instar 1.3.456 → 1.3.457

package/dist/core/devGatedFeatures.d.ts

@@ -0,0 +1,41 @@
+/**
+ * devGatedFeatures.ts — the registry of features that follow the
+ * standard_development_agent_dark_feature_gate convention: config OMITS
+ * `enabled`, the runtime resolves it via `resolveDevAgentGate` (live on a
+ * development agent, dark on the fleet).
+ *
+ * WHY (DEV-AGENT-DARK-GATE-CONFORMANCE-SPEC, Slice 2): Slice 1's lint catches a
+ * hand-rolled gate and a hardcoded `enabled: false` under a marker comment, but
+ * it cannot prove that a feature's *actual config + construction* resolves live
+ * on a dev agent. This registry drives the both-sides wiring test
+ * (`tests/unit/devGatedFeatures-wiring.test.ts`): for each entry, the REAL
+ * ConfigDefaults are applied and `resolveDevAgentGate(<configPath>)` must be
+ * true under a dev-agent config and false under a fleet config. A feature whose
+ * default hardcodes `enabled: false` (the literal #1001 mechanism — `applyDefaults`
+ * would inject the `false`) fails the test. Adding a dev-gated feature here is
+ * the natural checklist step; the test then guards it permanently.
+ *
+ * NOT every site that calls `resolveDevAgentGate` belongs here — only features
+ * whose intent is "dark fleet / LIVE on dev". Deliberately EXCLUDED:
+ *   - `monitoring.mcpProcessReaper` — destructive (kills processes); ships OFF +
+ *     dry-run for EVERYONE incl. dev agents by design (`enabled: false` default).
+ *   - `monitoring.resourceLedger` — the ledger itself defaults `enabled: true`
+ *     (on for everyone); only its sampling rides the gate off the same key, so
+ *     it is not cleanly a dark-on-fleet feature.
+ */
+/** A feature governed by the developmentAgent dark-feature gate. */
+export interface DevGatedFeature {
+    /** Stable identifier (matches the feature's name in code/docs). */
+    name: string;
+    /** Dotted path to the feature's `enabled` flag in the agent config. */
+    configPath: string;
+    /** One-line description of what runs live on a dev agent. */
+    description: string;
+}
+export declare const DEV_GATED_FEATURES: DevGatedFeature[];
+/**
+ * Read a dotted path off a config object, returning the value or undefined.
+ * Used by the wiring test and the spec-intent cross-check (Slice 3).
+ */
+export declare function getConfigByPath(config: unknown, dottedPath: string): unknown;
+//# sourceMappingURL=devGatedFeatures.d.ts.map

package/dist/core/devGatedFeatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAoC/C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}

package/dist/core/devGatedFeatures.js

@@ -0,0 +1,76 @@
+/**
+ * devGatedFeatures.ts — the registry of features that follow the
+ * standard_development_agent_dark_feature_gate convention: config OMITS
+ * `enabled`, the runtime resolves it via `resolveDevAgentGate` (live on a
+ * development agent, dark on the fleet).
+ *
+ * WHY (DEV-AGENT-DARK-GATE-CONFORMANCE-SPEC, Slice 2): Slice 1's lint catches a
+ * hand-rolled gate and a hardcoded `enabled: false` under a marker comment, but
+ * it cannot prove that a feature's *actual config + construction* resolves live
+ * on a dev agent. This registry drives the both-sides wiring test
+ * (`tests/unit/devGatedFeatures-wiring.test.ts`): for each entry, the REAL
+ * ConfigDefaults are applied and `resolveDevAgentGate(<configPath>)` must be
+ * true under a dev-agent config and false under a fleet config. A feature whose
+ * default hardcodes `enabled: false` (the literal #1001 mechanism — `applyDefaults`
+ * would inject the `false`) fails the test. Adding a dev-gated feature here is
+ * the natural checklist step; the test then guards it permanently.
+ *
+ * NOT every site that calls `resolveDevAgentGate` belongs here — only features
+ * whose intent is "dark fleet / LIVE on dev". Deliberately EXCLUDED:
+ *   - `monitoring.mcpProcessReaper` — destructive (kills processes); ships OFF +
+ *     dry-run for EVERYONE incl. dev agents by design (`enabled: false` default).
+ *   - `monitoring.resourceLedger` — the ledger itself defaults `enabled: true`
+ *     (on for everyone); only its sampling rides the gate off the same key, so
+ *     it is not cleanly a dark-on-fleet feature.
+ */
+export const DEV_GATED_FEATURES = [
+    {
+        name: 'growthAnalyst',
+        configPath: 'monitoring.growthAnalyst.enabled',
+        description: 'Proactive growth & milestone analyst (/growth/*).',
+    },
+    {
+        name: 'coherenceJournal',
+        configPath: 'multiMachine.coherenceJournal.enabled',
+        description: 'Cross-machine coherence journal.',
+    },
+    {
+        name: 'warmSessionA2A',
+        configPath: 'threadline.warmSessionA2A.enabled',
+        description: 'Warm-session pool for agent-to-agent delivery.',
+    },
+    {
+        name: 'secretSync',
+        configPath: 'multiMachine.secretSync.enabled',
+        description: 'Cross-machine secret sync (receive side).',
+    },
+    {
+        name: 'geminiLoopDriver',
+        configPath: 'autonomousSessions.geminiLoopDriver.enabled',
+        description: 'Gemini autonomous-loop driver.',
+    },
+    {
+        name: 'respawnBuildContext',
+        configPath: 'sessions.respawnBuildContext.enabled',
+        description: 'Respawn build-context capture on session restart.',
+    },
+    {
+        name: 'selfKnowledgeSessionContext',
+        configPath: 'selfKnowledge.sessionContext.enabled',
+        description: 'Session-boot self-knowledge context injection.',
+    },
+];
+/**
+ * Read a dotted path off a config object, returning the value or undefined.
+ * Used by the wiring test and the spec-intent cross-check (Slice 3).
+ */
+export function getConfigByPath(config, dottedPath) {
+    let cur = config;
+    for (const key of dottedPath.split('.')) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[key];
+    }
+    return cur;
+}
+//# sourceMappingURL=devGatedFeatures.js.map

package/dist/core/devGatedFeatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devGatedFeatures.js","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAYH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,mDAAmD;KACjE;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,mDAAmD;KACjE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,gDAAgD;KAC9D;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,UAAkB;IACjE,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.456",
+  "version": "1.3.457",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-10T01:10:23.066Z",
-  "instarVersion": "1.3.456",
+  "generatedAt": "2026-06-10T01:54:06.043Z",
+  "instarVersion": "1.3.457",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.457.md

@@ -0,0 +1,45 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added Slice 2 of the dev-agent dark-gate conformance guard: a
+`DEV_GATED_FEATURES` registry (`src/core/devGatedFeatures.ts`) and a both-sides
+wiring test that applies the REAL config defaults and asserts each registered
+dev-gated feature resolves LIVE under a `developmentAgent: true` config and DARK
+under a fleet config. This catches the half of the #1001 bug that Slice 1's lint
+can't see — a feature whose shipped default hardcodes `enabled: false` (so
+`applyDefaults` injects it) now fails the build, because the feature would be dark
+on dev agents. Seven features are registered; two (`mcpProcessReaper`,
+`resourceLedger`) are deliberately excluded with documented reasons (intentionally
+not dark-on-fleet).
+
+## What to Tell Your User
+
+Nothing user-facing — internal developer/CI tooling (audience: agent-only). No
+runtime behavior changes; it only adds a test that guards the dev-gate convention.
+
+## Summary of New Capabilities
+
+- `DEV_GATED_FEATURES` registry + `getConfigByPath` (`src/core/devGatedFeatures.ts`).
+- `tests/unit/devGatedFeatures-wiring.test.ts` — both-sides wiring test (+ a teeth
+  test proving it catches a planted `enabled: false` regression).
+- Honest limit: Slice 3 (spec-intent cross-check) still catches the
+  forgot-the-gate-entirely case; tracked as CMT-1253. <!-- tracked: CMT-1253 -->
+
+## Evidence
+
+This is a preventive CI guard, not a runtime bug fix — so "evidence" is a
+demonstration that the guard has teeth on the #1001 mechanism:
+- **Before (no guard):** a dev-gated feature whose shipped default hardcodes
+  `enabled: false` ships dark on dev agents undetected — exactly #1001, which was
+  caught only by operator review.
+- **Reproduction (guard fires):** copied `src/config/ConfigDefaults.ts`, injected
+  `enabled: false` as the first field of the real `growthAnalyst` block, and ran
+  the both-sides test → the live-on-dev assertion **FAILS** (red). A baked-in
+  `enabled: true` would fail the dark-on-fleet assertion instead.
+- **After (clean tree):** the unmodified tree → **16/16 green** (no registered
+  feature currently hardcodes a default). So the guard fires on the regression and
+  stays quiet otherwise.

package/upgrades/side-effects/dev-gated-features-registry.md

@@ -0,0 +1,70 @@
+# Side-Effects Review — Dev-Gated-Feature Registry + Both-Sides Wiring Test (Slice 2)
+
+**Change:** Slice 2 of DEV-AGENT-DARK-GATE-CONFORMANCE-SPEC (the converged +
+operator-approved spec). Adds the layer that catches a dev-gated feature wired to
+resolve **dark on a dev agent** — the gap Slice 1's lint cannot see.
+
+- `src/core/devGatedFeatures.ts` (new) — `DEV_GATED_FEATURES` registry (name +
+  config path + description) and a `getConfigByPath` reader.
+- `tests/unit/devGatedFeatures-wiring.test.ts` (new) — for each registered
+  feature, applies the REAL `getMigrationDefaults` and asserts
+  `resolveDevAgentGate(<configPath>)` is **true** under a `developmentAgent: true`
+  config and **false** under a fleet config, plus a "teeth" test confirming an
+  injected `enabled: false` default fails the live-on-dev assertion (the literal
+  #1001 mechanism).
+
+**Registry membership (the design decision in this slice):** only features whose
+intent is "dark fleet / LIVE on dev" are included (growthAnalyst, coherenceJournal,
+warmSessionA2A, secretSync, geminiLoopDriver, respawnBuildContext,
+selfKnowledgeSessionContext — verified to omit `enabled` in defaults). Deliberately
+EXCLUDED, with reasons in code: `monitoring.mcpProcessReaper` (destructive — ships
+OFF + dry-run for everyone incl. dev by design) and `monitoring.resourceLedger`
+(ledger defaults `enabled: true`; only sampling rides the gate off the same key).
+
+## 1. Over-block — what legitimate inputs does this reject that it shouldn't?
+The test asserts every registered feature is live-on-dev / dark-on-fleet. A
+feature that legitimately ships dark-everywhere or live-everywhere would fail if
+wrongly added to the registry — but membership is a deliberate, reviewed choice
+(the two non-conforming features are explicitly excluded with documented reasons),
+so the test only constrains features that genuinely follow the convention.
+
+## 2. Under-block — what failure modes does this still miss?
+Catches the hardcoded-default half of the #1001 shape (a `false` baked into the
+feature's default → `applyDefaults` injects it → live-on-dev assertion fails) for
+**registered** features. Still misses: (a) a dev-gated feature never added to the
+registry; (b) the construction-side half where a site reads `enabled === true`
+without any gate (no default to catch) — that is Slice 3's spec-intent cross-check.
+Both limits are named in the spec's layer table.
+
+## 3. Level-of-abstraction fit — right layer?
+Yes — a unit test over the real config-default assembly (`applyDefaults` +
+`getMigrationDefaults`), the same path PostUpdateMigrator uses. It exercises the
+actual default→gate resolution, not a source regex, so it catches the mechanism
+rather than a spelling.
+
+## 4. Signal vs authority compliance
+The test is CI authority (fails the build) over a deterministic, mechanical
+property — same posture as the rest of the suite. The registry is inert data; it
+holds no runtime authority (Slice 3 consumes it read-only).
+
+## 5. Interactions — shadowing, double-fire, races?
+None. `devGatedFeatures.ts` is pure data + a pure path reader; the test builds
+throwaway config objects. No shared state, no runtime wiring in this slice.
+
+## 6. External surfaces — visible to other agents/users/systems?
+None. No routes, no config, no agent-installed files. Repo-internal source + test.
+No Migration Parity entry needed.
+
+## 7. Rollback cost — back-out if wrong?
+Trivial — delete the two files. No runtime behavior, no state, no deployed artifact.
+
+## No deferrals
+Slice 3 (spec-intent cross-check) is the next slice of the same approved spec,
+tracked under CMT-1253 — not a deferral of this slice's scope. <!-- tracked: CMT-1253 -->
+
+## Second-pass review (independent)
+The registry membership was derived by auditing each `resolveDevAgentGate` site's
+default against the convention: the 7 included features verified to omit `enabled`
+(test green on all = no hidden hardcoded default); the 2 excluded features
+(mcpProcessReaper, resourceLedger) inspected and confirmed intentionally NOT
+dark-on-fleet. The teeth test confirms the guard fires on a planted regression.