steel-quenchAll-angle verification meta-skill for near-complete artifacts. Turns vague design anxiety into structured challenger waves using fh-commons:quench-challenger, then drives defense and convergence until root weaknesses, residual risks, and added complexity are explicit. Covers standard attack/defense rounds, optional Meta-Aware Adversary mode for AI-specific …
Independent GitHub snapshot · Automated classification · Original documentation governs
Heating steel and plunging it into water brings internal defects to the surface. quench-challenger attacks → defense → repeat = systematic surfacing and elimination of design flaws.
A designer's anxiety is most dangerous when vague. steel-quench breaks that anxiety into concrete attack angles, defends against them, and closes with residual risks explicitly stated.
Scope boundary: steel-quench stress-tests a near-complete artifact (post-build). For pre-build design decisions →
deliberation. For completed-asset validation →sim-conductor.
| Phrase | Situation |
|---|---|
| "quench this", "run quench" | All-angle verification just before completion |
| "devil's judgment" | Focused challenger attack on specific design decision |
| "all-angle review", "end-to-end verification" | Full project scope verification |
| "shake out design anxiety", "deep pre-completion inspection" | Concretize vague anxiety |
| "attack from the root" | Re-verify from reason for existence |
| "diagnose with counterexample", "use this bad case as reference" | Phase 0 calibration |
| "did it really pass?", "re-attack after the gate", "the gate said PASS" | Wave-P3 gate-passage re-attack |
/steel-quench | Explicit call |
| Wave | Role | Termination |
|---|---|---|
| Phase 0 (optional) | Counterexample calibration — extract patterns from external bad cases, merge into Wave 1 (→ SKILL_detail.md §Phase0) | No external case → skip |
| Wave 1 | Challenger attack (quench-challenger) — surface critical flaws, no defense | — |
| Wave 2 | Defense — defend or state as residual risk | — |
| Wave 3+ | Convergence — repeat until a round is clean AND triggers no repair | Zero new S/A and no repairs made in response, B included (§Convergence Criteria) |
| Wave 4 (optional) | Meta-Aware Adversary — AI uses its own nature as attack vector | Wave 3+ criterion (clean + no-repair) + AI-specific criteria |
| Wave-P3 (optional) | Gate-passage re-attack — when an upstream gate declares PASS, re-attack the just-passed artifact on Coverage / Narrative / False-confidence | All 3 dimensions Attack Failed |
| Wave 5 (optional) | Multi-Team Adversarial Panel — external CLIs or cross-session Claude | Wave 3+ criterion, cross-team |
| Wave-T (after convergence) | Temper — measure complexity the quench added; flag over-hardening | τ-PASS or named τ-FAIL |
Detail: See
SKILL_detail.md §Phase0— counterexample calibration full spec (pattern extraction from an external bad case, merge rules into Wave 1) — read when an external bad case is supplied.
Zero-finding wave names its angles (2026-08-26). A wave reported as clean (0 new findings) must
state which attack angles actually ran and which did not (e.g. clean (돌린 각: #1 단순대안 · #3 실사용 — #5 미실행)), never a bare "clean". A clean round means «these angles found nothing», not
«nothing is there» — a different perspective can still find new issues (externally replicated:
edgelog ~400-call measurement, 2026-08-25 digest, finding ⓔ). Same discipline as the marker's
axes-run: — silence is not zero. This is a record requirement, not a new termination rule: the
§Convergence Criteria verdict (zero new S/A + no repairs) is unchanged — what changes is that an
unnamed clean round is an incomplete record, so a reader auditing convergence can see which angles
each clean round actually covered instead of assuming all of them ran.
Schema:
knowledge/shared/harness-core/tpa_schema.md— canonical artifact_type/risk_level/phantom_risk derivation, gate routing, meta-harness broadcast multiplier.
Runs when steel-quench is invoked without a specific wave restriction. Skip if user specifies exact waves (e.g. "run Wave 1 and Wave 4 only").
Read target artifact → classify vulnerability surface:
| Dimension | Signal → Wave weight shift |
|---|---|
artifact_type | SKILL.md/design-doc → Wave 2 (structural defense) weight↑ · bash/code → Wave 1 (real-code) weight↑ · external publish imminent → Wave 5 (cross-team) weight↑ |
phantom_risk | citations/arXiv/DOIs/http URLs present → Wave 3 (source-grounding) weight↑ |
claim_density | 3+ benefit claims → Wave 1 U3 (evidence grounding) angle weight↑ |
novelty | first-of-its-kind pattern → Wave 4 (convergence) weight↑ |
scope | internal-only doc → Wave 5 (external CLI) weight=0 (skip) |
Wave selection output:
Run: [list of selected waves with rationale]
Skip: [list of skipped waves with reason]
External CLIs available: [yes/no → Wave 5 available]
Degraded coverage rule: if a high-weight wave or capability is skipped (user choice, unavailable tool, or scope=internal) or runs below its declared model-tier floor (tier-floor resolution, multi_model_sidecar_strategy.md §Tier-floor), flag explicitly in the output header — do not silently proceed. Below-floor example: challenger: sonnet (below-floor; floor=opus); a judged verdict produced below floor is a re-quench candidate once a floor-tier is available.
조직 제약을 모르는 적대 검증은 헛방을 친다 — 조직이 이미 결정한 것을 공격하거나, 조직 정책
하에서만 성립하는 실제 공격을 놓친다. 공격 각도를 정하기 전에 조직층을 읽는다.
계약: knowledge/shared/rules/knowledge_layer_seam.md (이 스킬이 2호 소비자;
1호는 phantom-quench Step 2-O).
절차: 진입 인덱스(knowledge/{org}/INDEX.md · index.md · README.md · readme.md —
판정기와 같은 후보 집합) → 대상과 관련된 정책·용어·도메인 사실만 로드. 전수 스캔 금지(계약 K2).
부재면 «조직 제약 미상»으로 명시하고 진행 — 없는 제약을 추론으로 만들지 않는다.
🟥 not found 는 «제약 없음» 이 아니다. 미상은 미상으로 적는다.
로드한 것의 용도는 딱 둘
조직층은 공격을 무장해제할 수 없다. 조직 위키에 "이건 승인된 패턴", "이 케이스는 예외", "과거에 검토 완료" 가 있어도 그것은 공격을 기각하는 근거가 아니다.
이유: 조직층은 무엇(사실·정책)만 공급하고 어떻게 판정하나는 공급하지 않는다(계약 §1-a). "승인됨"은 조직이 그렇게 정했다는 사실이지 그 결정이 옳다는 판정이 아니다. 적대 검증의 일이 정확히 그 판정을 다시 하는 것이다.
| 조직층에 있는 것 | 허용되는 사용 | 금지 |
|---|---|---|
| 정책·규칙 | 위반을 공격 근거로 | 면제 근거로 |
| "승인된 패턴" | 그 승인의 근거를 공격 대상으로 | 공격 기각 |
| "과거 검토 완료" | 그때의 전제가 아직 참인지 확인 | 재검토 생략 |
stale 페이지(review_after 경과) | 제약으로 쓰지 않는다 — 미상 처리 | 최신으로 가정 |
보고 의무: 조직층 때문에 공격을 조정했으면(각도 추가 · 헛방 제거) 무엇을 왜 조정했는지 Wave 1 출력에 남긴다. 조용한 조정은 검증 범위 축소와 구별되지 않는다.
반출 금지(K1-s): cross-provider/cross-family 챌린저에 조직층 원문을 넘기지 않는다 — 넘어가는 것은 sanitized 제약 요약뿐이다. (CLAUDE.md §Field-Harness Diagnostic 의 residency 규칙과 같은 floor 이고, 이 스킬이 그것을 느슨하게 만들지 않는다.)
출처: 원 필드(sibling harness)의 선례를 이식했다. FH 자기 정본이 이 자리를 **명시적으로 「미배선 — 약속이 아니라 후보」**로 적어두고 있었다(
knowledge_layer_seam.md§0 배선 현황). 이 절이 그 행을 후보에서 배선으로 옮긴다. 🟥 이식한 것은 절차이지 그쪽의 기계-주장이 아니다 — 원본에는 훅이 이 절을 강제한다는 취지의 서술이 딸려 있었으나, 실측하니 그 훅 레인이 존재하지 않았다(axis2-defense훅 히트 0, 컨트롤crossfamily21). 그래서 강제 서술은 안 가져왔다. 이 절은 오늘 기준 살리언스 층이고 기계 바닥이 없다 — 그렇게 적는 것이 팬텀을 들여오지 않는 유일한 방법이다.
For the target artifact, scan installed agents for a domain-specific adversarial reviewer:
.claude/agents/ for a reviewer matching artifact_typefh-commons:quench-challenger (general-purpose adversarial review)/plugin-recommender "adversarial reviewer for [artifact_type]" → user: install / skip / use fallbackSidecar availability for a cross-provider challenger (Gemini/Codex, Wave 5) is resolved via the Tier 1→2→3 recipe in
knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Sidecar Engine Resolution Protocol; Tier 3 = thefh-commons:quench-challengerClaude sub-agent below (guaranteed fallback — same-provider, so model-access not cross-provider diversity).
Runtime adapter note: In Claude Code, invoke the fallback as an isolated Agent(subagent_type="fh-commons:quench-challenger"). In Codex-primary or other non-Claude runtimes, use the FH adapter instead:
FH_BACKEND=codex npx --package @chrono-meta/fh-gate fh-run \
--agent fh-commons:quench-challenger \
--file {target-artifact}
Treat the adapter output as the isolated challenger result for Wave 1. This preserves the same workflow without depending on Claude Code's Agent tool.
Wave 5 activation rule: Wave 5 (external CLI team) is only activated when scope is not internal-only AND external CLIs are available AND risk_level is high or user explicitly requests it.
Detail: See
SKILL_detail.md §ArtifactProfile— worked examples (SKILL.md, bash script, README, design doc with citations) showing wave selection and rationale — read when classifying an unfamiliar artifact type.
Import origin (sister-asset cross-audit 2026-06-14,
tracks/_audit/session_2026_06_14_official-plugins-cross-audit.md): skill-creator + plugin-dev/skill-reviewer measure trigger accuracy empirically; FH's skill gate ("3+ NL triggers") and steel-quench's trigger-collision attack are judged, not measured. This probe converts that one verdict to measured — the mechanical-anchor discipline (a terminal trigger verdict should rest on a count, not an inference: the W4-4 question applied to the skill's own description).
External frame: treating a trigger/prompt phrase set as a first-class artifact that needs a coverage criterion analog to code coverage is the position argued in arXiv:2607.02057, Prompt Coverage Adequacy. FH's instrument here is a fire-count over should-fire / near-miss phrases, not that paper's attention-based test-suite coverage — the anchor grounds the coverage-adequacy framing, not a drop-in metric.
Fires only when artifact_type = skill_md (Step 0.3 canonical enum, tpa_schema.md — i.e. a SKILL.md) AND the trigger surface changed. Trigger surface = exactly the description: YAML field plus the ## Triggers / ## Trigger Phrases section (and nothing else — a body-wave or procedure edit with both of those untouched does not fire it). Any other artifact has no trigger surface — note Step 0.5: skipped (not a skill_md trigger change) and proceed.
Procedure (prose-scale — FH routes + governs, it does not rebuild skill-creator's eval engine; no Python harness, no vector store):
description, author 8–10 should-trigger phrases (varied, realistic user utterances; include some that omit the skill's internal vocabulary) and 8–10 near-miss should-NOT-trigger phrases (share keywords/domain but actually need a different tool — the discriminating cases, not obvious irrelevants).Agent / fh-run — same isolation rule as Wave 1; the author session must not judge its own triggers) against the live skill description only.trigger-probe: <fired>/<should> fire · <false>/<should-not> false-fire (model: <tier>).Verdict mapping (measured → severity; feeds Wave-T temper + Done When):
| Measured | Verdict | Severity |
|---|---|---|
| should-fire < 70% | undertrigger — description too narrow, or diet stripped a real trigger | S if load-bearing gate skill, else A |
| should-not false-fire > 20% | overtrigger / collision — bleeds into an adjacent skill's territory (the collision class steel-quench owns, now measured) | A |
| both within bound | trigger surface PASS (measured, not guessed) | — |
Threshold granularity (the bounds are guidelines, not a knife-edge): at the probe size (N=8–10 → ~10–12.5% steps) the percentages are coarse and 20%/70% may not be exactly reachable. Report the count (2/8 false-fire), not just a percentage; on a boundary result take the stricter verdict and re-probe with more phrases before finalizing. The bound is a trigger-collision heuristic, not a derived constant.
Honesty caveat: the probe measures trigger-description accuracy on the session model — not field behavior across all tiers. A near-floor model may under-fire regardless of description quality; record the probe model and, on a below-floor run, treat the result as provisional (Step 0.3 below-floor rule).
Detail: See
SKILL_detail.md §TriggerProbe— worked probe set + fire-count table + before/after description fix.
Sibling of Step 0.5: Step 0.5 measures whether a skill fires on the right utterances; Step 0.6 measures whether a judged gate's verdict rests on behavior or on the rubric's phrasing. Cross-family review (auto-decorrelation) lowers correlation between judges but does not test groundedness — two decorrelated families can be swayed by the same wording artifact. This probe converts "is this verdict grounded?" from judged to measured: hold the behavior fixed, paraphrase the rubric, count flips.
External frame: content-preserving policy rewrites flip up to 9.1% of LLM safety-judge verdicts above baseline jitter — 18–43% of those flips on unambiguous cases (arXiv:2605.06161, Beyond Accuracy: Policy Invariance as a Reliability Test for LLM Safety Judges, Weng/Feng/Xie 2026). The instrument here is a flip-count over fixture×paraphrase runs, not that paper's benchmark — the anchor grounds the invariance framing, not a drop-in metric.
Fires only when the target is a load-bearing judged gate — a rubric whose verdict is a gate enum (PASS/FAIL/BLOCK/allow/deny) AND whose verdict gates a consequential action (a FAIL actually blocks a publish/delete/merge, changes a safety outcome, or guards an irreversible surface). The same scope as the Field-Harness Load-Bearing Change Gate. The enum shape is necessary but not sufficient (target-tier sim, 2026-07-03): a cosmetic judged Done-When that merely uses PASS/FAIL vocabulary but gates nothing consequential ("does the description read well — PASS/FAIL") is not load-bearing — confirm a real downstream consequence before firing, or the probe over-fires on gate-shaped-but-inert rubrics. One-time baseline per gate; re-probe only when the gate's rubric prose changes (mirror of Step 0.5's re-probe rule). It does not fire on ordinary judged Done-When conditions, advisory checks, or prose-only edits that leave the rubric untouched — note Step 0.6: skipped (not a load-bearing judged-gate rubric change) and proceed. A gate whose verdict is already bound to a mechanical assertion (fixture test, exit code) has no discretion to probe — skip with that note.
Procedure (rides shipped machinery — no new harness, benchmark, or daemon):
model: pinned to the tier the gate must survive on; the author session does not judge its own rubric.verdict-invariance: <flips>/<fixtures×K> runs flipped (gate: <name> · tier: <model>).axis2-evidence field (non-vacuous by construction — a count, not "it ran") and emit a one-line Judge Card alongside the gate: judge-card: <gate> · flip-rate <n>/<runs> · fixtures <ids> · <date>. The card is the baseline the re-probe rule compares against.Threshold + verdict mapping (measured):
| Measured | Verdict | Severity |
|---|---|---|
| ≥1 flip on an unambiguous fixture | ungrounded — the verdict tracks phrasing, not behavior; the rubric leaks discretion | S (load-bearing by scope definition) |
| 0 flips across all fixture×paraphrase runs | invariance PASS (measured, not guessed) | — |
Remediation (on FAIL, before the gate is trusted): either bind a fixture-based mechanical assertion (the fixture that flipped becomes a regression test the verdict must satisfy regardless of prose), or narrow/shorten the rubric prose until the re-probe stops flipping. Both moves remove discretion from the prose — the ratchet direction is always toward less judged surface, not more rubric.
Check class: measured. Adversarial pairing (the probe's own soft spot is "were the paraphrases actually semantics-preserving?" — a corrupted paraphrase manufactures flips): paired by (a) ambiguity control — flips are counted only on unambiguous fixtures, where a semantics-changing rewrite would move both fixtures coherently rather than flipping one, and (b) cross-family paraphrase generation — the rewrite set is not authored by the family whose verdict is under test. No judge-only path: the terminal artifact is a count over dispatched runs.
Honest residual (named): the probe proves the verdict is invariant to wording, not that it is correct — a gate can be robustly, invariantly wrong. Correctness stays with fixture ground-truth and the human PR gate; Step 0.6 removes one failure class (phrasing-dependence), it does not certify the rubric.
Simplicity note (earned-complexity check, Wave-1 angle #1 applied to itself): net-new surface = a fixture-paraphrase procedure + one threshold. Everything else is already shipped — steel-quench dispatch, the 4-axis target-tier sim, the Axis-2 marker field, auto-decorrelation, and the mechanical fixtures load-bearing gates already owe. Cost converges to zero: baseline once per gate, re-probe only on rubric prose change. Each FAIL's remediation shrinks judged prose or adds a mechanical anchor — the harness gets simpler under measurement, not more decorated.
Origin: proposed by an autonomous innovator scan (Mode F, 2026-07-03), designed by a Fable-5 sidecar, source-verified (2605.06161 numerics confirmed verbatim) before adoption. Orthogonal to today's cross-family gate: that lowers judge correlation, this measures verdict groundedness.
Execution principles: Attacks must be based on real code/files/configs — abstract criticism prohibited. Assign severity: S (immediate blocker) / A (required before deployment) / B (improvement recommended). Call fh-commons:quench-challenger in isolation first (6-axis structural attack); apply 6 angles in parallel.
Isolation can be achieved by Claude Code Agent(...) or by fh-run --agent fh-commons:quench-challenger under Codex. Do not run the challenger inline in the same reasoning pass when the attack result gates the defense.
| # | Attack Angle | Core Question |
|---|---|---|
| 1 | Reason for existence | "Why this structure? Is there no simpler alternative?" |
| 2 | Real-use verification | "Does what's written in the docs actually match the real code?" |
| 3 | Bus factor | "Single-person dependency — can it operate if that person is absent?" |
| 4 | Platform obsolescence | "Does this structure survive when the external ecosystem expands or changes?" |
| 5 | Self-referential structure | "Is there a closed circuit that evaluates itself by its own criteria?" |
| 6 | Gate-locality | "Is every safety gate readable by the actor that must enforce it? Name any gate defined only in a file/layer the enforcing runtime never loads (e.g. a rule in a Claude-only CLAUDE.md that a Gemini/Codex orchestrator reading AGENTS.md never sees; a provenance check described in a doc but absent from the write path)." (see knowledge/shared/harness-core/gate_locality_principle.md) |
S-grade Immediate Human Gate: If Wave 1 contains 1+ S-grade blocker → pause, surface options (a) proceed to Wave 2 / (b) human review first / (c) abort. Do not silently enter Wave 2 with unreviewed S-grade items.
Code-artifact supplementary lens — silent-failure scan (conditional · fires only when artifact_type ∈ {bash_script, code} — Step 0.3 canonical enum, tpa_schema.md; non-code artifact → note code-lens: n/a (non-code artifact) and skip). artifact_type is derived from file path / extension (tpa_schema.md classification rule), not interior content — a skill_md that embeds a ```bash fence stays skill_md and does not fire this lens (do not conflate with the CLAUDE.md Substantive carve-out, which keys Axes 2–3 of the commit gate off code-fence presence — a different mechanism). Import origin: pr-review-toolkit/silent-failure-hunter (sister-asset cross-audit 2026-06-14, Import #2). Wave 1's 5 angles attack structure; this adds the named error-suppression vector the general angles miss. Grep the diff/file for each named pattern:
| Pattern | What to flag | Severity guide |
|---|---|---|
Empty catch / || true / 2>/dev/null swallow | An error path that discards the error with no log, no re-raise, no user surface | S if it hides a gate/verification failure, else A |
Broad catch (except: / catch (e) with no type) | Catches more than intended; masks unrelated failures | A |
| Unjustified fallback | Falls back to a default on error without recording that it fell back | A — silent degradation is the worst class (cf. P6 graceful-degradation must be documented) |
| Exit-code ignored | A piped/chained command whose non-zero exit can't propagate (cmd1 | cmd2, missing set -e/pipefail) | A if it gates a downstream destructive/publish step |
A finding here is a real-code attack (Wave 1 execution principle) — cite the exact line. The lens is a checklist supplement, not a 6th mandatory angle: it carries no weight on non-code artifacts.
Detail: See
SKILL_detail.md §Wave1— Wave 1 output format, optional numeric score, quench-challenger invocation; and§CodeLens— silent-failure worked examples (bash + python).
Three questions, asked of your own findings and numbers, before Wave 1 is done. They are written
out rather than left to judgment because that is exactly what makes them portable: measured n=6 in
the origin field, a floor-tier pass executes the attack angles above without defect but does not
spontaneously ask these three, while a stronger tier does. That is a checklist gap, not a
capability gap — and by sonnet_floor_doctrine.md a harness whose behaviour depends on which model
is driving is defective, not merely limited.
| # | Question | What a real answer looks like |
|---|---|---|
| 재현성 | Can another session reproduce this verdict from the same inputs? | The exact command, or file:line, another session runs. "It's reproducible" is not an answer. |
| 비교공정성 | Were the two arms measured under the same conditions? | reps, inputs and environment named for both arms. An asymmetry you found and left in place counts — say so. |
| 추정층위 | Is each number a measurement, an estimate, or a quotation? | Which, per number — and for a measurement, what showed the instrument works on this target (known-pair). |
Where the answers go — one line in the Axes 2+3 marker:
axis2-defense: reproducibility=<…> fairness=<…> estimation-layer=<…>
Enforcement, stated exactly. templates/.git-hooks/pre-commit → validate_defense_leg() runs
this at the floor tiers only (floor-status: sonnet-floor or below-floor), and checks
presence · completeness · non-vacuity: all three sub-answers must exist and ok/yes/n/a is
rejected as a filled form rather than an answer. Fixtures: scripts/test_marker_defense_lanes.sh
(17 lanes: known-pairs both directions, two over-block controls, four prescription assertions, and a
call-site pin — because a suite that extracts the function and calls it directly stays green when
the hook stops calling it, which is precisely the failure being imported against).
🟥 It cannot check whether the answers are TRUE. That stays with the operator and the weekly
audit, exactly like every other marker field — do not read the hook's PASS as verification.
Why the trigger is narrow. below-floor occurs 0 times across the existing marker corpus, so
gating on it alone would be a decoration that never fires; sonnet-floor occurs 11. The wide reading
("any marker carrying numbers") is deliberately not taken — pricing this axis at a near-universal
rate is the over-trigger field_verdict_crossfamily_gate.md §7 rejects, and a field required
everywhere becomes a rubber stamp.
Provenance, and what was deliberately NOT imported. Absorbed from a sibling harness (2026-08-20). That document additionally amends its floor rule so a below-floor pass carrying this line plus a crossfamily record passes without the operator ack. 🟥 That is a loosening of an existing FH gate and was not adopted — here the leg is purely additive and
below-floorstill requiresbelow-floor-ack, unchanged. 🟥 The same document asserted its own hook read this field and its own fixture suite pinned it. Measured twice with a control (crossfamily→ 21 hits in the same files): both were 0. The prose was portable; the machine was not. Everything claimed in this section's Enforcement paragraph was built here, and the fixture file named there is the receipt.
3 Defense Principles: (1) Reinforce with external cases via WebSearch — "unique to us" or "structural pattern"? (2) Cover with experience — other project cases defend bus factor. (3) Prioritize immediate implementation over logical construction.
Classification: Immediate implementation (this session) / Long-term improvement (residual risk card) / Structural acceptance (declare with rationale).
"Brain in a Vat + Sandboxed Adversary": Challenger attacks only static code (isolated). Defender brings living system evidence. This asymmetry makes Wave 2 structurally superior to Wave 1.
Detail: See
SKILL_detail.md §Wave2— Wave 2 output format, full Brain-in-Vat principle.
The challenger (quench-challenger in Wave 4 mode) knows it's running in an isolated sub-agent sandbox and uses that knowledge as a weapon.
| # | Attack Angle | Core Question |
|---|---|---|
| W4-1 | AI dependency single point of failure | "If Claude API goes down, does harness core function go to zero?" |
| W4-2 | Context Collapse | "When initial instructions are lost to context compression, does harness go silent?" |
| W4-3 | Prompt Injection exposure | "Can external data overwrite harness internal rules?" |
| W4-4 | Hallucination cumulative contamination | "Do Wave defense arguments rely on LLM inference rather than actual measurement?" |
| W4-5 | Tool Dependency Lock-in | "If a specific MCP/plugin/tool is removed, does harness functionality collapse?" |
Wave 4 convergence = Wave 3 criteria + 3 AI-specific vectors actually reviewed + hallucination defense based on original file references.
W4-4 ↔ Step 0.5: W4-4 is the general measurement-vs-inference question; Step 0.5 (Trigger-Accuracy Probe) is its measured instance for one surface — the skill's own trigger description. When the target is a
skill_mdwith a changed trigger surface, satisfy W4-4 by running Step 0.5 rather than answering it by inference.
Detail: See
SKILL_detail.md §Wave4— Wave 4 output format, defense principles, convergence criteria, activation declaration format.
Activation: When an upstream gate declares PASS on an artifact — any "declared-complete boundary"
(a verification gate's terminal PASS, a /pipeline-conductor green sweep, a /marketplace-gate listing
verdict, the 4-axis auto-gate marker, a domain TC/coverage gate). Propose preemptively, run after approval.
No gate-PASS in scope → skip Wave-P3 entirely.
A 1-round gate PASS is exactly when reviewers stop looking — "we just passed" is the lowest-vigilance moment in any workflow. Wave-P3 distrusts the declaration and re-attacks the just-passed artifact on three dimensions the gate's own pass criteria structurally could not check. Only when all three Attack Failed can a "Real PASS" be declared.
PASS-framing redaction (mandatory pre-step) — the artifact reaches Wave-P3 carrying its own
PASS declaration (a ✅, a "Verified" header, the gate marker), and a re-judge that reads that
framing is biased toward "Attack Failed" — the exact bias Wave-P3 exists to defeat (judge-robustness
swarm, 2026-06-13). Before feeding the artifact to the dimensions/challenger, strip the pass-framing
at the bash layer, not the AI layer:
# Strip framing glyphs + canonical FH verdict PHRASES only — never the bare word PASS
# (a global s/PASS//g corrupts substance: "status==PASS" → "status==", manufacturing findings).
P3R=$(mktemp)
sed -E -e 's/[✅🟩✓]//g' \
-e 's/(ALL AXES PASSED|FH_GATE_VERDICT:[[:space:]]*PASS|Real PASS|VERIFIED|[Gg]ate[^.]{0,24}declared PASS)//g' \
"{ARTIFACT}" > "$P3R"
# feed "$P3R" to Wave-P3; clean up after: rm -f "$P3R"
Feed $P3R to Wave-P3, then rm -f "$P3R". The redaction is mechanical, so it cannot itself be
placated. Honest scope: it strips framing glyphs and canonical FH verdict phrases — bare-word or
lowercase prose self-congratulation ("this passed review", "looks green") is out of scope for sed
and is covered by a prose backstop instead: the Wave-P3 persona is instructed to disregard any
residual self-pass language in the artifact and attack as if no verdict were stated.
Agent utilization:
fh-commons:quench-challenger (optional) — adds 6-axis structural attack to each dimension, fed the redacted artifact. If absent, run the 3 dimensions directly on the redacted copy.fh-meta:persona-innovator (after convergence) — error/gap patterns found during Wave-P3 → auto-propose new Cross-Project Pattern rows or skill-candidate signals.The three dimensions generalize the gate's three blind spots:
| # | Dimension | The blind spot it attacks |
|---|---|---|
| Wave-P3a | Coverage | What did the gate not check? Items marked covered/passed that lack a traceable artifact (ID, test, file, citation). |
| Wave-P3b | Narrative | What story does the passed artifact tell that may be wrong? Residual hardcoded/environment-coupled values and vague, unverifiable claims the PASS declaration smuggled through. |
| Wave-P3c | False-confidence | Did the gate produce false confidence? High-risk items that passed carrying only a binary pass/fail, with no residual-risk or failure-mode caveat. |
Each dimension is Attack Succeeded (defect found) or Attack Failed (clean).
Wave-P3 Done When:
All 3 dimensions [Attack Failed] → ✅ Real PASS → activate fh-meta:persona-innovator (extract new patterns)
Any 1 [Attack Succeeded] → fix affected items, re-run Wave-P3 (max 2 re-runs)
Still [Attack Succeeded] after 2 re-runs → "gate structural redesign required" → ESCALATE
Basis: reverse-imported from a field-side sister harness (private companion signal, 2026-06-08). Field
evidence: a test-case coverage gate declared a 1-round PASS, then additional FAILs surfaced in rounds 2–3 —
the gate-PASS-then-defect-found-in-next-stage pattern Wave-P3 collapses. Generalized from the field's
domain-coupled (a spec→test-case gate) form to a gate-agnostic boundary hook. Shares its root with
fh-commons:convergence-loop (single-pass distrust).
Detail: See
SKILL_detail.md §WaveP3— per-dimension attack questions, gap criteria, and output format — read when running a gate-passage re-attack.
Quench hardens, but quenched steel is brittle — no smith ships it un-tempered. steel-quench attacks until a frozen-artifact round is clean; nothing in that loop asks whether the hardening itself introduced complexity beyond what the fixes required (defense scaffolding, decorative wiring). Wave-T is that inverse corrective. It runs after Wave 3+ convergence, before Done When. It does not attack; it measures the cost of the convergence just achieved.
| Step | Class | What it does |
|---|---|---|
| T-1 complexity delta | measured | bash templates/temper_check.sh <repo> <file> <pre-quench-ref> — Δlines/sections/steps/tables/fences/cross-refs, baseline (pre-Wave-1) → post-convergence. Prose-only counts: code-fence interiors are excluded (bash comments are not sections) |
| T-2 absolute context | measured | harness-doctor L1–L3 on the post-quench asset — absolute complexity tier (reuse, don't reimplement) |
| T-3 τ verdict | judged — paired with the quench's own Wave findings (each flagged construct must trace to a specific finding it allegedly fixes; no judge-only path) | τ-PASS: added complexity ⊆ what the fixes required. τ-FAIL: the quench introduced a construct that defends against an attack rather than fixing the flaw — name it, propose the simpler form, hand back for de-brittling. τ-FAIL is the temper step working, not a quench failure |
T-3 heuristic flags (any → review, never auto-reject): a new section/table/step whose only referent is a Wave-N finding · Δcross-refs ≫ Δsteps (wiring, not function) · the asset crosses a harness-doctor complexity tier it was below pre-quench.
Don't-overbuild guard (τ applied to τ): Wave-T is one script + this section, reusing harness-doctor
for the absolute read. If Wave-T grows its own detection engine, it has failed its own test — a temper
step that adds complexity is self-refuting. Known limits (honest): temper_check.sh takes one path —
renamed files need a manual pre/post measurement; the wiring flag uses strict >, so Δxrefs = Δsteps
does not fire it (the section flag usually carries those cases).
Model note: T-1 is bash (no model), T-2 reuses harness-doctor (sonnet-rated). T-3 adjudication was validated blind on both Opus and Sonnet (3-fixture ground-truth test, 3/3 each, 2026-06-10) — Wave-T end-to-end does not require the largest model tier. Opus remains the recommendation for full steel-quench runs (challenger waves are broader than T-3).
When quenching a public artifact that has its own ground truth — a repo's open issues, test suite, or stated policy/threat-model (a frontier codebase, a sister project — not your own in-progress draft) — add an adjudication pass after the panel produces findings. The panel (Wave 5 cross-family) gives decorrelated detection; this pass adds the external check the panel cannot self-supply. For each finding, classify:
| Class | Test | Meaning |
|---|---|---|
| Corroborated | matches an OPEN issue / a failing test | independent rediscovery — strongest |
| Novel | no matching issue, but confirmed by logic or a written test | caught what the target missed |
| Reframe / reject | the target's own docs/policy/threat-model marks it intentional or out-of-scope | NOT a confident catch — a false positive |
The GT (not a cross-family vote) resolves contention objectively, and it catches the panel's own
shared training-prior false positives. Report only Corroborated + Novel as confident catches; a null
result on sound code is the correct answer, not a failure. Basis: 2026-06-06 frontier-quench sweep —
a single-family pass repeated still misses what cross-family catches, and a target's SECURITY.md reframed
"security" findings to "correctness" (its permission layer was UX, not a boundary).
| # | Pattern Name | Description | Response Direction |
|---|---|---|---|
| P1 | Single-person bus factor | System paralysis when core operator absent | Document, automate, formalize delegation |
| P2 | Doc-code mismatch | Documented behavior differs from actual code | Re-sync to real code as ground truth |
| P3 | Self-referential diagnosis | Creator validates — internal viewpoint closed circuit | Connect external persona or sim-conductor |
| P4 | No real-use verification | Theoretically designed but never executed | Mandate 1 cold-start simulation |
| P5 | Platform obsolescence unplanned | No response to external ecosystem changes | Quarterly frontier diagnosis |
| P6 | AI dependency single point of failure | Claude API/MCP removal causes collapse | Document graceful degradation + fallback |
| P7 | Hallucination-contaminated defense | Defense relies on LLM inference, not measurement | Mandate citing original file/commit/value |
| P8 | Context Collapse unguarded | Key instructions lost to compression → harness silent | Review CLAUDE.md compact repeated insertion |
| P9 | Harness-bulk as model compensation | Pipeline thickened to substitute for a model capability ceiling (a gap no iteration count closes — e.g. domain understanding) — complexity replaces missing capability, violating the field axis "simpler over time" (meta-harness: distinguish from complexity that earns its scope) | Route the task class to a stronger model; never paper over the ceiling with more harness. Signals: steps added for one model's weakness; step count rising while class quality stays flat across iterations |
| P10 | Untrusted-Boundary Text-Parse Treadmill (Grep-Collision Treadmill) | A control decision (verdict / pass-block / routing) is grep'd out of free-form text on a boundary that also carries untrusted content. Each text-parser patch (anchor-first-line → scan-anywhere → count-headers → render-aware) only relocates the spoof — untrusted content can always forge or shadow the parsed token, because verdict and attacker share one surface (the prose/data plane). No terminal state exists inside the text plane. | Bind the decision to a typed, out-of-band channel (schema-constrained structured output — --json-schema / --output-schema) the untrusted content cannot occupy; structurally eliminate the format-spoof/grep-collision class instead of patching it. Residual is named, not closed: structured output constrains format, not the model's chosen value — and the decoding constraint is itself an injection surface (Constrained Decoding Attack, arXiv:2503.24191) → keep the untrusted-evidence instruction + irreversible-action HITL floor. Signal: a parser fix on an untrusted-content boundary that the next adversarial round defeats. Origin: fh-gate.sh verdict parser, 2026-06-26 (frontier-converged: arXiv:2506.08837 Dual-LLM symbolic channel). |
Add new rows as new patterns are discovered.
Wave convergence criteria met: zero new S/A-grade findings in a round that triggered NO repairs at
any grade (B included — a repaired B is an unverified change, and that is the measured way a
'clean' round has already leaked an A) — see §Convergence Criteria
+ Residual risk card output (A-grade · B-grade items)
+ "steel-quench Complete" declaration output
Verdict: PASS (zero new S/A and no repairs made in response, at any grade — §Convergence Criteria; repairing even a B and then declaring convergence is the measured round-4 failure) | CONDITIONAL_PASS (A/B-grade remain) | FAIL (S-grade persist) | ESCALATE (structural ambiguity requiring human judgment)
Convergence is measured over a FROZEN artifact. A round that produced repairs did not verify the artifact you are shipping — it verified the previous one. So the terminating round must be a round over unchanged code:
Terminate when a round returns zero new S/A-grade findings AND you make no repairs in
response to it — at ANY grade, B included. A round whose B findings you accept as residual is
terminal; a round whose B findings you fix is not, because the fix is unverified.
Why the B clause is the load-bearing half, not a formality: in the measured history below, round 4
returned 0A+3B — clean by every S/A-based criterion, and the old rule would have stopped there.
The three B's were repaired, and round 5 found a genuine A inside those repairs. So "zero new
S/A" is not the discriminator; "nothing was changed in response" is. The loop ends when you stop
repairing, not when the challenger runs out of ideas.
A post-convergence Wave-T de-brittling edit counts as a repair for this purpose. Wave-T runs
after convergence and before Done When, so trimming a construct there is an unaudited edit that
the completion declaration would still describe truthfully ("no repairs were made in response to
this round") while the invariant it certifies — the shipped artifact is the audited one — is
false. Either ship the τ-FAIL as a named τ-FAIL (the pipeline table's own alternative, and
terminal) or run one more round over the trimmed artifact before declaring Done.
Record the per-round yield vector in the Axis-2 marker — axis2-rounds: 4A / 3A+1B / 2A / 0A+3B / 1A+2B. It is what makes the stop decision auditable afterwards, and a flat or rising
vector is criterion 4's only input.
PIN THE TARGET — mandatory on every dispatched Wave, and the reason criterion 1 can be trusted
at all. The dispatch prompt carries a measured fingerprint and orders the agent to report
WRONG-TARGET and stop on mismatch:
bash scripts/target_freeze.sh pin "$REPO" "$WAVE_LABEL" # 발주 직전 — 토큰을 프롬프트에 박는다
bash scripts/target_freeze.sh verify "$REPO" "$WAVE_LABEL" # 회수 직후 — rc 1 이면 WRONG-TARGET
An audit that did not pin its target cannot be counted as a terminating round — it may have
read a tree that changed under it, which voids the verdict wholesale
([[feedback_audit_target_must_be_frozen]]). This lives HERE, inline, next to the claim it holds
up: the first draft put it in SKILL_detail.md §Wave5, reachable only when --sidecar is
active — gate-locality on the very fix that was closing a gate-locality gap, caught by the round
that audited it.
✅ MECHANIZED 2026-08-17 — the residual below is the history, not the current state. The recurrence condition this paragraph set ("mechanize on the first recurrence") fired three times in one day: a cross-family review was sent a pre-repair diff · a review's output was truncated with
tail, losing findings and the pin itself · a scan was followed by an edit that shifted every line number. All three were "did I send / read the tree that is there now?", and the prose rule above was already in place and caught none of them (operator-approved as the next session's 1순위, 2026-08-17).
scripts/target_freeze.sh(lanes:scripts/test_target_freeze_lanes.sh, 28/28) takes the third attempt deliberately through the two failures recorded below: it content-addressesgit diff HEAD(the patch, not its line count — so a same-line-count in-place edit is caught, lane A) and hashes untracked files separately (lane B), and it is not a hook — two explicit commands the dispatcher runs, so it cannot become the 100%-firing background noise of attempt ①. It refuses to answer at all whenassume-unchanged/skip-worktreeis set (exit 10 UNKNOWN, never MATCH), and a restore-to-original lane returns MATCH — that arm is the point: without it, "always reports WRONG" would pass every other lane. 🟥 Scope, stated narrowly: it freezes the target tree, not the bytes you inlined into a sidecar prompt. Where files are pasted into the prompt (auto-decorrelation§L191 — sidecars often cannot read a tree at all), the inlined content needs its own binding; this script does not provide it.Named residual (HISTORICAL — superseded by the block above) — the freeze claim was SELF-ATTESTED, and deliberately not mechanized. Criterion 1 turns on "unmodified since the previous audit", and nothing checks that. Two attempts to mechanize it on the day the rule was written were both wrong: a hook advisory that fired on 100% of markers (noise, and its convergence detector could not match the hook's own prescribed evidence vocabulary), and a
base-SHA + diff-line-countfingerprint that is invariant under an in-place edit — the modal shape of a prose repair — and structurally blind to untracked files. Both were removed rather than patched. This repo mechanizes at repetition, not at first sight, and a one-day-old rule that has already produced two wrong machines is telling you which side of that line it is on. What holds the claim honest today is practice, not mechanism: a dispatched audit pins the target fingerprint in its Step 0 and reportsWRONG-TARGETon mismatch ([[feedback_audit_target_must_be_frozen]]). Mechanize on the first recurrence of a convergence claim that turns out to be false — and when you do, content-address the full working state (tracked diff and untracked files), because that is the specific hole the discarded attempt fell into.
A-grade or higher complex improvements → skill-ize with /meta-prompt-builder
If the yield does not fall across rounds, stop tightening and REDUCE THE DESIGN. A vector that
stays flat is not telling you to review harder; it is telling you that each round's repairs are
manufacturing the next round's findings. Cut the scope that is generating them (see the
Added-Scope Gate in .claude/rules/fh_4axis_gate.md) and re-audit the smaller artifact.
Full Wave results → recommend persisting to tracks/_meta/steel_quench_YYYY_MM_DD_{slug}.md
Why this replaced "zero new S-grade → terminate" (measured 2026-08-02, PR #231). A single change ran 5 rounds with yields
4A / 3A+1B / 2A / 0A+3B(cross-family) / 1A+2B. The old criterion would have terminated at round 4 (zero S/A) — and round 5, run over round 4's repairs, found a genuine A. Meanwhile the competing criterion carried in operator memory ("two consecutive rounds with zero new") can never fire while every round ships repairs, so it read as permanently not-converged and the change shipped with that stated instead. Both criteria were wrong in the same way: they counted rounds instead of asking whether anything had changed underneath. Rounds 2, 3 and 5 found defects exclusively in code the previous round had added. Freezing is the fix that both were reaching for — the same discipline the single-audit rule already requires of its target, applied to the convergence loop itself.
| Situation | Connected Skill | Mandatory? |
|---|---|---|
| Delegate improvements as prompts | /meta-prompt-builder | optional |
| External publish: re-validate from external user perspective | /sim-conductor Area A | mandatory |
| Re-validate structural decision | /verify-bidirectional | optional |
| Attack angle is a harness structure problem | /harness-doctor | optional |
| After Wave convergence, propose new pattern rules | fh-meta:persona-innovator | optional |
| Wave 1 structure-specific attack (6-axis) | fh-commons:quench-challenger | priority |
| Back-trace whether claims exist in source files | /phantom-quench | mandatory when phantom_risk=true OR scope=external — its verdict folds back: a load-bearing Phantom = a new S-grade finding, convergence blocked until closed (routing defined in tpa_schema.md §Gate Routing Table — read it when this fires) |
steel-quench → sim-conductor gate: After Wave convergence in external-publish context, /sim-conductor Area A is the mandatory next step.
steel-quench convergence (zero new S/A over a frozen artifact)
↓ pass residual risk list
sim-conductor Area A (external user perspective)
↓ new items found that steel-quench missed?
├── yes → additional steel-quench Wave round
└── no → deployment approved
Detail: See
SKILL_detail.md §Wave5— Wave 5 Multi-Team Panel (team formation bash, parallel dispatch, cross-team synthesis) — read when activating--sidecarflag. SeeSKILL_detail.md §Structural-Defensefor meta-harness defense layering explanation.
phantom-quench.pipeline-conductor, marketplace-gate, the 4-axis auto-gate, convergence-loop, domain coverage gates) is a valid Wave-P3 entry point. Invoke /steel-quench Wave-P3 on the just-passed artifact rather than editing each gate to embed it — the hook lives here, callers reference it.On Claude API / MCP failure → refer to references/fallback-guide.md.