instar 1.3.381 → 1.3.383

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.381",
+  "version": "1.3.383",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T21:38:40.950Z",
-  "instarVersion": "1.3.381",
+  "generatedAt": "2026-06-06T22:01:27.206Z",
+  "instarVersion": "1.3.383",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1122,7 +1122,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/convergence-check.sh",
-      "contentHash": "21a81a7cf2437724a4b1453eaafb5a0bbcef3ab4cea7326c66c00358dd69535a",
+      "contentHash": "0908e2775c497fe526b817563b6f8e29ec4d6bedaf5521a87e625857afc367c3",
       "since": "2025-01-01"
     },
     "template:emit-session-clock.sh": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "f1aacd1fdb49755abf108a032bf8dae70e0ae14240ab1f21e50e79c4433748be",
+      "contentHash": "8bc2ad931e539665db73afc0659619ec51ef9abfe807f2b8a4f79859aa36b1b6",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/templates/scripts/convergence-check.sh

@@ -30,7 +30,10 @@ if echo "$CONTENT" | grep -qiE "(unfortunately.{0,20}(i can.t|i.m unable|not (po
 fi
 
 # 2. COMMITMENT OVERREACH — Promises that may not survive session boundaries
-if echo "$CONTENT" | grep -qiE "(i.ll (make sure|ensure|guarantee|always|never forget)|i (promise|commit to|will always)|you can count on me to|i.ll remember (to|this)|from now on i.ll)"; then
+# Word-boundary guards (live FPs 2026-06-06): "Mini promises"/"I promised"
+# matched the bare `i (promise...)` — the leading i must start a word and
+# `promise` must not continue into promised/promises.
+if echo "$CONTENT" | grep -qiE "(^|[^a-zA-Z])i.ll (make sure|ensure|guarantee|always|never forget)|(^|[^a-zA-Z])i (promise([^a-zA-Z]|$)|commit to|will always)|you can count on me to|(^|[^a-zA-Z])i.ll remember (to|this)|from now on i.ll"; then
   ISSUES+=("COMMITMENT: You're making a promise that may not survive context compaction or session end. Can your infrastructure actually keep this commitment? If not, reframe as intent rather than guarantee.")
   ISSUE_COUNT=$((ISSUE_COUNT + 1))
 fi

package/upgrades/1.3.383.md

@@ -0,0 +1,76 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The pre-messaging quality gate's "commitment overreach" pattern matched the
+bare sequence `i (promise|...)` anywhere in a message — including INSIDE other
+words. "the Mini promises" (a word ending in *i* followed by a plural noun) and
+"everything I promised" (past-tense narration) both tripped it; in one day it
+blocked five legitimate status reports that contained no promise at all.
+
+The pattern (all three copies: the shipped shell template, the migrator's
+inline fallback, and the TypeScript ConvergenceChecker) now requires the
+leading *i* to start a word and refuses to match when "promise" continues into
+promised/promises. Real first-person commitments ("I promise to…",
+"I'll make sure…", "you can count on me to…") still trip exactly as before.
+
+The quota collector (which writes quota-state.json) and the QuotaManager that
+drives its adaptive polling were nested inside the server's
+"I own Telegram polling" block. On any agent whose LIFELINE owns polling — the
+normal production topology — that block is skipped, so the collector never ran:
+quota-state.json was never written, the tracker read an absent file, and
+quota-aware placement stayed permanently fail-open (the exact rate-limit-stall
+hazard from the EXO incident it exists to prevent). Turning on quotaTracking
+alone could not fix it; the writer was gated behind an unrelated condition.
+
+The account switcher + collector + QuotaManager pipeline now live at top scope
+(after the scheduler is constructed, so migration wiring is real), gated only on
+the quota tracker — so the collector runs regardless of who polls Telegram.
+
+## What to Tell Your User
+
+Nothing — fewer spurious "message blocked" interruptions when the agent
+mentions promises as a topic rather than making one.
+
+- audience: agent-only
+- maturity: stable
+
+If you run a lifeline-driven agent and turned on quota tracking but never saw
+quota data, this is why — now it collects. Quota-aware placement (routing work
+away from a rate-limited machine) actually has data to act on.
+
+- audience: agent-only
+- maturity: stable
+
+## Summary of New Capabilities
+
+- Word-boundary guards on the commitment_overreach pattern in
+  `templates/scripts/convergence-check.sh`, the PostUpdateMigrator inline
+  fallback, and `ConvergenceChecker.ts` — kept in lockstep.
+- Existing agents receive the fixed script automatically (convergence-check.sh
+  is always-overwritten from the template on every migration pass).
+
+- Quota collection + adaptive polling run independent of Telegram-polling
+  ownership (was send-only-server dead).
+- accountSwitcher hoisted to top scope (still consumed by the polling block's
+  wireTelegramCallbacks when that path runs).
+
+## Evidence
+
+- `tests/unit/convergence-check.test.ts` (+6): the five live false positives
+  pass; real present-tense promises, sentence-final "I promise.", and the
+  other commitment phrasings still flag. 61/61 in file (runs the REAL script).
+- `tests/unit/convergence-checker-commitment-boundary.test.ts` (new): the same
+  both-sides matrix against the TS checker.
+- Pattern verified on macOS (BSD) grep -E with 12 probe strings before patching.
+
+- `tests/unit/quota-collector-polling-independence-wiring.test.ts` (new, 3
+  tests): quotaManager.start() is reached before the !lifelineOwnsPolling
+  block; the pipeline is constructed after the scheduler; no second
+  QuotaManager construction (no double-start).
+- Live: echo logs "Telegram send-only mode (lifeline owns polling)" + "No quota
+  state file found — fail-open" pre-fix; quota-state.json + real GET /quota data
+  post-fix (live re-verify after release).

package/upgrades/side-effects/convergence-commitment-regex-boundaries.md

@@ -0,0 +1,53 @@
+# Side-Effects Review — Convergence commitment-regex word boundaries
+
+**Version / slug:** `convergence-commitment-regex-boundaries`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+Word-boundary guards on the commitment_overreach pattern (3 lockstep copies:
+shell template, migrator inline fallback, TS checker). Live FPs "Mini
+promises" / "I promised" blocked five legitimate messages in one day.
+
+## Decision-point inventory
+
+One: the boundary semantics — leading `(^|[^a-zA-Z])i ` and trailing
+`promise([^a-zA-Z]|$)`. Chosen over `\b` for BSD-grep portability; verified
+on macOS grep with a 12-string both-sides probe before patching.
+
+## 1. Over-block
+
+None added — the new pattern matches a strict SUBSET of the old one.
+
+## 2. Under-block
+
+Deliberate: past-tense "I promised" no longer flags. That phrasing narrates a
+prior commitment rather than making one; the gate's purpose is catching NEW
+promises that may not survive the session. "I promise" present-tense, bare
+sentence-final, and every other phrasing alternative still flag (tested).
+
+## 3. Level-of-abstraction fit
+
+The fix lives in the pattern itself, in all three places the pattern exists —
+no new layers. The template is the canonical copy; the migrator's
+always-overwrite delivers it to existing agents (Migration Parity satisfied
+structurally, no new migration needed).
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+The gate keeps exactly its existing authority (block-before-send); this change
+only narrows its trigger to what it was always meant to catch.
+
+## 5. Interactions
+
+- grounding-before-messaging.sh consumes the script unchanged.
+- The LLM-side reviewers are unaffected (this is the deterministic tier).
+- Self-Violation Signal / correction loops: fewer false correction inputs.
+
+## 6. External surfaces
+
+None. No routes, config, or notifications.

package/upgrades/side-effects/quota-collector-polling-independence.md

@@ -0,0 +1,62 @@
+# Side-Effects Review — Quota collector polling independence (finding A1)
+
+**Version / slug:** `quota-collector-polling-independence`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+The QuotaManager/collector/accountSwitcher pipeline was hoisted out of the
+`if (telegramConfig && !skipTelegram && !isStandbyTelegram && !lifelineOwnsPolling)`
+block to top scope (after the scheduler exists), gated only on quotaTracker.
+On lifeline-owns-polling agents the collector never started → fail-open
+placement (finding A1).
+
+## Decision-point inventory
+
+One: WHERE the pipeline runs. Now: top scope, after scheduler, gated on
+quotaTracker. Before: inside the server-owns-polling block.
+
+## 1. Over-block
+
+None. The pipeline now runs in MORE cases (send-only servers too), never fewer.
+
+## 2. Under-block
+
+The collector still no-ops for non-claude-code frameworks (unchanged) and when
+quotaTracking is off (unchanged). A missing OAuth credential still degrades to
+JSONL estimation inside QuotaCollector (unchanged).
+
+## 3. Level-of-abstraction fit
+
+Quota collection is independent of Telegram-polling ownership; placing it with
+the other top-scope monitoring setup (after scheduler, beside telemetry
+heartbeat) is the correct layer. accountSwitcher moves with it; its later
+consumer (wireTelegramCallbacks, inside the polling block) resolves it from the
+enclosing scope — verified by tsc.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+No authority change. quota-aware placement remains fail-open on absent data;
+this fix simply lets the data exist.
+
+## 5. Interactions
+
+- Scheduler: the pipeline now runs after `scheduler` is constructed, so
+  setScheduler() wires a real scheduler (was already conditional on `scheduler`).
+- wireTelegramCallbacks (polling block): consumes the hoisted accountSwitcher
+  from the enclosing scope — only runs in the polling path, harmless otherwise.
+- notify(): defined at outer scope (function decl), called lazily on threshold
+  crossings — safe to construct the notifier earlier.
+- Double-start: the old in-block copy was REMOVED (test asserts a single
+  QuotaManager construction) — no risk of two pollers.
+- guard-posture tripwire: already observed quotaTracking re-enabled; this fix
+  makes that enablement actually produce data.
+
+## 6. External surfaces
+
+No new routes/config/notifications. `GET /quota` now returns real data on
+lifeline-driven agents instead of `no_data`.