instar 1.3.1661 → 1.3.1663

package/upgrades/side-effects/feedback-changeset-byte-cap-calibration.md

@@ -0,0 +1,60 @@
+# Side-Effects Review — Feedback change set byte cap calibration
+
+**Version / slug:** `feedback-changeset-byte-cap-calibration`
+**Date:** 2026-11-04
+**Author:** Echo
+**Second-pass reviewer:** independent decision reviewer
+
+## Summary of the change
+
+Raise the feedback executor's full-file byte ceiling from 4 to 5 MiB so edits to the measured `server.ts` and `routes.ts` pair can enter review. Above 4 MiB, every added or modified file must be valid UTF-8 text without NUL bytes. Keep the 200-file cap, confinement and secret gates, 192 KiB independent diff-review ceiling, and downstream test/CI gates. Parent spec, code comments and unit boundaries are updated in the same patch.
+
+## Decision-point inventory
+
+- `buildChangeSet` byte ceiling — modify — deterministic resource/safety limit becomes 5 MiB.
+- `buildChangeSet` over-4 MiB binary rule — add — opaque content stays under the former aggregate limit.
+- Existing special-file, `.claude`, credential, diff and file-count gates — pass-through.
+
+## 1. Over-block
+
+A valid change above 4 MiB containing an added binary fixture, a NUL-bearing source file, or non-UTF-8 text still fails. This preserves the former allowance for opaque files because the independent PR diff may omit their bytes. Legitimate text changes above 5 MiB also fail; the worker can split the fix or the cap can be recalibrated with measured evidence.
+
+## 2. Under-block
+
+A valid UTF-8 file without NUL could still encode opaque content, so this is not a semantic text proof. Secret scanning still sees the full bytes, and independent review sees the PR diff; the 192 KiB diff refusal limits changed text. The rejected a1 candidate has no recorded total byte size and is not proven to fit the new cap.
+
+## 3. Level-of-abstraction fit
+
+`buildChangeSet` owns trusted extraction from the confined workspace and already enforces aggregate size. The adjacent text check protects the only newly admitted size range. It does not decide whether the patch is useful or correct; the existing independent review and tests do that.
+
+## 4. Signal vs authority compliance
+
+Required reference: [Signal vs Authority](../../docs/signal-vs-authority.md). This is a hard resource and opaque-content invariant on an untrusted worker payload before copying it to a trusted clone. The exact byte, NUL and UTF-8 facts are deterministic and complete for this narrow rule. A model cannot safely waive the resource bound; it still judges the patch afterward.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The bounded payload allowance is an invariant; usefulness and risk remain with independent review.
+
+## 5. Interactions
+
+The 5 MiB aggregate cap runs during trusted workspace extraction. The binary rule runs after aggregate accounting and before the change set returns. The secret gate later scans full bytes, and independent review retains the diff ceiling. No concurrent state or cleanup behavior changes; a failed attempt is already disposed and needs a fresh run.
+
+## 6. External surfaces
+
+The executor may now create a reviewable PR from a text-only change between 4 and 5 MiB where it previously failed `changeset-too-large`. No new operator action, API shape, user notice, persistent record format, or migration is introduced. Existing agents receive the changed compiled code on update.
+
+## 6b. Operator-surface quality
+
+No operator surface is touched.
+
+## 7. Multi-machine posture
+
+The gate is the same code invariant on each installed machine. Existing canonical-owner selection chooses where feedback execution runs; this patch adds no replicated state, phone action, URL, or notice.
+
+## 8. Rollback cost
+
+Revert the constant and binary condition in a normal release. No data migration or state repair is needed. Any PR already created remains under review, exact-head tests and CI; rollback does not merge it.
+
+## Second-pass response
+
+Concur with the review. The artifact matches the current diff; the 5 MiB text allowance, retained 4 MiB binary ceiling, 200-file cap, secret scan and independent review gates are accurately described. No migration or operator surface is introduced. (Independent decision reviewer, 2026-11-04.)

package/upgrades/side-effects/memory-privacy-ladder-off-by-default.md

@@ -0,0 +1,100 @@
+# Side-Effects Review — memory privacy: spec and maturation board match off-by-default
+
+**Version / slug:** `memory-privacy-ladder-off-by-default`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — Tier 1: documentation and board data only; no runtime decision changes`
+
+## Summary of the change
+
+Tier 1, 4 files, about 20 lines. `docs/specs/memory-privacy.md` still said "on by default", "fleet: default on" and "dark-window: none", but since PR 2744 (1.3.1657) the feature has shipped off by default, by Justin's decision on 2026-11-04. The spec now says off by default in section 8, adds a `ladder:` line, and rewrites the maturation plan: development rung by owner opt-in (nimbus first), fleet final off by recorded preference, criterion and dark window dated. `src/data/feature-ladders.json` gains a `memoryPrivacy` entry: `final: default-off-by-preference`, the recorded decision (decider, reason, date, reference), risk sensitive, a dev rung with `advance: code`, and tracking `needed`, since the feature logs no evidence yet. The ELI16 line that read as if it turns on by itself is reworded. Effort: one commit attempt, no review rounds.
+
+## Decision-point inventory
+
+No runtime decision point changes. The board reads the new entry; with `advance: code`, nothing will flip the setting on its own.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable.
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The ladder registry is the single home for graduation decisions (Maturation Path clause d), so the preference final belongs there, not only in prose.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point.
+
+---
+
+## 5. Interactions
+
+The maturation service will list the entry. Its dev rung reads `logs/feature-evidence.jsonl`, where nothing is written yet, so it reads as not started; the tracking plan says so. `advance: code` keeps any automatic move from turning on a restricting setting.
+
+---
+
+## 6. External surfaces
+
+The maturation board shows one new entry. No agent behaviour or user-facing message changes.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+The ladder data ships with the package, identical on every machine. No state, notices or URLs.
+
+---
+
+## 8. Rollback cost
+
+Revert the commit. No persistent state.
+
+---
+
+## Conclusion
+
+Brings the document and the board in line with what ships. Clear to ship.
+
+---
+
+## Second-pass review (if required)
+
+Not required.
+
+---
+
+## Evidence pointers
+
+Ladder tests 45/45; `findMaturationPlanGaps(spec, { requireLadder: true })` → ok. Follow-up for the boot check is tracked as ACT-047.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable.

package/upgrades/side-effects/memory-privacy-linux-replies.md

@@ -0,0 +1,109 @@
+# Side-Effects Review — memory privacy: replies reach the server from Linux sandboxed sessions
+
+**Version / slug:** `memory-privacy-linux-replies`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — Tier 1: no new reach, no block/allow surface, Linux-only, opt-in feature`
+
+## Summary of the change
+
+Tier 1, 6 files, about 90 lines including tests and docs. Fixes fb-0fd50d5c-bad. With `memoryPrivacy.enabled: true` on Linux, a scoped session runs in bubblewrap with its own network namespace, and the sandbox's `NO_PROXY` lists `localhost`, so every reply script's curl went direct and failed with exit 7: memory was kept private but nobody got a reply. `src/core/memorySessionPolicy.ts` gains `prepareSessionCurlHome(scopeDir)`, which on Linux writes `<scope>/.curl/.curlrc` with `noproxy = ""` and returns that folder. `src/core/SessionManager.ts` passes it to scoped sessions as `CURL_HOME`, so curl sends `localhost` through the sandbox proxy, which already allows it (`localhost` is in `allowedDomains`). macOS and privacy-off sessions are unchanged. Effort: one commit attempt so far, no spec review rounds (the converged memory-privacy spec already says the session reaches localhost; this makes Linux match it).
+
+## Decision-point inventory
+
+- Memory-session launch (`SessionManager` scoped spawn) — modify — adds one environment variable on Linux; no allow/deny decision changes.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable.
+
+---
+
+## 2. Under-block
+
+No block/allow surface. On reach: the session gains nothing new. It could already run `curl --noproxy '' -x "$HTTP_PROXY" http://localhost:...` itself; this only makes the reply scripts do what the sandbox already permits. The proxy still filters by `allowedDomains`, and the server still accepts only the session's limited `mps_` token. The file boundary is untouched: in the live run the agent home's files stayed unreadable.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Right layer: the spawn already owns the session's environment (`TMPDIR`, `CLAUDE_CODE_TMPDIR`, `INSTAR_PORT`). Changing each reply script would need a migration for five scripts and would miss any curl the session runs on its own; `CURL_HOME` covers all of them from one place.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+It sets a transport setting for the session's curl; nothing is decided or refused.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point. The platform check is an invariant: Linux sandboxes use a separate network namespace, macOS does not.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none; reply scripts run unchanged and pick up the setting from curl itself.
+- **Double-fire:** none.
+- **Races:** the file is rewritten at every spawn of that scope; two sessions on the same scope write identical bytes.
+- **Feedback loops:** none.
+
+---
+
+## 6. External surfaces
+
+Only agents with memory privacy turned on, on Linux. Their replies now reach Slack, Telegram, WhatsApp and the app again. No operator-facing actions.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local by design: the file lives in the machine-local scope folder that the spec already keeps on one machine, and it describes this machine's sandbox. No notices, no URLs, no new status surfaces.
+
+---
+
+## 8. Rollback cost
+
+Pure code change: revert and ship a patch. The leftover `.curl/.curlrc` in scope folders is inert without `CURL_HOME`.
+
+---
+
+## Conclusion
+
+Clear to ship. It restores replies for Linux agents that opted in, without widening what the session can reach. Follow-up worth considering, not required here: the boot probe could also check that the server answers from inside the sandbox before reporting `sandboxReady: true`.
+
+---
+
+## Second-pass review (if required)
+
+Not required (Tier 1, no block/allow surface, no new reach).
+
+---
+
+## Evidence pointers
+
+Live on Hetzner mp-privacy-test (Ubuntu 24.04, Claude Code 2.1.318, a local stand-in for the model API so no account was used), real settings from `buildMemorySessionSettings`, real `slack-reply.sh` and `telegram-reply.sh`, stand-in server on 127.0.0.1:4040:
+- Without the change: `curl: (7) Failed to connect to localhost port 4040`, slack rc=1, server saw nothing.
+- With `CURL_HOME`: "Sent 22 chars to channel C123ABC", "Sent 9 chars to topic 42"; server saw `/slack/reply/C123ABC`, `/messaging/preflight`, `/telegram/reply/42`, each with `Bearer mps_scoped`; reading the agent home's notes file still failed with Permission denied.
+- Proxy without its credentials answers 407, which an earlier probe read as an empty reply.
+Tests: `tests/unit/memory-session-policy.test.ts`, `tests/integration/memory-privacy-spawn.test.ts`.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable.

package/upgrades/side-effects/person-decides-counterpart.md

@@ -0,0 +1,62 @@
+# Side-Effects Review — The Person Decides; the Agent Does the Rest (1.x counterpart of Rule 120)
+
+**Version / slug:** `person-decides-counterpart`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** `GPT-6 Astra, on the final diff`
+
+## Summary of the change
+
+A constitution text change. A new article, *The Person Decides; the Agent Does the Rest*, joins the Interaction family as a tree node under *Agent Proposes, Operator Approves*, which gains the back-link. It carries the same obligation as 2.0 Rule 120 (instar-2 PR 190): the agent does the research, account management and operation, and the person only approves or declines, asks for changes, or supplies a credential. It says plainly that nothing enforces it yet and names the two checks owed. The alignment map gains the pair's rows, the generated hierarchy block is regenerated, the Interaction family audit is re-recorded, and the article-count assertion moves from 94 to 95.
+
+## Decision-point inventory
+
+None added. No code path changes.
+
+---
+
+## 1. Over-block
+
+No block surface. The article names an outbound check for later building; it builds none.
+
+## 2. Under-block
+
+Until the outbound check and the per-service live proofs exist, an agent can still hand the person a setup task and nothing stops it. The article says so in **Applied through**.
+
+## 3. Level-of-abstraction fit
+
+A child of *Agent Proposes, Operator Approves*: that parent governs the shape of one ask, and this states the whole boundary of what may be asked. *No Manual Work* is the other natural parent, but its title cannot be named in the tree-node syntax (it contains emphasis markers), and the placement prose names it.
+
+## 4. Signal vs authority compliance
+
+Compliant: the article creates no authority. The owed outbound check would be a hold on a message, to be designed under `docs/signal-vs-authority.md` when it is built.
+
+## 5. Interactions
+
+*Self-Unblock Before Escalating* still decides whether the person is asked at all. *Sovereignty* keeps "if it's the human's, ask", which the alignment map already lists as conflict 5; acting in the person's accounts happens inside the authority they granted, and this change does not resolve that conflict. *The Agent Carries the Loop* (follow-through) is unaffected.
+
+## 6. External surfaces
+
+None at runtime. The published constitution text changes.
+
+## 7. Multi-machine posture
+
+Repo-tracked text; unified.
+
+## 8. Rollback cost
+
+A revert of the text, the map rows, the count assertion and the re-recorded Interaction audit.
+
+## Second-pass review
+
+**Reviewer:** independent cross-family reader, codex-cli on gpt-6-astra
+
+Read the final diff and the 2.0 rule book with Rule 120. Six findings, all low. No drift from Rule 120: "within the authority granted" makes explicit what 2.0 Sovereignty already imposes, and dropping the executive-assistant analogy changes no obligation. Placement sound and the overlaps complementary; *Never a False Blocker*'s physical-action and CAPTCHA allowance is a tension that *Self-Unblock Before Escalating* already has with the same ladder, and this change imports Rule 120 rather than resolving it. No enforcement overclaim. Map counts and rows independently re-counted and correct. Two wording nits applied: the overview now says "no runtime enforcement changes" rather than "agents behave the same", and this artifact says "same obligation" rather than "same wording". Tree-parentage, insertion-placement, hierarchy and countdown checks all pass. Concur with the review: VERDICT YES.
+
+## Counterpart
+
+instar-2 PR 190 adds Rule 120 with the same obligation, and is the master, so it merges first.
+
+## Test expectations changed
+
+`tests/unit/standards-coverage-ratchet.test.ts`: article count 94 to 95.

package/upgrades/side-effects/session-by-tmux.md

@@ -0,0 +1,48 @@
+# Side-Effects Review — lookups by tmux name find the live session
+
+**Version / slug:** `session-by-tmux`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** gpt-6-astra via codex, outside review, two rounds. Round one objected: `ThreadlineMcpHttpService.noteCallFailure` still took the first record by name. Fixed through the shared `pickSessionByTmux`. Round two concurred.
+
+## Summary of the change
+
+`state.listSessions().find(s => s.tmuxSession === name)` returns whichever record the directory lists first, and a name is reused when a conversation comes back to a machine. A drain closed a finished record, was told `already-completed`, and left the running session on the machine the conversation had left (signed red, Studio to Mini, 2026-11-04). `StateManager.findSessionByTmux` prefers a running record, then the newest, at all nine lookups, and a test keeps the pattern out of `src`.
+
+## Decision-point inventory
+
+- Session lookup by name — modify — nine call sites read `StateManager.findSessionByTmux`, and the Threadline failure report reads the same `pickSessionByTmux` rule. No decision rule changes; each now reads the right record.
+
+---
+
+## 1. Over-block
+
+The drain now closes a session it used to miss. That is the intent: the record says the conversation lives elsewhere. Closing still goes through `terminateWithAuthority`.
+
+## 2. Under-block
+
+Only records with a shared name change outcome. If a name has no running record the newest wins, which is the closest fact available.
+
+## 3. Level-of-abstraction fit
+
+One pure rule, `pickSessionByTmux`, exposed on `StateManager`, the owner of session records, rather than a fix at the drain alone, because ten sites had the same fault. The Threadline service gets its records from an injected list, so it calls the rule directly.
+
+## 4. Signal vs authority compliance
+
+No new authority. Readers get a truer record.
+
+## 5. Interactions
+
+Each site meant "the session this name means now": framework resolution, the output route, bound-session reads, delivery incarnation checks and the drain. The Threadline failure report no longer stays silent for a live HTTP session that shares a name with a finished stdio record. `DeviceLimitSessionMover` keeps its injected list and is exempt in the guard. The result is a copy, as before.
+
+## 6. External surfaces
+
+None. No route shape, config or message changes.
+
+## 7. Multi-machine posture
+
+Machine-local records. It fixes a multi-machine symptom: one conversation running in two places after a return trip.
+
+## 8. Rollback cost
+
+Revert the commit. No state depends on it.