instar 1.3.1603 → 1.3.1604

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1603",
+  "packageVersion": "1.3.1604",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "02f516683f8d3c91c31aa33aed8183a93f9b7d8a4444a4c428f88b4a3acc73d8",
+  "sha256": "448cb97969fbcca95176bfe7f47c69870a46150d15cdf2da8fceed8dced532ec",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1603"
+  "packageVersion": "1.3.1604"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1603"
+  "packageVersion": "1.3.1604"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1603",
+  "version": "1.3.1604",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-11-02T16:28:07.623Z",
-  "instarVersion": "1.3.1603",
+  "generatedAt": "2026-11-02T16:51:41.935Z",
+  "instarVersion": "1.3.1604",
   "entryCount": 206,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1603",
+  "packageVersion": "1.3.1604",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "02f516683f8d3c91c31aa33aed8183a93f9b7d8a4444a4c428f88b4a3acc73d8",
+  "sha256": "448cb97969fbcca95176bfe7f47c69870a46150d15cdf2da8fceed8dced532ec",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1603"
+  "packageVersion": "1.3.1604"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1603"
+  "packageVersion": "1.3.1604"
 }

package/upgrades/1.3.1604.md

@@ -0,0 +1,20 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The macOS desktop package CI job now runs the guided setup production-boot E2E file after building. This preserves automated Mac coverage after the test was correctly made platform-specific. The same test file checks that native Linux reports unsupported setup and refuses to write configuration. The Windows package smoke test retries only a temporary connection-unavailable response with a fresh signed nonce, bounded to five attempts. Two test-only timing races and the current-main documentation coverage floor are also repaired. Runtime product behavior is unchanged.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+The exact revised head passed 55,509 unit tests with zero failures. Its macOS E2E command passed four tests with the Mac setup case included and one Linux-only skip. The predecessor code-identical head passed local integration, GitHub CI, and independent unit/integration/E2E verification with zero failures. A separate second-pass reviewer caught the Mac CI coverage gap and concurred after the workflow fix and review-artifact correction. New-head CI and independent verification remain required after publication.

package/upgrades/side-effects/desktop-setup-platform-ci-release-fragment.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — CI repair release fragment
+
+**Version / slug:** `desktop-setup-platform-ci-release-fragment`
+**Date:** 2026-11-02
+**Author:** Echo
+**Second-pass reviewer:** not required
+
+## Summary of the change
+
+Add an internal-only release-note fragment for the previously reviewed CI and test repair. No executable code, workflow or test assertions change in this commit.
+
+## Decision-point inventory
+
+No runtime decision point changes. The release assembler reads the fragment and the pre-push gate verifies its presence.
+
+## 1. Over-block
+
+No new input is rejected. A malformed fragment could fail release lint, so this file follows the existing internal-only fragment format.
+
+## 2. Under-block
+
+This fragment does not prove the revised PR head's GitHub or independent verification. It explicitly states those gates remain required after publication.
+
+## 3. Level-of-abstraction fit
+
+The release note belongs in `upgrades/next/` because the CI workflow is release-relevant. It introduces no competing-signals heuristic.
+
+## 4. Signal vs authority compliance
+
+The fragment is descriptive evidence for release assembly, not a runtime authority. The pre-push gate remains the deterministic authority for requiring a fragment, consistent with `docs/signal-vs-authority.md`.
+
+## 5. Interactions
+
+The internal-only marker lets the assembler omit user-facing sections for this no-runtime-surface change. The fragment is not intended to be used as a test receipt.
+
+## 6. External surfaces
+
+Release notes will describe the CI/test repair. No user-facing product behavior, API, message, credential or network destination changes.
+
+## 7. Multi-machine posture
+
+The note ships in the repository and is shared with every build; it creates no machine-local state or topic behavior.
+
+## 8. Rollback cost
+
+Revert the fragment with the CI repair if the PR is reverted. No data migration or agent state repair is needed.

package/upgrades/side-effects/desktop-setup-platform-ci-repair.md

@@ -0,0 +1,59 @@
+# Side-Effects Review — Desktop setup platform CI repair
+
+**Version / slug:** `desktop-setup-platform-ci-repair`
+**Date:** 2026-11-02
+**Author:** Echo
+**Second-pass reviewer:** pr2584_second_pass
+
+## Summary of the change
+
+This PR repairs test and documentation coverage for the guided Remote Desktop setup on Mac, native Linux and Windows. The production implementation is unchanged. The Mac production-boot positive case runs only on macOS, and the macOS CI package job now runs that E2E file after build; a native-Linux production-boot case checks the unsupported state, HTTP 409 and absence of a config write. The Windows packaged transport smoke probe retries only an HTTP 503 connection-unavailable result, at most five times, each with a newly signed nonce. The package-completeness test retries a known temporary identity-helper ENOENT race; the context-map expiry test uses a controlled clock. Two documentation pages restore the required capability coverage after newer mainline routes landed.
+
+## Decision-point inventory
+
+- `.github/workflows/ci.yml` — adds the production-boot E2E file to the macOS package job so the Mac positive assertion runs in CI.
+- `tests/e2e/desktop-setup-boot-lifecycle.test.ts` — modifies CI platform selection; verifies the Mac positive path on Mac and the native-Linux refusal path on Linux.
+- `tests/e2e/windows-desktop-local-transport-smoke.mjs` — modifies the Windows CI probe's bounded startup retry, not the product transport.
+- `tests/unit/package-completeness.test.ts` — modifies a test-only retry predicate for a temporary native helper deletion race.
+- `tests/unit/threadline/ContextThreadMap.test.ts` — replaces wall-clock spin with a deterministic fake Date; product expiry logic is unchanged.
+- Docs pages — add explanation of shipped desktop and machine-maintenance capabilities; no runtime decision changes.
+
+## 1. Over-block
+
+The Windows smoke still fails if the companion returns a non-503 error, responds at a later phase, or remains unavailable after five attempts. A slow but eventually healthy companion after the fifth attempt will fail CI. That is a bounded test gate, and the Windows package job passed on this exact head. Native WSL is excluded from the native-Linux assertion because WSL has a separate platform capability path; this leaves WSL coverage to its own tests.
+
+## 2. Under-block
+
+The Windows retry might hide a transient startup delay, but each failed attempt must be the specific unavailable response and the final successful attempt must still complete the signed transport request. Fresh nonce and timestamp avoid accidental replay rejection. This smoke does not test the Windows companion replay-rejection path; that path is not established by this PR’s test evidence. The Mac-only skip means Linux CI cannot prove the Mac positive path; the new macOS CI step and local Mac execution cover it. The native-Linux test checks that refusal writes no setup config, reducing the risk of false success. The package retry matches only ENOENT mentioning a temporary capture or identity helper, so unrelated pack failures remain failures.
+
+## 3. Level-of-abstraction fit
+
+The host assertion belongs in production-boot E2E tests because it checks the actual AgentServer platform behavior. Startup tolerance belongs in the Windows packaging smoke rather than production transport: it addresses companion launch timing and cannot alter user traffic. The package helper race and controlled-clock change stay in tests. No new product-level static heuristic is introduced at a competing-signals decision point.
+
+## 4. Signal vs authority compliance
+
+The Windows smoke test retains CI failure authority only for a deterministic transport invariant: an authenticated request must eventually succeed within five bounded attempts, with every other error failing. It does not grant a product decision or weaken a runtime guard. The other changes alter test selection or test timing, and the docs change has no runtime authority. This follows `docs/signal-vs-authority.md` by keeping the CI probe as evidence for the packaging gate while the production platform and transport code remain the authority for actual behavior.
+
+## 5. Interactions
+
+The platform split prevents a native Linux runner from demanding a Mac-only state; the new Linux case checks the legitimate refusal instead. The Windows smoke runs after the companion launches; each retry signs new bytes so the existing replay guard does not reject a duplicate. This smoke does not exercise the replay rejection branch. The package retry can run while desktop-host tests create/delete helper files; it retries only the observed path-specific race. Fake Date is restored in `finally`, so other tests do not inherit its clock. Docs Coverage reads the new architecture and API text but changes no service wiring.
+
+## 6. External surfaces
+
+The user-facing product behavior is unchanged. GitHub CI gains an accurate Linux assertion, a macOS production-boot E2E step, a bounded Windows startup probe, and restored documentation coverage. The API reference now names the watch-only machine-maintenance routes and their dark/unknown states. No user messages, credentials, network destinations or runtime permissions change.
+
+## 7. Multi-machine posture
+
+This repair runs in CI on Mac, native Linux and Windows; it has no durable state to replicate. The test fixtures use temporary local state only. The documented machine-maintenance endpoints explicitly describe machine-local observation and avoid implying a pool-wide result. No one-voice notification path or topic transfer changes.
+
+## 8. Rollback cost
+
+Reverting this PR restores the prior false Linux assertion and fixed one-second Windows wait, so CI may fail on healthy code again. The docs can be reverted without data migration. There is no production state migration or agent state repair.
+
+## Second-pass review
+
+**Reviewer:** pr2584_second_pass
+
+First pass raised two specific concerns: the macOS package job did not run the Mac production-boot E2E, and the artifact overstated replay coverage. The workflow now runs that file on macOS after build, and sections 2 and 5 describe the fresh nonce as avoiding accidental replay rejection rather than testing the replay guard. A second review found an unsupported claim of separate replay-rejection coverage; section 2 now states that this path is unmeasured by this PR. Final independent review concurred after this correction.
+
+**Final verdict:** Concur with the review — reviewer `pr2584_second_pass`. The macOS workflow runs the boot E2E after build, and the artifact accurately limits the Windows replay claim.