| name | steel-quench |
| description | All-angle verification meta-skill for near-complete artifacts. Turns vague design anxiety into structured challenger waves using fh-commons:quench-challenger, then drives defense and convergence until root weaknesses, residual risks, and added complexity are explicit. Covers standard attack/defense rounds, optional Meta-Aware Adversary mode for AI-specific risks such as hallucination, context collapse, prompt injection, and tool lock-in, and Wave-P3 re-attack after an upstream gate declares PASS. Built-in outputs emphasize attack-plus-prescription pairs and can feed fh-meta:persona-innovator after convergence. Triggered by: "quench this", "devil's judgment", "all-angle review", "end-to-end verification", "steel quench", "deep pre-completion inspection", "did it really pass?". |
| user-invocable | true |
| allowed-tools | ["Read","Write","Edit","Bash","Grep","Glob","WebSearch","Agent"] |
| model-note | session-inherit — Sonnet base is first-class (sonnet_floor_doctrine.md); depth-critical judged steps route to dispatch (opus agent / cross-family sidecar, consent-gated), never a substrate requirement |
steel-quench — All-Angle Verification Meta-Skill
Heating steel and plunging it into water brings internal defects to the surface. quench-challenger attacks → defense → repeat = systematic surfacing and elimination of design flaws.
A designer's anxiety is most dangerous when vague. steel-quench breaks that anxiety into concrete attack angles, defends against them, and closes with residual risks explicitly stated.
Scope boundary: steel-quench stress-tests a near-complete artifact (post-build). For pre-build design decisions → deliberation. For completed-asset validation → sim-conductor.
Trigger Phrases
| Phrase | Situation |
|---|
| "quench this", "run quench" | All-angle verification just before completion |
| "devil's judgment" | Focused challenger attack on specific design decision |
| "all-angle review", "end-to-end verification" | Full project scope verification |
| "shake out design anxiety", "deep pre-completion inspection" | Concretize vague anxiety |
| "attack from the root" | Re-verify from reason for existence |
| "diagnose with counterexample", "use this bad case as reference" | Phase 0 calibration |
| "did it really pass?", "re-attack after the gate", "the gate said PASS" | Wave-P3 gate-passage re-attack |
/steel-quench | Explicit call |
Wave Structure
| Wave | Role | Termination |
|---|
| Phase 0 (optional) | Counterexample calibration — extract patterns from external bad cases, merge into Wave 1 | No external case → skip |
| Wave 1 | Challenger attack (quench-challenger) — surface critical flaws, no defense | — |
| Wave 2 | Defense — defend or state as residual risk | — |
| Wave 3+ | Convergence — repeat until zero new S-grade | Zero new S-grade |
| Wave 4 (optional) | Meta-Aware Adversary — AI uses its own nature as attack vector | Zero new S-grade + AI-specific criteria |
| Wave-P3 (optional) | Gate-passage re-attack — when an upstream gate declares PASS, re-attack the just-passed artifact on Coverage / Narrative / False-confidence | All 3 dimensions Attack Failed |
| Wave 5 (optional) | Multi-Team Adversarial Panel — external CLIs or cross-session Claude | Zero new S-grade cross-team |
| Wave-T (after convergence) | Temper — measure complexity the quench added; flag over-hardening | τ-PASS or named τ-FAIL |
Step 0.3 — Artifact Vulnerability Profile
Schema: knowledge/shared/harness-core/tpa_schema.md — canonical artifact_type/risk_level/phantom_risk derivation, gate routing, meta-harness broadcast multiplier.
Runs when steel-quench is invoked without a specific wave restriction.
Skip if user specifies exact waves (e.g. "run Wave 1 and Wave 4 only").
Read target artifact → classify vulnerability surface:
| Dimension | Signal → Wave weight shift |
|---|
artifact_type | SKILL.md/design-doc → Wave 2 (structural defense) weight↑ · bash/code → Wave 1 (real-code) weight↑ · external publish imminent → Wave 5 (cross-team) weight↑ |
phantom_risk | citations/arXiv/DOIs/http URLs present → Wave 3 (source-grounding) weight↑ |
claim_density | 3+ benefit claims → Wave 1 U3 (evidence grounding) angle weight↑ |
novelty | first-of-its-kind pattern → Wave 4 (convergence) weight↑ |
scope | internal-only doc → Wave 5 (external CLI) weight=0 (skip) |
Wave selection output:
Run: [list of selected waves with rationale]
Skip: [list of skipped waves with reason]
External CLIs available: [yes/no → Wave 5 available]
Degraded coverage rule: if a high-weight wave or capability is skipped (user choice, unavailable tool, or scope=internal) or runs below its declared model-tier floor (tier-floor resolution, multi_model_sidecar_strategy.md §Tier-floor), flag explicitly in the output header — do not silently proceed. Below-floor example: challenger: sonnet (below-floor; floor=opus); a judged verdict produced below floor is a re-quench candidate once a floor-tier is available.
Step 0.4 — Specialized Reviewer Discovery
For the target artifact, scan installed agents for a domain-specific adversarial reviewer:
- Check
.claude/agents/ for a reviewer matching artifact_type
- Built-in fallback:
fh-commons:quench-challenger (general-purpose adversarial review)
- GAP for high-risk artifact: query
/plugin-recommender "adversarial reviewer for [artifact_type]" → user: install / skip / use fallback
Sidecar availability for a cross-provider challenger (Gemini/Codex, Wave 5) is resolved via the Tier 1→2→3 recipe in knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Sidecar Engine Resolution Protocol; Tier 3 = the fh-commons:quench-challenger Claude sub-agent below (guaranteed fallback — same-provider, so model-access not cross-provider diversity).
Runtime adapter note: In Claude Code, invoke the fallback as an isolated Agent(subagent_type="fh-commons:quench-challenger"). In Codex-primary or other non-Claude runtimes, use the FH adapter instead:
FH_BACKEND=codex npx --package @chrono-meta/fh-gate fh-run \
--agent fh-commons:quench-challenger \
--file {target-artifact}
Treat the adapter output as the isolated challenger result for Wave 1. This preserves the same workflow without depending on Claude Code's Agent tool.
Wave 5 activation rule: Wave 5 (external CLI team) is only activated when scope is not internal-only AND external CLIs are available AND risk_level is high or user explicitly requests it.
Detail: See SKILL_detail.md §ArtifactProfile — worked examples (SKILL.md, bash script, README, design doc with citations) showing wave selection and rationale — read when classifying an unfamiliar artifact type.
Step 0.5 — Trigger-Accuracy Probe (SKILL.md artifacts only · measured)
Import origin (sister-asset cross-audit 2026-06-14, tracks/_audit/session_2026_06_14_official-plugins-cross-audit.md): skill-creator + plugin-dev/skill-reviewer measure trigger accuracy empirically; FH's skill gate ("3+ NL triggers") and steel-quench's trigger-collision attack are judged, not measured. This probe converts that one verdict to measured — the mechanical-anchor discipline (a terminal trigger verdict should rest on a count, not an inference: the W4-4 question applied to the skill's own description).
External frame: treating a trigger/prompt phrase set as a first-class artifact that needs a
coverage criterion analog to code coverage is the position argued in arXiv:2607.02057, Prompt
Coverage Adequacy. FH's instrument here is a fire-count over should-fire / near-miss phrases,
not that paper's attention-based test-suite coverage — the anchor grounds the coverage-adequacy
framing, not a drop-in metric.
Fires only when artifact_type = skill_md (Step 0.3 canonical enum, tpa_schema.md — i.e. a SKILL.md) AND the trigger surface changed. Trigger surface = exactly the description: YAML field plus the ## Triggers / ## Trigger Phrases section (and nothing else — a body-wave or procedure edit with both of those untouched does not fire it). Any other artifact has no trigger surface — note Step 0.5: skipped (not a skill_md trigger change) and proceed.
Procedure (prose-scale — FH routes + governs, it does not rebuild skill-creator's eval engine; no Python harness, no vector store):
- From the skill's
description, author 8–10 should-trigger phrases (varied, realistic user utterances; include some that omit the skill's internal vocabulary) and 8–10 near-miss should-NOT-trigger phrases (share keywords/domain but actually need a different tool — the discriminating cases, not obvious irrelevants).
- Dispatch the probe set in isolation (
Agent / fh-run — same isolation rule as Wave 1; the author session must not judge its own triggers) against the live skill description only.
- Count and report as measured:
trigger-probe: <fired>/<should> fire · <false>/<should-not> false-fire (model: <tier>).
Verdict mapping (measured → severity; feeds Wave-T temper + Done When):
| Measured | Verdict | Severity |
|---|
| should-fire < 70% | undertrigger — description too narrow, or diet stripped a real trigger | S if load-bearing gate skill, else A |
| should-not false-fire > 20% | overtrigger / collision — bleeds into an adjacent skill's territory (the collision class steel-quench owns, now measured) | A |
| both within bound | trigger surface PASS (measured, not guessed) | — |
Threshold granularity (the bounds are guidelines, not a knife-edge): at the probe size (N=8–10 → ~10–12.5% steps) the percentages are coarse and 20%/70% may not be exactly reachable. Report the count (2/8 false-fire), not just a percentage; on a boundary result take the stricter verdict and re-probe with more phrases before finalizing. The bound is a trigger-collision heuristic, not a derived constant.
Honesty caveat: the probe measures trigger-description accuracy on the session model — not field behavior across all tiers. A near-floor model may under-fire regardless of description quality; record the probe model and, on a below-floor run, treat the result as provisional (Step 0.3 below-floor rule).
Detail: See SKILL_detail.md §TriggerProbe — worked probe set + fire-count table + before/after description fix.
Step 0.6 — Verdict-Invariance Probe (load-bearing judged gates only · measured)
Sibling of Step 0.5: Step 0.5 measures whether a skill fires on the right utterances; Step 0.6 measures whether a judged gate's verdict rests on behavior or on the rubric's phrasing. Cross-family review (auto-decorrelation) lowers correlation between judges but does not test groundedness — two decorrelated families can be swayed by the same wording artifact. This probe converts "is this verdict grounded?" from judged to measured: hold the behavior fixed, paraphrase the rubric, count flips.
External frame: content-preserving policy rewrites flip up to 9.1% of LLM safety-judge verdicts above baseline jitter — 18–43% of those flips on unambiguous cases (arXiv:2605.06161, Beyond Accuracy: Policy Invariance as a Reliability Test for LLM Safety Judges, Weng/Feng/Xie 2026). The instrument here is a flip-count over fixture×paraphrase runs, not that paper's benchmark — the anchor grounds the invariance framing, not a drop-in metric.
Fires only when the target is a load-bearing judged gate — a rubric whose verdict is a gate enum (PASS/FAIL/BLOCK/allow/deny) AND whose verdict gates a consequential action (a FAIL actually blocks a publish/delete/merge, changes a safety outcome, or guards an irreversible surface). The same scope as the Field-Harness Load-Bearing Change Gate. The enum shape is necessary but not sufficient (target-tier sim, 2026-07-03): a cosmetic judged Done-When that merely uses PASS/FAIL vocabulary but gates nothing consequential ("does the description read well — PASS/FAIL") is not load-bearing — confirm a real downstream consequence before firing, or the probe over-fires on gate-shaped-but-inert rubrics. One-time baseline per gate; re-probe only when the gate's rubric prose changes (mirror of Step 0.5's re-probe rule). It does not fire on ordinary judged Done-When conditions, advisory checks, or prose-only edits that leave the rubric untouched — note Step 0.6: skipped (not a load-bearing judged-gate rubric change) and proceed. A gate whose verdict is already bound to a mechanical assertion (fixture test, exit code) has no discretion to probe — skip with that note.
Procedure (rides shipped machinery — no new harness, benchmark, or daemon):
- Fixtures: take 2–3 unambiguous behavior fixtures — at least one clear-PASS and one clear-FAIL. Reuse the mechanical regression fixtures the gate already ships (the Field-Harness gate's convergence sub-condition requires them); author minimal ones only if absent, and ship them with the gate afterward.
- Paraphrase: generate K=5 semantics-preserving rewrites of the rubric prose (reorder clauses, synonym-swap, restructure lists — never add/remove a criterion). Generate the set cross-family via auto-decorrelation so the paraphrase distribution is not same-family-biased; degrade honestly to same-family with a logged note if no sidecar is reachable.
- Dispatch: run the gate's verdict on each fixture × each paraphrase (plus the original rubric) through the target-tier sim already used by the 4-axis gate — isolated Agent,
model: pinned to the tier the gate must survive on; the author session does not judge its own rubric.
- Metric: count verdict flips on the unambiguous fixtures. Report as measured:
verdict-invariance: <flips>/<fixtures×K> runs flipped (gate: <name> · tier: <model>).
- Record: write the flip-count into the Axis-2 marker's
axis2-evidence field (non-vacuous by construction — a count, not "it ran") and emit a one-line Judge Card alongside the gate: judge-card: <gate> · flip-rate <n>/<runs> · fixtures <ids> · <date>. The card is the baseline the re-probe rule compares against.
Threshold + verdict mapping (measured):
| Measured | Verdict | Severity |
|---|
| ≥1 flip on an unambiguous fixture | ungrounded — the verdict tracks phrasing, not behavior; the rubric leaks discretion | S (load-bearing by scope definition) |
| 0 flips across all fixture×paraphrase runs | invariance PASS (measured, not guessed) | — |
Remediation (on FAIL, before the gate is trusted): either bind a fixture-based mechanical assertion (the fixture that flipped becomes a regression test the verdict must satisfy regardless of prose), or narrow/shorten the rubric prose until the re-probe stops flipping. Both moves remove discretion from the prose — the ratchet direction is always toward less judged surface, not more rubric.
Check class: measured. Adversarial pairing (the probe's own soft spot is "were the paraphrases actually semantics-preserving?" — a corrupted paraphrase manufactures flips): paired by (a) ambiguity control — flips are counted only on unambiguous fixtures, where a semantics-changing rewrite would move both fixtures coherently rather than flipping one, and (b) cross-family paraphrase generation — the rewrite set is not authored by the family whose verdict is under test. No judge-only path: the terminal artifact is a count over dispatched runs.
Honest residual (named): the probe proves the verdict is invariant to wording, not that it is correct — a gate can be robustly, invariantly wrong. Correctness stays with fixture ground-truth and the human PR gate; Step 0.6 removes one failure class (phrasing-dependence), it does not certify the rubric.
Simplicity note (earned-complexity check, Wave-1 angle #1 applied to itself): net-new surface = a fixture-paraphrase procedure + one threshold. Everything else is already shipped — steel-quench dispatch, the 4-axis target-tier sim, the Axis-2 marker field, auto-decorrelation, and the mechanical fixtures load-bearing gates already owe. Cost converges to zero: baseline once per gate, re-probe only on rubric prose change. Each FAIL's remediation shrinks judged prose or adds a mechanical anchor — the harness gets simpler under measurement, not more decorated.
Origin: proposed by an autonomous innovator scan (Mode F, 2026-07-03), designed by a Fable-5 sidecar, source-verified (2605.06161 numerics confirmed verbatim) before adoption. Orthogonal to today's cross-family gate: that lowers judge correlation, this measures verdict groundedness.
Wave 1 — 6 Mandatory Attack Angles
Execution principles: Attacks must be based on real code/files/configs — abstract criticism prohibited.
Assign severity: S (immediate blocker) / A (required before deployment) / B (improvement recommended).
Call fh-commons:quench-challenger in isolation first (6-axis structural attack); apply 6 angles in parallel.
Isolation can be achieved by Claude Code Agent(...) or by fh-run --agent fh-commons:quench-challenger under Codex. Do not run the challenger inline in the same reasoning pass when the attack result gates the defense.
| # | Attack Angle | Core Question |
|---|
| 1 | Reason for existence | "Why this structure? Is there no simpler alternative?" |
| 2 | Real-use verification | "Does what's written in the docs actually match the real code?" |
| 3 | Bus factor | "Single-person dependency — can it operate if that person is absent?" |
| 4 | Platform obsolescence | "Does this structure survive when the external ecosystem expands or changes?" |
| 5 | Self-referential structure | "Is there a closed circuit that evaluates itself by its own criteria?" |
| 6 | Gate-locality | "Is every safety gate readable by the actor that must enforce it? Name any gate defined only in a file/layer the enforcing runtime never loads (e.g. a rule in a Claude-only CLAUDE.md that a Gemini/Codex orchestrator reading AGENTS.md never sees; a provenance check described in a doc but absent from the write path)." (see knowledge/shared/harness-core/gate_locality_principle.md) |
S-grade Immediate Human Gate: If Wave 1 contains 1+ S-grade blocker → pause, surface options (a) proceed to Wave 2 / (b) human review first / (c) abort. Do not silently enter Wave 2 with unreviewed S-grade items.
Code-artifact supplementary lens — silent-failure scan (conditional · fires only when artifact_type ∈ {bash_script, code} — Step 0.3 canonical enum, tpa_schema.md; non-code artifact → note code-lens: n/a (non-code artifact) and skip). artifact_type is derived from file path / extension (tpa_schema.md classification rule), not interior content — a skill_md that embeds a ```bash fence stays skill_md and does not fire this lens (do not conflate with the CLAUDE.md Substantive carve-out, which keys Axes 2–3 of the commit gate off code-fence presence — a different mechanism). Import origin: pr-review-toolkit/silent-failure-hunter (sister-asset cross-audit 2026-06-14, Import #2). Wave 1's 5 angles attack structure; this adds the named error-suppression vector the general angles miss. Grep the diff/file for each named pattern:
| Pattern | What to flag | Severity guide |
|---|
Empty catch / || true / 2>/dev/null swallow | An error path that discards the error with no log, no re-raise, no user surface | S if it hides a gate/verification failure, else A |
Broad catch (except: / catch (e) with no type) | Catches more than intended; masks unrelated failures | A |
| Unjustified fallback | Falls back to a default on error without recording that it fell back | A — silent degradation is the worst class (cf. P6 graceful-degradation must be documented) |
| Exit-code ignored | A piped/chained command whose non-zero exit can't propagate (cmd1 | cmd2, missing set -e/pipefail) | A if it gates a downstream destructive/publish step |
A finding here is a real-code attack (Wave 1 execution principle) — cite the exact line. The lens is a checklist supplement, not a 6th mandatory angle: it carries no weight on non-code artifacts.
Detail: See SKILL_detail.md §Wave1 — Wave 1 output format, optional numeric score, quench-challenger invocation; and §CodeLens — silent-failure worked examples (bash + python).
Wave 2 — Defense Principles
3 Defense Principles: (1) Reinforce with external cases via WebSearch — "unique to us" or "structural pattern"?
(2) Cover with experience — other project cases defend bus factor. (3) Prioritize immediate implementation over logical construction.
Classification: Immediate implementation (this session) / Long-term improvement (residual risk card) / Structural acceptance (declare with rationale).
"Brain in a Vat + Sandboxed Adversary": Challenger attacks only static code (isolated). Defender brings living system evidence. This asymmetry makes Wave 2 structurally superior to Wave 1.
Detail: See SKILL_detail.md §Wave2 — Wave 2 output format, full Brain-in-Vat principle.
Wave 4 — Meta-Aware Adversary (5 Attack Angles)
The challenger (quench-challenger in Wave 4 mode) knows it's running in an isolated sub-agent sandbox and uses that knowledge as a weapon.
| # | Attack Angle | Core Question |
|---|
| W4-1 | AI dependency single point of failure | "If Claude API goes down, does harness core function go to zero?" |
| W4-2 | Context Collapse | "When initial instructions are lost to context compression, does harness go silent?" |
| W4-3 | Prompt Injection exposure | "Can external data overwrite harness internal rules?" |
| W4-4 | Hallucination cumulative contamination | "Do Wave defense arguments rely on LLM inference rather than actual measurement?" |
| W4-5 | Tool Dependency Lock-in | "If a specific MCP/plugin/tool is removed, does harness functionality collapse?" |
Wave 4 convergence = Wave 3 criteria + 3 AI-specific vectors actually reviewed + hallucination defense based on original file references.
W4-4 ↔ Step 0.5: W4-4 is the general measurement-vs-inference question; Step 0.5 (Trigger-Accuracy Probe) is its measured instance for one surface — the skill's own trigger description. When the target is a skill_md with a changed trigger surface, satisfy W4-4 by running Step 0.5 rather than answering it by inference.
Detail: See SKILL_detail.md §Wave4 — Wave 4 output format, defense principles, convergence criteria, activation declaration format.
Wave-P3 — Gate-Passage Re-Attack (optional)
Activation: When an upstream gate declares PASS on an artifact — any "declared-complete boundary"
(a verification gate's terminal PASS, a /pipeline-conductor green sweep, a /marketplace-gate listing
verdict, the 4-axis auto-gate marker, a domain TC/coverage gate). Propose preemptively, run after approval.
No gate-PASS in scope → skip Wave-P3 entirely.
A 1-round gate PASS is exactly when reviewers stop looking — "we just passed" is the lowest-vigilance
moment in any workflow. Wave-P3 distrusts the declaration and re-attacks the just-passed artifact on three
dimensions the gate's own pass criteria structurally could not check. Only when all three Attack Failed can
a "Real PASS" be declared.
PASS-framing redaction (mandatory pre-step) — the artifact reaches Wave-P3 carrying its own
PASS declaration (a ✅, a "Verified" header, the gate marker), and a re-judge that reads that
framing is biased toward "Attack Failed" — the exact bias Wave-P3 exists to defeat (judge-robustness
swarm, 2026-06-13). Before feeding the artifact to the dimensions/challenger, strip the pass-framing
at the bash layer, not the AI layer:
P3R=$(mktemp)
sed -E -e 's/[✅🟩✓]//g' \
-e 's/(ALL AXES PASSED|FH_GATE_VERDICT:[[:space:]]*PASS|Real PASS|VERIFIED|[Gg]ate[^.]{0,24}declared PASS)//g' \
"{ARTIFACT}" > "$P3R"
Feed $P3R to Wave-P3, then rm -f "$P3R". The redaction is mechanical, so it cannot itself be
placated. Honest scope: it strips framing glyphs and canonical FH verdict phrases — bare-word or
lowercase prose self-congratulation ("this passed review", "looks green") is out of scope for sed
and is covered by a prose backstop instead: the Wave-P3 persona is instructed to disregard any
residual self-pass language in the artifact and attack as if no verdict were stated.
Agent utilization:
fh-commons:quench-challenger (optional) — adds 6-axis structural attack to each dimension, fed the redacted artifact. If absent, run the 3 dimensions directly on the redacted copy.fh-meta:persona-innovator (after convergence) — error/gap patterns found during Wave-P3 → auto-propose new Cross-Project Pattern rows or skill-candidate signals.
The three dimensions generalize the gate's three blind spots:
| # | Dimension | The blind spot it attacks |
|---|
| Wave-P3a | Coverage | What did the gate not check? Items marked covered/passed that lack a traceable artifact (ID, test, file, citation). |
| Wave-P3b | Narrative | What story does the passed artifact tell that may be wrong? Residual hardcoded/environment-coupled values and vague, unverifiable claims the PASS declaration smuggled through. |
| Wave-P3c | False-confidence | Did the gate produce false confidence? High-risk items that passed carrying only a binary pass/fail, with no residual-risk or failure-mode caveat. |
Each dimension is Attack Succeeded (defect found) or Attack Failed (clean).
Wave-P3 Done When:
All 3 dimensions [Attack Failed] → ✅ Real PASS → activate fh-meta:persona-innovator (extract new patterns)
Any 1 [Attack Succeeded] → fix affected items, re-run Wave-P3 (max 2 re-runs)
Still [Attack Succeeded] after 2 re-runs → "gate structural redesign required" → ESCALATE
Basis: reverse-imported from a field-side sister harness (private companion signal, 2026-06-08). Field
evidence: a test-case coverage gate declared a 1-round PASS, then additional FAILs surfaced in rounds 2–3 —
the gate-PASS-then-defect-found-in-next-stage pattern Wave-P3 collapses. Generalized from the field's
domain-coupled (a spec→test-case gate) form to a gate-agnostic boundary hook. Shares its root with
fh-commons:convergence-loop (single-pass distrust).
Detail: See SKILL_detail.md §WaveP3 — per-dimension attack questions, gap criteria, and output format — read when running a gate-passage re-attack.
Wave-T — Temper (post-convergence)
Quench hardens, but quenched steel is brittle — no smith ships it un-tempered. steel-quench attacks
until zero new S-grade; nothing in that loop asks whether the hardening itself introduced complexity
beyond what the fixes required (defense scaffolding, decorative wiring). Wave-T is that inverse
corrective. It runs after Wave 3+ convergence, before Done When. It does not attack; it measures
the cost of the convergence just achieved.
| Step | Class | What it does |
|---|
| T-1 complexity delta | measured | bash templates/temper_check.sh <repo> <file> <pre-quench-ref> — Δlines/sections/steps/tables/fences/cross-refs, baseline (pre-Wave-1) → post-convergence. Prose-only counts: code-fence interiors are excluded (bash comments are not sections) |
| T-2 absolute context | measured | harness-doctor L1–L3 on the post-quench asset — absolute complexity tier (reuse, don't reimplement) |
| T-3 τ verdict | judged — paired with the quench's own Wave findings (each flagged construct must trace to a specific finding it allegedly fixes; no judge-only path) | τ-PASS: added complexity ⊆ what the fixes required. τ-FAIL: the quench introduced a construct that defends against an attack rather than fixing the flaw — name it, propose the simpler form, hand back for de-brittling. τ-FAIL is the temper step working, not a quench failure |
T-3 heuristic flags (any → review, never auto-reject): a new section/table/step whose only referent
is a Wave-N finding · Δcross-refs ≫ Δsteps (wiring, not function) · the asset crosses a harness-doctor
complexity tier it was below pre-quench.
Don't-overbuild guard (τ applied to τ): Wave-T is one script + this section, reusing harness-doctor
for the absolute read. If Wave-T grows its own detection engine, it has failed its own test — a temper
step that adds complexity is self-refuting. Known limits (honest): temper_check.sh takes one path —
renamed files need a manual pre/post measurement; the wiring flag uses strict >, so Δxrefs = Δsteps
does not fire it (the section flag usually carries those cases).
Model note: T-1 is bash (no model), T-2 reuses harness-doctor (sonnet-rated). T-3 adjudication was
validated blind on both Opus and Sonnet (3-fixture ground-truth test, 3/3 each, 2026-06-10) — Wave-T
end-to-end does not require the largest model tier. Opus remains the recommendation for full
steel-quench runs (challenger waves are broader than T-3).
External-GT Adjudication (when the target has a public ground truth)
When quenching a public artifact that has its own ground truth — a repo's open issues, test suite, or
stated policy/threat-model (a frontier codebase, a sister project — not your own in-progress draft) — add
an adjudication pass after the panel produces findings. The panel (Wave 5 cross-family) gives decorrelated
detection; this pass adds the external check the panel cannot self-supply. For each finding, classify:
| Class | Test | Meaning |
|---|
| Corroborated | matches an OPEN issue / a failing test | independent rediscovery — strongest |
| Novel | no matching issue, but confirmed by logic or a written test | caught what the target missed |
| Reframe / reject | the target's own docs/policy/threat-model marks it intentional or out-of-scope | NOT a confident catch — a false positive |
The GT (not a cross-family vote) resolves contention objectively, and it catches the panel's own
shared training-prior false positives. Report only Corroborated + Novel as confident catches; a null
result on sound code is the correct answer, not a failure. Basis: 2026-06-06 frontier-quench sweep —
a single-family pass repeated still misses what cross-family catches, and a target's SECURITY.md reframed
"security" findings to "correctness" (its permission layer was UX, not a boundary).
Cross-Project Common Patterns (initial seed)
| # | Pattern Name | Description | Response Direction |
|---|
| P1 | Single-person bus factor | System paralysis when core operator absent | Document, automate, formalize delegation |
| P2 | Doc-code mismatch | Documented behavior differs from actual code | Re-sync to real code as ground truth |
| P3 | Self-referential diagnosis | Creator validates — internal viewpoint closed circuit | Connect external persona or sim-conductor |
| P4 | No real-use verification | Theoretically designed but never executed | Mandate 1 cold-start simulation |
| P5 | Platform obsolescence unplanned | No response to external ecosystem changes | Quarterly frontier diagnosis |
| P6 | AI dependency single point of failure | Claude API/MCP removal causes collapse | Document graceful degradation + fallback |
| P7 | Hallucination-contaminated defense | Defense relies on LLM inference, not measurement | Mandate citing original file/commit/value |
| P8 | Context Collapse unguarded | Key instructions lost to compression → harness silent | Review CLAUDE.md compact repeated insertion |
| P9 | Harness-bulk as model compensation | Pipeline thickened to substitute for a model capability ceiling (a gap no iteration count closes — e.g. domain understanding) — complexity replaces missing capability, violating the field axis "simpler over time" (meta-harness: distinguish from complexity that earns its scope) | Route the task class to a stronger model; never paper over the ceiling with more harness. Signals: steps added for one model's weakness; step count rising while class quality stays flat across iterations |
| P10 | Untrusted-Boundary Text-Parse Treadmill (Grep-Collision Treadmill) | A control decision (verdict / pass-block / routing) is grep'd out of free-form text on a boundary that also carries untrusted content. Each text-parser patch (anchor-first-line → scan-anywhere → count-headers → render-aware) only relocates the spoof — untrusted content can always forge or shadow the parsed token, because verdict and attacker share one surface (the prose/data plane). No terminal state exists inside the text plane. | Bind the decision to a typed, out-of-band channel (schema-constrained structured output — --json-schema / --output-schema) the untrusted content cannot occupy; structurally eliminate the format-spoof/grep-collision class instead of patching it. Residual is named, not closed: structured output constrains format, not the model's chosen value — and the decoding constraint is itself an injection surface (Constrained Decoding Attack, arXiv:2503.24191) → keep the untrusted-evidence instruction + irreversible-action HITL floor. Signal: a parser fix on an untrusted-content boundary that the next adversarial round defeats. Origin: fh-gate.sh verdict parser, 2026-06-26 (frontier-converged: arXiv:2506.08837 Dual-LLM symbolic channel). |
Add new rows as new patterns are discovered.
Done When
Wave convergence criteria met: zero new S-grade blockers
+ Residual risk card output (A-grade · B-grade items)
+ "steel-quench Complete" declaration output
Verdict: PASS (zero S-grade, convergence reached) | CONDITIONAL_PASS (A/B-grade remain) | FAIL (S-grade persist) | ESCALATE (structural ambiguity requiring human judgment)
Convergence Criteria + Downstream Chaining
Convergence Criteria
- Zero new S-grade blockers → terminate
- A-grade or higher complex improvements → skill-ize with
/meta-prompt-builder
- Full Wave results → recommend persisting to
tracks/_meta/steel_quench_YYYY_MM_DD_{slug}.md
Connected Skills
| Situation | Connected Skill | Mandatory? |
|---|
| Delegate improvements as prompts | /meta-prompt-builder | optional |
| External publish: re-validate from external user perspective | /sim-conductor Area A | mandatory |
| Re-validate structural decision | /verify-bidirectional | optional |
| Attack angle is a harness structure problem | /harness-doctor | optional |
| After Wave convergence, propose new pattern rules | fh-meta:persona-innovator | optional |
| Wave 1 structure-specific attack (6-axis) | fh-commons:quench-challenger | priority |
| Back-trace whether claims exist in source files | /phantom-quench | mandatory when phantom_risk=true OR scope=external (see tpa_schema.md §Gate Routing Table) |
steel-quench → sim-conductor gate: After Wave convergence in external-publish context, /sim-conductor Area A is the mandatory next step.
Required Pre-External-Deployment Sequence
steel-quench convergence (zero new S-grade)
↓ pass residual risk list
sim-conductor Area A (external user perspective)
↓ new items found that steel-quench missed?
├── yes → additional steel-quench Wave round
└── no → deployment approved
Detail: See SKILL_detail.md §Wave5 — Wave 5 Multi-Team Panel (team formation bash, parallel dispatch, cross-team synthesis) — read when activating --sidecar flag. See SKILL_detail.md §Structural-Defense for meta-harness defense layering explanation.
Operating Notes
- Do not defend in Wave 1. Mixing attack and defense modes dulls the attack's edge.
- Attacks without real code are invalid. Abstract criticism is not included in Wave 1 results.
- quench-challenger first. Call fh-commons:quench-challenger in isolation in Wave 1 if available.
- Always check self-referential pattern (P3). Cross-validate Wave results with external criteria.
- Public target → adjudicate against external GT before claiming. A finding the target's own docs/policy/threat-model marks intentional or out-of-scope is a false positive, not a catch. See §External-GT Adjudication.
- Attack surface limit: steel-quench attacks output content patterns. Phantom Claim detection →
phantom-quench.
- Gate cross-reference: any FH skill that declares a PASS / green / listing-ready verdict (
pipeline-conductor, marketplace-gate, the 4-axis auto-gate, convergence-loop, domain coverage gates) is a valid Wave-P3 entry point. Invoke /steel-quench Wave-P3 on the just-passed artifact rather than editing each gate to embed it — the hook lives here, callers reference it.
Failure Fallback
On Claude API / MCP failure → refer to references/fallback-guide.md.
