instar 1.3.401 → 1.3.403

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.401",
+  "version": "1.3.403",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T08:02:36.690Z",
-  "instarVersion": "1.3.401",
+  "generatedAt": "2026-06-07T08:45:36.629Z",
+  "instarVersion": "1.3.403",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5216944296c49960c882e7d4766e05e5f09dfc7c2d103c65d0ef0f377f92b8f1",
+      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "f2927adade5b10033173d049f8145cfa2aa8134659fbd0c57e50645248586803",
+      "contentHash": "1b7d450ba6a4b4793a0497d93dde540c42227edb34d6b6fd92ab641c76b64438",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.402.md

@@ -0,0 +1,64 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+Added the enrollment wizard — the fourth piece of the Subscription & Auth
+Standard, on top of the P1.1 account registry, P1.2 quota poller, and P1.3
+auto-swap scheduler. It assists logging a new subscription account into the pool
+from a phone, and makes the flow expiry-proof.
+
+Three new core pieces:
+
+- **`PendingLoginStore`** — a durable ledger of logins-in-progress. Each record
+  holds PUBLIC artifacts only: the verification URL, the optional short device
+  code, the flow kind, when it expires, and a re-issue count. There is no field
+  to hold a token — credential-safety by construction, the same structural guard
+  the account registry uses. The store persists to disk, so an in-flight login
+  survives a server restart.
+- **`EnrollmentWizard`** — orchestration on top of the store: start a login
+  (drive the framework's login flow, capture the public code/URL, store it with
+  its TTL visible), and a sweep that auto-reissues any expired login WITHOUT the
+  operator asking — the exact gap the pi-harness live-test exposed (a code that
+  expired before the operator got to it). A failed re-drive is skipped and retried
+  next sweep, so one bad login can't abort the sweep.
+- **`FrameworkLoginDriver`** — the concrete driver: spawns the framework's login
+  command under the target account's config home and scrapes the public
+  verification URL + device code + TTL from the pane (Codex = device-code; Claude =
+  URL + paste-back-code). The scrape logic is pure and unit-tested against real
+  captured-output fixtures.
+
+Routes (under `/subscription-pool`, internal/dark until graduation):
+`POST /subscription-pool/enroll`, `GET /subscription-pool/pending-logins`,
+`POST /subscription-pool/enroll/:id/complete`,
+`POST /subscription-pool/enroll/reissue-expired`. A low-frequency background tick
+calls the reissue sweep. The list/sweep routes answer `200 { enabled:false }` when
+the wizard is unwired — never 503.
+
+Coverage: unit tests for the store, the wizard (incl. the auto-reissue gap +
+driver-failure resilience), and the driver scrape logic; integration tests for
+the HTTP routes (asserting no token field ever appears in a response); an
+end-to-end test that confirms the routes are alive and a started enrollment
+survives a server restart.
+
+## What to Tell Your User
+
+You can add another subscription account from your phone. I'll show you a short
+code and a link; you open the provider's own page and approve. Nothing secret
+ever passes through me — only the public code and link. And if the code expires
+before you get to it, I quietly issue a fresh one instead of leaving you stuck —
+no trip back to a terminal. An enrollment you start is remembered even if I
+restart in the middle.
+
+## Summary of New Capabilities
+
+- **Phone-friendly enrollment** — start a new-account login and get a short
+  code + link to approve on the provider's own page; nothing secret transits the
+  agent.
+- **Auto-reissue on expiry** — an expired login code is silently refreshed on a
+  sweep, so a code that ages out before you act doesn't strand the flow.
+- **Durable pending logins** — in-flight logins survive a server restart.
+- **Pending-logins surface** — `GET /subscription-pool/pending-logins` lists the
+  active codes/links + their TTL (the phone surface + the dashboard panel feed).

package/upgrades/1.3.403.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+Added a **Subscriptions** tab to the dashboard — the visual surface for the
+multi-account Subscription & Auth pool (P1.1–P2.1). It shows, per account: the
+nickname, a friendly status, and live quota bars for the 5-hour and weekly
+windows with a "resets in …" countdown. A **Pending Logins** panel below lists
+any in-flight enrollment — the device code / verification URL (shown as copyable
+text, never a live link) with its TTL countdown and how many times it has been
+re-issued.
+
+The tab is a self-contained browser-native ESM module (`dashboard/subscriptions.js`)
+served statically, registered in `index.html` exactly like the Process Health and
+Preferences tabs (lazy dynamic-import, start/stop on tab activation, polled every
+30s). It consumes the existing `GET /subscription-pool` and
+`GET /subscription-pool/pending-logins` routes — no new server routes, no `src/`
+change. When the pool isn't set up the routes answer `{ enabled:false }` and the
+tab shows a friendly "not set up yet" message (never an error).
+
+It carries the same load-bearing display-safety contract as the Process Health
+tab: every dynamic value is sanitized (NFKC fold + control/bidi/chrome-glyph
+strip + grapheme cap) before the DOM, all writes are `textContent` only, and the
+only dynamic attribute (a quota-bar width) comes from a clamped 0–100 integer.
+
+Coverage: 26 tests across three tiers — render unit tests (sanitize/clamp/
+countdown/renderers + XSS-survives-as-inert-text), a controller integration test
+(jsdom + injected fetch/timers: render, feature-dark, XSS through the controller,
+fetch-failure resilience, visibility gating), and an e2e feature-alive test that
+boots a real server with the production routes and drives the shipped controller
+against it (accounts + pending logins render; feature-off → friendly copy).
+
+## What to Tell Your User
+
+There's a new **Subscriptions** tab on your dashboard. It shows each of your
+subscription accounts, how much of each is left (5-hour and weekly) and when it
+resets, and any logins still waiting for you to approve on your phone — with the
+code and a countdown. Open it from any device with your dashboard PIN.
+
+## Summary of New Capabilities
+
+- **Subscriptions dashboard tab** — per-account live quota bars (5h + weekly) with
+  reset countdowns + friendly status, on any device behind the dashboard PIN.
+- **Pending Logins panel** — in-flight enrollment codes / verification URLs (as
+  copyable text) with TTL countdown + re-issue count.
+- **Mobile-responsive + safe** — sanitized, `textContent`-only rendering; no live
+  links; reuses the Process Health tab's hardened display contract.

package/upgrades/side-effects/subscription-auth-enrollment.md

@@ -0,0 +1,91 @@
+# Side-Effects Review — Mobile-first enrollment wizard (P2.1)
+
+## Scope of change
+
+- `src/core/PendingLoginStore.ts` (new) — durable ledger of in-flight logins (public artifacts only).
+- `src/core/EnrollmentWizard.ts` (new) — orchestration: start + auto-reissue-on-expiry + complete.
+- `src/core/FrameworkLoginDriver.ts` (new) — concrete LoginDriver: spawn framework login under the account's config home, scrape the public code/URL.
+- `src/server/routes.ts` — RouteContext `enrollmentWizard` + 4 routes under `/subscription-pool`.
+- `src/server/AgentServer.ts` — `enrollmentWizard?` option + private field + RouteContext plumbing.
+- `src/commands/server.ts` — instantiate the store + driver + wizard; pass to AgentServer; background reissue tick (unref'd).
+- tests (unit + integration + e2e) + api.md.
+
+## The concern: a wizard that spawns a login process + writes a durable store
+
+The new authority here is (a) spawning a framework login command, and (b) writing
+a durable store. The safety design:
+
+- **Spawning is injected + scoped.** The interactive leg (driving the login CLI)
+  is the injected `LoginDriver`. The concrete `FrameworkLoginDriver` spawns the
+  framework's OWN login command under a per-account `CLAUDE_CONFIG_DIR` — it does
+  not extract, read, or transmit any credential. The credential is written by the
+  framework's own client into that config home; instar only reads the PUBLIC
+  artifact (verification URL + short code) the provider prints to be typed into
+  its own page.
+- **No secret can enter the store by construction.** `PendingLoginStore`'s record
+  type has no token/secret field. There is nothing to smuggle a credential into —
+  the same structural guarantee P1.1 enforces for the account registry. The
+  integration test asserts no token-like field ever appears in a response body.
+- **Dark + operator/internal.** The routes nest under `/subscription-pool`
+  (already INTERNAL, not surfaced in /capabilities until graduation) and do
+  nothing until an operator starts an enrollment. No live-session path is touched.
+- **The background tick is inert + bounded.** The reissue sweep only re-drives
+  logins that are already EXPIRED; with no pending logins it is a no-op. The timer
+  is `unref()`'d so it never holds the process open.
+
+## Authority / autonomy analysis
+
+- **Tier-2 by association** (spawns a process, writes a store) but ships dark +
+  operator-gated. The driving spec (`subscription-auth-p2.1-enrollment.md`) is
+  converged + `approved: true` (Justin, Telegram topic 20905, 2026-06-07 — blanket
+  approval of the remaining phases under the autonomy directive).
+- **No autonomous credential handling.** The agent never holds a token; the
+  operator approves at the provider's own page. The wizard's only autonomy is
+  re-issuing an EXPIRED public code — which carries no secret and strands nothing.
+- **Honest failure.** A driver failure during a reissue is logged + the login is
+  left expired for the next sweep (no false "reissued" claim); a scrape timeout
+  throws and the login is left for the operator (no fabricated artifact).
+
+## Failure modes considered
+
+- Login code expires before the operator acts → auto-reissued on the next sweep (the headline fix).
+- Driver/scrape failure → logged, login left expired, sweep continues (one bad login can't abort it).
+- Server restart mid-enrollment → the pending login persisted to disk; it reloads and stays on the surface.
+- Wizard unwired (dark) → list/sweep routes answer 200 `{ enabled:false }`, never 503.
+- No pending logins → the background sweep is a no-op; the timer is unref'd.
+
+## Blast radius
+
+Contained by the dark/operator-gated rollout + the credential-safety-by-construction
+store. With no enrollment started (the default), none of this code executes beyond
+an inert sweep over an empty store. The risk surface is the spawn-+-scrape path,
+exercised only when an operator explicitly starts an enrollment.
+
+## Framework generality
+
+The wizard is framework-agnostic in shape, framework-specific in effect:
+
+- `EnrollmentWizard` + `PendingLoginStore` are fully generic — they carry
+  `provider` + `framework` fields and treat the login artifact uniformly. The
+  per-provider default flow kind (`defaultKind`) encodes the only branch: Codex/
+  OpenAI = device-code (its endorsed flow); everyone else = url-code-paste (the
+  phone-friendly Claude path). Adding a framework is a one-line default + a driver
+  case, not a structural change.
+- `FrameworkLoginDriver` is where framework specificity lives, and it is honest
+  about it: the spawn command + the scrape patterns are per-flow (device-code vs
+  url-code-paste), and the pure `parseArtifact` handles both. The two real flows
+  (Codex device-code, Claude URL-paste) are implemented; gemini-cli / pi-cli slot
+  into the same `framework` union and reuse the same scrape patterns when their
+  login flows are wired — no Claude-only assumption is baked into the abstraction.
+- Per the constitution's "Framework-Agnostic — and Framework-Optimizing": the
+  store + wizard stay neutral across providers; the optimization (which login flow,
+  what to scrape) is per-framework in the driver. This matches the standard's
+  Claude-first scope (Justin's decision 3) without foreclosing the others.
+
+## Migration / parity
+
+All three new classes are additive (new files; the store is created lazily on
+first enrollment). Routes stay under the already-classified `/subscription-pool`
+INTERNAL prefix (no CapabilityIndex change until graduation). An optional
+`subscriptionPool.enrollment` config block tunes TTL/sweep cadence; absent, shipped
+defaults apply. No existing behaviour changes. Ships via dist.