instar 1.3.277 → 1.3.278

package/dashboard/index.html

@@ -790,6 +790,35 @@
       display: none !important;
     }
 
+    /* Mandates tab */
+    .mnd-card { border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; margin-bottom: 12px; display: flex; flex-direction: column; gap: 8px; }
+    .mnd-card-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+    .mnd-scope { font-size: 17px; font-weight: 600; color: var(--text-bright); }
+    .mnd-badge { font-size: 12px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--border); }
+    .mnd-ok { color: #3fb950; border-color: #3fb95055; }
+    .mnd-bad { color: #f85149; border-color: #f8514955; font-weight: 700; }
+    .mnd-deny { color: #d29922; border-color: #d2992255; }
+    .mnd-dead { color: var(--text-dim); }
+    .mnd-meta { font-size: 13px; color: var(--text-dim); }
+    .mnd-authorities { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; }
+    .mnd-empty { font-size: 16px; color: var(--text-dim); line-height: 1.6; padding: 12px 0; }
+    .mnd-revoke-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+    .mnd-pin { width: 110px; } .mnd-reason { flex: 1; min-width: 160px; }
+    .mnd-btn { padding: 6px 14px; cursor: pointer; }
+    .mnd-btn-danger { color: #f85149; }
+    .mnd-dead-note { font-size: 13px; color: var(--text-dim); font-style: italic; }
+    .mnd-notice { min-height: 20px; font-size: 14px; color: #3fb950; }
+    .mnd-notice-err { color: #f85149; }
+    .mnd-issue-form { display: flex; flex-direction: column; gap: 10px; max-width: 640px; padding: 12px 0; }
+    .mnd-issue-form label { display: flex; flex-direction: column; gap: 4px; font-size: 13px; color: var(--text-dim); }
+    .mnd-issue-form input, .mnd-issue-form textarea { font: inherit; padding: 6px 8px; }
+    .mnd-issue-form textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+    .mnd-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+    .mnd-table th, .mnd-table td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
+    .mnd-reason-cell { color: var(--text-dim); max-width: 420px; }
+    .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; }
+    .mnd-dim { font-size: 13px; color: var(--text-dim); }
+
     /* ── process-health tab (PROCESS-HEALTH-DASHBOARD-TAB-SPEC §4.1) ──
        Large, readable, calm. No monospace, no tables, no alarm colors.
        Measurable bars: headline ≥24px, section headers ≥20px, body ≥17px,
@@ -2652,6 +2681,7 @@
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
           <button class="tab" data-tab="preferences-learning" onclick="switchTab('preferences-learning')">Preferences</button>
           <button class="tab" data-tab="machines" onclick="switchTab('machines')">Machines</button>
+          <button class="tab" data-tab="mandates" onclick="switchTab('mandates')">Mandates</button>
         </nav>
       </div>
       <div class="vital-signs" id="vitalSigns">
@@ -3200,6 +3230,37 @@
       </details>
     </div>
 
+    <!-- mandates tab (coordination-mandate spec, decision 2A — the operator's PIN-gated surface) -->
+    <div id="mandatesPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:baseline">
+        <h2 class="ph-title">Coordination Mandates</h2>
+        <div id="mndStamp" class="ph-stamp" aria-live="polite"></div>
+      </div>
+      <p class="ph-intro">Your bounded "permission slips" for autonomous agent-to-agent work. The slip — never the agent — is the authorizer. Issuing and revoking require <strong>your dashboard PIN</strong>; agent credentials alone are refused by design. With no slip issued, every delegated action is denied.</p>
+      <div id="mndNotice" class="mnd-notice" aria-live="polite"></div>
+      <section class="ph-section">
+        <h3 class="ph-h">Issued mandates</h3>
+        <div id="mndList"></div>
+      </section>
+      <details class="ph-detail">
+        <summary class="ph-detail-summary">Issue a new mandate (PIN required)</summary>
+        <div class="mnd-issue-form">
+          <label>Scope <input type="text" id="mndIssueScope" value="feedback-migration" /></label>
+          <label>Agent A fingerprint <input type="text" id="mndIssueAgentA" placeholder="full routing fingerprint" /></label>
+          <label>Agent B fingerprint <input type="text" id="mndIssueAgentB" placeholder="full routing fingerprint" /></label>
+          <label>Authorities (JSON) <textarea id="mndIssueAuthorities" rows="9" spellcheck="false"></textarea></label>
+          <label>Expires <input type="datetime-local" id="mndIssueExpires" /></label>
+          <label>Your dashboard PIN <input type="password" id="mndIssuePin" autocomplete="off" placeholder="typed at issuance, never stored" /></label>
+          <button id="mndIssueBtn" class="mnd-btn">Issue mandate</button>
+        </div>
+      </details>
+      <section class="ph-section">
+        <h3 class="ph-h">Decision audit</h3>
+        <p class="ph-h-sub">Every allow and deny, hash-chained. A broken chain means tampering — treat it as an incident.</p>
+        <div id="mndAudit"></div>
+      </section>
+    </div>
+
     <!-- preferences-learning tab (Correction & Preference Learning Sentinel §10 Slice-2) -->
     <div id="preferencesLearningPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:baseline">
@@ -4543,6 +4604,13 @@
         onActivate: () => { if (typeof startMachines === 'function') startMachines(); },
         onDeactivate: () => { if (typeof stopMachines === 'function') stopMachines(); },
       },
+      {
+        id: 'mandates',
+        panels: ['mandatesPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof startMandates === 'function') startMandates(); },
+        onDeactivate: () => { if (typeof stopMandates === 'function') stopMandates(); },
+      },
       {
         id: 'secrets',
         panels: ['secretsPanel'],
@@ -8474,6 +8542,42 @@
       if (__phController) __phController.stop();
     }
 
+    // ── Mandates tab (coordination-mandate spec, decision 2A) ──
+    // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
+    // tab is sent once per action and never stored anywhere.
+    let __mndController = null;
+    let __mndModule = null;
+    async function startMandates() {
+      if (!__mndModule) {
+        try { __mndModule = await import('/dashboard/mandates.js'); }
+        catch (e) { console.error('[mandates] module load failed', e); return; }
+      }
+      if (!__mndController) {
+        const els = {
+          list: document.getElementById('mndList'),
+          audit: document.getElementById('mndAudit'),
+          notice: document.getElementById('mndNotice'),
+          stamp: document.getElementById('mndStamp'),
+          issueScope: document.getElementById('mndIssueScope'),
+          issueAgentA: document.getElementById('mndIssueAgentA'),
+          issueAgentB: document.getElementById('mndIssueAgentB'),
+          issueAuthorities: document.getElementById('mndIssueAuthorities'),
+          issueExpires: document.getElementById('mndIssueExpires'),
+          issuePin: document.getElementById('mndIssuePin'),
+          issueBtn: document.getElementById('mndIssueBtn'),
+        };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          ...opts,
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+        });
+        __mndController = __mndModule.createController({ doc: document, els, fetchImpl });
+      }
+      __mndController.start();
+    }
+    function stopMandates() {
+      if (__mndController) __mndController.stop();
+    }
+
     // ── Preferences tab (Correction & Preference Learning Sentinel §10 Slice-2) ──
     // Same lazy dynamic-import pattern as Process Health: the controller lives in
     // this (classic) scope so it can read `token`; the module ships the pure

package/dashboard/mandates.js

@@ -0,0 +1,205 @@
+/**
+ * mandates.js — the Mandates dashboard tab (coordination-mandate spec, decision 2A).
+ *
+ * The OPERATOR's surface for the Coordination Mandate engine: see every mandate
+ * (with live authorship verification), issue a new one, revoke one, and read the
+ * hash-chained decision audit. Issuance + revocation require the dashboard PIN —
+ * typed here at action time, sent once, NEVER stored (no localStorage, no module
+ * state). The Bearer token alone cannot perform either; that is the engine's
+ * design, and this tab is the human-authenticated surface it points at.
+ *
+ * Same shape as process-health.js / preferences-learning.js: pure renderers +
+ * createController({ doc, els, fetchImpl }) so index.html stays a thin shim.
+ */
+
+const REFRESH_MS = 30_000;
+
+// The A/A/B first-mandate shape, prefilled so the operator edits rather than authors.
+const AUTHORITIES_TEMPLATE = JSON.stringify([
+  { action: 'exchange-read-credential', bounds: { credentialScope: 'read-only', onMachine: true } },
+  { action: 'sign-code-review', bounds: { artifact: 'migration-port', mutual: true } },
+], null, 2);
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+  }[c]));
+}
+
+function shortFp(fp) {
+  const s = String(fp ?? '');
+  return s.length > 12 ? s.slice(0, 8) + '…' : s;
+}
+
+function fmtWhen(iso) {
+  if (!iso) return '—';
+  try {
+    const d = new Date(iso);
+    return d.toLocaleString(undefined, { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
+  } catch { return String(iso); }
+}
+
+export function renderMandates(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    return '<div class="mnd-empty">No mandates issued. The gate is deny-by-default: every delegated agent action refuses until you issue one.</div>';
+  }
+  return list.map((m) => {
+    const expired = Date.parse(m.expiresAt) < Date.now();
+    const state = m.revoked ? 'revoked' : expired ? 'expired' : 'active';
+    const stateCls = state === 'active' ? 'mnd-ok' : 'mnd-dead';
+    const authBadge = m.authorshipValid
+      ? '<span class="mnd-badge mnd-ok">authorship verified</span>'
+      : '<span class="mnd-badge mnd-bad">AUTHORSHIP INVALID</span>';
+    const authorities = (m.authorities || []).map((a) =>
+      `<li><code>${esc(a.action)}</code> — bounds <code>${esc(JSON.stringify(a.bounds))}</code>${a.requiresCondition ? ` — requires <code>${esc(a.requiresCondition)}</code>` : ''}</li>`,
+    ).join('');
+    const revokeUi = state === 'active'
+      ? `<div class="mnd-revoke-row">
+           <input type="password" class="mnd-pin" data-revoke-pin="${esc(m.id)}" placeholder="PIN" autocomplete="off" />
+           <input type="text" class="mnd-reason" data-revoke-reason="${esc(m.id)}" placeholder="reason" />
+           <button class="mnd-btn mnd-btn-danger" data-revoke="${esc(m.id)}">Revoke</button>
+         </div>`
+      : `<div class="mnd-dead-note">${m.revoked ? `revoked ${fmtWhen(m.revoked.at)} — ${esc(m.revoked.reason)}` : `expired ${fmtWhen(m.expiresAt)}`}</div>`;
+    return `<div class="mnd-card">
+      <div class="mnd-card-head">
+        <span class="mnd-scope">${esc(m.scope)}</span>
+        <span class="mnd-badge ${stateCls}">${state}</span>
+        ${authBadge}
+      </div>
+      <div class="mnd-meta">id <code>${esc(m.id)}</code> · agents <code>${esc(shortFp(m.agents?.[0]))}</code> + <code>${esc(shortFp(m.agents?.[1]))}</code> · by ${esc(m.author)} · expires ${fmtWhen(m.expiresAt)}</div>
+      <ul class="mnd-authorities">${authorities}</ul>
+      ${revokeUi}
+    </div>`;
+  }).join('');
+}
+
+export function renderAudit(payload) {
+  const entries = payload?.entries ?? [];
+  const chainOk = payload?.chain?.ok;
+  const chainBadge = chainOk === false
+    ? '<span class="mnd-badge mnd-bad">CHAIN BROKEN — possible tampering</span>'
+    : '<span class="mnd-badge mnd-ok">chain verified</span>';
+  if (entries.length === 0) {
+    return `<div class="mnd-audit-head">${chainBadge}</div><div class="mnd-empty">No decisions recorded yet.</div>`;
+  }
+  const rows = entries.slice(-25).reverse().map((e) =>
+    `<tr>
+      <td>${fmtWhen(e.ts)}</td>
+      <td><span class="mnd-badge ${e.decision === 'allow' ? 'mnd-ok' : 'mnd-deny'}">${esc(e.decision)}</span></td>
+      <td><code>${esc(e.action)}</code></td>
+      <td><code>${esc(shortFp(e.agentFp))}</code></td>
+      <td class="mnd-reason-cell">${esc(e.reason)}</td>
+    </tr>`,
+  ).join('');
+  return `<div class="mnd-audit-head">${chainBadge}<span class="mnd-dim">${entries.length} total decisions · newest first</span></div>
+    <table class="mnd-table"><thead><tr><th>when</th><th>decision</th><th>action</th><th>agent</th><th>reason</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+export function createController({ doc, els, fetchImpl }) {
+  let timer = null;
+  let running = false;
+
+  async function fetchJson(url, opts) {
+    const res = await fetchImpl(url, opts);
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { status: res.status, body };
+  }
+
+  function note(msg, isError) {
+    if (!els.notice) return;
+    els.notice.textContent = msg;
+    els.notice.className = isError ? 'mnd-notice mnd-notice-err' : 'mnd-notice';
+    if (msg) setTimeout(() => { if (els.notice.textContent === msg) els.notice.textContent = ''; }, 8000);
+  }
+
+  async function refresh() {
+    try {
+      const [mand, audit] = await Promise.all([
+        fetchJson('/mandate'),
+        fetchJson('/mandate/audit?limit=200'),
+      ]);
+      if (mand.status === 503) {
+        els.list.innerHTML = '<div class="mnd-empty">Mandate engine unavailable on this server (older version or init failure).</div>';
+        els.audit.innerHTML = '';
+        if (els.stamp) els.stamp.textContent = '';
+        return;
+      }
+      els.list.innerHTML = renderMandates(mand.body?.mandates);
+      els.audit.innerHTML = renderAudit(audit.body);
+      if (els.stamp) els.stamp.textContent = 'updated ' + new Date().toLocaleTimeString();
+      wireRevokeButtons();
+    } catch (e) {
+      note('refresh failed: ' + (e?.message ?? e), true);
+    }
+  }
+
+  function wireRevokeButtons() {
+    els.list.querySelectorAll('[data-revoke]').forEach((btn) => {
+      btn.onclick = async () => {
+        const id = btn.getAttribute('data-revoke');
+        const pinEl = els.list.querySelector(`[data-revoke-pin="${id}"]`);
+        const reasonEl = els.list.querySelector(`[data-revoke-reason="${id}"]`);
+        const pin = pinEl?.value ?? '';
+        if (!pin) { note('Type your dashboard PIN to revoke — revocation is a human action.', true); return; }
+        btn.disabled = true;
+        try {
+          const { status, body } = await fetchJson(`/mandate/${encodeURIComponent(id)}/revoke`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ pin, reason: reasonEl?.value || 'operator revocation (dashboard)' }),
+          });
+          if (pinEl) pinEl.value = ''; // never retain the PIN
+          if (status === 200) { note(`Mandate ${id} revoked.`); await refresh(); }
+          else note(body?.error ?? `revoke failed (${status})`, true);
+        } finally { btn.disabled = false; }
+      };
+    });
+  }
+
+  async function issue() {
+    const pin = els.issuePin?.value ?? '';
+    if (!pin) { note('Type your dashboard PIN — issuance is a human action; agent credentials are refused.', true); return; }
+    let authorities;
+    try { authorities = JSON.parse(els.issueAuthorities?.value || '[]'); }
+    catch { note('Authorities must be valid JSON (array of { action, bounds }).', true); return; }
+    const payload = {
+      pin,
+      scope: els.issueScope?.value?.trim(),
+      agents: [els.issueAgentA?.value?.trim(), els.issueAgentB?.value?.trim()],
+      authorities,
+      expiresAt: els.issueExpires?.value ? new Date(els.issueExpires.value).toISOString() : '',
+    };
+    els.issueBtn.disabled = true;
+    try {
+      const { status, body } = await fetchJson('/mandate/issue', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      if (els.issuePin) els.issuePin.value = ''; // never retain the PIN
+      if (status === 201) {
+        note(`Mandate ${body?.mandate?.id ?? ''} issued.`);
+        await refresh();
+      } else {
+        note(body?.error ?? `issue failed (${status})`, true);
+      }
+    } finally { els.issueBtn.disabled = false; }
+  }
+
+  function start() {
+    if (running) return;
+    running = true;
+    if (els.issueAuthorities && !els.issueAuthorities.value) els.issueAuthorities.value = AUTHORITIES_TEMPLATE;
+    if (els.issueBtn) els.issueBtn.onclick = issue;
+    refresh();
+    timer = setInterval(refresh, REFRESH_MS);
+  }
+
+  function stop() {
+    running = false;
+    if (timer) { clearInterval(timer); timer = null; }
+  }
+
+  return { start, stop, refresh };
+}

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAiD1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAuE3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkPpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0/CvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAoG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6JtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0SvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAwBnf,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAob3B,OAAO,CAAC,wBAAwB;IAuJhC,OAAO,CAAC,2BAA2B;IAoEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IA0JnC,OAAO,CAAC,qBAAqB;IA4P7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA0MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAgC1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwC/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyN7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAiD1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAuE3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkPpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAyiDvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAoG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6JtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0SvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAwBnf,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAob3B,OAAO,CAAC,wBAAwB;IAuJhC,OAAO,CAAC,2BAA2B;IAoEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IA0JnC,OAAO,CAAC,qBAAqB;IA4P7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA0MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAgC1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwC/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyN7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -4066,6 +4066,50 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             patched = true;
             result.upgraded.push('CLAUDE.md: added Resource Usage (CPU + memory) awareness section');
         }
+        // Coordination Mandate engine (docs/specs/coordination-mandate.md) — Agent
+        // Awareness backfill for the deny-by-default A2A authority gate (#788).
+        // Existing agents updating in place must learn to evaluate-before-acting and
+        // that issuance/revocation are PIN-gated human actions. Content-sniffed on
+        // the distinctive evaluate route.
+        if (!content.includes('/mandate/evaluate')) {
+            const section = `
+**Coordination Mandate** — Your operator's "permission slip" for autonomous agent-to-agent work. Instead of approving every step of a multi-agent project, the operator issues ONE bounded, expiring, revocable mandate (from the dashboard Mandates tab, behind their PIN) delegating SPECIFIC authorities to a SPECIFIC pair of agents. The mandate — never you — is the authorizer: requester ≠ authorizer is preserved. Deny-by-default: with no mandate issued, every check denies.
+- **Before any A2A action under a mandate** (PROACTIVE — this is the trigger): check it: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/mandate/evaluate -H 'Content-Type: application/json' -d '{"action":"sign-code-review","params":{"artifact":"migration-port","mutual":true},"agentFp":"<your-fingerprint>","mandateId":"<id>"}'\` → \`{ decision: "allow"|"deny", reason }\`. A deny means STOP — do not retry around it or escalate to a human-bypass; the bounds are the operator's.
+- Inspect: \`GET /mandate\` (each with live \`authorshipValid\`) · \`GET /mandate/:id\` · \`GET /mandate/audit\` (every decision, hash-chained — \`chain.ok:false\` means tampering; surface it immediately).
+- **You cannot issue or revoke mandates.** \`POST /mandate/issue\` and \`POST /mandate/:id/revoke\` require the operator's dashboard PIN — your Bearer token is structurally insufficient. NEVER ask the user to paste their PIN into chat; point them at the dashboard **Mandates tab** (issue/revoke forms + the decision audit live there).
+- Every evaluation (allow AND deny) is audited. Act as if the audit is read by the operator — because it is. (Spec: \`docs/specs/coordination-mandate.md\`.)
+`;
+            content += '\n' + section;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Coordination Mandate awareness section');
+        }
+        // ReviewExchange protocol (coordination-mandate spec §7 G2.3) — Agent
+        // Awareness backfill. Content-sniffed on the distinctive route prefix.
+        if (!content.includes('/review-exchange')) {
+            const section = `
+**ReviewExchange (autonomous code review)** — The structured way two mandate-named agents sign off a code review WITHOUT the operator relaying. One exchange = one review package, content-addressed (\`packageSha256\` fixed at creation), moving linearly: proposed → delivered → verdict-recorded → complete (or changes-requested — rework is a NEW exchange). BOTH sign-offs (the peer's authenticated approve-verdict AND your countersignature) are evaluated through the mandate gate's \`sign-code-review\` authority before acceptance; every accepted signature carries the audit hash of the gate decision that authorized it.
+- Create: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/review-exchange -H 'Content-Type: application/json' -d '{"mandateId":"<id>","artifact":"migration-port","packageRef":"docs/...-review-package.md","packageSha256":"<sha256 of the package>","parties":["<your-fp>","<peer-fp>"]}'\`
+- Drive it: \`POST /review-exchange/:id/delivered\` (after you actually sent the package over Threadline — record the message ref as evidence) → \`POST /review-exchange/:id/peer-verdict\` (the peer's authenticated verdict; approve = their sign-off, mandate-gated) → \`POST /review-exchange/:id/sign\` (your countersignature, mandate-gated → complete).
+- **When to use** (PROACTIVE — this is the trigger): the moment a mandate with \`sign-code-review\` exists and you need a peer agent's review of work in its scope, drive it through an exchange — NEVER improvise a sign-off in chat prose (an unrecorded "LGTM" over Threadline is not a sign-off; the gate-audited exchange is). A 403 on a sign step means the mandate denied it — STOP, do not work around it.
+- Inspect: \`GET /review-exchange\` · \`GET /review-exchange/:id\` (signatures + audit hashes).
+`;
+            content += '\n' + section;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added ReviewExchange awareness section');
+        }
+        // Cutover-readiness checker (coordination-mandate spec §7 G2.4) — Agent
+        // Awareness backfill. Content-sniffed on the distinctive route prefix.
+        if (!content.includes('/cutover-readiness')) {
+            const section = `
+**Cutover Readiness** — When a migration (or any one-way cutover) is gated on objective conditions, this is the read surface for "is everything up to the door green?" — composed from REAL durable state (the persisted import integrity report + the durable zero-divergence parity window with a freshness bound), never from anyone's assertion.
+- Check: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/cutover-readiness\` → \`{ ready, door: "manual-operator-click", integrity, parity }\`.
+- Feed the parity window with a live check: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/cutover-readiness/parity-pass\` — the server fetches + compares server-side; you only trigger it. A failed check records nothing.
+- **The door is NOT yours**: \`ready: true\` means the conditions are green — it is NEVER an instruction to flip. The cutover click belongs to the operator. NEVER present \`ready\` to the user as "I can cut over now"; present it as "everything up to your click is green."
+`;
+            content += '\n' + section;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Cutover Readiness awareness section');
+        }
         if (patched) {
             try {
                 fs.writeFileSync(claudeMdPath, content);