instar 1.3.418 → 1.3.419

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.418",
+  "version": "1.3.419",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T23:51:53.400Z",
-  "instarVersion": "1.3.418",
+  "generatedAt": "2026-06-07T23:59:50.535Z",
+  "instarVersion": "1.3.419",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
+      "contentHash": "e22e519e773f1511f1b3812d893a327ee549622955906d71c8aa65372f87f4cd",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.419.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Three latent bugs in EXO 3.0 capabilities, surfaced by a new from-every-angle test harness, are fixed — each with a regression test:
+
+- Agent-passport verification no longer returns a 500 when a peer's passport omits a field. `permits()` defaults `forbiddenActions`/`allowedCapabilities` to `[]`, so a partial peer card yields a verdict instead of throwing "Cannot read properties of undefined (reading 'length')".
+- The org-intent Tradeoff Hierarchy parser now accepts the documented single-line `Safety > Operator trust > ...` chained form, not only bullet lists. The resolver previously saw an empty hierarchy and reported "no tradeoff hierarchy defined".
+- The learning-velocity metric now reads its three real event sources — the registered-learnings registry under `state/evolution/` (timestamp at `source.discoveredAt`), the `action-queue.json` evolution actions, and the SQLite correction ledger — instead of three paths the agent never writes. It previously always reported zero events.
+
+## What to Tell Your User
+
+- "I found and fixed three small internal bugs in my EXO 3.0 self-checks, each surfaced by a new test harness that probes every capability from several angles. A peer-passport check could crash on an incomplete card; a value-priority list wasn't being read; and a learning-pace number was stuck at zero because it looked in the wrong places. These are correctness fixes with no change to how I behave for you — the learning-pace number will now reflect my real activity."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Passport verify tolerates a partial peer passport | Automatic. A passport missing a field yields a verdict instead of a 500. |
+| Tradeoff Hierarchy chained-form parsing | Automatic. The org-intent A-greater-than-B line now resolves via the tradeoff endpoint. |
+| Learning-velocity real sources | Automatic. The metric reads the real learnings / evolution-actions / corrections stores. |
+
+## Evidence
+
+Before: `POST /passport/verify` with a passport missing `allowedCapabilities` returned HTTP 500 "Cannot read properties of undefined (reading 'length')". `POST /intent/tradeoff-resolve` returned "no tradeoff hierarchy defined" even though the hierarchy was present in the org-intent file. `GET /metrics/learning-velocity` returned `totalEvents: 0` / `insufficient-data` on an agent with hundreds of real evolution actions and registered learnings on disk.
+
+After: the same partial-passport request returns a 200 verdict (covered by a unit test, plus a regression test that still denies a forbidden action on a partial card). tradeoff-resolve resolves a value pair against the parsed order (unit test asserts the chained line parses to the ordered array; the bulleted form still parses). learning-velocity returns the real event count across learnings, evolution actions, and corrections (integration test seeds the real source paths/shapes and asserts a non-zero total). The pre-existing learning-velocity integration test had encoded the buggy paths, which is why the bug stayed green — it now seeds the real paths.

package/upgrades/eli16/exo3-harness-gap-fixes.md

@@ -0,0 +1,33 @@
+# EXO 3.0 Harness Gap Fixes — Plain-English Overview
+
+> The one-line version: a new from-every-angle test harness for our EXO 3.0 features found three small, real bugs that shipped because the old tests checked the wrong things — this fixes all three.
+
+## The problem in one breath
+
+We built a harness that probes every EXO 3.0 capability through its real endpoint, from several angles. It surfaced three genuine bugs that were invisible before because the existing tests quietly encoded the same wrong assumptions the code had. None of them are big — but each made a real capability lie about itself.
+
+## What already exists
+
+- **Agent Passport** — a portable card that says what an agent may and may not do; a peer can check an action against it before trusting it.
+- **Org-Intent / tradeoff hierarchy** — our purpose file lists, in priority order, which value wins when two collide (Safety first, then Operator trust, and so on).
+- **Learning-velocity metric** — a read-only number meant to show how fast the agent is actually learning, by counting real learning events.
+
+## What this adds
+
+This is three surgical fixes, no new features:
+
+- **Passport verify no longer crashes on a partial card.** A peer's passport that omits a field (it didn't go through our builder) used to make the verifier throw a 500 error. Now any missing list defaults to empty, so the verifier always returns a clean yes/no verdict instead of crashing.
+- **The tradeoff hierarchy now actually parses.** Our purpose file writes the hierarchy the documented way — one line, "Safety > Operator trust > Correctness > …". The parser only understood bullet lists, so it read an empty hierarchy and the resolver said "no hierarchy defined." Now it understands the chained form too.
+- **Learning-velocity reads the real event sources.** The metric was reading three file paths the agent never actually writes to (wrong directory, wrong timestamp field, and a JSONL file for data that lives in a database). So it always reported zero. Now it reads the registered-learnings registry (with the right timestamp), the evolution action queue, and the corrections database.
+
+## The safeguards
+
+**Prevents the verifier from crashing on untrusted input.** A passport is, by design, handed over by another agent — so it must be treated as possibly-partial. Defaulting the array fields means a malformed card produces a verdict, never an exception.
+
+**Prevents silent zero-reporting.** The learning-velocity test used to write fixtures to the same wrong paths the route read, so both were wrong together and the test stayed green. The test now seeds the REAL paths and shapes the live agent writes, so it can never again pass while the live metric reads zero.
+
+**No behavior change for healthy inputs.** A complete passport, a bulleted hierarchy, and an agent with no learning events all behave exactly as before. These fixes only add tolerance and correct paths.
+
+## What ships when
+
+One PR, all three fixes together — they were all surfaced by the same harness run and share the same root (latent bugs masked by tests that encoded the same wrong assumptions). Regression tests ship alongside each fix.

package/upgrades/side-effects/exo3-harness-gap-fixes.md

@@ -0,0 +1,69 @@
+# Side-Effects Review — EXO 3.0 harness gap fixes
+
+**Version / slug:** `exo3-harness-gap-fixes`
+**Date:** `2026-06-07`
+**Author:** `Echo (Instar dev agent)`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+
+Three surgical bug fixes surfaced by the new `exo3-harness` from-every-angle verification:
+(1) `src/core/AgentPassport.ts` `permits()` — default `forbiddenActions`/`allowedCapabilities` to `[]`
+so a partial peer passport yields a verdict instead of an HTTP 500; (2) `src/core/OrgIntentManager.ts`
+`parse()` — accept the documented chained `A > B > C` Tradeoff Hierarchy form in addition to bullets;
+(3) `src/server/routes.ts` `/metrics/learning-velocity` — read the REAL event sources
+(`state/evolution/learning-registry.json` with `source.discoveredAt`, `state/evolution/action-queue.json`
+`.actions[].createdAt`, and the SQLite `correctionLedger`) instead of three paths the agent never writes.
+Regression tests extended in the matching unit + integration suites.
+
+## Decision-point inventory
+
+- `AgentPassport.permits()` — modify (add input-tolerance; verdict logic unchanged)
+- `OrgIntentManager.parse()` tradeoff parsing — modify (add chained-line acceptance; bullets unchanged)
+- `/metrics/learning-velocity` event gathering — modify (correct source paths; scorer untouched)
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+None. Passport `permits()` becomes MORE permissive of input shapes (defaults missing arrays) but the
+allow/deny verdict for any complete passport is byte-identical. The tradeoff parser only ADDS a format;
+a bulleted hierarchy parses exactly as before. No block/allow surface added.
+
+## 2. Under-block
+
+**What does this change now allow that it shouldn't?**
+Nothing new is allowed. A partial passport that omits `forbiddenActions` is treated as "no forbidden
+actions" — which is the correct, safe reading of an absent list (the verifier still applies trust-floor
+and capability-scope). A forbidden action present in a partial passport is still denied (covered by a
+regression test).
+
+## 3. Data / state
+
+**What persistent state does this read or write?**
+Read-only. The learning-velocity route only READS `state/evolution/*.json` and the correction ledger;
+it never writes. No new files, no schema changes, no migrations.
+
+## 4. Performance
+
+The learning-velocity route now reads `action-queue.json` (can be ~hundreds of KB) once per request.
+This endpoint is a low-frequency, on-demand observability call (not a hot path); a single synchronous
+JSON parse per call is acceptable and bounded. No new work on any per-message or per-tick path.
+
+## 5. Failure modes
+
+Every new source read is wrapped in try/catch and skips on error (unreadable/malformed file → that
+source contributes zero, never a 500). The correction ledger read is guarded by `if (ctx.correctionLedger)`
+so agents with correction-learning off (ledger absent) are unaffected. The passport guard removes a
+crash failure mode entirely.
+
+## 6. Security / auth
+
+No auth surface change. The passport fix HARDENS a trust boundary (a peer-supplied passport can no
+longer crash the verifier — a malformed/hostile card now produces a clean verdict). No new endpoints,
+no new capabilities, no credential handling.
+
+## 7. Migration / compatibility
+
+No migration needed. The learning-velocity path correction means existing agents' metric starts
+reflecting real events on the next deploy (it read zero before). No config, no on-disk format, no
+agent-installed file changes. Pure runtime behavior correction.