instar 1.3.601 → 1.3.602

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.601",
+  "version": "1.3.602",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-16T15:30:58.206Z",
-  "instarVersion": "1.3.601",
+  "generatedAt": "2026-06-16T15:34:53.056Z",
+  "instarVersion": "1.3.602",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ef1ab9fcdf7735731e3dd43cdb89ef2211c7ad6755311d1989ac1013da201f46",
+      "contentHash": "83fa33dd80fa2c8b948a557008e2c265fbc7570fc36852b899eda8a503ea3736",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/{1.3.601.md → 1.3.602.md}

@@ -16,11 +16,47 @@ A new PreToolUse Bash hook (`pr-hand-lease-guard.js`) runs before any `git push`
 
 Ships **dark + dryRun-first**, dev-gated (`monitoring.prHandLease`, developmentAgent-only). In dryRun the full decision loop runs and audits every would-deny to `logs/pr-lease-decisions.jsonl`, but NO push is ever blocked until a deliberate `dryRun:false`. Single-session agents are a strict no-op. v1 is machine-local (cross-machine coordination is a tracked follow-up).
 
+The gold-standard live-test harness can now drive a REAL Slack channel as a REAL
+workspace member. Previously the harness's multi-machine capstone route
+(`POST /live-test/multi-machine-capstone`) built its Slack sender with
+`new SlackApiClient(demoSlackUserToken)`, which only knows how to authenticate
+with a Bearer token (`xoxp`/`xoxb`). But the only DISTINCT non-Echo Slack
+senders captured in the demo workspace are real test-USER identities
+authenticated the browser way — an `xoxc-…` web-client token plus the user's
+`d` session cookie. Those are not Bearer tokens, so the harness could never post
+AS a real member, which defeats the whole point of the standard (drive real
+channels as a real user).
+
+A new `LiveTestSlackCaller` credential adapter (implementing the same
+`SlackCaller` seam `SlackLiveSender` already consumes) closes the gap. It routes
+per method: `chat.postMessage` posts AS THE MEMBER via Slack web-client auth
+(`xoxc` token in the form body + the `d` cookie in a `Cookie: d=…` header,
+against the workspace host), while every other method (e.g.
+`conversations.history`) reads over Echo's own clean Bearer bot token at
+`slack.com`. The capstone route detects an `xoxc-` sender by prefix and wires
+the new adapter; a plain Bearer sender keeps the original `SlackApiClient` path.
+Two new config keys — `liveTest.demo.slackUserCookie` and
+`liveTest.demo.slackWorkspaceHost` — supply the cookie + host alongside the
+existing `slackUserToken`. The fail-closed `blockedSurfaces` behavior is intact:
+a missing cookie/host/bot-token records a loud blocked-surface (a real
+driver-error FAIL), never a fabricated reply.
+
+This is dark harness/developer infrastructure — it only runs inside the
+dev-gated live-test runner, never on the fleet runtime path, and changes no
+user-facing behavior.
+
 ## What to Tell Your User
 
 - "Nothing changes for you right now — this is internal dev-cycle infrastructure, off by default everywhere and in dry-run (observe-only) even on the development agent."
 - "Once enabled, if two of my own sessions ever try to push to the same branch at once, one quietly waits instead of starting a tug-of-war — so PRs stop getting thrashed by my own parallel work. You'd only notice it as *fewer* stuck merges."
 
+Nothing user-facing changes. This is internal developer test-harness plumbing:
+it lets the live-test runner post into a Slack channel as a genuine distinct
+member (via captured web-client credentials) instead of being limited to Bearer
+tokens, so the harness can actually exercise the real Slack surface end-to-end
+before any user does. If your agent isn't a development/instar-dev agent running
+the live-test capstone, you will never see this code execute.
+
 ## Summary of New Capabilities
 
 | Capability | How to Use |
@@ -29,6 +65,19 @@ Ships **dark + dryRun-first**, dev-gated (`monitoring.prHandLease`, developmentA
 | "Who owns this branch's lease?" | `GET /pr-leases` (Bearer-auth) → per-branch holder topic + derived liveness |
 | Decision audit | `logs/pr-lease-decisions.jsonl` (every acquire / renew / yield / auto-heal / release) |
 
+- `LiveTestSlackCaller` (`src/core/LiveTestSlackCaller.ts`) — a `SlackCaller`
+  adapter that posts `chat.postMessage` AS a real workspace member using an
+  `xoxc` web-client token + the member's `d` session cookie, and reads all other
+  methods over a Bearer bot token. Pure transport over an injectable `fetch`
+  (unit-testable).
+- The multi-machine capstone route (`POST /live-test/multi-machine-capstone`)
+  now wires `LiveTestSlackCaller` when the demo Slack sender is an `xoxc` token
+  (detected by prefix) and the `d` cookie + workspace host + bot token are
+  configured; otherwise it keeps the original Bearer `SlackApiClient` path.
+- New config keys `liveTest.demo.slackUserCookie` and
+  `liveTest.demo.slackWorkspaceHost` (read alongside the existing
+  `liveTest.demo.slackUserToken`).
+
 ## Evidence
 
 - **Unit** (`tests/unit/pr-hand-lease.test.ts`, 20 passing): `canonicalPushKey` over every refspec variant (explicit / `HEAD:` / `cd &&` / env-prefix / `--delete` / tag); respawn-survival (same-topic, new session → own-topic allow); live-foreign deny; dead→stale; foreign-machine-never-falsely-dead; live-holder-past-ceiling escalate; two-healers CAS race (exactly one wins, loser yields); dryRun ignored; corrupt-state → fail-open + recurrence-attention; tombstone passthrough; derived liveness.

package/upgrades/side-effects/xoxc-slack-caller.md

@@ -0,0 +1,99 @@
+# Side-Effects Review — LiveTestSlackCaller (xoxc web-client Slack sender for the live-test harness)
+
+**Version / slug:** `xoxc-slack-caller`
+**Date:** `2026-06-16`
+**Author:** Echo (autonomous)
+**Second-pass reviewer:** not-required (Tier 2; dev-gated test-harness-only surface, no fleet runtime path)
+
+## Summary of the change
+
+The gold-standard live-test harness's multi-machine capstone route
+(`POST /live-test/multi-machine-capstone`) constructs its Slack demo sender with
+`new SlackApiClient(demoSlackUserToken)` — a Bearer-only transport. The only
+DISTINCT non-Echo Slack senders we have captured for the demo workspace are real
+test-USER identities authenticated as a browser is: an `xoxc-…` web-client token
++ the user's `d` session cookie. These are valid (verified via `auth.test`) but
+are NOT Bearer tokens, so the route's Slack arm could not actually post AS a real
+member — defeating the standard's purpose (drive REAL channels as a real user).
+
+Files added:
+- `src/core/LiveTestSlackCaller.ts` — a `SlackCaller` adapter (the seam
+  `SlackLiveSender` already consumes). `chat.postMessage` → posts AS the member
+  via xoxc-in-body + `d` cookie header against the workspace host; every other
+  method → Bearer bot token at `slack.com`. Pure transport over an injectable
+  `fetch`.
+- `tests/unit/LiveTestSlackCaller.test.ts` — fake-fetch unit tests asserting the
+  two transports, undefined-param skipping, and loud constructor validation.
+- `upgrades/next/xoxc-slack-caller.md` — release fragment.
+
+Files modified:
+- `src/server/routes.ts` — the capstone route's Slack branch: detect an `xoxc-`
+  sender by prefix; when so (and the `d` cookie + workspace host + a Slack bot
+  token are configured) wire `SlackLiveSender({ api: new LiveTestSlackCaller(...) })`;
+  otherwise keep the existing Bearer `SlackApiClient` path. Adds config keys
+  `liveTest.demo.slackUserCookie` + `liveTest.demo.slackWorkspaceHost` to the
+  read-type and reads Echo's own bot token from `ctx.config.messaging` (slack)
+  for the history reads.
+
+## Decision-point inventory
+
+- **Added**: `src/core/LiveTestSlackCaller.ts` `call()` method-routing branch —
+  routes `chat.postMessage` to the member (web-client) transport vs everything
+  else to the Bearer bot transport. A *transport-selection* decision, not a
+  message-flow gate.
+- **Modified**: `src/server/routes.ts` capstone Slack branch — a new
+  `isXoxcSender` discriminator selects which sender to build. Fail-closed:
+  missing cookie/host/bot-token records a loud `blockedSurfaces` entry (a real
+  driver-error FAIL), never a fabricated reply or a silent fallback.
+
+No agent-to-user message-flow decision points are added. This is developer
+test-harness infrastructure behind the dev-gated live-test runner.
+
+## Roll-up across the seven review dimensions
+
+1. **Over-block**: none. The change only adds a new credential path; the
+   pre-existing Bearer path is preserved verbatim for non-xoxc tokens. A missing
+   credential records the same kind of loud blocked-surface the route already
+   used.
+2. **Under-block**: none. No gate was loosened. The xoxc path still requires the
+   `d` cookie + workspace host + a bot token; absence is recorded as a FAIL, not
+   waved through.
+3. **Level-of-abstraction fit**: correct. The credential mechanics live in a
+   dedicated adapter implementing the existing `SlackCaller` seam — the same
+   seam `SlackLiveSender` already depends on — so `SlackLiveSender` is unchanged
+   and the transport detail is isolated and unit-testable.
+4. **Signal-vs-authority compliance**: N/A to message flow. The only decision is
+   transport selection + a fail-closed blocked-surface record; no message is
+   blocked, delayed, or rewritten. No silent try/catch (inline guards throw
+   loudly) — complies with the no-silent-fallbacks ratchet.
+5. **Interactions**: the route now reads Echo's own Slack bot token from
+   `ctx.config.messaging` for history reads. This is read-only config access
+   already used elsewhere in the same file (precedent at the channel-invite
+   path). No new mutation, no shared state.
+6. **External surfaces**: a new outbound HTTP path to `https://<workspaceHost>/api/chat.postMessage`
+   carrying an `xoxc` token + a `d` cookie — but ONLY when an operator has
+   configured those demo creds and the dev-gated live-test runner is invoked.
+   The xoxc token + cookie are credentials of a throwaway demo test user, never
+   the operator's, and never logged (the adapter logs only `ok`/`ts`). No change
+   to any fleet runtime path.
+7. **Rollback cost**: low. Single revertable commit; the new file is additive;
+   the route change is a guarded branch that falls back to the prior Bearer path
+   when the xoxc discriminator is false. No persistent state.
+
+## Credential-handling note
+
+The adapter handles two secrets: the member `xoxc` token (form body) and the
+`d` session cookie (Cookie header). Both belong to a throwaway demo workspace
+test user, are supplied via `liveTest.demo.*` config, and are never written to
+logs — the adapter's logger emits only `ok` and `ts`. The Bearer history-read
+token is Echo's own bot token, already present in `ctx.config.messaging`.
+
+## Evidence pointers
+
+- `npx tsc --noEmit` — clean.
+- `npx vitest run tests/unit/LiveTestSlackCaller.test.ts` — 4/4 pass (asserts
+  xoxc-in-body + cookie + NOT-Bearer for postMessage; Bearer-bot for history;
+  undefined-param skip; loud constructor validation).
+- Ratchets green: `tests/unit/no-silent-fallbacks.test.ts`,
+  `tests/unit/CapabilityIndex.test.ts`,
+  `tests/unit/feature-delivery-completeness.test.ts`.