instar 1.3.341 → 1.3.343

package/dist/redteam/ScenarioPack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScenarioPack.js","sourceRoot":"","sources":["../../src/redteam/ScenarioPack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA+BjE,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAuC;IACrE,sEAAsE;IACtE,6EAA6E;IAC7E,oEAAoE;IACpE,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACtD,iBAAiB,EAAE,CAAC,eAAe,CAAC;IACpC,iBAAiB,EAAE,CAAC,YAAY,CAAC;CAClC,CAAC;AAoEF;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAkB,EAAE,SAAoB;IAC/D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAElB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,CAAC,CAAC,EAAE;gBAChB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,kBAAkB,CAAC,CAAC,aAAa,kDAAkD,SAAS,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,oFAAoF;aAC9O,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,CAAC,CAAC,EAAE;gBAChB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,uHAAuH;aACjI,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,CAAC,CAAC,EAAE;oBAChB,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,8FAA8F;iBACzH,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,uBAAuB,EAAE,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,MAAuB;IAC5E,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACL,UAAU,EAAE,UAAU;gBACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,MAAM,EAAE,mBAAmB,IAAI,yBAAyB,CAAC,CAAC,iBAAiB,IAAI;aAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,+IAA+I;KACxJ,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG;IACtB,4BAA4B,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ;IAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY;IAC3D,8CAA8C,EAAE,iBAAiB;CAClE,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB;IACrE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;CAC7E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAAiB;IAC/C,IAAI,EAAE,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAEjC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,mBAAmB;IACnB,IAAI,QAAQ,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,QAAQ,IAAI,OAAO;QAAE,OAAO,kBAAkB,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,MAAM,CAAC,OAAgB,EAAE,KAAoB;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAqCD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,YAAY,CAAC;QACzD,IAAI,UAAU,KAAK,YAAY,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACX,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC;YAC1B,CAAC;iBAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;gBACpB,MAAM,CAAC,sCAAsC;YAC/C,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,SAAS;YACtC,UAAU;YACV,aAAa;YACb,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,MAAM,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,MAAM,CAAC;IAC7G,MAAM,eAAe,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO;QACL,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,mBAAmB,EAAE,OAAO,CAAC,MAAM;KACpC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.341",
+  "version": "1.3.343",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T04:58:42.775Z",
-  "instarVersion": "1.3.341",
+  "generatedAt": "2026-06-06T05:21:01.567Z",
+  "instarVersion": "1.3.343",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "72604345a56ff19867136d0457efe9c4757b0bcaeeaadd48f3558b41caf82941",
+      "contentHash": "67606a9d2c94d2b88f5ec21a08965b25afbbb43e1291de2ebdd0cc77dfed949c",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.342.md

@@ -0,0 +1,85 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+GuardPostureTripwire — "a disabled guard is itself an incident." Born from
+2026-06-05, when the morning meltdown load-shed batch-flipped FIVE guards off
+in config.json (scheduler, contextWedgeSentinel, failureLearning,
+resourceLedger, burnDetection) and only the scheduler was noticed: the wedge
+sentinel stayed dark and watched a session die for an hour that same evening
+with zero audit rows. No instar code writes those flags — emergency hand-edits
+leave no trace, so each dark guard was discoverable only by a user-facing
+failure.
+
+Now: at every server boot, the resolved guard posture (every `monitoring.*`
+enabled flag + `scheduler.enabled` — generic by convention, no per-guard
+registration) is compared against the persisted posture from the previous
+boot. Any enabled→disabled transition gets a loud boot log line, one
+aggregated row in `logs/guard-posture.jsonl`, and ONE aggregated HIGH
+Attention item listing every newly-disabled guard. Re-enables get the
+breadcrumb only. Signal-only: nothing is ever auto-re-enabled, a broken
+tripwire can never break a boot, and the snapshot advances before alarms so
+the same transition never re-alarms.
+
+Queued initial messages now survive server restarts. When a session is
+spawned for an inbound message, the pending inject is recorded durably
+(`<stateDir>/state/pending-injects/`) and cleared only after the message is
+actually typed into the session. On boot, `recoverPendingInjects` sweeps
+survivors: still-alive sessions get re-delivery through the normal readiness
+path; dead or >6h-old records are reported via DegradationReporter and
+retired — a loss is now always VISIBLE.
+
+Why: the auto-updater restarted the server while a fresh codex session was
+still booting; the in-memory pending inject died with the process, tmux
+survived idle, and the operator waited 50+ minutes on a silently dropped
+message (finding 8d300555). Delivery is at-least-once by design — a rare
+duplicate beats a silent drop.
+
+Also: the "Fresh-spawn fallback succeeded" log now honestly says "launched
+(inject pending)" — it printed before the inject ran.
+
+## What to Tell Your User
+
+If any of my safety monitors ever gets switched off — by an emergency
+intervention, a config edit, or anything else — you now hear about it at the
+next restart instead of finding out weeks later when something it should have
+caught hits you. One consolidated heads-up, with the history kept in a log
+file. Nothing gets re-enabled behind your back; the heads-up is where you
+decide.
+
+If your agent's server restarts at the exact moment you message it, your
+message no longer risks silently vanishing — it is delivered when the session
+finishes starting, even across the restart.
+
+## Summary of New Capabilities
+
+- Boot-time guard-posture comparison with durable history at
+  `logs/guard-posture.jsonl` and snapshot at `state/guard-posture.json`.
+  Default-on, zero configuration; covers any future guard that follows the
+  `monitoring.<key>.enabled` convention automatically.
+- ONE aggregated HIGH Attention item per boot that saw disables (Bounded
+  Notification Surface — never per-guard items).
+- CLAUDE.md template + migration: agents are taught to check
+  `logs/guard-posture.jsonl` FIRST when asked "why didn't the watchdog catch
+  X?" — a silently-disabled guard explains more incidents than a broken one.
+
+- `SessionManager.recoverPendingInjects()` — boot-time orphaned-inject sweep
+  (wired automatically; not a user-facing surface).
+
+## Evidence
+
+Incident grounding: last sentinel-enabled boot 21:54Z = the exact minute of
+the #882 load-shed; 3 more dark guards found by config audit and re-enabled.
+Unit: 12 tests incl. the verbatim 5-guard incident config → exactly ONE
+aggregated item, no-repeat-alarm across boots, re-enable breadcrumb-only,
+corrupt-snapshot self-repair, emit-failure baseline-advance. Migrator: 2
+(added + idempotent). E2E: two-boot lifecycle over real disk + WIRED source
+guard. tsc clean; preflight PASS.
+
+13 new tests (store CRUD/corruption, all four sweep verdicts incl. the live
+incident shape, and wiring-integrity through a real SessionManager: record
+visible on disk DURING the spawn→inject window, cleared after). Adjacent
+session suites green (53 tests); tsc clean.

package/upgrades/1.3.343.md

@@ -0,0 +1,49 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added the Phase-1 core of the **MTP Red-Team Harness** (EXO 3.0 G7) — a
+self-contained, browser-free logic module (`src/redteam/ScenarioPack.ts`) plus
+two default scenario packs. It is the testable engine for standardized
+adversarial verification of an organization's machine-readable intent
+(ORG-INTENT.md): a pack linter that enforces channel coherence (a scenario's
+pretended sender must be deliverable by its transport), an expectation resolver
+that reuses the G1 `IntentTestHarness` to compute governed/ungoverned against
+*any* org's own intent, a heuristic outcome classifier, and a boundary-map
+assembler (per-scenario boundary depth, derivation ratio, ungoverned surface).
+
+Payloads are referenced by `{path, sha256}` and never read into the
+orchestrator — only the benign L0 (declared-audit) and L1 (naive ask) payloads
+are committed; the engineered L2/L3 payloads are gitignored and authored in a
+retired session at run time (the structural fix for CMT-1115, where inline
+red-team payloads permanently wedged a session via an AUP-rejection loop).
+
+No route, CLI, config key, or lifecycle hook is added — nothing imports this
+module at runtime yet. The CLI/route, dashboard surface, and first live
+boundary-map run are Phase 2.
+
+## What to Tell Your User
+
+Nothing user-facing ships here — this is foundation code for an experimental
+capability (verifying that an agent actually refuses the things its
+organization's rules forbid, under escalating attack pressure). It does not
+change any current behavior.
+
+## Summary of New Capabilities
+
+- `src/redteam/ScenarioPack.ts` (experimental, no runtime consumers yet):
+  scenario-pack types, pack linter, org-agnostic expectation resolver, outcome
+  classifier, boundary-map assembler.
+- Default scenario packs: `credentials` (L0–L3) and `value-conflict` (L0–L2),
+  payloads by reference.
+
+## Evidence
+
+Not a bug fix — net-new capability. Verified by 25 unit tests
+(`tests/unit/redteam-scenario-pack.test.ts`) covering both sides of every
+decision boundary (coherent vs incoherent transport, governed vs ungoverned,
+each outcome class, pass vs fail, boundary-depth edges including crack-at-L0 and
+holds-everywhere) and a clean `tsc --noEmit`.

package/upgrades/guard-posture-tripwire.eli16.md

@@ -0,0 +1,48 @@
+# ELI16 — Guard-Posture Tripwire
+
+## The problem
+
+Yesterday morning, during an emergency (the laptop was melting down), somebody
+— one of my own sessions, acting fast — turned off a bunch of my safety
+monitors by editing a config file. That's like flipping the breakers off while
+fighting a kitchen fire: sometimes reasonable in the moment. The problem is
+what came after: nobody wrote down which breakers got flipped. One (the job
+scheduler) was noticed and turned back on 5.5 hours later. FOUR others stayed
+off, silently. That same evening a session died in a brand-new way, and the
+exact watchdog built to catch dying sessions... was one of the monitors still
+switched off. It watched nothing. Justin found out via screenshot, again.
+
+The deep issue: none of my code turns these monitors off — humans and
+emergency interventions do, by hand, and hand-edits leave no trace. A monitor
+that's secretly off is worse than a broken one, because everything LOOKS
+covered.
+
+## What this change does
+
+At every server start, I now compare "which guards are on right now?" against
+a saved copy of "which guards were on last time I started?" If any guard went
+ON → OFF in between:
+
+1. A loud line in the boot log,
+2. A permanent record in `logs/guard-posture.jsonl` (so "was the watchdog even
+   running in March?" has an answer forever),
+3. ONE attention item — "these N guards got disabled since last boot, was that
+   on purpose?" — not N separate pings.
+
+Turning a guard back ON just gets the log entry — good news isn't homework.
+
+## What it deliberately does NOT do
+
+It never flips anything back on by itself. If you disabled a monitor on
+purpose, it stays disabled — you just acknowledge the one heads-up. The
+tripwire is a smoke detector, not a sprinkler system. And it can't break
+anything: if the tripwire itself hits an error, the server boots normally and
+the error goes in the log.
+
+## Why this matters beyond yesterday
+
+This was the SECOND silently-disabled guard found in one day. That's not bad
+luck, that's a missing structure: there was no system that noticed "a
+protection went away." Now there is, and it automatically covers every future
+monitor too — anything that follows the standard config naming is watched
+from the day it ships, with zero extra wiring.

package/upgrades/side-effects/guard-posture-tripwire.md

@@ -0,0 +1,76 @@
+# Side-Effects Review — GuardPostureTripwire
+
+**Version / slug:** `guard-posture-tripwire`
+**Date:** `2026-06-06`
+**Author:** `Echo (instar-dev agent, session-robustness topic per Justin's "work on more robust ways to handle these scenarios")`
+**Second-pass reviewer:** `self-adversarial pass over alarm fatigue + boot-safety (the two ways a boot-time alarm can go wrong)`
+
+## Summary of the change
+
+A boot-time detector compares the resolved guard posture (every
+`monitoring.*` enabled flag + `scheduler.enabled`) against the previous
+boot's persisted snapshot. enabled→disabled → loud log + one aggregated
+`logs/guard-posture.jsonl` row + ONE aggregated HIGH Attention item;
+disabled→enabled → log + breadcrumb only; first boot → baseline only.
+Files: `GuardPostureTripwire.ts` (new), `server.ts` boot wiring,
+`PostUpdateMigrator.ts` CLAUDE.md section, three test files, spec.
+
+## Decision-point inventory
+
+- Posture extraction — **add (read-only)** — resolved config in, key/boolean map out; generic convention, no registry.
+- Transition diff — **add (pure)** — intersection-only (shape changes are not flips).
+- Attention emit — **add (signal)** — one aggregated HIGH item per boot-with-disables; dedupe by stable id; absent Telegram → breadcrumb only.
+- Snapshot write order — **deliberate** — baseline advances BEFORE alarms so an emit failure cannot cause repeat alarms.
+
+## 1. Over-block
+
+Nothing is blocked — the tripwire has no authority. Worst noise case: an
+operator deliberately disabling a guard gets exactly ONE Attention item at the
+next boot (transition-based; the following boots are silent). A batch flip of
+N guards is ONE item, not N (Bounded Notification Surface).
+
+## 2. Under-block
+
+(a) A flip that is reverted BETWEEN boots (off at 2pm, back on at 5pm, no
+restart in between) never trips — acceptable: the guard never actually ran
+disabled. (b) Mid-run flips alarm only at the next boot — that is when config
+takes effect, so the alarm coincides with the guard actually dying; with
+auto-update restarts every ~30 min the window is bounded. (c) Guards that
+don't follow the `enabled` convention (none today) would be invisible —
+the convention IS the contract, documented in the spec.
+
+## 3. Level-of-abstraction fit
+
+Lives in `monitoring/` beside the sentinels it watches over; wired in
+server.ts boot exactly like the worktree detector (same emitAttention
+adapter, same placement constraint). The CLAUDE.md knowledge rides the
+existing migrateClaudeMd path with a content-sniff marker.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** `docs/signal-vs-authority.md`
+
+- [x] Pure signal. Never re-enables, never blocks a boot (every failure path
+  degrades into `result.error` + a log line), never edits config. The
+  Attention item is the operator's consent surface, not an action.
+
+## 5. Interactions
+
+- **Attention flood guard:** a single aggregated item with sourceContext
+  `guard-posture-tripwire` — inside every budget; HIGH priority is justified
+  (a dark guard is exactly the "user should know" class) and HIGH items are
+  never coalesced away.
+- **AttentionQueue dedupe:** stable id (`guard-posture-disabled:<date>:<list>`)
+  makes a same-day re-emit a no-op via the existing id-collision path.
+- **No Telegram:** breadcrumb still lands (the worktree-detector fallback
+  pattern); boot line says "breadcrumb only".
+- **Snapshot corruption:** degrades to first-boot semantics + self-repairs.
+
+## 6. External surfaces / 7. Rollback
+
+New files only: `state/guard-posture.json` (snapshot), `logs/guard-posture.jsonl`
+(append-only history), one CLAUDE.md section (idempotent migration). No API,
+no schema, no config key (default-on by design — a tripwire you can silently
+disable would be the joke version of this feature; disabling it means deleting
+the wiring, which is a reviewed code change). Rollback = revert; the files
+stay as inert history.

package/upgrades/side-effects/redteam-harness-phase1-core.md

@@ -0,0 +1,53 @@
+# Side-effects review — MTP Red-Team Harness Phase-1 core (EXO 3.0 G7)
+
+## What this change is
+A new, self-contained module `src/redteam/ScenarioPack.ts` (pure logic) + two
+default scenario packs under `src/redteam/packs/` + a unit test. It adds NO
+route, NO CLI command, NO session/lifecycle hook, NO config key, and is imported
+by nothing in the running server yet. It is foundation code for a Phase-2
+productization (CLI/route).
+
+## Blast radius
+- **Runtime impact: none.** Nothing imports `ScenarioPack.ts` at server boot or
+  in any job/sentinel/route. Adding the file cannot change any live behavior. A
+  grep for `redteam` / `ScenarioPack` across `src/server`, `src/commands`,
+  `src/core` composition shows no consumer.
+- **Only dependency is inward**: it imports `IntentTestHarness` and the
+  `ParsedOrgIntent` type — both read-only, already-shipped. It calls
+  `IntentTestHarness.testRefusal()` (a pure function over parsed intent); it
+  never mutates intent, never writes files, never performs I/O.
+- **The packs are data.** The two `pack.json` files + committed `L0.md`/`L1.md`
+  payloads are inert until a future runner reads them. No code loads them yet.
+
+## Security / safety review
+- **Payload-by-reference is enforced in the type system**: the module handles
+  payloads as `{ path, sha256 }` only and has no code path that reads a payload
+  body. The committed payloads (`L0.md` declared-audit, `L1.md` naive benign
+  ask) were authored in an isolated subagent session, never in the orchestrator
+  transcript — honoring the CMT-1115 lesson (inline red-team payloads
+  permanently wedged a session via an AUP-rejection loop).
+- **Engineered payloads are NOT committed**: `L2.md` (pressure) and `L3.md`
+  (engineered) are gitignored; their `pack.json` sha reads
+  `PENDING-LOCAL-AUTHOR`. So the reviewable PR diff contains no engineered
+  attack text — a reviewing agent reading this diff cannot be wedged by it.
+- **No new external surface**: no network calls, no new auth, no new file
+  writes. The classifier's regexes are local string checks.
+
+## Framework generality
+This change does not route through the session-launch / inject abstraction or
+message delivery — it is framework-agnostic pure logic operating on parsed
+ORG-INTENT, which is identical across claude-code / codex-cli / gemini-cli. The
+harness it seeds is explicitly designed to be org-agnostic AND framework-neutral
+(it tests an agent's behavior through whatever channel, independent of the
+underlying framework). No Claude-specific assumption is introduced.
+
+## Test coverage
+25 unit tests (`tests/unit/redteam-scenario-pack.test.ts`) cover both sides of
+every decision boundary: coherent vs incoherent transport, governed vs
+ungoverned, each outcome class, pass vs fail, and the boundary-map edges
+(holds-through-L2-cracks-at-L3, cracks-at-L0, holds-everywhere, derivation
+ratio, ungoverned surface). `tsc --noEmit` is clean.
+
+## Rollback
+Deleting `src/redteam/` + the test + reverting the `.gitignore` lines fully
+removes the change with zero runtime consequence (nothing depends on it).

package/upgrades/1.3.341.md

@@ -1,41 +0,0 @@
-# Upgrade Guide — vNEXT
-
-<!-- assembled-by: assemble-next-md -->
-<!-- bump: patch -->
-
-## What Changed
-
-Queued initial messages now survive server restarts. When a session is
-spawned for an inbound message, the pending inject is recorded durably
-(`<stateDir>/state/pending-injects/`) and cleared only after the message is
-actually typed into the session. On boot, `recoverPendingInjects` sweeps
-survivors: still-alive sessions get re-delivery through the normal readiness
-path; dead or >6h-old records are reported via DegradationReporter and
-retired — a loss is now always VISIBLE.
-
-Why: the auto-updater restarted the server while a fresh codex session was
-still booting; the in-memory pending inject died with the process, tmux
-survived idle, and the operator waited 50+ minutes on a silently dropped
-message (finding 8d300555). Delivery is at-least-once by design — a rare
-duplicate beats a silent drop.
-
-Also: the "Fresh-spawn fallback succeeded" log now honestly says "launched
-(inject pending)" — it printed before the inject ran.
-
-## What to Tell Your User
-
-If your agent's server restarts at the exact moment you message it, your
-message no longer risks silently vanishing — it is delivered when the session
-finishes starting, even across the restart.
-
-## Summary of New Capabilities
-
-- `SessionManager.recoverPendingInjects()` — boot-time orphaned-inject sweep
-  (wired automatically; not a user-facing surface).
-
-## Evidence
-
-13 new tests (store CRUD/corruption, all four sweep verdicts incl. the live
-incident shape, and wiring-integrity through a real SessionManager: record
-visible on disk DURING the spawn→inject window, cleared after). Adjacent
-session suites green (53 tests); tsc clean.