instar 1.3.540 → 1.3.541

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.540",
+  "version": "1.3.541",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T21:07:38.641Z",
-  "instarVersion": "1.3.540",
+  "generatedAt": "2026-06-13T21:38:38.083Z",
+  "instarVersion": "1.3.541",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
+      "contentHash": "a6a1c22fc6213c6ab2da23825c5fcd0b2213fd3dbc4bc9bae094bcdb42c8157c",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "c505368755a51f57c461447eae1b32da1815444b25060d985ab2381779bd6311",
+      "contentHash": "1e282ecacc10ebe6ab4adeaabc00ff2f0295b1b0954ee5b48e2314c368594577",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.541.md

@@ -0,0 +1,29 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Enforces the spec's applicability precondition: live credential re-pointing only works for sessions that read their credential from the per-config-home store. A session launched with an env token bypasses that store and is invisible to the mechanism — so this step records, at spawn, WHERE each session's Anthropic credential comes from, and refuses to run the feature whenever an env-token session is present.
+
+- **Durable per-session provenance flag** — a new `credentialSource: 'store' | 'env'` field on the session record, set at every claude-code spawn lane. It is derived from the IDENTICAL expression that selects the session's Anthropic env block — `(config.anthropicApiKey ?? '') !== '' ? 'env' : 'store'`, computed at the spawn site — so the flag can never drift from what actually launched the session (single source of truth; an independent recomputation would re-create the staleness class this spec exists to kill).
+- **The env-token gate** — a new `CredentialEnvTokenGate` (src/core/CredentialEnvTokenGate.ts), a pure evaluator. It REFUSES the feature, with a NAMED category reason, when either the config field `anthropicApiKey` is any non-empty value (an OAuth token OR a direct API key — both bypass the store) OR any running claude-code session's provenance flag is `env`. Checking the LIVE fleet — not just the config field — closes the mid-life-flip hole: an operator setting an env token mid-run would otherwise leave already-running store sessions steerable while new env spawns are silently un-steered.
+- **Named reason on the status route** — `GET /credentials/rebalancer`, when the feature flag is ON, now surfaces the gate verdict (refused, the reason category, and the count of env sessions), scrubbed through the existing secret-scrub chokepoint. Dark (flag off) it stays a strict 503 no-op.
+- **Attribution-suppression** — on a gate refusal the location gate behaves as dark, so the quota poller stops routing reads/attribution through moved slots: an env session's usage is never mis-attributed to a slot tenant.
+- **Dark** — gated by the existing `subscriptionPool.credentialRepointing` flag. With the feature off (the fleet + dev default) the gate is never consulted and the only delta is the additive provenance field on new session records (free metadata, never read) — byte-for-byte today's behavior.
+
+## What to Tell Your User
+
+This is internal plumbing that ships turned off, so nothing changes for you day to day. What it builds toward, with a safety guarantee baked in: the under-the-hood feature that moves a credential between your subscription accounts only works for sessions that read their login from the on-disk store I manage. If a session was instead launched with a login token handed straight to it in its environment, that session ignores the store entirely and the moving trick would be a no-op for it. So this step teaches me to record, the moment each session starts, which of those two kinds it is — and to refuse to run the whole moving feature at all whenever any running session is the kind I cannot steer. That refusal is deliberate and visible, with a plain reason, rather than the feature quietly mis-handling a session it does not actually control. It is off by default and does nothing until the feature is turned on after a review window.
+
+## Summary of New Capabilities
+
+One new exported class — `CredentialEnvTokenGate` (the env-token applicability gate: refuses on the config field OR a live env-token session in the fleet, with a named reason) — plus a new additive optional `Session.credentialSource` provenance field set at every claude-code spawn lane, and the `GET /credentials/rebalancer` route surfacing the gate verdict. All gated by the existing `subscriptionPool.credentialRepointing` flag. No new gate flag, no new unfunneled credential write path.
+
+## Evidence
+
+- `tests/unit/credential-env-token-gate.test.ts` (18) — config predicate (permits empty/undefined; refuses on sk-ant-oat, on a direct sk-ant-api03 key, and on any non-empty value); live-fleet path (refuses on one running env session with config empty, counts multiple, ignores a non-running env session and a non-claude env session, treats undefined as store, config-field refusal short-circuits before the fleet scan); attribution-suppression (`shouldAttributeSlotTenant` false for env, true for store/undefined); and the single-source-of-truth blocker proven by a static grep-assert against the real SessionManager source (exactly 3 env-block predicates + 3 identical provenance derivations + 4 record writes).
+- `tests/integration/credential-routes.test.ts` (+3) — the rebalancer route surfaces the config-field refusal (scrubbed, no token leak), the live-fleet refusal (mid-life flip, config empty), and permits when config empty + all-store fleet.
+- `tests/e2e/credential-repointing-routes-alive.test.ts` (+3) — feature-alive on the real AgentServer factory: rebalancer DARK is a strict 503 no-op, ENABLED + clean config + all-store fleet permits, ENABLED + a live env-token session refuses with the named reason.
+- tsc clean; full `npm run lint` clean (dark-gate 16/16 unchanged — no ConfigDefaults touched); no-silent-fallbacks + no-empty-catch-blocks + feature-delivery-completeness + docs-coverage green.

package/upgrades/side-effects/ws52-step8-provenance-gate.md

@@ -0,0 +1,78 @@
+# Side-effects review — WS5.2 Step 8 (credential provenance flag + env-token gate)
+
+**Spec:** `docs/specs/live-credential-repointing-rebalancer.md` (approved:true, converged) §2.10/§0.b/§2.4, build-plan §8.
+**Tier:** 2 (src code + a read-time gate + a session-record metadata field; ships DARK behind the EXISTING `subscriptionPool.credentialRepointing` flag — NO new gate flag).
+**Parent principle:** Cross-Machine Coherence — One Agent, Robust Under Degraded Conditions.
+**Second-pass reviewer:** independent reviewer subagent (this change touches a "gate" → Phase 5 required).
+
+## What changed
+
+- **NEW `src/core/CredentialEnvTokenGate.ts`** — the §2.10 env-token gate (the §0.b applicability precondition, enforced). Pure evaluator (no IO): `evaluate()` REFUSES the feature, with a NAMED CATEGORY reason, when (a) `config.anthropicApiKey` is ANY non-empty value (OAuth OR API key — round-3) OR (b) any RUNNING claude-code session's durable `credentialSource` flag is `'env'` (the live-fleet path that closes the mid-life flip). The static helper `shouldAttributeSlotTenant(session)` is `false` for an env session (its usage is never mis-attributed to a slot tenant — §2.10 requirement 3).
+- **`src/core/types.ts`** — adds `Session.credentialSource?: 'store' | 'env'` (additive optional metadata field; no `enabled:` literal → dark-gate UNCHANGED).
+- **`src/core/SessionManager.ts`** — sets `credentialSource` on the session record at all four claude-code spawn record-writes. At the three env-block lanes (headless `~:1846`, rerouted-interactive `~:2127`, interactive `~:3248`) it is derived from the **IDENTICAL** expression that selects the Anthropic env block — `(this.config.anthropicApiKey ?? '') !== '' ? 'env' : 'store'`, computed at the spawn site, NEVER a recomputation. The triage lane hardcodes `'store'` (it always empties `ANTHROPIC_API_KEY=`, so it deterministically reads the store).
+- **`src/commands/server.ts`** — constructs the `CredentialEnvTokenGate` (reading `config.sessions.anthropicApiKey` — the SAME source `sessionManagerConfig` spreads into SessionManager — and `state.listSessions()`); AND-s its refusal into the `CredentialLocationGate.isEnabled` (so a §2.10 refusal suppresses ALL re-pointing attribution: requirement 3 enforced structurally through the one gate the QuotaPoller already consults); adds the gate to the `credentialRepointing` bundle.
+- **`src/server/routes.ts`** — adds `envTokenGate` to the `credentialRepointing` RouteContext type; `GET /credentials/rebalancer` now surfaces the gate verdict (refused + named reason + envSessionCount) when the flag is ON, scrubbed via `audit.response`. DARK → strict 503 no-op (unchanged).
+- **Tests:** NEW `tests/unit/credential-env-token-gate.test.ts` (18); extended `tests/integration/credential-routes.test.ts` (+3 rebalancer cases) and `tests/e2e/credential-repointing-routes-alive.test.ts` (+3 cases, incl. live env-token fleet); widened the look-back window in `tests/unit/codex-model-swap-wiring.test.ts` (the §2.10 derivation sits between `effectiveAccountId` and `buildInteractiveLaunch` — the WS5.3 source-string-ratchet lesson).
+
+## Decision-point inventory
+
+- `CredentialEnvTokenGate.evaluate()` — **add** — the §2.10 refusal decision (config field OR live fleet). It is a SIGNAL feeding the rebalancer status surface + the location-gate enablement; it never blocks a session spawn, a message, or a swap directly.
+- `CredentialLocationGate.isEnabled` AND-in — **modify** — a §2.10 refusal makes the location gate behave as dark (attribution off) so the QuotaPoller stops re-routing reads/attribution through moved slots for an env fleet.
+- `Session.credentialSource` derivation — **add** — additive provenance metadata, not a decision (it is the durable INPUT the gate's fleet scan reads).
+
+## State files / migrations
+
+- **No new state file.** `credentialSource` rides the existing session record (`state/sessions/*.json`); additive optional field, absent on legacy records (treated as `'store'` — the safe, non-refusing direction).
+- **No migration in Step 8.** The CLAUDE.md awareness template + `migrateConfig`/`migrateClaudeMd` + CapabilityIndex are explicitly scoped to **build-plan §9 (Step 9 — Migration parity)** — tracked there, not deferred silently. No new config flag means nothing to migrate for the gate itself.
+
+## Blast radius / reversibility
+
+- **Ships DARK.** The gate is only consulted behind `subscriptionPool.credentialRepointing.enabled` (the location-gate AND-in short-circuits on the flag BEFORE evaluating the gate, and the rebalancer route 503s while dark). With the flag off (always, fleet-wide) the only runtime delta is the additive `credentialSource` field on new session records — free metadata, never read. E2E proves the dark surface is a byte-for-byte 503 no-op.
+- Reversibility: revert the commit. The `credentialSource` field is inert metadata; no credential write, no schema migration, no durable state to repair. A swap is still the reversible oracle-verified permutation from Step 5.
+
+## Per-Phase-C (multi-machine posture)
+
+- **Machine-local BY DESIGN.** The gate is per-machine: each machine evaluates ITS OWN `config.sessions.anthropicApiKey` + ITS OWN `state.listSessions()`. An N-machine pool is N independent gates; a machine running an env-token fleet refuses LOCALLY without reading or affecting a peer's store-reading fleet. No cross-machine credential read, no LAN/broadcast assumption. The `credentialSource` flag is per-session-per-machine durable metadata and never crosses machines (it would be meaningless on another machine, whose config/fleet differ). This is the correct posture: env-vs-store is a function of the LOCAL config field + the LOCAL fleet, so a remote read would be both unnecessary and a coherence hazard.
+
+## Adversarial review (4 lenses, folded as named tests)
+
+1. **Single-source-of-truth provenance (THE blocker)** — the flag is the IDENTICAL `(this.config.anthropicApiKey ?? '')` expression as the env-block selection at each of the three lanes, computed at the spawn site. Proven by a static grep-assert against the real SessionManager source (exactly 3 env-block predicates + 3 identical provenance derivations + 4 record writes) — an independent recomputation would fail it. A divergence test guards the staleness class this whole spec exists to kill.
+2. **Mid-life-flip / live-fleet** — the gate refuses on a running `env` session even when the config field is empty (named unit + integration + e2e tests). A config-only gate would miss it; the fleet scan reads the durable flag.
+3. **Attribution-suppression** — `shouldAttributeSlotTenant` is false for an env session (named test); structurally, the location-gate AND-in suppresses re-pointing attribution wholesale on refusal so the QuotaPoller never mis-attributes an env session's usage to a slot tenant.
+4. **Dark-ship inertness** — flag OFF → rebalancer 503 strict no-op; record-write shape unchanged except the additive field (e2e "feature is alive" — the single most important test).
+
+## Silent-fallback tags
+
+`CredentialEnvTokenGate` is pure logic with NO catch blocks. The route/server edits add no new catch. no-silent-fallbacks (5/5) + no-empty-catch-blocks (4/4) pass with NO baseline bump.
+
+## Second-pass review (Phase 5 — independent reviewer subagent)
+
+**Concur with the review.** All seven load-bearing invariants verified against the actual code:
+1. Single-source-of-truth — the `credentialSource` derivation is the IDENTICAL `(this.config.anthropicApiKey ?? '') !== ''` expression adjacent to each lane's `.startsWith('sk-ant-oat')` env-block predicate over the SAME `this.config.anthropicApiKey` field (SessionManager lanes 1/2/3); triage hardcodes `'store'` and demonstrably empties `ANTHROPIC_API_KEY=`. Not a recomputation.
+2. Config predicate is "any non-empty value" (`key !== ''`), correctly broader than the launch's sk-ant-oat branch (both branches set a store-bypassing env var).
+3. Gate ANDs the live-fleet scan (running + claude-code + `credentialSource === 'env'`, undefined→store safe default) onto the config check, closing the mid-life-flip hole.
+4. The location-gate `isEnabled` AND-in is sound: `&&` short-circuits on the dark flag BEFORE `evaluate()` is ever called (true no-op while dark); on refusal it suppresses re-pointing attribution wholesale (the conservatively-correct direction); `shouldAttributeSlotTenant` false for env.
+5. Gate-level single-source-of-truth holds — `config.sessions?.anthropicApiKey` is the same value `sessionManagerConfig = { ...config.sessions }` feeds SessionManager (anthropicApiKey not overridden).
+6. Dark surface is a strict 503 no-op through the scrub chokepoint; the only record-shape delta is the additive optional field.
+7. Signal-vs-authority: advisory except the attribution-suppression AND-in, which is appropriate and non-brittle (a boolean over a durable flag with a safe default).
+
+No concern raised.
+
+## Gate-ratchet results (run locally before push)
+
+- `tsc --noEmit` clean; full `npm run lint` clean (includes dark-gate 16/16 — **UNCHANGED**, no ConfigDefaults touch).
+- no-silent-fallbacks 5/5, no-empty-catch-blocks 4/4, feature-delivery-completeness 97/97, docs-coverage --check pass (floor-based; internal-plumbing symbol, no floor breach).
+- credential-env-token-gate 18/18; credential-routes (integration) all pass incl. 3 new rebalancer cases; credential-repointing-routes-alive (e2e) 6/6 incl. live env-token fleet; codex-model-swap-wiring 7/7 (window widened); all SessionManager wiring/activation tests green.
+
+## Second-pass review verdict (Phase 5 — required: change touches a "gate")
+
+Independent reviewer subagent audited the gate + the 4 spawn-site provenance derivations + the dark-ship short-circuit against the real code (not the artifact's claims), and against `docs/signal-vs-authority.md`. All six verification points held:
+
+1. **Single-source-of-truth** — all 3 env-block lanes (`SessionManager.ts:1844/2126/3246`) derive `credentialSource` from the identical `(this.config.anthropicApiKey ?? '') !== ''` predicate adjacent to their own env-block write; the triage lane hardcodes `'store'` and provably empties `ANTHROPIC_API_KEY=`. The gate reads `config.sessions?.anthropicApiKey` (`server.ts:9213`), which is the SAME value `sessionManagerConfig = {...config.sessions}` feeds SessionManager (not overridden). Not a recompute.
+2. **Fail-safe direction** — `credentialSource==='env'` is the only fleet-path refusal; `undefined`→`'store'` (non-refusing). A refusal disables the FEATURE (re-pointing attribution), never messaging/sessions/swaps.
+3. **Dark-ship inertness** — `enabled === true && !gate.evaluate().refused` short-circuits on the flag BEFORE `evaluate()`; the route 503s before evaluating. Byte-for-byte prior behavior when dark.
+4. **Config predicate** — refuses on ANY non-empty `anthropicApiKey` (OAuth `sk-ant-oat` OR api key), matching both SessionManager launch branches.
+5. **Signal-vs-authority** — a deterministic policy evaluator over a structured durable flag, not a brittle detector; the only authority it holds is suppressing the feature itself (the conservatively-correct fail-safe), which the principle doc explicitly permits for a domain this constrained.
+6. **Over/under-refuse** — the mixed-fleet whole-feature refusal is conservatively-correct (refuse rather than mis-steer); machine-local posture is correct. No hole found.
+
+**Verdict: CONCUR.** The side-effects artifact's claims all hold against the actual code.