instar 1.3.1248 → 1.3.1249

package/scripts/jev-shadow-report.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * jev-shadow-report.mjs — read the Jev signal-layer shadow log and report the
+ * soak as PER-RULE CONFUSION MATRICES plus COVERAGE. Never one blended
+ * agreement percentage: 99% agreement can hide total failure on rare positives.
+ *
+ * Spec: docs/specs/jev-signal-layer-shadow.md (graduation criterion).
+ *
+ * Usage (from the agent home):
+ *   node scripts/jev-shadow-report.mjs [logPath] [--json]
+ * Default logPath: logs/jev-signal-shadow.jsonl
+ *
+ * Rows are deduplicated by sha256 (a message re-entering the gate on retry is
+ * one candidate, not two). Detector truth = the B1–B7 deterministic signal
+ * kinds recorded in the row; Jev "positive" = p > 0.5 (the frozen threshold).
+ */
+import fs from 'node:fs';
+
+const RULE_TO_KIND = {
+  raw_path: 'file-path', cli_command: 'cli-command', config_key: 'config-key',
+  api_endpoint: 'api-endpoint', copy_paste_code: 'copy-paste-code', env_var: 'env-var',
+  cron_or_slug: 'cron-or-slug',
+};
+const THRESHOLD = 0.5;
+const MIN_POSITIVES = 20;
+
+const args = process.argv.slice(2);
+const asJson = args.includes('--json');
+const logPath = args.find((a) => !a.startsWith('--')) ?? 'logs/jev-signal-shadow.jsonl';
+
+export function buildReport(lines) {
+  const seen = new Set();
+  const compared = [];
+  const notCompared = {};
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let row; try { row = JSON.parse(line); } catch { continue; }
+    if (row.kind === 'not-compared') { notCompared[row.reason] = (notCompared[row.reason] ?? 0) + 1; continue; }
+    if (row.kind !== 'compared' || seen.has(row.sha256)) continue;
+    seen.add(row.sha256);
+    compared.push(row);
+  }
+  const perRule = {};
+  for (const [rule, kind] of Object.entries(RULE_TO_KIND)) {
+    const m = { hits: 0, misses: 0, falseAlarms: 0, trueNegatives: 0, answered: 0 };
+    for (const r of compared) {
+      const p = r.jev?.[rule];
+      if (typeof p !== 'number') continue;
+      m.answered++;
+      const det = (r.detectorSignals ?? []).includes(kind);
+      const jev = p > THRESHOLD;
+      if (det && jev) m.hits++; else if (det && !jev) m.misses++;
+      else if (!det && jev) m.falseAlarms++; else m.trueNegatives++;
+    }
+    const positives = m.hits + m.misses;
+    m.positiveCases = positives;
+    m.agreement = m.answered ? +((m.hits + m.trueNegatives) / m.answered).toFixed(4) : null;
+    m.verdict = positives < MIN_POSITIVES ? 'insufficient-evidence'
+      : (m.agreement >= 0.99 && m.misses === 0 ? 'meets-bar' : 'below-bar');
+    perRule[rule] = m;
+  }
+  const notComparedTotal = Object.values(notCompared).reduce((a, b) => a + b, 0);
+  const candidates = compared.length + notComparedTotal;
+  return {
+    candidates,
+    comparedDistinct: compared.length,
+    coverage: candidates ? +(compared.length / candidates).toFixed(4) : null,
+    notCompared,
+    perRule,
+    graduationEligible: candidates > 0
+      && compared.length / candidates >= 0.9
+      && Object.values(perRule).every((m) => m.verdict !== 'below-bar')
+      && Object.values(perRule).some((m) => m.verdict === 'meets-bar'),
+  };
+}
+
+const isMain = import.meta.url === `file://${process.argv[1]}`;
+if (isMain) {
+  if (!fs.existsSync(logPath)) { console.error(`no shadow log at ${logPath}`); process.exit(1); }
+  const report = buildReport(fs.readFileSync(logPath, 'utf8').split('\n'));
+  if (asJson) { console.log(JSON.stringify(report, null, 2)); process.exit(0); }
+  console.log(`candidates ${report.candidates} · compared (distinct) ${report.comparedDistinct} · coverage ${report.coverage}`);
+  console.log(`not compared: ${JSON.stringify(report.notCompared)}`);
+  console.log('rule              positives  hits  misses  falseAlarms  agreement  verdict');
+  for (const [rule, m] of Object.entries(report.perRule)) {
+    console.log(`${rule.padEnd(17)} ${String(m.positiveCases).padStart(9)} ${String(m.hits).padStart(5)} ${String(m.misses).padStart(7)} ${String(m.falseAlarms).padStart(12)}  ${String(m.agreement).padStart(9)}  ${m.verdict}`);
+  }
+  console.log(`graduation-eligible: ${report.graduationEligible}`);
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-09-21T17:27:53.392Z",
-  "instarVersion": "1.3.1248",
+  "generatedAt": "2026-09-21T17:48:31.257Z",
+  "instarVersion": "1.3.1249",
   "entryCount": 203,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:telegram-origin-guard": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -110,7 +110,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -119,7 +119,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -137,7 +137,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -155,7 +155,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1571,7 +1571,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "47219bc1cb94a5e296cc89c92565e6fecdb6ba34e55aa0c6234b625e37407072",
+      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1248",
+  "packageVersion": "1.3.1249",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "002e6d36582289c4504e8112433527c2ad992e229e80012541d72a00785c0210",
+  "sha256": "da9c464af31b76d291aca99a5c3c89118da1ff2a46d113e7a4af5409206a9f5c",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1248"
+  "packageVersion": "1.3.1249"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
   "articleCount": 91,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1248"
+  "packageVersion": "1.3.1249"
 }

package/upgrades/{1.3.1248.md → 1.3.1249.md}

@@ -23,6 +23,20 @@ Two honesty fixes ride along. An account that genuinely reports no usage window
 
 This is a reader and presentation fix. No routing, placement, load-shedding or proactive-swap threshold changed. Their input improves — two exhausted accounts now present a real number where they previously presented nothing — which makes them more likely to route work away from a full account, not less.
 
+A new, dark research instrument: the Jev signal-layer shadow. When turned on, every
+message reaching the outbound tone gate is also shown to TypeSafe's Jev model with
+seven yes/no questions — one for each existing deterministic check for jargon a
+user shouldn't see (raw paths, terminal commands, config keys, internal endpoints,
+paste-and-run code, environment variables, cron strings and internal ids). Each
+answer is compared with what the existing check found and a content-free row is
+written to `logs/jev-signal-shadow.jsonl`. It decides nothing, is never waited on,
+and never stores message text.
+
+It ships OFF (`intelligence.jevSignalShadow.enabled: false`), and it stays inert
+even when enabled unless a future `soakEndsAt` is set and a `typesafe_api_key` is in
+the vault. `scripts/jev-shadow-report.mjs` turns the log into per-check agreement
+tables. Existing agents receive the dark default block on update.
+
 The outbound live-credential wall — the one check that stops a message carrying an
 API key or token from being sent, and the one check that cannot be overridden — did
 not recognise the key formats providers issue today. Modern OpenAI keys
@@ -62,6 +76,10 @@ Two things will look a little different. An account that genuinely has no weekly
 
 Nothing about how your work is spread across accounts changed.
 
+Nothing changes for you. This adds a measuring tool I can switch on for a limited
+time to test whether a small, cheap model can take over some of the checks I run
+on my own messages. It never changes, delays or blocks what I send.
+
 If I ever try to send you a message containing one of today's API keys or access
 tokens — the current OpenAI and OpenRouter key formats, or GitHub's newer
 fine-grained tokens — it is now stopped before it reaches you, the same way older key
@@ -86,6 +104,10 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 - Quota readings older than six hours are labelled with their age on the Subscriptions card.
 - Back-compatible: rollouts with no `limit_id` are still read as codex-family; the new snapshot field is optional and absent on existing stored state.
 
+- Dark, time-bounded comparison of Jev against the B1–B7 outbound jargon checks.
+- Content-free comparison log plus a per-check confusion-matrix report script.
+- Shadow calls metered under feature `jev-signal-shadow` in the LLM metrics.
+
 - The non-overridable outbound credential wall covers modern OpenAI, OpenRouter and GitHub fine-grained key formats.
 - Invisible-character interleaving no longer hides a key from the wall.
 - Proxy replies and Agent-Health-lane attention items are covered by the wall.
@@ -112,6 +134,10 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 - Unit (`tests/unit/quota-poller.test.ts`, 26 passing): both sides of the boundary — a windowless reading sets `noQuotaWindow`, a windowed one does not.
 - Unit (`tests/unit/subscriptions-render.test.ts`, 97 passing): the three distinct card states (a bar, "reports no usage window", "No quota reading yet") and the age label appearing above the six-hour threshold and not below it.
 
+- Unit `tests/unit/JevSignalShadow.test.ts` (17 passing): question set covers every detector kind; inert when disabled, with no soak window, past it, or without a key; compared and every not-compared reason reachable; no message text in any row or from a vendor error body; synchronous, never-throwing `observe()`; key cached; metering recorded.
+- Integration `tests/integration/jev-signal-shadow-gate.test.ts` (6 passing): real gate verdict identical with a disabled shadow; verdict returns while the Jev call hangs; a throwing observer or a network failure cannot break the gate; report script builds deduplicated confusion matrices.
+- E2E `tests/e2e/jev-signal-shadow-lifecycle.test.ts` (3 passing): the update path installs the dark default idempotently; the shipped state makes no call and writes no row; flipping the config with no restart produces a compared row.
+
 - Unit `tests/unit/outbound-credential-wall-modern-formats.test.ts` (65 passing): every modern issued shape refused (generated at test time, nothing committed); no regression on older shapes; drift guard mapping every messaging pattern type to a wall kind or a stated exemption; cross-file ratchet over the eight copies; no false positives on prose, bare prefixes and kebab slugs; invisible-character strip across nine classes plus the separated-key regression guard; oversize still fails closed; scrubber offsets stay valid; per-pattern linear-time budget on a 64 KB unbroken run with interior word boundaries (no exemptions); capped `jwt`/`url` detection equivalence.
 - Integration `tests/integration/telegram-reply-advisory-migration.test.ts` (18 passing): modern keys refused on a normal reply, on a proxy reply, and in a laned attention item; a clean proxy reply still sends.
 - E2E `tests/e2e/tone-gate-advisory-migration-alive.test.ts` (12 passing): modern keys refused on the real boot.

package/upgrades/side-effects/jev-signal-shadow.md

@@ -0,0 +1,138 @@
+# Side-Effects Review — Jev signal-layer shadow (dark, measure-only)
+
+**Version / slug:** `jev-signal-shadow`
+**Date:** `2026-09-21`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (see appended section)`
+
+## Summary of the change
+
+Adds `JevSignalShadow` (`src/core/JevSignalShadow.ts`), a research instrument that
+sends each message reaching the outbound tone gate to TypeSafe's Jev model with
+seven yes/no questions — one per deterministic B1–B7 artefact detector — and logs a
+content-free comparison row to `logs/jev-signal-shadow.jsonl`. `MessagingToneGate`
+gains `setSignalShadow()` and calls `observe(text)` once at the top of `review()`
+inside a try/catch; `observe()` is synchronous, never throws, and never awaited.
+`server.ts` constructs it after the tone gate with a live config read, the vault key
+`typesafe_api_key`, and the feature-metrics recorder. `PostUpdateMigrator.migrateConfig`
+adds the dark default `intelligence.jevSignalShadow` block (enabled:false,
+soakEndsAt:null). `scripts/jev-shadow-report.mjs` reads the log into per-rule
+confusion matrices plus coverage.
+
+Spec: `docs/specs/jev-signal-layer-shadow.md` (converged; approved by Justin
+2026-09-21, including the soak egress approval).
+
+## Decision-point inventory
+
+- *(none)* — the shadow writes an audit row and nothing reads it on any decision
+  path. `MessagingToneGate.review()` gains one guarded fire-and-forget call before
+  its existing logic; the verdict computation is untouched.
+
+---
+
+## 1. Over-block
+
+No issue identified. The shadow holds no authority and cannot refuse, delay or alter
+a message. Proven by the integration test that runs the real gate against a Jev stub
+that never settles: the verdict returns while the call is still pending.
+
+## 2. Under-block
+
+Not applicable — it blocks nothing. What it can MISS as an instrument is recorded,
+not hidden: every candidate that is not compared produces a row with a closed-enum
+reason (timeout, http-error, oversize, skipped-concurrent, skipped-sample,
+model-mismatch, disabled-no-key, soak-expired), so the report's coverage figure is
+honest. Standing conditions (no key, soak expired) write one row per process, not
+one per message.
+
+## 3. Level-of-abstraction fit
+
+The tone gate is the one place every outbound message already passes with its
+detector signals available, so observing there is the correct layer. The shadow
+re-runs `detectGateSignals` itself (cheap, deterministic) rather than threading
+state out of the gate, keeping zero shared state with the decision path.
+
+## 4. Signal vs authority compliance
+
+Pure signal, and not even a consumed one yet: the output is a log for a later human
+decision. Per `docs/signal-vs-authority.md`, adding an unconsumed detector is the
+safest possible shape. Graduation into any authority is explicitly a separate spec.
+
+## 5. Interactions
+
+- **Gate latency:** synchronous cost per candidate is one config read, one sha256
+  (over at most the first 1 MB), one small append for any not-compared row
+  (skipped-sample, oversize, skipped-concurrent), and (when dispatching) one
+  detector pass and one JSON body. The vault key — a lookup that can block on a
+  macOS keychain subprocess — is read at construction (boot); after a miss or a 401/403 it is re-read at most once per 10 minutes, so a
+  revoked key costs one lookup per 10 minutes, not one per message. That rate-limited
+  re-read does run synchronously on the gate path, and only while the shadow is
+  enabled with a missing or revoked key. A key added to
+  the vault later is picked up within 10 minutes, no restart.
+  Network runs detached. Single-flight: at most one call in flight per process;
+  overflow is a row, never a queue, so a slow vendor cannot build memory pressure.
+- **Feature metrics:** each call records under feature `jev-signal-shadow`,
+  framework `typesafe-api`, so token spend appears in `/metrics/features` beside
+  other LLM features. No double-counting with the gate's own LLM call.
+- **Credential wall:** unaffected; the shadow sees the same text the gate sees and
+  sends it only to TypeSafe, and only while enabled.
+- **Tests:** the shadow is optional (`signalShadow?`); every existing tone-gate test
+  constructs the gate without one and is unchanged.
+
+## 6. External surfaces
+
+While ENABLED, message text reaching the gate is sent to one more third party
+(TypeSafe, under the MCA accepted 2026-09-20). This is the egress the operator
+approved explicitly in the spec (`soak-egress-approved: true`). Ships DISABLED; the
+14-day bound is mechanical (`soakEndsAt`, checked per candidate, survives restarts).
+Log rows never contain message text: sha256, byte length, detector kinds, Jev
+probabilities, reason enum. A vendor error body is never recorded. The vault key is
+read once and cached, re-read only after a 401/403, and never logged.
+
+## 7. Multi-machine posture
+
+Machine-local BY DESIGN. The log is this machine's observation of its own gate
+traffic (observation locality). Config is ordinary per-machine config; the soak is
+enabled on this dev agent only. No user-facing notices, no durable state that must
+follow a topic, no URLs.
+
+## 8. Rollback cost
+
+Operational: set `intelligence.jevSignalShadow.enabled` false — read live per
+candidate, no restart. Code: revert the commit; the config block left behind is
+inert (nothing else reads it). The log is inert data.
+
+## Second-pass review
+
+**Reviewer:** independent reviewer subagent
+**Verdict:** Concern raised: the vault key read runs synchronously on the gate path, and after a 401/403 it runs again on every dispatched candidate.
+
+The concern:
+- `observeInner()` calls `readKey()` inline, inside `MessagingToneGate.review()`, whenever `cachedKey === undefined`. In production `readKey` builds a `SecretStore` and calls `.get()`. On macOS that resolves the master key with `execFileSync('security', …, { timeout: 5000 })`, which is a synchronous subprocess that blocks the whole event loop. It can take up to 5 s per lookup, and the resolution order may try two keychain accounts. This cost lands on the first enabled candidate.
+- After a 401/403, `dispatch` resets `cachedKey = undefined`. The next candidate then re-reads the key synchronously. The key read happens before the single-flight check, so a revoked key that stays in the vault leads to one blocking keychain spawn per dispatched candidate, for the whole soak. The spec forbids exactly this ("never a per-call decrypt on the event loop", "never a gate delay").
+- Suggested fix: resolve the key off the message path. Either read it inside the detached `dispatch()`, or warm it at construction or on a `setImmediate`. Also latch an auth failure, for example to a `disabled-no-key`-class status with a bounded re-read interval, instead of re-reading on every candidate.
+
+Smaller accuracy points for this artifact (not blocking):
+- §5 "Interactions / Gate latency" lists the synchronous cost as config read, sha256, detector pass and JSON body. It leaves out two synchronous costs: the keychain read above, and the `mkdirSync` + `appendFileSync` for the `not-compared` rows (`skipped-sample`, `oversize`, `skipped-concurrent`, status rows). Those rows are written on the gate path.
+- The sha256 is computed over the full text before the 1 MB size guard, so hashing an oversize message is not bounded by the guard.
+- A missing key is cached as `null` for the life of the process, so a key added to the vault after enabling needs a restart. That is consistent with "read once", but the operator should be told.
+- The e2e test wires the real gate to a shadow built in the test. It does not exercise the `server.ts` construction: the live `intelligence.jevSignalShadow` read, the `SecretStore` key read and the `logs/` path. The tone-gate lifecycle standard asks for a test of the production initialization path.
+
+What I checked and found sound:
+- Verdict isolation: `observe()` is wrapped in try/catch both in the module and at the call site. `dispatch` is async and chained with `.catch().finally()`, so no promise rejection goes unhandled. `review()` never awaits the dispatch. The abort timer is bounded by `timeoutMs` and cleared in `finally`, so it cannot keep the process alive past that bound.
+- Single-flight: `inFlight` is set only after every early return, and it is reset in `.finally()` on every path. `write()` and the metrics call each swallow their own errors, so neither can skip the reset.
+- Leakage: rows carry only the sha256, byte length, detector kinds, probabilities, model and a closed-enum reason. The vendor response body is never read on a non-OK status. The API key appears only in the request header and never reaches a row, a metric or the console. The construction-failure log line prints only the error message.
+- Disabled means inert: `enabled !== true` returns before hashing, any key read, any network call or any row. The integration and e2e tests assert zero rows.
+- The soak bound is mechanical: a missing, unparseable or past `soakEndsAt` is inert and checked on every candidate. The block is read from live config, so the bound survives restarts. It writes one status row per process.
+- Spec coverage: the closed reason set is complete and each reason has a test. Model pinning and `model-mismatch` exclusion, the migration (existence-checked, idempotent), the feature-metrics metering and the report script (dedupe by hash, per-rule confusion matrices, coverage, insufficient-evidence under 20 positives) are all present. All 26 tests in the three new files pass. The enabled-vs-disabled latency measurement belongs to the test-agent-live stage and is not claimed as done here.
+
+### Re-review after fixes
+
+**Verdict:** Concur with the review
+
+- **Key read:** the constructor now reads the key once, at boot, through `refreshKey()`. A missing key, or a 401/403 (which clears both the key and the timestamp), is re-read at most once per `KEY_REREAD_MS` (10 min). The earlier failure mode, one blocking keychain spawn per dispatched message with a revoked key, is gone.
+- **One wording point, not blocking:** a rate-limited re-read still runs synchronously inside `observeInner()`, so on the message path. The cost is at most one lookup per 10 minutes, and only while the shadow is enabled with a missing or revoked key. That bound is acceptable. §5's "never on the message path" should be read as applying to the first read only.
+- **Boot-time read on dark agents:** construction now does a vault read at boot on every agent, including ones where the shadow is disabled. That is harmless. `SecretStore.read()` returns `{}` without touching the keychain when no vault file exists, it never generates a key on this path, and other boot code already reads the vault.
+- **Hash bound:** sha256 is now computed over at most the first `maxScanBytes`, so hash cost is bounded.
+- **Production wiring:** it is extracted into `buildJevSignalShadow()`. `server.ts` and the e2e test both build through it (live `intelligence` read, `readSecret('typesafe_api_key')`, the `logs/` path), so Tier 3 now covers the production construction path.
+- **Everything else still holds:** single-flight reset, no rejection left unhandled, no leakage, disabled is inert, and the mechanical soak bound are unchanged. The three test files now hold 29 tests (up from 26), and all pass.