instar 1.3.470 → 1.3.472

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-10T16:53:50.243Z",
-  "instarVersion": "1.3.470",
+  "generatedAt": "2026-06-10T18:08:30.928Z",
+  "instarVersion": "1.3.472",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "f1ade5cb42806c31d0ebe24e86e66f3fa331f288ec99bae5d8df0a08622b6eb9",
+      "contentHash": "7c1e84f9d52be2ebff9c3701138f9b65d488ae7ff51ee1e8681d8476c66907fd",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {
@@ -1554,7 +1554,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "c4b6d22bcb02a0ce956d38326c9d764b47bac8c37545ccf287bef29f9912f908",
+      "contentHash": "91a08551e1f1c321ae5b923cc68577dd8bda1381bc810d8e3444295947b00ab4",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.471.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The `/spec-converge` review's Lessons-aware reviewer gained a new mandate — clause
+**(d) FOUNDATION/SUBSYSTEM AUDIT**: the review must now reach one layer below the spec
+boundary and weigh the subsystem the spec *tests, extends, or builds on* against known
+standards and lessons, not just the spec's own surface. When that foundation is flawed,
+the finding is "this spec is sound but the subsystem it depends on violates standard X /
+repeats mistake Y — surface it before building on/around it."
+
+This closes a real review gap (2026-06-09): a test-harness spec converged cleanly while
+the permission gate it proved still held brittle blocking authority in violation of
+Signal-vs-Authority. The convergence audited only the harness and took the flawed
+foundation as given. A new idempotent `PostUpdateMigrator` step
+(`migrateSpecConvergeFoundationAudit`) backfills the clause into existing agents'
+installed spec-converge skill on update (fingerprint-guarded; customized skills are left
+untouched).
+
+## What to Tell Your User
+
+Nothing changes for end users — this is an internal hardening of the instar
+spec-review process used by instar-developing agents. No runtime behavior, gate, or
+message path changes. The practical effect is that future instar specs are reviewed one
+layer deeper, so a spec can no longer pass review while quietly testing or extending a
+component that itself violates a standard.
+
+## Summary of New Capabilities
+
+- `/spec-converge` Lessons-aware reviewer clause (d): foundation/subsystem audit one
+  layer below the spec boundary.
+- `PostUpdateMigrator.migrateSpecConvergeFoundationAudit`: idempotent, fingerprint-guarded
+  backfill of the clause for existing agents (customized skills untouched).
+
+## Evidence
+
+- `skills/spec-converge/SKILL.md` — clause (d) added to the Lessons-aware bullet.
+- `src/core/PostUpdateMigrator.ts` — `migrateSpecConvergeFoundationAudit` registered in
+  the migrate runner; mirrors the established fingerprint-guarded skill-content migration
+  idiom (`migrateInstarDevInternalOnlyReleaseNoteLane`, `migrateTestAsSelfSkill`).
+- `tests/unit/migrate-spec-converge-foundation-audit.test.ts` — 5 tests: updates a stock
+  skill, idempotent when the marker is present, leaves a customized skill untouched,
+  no-ops when not installed, and a wiring-integrity test asserting the bundled source
+  actually carries the marker (so the migration cannot silently no-op for every agent).
+- `tsc --noEmit` clean; sibling skill-migration + builtin-dev-skills suites green (19
+  tests across the touched area).
+- Side-effects review: `upgrades/side-effects/spec-converge-foundation-audit.md`.

package/upgrades/1.3.472.md

@@ -0,0 +1,40 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The interactive (user-facing) session lane now pins to a subscription-pool account,
+mirroring the headless lane. When `subscriptionPool.pinSessionsToPool` is enabled,
+`SessionManager.spawnInteractiveSession` consults the same spawn-account resolver
+that `spawnSession` uses (unless the caller passed an explicit `configHome`, e.g. the
+account-swap path, which still wins). The session launches under the scheduler-picked
+pool account's config home and is tagged with `subscriptionAccountId` — making the
+user's own conversation directly eligible for proactive and reactive auto-swap,
+instead of riding the default login untagged (rescuable only by the
+ProactiveSwapMonitor's default-login fallback). The resolver-pinned home is seeded
+onboarding-ready first, so a headless-enrolled home can't wedge the launch on the
+first-launch wizard. Claude-code only; complete no-op when pinning is off.
+
+## What to Tell Your User
+
+The conversation you actually chat with is now protected the same first-class way
+your background sessions are. When you pool several logins, your own chat session is
+tagged to whichever login it is running on, so the moment that login gets close to
+full I can move your conversation to a fresh login before it ever stalls — not just
+rescue it after the fact. Nothing changes unless you have pooling turned on.
+
+## Summary of New Capabilities
+
+- The interactive session lane pins to a pool account and carries its account tag,
+  so the user's conversation is first-class for both proactive and reactive swap.
+
+## Evidence
+
+- `tests/unit/interactive-session-pin.test.ts` — 6 cases: resolver-pin, explicit
+  home wins, unwired no-op, empty-pool no-op, codex-not-pinned, onboarding-safe seeding.
+- `tests/integration/subscription-pin-sessions.test.ts` — interactive lane pins via
+  the real `selectAccount`-wired resolver; empty-pool no-op.
+- `tests/e2e/session-management-e2e.test.ts` — real tmux: an interactive session is
+  tagged with the resolver-picked account and its home is seeded onboarding-ready.

package/upgrades/side-effects/pin-interactive-session-lane.md

@@ -0,0 +1,47 @@
+# Side-effects review — Pin the interactive session lane (B1)
+
+**Change:** `SessionManager.spawnInteractiveSession` now consults the wired
+spawn-account resolver (set under `subscriptionPool.pinSessionsToPool`) when the
+caller did not pass an explicit `configHome`. The interactive (user-facing) lane
+launches under, and is tagged with, the scheduler-picked pool account — mirroring
+the headless lane (`spawnSession`). One file: `src/core/SessionManager.ts`.
+
+## Blast radius
+
+- **Scope is gated three ways.** No-op unless (a) `pinSessionsToPool` wired the
+  resolver, (b) the framework is `claude-code`, and (c) the caller passed no
+  explicit `configHome`. With pooling off the resolver is never set → `pinnedAccount`
+  is null → `effectiveConfigHome`/`effectiveAccountId` are undefined → byte-for-byte
+  the prior default-login behavior.
+- **Explicit configHome still wins.** The account-swap path (SessionRefresh) passes
+  a `configHome`; that suppresses the resolver, so a swap target is never overridden.
+- **Non-claude lanes untouched.** Codex/Pi interactive sessions are never put on a
+  Claude pool home (the `framework === 'claude-code'` guard).
+
+## Interactions considered
+
+- **Onboarding-safe seeding (#1043):** `ensurePinnedHomeInteractiveReady` is now
+  invoked for the resolver-pinned home too (not only explicit-configHome), so a
+  headless-enrolled pool home is seeded interactive-ready before the launch — the
+  2026-06-09 wizard-wedge cannot recur via this new path. Tokens/oauthAccount are
+  never read or written by that helper.
+- **ProactiveSwapMonitor / autoSwapOnRateLimit:** these key on
+  `session.subscriptionAccountId`. B1 makes the interactive session carry that tag,
+  so it becomes directly swap-eligible. The monitor's default-login resolution
+  remains the safety net for the still-untagged case (pooling off / empty pool).
+- **`tmuxSessionExists` early-return:** an already-running session is reused and not
+  re-pinned — correct; live sessions are moved by the swap engine, not re-tagged here.
+- **Fail-safe:** `ensureInteractiveReady` logs and continues on a missing/unwritable
+  home; a launch never crashes on it (verified by the unit case using a fake path).
+
+## Migration / awareness
+
+- No config default, hook, skill, or CLAUDE.md template change → no `PostUpdateMigrator`
+  entry required. B1 rides the existing `pinSessionsToPool` flag; the user-facing
+  continuity capability is already documented (template "Pre-limit (proactive) swap"
+  bullet). Existing agents pick up the behavior on the normal code update.
+
+## Tests
+
+Unit (6), integration (+2 interactive cases in the existing pin suite), e2e (+1 real
+tmux case). Full sibling spawn/session/wiring suites green (96 tests). tsc clean.

package/upgrades/side-effects/spec-converge-foundation-audit.md

@@ -0,0 +1,92 @@
+# Side-Effects Review — spec-converge clause (d) foundation/subsystem audit
+
+**Version / slug:** `spec-converge-foundation-audit`
+**Date:** `2026-06-10`
+**Author:** `echo`
+**Tier:** `1` (skill-prompt clause + idempotent content migration + tests; no new runtime subsystem, route, or config)
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+Extend the `/spec-converge` Lessons-aware reviewer's mandate with clause **(d)
+FOUNDATION/SUBSYSTEM AUDIT**: the review must reach one layer below the spec boundary
+and weigh the subsystem the spec *tests / extends / builds on* against known standards
+and lessons — not just the spec's own surface. When that foundation is flawed, the
+finding is "this spec is sound but the subsystem it depends on violates standard X /
+repeats mistake Y — surface it before building on/around it."
+
+Two edits + tests:
+1. `skills/spec-converge/SKILL.md` — the bundled source skill gains clause (d) on the
+   Lessons-aware bullet (the `## Internal reviewers` section).
+2. `src/core/PostUpdateMigrator.ts` — a new `migrateSpecConvergeFoundationAudit`
+   (registered in the migrate runner) so existing agents' installed
+   `.claude/skills/spec-converge/SKILL.md` receives clause (d) on update. Idempotent +
+   conservative: re-copies the bundled skill only when the installed copy (a) lacks the
+   `FOUNDATION/SUBSYSTEM AUDIT` marker AND (b) still matches the stock spec-converge
+   fingerprint (`# /spec-converge` + `**Internal reviewers (Claude subagents):**`). A
+   customized skill is skipped untouched.
+3. `tests/unit/migrate-spec-converge-foundation-audit.test.ts` — 5 tests (update,
+   idempotent, customized-untouched, not-installed no-op, bundled-source wiring
+   integrity).
+
+Motivation: the 2026-06-09 gap where a test-harness spec converged cleanly while the
+permission gate it proved still held brittle blocking authority in violation of
+Signal-vs-Authority. The convergence audited only the harness and took the flawed
+foundation as given. This closes that gap structurally (Structure > Willpower): the
+reviewer is *instructed* to look below the spec, rather than the author having to
+remember to.
+
+## Decision-point inventory
+
+- **Migration content-sniff guard** — re-copy vs. skip. Inputs: installed skill text.
+  Branch 1: marker already present → return (idempotent no-op). Branch 2: stock
+  fingerprint missing → skip + record `customized`. Branch 3: stock fingerprint present
+  AND marker absent → re-copy the bundled skill. No LLM, no runtime authority — pure
+  string-presence checks at update time.
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject?** Nothing is rejected at runtime — no
+gate, no message path, no API. The migration's only "rejection" is *declining to update*
+a skill it can't confidently recognize as stock (fingerprint missing → skipped). That is
+the safe direction: a customized spec-converge skill keeps the operator's edits rather
+than being clobbered. The reviewer clause makes the review *stricter* (one more thing to
+check), but the Lessons-aware reviewer is signal-only — it surfaces findings, it does not
+block; blocking authority remains the separate Standards-Conformance Gate path.
+
+## 2. Under-block
+
+**What does this still miss?** (a) The clause is a *prompt* instruction, so its
+effectiveness depends on the reviewing model actually reaching one layer down — it is a
+stronger signal, not a code-enforced guarantee (a future code-backed "foundation
+referenced by the spec was audited" check could harden it, but that is out of scope for a
+Tier-1 prompt change). (b) The migration re-copies the *whole* bundled skill (matching the
+established skill-migration idiom); an agent on a much older stock version receives all
+accumulated bundled changes, not just clause (d) — acceptable because the fingerprint
+guard only fires on stock copies. (c) Agents who customized the skill are intentionally
+not upgraded; they must adopt clause (d) by hand.
+
+## 3. Level-of-abstraction fit
+
+**Right layer?** Yes. The clause lives in the one reviewer whose job is standards/lessons
+conformance (Lessons-aware), beside its existing (a)/(b)/(c) checks — not bolted onto an
+unrelated reviewer. The migration lives beside the sibling skill-content migrations
+(`migrateInstarDevInternalOnlyReleaseNoteLane`, `migrateTestAsSelfSkill`) and reuses their
+exact fingerprint-guarded re-copy pattern, so it inherits the proven Migration-Parity
+idiom rather than inventing a new one.
+
+## Migration / rollback
+
+- **Migration:** `migrateSpecConvergeFoundationAudit` runs on the normal post-update path.
+  Idempotent (marker check) and conservative (fingerprint guard). No state, no config.
+- **Rollback:** pure revert — drop the clause from the bundled skill, remove the migration
+  method + its registration line, delete the test. No data migration to undo; the migration
+  only ever copied a newer skill prompt over a stock older one.
+
+## Testing-integrity note
+
+Unit tests cover both sides of the migration's decision boundary (updates stock /
+skips customized / idempotent / not-installed) plus a wiring-integrity test asserting the
+bundled source actually carries the marker (so the migration cannot silently no-op for
+every agent). `tsc --noEmit` clean; sibling skill-migration + builtin-dev-skills suites
+stay green (19 tests total across the touched area).