instar 1.3.485 → 1.3.487

package/dist/core/PostUpdateMigrator.js

@@ -3017,6 +3017,15 @@ setTimeout(() => process.exit(0), 2000);
             patched = true;
             result.upgraded.push('CLAUDE.md: added Real-Check Verification section');
         }
+        // Outbound advisory (outbound-jargon-filepath-gap §5) — the inform-only
+        // preflight for automated job sends. An agent that never learns what a
+        // "NOT SENT — advisory" transcript line means will treat it as an error
+        // and improvise; this section is the awareness (Agent Awareness Standard).
+        if (!content.includes('Outbound advisory for automated messages')) {
+            content += `\n**Outbound advisory for automated messages (inform-only)** — When a background job of mine sends a Telegram message, the relay script first runs deterministic checks over the text (raw file paths, dev jargon, machine-local links). If something is flagged, the message is NOT sent yet: an advisory lands in the job session's transcript whose FIRST line is the literal \`NOT SENT — advisory (fix and re-run, or re-run with --ack-advisory to send unchanged)\`. The sender keeps final authority — the advisory layer never blocks, never escalates against the sender, and every error path delivers.\n- **If I see a NOT SENT advisory in my transcript** (PROACTIVE — this is the trigger): FIX the message and re-run the script — restate jargon in plain English; replace a raw file path by publishing a private view and sending the link; replace a localhost link with the public tunnel URL (a localhost link is the one finding \`--ack-advisory\` can NOT deliver — a pre-existing server guard refuses it regardless). Only \`--ack-advisory\` when the flagged content is genuinely right for the user (the override is audited).\n- Audit trail: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/messaging/advisory-log?limit=50"\`. A job that repeatedly drops its own advised messages raises ONE deduped Attention item to the operator.\n- Conversational replies are completely unaffected — the preflight only runs for scheduler-stamped automated job sends.\n- Off-switch: \`messaging.outboundAdvisory.enabled: false\` in \`.instar/config.json\` (read live — no restart).\n`;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Outbound advisory for automated messages section');
+        }
         // Cartographer doc-tree (cartographer-doc-tree-schema spec #1) — a hierarchical
         // semantic map with git-hash staleness. Ships dark; documented so agents that
         // enable it know the routes exist (Agent Awareness Standard).
@@ -3528,6 +3537,31 @@ Audit what each LLM-driven gate/sentinel actually does: WHICH provider + model r
             patched = true;
             result.upgraded.push('CLAUDE.md: added Per-Feature LLM Metrics (/metrics/features) awareness (llm-feature-metrics + observable-intelligence)');
         }
+        // token-audit-completeness (Agent Awareness + Migration Parity): existing
+        // agents must learn the per-model token breakdown, usageCoverage, and the
+        // unlabeled-spend shares. Append-only addendum (house policy — the base
+        // Per-Feature section above is never edited in place). Content-sniff on
+        // the literal `unlabeledCallShare` — a REAL field name the addendum text
+        // emits AND the updated templates.ts base section emits, so a freshly-
+        // initialized agent self-matches and is never double-patched (an earlier
+        // candidate, `unlabeledShare`, is a substring of NEITHER actual field —
+        // an addendum written with the real names would never self-match and the
+        // migration would re-append on every update run, violating idempotency).
+        if (!content.includes('unlabeledCallShare')) {
+            const tokenAuditSection = `
+### Token-Audit Completeness — per-model token breakdown & usage coverage
+
+\`/metrics/features\` answers cost questions per feature AND per model (operator directive: an unmetered LLM call is an unaccountable one — see the Token-Audit Completeness standard in the constitution):
+- Each feature row carries \`byModel\` (feature×model×framework: calls, tokensIn/tokensOut/tokensCached); \`totals.byModel\` is the cross-feature aggregate. \`tokensCached\` is the cache-read SUBSET of \`tokensIn\` (fresh cost = tokensIn − tokensCached).
+- \`totals.usageCoverage\` reports, per framework, the share of successful calls that recorded REAL token usage. Codex-routed calls report per-call tokens (exec --json); 0 coverage on a non-exempt framework is the drift alarm, not noise. gemini-cli is the documented cannot-surface exemption. Failed calls still carry their already-burned tokens (error rows record cost).
+- \`totals.unlabeledTokenShare\` + \`totals.unlabeledCallShare\` track unattributed spend — the baseline is ZERO and a lint ratchet keeps every new LLM callsite tagged with \`attribution.component\`.
+- Rollback lever for codex exec-json mode: \`intelligence.codexExecJson: false\` in \`.instar/config.json\` (or env \`INSTAR_CODEX_EXEC_JSON=0\`) restores the plain invocation — codex calls then go token-blind and \`usageCoverage\` shows it honestly.
+- **When to use** (PROACTIVE): "how many tokens did feature X spend, on which model?" / "are we audit-blind anywhere?" / before enabling any cost-bearing background feature (e.g. the cartographer freshness sweep) → read \`byModel\` + \`usageCoverage\` instead of guessing. Spec: \`docs/specs/token-audit-completeness.md\`.
+`;
+            content += '\n' + tokenAuditSection;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Token-Audit Completeness (per-model breakdown + usageCoverage) awareness (token-audit-completeness)');
+        }
         // correction-capture-backlog (Agent Awareness + Migration Parity): existing
         // agents with the Correction & Preference Learning block need to learn that a
         // rate-limited capture is now backlogged + distilled later (not dropped), so
@@ -5065,6 +5099,12 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             // the enrollment wizard (never ask the user to paste a token). Mirrored to
             // the shadows like every agent-facing capability.
             '**Subscription Pool (multi-account quota + auto-swap + enrollment)**',
+            // Outbound advisory (outbound-jargon-filepath-gap §5): the inform-only
+            // preflight is framework-agnostic (the env + relay script do the work),
+            // so a Codex/Gemini job session also needs to know what a "NOT SENT —
+            // advisory" line means and that fix-then-re-run / --ack-advisory are
+            // the two moves. Mirrored like every agent-facing capability.
+            '**Outbound advisory for automated messages (inform-only)**',
             // Working-Set Handoff (WORKING-SET-HANDOFF-SPEC §3.7): the fetch reflex
             // (POST /coherence/fetch-working-set). A Codex/Gemini agent that never
             // learns it will tell the user the files "aren't on this machine"
@@ -5111,6 +5151,21 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             // KPI. A Codex/Gemini agent that never learns /metrics/learning-velocity
             // can't answer "are we actually learning?" with real numbers.
             '**Learning-Velocity Metric (EXO 3.0',
+            // Per-Feature LLM Metrics base section (token-audit-completeness): the
+            // shadow mirror never carried it. TWO tail-truncated, line-leading
+            // literals cover both deployed variants — templates' bold-block form and
+            // migrateClaudeMd's H3 form (each CLAUDE.md contains exactly one, so
+            // exactly one literal fires; the other no-ops). Tail-truncation is the
+            // list's sanctioned multi-variant trick (cf. the MTP marker); a
+            // HEAD-truncated bare phrase would anchor mid-heading and match the
+            // phrase inside OTHER sections' body prose, truncating their slices.
+            '**Per-Feature LLM Metrics',
+            '### Per-Feature LLM Metrics',
+            // Token-audit addendum (per-model breakdown + usageCoverage): a Codex/
+            // Gemini agent that never learns byModel/usageCoverage can't answer
+            // "how much did feature X spend on which model?" or spot audit-blind
+            // frameworks.
+            '### Token-Audit Completeness — per-model token breakdown & usage coverage',
         ];
         for (const shadowName of ['AGENTS.md', 'GEMINI.md']) {
             const shadowPath = path.join(this.config.projectDir, shadowName);
@@ -8935,6 +8990,12 @@ process.stdin.on('end', async () => {
         // recoverable queue, neutral relay mirror; no --stdin-base64 mode).
         // Shipped through v1.3.266.
         '0f6d27a522b123551871e6081774f8c89d1ad0ce248597af7dd60d8522871069',
+        // --stdin-base64 version (pre-outbound-advisory). Shipped through
+        // v1.3.484. Required so the outbound-advisory preflight template
+        // (outbound-jargon-filepath-gap §5) reaches existing agents — without
+        // this entry a stock deployed script reads as "unknown" and only gets a
+        // `.new` candidate, and the preflight never activates in the field.
+        '3e30b2cd29e1745a3799eae98e4e10ded2ab713cbcd55ac17d21c5aab8ca0526',
     ]);
     /**
      * SHA-based migrator for telegram-reply.sh — replaces marker-string