instar 1.3.1639 → 1.3.1640

package/src/templates/scripts/app-reply.sh

@@ -126,6 +126,22 @@ DELIVERY_ID="${INSTAR_DELIVERY_ID:-}"
 [[ "$DELIVERY_ID" =~ ^[0-9a-fA-F-]{16,64}$ ]] || DELIVERY_ID=""
 [ -n "$DELIVERY_ID" ] || DELIVERY_ID=$(python3 -c 'import uuid; print(uuid.uuid4())' 2>/dev/null)
 
+# message-origin-all-platforms §2: pass this session's origin credential so the server can record
+# which harness and model wrote the reply. A surviving session can be re-enrolled after a server
+# update without killing its process: read only its own server-published tmux credential, never
+# print it. Absent or unverifiable, the server records what it can and the reply still sends.
+if [ -n "${INSTAR_SESSION_NAME:-}" ] && command -v tmux >/dev/null 2>&1; then
+  ORIGIN_ENV_ROW=$(tmux show-environment -t "=${INSTAR_SESSION_NAME}" INSTAR_ORIGIN_TOKEN 2>/dev/null || true)
+  case "$ORIGIN_ENV_ROW" in
+    INSTAR_ORIGIN_TOKEN=ior1_*) INSTAR_ORIGIN_TOKEN="${ORIGIN_ENV_ROW#INSTAR_ORIGIN_TOKEN=}" ;;
+  esac
+  unset ORIGIN_ENV_ROW
+fi
+case "${INSTAR_ORIGIN_TOKEN:-}" in
+  ior1_*) ;;
+  *) INSTAR_ORIGIN_TOKEN="" ;;
+esac
+
 set +e
 RESPONSE=$(curl -sS --connect-timeout 3 --max-time "$MAX_TIME" -w "\n%{http_code}" -X POST \
   "http://localhost:${PORT}/app/session-reply" \
@@ -133,6 +149,7 @@ RESPONSE=$(curl -sS --connect-timeout 3 --max-time "$MAX_TIME" -w "\n%{http_code
   ${AUTH:+-H "Authorization: Bearer $AUTH"} \
   ${AGENT_ID:+-H "X-Instar-AgentId: $AGENT_ID"} \
   ${INSTAR_BIND_TOKEN:+-H "X-Instar-Bind-Token: $INSTAR_BIND_TOKEN"} \
+  ${INSTAR_ORIGIN_TOKEN:+-H "X-Instar-Origin-Session: $INSTAR_ORIGIN_TOKEN"} \
   ${DELIVERY_ID:+-H "X-Instar-DeliveryId: $DELIVERY_ID"} \
   -d "$BODY_JSON")
 CURL_STATUS=$?

package/src/templates/scripts/slack-reply.sh

@@ -125,6 +125,22 @@ else
 fi
 
 # Send via Instar server
+# message-origin-all-platforms §2: pass this session's origin credential so the server can record
+# which harness and model wrote the reply. A surviving session can be re-enrolled after a server
+# update without killing its process: read only its own server-published tmux credential, never
+# print it. Absent or unverifiable, the server records what it can and the reply still sends.
+if [ -n "${INSTAR_SESSION_NAME:-}" ] && command -v tmux >/dev/null 2>&1; then
+  ORIGIN_ENV_ROW=$(tmux show-environment -t "=${INSTAR_SESSION_NAME}" INSTAR_ORIGIN_TOKEN 2>/dev/null || true)
+  case "$ORIGIN_ENV_ROW" in
+    INSTAR_ORIGIN_TOKEN=ior1_*) INSTAR_ORIGIN_TOKEN="${ORIGIN_ENV_ROW#INSTAR_ORIGIN_TOKEN=}" ;;
+  esac
+  unset ORIGIN_ENV_ROW
+fi
+case "${INSTAR_ORIGIN_TOKEN:-}" in
+  ior1_*) ;;
+  *) INSTAR_ORIGIN_TOKEN="" ;;
+esac
+
 set +e
 RESPONSE=$(curl -sS --connect-timeout 3 --max-time 35 -w "\n%{http_code}" -X POST \
   "$REPLY_URL" \
@@ -132,6 +148,7 @@ RESPONSE=$(curl -sS --connect-timeout 3 --max-time 35 -w "\n%{http_code}" -X POS
   ${AUTH:+-H "Authorization: Bearer $AUTH"} \
   ${AGENT_ID:+-H "X-Instar-AgentId: $AGENT_ID"} \
   ${INSTAR_BIND_TOKEN:+-H "X-Instar-Bind-Token: $INSTAR_BIND_TOKEN"} \
+  ${INSTAR_ORIGIN_TOKEN:+-H "X-Instar-Origin-Session: $INSTAR_ORIGIN_TOKEN"} \
   ${DELIVERY_ID:+-H "X-Instar-DeliveryId: $DELIVERY_ID"} \
   -d "$BODY_JSON")
 CURL_STATUS=$?
@@ -152,6 +169,12 @@ if [ "$HTTP_CODE" = "200" ]; then
   else
     echo "Sent ${#MESSAGE} chars to channel ${CHANNEL_ID}"
   fi
+elif [ "$HTTP_CODE" = "503" ] && printf '%s' "$BODY" | grep -q 'origin-recording-unavailable'; then
+  # message-origin-all-platforms §3: this machine could not record which machine and model wrote
+  # the reply, so nothing was sent to Slack. A fixed notice tells the conversation.
+  echo "NOT SENT (HTTP 503): the server could not record this reply's origin, so Slack was not contacted." >&2
+  echo "  Nothing was delivered. Resend once the server reports origin recording is working (GET /health -> messageOrigin)." >&2
+  exit 1
 elif [ "$HTTP_CODE" = "408" ]; then
   # Request timeout on the server side — the outbound path (tone gate + Slack API)
   # exceeded the route's budget. The actual send may have completed anyway.

package/upgrades/1.3.1640.md

@@ -0,0 +1,25 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Every message the agent sends now records which machine, harness ("door", such as Claude Code or Codex) and model wrote it on app conversations and Slack too, not only on Telegram. An app reply is stored together with its origin. Every Slack post, edit and file share writes a small origin record before it leaves; if that record cannot be written the message is not sent, and one short pre-recorded notice tells the conversation, so the agent is never silent. The agent's own Slack replies carry the same one-line origin footer Telegram replies have, under the same show/hide setting.
+
+The Instar app's history reads (app conversations, Slack and Telegram) now return an `origin` block on each agent message with the machine, harness, model, how each was known, and the agent's current show/hide setting. `recorded: null` means this machine cannot tell, never "not recorded". On an agent without Telegram the setting lives at the top level of the config (`messageOrigin.display`).
+
+## What to Tell Your User
+
+My messages now carry where they came from on every platform you use with me: which of your machines wrote them, which tool I was running in, and which model. It shows by default. If you would rather not see it, just tell me and I will hide it; it is still recorded either way. Slack replies get the same small footer Telegram already has. The app shows it once its next update reads the new data.
+
+## Summary of New Capabilities
+
+- App and Slack replies record machine, harness and model, like Telegram.
+- Phone history reads return the origin of each agent message, with the display setting.
+- Slack replies carry the origin footer.
+- A Slack message is never sent without its origin record; a pre-recorded notice keeps the conversation informed.
+
+## Evidence
+
+Unit tests cover the evidence model, the reply-origin ladder, the Slack ledger (refusal, recovery, rotation, the reserved notice), the app store field and its replication, the batched Telegram lookup and its index. An integration test drives the three phone reads and the Slack reply route through the production device authenticator; an end-to-end test boots the server with no Telegram, replies in an app conversation and reads the recorded origin back from the phone route.

package/upgrades/feedback-confined-timeout.eli16.md

@@ -0,0 +1,7 @@
+# Feedback worker test timeout cleanup
+
+When a feedback fix changes a core file, its related tests can cover much of Instar. The old 20 minute limit stopped one SecretStore attempt before it could open a pull request. The sandbox wrapper exited, but its test children kept the output pipe open, so the executor stayed stuck until those children were stopped separately.
+
+The related test step now has a 45 minute limit. All other confined commands keep their 20 minute limit. When either limit is reached, the runner kills the original process group and records the timeout immediately, even if a child has separated from that group and kept an output pipe open. Native Windows execution is refused because this process containment is supported only on macOS and Linux. The worker still has to pass its old-code test, new-code test, lint, related tests, independent review, local verification, and CI before a merge.
+
+This change does not make the SecretStore patch safe by itself. That patch has a separate independent data loss finding and needs correction before merge.

package/upgrades/side-effects/feedback-confined-timeout.md

@@ -0,0 +1,80 @@
+# Side-Effects Review — bounded feedback test timeout
+
+**Version / slug:** feedback-confined-timeout  
+**Date:** 2026-11-03  
+**Author:** Echo  
+**Second-pass reviewer:** feedback_gate_review (concurred)
+
+## Summary of the change
+
+The feedback executor's confined command runner now returns a timeout or output-limit failure even when a descendant retains its output pipe. It kills the original POSIX process group, destroys its local pipes, and settles without waiting for Node's `close` event. `vitest related` gets 45 minutes; other gates remain at 20 minutes. The approved execution spec records the exception. Native Windows remains unsupported by the runner. This changes the executor's resource-bound decision, not review or merge policy.
+
+## Decision-point inventory
+
+- `runCapped` timeout and output cap — modified — settle with a failure at the fixed limit.
+- `FeedbackExecutorService` related gate budget — modified — use 45 minutes only for this gate.
+- `SandboxRuntimeRunner` platform support — modified — refuse direct `run()` on unsupported platforms, matching `available()`.
+
+## 1. Over-block
+
+A legitimate related test that needs more than 45 minutes still fails. That is an intentional resource ceiling inside the six-hour attempt lease. Native Windows is refused, matching the preexisting availability refusal; there is no new supported Windows execution path to block.
+
+## 2. Under-block
+
+A descendant that starts a new process group can continue running after the timeout result. The sandbox's filesystem and network policy still constrain it, but process-group SIGKILL cannot terminate that escaped group. The result itself is bounded. This residual needs a separate process-containment design if escaped children are observed to persist.
+
+## 3. Level-of-abstraction fit
+
+The runner owns process lifetime and pipe closure; the executor owns per-gate time budgets. A reviewer cannot repair a stuck low-level Promise. The change keeps the existing failed-at-limit result flowing into the executor's attempt state machine.
+
+## 4. Signal vs authority compliance
+
+Required reference: [Signal vs Authority](../../docs/signal-vs-authority.md). This is deterministic resource-limit enforcement, not a judgment about feedback content or agent intent. The runner reports `timedOut` or `outputCapped` to the existing executor authority; it does not make a new semantic block/allow decision. The platform refusal is a safety invariant for unavailable containment.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The wall-clock budget is an explicit invariant recorded in the approved execution spec.
+
+## 5. Interactions
+
+- **Shadowing:** The 45-minute related budget replaces the generic 20-minute budget only at the related-test call; base, head, lint, canary, and dependency calls retain the generic budget.
+- **Double-fire:** A timeout and `close` can race. The `settled` flag allows only one result; the timer is cleared when settled.
+- **Races:** A detached descendant may outlive clone cleanup. It remains inside the sandbox policy, but its process lifetime is not guaranteed by this patch. The executor records the limit failure without waiting on it.
+- **Feedback loops:** No new retry or auto-merge trigger is added. A failed attempt remains subject to existing caps and review policy.
+
+## 6. External surfaces
+
+An executor attempt that previously remained stuck in `verifying` now records a limit failure. A related test may consume up to 45 minutes. Feedback API result shapes and Telegram message formats do not change. No operator-facing action is added.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: a confined command and its process group exist on the machine that owns the attempt. The attempt's state is recorded by the existing feedback executor on the drain owner. This change emits no user-facing notices, holds no new durable state, and generates no URLs. Topic transfer does not affect the local timeout result.
+
+## 8. Rollback cost
+
+Revert the code and spec amendment, then ship a patch. No data migration or agent state repair is needed. Rollback restores the 20-minute related limit and the known risk of a stuck `verifying` attempt when a descendant holds output pipes.
+
+## Conclusion
+
+The reviewer identified two gaps in the first draft: detached pipe holders could still stall completion, and the 45-minute exception conflicted with the spec. Both are corrected. The reviewer concurred with the revised bounded-result fix. The escaped-descendant lifetime risk is explicit above and does not negate the bounded-result claim.
+
+## Second-pass review
+
+**Reviewer:** feedback_gate_review  
+**Independent read of the artifact:** concur
+
+The reviewer found no remaining blocker for bounded timeout completion and confirmed the escaped-descendant residual is documented.
+
+## Evidence pointers
+
+- Live attempt `feedback-e800bf35-6381-46e7-a769-1530c55ac7ac:a6` failed `limit:command-wall-clock` after its old runner required manual descendant termination.
+- Unit regression covers ordinary and detached descendants retaining stdout. Focused runner/executor tests: 154 passed.
+- Integration route tests: 9 passed. E2E executor lifecycle tests: 2 passed. Build and lint passed. Full three-stage suite is running.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect. The timeout's `killTree` is a one-shot response to a single confined command crossing its fixed limit, not a self-triggered loop or retry controller. Negative declaration: `defectClass: unbounded-self-action`, `closure: n/a`, reason: one-shot per-command resource enforcement, with no action scheduled by the result itself.

package/upgrades/side-effects/message-origin-all-platforms.md

@@ -0,0 +1,92 @@
+# Side-Effects Review — Message origin on every platform (app, Slack, phone reads)
+
+**Version / slug:** `message-origin-all-platforms`
+**Date:** `2026-11-03`
+**Author:** `Echo`
+**Second-pass reviewer:** `independent subagent (see below)`
+
+## Summary of the change
+
+Tier 2. Spec: `docs/specs/message-origin-all-platforms.md` (3 review rounds, cap 3; cross-model `codex-cli:gpt-6-astra`). Every agent reply in a native app conversation is stored with its origin (machine, harness, model and how each was known) in the same append; every Slack post, edit, ephemeral and file share writes an origin row to `.instar/state/slack-origins.jsonl` before it leaves and is refused when that row cannot be written (a pre-recorded per-conversation notice keeps the agent reachable); the phone's three history reads return `origin` on agent rows with the agent's current display bits; Telegram rows join the existing origin store through one new batched, indexed, read-only lookup. Slack session replies get the same one-line footer Telegram has. New files: `src/messaging/messageOrigin.ts`, `src/messaging/slack/SlackOriginLedger.ts`, `src/server/replyOrigin.ts`. Changed: `SlackAdapter`, `FileHandler`, `routes.ts` (app and Slack reply routes, Telegram topic history, /health), `AppConversationStore` (plus the replicated wire field), mobile conversation and Slack routes, `AgentServer` and `server.ts` wiring, the origin store (index and method), `TelegramOriginService` (`sessionProducer` lifted out of `runWithSessionToken`), the display-settings route, relay scripts and installers, the CLAUDE.md template and migration. Effort: 3 spec rounds; build in one pass.
+
+## Decision-point inventory
+
+- **Slack send refusal when the origin intent cannot be written** — added. Deterministic: the local append landed or not. Scoped to an I/O failure; bad evidence is recorded as `unknown`, never refused.
+- **Evidence ladder** — added, evidence only, never a gate.
+- **Display bits** — presentation only.
+
+## 1. Over-block
+
+A Slack send is refused when the ledger file cannot be written (disk full, permissions). That refuses legitimate messages in that state, by design (the operator's "ALWAYS recorded"). Bounded: the refusal retries the write on the next send after 5 s, so it lifts the moment the disk does; a pre-recorded notice tells an affected conversation once per process run, only for a refused post, and only if a send to that conversation succeeded earlier in the run (edits, ephemeral messages and file shares get no notice); the operator exception `messageOrigin.recording.slackFailClosed: false` turns refusal into reported pass-through. Any failed ledger write (an intent, a receipt or a reserve) arms the 5-second window for every conversation, because it is the same disk. A test harness or adapter built with an unwritable state directory would refuse every Slack send: the adapter test files touched here pass.
+
+## 2. Under-block
+
+- WhatsApp and iMessage replies record nothing (ACT-023).
+- A Slack message whose receipt write failed has a record the phone cannot link (`recorded: null`, `unlinked`).
+- `SlackLiveSender` (the live-test harness, a separate test identity) bypasses the chokepoint by design.
+- `SlackAdapter.send()` posts long messages in chunks, one call each; a refusal on a later chunk leaves earlier chunks posted. No reply route uses it.
+- A reply whose evidence scope does not match the adapter's target (an unusual thread value) is recorded as server automation, not refused.
+- On an agent without Telegram, harness and model come from the launch record (`configured`), not a runtime observation.
+- Messages sent before this change read `false` (app, this machine), `not-found` (Telegram) or `not-retained` (Slack).
+
+## 3. Level-of-abstraction fit
+
+Recording sits at each platform's send chokepoint (the app reply append; `SlackAdapter.formattedApiCall` and `FileHandler.uploadFile`), not in agent prose or a hook. The evidence model and the session-producer derivation are the Telegram ones, reused (`OriginEvidence`, `sessionProducer`). The Telegram store is not duplicated; it gains one read method and one index.
+
+## 4. Signal vs authority compliance
+
+The only blocking authority added is the Slack "no record, no send" rule: deterministic (did a local append succeed), the same rule the existing standard applies to Telegram, with reachability preserved and an operator exception. Origin evidence itself is information: nothing reads it to decide anything; the bind token, not the evidence, decides which conversation a reply may reach.
+
+## 4b. Judgment-point check
+
+No competing signals: a file append succeeded or it did not. Not a judgment point.
+
+## 5. Interactions
+
+- `handleSlackReply` (both Slack reply routes): the origin scope wraps only the adapter send; the 503 branch sits before the generic 500 and after the 408 timeout branch, so the redrive and delivery-id rules are unchanged.
+- Outbound review: the footer is added after `checkOutboundMessage` (it is not part of the reviewed authored text) and passes the deterministic credential wall; the LLM tone gate never sees it.
+- App store replication: `agentOrigin` added to the wire allowlist; the receiver re-validates it and keeps it only when its machine id matches the event's.
+- Telegram store worker: one indexed read per phone history page, bounded at 750 ms by the caller.
+- Presence standby: the outage notice never calls `onMessageLogged`.
+- Display-settings route: on an agent with no enabled Telegram entry it now reads and writes the top-level setting instead of answering 503.
+
+## 6. External surfaces
+
+- Slack users see a new italic footer line on the agent's own replies (on by default; the same display bits hide it).
+- The phone's history rows gain an `origin` field (additive; older app builds ignore it). Values: display names, harness ids, model ids, statuses. Never tokens, session ids, paths, refs or channel ids.
+- `/health` (authed) gains `messageOrigin` counters.
+- `app-reply.sh` and `slack-reply.sh` send one more header; `slack-reply.sh` prints `NOT SENT` on the new 503.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+- App origin: replicated with the event through the existing app store replication; a peer's record must carry its own machine id.
+- Slack ledger: proxied-on-read through the machine that sent the message. Every Slack read names the machine that lists the conversation, and a message another machine sent reads `null`, `other-machine` here (the Slack connection moves with the serving lease).
+- Telegram: per-machine store; pool reads fan out with `includeOrigin=1` and each machine joins its own rows; a peer's recorded origin fills a local `null` on collision.
+- Display bits: read on the machine answering, never taken from a peer.
+
+## 8. Rollback cost
+
+Revert the release. Recorded fields are additive; older code ignores `agentOrigin` and never reads the Slack ledger. The Slack refusal alone has a live operator switch. No state repair.
+
+## Conclusion
+
+Ships live for every agent, as asked. The one new refusal is narrow, loud, recoverable without a restart and switchable by the operator.
+
+## Second-pass review (if required)
+
+**Reviewer:** independent subagent (Claude, fresh context), reading the artifact, the spec and the diff.
+**Independent read of the artifact: concur**
+
+Notes raised and handled: (1) the credential lookup was unbounded and the app route's evidence call sat outside its try: now bounded at 1.5 s and the ladder never throws; (2) a reserve or report error after a written intent could count as a refusal: moved after the write; (3) the notice wording overstated it: §1 corrected; (4) Telegram join reason labels: `not-found` with no store, `lookup-failed` on a store error; (5) a thread-value edge and the chunked `send()` path: aligned the scope with the adapter and noted in §2.
+
+## Evidence pointers
+
+- Unit: `tests/unit/messageOrigin.test.ts`, `tests/unit/SlackOriginLedger.test.ts`, `tests/unit/replyOrigin.test.ts`, `tests/unit/app-conversation-agent-origin.test.ts`, `tests/unit/telegram-origin/lookup-origin-evidence.test.ts`, `tests/unit/PostUpdateMigrator-messageOriginAllPlatforms.test.ts`.
+- Integration (production device authenticator): `tests/integration/message-origin-all-platforms.test.ts`.
+- E2E alive: `tests/e2e/message-origin-all-platforms-alive.test.ts`.
+
+## Found in testing
+
+The integration test caught one defect before push: `detectOutboundCredential` returns `{ detected }`, and the footer check treated the object as truthy, so the Slack footer was always dropped. Fixed to read `.detected`; the integration test asserts the footer reaches the adapter.
+
+Live Slack contract tests were not run: Echo's Slack bot token was revoked on 2026-07-01. The changed adapter files carry CONTRACT-EVIDENCE: EXEMPT markers stating that no Slack API method, parameter or response field changed.