instar 1.3.276 → 1.3.278

package/dashboard/index.html

@@ -790,6 +790,35 @@
       display: none !important;
     }
 
+    /* Mandates tab */
+    .mnd-card { border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; margin-bottom: 12px; display: flex; flex-direction: column; gap: 8px; }
+    .mnd-card-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+    .mnd-scope { font-size: 17px; font-weight: 600; color: var(--text-bright); }
+    .mnd-badge { font-size: 12px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--border); }
+    .mnd-ok { color: #3fb950; border-color: #3fb95055; }
+    .mnd-bad { color: #f85149; border-color: #f8514955; font-weight: 700; }
+    .mnd-deny { color: #d29922; border-color: #d2992255; }
+    .mnd-dead { color: var(--text-dim); }
+    .mnd-meta { font-size: 13px; color: var(--text-dim); }
+    .mnd-authorities { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; }
+    .mnd-empty { font-size: 16px; color: var(--text-dim); line-height: 1.6; padding: 12px 0; }
+    .mnd-revoke-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+    .mnd-pin { width: 110px; } .mnd-reason { flex: 1; min-width: 160px; }
+    .mnd-btn { padding: 6px 14px; cursor: pointer; }
+    .mnd-btn-danger { color: #f85149; }
+    .mnd-dead-note { font-size: 13px; color: var(--text-dim); font-style: italic; }
+    .mnd-notice { min-height: 20px; font-size: 14px; color: #3fb950; }
+    .mnd-notice-err { color: #f85149; }
+    .mnd-issue-form { display: flex; flex-direction: column; gap: 10px; max-width: 640px; padding: 12px 0; }
+    .mnd-issue-form label { display: flex; flex-direction: column; gap: 4px; font-size: 13px; color: var(--text-dim); }
+    .mnd-issue-form input, .mnd-issue-form textarea { font: inherit; padding: 6px 8px; }
+    .mnd-issue-form textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+    .mnd-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+    .mnd-table th, .mnd-table td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
+    .mnd-reason-cell { color: var(--text-dim); max-width: 420px; }
+    .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; }
+    .mnd-dim { font-size: 13px; color: var(--text-dim); }
+
     /* ── process-health tab (PROCESS-HEALTH-DASHBOARD-TAB-SPEC §4.1) ──
        Large, readable, calm. No monospace, no tables, no alarm colors.
        Measurable bars: headline ≥24px, section headers ≥20px, body ≥17px,
@@ -2652,6 +2681,7 @@
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
           <button class="tab" data-tab="preferences-learning" onclick="switchTab('preferences-learning')">Preferences</button>
           <button class="tab" data-tab="machines" onclick="switchTab('machines')">Machines</button>
+          <button class="tab" data-tab="mandates" onclick="switchTab('mandates')">Mandates</button>
         </nav>
       </div>
       <div class="vital-signs" id="vitalSigns">
@@ -3200,6 +3230,37 @@
       </details>
     </div>
 
+    <!-- mandates tab (coordination-mandate spec, decision 2A — the operator's PIN-gated surface) -->
+    <div id="mandatesPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:baseline">
+        <h2 class="ph-title">Coordination Mandates</h2>
+        <div id="mndStamp" class="ph-stamp" aria-live="polite"></div>
+      </div>
+      <p class="ph-intro">Your bounded "permission slips" for autonomous agent-to-agent work. The slip — never the agent — is the authorizer. Issuing and revoking require <strong>your dashboard PIN</strong>; agent credentials alone are refused by design. With no slip issued, every delegated action is denied.</p>
+      <div id="mndNotice" class="mnd-notice" aria-live="polite"></div>
+      <section class="ph-section">
+        <h3 class="ph-h">Issued mandates</h3>
+        <div id="mndList"></div>
+      </section>
+      <details class="ph-detail">
+        <summary class="ph-detail-summary">Issue a new mandate (PIN required)</summary>
+        <div class="mnd-issue-form">
+          <label>Scope <input type="text" id="mndIssueScope" value="feedback-migration" /></label>
+          <label>Agent A fingerprint <input type="text" id="mndIssueAgentA" placeholder="full routing fingerprint" /></label>
+          <label>Agent B fingerprint <input type="text" id="mndIssueAgentB" placeholder="full routing fingerprint" /></label>
+          <label>Authorities (JSON) <textarea id="mndIssueAuthorities" rows="9" spellcheck="false"></textarea></label>
+          <label>Expires <input type="datetime-local" id="mndIssueExpires" /></label>
+          <label>Your dashboard PIN <input type="password" id="mndIssuePin" autocomplete="off" placeholder="typed at issuance, never stored" /></label>
+          <button id="mndIssueBtn" class="mnd-btn">Issue mandate</button>
+        </div>
+      </details>
+      <section class="ph-section">
+        <h3 class="ph-h">Decision audit</h3>
+        <p class="ph-h-sub">Every allow and deny, hash-chained. A broken chain means tampering — treat it as an incident.</p>
+        <div id="mndAudit"></div>
+      </section>
+    </div>
+
     <!-- preferences-learning tab (Correction & Preference Learning Sentinel §10 Slice-2) -->
     <div id="preferencesLearningPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:baseline">
@@ -4543,6 +4604,13 @@
         onActivate: () => { if (typeof startMachines === 'function') startMachines(); },
         onDeactivate: () => { if (typeof stopMachines === 'function') stopMachines(); },
       },
+      {
+        id: 'mandates',
+        panels: ['mandatesPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof startMandates === 'function') startMandates(); },
+        onDeactivate: () => { if (typeof stopMandates === 'function') stopMandates(); },
+      },
       {
         id: 'secrets',
         panels: ['secretsPanel'],
@@ -8474,6 +8542,42 @@
       if (__phController) __phController.stop();
     }
 
+    // ── Mandates tab (coordination-mandate spec, decision 2A) ──
+    // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
+    // tab is sent once per action and never stored anywhere.
+    let __mndController = null;
+    let __mndModule = null;
+    async function startMandates() {
+      if (!__mndModule) {
+        try { __mndModule = await import('/dashboard/mandates.js'); }
+        catch (e) { console.error('[mandates] module load failed', e); return; }
+      }
+      if (!__mndController) {
+        const els = {
+          list: document.getElementById('mndList'),
+          audit: document.getElementById('mndAudit'),
+          notice: document.getElementById('mndNotice'),
+          stamp: document.getElementById('mndStamp'),
+          issueScope: document.getElementById('mndIssueScope'),
+          issueAgentA: document.getElementById('mndIssueAgentA'),
+          issueAgentB: document.getElementById('mndIssueAgentB'),
+          issueAuthorities: document.getElementById('mndIssueAuthorities'),
+          issueExpires: document.getElementById('mndIssueExpires'),
+          issuePin: document.getElementById('mndIssuePin'),
+          issueBtn: document.getElementById('mndIssueBtn'),
+        };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          ...opts,
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+        });
+        __mndController = __mndModule.createController({ doc: document, els, fetchImpl });
+      }
+      __mndController.start();
+    }
+    function stopMandates() {
+      if (__mndController) __mndController.stop();
+    }
+
     // ── Preferences tab (Correction & Preference Learning Sentinel §10 Slice-2) ──
     // Same lazy dynamic-import pattern as Process Health: the controller lives in
     // this (classic) scope so it can read `token`; the module ships the pure

package/dashboard/mandates.js

@@ -0,0 +1,205 @@
+/**
+ * mandates.js — the Mandates dashboard tab (coordination-mandate spec, decision 2A).
+ *
+ * The OPERATOR's surface for the Coordination Mandate engine: see every mandate
+ * (with live authorship verification), issue a new one, revoke one, and read the
+ * hash-chained decision audit. Issuance + revocation require the dashboard PIN —
+ * typed here at action time, sent once, NEVER stored (no localStorage, no module
+ * state). The Bearer token alone cannot perform either; that is the engine's
+ * design, and this tab is the human-authenticated surface it points at.
+ *
+ * Same shape as process-health.js / preferences-learning.js: pure renderers +
+ * createController({ doc, els, fetchImpl }) so index.html stays a thin shim.
+ */
+
+const REFRESH_MS = 30_000;
+
+// The A/A/B first-mandate shape, prefilled so the operator edits rather than authors.
+const AUTHORITIES_TEMPLATE = JSON.stringify([
+  { action: 'exchange-read-credential', bounds: { credentialScope: 'read-only', onMachine: true } },
+  { action: 'sign-code-review', bounds: { artifact: 'migration-port', mutual: true } },
+], null, 2);
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+  }[c]));
+}
+
+function shortFp(fp) {
+  const s = String(fp ?? '');
+  return s.length > 12 ? s.slice(0, 8) + '…' : s;
+}
+
+function fmtWhen(iso) {
+  if (!iso) return '—';
+  try {
+    const d = new Date(iso);
+    return d.toLocaleString(undefined, { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
+  } catch { return String(iso); }
+}
+
+export function renderMandates(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    return '<div class="mnd-empty">No mandates issued. The gate is deny-by-default: every delegated agent action refuses until you issue one.</div>';
+  }
+  return list.map((m) => {
+    const expired = Date.parse(m.expiresAt) < Date.now();
+    const state = m.revoked ? 'revoked' : expired ? 'expired' : 'active';
+    const stateCls = state === 'active' ? 'mnd-ok' : 'mnd-dead';
+    const authBadge = m.authorshipValid
+      ? '<span class="mnd-badge mnd-ok">authorship verified</span>'
+      : '<span class="mnd-badge mnd-bad">AUTHORSHIP INVALID</span>';
+    const authorities = (m.authorities || []).map((a) =>
+      `<li><code>${esc(a.action)}</code> — bounds <code>${esc(JSON.stringify(a.bounds))}</code>${a.requiresCondition ? ` — requires <code>${esc(a.requiresCondition)}</code>` : ''}</li>`,
+    ).join('');
+    const revokeUi = state === 'active'
+      ? `<div class="mnd-revoke-row">
+           <input type="password" class="mnd-pin" data-revoke-pin="${esc(m.id)}" placeholder="PIN" autocomplete="off" />
+           <input type="text" class="mnd-reason" data-revoke-reason="${esc(m.id)}" placeholder="reason" />
+           <button class="mnd-btn mnd-btn-danger" data-revoke="${esc(m.id)}">Revoke</button>
+         </div>`
+      : `<div class="mnd-dead-note">${m.revoked ? `revoked ${fmtWhen(m.revoked.at)} — ${esc(m.revoked.reason)}` : `expired ${fmtWhen(m.expiresAt)}`}</div>`;
+    return `<div class="mnd-card">
+      <div class="mnd-card-head">
+        <span class="mnd-scope">${esc(m.scope)}</span>
+        <span class="mnd-badge ${stateCls}">${state}</span>
+        ${authBadge}
+      </div>
+      <div class="mnd-meta">id <code>${esc(m.id)}</code> · agents <code>${esc(shortFp(m.agents?.[0]))}</code> + <code>${esc(shortFp(m.agents?.[1]))}</code> · by ${esc(m.author)} · expires ${fmtWhen(m.expiresAt)}</div>
+      <ul class="mnd-authorities">${authorities}</ul>
+      ${revokeUi}
+    </div>`;
+  }).join('');
+}
+
+export function renderAudit(payload) {
+  const entries = payload?.entries ?? [];
+  const chainOk = payload?.chain?.ok;
+  const chainBadge = chainOk === false
+    ? '<span class="mnd-badge mnd-bad">CHAIN BROKEN — possible tampering</span>'
+    : '<span class="mnd-badge mnd-ok">chain verified</span>';
+  if (entries.length === 0) {
+    return `<div class="mnd-audit-head">${chainBadge}</div><div class="mnd-empty">No decisions recorded yet.</div>`;
+  }
+  const rows = entries.slice(-25).reverse().map((e) =>
+    `<tr>
+      <td>${fmtWhen(e.ts)}</td>
+      <td><span class="mnd-badge ${e.decision === 'allow' ? 'mnd-ok' : 'mnd-deny'}">${esc(e.decision)}</span></td>
+      <td><code>${esc(e.action)}</code></td>
+      <td><code>${esc(shortFp(e.agentFp))}</code></td>
+      <td class="mnd-reason-cell">${esc(e.reason)}</td>
+    </tr>`,
+  ).join('');
+  return `<div class="mnd-audit-head">${chainBadge}<span class="mnd-dim">${entries.length} total decisions · newest first</span></div>
+    <table class="mnd-table"><thead><tr><th>when</th><th>decision</th><th>action</th><th>agent</th><th>reason</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+export function createController({ doc, els, fetchImpl }) {
+  let timer = null;
+  let running = false;
+
+  async function fetchJson(url, opts) {
+    const res = await fetchImpl(url, opts);
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { status: res.status, body };
+  }
+
+  function note(msg, isError) {
+    if (!els.notice) return;
+    els.notice.textContent = msg;
+    els.notice.className = isError ? 'mnd-notice mnd-notice-err' : 'mnd-notice';
+    if (msg) setTimeout(() => { if (els.notice.textContent === msg) els.notice.textContent = ''; }, 8000);
+  }
+
+  async function refresh() {
+    try {
+      const [mand, audit] = await Promise.all([
+        fetchJson('/mandate'),
+        fetchJson('/mandate/audit?limit=200'),
+      ]);
+      if (mand.status === 503) {
+        els.list.innerHTML = '<div class="mnd-empty">Mandate engine unavailable on this server (older version or init failure).</div>';
+        els.audit.innerHTML = '';
+        if (els.stamp) els.stamp.textContent = '';
+        return;
+      }
+      els.list.innerHTML = renderMandates(mand.body?.mandates);
+      els.audit.innerHTML = renderAudit(audit.body);
+      if (els.stamp) els.stamp.textContent = 'updated ' + new Date().toLocaleTimeString();
+      wireRevokeButtons();
+    } catch (e) {
+      note('refresh failed: ' + (e?.message ?? e), true);
+    }
+  }
+
+  function wireRevokeButtons() {
+    els.list.querySelectorAll('[data-revoke]').forEach((btn) => {
+      btn.onclick = async () => {
+        const id = btn.getAttribute('data-revoke');
+        const pinEl = els.list.querySelector(`[data-revoke-pin="${id}"]`);
+        const reasonEl = els.list.querySelector(`[data-revoke-reason="${id}"]`);
+        const pin = pinEl?.value ?? '';
+        if (!pin) { note('Type your dashboard PIN to revoke — revocation is a human action.', true); return; }
+        btn.disabled = true;
+        try {
+          const { status, body } = await fetchJson(`/mandate/${encodeURIComponent(id)}/revoke`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ pin, reason: reasonEl?.value || 'operator revocation (dashboard)' }),
+          });
+          if (pinEl) pinEl.value = ''; // never retain the PIN
+          if (status === 200) { note(`Mandate ${id} revoked.`); await refresh(); }
+          else note(body?.error ?? `revoke failed (${status})`, true);
+        } finally { btn.disabled = false; }
+      };
+    });
+  }
+
+  async function issue() {
+    const pin = els.issuePin?.value ?? '';
+    if (!pin) { note('Type your dashboard PIN — issuance is a human action; agent credentials are refused.', true); return; }
+    let authorities;
+    try { authorities = JSON.parse(els.issueAuthorities?.value || '[]'); }
+    catch { note('Authorities must be valid JSON (array of { action, bounds }).', true); return; }
+    const payload = {
+      pin,
+      scope: els.issueScope?.value?.trim(),
+      agents: [els.issueAgentA?.value?.trim(), els.issueAgentB?.value?.trim()],
+      authorities,
+      expiresAt: els.issueExpires?.value ? new Date(els.issueExpires.value).toISOString() : '',
+    };
+    els.issueBtn.disabled = true;
+    try {
+      const { status, body } = await fetchJson('/mandate/issue', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      if (els.issuePin) els.issuePin.value = ''; // never retain the PIN
+      if (status === 201) {
+        note(`Mandate ${body?.mandate?.id ?? ''} issued.`);
+        await refresh();
+      } else {
+        note(body?.error ?? `issue failed (${status})`, true);
+      }
+    } finally { els.issueBtn.disabled = false; }
+  }
+
+  function start() {
+    if (running) return;
+    running = true;
+    if (els.issueAuthorities && !els.issueAuthorities.value) els.issueAuthorities.value = AUTHORITIES_TEMPLATE;
+    if (els.issueBtn) els.issueBtn.onclick = issue;
+    refresh();
+    timer = setInterval(refresh, REFRESH_MS);
+  }
+
+  function stop() {
+    running = false;
+    if (timer) { clearInterval(timer); timer = null; }
+  }
+
+  return { start, stop, refresh };
+}

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAojRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8jRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9460,6 +9460,17 @@ export async function startServer(options) {
                                     ? provisioner.provisionAll()
                                     : Promise.resolve([]),
                                 localKeyPaths: () => secretSyncMod.secretKeyPaths(readSecrets()),
+                                // Vault readability probe — NEVER mask a decrypt failure as "empty"
+                                // (the 2026-06-05 bifurcation hid behind localKeyPaths: []).
+                                vaultStatus: () => {
+                                    try {
+                                        const secrets = provStore.read();
+                                        return { status: Object.keys(secrets).length > 0 ? 'ok' : 'empty' };
+                                    }
+                                    catch (err) {
+                                        return { status: 'decrypt-failed', error: err instanceof Error ? err.message : String(err) };
+                                    }
+                                },
                                 syncTargets: onlinePeers,
                             };
                             if (_secretSyncPushEnabled) {