instar 1.3.446 → 1.3.448

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.446",
+  "version": "1.3.448",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-09T17:23:24.485Z",
-  "instarVersion": "1.3.446",
+  "generatedAt": "2026-06-09T18:24:57.311Z",
+  "instarVersion": "1.3.448",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "494ab37af4896a53820002d16390fe132540fb23e2a7c404139c90ca53062bb6",
+      "contentHash": "2ee1fcd31c96470a77ceb7efbbac2b2267e60260820d3caff565b7212c68c5c5",
       "since": "2025-01-01"
     },
     "cli:init": {

package/src/data/state-coherence-registry.json

@@ -137,6 +137,18 @@
       ],
       "grandfathered": false
     },
+    {
+      "category": "slack-relationship-baselines",
+      "description": "Durable per-principal behavioral baseline (Pillar 3 relationship-aware anomaly second factor): privacy-respecting SHAPE aggregates only — action repertoire, tier/hour histograms, coarse message-length stats, urgency rate — NEVER message content. Fed observe-only from authorized Slack traffic; read by RelationshipAnomalyScorer. Ships DARK. See docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §7.1-7.2, §7.6.",
+      "scope": "machine-local",
+      "freshness": "eventual",
+      "conflictShape": "single-writer",
+      "transport": "none",
+      "paths": [
+        "state/slack-relationship-baselines.json"
+      ],
+      "grandfathered": false
+    },
     {
       "category": "topic-placement-history",
       "description": "Topic<->machine placement history (does not exist as its own store yet; the journal's first stream materializes it). Distinct from current-owner pool state.",

package/upgrades/1.3.447.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+feat(permissions): Slack org permissions **Phase 3** — relationship-aware anomaly detection + a step-up ladder (the relationship second factor on the permission gate). **Observe-only / dark, opt-in.**
+
+- `RelationshipBehaviorStore` — durable, per-principal behavioral baseline recording **SHAPE only** (action labels, tier/hour-of-day counts, coarse message-length stats) — **never message content**.
+- `RelationshipAnomalyScorer` (a real `AnomalyScorer`) — scores how far a request deviates from the principal's baseline via 5 deterministic weighted signals (out-of-character action, tier escalation, off-cadence hour, sudden urgency, length-style deviation); confidence scales with baseline depth.
+- Step-up ladder: a would-be-allowed FLOOR action that scores anomalous → a `step-up` verdict (out-of-band verification). **OBSERVE-ONLY** (enforce=false → logged to the decision ledger, never live-challenged). Anomaly can ONLY raise a would-allow to step-up — a refuse stays a refuse; the deterministic floor is untouched.
+- New/thin baseline → conservative (no spurious step-up; no authority-by-suspicion). Optional LLM style-check is off by default + strictly add-only (fail-closed). `GET /permissions/baselines` read-only inspection.
+
+## What to Tell Your User
+
+Nothing changes by default — observe-only and dark. When enabled, it's the "is this really you?" second factor: if a high-authority account suddenly makes an out-of-character high-risk request (off your usual cadence, an unusually sensitive action, a mismatched style), the agent flags it for step-up verification instead of just trusting it — your compromised-CEO scenario. For now it only *logs* what it would do (so we can measure accuracy before turning it on), it can only ever ask for *more* verification (never less), and it only learns the SHAPE of interactions, never the content of your messages.
+
+## Summary of New Capabilities
+
+- **`slack.permissionGate.relationshipAnomaly: { enabled, useLlmStyleCheck, stepUpThreshold }`** (opt-in, observe-only) — turns on relationship-aware anomaly scoring + the step-up ladder for the Slack permission gate. Off by default (Null scorer = no anomaly, no step-up).
+- **`GET /permissions/baselines`** — read-only inspection of the per-principal behavioral baselines (SHAPE only; operator/internal).
+
+## Evidence
+
+- 19 unit (store durability/privacy, 5-signal scoring, no-baseline conservatism, confidence scaling, LLM fail-closed/match/mismatch, gate composition incl. spoofed-CEO→step-up + member-floor-stays-refuse + new-owner-no-spurious-step-up, observer dark-default-records-nothing) + 3 integration (baselines route). `tsc --noEmit` clean; lint clean (incl. no-silent-llm-fallback ratchet); build clean.
+- Side-effects review (`upgrades/side-effects/slack-relationship-stepup.md`) + an independent adversarial Phase-5 second-pass (baseline-poisoning / never-lower / no-leak).

package/upgrades/1.3.448.md

@@ -0,0 +1,97 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Makes the SessionWatchdog's stuck-command escalation **fail CLOSED** instead of fail-open when its LLM "stuck vs legitimate" judge can't run. The watchdog flags a shell command as a candidate after 3 minutes, asks an LLM whether it's genuinely stuck or a legitimate long-running task (build/test/install), and only then sends `Ctrl+C`. Previously, when that judge was UNAVAILABLE (no provider) or ERRORED (rate-limited / circuit-open / timeout — common under load), `isCommandStuck` returned `true` (fail-open) → it Ctrl+C'd **every** command past the 3-minute threshold, interrupting legitimate test suites, builds, and `docs-coverage.mjs` runs (the session shows *"Interrupted · What should Claude do instead?"*). Now: when the judge can't run, the watchdog does NOT interrupt below a deterministic hard ceiling (`monitoring.watchdog.hardCeilingSec`, default **1800s / 30 min**); it only escalates once a command has run past that ceiling — so a genuinely hung command (e.g. `crontab -` waiting on stdin forever) is still recovered deterministically without any LLM. A ceiling of `0` disables it (pure fail-closed — never interrupt without a positive LLM "stuck" verdict). The stdin-consumer fail-closed guard and the positive-LLM-verdict path are unchanged. This is the "No Silent Degradation to Brittle Fallback" standard applied to a destructive action.
+
+## What to Tell Your User
+
+If you saw sessions get interrupted "out of nowhere" — a command suddenly stopping with *"Interrupted · What should Claude do instead?"* — that was my stuck-command watchdog misfiring. It Ctrl+C's commands it thinks are hung, using an AI check to spare legitimate long builds/tests; but when that check couldn't run (which happens exactly when the machine is busy), it assumed the worst and interrupted everything over 3 minutes. Now it does the safe thing instead: if it can't confirm a command is actually stuck, it leaves it alone — and only force-stops something that's been frozen for a very long time (30 min by default) with no other way to tell. So your real work stops getting killed, while a truly hung command is still recovered.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Watchdog fails closed when its stuck-judge is unavailable | automatic — no config needed |
+| Tune/disable the deterministic hard ceiling | set `monitoring.watchdog.hardCeilingSec` (default 1800; `0` disables) |
+
+## Evidence
+
+Reproduction (live, from this agent's `logs/server.log`, 2026-06-09): repeated `[Watchdog] "<session>": stuck command (190s) … — sending Ctrl+C` / `(230s)` entries on legitimate autonomous work, plus the user's screenshot of a session interrupted mid-`docs-coverage.mjs --check`. These coincide with the machine under load (LLM circuit open / rate-limited), i.e. the fail-open path: `isCommandStuck` returned `true` because the judge couldn't run.
+
+After the fix: new unit suite `tests/unit/SessionWatchdog-failclosed.test.ts` (8 tests) pins both sides — judge unavailable/erroring below the ceiling → no interrupt; past the ceiling → interrupt; ceiling 0 → never interrupt; LLM "legitimate"/"stuck" verdicts honored unchanged. `tests/unit/SessionWatchdog-pipeline.test.ts` updated (the test that asserted the old fail-open now asserts fail-closed, plus past-ceiling and LLM-confirmed-stuck cases). All 175 watchdog/triage unit tests green; `tsc` + repo lint clean.
+
+## The problem
+
+You saw sessions suddenly stop mid-command — a build or test or script just
+halting with *"Interrupted · What should Claude do instead?"* — for no obvious
+reason. It wasn't random. Here's what was actually happening.
+
+I run a safety watchdog that watches the shell commands running inside each
+session. Its job is to rescue a session if a command gets truly stuck (hangs
+forever). The way it works:
+
+1. If a command has been running more than **3 minutes**, the watchdog gets
+   suspicious.
+2. Lots of legitimate commands take longer than 3 minutes — installs, builds,
+   big test suites. So before doing anything, the watchdog asks an AI helper:
+   *"Is this command actually stuck, or is it just a normal long-running job?"*
+3. If the AI says "stuck," the watchdog presses **Ctrl+C** to kill the command.
+   That Ctrl+C is exactly the "Interrupted" you saw.
+
+The bug was in step 2. When that AI helper **couldn't run** — because the
+machine was busy, rate-limited, or its circuit breaker was tripped (which
+happens *precisely* when lots of commands are slow) — the old code **assumed
+the command was stuck and killed it anyway.** That's called "failing open." So
+under load, the watchdog Ctrl+C'd basically every command that ran longer than
+3 minutes — including perfectly healthy builds and test suites and the
+docs-coverage check in your screenshot.
+
+In other words: the safety net meant to rescue stuck sessions was itself
+interrupting healthy ones, and worst exactly when the system was busiest.
+
+## What already exists
+
+- The watchdog, its 3-minute threshold, and the AI "stuck or legitimate?" check.
+- A separate, already-correct rule for pipeline commands (`tail`, `grep`): those
+  already refused to be killed without a positive AI confirmation. This fix
+  brings the *normal* command path in line with that safer behavior.
+
+## What's new
+
+One change in judgment: when the AI helper can't run, the watchdog now does the
+**safe** thing instead of the destructive thing. It **does not interrupt** a
+command just because it can't confirm it's stuck. It only force-stops a command
+once it has been running past a deterministic **hard ceiling** — 30 minutes by
+default — which is long enough that a genuinely frozen command (like one waiting
+forever for keyboard input that will never come) still gets cleaned up, without
+needing the AI at all.
+
+There's a new dial, `monitoring.watchdog.hardCeilingSec`, default 1800 (30 min).
+Set it to `0` to turn the ceiling off entirely — then the watchdog will *never*
+interrupt a command unless the AI helper positively says "stuck."
+
+## The safeguards in plain terms
+
+- **Safe direction by default.** Killing a real build/test is frequent and
+  costly; letting a maybe-stuck command keep running for a while is rare and
+  cheap. When unsure, the watchdog now leaves the command alone.
+- **Genuinely stuck commands are still rescued.** The 30-minute hard ceiling is
+  a deterministic backstop that needs no AI — so a command frozen on input
+  (e.g. `crontab -` waiting on stdin) is still caught.
+- **Nothing else changes.** When the AI helper *can* run, its "legitimate" or
+  "stuck" verdict is honored exactly as before. The change only affects the case
+  where it can't run.
+- **This change can only kill LESS, never more** — so it can't introduce a new
+  way to interrupt healthy work.
+
+## What you need to decide
+
+Nothing required — it ships as a normal patch with a safe default. The only
+optional choice is whether to tune `hardCeilingSec` (lower it if you want hung
+commands recovered faster, or set `0` to never interrupt without a positive AI
+"stuck" verdict). After it deploys, your sessions stop getting Ctrl+C'd out of
+nowhere when the machine is under load.