instar 1.2.83 → 1.3.0

package/dist/server/stopGate.d.ts

@@ -1,8 +1,10 @@
 /**
  * stopGate.ts — UnjustifiedStopGate server infrastructure (PR0a).
  *
- * Provides the read-side API surface that the future stop-hook router
- * consumes (PR3). State is in-memory for PR0a; PR3 migrates to SQLite.
+ * Provides the read-side API surface that the stop-hook router consumes.
+ * Runtime mode persists to disk so shadow-mode rollout survives server
+ * restarts; per-session hot-path state remains process-local and is
+ * repopulated by hook events.
  *
  * Spec: docs/specs/context-death-pitfall-prevention.md
  *
@@ -20,6 +22,10 @@
 export declare const GATE_ROUTE_VERSION = 1;
 export declare const GATE_ROUTE_MINIMUM_VERSION = 1;
 export type GateMode = 'off' | 'shadow' | 'enforce';
+export declare function configureStopGateState(opts?: {
+    modeFilePath?: string;
+    defaultMode?: GateMode;
+}): GateMode;
 export declare function getMode(): GateMode;
 export declare function setMode(mode: GateMode): void;
 export declare function getKillSwitch(): boolean;

package/dist/server/stopGate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stopGate.d.ts","sourceRoot":"","sources":["../../src/server/stopGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAS5C,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAiBpD,wBAAgB,OAAO,IAAI,QAAQ,CAElC;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAE5C;AAED,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIrD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAI/E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAIrC;AAgBD,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8DAC0D;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CA0B7E;AASD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;8EAE0E;IAC1E,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAoBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,aAAkB,GAAG,YAAY,CAatE"}
+{"version":3,"file":"stopGate.d.ts","sourceRoot":"","sources":["../../src/server/stopGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAeH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAS5C,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AA6CpD,wBAAgB,sBAAsB,CAAC,IAAI,GAAE;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,QAAQ,CAAC;CACnB,GAAG,QAAQ,CAShB;AAED,wBAAgB,OAAO,IAAI,QAAQ,CAElC;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAG5C;AAED,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIrD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAI/E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAKrC;AAgBD,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8DAC0D;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CA0B7E;AASD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;8EAE0E;IAC1E,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAoBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,aAAkB,GAAG,YAAY,CAatE"}

package/dist/server/stopGate.js

@@ -1,8 +1,10 @@
 /**
  * stopGate.ts — UnjustifiedStopGate server infrastructure (PR0a).
  *
- * Provides the read-side API surface that the future stop-hook router
- * consumes (PR3). State is in-memory for PR0a; PR3 migrates to SQLite.
+ * Provides the read-side API surface that the stop-hook router consumes.
+ * Runtime mode persists to disk so shadow-mode rollout survives server
+ * restarts; per-session hot-path state remains process-local and is
+ * repopulated by hook events.
  *
  * Spec: docs/specs/context-death-pitfall-prevention.md
  *
@@ -34,13 +36,50 @@ export const GATE_ROUTE_MINIMUM_VERSION = 1;
 const state = {
     mode: 'off',
     killSwitch: false,
+    modeFilePath: null,
     sessionStartTs: new Map(),
 };
+function readPersistedMode(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        const mode = parsed.mode;
+        if (mode === 'off' || mode === 'shadow' || mode === 'enforce')
+            return mode;
+    }
+    catch {
+        // Missing/unreadable state is not fatal; caller supplies default.
+    }
+    return null;
+}
+function persistMode() {
+    if (!state.modeFilePath)
+        return;
+    try {
+        fs.mkdirSync(path.dirname(state.modeFilePath), { recursive: true });
+        fs.writeFileSync(state.modeFilePath, JSON.stringify({ mode: state.mode, updatedAt: new Date().toISOString() }, null, 2) + '\n', { mode: 0o600 });
+    }
+    catch {
+        // Fail open. The route still returns the in-memory mode; persistence
+        // failure is reported by the caller's normal health/degradation path.
+    }
+}
+export function configureStopGateState(opts = {}) {
+    if (opts.modeFilePath) {
+        state.modeFilePath = opts.modeFilePath;
+        state.mode = readPersistedMode(opts.modeFilePath) ?? (opts.defaultMode ?? state.mode);
+        persistMode();
+        return state.mode;
+    }
+    if (opts.defaultMode)
+        state.mode = opts.defaultMode;
+    return state.mode;
+}
 export function getMode() {
     return state.mode;
 }
 export function setMode(mode) {
     state.mode = mode;
+    persistMode();
 }
 export function getKillSwitch() {
     return state.killSwitch;
@@ -83,6 +122,7 @@ export function getSessionStartTs(sessionId) {
 export function _resetForTests() {
     state.mode = 'off';
     state.killSwitch = false;
+    state.modeFilePath = null;
     state.sessionStartTs.clear();
 }
 // ── Compaction probe (P0.6) ─────────────────────────────────────────────

package/dist/server/stopGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"stopGate.js","sourceRoot":"","sources":["../../src/server/stopGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2EAA2E;AAC3E,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,gCAAgC;AAChC,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAoB5C,MAAM,KAAK,GAAc;IACvB,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,KAAK;IACjB,cAAc,EAAE,IAAI,GAAG,EAAE;CAC1B,CAAC;AAEF,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc;IACpC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;IAC/B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,WAAmB;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IAChD,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;IACnB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,0CAA0C;AAC1C,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,6BAA6B;AAC7B,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAY9C,MAAM,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,oDAAoD;IACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,uBAAuB,IAAI,CAAC,SAAS,aAAa,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB;WACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,8BAA8B;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,mCAAmC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAmB;IAC/C,IAAI,OAAO,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;WAChC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE;IACtD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAC5C,kBAAkB,EAAE,kBAAkB,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;QACF,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACzE,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"stopGate.js","sourceRoot":"","sources":["../../src/server/stopGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2EAA2E;AAC3E,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,gCAAgC;AAChC,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAqB5C,MAAM,KAAK,GAAc;IACvB,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,KAAK;IACjB,YAAY,EAAE,IAAI;IAClB,cAAc,EAAE,IAAI,GAAG,EAAE;CAC1B,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAuB,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO;IAChC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,EAAE,CAAC,aAAa,CACd,KAAK,CAAC,YAAY,EAClB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACzF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAGnC,EAAE;IACJ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,KAAK,CAAC,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,WAAW,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc;IACpC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;IAC/B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,WAAmB;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IAChD,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;IACnB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,0CAA0C;AAC1C,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,6BAA6B;AAC7B,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAY9C,MAAM,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,oDAAoD;IACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,uBAAuB,IAAI,CAAC,SAAS,aAAa,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB;WACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,8BAA8B;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,mCAAmC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAmB;IAC/C,IAAI,OAAO,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;WAChC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE;IACtD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAC5C,kBAAkB,EAAE,kBAAkB,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;QACF,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACzE,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.2.83",
+  "version": "1.3.0",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/playbook-scripts/build-state.py

@@ -206,6 +206,30 @@ def git_run(args, cwd=None):
     return result.returncode == 0, result.stdout.strip(), result.stderr.strip()
 
 
+# ─── Owner identity (BUILD-STOP-HOOK-SESSION-SCOPING-SPEC) ────────────
+# A build is owned by the session that started it. We stamp the owner's stable
+# tmux session name (cwd-independent) at init so the Stop hook can scope its
+# "keep working" block to the OWNER alone — other concurrent sessions of the same
+# agent must approve-exit without draining the owner's reinforcement budget.
+# Test seams (shared with build-stop-hook.sh): INSTAR_HOOK_TMUX_SESSION (if set,
+# even empty, wins) and INSTAR_HOOK_NO_TMUX=1 (forces empty). Best-effort only —
+# resolution failure must never break `init`.
+
+def resolve_owner_tmux(explicit=None):
+    if explicit:
+        return explicit.strip()
+    if os.environ.get("INSTAR_HOOK_NO_TMUX") == "1":
+        return ""
+    if "INSTAR_HOOK_TMUX_SESSION" in os.environ:
+        return os.environ["INSTAR_HOOK_TMUX_SESSION"]
+    try:
+        r = subprocess.run(["tmux", "display-message", "-p", "#S"],
+                           capture_output=True, text=True, timeout=3)
+        return r.stdout.strip() if r.returncode == 0 else ""
+    except Exception:
+        return ""
+
+
 # ─── Worktree Commands ──────────────────────────────────────────
 
 def cmd_worktree_create(args):
@@ -329,10 +353,16 @@ def cmd_init(args):
         out({"error": "Invalid size. Use SMALL, STANDARD, or LARGE"})
         sys.exit(1)
 
+    owner = {
+        "tmux": resolve_owner_tmux(getattr(args, "owner_tmux", None)),
+        "session": (getattr(args, "owner_session", None) or "").strip(),
+        "stampedAt": now_iso(),
+    }
     state = {
         "task": args.task, "phase": "idle", "size": size,
         "protection": PROTECTION_LEVELS[size],
         "startedAt": now_iso(), "completedAt": None,
+        "owner": owner,
         "currentStep": 0, "totalSteps": 0, "steps": [],
         "totalTests": 0, "allPassing": True,
         "fixIterations": 0, "maxFixIterations": 3,
@@ -341,7 +371,9 @@ def cmd_init(args):
         "worktree": None,
     }
     save_state(state)
-    append_audit("build.initialized", {"task": args.task, "size": size})
+    append_audit("build.initialized", {
+        "task": args.task, "size": size,
+        "ownerTmux": owner["tmux"], "ownerSession": owner["session"]})
     out({"status": "initialized", "task": args.task, "size": size,
          "protection": PROTECTION_LEVELS[size]["label"],
          "reinforcements": PROTECTION_LEVELS[size]["reinforcements"]})
@@ -583,6 +615,12 @@ def main():
     s.add_argument("task")
     s.add_argument("--size", choices=["SMALL", "STANDARD", "LARGE"],
                    default="STANDARD")
+    # Owner identity (session-scoping). --owner-session carries the Claude session
+    # UUID ($CLAUDE_CODE_SESSION_ID), which child processes don't inherit, so the
+    # SKILL passes it explicitly. --owner-tmux is an override seam (tests / unusual
+    # launches); normally the tmux name is self-resolved.
+    s.add_argument("--owner-session", default="")
+    s.add_argument("--owner-tmux", default="")
 
     s = sub.add_parser("transition")
     s.add_argument("phase")

package/scripts/analyze-release.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// safe-git-allow: release analyzer runs before TS source is compiled; read-only git only.
 /**
  * Release Change Analyzer
  *
@@ -24,11 +25,10 @@
  *   node scripts/analyze-release.js --recommend-only   # Just recommend bump type
  */
 
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { SafeGitExecutor } from '../src/core/SafeGitExecutor.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -43,18 +43,26 @@ function log(msg) {
 
 // ── Git Helpers ──────────────────────────────────────────────────────
 
+function gitRead(args) {
+  return execFileSync('git', args, {
+    cwd: ROOT,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
 function getLastReleaseTag() {
   try {
-    return SafeGitExecutor.readSync(['describe', '--tags', '--abbrev=0'], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:48' }).trim();
+    return gitRead(['describe', '--tags', '--abbrev=0']).trim();
   } catch {
     // No tags at all — diff against the initial commit
-    return SafeGitExecutor.readSync(['rev-list', '--max-parents=0', 'HEAD'], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:52' }).trim();
+    return gitRead(['rev-list', '--max-parents=0', 'HEAD']).trim();
   }
 }
 
 function getCommitsSinceTag(tag) {
   try {
-    const raw = SafeGitExecutor.readSync(['log', `${tag}..HEAD`, '--oneline', '--no-merges'], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:getCommitsSinceTag' });
+    const raw = gitRead(['log', `${tag}..HEAD`, '--oneline', '--no-merges']);
     return raw.trim().split('\n').filter(Boolean).map(line => {
       const [hash, ...rest] = line.split(' ');
       return { hash, message: rest.join(' ') };
@@ -66,7 +74,7 @@ function getCommitsSinceTag(tag) {
 
 function getDiffStat(tag) {
   try {
-    return SafeGitExecutor.readSync(['diff', `${tag}..HEAD`, '--stat'], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:getDiffStat' }).trim();
+    return gitRead(['diff', `${tag}..HEAD`, '--stat']).trim();
   } catch {
     return '';
   }
@@ -74,7 +82,7 @@ function getDiffStat(tag) {
 
 function getChangedFiles(tag) {
   try {
-    const raw = SafeGitExecutor.readSync(['diff', `${tag}..HEAD`, '--name-status'], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:getChangedFiles' });
+    const raw = gitRead(['diff', `${tag}..HEAD`, '--name-status']);
     return raw.trim().split('\n').filter(Boolean).map(line => {
       const [status, ...pathParts] = line.split('\t');
       return { status: status.charAt(0), file: pathParts.join('\t') };
@@ -86,7 +94,7 @@ function getChangedFiles(tag) {
 
 function getFileDiff(tag, file) {
   try {
-    return SafeGitExecutor.readSync(['diff', `${tag}..HEAD`, '--', file], { cwd: ROOT, encoding: 'utf-8', operation: 'scripts/analyze-release.js:getFileDiff' });
+    return gitRead(['diff', `${tag}..HEAD`, '--', file]);
   } catch {
     return '';
   }

package/scripts/generate-builtin-manifest.cjs

@@ -43,7 +43,7 @@ function fileExists(filePath) {
 
 /**
  * Scan hooks from PostUpdateMigrator's migrateHooks method.
- * These are the 14 hook files Instar writes to .instar/hooks/instar/.
+ * These are the hook files Instar writes to .instar/hooks/instar/.
  */
 function scanHooks() {
   const entries = [];
@@ -63,6 +63,7 @@ function scanHooks() {
     { file: 'free-text-guard.sh', domain: 'safety' },
     { file: 'claim-intercept.js', domain: 'coherence' },
     { file: 'claim-intercept-response.js', domain: 'coherence' },
+    { file: 'stop-gate-router.js', domain: 'safety' },
     { file: 'auto-approve-permissions.js', domain: 'safety' },
   ];