instar 1.3.489 → 1.3.491

package/dist/core/PostUpdateMigrator.js

@@ -3846,8 +3846,11 @@ Beyond the one-awake-machine model: with the pool enabled I run conversations ac
         // section predate GET /sessions?scope=pool (every session, every machine, each
         // tagged with its machine — the dashboard cross-machine sessions list). Append
         // the line so deployed agents can answer "what's running across my machines?"
-        // from the API. Idempotent via the unique `scope=pool` marker.
-        if (content.includes('Multi-Machine Session Pool (active-active') && !content.includes('scope=pool')) {
+        // from the API. Idempotent via the unique `sessions?scope=pool` marker
+        // (route-qualified: other sections legitimately mention `?scope=pool` for
+        // their own routes — e.g. the Guard Posture section's /guards?scope=pool —
+        // so a bare `scope=pool` sniff would falsely block this append).
+        if (content.includes('Multi-Machine Session Pool (active-active') && !content.includes('sessions?scope=pool')) {
             const poolSessions = `
 - **Every session, every machine:** the dashboard sessions list shows ALL sessions across the pool, each tagged with the machine it runs on. API: \`GET /sessions?scope=pool\` → \`{ sessions: [...each with machineId/machineNickname...], pool: { peersOk, failed } }\`. An unreachable peer degrades to a \`failed\` entry — local sessions always answer.
 - **Post-transfer closeout (automatic):** when a topic moves to another machine, the OLD machine's session for it is closed automatically (immediately on an explicit "move", or within ~2 reaper ticks for any other path) — no duplicate sessions doing duplicate work. The close is recorded in the reap-log with reason "topic moved to <machine>"; protected sessions are never auto-closed.
@@ -3982,6 +3985,31 @@ At every server boot the guard posture (every \`monitoring.*\` enabled flag + \`
         else {
             result.skipped.push('CLAUDE.md: Guard-Posture Tripwire section already present');
         }
+        // Guard Posture endpoint (GUARD-POSTURE-ENDPOINT-SPEC §4 Agent Awareness +
+        // §2.5 interim hazard containment). The tripwire section above only covers
+        // boot-time TRANSITIONS; this teaches the steady-state read surface
+        // (GET /guards, ?scope=pool) plus the PATCH /config one-level-deep-merge
+        // hazard (a partial block erases sibling tuning — lived 2026-06-11).
+        // Byte-identical to the generateClaudeMd block (Migration Parity).
+        // Idempotent via content-sniffing on the section heading.
+        if (!content.includes('Guard Posture — which safety systems are genuinely on')) {
+            const section = `
+### Guard Posture — which safety systems are genuinely on (\`GET /guards\`)
+
+Every guard (monitoring sentinels, reapers, the scheduler, …) is graded by what can be VERIFIED, never by what the config wishes: \`on-confirmed\` / \`on-unverified\` / \`on-stale\` / \`on-dry-run\` / \`off\` (\`dark-default\` = ships-dark, quiet vs \`diverged-from-default\` = default-on but currently off — the load-shed signature) / \`diverged-pending-restart\` / \`errored\` / \`missing\` / \`off-runtime-divergent\`. Only the "off that shouldn't be off" and runtime-contradiction classes alert — a ships-dark feature that is off is normal, never noise.
+- This machine: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/guards\`
+- Every machine (heartbeat-fresh, or last-known posture with its age for a dark peer): \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/guards?scope=pool"\`
+- **When to use** (PROACTIVE — this is the trigger): "are my guards on?" / "why didn't the watchdog/reaper fire on machine X?" / a post-incident sweep after ANY load-shed → read \`/guards?scope=pool\` and report the deviant rows instead of guessing from config memory. The Machines dashboard tab shows each machine's last-known posture with its age — even for a peer that is currently dark.
+- **HAZARD — re-enabling a guard via \`PATCH /config\`**: send the guard's FULL config block (the merge is one-level-deep and a partial block erases sibling tuning); read the current block from the source machine first (\`GET /guards\` shows posture; the config block itself comes from that machine's config).
+- Three complementary layers, one shared inventory: the Guard-Posture Tripwire covers enabled→disabled transitions at boot (\`logs/guard-posture.jsonl\`); \`/guards\` is the steady-state read; the GuardPostureProbe raises ONE aggregated Attention item when an anomaly persists across consecutive probes.
+`;
+            content += '\n' + section;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Guard Posture (/guards) capability section');
+        }
+        else {
+            result.skipped.push('CLAUDE.md: Guard Posture (/guards) capability section already present');
+        }
         // AgentWorktreeReaper report (RESPONSIBLE-RESOURCE-USAGE — OS resource hygiene).
         // Tells the agent the "which stale worktrees can be reclaimed?" read-surface
         // exists. Without it, an agent asked about worktree disk/sprawl has no grounded
@@ -5018,6 +5046,28 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             patched = true;
             result.upgraded.push('CLAUDE.md: added import dry-run line to Cutover Readiness section');
         }
+        // Topic Profile (TOPIC-PROFILE-SPEC §12) — Agent Awareness backfill. The
+        // conversational triggers are the PRIMARY surface (B2/B36: the agent acts
+        // on intent, never instructs the operator to type /topic — the slash form
+        // is a power-user convenience only), and the READ direction ships in the
+        // same section as Registry-First entries (GET /topic-profile/:topicId +
+        // logs/topic-profile-changes.jsonl) so the agent reads instead of guessing.
+        // Body mirrors generateClaudeMd() (Agent Awareness Standard). Content-
+        // sniffed on the section header, distinctive + stable, so the migration is
+        // idempotent and skips template-generated CLAUDE.md files.
+        if (!content.includes('Topic Profile (per-topic model')) {
+            const section = `
+**Topic Profile (per-topic model, thinking, framework pins)** — Every conversation topic can carry a durable profile pinning its BASELINE model (an explicit id OR a tier — never both), thinking depth (\`off\`/\`low\`/\`medium\`/\`high\`/\`max\`), and framework (\`claude-code\`/\`codex-cli\`/…). Pins survive restarts and follow the topic. **The conversational surface is PRIMARY** (PROACTIVE — these are the triggers): when the user says "use codex here", "pin this topic to Fable", or "set high thinking on this topic", that IS the request — propose the change back in plain words, confirm, and the pin is durable from then on. NEVER instruct the user to type \`/topic\`; the \`/topic\` command exists only as a power-user convenience.
+- What is this topic pinned to? \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/topic-profile/TOPIC_ID\` — Registry First: read it, never guess (no entry = the topic runs on defaults).
+- Why/when did a pin change? Read \`logs/topic-profile-changes.jsonl\` — the per-change audit (who set what, when, old → new).
+- A pinned model/framework that is no longer available falls back to defaults with a once-per-transition notice — the session keeps working; a pin is never a block.
+- A baseline pin does NOT disable the heavy-work ultra escalation (\`escalationOverride: 'inherit'\` is the default); it steps aside only when the operator explicitly opts the topic out (\`'suppress'\`).
+- Config: \`.instar/config.json\` → \`topicProfiles\` (\`dryRun\`, debounce windows, stagger cap, breaker threshold; \`defaults\` = per-topic config-default model/thinking). Writes ship dark behind the dev-agent gate with \`dryRun: true\` (intended respawns are logged, not performed); resolution (reads) is always on.
+`;
+            content += '\n' + section;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Topic Profile awareness section');
+        }
         if (patched) {
             try {
                 fs.writeFileSync(claudeMdPath, content);
@@ -5166,6 +5216,11 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             // "how much did feature X spend on which model?" or spot audit-blind
             // frameworks.
             '### Token-Audit Completeness — per-model token breakdown & usage coverage',
+            // Topic Profile (TOPIC-PROFILE-SPEC §12): framework-agnostic — a Codex/
+            // Gemini agent's topics carry pins too, and an agent that never learns
+            // the conversational triggers + read surfaces will guess instead of
+            // reading GET /topic-profile/:topicId (the B2/B36 failure class).
+            '**Topic Profile (per-topic model, thinking, framework pins)**',
         ];
         for (const shadowName of ['AGENTS.md', 'GEMINI.md']) {
             const shadowPath = path.join(this.config.projectDir, shadowName);
@@ -6207,6 +6262,22 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
      *   - .instar/state/pr-cost-ledger.jsonl     (daily cost accounting)
      *   - .instar/state/security.jsonl*          (auth + revocation events)
      *
+     * Topic Profile (TOPIC-PROFILE-SPEC §12, round-5/6): the profile store
+     * (`state/topic-profiles.json`) and the operator-binding store it
+     * authorizes against (`state/topic-operators.json`) join the same union —
+     * both are durable operator intent, exactly the identity/continuity class
+     * the backup protects (a restore must not produce pins whose bound
+     * operator is absent). The resume maps (topic-resume-map /
+     * codex-resume-map) are machine-local ephemera and deliberately EXCLUDED
+     * — they reference transcripts that don't travel.
+     *
+     * PATH SHAPE IS PINNED (round-6 integration): the topic-profile entries
+     * are stateDir-RELATIVE (`state/...`), NEVER `.instar/state/...` —
+     * BackupManager.createSnapshot() joins each entry onto a stateDir that
+     * already IS `<project>/.instar`, so an `.instar/`-prefixed entry
+     * silently never matches anything (a dead manifest entry that loses
+     * every operator pin on restore).
+     *
      * Set-union semantics preserve user-added entries. Idempotent on
      * re-run. Atomic write (temp → fsync → rename).
      *
@@ -6224,6 +6295,12 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             '.instar/state/pr-cost-ledger.jsonl',
             '.instar/state/security.jsonl*',
         ];
+        // stateDir-relative (see PATH SHAPE IS PINNED above) — these resolve in
+        // BackupManager.createSnapshot's `path.join(stateDir, entry)`.
+        const TOPIC_PROFILE_BACKUP_ENTRIES = [
+            'state/topic-profiles.json',
+            'state/topic-operators.json',
+        ];
         const configPath = path.join(this.config.stateDir, 'config.json');
         if (!fs.existsSync(configPath)) {
             result.skipped.push('config.backup.includeFiles (config.json not found)');
@@ -6241,7 +6318,11 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
         const existing = Array.isArray(backup.includeFiles)
             ? backup.includeFiles.filter((e) => typeof e === 'string')
             : [];
-        const merged = Array.from(new Set([...existing, ...PR_GATE_BACKUP_ENTRIES]));
+        const merged = Array.from(new Set([
+            ...existing,
+            ...PR_GATE_BACKUP_ENTRIES,
+            ...TOPIC_PROFILE_BACKUP_ENTRIES,
+        ]));
         for (const entry of merged) {
             if (path.normalize(entry).startsWith('.instar/secrets/')) {
                 result.errors.push(`migrateBackupManifest: includeFiles contains secrets-prefix entry "${entry}" — BackupManager will refuse it at snapshot time, but the entry should not be here`);
@@ -6265,7 +6346,14 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
                 fs.closeSync(fd);
             }
             fs.renameSync(tmpPath, configPath);
-            result.upgraded.push(`config.backup.includeFiles: added ${added.length} pr-gate state path(s)`);
+            const prGateAdded = added.filter((e) => PR_GATE_BACKUP_ENTRIES.includes(e)).length;
+            const topicProfileAdded = added.filter((e) => TOPIC_PROFILE_BACKUP_ENTRIES.includes(e)).length;
+            if (prGateAdded > 0) {
+                result.upgraded.push(`config.backup.includeFiles: added ${prGateAdded} pr-gate state path(s)`);
+            }
+            if (topicProfileAdded > 0) {
+                result.upgraded.push(`config.backup.includeFiles: added ${topicProfileAdded} topic-profile state path(s)`);
+            }
         }
         catch (err) {
             result.errors.push(`migrateBackupManifest write: ${err instanceof Error ? err.message : String(err)}`);