instar 1.3.277 → 1.3.278

package/dist/scaffold/templates.js

@@ -668,7 +668,7 @@ This routes feedback to the Instar maintainers automatically. Valid types: \`bug
 **Coordination Mandate** — Your operator's "permission slip" for autonomous agent-to-agent work. Instead of approving every step of a multi-agent project, the operator issues ONE bounded, expiring, revocable mandate (from the dashboard, behind their PIN) delegating SPECIFIC authorities to a SPECIFIC pair of agents. The mandate — never you — is the authorizer: requester ≠ authorizer is preserved. Deny-by-default: with no mandate issued, every check denies.
 - **Before any A2A action under a mandate** (PROACTIVE — this is the trigger): check it: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/mandate/evaluate -H 'Content-Type: application/json' -d '{"action":"sign-code-review","params":{"artifact":"migration-port","mutual":true},"agentFp":"<your-fingerprint>","mandateId":"<id>"}'\` → \`{ decision: "allow"|"deny", reason }\`. A deny means STOP — do not retry around it or escalate to a human-bypass; the bounds are the operator's.
 - Inspect: \`GET /mandate\` (each with live \`authorshipValid\`) · \`GET /mandate/:id\` · \`GET /mandate/audit\` (every decision, hash-chained — \`chain.ok:false\` means tampering; surface it immediately).
-- **You cannot issue or revoke mandates.** \`POST /mandate/issue\` and \`POST /mandate/:id/revoke\` require the operator's dashboard PIN — your Bearer token is structurally insufficient. NEVER ask the user to paste their PIN into chat; point them at the dashboard.
+- **You cannot issue or revoke mandates.** \`POST /mandate/issue\` and \`POST /mandate/:id/revoke\` require the operator's dashboard PIN — your Bearer token is structurally insufficient. NEVER ask the user to paste their PIN into chat; point them at the dashboard **Mandates tab** (issue/revoke forms + the decision audit live there).
 - Every evaluation (allow AND deny) is audited. Act as if the audit is read by the operator — because it is. (Spec: \`docs/specs/coordination-mandate.md\`.)
 
 **ReviewExchange (autonomous code review)** — The structured way two mandate-named agents sign off a code review WITHOUT the operator relaying. One exchange = one review package, content-addressed (\`packageSha256\` fixed at creation), moving linearly: proposed → delivered → verdict-recorded → complete (or changes-requested — rework is a NEW exchange). BOTH sign-offs (the peer's authenticated approve-verdict AND your countersignature) are evaluated through the mandate gate's \`sign-code-review\` authority before acceptance; every accepted signature carries the audit hash of the gate decision that authorized it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.277",
+  "version": "1.3.278",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-05T08:15:17.647Z",
-  "instarVersion": "1.3.277",
+  "generatedAt": "2026-06-05T08:36:45.491Z",
+  "instarVersion": "1.3.278",
   "entryCount": 198,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "3ded8ee5789307525929dba01a9550a49570129bce2db0d1d5c1f989ad6dbb3e",
+      "contentHash": "e2715fcdb1fa8875b2b20cc52b9180602aee4669a739f54d428f2c6d30986c72",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -688,7 +688,7 @@ This routes feedback to the Instar maintainers automatically. Valid types: \`bug
 **Coordination Mandate** — Your operator's "permission slip" for autonomous agent-to-agent work. Instead of approving every step of a multi-agent project, the operator issues ONE bounded, expiring, revocable mandate (from the dashboard, behind their PIN) delegating SPECIFIC authorities to a SPECIFIC pair of agents. The mandate — never you — is the authorizer: requester ≠ authorizer is preserved. Deny-by-default: with no mandate issued, every check denies.
 - **Before any A2A action under a mandate** (PROACTIVE — this is the trigger): check it: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/mandate/evaluate -H 'Content-Type: application/json' -d '{"action":"sign-code-review","params":{"artifact":"migration-port","mutual":true},"agentFp":"<your-fingerprint>","mandateId":"<id>"}'\` → \`{ decision: "allow"|"deny", reason }\`. A deny means STOP — do not retry around it or escalate to a human-bypass; the bounds are the operator's.
 - Inspect: \`GET /mandate\` (each with live \`authorshipValid\`) · \`GET /mandate/:id\` · \`GET /mandate/audit\` (every decision, hash-chained — \`chain.ok:false\` means tampering; surface it immediately).
-- **You cannot issue or revoke mandates.** \`POST /mandate/issue\` and \`POST /mandate/:id/revoke\` require the operator's dashboard PIN — your Bearer token is structurally insufficient. NEVER ask the user to paste their PIN into chat; point them at the dashboard.
+- **You cannot issue or revoke mandates.** \`POST /mandate/issue\` and \`POST /mandate/:id/revoke\` require the operator's dashboard PIN — your Bearer token is structurally insufficient. NEVER ask the user to paste their PIN into chat; point them at the dashboard **Mandates tab** (issue/revoke forms + the decision audit live there).
 - Every evaluation (allow AND deny) is audited. Act as if the audit is read by the operator — because it is. (Spec: \`docs/specs/coordination-mandate.md\`.)
 
 **ReviewExchange (autonomous code review)** — The structured way two mandate-named agents sign off a code review WITHOUT the operator relaying. One exchange = one review package, content-addressed (\`packageSha256\` fixed at creation), moving linearly: proposed → delivered → verdict-recorded → complete (or changes-requested — rework is a NEW exchange). BOTH sign-offs (the peer's authenticated approve-verdict AND your countersignature) are evaluated through the mandate gate's \`sign-code-review\` authority before acceptance; every accepted signature carries the audit hash of the gate decision that authorized it.

package/upgrades/1.3.278.md

@@ -0,0 +1,36 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a Mandates tab to the dashboard — the operator's surface for the coordination
+permission slips. It lists every issued mandate with live authorship verification and
+state, provides PIN-gated forms to issue a new mandate or revoke an existing one, and
+shows the tamper-evident decision audit with its chain status. The PIN is typed at
+action time, sent once, and cleared immediately — it is never stored anywhere in the
+browser. Also backfilled the agent-awareness sections for the three coordination
+surfaces into existing agents' instruction files on update, so agents updated in
+place learn these capabilities exist (previously only freshly-initialized agents got
+them).
+
+## What to Tell Your User
+
+Your dashboard now has a Mandates tab where you manage the permission slips for
+autonomous agent-to-agent work: see every slip and whether its authorship still
+verifies, issue a new one with your PIN, tear one up with your PIN, and read the
+tamper-evident log of every allowed and denied action under them. Your PIN is asked
+for right when you act and is never remembered by the page.
+
+## Summary of New Capabilities
+
+- See all coordination mandates with live authorship-verification badges and
+  active/revoked/expired state at a glance.
+- Issue a mandate from a form (pre-filled with the standard two-authority shape) —
+  PIN required, typed at issuance, never stored.
+- Revoke any active mandate inline with a reason — PIN required.
+- Read the hash-chained decision audit; a broken chain is flagged loudly as possible
+  tampering.
+- Existing agents now learn the mandate, review-exchange, and cutover-readiness
+  surfaces via the update path, not just fresh installs.

package/upgrades/side-effects/mandates-dashboard-tab.md

@@ -0,0 +1,56 @@
+# Side-effects review — Mandates dashboard tab + coordination awareness backfill
+
+Spec: `docs/specs/coordination-mandate.md` (approved A/A/B; decision 2A makes the
+dashboard-behind-PIN the issuance surface). Change: a new dashboard **Mandates** tab
+(`dashboard/mandates.js` external module + index.html shim) + the Migration-Parity
+CLAUDE.md backfill for the three coordination surfaces shipped in #788/#797/#799.
+
+## 1. Blast radius
+
+- **Dashboard:** additive — one new tab button, panel, TAB_REGISTRY entry, lazy
+  module import (the process-health.js pattern), and scoped `.mnd-*` CSS. No existing
+  tab, function, or style is modified. The dashboard ships inside the npm package, so
+  existing agents receive the tab on their next update with no migration.
+- **PostUpdateMigrator:** three new content-sniffed CLAUDE.md backfill blocks
+  (Coordination Mandate / ReviewExchange / Cutover Readiness), appended only when the
+  distinctive route marker is absent — idempotent, never rewrites existing content.
+  This closes a REAL parity gap: #788/#797/#799 added the template blurbs for new
+  agents but no backfill, so the deployed fleet would never have learned these
+  surfaces exist.
+- **templates.ts:** one line sharpened (point the operator at the "Mandates tab"
+  rather than the generic dashboard).
+
+## 2. Security model (the PIN discipline, in the UI this time)
+
+- The tab's issue/revoke forms collect the PIN in a `type="password"` input with
+  `autocomplete="off"`, send it ONCE in the request body to the already-PIN-gated
+  routes, and **clear the field immediately after the response — success or failure**.
+  It is never written to localStorage, module state, or logs (behaviorally tested).
+- The Bearer token the dashboard holds cannot issue/revoke — that is the engine's
+  server-side design (#788); this tab is just the human surface decision 2A names.
+- Rendering is XSS-safe: every dynamic field (ids, scopes, fingerprints, authority
+  bounds, audit reasons — all potentially attacker-influenced via the API) is escaped
+  (tested with hostile payloads).
+- A broken audit chain (`chain.ok:false`) renders as a loud "CHAIN BROKEN — possible
+  tampering" badge, never silently.
+
+## 3. State / data
+
+None on the server. The tab reads `/mandate` + `/mandate/audit` and writes only
+through the existing PIN-gated routes. Browser-side, nothing persists beyond the
+already-stored dashboard Bearer token (unchanged).
+
+## 4. Failure modes
+
+- Older server without the engine → 503 → friendly "engine unavailable" copy.
+- Module load failure → console error, tab simply shows nothing (no crash).
+- Wrong PIN → the route's 403 + attempt limiting surface as an inline error; the
+  field still clears.
+
+## 5. Test coverage
+
+18 tests: 5 HTML-at-rest wiring (tab/panel/registry/lazy-import/plain-language), 4
+renderer (deny-by-default copy, badges, XSS with hostile payloads, broken-chain), 6
+controller (PIN required → no request; PIN sent once then CLEARED on success AND on
+403; template prefill; 503 state), 4 migration (backfill lands with port baked in,
+security copy verbatim, idempotent, no double-patch on fresh agents).