instar 1.3.1219 → 1.3.1221

package/dist/types/pipeline.d.ts

@@ -210,7 +210,7 @@ export declare const RE_DELIVERY_MARKER = "RE-DELIVERED \u2014 no reply was reco
  * ADDITIVE ONLY — when `reDelivered` is falsy the returned bytes are identical
  * to the pre-marker output.
  */
-export declare function buildInjectionTag(topicId: number, topicName?: string, senderName?: string, telegramUserId?: number, reDelivered?: boolean): string;
+export declare function buildInjectionTag(topicId: number, topicName?: string, senderName?: string, telegramUserId?: number, reDelivered?: boolean, signedByAgent?: string): string;
 /**
  * Convert a PipelineMessage to a log entry.
  * All identity fields are preserved for historical search.

package/dist/types/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/types/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,EAAE,cAAc,CAAC;IACvB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,CAAC,EAAE;QACN,0CAA0C;QAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gCAAgC;QAChC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,oBAAoB;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAID;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;mEAC+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;GAGG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/D,EACD,IAAI,EAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,KAAK,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CAClC,GACA,eAAe,CAejB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAUpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,+DAC0B,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,WAAW,CAAC,EAAE,OAAO,GACpB,MAAM,CAaR;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,gBAAgB,CAYlB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAKjE"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/types/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,EAAE,cAAc,CAAC;IACvB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,CAAC,EAAE;QACN,0CAA0C;QAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gCAAgC;QAChC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,oBAAoB;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAID;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;mEAC+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;GAGG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/D,EACD,IAAI,EAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,KAAK,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CAClC,GACA,eAAe,CAejB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAUpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,+DAC0B,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,WAAW,CAAC,EAAE,OAAO,EACrB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAmBR;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,gBAAgB,CAYlB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAKjE"}

package/dist/types/pipeline.js

@@ -128,21 +128,24 @@ export const RE_DELIVERY_MARKER = 'RE-DELIVERED — no reply was recorded for th
  * ADDITIVE ONLY — when `reDelivered` is falsy the returned bytes are identical
  * to the pre-marker output.
  */
-export function buildInjectionTag(topicId, topicName, senderName, telegramUserId, reDelivered) {
+export function buildInjectionTag(topicId, topicName, senderName, telegramUserId, reDelivered, signedByAgent) {
     const uidSuffix = telegramUserId ? ` (uid:${telegramUserId})` : '';
     const reDeliverySuffix = reDelivered === true ? ` — ${RE_DELIVERY_MARKER}` : '';
-    if (topicName && senderName) {
-        return `[telegram:${topicId} "${topicName}" from ${senderName}${uidSuffix}${reDeliverySuffix}]`;
-    }
-    else if (topicName) {
-        return `[telegram:${topicId} "${topicName}"${reDeliverySuffix}]`;
+    const topicPart = topicName ? ` "${topicName}"` : '';
+    // Agent-signed provenance (ASP). `signedByAgent` is an IN-PROCESS parameter
+    // carried from the classifier's own verdict — never parsed from content, so a
+    // body that merely claims a signature cannot mint this label. The human whose
+    // account carried the message is still named: the session must know the
+    // channel, and must NOT read the message as that human speaking.
+    const safeAgent = signedByAgent && /^[A-Za-z0-9_-]{1,64}$/.test(signedByAgent) ? signedByAgent : undefined;
+    let fromPart = '';
+    if (safeAgent) {
+        fromPart = ` from agent ${safeAgent} (signed)` + (senderName ? ` via ${senderName}'s account${uidSuffix}` : '');
     }
     else if (senderName) {
-        return `[telegram:${topicId} from ${senderName}${uidSuffix}${reDeliverySuffix}]`;
-    }
-    else {
-        return `[telegram:${topicId}${reDeliverySuffix}]`;
+        fromPart = ` from ${senderName}${uidSuffix}`;
     }
+    return `[telegram:${topicId}${topicPart}${fromPart}${reDeliverySuffix}]`;
 }
 /**
  * Convert a PipelineMessage to a log entry.

package/dist/types/pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/types/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAuH7E,qEAAqE;AAErE;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,GAOC,EACD,IAKC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE;YACN,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YAC3B,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;YAC9B,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;SAC5B;QACD,OAAO,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,IAAI;QAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAClD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,yBAAyB;QACjD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,WAAmB;IAEnB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAEzD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAElC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEtE,OAAO;QACL,WAAW;QACX,OAAO;QACP,UAAU,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE;QACpC,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;QAChE,cAAc,EAAE,GAAG;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uDAAuD,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,SAAkB,EAClB,UAAmB,EACnB,cAAuB,EACvB,WAAqB;IAErB,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,gBAAgB,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhF,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5B,OAAO,aAAa,OAAO,KAAK,SAAS,UAAU,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,CAAC;IAClG,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,OAAO,aAAa,OAAO,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC;IACnE,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,OAAO,aAAa,OAAO,SAAS,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,aAAa,OAAO,GAAG,gBAAgB,GAAG,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,QAAyB,EACzB,WAA0B;IAE1B,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW;QACX,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;QACrC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;QACxC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;KAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;QAC3B,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/types/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAuH7E,qEAAqE;AAErE;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,GAOC,EACD,IAKC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE;YACN,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YAC3B,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;YAC9B,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;SAC5B;QACD,OAAO,EAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,IAAI;QAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAClD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,yBAAyB;QACjD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,WAAmB;IAEnB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAEzD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAElC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEtE,OAAO;QACL,WAAW;QACX,OAAO;QACP,UAAU,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE;QACpC,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;QAChE,cAAc,EAAE,GAAG;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uDAAuD,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,SAAkB,EAClB,UAAmB,EACnB,cAAuB,EACvB,WAAqB,EACrB,aAAsB;IAEtB,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,gBAAgB,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,SAAS,GAAG,aAAa,IAAI,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,GAAG,eAAe,SAAS,WAAW,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,QAAQ,GAAG,SAAS,UAAU,GAAG,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,aAAa,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,QAAyB,EACzB,WAA0B;IAE1B,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW;QACX,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;QACrC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;QACxC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;KAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;QAC3B,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1219",
+  "version": "1.3.1221",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/stage-b-certified-fingerprint.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+/**
+ * Stage-B certified-set fingerprint (spec: stage-b-evidence-code-binding).
+ *
+ * The release gate binds the approved canary evidence to the CODE it certified,
+ * not to a version number. This tool owns the code side of that binding:
+ *
+ *   --check   Recompute the certified set's transitive relative-import closure
+ *             and fingerprint; fail (exit 1) naming per-file drift, any closure
+ *             member that is neither certified nor excluded-with-reason, and
+ *             any stale manifest entry. Run by the publish gate and pre-push.
+ *   --write   Rebind the manifest. STRUCTURALLY refuses the dishonest rebind:
+ *             if the fingerprint changed, the bundled artifact's canonical
+ *             digest must ALSO have changed (fresh evidence) — old evidence can
+ *             never be re-stamped onto changed code.
+ *
+ * The fingerprint has no adversarial value (everything here is editable in one
+ * PR, exactly like the verifier itself); it exists to catch HONEST drift and to
+ * make every coverage cut an enumerated, reviewed record.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MANIFEST = path.join(root, 'src', 'data', 'stageBCertifiedSet.ts');
+
+function sha256(buf) { return crypto.createHash('sha256').update(buf).digest('hex'); }
+
+export function relativeImportClosure(rootDir, roots) {
+  const seen = new Set();
+  const work = [...roots];
+  while (work.length) {
+    const rel = work.pop();
+    if (seen.has(rel)) continue;
+    const abs = path.join(rootDir, rel);
+    if (!fs.existsSync(abs)) { seen.add(rel); continue; } // reported by the partition check
+    seen.add(rel);
+    const src = fs.readFileSync(abs, 'utf8');
+    // Every relative-specifier form: static import/export-from (either quote),
+    // side-effect import, dynamic import(), and require(). Fail-closed claim
+    // depends on this breadth — a form the matcher misses escapes coverage.
+    const specs = [];
+    for (const m of src.matchAll(/(?:from|import)\s*\(?\s*(['"])(\.[^'"]+)\1/g)) specs.push(m[2]);
+    for (const m of src.matchAll(/require\s*\(\s*(['"])(\.[^'"]+)\1\s*\)/g)) specs.push(m[2]);
+    for (const spec of specs) {
+      let dep = spec.replace(/\.js$/, '.ts');
+      let depAbs = path.normalize(path.join(path.dirname(abs), dep));
+      if (!fs.existsSync(depAbs) && fs.existsSync(depAbs.replace(/\.ts$/, '/index.ts'))) {
+        depAbs = depAbs.replace(/\.ts$/, '/index.ts');
+      }
+      work.push(path.relative(rootDir, depAbs).split(path.sep).join('/'));
+    }
+  }
+  return [...seen].sort();
+}
+
+export function certifiedFingerprint(rootDir, certified) {
+  const h = crypto.createHash('sha256');
+  for (const rel of [...certified].sort()) {
+    h.update(sha256(Buffer.from(rel, 'utf8')));
+    h.update(sha256(fs.readFileSync(path.join(rootDir, rel))));
+  }
+  return h.digest('hex');
+}
+
+async function loadGateFromDist() {
+  const dist = path.join(root, 'dist', 'core', 'StageBActivationGate.js');
+  if (!fs.existsSync(dist)) {
+    console.error('[stage-b-fingerprint] dist/core/StageBActivationGate.js missing — run npm run build first');
+    process.exit(1);
+  }
+  return import(dist);
+}
+
+function readManifest() {
+  // The manifest is a TS data module; parse its JSON payload between markers.
+  const src = fs.readFileSync(MANIFEST, 'utf8');
+  const m = src.match(/STAGE_B_CERTIFIED_SET[^=]*=\s*(\{[\s\S]*\})\s*as const/);
+  if (!m) throw new Error(`cannot parse ${MANIFEST}`);
+  return JSON.parse(m[1]);
+}
+
+function writeManifest(data) {
+  const body = JSON.stringify(data, null, 2);
+  fs.writeFileSync(MANIFEST, `/**
+ * Stage-B certified-set manifest (spec: stage-b-evidence-code-binding).
+ * Maintained ONLY by scripts/stage-b-certified-fingerprint.mjs --write, which
+ * refuses to rebind old evidence onto changed code. Every closure member is
+ * either certified (fingerprinted) or excluded with a written reason; the
+ * --check partition is fail-closed for anything new.
+ */
+export const STAGE_B_CERTIFIED_SET = ${body} as const;
+
+export type StageBCertifiedSet = typeof STAGE_B_CERTIFIED_SET;
+`);
+}
+
+function partitionProblems(man, closure) {
+  const problems = [];
+  const certified = new Set(man.certified);
+  const excluded = new Set(man.excluded.map((e) => e.file));
+  for (const f of closure) {
+    if (!certified.has(f) && !excluded.has(f)) problems.push(`unclassified closure member: ${f} — add it to certified, or to excluded with a reason`);
+    if (certified.has(f) && excluded.has(f)) problems.push(`${f} is both certified and excluded`);
+  }
+  for (const f of man.certified) {
+    if (!fs.existsSync(path.join(root, f))) problems.push(`certified file missing on disk: ${f}`);
+    if (!closure.includes(f)) problems.push(`certified file no longer in the closure: ${f} — remove or re-root`);
+  }
+  for (const e of man.excluded) {
+    if (!e.reason || e.reason.trim().length < 8) problems.push(`excluded entry without a real reason: ${e.file}`);
+    if (!closure.includes(e.file)) problems.push(`excluded entry no longer in the closure: ${e.file} — remove the stale exclusion`);
+  }
+  return problems;
+}
+
+const mode = process.argv[2];
+if (!['--check', '--write', '--init'].includes(mode ?? '')) {
+  console.error('usage: stage-b-certified-fingerprint.mjs --check | --write | --init');
+  process.exit(2);
+}
+
+const gateMod = await loadGateFromDist();
+const shipped = gateMod.bundledStageBReleaseEvidence();
+if (!shipped) { console.error('[stage-b-fingerprint] no bundled evidence'); process.exit(1); }
+const evidenceDigest = gateMod.canonicalShippedArtifactDigest(shipped.artifact);
+
+if (mode === '--init') {
+  if (fs.existsSync(MANIFEST)) { console.error('[stage-b-fingerprint] manifest exists; use --write'); process.exit(1); }
+  console.error('[stage-b-fingerprint] --init requires a hand-authored partition first; see the spec');
+  process.exit(1);
+}
+
+const man = readManifest();
+const closure = relativeImportClosure(root, man.roots);
+const problems = partitionProblems(man, closure);
+const fingerprint = certifiedFingerprint(root, man.certified.filter((f) => fs.existsSync(path.join(root, f))));
+
+if (mode === '--check') {
+  if (fingerprint !== man.fingerprint) {
+    for (const f of man.certified) {
+      const abs = path.join(root, f);
+      if (fs.existsSync(abs) && man.fileHashes && man.fileHashes[f] && man.fileHashes[f] !== sha256(fs.readFileSync(abs))) {
+        problems.push(`certified source drifted: ${f}`);
+      }
+    }
+    problems.push(`fingerprint mismatch: manifest ${man.fingerprint.slice(0, 12)}… vs computed ${fingerprint.slice(0, 12)}… — the certified Stage-B code changed since the approved canary. Run and approve a fresh canary, embed its evidence, then rebind with --write.`);
+  }
+  if (evidenceDigest !== man.artifactDigest) {
+    problems.push(`bundled evidence is not the artifact this manifest vouches for (digest ${evidenceDigest.slice(0, 12)}… vs manifest ${man.artifactDigest.slice(0, 12)}…) — rebind with --write.`);
+  }
+  if (problems.length) {
+    console.error(`[stage-b-fingerprint] CHECK FAILED (${problems.length}):`);
+    for (const p of problems) console.error('  - ' + p);
+    process.exit(1);
+  }
+  console.log(`[stage-b-fingerprint] OK — ${man.certified.length} certified, ${man.excluded.length} excluded (each with a reason), closure ${closure.length}, evidence ${evidenceDigest.slice(0, 12)}…`);
+  process.exit(0);
+}
+
+// --write: rebind. Refuse re-stamping old evidence onto changed code.
+if (problems.length) {
+  console.error('[stage-b-fingerprint] refusing to write over an unresolved partition:');
+  for (const p of problems) console.error('  - ' + p);
+  process.exit(1);
+}
+if (fingerprint !== man.fingerprint && evidenceDigest === man.artifactDigest) {
+  console.error('[stage-b-fingerprint] REFUSED: the certified code changed but the bundled evidence is the same artifact this manifest already vouches for.');
+  console.error('  Old canary evidence cannot be re-stamped onto changed code. Run and approve a fresh canary, embed its signed evidence, then --write.');
+  process.exit(1);
+}
+const fileHashes = {};
+for (const f of man.certified) fileHashes[f] = sha256(fs.readFileSync(path.join(root, f)));
+writeManifest({ ...man, fingerprint, artifactDigest: evidenceDigest, fileHashes, boundAt: new Date().toISOString().slice(0, 10) });
+console.log(`[stage-b-fingerprint] manifest rebound: fingerprint ${fingerprint.slice(0, 12)}…, evidence ${evidenceDigest.slice(0, 12)}…`);

package/scripts/verify-codex-stage-b-release-evidence.mjs

@@ -8,6 +8,7 @@
  * blocks npm publication.
  */
 import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
@@ -26,4 +27,12 @@ if (!evidence || failure) {
   process.exit(1);
 }
 
+// Code-binding spec: the certified Stage-B sources must match the manifest the
+// evidence is bound to. Drift blocks publishing until a fresh canary rebinds.
+const fp = spawnSync(process.execPath, [path.join(root, 'scripts', 'stage-b-certified-fingerprint.mjs'), '--check'], { stdio: 'inherit' });
+if (fp.status !== 0) {
+  console.error('[codex-stage-b-release] BLOCKED: certified-source drift (see above).');
+  process.exit(1);
+}
+
 console.log(`[codex-stage-b-release] verified ${evidence.artifact.deliveryCount} deliveries over ${Math.floor((evidence.artifact.endedAt - evidence.artifact.startedAt) / 60_000)} minutes; signer=${evidence.artifact.echoMachineId}`);