[CLAUDE] Docs: S149-S150 closeout — bookend lượt đầu end-to-end (hình B) + 2 arc đóng + tally #53 chốt 45
All checks were successful
Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m48s
All checks were successful
Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m48s
- Arc-1 hội-tụ-bookend (rename 5 vai + 4 máy PS1 + C9-C12) + arc-2 adap-backlog 23/23 + probe Opus-5 khép (S149)
- Bookend @close S150: wave 6 vai (4 đo + 2 KIỂM) → 20 FLAG disposition từng-dòng; ring1 31/34-ĐẠT, ring2 10/10 + M-1 view-stale-role-desc
- Khoá _frozen_until_owner CẮM trước h24-signal-write (frozen-held in thật); 9 class FIRE; JUMP dải {5,4,4,3}+asym{1,4} chờ anh #21
- STATUS bump CURRENT S149-S150 + 2 khối Recently Done; HANDOFF segment mới + re-stamp đủ-slug + (17)(18)(19) lật + (14) viết lại + 6 slot #21-#26
- K2 posture-A @engine PHẦN K + K5 luật TÁCH vòng-đo-mới @session-end (O-2/O-3 OWNER-DELEGATED execute)
- sleep-doc derive-monitor-set (bỏ hardcode 4-tên); spawn-model-audit desc/comment fix; h24-signal-write param-default fix (first-live bug)
- M9 on-behalf ×3 (tooling + inv-cb F3 + reviewer F4); ring1/ring4 nhà seed; ring2 3 cite-dead vá
- Sổ garble #53 derive-from-body chốt 45 + sub-class ngược-#53/skeleton-ruột-rỗng (ghi-đĩa CẦN-KHÔNG-ĐỦ)
- Session-log S149-S150 (Sàn-5 đăng-ký 6 run=) + closeout-synthesis dạng-1
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
pqhuy1987
@ -565,7 +565,7 @@ $TitleFreshSkip = @('\docs\_archive\')
|
||||
# explain it. That quote is byte-identical to a live anchor -- being identical is
|
||||
# the POINT of a good example -- so a pattern-matcher flags the teacher.
|
||||
# Measured on disk @S123: 4 H24-1 flags, 2 are this exact case:
|
||||
# .claude/agents/lead-view-auditor.md:45 quotes the anchor as the EXAMPLE
|
||||
# .claude/agents/lead-stale-auditor.md:45 quotes the anchor as the EXAMPLE
|
||||
# for its own class `view-stale-header`
|
||||
# docs/governance/adap-reports/...harness-24...:78 quotes it while EXPLAINING that
|
||||
# very false-positive <- 3rd generation
|
||||
@ -581,7 +581,7 @@ $TitleFreshSkip = @('\docs\_archive\')
|
||||
# not USED (use/mention distinction). Count backticks left of the match; ODD => we are
|
||||
# inside an open span => quoted example => keep looking. Measured 4/4 ON DISK TODAY:
|
||||
# BARE -> docs/rag-setup-plan.md:4 . form-engine/SKILL.md:15 = TRUE POSITIVE, still fires
|
||||
# QUOTED -> lead-view-auditor.md:45 . adap-report...:78 = FALSE POSITIVE, now skipped
|
||||
# QUOTED -> lead-stale-auditor.md:45 . adap-report...:78 = FALSE POSITIVE, now skipped
|
||||
#
|
||||
# 4/4, NOT the "5/5" an earlier draft of this comment claimed (fixed S123 after review).
|
||||
# The would-be 5th case, permission-matrix/SKILL.md:16, IS NOT ON DISK ANY MORE and does
|
||||
@ -1514,6 +1514,399 @@ else {
|
||||
$h245Note = if ($h245Measured) { '' } else { ' -- MEASURED NOTHING (skipped above); a 0 after a skip is not a green' }
|
||||
Write-Host (" H24-5 counter-ancestor flags = {0} [INFORM-only, LOW, NOT folded into TOTAL baseline]{1}" -f $h245Flags, $h245Note) -ForegroundColor DarkGray
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# C9 - hmw WIDTH mirror-drift (INFORM-only, NEW @S149; count SEPARATE, NOT in TOTAL)
|
||||
# ---------------------------------------------------------------------------
|
||||
# WHY: `hmw_width.cap` in memory-budget.json is CANONICAL, but hmw.js must hardcode the
|
||||
# same number as a MIRROR because the workflow sandbox has no filesystem (hmw.js:5).
|
||||
# Two copies of one number = exactly the drift class B1 exists to prevent. Measured @S149:
|
||||
# `grep -ril 'width' scripts/` = 0 hit => nothing was checking this pair at all.
|
||||
# INFORM-only per repo convention: a NEW net reads separately first; folding into TOTAL
|
||||
# (and raising severity) is post-triage and owner-gated, never the net author's call.
|
||||
Write-Section 'C9 - hmw WIDTH mirror-drift (INFORM-only)'
|
||||
$c9Flags = 0
|
||||
$c9Measured = $false
|
||||
$hmwP = Join-Path $RepoRoot '.claude\workflows\hmw.js'
|
||||
$budP = Join-Path $RepoRoot '.claude\agent-memory\memory-budget.json'
|
||||
if (-not (Test-Path $hmwP)) {
|
||||
Write-Host ' [skip] hmw.js not found' -ForegroundColor DarkGray
|
||||
}
|
||||
elseif (-not (Test-Path $budP)) {
|
||||
Write-Host ' [skip] memory-budget.json not found' -ForegroundColor DarkGray
|
||||
}
|
||||
else {
|
||||
$hmwTxt = Get-Content -LiteralPath $hmwP -Raw -Encoding UTF8
|
||||
$mirrorM = [regex]::Match($hmwTxt, 'const\s+WIDTH_CAP\s*=\s*(\d+)')
|
||||
$budObj = $null
|
||||
try { $budObj = (Get-Content -LiteralPath $budP -Raw -Encoding UTF8 | ConvertFrom-Json) } catch { $budObj = $null }
|
||||
$canon = if ($null -ne $budObj -and $null -ne $budObj.hmw_width) { $budObj.hmw_width.cap } else { $null }
|
||||
|
||||
if (-not $mirrorM.Success) {
|
||||
# FAIL-LOUD on absence: a missing mirror is NOT a green. Same discipline as H24-2
|
||||
# (missing key => fail loud, never assume a default).
|
||||
Write-InformFlag (Rel $hmwP) `
|
||||
'hmw WIDTH mirror MISSING: no `const WIDTH_CAP = <n>` found - the cap may have been removed or renamed, which silently drops the runaway guard' `
|
||||
'restore the mirror, or if the guard was intentionally retired, remove hmw_width from memory-budget.json in the SAME change'
|
||||
$c9Flags++; $c9Measured = $true
|
||||
}
|
||||
elseif ($null -eq $canon) {
|
||||
Write-InformFlag (Rel $budP) `
|
||||
('hmw WIDTH canonical MISSING: hmw.js hardcodes {0} but memory-budget.json has no hmw_width.cap - the number has no owner-visible home' -f $mirrorM.Groups[1].Value) `
|
||||
'add hmw_width {cap, mechanism, ratified, _ratified_by} to memory-budget.json (precedent: distill_trigger O-1/O-6)'
|
||||
$c9Flags++; $c9Measured = $true
|
||||
}
|
||||
else {
|
||||
$c9Measured = $true
|
||||
$mirrorN = [int]$mirrorM.Groups[1].Value
|
||||
$canonN = [int]$canon
|
||||
if ($mirrorN -ne $canonN) {
|
||||
Write-InformFlag (Rel $hmwP) `
|
||||
('hmw WIDTH DRIFT: hmw.js mirror={0} but memory-budget.json hmw_width.cap={1} - the running guard does not match the ratified number' -f $mirrorN, $canonN) `
|
||||
'sync hmw.js WIDTH_CAP to the canonical value, then re-run the 2-way fault-inject on the new number (cap+1 => 4 loud lines; cap => silent)'
|
||||
$c9Flags++
|
||||
}
|
||||
else {
|
||||
Write-Host (" [ok] WIDTH mirror {0} == canonical hmw_width.cap {1}" -f $mirrorN, $canonN) -ForegroundColor DarkGray
|
||||
}
|
||||
}
|
||||
}
|
||||
$c9Note = if ($c9Measured) { '' } else { ' -- MEASURED NOTHING (skipped above); a 0 after a skip is not a green' }
|
||||
Write-Host (" C9 width-drift flags = {0} [INFORM-only, LOW, NOT folded into TOTAL baseline]{1}" -f $c9Flags, $c9Note) -ForegroundColor DarkGray
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# C10 - logic-session folder missing / unopened (INFORM-only, NEW @S149)
|
||||
# ---------------------------------------------------------------------------
|
||||
# WHY THIS EXISTS - first-person evidence, not a hypothetical:
|
||||
# /session-start BUOC 0.8 requires opening `.claude/sessions/session-<N>/` at the START of a
|
||||
# session. At S149 the lead ECHOED that very rule verbatim (BUOC 0 prints the whole command
|
||||
# body) and then skipped it anyway - the folder was created ~1.5h late, after 3 large
|
||||
# workflows, and only because the OWNER noticed. Owner's words: "day la ly do ma nghi thuc
|
||||
# nay bat buoc". A rule that lives only in lead memory is not a rule; it is a hope.
|
||||
# Same class as the `trio: skipped` WAL trace (ghost-wire: mandated, never once written).
|
||||
# WHAT IT CHECKS: every session-<N> folder must (a) match ^session-\d+$, (b) carry its
|
||||
# _context-s-<N>.md, and (c) the HIGHEST N must be OPEN (no _end / closed.md) - because a
|
||||
# running session must have an open logic-session to write into. All-closed => nobody opened
|
||||
# one for the session that is running right now.
|
||||
# 🔸 KHAI THAT - what this CANNOT do: it cannot prove the folder was opened EARLY (on time).
|
||||
# A late-but-present folder reads identical to a punctual one. It catches ABSENCE, not
|
||||
# LATENESS. Closing that gap needs a timestamp compare against session start, which the
|
||||
# detector has no reliable source for. Do not read a green C10 as "ritual ran on time".
|
||||
# INFORM-only per repo convention (new net reads separately; folding into TOTAL is owner-gated).
|
||||
Write-Section 'C10 - logic-session folder (INFORM-only)'
|
||||
$c10Flags = 0
|
||||
$c10Measured = $false
|
||||
$sessRoot = Join-Path $RepoRoot '.claude\sessions'
|
||||
if (-not (Test-Path $sessRoot)) {
|
||||
Write-Host ' [skip] .claude/sessions not found' -ForegroundColor DarkGray
|
||||
}
|
||||
else {
|
||||
$c10Measured = $true
|
||||
$sessDirs = @(Get-ChildItem -LiteralPath $sessRoot -Directory -ErrorAction SilentlyContinue)
|
||||
if ($sessDirs.Count -eq 0) {
|
||||
Write-InformFlag (Rel $sessRoot) `
|
||||
'no logic-session folder at all: /session-start BUOC 0.8 opens session-<N>/ but none exists' `
|
||||
'create .claude/sessions/session-1/ with _context-s-1.md (STOCK-map + FLOW-START)'
|
||||
$c10Flags++
|
||||
}
|
||||
else {
|
||||
$maxN = -1
|
||||
foreach ($d in $sessDirs) {
|
||||
if ($d.Name -notmatch '^session-(\d+)$') {
|
||||
Write-InformFlag (Rel $d.FullName) `
|
||||
("logic-session folder name '{0}' breaks the machine-scannable form ^session-\d+$" -f $d.Name) `
|
||||
'rename to session-<N> (no L<mm>, no descriptive suffix - tooling scans this pattern)'
|
||||
$c10Flags++
|
||||
continue
|
||||
}
|
||||
$n = [int]$Matches[1]
|
||||
if ($n -gt $maxN) { $maxN = $n }
|
||||
$ctx = Join-Path $d.FullName ("_context-s-{0}.md" -f $n)
|
||||
$legacy = @(Get-ChildItem -LiteralPath $d.FullName -Filter 'pause-*.md' -ErrorAction SilentlyContinue).Count
|
||||
if (-not (Test-Path $ctx) -and $legacy -eq 0) {
|
||||
Write-InformFlag (Rel $d.FullName) `
|
||||
("session-{0} has neither _context-s-{0}.md (hub form) nor legacy pause-*.md - the folder carries no narrative at all" -f $n) `
|
||||
'write _context-s-<N>.md with (a) STOCK-map pointers and (b) FLOW-START'
|
||||
$c10Flags++
|
||||
}
|
||||
}
|
||||
if ($maxN -ge 0) {
|
||||
$topDir = Join-Path $sessRoot ("session-{0}" -f $maxN)
|
||||
$isClosed = (Test-Path (Join-Path $topDir '_end')) -or (Test-Path (Join-Path $topDir 'closed.md'))
|
||||
if ($isClosed) {
|
||||
Write-InformFlag (Rel $sessRoot) `
|
||||
("highest logic-session (session-{0}) is CLOSED and no newer one was opened - if a session is running now, BUOC 0.8 was skipped" -f $maxN) `
|
||||
("open session-{0} with _context-s-{0}.md; only /session-start may mint a new <N>" -f ($maxN + 1))
|
||||
$c10Flags++
|
||||
}
|
||||
else {
|
||||
Write-Host (" [ok] session-{0} is OPEN (no _end/closed.md)" -f $maxN) -ForegroundColor DarkGray
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
$c10Note = if ($c10Measured) { '' } else { ' -- MEASURED NOTHING (skipped above); a 0 after a skip is not a green' }
|
||||
Write-Host (" C10 logic-session flags = {0} [INFORM-only, LOW, NOT folded into TOTAL baseline]{1}" -f $c10Flags, $c10Note) -ForegroundColor DarkGray
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# C11 - H24 FLAG-khuon + diary-delta (INFORM-only, NEW @S149; count SEPARATE, NOT in TOTAL)
|
||||
# ---------------------------------------------------------------------------
|
||||
# TWO checks over run-folder H24 artifacts, both born from a MEASURED S148 loss:
|
||||
# (a) FLAG-khuon: every H24 auditor sub-file (name carries lead-stale|lead-gap|ring2-audit)
|
||||
# that RAISES an enumerated FLAG-<n> must tag it as
|
||||
# "## FLAG-<n> <em-dash> `<class>` <em-dash> <SEV>" (class family view-* / gap-*)
|
||||
# A file that carries a FLAG-<n> but has NO conforming tag line => the by-class tally
|
||||
# that reads these files CANNOT count it. That is the exact S148 defect: the vong
|
||||
# dropped the khuon and 2 of 9 FLAGs fell out of the count (spec M4). INFORM, because
|
||||
# the fix is procedural (re-tag), not a build break.
|
||||
# -> WHY the enumerated form "FLAG-<n>" and NOT the bare word "FLAG": a CLEAN auditor
|
||||
# legitimately writes "0 FLAG" / "no FLAG this run" - which contains the word FLAG
|
||||
# but raised nothing to tag. Triggering on the bare word would FLAG a clean run =
|
||||
# false positive on the very role (ring2-audit) that most often reports 0. The
|
||||
# enumerated form appears ONLY when a flag was actually raised. This REFINES the
|
||||
# spec's loose "chu FLAG" to the non-false-positive signal (anti-Goodhart: a 0 must
|
||||
# be a real 0, never a net that cannot tell clean from broken).
|
||||
# -> LIMIT (khai that): file-level. One conforming tag line silences the whole file, so
|
||||
# a file that tags 1 of 2 flags is NOT caught here (partial-tagging is a harder check
|
||||
# the tally itself must do). C11 catches the TOTAL-omission case S148 actually hit
|
||||
# (khuon dropped entirely). A QUOTED example tag also counts as conforming => a doc
|
||||
# quoting the format reads silent; silence is the safe direction (no false alarm).
|
||||
# (b) diary-delta (M9): a run-folder carrying sub-<role>-*.md for an INFORM-only role (list
|
||||
# read LIVE from .claude/agents/*.md frontmatter carrying 'INFORM-only') means that role
|
||||
# RAN and produced an artifact. If the role's diary (.claude/agent-memory/<role>/) has
|
||||
# NO git commit at/after that artifact's mtime, the role ran but nobody seeded its memory
|
||||
# => GAP-3 (spec M9: recurred x4 S124->S149). git is the delta source the spec names; it
|
||||
# is a LOCAL VCS query, not a model/API, so it is within the NO-API mandate. A missing OR
|
||||
# older commit => flag. git absent => say so (do not read "cannot measure" as clean).
|
||||
# *** FROZEN-HISTORY GATE (critical): only run-folders with LastWriteTime >= $C11_LAND_DATE scanned.
|
||||
# Older folders predate this khuon AND the separated lead-stale/lead-gap roles; re-flagging
|
||||
# them is noise about a closed period (spec section 1: "S148 ve truoc = frozen, da biet").
|
||||
# Do NOT "freshen" the constant below - it is the day C11 landed, by design.
|
||||
# INFORM-only per repo convention (new net reads separately; fold into TOTAL is owner-gated).
|
||||
Write-Section 'C11 - H24 FLAG-khuon + diary-delta (INFORM-only)'
|
||||
$c11Flags = 0
|
||||
$c11Measured = $false
|
||||
|
||||
# LAND DATE - the day this detector shipped (S149, spec M4). Run-folders touched BEFORE this
|
||||
# are frozen history. GRANULARITY note (measured @S149): the S148 force-fire folder shares
|
||||
# this calendar day but wrote a COMBINED sub-h24-audit-*.md that matches NONE of the
|
||||
# lead-stale|lead-gap|ring2-audit name patterns, so it is scanned-but-inert. Verified on disk
|
||||
# @S149: `find runs -name '*lead-stale*' -o -name '*lead-gap*' -o -name '*ring2-audit*'` = 0
|
||||
# hits across ALL history => the FIRST files to match will be produced by roles running UNDER
|
||||
# this khuon, i.e. after this lands. A date-level gate therefore suffices (no matching trigger
|
||||
# file exists in any frozen folder, so nothing frozen can fire).
|
||||
$C11_LAND_DATE = [datetime]'2026-07-24'
|
||||
|
||||
$runsRoot = Join-Path $RepoRoot '.claude\workflows\runs'
|
||||
if (-not (Test-Path $runsRoot)) {
|
||||
Write-Host ' [skip] .claude/workflows/runs not found' -ForegroundColor DarkGray
|
||||
}
|
||||
else {
|
||||
# INFORM-only role list, read LIVE from agent frontmatter so a NEW monitor auto-joins
|
||||
# (spec M9: "doc song"). Scoped to the frontmatter block (where description lives) so a
|
||||
# body mention of 'INFORM-only' in a non-monitor agent does not falsely enroll it.
|
||||
$informRoles = New-Object System.Collections.Generic.List[string]
|
||||
$agentsDir = Join-Path $RepoRoot '.claude\agents'
|
||||
if (Test-Path $agentsDir) {
|
||||
foreach ($af in (Get-ChildItem -LiteralPath $agentsDir -Filter *.md -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -ne 'README.md' })) {
|
||||
$al = @(Get-Content -LiteralPath $af.FullName -Encoding UTF8 -ErrorAction SilentlyContinue)
|
||||
if ($al.Count -eq 0 -or $al[0].Trim() -ne '---') { continue }
|
||||
$fmEnd = -1
|
||||
for ($j = 1; $j -lt $al.Count; $j++) { if ($al[$j].Trim() -eq '---') { $fmEnd = $j; break } }
|
||||
if ($fmEnd -le 1) { continue }
|
||||
$fmLines = $al[1..($fmEnd - 1)]
|
||||
if (($fmLines -join "`n") -notmatch 'INFORM-only') { continue }
|
||||
$rname = $null
|
||||
foreach ($fl in $fmLines) {
|
||||
$nm = [regex]::Match($fl, '^\s*name:\s*(.+?)\s*$')
|
||||
if ($nm.Success) { $rname = $nm.Groups[1].Value.Trim(); break }
|
||||
}
|
||||
if (-not $rname) { $rname = $af.BaseName }
|
||||
if (-not $informRoles.Contains($rname)) { $informRoles.Add($rname) | Out-Null }
|
||||
}
|
||||
}
|
||||
|
||||
# git availability probe (part b needs it). Absent git => part (b) cannot measure delta;
|
||||
# we say so per file rather than silently reading a role as clean.
|
||||
$gitOk = $false
|
||||
try { $null = (& git --version 2>$null); $gitOk = ($LASTEXITCODE -eq 0) } catch { $gitOk = $false }
|
||||
|
||||
# class-tag khuon (M4). em-dash from code point ($EM_DASH, :112 - ASCII-source rule,
|
||||
# gotcha #30); backtick optional (roles sometimes drop the code-span); class view-/gap-.
|
||||
$flagEnumRx = 'FLAG-\d+'
|
||||
$flagTagRx = '## FLAG-\d+ ' + $EM_DASH + ' `?(?:view-|gap-)[a-z-]+`? ' + $EM_DASH + ' (?:LOW|MED|HIGH)'
|
||||
$roleNameRx = '(?i)(lead-stale|lead-gap|ring2-audit)'
|
||||
|
||||
$freshFolders = @(Get-ChildItem -LiteralPath $runsRoot -Directory -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.LastWriteTime -ge $C11_LAND_DATE })
|
||||
|
||||
foreach ($rf in $freshFolders) {
|
||||
$subMd = @(Get-ChildItem -LiteralPath $rf.FullName -Filter 'sub-*.md' -File -ErrorAction SilentlyContinue)
|
||||
foreach ($sm in $subMd) {
|
||||
|
||||
# ---- (a) FLAG-khuon: H24 auditor sub-file must class-tag every raised flag ----
|
||||
if ($sm.Name -match $roleNameRx) {
|
||||
$c11Measured = $true
|
||||
$smLines = @(Get-Content -LiteralPath $sm.FullName -Encoding UTF8 -ErrorAction SilentlyContinue)
|
||||
$hasEnum = $false; $tagged = $false; $firstEnumLine = 0
|
||||
for ($li = 0; $li -lt $smLines.Count; $li++) {
|
||||
if ($smLines[$li] -cmatch $flagEnumRx) { $hasEnum = $true; if ($firstEnumLine -eq 0) { $firstEnumLine = $li + 1 } }
|
||||
if ($smLines[$li] -match $flagTagRx) { $tagged = $true }
|
||||
}
|
||||
if ($hasEnum -and -not $tagged) {
|
||||
if ($firstEnumLine -eq 0) { $firstEnumLine = 1 }
|
||||
Write-InformFlag ("{0}:{1}" -f (Rel $sm.FullName), $firstEnumLine) `
|
||||
'H24 FLAG-khuon: sub-file raises FLAG-<n> but has NO conforming class-tag line "## FLAG-<n> [em-dash] `<view-/gap-...>` [em-dash] SEV" - the by-class tally cannot count an untagged flag (S148 lost 2/9 flags exactly this way)' `
|
||||
'tag EACH raised flag on its own line "## FLAG-<n> [em-dash=U+2014] `<class>` [em-dash] SEV" (class in view-*/gap-*); one conforming line un-flags the file'
|
||||
$c11Flags++
|
||||
}
|
||||
}
|
||||
|
||||
# ---- (b) diary-delta (M9): INFORM-only role artifact with no fresher diary commit ----
|
||||
foreach ($role in $informRoles) {
|
||||
if ($sm.Name -match ('^sub-' + [regex]::Escape($role) + '[-.]')) {
|
||||
if (-not $gitOk) {
|
||||
Write-Host (" [note] git unavailable - diary-delta for role '{0}' NOT measured (not read as clean)" -f $role) -ForegroundColor DarkGray
|
||||
continue
|
||||
}
|
||||
$c11Measured = $true
|
||||
$diaryRel = ".claude/agent-memory/$role/"
|
||||
$gitOut = $null; $code = 1
|
||||
try { $gitOut = & git -C $RepoRoot log -1 --format=%cI -- $diaryRel 2>$null; $code = $LASTEXITCODE } catch { $gitOut = $null; $code = 1 }
|
||||
$diaryTime = $null
|
||||
if ($code -eq 0 -and $gitOut) {
|
||||
$parsed = [datetime]::MinValue
|
||||
if ([datetime]::TryParse(([string]$gitOut).Trim(), [ref]$parsed)) { $diaryTime = $parsed }
|
||||
}
|
||||
if (($null -eq $diaryTime) -or ($diaryTime -lt $sm.LastWriteTime)) {
|
||||
$seen = if ($null -eq $diaryTime) { 'no diary commit found' } else { ('diary last commit ' + $diaryTime.ToString('yyyy-MM-ddTHH:mm')) }
|
||||
Write-InformFlag (Rel $sm.FullName) `
|
||||
("diary-0-delta (GAP-3): role '{0}' produced an artifact (mtime {1}) but its diary has no newer commit ({2}) - role ran, memory not seeded (spec M9)" -f $role, $sm.LastWriteTime.ToString('yyyy-MM-ddTHH:mm'), $seen) `
|
||||
("lead APPEND agent-memory/{0}/ on-behalf IN THE SAME session (khuon B3) and commit, so next session does not enter blind" -f $role)
|
||||
$c11Flags++
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
$c11Note = if ($c11Measured) { '' } else { ' -- MEASURED NOTHING (no fresh H24 sub-file or INFORM-role artifact in the >= land-date window); a 0 after a skip is not a green' }
|
||||
Write-Host (" C11 FLAG-khuon + diary-delta flags = {0} [INFORM-only, LOW, NOT folded into TOTAL baseline]{1}" -f $c11Flags, $c11Note) -ForegroundColor DarkGray
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# C12 - raw-engine-bypass (INFORM-only, NEW @S149; count SEPARATE, NOT in TOTAL)
|
||||
# ---------------------------------------------------------------------------
|
||||
# FLOOR SOURCE - hub answer, quoted from
|
||||
# broadcasts/inbox/ai_infra/2026-07-03-ai_infra-to-se-batch13-ack-stamp-and-answers.md:27-29
|
||||
# (section title :27 = "Tra loi cau hoi 1 - detector 'workflow chay ngoai engine chuan' co bat
|
||||
# buoc khong?"; answer :29, verbatim, diacritics stripped for the ASCII-source rule):
|
||||
# "Co, o muc san-chuc-nang; con hinh thuc thi SE tu quyet. San = du an phai CO mot cach phat
|
||||
# hien duoc duong chay workflow khong di qua engine chuan cua minh (vi duong do bo qua toan
|
||||
# bo enforce ve harvest ky uc + vai + checkpoint - day la lop loi tung gay tut chat luong ky
|
||||
# uc toan fleet, da RCA). Hinh thuc dat san thi tu chon: grep transcript, quet ledger-vs-run-
|
||||
# folder, hay 'untracked-run detector nhe' nhu SE de xuat - deu dat, mien chay deu moi cuoi
|
||||
# phien."
|
||||
# => This CLOSES the live residue of broadcast 2026-06-18-Governance-h10-flat-detector-refine
|
||||
# khoan (b), which SE TAILORED-OUT at S72 (docs/governance/adap-reports/
|
||||
# 2026-06-18-Governance-harness-10-flat-refine-checklist-v2.md:46). The tailored-out reason
|
||||
# ("SE runs through the Anthropic Workflow tool, no CLI-launcher bypass-surface") was later
|
||||
# FALSIFIED on disk: S119 measured THREE spawn paths - hmw.js (gated), raw Workflow, raw
|
||||
# Agent - two of them ungated (docs/changelog/sessions/
|
||||
# 2026-07-15-S119-adap-6-broadcast-spec-v3.md:69 and :128, "ke CON-LAI").
|
||||
# FORM CHOSEN = session-log sweep (item 1/3 of the hub menu, the cheapest). It ships inside this
|
||||
# net, which is invoked at session-end => satisfies "chay deu moi cuoi phien".
|
||||
# WHAT IT CHECKS: a session log that MENTIONS a spawn (line carrying 'raw Workflow' / 'raw Agent'
|
||||
# / 'raw-Agent' / a 'wf_' run id) while the WHOLE FILE carries no 'run=' line. 'run=' is the
|
||||
# registration token of the wf: line - form measured on disk: "wf: <label> run=<run-id>
|
||||
# runId=wf_<hex>" (docs/changelog/sessions/2026-07-16-2250-S129-adap-errata-eol.md:8) - and it
|
||||
# is what binds a spawn to a tracked run-folder. Mention-without-registration = the signature
|
||||
# of a workflow that ran outside the standard engine.
|
||||
# USE/MENTION discriminator (citation-trap class): a doc that DESCRIBES this detector inevitably
|
||||
# contains its own trigger tokens. Two enclosure guards, both on the silence side:
|
||||
# (a) lines inside ``` fences are skipped;
|
||||
# (b) a line that also names 'C12' or 'governance-detectors' is skipped (self-reference).
|
||||
# Stated cost: a REAL bypass reported on a line that happens to name C12 reads silent. For a
|
||||
# day-one INFORM net, silence is the safe direction (a false alarm kills the net faster).
|
||||
# [!] KHAI THAT - what this CANNOT do:
|
||||
# (1) FILE-level guard: ONE 'run=' anywhere silences the whole file. A session that registered
|
||||
# run A and then spawned B raw is NOT caught. Per-spawn correlation is not derivable from
|
||||
# the session log's prose.
|
||||
# (2) It reads the session's OWN account. A bypass nobody wrote down stays invisible - this is
|
||||
# a self-report net, not a transcript net (the transcript form on the hub menu covers that,
|
||||
# at much higher cost). Do NOT read a green C12 as "no bypass happened".
|
||||
# (3) It does not prove the run-folder exists; it only reads the registration token.
|
||||
# *** FROZEN-HISTORY GATE (critical): only session logs with LastWriteTime >= $C12_LAND_DATE.
|
||||
# MEASURED reason (dry run 2026-07-25 over all 148 session logs): 36 carry 'wf_' but only 9
|
||||
# carry 'run=' => 29 files would flag on day one. Those predate both the wf:-registration habit
|
||||
# and this net; re-flagging a closed period is noise, and 29 LOW lines on day one is exactly how
|
||||
# a net gets ignored. Same discipline as C11. Do NOT "freshen" the constant below - it is the
|
||||
# day C12 landed, by design.
|
||||
# INFORM-only per repo convention (a new net reads separately first; folding into TOTAL and
|
||||
# raising severity is post-triage and owner-gated, never the net author's call).
|
||||
Write-Section 'C12 - raw-engine-bypass (INFORM-only)'
|
||||
$c12Flags = 0
|
||||
$c12Measured = $false
|
||||
|
||||
# LAND DATE - the day this detector shipped (S149, C-b). Session logs touched BEFORE = frozen.
|
||||
$C12_LAND_DATE = [datetime]'2026-07-25'
|
||||
|
||||
$sessLogDir = Join-Path $RepoRoot 'docs\changelog\sessions'
|
||||
if (-not (Test-Path $sessLogDir)) {
|
||||
Write-Host ' [skip] docs/changelog/sessions not found' -ForegroundColor DarkGray
|
||||
}
|
||||
else {
|
||||
# Spawn-mention tokens. 'raw[- ]Workflow|Agent' covers both spellings seen on disk
|
||||
# (S119:69 writes "raw Workflow"/"raw Agent"; S131:17 writes "raw-Agent").
|
||||
$bypassRx = 'raw[-\s]?(?:Workflow|Agent)|wf_'
|
||||
$runRegRx = 'run='
|
||||
$mentionRx = 'C12|governance-detectors'
|
||||
|
||||
$freshLogs = @(Get-ChildItem -LiteralPath $sessLogDir -Filter *.md -File -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.LastWriteTime -ge $C12_LAND_DATE })
|
||||
|
||||
if ($freshLogs.Count -eq 0) {
|
||||
Write-Host (' [note] no session log with mtime >= {0} - window EMPTY, nothing measured (not a green)' -f `
|
||||
$C12_LAND_DATE.ToString('yyyy-MM-dd')) -ForegroundColor DarkGray
|
||||
}
|
||||
|
||||
foreach ($sl in $freshLogs) {
|
||||
$c12Measured = $true
|
||||
$slLines = @(Get-Content -LiteralPath $sl.FullName -Encoding UTF8 -ErrorAction SilentlyContinue)
|
||||
|
||||
# File-level registration guard: one wf: run= line anywhere means this session DID
|
||||
# register its run-folder(s) -> whole file silent (see LIMIT (1) above).
|
||||
$registered = $false
|
||||
foreach ($ln in $slLines) { if ($ln -match $runRegRx) { $registered = $true; break } }
|
||||
if ($registered) {
|
||||
Write-Host (" [ok] {0} carries a run= registration line" -f $sl.Name) -ForegroundColor DarkGray
|
||||
continue
|
||||
}
|
||||
|
||||
$inFence = $false
|
||||
$hitLine = 0
|
||||
$hitTok = ''
|
||||
for ($li = 0; $li -lt $slLines.Count; $li++) {
|
||||
$ln = $slLines[$li]
|
||||
if ($ln -match '^\s*```') { $inFence = -not $inFence; continue }
|
||||
if ($inFence) { continue }
|
||||
if ($ln -match $mentionRx) { continue }
|
||||
$bm = [regex]::Match($ln, $bypassRx, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
|
||||
if ($bm.Success) { $hitLine = $li + 1; $hitTok = $bm.Value; break }
|
||||
}
|
||||
|
||||
if ($hitLine -gt 0) {
|
||||
Write-InformFlag ("{0}:{1}" -f (Rel $sl.FullName), $hitLine) `
|
||||
("raw-engine-bypass: session log mentions a spawn ('{0}') but the WHOLE file carries no 'run=' registration line - a workflow that never registered a run-folder skips the harvest/role/checkpoint enforcement (hub floor 2026-07-03 answer, section 3)" -f $hitTok) `
|
||||
"add the wf: line 'wf: <label> run=<run-id> runId=wf_<id>' to this session log, or re-run through .claude/workflows/hmw.js so a tracked run-folder exists; a DELIBERATE raw-Agent monitor is fine but must be declared in a session that also carries run="
|
||||
$c12Flags++
|
||||
}
|
||||
else {
|
||||
Write-Host (" [ok] {0} - no unregistered spawn mention" -f $sl.Name) -ForegroundColor DarkGray
|
||||
}
|
||||
}
|
||||
}
|
||||
$c12Note = if ($c12Measured) { '' } else { ' -- MEASURED NOTHING (no session log at/after the land date); a 0 outside the window is not a green' }
|
||||
Write-Host (" C12 raw-engine-bypass flags = {0} [INFORM-only, LOW, NOT folded into TOTAL baseline]{1}" -f $c12Flags, $c12Note) -ForegroundColor DarkGray
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Summary + C4 self-exclusion audit (RUNTIME proof)
|
||||
# ---------------------------------------------------------------------------
|
||||
@ -1537,7 +1930,7 @@ if ($selfInScan -eq 0 -and $leaked -eq 0) {
|
||||
|
||||
Write-Host ''
|
||||
Write-Host ("TOTAL FLAGS: {0}" -f $script:FlagCount) -ForegroundColor Cyan
|
||||
Write-Host ("INFORM-ONLY (new nets C6 cite-2-tier + H24-4 pending-flip + H24-5 counter-ancestor-classify): {0} - counted SEPARATELY, NOT in TOTAL above (anti-Goodhart, owner-set; fold+sev-raise is post-triage)" -f $script:InformCount) -ForegroundColor DarkGray
|
||||
Write-Host ("INFORM-ONLY (new nets C6 cite-2-tier + H24-4 pending-flip + H24-5 counter-ancestor-classify + C9 hmw-width-drift + C11 h24-flag-form + C12 raw-engine-bypass): {0} - counted SEPARATELY, NOT in TOTAL above (anti-Goodhart, owner-set; fold+sev-raise is post-triage)" -f $script:InformCount) -ForegroundColor DarkGray
|
||||
Write-Host 'NOTE: DETECT-only lowering net. Exit 0 always (never fails build). FLAGs are advisory.' -ForegroundColor DarkGray
|
||||
|
||||
exit 0
|
||||
|
||||
Reference in New Issue
Block a user