instar 1.3.625 → 1.3.627

package/dist/scaffold/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2hDR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2TR"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CA4hDR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2TR"}

package/dist/scaffold/templates.js

@@ -13,7 +13,7 @@
 // existing-agent migration there) so the two can never drift. Imported as a runtime
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
-import { PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 /**
  * Generate AGENT.md — the agent's identity file.
  */
@@ -807,6 +807,7 @@ I declare owner/blockedOn at commitment creation; a later state change goes thro
 - **The autonomous balancer surface** — \`GET /credentials/rebalancer\` (the use-it-or-lose-it drainer is Increment B; this surfaces the env-token applicability gate's verdict + WHY re-pointing would refuse, when enabled).
 - **When to use** (PROACTIVE — these are the triggers): "flip my default account to X" / "make X my default" → \`POST /credentials/set-default\`; "which account is this session/slot on?" / "where does ~/.claude point?" → \`GET /credentials/locations\` (read it, don't infer from \`claude auth status\` — that reads a metadata file, not the live credential). Single-account agents are a no-op. (Spec: \`docs/specs/live-credential-repointing-rebalancer.md\`.)
 ${PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION(port)}
+${MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION()}
 **Per-Feature LLM Metrics & LLM Activity (Observable Intelligence)** — Audit what each of your LLM-driven gates/sentinels actually does: WHICH provider + model ran it, how often it ACTED (fired) vs found nothing (noop), how often it was skipped to save rate limits (shed), cost, and latency. This is the *Observable Intelligence* standard — no autonomous AI action the system takes is allowed to be invisible. Read-only observability — it never gates anything.
 - Check: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/metrics/features?sinceHours=24"\`
 - Returns \`{ totals, features: [{ feature, frameworks, models, byModel, calls, realCalls, tokensIn, tokensOut, tokensCached, fired, noop, shed, fireRate, p50LatencyMs, p95LatencyMs, ... }] }\` — one row per system (e.g. MessagingToneGate, MessageSentinel). \`frameworks\`/\`models\` = which provider(s) actually served the call; \`fireRate\` = how often it acts; \`shed\` = skipped by the rate-limit guard. Filter with \`?feature=<name>\`.

package/dist/scaffold/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AACpF,mFAAmF;AACnF,4BAA4B;AAC5B,OAAO,EAAE,4CAA4C,EAAE,MAAM,+BAA+B,CAAC;AAS7F;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,KAAK,QAAQ,CAAC,IAAI;;;;OAIpB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;;;;EAIpC,QAAQ,CAAC,WAAW;;;;;;;;;;;;;;;;;;;;;;6BAsBO,QAAQ,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D7C,CAAC;AAEF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,WAAmB,EAAE,QAAgB;IACrF,OAAO;;;;;;;;;;;;;;;;;;EAkBP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkDH,QAAQ;;;;;CAKjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,KAAK,QAAQ;;;;;;;;;;;;;;4CAcsB,QAAQ;CACnD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,KAAK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK,EAC5B,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,kFAAkF,IAAI;;;;;;;;;;;;;8EAa5C,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;;;;;;;;;;;;;;;;;;;;;;;0CAuBjE,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;;;;;gCAY7B,IAAI;;;;;;;;;sFASkD,IAAI;4FACE,IAAI;;;;;;;mEAO7B,IAAI;+GACwC,IAAI;8EACrC,IAAI;;;;mEAIf,IAAI;4EACK,IAAI;;;;;;;sHAOsC,IAAI;+WACqP,IAAI;;;;;uEAK5S,IAAI;;;;;;;;;;;2EAWA,IAAI;mJACoE,IAAI;;;;;;uEAMhF,IAAI;;;;;;uFAMY,IAAI;;;;wEAInB,IAAI;;;;;;+IAMmE,IAAI;wKACqB,IAAI;;;;;iKAKX,IAAI;;;;;sEAK/F,IAAI;;;;;;;;;;;6EAWG,IAAI;;2FAEU,IAAI;qFACV,IAAI;;;;uHAI8B,IAAI;;;;;;;;;mGASxB,IAAI;;;;;;;;;;;gFAWvB,IAAI;;;;qJAIiE,IAAI;;;;;;yHAMhC,IAAI;8MACiF,IAAI;;;;0JAIxD,IAAI;qGACzD,IAAI;mHACU,IAAI;;;;;;8EAMzC,IAAI;;;;;;oGAMkB,IAAI;yGACC,IAAI;;;;;iFAK5B,IAAI;yIACoD,IAAI;6hBACgZ,IAAI;;;;;;;;;;;;;;mEAc9d,IAAI;;;8EAGO,IAAI;6EACL,IAAI;0EACP,IAAI;;;;;6EAKD,IAAI;yCACxC,IAAI;mEACsB,IAAI;4EACK,IAAI;+EACD,IAAI;;;;;2EAKR,IAAI;;;;;;;uFAOQ,IAAI;;;;;;2EAMhB,IAAI;+EACA,IAAI;;;;;;;6KAO0F,IAAI;qMACoB,IAAI,gMAAgM,IAAI;;;;;;uFAMtT,IAAI;mIACwC,IAAI;;;;;2GAK5B,IAAI;6EAClC,IAAI;+FACc,IAAI;;;;;;;;;;;;;;;;;;;uFAmBZ,IAAI;yFACF,IAAI;kIACqC,IAAI;;;;;;;gIAON,IAAI;sFAC9C,IAAI;0HACgC,IAAI;;;;oGAI1B,IAAI;oIAC4B,IAAI;;;;;;;;qEAQnE,IAAI;;;;;;;;4EAQG,IAAI;yEACP,IAAI;0GAC6B,IAAI;+EAC/B,IAAI;2XACwS,IAAI;;;;6EAIlT,IAAI;mJACkE,IAAI;6JACM,IAAI;sGAC3D,IAAI;;;;;;;;;;wbAU8U,IAAI;;;;qEAIvX,IAAI;wFACe,IAAI;2IAC+C,IAAI;;;0EAGrE,IAAI;6EACD,IAAI;oFACG,IAAI;;;;;;;;;8EASV,IAAI;sEACZ,IAAI;8EACI,IAAI;4EACN,IAAI;mFACG,IAAI;;;;oEAInB,IAAI;0EACE,IAAI;4EACF,IAAI;+EACD,IAAI;iFACF,IAAI;;;oEAGjB,IAAI;;;;+EAIO,IAAI;6EACN,IAAI;0EACP,IAAI;uFACS,IAAI;;wEAEnB,IAAI;;;;;2EAKD,IAAI;;;;;;oEAMX,IAAI;;;qEAGH,IAAI;sEACH,IAAI;mKACyF,IAAI;;;sEAGjG,IAAI;;;qEAGL,IAAI;;;8BAG3C,IAAI;;;;;4OAK0M,IAAI;;;;;;;;mFAQ7J,IAAI;;;;;uBAKhE,IAAI;;;wFAG6D,IAAI;;;;;;;;;;;;6EAYf,IAAI;sFACK,IAAI;8EACZ,IAAI;;;;;sEAKZ,IAAI;oEACN,IAAI;8EACM,IAAI;yFACO,IAAI;;;;;uFAKN,IAAI;;;;;oEAKvB,IAAI;;;;;uGAK+B,IAAI;;;;;;;;;;yIAU8B,IAAI;kHAC3B,IAAI;;;;EAIpH,4CAA4C,CAAC,IAAI,CAAC;;qEAEiB,IAAI;;;;;;;iRAOwM,IAAI;8NACvD,IAAI;;;;sEAI5J,IAAI;;;;;qEAKL,IAAI;;;;mFAIU,IAAI;;;;;;2FAMI,IAAI;;;;;;;wFAOP,IAAI;uFACL,IAAI;;;;4JAIiE,IAAI;;;;;;;8EAOlF,IAAI;;;;;;6EAML,IAAI;;;;;;oEAMb,IAAI;+GACuC,IAAI;gIACa,IAAI;;;;0FAI1C,IAAI;;;;uGAIS,IAAI;sGACL,IAAI;;;;qEAIrC,IAAI;;;;;;;;;qEASJ,IAAI;6EACI,IAAI;2EACN,IAAI;2EACJ,IAAI;kEACb,IAAI;;;;;0EAKI,IAAI;4FACc,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA4EvC,IAAI;;;;;;;;;;;;;;;;;;;;;;;8EAuBiB,IAAI;4HAC0C,IAAI;kKACkC,IAAI;uJACf,IAAI;;;6GAG9C,IAAI;2FACtB,IAAI;4HAC6B,IAAI;;;2FAGrC,IAAI;;kFAEb,IAAI;wFACE,IAAI;6FACC,IAAI;iJACgD,IAAI;wHAC7B,IAAI;uIACW,IAAI;;;;;;;;;;;;;;;;;;;;uFAoBpD,IAAI;wFACH,IAAI;;;wFAGJ,IAAI;;0FAEF,IAAI;+FACC,IAAI;sGACG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwG5F,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA6HmB,IAAI;;;;;;;;;;;mCAWX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;mEAwB4B,IAAI;;;;;mEAKJ,IAAI;;;;;mEAKJ,IAAI;;;;mEAIJ,IAAI;;;;;;yDAMd,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAiFc,IAAI;yEACN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsG5E,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bd,CAAC;IACA,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAqE0B,IAAI;sCACL,IAAI;;;;;;;;8EAQoC,IAAI;;;;;;wGAMsB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoC3G,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,qFAAqF,IAAI;;;;;;CAM5H,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;CAId,CAAC;IACA,CAAC;IAED,OAAO,IAAI;;;;;;;8EAOiE,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;yFAClB,IAAI;;;;;;0DAMnC,IAAI;;;;;;;;;;;;;;;;;;;;;;;2FAuB6B,IAAI;8FACD,IAAI;+MAC6G,IAAI;mGAChH,IAAI;;;mMAG4F,IAAI;;;;;0LAKb,IAAI;;;;4EAIlH,IAAI;+LAC+G,IAAI;;;;8DAIrI,IAAI;;;;;;;;;;;0CAWxB,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;0DAQH,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+GhD,SAAS;;;;;;;;;;;;sEAY+C,IAAI;;CAEzE,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AACpF,mFAAmF;AACnF,4BAA4B;AAC5B,OAAO,EAAE,4CAA4C,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AASvI;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,KAAK,QAAQ,CAAC,IAAI;;;;OAIpB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;;;;EAIpC,QAAQ,CAAC,WAAW;;;;;;;;;;;;;;;;;;;;;;6BAsBO,QAAQ,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D7C,CAAC;AAEF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,WAAmB,EAAE,QAAgB;IACrF,OAAO;;;;;;;;;;;;;;;;;;EAkBP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkDH,QAAQ;;;;;CAKjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,KAAK,QAAQ;;;;;;;;;;;;;;4CAcsB,QAAQ;CACnD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,KAAK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK,EAC5B,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,kFAAkF,IAAI;;;;;;;;;;;;;8EAa5C,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;;;;;;;;;;;;;;;;;;;;;;;0CAuBjE,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;;;;;gCAY7B,IAAI;;;;;;;;;sFASkD,IAAI;4FACE,IAAI;;;;;;;mEAO7B,IAAI;+GACwC,IAAI;8EACrC,IAAI;;;;mEAIf,IAAI;4EACK,IAAI;;;;;;;sHAOsC,IAAI;+WACqP,IAAI;;;;;uEAK5S,IAAI;;;;;;;;;;;2EAWA,IAAI;mJACoE,IAAI;;;;;;uEAMhF,IAAI;;;;;;uFAMY,IAAI;;;;wEAInB,IAAI;;;;;;+IAMmE,IAAI;wKACqB,IAAI;;;;;iKAKX,IAAI;;;;;sEAK/F,IAAI;;;;;;;;;;;6EAWG,IAAI;;2FAEU,IAAI;qFACV,IAAI;;;;uHAI8B,IAAI;;;;;;;;;mGASxB,IAAI;;;;;;;;;;;gFAWvB,IAAI;;;;qJAIiE,IAAI;;;;;;yHAMhC,IAAI;8MACiF,IAAI;;;;0JAIxD,IAAI;qGACzD,IAAI;mHACU,IAAI;;;;;;8EAMzC,IAAI;;;;;;oGAMkB,IAAI;yGACC,IAAI;;;;;iFAK5B,IAAI;yIACoD,IAAI;6hBACgZ,IAAI;;;;;;;;;;;;;;mEAc9d,IAAI;;;8EAGO,IAAI;6EACL,IAAI;0EACP,IAAI;;;;;6EAKD,IAAI;yCACxC,IAAI;mEACsB,IAAI;4EACK,IAAI;+EACD,IAAI;;;;;2EAKR,IAAI;;;;;;;uFAOQ,IAAI;;;;;;2EAMhB,IAAI;+EACA,IAAI;;;;;;;6KAO0F,IAAI;qMACoB,IAAI,gMAAgM,IAAI;;;;;;uFAMtT,IAAI;mIACwC,IAAI;;;;;2GAK5B,IAAI;6EAClC,IAAI;+FACc,IAAI;;;;;;;;;;;;;;;;;;;uFAmBZ,IAAI;yFACF,IAAI;kIACqC,IAAI;;;;;;;gIAON,IAAI;sFAC9C,IAAI;0HACgC,IAAI;;;;oGAI1B,IAAI;oIAC4B,IAAI;;;;;;;;qEAQnE,IAAI;;;;;;;;4EAQG,IAAI;yEACP,IAAI;0GAC6B,IAAI;+EAC/B,IAAI;2XACwS,IAAI;;;;6EAIlT,IAAI;mJACkE,IAAI;6JACM,IAAI;sGAC3D,IAAI;;;;;;;;;;wbAU8U,IAAI;;;;qEAIvX,IAAI;wFACe,IAAI;2IAC+C,IAAI;;;0EAGrE,IAAI;6EACD,IAAI;oFACG,IAAI;;;;;;;;;8EASV,IAAI;sEACZ,IAAI;8EACI,IAAI;4EACN,IAAI;mFACG,IAAI;;;;oEAInB,IAAI;0EACE,IAAI;4EACF,IAAI;+EACD,IAAI;iFACF,IAAI;;;oEAGjB,IAAI;;;;+EAIO,IAAI;6EACN,IAAI;0EACP,IAAI;uFACS,IAAI;;wEAEnB,IAAI;;;;;2EAKD,IAAI;;;;;;oEAMX,IAAI;;;qEAGH,IAAI;sEACH,IAAI;mKACyF,IAAI;;;sEAGjG,IAAI;;;qEAGL,IAAI;;;8BAG3C,IAAI;;;;;4OAK0M,IAAI;;;;;;;;mFAQ7J,IAAI;;;;;uBAKhE,IAAI;;;wFAG6D,IAAI;;;;;;;;;;;;6EAYf,IAAI;sFACK,IAAI;8EACZ,IAAI;;;;;sEAKZ,IAAI;oEACN,IAAI;8EACM,IAAI;yFACO,IAAI;;;;;uFAKN,IAAI;;;;;oEAKvB,IAAI;;;;;uGAK+B,IAAI;;;;;;;;;;yIAU8B,IAAI;kHAC3B,IAAI;;;;EAIpH,4CAA4C,CAAC,IAAI,CAAC;EAClD,wCAAwC,EAAE;;qEAEyB,IAAI;;;;;;;iRAOwM,IAAI;8NACvD,IAAI;;;;sEAI5J,IAAI;;;;;qEAKL,IAAI;;;;mFAIU,IAAI;;;;;;2FAMI,IAAI;;;;;;;wFAOP,IAAI;uFACL,IAAI;;;;4JAIiE,IAAI;;;;;;;8EAOlF,IAAI;;;;;;6EAML,IAAI;;;;;;oEAMb,IAAI;+GACuC,IAAI;gIACa,IAAI;;;;0FAI1C,IAAI;;;;uGAIS,IAAI;sGACL,IAAI;;;;qEAIrC,IAAI;;;;;;;;;qEASJ,IAAI;6EACI,IAAI;2EACN,IAAI;2EACJ,IAAI;kEACb,IAAI;;;;;0EAKI,IAAI;4FACc,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA4EvC,IAAI;;;;;;;;;;;;;;;;;;;;;;;8EAuBiB,IAAI;4HAC0C,IAAI;kKACkC,IAAI;uJACf,IAAI;;;6GAG9C,IAAI;2FACtB,IAAI;4HAC6B,IAAI;;;2FAGrC,IAAI;;kFAEb,IAAI;wFACE,IAAI;6FACC,IAAI;iJACgD,IAAI;wHAC7B,IAAI;uIACW,IAAI;;;;;;;;;;;;;;;;;;;;uFAoBpD,IAAI;wFACH,IAAI;;;wFAGJ,IAAI;;0FAEF,IAAI;+FACC,IAAI;sGACG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwG5F,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA6HmB,IAAI;;;;;;;;;;;mCAWX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;mEAwB4B,IAAI;;;;;mEAKJ,IAAI;;;;;mEAKJ,IAAI;;;;mEAIJ,IAAI;;;;;;yDAMd,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAiFc,IAAI;yEACN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsG5E,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bd,CAAC;IACA,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAqE0B,IAAI;sCACL,IAAI;;;;;;;;8EAQoC,IAAI;;;;;;wGAMsB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoC3G,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,qFAAqF,IAAI;;;;;;CAM5H,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;CAId,CAAC;IACA,CAAC;IAED,OAAO,IAAI;;;;;;;8EAOiE,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;yFAClB,IAAI;;;;;;0DAMnC,IAAI;;;;;;;;;;;;;;;;;;;;;;;2FAuB6B,IAAI;8FACD,IAAI;+MAC6G,IAAI;mGAChH,IAAI;;;mMAG4F,IAAI;;;;;0LAKb,IAAI;;;;4EAIlH,IAAI;+LAC+G,IAAI;;;;8DAIrI,IAAI;;;;;;;;;;;0CAWxB,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;0DAQH,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+GhD,SAAS;;;;;;;;;;;;sEAY+C,IAAI;;CAEzE,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.625",
+  "version": "1.3.627",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,13 +28,15 @@
     "test:contract": "node scripts/run-contract-tests.js",
     "test:contract:raw": "vitest run --config vitest.contract.config.ts",
     "test:all": "vitest run && vitest run --config vitest.integration.config.ts && vitest run --config vitest.e2e.config.ts",
-    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/check-codex-rule1-drift.js",
+    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js",
     "lint:destructive": "node scripts/lint-no-direct-destructive.js",
     "lint:dev-agent-dark-gate": "node scripts/lint-dev-agent-dark-gate.js",
     "lint:guard-manifest": "node scripts/lint-guard-manifest.js",
     "lint:dev-agent-dark-gate:staged": "node scripts/lint-dev-agent-dark-gate.js --staged",
     "lint:destructive:staged": "node scripts/lint-no-direct-destructive.js --staged",
     "lint:llm-http": "node scripts/lint-no-direct-llm-http.js",
+    "lint:scrape-realness": "node scripts/lint-scrape-fixture-realness.js",
+    "lint:scrape-realness:staged": "node scripts/lint-scrape-fixture-realness.js --staged",
     "lint:llm-attribution": "node scripts/lint-llm-attribution.js",
     "lint:llm-attribution:staged": "node scripts/lint-llm-attribution.js --staged",
     "lint:llm-http:staged": "node scripts/lint-no-direct-llm-http.js --staged",

package/scripts/lint-scrape-fixture-realness.js

@@ -0,0 +1,327 @@
+#!/usr/bin/env node
+/**
+ * lint-scrape-fixture-realness.js — enforces that every REGISTERED scrape/parser
+ * has a test that FEEDS it a structurally-real captured fixture and asserts on
+ * the result (not a hand-authored clean string).
+ *
+ * Implements piece 3 of docs/specs/scrape-fixture-realness.md (the "code=t"
+ * lesson, structurally enforced). A parser of untrusted real-world text is only
+ * as good as the realness of its test input. The check is precise by
+ * construction — a CURATED registry (SCRAPE_PARSERS), not a heuristic over all
+ * tests — so false-positives are near-zero (same posture as
+ * lint-no-direct-llm-http / lint-dev-agent-dark-gate). Adding/removing a registry
+ * entry requires a spec change.
+ *
+ * For each registered parser the lint verifies (spec §3):
+ *   (a) tests/fixtures/captured/<slug>/ has >=1 `.txt`, each with a valid matching
+ *       `.meta.json` (required fields present + capturedAt parses as ISO date).
+ *   (b) testFile contains a test whose name === testName, and within that test's
+ *       body ALL of: a loadCapturedFixture('<slug>', ...) call, the parserSymbol
+ *       called with the loaded var as an argument (member-expression accepted),
+ *       and an expect( call.
+ *
+ * It ALSO scans src/ for exported parse-prefixed / scrape-prefixed symbols not covered by the
+ * registry and prints a non-blocking WARNING ("register-or-justify") — a
+ * Close-the-Loop signal, never a block (Signal vs. Authority).
+ *
+ * Exit codes:
+ *   0 — every registered entry conforms (warnings do NOT affect exit code).
+ *   1 — at least one registered entry fails a sub-check.
+ *
+ * Usage:
+ *   node scripts/lint-scrape-fixture-realness.js                # full check
+ *   node scripts/lint-scrape-fixture-realness.js --staged       # staged files (still runs full registry check)
+ *   node scripts/lint-scrape-fixture-realness.js path1 path2    # explicit paths (still runs full registry check)
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.resolve(__dirname, '..');
+
+/**
+ * The curated registry of parsers whose realness is enforced. Each entry:
+ *   { parserSymbol, fixtureSlug, testFile, testName }
+ *
+ * Adding/removing an entry requires a spec change (FD1/FD3). The seed is the one
+ * parser we KNOW consumes untrusted terminal text and bit us (the code=t bug).
+ */
+export const SCRAPE_PARSERS = [
+  {
+    parserSymbol: 'FrameworkLoginDriver.parseArtifact',
+    fixtureSlug: 'claude-url-code-paste',
+    testFile: 'tests/unit/framework-login-driver.test.ts',
+    testName: 'parses the REAL wrapped Mac Mini login pane',
+  },
+];
+
+const REQUIRED_META_FIELDS = ['source', 'command', 'capturedAt', 'machine', 'redactions', 'note'];
+
+/**
+ * (a) — verify the captured-fixture directory + sidecars for a slug.
+ * @returns {string[]} list of failure messages (empty = ok)
+ */
+export function checkFixtures(root, fixtureSlug) {
+  const failures = [];
+  const dir = path.join(root, 'tests', 'fixtures', 'captured', fixtureSlug);
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+    failures.push(`fixture dir missing: tests/fixtures/captured/${fixtureSlug}/`);
+    return failures;
+  }
+  const entries = fs.readdirSync(dir);
+  const txts = entries.filter((f) => f.endsWith('.txt'));
+  if (txts.length === 0) {
+    failures.push(`no .txt captures in tests/fixtures/captured/${fixtureSlug}/`);
+    return failures;
+  }
+  for (const txt of txts) {
+    const base = txt.slice(0, -'.txt'.length);
+    const sidecar = `${base}.meta.json`;
+    const sidecarPath = path.join(dir, sidecar);
+    if (!fs.existsSync(sidecarPath)) {
+      failures.push(`missing sidecar ${fixtureSlug}/${sidecar} for capture ${fixtureSlug}/${txt}`);
+      continue;
+    }
+    let meta;
+    try {
+      meta = JSON.parse(fs.readFileSync(sidecarPath, 'utf-8'));
+    } catch (err) {
+      failures.push(`sidecar ${fixtureSlug}/${sidecar} is not valid JSON: ${err.message}`);
+      continue;
+    }
+    for (const field of REQUIRED_META_FIELDS) {
+      if (!(field in meta)) {
+        failures.push(`sidecar ${fixtureSlug}/${sidecar} missing required field "${field}"`);
+      }
+    }
+    if (meta.capturedAt !== undefined) {
+      const t = Date.parse(meta.capturedAt);
+      if (Number.isNaN(t)) {
+        failures.push(`sidecar ${fixtureSlug}/${sidecar} capturedAt "${meta.capturedAt}" is not a parseable ISO-8601 date`);
+      }
+    }
+  }
+  return failures;
+}
+
+/**
+ * Extract the body text of an `it('<name>', ...)` / `test('<name>', ...)` block
+ * by matching the opening and walking braces to the matching close. Returns null
+ * if no test with that exact name is found.
+ */
+export function extractTestBody(source, testName) {
+  // Find an it/test call whose first string-literal arg === testName.
+  // Match the literal (single, double, or backtick quotes) followed by a comma.
+  const escaped = testName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const opener = new RegExp(`\\b(?:it|test)\\s*\\(\\s*(['"\`])${escaped}\\1\\s*,`, 'g');
+  const m = opener.exec(source);
+  if (!m) return null;
+  // Walk forward from the end of the matched opener to find the body's braces.
+  // The test body is the arrow/function passed as the 2nd arg; find its first
+  // `{` after the opener and brace-match to its close.
+  let i = opener.lastIndex;
+  // Skip ahead to the first `{` that starts the callback body.
+  const braceStart = source.indexOf('{', i);
+  if (braceStart < 0) return null;
+  let depth = 0;
+  for (let j = braceStart; j < source.length; j++) {
+    const ch = source[j];
+    if (ch === '{') depth++;
+    else if (ch === '}') {
+      depth--;
+      if (depth === 0) {
+        return source.slice(braceStart + 1, j);
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * (b) — verify the registered test exists and feeds-and-asserts.
+ * @returns {string[]} list of failure messages (empty = ok)
+ */
+export function checkTest(root, entry) {
+  const failures = [];
+  const testPath = path.join(root, entry.testFile);
+  if (!fs.existsSync(testPath)) {
+    failures.push(`testFile missing: ${entry.testFile}`);
+    return failures;
+  }
+  const source = fs.readFileSync(testPath, 'utf-8');
+  const body = extractTestBody(source, entry.testName);
+  if (body === null) {
+    failures.push(`no test named "${entry.testName}" found in ${entry.testFile}`);
+    return failures;
+  }
+
+  // The loader call, capturing the variable it assigns to.
+  // const <v> = loadCapturedFixture('<slug>', ...)
+  const slugEsc = entry.fixtureSlug.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const loaderRe = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*loadCapturedFixture\\s*\\(\\s*['"\`]${slugEsc}['"\`]`,
+  );
+  const loaderMatch = body.match(loaderRe);
+  if (!loaderMatch) {
+    failures.push(
+      `test "${entry.testName}" must call loadCapturedFixture('${entry.fixtureSlug}', …) and assign the result to a variable`,
+    );
+  }
+  const loadedVar = loaderMatch ? loaderMatch[1] : null;
+
+  // The parser call, fed the loaded variable as an argument.
+  // Accept member-expression (Cls.method) or bare/aliased call.
+  // parserSymbol may be "Cls.method" — escape dots literally.
+  const parserEsc = entry.parserSymbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  let parserFed = false;
+  if (loadedVar) {
+    const varEsc = loadedVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // <parserSymbol>( ... <loadedVar> ... ) — loadedVar appears as an arg.
+    const parserRe = new RegExp(`${parserEsc}\\s*\\(\\s*${varEsc}\\b`);
+    parserFed = parserRe.test(body);
+  }
+  if (!parserFed) {
+    failures.push(
+      `test "${entry.testName}" must pass the loaded fixture variable as the first argument to ${entry.parserSymbol}(…)`,
+    );
+  }
+
+  // At least one expect( on the result.
+  if (!/\bexpect\s*\(/.test(body)) {
+    failures.push(`test "${entry.testName}" must assert on the parse result with expect(…)`);
+  }
+
+  return failures;
+}
+
+/** Recursively collect `.ts` files under a dir. */
+function walkTs(dir, out, skip) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (skip.has(e.name)) continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) walkTs(full, out, skip);
+    else if (e.name.endsWith('.ts') && !e.name.endsWith('.d.ts')) out.push(full);
+  }
+}
+
+/**
+ * Close-the-Loop signal: scan src/ for exported parse-prefixed / scrape-prefixed symbols not in
+ * the registry. Non-blocking — returns a warning list only.
+ * @returns {Array<{symbol:string,file:string}>}
+ */
+export function findUnregisteredParsers(root) {
+  const skip = new Set(['node_modules', 'dist', 'build', '.instar', '.git', '.next', 'coverage']);
+  const files = [];
+  const srcDir = path.join(root, 'src');
+  if (fs.existsSync(srcDir)) walkTs(srcDir, files, skip);
+
+  // The bare method names already covered by the registry (e.g. "parseArtifact").
+  const registeredMethodNames = new Set(
+    SCRAPE_PARSERS.map((e) => {
+      const parts = e.parserSymbol.split('.');
+      return parts[parts.length - 1];
+    }),
+  );
+
+  const re = /export\s+(?:async\s+)?function\s+((?:parse|scrape)[A-Z]\w*)|export\s+const\s+((?:parse|scrape)[A-Z]\w*)/g;
+  const found = [];
+  const seen = new Set();
+  for (const file of files) {
+    let text;
+    try {
+      text = fs.readFileSync(file, 'utf-8');
+    } catch {
+      continue;
+    }
+    let m;
+    re.lastIndex = 0;
+    while ((m = re.exec(text)) !== null) {
+      const symbol = m[1] || m[2];
+      if (!symbol) continue;
+      if (registeredMethodNames.has(symbol)) continue;
+      const rel = path.relative(root, file).split(path.sep).join('/');
+      const key = `${rel}:${symbol}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      found.push({ symbol, file: rel });
+    }
+  }
+  return found;
+}
+
+/**
+ * Run the full lint over the registry. Pure-ish (reads fs, returns a result).
+ * @returns {{ exitCode:number, errors:string[], warnings:string[], passed:Array }}
+ */
+export function runLint(root = ROOT) {
+  const errors = [];
+  const passed = [];
+  for (const entry of SCRAPE_PARSERS) {
+    const failures = [...checkFixtures(root, entry.fixtureSlug), ...checkTest(root, entry)];
+    if (failures.length > 0) {
+      errors.push(
+        `Registered parser "${entry.parserSymbol}" (${entry.testFile}) failed realness check:\n` +
+          failures.map((f) => `      - ${f}`).join('\n'),
+      );
+    } else {
+      passed.push(entry);
+    }
+  }
+
+  const unregistered = findUnregisteredParsers(root);
+  const warnings = [];
+  if (unregistered.length > 0) {
+    warnings.push(
+      `register-or-justify: ${unregistered.length} exported parse*/scrape* symbol(s) in src/ are not in SCRAPE_PARSERS.\n` +
+        `      If they consume untrusted real-world text, register them (spec change) or justify out-of-scope in the PR:\n` +
+        unregistered.slice(0, 20).map((u) => `        • ${u.symbol} (${u.file})`).join('\n') +
+        (unregistered.length > 20 ? `\n        • ...and ${unregistered.length - 20} more` : ''),
+    );
+  }
+
+  return { exitCode: errors.length > 0 ? 1 : 0, errors, warnings, passed };
+}
+
+function main() {
+  // --staged / explicit paths are accepted for parity with sibling lints, but
+  // the realness check is over the curated registry, so it always runs the full
+  // registry check regardless of which files changed.
+  const { exitCode, errors, warnings, passed } = runLint(ROOT);
+
+  if (errors.length > 0) {
+    console.error('lint-scrape-fixture-realness: registered parser(s) failed realness enforcement.\n');
+    console.error('A registered scrape/parser must have a test that FEEDS it a structurally-real captured');
+    console.error('fixture and asserts on the result. See docs/specs/scrape-fixture-realness.md.\n');
+    for (const e of errors) console.error(`  ❌ ${e}`);
+    console.error('');
+  } else {
+    for (const e of passed) {
+      console.log(`  ✅ ${e.parserSymbol} — realness fixture + feeds-and-asserts test OK (${e.testName})`);
+    }
+  }
+
+  if (warnings.length > 0) {
+    for (const w of warnings) console.warn(`  ⚠️  ${w}`);
+    console.warn('');
+  }
+
+  process.exit(exitCode);
+}
+
+const isDirectRun = (() => {
+  try {
+    return process.argv[1] && path.resolve(process.argv[1]) === __filename;
+  } catch {
+    return false;
+  }
+})();
+if (isDirectRun) main();

package/scripts/pre-push-gate.js

@@ -428,6 +428,12 @@ try {
   warnings.push(`lint-no-direct-llm-http failed to run: ${err.message}`);
 }
 
+// (The scrape-fixture-realness lint is enforced via the `npm run lint` chain in
+// package.json, which CI runs — not duplicated here. A direct gate invocation
+// would run against this gate's resolved ROOT, which is a scratch dir under the
+// gate's own unit tests, where the registered fixtures don't exist; the chain in
+// `npm run lint` runs in the real repo and is the authoritative enforcement.)
+
 // ── 6. URL.pathname filesystem guard ──────────────────────────────────
 // new URL(..., import.meta.url).pathname preserves %20-encoded spaces,
 // breaking filesystem operations. Use __dirname (via fileURLToPath) instead.

package/scripts/redact-captured-fixture.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * redact-captured-fixture.mjs — same-SHAPE, grammar-valid secret redaction for
+ * captured parser fixtures.
+ *
+ * Captured fixtures (tests/fixtures/captured/<slug>/) preserve every STRUCTURAL
+ * byte that matters to parsing (wrapping/ANSI/spacing/line-breaks) — those are
+ * the realness and are NEVER tidied. But a real capture carries secrets (OAuth
+ * client_id/state, tokens, usernames, paths). Committing them raw is a leak, so
+ * each secret VALUE is replaced with a same-SHAPE placeholder:
+ *
+ *   - SAME LENGTH (so line positions + wrapping stay byte-identical),
+ *   - SAME CHARACTER CLASS (hex stays hex, base64url stays base64url, …),
+ *   - delimiters preserved AT THEIR POSITIONS (a UUID keeps its `-` offsets),
+ *   - GRAMMAR-VALID (a redacted URL still parses; encoding form intact).
+ *
+ * A redaction that would change length is REJECTED — a length change shifts the
+ * wrapping and silently produces a passing-but-fake fixture.
+ *
+ * See docs/specs/scrape-fixture-realness.md (FD2) and
+ * tests/fixtures/captured/README.md.
+ *
+ * Usage (CLI):
+ *   node scripts/redact-captured-fixture.mjs <raw.txt> \
+ *     --redact '<find>:<class>' [--redact '<find>:<class>' ...] [-o out.txt]
+ *
+ *   <class> ∈ hex | uuid | base64url | alnum | token
+ *
+ * Programmatic:
+ *   import { redactCapture } from './redact-captured-fixture.mjs';
+ *   const { redacted, redactions } = redactCapture(raw, [{ find, class }]);
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// The supported redaction classes. Adding a class requires a spec change
+// (it widens the same-shape contract).
+export const REDACTION_CLASSES = new Set(['hex', 'uuid', 'base64url', 'alnum', 'token']);
+
+// Per-class placeholder fill characters. The fill is a single canonical char of
+// the class so the result is obviously inert (not a plausible real secret),
+// while staying in the class so the parser's grammar is preserved.
+const CLASS_FILL = {
+  hex: 'a', // [0-9a-f]
+  uuid: 'a', // hex within UUID segments; hyphens are preserved positionally
+  base64url: 'z', // [A-Za-z0-9_-]
+  alnum: 'x', // [A-Za-z0-9]
+  token: 'x', // generic opaque token — treated like alnum for the fill
+};
+
+// Characters that are DELIMITERS within a value of a given class — preserved at
+// their exact positions so the value's internal structure (and thus length +
+// grammar) is unchanged. Everything else is replaced with the class fill char.
+const CLASS_DELIMITERS = {
+  hex: new Set([]),
+  uuid: new Set(['-']),
+  base64url: new Set(['-', '_']),
+  alnum: new Set([]),
+  token: new Set(['-', '_', '.']),
+};
+
+/**
+ * Build a same-length, same-class, grammar-valid placeholder for a secret value.
+ * Delimiter characters for the class are preserved at their positions.
+ */
+function placeholderFor(value, cls) {
+  const fill = CLASS_FILL[cls];
+  const delims = CLASS_DELIMITERS[cls];
+  let out = '';
+  for (const ch of value) {
+    out += delims.has(ch) ? ch : fill;
+  }
+  return out;
+}
+
+/**
+ * Redact secrets from a raw capture, producing a same-shape result.
+ *
+ * @param {string} raw    the raw captured text (structural bytes preserved)
+ * @param {Array<{find:string, class:string}>} specs  secrets to redact
+ * @returns {{ redacted: string, redactions: Array<{what:string,strategy:string,length:number,class:string}> }}
+ * @throws if a class is unknown, a `find` is missing from `raw`, or a
+ *         placeholder would change length (it never should — this is a guard).
+ */
+export function redactCapture(raw, specs) {
+  if (typeof raw !== 'string') throw new Error('redactCapture: raw must be a string');
+  if (!Array.isArray(specs)) throw new Error('redactCapture: specs must be an array');
+
+  let redacted = raw;
+  const redactions = [];
+
+  for (const spec of specs) {
+    const { find } = spec;
+    const cls = spec.class;
+    if (typeof find !== 'string' || find.length === 0) {
+      throw new Error('redactCapture: each spec needs a non-empty `find` string');
+    }
+    if (!REDACTION_CLASSES.has(cls)) {
+      throw new Error(
+        `redactCapture: unknown class "${cls}" for find "${find}" — must be one of ${[...REDACTION_CLASSES].join(', ')}`,
+      );
+    }
+    if (!redacted.includes(find)) {
+      throw new Error(`redactCapture: secret to redact not found in capture: "${find}"`);
+    }
+
+    const placeholder = placeholderFor(find, cls);
+    // Length-preservation guard: the whole point is byte-identical wrapping.
+    if (placeholder.length !== find.length) {
+      throw new Error(
+        `redactCapture: placeholder length ${placeholder.length} != original length ${find.length} ` +
+          `for class "${cls}" — a length-changing redaction shifts wrapping and is rejected.`,
+      );
+    }
+
+    redacted = redacted.split(find).join(placeholder);
+    redactions.push({
+      what: find,
+      strategy: `same-length ${find.length} ${cls}-class placeholder, delimiters preserved at positions`,
+      length: find.length,
+      class: cls,
+    });
+  }
+
+  return { redacted, redactions };
+}
+
+// ── thin CLI wrapper ──────────────────────────────────────────────────
+function parseArgs(argv) {
+  const specs = [];
+  let input = null;
+  let out = null;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--redact') {
+      const v = argv[++i];
+      const idx = v.lastIndexOf(':');
+      if (idx < 0) throw new Error(`--redact expects '<find>:<class>', got "${v}"`);
+      specs.push({ find: v.slice(0, idx), class: v.slice(idx + 1) });
+    } else if (a === '-o' || a === '--out') {
+      out = argv[++i];
+    } else if (!input) {
+      input = a;
+    }
+  }
+  return { input, out, specs };
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  if (argv.length === 0 || argv.includes('--help') || argv.includes('-h')) {
+    console.log(
+      'Usage: node scripts/redact-captured-fixture.mjs <raw.txt> --redact \'<find>:<class>\' [...] [-o out.txt]\n' +
+        `  <class> ∈ ${[...REDACTION_CLASSES].join(' | ')}`,
+    );
+    process.exit(argv.length === 0 ? 1 : 0);
+  }
+  const { input, out, specs } = parseArgs(argv);
+  const raw = fs.readFileSync(input, 'utf-8');
+  const { redacted, redactions } = redactCapture(raw, specs);
+  if (out) {
+    fs.writeFileSync(out, redacted);
+    console.error(`Wrote redacted capture to ${out}`);
+  } else {
+    process.stdout.write(redacted);
+  }
+  console.error(`Redactions (${redactions.length}):`);
+  for (const r of redactions) {
+    console.error(`  - ${r.class} (len ${r.length}): ${r.strategy}`);
+  }
+}
+
+const isDirectRun = (() => {
+  try {
+    return process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
+if (isDirectRun) main();