instar 1.3.1335 → 1.3.1336

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1335",
+  "packageVersion": "1.3.1336",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "192708e0596041ea998bfadb1f25e4bf3ad421836bc2968f5161f8540f091c41",
+  "sha256": "aca43025a5acfdf9c9a6eee3c9fc8a023d94ca429fcf36c65993528a00272429",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1335"
+  "packageVersion": "1.3.1336"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
   "articleCount": 92,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1335"
+  "packageVersion": "1.3.1336"
 }

package/dist/identity/IdentityManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityManager.d.ts","sourceRoot":"","sources":["../../src/identity/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqBH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAElB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,qBAAqB;IACpC,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAkC;gBAEtC,QAAQ,EAAE,MAAM;IAK5B;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,GAAE,qBAA0B,GAAG,oBAAoB;IA8DjE;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,iBAAiB,GAAG,IAAI;IAqDjE;;OAEG;IACH,GAAG,IAAI,iBAAiB,GAAG,IAAI;IAI/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;OAGG;IACH,OAAO,IAAI,YAAY,GAAG,IAAI;IAM9B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,WAAW;CAGpB"}
+{"version":3,"file":"IdentityManager.d.ts","sourceRoot":"","sources":["../../src/identity/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqBH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAElB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,qBAAqB;IACpC,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAkC;gBAEtC,QAAQ,EAAE,MAAM;IAK5B;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,GAAE,qBAA0B,GAAG,oBAAoB;IA8DjE;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,iBAAiB,GAAG,IAAI;IAmEjE;;OAEG;IACH,GAAG,IAAI,iBAAiB,GAAG,IAAI;IAI/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;OAGG;IACH,OAAO,IAAI,YAAY,GAAG,IAAI;IAM9B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,WAAW;CAGpB"}

package/dist/identity/IdentityManager.js

@@ -107,7 +107,15 @@ export class CanonicalIdentityManager {
             return null;
         const file = loaded.raw;
         let privateKey;
-        if (file.privateKeyEncryption === 'none') {
+        // The pairing installer (installAgentIdentityFromPairing) writes a
+        // plaintext key with no `privateKeyEncryption` field (spec:
+        // joined-machine-unified-trust). An ABSENT field therefore means 'none'.
+        // readIdentityKeyFile has already validated that file as a plaintext pair
+        // (32-byte seed whose public key matches), so a ciphertext key without the
+        // field never reaches here. A field that is present but holds anything
+        // other than the two known methods is still refused below.
+        const declaresNoEncryption = file.privateKeyEncryption === 'none' || !('privateKeyEncryption' in loaded.raw);
+        if (declaresNoEncryption) {
             privateKey = loaded.privateKey;
         }
         else if (file.privateKeyEncryption === 'xchacha20-poly1305+argon2id') {
@@ -129,13 +137,17 @@ export class CanonicalIdentityManager {
         else {
             throw new Error(`Unknown encryption method: ${file.privateKeyEncryption}`);
         }
+        // The installer shape also carries no canonicalId / displayFingerprint.
+        // Both are pure functions of the public key, so derive them when absent
+        // (or empty).
+        const canonicalId = file.canonicalId || computeCanonicalId(loaded.publicKey);
         const identity = {
             version: file.version,
             publicKey: loaded.publicKey,
             privateKey,
             x25519PublicKey: deriveX25519PublicKey(privateKey),
-            canonicalId: file.canonicalId,
-            displayFingerprint: file.displayFingerprint,
+            canonicalId,
+            displayFingerprint: file.displayFingerprint || computeDisplayFingerprint(canonicalId),
             createdAt: file.createdAt,
             recoveryCommitment: file.recoveryCommitment,
             migrationComplete: file.migrationComplete,

package/dist/identity/IdentityManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityManager.js","sourceRoot":"","sources":["../../src/identity/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAIxB,MAAM,YAAY,CAAC;AAsBpB,wEAAwE;AAExE,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IAC9B,QAAQ,GAA6B,IAAI,CAAC;IAElD,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAiC,EAAE;QACxC,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,cAAkC,CAAC;QACvC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,YAAgC,CAAC;QAErC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,GAAG,sBAAsB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACrC,MAAM,eAAe,GAAG,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACrE,kBAAkB,GAAG,wBAAwB,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7F,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,uDAAuD;QACvD,IAAI,cAAsB,CAAC;QAC3B,IAAI,UAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAEhC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;YAC5B,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjF,UAAU,GAAG,6BAA6B,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,OAAO,EAAE,uBAAuB;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,cAAc;YAC1B,oBAAoB,EAAE,UAAU;YAChC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,WAAW;YACX,kBAAkB;YAClB,GAAG,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEvB,MAAM,QAAQ,GAAsB;YAClC,OAAO,EAAE,uBAAuB;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1D,WAAW;YACX,kBAAkB;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB;SACnB,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,UAA+B,EAAE;QACpC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAA8B,CAAC;QAEnD,IAAI,UAAkB,CAAC;QAEvB,IAAI,IAAI,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YACzC,UAAU,GAAG,MAAM,CAAC,UAAW,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,CAAC,oBAAoB,KAAK,6BAA6B,EAAE,CAAC;YACvE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,UAAW,EAAE,IAAI,CAAC,CAAC;YAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,IAAI,wBAAwB,CAChC,IAAI,CAAC,YAAY,EACjB,gCAAgC,UAAU,CAAC,MAAM,oBAAoB,kBAAkB,EAAE,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,mDAAmD,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAAC;YAClD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,mEAAmE;IAE3D,YAAY;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAkB;QACpC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"IdentityManager.js","sourceRoot":"","sources":["../../src/identity/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAIxB,MAAM,YAAY,CAAC;AAsBpB,wEAAwE;AAExE,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IAC9B,QAAQ,GAA6B,IAAI,CAAC;IAElD,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAiC,EAAE;QACxC,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,cAAkC,CAAC;QACvC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,YAAgC,CAAC;QAErC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,GAAG,sBAAsB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACrC,MAAM,eAAe,GAAG,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACrE,kBAAkB,GAAG,wBAAwB,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7F,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,uDAAuD;QACvD,IAAI,cAAsB,CAAC;QAC3B,IAAI,UAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAEhC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;YAC5B,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjF,UAAU,GAAG,6BAA6B,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,OAAO,EAAE,uBAAuB;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,cAAc;YAC1B,oBAAoB,EAAE,UAAU;YAChC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,WAAW;YACX,kBAAkB;YAClB,GAAG,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEvB,MAAM,QAAQ,GAAsB;YAClC,OAAO,EAAE,uBAAuB;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1D,WAAW;YACX,kBAAkB;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB;SACnB,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,UAA+B,EAAE;QACpC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAA8B,CAAC;QAEnD,IAAI,UAAkB,CAAC;QAEvB,mEAAmE;QACnE,4DAA4D;QAC5D,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,oBAAoB,GACxB,IAAI,CAAC,oBAAoB,KAAK,MAAM,IAAI,CAAC,CAAC,sBAAsB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QAElF,IAAI,oBAAoB,EAAE,CAAC;YACzB,UAAU,GAAG,MAAM,CAAC,UAAW,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,CAAC,oBAAoB,KAAK,6BAA6B,EAAE,CAAC;YACvE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,UAAW,EAAE,IAAI,CAAC,CAAC;YAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,IAAI,wBAAwB,CAChC,IAAI,CAAC,YAAY,EACjB,gCAAgC,UAAU,CAAC,MAAM,oBAAoB,kBAAkB,EAAE,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,mDAAmD,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,cAAc;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAsB;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAAC;YAClD,WAAW;YACX,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,WAAW,CAAC;YACrF,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,mEAAmE;IAE3D,YAAY;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAkB;QACpC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1335",
+  "version": "1.3.1336",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-10-09T16:37:23.676Z",
-  "instarVersion": "1.3.1335",
+  "generatedAt": "2026-10-09T17:55:56.614Z",
+  "instarVersion": "1.3.1336",
   "entryCount": 203,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1335",
+  "packageVersion": "1.3.1336",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "192708e0596041ea998bfadb1f25e4bf3ad421836bc2968f5161f8540f091c41",
+  "sha256": "aca43025a5acfdf9c9a6eee3c9fc8a023d94ca429fcf36c65993528a00272429",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1335"
+  "packageVersion": "1.3.1336"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
   "articleCount": 92,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1335"
+  "packageVersion": "1.3.1336"
 }

package/upgrades/1.3.1336.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+A bug fix (spec: `docs/specs/joined-machine-unified-trust.md`, ACT-072). A machine that joined an existing agent by pairing saves the agent's identity file without a `privateKeyEncryption` field, because the key it saves is not encrypted. `CanonicalIdentityManager.load()` refused any file without that field (`Unknown encryption method: undefined`), so the unified trust layer (authorization policy, trust audit log, invitations, verified pairing, MoltBridge identity) never started on a joined machine; the boot only logged `Unified trust system init failed (non-fatal)`.
+
+The loader now reads a missing field as "not encrypted", which is what the pairing installer means and what every other reader of the file already assumed. It accepts the file only after the existing checks pass: the private key must be a 32-byte seed whose public key matches. The two identifiers the short file lacks (`canonicalId`, `displayFingerprint`) are computed from the public key. A field that is present but unknown is still refused, and a malformed key is still refused with the file left untouched. Nothing is written to disk.
+
+## What to Tell Your User
+
+If you run me on more than one computer, my trust settings now work on every one of them, not just the first. Before, a computer that joined later quietly ran without them. It fixes itself the next time that computer starts; there is nothing to do.
+
+## Summary of New Capabilities
+
+- No new capability. Joined machines regain the unified trust layer the first machine already had.
+
+## Evidence
+
+- `tests/unit/identity/IdentityKeyFile.test.ts`: the installer shape loads with the right key and identifiers and the file unchanged; a declared unknown or `null` method, a non-seed private key, and a mismatched pair are still refused.
+- `tests/integration/joined-machine-unified-trust.test.ts`: a real source identity, sealed and installed by the real pairing code, then `createUnifiedTrustSystem` on the joiner: no error, same identity as the source, and a signature made on the joiner verifies against the source key. Both tests fail on the previous code.

package/upgrades/side-effects/joined-machine-unified-trust.md

@@ -0,0 +1,98 @@
+# Side-Effects Review — Unified trust initialises on a machine that joined via pairing
+
+**Version / slug:** `joined-machine-unified-trust`
+**Date:** `2026-10-09`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (see below)`
+
+Spec: docs/specs/joined-machine-unified-trust.md (approved under the operator's standing approval, 2026-10-08 14:49). Tracking: ACT-072. Tier 2 (identity keys are a safety surface).
+
+## Summary of the change
+
+`CanonicalIdentityManager.load()` (`src/identity/IdentityManager.ts`) threw `Unknown encryption method: undefined` on the canonical `identity.json` that the pairing installer (`installAgentIdentityFromPairing`) writes, because that file has no `privateKeyEncryption`, `canonicalId` or `displayFingerprint` field. `createUnifiedTrustSystem` calls that loader, so on every machine that joined via pairing the boot logged `Unified trust system init failed (non-fatal)` and the unified trust layer never started.
+
+- **`src/identity/IdentityManager.ts`** — an ABSENT `privateKeyEncryption` field is read as `'none'`; `canonicalId` and `displayFingerprint` are derived from the public key when absent or empty. This change adds no write (the existing ACT-062 hex repair still runs first for any file).
+- **`tests/unit/identity/IdentityKeyFile.test.ts`** — the PR #2150 test that pinned the refusal is replaced by both sides of the boundary.
+- **`tests/integration/joined-machine-unified-trust.test.ts` (new)** — real seal → real installer write → `createUnifiedTrustSystem`.
+
+No config key, route, hook, template section or state schema is added.
+
+## Decision-point inventory
+
+- Does the loader accept a canonical file with no declared encryption — **modify** — invariant: accept only when the field is absent AND the shared reader has validated a 32-byte plaintext seed whose public key matches. A present-but-unknown value (including `null`) is still refused.
+
+---
+
+## 1. Over-block
+
+No issue identified. The change only removes a refusal; the refusals that remain (malformed key, mismatched pair, unknown declared method) are unchanged.
+
+## 2. Under-block
+
+- Could the widening admit a bad key? No: with the field absent, `readIdentityKeyFile` treats the file as plaintext and requires a 32-byte private seed whose derived public key equals the stored one, before the loader branch runs. A ciphertext key shipped without its label (an encrypted source identity handed over by pairing) is refused there. Unit and integration tests pin it.
+- A stored non-empty `canonicalId` / `displayFingerprint` that disagrees with the public key is used as stored, exactly as before this change. Unchanged.
+- A joined machine still has no `recoveryCommitment` / `recoverySalt` (the handover does not carry them), so recovery-phrase rotation is unavailable there. Pre-existing and unaffected.
+
+## 3. Level-of-abstraction fit
+
+The loader is the one reader that disagreed with every other reader of this file about an absent field (`readIdentityKeyFile`, `TelegramOriginBoot`, the window send-time guard all read absent as "not encrypted"). Fixing the loader fixes new and already-joined machines with no migration; changing the installer would have required a migration that rewrites private-key files.
+
+## 4. Signal vs authority compliance
+
+No blocking authority is added; a deterministic invariant on key bytes stays the arbiter. Compliant with `docs/signal-vs-authority.md`.
+
+## 4b. Judgment-point check
+
+No judgment-shaped decision point (all invariant).
+
+## 5. Interactions
+
+Unified trust now starts on joined machines, so they behave like the machine they joined. Concretely, the consumers of `ctx.unifiedTrust` in `src/server/routes.ts` that returned "no trust manager" before now get the real one on a joined machine:
+- Threadline pairing list / verify / deny routes and the verified-pairing credential-share gate use the real trust manager instead of their no-trust-manager branch.
+- A2A local-route trust (`threadline.localRouteTrust`, dev-gated, dry-run by default) now evaluates on a joined machine instead of counting "no trust manager". In dry-run it only logs and counts; enforcement remains the operator's explicit `dryRun: false`.
+- MoltBridge (only when `moltbridge.enabled`) initialises with the agent identity — the same identity as the source machine.
+These are the same behaviours the source machine already had; no new behaviour exists anywhere that did not exist on the first machine.
+
+## 6. External surfaces
+
+- Boot log on a joined machine: `Unified trust system initialized (identity: <displayFingerprint>)` replaces `Unified trust system init failed (non-fatal): Unknown encryption method: undefined`.
+- No file is rewritten; no route, protocol or wire change.
+
+## 6b. Operator-surface quality
+
+No operator surface added.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+The agent identity stays unified (moved only by the sealed pairing handover). This change removes a cross-machine incoherence: the trust layer existed on the first machine and not on joiners. Each machine reads its own canonical file (machine-local by the protected trust-anchor rule, spec marker `physical-credential-locality`); the derived identifiers are a pure function of the public key, so every machine computes the same values with no coordination. No user-facing notice, URL, topic binding or durable state is added.
+
+## 8. Rollback cost
+
+Revert the commit. The previous loader refuses the installer shape again (the pre-fix state). No file was rewritten, so nothing on disk needs repair.
+
+## Conclusion
+
+The build follows the spec. Ungated: it repairs a permanent failure and is inert for any machine whose canonical file declares its encryption (every minted identity does). Clear to ship.
+
+## Evidence pointers
+
+- `tests/unit/identity/IdentityKeyFile.test.ts` — "CanonicalIdentityManager.load — the pairing installer shape (ACT-072)": accepted with derived identifiers and file unchanged; the same shape stored as hex repaired then loaded with no field added; empty identifiers derived; declared unknown, `null` and empty methods refused; non-seed private key refused and file untouched; mismatched pair refused. The acceptance test was confirmed to fail on the previous loader.
+- `tests/integration/joined-machine-unified-trust.test.ts` — real canonical identity → `readAgentIdentityForHandover` → `sealIdentityForJoiner` → `installAgentIdentityFromPairing` → `createUnifiedTrustSystem`: same public key, canonicalId and displayFingerprint as the source, file byte-identical, a signature with the loaded key verifies against the source key; a malformed installer-shaped file still throws `IdentityFileInvalidError` and is untouched. Confirmed to fail on the previous loader with `Unknown encryption method: undefined`.
+
+## Class-Closure Declaration (display-only mirror)
+
+Not applicable: no self-triggered controller and no agent-authored-artifact defect. The class is "one reader disagrees with the writer about an absent field"; every other reader of this file already read absent as plaintext.
+
+## Second-pass review
+
+**Reviewer:** independent adversarial/security reviewer subagent (read the spec, the diff and every reader of the canonical file; ran no tests). The codex GPT-tier spec review (`gpt-6-astra`) also ran; its findings are in the convergence report.
+**Independent read of the artifact: concur**
+
+Nothing material. Confirmed: the widening admits only a validated plaintext pair (the shared reader runs first; ciphertext without its label is 72 bytes and is refused); the `in` check survives a hex repair (the repair spreads the raw object and adds no encryption field); the derived identifiers equal what `create()`, `Migration.ts` and `KeyRotation.ts` compute, and the handover ships the source public key unchanged; no other reader needs these fields from disk (`AgentServer` reads only `publicKey`; `routes.ts` and `TelegramOriginBoot` already read absent as plaintext; MoltBridge reads the loaded identity).
+
+Minor findings and what was done:
+1. Empty stored identifiers passed through `??`. **Fixed:** empty is derived; test added.
+2. No test for a hex-stored installer shape or a declared empty method. **Fixed:** both added.
+3. Recovery data is not carried by the handover. **Recorded** in the spec and the under-block section (pre-existing).
+4. MoltBridge (when enabled) now initialises on a joined machine under the same identity. **Recorded** in the spec's multi-machine posture and §5 (intended).
+5. A stored non-empty `canonicalId` is not checked against the key. **Recorded** (pre-existing, unchanged).