flag the matching card carry item resolved for ⑤** — ⑤ owns the card write (card-last

- guard), ④-c never edits the card. **First-run no-op** if no matching handoff/carry exists.

- (Why-its-own-step origin + ownership split + salience/backstops → §detail below.)

- → ⑤ **Log-close + card update, in that internal order** ← ABSOLUTE LAST: must capture ①–④-c

- outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to

- `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`

- is CLOSED — a later append re-opens the violation ⑤ exists to prevent.

- **Late finding (named case)**: a finding that surfaces AFTER (b) — including while writing

- the final message to the operator — means ⑤ is **not done**. Re-run ⑤ **whole**: append,

- then **rewrite the card**. Appending alone is the violation; the card must never be older

- than `fh_completed`.

- → ⑥ Commit card + push

- ```

-

- > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md` — `§Session-Close-npm-Freshness`

- > (④-b: Codex cache-path drift, the 3-way drift example, tag-drift caveat) · `§Session-Close-Handoff-Lifecycle`

- > (④-c: why-its-own-step origin, ownership split, salience/backstops) · `§Open-PR-Sweep-Origin` (①-b) — read

- > when executing that close step.

-

- > **다축 마감 (같은 하네스에 세션이 둘 이상일 때)**: 순서·판별·쓰기 규율은

- > `knowledge/shared/rules/multi_session_close_protocol.md` 가 정본이다. **접기 전에 살아있는

- > peer 에게 「더 있나」를 묻는 단계가 있고, 그 질문은 `gh pr list` 재대조로 대체되지 않는다**

- > (PR 이 없는 델타를 구조적으로 못 잡는다 — 2026-08-09 실측 8건). 세 가지를 각각 못 믿는다:

- > **보냈다≠닿았다 · 살아있다≠일하는중 · 닫혔다≠안열렸다.** 기계 표면화는

- > `session_close_check.sh` ①-c·①-d, 내용 착지는 `scripts/utterance_landing_check.sh`.

- > **읽어라 — 이 요약에는 판별 규칙도 쓰기 규율도 없다.**

-

- **Card-last guard**: ①–④-c (incl. ①-b open-PR sweep, ④-c handoff lifecycle) must ALL complete before

- ⑤ runs. **Mechanical floor**: `scripts/session_close_check.sh` is **wired into `templates/.git-hooks/pre-push`** (2026-07-20) — it runs on *every* push, so it is no longer prose-invoked. Enforcement is surface-matched: an ordinary push **surfaces** ❌ violations (advisory — a branch push is reversible), and the **close push blocks** on them: run step ⑥ as **`FH_SESSION_CLOSE=1 git push`** → exit 1 (card-last violated / required close artifact missing) stops the push until fixed. *Why not block always*: same §CM-Close-Atomic-Origin. Any new information produced during ①–④ (new commits from a merged self-PR, model changes,

- new findings, a carry item flipped to DONE) feeds INTO ⑤ — card is never written mid-sequence and

- then left open for more work to accumulate after it.

-

- **⑤ is atomic because prose repairs failed (N=3, 2026-07-28)**: `fh_completed` is the **first half of** ⑤, so a close-time finding has exactly one landing order — log, then card. On a violation the pre-push gate **names the offending files and prints their last lines**; `session_close_check.sh` also carries a **⑤-b card-drift probe** (advisory, never blocks) that cross-checks the card's *absence claims* against disk (**Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Close-Atomic-Origin` — read before restructuring ⑤).

-

- **Mid-session card writes are drafts**: If a task (e.g., a calibration run) internally updates

- the card, that is a draft. The close chain always re-runs ⑤ to capture post-draft activities.

- Never skip ⑤ because "the card was just updated" — check for delta first.

-

- Card update is NOT a sub-step of harvest-loop — even if harvest-loop is skipped, card update must run.

-

- **Agent View pre-read (mandatory when session ran in Agent View / worktree / background job)**: Before writing the card, read your companion store's handoff files (if you keep one) to recover sub-agent completions that may not be in main session context. Skipping this step in Agent View is the root cause of "card created with stale content" bugs — the main context does not automatically see worktree-completed items.

-

- **Card update obligation** (independent obligation — regardless of harvest-loop completion): Update `reference_next_session_starter.md`.

- ① **Agent View pre-read** (see above) → ② Step 0-b cross-check generates removal list → ③ Remove completed items → ④ Add new priorities → ⑤ Fix stale paths/versions → ⑥ Overwrite → ⑦ Output "BEFORE N items → AFTER M items" diff.

- "Delta update" not "snapshot" — completed items remaining in next session card is a bug.

- 🟥 **그리고 그 역방향도 버그다 — «안 닫힌 것이 사라지는 것».** 재작성은 줄이는 일이 아니라 «완료를 덜어내는」 일이다: 카드에서 빠진 항목은 ⓐ `fh_completed_{date}.md` 에 완료로 적혔거나 ⓑ 카드에 «왜 뺐는지」가 적혀 있어야 하고, 둘 다 아니면 유실이다. (2026-08-24 실사고: `knowledge/shared/harness-core/claude_md_gate_details.md §CM-Card-Loss-Evidence`) 기계 앵커는 `session_close_check.sh` ⑤-C(이전 카드의 **미래 날짜**가 카드나 오늘 완료 로그에 살아 있나) — 🟥 **날짜 토큰만 보므로 날짜 없는 미완은 구조적으로 못 잡는다**(앵커지 floor 아님). 외부 근거: arXiv 2607.26637(같은 절). 같은 규율을 카드·메모리·상주 문서를 **줄이는 모든 패스**(마감 ⑤ · `/memory-hygiene` · `/salience-splitter`)에 적용한다 — «줄여라」만 있는 지시는 조용히 사실을 지운다. ⚠️ 그 연구는 반대 방향도 함께 보고한다(작은 코퍼스에서는 응축이 56.2% → 68.8% 로 **도움**) — 그래서 이 규칙은 «줄이지 마라」가 아니라 «빠진 것은 완료이거나 명시된 것이어야 한다」다.

-

- **Thread-continuation block (operator, 2026-08-16)**: *"특정 주제에 집중해서 진행한 세션이라면

- 앞으로도 마감할 때 그 갈래로 이어갈 수 있게 알아서 정리해줘."* When a session ran predominantly on

- **one thread** (an incubation, one field harness, one doctrine arc) — as opposed to scattered

- maintenance — the card additionally carries a **named continuation block for that thread**, without

- being asked:

-

- ```

- 🧵 <thread name> — 이어가려면

- 지금 어디 : <state, with the artifact that proves it — a verdict line, a test count, a merged PR>

- 다음 한 걸음: <the single next action, concrete enough to start without re-deriving>

- 안 닫힌 것 : <what is open, stated as open — not omitted>

- 읽을 것 : <the 1-3 files that reconstitute context, in read order>

- ```

-

- Not a second card and not a summary of the session — it is the **entry point for the next session

- that picks up this thread**, and it is written so that session does not have to re-derive where the

- thread stood. A scattered-maintenance session correctly writes none. Two or more threads → one block

- each, in priority order.

-

- ## Session Sync / Knowledge Push Protocol

-

- > Detailed procedure: `knowledge/shared/rules/sync_push_protocols.md`

-

- When the user requests "sync", "save session", etc., follow the `sync_push_protocols.md` protocol. CATALOG.md format, tag conventions, and track mapping are also referenced in that file.

-

- ## Sister Asset Protocol

-

- > Detailed procedure (3 steps · restrictions · branch sync): `knowledge/shared/rules/sister_asset_protocol.md`

- When a sibling asset on the same topic is discovered (internal team or external frontier), follow `sister_asset_protocol.md`. Keep the detection threshold low — the goal is to close awareness gaps.

- ## Operations Reference

- > CATALOG.md format · tag conventions: `knowledge/shared/rules/sync_push_protocols.md`

- > Sub-agent operations · weekly improvement cycle · maturity 3-phase roadmap: `knowledge/shared/rules/operations.md`