instar 1.3.1011 → 1.3.1012

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1011",
+  "version": "1.3.1012",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-27T19:51:46.153Z",
-  "instarVersion": "1.3.1011",
+  "generatedAt": "2026-07-27T19:56:42.745Z",
+  "instarVersion": "1.3.1012",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.1011.md → 1.3.1012.md}

@@ -5,6 +5,15 @@
 
 ## What Changed
 
+Corrects the `rollout-evidence-ref` in `docs/specs/mutual-ssh-autobootstrap.md`. It named
+`/multi-machine/mutual-ssh` — a path with no route anywhere in `src/`. The rollout has been marked
+active and unmeasurable since the feature merged on 2026-07-21.
+
+The readout was never missing. It is `GET /machines/ssh-health`, wired the whole time, and it
+returns real data right now. The spec simply named the wrong address.
+
+Spec frontmatter only. No runtime surface, no route added, no behaviour change.
+
 Memory recall now retrieves semantically. Keyword matching becomes the fallback it was always
 meant to be.
 
@@ -41,6 +50,16 @@ the fallback.
 
 ## What to Tell Your User
 
+Some features are released carefully: switched on quietly first, and only turned up once there is
+evidence they work. Each one's plan names the readout you check to see that evidence.
+
+This feature's plan named a readout that does not exist — so there was no way to tell whether it was
+working, and it would have sat in its cautious first stage forever. The readout it should have named
+does exist and has all along.
+
+Nothing about the feature changed. What changed is that its progress can now be read, and right now
+it honestly reports that it is not ready yet — which is a much better answer than silence.
+
 Your agent has two ways to search its own memory: one that matches on meaning, and one that
 matches on words. The good one was built, fully switched on, and never called.
 
@@ -62,6 +81,9 @@ lookup, quietly, and everything after is fast.
 
 ## Summary of New Capabilities
 
+- The mutual-SSH feature's graduation evidence is readable at `GET /machines/ssh-health` instead of
+  pointing at a path that returns nothing.
+
 - Memory recall retrieves by meaning rather than keyword, using the embedding index that was
   already built and populated but never called.
 - Each recall reports which strategy served it, so running on the keyword fallback is
@@ -73,6 +95,26 @@ lookup, quietly, and everything after is fast.
 
 ## Evidence
 
+Both paths probed live against the running server:
+
+| path | result |
+|---|---|
+| `/multi-machine/mutual-ssh` (the ref as written) | **404** |
+| `/machines/ssh-health` (the real readout) | **200** — `enrollmentState: ssh-bootstrap-blocked`, `pairs[0].mutual: false`, `standingKeyInstalled: false` |
+
+So the graduation criterion — at least one peer pair with bidirectional readiness proof and no
+blocking reason — is now evaluable, and currently, correctly, **not met**. Before this change,
+"not met" and "not measurable" were the same 404.
+
+The route is served from `src/server/routes.ts` (`router.get('/machines/ssh-health')`) reading
+`MutualSshRuntime.status()`, so the corrected ref also satisfies the rollout-evidence lint.
+
+**A correction to my own earlier diagnosis, recorded because it is the more useful finding.** I
+first read the 404 and concluded the endpoint had never landed with the feature, and filed an action
+to build it. It had landed, under a different name. Concluding absence from a single lookup, without
+checking whether the thing exists elsewhere, is the same error this whole sweep is about — and I
+made it while running the sweep.
+
 New tests run against **unmodified source first**:
 
 | run | result |

package/upgrades/side-effects/mutual-ssh-evidence-ref.md

@@ -0,0 +1,45 @@
+# Side-effects review — mutual-ssh rollout-evidence-ref correction
+
+**Change:** one frontmatter line in `docs/specs/mutual-ssh-autobootstrap.md` —
+`rollout-evidence-ref: /multi-machine/mutual-ssh` → `/machines/ssh-health`.
+
+**Tier:** 0–1. Spec frontmatter only. No `src/` surface, no route, no config key, no persisted
+state, no migration. Rollback is reverting one line.
+
+## What reads this field
+
+`scripts/lint-rollout-evidence-resolvable.js` (string-matches the ref against `src/`) and any
+future rollout-graduation reader. Nothing at runtime dereferences it — the field is documentation
+of where a human or a check should look, so a wrong value cannot cause a runtime fault. Its failure
+mode is exactly what happened: silence.
+
+## Blast radius
+
+None at runtime. The one behavioural consequence is intended and desirable: the mutual-ssh rollout
+becomes *measurable*, and the first honest measurement says **not ready** (`enrollmentState:
+ssh-bootstrap-blocked`, `pairs[0].mutual: false`). A feature that previously could not be assessed
+now reports a negative. That is the point; it is not a regression.
+
+## Why not build `/multi-machine/mutual-ssh` instead
+
+That was the first plan, and it was wrong. Adding an alias route to satisfy a spec that named a
+non-existent path would have created a second address for one readout — two places to look, two
+things to keep in sync, and a permanent invitation to the same confusion. The spec was wrong; the
+spec was corrected.
+
+## Verification
+
+- `curl /multi-machine/mutual-ssh` → 404 (before and after — nothing was added).
+- `curl /machines/ssh-health` → 200 with live pair state.
+- `node scripts/lint-rollout-evidence-resolvable.js` → the corrected ref resolves.
+
+## Rollback
+
+`git revert` the one-line commit. The rollout returns to being unmeasurable, which is the state it
+has been in since 2026-07-21.
+
+## Known limitation, stated rather than hidden
+
+The lint that guards this field is a **string match against `src/`**. A route that is written but
+never mounted would still satisfy it. That limitation is documented in the lint's own header; the
+live probe above is what actually establishes that this particular ref resolves.