instar 1.3.1219 → 1.3.1221

package/src/data/stageBCertifiedSet.ts

@@ -0,0 +1,367 @@
+/**
+ * Stage-B certified-set manifest (spec: stage-b-evidence-code-binding).
+ * Maintained ONLY by scripts/stage-b-certified-fingerprint.mjs --write, which
+ * refuses to rebind old evidence onto changed code. Every closure member is
+ * either certified (fingerprinted) or excluded with a written reason; the
+ * --check partition is fail-closed for anything new.
+ */
+export const STAGE_B_CERTIFIED_SET = {
+  "roots": [
+    "src/core/InboundDeliveryStore.ts",
+    "src/core/CodexDeliveryObserver.ts",
+    "src/core/CodexComposerAdapter.ts",
+    "src/core/CodexLifecycleProductionComposition.ts",
+    "src/core/StageBStartupReadiness.ts"
+  ],
+  "certified": [
+    "src/core/CodexComposerAdapter.ts",
+    "src/core/CodexDeliveryObserver.ts",
+    "src/core/CodexLifecycleProductionComposition.ts",
+    "src/core/InboundDeliveryStore.ts",
+    "src/core/SessionRecoveryChannel.ts",
+    "src/core/SessionRecoveryConsumer.ts",
+    "src/core/StageBStartupReadiness.ts"
+  ],
+  "excluded": [
+    {
+      "file": "src/core/AccountFollowMeGrants.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/AccountFollowMeSpendSlice.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/AnthropicSubscriptionRouter.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/CircuitBreakingIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/ClaudeCliIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/CodexCliIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/Config.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/CredentialAuditEmit.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/CredentialWriteFunnel.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/GateSignalDetectors.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/GeminiCliIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/InFlightSyncOpMarker.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/InstrumentAssessment.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/InteractivePoolIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/JargonDetector.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/JudgmentProvenanceLog.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/LlmCircuitBreaker.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/MessagingToneGate.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/ModelTierEscalation.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/OAuthRefresher.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/PhysicalEffectLock.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/PiCliIntelligenceProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/ProjectRoundLock.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SafeFsExecutor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SafeGitExecutor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SecretMigrator.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/SecretStore.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SessionLivenessOracle.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/SourceTreeGuard.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SpawnCapIntelligenceProvider.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/SqliteRegistry.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/StageBActivationGate.ts",
+      "reason": "release policy, not canaried delivery behavior; binding it would force irrelevant two-hour canaries for gate-policy fixes (incl. the code-binding fix itself), and it adds no adversarial protection since the manifest is equally PR-editable"
+    },
+    {
+      "file": "src/core/canonicalFeedback.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/claudeForbiddenGuard.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/decisionQualityTypes.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/deferral-floor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/devAgentGate.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/durableSecretScrub.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/dynamicMcpConfig.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/frameworkFacts.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/hostSemaphoreCore.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/hostSpawnSemaphore.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/inboundQueueConfig.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/intelligenceProviderFactory.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/internal-id-leak.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/machineCoherenceAdvert.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/machineCoherenceManifest.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/machineServesChannel.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/models.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/seamlessnessConfig.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/core/self-stop-floor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/core/types.ts",
+      "reason": "universal shared type module; changes routinely for every subsystem"
+    },
+    {
+      "file": "src/data/codexStageBReleaseEvidence.ts",
+      "reason": "the evidence itself; bound by artifactDigest, fingerprinting it would be circular"
+    },
+    {
+      "file": "src/data/provenanceCoverage.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/data/stageBCertifiedSet.ts",
+      "reason": "this manifest; self-reference would be circular"
+    },
+    {
+      "file": "src/monitoring/CredentialProvider.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/monitoring/DegradationReporter.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/monitoring/ErrorCodeExtractor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/monitoring/Redactor.ts",
+      "reason": "cross-cutting utility shared far beyond Codex delivery, certified by its own suite; binding it would re-freeze releases on unrelated churn"
+    },
+    {
+      "file": "src/providers/adapters/gemini-cli/models.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/gemini-cli/observability/geminiCapacityPolicy.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/gemini-cli/transport/geminiSpawn.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/openai-codex/errors.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/openai-codex/models.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/openai-codex/observability/eventNormalizer.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/openai-codex/transport/codexSpawn.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/openai-codex/transport/codexUsageParser.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/pi-cli/config.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/pi-cli/errors.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/pi-cli/policy.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/pi-cli/transport/oneShotCompletion.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/adapters/pi-cli/transport/piSpawn.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/capabilities.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/costAwareRouting.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/errors.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/events.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/primitives/observability/usageMeterProvider.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/primitives/transport/oneShotCompletion.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/registry.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/routing.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    },
+    {
+      "file": "src/providers/types.ts",
+      "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
+    }
+  ],
+  "fingerprint": "6aafe889d2bf5e21aeb821348fdbc593e0ca34282de706d53a5eb44cd848ea4b",
+  "artifactDigest": "7499d16a6ab0b986757121c3d1b3f97f93f7204d341e0a07aaecb360863c75eb",
+  "fileHashes": {
+    "src/core/CodexComposerAdapter.ts": "8d4753c45f317092f3d1e8d6e5a73a875dbf046cbac20066220fa036b4f0e065",
+    "src/core/CodexDeliveryObserver.ts": "7de40edfd2f64adfcef9e18bf6191acb4bdeb294886f0369895b948e1be345dd",
+    "src/core/CodexLifecycleProductionComposition.ts": "a94897fbd317af61c5ea8d09da7484b2799b985ef44af2e2cc304f769fff62a4",
+    "src/core/InboundDeliveryStore.ts": "93009f9b2cc2c4ee2124c09e8fe3f8ac30edf17b033c13864ff61b0e14ea0e88",
+    "src/core/SessionRecoveryChannel.ts": "d38b8ebc6d073008ae2d9f9109a254019813499d5d327a3ff00e4b2a72272b65",
+    "src/core/SessionRecoveryConsumer.ts": "6a00ca4993d188f1c95eaa7d156795804f00f7e10e600ea12fa2e8cd40423268",
+    "src/core/StageBStartupReadiness.ts": "92275608368d44abc98802f9a445acc6419fd57bddb8c2e4935f32961d401183"
+  },
+  "boundAt": "2026-09-04",
+  "boundBy": "echo (operator-approved rebinding, topic 52075, 2026-09-03)",
+  "note": "Initial binding: certified sources verified byte-identical to the evidence commit (git diff 92a21075d..1b46533a7 over the certified set is empty), so the approved 2026-08-31 canary evidence remains the honest witness."
+} as const;
+
+export type StageBCertifiedSet = typeof STAGE_B_CERTIFIED_SET;

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1219",
+  "packageVersion": "1.3.1221",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "1de67d05c7ab2a67b13fca08b37ee53163e20c8863520491812e25cc29d95d48",
+  "sha256": "5fa578c9e59c4db0835d48d02776497a23b3fbc74c2f0048192dd5ad9da9c679",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1219"
+  "packageVersion": "1.3.1221"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1219"
+  "packageVersion": "1.3.1221"
 }

package/upgrades/1.3.1220.md

@@ -0,0 +1,87 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+A message an agent signs and delivers through a human's Telegram account (for
+example, this agent posting through the operator's own login to reach a sister
+session) was already recognised by the signature classifier, but that verdict
+lived only in a ledger. The receiving session was still told the message came
+from the human, and the topic-operator auto-bind still seated that human as the
+topic's verified operator on the strength of a message they did not write.
+
+Now the routing path reads the classifier's own verdict for each message (by
+platform message id, from in-process state, never from content) at the point
+where both ingress paths converge. A verified-signed message is injected with a
+tag that names the signing agent and the account that carried it, the thread
+history a fresh session reads says the same, and operator auto-bind is refused
+for it. Existing agents receive the awareness bullet through the CLAUDE.md
+migration.
+
+The Stage-B publish gate bound its signed canary evidence to a version number,
+which can match exactly once: the named version shipped, every later release
+failed the binding check, and publishing froze for the whole fleet. The gate
+now binds the evidence to the code the canary actually certified. A reviewed
+manifest lists the certified Stage-B sources (their import closure is
+recomputed on every check, and every member must be certified or excluded with
+a written reason — anything new fails closed), a fingerprint of their exact
+bytes, and the canonical digest of the signed evidence. Publishing verifies
+the sources still match the manifest; the runtime fleet-activation path,
+which had the same version binding and would have kept Stage B silently dark
+on every later release, verifies the same linkage. The rebinding tool
+structurally refuses to re-stamp old evidence onto changed code: changed
+certified sources require fresh embedded canary evidence. The canary
+thresholds themselves — two hours, fifty deliveries, full case matrix, zero
+failures, signed approval — are unchanged.
+
+## What to Tell Your User
+
+If I post a message into one of my own topics through your Telegram account,
+the session on the other end now sees it labelled as coming from me, signed,
+via your account, rather than as you speaking. That message can never make
+you the operator of that topic by itself; only a message you actually wrote
+does that. Nothing changes for messages you type yourself.
+
+Updates flow again. Releases were frozen for two days by a safety gate that
+tied its proof to a version number; the proof is now tied to the code it
+actually vouches for, so releases pass while that code is unchanged and a real
+change to it still demands a fresh certification run first.
+
+## Summary of New Capabilities
+
+- A verified agent-signed message delivered through a human's account is
+  injected with a tag naming the signing agent and the carrying account, and the
+  thread history a fresh session reads carries the same label.
+- Operator auto-bind is refused for such a message; a human's own messages keep
+  today's behaviour exactly.
+- The signature classifier now answers "what was the verdict for this message?"
+  for the routing path without verifying twice.
+
+- Releases publish again: the two days of merged fixes (including the
+  signed-message labelling fix) ship in the next release.
+- A change to certified Stage-B code still blocks publishing until a fresh
+  canary is approved, and now the block names exactly which files drifted.
+- The certified/excluded partition is explicit, reviewed, and fail-closed for
+  new imports, so coverage cannot rot silently.
+
+## Evidence
+
+Unit tests cover the tag builder's new clause (byte-identical output when
+absent, charset-sanitised agent id), the classifier's bounded per-message
+verdict lookup (verified, human, replay-rejected, id-less, outbound, eviction),
+the read-time authorship join exposing the agent id only on a verified verdict,
+the history label, the auto-bind refusal, and the idempotent CLAUDE.md
+migration. Source-level wiring tests pin that the verdict is resolved before
+the auto-bind, that the bind is gated on it, that the injection carries it, and
+that every thread-history renderer uses the shared label.
+
+Eighteen new unit tests cover the canonical digest (order stability, field
+and signature sensitivity, manifest linkage), the version-independent
+verifier on both publish and runtime paths, the tampered-evidence and
+config-binding refusals, the manifest partition invariants, and the tool and
+hook wiring. The existing Stage-B activation, readiness, forensics, and
+publish-gate suites pass unchanged except two tests updated for the
+override-seam scoping. The live publish verifier passes on this tree for a
+future version number.

package/upgrades/1.3.1221.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The outbound tone gate previously treated any `B2_FILE_PATH` verdict as a hard stop unless the broader advisory-migration experiment was enabled. That made a contextual writing preference capable of blocking legitimate artifact links and exact paths. `B2_FILE_PATH` is now advisory on every install. The agent may revise the prose or explicitly override the nudge with a reason; credential exposure and autonomous self-stop rules remain hard blockers.
+
+Existing agents receive the revised behavior awareness through an idempotent CLAUDE.md migration, while fresh installs inherit it directly from the current template.
+
+## What to Tell Your User
+
+Exact file paths and artifact links are allowed when they are useful. The agent may still get a clarity suggestion, but that suggestion can no longer prevent delivery merely because it contains a path. Secret values remain blocked.
+
+## Summary of New Capabilities
+
+- File-path feedback is advisory by default across fresh and upgraded agents.
+- Agents can send a necessary path after recording why the nudge does not apply.
+- Credential-safety walls remain unchanged.
+
+## Evidence
+
+Focused unit and integration coverage verifies the runtime disposition with the broader migration both off and on, behavior when decision recording is unavailable, fresh-install awareness, replacement of legacy installed guidance, and migration idempotency.

package/upgrades/side-effects/asp-signed-inbound-label.md

@@ -0,0 +1,117 @@
+# Side-Effects Review — Agent-signed inbound messages are labelled, not laundered
+
+**Version / slug:** `asp-signed-inbound-label`
+**Date:** `2026-09-02`
+**Author:** `Echo`
+**Second-pass reviewer:** `Codex independent reviewer (see below)`
+
+## Summary of the change
+
+A message an agent signs and delivers through a human's Telegram account already receives an `agent-verified` verdict from the ASP inbound classifier, but that verdict lived only in a ledger. The receiving session was still told the message came `from <human>`, and the topic-operator auto-bind still seated that human as the topic's verified operator. This change reads the classifier's own verdict at the routing convergence point (`telegram.onTopicMessage` in `src/commands/server.ts`), by platform message id from in-process state, and does three things for a verified-signed message: the injection tag names the signing agent and the carrying account (`src/types/pipeline.ts`, `src/core/SessionManager.ts`), the thread-history renderers say the same via one shared label (`src/server/routes.ts`, `src/core/ForwardedTopicContext.ts`, `src/core/AspAuthorshipJoin.ts`), and operator auto-bind is refused. The classifier gains a bounded per-message verdict lookup (`src/core/AspInboundClassifier.ts`); the helpers live in `src/messaging/shared/signedInbound.ts`; the CLAUDE.md awareness bullet and its idempotent migration live in `src/core/PostUpdateMigrator.ts`.
+
+## Decision-point inventory
+
+- `telegram.onTopicMessage` operator auto-bind (`src/commands/server.ts`) — modify — the bind is additionally gated on "this message is not agent-signed"; every other condition is unchanged.
+- Lifeline-forward operator auto-bind (`src/server/routes.ts`) — modify — the same gate, on the same cached verdict (the message is logged, and therefore classified, before this bind runs).
+- `AspInboundClassifier.classify` — pass-through — unchanged verdict logic; it now also remembers each verdict by message id.
+- `buildInjectionTag` / `injectTelegramMessage` — modify — an additive sender clause; no block/allow surface.
+- Thread-history renderers — modify — label only; no block/allow surface.
+
+---
+
+## 1. Over-block
+
+The only thing this change withholds is operator auto-bind, and only for a message whose signature the classifier verified as an agent's. A human's own message is never withheld: an unsigned message, a message with a malformed or forged tag (`rejected`), and a message the classifier never saw all keep today's auto-bind behaviour. Over-block would require the classifier to verify a signature a human typed — which requires the agent's private key. If a topic's very first message is agent-signed, that topic simply has no verified operator until the human writes; that is the correct state, not a regression.
+
+## 2. Under-block
+
+An agent that never signs its messages is still indistinguishable from the account holder (the ASP limit already stated in the awareness section). The durable inbound queue path (`dmsg.senderEnvelope`, ships dark) does not carry the flag yet, so a message delivered through that path would arrive with today's tag; it still cannot mis-bind, because the bind decision happens at the convergence point before either delivery path. A message classified before this process started (ledger only, no in-memory verdict) is labelled by the history join but injected with today's tag. Rejected-but-genuine signatures (the plain-text-only limit) fall to `human` behaviour, which is the pre-existing fail direction.
+
+## 3. Level-of-abstraction fit
+
+This is a low-level invariant at the identity layer, exactly where Know Your Principal says it belongs: the one place both ingress paths converge, reading the one cryptographic authority that already exists. It does not add a second verifier (the nonce is single-use, so it must not), and it does not add a judgment. The higher-level gate it feeds is the existing operator-binding path, which now has a truthful input.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface beyond withholding one automatic grant on cryptographic proof.
+
+The label is a signal to the session. The one authority it exercises — refusing operator auto-bind — is deterministic on an exact, unforgeable match (a valid Ed25519 signature bound to a single-use nonce), which is the ruled shape for structure deciding alone. It never blocks, delays, rewrites, or drops a message; every failure path delivers the message unlabelled.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point. "Was this message signed by an agent?" is enumerable (verified / not), and the auto-bind refusal is a safety guard on an identity grant, deterministic by design.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** the verdict is read from the classifier, which runs on the `onMessageLogged` seam BEFORE routing on both ingress paths (polling: `appendToLog` precedes `onTopicMessage`; lifeline: `logInboundMessage` precedes the `onTopicMessage` fire in `routes.ts`). If logging is deduplicated for a repeated message id, the first verdict is reused, which is correct.
+- **Double-fire:** none. The classifier still verifies exactly once; the routing path reads, never re-verifies (a second verify would classify the genuine message as a replay).
+- **Races:** the in-memory map is written and read on the same event-loop turn sequence; bounded at 1000 entries with oldest-first eviction.
+- **Feedback loops:** none. The label does not feed the classifier.
+- The `routes.ts` lifeline-side operator bind runs BEFORE the convergence point, so gating only the convergence point would have left an agent-signed lifeline message able to seat the operator (raised by the second-pass reviewer). It is now gated on the same verdict, read through a context getter to the one classifier; the log call that classifies the message precedes it in the same handler.
+- The convergence point OWNS `metadata.signedByAgent`: it is rewritten from the verdict on every message and removed when the verdict is not agent-verified, so a value arriving on the Message from a wire body, a replay, or a queue row can never reach the injection (also raised by the second-pass reviewer).
+
+---
+
+## 6. External surfaces
+
+- Other agents on the same machine: none.
+- Install base: every agent gets the labelling on the next server restart; the awareness bullet arrives through the CLAUDE.md migration.
+- External systems: none. No Telegram send changes.
+- Persistent state: none new. The ASP ledger format is unchanged; the history join reads it as before and adds a derived field.
+- Timing: none.
+- Operator surface: no operator-facing actions.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Proxied-on-read.** The verdict is machine-local by nature (the classifier on the receiving machine verifies the signature and holds the nonce store), and the label follows the message to whichever session is injected on that machine. For a topic that has moved, the forwarded thread history carries `authorship` and `authorshipAgentId` from the previous machine's history read, so the relayed history block shows the same label. It emits no user-facing notice, holds no durable state that could strand on transfer, and generates no URL.
+
+---
+
+## 8. Rollback cost
+
+Pure code change — revert and ship a patch. No persistent state, no data migration. The awareness bullet would then overstate behaviour until a correcting migration lands; a rollback would carry one.
+
+---
+
+## Conclusion
+
+The change closes a real identity-bleed path with the smallest possible authority: one deterministic refusal on cryptographic proof, and otherwise labels. The review moved the verdict lookup from "verify again at routing" (wrong: single-use nonce) to "remember the log-time verdict by message id", and added the charset sanitisation on the agent id so a ledger row can never inject text into a tag. Two honest limits are recorded above (dark inbound-queue path; lifeline-side first bind). Clear to ship after the independent second pass and the full test gate.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** Codex independent reviewer (GPT-5.6, read-only, artifact + diff)
+**Independent read of the artifact:** concern on the first pass, both points accepted and fixed. (1) The lifeline-forward operator bind ran before the convergence point, so the claimed under-block protection did not hold for that ingress — now gated on the same verdict. (2) The injection trusted a pre-existing `metadata.signedByAgent` — the convergence point now rewrites the field from the verdict and strips any other value. The reviewer confirmed the auto-bind at the convergence point depends only on the classifier-derived value, that no second signature verification occurs, that the tag change is backward-compatible, and that the label grants no authority. Second pass on the revised diff (same reviewer, same read-only setup): **concur, no issues** — the lifeline-forward bind is gated on the cached verdict after the log call, the convergence point owns the metadata field, no second verification exists, and the label grants no authority.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/signed-inbound-label.test.ts`
+- `tests/unit/asp-inbound-classifier-verdictFor.test.ts`
+- `tests/unit/asp-authorship-join-agentid.test.ts`
+- `tests/unit/PostUpdateMigrator-aspSignedInboundBullet.test.ts`
+- `tests/unit/redelivery-marker.test.ts` (parameter-count guard updated with its reasoning)
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable. This change fixes routing code (TypeScript source), not an LLM prompt, hook, config, skill, or standards text, and it adds no self-triggered controller: nothing here fires a restart, swap, respawn, spawn, notify, retry, re-drive, or kill on its own.