instar 1.3.1247 → 1.3.1249

package/upgrades/{1.3.1247.md → 1.3.1249.md}

@@ -23,6 +23,41 @@ Two honesty fixes ride along. An account that genuinely reports no usage window
 
 This is a reader and presentation fix. No routing, placement, load-shedding or proactive-swap threshold changed. Their input improves — two exhausted accounts now present a real number where they previously presented nothing — which makes them more likely to route work away from a full account, not less.
 
+A new, dark research instrument: the Jev signal-layer shadow. When turned on, every
+message reaching the outbound tone gate is also shown to TypeSafe's Jev model with
+seven yes/no questions — one for each existing deterministic check for jargon a
+user shouldn't see (raw paths, terminal commands, config keys, internal endpoints,
+paste-and-run code, environment variables, cron strings and internal ids). Each
+answer is compared with what the existing check found and a content-free row is
+written to `logs/jev-signal-shadow.jsonl`. It decides nothing, is never waited on,
+and never stores message text.
+
+It ships OFF (`intelligence.jevSignalShadow.enabled: false`), and it stays inert
+even when enabled unless a future `soakEndsAt` is set and a `typesafe_api_key` is in
+the vault. `scripts/jev-shadow-report.mjs` turns the log into per-check agreement
+tables. Existing agents receive the dark default block on update.
+
+The outbound live-credential wall — the one check that stops a message carrying an
+API key or token from being sent, and the one check that cannot be overridden — did
+not recognise the key formats providers issue today. Modern OpenAI keys
+(`sk-proj-`, `sk-svcacct-`, `sk-admin-`, `sk-None-`), OpenRouter keys (`sk-or-v1-`)
+and GitHub fine-grained tokens (`github_pat_`) all passed it, and the LLM review
+behind the wall passed them too. Two prefix-anchored patterns in the shared secret
+list now cover them, and the same list's durable-output redaction redacts them.
+
+The wall also now strips invisible interleave characters (zero-width and other
+format characters, the combining grapheme joiner, variation selectors) before
+matching, scanning both the raw and the stripped text. Two send paths that skipped
+the whole outbound authority — proxy/system-template Telegram replies and
+Agent-Health-lane attention items — now still run the credential wall; their skip
+continues to bypass tone judgment only. Eight hand-kept copies of credential
+patterns across the codebase were brought up to the same shapes.
+
+The new falsifiable timing fixture found two pre-existing quadratic patterns in the
+shared list (`jwt` and `url-embedded-credential`); `url-embedded-credential` runs on
+every outbound message as part of the wall and could stall the server for minutes on
+a large pasted blob. Both are capped, with no change in what they detect.
+
 The Subscriptions dashboard's quota bars are now colour-coded by how much of each account's limit is used. Every bar previously rendered in the same green regardless of utilization, so the only difference between an account at 4% and one at 92% was the bar's length — a distinction that is hard to read at a glance across a stacked list of accounts, which is exactly where the list is read.
 
 Each bar's fill now carries one of three severity classes derived from the same clamped 0–100 integer that already sets its width: green below 75% used, amber from 75% through 89%, red at 90% and above. The percent text that has always sat beside the bar is unchanged, so the colour is redundant with information already on screen rather than the only way to read the value.
@@ -41,6 +76,16 @@ Two things will look a little different. An account that genuinely has no weekly
 
 Nothing about how your work is spread across accounts changed.
 
+Nothing changes for you. This adds a measuring tool I can switch on for a limited
+time to test whether a small, cheap model can take over some of the checks I run
+on my own messages. It never changes, delays or blocks what I send.
+
+If I ever try to send you a message containing one of today's API keys or access
+tokens — the current OpenAI and OpenRouter key formats, or GitHub's newer
+fine-grained tokens — it is now stopped before it reaches you, the same way older key
+formats already were. I'll refer to the key by name instead. Nothing changes for any
+normal message.
+
 Your Subscriptions dashboard now shows each account's quota bar in green, amber or red depending on how much of the limit is used, instead of always green. An account that is comfortable stays green, one that is getting tight turns amber at 75%, and one that is at or near its wall turns red at 90%. Nothing about how work is routed between your accounts changed — this only makes the page easier to scan. The percentage is still written next to every bar.
 
 ## Summary of New Capabilities
@@ -59,6 +104,16 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 - Quota readings older than six hours are labelled with their age on the Subscriptions card.
 - Back-compatible: rollouts with no `limit_id` are still read as codex-family; the new snapshot field is optional and absent on existing stored state.
 
+- Dark, time-bounded comparison of Jev against the B1–B7 outbound jargon checks.
+- Content-free comparison log plus a per-check confusion-matrix report script.
+- Shadow calls metered under feature `jev-signal-shadow` in the LLM metrics.
+
+- The non-overridable outbound credential wall covers modern OpenAI, OpenRouter and GitHub fine-grained key formats.
+- Invisible-character interleaving no longer hides a key from the wall.
+- Proxy replies and Agent-Health-lane attention items are covered by the wall.
+- Durable-output redaction covers the same formats.
+- Two latent event-loop stalls in the shared secret-pattern list removed.
+
 - Subscriptions quota bars are colour-coded: green (<75% used), amber (75–89%), red (≥90%).
 - The colour is derived from the already-clamped percent, so a bad reading cannot produce a misleading colour — it clamps to 0% / green or 100% / red.
 - Colour is never the only signal: the "N% used" text is unchanged and always present.
@@ -79,6 +134,16 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 - Unit (`tests/unit/quota-poller.test.ts`, 26 passing): both sides of the boundary — a windowless reading sets `noQuotaWindow`, a windowed one does not.
 - Unit (`tests/unit/subscriptions-render.test.ts`, 97 passing): the three distinct card states (a bar, "reports no usage window", "No quota reading yet") and the age label appearing above the six-hour threshold and not below it.
 
+- Unit `tests/unit/JevSignalShadow.test.ts` (17 passing): question set covers every detector kind; inert when disabled, with no soak window, past it, or without a key; compared and every not-compared reason reachable; no message text in any row or from a vendor error body; synchronous, never-throwing `observe()`; key cached; metering recorded.
+- Integration `tests/integration/jev-signal-shadow-gate.test.ts` (6 passing): real gate verdict identical with a disabled shadow; verdict returns while the Jev call hangs; a throwing observer or a network failure cannot break the gate; report script builds deduplicated confusion matrices.
+- E2E `tests/e2e/jev-signal-shadow-lifecycle.test.ts` (3 passing): the update path installs the dark default idempotently; the shipped state makes no call and writes no row; flipping the config with no restart produces a compared row.
+
+- Unit `tests/unit/outbound-credential-wall-modern-formats.test.ts` (65 passing): every modern issued shape refused (generated at test time, nothing committed); no regression on older shapes; drift guard mapping every messaging pattern type to a wall kind or a stated exemption; cross-file ratchet over the eight copies; no false positives on prose, bare prefixes and kebab slugs; invisible-character strip across nine classes plus the separated-key regression guard; oversize still fails closed; scrubber offsets stay valid; per-pattern linear-time budget on a 64 KB unbroken run with interior word boundaries (no exemptions); capped `jwt`/`url` detection equivalence.
+- Integration `tests/integration/telegram-reply-advisory-migration.test.ts` (18 passing): modern keys refused on a normal reply, on a proxy reply, and in a laned attention item; a clean proxy reply still sends.
+- E2E `tests/e2e/tone-gate-advisory-migration-alive.test.ts` (12 passing): modern keys refused on the real boot.
+- Measured: over ~366 MB of real text (Telegram history, repo, logs, state stores) the new patterns match zero strings through the full shipped pipeline. `url-embedded-credential` went from 2.4 s at 64 KB to 157 ms for a full megabyte.
+- Independent second-pass review: concur (both nuances raised were acted on before commit).
+
 - Visual: the shipped module and the shipped CSS rendered together against the account mix from the operator's reference screenshot — 0/22/68% green, 83/89% amber, 100% red.
 - Unit (`tests/unit/subscriptions-render.test.ts`, 92 passing): both sides of both band boundaries (74/75 and 89/90), severity derived from the clamped number (1000 → critical, −50 → ok, non-numeric → ok, 74.6 → warn by rounding), the fill's class attribute, and a hostile percent proving the class stays a closed-set literal.
 - Mutation-checked: flipping `>=` to `>` on the warn boundary fails the 75% case, so the boundary assertions are load-bearing rather than decorative.

package/upgrades/side-effects/jev-signal-shadow.md

@@ -0,0 +1,138 @@
+# Side-Effects Review — Jev signal-layer shadow (dark, measure-only)
+
+**Version / slug:** `jev-signal-shadow`
+**Date:** `2026-09-21`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (see appended section)`
+
+## Summary of the change
+
+Adds `JevSignalShadow` (`src/core/JevSignalShadow.ts`), a research instrument that
+sends each message reaching the outbound tone gate to TypeSafe's Jev model with
+seven yes/no questions — one per deterministic B1–B7 artefact detector — and logs a
+content-free comparison row to `logs/jev-signal-shadow.jsonl`. `MessagingToneGate`
+gains `setSignalShadow()` and calls `observe(text)` once at the top of `review()`
+inside a try/catch; `observe()` is synchronous, never throws, and never awaited.
+`server.ts` constructs it after the tone gate with a live config read, the vault key
+`typesafe_api_key`, and the feature-metrics recorder. `PostUpdateMigrator.migrateConfig`
+adds the dark default `intelligence.jevSignalShadow` block (enabled:false,
+soakEndsAt:null). `scripts/jev-shadow-report.mjs` reads the log into per-rule
+confusion matrices plus coverage.
+
+Spec: `docs/specs/jev-signal-layer-shadow.md` (converged; approved by Justin
+2026-09-21, including the soak egress approval).
+
+## Decision-point inventory
+
+- *(none)* — the shadow writes an audit row and nothing reads it on any decision
+  path. `MessagingToneGate.review()` gains one guarded fire-and-forget call before
+  its existing logic; the verdict computation is untouched.
+
+---
+
+## 1. Over-block
+
+No issue identified. The shadow holds no authority and cannot refuse, delay or alter
+a message. Proven by the integration test that runs the real gate against a Jev stub
+that never settles: the verdict returns while the call is still pending.
+
+## 2. Under-block
+
+Not applicable — it blocks nothing. What it can MISS as an instrument is recorded,
+not hidden: every candidate that is not compared produces a row with a closed-enum
+reason (timeout, http-error, oversize, skipped-concurrent, skipped-sample,
+model-mismatch, disabled-no-key, soak-expired), so the report's coverage figure is
+honest. Standing conditions (no key, soak expired) write one row per process, not
+one per message.
+
+## 3. Level-of-abstraction fit
+
+The tone gate is the one place every outbound message already passes with its
+detector signals available, so observing there is the correct layer. The shadow
+re-runs `detectGateSignals` itself (cheap, deterministic) rather than threading
+state out of the gate, keeping zero shared state with the decision path.
+
+## 4. Signal vs authority compliance
+
+Pure signal, and not even a consumed one yet: the output is a log for a later human
+decision. Per `docs/signal-vs-authority.md`, adding an unconsumed detector is the
+safest possible shape. Graduation into any authority is explicitly a separate spec.
+
+## 5. Interactions
+
+- **Gate latency:** synchronous cost per candidate is one config read, one sha256
+  (over at most the first 1 MB), one small append for any not-compared row
+  (skipped-sample, oversize, skipped-concurrent), and (when dispatching) one
+  detector pass and one JSON body. The vault key — a lookup that can block on a
+  macOS keychain subprocess — is read at construction (boot); after a miss or a 401/403 it is re-read at most once per 10 minutes, so a
+  revoked key costs one lookup per 10 minutes, not one per message. That rate-limited
+  re-read does run synchronously on the gate path, and only while the shadow is
+  enabled with a missing or revoked key. A key added to
+  the vault later is picked up within 10 minutes, no restart.
+  Network runs detached. Single-flight: at most one call in flight per process;
+  overflow is a row, never a queue, so a slow vendor cannot build memory pressure.
+- **Feature metrics:** each call records under feature `jev-signal-shadow`,
+  framework `typesafe-api`, so token spend appears in `/metrics/features` beside
+  other LLM features. No double-counting with the gate's own LLM call.
+- **Credential wall:** unaffected; the shadow sees the same text the gate sees and
+  sends it only to TypeSafe, and only while enabled.
+- **Tests:** the shadow is optional (`signalShadow?`); every existing tone-gate test
+  constructs the gate without one and is unchanged.
+
+## 6. External surfaces
+
+While ENABLED, message text reaching the gate is sent to one more third party
+(TypeSafe, under the MCA accepted 2026-09-20). This is the egress the operator
+approved explicitly in the spec (`soak-egress-approved: true`). Ships DISABLED; the
+14-day bound is mechanical (`soakEndsAt`, checked per candidate, survives restarts).
+Log rows never contain message text: sha256, byte length, detector kinds, Jev
+probabilities, reason enum. A vendor error body is never recorded. The vault key is
+read once and cached, re-read only after a 401/403, and never logged.
+
+## 7. Multi-machine posture
+
+Machine-local BY DESIGN. The log is this machine's observation of its own gate
+traffic (observation locality). Config is ordinary per-machine config; the soak is
+enabled on this dev agent only. No user-facing notices, no durable state that must
+follow a topic, no URLs.
+
+## 8. Rollback cost
+
+Operational: set `intelligence.jevSignalShadow.enabled` false — read live per
+candidate, no restart. Code: revert the commit; the config block left behind is
+inert (nothing else reads it). The log is inert data.
+
+## Second-pass review
+
+**Reviewer:** independent reviewer subagent
+**Verdict:** Concern raised: the vault key read runs synchronously on the gate path, and after a 401/403 it runs again on every dispatched candidate.
+
+The concern:
+- `observeInner()` calls `readKey()` inline, inside `MessagingToneGate.review()`, whenever `cachedKey === undefined`. In production `readKey` builds a `SecretStore` and calls `.get()`. On macOS that resolves the master key with `execFileSync('security', …, { timeout: 5000 })`, which is a synchronous subprocess that blocks the whole event loop. It can take up to 5 s per lookup, and the resolution order may try two keychain accounts. This cost lands on the first enabled candidate.
+- After a 401/403, `dispatch` resets `cachedKey = undefined`. The next candidate then re-reads the key synchronously. The key read happens before the single-flight check, so a revoked key that stays in the vault leads to one blocking keychain spawn per dispatched candidate, for the whole soak. The spec forbids exactly this ("never a per-call decrypt on the event loop", "never a gate delay").
+- Suggested fix: resolve the key off the message path. Either read it inside the detached `dispatch()`, or warm it at construction or on a `setImmediate`. Also latch an auth failure, for example to a `disabled-no-key`-class status with a bounded re-read interval, instead of re-reading on every candidate.
+
+Smaller accuracy points for this artifact (not blocking):
+- §5 "Interactions / Gate latency" lists the synchronous cost as config read, sha256, detector pass and JSON body. It leaves out two synchronous costs: the keychain read above, and the `mkdirSync` + `appendFileSync` for the `not-compared` rows (`skipped-sample`, `oversize`, `skipped-concurrent`, status rows). Those rows are written on the gate path.
+- The sha256 is computed over the full text before the 1 MB size guard, so hashing an oversize message is not bounded by the guard.
+- A missing key is cached as `null` for the life of the process, so a key added to the vault after enabling needs a restart. That is consistent with "read once", but the operator should be told.
+- The e2e test wires the real gate to a shadow built in the test. It does not exercise the `server.ts` construction: the live `intelligence.jevSignalShadow` read, the `SecretStore` key read and the `logs/` path. The tone-gate lifecycle standard asks for a test of the production initialization path.
+
+What I checked and found sound:
+- Verdict isolation: `observe()` is wrapped in try/catch both in the module and at the call site. `dispatch` is async and chained with `.catch().finally()`, so no promise rejection goes unhandled. `review()` never awaits the dispatch. The abort timer is bounded by `timeoutMs` and cleared in `finally`, so it cannot keep the process alive past that bound.
+- Single-flight: `inFlight` is set only after every early return, and it is reset in `.finally()` on every path. `write()` and the metrics call each swallow their own errors, so neither can skip the reset.
+- Leakage: rows carry only the sha256, byte length, detector kinds, probabilities, model and a closed-enum reason. The vendor response body is never read on a non-OK status. The API key appears only in the request header and never reaches a row, a metric or the console. The construction-failure log line prints only the error message.
+- Disabled means inert: `enabled !== true` returns before hashing, any key read, any network call or any row. The integration and e2e tests assert zero rows.
+- The soak bound is mechanical: a missing, unparseable or past `soakEndsAt` is inert and checked on every candidate. The block is read from live config, so the bound survives restarts. It writes one status row per process.
+- Spec coverage: the closed reason set is complete and each reason has a test. Model pinning and `model-mismatch` exclusion, the migration (existence-checked, idempotent), the feature-metrics metering and the report script (dedupe by hash, per-rule confusion matrices, coverage, insufficient-evidence under 20 positives) are all present. All 26 tests in the three new files pass. The enabled-vs-disabled latency measurement belongs to the test-agent-live stage and is not claimed as done here.
+
+### Re-review after fixes
+
+**Verdict:** Concur with the review
+
+- **Key read:** the constructor now reads the key once, at boot, through `refreshKey()`. A missing key, or a 401/403 (which clears both the key and the timestamp), is re-read at most once per `KEY_REREAD_MS` (10 min). The earlier failure mode, one blocking keychain spawn per dispatched message with a revoked key, is gone.
+- **One wording point, not blocking:** a rate-limited re-read still runs synchronously inside `observeInner()`, so on the message path. The cost is at most one lookup per 10 minutes, and only while the shadow is enabled with a missing or revoked key. That bound is acceptable. §5's "never on the message path" should be read as applying to the first read only.
+- **Boot-time read on dark agents:** construction now does a vault read at boot on every agent, including ones where the shadow is disabled. That is harmless. `SecretStore.read()` returns `{}` without touching the keychain when no vault file exists, it never generates a key on this path, and other boot code already reads the vault.
+- **Hash bound:** sha256 is now computed over at most the first `maxScanBytes`, so hash cost is bounded.
+- **Production wiring:** it is extracted into `buildJevSignalShadow()`. `server.ts` and the e2e test both build through it (live `intelligence` read, `readSecret('typesafe_api_key')`, the `logs/` path), so Tier 3 now covers the production construction path.
+- **Everything else still holds:** single-flight reset, no rejection left unhandled, no leakage, disabled is inert, and the mechanical soak bound are unchanged. The three test files now hold 29 tests (up from 26), and all pass.

package/upgrades/side-effects/outbound-credential-wall-modern-key-formats.md

@@ -0,0 +1,178 @@
+# Side-Effects Review — Outbound credential wall: modern OpenAI and GitHub key formats
+
+**Version / slug:** `outbound-credential-wall-modern-key-formats`
+**Date:** `2026-09-21`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (see appended section)`
+
+## Summary of the change
+
+The live-credential wall (`detectOutboundCredential`) is the one outbound check
+documented as non-overridable, but modern OpenAI project keys (`sk-proj-`, plus
+`sk-svcacct-`, `sk-admin-`, `sk-None-`, and OpenRouter's `sk-or-v1-`) and GitHub
+fine-grained tokens (`github_pat_`) passed it, and the LLM authority behind it
+passed them too. This change adds two lookbehind-anchored patterns to the shared
+`DURABLE_SECRET_PATTERNS` list (`src/core/durableSecretScrub.ts`), strips
+invisible interleave characters inside the wall only
+(`src/messaging/outbound-credential-guard.ts`), runs the wall ALONE on the two
+send paths that deliberately skip the full outbound authority (proxy/system-
+template Telegram replies; Agent-Health-lane attention items) via a new
+`refuseIfCredential` helper in `src/server/routes.ts`, brings eight hand-kept
+pattern copies up to the modern shapes in each file's own convention
+(`ContentClassifier`, `redactUrl`, `openConversationBrief`, `ExecutionJournal`,
+`scripts/audit-secret-patterns.mjs`, `PromiseBeacon`, `ClaimObservation`,
+`testAsSelfValidation`, and the embedded `post-action-reflection` hook template in
+`PostUpdateMigrator`), corrects the list's stale "ORDER MATTERS" comment, and
+linearises two PRE-EXISTING quadratic patterns (`jwt`, `url-embedded-credential`)
+that the spec's new falsifiable timing fixture exposed.
+
+Spec: `docs/specs/outbound-credential-wall-modern-key-formats.md` (converged in 3
+rounds, cross-model `codex-cli:gpt-6-astra`; approved by Justin 2026-09-21).
+
+**Scope note versus the approved spec.** The spec deferred the `jwt` quadratic to
+ACT-029 with a temporary timing exemption. During the build, the spec's own new
+unbroken-run fixture found a SECOND quadratic pattern, `url-embedded-credential`,
+which — unlike `jwt` — is a hard-wall kind and therefore runs on every outbound
+message (2.4 s at 64 KB; minutes at the 1 MB scan ceiling). Both turned out to
+have a one-token, detection-preserving fix (cap the unbounded leading quantifier),
+so both are fixed here and the exemption machinery the spec described is not
+built. This is strictly smaller and safer than the spec's plan; ACT-029 closes
+with this change.
+
+## Decision-point inventory
+
+- `detectOutboundCredential` (outbound live-credential wall) — **modify** — covers
+  six more issued key shapes; normalises invisible characters before matching.
+- Telegram reply route, proxy / system-template skip — **modify** — the wall now
+  runs before the skip; the skip continues to bypass tone judgment exactly as
+  before.
+- `POST /attention`, Agent-Health lane — **modify** — the wall now runs before the
+  lane branch; the lane continues to bypass the per-topic tone/jargon authority.
+- Durable-output redaction (all `scrubForStore` consumers) — **modify** — redacts
+  the six new shapes; two existing patterns made linear with identical detection.
+- Eight pattern copies — **modify** — each gains the modern shapes in its own
+  convention; none gains blocking authority it did not already have.
+
+---
+
+## 1. Over-block
+
+- **A long placeholder in the issued shape** (`sk-proj-` + 32 `X`s) is refused, by
+  design — the wall asserts shape, not liveness. Pinned by a unit test as the
+  intended behaviour.
+- **A hyphen-preceded kebab tail** such as `x-sk-proj-<32+ kebab chars>` is refused
+  (the lookbehind rejects only letter/digit-joined text). Separator-joined real
+  keys are plausible, so this is the chosen direction; pinned by a unit test.
+- Measured: over ~366 MB of real text on this machine (every stored Telegram
+  message, every tracked repo file, server logs, every JSON/JSONL state store),
+  the two new patterns match **zero** strings through the full shipped pipeline.
+  Prose that names the formats (`sk-proj-`, `github_pat_` with no body) and
+  letter-joined kebab slugs (`task-proj-…`, `desk-proj-…`) pass — pinned by tests.
+- The `jwt`/`url` caps change no verdict on any tested input (equivalence probes
+  in the unit suite, including a digit-prefixed scheme and a 200-char run).
+
+## 2. Under-block
+
+- **A key glued directly to a letter or digit** (`ENVsk-proj-…`) is not matched —
+  the accepted cost of the lookbehind that keeps kebab slugs from being refused.
+- **Cross-message, re-encoded (base64 etc.) or visibly interleaved keys** pass — a
+  per-message shape wall cannot see them; recorded in the spec's Known bypasses.
+- **Combining-mark interleaves outside the stripped set** (`\p{Cf}`, U+034F,
+  U+FE00–U+FE0F) pass the wall.
+- **Unwalled send surfaces remain**: `/publish`, `/view`, `/messages/send`,
+  `threadline_send`, the browser broker, and iMessage's text-less token path.
+  Tracked as ACT-028 (due 2026-10-11) with a per-surface decision required.
+- **The scrubber does not strip invisible characters** (its spans are offsets
+  into the original text), so an interleaved key refused outbound can still
+  persist unredacted in a durable store. Tracked under ACT-027.
+- **Three agent-installed copies** (`serendipity-capture.sh` template, the
+  `credential-leak-detector` skill content, and the remainder of a ~25-file
+  census) need migration machinery and are ACT-027 (due 2026-10-11).
+
+## 3. Level-of-abstraction fit
+
+Correct layer. The wall is a deterministic floor that runs before the LLM
+authority precisely so it holds when no verdict is available (provider outage,
+spawn-cap saturation). The two new route call sites reuse that same floor rather
+than inventing a parallel check; `refuseIfCredential` is the wall and nothing
+else, and returns the identical 422 body the in-funnel wall returns.
+
+## 4. Signal vs authority compliance
+
+Compliant under the documented exemption. `docs/signal-vs-authority.md` names
+"hard-invariant validation" and "safety guards on irreversible actions" as the
+cases where a deterministic check holds authority; a leaked credential cannot be
+un-leaked, and a vendor-assigned literal prefix is structured data, not meaning.
+No brittle check gains new blocking authority: the added patterns extend an
+existing invariant's coverage, and the route changes apply the existing invariant
+to paths that skipped it as an unintended side effect of skipping tone judgment.
+
+## 5. Interactions
+
+- **Shadows / is shadowed by:** on the normal reply path the wall still runs
+  inside `evaluateOutbound`; the new pre-skip call only fires when `isProxy` or a
+  system template is set, so there is no double-evaluation on the normal path.
+- **System templates** are fully anchored regexes with closed placeholder classes
+  (`{duration}`, `{category}`, `{short_id}`), so a system-template send can never
+  contain a credential; the new check is inert there by construction (kept as
+  defence-in-depth should a template ever gain free text).
+- **willRelay** hand-offs are deliberately unchanged: the lease holder's receive
+  path re-enters the full authority, which includes the wall.
+- **Redaction consumers** (`DurableOutputScrubber`, `MessagingToneGate` provenance,
+  `FeedbackDrainService`, `MutualSshHealthController`, `GoalRealignment`, two
+  direct `scrubForStore` call sites) gain the new shapes; the zero-match corpus
+  measurement says no existing stored or outgoing text changes.
+- **Timing:** the linearised `jwt`/`url` patterns remove a latent event-loop stall
+  on the tone gate's twice-per-message scrub and on the wall itself.
+
+## 6. External surfaces
+
+- A message carrying one of the six shapes now returns `422
+  credential-exposure-guard` instead of being delivered — the intended change,
+  visible to the sending agent, which is told to refer to the key by name.
+- Laned attention items and proxy replies carrying a key now get the same 422.
+- No change to any other agent, any config, or any external service. No timing
+  dependency.
+
+## 7. Multi-machine posture
+
+`unified`. Everything changed is code constants and code paths shipped identically
+to every machine by the release. No state, no replication, no URLs. During a
+rolling update an old-version machine still passes the new shapes until it
+updates; that window is owned by the version-skew machinery.
+
+## 8. Rollback cost
+
+Revert the commit. No configuration, migration or stored state to unwind. The
+`post-action-reflection` hook reverts on the next migration run (always-overwrite).
+Redactions already applied to durable stores while the patterns were live stay
+redacted — irreversible by the parent standard's design, and the intended
+direction for a security pattern.
+
+---
+
+## Second-pass review
+
+**Reviewer:** independent reviewer subagent, 2026-09-21.
+
+**Verdict: Concur with the review.** The reviewer checked every artifact claim against
+the diff and running code: identical 422 body, no double-evaluation on either route
+(the reply-route guard and `checkOutboundMessage` are mutually exclusive; laned vs
+non-laned attention items take disjoint paths), the rendered `PostUpdateMigrator`
+template regex, the lookbehind on real key shapes (bare, quoted, `KEY=`, `MY_KEY_`,
+backtick all matched; only letter/digit-glued missed, as documented), the `u` flag
+and raw-length-first ordering, and the `url` cap (no verdict change — the unanchored
+regex still starts inside an overlong scheme).
+
+Two nuances the reviewer raised, both acted on:
+
+1. **Stripping could glue a key to a preceding letter** (`ENV<ZWSP>ghp_…`): the raw
+   text has a word boundary, the stripped text does not, so a stripped-only scan
+   would have been a small regression against main for the older `\b`-anchored
+   patterns. **Fixed before commit:** the wall now scans the raw text and, when it
+   differs, the stripped text; a regression test pins the separated-key case.
+2. **The `jwt` cap is linear with a constant:** a 2,000-character dash-free header
+   segment matches under the old regex and not the new one (probability ~1e-7 for
+   base64url text, and `jwt` is scrub-only, not a wall kind), and a dash-dense 1 MB
+   input still costs ~2.2 s of scrubbing — bounded, not minutes. Accepted and
+   recorded here rather than claimed as free.