instar 1.3.560 → 1.3.561

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-14T09:02:12.574Z",
-  "instarVersion": "1.3.560",
+  "generatedAt": "2026-06-14T10:35:51.901Z",
+  "instarVersion": "1.3.561",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1554,7 +1554,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.561.md

@@ -0,0 +1,31 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+**This release is the feedback-factory sender repoint** (docs/specs/feedback-factory-migration.md §2.5 Phase 4): the fleet's canonical feedback endpoint moves from Portal's receiver (`dawn.bot-me.ai/api/instar/feedback`) to the Instar operated instance's canonical front (`feedback.dawn-tunnel.dev/api/feedback`) — a live, verified Vercel receiver whose DNS zone is operator-controlled. (`feedback.instar.sh` is the intended long-term name; its DNS was not reachable at repoint time, so the operated endpoint went live on `feedback.dawn-tunnel.dev` first. A later re-point to instar.sh, if that becomes serviceable, is a one-line constant change + an idempotent migration.)
+
+- **Single-source constant.** `src/core/canonicalFeedback.ts` now defines `CANONICAL_FEEDBACK_URL` + `LEGACY_FEEDBACK_URLS`; the Config loader default and both init shapes consume it (the literal URL can never drift across call sites again — pinned by test).
+- **Migration Parity (the actual fleet repoint).** An idempotent `PostUpdateMigrator.migrateConfig` block rewrites a deployed agent's `feedback.webhookUrl` to the canonical front **only when it exactly equals a known legacy canonical default**. A custom operator webhook URL is structurally untouched (exact-match allowlist). Variant spellings that miss the match keep working through the old receiver's 301/proxy-forward (spec Phase 5) — the long tail loses nothing.
+- **Unchanged:** the HMAC signing model and shared secret (same key through cutover, spec §2.9), the sender code itself, and `dispatches.dispatchUrl` (the dispatch move is sequenced separately).
+
+## What to Tell Your User
+
+- "The address I send Instar bug reports and feedback to has moved to its new home (run by the Instar maintainer). This happened automatically with this update — nothing for you to do, and no reports were lost: the old address keeps forwarding while the fleet rolls over."
+- "If you ever configured a CUSTOM feedback webhook of your own, it was not touched."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Canonical feedback endpoint (stable) | Automatic — `feedback.webhookUrl` repoints on update; new installs get it via `init` |
+| Single-source endpoint constant | `src/core/canonicalFeedback.ts` (`CANONICAL_FEEDBACK_URL`) |
+
+## Evidence
+
+- `tests/unit/PostUpdateMigrator-feedbackUrlRepoint.test.ts`: both sides of the rewrite decision boundary (legacy URL repointed / custom URL untouched), idempotency (second run = no change), no-invention on absent config, legacy-list regression pin, and the canonical URL passing the sender's own `validateWebhookUrl` gate.
+- `tests/unit/feedback-webhook.test.ts` updated: Config loader resolves through the constant; the legacy literal is banned from the loader source.
+- Full unit suite green; side-effects artifact `upgrades/side-effects/feedback-sender-repoint.md` with independent second-pass review.
+- Live pre-merge gate (operational): a signed HMAC round-trip against `https://feedback.dawn-tunnel.dev/api/feedback` was verified green before this repoint — `200 {received:true}` with the report landing durably in the operated instance's Blob inbox marked `verified:true`.

package/upgrades/side-effects/feedback-sender-repoint.md

@@ -0,0 +1,61 @@
+# Side-Effects Review — Canonical feedback URL repoint (Phase-4 cutover flip)
+
+**Version / slug:** `feedback-sender-repoint`
+**Date:** `2026-06-11`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `required (fleet-wide sender repoint — the one-way door) — see appended response`
+
+## Summary of the change
+
+The migration spec's Phase-4 sender repoint (docs/specs/feedback-factory-migration.md §2.5): **merging this PR repoints the entire fleet's feedback sender** to the Echo-operated canonical front, an operator-authorized fleet-wide change. Introduces `src/core/canonicalFeedback.ts` (the single source for the fleet's canonical feedback endpoint: `CANONICAL_FEEDBACK_URL = https://feedback.dawn-tunnel.dev/api/feedback` — the live operated receiver, its DNS zone operator-controlled; `feedback.instar.sh` is the intended long-term name, not DNS-reachable at repoint time — plus the `LEGACY_FEEDBACK_URLS` rewrite allowlist), repoints the three in-code default sites (`src/core/Config.ts` loader default, `src/commands/init.ts` ×2 new-install shapes), and adds the **Migration Parity** arm: an idempotent `PostUpdateMigrator.migrateConfig` block that rewrites a deployed agent's `feedback.webhookUrl` to the canonical front **only when it exactly equals a known legacy canonical default** — an operator's custom URL is structurally untouchable. `dispatches.dispatchUrl` is deliberately NOT flipped (spec sequences the dispatch move separately; the old receiver's Phase-5 proxy-forward covers continuity). Tests: new `PostUpdateMigrator-feedbackUrlRepoint.test.ts` (both sides of the rewrite boundary, idempotency, no-invention, regression pins, sender-validation gate) and the updated `feedback-webhook.test.ts` (single-source + legacy-literal-banned pins).
+
+## Decision-point inventory
+
+- `migrateConfig` webhookUrl rewrite — **add** — a string-equality membership check against `LEGACY_FEEDBACK_URLS`. Deliberately brittle-and-cheap by design: exact-match-only is the conservative direction (a non-match means NO action), and it holds no blocking authority — it rewrites a default, never gates a flow.
+- Sender POST target (`FeedbackManager`) — **pass-through** — unchanged code; its destination value changes at config level. `validateWebhookUrl` (https + non-internal) passes the new URL (pinned by test).
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. The closest analogue: the rewrite could "over-fire" on an operator who deliberately pointed at Dawn's legacy URL as a *custom* choice — indistinguishable from the shipped default by construction. Post-cutover that URL is a 301/proxy-forward to the canonical front (spec Phase 5), so even that case lands at the same place. No issue identified.
+
+## 2. Under-block
+
+The rewrite "under-fires" for an agent whose config carries a variant spelling (trailing slash, http://, different casing) — exact-match misses it. Those agents keep posting to the old URL, which is exactly what the Phase-5 proxy-forward exists for: they keep landing on the canonical front via the forward, losing nothing. The long tail is covered structurally, not by widening the match (widening would risk touching custom URLs — the wrong trade).
+
+## 3. Level-of-abstraction fit
+
+The constant lives at the core layer (one definition, three consumers + the migrator — no string drift possible again); the repoint of deployed agents lives in the migration layer (`PostUpdateMigrator`), which is the system's designated mechanism for exactly this (Migration Parity standard names this very case: "the sender's canonical feedback URL must flip for EXISTING agents via PostUpdateMigrator"). No layer inversion.
+
+## 4. Signal vs authority compliance
+
+Compliant — the change adds no detector and no authority. The migration is a one-shot data rewrite with an exact-match guard whose failure mode is "do nothing" (deny-safe in the conservative direction). Reference: docs/signal-vs-authority.md.
+
+## 5. Interactions
+
+- Composes with the receiver-persistence PR (the canonical front + inbox + drainer must be live and verified BEFORE this merges — preflight-gated in the cutover runbook/windows, not by code coupling; this PR is inert until published + agents update).
+- The migrator block runs inside `migrateConfig` after the PIN block; it touches only `feedback.webhookUrl` and cannot race the ConfigDefaults registry (which only ADDS missing fields, never rewrites existing values — the reason a dedicated block is required at all).
+- `QuotaTracker` (`dawn.bot-me.ai/api/instar/quota`) and `paritySubmitClient`/`integrityPassRunner` (parity tooling) deliberately keep their own URLs — different services, out of Phase-4 scope.
+- The CLAUDE.md "API Authentication" prose in agent templates mentions the old webhook host; the canonical front uses the SAME auth model (User-Agent/X-Instar-Version + HMAC), so the prose stays accurate in mechanism; the host mention is updated by the template's normal regeneration path, not load-bearing.
+
+## 6. External surfaces
+
+This is the maximal external surface: every deployed agent's feedback sender repoints on its next update. Mitigations are the spec's own: (a) the merge is held to Dawn's freeze window (PR title carries `[HOLD: merge = cutover flip]`); (b) the flip is gradual by nature — agents repoint as they update; the old receiver's Phase-5 proxy-forward catches every not-yet-updated sender; (c) the new URL must pass a live signed HMAC round-trip BEFORE the window opens (preflight gate); (d) the shared `INSTAR_WEBHOOK_SECRET` is unchanged through cutover (spec §2.9), so signed reports verify identically on both receivers.
+
+## 7. Rollback cost
+
+The spec's own rollback path (Part-3 §5): re-pointing BACK is the same mechanism in reverse — a follow-up release moves `CANONICAL_FEEDBACK_URL` back and the legacy list gains the new URL; deployed agents re-migrate on update. During any gap, Dawn's old receiver is still warm (Phase 5 keeps it as proxy-forward, not dark), so no report is lost in either direction. No data migration, no schema, no state created at merge time beyond config rewrites that are themselves reversible.
+
+---
+
+## Second-pass review response (independent reviewer subagent, 2026-06-11)
+
+Concur with the review.
+
+1. **The rewrite is genuinely conservative.** `PostUpdateMigrator.ts` gates the rewrite on an exact-string membership check against the one-entry allowlist (`canonicalFeedback.ts`); a custom/variant URL falls through to no action, absent `feedback`/`webhookUrl` invents nothing (ConfigDefaults has no `feedback.webhookUrl` entry — only the unrelated `feedbackPostDelayMs` — so there is no second path that could write a URL), and the write is atomic with a `.bak` backup. Idempotency holds by construction (the canonical URL is pinned out of the legacy list by test).
+2. **No missed in-code default site.** `git grep` over `src/` returns only `paritySubmitClient.ts` (a DIFFERENT endpoint — `/api/instar/feedback-factory/parity-submit`) plus the legacy-list entry; the remaining host mentions (init dispatchUrl ×2, integrityPassRunner, QuotaTracker comment, a grounding-gate doc example) are the deliberate out-of-scope set §5 names. No agent-installed template surface carries the URL.
+3. **Inert before merge, real rollback.** The diff is pure source + tests + docs — nothing executes from an unmerged branch; the repoint only reaches agents via a published release + their next migration run. The rollback claim matches the spec verbatim (Phase-4 repoint "itself reversible (re-migrate to old URL)"). All 9 tests in the two test files pass, covering both sides of the decision boundary, idempotency, and the `validateWebhookUrl` gate.
+4. **Artifact and fragment honesty.** The seven sections match the code; the fragment publishes only at merge (the cutover itself), so it announces nothing as live early. One non-blocking nit: §5 attributed the stale old-host prose to "agent templates" — it actually lives in the repo's own `CLAUDE.md`; substance correct.
+
+**Resolution (author, same session):** the nit was fixed in this PR — the repo `CLAUDE.md` webhook line now names the canonical front + the constant module. Iterated and closed.