instar 1.3.1223 → 1.3.1225

package/.claude/skills/autonomous/SKILL.md

@@ -104,7 +104,7 @@ Write this content:
      when set, the stop-hook RUNS it on a met:true verdict and only allows the exit if it ALSO
      passes (fail/timeout → keep working). This sentinel is the PostUpdateMigrator marker that
      re-deploys this SKILL.md to existing agents. Spec: autonomous-completion-real-checks.md -->
-<!-- SCOPE_ACCRETION — scope-accretion completion discipline: register the run server-side
+<!-- W32_PREPARING_LIVENESS — scope-accretion completion discipline: register the run server-side
      (POST /autonomous/register) and record the returned run_id in the frontmatter; the server
      then holds completion while deliverables THIS run creates sit unbuilt, uncorroborated, and
      unratified. This sentinel is the PostUpdateMigrator marker that re-deploys this SKILL.md to
@@ -112,7 +112,8 @@ Write this content:
 
 ```markdown
 ---
-active: true
+active: {false when POST /autonomous/register returns preparationRequired:true; true otherwise}
+status: {the initialStatus returned by POST /autonomous/register; active when absent}
 iteration: 1
 session_id: {VALUE OF $CLAUDE_CODE_SESSION_ID — get via: echo $CLAUDE_CODE_SESSION_ID}
 goal: "YOUR GOAL"
@@ -193,7 +194,11 @@ jq -nc --arg t "TOPIC_ID" --arg c "YOUR completion_condition text" --arg w "$(pw
     --data-binary @- "http://localhost:${PORT}/autonomous/register"
 ```
 
-Write the returned `runId` into the state file's `run_id:` frontmatter field. If the mission is
+Write the returned `runId` into the state file's `run_id:` frontmatter field. When the response says
+`preparationRequired:true`, write `active:false` and `status:preparing`; the server's five-predicate
+liveness authority is the only path that may later promote the canonical file to `active:true`.
+When that field is absent/false (authority dark, observe-only/dry-run, or non-Echo), preserve the legacy `active:true` start; shadow observation must not alter compatibility state.
+If the mission is
 GENUINELY draft-only (the operator asked for drafts, not builds), list those exact repo-relative
 paths in `declaredDeliverables` — that list is operator-visible at setup and immutable mid-run.
 If the server is unreachable, leave `run_id` empty and continue — the gate degrades honestly.

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -57,6 +57,8 @@ for _arg in "$@"; do [[ "$_arg" == "--codex" ]] && IS_CODEX=1; done
 # pass|fail|configured:false observation to the existing decision-quality annotator.
 # hook-capability: STATE_PARSE_LOUD — a selected state file with missing/malformed
 # frontmatter is a visible hook failure, distinct from the clean no-state exit.
+# hook-capability: PREPARATION_CARRIER — a truthful inactive autonomous record in
+# preparing/recovering state falls through to the bounded continuation authority.
 # emit — human-facing approve/status text. In codex mode the Stop hook's STDOUT must be
 # ONLY valid decision-JSON (the `{"decision":"block",...}` case far below) or empty:
 # codex rejects ANY other stdout as "invalid stop hook JSON output" and reports the stop
@@ -122,6 +124,26 @@ LEGACY_STATE=".instar/autonomous-state.local.md"
 MULTI_DIR=".instar/autonomous"
 LIVENESS_SECS="${INSTAR_AUTONOMOUS_LIVENESS_SECS:-120}"
 
+# The sole shell adapter for bounded task continuation. The TypeScript store and
+# authenticated decision route remain the mutation/decision authority.
+continuation_decision() {
+  [[ "$IS_CODEX" == "1" ]] || return 0
+  [[ "$CODEX_TASK_CONTINUATION_ENABLED" == "1" ]] || return 0
+  [[ -n "$MY_TOPIC" ]] || return 0
+  local port auth agent_id decision reason
+  port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
+  auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  agent_id=$(python3 -c "import json;c=json.load(open('.instar/config.json'));print(c.get('projectName') or c.get('agentName') or 'local-stop-hook')" 2>/dev/null | tr -d '\r\n' || echo "local-stop-hook")
+  [[ -n "$agent_id" ]] || agent_id="local-stop-hook"
+  decision=$(jq -nc --arg topicId "$MY_TOPIC" --arg sessionId "$HOOK_SESSION" '{topicId:$topicId,sessionId:$sessionId}' \
+    | curl -sS -m 5 -H "Authorization: Bearer $auth" -H "X-Instar-AgentId: $agent_id" -H 'Content-Type: application/json' \
+      --data-binary @- "http://127.0.0.1:${port}/continuation/decide" 2>/dev/null || echo "")
+  if [[ "$(printf '%s' "$decision" | jq -r '.decision // ""' 2>/dev/null)" == "continue" ]]; then
+    reason=$(printf '%s' "$decision" | jq -r '.reasonText // "Continue the explicit open task list."' 2>/dev/null)
+    jq -nc --arg reason "$reason" '{decision:"block",reason:$reason}'
+  fi
+}
+
 # ── Inputs from the hook ──────────────────────────────────────────────
 HOOK_SESSION=$(printf '%s' "$HOOK_INPUT" | jq -r '.session_id // ""' 2>/dev/null || echo "")
 TRANSCRIPT_PATH=$(printf '%s' "$HOOK_INPUT" | jq -r '.transcript_path // ""' 2>/dev/null || echo "")
@@ -201,27 +223,11 @@ else
   # No autonomous job for this session. Ordinary Codex interactive work may
   # still own an explicit bounded continuation ledger. The server is the sole
   # mutation/decision authority; empty/invalid state returns allow.
-  if [[ "$IS_CODEX" == "1" ]] && [[ "$CODEX_TASK_CONTINUATION_ENABLED" == "1" ]] && [[ -n "$MY_TOPIC" ]]; then
-    _PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-    _AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
-    _DECISION=$(jq -nc --arg topicId "$MY_TOPIC" --arg sessionId "$HOOK_SESSION" '{topicId:$topicId,sessionId:$sessionId}' \
-      | curl -sS -m 5 -H "Authorization: Bearer $_AUTH" -H 'Content-Type: application/json' \
-        --data-binary @- "http://127.0.0.1:${_PORT}/continuation/decide" 2>/dev/null || echo "")
-    if [[ "$(printf '%s' "$_DECISION" | jq -r '.decision // ""' 2>/dev/null)" == "continue" ]]; then
-      _REASON=$(printf '%s' "$_DECISION" | jq -r '.reasonText // "Continue the explicit open task list."' 2>/dev/null)
-      jq -nc --arg reason "$_REASON" '{decision:"block",reason:$reason}'
-    fi
-  fi
+  continuation_decision
   # No autonomous job or open continuation ledger — allow exit.
   exit 0
 fi
 
-# An autonomous state owns this turn. Its own Codex gate remains authoritative;
-# enabling ordinary task continuation must never implicitly enable autonomous jobs.
-if [[ "$IS_CODEX" == "1" ]] && [[ "$CODEX_LOOP_ENABLED" != "1" ]]; then
-  exit 0
-fi
-
 # ── Read the selected state file ──────────────────────────────────────
 # STATE_FILE was selected only after an existence check. From this point on,
 # "no parseable state" is corruption, NOT the same outcome as "no autonomous
@@ -274,6 +280,18 @@ if [[ "$ACTIVE" != "true" ]] && [[ "$ACTIVE" != "false" ]]; then
   state_parse_failure
 fi
 if [[ "$ACTIVE" != "true" ]]; then
+  # Inactive autonomous records are observational, never continuation
+  # authority. Always fall through to the bounded ledger: no ledger (or a
+  # disabled/error decision) allows the stop, while a truthful preparation
+  # carrier can continue even during the tiny cross-file marker write window.
+  continuation_decision
+  exit 0
+fi
+
+# Only an ACTIVE autonomous record is governed by the autonomous Codex-loop
+# gate. An inactive record is observational and has already fallen through to
+# the independently gated continuation authority above.
+if [[ "$IS_CODEX" == "1" ]] && [[ "$CODEX_LOOP_ENABLED" != "1" ]]; then
   exit 0
 fi
 

package/.claude/skills/autonomous/scripts/setup-autonomous.sh

@@ -193,7 +193,7 @@ if [[ -n "$VERIFICATION_CWD" ]]; then
 $VERIFICATION_FIELDS"
 fi
 
-# ── SCOPE_ACCRETION — server-side run registration (spec: autonomous-scope-
+# ── W32_PREPARING_LIVENESS — server-side run registration (spec: autonomous-scope-
 # accretion-completion.md R30). The SERVER mints the runId, snapshots the
 # scopeAccretion config + the sweep base roots with their start-SHAs, and clamps
 # endAt — so mid-run edits to config/state-file change nothing the completion
@@ -202,6 +202,27 @@ fi
 # unreachable server leaves run_id empty (the gate degrades honestly server-side;
 # the run still starts — registration is a discipline layer, not a start gate).
 RUN_ID=""
+# Resolve enforcement from local config before contacting the server.
+# Registration is a response contract, not the source of the rollout decision:
+# an enforcing Echo run stays preparing if the server is temporarily unreachable,
+# while observe-only/dark/legacy installs retain byte-compatible active behavior.
+LIVENESS_INITIAL=$(python3 -c "import json
+try:
+ c=json.load(open('.instar/config.json'))
+ raw=((c.get('monitoring') or {}).get('windowRunLiveness') or {})
+ explicit=raw.get('enabled',None)
+ enabled=explicit if isinstance(explicit,bool) else bool(c.get('developmentAgent',False))
+ enforcing=c.get('projectName')=='echo' and enabled and raw.get('dryRun',True) is False
+ print('preparing' if enforcing else 'active')
+except Exception:
+ print('active')" 2>/dev/null || echo active)
+if [[ "$LIVENESS_INITIAL" == "active" ]]; then
+  RUN_ACTIVE="true"
+  RUN_STATUS="active"
+else
+  RUN_ACTIVE="false"
+  RUN_STATUS="preparing"
+fi
 if [[ -n "$REPORT_TOPIC" ]]; then
   REG_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
   REG_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
@@ -222,6 +243,13 @@ print(json.dumps([p.strip() for p in sys.stdin.read().split(',') if p.strip()]))
   RUN_ID=$(printf '%s' "$REG_RESP" | python3 -c "import sys,json
 try: print(json.load(sys.stdin).get('runId',''))
 except Exception: print('')" 2>/dev/null || echo "")
+  REG_INITIAL_STATUS=$(printf '%s' "$REG_RESP" | python3 -c "import sys,json
+try: print(json.load(sys.stdin).get('initialStatus',''))
+except Exception: print('')" 2>/dev/null || echo "")
+  if [[ "$REG_INITIAL_STATUS" == "preparing" ]]; then
+    RUN_ACTIVE="false"
+    RUN_STATUS="preparing"
+  fi
   if [[ -n "$RUN_ID" ]]; then
     echo "  Scope-accretion: run registered server-side (runId $RUN_ID)"
   else
@@ -235,7 +263,8 @@ fi
 
 cat > "$STATE_PATH" <<EOF
 ---
-active: true
+active: $RUN_ACTIVE
+status: $RUN_STATUS
 iteration: 1
 session_id: ${CLAUDE_CODE_SESSION_ID:-}
 goal: "$GOAL"

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2FH,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8wBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyhvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2FH,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8wBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+hvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -21281,7 +21281,15 @@ export async function startServer(options) {
                         try {
                             const r = ownershipApplier.tick();
                             if (r.materialized)
-                                console.log(pc.dim(`  [OwnershipApplier] materialized ${r.materialized}/${r.examined} topic(s) from replicated placements`));
+                                console.log(pc.dim(`  [OwnershipApplier] materialized ${r.materialized}/${r.examined} topic(s) from replicated placements (${r.pagesScanned ?? 1} page(s))`));
+                            // A DEGRADED scan is the shape of the bug this paging fixed: the applier
+                            // silently seeing only part of the journal, so a topic is never materialized
+                            // and its drain refuses `not-owner` forever. Never let that be quiet again —
+                            // these two states are logged even on a tick that materialized nothing.
+                            if (r.pageCeilingHit)
+                                console.log(pc.dim(`  [OwnershipApplier] page ceiling hit — the placement scan was INCOMPLETE this tick; some topics may not be materialized`));
+                            if (r.pagingUnavailable)
+                                console.log(pc.dim(`  [OwnershipApplier] paging unavailable — read a SINGLE placement page; low-epoch topics may not be materialized`));
                         }
                         catch (err) {
                             console.error('[OwnershipApplier] tick failed:', err instanceof Error ? err.message : String(err));