instar 1.3.356 → 1.3.357

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.356",
+  "version": "1.3.357",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T08:09:49.249Z",
-  "instarVersion": "1.3.356",
+  "generatedAt": "2026-06-06T08:26:56.471Z",
+  "instarVersion": "1.3.357",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "dd4e2aa5edf9df31d6193e61f9b36f739282b4403c52c5ae73a218ae09c67e9d",
+      "contentHash": "1256daa92d8ec5e17f975580bb076fa2c451cbd7db03b36ae3c4a929837adac4",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.357.md

@@ -0,0 +1,40 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The verified topic operator is now recorded AUTOMATICALLY (Know Your Principal
+standard, security-build increment 2d — the WRITE side). On the lifeline-forward
+inbound path (`POST /internal/telegram-forward`), a real user message from an
+AUTHENTICATED + AUTHORIZED sender binds that sender as the topic's operator, so
+the session-start hook (#908) injects it without a manual `POST /topic-operator`.
+Added a public `TelegramAdapter.isAuthorizedSender()` (the authorized-only gate)
+wrapping the private `isAuthorized`.
+
+## What to Tell Your User
+
+Nothing user-facing changes. Foundation wiring (experimental) for the Caroline
+identity-bleed security fix: the agent now learns its verified operator on its own
+from authorized inbound messages. ONLY authorized senders are recorded — an
+unauthorized party in the group is never seated as operator. Fail-soft: a bind
+failure never affects message handling.
+
+## Summary of New Capabilities
+
+- Auto-bind of the topic operator on `/internal/telegram-forward` (authorized
+  senders only; a2a bot messages and unauthorized senders never bind; fail-soft;
+  idempotent).
+- `TelegramAdapter.isAuthorizedSender(number|string)` — public read-only auth check.
+- Known gap (tracked for Inc-2e): the adapter long-poll (no-lifeline) path is not
+  yet covered; a no-lifeline install has no auto-bind (fail-safe).
+
+## Evidence
+
+Verified by 5 Tier-1 unit tests (`telegram-isauthorizedsender`: both sides of the
+boundary, number/string ids, blank/NaN guard, no-allowlist model) and 4 Tier-2
+integration tests (`topic-operator-autobind-route`: over the wire — authorized
+binds, unauthorized doesn't, a2a bot doesn't, null store no-op). The 14 existing
+`/internal/telegram-forward` integration tests stay green (no regression). Clean
+`tsc --noEmit`.

package/upgrades/side-effects/topic-operator-autobind-inc2d.md

@@ -0,0 +1,70 @@
+# Side-effects review — Topic Operator inbound auto-bind (Know Your Principal #898, increment 2d)
+
+## What this change does
+The WRITE side of the operator binding. On the lifeline-forward inbound path
+(`POST /internal/telegram-forward`), the verified operator of a topic is now
+recorded automatically from the AUTHENTICATED + AUTHORIZED sender of a real user
+message — so the session-start hook (#908) and the future cross-principal guard
+have a populated binding instead of relying on a manual `POST /topic-operator`.
+
+- `TelegramAdapter`: new public `isAuthorizedSender(number|string): boolean`,
+  wrapping the private `isAuthorized` (number/string tolerant; blank/non-numeric
+  → false). Read-only; no behavior change to the private path.
+- `routes.ts` `/internal/telegram-forward`: one additive block, placed AFTER the
+  a2a-hook short-circuit and BEFORE `onTopicMessage`, that binds the operator iff
+  `ctx.telegram.isAuthorizedSender(fromUserId)` is true.
+
+## The load-bearing security property
+ONLY an authorized sender becomes the operator. An unauthorized party in the
+bot's group is never seated — that is exactly the cross-principal ("Caroline")
+bug, and the integration test proves the over-the-wire refusal (a `fromUserId`
+outside the allowlist, even with `fromFirstName: "Caroline"`, binds nothing).
+The uid is the platform-authenticated sender id; a content name is never the
+source (`TopicOperatorStore.setOperator` enforces this by construction, #904).
+
+## Blast radius (hot path — reviewed carefully)
+- **Additive + fail-soft.** The block is wrapped in try/catch and only runs when
+  `ctx.topicOperatorStore` is non-null, `fromUserId` is present, and `topicId` is
+  a number. Any error is logged and swallowed — an auto-bind failure can NEVER
+  break message routing. `setOperator` is a fast local JSON write, idempotent on
+  the same uid (a redelivered message re-binds the same operator harmlessly).
+- **a2a-safe.** Placed after the a2a short-circuit, so agent-to-agent bot messages
+  return before the bind; a bot id is also not in `authorizedUserIds` anyway. The
+  14 existing `/internal/telegram-forward` integration tests stay green (no
+  regression to the version handshake, exactly-once, sentinel, or a2a paths).
+- **No new route / class / config key / dependency.** It consumes the store +
+  routes shipped in #904/#906 and the injection from #908.
+
+## No-allowlist trust model (documented)
+`isAuthorizedSender` mirrors `isAuthorized`: with NO `authorizedUserIds` allowlist
+configured, every authenticated sender is accepted (the agent already serves
+everyone in that mode), so the operator becomes the most-recent authenticated
+sender. This is consistent with the existing trust model and is NOT a
+Caroline-class bleed (the uid is Telegram-authenticated, not a content name). A
+secure deployment configures `authorizedUserIds`, and then only those uids bind.
+
+## Scope (deliberate) + the known gap
+This binds on the **lifeline-forward path only** — the instar fleet's primary
+inbound route. The adapter's own long-poll path (`onTopicMessage`, the
+no-lifeline case) is NOT covered here, because its single shared callback is
+defined in `src/commands/server.ts` (the production composition root, not
+route-testable). That gap is tracked for a follow-up (Inc-2e): bind in the shared
+`onTopicMessage` handler to cover both paths with one change. Until then, a
+no-lifeline install simply has no auto-bind (fail-safe: no binding → no injection
+→ no false identity), and `POST /topic-operator` remains the manual path.
+
+## Migration parity
+None required — server-side route behavior + an in-process adapter method reach
+existing agents on the next server update (the Migration Parity Standard governs
+agent-installed FILES; this touches none).
+
+## Tests
+- Tier 1 (unit): `tests/unit/telegram-isauthorizedsender.test.ts` (5) — both sides
+  of the boundary, number/string ids, blank/NaN guard, no-allowlist model.
+- Tier 2 (integration): `tests/integration/topic-operator-autobind-route.test.ts`
+  (4) — over the wire: authorized binds, unauthorized doesn't, a2a bot doesn't,
+  null store no-op. Existing telegram-forward suites (14) stay green.
+
+## Rollback
+Revert the one route block + the `isAuthorizedSender` method + delete the two
+tests. The store on disk is inert without the bind.

package/upgrades/topic-operator-autobind-inc2d.eli16.md

@@ -0,0 +1,46 @@
+# ELI16 — Automatically remembering who the boss is
+
+## The one-sentence version
+When the verified boss sends a message, the agent now automatically writes down
+"this is the boss of this chat" — so it no longer has to be told by hand.
+
+## The backstory
+We've been fixing a real problem: an agent on a shared computer slowly started
+treating a *different real person* (call her Caroline) as its boss, because the
+mix-up lived inside the agent's own writing where nothing was watching. To fix it
+we built three pieces:
+
+1. A filing cabinet that remembers, per chat, who the verified boss is — and the
+   rule is strict: the boss is decided ONLY by the verified ID of whoever actually
+   sent the message, never a name typed in a document.
+2. A startup note that hands the agent that "who's your boss" info when it wakes
+   up (shipped last step).
+3. **This step:** actually filling in the filing cabinet automatically.
+
+## What this change adds
+Before, the filing cabinet only got filled in by a manual one-time call. Now,
+whenever a message comes in through the agent's main message pipe, the system
+checks: "is this sender on the allowed list?" If yes, it quietly writes them down
+as the verified boss of that chat. If no, it does NOTHING — an outsider in the
+group can never become the boss. That "only allowed senders count" rule is the
+whole point: it's what stops the Caroline mix-up from happening again. We prove it
+with a test that sends a message from an *un*-allowed person literally named
+"Caroline" and checks that nobody gets written down.
+
+## Why it's safe
+- It only **adds** a step, wrapped so that if anything ever goes wrong, the message
+  still gets handled normally — recording the boss can never break the chat.
+- It ignores robot-to-robot messages (those get handled earlier), and it ignores
+  anyone not on the allowed list.
+- Writing the same boss twice is harmless, so a re-delivered message can't cause
+  trouble.
+
+## What's deliberately left for next time
+This fills in the cabinet on the agent's **main** message pipe (the one the whole
+fleet uses). There's a second, simpler pipe (used when the agent talks to Telegram
+directly without the relay) that this step doesn't cover yet, because that one's
+wiring lives in a harder-to-test startup file. That's tracked as a small follow-up.
+Until then, an agent on that simpler setup just doesn't auto-fill the cabinet —
+which is safe, because no entry means no false boss. The final step after that
+lets the agent's own safety checker USE the binding to catch itself if it ever
+credits a decision to the wrong person.