instar 1.3.670 → 1.3.672

package/dist/server/routes.js

@@ -34,6 +34,8 @@ import { PlaywrightProfileRegistry, PlaywrightRegistryError, PlaywrightRegistryC
 import { writeConfigAtomic, readSelfKnowledgeFlags } from '../core/BootSelfKnowledge.js';
 import { rateLimiter, signViewPath, OUTBOUND_GATE_REVIEW_BUDGET_MS } from './middleware.js';
 import { reviewWithinBudget } from './outboundGateBudget.js';
+import { resolveToneRecipientClass } from './toneRecipientClass.js';
+import { buildDegradedToneResult } from '../core/MessagingToneGate.js';
 import { writeLifelineRestartSignal } from '../core/version-skew.js';
 import { readSessionClocks } from '../core/SessionClockReader.js';
 import { P13_PROTOCOL_VERSION } from '../core/CompletionEvaluator.js';
@@ -965,6 +967,31 @@ export function createRoutes(ctx) {
                 // clock-read error must never block an outbound message.
                 agentState = undefined;
             }
+            // operator-channel-sacred (outbound, spec: outbound-gate-tiered-fail-direction):
+            // resolve the recipient class STRUCTURALLY (verified operator binding +
+            // single-human-operator), and decide whether an availability failure should
+            // DELIVER (operator's own channel, 'tiered' mode, not dryRun) vs HOLD.
+            const recipientClass = resolveToneRecipientClass(ctx.topicOperatorStore, options.topicId);
+            const _toneCfg = ctx.config.messaging?.toneGate;
+            const _toneMode = _toneCfg?.failClosedMode ?? (_toneCfg?.failClosedOnExhaustion === false ? 'never' : 'always');
+            const operatorTierDeliver = _toneMode === 'tiered' && recipientClass === 'operator' && _toneCfg?.toneTierDryRun !== true;
+            // §Design 6 + tone-gate-graceful-degradation F4. The slow-review timeout is
+            // the SLOW manifestation of the same rate-limit outage as a provider throw,
+            // so it mirrors `review()`'s disposition. Precedence (highest first):
+            //   - operator-tier deliver (operator's own channel, 'tiered', not dryRun) → fail-OPEN, tagged
+            //   - per-call opt-out (automated/fixed-template send) → fail-OPEN (stay available)
+            //   - failClosedOnExhaustion:false (operator kill-switch) → fail-OPEN
+            //   - failClosedOnExhaustion:true  (operator strict)      → pure-HOLD (GATE_TIMEOUT)
+            //   - default (unset)                                     → DEGRADE to the
+            //     deterministic leak floor (clean SENDS, leak HOLDS) — closes the F4 gap
+            //     for the slow path, not just the fast throw.
+            const perCallAllowsClosed = options.failClosedOnBudgetTimeout ?? true;
+            const globalFailClosed = _toneCfg?.failClosedOnExhaustion;
+            // Operator-tier delivery suppresses both fail-closed and degrade (we want OPEN).
+            const budgetFailClosed = !operatorTierDeliver && perCallAllowsClosed && globalFailClosed !== false;
+            const budgetDegrade = budgetFailClosed && globalFailClosed !== true
+                ? (latencyMs) => buildDegradedToneResult(text, latencyMs, 'budget-timeout')
+                : undefined;
             const result = await reviewWithinBudget(ctx.messagingToneGate.review(text, {
                 channel,
                 recentMessages,
@@ -972,16 +999,15 @@ export function createRoutes(ctx) {
                 targetStyle: ctx.config.messagingStyle,
                 messageKind: options.messageKind,
                 agentState,
+                recipientClass,
             }), gateBudgetMs, undefined, undefined, 
-            // §Design 6: the slow-review timeout fails CLOSED by default (the safe
-            // direction). Two independent ways to fail OPEN instead: (a) the per-call
-            // opt-out — an automated/fixed-template send (post-update) that must stay
-            // available passes failClosedOnBudgetTimeout:false; (b) the global operator
-            // kill-switch messaging.toneGate.failClosedOnExhaustion:false (reverts every
-            // path live, no deploy). Both must allow fail-closed for it to engage.
-            ((options.failClosedOnBudgetTimeout ?? true) &&
-                (ctx.config.messaging?.toneGate
-                    ?.failClosedOnExhaustion) !== false));
+            // §Design 6 + F4: the slow-review timeout disposition mirrors review()'s.
+            // `budgetFailClosed` already folds in (a) the per-call opt-out, (b) the
+            // global kill-switch, and (c) operator-tier delivery (which suppresses
+            // fail-closed so the operator is never sealed out under load). When the
+            // disposition is the default (config unset), `budgetDegrade` is defined and
+            // takes precedence in reviewWithinBudget — degrading to the leak floor.
+            budgetFailClosed, operatorTierDeliver, budgetDegrade);
             // Structured observability: log every decision the authority made. This is
             // the "why I blocked" log — over-block audits read this. Invalid-rule
             // citations (authority drift) and budgetExceeded fail-opens are logged so
@@ -1343,6 +1369,10 @@ export function createRoutes(ctx) {
                 failedOpen: entry.result.failedOpen || false,
                 invalidRule: entry.result.invalidRule || false,
                 budgetExceeded: entry.result.budgetExceeded || false,
+                // operator-channel-sacred (outbound): surface the deliver-on-availability-
+                // failure so it is AUDITED, never silent (the No-Silent-Degradation
+                // reconciliation rests on this being observable).
+                failedOpenOperatorChannel: entry.result.failedOpenOperatorChannel || false,
                 latencyMs: entry.result.latencyMs,
                 signals: {
                     junk: entry.signals.junk?.detected ?? null,