instar 1.3.677 → 1.3.678

package/dist/core/internalFrameworkDefault.d.ts

@@ -28,6 +28,23 @@ import type { ComponentFrameworksConfig } from './IntelligenceRouter.js';
  * entry against the real `IntelligenceFramework` enum so an unknown name never ships.
  */
 export declare const INTERNAL_FRAMEWORK_PREFERENCE: readonly IntelligenceFramework[];
+/**
+ * The LATENCY-SENSITIVE preference chain — used for the `gate` category ONLY.
+ *
+ * A `gate` is a SYNCHRONOUS, action-blocking check (the user-facing
+ * `MessagingToneGate` is the canonical one — a human is waiting for their reply).
+ * The general `INTERNAL_FRAMEWORK_PREFERENCE` puts `codex-cli` first by operator
+ * directive (spread background LOAD off Claude), but codex-cli is the SLOWEST
+ * off-Claude framework (~30s, which exceeds the 20s outbound-gate review budget
+ * and times the gate out — the 2026-06-25 silent-outbound class). For a
+ * latency-sensitive gate the right default is the FASTEST available off-Claude
+ * framework, not the load-spreading order. Ranked fastest→slowest, Claude last.
+ *
+ * This does NOT override the codex-first directive for the BACKGROUND categories
+ * (`sentinel` / `reflector`) — their latency does not block a human, so they keep
+ * the load-spreading order. Only `gate` (where a user waits) goes fastest-first.
+ */
+export declare const LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE: readonly IntelligenceFramework[];
 /**
  * Compute the default `componentFrameworks` from the active-framework set.
  *
@@ -35,8 +52,12 @@ export declare const INTERNAL_FRAMEWORK_PREFERENCE: readonly IntelligenceFramewo
  *   agent, IN PREFERENCE ORDER (the caller filters `INTERNAL_FRAMEWORK_PREFERENCE`
  *   by `buildProvider(fw) !== null`). MUST already be ordered + de-duplicated.
  * @returns the effective `ComponentFrameworksConfig`:
- *   - `categories.{sentinel,gate,reflector}` = `active[0]` (first active off-Claude,
- *     or claude-code if that's all that's active)
+ *   - `categories.{sentinel,reflector}` = `active[0]` (first active off-Claude in the
+ *     codex-first load-spreading order, or claude-code if that's all that's active)
+ *   - `categories.gate` = the FASTEST active off-Claude framework
+ *     (`LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE`: pi → gemini → codex → claude) — the
+ *     gate is synchronous + user-blocking, so it prefers speed over load-spreading.
+ *     Equals `active[0]` when only one off-Claude framework is active (no-op then).
  *   - `failureSwap` = `active.slice(1)` (the ordered tail, claude-code last)
  *   - `fallback: 'default'`
  *

package/dist/core/internalFrameworkDefault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internalFrameworkDefault.d.ts","sourceRoot":"","sources":["../../src/core/internalFrameworkDefault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,qBAAqB,EAKhE,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,GACjD,yBAAyB,CAqB3B"}
+{"version":3,"file":"internalFrameworkDefault.d.ts","sourceRoot":"","sources":["../../src/core/internalFrameworkDefault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,qBAAqB,EAKhE,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAAS,qBAAqB,EAKzE,CAAC;AAUX;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,GACjD,yBAAyB,CA6B3B"}

package/dist/core/internalFrameworkDefault.js

@@ -31,6 +31,32 @@ export const INTERNAL_FRAMEWORK_PREFERENCE = [
     'gemini-cli',
     'claude-code',
 ];
+/**
+ * The LATENCY-SENSITIVE preference chain — used for the `gate` category ONLY.
+ *
+ * A `gate` is a SYNCHRONOUS, action-blocking check (the user-facing
+ * `MessagingToneGate` is the canonical one — a human is waiting for their reply).
+ * The general `INTERNAL_FRAMEWORK_PREFERENCE` puts `codex-cli` first by operator
+ * directive (spread background LOAD off Claude), but codex-cli is the SLOWEST
+ * off-Claude framework (~30s, which exceeds the 20s outbound-gate review budget
+ * and times the gate out — the 2026-06-25 silent-outbound class). For a
+ * latency-sensitive gate the right default is the FASTEST available off-Claude
+ * framework, not the load-spreading order. Ranked fastest→slowest, Claude last.
+ *
+ * This does NOT override the codex-first directive for the BACKGROUND categories
+ * (`sentinel` / `reflector`) — their latency does not block a human, so they keep
+ * the load-spreading order. Only `gate` (where a user waits) goes fastest-first.
+ */
+export const LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE = [
+    'pi-cli',
+    'gemini-cli',
+    'codex-cli',
+    'claude-code',
+];
+/** The first framework in `order` that is also present in `active`, else undefined. */
+function firstActiveIn(order, active) {
+    return order.find((fw) => active.includes(fw));
+}
 /**
  * Compute the default `componentFrameworks` from the active-framework set.
  *
@@ -38,8 +64,12 @@ export const INTERNAL_FRAMEWORK_PREFERENCE = [
  *   agent, IN PREFERENCE ORDER (the caller filters `INTERNAL_FRAMEWORK_PREFERENCE`
  *   by `buildProvider(fw) !== null`). MUST already be ordered + de-duplicated.
  * @returns the effective `ComponentFrameworksConfig`:
- *   - `categories.{sentinel,gate,reflector}` = `active[0]` (first active off-Claude,
- *     or claude-code if that's all that's active)
+ *   - `categories.{sentinel,reflector}` = `active[0]` (first active off-Claude in the
+ *     codex-first load-spreading order, or claude-code if that's all that's active)
+ *   - `categories.gate` = the FASTEST active off-Claude framework
+ *     (`LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE`: pi → gemini → codex → claude) — the
+ *     gate is synchronous + user-blocking, so it prefers speed over load-spreading.
+ *     Equals `active[0]` when only one off-Claude framework is active (no-op then).
  *   - `failureSwap` = `active.slice(1)` (the ordered tail, claude-code last)
  *   - `fallback: 'default'`
  *
@@ -58,10 +88,18 @@ export function resolveInternalFrameworkDefault(activeFrameworks) {
         return { failureSwap: [], fallback: 'default' };
     }
     const primary = active[0];
+    // The `gate` category is LATENCY-SENSITIVE: a synchronous, user-blocking check.
+    // It gets the FASTEST active off-Claude framework (pi → gemini → codex → claude),
+    // NOT the load-spreading codex-first order. `active` is in INTERNAL_FRAMEWORK_
+    // PREFERENCE order, so we re-rank it by the latency order to find the fastest.
+    // Falls back to `primary` if (somehow) no latency-ranked match — keeping the gate
+    // never worse than today. When only one off-Claude framework is active, gatePrimary
+    // === primary (byte-identical to the old behavior).
+    const gatePrimary = firstActiveIn(LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE, active) ?? primary;
     return {
         categories: {
             sentinel: primary,
-            gate: primary,
+            gate: gatePrimary,
             reflector: primary,
             // `job` and `other` are deliberately ABSENT (§4.1).
         },

package/dist/core/internalFrameworkDefault.js.map

@@ -1 +1 @@
-{"version":3,"file":"internalFrameworkDefault.js","sourceRoot":"","sources":["../../src/core/internalFrameworkDefault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,aAAa;CACL,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAAkD;IAElD,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAEhC,iFAAiF;IACjF,8EAA8E;IAC9E,kFAAkF;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO;QACL,UAAU,EAAE;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,OAAO;YAClB,oDAAoD;SACrD;QACD,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"internalFrameworkDefault.js","sourceRoot":"","sources":["../../src/core/internalFrameworkDefault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,aAAa;CACL,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAqC;IACtF,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,aAAa;CACL,CAAC;AAEX,uFAAuF;AACvF,SAAS,aAAa,CACpB,KAAuC,EACvC,MAAwC;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAAkD;IAElD,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAEhC,iFAAiF;IACjF,8EAA8E;IAC9E,kFAAkF;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,+EAA+E;IAC/E,kFAAkF;IAClF,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,aAAa,CAAC,sCAAsC,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC;IAC7F,OAAO;QACL,UAAU,EAAE;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,OAAO;YAClB,oDAAoD;SACrD;QACD,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.677",
+  "version": "1.3.678",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-26T13:12:48.410Z",
-  "instarVersion": "1.3.677",
+  "generatedAt": "2026-06-26T13:16:49.510Z",
+  "instarVersion": "1.3.678",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.677.md → 1.3.678.md}

@@ -5,6 +5,17 @@
 
 ## What Changed
 
+The provider-fallback default policy routed every internal off-Claude category
+(`sentinel`, `gate`, `reflector`) onto the same codex-first primary. But the
+`gate` category includes the **user-facing tone gate** — a synchronous check a
+human is waiting on — and `codex-cli` is the slowest off-Claude framework (~30s),
+which exceeds the 20s outbound-review budget and times the gate out (a cause of
+the 2026-06-25 silent-outbound incident). The `gate` category now resolves its
+default primary from a separate speed-ranked order (`pi → gemini → codex →
+claude`) — the fastest *active* off-Claude framework — while `sentinel`/`reflector`
+keep the codex-first load-spreading order. `failureSwap`, the gate's verdict
+logic, and the F4 degrade floor are all unchanged.
+
 The host spawn cap (the fork-bomb/OOM safety floor that bounds how many LLM
 subprocesses run at once) now reserves a little headroom for the user's reply. Under
 load, the user-facing tone gate used to wait in the same undifferentiated line as
@@ -27,6 +38,11 @@ treated as reachable), so it never cries wolf on a normal idle kill.
 
 ## What to Tell Your User
 
+Your replies' safety check now runs on the fastest available engine instead of
+the slowest, so it stops timing out under load — one fewer cause of slow or
+missing replies. Background checks are unchanged. If only one non-Claude engine is
+installed, nothing changes.
+
 When the machine is busy, your reply's safety check now jumps to a reserved slot instead
 of waiting behind background work — fewer slow/held replies under load. The crash
 protection is exactly as strong as before. Most setups see no change (it's off on the
@@ -41,6 +57,12 @@ follow-up. Off on the fleet for now.
 
 ## Summary of New Capabilities
 
+- The latency-sensitive `gate` category defaults to the fastest active off-Claude
+  framework (`LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE`), not the codex-first order.
+- `sentinel`/`reflector`/`job`/`other` routing and `failureSwap` are unchanged.
+- An explicit `categories.gate` in config always overrides the computed default.
+- Single-off-Claude-framework agents and claude-only agents: byte-identical no-op.
+
 - `attribution.lane:'interactive'` requests reserved headroom — honored ONLY for an
   allowlisted, user-blocking seam (the operator-facing tone gate); everything else stays
   background.
@@ -58,6 +80,16 @@ follow-up. Off on the fleet for now.
 
 ## Evidence
 
+- `internalFrameworkDefault.test.ts`: gate prefers fastest (pi) while sentinel
+  stays codex; pi-down→gemini (the gemini-serves-when-pi-down case); both-down→codex
+  (never worse than today); single-framework→no divergence. 17 unit tests pass.
+- `provider-fallback-default-routing.test.ts` (integration): the gate component on
+  `GET /intelligence/routing` reports the fastest active framework. 3 pass.
+- `provider-fallback-default-policy-lifecycle.test.ts` (e2e): route alive, policy
+  live. `tsc --noEmit` clean. 24 affected tests green.
+- Side-effects review: `upgrades/side-effects/latency-sensitive-gate-framework.md`.
+- Spec amendment: `docs/specs/provider-fallback-default-policy.md` §4.1.
+
 - `hostSpawnSemaphore-priority.test.ts` (10): symmetric reserve, OOM floor unconditional,
   garbage-lane→background-never-dropped, clamp (N=1/N=2/oversized/0), off=byte-identical.
 - `spawn-cap-provider-lane.test.ts` (7): allowlist downgrade (CoherenceReviewer→background),

package/upgrades/side-effects/latency-sensitive-gate-framework.md

@@ -0,0 +1,79 @@
+# Side-Effects Review — Latency-Sensitive Gate Framework Default
+
+**Version / slug:** `latency-sensitive-gate-framework`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Tier:** 1 (small, localized; one pure resolver function + its tests + docs)
+
+## Summary
+
+The provider-fallback default policy routes internal components off-Claude via a
+single codex-first preference chain (`codex-cli → pi-cli → gemini-cli →
+claude-code`). The `gate` category — which includes the **user-facing
+`MessagingToneGate`**, a synchronous check a human is waiting on — inherited that
+codex-first primary. But `codex-cli` is the SLOWEST off-Claude framework (~30s),
+which exceeds the 20s outbound-gate review budget and times the gate out (the
+2026-06-25 silent-outbound class). This change gives the `gate` category a
+SEPARATE, speed-ranked order (`LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE = pi →
+gemini → codex → claude`) so it defaults to the FASTEST active off-Claude
+framework. `sentinel`/`reflector` (background) keep codex-first; `failureSwap` and
+all other categories are unchanged.
+
+## The 8 questions
+
+1. **Over-block** — N/A. This is not a gate; it selects which backend computes the
+   tone-gate verdict. It rejects nothing.
+2. **Under-block** — N/A. The tone gate's block/allow logic and its deterministic
+   degrade floor (F4) are byte-identical; only the LLM backend that produces the
+   verdict changes. A faster backend means FEWER budget-timeout degrades, i.e.
+   *more* real verdicts, not fewer.
+3. **Level-of-abstraction fit** — Correct. The change lives in the one pure policy
+   resolver (`resolveInternalFrameworkDefault`) that already computes per-category
+   primaries; `ComponentFrameworksConfig.categories` is already a per-category map,
+   so no routing-engine change is needed. The router consumes the config unchanged.
+4. **Signal vs authority** — No authority added. The resolver is a pure function
+   (active-set → config); it holds no blocking power. The tone gate's authority
+   (hold/send) is untouched. Complies with `docs/signal-vs-authority.md`.
+5. **Interactions** — The gate's PRIMARY now differs from `sentinel`/`reflector`.
+   `failureSwap` is the shared tail (`active.slice(1)`, codex-first); for a gate
+   whose primary is `pi`, the tail may list `pi` first (the just-tried framework) —
+   harmless: the failure-swap walk is circuit-checked, so a just-failed/open
+   provider is skipped. When only one off-Claude framework is active, `gatePrimary
+   === active[0]` (byte-identical no-op). No double-fire, no shadowing.
+6. **External surfaces** — `GET /intelligence/routing` now reports the gate
+   component on a (possibly) different framework than sentinels. That is the
+   intended, visible effect. No new route, no schema change.
+7. **Multi-machine posture** — **Machine-local BY DESIGN.** The default policy is
+   computed per-agent at boot from that agent's own active-framework set (which
+   frameworks' CLIs are installed/configured on THAT machine). No replication, no
+   cross-machine coupling. Each machine independently resolves the fastest gate
+   backend it has. Correct — framework availability is inherently per-machine.
+8. **Rollback cost** — Trivial. Revert the commit (one source file + tests + one
+   doc amendment). No state, no migration. An operator who wants the gate back on
+   codex sets `categories.gate` explicitly (the explicit config always wins over
+   the computed default). A single-off-Claude-framework agent is unaffected.
+
+## What it does NOT do
+
+- Does NOT change the tone gate's verdict/hold/send logic or the F4 degrade floor.
+- Does NOT touch `sentinel`/`reflector`/`job`/`other` routing, or `failureSwap`.
+- Does NOT introduce a measured latency model — the ranking (pi < gemini < codex)
+  is a documented static assertion from observed behavior (~6s / ~9-13s / ~30s),
+  owned in `LATENCY_SENSITIVE_FRAMEWORK_PREFERENCE` with a unit-tested enum guard.
+- Does NOT revoke the codex-first operator directive — it narrows it to exclude the
+  one latency-sensitive, user-blocking category.
+
+## Second-pass note (outbound-path touch)
+
+This touches the OUTBOUND tone-gate path, which is a Phase-5 trigger area. The
+substantive review point: the change adds NO block/allow authority — it only
+selects a faster backend for an existing gate, and the gate's safety behavior
+(including the deterministic degrade floor on backend failure) is unchanged. The
+decision boundary (gate diverges to fastest; background stays codex-first; single-
+framework is a no-op) is covered by the new unit + integration tests. A full
+independent reviewer was judged unnecessary for an authority-free routing-default
+change; the PR is the review surface.
+
+## Rollback
+
+Revert the commit. No migration, no state.