instar 1.3.1158 → 1.3.1160

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1158",
+  "packageVersion": "1.3.1160",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "9cbf312433ed10eafb3f33a245b9ba17546fdd534ce1c2caf3dcaf28157ee33c",
+  "sha256": "05daed4cc90fbaa0916c051d8cf8985aa11cdc27f15f50ea5a3ffeff29550857",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1158"
+  "packageVersion": "1.3.1160"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1158"
+  "packageVersion": "1.3.1160"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1158",
+  "version": "1.3.1160",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-15T04:14:15.394Z",
-  "instarVersion": "1.3.1158",
+  "generatedAt": "2026-08-15T04:54:47.730Z",
+  "instarVersion": "1.3.1160",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1158",
+  "packageVersion": "1.3.1160",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "9cbf312433ed10eafb3f33a245b9ba17546fdd534ce1c2caf3dcaf28157ee33c",
+  "sha256": "05daed4cc90fbaa0916c051d8cf8985aa11cdc27f15f50ea5a3ffeff29550857",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1158"
+  "packageVersion": "1.3.1160"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1158"
+  "packageVersion": "1.3.1160"
 }

package/upgrades/1.3.1160.md

@@ -0,0 +1,67 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Extracted `tests/helpers/geminiEnvRefusal.ts` and its two call sites
+(`tests/e2e/gemini-cli-alive-lifecycle.test.ts`,
+`tests/e2e/gemini-setup-narrative-lifecycle.test.ts`) plus its unit test out of the
+blocked `echo/authorship-provenance` branch and onto main on their own.
+
+The two live-gemini E2Es gate on `haveGemini = !!detectGeminiPath()` — whether the
+BINARY IS INSTALLED. An installed-but-uncredentialed CLI exits 41 before processing
+the prompt, so the assertion downstream can neither pass nor meaningfully fail. CI is
+green only because no gemini binary exists there; the box that HAS gemini is the one
+that goes red.
+
+The two vitest globalSetup files that prepare the packed standards-registry asset
+(`tests/setup/build-dist.globalSetup.ts` and
+`tests/setup/ensure-registry-asset.globalSetup.ts`) decided whether to regenerate it
+on PRESENCE alone — `if (outputs.every(exists)) return`. An asset generated from an
+older revision of `docs/STANDARDS-REGISTRY.md` was therefore never regenerated.
+
+Both now consult a shared `registryAssetIsStale()` helper that compares the oldest
+output's mtime against the newest input's (`docs/STANDARDS-REGISTRY.md`,
+`docs/standards-registry-floor.json`, `package.json`) — the same shape the sibling
+`ensureDistBuilt()` twelve lines above already used.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- A full unit+integration+e2e run on a current checkout (3070 files) produced
+  **exactly 2 failures — both of these files**, both on
+  `Gemini CLI exited 41 — you must specify the GEMINI_API_KEY environment variable`.
+- The helper is ABSENT from main (404 via the contents API, against a control showing
+  7 files DO exist in `tests/helpers/`), and the failing test on main references it 0
+  times — so the fix genuinely never landed.
+- Main has not modified either e2e file since the authorship branch's base, so this
+  reverts nothing; the diff is +37/-6 against main.
+- `tsc --noEmit` exit 0 via the real binary.
+
+- Measured 2026-08-15: in a checkout whose asset was generated at 17:59 from a source
+  three hours newer, `standards-registry-asset`, `standards-enforcement-auditor` and
+  `standards-coverage-route` failed with 8 assertions. Regenerating the asset alone
+  made all 77 pass.
+- `tests/unit/registry-asset-freshness.test.ts` — 9/9.
+- Negative controls, both fired: reverting the comparison fails THE DEFECT case
+  (1 failed / 8 passed); reverting one call site to the presence check fails the
+  wiring case, naming the file. Both sources restored byte-exact.
+- The wiring guard matches the MODULE SPECIFIER, not the imported identifier, so an
+  aliased import cannot defeat it — the alias blindness found in an invariant test
+  earlier this week.
+- `tsc --noEmit` exit 0; full lint chain exit 0 across 45 lints.
+
+## Why it is separate
+
+Out-of-charter work absorbed into a large blocked change becomes hostage to that
+change's gate. The Zero-Failure Standard was satisfied on a branch and NOT on main,
+which is the only place it counts.

package/upgrades/side-effects/gemini-env-refusal-extract.md

@@ -0,0 +1,60 @@
+# Side-effects review — extracting the gemini environmental-refusal classifier
+
+## The change
+
+Moves `tests/helpers/geminiEnvRefusal.ts`, its unit test, and its two E2E call sites out of the blocked
+`echo/authorship-provenance` branch and onto main on their own. No new code: the same four files,
+standing alone where they can land. Test-only; no runtime surface.
+
+## Why it is separate, which is the actual point
+
+The two live-gemini E2Es gate on whether the BINARY IS INSTALLED. An installed-but-uncredentialed CLI
+exits 41 before it processes the prompt, so the assertion downstream can neither pass nor meaningfully
+fail. CI is green only because no gemini binary exists there — the box that HAS gemini is the one that
+goes red. That is a Zero-Failure Standard violation on main today.
+
+The fix was written hours ago, out-of-charter, and committed to whichever branch was checked out at the
+time — a large change now blocked at an approval gate for reasons unrelated to gemini. So the standard
+was satisfied on a branch and NOT on main, which is the only place it counts. **Out-of-charter work
+absorbed into a blocked change becomes hostage to that change's gate.**
+
+## Review answers
+
+1. **Over-block.** The classifier skips ONLY on causes the CLI itself names (missing credentials, quota
+   exhaustion, a version-manager miss). Everything else still fails. The rejected alternative — a live
+   preflight asking "can this box reach gemini at all?" — is recorded in the helper's own header as the
+   wrong trade: it would also skip on a transient failure, so a real regression would vanish silently.
+   Between a false red (visible, blocks a push) and a silent skip (invisible), the silent skip is worse.
+2. **Under-block.** A NEW environmental cause with different wording still fails loudly. That is the
+   intended direction; the list grows only when a real cause is observed.
+3. **Level-of-abstraction fit.** The classification is shared once and the tests decide what to do with
+   the answer — this is the third environmental cause these files handle, which is the point at which
+   two copies stop being maintainable.
+4. **Signal vs authority.** Not a gate. It decides whether a test asserts or skips.
+5. **Interactions.** None outside the three test files. No production import.
+6. **External surfaces.** None.
+7. **Multi-machine posture.** Machine-local BY DESIGN — it classifies THIS box's credential state.
+8. **Rollback cost.** Revert; the two e2e files return to failing on an uncredentialed box.
+
+## Evidence
+
+- **The negative control is main itself, measured rather than mutated.** A full run on a current
+  checkout (3073 files) produced exactly 2 failures — these two files — both on
+  `Gemini CLI exited 41 — you must specify the GEMINI_API_KEY environment variable`.
+- On this branch the same three files pass, 24 tests, with the E2E bodies skipping loudly:
+  *"Skipping live Gemini narrative assertion: no credentials configured (the child env is key-free by
+  design; OAuth creds absent)."*
+- The helper is ABSENT from main (404 via the contents API, against a control showing 7 files DO exist
+  in `tests/helpers/`), and the failing test on main references it 0 times — the fix genuinely never
+  landed.
+- Main has not modified either e2e file since the source branch's base, so this reverts nothing; the
+  diff against main is +37/-6 on the e2e files plus the two new files.
+- `tsc --noEmit` exit 0 via the real binary.
+
+## Class closure — what this does NOT close
+
+- **The live smoke assertion still never executes on this box.** It skips, correctly and loudly. Making
+  it exercisable needs a credential decision that is the operator's, not a code change.
+- **Only gemini.** No audit was done of other live-CLI E2Es for the same installed-vs-usable confusion.
+- **The stranding pattern itself is untouched.** Nothing prevents the next out-of-charter fix from being
+  committed to a branch that later blocks. That is a process observation, recorded rather than solved.

package/upgrades/side-effects/registry-asset-freshness.md

@@ -0,0 +1,76 @@
+# Side-effects review — registry asset freshness
+
+## The change
+
+Two vitest globalSetup files decided whether to regenerate the packed
+standards-registry asset by asking only whether its outputs EXIST. Both now share a
+`registryAssetIsStale()` helper that compares the oldest output's mtime against the
+newest input's. Test-only; no runtime surface.
+
+## Review answers
+
+1. **Over-block.** This is the dominant risk and it got the most care, because the
+   check runs at the START of every suite and an over-eager rule regenerates on every
+   run. Three conservative cases, each with its own test: equal mtimes are NOT stale;
+   no readable input is NOT stale; an empty output list is NOT stale. Measured cost of
+   a genuine regeneration is one generator invocation (~1s), and it self-limits — a
+   freshly written asset is newer than its inputs, so the next run skips.
+
+2. **Under-block.** mtime is a proxy for content, not content itself. A source edited
+   and reverted leaves a newer mtime and triggers one unnecessary regeneration
+   (harmless). A content-identical touch does the same. Conversely, a filesystem that
+   does not preserve mtimes, or a checkout that sets all mtimes equal, would report
+   fresh when stale. A content hash would be exact — the generator already writes a
+   `sha256` into its metadata — and that is the stronger version of this fix. NOT done
+   here: it means reading and hashing a 450KB document on every suite start, where the
+   mtime compare is four `stat` calls, and the sibling `ensureDistBuilt()` this mirrors
+   uses mtimes too. Stated rather than implied.
+
+3. **Level-of-abstraction fit.** Correct layer: the setup layer is where every test
+   file inherits the guarantee. The file's own history says this explicitly — a
+   per-file `beforeAll` bootstrap was found to be invisible to the next file that
+   needed it.
+
+4. **Signal vs authority.** Not a gate. It decides whether to run a generator; it
+   blocks nothing and rejects no input.
+
+5. **Interactions.** `ensureRegistryAsset()` must still run AFTER `ensureDistBuilt()`
+   (the generator imports from `dist/`). Unchanged — only the early-return predicate
+   moved. The exported `ensureRegistryAsset(root)` keeps its signature, so the
+   production-generator parity ratchet that imports it is unaffected.
+
+6. **External surfaces.** None. Test setup only; nothing ships to an agent or a user.
+
+7. **Multi-machine posture.** Machine-local BY DESIGN — a per-checkout build artifact.
+   There is nothing to replicate: each checkout generates its own copy, and the whole
+   defect was one checkout trusting its own stale copy.
+
+8. **Rollback cost.** Revert the commit. The helper is additive; the two call sites
+   return to a presence check.
+
+## Class closure — what this does NOT close
+
+- **Only these two sites.** A sweep of `tests/setup/` and `scripts/` for
+  regenerate-on-presence guards found exactly these two making a regeneration decision
+  on existence alone; the other `existsSync` hits are ordinary existence guards, not
+  regeneration decisions. The wiring test pins both and fails if either drifts, but it
+  knows only about setups that generate THIS asset.
+- **`src/data/builtin-manifest.json`** is named in the generator's own comment as
+  having a related defect (generated only into `src/data/` while its reader resolves
+  module-relative from `dist/data/`). Different feature, different defect, untouched.
+- **mtime is not content** — see review answer 2.
+
+## Evidence
+
+- `tests/unit/registry-asset-freshness.test.ts` — 9/9 green.
+- Negative controls, BOTH fired and both restored byte-exact: reverting the comparison
+  fails THE DEFECT case (1 failed / 8 passed — the 8 passing are the controls, which is
+  what makes them controls); reverting one call site to the presence check fails the
+  wiring case and names the file.
+- Observed live: running the new test in a fresh checkout regenerated the asset
+  ("88 articles → src/data + dist/data"). Under the presence check it would have
+  skipped, because the outputs existed.
+- The originating measurement: three test files / eight assertions failing against a
+  three-hour-stale asset; regeneration alone made all 77 pass.
+- `tsc --noEmit` exit 0 (run via the real binary — `npx tsc` here is intercepted by a
+  shim that exits 0 without typechecking). Full lint chain exit 0 across 45 lints.