instar 1.3.1248 → 1.3.1250

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -124,6 +124,26 @@ LEGACY_STATE=".instar/autonomous-state.local.md"
 MULTI_DIR=".instar/autonomous"
 LIVENESS_SECS="${INSTAR_AUTONOMOUS_LIVENESS_SECS:-120}"
 
+# ── VAULT_AUTH_RESOLVE — the server bearer token, vault-aware. config.json's
+# authToken becomes a SecretMigrator placeholder ({"secret": true}) once an
+# agent's secrets move to the encrypted vault; the old inline reads then printed
+# the literal placeholder and every server call 403'd — on an admission-enforcing
+# install the run registered nothing and sat "preparing" forever (the 2026-09-19
+# silent no-start). Prefer a real string from config; otherwise read the vault
+# via the hardened secret-get script (value to stdout only, never logged).
+resolve_auth_token() {
+  local t
+  t=$(python3 -c "import json
+try:
+ v=json.load(open('.instar/config.json')).get('authToken','')
+ print(v if isinstance(v,str) else '')
+except Exception: print('')" 2>/dev/null || echo "")
+  if [[ -n "$t" ]]; then printf '%s' "$t"; return 0; fi
+  if [[ -f .instar/scripts/secret-get.mjs ]]; then
+    node .instar/scripts/secret-get.mjs authToken 2>/dev/null || true
+  fi
+}
+
 # The sole shell adapter for bounded task continuation. The TypeScript store and
 # authenticated decision route remain the mutation/decision authority.
 continuation_decision() {
@@ -132,7 +152,7 @@ continuation_decision() {
   [[ -n "$MY_TOPIC" ]] || return 0
   local port auth agent_id decision reason
   port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  auth=$(resolve_auth_token)
   agent_id=$(python3 -c "import json;c=json.load(open('.instar/config.json'));print(c.get('projectName') or c.get('agentName') or 'local-stop-hook')" 2>/dev/null | tr -d '\r\n' || echo "local-stop-hook")
   [[ -n "$agent_id" ]] || agent_id="local-stop-hook"
   decision=$(jq -nc --arg topicId "$MY_TOPIC" --arg sessionId "$HOOK_SESSION" '{topicId:$topicId,sessionId:$sessionId}' \
@@ -471,7 +491,7 @@ run_end_call() {
   fi
   local re_port re_auth
   re_port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  re_auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  re_auth=$(resolve_auth_token)
   jq -nc --arg r "$reason" --arg id "${RUN_ID:-}" --argjson met "$re_met" --argjson terminal "$terminal" \
     --argjson configured "$re_configured" --arg outcome "$re_outcome" --arg exit "$re_exit" \
     '{reason:$r,met:$met,terminal:$terminal,realcheck:(if $configured then ({configured:true,outcome:$outcome} + (if $exit != "" then {exitCode:($exit|tonumber)} else {} end)) else {configured:false} end)} + (if $id != "" then {runId:$id} else {} end)' 2>/dev/null \
@@ -570,7 +590,7 @@ if [[ "$GOAL_MODE" == "native" ]]; then
   native_goal_clear() {
     local port auth
     port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-    auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+    auth=$(resolve_auth_token)
     jq -nc --arg t "$REPORT_TOPIC" '{topicId:$t}' \
       | curl -s -m 10 -H "Authorization: Bearer $auth" -H 'Content-Type: application/json' \
         --data-binary @- "http://localhost:${port}/autonomous/native-goal/clear" >/dev/null 2>&1 || true
@@ -825,7 +845,7 @@ cd_raise_attention_item() {
   fi
   local at_port at_auth at_id at_summary
   at_port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  at_auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  at_auth=$(resolve_auth_token)
   # One item per run (id keyed on topic+started_at): a re-fire within the same run
   # reuses the id so the attention store de-dups rather than piling up items.
   at_id="autonomous-hard-blocker-${REPORT_TOPIC:-none}-$(printf '%s' "${STARTED_AT:-}" | tr -cd '0-9')"
@@ -918,7 +938,7 @@ p13_stop_allowed() {
   fi
   [[ -z "$p13_tail" ]] && return 0
   p13_port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  p13_auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  p13_auth=$(resolve_auth_token)
   if [[ "$CD_ENABLED" == "1" ]]; then
     local sig; sig=$(build_signals_json "$stop_kind" "false")
     p13_payload=$(jq -nc --arg t "$p13_tail" --argjson sig "$sig" '{transcriptTail:$t, signals:$sig}')
@@ -1037,7 +1057,7 @@ realcheck_raise_attention() {
   fi
   local at_port at_auth at_id
   at_port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  at_auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  at_auth=$(resolve_auth_token)
   at_id="autonomous-realcheck-stuck-${REPORT_TOPIC:-none}-$(printf '%s' "${STARTED_AT:-}" | tr -cd '0-9')"
   jq -nc \
     --arg id "$at_id" \
@@ -1222,7 +1242,7 @@ run_verification() {
   #    authToken literal + a generic Bearer token.
   local rc_leak=0 rc_auth_val
   if [[ "$(hb_leak_hit "$rc_utf8")" == "1" ]]; then rc_leak=1; fi
-  rc_auth_val=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  rc_auth_val=$(resolve_auth_token)
   if [[ $rc_leak -eq 0 ]] && [[ -n "$rc_auth_val" ]] && printf '%s' "$rc_utf8" | grep -qF "$rc_auth_val" 2>/dev/null; then rc_leak=1; fi
   if [[ $rc_leak -eq 0 ]] && printf '%s' "$rc_utf8" | grep -qE 'Bearer [A-Za-z0-9._-]{20,}' 2>/dev/null; then rc_leak=1; fi
   if [[ $rc_leak -eq 1 ]]; then
@@ -1458,7 +1478,7 @@ if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$COMPLETION_CONDITION" ]]
       | jq -r '.message.content | map(select(.type=="text")) | map(.text) | join("\n")' 2>/dev/null \
       | tail -c 8000 || echo "")
     EVAL_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-    EVAL_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+    EVAL_AUTH=$(resolve_auth_token)
     # SCOPE_ACCRETION — echo topicId/runId/sessionId so the server resolves the
     # run against its OWN registration record (R35 arming; R36 registered-
     # condition authority; §6 runId pair check). Empty fields are omitted.

package/.claude/skills/autonomous/scripts/setup-autonomous.sh

@@ -6,6 +6,26 @@
 
 set -euo pipefail
 
+# ── VAULT_AUTH_RESOLVE — the server bearer token, vault-aware. config.json's
+# authToken becomes a SecretMigrator placeholder ({"secret": true}) once an
+# agent's secrets move to the encrypted vault; the old inline reads then printed
+# the literal placeholder and every server call 403'd — on an admission-enforcing
+# install the run registered nothing and sat "preparing" forever (the 2026-09-19
+# silent no-start). Prefer a real string from config; otherwise read the vault
+# via the hardened secret-get script (value to stdout only, never logged).
+resolve_auth_token() {
+  local t
+  t=$(python3 -c "import json
+try:
+ v=json.load(open('.instar/config.json')).get('authToken','')
+ print(v if isinstance(v,str) else '')
+except Exception: print('')" 2>/dev/null || echo "")
+  if [[ -n "$t" ]]; then printf '%s' "$t"; return 0; fi
+  if [[ -f .instar/scripts/secret-get.mjs ]]; then
+    node .instar/scripts/secret-get.mjs authToken 2>/dev/null || true
+  fi
+}
+
 # Parse arguments
 GOAL=""
 DURATION="4h"
@@ -137,7 +157,7 @@ HARD_BLOCKER_NONCE=$(openssl rand -hex 8 2>/dev/null || head -c 16 /dev/urandom
 # holds. Starting/restarting THIS topic's own job is always allowed.
 if [[ -n "$REPORT_TOPIC" ]]; then
   PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  AUTH=$(resolve_auth_token)
   CAN_START=$(curl -s -m 3 -H "Authorization: Bearer $AUTH" "http://localhost:${PORT}/autonomous/can-start?priority=medium" 2>/dev/null || echo "")
   ALLOWED=$(printf '%s' "$CAN_START" | python3 -c "import sys,json
 try: print(json.load(sys.stdin).get('allowed'))
@@ -154,7 +174,12 @@ except Exception: print('')" 2>/dev/null || echo "")
   fi
   if [[ "$ALLOWED" == "unknown" ]] && [[ "$ALREADY_RUNNING" != "true" ]]; then
     MAX_CONCURRENT=$(python3 -c "import json;print((json.load(open('.instar/config.json')).get('autonomousSessions') or {}).get('maxConcurrent',5))" 2>/dev/null || echo 5)
-    COUNT=$(ls .instar/autonomous/*.local.md 2>/dev/null | grep -cv "/${REPORT_TOPIC}\.local\.md$")
+    # VAULT_AUTH_RESOLVE: grep -c exits 1 on zero matches, and under
+    # `set -euo pipefail` that killed the WHOLE setup silently (exit 1, no
+    # output) whenever this fallback ran (server unreachable → allowed
+    # "unknown") and no OTHER topic had a state file — a silent no-start.
+    # `|| true` keeps grep's "0" output.
+    COUNT=$(ls .instar/autonomous/*.local.md 2>/dev/null | grep -cv "/${REPORT_TOPIC}\.local\.md$") || true
     COUNT=${COUNT:-0}
     if [[ "$COUNT" =~ ^[0-9]+$ ]] && [[ "$MAX_CONCURRENT" =~ ^[0-9]+$ ]] && [[ $COUNT -ge $MAX_CONCURRENT ]]; then
       echo "❌ Autonomous start refused: concurrency cap reached ($COUNT/$MAX_CONCURRENT) [server unreachable; local check]." >&2
@@ -225,7 +250,7 @@ else
 fi
 if [[ -n "$REPORT_TOPIC" ]]; then
   REG_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-  REG_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  REG_AUTH=$(resolve_auth_token)
   # Comma-separated → JSON array (empty string → []).
   REG_DECLARED=$(printf '%s' "$DECLARED_DELIVERABLES" | python3 -c "import sys,json
 print(json.dumps([p.strip() for p in sys.stdin.read().split(',') if p.strip()]))" 2>/dev/null || echo '[]')
@@ -238,8 +263,10 @@ print(json.dumps([p.strip() for p in sys.stdin.read().split(',') if p.strip()]))
     '{topicId:$t,condition:$c,workDir:$w,declaredDeliverables:$d,startedAt:$s}
      + (if $e != "" then {endAt:$e} else {} end)
      + (if $sid != "" then {sessionId:$sid} else {} end)' 2>/dev/null \
-    | curl -s -m 8 -H "Authorization: Bearer $REG_AUTH" -H 'Content-Type: application/json' \
+    | curl -s -m 8 -w '\n%{http_code}' -H "Authorization: Bearer $REG_AUTH" -H 'Content-Type: application/json' \
       --data-binary @- "http://localhost:${REG_PORT}/autonomous/register" 2>/dev/null || echo "")
+  REG_CODE=$(printf '%s' "$REG_RESP" | tail -n 1)
+  REG_RESP=$(printf '%s' "$REG_RESP" | sed '$d')
   RUN_ID=$(printf '%s' "$REG_RESP" | python3 -c "import sys,json
 try: print(json.load(sys.stdin).get('runId',''))
 except Exception: print('')" 2>/dev/null || echo "")
@@ -252,6 +279,13 @@ except Exception: print('')" 2>/dev/null || echo "")
   fi
   if [[ -n "$RUN_ID" ]]; then
     echo "  Scope-accretion: run registered server-side (runId $RUN_ID)"
+  elif [[ "$REG_CODE" == "401" || "$REG_CODE" == "403" ]]; then
+    echo "  ERROR: run registration REFUSED (HTTP $REG_CODE) — the server rejected the bearer token." >&2
+    echo "  The token lives in the encrypted vault on migrated agents; this script resolves it via resolve_auth_token()." >&2
+    if [[ "$RUN_STATUS" == "preparing" ]]; then
+      echo "  ABORTING SETUP: this install requires server admission before a run can arm; an unregistered run would sit 'preparing' forever (the silent no-start this guard closes)." >&2
+      exit 1
+    fi
   else
     echo "  Scope-accretion: server registration unavailable — accretion gate degrades honestly (run still bounded by duration)"
   fi
@@ -345,7 +379,7 @@ if [[ -n "$COMPLETION_CONDITION" ]] && [[ -n "$REPORT_TOPIC" ]]; then
   fi
   if [[ "$NATIVE_GOAL_OK" == "true" ]]; then
     NG_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
-    NG_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+    NG_AUTH=$(resolve_auth_token)
     jq -nc --arg t "$REPORT_TOPIC" --arg c "$COMPLETION_CONDITION" '{topicId:$t,condition:$c}' \
       | curl -s -m 8 -H "Authorization: Bearer $NG_AUTH" -H 'Content-Type: application/json' \
         --data-binary @- "http://localhost:${NG_PORT}/autonomous/native-goal/set" >/dev/null 2>&1 \

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAysvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4tvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -17178,6 +17178,26 @@ export async function startServer(options) {
                 return resolveToneGateOperatorConfig(live && typeof live === 'object' ? { ...config, toneGate: live } : config);
             });
             console.log(pc.green('  Messaging tone gate: active (Haiku via shared IntelligenceProvider)'));
+            // Jev signal-layer shadow (dark by default; spec
+            // docs/specs/jev-signal-layer-shadow.md). Always constructed so the live
+            // config can switch it on without a restart; it is inert unless enabled,
+            // inside its soak window, and a vault key exists.
+            try {
+                const { buildJevSignalShadow } = await import('../core/JevSignalShadow.js');
+                const { getFeatureMetricsRecorder } = await import('../core/CircuitBreakingIntelligenceProvider.js');
+                const { SecretStore } = await import('../core/SecretStore.js');
+                const shadow = buildJevSignalShadow({
+                    readLiveIntelligence: () => liveConfig.get('intelligence', undefined),
+                    bootBlock: config.intelligence?.jevSignalShadow,
+                    readSecret: (name) => new SecretStore({ stateDir: config.stateDir, forceFileKey: config.secrets?.forceFileKey }).get(name),
+                    stateDir: config.stateDir,
+                    metrics: { record: (r) => getFeatureMetricsRecorder()?.record(r) },
+                });
+                messagingToneGate.setSignalShadow(shadow);
+            }
+            catch (err) {
+                console.log(pc.yellow(`  Jev signal shadow: not constructed (${err?.message ?? 'unknown'})`));
+            }
         }
         else {
             console.log(pc.yellow('  Messaging tone gate: inactive (no IntelligenceProvider available)'));