instar 1.3.524 → 1.3.526

package/dist/core/PostUpdateMigrator.js

@@ -261,6 +261,7 @@ export class PostUpdateMigrator {
         this.migrateCommitmentOwnerBackfill(result);
         this.migrateMultiMachinePostureReviewDimension(result);
         this.migrateConformanceGateAutoInvoke(result);
+        this.migrateHonestProgressMessagingDefaults(result);
         return result;
     }
     // ── Standards-Conformance Gate auto-invocation (2026-06-12, topic 13481) ──
@@ -530,6 +531,81 @@ export class PostUpdateMigrator {
             result.skipped.push('cartographer-dev-gate: no default-shaped false to strip (marker set)');
         }
     }
+    // ── HONEST-PROGRESS-MESSAGING D (Config surface + migration parity) ──
+    //
+    // The honest-messaging behavior reaches every agent via the monitors' code
+    // defaults already; this migration SURFACES the operator-tunable / rollback
+    // keys into a deployed agent's config.json so they are visible and settable,
+    // and logs which keys it backfilled (audit). Existence-checked + idempotent: a
+    // key the operator has explicitly set — including the rollback
+    // `suppressUnchangedHeartbeats: false` — is NEVER overwritten. Writes to the
+    // paths the runtime ACTUALLY reads: `monitoring.activeWorkSilenceSentinel.*`
+    // and TOP-LEVEL `promiseBeacon.*` (server.ts reads `config.promiseBeacon`, not
+    // `monitoring.promiseBeacon` — the spec prose's path was corrected against the
+    // real read site during the build).
+    migrateHonestProgressMessagingDefaults(result) {
+        const configPath = path.join(this.config.stateDir, 'config.json');
+        if (!fs.existsSync(configPath)) {
+            result.skipped.push('honest-progress-messaging-defaults: config.json not found');
+            return;
+        }
+        let config;
+        try {
+            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        }
+        catch (err) {
+            result.errors.push(`honest-progress-messaging-defaults: config.json read failed: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        const migrations = (config._instar_migrations ?? []);
+        const marker = 'honest-progress-messaging-defaults';
+        if (migrations.some(m => m.startsWith(marker))) {
+            result.skipped.push('honest-progress-messaging-defaults: already migrated');
+            return;
+        }
+        // Ensure a nested object exists without clobbering operator settings.
+        const ensureObj = (parent, key) => {
+            const cur = parent[key];
+            if (cur && typeof cur === 'object' && !Array.isArray(cur))
+                return cur;
+            const fresh = {};
+            parent[key] = fresh;
+            return fresh;
+        };
+        // Set a key ONLY if absent (existence-checked) — operator overrides survive.
+        const backfilled = [];
+        const setIfAbsent = (obj, key, value, label) => {
+            if (!(key in obj)) {
+                obj[key] = value;
+                backfilled.push(label);
+            }
+        };
+        const monitoring = ensureObj(config, 'monitoring');
+        const silence = ensureObj(monitoring, 'activeWorkSilenceSentinel');
+        setIfAbsent(silence, 'silenceThresholdMs', 1_800_000, 'monitoring.activeWorkSilenceSentinel.silenceThresholdMs');
+        setIfAbsent(silence, 'activeWorkMaxFrozenIndicatorMs', 5_400_000, 'monitoring.activeWorkSilenceSentinel.activeWorkMaxFrozenIndicatorMs');
+        const beacon = ensureObj(config, 'promiseBeacon');
+        setIfAbsent(beacon, 'suppressUnchangedHeartbeats', true, 'promiseBeacon.suppressUnchangedHeartbeats');
+        setIfAbsent(beacon, 'beaconLivenessIntervalMs', 3_600_000, 'promiseBeacon.beaconLivenessIntervalMs');
+        setIfAbsent(beacon, 'turnFinishedCloseoutChecks', 3, 'promiseBeacon.turnFinishedCloseoutChecks');
+        // Record the marker even when nothing was backfilled, so it runs exactly once.
+        const now = new Date().toISOString();
+        migrations.push(`${marker}-${now}`);
+        config._instar_migrations = migrations;
+        try {
+            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+        }
+        catch (err) {
+            result.errors.push(`honest-progress-messaging-defaults: config.json write failed: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (backfilled.length > 0) {
+            result.upgraded.push(`honest-progress-messaging-defaults: backfilled ${backfilled.join(', ')} (existence-checked — operator overrides preserved)`);
+        }
+        else {
+            result.skipped.push('honest-progress-messaging-defaults: all keys already present (marker set)');
+        }
+    }
     /**
      * Seed the interactive first-launch onboarding flags into every EXISTING
      * claude-code subscription-pool config home (2026-06-09 incident, topic
@@ -4244,6 +4320,26 @@ A secret you give me on one machine — a Telegram token, an API key, a GitHub P
             patched = true;
             result.upgraded.push('CLAUDE.md: added secret-sync push-opt-in safety line');
         }
+        // One Memory (replicated stores) — multi-machine-replicated-store-foundation
+        // §7. Deployed agents don't know certain stores now replicate with a no-clobber
+        // union + operator-resolved conflicts + origin-tagged rollback, nor the three
+        // /state/* routes. Append the section so an agent can answer "why do I have two
+        // versions of preference X?" / "roll back machine Y's data". Idempotent via the
+        // unique `/state/resolve-conflict` marker.
+        if (!content.includes('/state/resolve-conflict') && !content.includes('One Memory (replicated stores)')) {
+            const oneMemory = `
+### One Memory (replicated stores)
+
+When enabled, certain stores (preferences, relationships) replicate across my machines so I have ONE memory, not one-per-machine. A read returns the UNION of every machine's copy, merged by a no-clobber rule: a normal sequential edit history resolves to the latest writer; but two machines that edited the SAME thing DURING A PARTITION (a genuine concurrent divergence) are NEVER silently overwritten. For a high-impact store (preferences, relationships) BOTH versions are preserved and the conflict is flagged for you to resolve; for a low-impact store the latest wins but the overwrite is flagged, never silent. A replicated record never clobbers a divergent local one — reach is not authority. Ships DARK behind \`multiMachine.stateSync.<store>\` (default false); a single-machine agent is a strict no-op.
+- See open conflicts: \`curl -H "Authorization: Bearer $AUTH" http://localhost:4042/state/conflicts\` → the unresolved divergences awaiting your call (each with a stable \`conflictId\` + the preserved versions).
+- Resolve one (YOUR authority — the foundation never picks a winner): \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:4042/state/resolve-conflict -H 'Content-Type: application/json' -d '{"conflictId":"<id>","winnerOrigin":"<machine id>"}'\` (or supply a \`mergedVersion\` object). The chosen/merged record then replicates as normal.
+- Roll back a machine's data (un-merge): disabling \`multiMachine.stateSync.<store>\` for a peer atomically DROPS that origin's contribution — the union recomputes live, a key that was winning from the dropped machine reverts to the latest among the REMAINING machines (or to "no record"), any conflict that only existed because of it auto-resolves, and the dropped streams are quarantined-aside (reversible, auditable, never a destructive delete). View what's currently un-merged: \`curl -H "Authorization: Bearer $AUTH" http://localhost:4042/state/quarantine\`.
+- **When to use** (PROACTIVE — these are the triggers): the user asks "why do I have two versions of preference X?" → read open conflicts and present them for resolution. The user says "roll back machine Y's data / forget what the other machine learned" → un-merge that origin. Spec: \`docs/specs/multi-machine-replicated-store-foundation.md\` §7.
+`;
+            content += '\n' + oneMemory;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added One Memory (replicated stores) section');
+        }
         // ContextWedgeSentinel — the 4th silently-stopped sentinel. Tells the agent
         // about the transcript fast-fail wedges (thinking-block 400 + AUP-rejection
         // loop) + that auto-recovery is opt-in. Without it, an agent asked "why did
@@ -5530,6 +5626,16 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             patched = true;
             result.upgraded.push('CLAUDE.md: added Threadline Single-Negotiator section');
         }
+        // HONEST-PROGRESS-MESSAGING C (docs alignment) — the silent-freeze watchdog +
+        // promise beacon are now honest (corroborate before claiming a freeze; silent
+        // unless there's something true to say). Existing agents learn what they are,
+        // their defaults, and how to tune/disable via this appended subsection (Agent
+        // Awareness Standard). Content-sniff marker keeps it idempotent.
+        if (!content.includes('Honest progress messaging (silent-freeze watchdog + promise beacon)')) {
+            content += `\n### Honest progress messaging (silent-freeze watchdog + promise beacon)\n\nTwo background notifiers used to post frequent, falsely-confident noise because they judged "work" by whether the terminal *screen* repainted — a busy long task looks identical to a frozen one. Both are now honest. They are SIGNALS, never gates: they only decide whether to notify you, and every error path fails toward silence.\n- **Silent-freeze watchdog** (ActiveWorkSilenceSentinel): before claiming a session is stuck, it re-captures the LIVE frame and corroborates — if the frame still shows an active-work indicator (spinner / "esc to interrupt"), a sub-agent is live, or it's a clean idle prompt, it stays SILENT. It speaks only when genuinely wedged, and even then hedges ("…hasn't changed in N min and a nudge didn't wake it — it may be stuck, or on a long task I can't see into. Want me to check?"). Threshold raised 15m→30m; a 90m frozen-indicator backstop still surfaces a real mid-tool hang. Tune/disable: \`monitoring.activeWorkSilenceSentinel.enabled\` (off), \`.silenceThresholdMs\` (default 30m), \`.activeWorkMaxFrozenIndicatorMs\` (default 90m).\n- **Promise beacon** (the ⏳ heartbeats): the zero-information "still on it, no new output" filler is suppressed by default — it speaks only on genuine new progress, deadline pressure, a sparse once-per-60m liveness line, or a one-shot turn-finished close-out. Base cadence relaxed 10m→20m. Tune/disable: \`promiseBeacon.suppressUnchangedHeartbeats: false\` (restore the legacy every-tick heartbeat — the rollback lever), \`promiseBeacon.beaconLivenessIntervalMs\` (default 60m), \`promiseBeacon.turnFinishedCloseoutChecks\` (default 3).\n- **Doc correction:** the trio's escalations are NOT gated by \`monitoring.sentinelTelegramEscalation\` (that gate governs a different path); they route through the tone-gated \`/attention\` surface and are controlled by each sentinel's own \`enabled\` flag (both default true). Effectiveness is measurable in \`logs/sentinel-events.jsonl\` and the per-feature LLM-metrics surface (feature keys \`active-work-silence\`, \`promise-beacon\`). Spec: \`docs/specs/HONEST-PROGRESS-MESSAGING-SPEC.md\`.\n`;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Honest progress messaging section');
+        }
         if (patched) {
             try {
                 fs.writeFileSync(claudeMdPath, content);
@@ -5702,6 +5808,16 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             // Metrics precedent; each CLAUDE.md contains exactly one, so the other no-ops.
             '**Links that survive machine boundaries (WS4.4',
             '### Links that survive machine boundaries (WS4.4',
+            // One Memory (replicated stores) — multi-machine-replicated-store-foundation
+            // §7: framework-agnostic — a Codex/Gemini agent on a multi-machine pool must
+            // know stores replicate with a no-clobber union + operator-resolved conflicts
+            // (/state/conflicts, /state/resolve-conflict) + origin-tagged rollback
+            // (/state/quarantine), so it answers "why two versions of preference X?" /
+            // "roll back machine Y's data" instead of improvising a clobber. Two tail-
+            // truncated variants cover both deployed forms (templates' bold block +
+            // migrateClaudeMd's H3); each CLAUDE.md contains exactly one, so the other no-ops.
+            '**One Memory (replicated stores)',
+            '### One Memory (replicated stores)',
         ];
         for (const shadowName of ['AGENTS.md', 'GEMINI.md']) {
             const shadowPath = path.join(this.config.projectDir, shadowName);