instar 1.3.446 → 1.3.447

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.446",
+  "version": "1.3.447",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-09T17:23:24.485Z",
-  "instarVersion": "1.3.446",
+  "generatedAt": "2026-06-09T18:08:35.007Z",
+  "instarVersion": "1.3.447",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "cli:init": {

package/src/data/state-coherence-registry.json

@@ -137,6 +137,18 @@
       ],
       "grandfathered": false
     },
+    {
+      "category": "slack-relationship-baselines",
+      "description": "Durable per-principal behavioral baseline (Pillar 3 relationship-aware anomaly second factor): privacy-respecting SHAPE aggregates only — action repertoire, tier/hour histograms, coarse message-length stats, urgency rate — NEVER message content. Fed observe-only from authorized Slack traffic; read by RelationshipAnomalyScorer. Ships DARK. See docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §7.1-7.2, §7.6.",
+      "scope": "machine-local",
+      "freshness": "eventual",
+      "conflictShape": "single-writer",
+      "transport": "none",
+      "paths": [
+        "state/slack-relationship-baselines.json"
+      ],
+      "grandfathered": false
+    },
     {
       "category": "topic-placement-history",
       "description": "Topic<->machine placement history (does not exist as its own store yet; the journal's first stream materializes it). Distinct from current-owner pool state.",

package/upgrades/1.3.447.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+feat(permissions): Slack org permissions **Phase 3** — relationship-aware anomaly detection + a step-up ladder (the relationship second factor on the permission gate). **Observe-only / dark, opt-in.**
+
+- `RelationshipBehaviorStore` — durable, per-principal behavioral baseline recording **SHAPE only** (action labels, tier/hour-of-day counts, coarse message-length stats) — **never message content**.
+- `RelationshipAnomalyScorer` (a real `AnomalyScorer`) — scores how far a request deviates from the principal's baseline via 5 deterministic weighted signals (out-of-character action, tier escalation, off-cadence hour, sudden urgency, length-style deviation); confidence scales with baseline depth.
+- Step-up ladder: a would-be-allowed FLOOR action that scores anomalous → a `step-up` verdict (out-of-band verification). **OBSERVE-ONLY** (enforce=false → logged to the decision ledger, never live-challenged). Anomaly can ONLY raise a would-allow to step-up — a refuse stays a refuse; the deterministic floor is untouched.
+- New/thin baseline → conservative (no spurious step-up; no authority-by-suspicion). Optional LLM style-check is off by default + strictly add-only (fail-closed). `GET /permissions/baselines` read-only inspection.
+
+## What to Tell Your User
+
+Nothing changes by default — observe-only and dark. When enabled, it's the "is this really you?" second factor: if a high-authority account suddenly makes an out-of-character high-risk request (off your usual cadence, an unusually sensitive action, a mismatched style), the agent flags it for step-up verification instead of just trusting it — your compromised-CEO scenario. For now it only *logs* what it would do (so we can measure accuracy before turning it on), it can only ever ask for *more* verification (never less), and it only learns the SHAPE of interactions, never the content of your messages.
+
+## Summary of New Capabilities
+
+- **`slack.permissionGate.relationshipAnomaly: { enabled, useLlmStyleCheck, stepUpThreshold }`** (opt-in, observe-only) — turns on relationship-aware anomaly scoring + the step-up ladder for the Slack permission gate. Off by default (Null scorer = no anomaly, no step-up).
+- **`GET /permissions/baselines`** — read-only inspection of the per-principal behavioral baselines (SHAPE only; operator/internal).
+
+## Evidence
+
+- 19 unit (store durability/privacy, 5-signal scoring, no-baseline conservatism, confidence scaling, LLM fail-closed/match/mismatch, gate composition incl. spoofed-CEO→step-up + member-floor-stays-refuse + new-owner-no-spurious-step-up, observer dark-default-records-nothing) + 3 integration (baselines route). `tsc --noEmit` clean; lint clean (incl. no-silent-llm-fallback ratchet); build clean.
+- Side-effects review (`upgrades/side-effects/slack-relationship-stepup.md`) + an independent adversarial Phase-5 second-pass (baseline-poisoning / never-lower / no-leak).

package/upgrades/side-effects/slack-relationship-stepup.md

@@ -0,0 +1,107 @@
+# Side-Effects Review — Slack Permission System Phase 3: relationship-aware anomaly + step-up ladder
+
+**Version / slug:** `slack-relationship-stepup`
+**Date:** 2026-06-09
+**Author:** Echo
+**Second-pass reviewer:** Echo (self, dedicated reviewer pass — this touches a "gate" decision surface)
+
+## Summary of the change
+
+Phase 3 (Pillar 3) of the Slack org permission system: a relationship-aware behavioral second factor. It adds two new modules in `src/permissions/`: `RelationshipBehaviorStore.ts` (a durable, deterministic, privacy-respecting per-principal behavioral baseline — it records the SHAPE of each interaction: action label, sensitivity tier, hour-of-day, message length, urgency flag — NEVER message content) and `RelationshipAnomalyScorer.ts` (a real implementation of the existing `AnomalyScorer` interface that scores how out-of-character a request is across five deterministic signals plus an OPTIONAL fail-closed LLM style check). `SlackPermissionObserver.ts` is extended to FEED the baseline (observe-only, directed requests only) from real traffic. `index.ts` exports the new modules. `server.ts` wires them DARK/opt-in behind `slack.permissionGate.relationshipAnomaly.enabled` (default: the existing urgency-only `HeuristicAnomalyScorer` — nothing changes). `routes.ts` adds a read-only `GET /permissions/baselines` inspection route. `state-coherence-registry.json` registers the new `slack-relationship-baselines` state category. Decision points it interacts with: the existing `SlackPermissionGate.evaluate` step-up path (§7.4 composition — anomaly can only RAISE a would-be-allowed FLOOR action to step-up, never lower any bar). Everything is OBSERVE-ONLY: the step-up verdict is computed and logged to the decision ledger; nothing is live-challenged or blocked (the observer ships enforce=false).
+
+## Decision-point inventory
+
+- `SlackPermissionGate.evaluate` step-up path (`src/permissions/SlackPermissionGate.ts:167-179`) — pass-through (UNCHANGED) — the gate already consumes an `AnomalyScorer.assess()` score against `stepUpThreshold` and escalates a would-be-allowed floor action to `step-up`. This change supplies a richer scorer into the SAME slot; the gate logic is untouched.
+- `RelationshipAnomalyScorer.assess` (new) — add — produces a 0..1 anomaly SIGNAL (no blocking authority of its own). It is consumed by the gate; it never blocks/allows directly.
+- `RelationshipBehaviorStore.record` (new) — add — append/aggregate per-principal baseline; pure data, no decision.
+- `SlackPermissionObserver.recordBehavior` (new) — add — feeds the baseline observe-only; no decision, no block.
+- `GET /permissions/baselines` (new route) — add — read-only inspection; no decision surface.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+In OBSERVE-ONLY mode (the only mode this ships in): NONE. No message is ever blocked or challenged — the step-up verdict is logged, never acted on (the observer's `enforce` flag stays false; this PR does not enable enforce).
+
+For the FUTURE enforce path (data-gated, not enabled here), the relevant over-fire is a spurious step-up: e.g. a legitimate owner who genuinely changes their behavior (new role, travels to a new timezone shifting their hour-of-day, suddenly writes longer messages). The scorer mitigates this conservatively: a thin baseline (< establishedMin=5 interactions) suppresses the action/tier/style signals entirely (no "out of character" without an established "character"); a no-baseline principal scores 0 (no fabricated step-up); and anomaly can ONLY raise the bar on a request that was ALREADY going to be allowed — it never invents a new gate. The composition (§7.4) means an over-fire's worst case is "I'd like to confirm it's really you via your known channel," not a hard deny.
+
+---
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+- A compromised account that mimics the principal's exact style/cadence/action repertoire and avoids urgency language scores low — the behavioral factor is a probabilistic signal, not a guarantee (by design; §7 frames it as "feeling something off," not proof).
+- The deterministic style signal is coarse (message LENGTH z-score only). A content-level voice mismatch is only caught when the optional LLM style check is enabled (and even then only on a clear MISMATCH).
+- A NEW principal (no baseline) has no "character," so a first-ever out-of-character request from a brand-new compromised account scores 0. This is the documented conservative choice: the FLOOR (RolePolicy) still protects the dangerous action regardless — a new owner still needs owner-role authority for a floor action; anomaly is an ADD-ON tightener, not the floor.
+- Off-cadence detection uses local server hour vs the principal's recorded hour histogram; a principal who legitimately works irregular hours has a flat histogram and rarely trips off-cadence (acceptable — fewer false positives).
+
+These are acceptable for an observe-only second factor whose entire purpose is to be MEASURED (FP/FN rate) before it ever enforces.
+
+---
+
+## 3. Level-of-abstraction fit
+
+This is correctly a DETECTOR (a signal producer), not an authority. `RelationshipAnomalyScorer` returns a score + reasons; it holds no block/allow authority. The AUTHORITY remains `SlackPermissionGate`, which already owns the deterministic Layer-0 floor and the role ceilings — the dangerous decisions stay in code, not in the brittle scorer. The scorer FEEDS the gate's existing step-up slot rather than running parallel to it. The durable baseline is a dedicated store rather than a retrofit onto the generic `RelationshipManager`: the generic manager has no structured per-request SHAPE history (action-tier/hour histograms, length stats) and adding privacy-sensitive structured tracking to it would over-couple a cross-platform memory system to a Slack-permission concern. The new store is small, Slack-scoped, and content-free — the right layer. This mirrors how the rest of the permissions module is decoupled (it imports nothing from core; deps are injected).
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change produces a SIGNAL consumed by an existing smart gate.
+
+`RelationshipAnomalyScorer` is a pure signal producer: it returns `{ score, reasons }` and never blocks. The `SlackPermissionGate` (the authority) consumes that signal and is the only thing that produces a verdict — and even then, anomaly can ONLY raise a would-be-allowed floor action to step-up; it can never turn a refuse into an allow (verified by the "anomaly can only RAISE the bar" test). The OPTIONAL LLM style check is `gating: true` (provider-swaps at the IntelligenceRouter) and fails CLOSED (any failure omits its contribution; it never widens) — compliant with the No-Silent-Degradation standard. The deterministic signals stand alone with no LLM dependency, so the dangerous path never depends on an LLM.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** The scorer runs INSIDE `SlackPermissionGate.evaluate`, only on the would-allow-a-floor-action branch (after the deterministic floor + grant check). It cannot shadow the floor check — the floor runs first and a refuse is returned before the scorer is ever consulted. Verified by the member-floor-request test (stays a refuse).
+- **Double-fire:** The observer records the baseline AND the existing decision ledger records the verdict on the same `observe()` call — two distinct append-only writes to two distinct files, no contention. Baseline recording is gated to directed requests only (overheard chatter is excluded), so channel noise doesn't pollute the baseline.
+- **Races:** `RelationshipBehaviorStore` writes via temp-file + rename (atomic-ish) so a crash mid-write can't truncate the baseline. It is per-principal-keyed within a single JSON file; the single-writer model matches the registry `conflictShape: single-writer`. The observer is the only writer in production.
+- **Feedback loops:** The baseline is fed by observed traffic and read by the scorer — but recording is post-verdict and never influences the SAME message's verdict (the verdict is computed from the baseline AS-OF-BEFORE this message). No self-reinforcing loop within a turn.
+
+---
+
+## 6. External surfaces
+
+- **Other agents / install base:** None. The feature ships DARK behind `slack.permissionGate.relationshipAnomaly.enabled` (default off). With the flag off, `server.ts` keeps the existing `HeuristicAnomalyScorer` (urgency-only) exactly as before — byte-for-byte unchanged behavior for every existing agent. No CLAUDE.md template or PostUpdateMigrator change (consistent with Slices 0/1/2, which also added nothing there — this is internal server-wired config, not an agent-installed file or a conversational capability).
+- **External systems (Slack):** No change to Slack message handling. Observe-only: nothing is sent, blocked, or reacted-to differently.
+- **Persistent state:** Adds ONE new state file `slack-relationship-baselines.json` (registered in the coherence registry, machine-local, content-free SHAPE aggregates). It is only written when the feature is enabled AND a behaviorStore is wired; otherwise the file never exists.
+- **New read route:** `GET /permissions/baselines` returns SHAPE aggregates only (verified by a test asserting no message content appears in the payload).
+- **Timing/runtime:** Off-cadence uses server-local hour; documented limitation, no correctness dependency.
+
+---
+
+## 7. Rollback cost
+
+Pure additive code change, ships dark. Rollback = revert the commit and ship a patch; no migration, no agent-state repair, no user-visible regression (the feature was never on by default). The new state file, if any agent had enabled the feature, is a self-contained machine-local JSON that can be deleted with no downstream effect (the scorer treats a missing baseline as "no baseline" → score 0). The new coherence-registry category is descriptive metadata; removing it has no runtime effect. Estimated rollback: one revert commit, zero downtime.
+
+## Conclusion
+
+The review produced no design changes — the change was built as a signal producer feeding the existing authority from the start, and ships observe-only/dark, matching the spec's §7.6 ("the anomaly detector ships dark/observe-only; logs would-be step-ups; nothing gates until the FP rate is known-good"). The conservative no-baseline / thin-baseline behavior is the documented, deliberate choice (don't fabricate a step-up you can't justify from history; the floor protects the dangerous action regardless). The optional LLM style check is fail-closed and add-only. The deterministic core has no LLM dependency. Clear to ship as a dark/observe-only Phase 3 increment pending the spec's convergence gate (the spec is operator-approved but `review-convergence: pending`, so this lands as a Tier-2 increment behind that gate).
+
+---
+
+## Second-pass review (independent adversarial — "gate"-class change)
+
+**Verdict: CONCUR on all five invariants, with one substantive CONCERN (baseline-poisoning) — mitigation #1 applied + regression-tested in this PR; deeper mitigations tracked as follow-ups.**
+
+The independent adversarial reviewer verified against the code: (1) anomaly only RAISES a would-be-allowed floor verdict to step-up — it can never convert a refuse to allow, weaken the floor, or suppress a required step-up (the score is consulted only after the deterministic deny-by-default floor check passes); (2) message text cannot LOWER the deterministic score (shape-based; the urgency regex + length z-score are add-only) and the optional LLM check is strictly add-only (a prompt-injected "this is the real CEO" → MATCH/empty/unparseable → adds nothing); (3) the store persists SHAPE only (no text/topics; tests + the route assert it); (4) observe-only + dark default confirmed; (5) no authority-by-suspicion (new/thin baseline → no spurious step-up; the floor still protects).
+
+**CONCERN — baseline poisoning (was real):** the highest-weight signal (out-of-character action, 0.45) fired only when `actionCounts[action] === 0`, so a patient attacker / slowly-compromised account could seed a single prior observation to permanently disable it; the reviewer reproduced a poisoned baseline scoring 0.45 < the 0.5 step-up threshold → no step-up. It was a follow-up (not a merge blocker) since the change ships observe-only and the deterministic floor still requires owner/grant regardless — but it had to be closed before enforcement is ever turned on (the whole value of Pillar 3 is catching a *legitimately-authorized* account behaving out of character, which is exactly what poisoning targets).
+
+**Mitigation #1 APPLIED in this PR (`RelationshipAnomalyScorer.ts`):** the out-of-character signal now fires when the action's SHARE is below a floor (`rareActionShareFloor`, default 0.10), not only when never-seen, with the weight scaled by rarity (full at never-seen → 0 at the floor) so a genuinely-routine action never trips it. Regression test added (the reviewer's exact poisoned baseline — 50 reads + 2 seeded money-movement obs → the malicious request now scores ≥ 0.5 and the rare-action signal still names it). **Follow-ups tracked (deeper poisoning resistance):** (#2) recency/EWMA-decay weighting so a recent burst can't durably reshape the histogram; (#3) a minimum-baseline-AGE gate (using the existing `firstSeen`) + a per-principal observation-rate cap. These are schema-touching and not required while observe-only — to be done before the enforce flip.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/slack-relationship-anomaly.test.ts` — 19 tests (store durability/privacy, five-signal scoring, no-baseline conservatism, confidence scaling, LLM fail-closed, gate composition, observer recording).
+- `tests/integration/permissions-routes.test.ts` — `GET /permissions/baselines` route (SHAPE-only, single-principal, empty-state).
+- `npx tsc --noEmit` — clean. `npm run lint` — clean (state-registry lint accepts the new category; no-silent-llm-fallback ratchet accepts the gating:true style-check callsite).
+- Spec: `docs/specs/SLACK-ORG-INTEGRATION-SPEC.md` §7.1–7.4, §7.6.