instar 1.3.1159 → 1.3.1161

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1159",
+  "packageVersion": "1.3.1161",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "64b362d2e7aed4d92d9e9948a954ae1c099930efc5972c89842953e81cfd36ff",
+  "sha256": "43851e9ac8b44d594fefed64286f3c7d1a9e5028b8b96934309d13cb50851fad",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1159"
+  "packageVersion": "1.3.1161"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1159"
+  "packageVersion": "1.3.1161"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1159",
+  "version": "1.3.1161",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-15T04:46:02.884Z",
-  "instarVersion": "1.3.1159",
+  "generatedAt": "2026-08-15T05:03:51.309Z",
+  "instarVersion": "1.3.1161",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1159",
+  "packageVersion": "1.3.1161",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "64b362d2e7aed4d92d9e9948a954ae1c099930efc5972c89842953e81cfd36ff",
+  "sha256": "43851e9ac8b44d594fefed64286f3c7d1a9e5028b8b96934309d13cb50851fad",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1159"
+  "packageVersion": "1.3.1161"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1159"
+  "packageVersion": "1.3.1161"
 }

package/upgrades/{1.3.1159.md → 1.3.1160.md}

@@ -5,6 +5,17 @@
 
 ## What Changed
 
+Extracted `tests/helpers/geminiEnvRefusal.ts` and its two call sites
+(`tests/e2e/gemini-cli-alive-lifecycle.test.ts`,
+`tests/e2e/gemini-setup-narrative-lifecycle.test.ts`) plus its unit test out of the
+blocked `echo/authorship-provenance` branch and onto main on their own.
+
+The two live-gemini E2Es gate on `haveGemini = !!detectGeminiPath()` — whether the
+BINARY IS INSTALLED. An installed-but-uncredentialed CLI exits 41 before processing
+the prompt, so the assertion downstream can neither pass nor meaningfully fail. CI is
+green only because no gemini binary exists there; the box that HAS gemini is the one
+that goes red.
+
 The two vitest globalSetup files that prepare the packed standards-registry asset
 (`tests/setup/build-dist.globalSetup.ts` and
 `tests/setup/ensure-registry-asset.globalSetup.ts`) decided whether to regenerate it
@@ -26,6 +37,16 @@ None — internal change (no user-facing surface).
 
 ## Evidence
 
+- A full unit+integration+e2e run on a current checkout (3070 files) produced
+  **exactly 2 failures — both of these files**, both on
+  `Gemini CLI exited 41 — you must specify the GEMINI_API_KEY environment variable`.
+- The helper is ABSENT from main (404 via the contents API, against a control showing
+  7 files DO exist in `tests/helpers/`), and the failing test on main references it 0
+  times — so the fix genuinely never landed.
+- Main has not modified either e2e file since the authorship branch's base, so this
+  reverts nothing; the diff is +37/-6 against main.
+- `tsc --noEmit` exit 0 via the real binary.
+
 - Measured 2026-08-15: in a checkout whose asset was generated at 17:59 from a source
   three hours newer, `standards-registry-asset`, `standards-enforcement-auditor` and
   `standards-coverage-route` failed with 8 assertions. Regenerating the asset alone
@@ -38,3 +59,9 @@ None — internal change (no user-facing surface).
   aliased import cannot defeat it — the alias blindness found in an invariant test
   earlier this week.
 - `tsc --noEmit` exit 0; full lint chain exit 0 across 45 lints.
+
+## Why it is separate
+
+Out-of-charter work absorbed into a large blocked change becomes hostage to that
+change's gate. The Zero-Failure Standard was satisfied on a branch and NOT on main,
+which is the only place it counts.

package/upgrades/1.3.1161.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Adds `tests/setup/nativeModuleHealth.globalSetup.ts`, wired into `vitest.config.ts`
+after `build-dist.globalSetup.ts`. It probes better-sqlite3 once (load AND open an
+in-memory DB) and, only when that fails, prints one line at setup and a single
+banner at TEARDOWN — which vitest renders after the run summary, beside the failure
+count.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `tests/unit/native-module-health-banner.test.ts` — 11/11.
+- **Placement proven END-TO-END, not asserted**: the broken branch was forced by
+  mutation (count-asserted at exactly 1 — the first attempt applied 0 times and was
+  caught by that control), a suite was run, and the banner rendered AFTER the
+  `Test Files / Tests / Duration` summary. Source restored byte-exact, 0 markers.
+- Probe covers the incident's real signature — the module LOADS but cannot open a
+  database. A require-only probe would have reported healthy for the entire outage;
+  that case is pinned.
+- Over-block control: given a healthy probe it writes NOTHING and returns NO
+  teardown. It also cannot throw — a throwing probe is reported, not propagated,
+  because this runs before every suite.
+- `tsc --noEmit` exit 0 via the real binary; full lint chain exit 0.
+
+## Why
+
+Measured 2026-08-15: a local full suite reported 225 failing files; 108 were
+downstream of better-sqlite3 having no native binary in that checkout (the install
+had skipped its postinstall). instar diagnosed it correctly and printed the remedy
+**189 times**, and that did not help — 189 lines in a 21MB log is volume, not a
+signal. This does not add detection; it moves the existing diagnosis to where it is
+read.
+
+## Not closed
+
+Scoped to better-sqlite3 alone — deliberately, since generalising from one incident
+is the over-read that caused it. The install hygiene itself is unchanged; this makes
+its consequence legible, it does not prevent it.

package/upgrades/side-effects/gemini-env-refusal-extract.md

@@ -0,0 +1,60 @@
+# Side-effects review — extracting the gemini environmental-refusal classifier
+
+## The change
+
+Moves `tests/helpers/geminiEnvRefusal.ts`, its unit test, and its two E2E call sites out of the blocked
+`echo/authorship-provenance` branch and onto main on their own. No new code: the same four files,
+standing alone where they can land. Test-only; no runtime surface.
+
+## Why it is separate, which is the actual point
+
+The two live-gemini E2Es gate on whether the BINARY IS INSTALLED. An installed-but-uncredentialed CLI
+exits 41 before it processes the prompt, so the assertion downstream can neither pass nor meaningfully
+fail. CI is green only because no gemini binary exists there — the box that HAS gemini is the one that
+goes red. That is a Zero-Failure Standard violation on main today.
+
+The fix was written hours ago, out-of-charter, and committed to whichever branch was checked out at the
+time — a large change now blocked at an approval gate for reasons unrelated to gemini. So the standard
+was satisfied on a branch and NOT on main, which is the only place it counts. **Out-of-charter work
+absorbed into a blocked change becomes hostage to that change's gate.**
+
+## Review answers
+
+1. **Over-block.** The classifier skips ONLY on causes the CLI itself names (missing credentials, quota
+   exhaustion, a version-manager miss). Everything else still fails. The rejected alternative — a live
+   preflight asking "can this box reach gemini at all?" — is recorded in the helper's own header as the
+   wrong trade: it would also skip on a transient failure, so a real regression would vanish silently.
+   Between a false red (visible, blocks a push) and a silent skip (invisible), the silent skip is worse.
+2. **Under-block.** A NEW environmental cause with different wording still fails loudly. That is the
+   intended direction; the list grows only when a real cause is observed.
+3. **Level-of-abstraction fit.** The classification is shared once and the tests decide what to do with
+   the answer — this is the third environmental cause these files handle, which is the point at which
+   two copies stop being maintainable.
+4. **Signal vs authority.** Not a gate. It decides whether a test asserts or skips.
+5. **Interactions.** None outside the three test files. No production import.
+6. **External surfaces.** None.
+7. **Multi-machine posture.** Machine-local BY DESIGN — it classifies THIS box's credential state.
+8. **Rollback cost.** Revert; the two e2e files return to failing on an uncredentialed box.
+
+## Evidence
+
+- **The negative control is main itself, measured rather than mutated.** A full run on a current
+  checkout (3073 files) produced exactly 2 failures — these two files — both on
+  `Gemini CLI exited 41 — you must specify the GEMINI_API_KEY environment variable`.
+- On this branch the same three files pass, 24 tests, with the E2E bodies skipping loudly:
+  *"Skipping live Gemini narrative assertion: no credentials configured (the child env is key-free by
+  design; OAuth creds absent)."*
+- The helper is ABSENT from main (404 via the contents API, against a control showing 7 files DO exist
+  in `tests/helpers/`), and the failing test on main references it 0 times — the fix genuinely never
+  landed.
+- Main has not modified either e2e file since the source branch's base, so this reverts nothing; the
+  diff against main is +37/-6 on the e2e files plus the two new files.
+- `tsc --noEmit` exit 0 via the real binary.
+
+## Class closure — what this does NOT close
+
+- **The live smoke assertion still never executes on this box.** It skips, correctly and loudly. Making
+  it exercisable needs a credential decision that is the operator's, not a code change.
+- **Only gemini.** No audit was done of other live-CLI E2Es for the same installed-vs-usable confusion.
+- **The stranding pattern itself is untouched.** Nothing prevents the next out-of-charter fix from being
+  committed to a branch that later blocks. That is a process observation, recorded rather than solved.

package/upgrades/side-effects/native-module-health-banner.md

@@ -0,0 +1,60 @@
+# Side-effects review — native-module health banner
+
+## The change
+
+A vitest globalSetup that probes better-sqlite3 once and, only on failure, emits one
+setup line plus a single banner at teardown (rendered after the run summary). Adds no
+detection: it relocates a diagnosis instar already produces to where a reader looks.
+
+## Review answers
+
+1. **Over-block.** The dominant risk, because this runs before EVERY suite on every
+   machine. It writes nothing and returns no teardown on a healthy probe — pinned by a
+   control. It never fails, skips, or changes an exit code. And it cannot throw: the
+   probe is wrapped even though the default probe already catches internally, because
+   an exception here would take down every run — strictly worse than the degraded
+   state it describes.
+2. **Under-block.** It watches ONE module. A different native module breaking silently
+   gets no banner. That is deliberate: generalising to "native modules" from a single
+   incident would be inventing a class, which is the exact over-read that caused the
+   incident. It also cannot detect a module that loads, opens a DB, and misbehaves
+   later — the probe is a smoke test, not a health monitor.
+3. **Level-of-abstraction fit.** globalSetup is the right layer: a per-file check is
+   invisible to the next file (this file's sibling records that lesson explicitly),
+   and teardown is the only hook that runs after the summary.
+4. **Signal vs authority.** Pure signal. It gates nothing and rejects nothing.
+5. **Interactions.** Ordered AFTER `build-dist.globalSetup.ts`, so its teardown runs
+   FIRST (teardowns run in reverse) and the banner sits closest to the summary. It
+   shares no state with any other setup.
+6. **External surfaces.** None. Test-run stderr only; nothing ships to an agent or a
+   user, no file is written.
+7. **Multi-machine posture.** Machine-local BY DESIGN — it reports on THIS checkout's
+   node_modules. There is nothing to replicate; a peer's binary state is irrelevant to
+   a local run.
+8. **Rollback cost.** Remove the config entry, or delete the file. No migration, no
+   state, no consumer.
+
+## Class closure — what this does NOT close
+
+- **It does not prevent the cause.** An install that skips its postinstall still
+  produces a broken checkout; this only makes the consequence readable. The hygiene
+  fix (never installing with `--ignore-scripts`) is a habit, not code, and I am not
+  claiming otherwise.
+- **Only better-sqlite3**, and only at run start.
+- **Placement depends on vitest rendering teardown output after the summary.** That is
+  measured on vitest 2.1.9 here, not guaranteed by contract. If a future version
+  reorders it, the setup line still fires at the top — which is why both exist.
+
+## Evidence
+
+- 11/11 in `tests/unit/native-module-health-banner.test.ts`; `tsc --noEmit` exit 0 via
+  the real binary; full lint chain exit 0.
+- **Placement proven end-to-end.** The broken branch was forced by mutation and a real
+  suite was run; the banner rendered AFTER `Test Files / Tests / Duration`. **My first
+  mutation attempt applied 0 times and its own count control caught it** — that run
+  would have "passed" while proving nothing, which is the defect class this whole
+  change is about. Re-applied against the real line (count asserted at exactly 1),
+  re-run, restored byte-exact with 0 markers.
+- The incident's real signature is pinned: a module that LOADS but cannot open a
+  database is reported BROKEN. A require-only probe would have called the entire
+  outage healthy.