instar 1.3.347 → 1.3.348

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T05:48:21.704Z",
-  "instarVersion": "1.3.347",
+  "generatedAt": "2026-06-06T06:16:53.583Z",
+  "instarVersion": "1.3.348",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.348.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+**Coherence Journal mesh transport (P1 closing step)** — the `journal-sync`
+MeshCommand + receive handler + own-stream advert on the `session-status`
+response + `PeerPresencePuller` delta-drive that runs the merged
+`JournalSyncApplier` over the existing 30s machine check-in
+(COHERENCE-JOURNAL-SPEC §3.4 rule 5). Adverts are O(kinds) integers on the
+heartbeat; entry deltas ride separate size-capped requests. Ships DARK
+everywhere (gated on explicit `multiMachine.coherenceJournal.replication.enabled
+=== true`) — merge does not change live mesh traffic; cross-machine sync is
+a deliberate flip (the live two-machine proof).
+
+The MTP red-team harness resolver (`src/redteam/ScenarioPack.ts`) now states its
+governance verdicts honestly. Every `ResolvedExpectation` carries a `method`
+field (`keyword-heuristic`), and the `reason` strings name their keyword-overlap
+basis instead of asserting the verdict as fact — an `ungoverned` result is now
+framed as a candidate to verify semantically, not a proven intent gap. The
+matching logic is unchanged; only the verdict's self-description.
+
+## What to Tell Your User
+
+This is the wire that lets your agent's machines actually exchange their
+diaries — but it ships switched OFF. Turning it on (so the Laptop can answer
+"where did this conversation live on the Mini?") is a deliberate, watched
+step, not something a code update flips silently.
+
+Nothing user-facing changes. This is an internal correctness fix to an
+experimental capability: the red-team harness no longer overstates a crude
+keyword-match result as a definitive finding.
+
+## Summary of New Capabilities
+
+- None user-invocable yet — the transport is dark until the replication
+  switch is turned on. Internal: `journal-sync` mesh verb + advert-driven
+  delta replication.
+
+- `ResolvedExpectation.method` field for provenance of every governance verdict.
+- Honest verdict `reason` strings (keyword-overlap basis named; `ungoverned`
+  framed as candidate-to-verify).
+
+## Evidence
+
+- Integration round-trip (two in-process journal+applier pairs through a
+  real signed MeshRpc envelope; forged-sender rejection) + gated-drive unit
+  test (no-op when off, never throws). tsc + full lint chain clean.
+
+Not a behavior change to classification — a truthfulness fix to the verdict
+text + a provenance field, required by the Truthful Provenance standard (#896).
+The brittleness it makes honest about was observed live: a false-negative
+`ungoverned` verdict on the first boundary map. Verified by 26 unit tests
+(one new, asserting method-provenance and that the as-fact phrasing is gone) and
+a clean `tsc --noEmit`.

package/upgrades/coherence-journal-meshwire.eli16.md

@@ -0,0 +1,9 @@
+# The diaries actually sync now (P1 closing step — mesh transport)
+
+P1.1 made each machine keep its diaries, P1.2 made them readable, P1.3 built the engine that safely receives a peer's diary. This is the wire that connects them: machines now actually hand each other their diaries over the secure line they already use.
+
+It's deliberately tiny and cheap. The existing once-every-30-seconds "are you alive?" check between machines now carries one extra scrap of information: a peer's "I'm at line N in each of my diaries." When a machine notices a peer is further along than the copy it holds, it asks for just the missing lines — over a separate, size-capped request, so the fast heartbeat itself never gets heavy. The receiving side runs every defense from P1.3 (a machine can only hand over its OWN diary; every line validated; restores caught; nothing trusted until durably saved).
+
+**The safety choice that matters:** this ships DARK even on me. Merging it does NOT turn on cross-machine syncing. The transport and the drive are gated behind an explicit "replication on" switch that defaults off everywhere — so landing this code changes nothing about live mesh traffic. Turning it on between the Laptop and the Mini is a separate, deliberate, watched step (the live proof you pre-approved). This is on purpose: the mesh is load-bearing for everything, and "merge a PR" should never silently rewire it.
+
+What the live proof will show, once both machines are on this version and I flip the switch: move conversation 13481 from the Laptop to the Mini, then ask the LAPTOP "where did 13481 live and why did it move?" — and it answers correctly from the Mini's synced diary. That's the whole initiative's promise, demonstrated end to end. After the proof, the switch can become the spec's default (live-on-dev); until then it stays off so nothing surprises us.

package/upgrades/side-effects/coherence-journal-meshwire.md

@@ -0,0 +1,49 @@
+# Side-Effects Review — Coherence Journal mesh transport (P1 closing step)
+
+**Version / slug:** `coherence-journal-meshwire`
+**Date:** `2026-06-05`
+**Author:** `echo`
+**Second-pass reviewer:** `not required as a PR-time pass — design converged (§3.4 rule 5); this is the transport that drives the already-merged, already-reviewed JournalSyncApplier`
+
+## Summary of the change
+
+Wires the `journal-sync` mesh transport (COHERENCE-JOURNAL-SPEC §3.4 rule 5) that drives the merged `JournalSyncApplier`: a `journal-sync` MeshCommand (read/observe RBAC class), an always-registered receive handler (serve own-stream batch / apply inbound), the own-stream advert piggybacked on the `session-status` response, and the `PeerPresencePuller` delta-drive (request + apply when a peer is ahead). The SEND/drive path is gated on `multiMachine.coherenceJournal.replication.enabled === true` (explicit true only) — ships DARK on every agent including echo; merge does not alter live mesh traffic.
+
+## Decision-point inventory
+- `journal-sync` RBAC classification — ADD — read/observe class (any registered peer), same as capacity-report/session-status. No new authority: it serves/accepts replica DATA, never an actuation.
+- Replication activation — gated on explicit `replication.enabled===true`; absent in ConfigDefaults → false everywhere. The proof flips it deliberately.
+
+## 1. Over-block
+Receive handler rejects forged/invalid entries via the applier's §3.4 gates (already reviewed) — counted, never silent. No new over-block surface on the live path (drive is dark).
+
+## 2. Under-block
+First-hop-only: a third machine's history relayed by a peer is rejected (accepted P1 limitation; transitive relay is post-P1). The receive handler being always-on is safe because the applier validates every entry and no peer SENDS unless its own replication flag is on.
+
+## 3. Level-of-abstraction fit
+Transport is a thin driver over the pure applier/writer; the puller carries the advert because the puller IS the existing 30s cadence (no new timer — §3.4 rule 5's grounded correction). Right seam.
+
+## 4. Signal vs authority compliance
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+- [x] No — the transport moves signal data (replica streams). The §3.9 actuation-ban lint (merged) keeps consumers signal-only.
+
+## 5. Interactions
+- Heartbeat bloat: the advert is O(kinds) integers on the session-status RESPONSE; entry payloads ride SEPARATE size-capped journal-sync requests, never the heartbeat envelope (the master spec's JSON.stringify-on-hot-path root cause is avoided).
+- Mixed-version: an old peer RBAC-default-denies journal-sync (403) or has no handler (501); the sender treats both as "peer lacks the verb" and backs off — no retry storm (gated drive only runs when replication is on anyway).
+- Backward-compat: the journalAdvert field on session-status is optional; old callers parse permissively and ignore it (verified).
+- guardWrite seam: replica appends go through state.guardJournalWrite (standby-safe, prefix-allowlisted) — same as the writer.
+
+## 6. External surfaces
+- New mesh verb on the wire ONLY when replication.enabled===true on the sender. On merge: dark everywhere → zero new mesh traffic. The receive handler accepts journal-sync if a peer ever sends, but no peer sends while dark.
+- New replica files under state/coherence-journal/peers/ ONLY once the proof flips it on.
+
+## 7. Rollback cost
+Pure code revert + patch; replica files inert plain JSONL. The dark default means rollback before the proof is a no-op in practice.
+
+## Conclusion
+The transport lands dark by explicit gate so merge ≠ live mesh change; the live two-machine proof is a deliberate, monitored flip (pre-approved). The §3.4-rule-5 grounded transport (advert on the real 30s pull, deltas separate + capped) is implemented as specified. After a successful proof, the gate can move to the spec's live-on-dev default in a follow-up. Clear to ship dark.
+
+## Second-pass review (if required)
+**Reviewer:** convergence panel (§3.4 design-time) + the live two-machine proof as the closing functional verification.
+
+## Evidence pointers
+- tests/integration/journal-sync-roundtrip.test.ts (two in-process pairs through a real signed envelope; forged-sender rejection), tests/unit/PeerPresencePuller-journal.test.ts (gated drive; no-op when off; never throws).

package/upgrades/side-effects/resolver-verdict-honesty.md

@@ -0,0 +1,45 @@
+# Side-effects review — red-team resolver verdict honesty
+
+## What this change is
+A two-part honesty fix to `src/redteam/ScenarioPack.ts` `resolveExpectation`:
+(1) adds a `method: 'keyword-heuristic'` field to `ResolvedExpectation`;
+(2) rewrites the governed/ungoverned `reason` strings so they name their
+keyword-overlap basis and frame an `ungoverned` result as a candidate-to-verify
+rather than an asserted intent gap. The matching LOGIC is unchanged — only the
+verdict's self-description.
+
+## Why
+The keyword-overlap matcher produces false negatives (it misses
+semantically-related constraints) and is rephrase-bypassable (CMT-1110). On the
+first live boundary map it reported a false "ungoverned" finding as fact, which
+briefly misled the author. The just-ratified Truthful Provenance standard
+(#896) requires a verdict to carry the method that produced it; an asserted
+heuristic verdict violated that.
+
+## Blast radius
+- **Behavior of governance classification: unchanged.** `governance` is still
+  `'governed'`/`'ungoverned'` by the same threshold; only `reason` text changed
+  and a `method` field was added. No scenario's pass/fail flips.
+- **Consumers:** the only consumer of `reason`/`method` is the local
+  orchestrator (`.instar/scripts/redteam-run.mjs`), which prints them — it now
+  prints the honest text. No code branches on the reason string. The new
+  `method` field is additive (optional consumers ignore it).
+- **No route, config, lifecycle, or migration surface touched.** Pure-logic
+  module with no runtime consumers in the server.
+- **Type change:** `ResolvedExpectation` gains a required `method` field; both
+  return sites set it, and tsc is clean, so no caller breaks.
+
+## Framework generality
+Pure logic over parsed ORG-INTENT — no session-launch/inject/message-delivery
+surface, framework-agnostic. No Claude-specific assumption.
+
+## Test coverage
+26 unit tests (was 25): a new test asserts every verdict carries
+`method: 'keyword-heuristic'`, and the ungoverned test now asserts the reason
+names the keyword basis + frames itself as a candidate (and that the old
+as-fact phrasing is gone). Both sides of the governed/ungoverned boundary
+covered. `tsc --noEmit` clean.
+
+## Rollback
+Revert the single file + test; zero runtime consequence (nothing branches on
+the verdict text).