instar 1.3.1178 → 1.3.1179

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1178",
+  "packageVersion": "1.3.1179",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "f029879dbc7cd1b446fd6a7d35ae5c625f714f0c373fc8cc56dcd9dd36d3d756",
+  "sha256": "44d5cab21f32cf4e49f8d3d8bbcfb270282dae4260df4eee3a31fc01a8a3ce09",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1178"
+  "packageVersion": "1.3.1179"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1178"
+  "packageVersion": "1.3.1179"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1178",
+  "version": "1.3.1179",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/standards-coverage.mjs

@@ -54,6 +54,13 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import yaml from 'js-yaml';
 import { articleIds, parseRegistryStructure } from './standards-registry-article-core.mjs';
+import {
+  evaluateStandardsDirection,
+  readCandidateApproverKey,
+  readDirectionApprovalLedger,
+  resolveProtectedApproverKey,
+  resolveProtectedBaseRegistry,
+} from './standards-direction-guard.mjs';
 import { parseFrontmatter, validateAuditReport } from './write-audit-convergence.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -105,6 +112,8 @@ const AREA_AUDITS_PATH = path.join(ROOT, 'docs', 'standards-registry-area-audits
 const AREA_MODEL_AUDIT_PATH = path.join(ROOT, 'docs', 'standards-registry-area-model-audit.json');
 const CI_WORKFLOW_PATH = path.join(ROOT, '.github', 'workflows', 'ci.yml');
 const OUT_PATH = path.join(ROOT, '.instar', 'standards-coverage.json');
+const DIRECTION_APPROVALS_PATH = path.join(ROOT, 'docs', 'standards-direction-approvals.json');
+const DIRECTION_APPROVER_KEY_PATH = path.join(ROOT, '.github', 'keyrings', 'telegram-principal-pub.pem');
 
 // ── Hardcoded committed floors (the read baseline; output file is never it) ──
 const numEnv = (env, def) => {
@@ -575,6 +584,9 @@ function validateRootSelfWiring() {
   const checkEnv = {
     STANDARDS_AREA_AUDIT_BASE_FILE: '${{ runner.temp }}/standards-area-audits-base.json',
     STANDARDS_AREA_AUDIT_BASE_REQUIRED: '${{ steps.area-audit-base.outputs.required }}',
+    STANDARDS_DIRECTION_BASE_FILE: '${{ runner.temp }}/standards-registry-base.md',
+    STANDARDS_DIRECTION_BASE_APPROVER_KEY_FILE: '${{ runner.temp }}/standards-direction-approver-base.pem',
+    STANDARDS_DIRECTION_BASE_REVISION: "${{ github.event.pull_request.base.sha || github.event.before || format('{0}^', github.sha) }}",
   };
   if (!exactKeys(job, ['name', 'runs-on', 'steps']) ||
     job.name !== 'Standards Enforcement Coverage' || job['runs-on'] !== 'ubuntu-latest' ||
@@ -595,6 +607,8 @@ function validateRootSelfWiring() {
     'else',
     '  echo "required=0" >> "$GITHUB_OUTPUT"',
     'fi',
+    'git show "$BASE_SHA:docs/STANDARDS-REGISTRY.md" > "$RUNNER_TEMP/standards-registry-base.md"',
+    'git show "$BASE_SHA:.github/keyrings/telegram-principal-pub.pem" > "$RUNNER_TEMP/standards-direction-approver-base.pem"',
     '',
   ].join('\n');
   const expectedBaseSha = "${{ github.event.pull_request.base.sha || github.event.before || format('{0}^', github.sha) }}";
@@ -1237,9 +1251,70 @@ function compute() {
         capturedSections: 0,
         unrecognizedSections: [],
       },
+      directionGuard: {
+        status: ALLOW_PARTIAL_REGISTRY ? 'not-assessed' : 'not-proven',
+        errors: ALLOW_PARTIAL_REGISTRY ? [] : ['candidate standards registry is unavailable'],
+        changes: [],
+        trustRoot: { origin: 'protected-base', source: null, revision: null, candidateTreeIgnored: true },
+        population: { protectedBase: 0, candidate: 0, continuity: 0, additions: [], removals: [], byFamily: {} },
+      },
     };
   }
 
+  const directionGuard = (() => {
+    if (ALLOW_PARTIAL_REGISTRY) {
+      return {
+        status: 'not-assessed', errors: [], changes: [],
+        trustRoot: { origin: 'not-assessed', source: null, revision: null, candidateTreeIgnored: true },
+        population: { protectedBase: 0, candidate: 0, continuity: 0, additions: [], removals: [], byFamily: {} },
+      };
+    }
+    const base = resolveProtectedBaseRegistry({
+      root: ROOT,
+      explicitFile: Object.hasOwn(process.env, 'STANDARDS_DIRECTION_BASE_FILE')
+        ? process.env.STANDARDS_DIRECTION_BASE_FILE
+        : undefined,
+      explicitRevision: process.env.STANDARDS_DIRECTION_BASE_REVISION,
+    });
+    if (base.errors.length > 0 || base.markdown === null) {
+      return {
+        status: 'not-proven', errors: base.errors, changes: [],
+        trustRoot: { origin: 'protected-base', source: null, revision: null, candidateTreeIgnored: true },
+        population: { protectedBase: 0, candidate: 0, continuity: 0, additions: [], removals: [], byFamily: {} },
+      };
+    }
+    const approvals = readDirectionApprovalLedger(DIRECTION_APPROVALS_PATH);
+    const candidateKey = readCandidateApproverKey(DIRECTION_APPROVER_KEY_PATH);
+    const key = resolveProtectedApproverKey({
+      root: ROOT,
+      explicitFile: Object.hasOwn(process.env, 'STANDARDS_DIRECTION_BASE_APPROVER_KEY_FILE')
+        ? process.env.STANDARDS_DIRECTION_BASE_APPROVER_KEY_FILE
+        : undefined,
+      explicitRevision: process.env.STANDARDS_DIRECTION_BASE_REVISION,
+    });
+    if (key.revision !== base.revision) {
+      key.errors.push('protected-base registry and approver trust root resolved from different revisions');
+    }
+    const assessed = evaluateStandardsDirection({
+      baseMarkdown: base.markdown,
+      candidateMarkdown: markdown,
+      approvalLedger: approvals.value,
+      approverPublicKeyPem: key.pem,
+      candidateApproverPublicKeyPem: candidateKey.pem,
+      baseRevision: base.revision ?? 'unknown-protected-base',
+    });
+    assessed.errors.unshift(...approvals.errors, ...candidateKey.errors, ...key.errors);
+    if (assessed.errors.length > 0) assessed.status = 'not-proven';
+    assessed.trustRoot = {
+      origin: 'protected-base',
+      source: key.source,
+      revision: key.revision,
+      candidateTreeIgnored: true,
+      candidateTreeDriftBlocked: true,
+    };
+    return assessed;
+  })();
+
   const { articles, enforcementScope, areaSha256, areaSectionCounts } = parseRegistry(canonicalText(markdown));
   const routeTable = loadRouteTable();
   const extracted = articles.map((a) => ({ a, refs: extractRefs(a) }));
@@ -1297,7 +1372,9 @@ function compute() {
 
   const total = articles.length;
   const enforced = byKind.ratchet + byKind.gate + byKind.lint;
-  const enforcedRatio = total === 0 ? 1 : Number((enforced / total).toFixed(4));
+  const continuityTotal = directionGuard.population?.continuity || total;
+  const currentPopulationEnforcedRatio = total === 0 ? 1 : Number((enforced / total).toFixed(4));
+  const enforcedRatio = continuityTotal === 0 ? 1 : Number((enforced / continuityTotal).toFixed(4));
   const areaNames = [...areaTallies.keys()].sort();
   const loadedAreaAudits = loadAreaAuditLedger(areaNames);
   const loadedAreaModelAudit = loadAreaModelAudit(areaNames);
@@ -1323,7 +1400,9 @@ function compute() {
     const audit = isPlainObject(loadedAreaAudits.ledger?.areas?.[areaName])
       ? loadedAreaAudits.ledger.areas[areaName]
       : null;
-    const ratio = tally.total === 0 ? 1 : Number((tally.enforced / tally.total).toFixed(4));
+    const areaContinuityTotal = directionGuard.population?.byFamily?.[areaName]?.continuity || tally.total;
+    const currentPopulationRatio = tally.total === 0 ? 1 : Number((tally.enforced / tally.total).toFixed(4));
+    const ratio = areaContinuityTotal === 0 ? 1 : Number((tally.enforced / areaContinuityTotal).toFixed(4));
     const auditCurrent = typeof audit?.areaSha256 === 'string' && audit.areaSha256 === areaSha256[areaName];
     if (audit && !auditCurrent) {
       areaAuditErrors.push(
@@ -1333,9 +1412,11 @@ function compute() {
     if (auditCurrent) currentAreaAudits += 1;
     areas[areaName] = {
       total: tally.total,
+      continuityTotal: areaContinuityTotal,
       enforced: tally.enforced,
       byKind: tally.byKind,
       refResolutionRatio: ratio,
+      currentPopulationRefResolutionRatio: currentPopulationRatio,
       gaps: tally.gaps,
       currentAreaSha256: areaSha256[areaName],
       lastAuditedAt: typeof audit?.lastAuditedAt === 'string' ? audit.lastAuditedAt : null,
@@ -1365,7 +1446,8 @@ function compute() {
     generatedAt: new Date().toISOString(),
     registryFound: true,
     rootSelfWiring,
-    total, byKind, enforcedRatio, gaps, enforcementScope, areas,
+    total, continuityTotal, byKind, enforcedRatio, currentPopulationEnforcedRatio,
+    gaps, enforcementScope, areas, directionGuard,
     areaAudit: {
       status: areaAuditErrors.length === 0 ? 'current' : 'invalid',
       path: path.relative(ROOT, AREA_AUDITS_PATH),
@@ -1470,7 +1552,7 @@ function recordAreaAudit(report, selection, auditRef) {
     if (canonicalTimestamp(oldTimestamp) && Date.parse(lastAuditedAt) < Date.parse(oldTimestamp)) {
       throw new Error(`lastAuditedAt for ${area} may not move backward`);
     }
-    const measuredFloor = { enforced: measurement.enforced, total: measurement.total };
+    const measuredFloor = { enforced: measurement.enforced, total: measurement.continuityTotal ?? measurement.total };
     const oldFloor = existing.areas?.[area]?.refResolutionFloor;
     const rebaselining = typeof REBASELINE_REASON === 'string' && REBASELINE_REASON.trim().length > 0;
     const refResolutionFloor = !rebaselining
@@ -1600,15 +1682,21 @@ function main() {
     process.stdout.write(JSON.stringify(report, null, 2) + '\n');
   } else if (!QUIET) {
     console.error(`[standards-coverage] registry=${report.registryFound} total=${report.total} ` +
+      `continuity-total=${report.continuityTotal ?? report.total} ` +
       `enforced-ratio=${report.enforcedRatio} (ratchet ${report.byKind.ratchet} / gate ${report.byKind.gate} / ` +
       `lint ${report.byKind.lint} / spec-only ${report.byKind['spec-only']} / gap ${report.byKind['documented-only']}) ` +
       `false-claims=${report.falseClaimCount} ` +
       `dangling=${report.danglingCount} ` +
       `unrecognized-sections=${report.enforcementScope.unrecognizedSections.length}`);
     console.error(`[standards-coverage] floors: enforced-ratio>=${FLOORS.enforcedRatio} dangling<=${FLOORS.danglingCeiling} false-claims<=${FLOORS.falseClaimCeiling} unrecognized-sections<=${FLOORS.unrecognizedSectionCeiling}`);
+    console.error(`[standards-coverage] direction-guard=${report.directionGuard.status} ` +
+      `base=${report.directionGuard.baseRevision ?? 'not-assessed'} ` +
+      `trust-root=${report.directionGuard.trustRoot?.origin ?? 'unknown'} ` +
+      `candidate-pin-ignored-as-authority=${report.directionGuard.trustRoot?.candidateTreeIgnored === true} ` +
+      `candidate-pin-drift-blocked=${report.directionGuard.trustRoot?.candidateTreeDriftBlocked === true}`);
     for (const [area, measurement] of Object.entries(report.areas)) {
       console.error(
-        `[standards-coverage] area="${area}" total=${measurement.total} ` +
+        `[standards-coverage] area="${area}" total=${measurement.total} continuity-total=${measurement.continuityTotal ?? measurement.total} ` +
         `ref-resolution-ratio=${measurement.refResolutionRatio} ` +
         `floor=${measurement.refResolutionFloor ? `${measurement.refResolutionFloor.enforced}/${measurement.refResolutionFloor.total}` : 'missing'} ` +
         `last-audited=${measurement.lastAuditedAt ?? 'missing'} audit-ref=${measurement.auditRef ?? 'missing'} ` +
@@ -1621,6 +1709,9 @@ function main() {
     for (const error of report.areaModelAudit.errors) {
       console.error(`[standards-coverage] AREA MODEL AUDIT — ${error}`);
     }
+    for (const error of report.directionGuard.errors) {
+      console.error(`[standards-coverage] DIRECTION GUARD — ${error}`);
+    }
     for (const fc of report.falseClaims) {
       console.error(`[standards-coverage] FALSE CLAIM — "${fc.standard}" asserts running machinery (${fc.claims.map((c) => `"${c}"`).join(', ')}) but names no resolvable guard.`);
     }
@@ -1629,15 +1720,18 @@ function main() {
   if (CHECK) {
     const failures = [];
     const aggregateEnforced = report.byKind.ratchet + report.byKind.gate + report.byKind.lint;
-    if (report.total > 0 && ratioBelowNumericFloor(aggregateEnforced, report.total, FLOORS.enforcedRatio)) {
-      failures.push(`enforced ratio ${aggregateEnforced}/${report.total} (${report.enforcedRatio}) < floor ${FLOORS.enforcedRatio}`);
+    const continuityDenominator = report.continuityTotal ?? report.total;
+    if (continuityDenominator > 0 && ratioBelowNumericFloor(aggregateEnforced, continuityDenominator, FLOORS.enforcedRatio)) {
+      failures.push(`enforced ratio ${aggregateEnforced}/${continuityDenominator} (${report.enforcedRatio}) < floor ${FLOORS.enforcedRatio}`);
     }
+    for (const error of report.directionGuard.errors) failures.push(`direction guard: ${error}`);
     for (const error of report.areaAudit.errors) failures.push(error);
     for (const error of report.areaModelAudit.errors) failures.push(error);
     for (const [area, measurement] of Object.entries(report.areas)) {
-      if (ratioBelowFloor(measurement.enforced, measurement.total, measurement.refResolutionFloor)) {
+      const areaContinuityDenominator = measurement.continuityTotal ?? measurement.total;
+      if (ratioBelowFloor(measurement.enforced, areaContinuityDenominator, measurement.refResolutionFloor)) {
         failures.push(
-          `area "${area}" ref-resolution ratio ${measurement.enforced}/${measurement.total} < floor ` +
+          `area "${area}" ref-resolution ratio ${measurement.enforced}/${areaContinuityDenominator} < floor ` +
           `${measurement.refResolutionFloor.enforced}/${measurement.refResolutionFloor.total}`,
         );
       }

package/scripts/standards-direction-guard.mjs

@@ -0,0 +1,439 @@
+// safe-git-allow: CI bootstrap uses read-only merge-base/show before TypeScript is compiled.
+/**
+ * Direction-aware constitutional amendment guard.
+ *
+ * Mechanical facts (article identity, addition, removal, population) come from
+ * the protected base and candidate registries. Semantic direction for an edit
+ * is declared, then independently ratified with an Ed25519 signature over the
+ * exact before/after bytes. A repository file written by the changer is never
+ * authority by itself.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { ARTICLE_ID_RE, articleIds, parseRegistryStructure } from './standards-registry-article-core.mjs';
+
+export const DIRECTION_APPROVAL_SCHEMA_VERSION = 1;
+export const DIRECTION_GUARD_SYMBOL = 'evaluateStandardsDirection';
+const FIELD_RE = /^\*\*(.+?)\.\*\*\s*(.*)$/;
+const DIRECTIONS = new Set(['add', 'remove', 'strengthen', 'neutral', 'weaken']);
+const SHA256_RE = /^[a-f0-9]{64}$/;
+const RFC3339_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+
+const canonicalText = (value) => String(value).replace(/\r\n?/g, '\n');
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const exactKeys = (value, keys) => isObject(value) &&
+  JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...keys].sort());
+const familyName = (heading) => heading.split(/\s+[—–-]\s+/)[0].trim();
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!isObject(value)) return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+}
+
+export function canonicalDirectionPayload(payload) {
+  return `standards-direction-ratification-v1\0${JSON.stringify(stableValue(payload))}`;
+}
+
+function slug(value) {
+  return value.normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80);
+}
+
+function fieldsFor(block) {
+  const fields = [];
+  let current = null;
+  const flush = () => {
+    if (!current) return;
+    fields.push({ heading: current.heading, text: current.lines.join('\n').trim() });
+    current = null;
+  };
+  for (const line of block.visibleLines) {
+    if (line === null) continue;
+    const match = line.match(FIELD_RE);
+    if (match) {
+      flush();
+      current = { heading: match[1].trim(), lines: [match[2]] };
+    } else if (current) current.lines.push(line);
+  }
+  flush();
+  return fields;
+}
+
+/** Resolve every Rule-bearing article to a closed, unique identity set. */
+export function inventoryStandardsArticles(markdown) {
+  const text = canonicalText(markdown);
+  const articles = [];
+  const errors = [];
+  const identities = new Set();
+  let parsedRuleMarkers = 0;
+
+  for (const section of parseRegistryStructure(text)) {
+    const family = familyName(section.heading);
+    for (const block of section.blocks) {
+      const fields = fieldsFor(block);
+      const rules = fields.filter((field) => field.heading === 'Rule');
+      if (rules.length === 0) continue;
+      parsedRuleMarkers += rules.length;
+      if (rules.length !== 1) {
+        errors.push(`article "${block.name}" must contain exactly one Rule field (found ${rules.length})`);
+        continue;
+      }
+      const explicitIds = articleIds(block);
+      if (explicitIds.length > 1) {
+        errors.push(`article "${block.name}" has duplicate Article ID declarations`);
+        continue;
+      }
+      if (explicitIds.length === 1 && !ARTICLE_ID_RE.test(explicitIds[0])) {
+        errors.push(`article "${block.name}" has invalid Article ID "${explicitIds[0]}"`);
+        continue;
+      }
+      const id = explicitIds[0] ?? `legacy/${slug(family)}/${slug(block.name)}`;
+      if (identities.has(id)) {
+        errors.push(`article identity collision for "${id}"`);
+        continue;
+      }
+      identities.add(id);
+      const rule = rules[0].text;
+      articles.push({
+        id,
+        family,
+        name: block.name,
+        rule,
+        ruleSha256: sha256(`standards-rule-v1\0${rule}`),
+        articleSha256: sha256(`standards-article-v1\0${canonicalText(block.raw)}`),
+      });
+    }
+  }
+
+  const rawRuleMarkers = text.split('\n').filter((line) => /^\*\*Rule\.\*\*/.test(line)).length;
+  if (rawRuleMarkers !== parsedRuleMarkers || parsedRuleMarkers !== articles.length) {
+    errors.push(
+      `article enumeration is open: raw Rule fields=${rawRuleMarkers}, parsed Rule fields=${parsedRuleMarkers}, identities=${articles.length}`,
+    );
+  }
+  if (articles.length === 0) errors.push('standards article population is empty (NOT-PROVEN, never 0/0 clean)');
+  return { articles, errors };
+}
+
+function articleSummary(article) {
+  if (!article) return null;
+  return {
+    id: article.id,
+    family: article.family,
+    name: article.name,
+    ruleSha256: article.ruleSha256,
+    articleSha256: article.articleSha256,
+  };
+}
+
+function changeKind(before, after) {
+  if (!before) return 'add';
+  if (!after) return 'remove';
+  return 'edit';
+}
+
+function directionLabel(direction, kind) {
+  if (kind === 'remove') return 'REMOVAL';
+  if (kind === 'add') return 'ADDITION';
+  if (direction === 'weaken') return 'WEAKENING';
+  if (direction === 'strengthen') return 'STRENGTHENING';
+  if (direction === 'neutral') return 'NEUTRAL EDIT';
+  return 'DIRECTION UNDECLARED';
+}
+
+function validTimestamp(value) {
+  if (typeof value !== 'string' || !RFC3339_UTC_RE.test(value)) return false;
+  const parsed = new Date(value);
+  return !Number.isNaN(parsed.getTime()) && parsed.toISOString() === value;
+}
+
+function verifyApprovalSignature(payload, signature, publicKeyPem) {
+  if (typeof signature !== 'string' || signature.length < 40 || typeof publicKeyPem !== 'string') return false;
+  try {
+    const key = crypto.createPublicKey(publicKeyPem);
+    return crypto.verify(
+      null,
+      Buffer.from(canonicalDirectionPayload(payload), 'utf8'),
+      key,
+      Buffer.from(signature, 'base64'),
+    );
+  } catch {
+    return false;
+  }
+}
+
+function validateApprovalShape(entry) {
+  if (!exactKeys(entry, ['payload', 'signature'])) return 'must contain exactly payload and signature';
+  const payload = entry.payload;
+  if (!exactKeys(payload, [
+    'schemaVersion', 'baseRevision', 'baseRegistrySha256', 'candidateRegistrySha256',
+    'articleId', 'change', 'direction', 'before', 'after', 'approvedBy', 'approvedAt',
+  ])) return 'payload has unknown or missing fields';
+  if (payload.schemaVersion !== DIRECTION_APPROVAL_SCHEMA_VERSION) return 'payload schemaVersion is unsupported';
+  if (!['add', 'remove', 'edit'].includes(payload.change) || !DIRECTIONS.has(payload.direction)) return 'payload change/direction is invalid';
+  if (typeof payload.baseRevision !== 'string' || payload.baseRevision.length < 1 || payload.baseRevision.length > 160) return 'payload baseRevision is invalid';
+  if (!SHA256_RE.test(payload.baseRegistrySha256) || !SHA256_RE.test(payload.candidateRegistrySha256)) return 'payload registry digest is invalid';
+  if (typeof payload.articleId !== 'string' || payload.articleId.length < 3 || payload.articleId.length > 180) return 'payload articleId is invalid';
+  if (typeof payload.approvedBy !== 'string' || payload.approvedBy.trim().length < 2 || payload.approvedBy.length > 120) return 'payload approvedBy is invalid';
+  if (!validTimestamp(payload.approvedAt) || Date.parse(payload.approvedAt) > Date.now() + 5 * 60_000) return 'payload approvedAt is invalid';
+  for (const [which, summary] of [['before', payload.before], ['after', payload.after]]) {
+    if (summary === null) continue;
+    if (!exactKeys(summary, ['id', 'family', 'name', 'ruleSha256', 'articleSha256']) ||
+      typeof summary.id !== 'string' || typeof summary.family !== 'string' || typeof summary.name !== 'string' ||
+      !SHA256_RE.test(summary.ruleSha256) || !SHA256_RE.test(summary.articleSha256)) {
+      return `payload ${which} summary is invalid`;
+    }
+  }
+  return null;
+}
+
+function parseApprovalLedger(value) {
+  const errors = [];
+  if (!exactKeys(value, ['schemaVersion', 'approvals']) ||
+    value.schemaVersion !== DIRECTION_APPROVAL_SCHEMA_VERSION || !Array.isArray(value.approvals)) {
+    return { approvals: [], errors: ['direction approval ledger must contain exactly schemaVersion: 1 and approvals[]'] };
+  }
+  const approvals = [];
+  for (const [index, entry] of value.approvals.entries()) {
+    const error = validateApprovalShape(entry);
+    if (error) errors.push(`direction approval ${index} ${error}`);
+    else approvals.push(entry);
+  }
+  return { approvals, errors };
+}
+
+function familyPopulation(articles) {
+  const map = new Map();
+  for (const article of articles) {
+    if (!map.has(article.family)) map.set(article.family, new Set());
+    map.get(article.family).add(article.id);
+  }
+  return map;
+}
+
+/**
+ * Evaluate candidate constitutional direction against a protected base.
+ * This exact export is imported by the pipeline and its negative-control test.
+ */
+export function evaluateStandardsDirection({
+  baseMarkdown,
+  candidateMarkdown,
+  approvalLedger = { schemaVersion: 1, approvals: [] },
+  approverPublicKeyPem = '',
+  candidateApproverPublicKeyPem = null,
+  baseRevision = 'unknown-protected-base',
+}) {
+  const base = inventoryStandardsArticles(baseMarkdown);
+  const candidate = inventoryStandardsArticles(candidateMarkdown);
+  const ledger = parseApprovalLedger(approvalLedger);
+  const errors = [
+    ...base.errors.map((error) => `protected base: ${error}`),
+    ...candidate.errors.map((error) => `candidate: ${error}`),
+    ...ledger.errors,
+  ];
+  if (candidateApproverPublicKeyPem !== null && candidateApproverPublicKeyPem !== approverPublicKeyPem) {
+    errors.push(
+      'APPROVER TRUST ROOT CHANGE is not self-authorizable: candidate pin differs from protected base; ' +
+      'bootstrap or rotation requires external protected-main control-plane authorization',
+    );
+  }
+  const baseRegistrySha256 = sha256(canonicalText(baseMarkdown));
+  const candidateRegistrySha256 = sha256(canonicalText(candidateMarkdown));
+  const baseById = new Map(base.articles.map((article) => [article.id, article]));
+  const candidateById = new Map(candidate.articles.map((article) => [article.id, article]));
+  const ids = [...new Set([...baseById.keys(), ...candidateById.keys()])].sort();
+  const changes = [];
+
+  for (const id of ids) {
+    const before = baseById.get(id) ?? null;
+    const after = candidateById.get(id) ?? null;
+    if (before && after && before.articleSha256 === after.articleSha256 &&
+      before.family === after.family && before.name === after.name) continue;
+    changes.push({ id, kind: changeKind(before, after), before, after });
+  }
+
+  const basePopulation = familyPopulation(base.articles);
+  const candidatePopulation = familyPopulation(candidate.articles);
+  const families = [...new Set([...basePopulation.keys(), ...candidatePopulation.keys()])].sort();
+  const byFamily = {};
+  for (const family of families) {
+    const baseIds = basePopulation.get(family) ?? new Set();
+    const candidateIds = candidatePopulation.get(family) ?? new Set();
+    byFamily[family] = {
+      protectedBase: baseIds.size,
+      candidate: candidateIds.size,
+      continuity: new Set([...baseIds, ...candidateIds]).size,
+    };
+  }
+
+  for (const change of changes) {
+    const matching = ledger.approvals.filter(({ payload }) =>
+      payload.baseRegistrySha256 === baseRegistrySha256 &&
+      payload.candidateRegistrySha256 === candidateRegistrySha256 &&
+      payload.articleId === change.id);
+    const displayName = change.after?.name ?? change.before?.name ?? change.id;
+    if (matching.length === 0) {
+      errors.push(
+        `${directionLabel(null, change.kind)} "${displayName}" (${change.id}) requires an independently signed direction ratification`,
+      );
+      continue;
+    }
+    if (matching.length > 1) {
+      errors.push(`article "${displayName}" has multiple ratifications for the same protected-base/candidate pair`);
+      continue;
+    }
+    const approval = matching[0];
+    const direction = approval.payload.direction;
+    const expectedDirection = change.kind === 'add' ? 'add' : change.kind === 'remove' ? 'remove' : direction;
+    const expectedPayload = {
+      schemaVersion: DIRECTION_APPROVAL_SCHEMA_VERSION,
+      baseRevision,
+      baseRegistrySha256,
+      candidateRegistrySha256,
+      articleId: change.id,
+      change: change.kind,
+      direction: expectedDirection,
+      before: articleSummary(change.before),
+      after: articleSummary(change.after),
+      approvedBy: approval.payload.approvedBy,
+      approvedAt: approval.payload.approvedAt,
+    };
+    const label = directionLabel(direction, change.kind);
+    if (change.kind === 'edit' && !['strengthen', 'neutral', 'weaken'].includes(direction)) {
+      errors.push(`${label} "${displayName}" has invalid edit direction "${direction}"`);
+      continue;
+    }
+    if (JSON.stringify(stableValue(approval.payload)) !== JSON.stringify(stableValue(expectedPayload))) {
+      errors.push(`${label} "${displayName}" ratification does not bind the exact protected-base/candidate article bytes`);
+      continue;
+    }
+    if (!verifyApprovalSignature(approval.payload, approval.signature, approverPublicKeyPem)) {
+      errors.push(`${label} "${displayName}" lacks a valid different-principal signature`);
+      continue;
+    }
+    change.direction = direction;
+    change.approvedBy = approval.payload.approvedBy;
+  }
+
+  return {
+    status: errors.length === 0 ? 'passed' : 'not-proven',
+    errors,
+    baseRevision,
+    baseRegistrySha256,
+    candidateRegistrySha256,
+    changes: changes.map((change) => ({
+      articleId: change.id,
+      name: change.after?.name ?? change.before?.name ?? change.id,
+      familyBefore: change.before?.family ?? null,
+      familyAfter: change.after?.family ?? null,
+      change: change.kind,
+      direction: change.direction ?? null,
+      approvedBy: change.approvedBy ?? null,
+    })),
+    population: {
+      protectedBase: base.articles.length,
+      candidate: candidate.articles.length,
+      continuity: new Set([...baseById.keys(), ...candidateById.keys()]).size,
+      additions: changes.filter((change) => change.kind === 'add').map((change) => change.id),
+      removals: changes.filter((change) => change.kind === 'remove').map((change) => change.id),
+      byFamily,
+    },
+  };
+}
+
+function resolveProtectedBaseText({ root, explicitFile, explicitRevision, repoPath, noun, envHint }) {
+  if (explicitFile !== undefined) {
+    if (typeof explicitFile !== 'string' || explicitFile.length === 0) {
+      return { text: null, revision: null, source: 'explicit', errors: [`protected-base ${noun} path is empty`] };
+    }
+    try {
+      const stat = fs.lstatSync(explicitFile);
+      if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a regular file');
+      return {
+        text: fs.readFileSync(explicitFile, 'utf8'),
+        revision: explicitRevision || 'explicit-protected-base',
+        source: explicitFile,
+        errors: [],
+      };
+    } catch (error) {
+      return { text: null, revision: null, source: explicitFile, errors: [`protected-base ${noun} is unavailable: ${error instanceof Error ? error.message : String(error)}`] };
+    }
+  }
+
+  for (const ref of ['refs/remotes/upstream/main', 'refs/remotes/origin/main']) {
+    try {
+      const revision = execFileSync('git', ['merge-base', 'HEAD', ref], { cwd: root, encoding: 'utf8' }).trim();
+      if (!revision) continue;
+      const text = execFileSync('git', ['show', `${revision}:${repoPath}`], { cwd: root, encoding: 'utf8' });
+      return { text, revision, source: ref, errors: [] };
+    } catch {
+      // Try the next protected main ref. Failure of all candidates is loud below.
+    }
+  }
+  return {
+    text: null,
+    revision: null,
+    source: null,
+    errors: [`protected-base ${noun} is unavailable (set ${envHint} or fetch upstream/main/origin/main)`],
+  };
+}
+
+/** Fail-closed protected-base registry acquisition for the real pipeline. */
+export function resolveProtectedBaseRegistry({ root, explicitFile, explicitRevision }) {
+  const result = resolveProtectedBaseText({
+    root,
+    explicitFile,
+    explicitRevision,
+    repoPath: 'docs/STANDARDS-REGISTRY.md',
+    noun: 'registry',
+    envHint: 'STANDARDS_DIRECTION_BASE_FILE',
+  });
+  return { ...result, markdown: result.text };
+}
+
+/** The approver pin is always read from the same protected base as the registry. */
+export function resolveProtectedApproverKey({ root, explicitFile, explicitRevision }) {
+  const result = resolveProtectedBaseText({
+    root,
+    explicitFile,
+    explicitRevision,
+    repoPath: '.github/keyrings/telegram-principal-pub.pem',
+    noun: 'approver trust root',
+    envHint: 'STANDARDS_DIRECTION_BASE_APPROVER_KEY_FILE',
+  });
+  return { ...result, pem: result.text };
+}
+
+/** Candidate pin bytes are observed only to refuse drift; they never verify a signature. */
+export function readCandidateApproverKey(file) {
+  try {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a regular file');
+    return { pem: fs.readFileSync(file, 'utf8'), errors: [] };
+  } catch (error) {
+    return {
+      pem: null,
+      errors: [`candidate approver trust root is unavailable: ${error instanceof Error ? error.message : String(error)}`],
+    };
+  }
+}
+
+export function readDirectionApprovalLedger(file) {
+  try {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a regular file');
+    return { value: JSON.parse(fs.readFileSync(file, 'utf8')), errors: [] };
+  } catch (error) {
+    return {
+      value: { schemaVersion: 1, approvals: [] },
+      errors: [`direction approval ledger is unavailable or malformed: ${error instanceof Error ? error.message : String(error)}`],
+    };
+  }
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-17T20:03:01.517Z",
-  "instarVersion": "1.3.1178",
+  "generatedAt": "2026-08-17T20:39:01.790Z",
+  "instarVersion": "1.3.1179",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1178",
+  "packageVersion": "1.3.1179",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "f029879dbc7cd1b446fd6a7d35ae5c625f714f0c373fc8cc56dcd9dd36d3d756",
+  "sha256": "44d5cab21f32cf4e49f8d3d8bbcfb270282dae4260df4eee3a31fc01a8a3ce09",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1178"
+  "packageVersion": "1.3.1179"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1178"
+  "packageVersion": "1.3.1179"
 }

package/upgrades/1.3.1179.md

@@ -0,0 +1,55 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The standards-coverage pipeline now treats every Rule-bearing article as a
+stable identity across protected main and a candidate change. Additions and
+removals are mechanical facts; edits carry an explicit direction ratified by an
+independently held Ed25519 key over the exact before/after bytes. Aggregate and
+family floors retain removed identities in their continuity denominator, so a
+smaller constitution cannot improve its score.
+
+The approver public key is read from protected main. Candidate key replacement
+is never signature authority, and candidate pin drift is refused even when the
+registry is unchanged, closing both one-change and two-change goalpost moves.
+Legacy heading renames intentionally appear as remove-plus-add and require the
+same independent review.
+
+## What to Tell Your User
+
+This is an internal governance hardening change. It does not add or alter an
+end-user action. It makes changes to Instar's own rulebook accountable: removing
+or weakening a rule can no longer make the score look better or pass on the
+changer's word alone.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|------------|
+| Direction-aware rulebook review | Automatic in fleet pull-request checks |
+| Removal-safe standards scoring | Automatic in the standards coverage report |
+| Protected approver-key continuity | Automatic; candidate key drift is refused |
+
+## Evidence
+
+On the live release baseline, deleting one article raised coverage from 0.7386
+to 0.7471 and a foundational weakening passed after the changer refreshed its
+own family attestation. Through the wired pipeline after this change, deletion
+reports REMOVAL while retaining 65/88, weakening reports WEAKENING after the old
+refresh, candidate key/signature replacement is refused, and a pin-only change
+is refused before it can become the next trust root. The pristine pipeline
+passes; the focused suites pass 53/53, including all four negative controls. The
+type-preserving hollow compiles, runs all three behavioral contracts, and loses
+on three assertion mismatches.
+
+## Known Limits
+
+The repository currently carries a comments-only approver-key placeholder, so
+standards amendments fail closed until a separately authorized protected-main
+control-plane action installs a real public key. Its private key must remain
+outside the repository, agent-readable credential stores, and build environments.
+Cryptography proves who ratified exact bytes; it does not prove that the human
+semantic judgment was wise.

package/upgrades/side-effects/phaseb-s5-rule-direction.md

@@ -0,0 +1,154 @@
+# Side-Effects Review — Standards Direction Guard
+
+**Version / slug:** `phaseb-s5-rule-direction`
+**Date:** `2026-08-17`
+**Author:** Instar-codey
+**Second-pass reviewer:** pending independent reviewer entry below
+
+## Summary of the change
+
+This change adds `scripts/standards-direction-guard.mjs`, integrates it into
+`scripts/standards-coverage.mjs` and CI, stores direction approvals in
+`docs/standards-direction-approvals.json`, and adds focused behavioral and
+negative-control tests. Standards-change acceptance now compares stable article
+identity against protected main, preserves removed identities in coverage
+denominators, and requires exact independently signed direction ratification.
+
+## Decision-point inventory
+
+- `evaluateStandardsDirection` — **add** — accepts or refuses additions,
+  removals, and edits against protected-base identities and signatures.
+- `standards-coverage --check` — **modify** — consumes the direction result and
+  uses continuity denominators for aggregate and family floors.
+- CI standards job — **modify** — extracts protected-base registry and approver
+  pin before invoking the existing check entry point.
+
+---
+
+## 1. Over-block
+
+An ordinary heading rename on one of the 86 legacy articles changes its derived
+identity and is treated as remove-plus-add, so it needs independent ratification.
+Formatting anywhere inside an article also changes its article hash and needs a
+declared, signed direction. These are known conservative costs: permissive rename
+inference would reopen the identity-erasure path. With the repository's current
+comments-only key placeholder, every standards amendment fails closed until a
+real independently controlled public key is installed on protected main.
+
+## 2. Under-block
+
+A legitimate approver can ratify a direction declaration that is semantically
+wrong; cryptography proves principal and bytes, not judgment quality. If the
+approver private key becomes readable to the changer, the principal separation
+collapses. The operational requirement is explicit: keep the private key outside
+the repository, agent credential stores, and build environments. Candidate key
+replacement is closed because the pin is read from protected main and all
+candidate pin drift is refused, including a pin-only first step.
+
+## 3. Level-of-abstraction fit
+
+The guard operates at the correct split. Stable identity, before/after hashes,
+population union, signature validity, and protected-base acquisition are closed
+mechanical facts. Semantic direction remains a human declaration. The code does
+not build a brittle prose classifier and does not compete with an LLM authority.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [ ] No — this change produces a signal consumed by an existing smart gate.
+- [ ] No — this change has no block/allow surface.
+- [ ] Yes — but the logic is a smart gate with full conversational context.
+- [x] Deterministic hard-invariant authority over a closed governance protocol.
+
+The generic template's first three safe boxes do not describe this case. The
+guard has blocking authority, but it does not judge prose with brittle logic.
+It verifies enumerable invariants: exact identities and hashes, allowed direction
+tokens, signature validity, and protected-base provenance. Human semantic judgment
+arrives as a signed declaration. This is the principle document's deterministic
+policy-evaluator / hard-invariant exception, not a message-meaning heuristic.
+
+## 4b. Judgment-point check
+
+No static heuristic is added at a competing-signals judgment point. The only
+semantic choice, direction, is explicitly made and signed by an independent
+principal. Code checks the declaration's closed protocol and never infers the
+choice from competing evidence.
+
+## 5. Interactions
+
+- **Shadowing:** the direction guard runs alongside the existing area-audit and
+  coverage floors. It adds errors; it does not prevent their evaluation or logs.
+- **Double-fire:** a standards edit can produce both a stale area-audit objection
+  and a direction objection. This is intentional: one binds review freshness,
+  the other binds amendment direction and independent authority. Refreshing the
+  first does not clear the second.
+- **Races:** all inputs are immutable Git bytes or a candidate JSON file during a
+  single CI process. There is no shared mutable runtime state.
+- **Feedback loops:** none. The check never writes its approval ledger or registry.
+
+## 6. External surfaces
+
+CI output gains direction status, protected-base revision, trust-root provenance,
+an explicit candidate-pin-not-authoritative fact, and a pin-drift-blocked fact.
+Standards authors gain a signed JSON approval record. No Telegram, Slack,
+Cloudflare, database, conversation, timing, or user data surface changes. No
+operator-facing action is added; key custody and protected-main pin installation
+remain repository governance operations.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+**Replicated through Git.** The registry, candidate ledger, public trust pin,
+guard, CI wiring, and tests are committed bytes. Every machine on the same commit
+derives the same canonical hashes and verdict. The signing private key is
+deliberately not replicated to agent machines. The feature emits no user-facing
+notices, holds no runtime durable state that can strand on topic transfer, and
+generates no URLs.
+
+## 8. Rollback cost
+
+Revert the guard, coverage integration, workflow extraction, ledger, docs, and
+tests as one patch and ship the next release. No data migration, agent-state
+repair, secret rotation, or runtime cleanup is required. During rollback the old
+self-attestation weakness returns, so rulebook amendments should remain paused.
+
+## Conclusion
+
+The review found two deliberate friction points and no accidental runtime side
+effect: legacy renames require ratification, and the comments-only protected pin
+blocks amendments until independent custody is provisioned. The candidate-pin
+goalpost attack is closed in both one-change and two-change forms by protected-base
+verification plus an unconditional candidate-drift refusal. Normal CI can never
+bootstrap or rotate the pin; that requires separate protected-main control-plane
+authority. The change is ready for normal CI.
+
+## Second-pass review
+
+**Reviewer:** independent Codex second-pass lane
+**Independent read of the artifact:** concern resolved. The first review found
+that protected-base verification stopped a same-change pin swap but allowed a
+pin-only first step to become the next base. It also found the ELI16 overstated
+malformed-placeholder behavior. Candidate pin drift is now always refused, the
+pin-only regression is tested, bootstrap/rotation authority is stated explicitly,
+and the malformed-key wording now matches the live pipeline. With those changes,
+the review concurs on authority separation, denominators, rename friction,
+multi-machine posture, and rollback.
+
+## Evidence pointers
+
+- `scratchpad/phaseB/REPORT-S5.md`
+- `tests/unit/standards-direction-guard.test.ts`
+- `tests/unit/standards-direction-guard-contract.test.ts`
+- `tests/unit/standards-coverage-ratchet.test.ts`
+
+## Class-Closure Declaration
+
+`defectClass: claim-vs-evidence`, `closure: guard`, `guardEvidence:
+{ enforcementType: gate, citation: scripts/standards-direction-guard.mjs#evaluateStandardsDirection,
+howCaught: the exact old self-authored family refresh has no independently signed
+direction record, so deletion and weakening remain refused even after that claim
+is refreshed }`.