instar 1.3.422 → 1.3.424

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T01:50:28.381Z",
-  "instarVersion": "1.3.422",
+  "generatedAt": "2026-06-08T04:23:21.250Z",
+  "instarVersion": "1.3.424",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "1b7d450ba6a4b4793a0497d93dde540c42227edb34d6b6fd92ab641c76b64438",
+      "contentHash": "e07f73675b7bafbe48a0392568e9582a697ef9836691e5483add48393a3bc7cc",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
+      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -702,10 +702,11 @@ This routes feedback to the Instar maintainers automatically. Valid types: \`bug
 - **Dashboard**: the **Subscriptions tab** shows live quota bars (5h + weekly + reset countdown), status, and the Pending Logins panel — share the dashboard URL + PIN.
 - **When to use** (PROACTIVE): "how much quota is left across my accounts?" / "am I about to hit a limit?" → \`GET /subscription-pool\`; the user wants to add another subscription → drive the enrollment wizard (never ask them to paste a token); a long job is at risk of a quota wall → the continuity guarantee + \`/swap\` keep it alive. Single-account pools are a no-op.
 
-**Per-Feature LLM Metrics** — See what each of your LLM-driven gates/sentinels actually costs and how often it fires, so tuning them is evidence-based (which to thin, which to strengthen). Read-only observability (like token usage) — it never gates anything.
+**Per-Feature LLM Metrics & LLM Activity (Observable Intelligence)** — Audit what each of your LLM-driven gates/sentinels actually does: WHICH provider + model ran it, how often it ACTED (fired) vs found nothing (noop), how often it was skipped to save rate limits (shed), cost, and latency. This is the *Observable Intelligence* standard — no autonomous AI action the system takes is allowed to be invisible. Read-only observability — it never gates anything.
 - Check: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/metrics/features?sinceHours=24"\`
-- Returns \`{ totals, features: [{ feature, calls, tokensIn, tokensOut, fired, noop, fireRate, p50LatencyMs, p95LatencyMs, ... }] }\` — one row per system (e.g. MessagingToneGate, CoherenceReviewer). Filter with \`?feature=<name>\`.
-- **When to use**: when asked "which checks cost the most / fire the least?", "is this gate worth it?", or before tuning a sentinel/gate — read the numbers instead of guessing. (Spec: \`docs/specs/llm-feature-metrics-spec.md\`.)
+- Returns \`{ totals, features: [{ feature, frameworks, models, calls, realCalls, tokensIn, tokensOut, fired, noop, shed, fireRate, p50LatencyMs, p95LatencyMs, ... }] }\` — one row per system (e.g. MessagingToneGate, MessageSentinel). \`frameworks\`/\`models\` = which provider(s) actually served the call; \`fireRate\` = how often it acts; \`shed\` = skipped by the rate-limit guard. Filter with \`?feature=<name>\`.
+- **Dashboard:** the **LLM Activity** tab renders all of this in plain language over a 24h / 7d / 30d window — point the user there rather than pasting curl output.
+- **When to use** (PROACTIVE): "which provider is this sentinel running on?" / "are the sentinels actually doing real work or just being skipped?" / "which checks cost the most or fire the least?" / before tuning a sentinel or gate → read the numbers (\`frameworks\`/\`models\` for provider, \`fireRate\` for effectiveness, \`shed\` for skip rate) instead of guessing. Bounded retention (~30 days; tune \`monitoring.featureMetrics.retentionDays\`). (Specs: \`docs/specs/observable-intelligence.md\`, \`docs/specs/llm-feature-metrics-spec.md\`.)
 
 **Resource Usage (CPU + memory + rate-limit events)** — Durable per-agent record of what you actually consume, mirroring the TokenLedger. Read-only observability — it never gates. Two parts:
 - **CPU + memory** (Phase B): your server process and every running session are sampled continuously for CPU% and memory (RSS). Check current + windowed (avg/peak) usage, broken down per source plus an aggregate: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/resources/summary?sinceHours=1"\` → \`{ sampleCount, sources: [{ source, currentCpuPercent, currentRssBytes, avgCpuPercent, peakCpuPercent, peakRssBytes, ... }] }\` (\`source\` is \`agent-server\`, \`session:<id>\`, or \`aggregate\`). Recent raw samples: \`GET /resources/samples?sinceHours=1&source=aggregate&limit=20\`. The dashboard "Resource Usage" tab renders all of this in plain language.

package/upgrades/1.3.423.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Two safety-gating LLM fallbacks flipped from fail-OPEN to fail-CLOSED, implementing the new "No Silent Degradation to Brittle Fallback" standard:
+- `ExternalOperationGate.consultLLM`: on LLM failure (rate-limit/circuit-open/timeout) it returned `proceed` — now returns `show-plan` (require approval). A risky op the LLM would have escalated can no longer slip through while the LLM is down.
+- `ContentClassifier` (A2A outbound-leak gate): on parse-fail or error it returned `safe` — now returns `sensitive`, so unverifiable content is held, not shipped to a peer.
+
+Also lands `docs/specs/no-silent-degradation-to-brittle-fallback.md`: the standard + the "Iterative Audit to Convergence" standard + round-1 audit (2 dangerous fail-open gates fixed here; provider-swap + lint + re-audit + throwaway-agent are the follow-ups).
+
+## What to Tell Your User
+
+- "I hardened two safety checks: when the AI behind them is rate-limited or down, they now pause for your approval (or hold the content) instead of silently allowing the action. The honest tradeoff is that during a heavy AI rate-limit, a few more operations will wait for your OK — that's the safe direction, and I'm adding an automatic swap-to-another-AI-provider so it happens less often."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Operations gate fails closed on LLM failure | Automatic. On AI failure the gate requires a plan/approval instead of proceeding. |
+| A2A leak gate fails closed on LLM failure | Automatic. Unverifiable outbound content is held as sensitive, not shipped. |
+| No-Silent-Degradation + Iterative-Audit standards | docs/specs/no-silent-degradation-to-brittle-fallback.md |
+
+## Evidence
+
+Before: with the LLM rate-limited (circuit open), `ExternalOperationGate` returned `proceed` for any op its deterministic floor didn't catch, and `ContentClassifier` returned `safe` for any content it couldn't classify. Surfaced live during the EXO 3.0 harness rate-limit. After: both fail closed (`show-plan` / `sensitive`). Regression tests: ExternalOperationGate "FAILS CLOSED to show-plan", ContentClassifier "FAILS CLOSED to sensitive" (parse-fail + throw). 98 unit tests green; tsc clean.

package/upgrades/1.3.424.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+The per-feature LLM metrics ledger now records, for every call the system makes on its own behalf (sentinels, gates, reflectors, background checks), **which provider + model actually ran it** and **whether the check acted (fired) or found nothing (noop)** — closing two long-standing blind spots: the `model` column was never populated, and the `fired` verdict was deferred to a "Phase 2" that never shipped, so codex/gemini calls were unattributable and every completed call read as a no-op. Recording is enforced at the single funnel (`CircuitBreakingIntelligenceProvider`) via two additive, optional seams on `IntelligenceOptions` — `onModel` (every provider surfaces its resolved model/framework, independent of token usage) and `classifyVerdict` (the caller classifies act-vs-no-act). A new **LLM Activity** dashboard tab renders it in plain language over a 24h/7d/30d window. Bounded retention (default 30 days, `monitoring.featureMetrics.retentionDays`) ages the audit trail out so it is never hoarded forever.
+
+## What to Tell Your User
+
+You can now audit what your agent's "autopilot" is actually doing: open the **LLM Activity** dashboard tab to see, per check, which AI provider ran it, how often it acted on something vs. found nothing, how often it was skipped to save rate limits, and what it cost — over time. This is the new *Observable Intelligence* standard: no autonomous AI action the system takes is allowed to be invisible. Nothing for you to do; it takes effect on the next restart.
+
+## Summary of New Capabilities
+
+- `/metrics/features` rows now include `frameworks[]`, `models[]`, real `fired`/`fireRate`, and `shed` — answering "which provider ran this sentinel?" and "is it doing real work or just being skipped?".
+- New **LLM Activity** dashboard tab (read-only) over a selectable window.
+- `IntelligenceOptions.onModel` + `classifyVerdict` seams; every provider (Claude/Codex/Gemini/Pi/InteractivePool) surfaces its model/framework; `MessageSentinel` + `CommitmentSentinel` classify their verdicts.
+- Bounded retention via `FeatureMetricsLedger.pruneOlderThan` + `monitoring.featureMetrics.retentionDays` (default 30).
+- New constitutional standard *Observable Intelligence — No Autonomous LLM Action Is Unauditable* (proposed, pending ratification) + spec `docs/specs/observable-intelligence.md`.
+
+## Evidence
+
+`tests/unit/FeatureMetricsLedger.test.ts` (12, +4: framework rollup, prune, idempotent column add), `tests/unit/CircuitBreaking-feature-metrics-tap.test.ts` (19, +7: onModel/classifyVerdict/error-path attribution + real-ledger rollup), `tests/integration/metrics-features-routes.test.ts` (+1: provider/model/fired through the route), `tests/e2e/metrics-features-lifecycle.test.ts` green; no-silent-fallbacks ratchet + feature-delivery-completeness parity green; `tsc` clean.
+
+## Scope (honest)
+
+Provider/model attribution + the fired/noop verdict are recorded for all providers. Per-call **token cost** is captured where the provider surfaces it (Claude, Pi); codex/gemini exec output carries no usage block, so their per-call tokens stay null (model/framework + outcome are still recorded; account-level codex cost is visible via `/codex/usage`) — per-call token parsing for those via their `--json` modes is a bounded follow-up. Read-only observability throughout: it never gates, blocks, or mutates the path it observes.

package/upgrades/eli16/llm-fallback-failclosed.md

@@ -0,0 +1,33 @@
+# Fail-Closed for LLM Safety Gates — Plain-English Overview
+
+> The one-line version: two safety gates that asked an AI for a yes/no were quietly saying "yes, go ahead" whenever the AI was unavailable — now they say "wait for approval" instead.
+
+## The problem in one breath
+
+When an AI model makes a safety decision and the model is rate-limited or down, the worst possible answer is to silently fall back to a permissive default — it looks protected but isn't. Two of our gates did exactly that: on an AI failure they returned the *go-ahead* answer.
+
+## What already exists
+
+- **The operations safety-gate** — checks risky external operations (sending email, deleting things) and decides: proceed, show-a-plan-first, or block. It was built after an agent autonomously deleted 200 emails.
+- **The outbound-leak gate** — checks content an agent is about to send to another agent for leaks (secrets, system prompts, private data) and decides: safe, sensitive, or blocked.
+
+## What this adds
+
+Both gates now **fail closed** when the AI can't answer:
+
+- The operations gate, on AI failure, returns **"show a plan first"** (require approval) instead of **"proceed"**. A risky operation the AI would have escalated can no longer slip through silently while the AI is down.
+- The outbound-leak gate, on AI failure (unparseable reply OR error), returns **"sensitive"** instead of **"safe"**, so unverifiable content is held instead of silently shipped to a peer.
+
+It also lands the **"No Silent Degradation to Brittle Fallback"** standard (when an AI gates a real action, swap providers or fail closed — never silently degrade to a weak check) and the **"Iterative Audit to Convergence"** standard (audit → fix → re-audit until a pass finds nothing new).
+
+## The safeguards
+
+**Prevents fake-safety.** A gate that silently downgrades to a permissive default is more dangerous than no gate, because it looks like it's protecting you. Failing closed removes that illusion.
+
+**No behavior change when the AI is healthy.** A complete, parseable AI verdict behaves exactly as before — these changes only affect the failure path.
+
+**Honest tradeoff.** During a heavy AI rate-limit, more operations will pause for approval instead of silently proceeding. That's the safe direction, and the planned provider-swap (try another AI before failing) will shrink how often it happens.
+
+## What ships when
+
+This PR is the two gate-flips + the standard. Next: a shared provider-swap so gates try another AI provider before failing closed, a lint that flags new silent-fallbacks in gating paths, a re-audit to convergence, and a throwaway sandbox agent for adversarial behavioral testing.

package/upgrades/eli16/observable-intelligence-llm-activity.md

@@ -0,0 +1,26 @@
+# Observable Intelligence — in plain language
+
+## The problem
+
+Your agent has a bunch of little "autopilot" helpers running in the background — the things we call sentinels and gates. They watch your messages, decide whether something needs action, and quietly handle housekeeping. Each one can ask an AI model a quick question to make its call.
+
+Someone asked a simple, fair question: *"Which AI provider are these helpers actually using, and are they even doing any real work?"* And the honest answer was: **we couldn't fully tell.** The log that's supposed to track this had two holes in it:
+
+1. It never wrote down **which AI** ran each check. So if you'd switched your sentinels over to a different provider (say, Codex instead of Claude), the log couldn't prove it.
+2. It never wrote down whether a check **actually did something** versus just looked and found nothing. So every check looked identical in the data — you couldn't tell a hard-working guard from a useless one.
+
+A helper that acts on your behalf but can't show what it chose to do is a helper you can't hold accountable. That's the gap this closes.
+
+## What changed
+
+Now, every time one of these helpers asks an AI a question, the system writes down: **which provider and model answered, whether the helper acted or found nothing, whether it got skipped to save on rate limits, how much it cost, and how long it took.** It records this at one shared "chokepoint" that every helper already passes through — so it covers all of them automatically, today and in the future, with nothing to remember.
+
+There's a new **"LLM Activity" tab** in your dashboard that shows all of this in plain English: one row per helper, over a window you pick (last day, week, or month). You can finally see, at a glance, which helpers earn their keep and which are mostly idle or skipped.
+
+## The balance
+
+We don't keep this log forever — that would just be hoarding. It's kept about a month (you can change that), then old entries age out. Long enough to spot trends, not so long it piles up.
+
+## Is it risky?
+
+No. This only **watches** — it never blocks, changes, or slows down anything the helpers do. If the new tracking ever hiccupped, the helper would carry on exactly as before. It's all extra, additive recording, fully covered by tests.

package/upgrades/side-effects/llm-fallback-failclosed.md

@@ -0,0 +1,37 @@
+# Side-Effects Review — Fail-closed for LLM safety gates
+
+**Version / slug:** `llm-fallback-failclosed`
+**Date:** `2026-06-07`
+**Author:** `Echo`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+Two safety-gating LLM fallbacks flipped from fail-OPEN to fail-CLOSED:
+`src/core/ExternalOperationGate.ts` `consultLLM` catch: `proceed` → `show-plan`.
+`src/threadline/ContentClassifier.ts` parse-fail + error catch: `safe` → `sensitive`.
+Plus `docs/specs/no-silent-degradation-to-brittle-fallback.md` (the standard + round-1 audit). Regression tests updated in both unit suites.
+
+## Decision-point inventory
+- `ExternalOperationGate.consultLLM` LLM-failure branch — modify (proceed→show-plan)
+- `ContentClassifier` parse-fail + error branches — modify (safe→sensitive)
+
+## 1. Over-block
+On LLM failure (rate-limit/circuit-open/timeout), operations now require a plan/approval and outbound A2A content is held as sensitive. During a heavy LLM outage this WILL pause more ops for approval and hold more A2A messages than before — intentional (fail-closed). Healthy-LLM behavior is unchanged. The planned provider-swap reduces failure frequency.
+
+## 2. Under-block
+Strictly reduces under-block: the previous fail-open silently allowed risky ops / shipped unverifiable content when the LLM was down. That hole is closed.
+
+## 3. Data / state
+None. Pure decision-value changes; no new files (except docs), no schema, no migration.
+
+## 4. Performance
+None. Same code path; only the returned verdict on the already-existing failure branch changes.
+
+## 5. Failure modes
+This change IS the failure-mode hardening. The fail-closed verdicts (show-plan, sensitive) are existing valid values handled downstream. No new throw paths.
+
+## 6. Security / auth
+Hardens two trust boundaries: the external-operation gate (autonomous-deletion incident origin) and the A2A outbound-leak gate. No new endpoints/capabilities.
+
+## 7. Migration / compatibility
+No migration. Behavior takes effect on next deploy; existing agents get the safer fail-closed posture automatically. No agent-installed file changes.

package/upgrades/side-effects/observable-intelligence-llm-activity.md

@@ -0,0 +1,25 @@
+# Side-effects review — Observable Intelligence / LLM Activity
+
+**Tier:** 1 (large but purely additive, read-only observability; no existing behavior changes; reversible; full 3-tier tests). Risk floor flags "new capability" — declared below floor with this rationale, recorded in the decision audit.
+
+## Surface touched
+
+- `IntelligenceOptions` gains two **optional** callbacks (`onModel`, `classifyVerdict`). Additive: every existing caller is byte-identical (evaluate() still returns `Promise<string>`).
+- `CircuitBreakingIntelligenceProvider` (the single funnel) captures model/framework + classifies the verdict and records them. Pure side-channel — wrapped in try/catch; a throw in either callback cannot change what `evaluate()` returns or break the observed path.
+- Five providers (Claude/Codex/Gemini/Pi/InteractivePool) each call `onModel` once per call. Each call is try/caught (`@silent-fallback-ok`) so it can never break the LLM path.
+- Two sentinels (MessageSentinel, CommitmentSentinel) pass a `classifyVerdict`; the classification reuses their existing parse and defaults to noop on throw.
+- `FeatureMetricsLedger`: new `framework` column via idempotent pragma-guarded `ALTER TABLE ADD COLUMN` (existing DBs migrate at open, no data loss); new `pruneOlderThan`; rollup gains `frameworks[]`/`models[]`.
+- `AgentServer`: a retention prune timer (boot + every 6h, `unref`'d), cleared at shutdown.
+
+## Risks considered
+
+- **Schema migration**: covered by a unit test that opens an old-schema DB and confirms the column is added without losing the legacy row. The ALTER is pragma-guarded and idempotent.
+- **Performance**: recording is one extra SQLite insert per call (already happening) plus two cheap callback invocations. No new network calls.
+- **Retention deletion**: `pruneOlderThan` only deletes rows older than the cutoff; fail-open (a failed prune leaves rows for the next tick). Default 30d, configurable, `0` disables.
+- **Observability never gates**: same guarantee as TokenLedger. A failed metric write, failed prune, or thrown callback degrades silently; the LLM path is unaffected.
+- **No new HTTP route** (reuses `/metrics/features`), so no new auth/route surface. Dashboard tab is read-only.
+- **Migration parity**: existing agents get the enhanced CLAUDE.md section via the existing `/metrics/features` migrateClaudeMd block (enhanced in place, idempotent — verified by `PostUpdateMigrator-metricsFeatures.test.ts`); new agents via the template.
+
+## Constitutional fit
+
+Implements the proposed **Observable Intelligence** standard (pending operator ratification); balanced by Responsible-Resource bounded retention. Sharpens the existing **Observability** standard.